@fedify/fedify 2.4.0-dev.2073 → 2.4.0-dev.2084

package/dist/{middleware-CpyCNOW_.mjs → middleware-BKeQYPm0.mjs}

@@ -1,27 +1,27 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-LYTbBhYV.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DvlvYpq_.mjs";
+import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-Beod6tzO.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
-import { d as hasPortableActor, f as isCompatibleKeyId, m as isPortableUri, o as importJwk, s as validateCryptoKey, t as exportJwk, u as getGatewayKeyBase } from "./key-BYXnTGro.mjs";
+import { d as hasPortableActor, f as isCompatibleKeyId, l as getCanonicalPortableId, m as isPortableUri, o as importJwk, s as validateCryptoKey, t as exportJwk, u as getGatewayKeyBase } from "./key-BJrp524f.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-DT3e2hOv.mjs";
-import { a as verifyObject, n as hasProofLike, o as verifyPortableObjectProof, r as signObject } from "./proof-CxsVG6vM.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-C7qHlv-b.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-C0SWQylk.mjs";
-import { n as kvCache } from "./kv-cache-DEH5jyND.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-BmFz5NLA.mjs";
+import { a as verifyObject, n as hasProofLike, o as verifyPortableObjectProof, r as signObject } from "./proof-ozG4HfcQ.mjs";
+import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-B0VRNipE.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-BUq5bYJr.mjs";
+import { n as kvCache } from "./kv-cache-C4C3LyYW.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-DpnpgjyX.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CDsVeZI7.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-BZJ7NsVV.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-CVHpPAjK.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CsKVgMzk.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-ClPt8nYu.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-BGlpUocK.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-C5NqoLBJ.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-B5Skp-vE.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-B6Aj2kGY.mjs";
 import { t as KvKeyCache } from "./keycache-BUDHB5rY.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-CLzSfIOV.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-Ba0EAZAI.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -858,13 +858,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$2.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$1.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$2),
+		kind: getCollectionMetricKind(name$1),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -905,7 +905,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$2, filterPredicate);
+						const items = filterCollectionItems(page.items, name$1, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -945,7 +945,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 		} else {
 			const uri = new URL(baseUri);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -961,7 +961,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$2, filterPredicate);
+					const items = filterCollectionItems(page.items, name$1, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -1891,8 +1891,9 @@ async function handleInboxInternal(request, parameters, span) {
 		});
 	}
 	if (!skipSignatureVerification) {
-		if (inspectCompoundPortableObjectApplicability(json, INBOX_COMPOUND_PROOF_LIMITS) !== "absent") {
-			const compoundProof = await verifyCompoundPortableObjectProofs(json, INBOX_COMPOUND_PROOF_LIMITS, {
+		const compoundJson = Array.isArray(json) ? json : jsonWithoutSig;
+		if (inspectCompoundPortableObjectApplicability(compoundJson, INBOX_COMPOUND_PROOF_LIMITS) !== "absent") {
+			const compoundProof = await verifyCompoundPortableObjectProofs(compoundJson, INBOX_COMPOUND_PROOF_LIMITS, {
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
@@ -2108,8 +2109,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$1;
+	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
+		this.name = name$2;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -2669,6 +2670,7 @@ function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, loc
 	return {
 		status: "accepted",
 		recipient: {
+			actorId: id,
 			inboxId,
 			canonicalInboxId,
 			gateways
@@ -2702,8 +2704,11 @@ function canonicalize(iri) {
 * Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
 * forwarded.
 *
-* Forwarded requests are not signed with HTTP Signatures; the receiving
-* gateways authenticate the activity by its own proof.
+* Forwarded requests are signed with HTTP Signatures by the RSA key among
+* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
+* servers requiring HTTP Signatures accept them, and are sent unsigned
+* otherwise.  Either way, the receiving gateways authenticate the activity by
+* its own proof.
 * @param parameters The parameters.
 * @returns The target inbox URLs that the activity was handed off to.
 */
@@ -2775,20 +2780,59 @@ function getForwardingTargets(recipient, excludedOrigins) {
 	}
 	return targets;
 }
-async function forwardImmediately({ activity, activityId, activityType, allowPrivateAddress, options, meterProvider, tracerProvider }, inboxes) {
+/**
+* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
+* key, as {@link sendActivity} signs requests only with such a key.  Since
+* the targets have already been claimed, the activity is forwarded unsigned
+* rather than not at all if the key cannot be resolved or used.
+*/
+async function resolveForwardingKey({ getKeys, activityId }) {
+	if (getKeys == null) return null;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	let key;
+	try {
+		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
+	} catch (error) {
+		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	if (key == null) return null;
+	try {
+		validateCryptoKey(key.privateKey, "private");
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	return key;
+}
+async function forwardImmediately(parameters, inboxes) {
+	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, options, meterProvider, tracerProvider } = parameters;
 	const logger = getLogger([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
 	const deadline = (options ?? resolvePortableInboxForwardingOptions()).deadline.total("millisecond");
-	const sends = inboxes.map((inbox) => sendActivity({
+	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
 		activity,
 		activityId: activityId.href,
 		activityType,
-		keys: [],
+		keys: key == null ? [] : [key],
 		inbox,
 		allowPrivateAddress,
+		specDeterminer,
 		meterProvider,
 		tracerProvider
 	}).catch((error) => {
@@ -2797,9 +2841,9 @@ async function forwardImmediately({ activity, activityId, activityType, allowPri
 			inbox: inbox.href,
 			error
 		});
-	}));
+	}))));
 	let timer;
-	const timedOut = await Promise.race([Promise.all(sends).then(() => false), new Promise((resolve) => {
+	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
 		timer = setTimeout(() => resolve(true), deadline);
 	})]);
 	clearTimeout(timer);
@@ -2808,12 +2852,27 @@ async function forwardImmediately({ activity, activityId, activityType, allowPri
 		deadline
 	});
 }
-async function enqueueForwarding({ activity, activityId, activityType, baseUrl, startQueue, meterProvider }, outboxQueue, inboxes) {
+async function enqueueForwarding(parameters, outboxQueue, inboxes) {
+	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
 	const logger = getLogger([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
+	const key = await resolveForwardingKey(parameters);
+	const keys = [];
+	if (key != null) try {
+		keys.push({
+			keyId: key.keyId.href,
+			privateKey: await exportJwk(key.privateKey)
+		});
+	} catch (error) {
+		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+	}
 	startQueue?.();
 	const started = (/* @__PURE__ */ new Date()).toISOString();
 	const traceContext = {};
@@ -2823,7 +2882,7 @@ async function enqueueForwarding({ activity, activityId, activityType, baseUrl,
 			type: "outbox",
 			id: crypto.randomUUID(),
 			baseUrl,
-			keys: [],
+			keys,
 			activity,
 			activityId: activityId.href,
 			activityType,
@@ -5324,6 +5383,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 						outboxQueue: this.outboxQueue,
 						startQueue: this.manuallyStartQueue ? void 0 : () => this._startQueueInternal(contextData),
 						allowPrivateAddress: this.allowPrivateAddress,
+						getKeys: () => this.#getPortableGatewayKeyPairs(context, identifier, recipient),
+						specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
 						options: this.portableInboxForwarding,
 						meterProvider: this.meterProvider,
 						tracerProvider: this.tracerProvider
@@ -5332,6 +5393,49 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}
 		});
 	}
+	/**
+	* Gets this server's gateway key pairs for the portable actor that owns
+	* a portable inbox, which sign the activities forwarded from the inbox.
+	* @param context The context.
+	* @param identifier The identifier of the portable actor.
+	* @param recipient The portable inbox.
+	* @returns The key pairs, or an empty array if the actor has no gateway
+	*          keys on this server.
+	*/
+	async #getPortableGatewayKeyPairs(context, identifier, recipient) {
+		const logger = getLogger([
+			"fedify",
+			"federation",
+			"inbox"
+		]);
+		if (this.actorCallbacks?.keyPairsDispatcher == null || this.actorCallbacks.portableActorIdMapper == null) {
+			logger.debug("Forwarding activities from the portable inbox {inbox} without HTTP Signatures, as gateway keys need both a key pairs dispatcher and a portable actor ID mapper.", { inbox: recipient.canonicalInboxId });
+			return [];
+		}
+		const actorId = getCanonicalPortableId(recipient.actorId);
+		if (actorId == null) return [];
+		const keyPairs = await context.getActorKeyPairs(identifier);
+		for (const { cryptographicKey } of keyPairs) {
+			const owner = cryptographicKey.ownerId;
+			const canonicalOwner = owner == null ? null : getCanonicalPortableId(owner);
+			if (canonicalOwner === actorId) continue;
+			if (canonicalOwner == null) logger.debug("Forwarding activities from the portable inbox {inbox} without HTTP Signatures, as the key pairs of the actor {identifier} are not the gateway keys of a portable actor.", {
+				inbox: recipient.canonicalInboxId,
+				identifier
+			});
+			else logger.warn("Forwarding activities from the portable inbox {inbox} without HTTP Signatures, as the key pairs of the actor {identifier} are the gateway keys of {owner}, not of the recipient {actorId}.", {
+				inbox: recipient.canonicalInboxId,
+				identifier,
+				owner: canonicalOwner,
+				actorId
+			});
+			return [];
+		}
+		return keyPairs.map(({ keyId, privateKey }) => ({
+			keyId,
+			privateKey
+		}));
+	}
 	async #fetchHashlinkMedia(request, media, { onNotFound, contextData, span, metricState }) {
 		metricState.endpoint = "hashlink_media";
 		metricState.routeTemplate = HASHLINK_MEDIA_ROUTE_TEMPLATE;

package/dist/{middleware-CCbyUF4c.js → middleware-D_9pNYe9.js}

@@ -2,10 +2,10 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { $ as recordCollectionPageItems, C as hasSignature, D as signJsonLd, E as isInvalidUrlTypeError, H as hasPortableActor, J as getRemoteHost, K as getDurationMs, L as importJwk, M as exportJwk, O as verifyCompactJsonLd, Q as recordCollectionDispatchDuration, R as validateCryptoKey, S as getNormalizationContextLoader, T as isClearlyMalformedContextReference, U as isCompatibleKeyId, V as getGatewayKeyBase, W as isPortableUri, X as isAbortError, Y as instrumentDocumentLoader, Z as recordCircuitBreakerStateChange, _ as assertSafeJsonLd, a as verifyRequestDetailed, at as recordOutboxActivity, c as hasProofLike, ct as registerQueueDepthGauge, d as verifyObject, et as recordCollectionRequest, f as verifyPortableObjectProof, g as InvalidContextReferenceError, ht as version, i as verifyRequest, it as recordInboxActivity, j as wrapContextLoaderForJsonLd, l as signObject, lt as normalizeOutgoingActivityJsonLd, mt as name, n as parseRfc9421SignatureInput, ot as recordOutboxEnqueue, p as verifyPortableObjectProofPolicy, q as getFederationMetrics, rt as recordFanoutRecipients, st as recordWebFingerHandle, t as doubleKnock, tt as recordCollectionTotalItems, u as verifyMapLocalProof, ut as formatAcceptSignature, w as hasSignatureLike, x as detachSignature, y as compactJsonLd } from "./http-vfTpzGEq.js";
+import { $ as recordCollectionPageItems, B as getCanonicalPortableId, C as hasSignature, D as signJsonLd, E as isInvalidUrlTypeError, H as hasPortableActor, J as getRemoteHost, K as getDurationMs, L as importJwk, M as exportJwk, O as verifyCompactJsonLd, Q as recordCollectionDispatchDuration, R as validateCryptoKey, S as getNormalizationContextLoader, T as isClearlyMalformedContextReference, U as isCompatibleKeyId, V as getGatewayKeyBase, W as isPortableUri, X as isAbortError, Y as instrumentDocumentLoader, Z as recordCircuitBreakerStateChange, _ as assertSafeJsonLd, a as verifyRequestDetailed, at as recordOutboxActivity, c as hasProofLike, ct as registerQueueDepthGauge, d as verifyObject, et as recordCollectionRequest, f as verifyPortableObjectProof, g as InvalidContextReferenceError, ht as version, i as verifyRequest, it as recordInboxActivity, j as wrapContextLoaderForJsonLd, l as signObject, lt as normalizeOutgoingActivityJsonLd, mt as name, n as parseRfc9421SignatureInput, ot as recordOutboxEnqueue, p as verifyPortableObjectProofPolicy, q as getFederationMetrics, rt as recordFanoutRecipients, st as recordWebFingerHandle, t as doubleKnock, tt as recordCollectionTotalItems, u as verifyMapLocalProof, ut as formatAcceptSignature, w as hasSignatureLike, x as detachSignature, y as compactJsonLd } from "./http-4PCCvhsU.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-DfGz0cXm.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DCJuwdnB.js";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-_pbbgLJK.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-1KUmAPH7.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -2633,13 +2633,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$2.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$1.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$2),
+		kind: getCollectionMetricKind(name$1),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -2680,7 +2680,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$2, filterPredicate);
+						const items = filterCollectionItems(page.items, name$1, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -2720,7 +2720,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 		} else {
 			const uri = new URL(baseUri);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -2736,7 +2736,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$2, filterPredicate);
+					const items = filterCollectionItems(page.items, name$1, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -3666,8 +3666,9 @@ async function handleInboxInternal(request, parameters, span) {
 		});
 	}
 	if (!skipSignatureVerification) {
-		if (inspectCompoundPortableObjectApplicability(json, INBOX_COMPOUND_PROOF_LIMITS) !== "absent") {
-			const compoundProof = await verifyCompoundPortableObjectProofs(json, INBOX_COMPOUND_PROOF_LIMITS, {
+		const compoundJson = Array.isArray(json) ? json : jsonWithoutSig;
+		if (inspectCompoundPortableObjectApplicability(compoundJson, INBOX_COMPOUND_PROOF_LIMITS) !== "absent") {
+			const compoundProof = await verifyCompoundPortableObjectProofs(compoundJson, INBOX_COMPOUND_PROOF_LIMITS, {
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
@@ -3883,8 +3884,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$1;
+	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
+		this.name = name$2;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -4964,6 +4965,7 @@ function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, loc
 	return {
 		status: "accepted",
 		recipient: {
+			actorId: id,
 			inboxId,
 			canonicalInboxId,
 			gateways
@@ -4997,8 +4999,11 @@ function canonicalize(iri) {
 * Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
 * forwarded.
 *
-* Forwarded requests are not signed with HTTP Signatures; the receiving
-* gateways authenticate the activity by its own proof.
+* Forwarded requests are signed with HTTP Signatures by the RSA key among
+* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
+* servers requiring HTTP Signatures accept them, and are sent unsigned
+* otherwise.  Either way, the receiving gateways authenticate the activity by
+* its own proof.
 * @param parameters The parameters.
 * @returns The target inbox URLs that the activity was handed off to.
 */
@@ -5070,20 +5075,59 @@ function getForwardingTargets(recipient, excludedOrigins) {
 	}
 	return targets;
 }
-async function forwardImmediately({ activity, activityId, activityType, allowPrivateAddress, options, meterProvider, tracerProvider }, inboxes) {
+/**
+* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
+* key, as {@link sendActivity} signs requests only with such a key.  Since
+* the targets have already been claimed, the activity is forwarded unsigned
+* rather than not at all if the key cannot be resolved or used.
+*/
+async function resolveForwardingKey({ getKeys, activityId }) {
+	if (getKeys == null) return null;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	let key;
+	try {
+		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
+	} catch (error) {
+		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	if (key == null) return null;
+	try {
+		validateCryptoKey(key.privateKey, "private");
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	return key;
+}
+async function forwardImmediately(parameters, inboxes) {
+	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, options, meterProvider, tracerProvider } = parameters;
 	const logger = getLogger([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
 	const deadline = (options ?? resolvePortableInboxForwardingOptions()).deadline.total("millisecond");
-	const sends = inboxes.map((inbox) => sendActivity({
+	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
 		activity,
 		activityId: activityId.href,
 		activityType,
-		keys: [],
+		keys: key == null ? [] : [key],
 		inbox,
 		allowPrivateAddress,
+		specDeterminer,
 		meterProvider,
 		tracerProvider
 	}).catch((error) => {
@@ -5092,9 +5136,9 @@ async function forwardImmediately({ activity, activityId, activityType, allowPri
 			inbox: inbox.href,
 			error
 		});
-	}));
+	}))));
 	let timer;
-	const timedOut = await Promise.race([Promise.all(sends).then(() => false), new Promise((resolve) => {
+	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
 		timer = setTimeout(() => resolve(true), deadline);
 	})]);
 	clearTimeout(timer);
@@ -5103,12 +5147,27 @@ async function forwardImmediately({ activity, activityId, activityType, allowPri
 		deadline
 	});
 }
-async function enqueueForwarding({ activity, activityId, activityType, baseUrl, startQueue, meterProvider }, outboxQueue, inboxes) {
+async function enqueueForwarding(parameters, outboxQueue, inboxes) {
+	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
 	const logger = getLogger([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
+	const key = await resolveForwardingKey(parameters);
+	const keys = [];
+	if (key != null) try {
+		keys.push({
+			keyId: key.keyId.href,
+			privateKey: await exportJwk(key.privateKey)
+		});
+	} catch (error) {
+		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+	}
 	startQueue?.();
 	const started = (/* @__PURE__ */ new Date()).toISOString();
 	const traceContext = {};
@@ -5118,7 +5177,7 @@ async function enqueueForwarding({ activity, activityId, activityType, baseUrl,
 			type: "outbox",
 			id: crypto.randomUUID(),
 			baseUrl,
-			keys: [],
+			keys,
 			activity,
 			activityId: activityId.href,
 			activityType,
@@ -7798,6 +7857,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 						outboxQueue: this.outboxQueue,
 						startQueue: this.manuallyStartQueue ? void 0 : () => this._startQueueInternal(contextData),
 						allowPrivateAddress: this.allowPrivateAddress,
+						getKeys: () => this.#getPortableGatewayKeyPairs(context, identifier, recipient),
+						specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
 						options: this.portableInboxForwarding,
 						meterProvider: this.meterProvider,
 						tracerProvider: this.tracerProvider
@@ -7806,6 +7867,49 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}
 		});
 	}
+	/**
+	* Gets this server's gateway key pairs for the portable actor that owns
+	* a portable inbox, which sign the activities forwarded from the inbox.
+	* @param context The context.
+	* @param identifier The identifier of the portable actor.
+	* @param recipient The portable inbox.
+	* @returns The key pairs, or an empty array if the actor has no gateway
+	*          keys on this server.
+	*/
+	async #getPortableGatewayKeyPairs(context, identifier, recipient) {
+		const logger = getLogger([
+			"fedify",
+			"federation",
+			"inbox"
+		]);
+		if (this.actorCallbacks?.keyPairsDispatcher == null || this.actorCallbacks.portableActorIdMapper == null) {
+			logger.debug("Forwarding activities from the portable inbox {inbox} without HTTP Signatures, as gateway keys need both a key pairs dispatcher and a portable actor ID mapper.", { inbox: recipient.canonicalInboxId });
+			return [];
+		}
+		const actorId = getCanonicalPortableId(recipient.actorId);
+		if (actorId == null) return [];
+		const keyPairs = await context.getActorKeyPairs(identifier);
+		for (const { cryptographicKey } of keyPairs) {
+			const owner = cryptographicKey.ownerId;
+			const canonicalOwner = owner == null ? null : getCanonicalPortableId(owner);
+			if (canonicalOwner === actorId) continue;
+			if (canonicalOwner == null) logger.debug("Forwarding activities from the portable inbox {inbox} without HTTP Signatures, as the key pairs of the actor {identifier} are not the gateway keys of a portable actor.", {
+				inbox: recipient.canonicalInboxId,
+				identifier
+			});
+			else logger.warn("Forwarding activities from the portable inbox {inbox} without HTTP Signatures, as the key pairs of the actor {identifier} are the gateway keys of {owner}, not of the recipient {actorId}.", {
+				inbox: recipient.canonicalInboxId,
+				identifier,
+				owner: canonicalOwner,
+				actorId
+			});
+			return [];
+		}
+		return keyPairs.map(({ keyId, privateKey }) => ({
+			keyId,
+			privateKey
+		}));
+	}
 	async #fetchHashlinkMedia(request, media, { onNotFound, contextData, span, metricState }) {
 		metricState.endpoint = "hashlink_media";
 		metricState.routeTemplate = HASHLINK_MEDIA_ROUTE_TEMPLATE;

package/dist/mod.cjs

@@ -3,14 +3,14 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-DGk8XI38.cjs");
-const require_federation = require("./federation-B1aeTKKN.cjs");
+const require_http = require("./http-B5q1CHtL.cjs");
+const require_federation = require("./federation-BLGx8JUH.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-DCIH7Iq0.cjs");
-const require_kv_cache = require("./kv-cache-DvqkKNIj.cjs");
+const require_owner = require("./owner-BQFZtFV4.cjs");
+const require_kv_cache = require("./kv-cache-Dhhhrryv.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");
-const require_sig = require("./sig-C6TnADze.cjs");
+const require_sig = require("./sig-k3C8sF7g.cjs");
 require("./utils/mod.cjs");
 //#endregion
 exports.CircuitBreaker = require_federation.CircuitBreaker;

package/dist/mod.js

@@ -3,15 +3,15 @@ import { URLPattern } from "urlpattern-polyfill";
 import "./rolldown-runtime-BC-Eo5Mj.js";
 import { n as autoIdAssigner, r as getDefaultActivityTransformers, t as actorDehydrator } from "./transformers-DAtXl_Kc.js";
 import "./compat/mod.js";
-import { A as verifySignature, D as signJsonLd, F as fetchKeyDetailed, I as generateCryptoKeyPair, L as importJwk, M as exportJwk, P as fetchKey, a as verifyRequestDetailed, b as createSignature, c as hasProofLike, d as verifyObject, dt as fulfillAcceptSignature, f as verifyPortableObjectProof, ft as parseAcceptSignature, h as verifyProof, i as verifyRequest, k as verifyJsonLd, l as signObject, pt as validateAcceptSignature, r as signRequest, s as createProof, ut as formatAcceptSignature, v as attachSignature, w as hasSignatureLike, x as detachSignature } from "./http-vfTpzGEq.js";
-import { a as respondWithObject, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as SendActivityError, l as CircuitBreaker, n as handleWebFinger, o as respondWithObjectIfAcceptable, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-CCbyUF4c.js";
+import { A as verifySignature, D as signJsonLd, F as fetchKeyDetailed, I as generateCryptoKeyPair, L as importJwk, M as exportJwk, P as fetchKey, a as verifyRequestDetailed, b as createSignature, c as hasProofLike, d as verifyObject, dt as fulfillAcceptSignature, f as verifyPortableObjectProof, ft as parseAcceptSignature, h as verifyProof, i as verifyRequest, k as verifyJsonLd, l as signObject, pt as validateAcceptSignature, r as signRequest, s as createProof, ut as formatAcceptSignature, v as attachSignature, w as hasSignatureLike, x as detachSignature } from "./http-4PCCvhsU.js";
+import { a as respondWithObject, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as SendActivityError, l as CircuitBreaker, n as handleWebFinger, o as respondWithObjectIfAcceptable, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-D_9pNYe9.js";
 import { n as getNodeInfo, r as parseNodeInfo, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-DfGz0cXm.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DCJuwdnB.js";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-_pbbgLJK.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-1KUmAPH7.js";
 import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue, Router, RouterError } from "./federation/mod.js";
 import "./nodeinfo/mod.js";
 import "./runtime/mod.js";
-import { t as verifyPortableObject } from "./sig-Cs9_ecdh.js";
+import { t as verifyPortableObject } from "./sig-DhdomAN0.js";
 import "./utils/mod.js";
 export * from "@fedify/vocab-runtime";
 //#endregion

package/dist/nodeinfo/handler.test.mjs

@@ -5,7 +5,7 @@ import { r as createRequestContext } from "../context-DlZhxdFT.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { S as handleNodeInfoJrd, o as createFederation, x as handleNodeInfo } from "../middleware-CpyCNOW_.mjs";
+import { S as handleNodeInfoJrd, o as createFederation, x as handleNodeInfo } from "../middleware-BKeQYPm0.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/handler.test.ts
 test("handleNodeInfo()", async () => {

package/dist/{owner-DCIH7Iq0.cjs → owner-BQFZtFV4.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-DGk8XI38.cjs");
+const require_http = require("./http-B5q1CHtL.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");

package/dist/{owner-CDsVeZI7.mjs → owner-CsKVgMzk.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-LYTbBhYV.mjs";
-import { c as verifyKeyOwnership, f as isCompatibleKeyId, h as isSamePublicKey$1, l as getCanonicalPortableId, n as fetchActorDocument, t as exportJwk } from "./key-BYXnTGro.mjs";
-import { t as fetchPortableGatewayKey } from "./portable-key-DCyKGCQd.mjs";
+import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
+import { c as verifyKeyOwnership, f as isCompatibleKeyId, h as isSamePublicKey$1, l as getCanonicalPortableId, n as fetchActorDocument, t as exportJwk } from "./key-BJrp524f.mjs";
+import { t as fetchPortableGatewayKey } from "./portable-key-B4R-CiIV.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";