@fedify/fedify 2.4.0-dev.2077 → 2.4.0-dev.2093

package/dist/{federation-CFd0Jhhv.cjs → federation-aSHO04ob.cjs}

@@ -1,16 +1,17 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-Dvy_IwRa.cjs");
+const require_http = require("./http-DSaSAN7X.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-BpOxL5PG.cjs");
-const require_kv_cache = require("./kv-cache-BP69NV0P.cjs");
+const require_owner = require("./owner-szIZl4qI.cjs");
+const require_kv_cache = require("./kv-cache-BSJAlP4C.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
-let byte_encodings_hex = require("byte-encodings/hex");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
+let _fedify_vocab_runtime_internal_portable_dereference = require("@fedify/vocab-runtime/internal/portable-dereference");
+let byte_encodings_hex = require("byte-encodings/hex");
 let _fedify_vocab_runtime_jsonld = require("@fedify/vocab-runtime/jsonld");
 _fedify_vocab_runtime_jsonld = require_rolldown_runtime.__toESM(_fedify_vocab_runtime_jsonld, 1);
 let es_toolkit = require("es-toolkit");
@@ -205,10 +206,11 @@ var FederationBuilderImpl = class {
 				"federation",
 				"actor"
 			]);
-			const portable = actor.id?.protocol === "ap:" || actor.id?.protocol === "ap+ef61:";
+			const portable = actor.id != null && require_http.isPortableId(actor.id);
 			if (actor.id == null) logger.warn("Actor dispatcher returned an actor without an id property.  Set the property with Context.getActorUri(identifier).");
 			else if (!portable && actor.id.href != context.getActorUri(identifier).href) logger.warn("Actor dispatcher returned an actor with an id property that does not match the actor URI.  Set the property with Context.getActorUri(identifier).");
 			if (actor instanceof _fedify_vocab.Tombstone) return actor;
+			if (actor.id != null && (0, _fedify_vocab_runtime_internal_portable_dereference.isCompatibleEf61Iri)(actor.id)) warnCompatibleActorId(actor.id, actor.gateway);
 			if (this.followingCallbacks != null && this.followingCallbacks.dispatcher != null) {
 				if (actor.followingId == null) logger.warn("You configured a following collection dispatcher, but the actor does not have a following property.  Set the property with Context.getFollowingUri(identifier).");
 				else if (!portable && actor.followingId.href != context.getFollowingUri(identifier).href) logger.warn("You configured a following collection dispatcher, but the actor's following property does not match the following collection URI.  Set the property with Context.getFollowingUri(identifier).");
@@ -733,6 +735,33 @@ var FederationBuilderImpl = class {
 function createFederationBuilder() {
 	return new FederationBuilderImpl();
 }
+/**
+* Warns about an FEP-ef61 portable actor identified by a compatible identifier
+* that is malformed, or is not on the actor's first gateway, where FEP-ef61
+* requires publishers to construct compatible identifiers.
+*/
+function warnCompatibleActorId(actorId, gateway) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"actor"
+	]);
+	try {
+		(0, _fedify_vocab_runtime.fromCompatibleEf61Id)(actorId);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.warn("Actor dispatcher returned an actor whose id property, {actorId}, is a malformed FEP-ef61 compatible identifier: {error}", {
+			actorId: actorId.href,
+			error
+		});
+		return;
+	}
+	if (gateway == null || !(0, _fedify_vocab_runtime.isGatewayUrl)(gateway)) logger.warn("Actor dispatcher returned an actor whose id property, {actorId}, is an FEP-ef61 compatible identifier, but whose first gateway is not an HTTP(S) origin.  Set the gateways property, and construct the compatible identifier with its first gateway.", { actorId: actorId.href });
+	else if (actorId.origin !== gateway.origin) logger.warn("Actor dispatcher returned an actor whose id property, {actorId}, is an FEP-ef61 compatible identifier on another gateway than its first gateway, {gateway}.  FEP-ef61 requires publishers to construct compatible identifiers with the first gateway in the actor's gateways.", {
+		actorId: actorId.href,
+		gateway: gateway.origin
+	});
+}
 //#endregion
 //#region src/federation/circuit-breaker.ts
 const Temporal$11 = require_http.Temporal;
@@ -1310,7 +1339,14 @@ async function buildCollectionSynchronizationHeader(collectionId, actorIds) {
 //#endregion
 //#region src/sig/compound-proof.ts
 const textEncoder = new TextEncoder();
-const PORTABLE_OBJECT_ID_PATTERN = /^ap(?:\+ef61)?:\/\//i;
+/**
+* Checks whether a literal `id` or `@id` value makes a map a portable object:
+* an `ap:` or `ap+ef61:` URI, or anything that looks like an FEP-ef61
+* compatible identifier, even a malformed one, which then fails the policy.
+*/
+function isPortableIdValue(value) {
+	return typeof value === "string" && require_http.isPortableId(value);
+}
 function isJsonMap(value) {
 	return typeof value === "object" && value != null && !Array.isArray(value);
 }
@@ -1556,18 +1592,20 @@ function collectPortableObjects(snapshot) {
 			for (let index = current.value.length - 1; index >= 0; index--) pending.push({
 				value: current.value[index],
 				path: childPath(current.path, String(index)),
-				depth: current.depth + 1
+				depth: current.depth + 1,
+				keyOf: current.keyOf
 			});
 			continue;
 		}
 		if (!isCompoundProofJsonObject(current.value)) continue;
 		const document = current.value;
-		const id = [document.id, document["@id"]].find((value) => typeof value === "string" && PORTABLE_OBJECT_ID_PATTERN.test(value));
+		const id = [document.id, document["@id"]].find(isPortableIdValue);
 		if (typeof id === "string") objects.push(Object.freeze({
 			path: current.path,
 			id,
 			depth: current.depth,
-			document
+			document,
+			...current.keyOf == null ? {} : { keyOf: current.keyOf }
 		}));
 		const entries = Object.entries(document).sort(([left], [right]) => comparePaths(left, right));
 		for (let index = entries.length - 1; index >= 0; index--) {
@@ -1576,7 +1614,11 @@ function collectPortableObjects(snapshot) {
 			pending.push({
 				value,
 				path: childPath(current.path, key),
-				depth: current.depth + 1
+				depth: current.depth + 1,
+				...typeof id === "string" && (key === "publicKey" || key === "assertionMethod") ? { keyOf: {
+					path: current.path,
+					member: key
+				} } : {}
 			});
 		}
 	}
@@ -1584,8 +1626,9 @@ function collectPortableObjects(snapshot) {
 	return objects;
 }
 /**
-* Determines whether a received JSON tree contains a portable object ID
-* outside a proof or context definition, without exceeding discovery limits.
+* Determines whether a received JSON tree contains a portable object ID, i.e.,
+* an `ap:` or `ap+ef61:` URI or an FEP-ef61 compatible identifier, outside
+* a proof or context definition, without exceeding discovery limits.
 *
 * This is only an applicability check.  It does not authenticate the input;
 * callers must still use {@link verifyCompoundPortableObjectProofs} to obtain
@@ -1632,7 +1675,7 @@ function inspectCompoundPortableObjectApplicability(json, limits) {
 		} else if (isJsonMap(value)) {
 			mapCount++;
 			if (mapCount > limits.maxMaps) return "indeterminate";
-			if ([value.id, value["@id"]].some((id) => typeof id === "string" && PORTABLE_OBJECT_ID_PATTERN.test(id))) return "present";
+			if ([value.id, value["@id"]].some(isPortableIdValue)) return "present";
 			if (!addByteLength(2)) return "indeterminate";
 			const children = function* () {
 				let first = true;
@@ -1695,7 +1738,8 @@ function findInJsonMaps(json, visit) {
 /**
 * Determines whether an outgoing JSON tree contains portable content that
 * requires producer-side proof-shape checks: a map, outside proof and context
-* values, whose direct `id` or `@id` is a portable ActivityPub URI.
+* values, whose direct `id` or `@id` is a portable ActivityPub URI or an
+* FEP-ef61 compatible identifier.
 *
 * This deliberately differs from
 * {@link inspectCompoundPortableObjectApplicability}: it applies no resource
@@ -1708,7 +1752,7 @@ function findInJsonMaps(json, visit) {
 * @internal
 */
 function containsCompoundPortableObject(json) {
-	return findInJsonMaps(json, (map) => [map.id, map["@id"]].some((id) => typeof id === "string" && PORTABLE_OBJECT_ID_PATTERN.test(id)) ? true : void 0) ?? false;
+	return findInJsonMaps(json, (map) => [map.id, map["@id"]].some(isPortableIdValue) ? true : void 0) ?? false;
 }
 /**
 * Finds the first direct `proof` member whose value the map-local
@@ -1805,7 +1849,7 @@ async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 	if (discovered.status !== "ok") return discovered;
 	const proofs = await verifyDiscoveredProofDocuments(discovered, options);
 	const proofByPath = new Map(proofs.map((proof) => [proof.path, proof]));
-	const portableObjects = await Promise.all(collectPortableObjects(discovered.snapshot).map(async (object) => {
+	const verifyPortableObject = async (object) => {
 		const metadata = {
 			path: object.path,
 			id: object.id,
@@ -1837,16 +1881,174 @@ async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 				reason: { type: "invalidPortableObject" }
 			});
 		}
+	};
+	const collected = collectPortableObjects(discovered.snapshot);
+	const objectByPath = new Map(collected.map((object) => [object.path, object]));
+	const isKeyCandidate = (object) => object.keyOf != null && !Object.hasOwn(object.document, "proof");
+	const results = /* @__PURE__ */ new Map();
+	for (const result of await Promise.all(collected.filter((object) => !isKeyCandidate(object)).map(verifyPortableObject))) results.set(result.path, result);
+	let projections = 0;
+	for (const object of collected) {
+		if (!isKeyCandidate(object)) continue;
+		const { path, member } = object.keyOf;
+		const parent = results.get(path);
+		const parentObject = objectByPath.get(path);
+		if (parent?.verified === true && parentObject != null && projections++ < MAX_KEY_PROJECTIONS && await isEmbeddedPortableKey(parentObject.document, member, object.document, parent.id)) continue;
+		results.set(object.path, await verifyPortableObject(object));
+	}
+	const portableObjects = Object.freeze(collected.flatMap((object) => {
+		const result = results.get(object.path);
+		return result == null ? [] : [result];
 	}));
 	return {
 		status: "ok",
 		verified: portableObjects.length > 0 && proofs.every((proof) => proof.verified) && portableObjects.every((object) => object.verified),
 		snapshot: discovered.snapshot,
 		proofs,
-		portableObjects: Object.freeze(portableObjects),
+		portableObjects,
 		statistics: discovered.statistics
 	};
 }
+/**
+* The maximum number of embedded keys per compound document that are checked
+* by {@link isEmbeddedPortableKey}, each of which expands a projection of its
+* parent.  Keys beyond it have to carry their own proofs.
+*/
+const MAX_KEY_PROJECTIONS = 64;
+const SECURITY = "https://w3id.org/security#";
+const KEY_TYPES = /* @__PURE__ */ new Set([`${SECURITY}Key`, `${SECURITY}Multikey`]);
+const KEY_PROPERTIES = /* @__PURE__ */ new Set([
+	"@id",
+	"@type",
+	`${SECURITY}owner`,
+	`${SECURITY}controller`,
+	`${SECURITY}publicKeyPem`,
+	`${SECURITY}publicKeyMultibase`
+]);
+/**
+* Tells whether an unsigned map embedded in a verified portable map is just
+* a key of the portable object the parent is, e.g., a gateway key of
+* a portable actor, which the parent's proof covers.
+*
+* The key's meaning depends on the contexts active where it sits, so it is
+* decided on a projection of the parent that keeps only what those contexts
+* depend on: the parent's `@context`, its types and ID, and the member that
+* holds the key.  That holds only if nothing else in the parent can change
+* them, so both documents may only use contexts that define no keyword
+* aliases and no scoped contexts; Fedify's preloaded contexts, the only
+* remote ones the compound policy loads, alias just `id` and `type`.
+*
+* The projection must expand to the parent's verified ID with the key as the
+* single value of `publicKey` or `assertionMethod`, and the key must be
+* nothing but a `CryptographicKey` or `Multikey` whose ID is a compatible
+* identifier of the parent plus a fragment, and whose owner or controller,
+* if any, is the parent.
+*/
+async function isEmbeddedPortableKey(parent, member, key, parentId) {
+	const parentPortableId = getCanonicalPortableIdOf(parentId);
+	if (parentPortableId == null) return false;
+	if (!isSimpleContext(parent["@context"]) || Object.hasOwn(key, "@context") && !isSimpleContext(key["@context"])) return false;
+	const literalIds = [key.id, key["@id"]].filter((id) => id !== void 0);
+	if (literalIds.length < 1 || literalIds.some((id) => id !== literalIds[0]) || typeof literalIds[0] !== "string" || !isKeyIdOf(literalIds[0], parentPortableId)) return false;
+	const projection = {};
+	for (const property of [
+		"@context",
+		"type",
+		"@type",
+		"id",
+		"@id"
+	]) if (Object.hasOwn(parent, property)) projection[property] = parent[property];
+	projection[member] = key;
+	let expanded;
+	try {
+		expanded = await _fedify_vocab_runtime_jsonld.default.expand(structuredClone(projection), {
+			documentLoader: require_http.getNormalizationContextLoader(require_http.preloadedOnlyDocumentLoader),
+			keepFreeFloatingNodes: true
+		});
+	} catch {
+		return false;
+	}
+	if (expanded.length !== 1 || hasGraphKeyword(expanded)) return false;
+	const node = expanded[0];
+	if (!isJsonMap(node) || typeof node["@id"] !== "string" || getCanonicalPortableIdOf(node["@id"]) !== parentPortableId) return false;
+	const properties = Object.keys(node).filter((property) => property !== "@id" && property !== "@type");
+	if (properties.length !== 1 || properties[0] !== `${SECURITY}${member}`) return false;
+	const values = node[properties[0]];
+	if (!Array.isArray(values) || values.length !== 1) return false;
+	const expandedKey = values[0];
+	if (!isJsonMap(expandedKey) || expandedKey["@id"] !== literalIds[0] || Object.keys(expandedKey).some((property) => !KEY_PROPERTIES.has(property))) return false;
+	const types = expandedKey["@type"];
+	if (types !== void 0 && (!Array.isArray(types) || types.some((type) => typeof type !== "string" || !KEY_TYPES.has(type)))) return false;
+	const pem = expandedKey[`${SECURITY}publicKeyPem`];
+	const multibase = expandedKey[`${SECURITY}publicKeyMultibase`];
+	if (pem === void 0 && multibase === void 0) return false;
+	if (pem !== void 0 && !isSingleStringValue(pem)) return false;
+	if (multibase !== void 0 && !isSingleStringValue(multibase, `${SECURITY}multibase`)) return false;
+	for (const property of [`${SECURITY}owner`, `${SECURITY}controller`]) {
+		const owners = expandedKey[property];
+		if (owners === void 0) continue;
+		if (!Array.isArray(owners) || owners.length !== 1 || !isJsonMap(owners[0]) || Object.keys(owners[0]).length !== 1 || typeof owners[0]["@id"] !== "string" || getCanonicalPortableIdOf(owners[0]["@id"]) !== parentPortableId) return false;
+	}
+	return true;
+}
+function getCanonicalPortableIdOf(id) {
+	try {
+		return require_http.getCanonicalPortableId((0, _fedify_vocab_runtime.parseIri)(id));
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Checks whether an ID is a compatible identifier of the given portable
+* object plus a fragment.
+*/
+function isKeyIdOf(id, portableId) {
+	let url;
+	try {
+		if ((0, _fedify_vocab_runtime.fromCompatibleEf61Id)(id) == null) return false;
+		url = new URL(id);
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+	if (url.hash.length < 2) return false;
+	url.hash = "";
+	return require_http.getCanonicalPortableId(url) === portableId;
+}
+/**
+* Checks whether a `@context` value defines no keyword aliases and no scoped
+* contexts: only references to contexts and term definitions that map terms
+* to IRIs, optionally with an `@id` or `@vocab` type coercion or a datatype.
+*/
+function isSimpleContext(context) {
+	if (typeof context === "string") return true;
+	if (Array.isArray(context)) return context.every(isSimpleContext);
+	if (context === void 0 || !isCompoundProofJsonObject(context)) return false;
+	return Object.entries(context).every(([term, definition]) => {
+		if (term.startsWith("@")) return false;
+		if (typeof definition === "string") return !definition.startsWith("@");
+		if (!isCompoundProofJsonObject(definition)) return false;
+		const { "@id": id, "@type": type, ...rest } = definition;
+		return Object.keys(rest).length < 1 && typeof id === "string" && !id.startsWith("@") && (type === void 0 || type === "@id" || type === "@vocab" || typeof type === "string" && !type.startsWith("@"));
+	});
+}
+function hasGraphKeyword(value) {
+	if (Array.isArray(value)) return value.some(hasGraphKeyword);
+	if (!isJsonMap(value)) return false;
+	return Object.entries(value).some(([key, child]) => key === "@graph" || key === "@included" || key === "@reverse" || hasGraphKeyword(child));
+}
+/**
+* Checks whether expanded values are a single plain string, optionally with
+* the given datatype.
+*/
+function isSingleStringValue(values, datatype) {
+	if (!Array.isArray(values) || values.length !== 1) return false;
+	const value = values[0];
+	if (!isJsonMap(value) || typeof value["@value"] !== "string") return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 || datatype != null && keys.length === 2 && value["@type"] === datatype;
+}
 //#endregion
 //#region src/federation/inbox.ts
 const Temporal$10 = require_http.Temporal;
@@ -2569,14 +2771,7 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 	} });
 }
 function isRequestedPortableObject(object, canonicalId) {
-	if (object.id == null) return false;
-	if (object.id.protocol !== "ap:" && object.id.protocol !== "ap+ef61:") return false;
-	try {
-		return (0, _fedify_vocab_runtime.canonicalizePortableUri)((0, _fedify_vocab_runtime.formatIri)(object.id)) === canonicalId;
-	} catch (error) {
-		if (error instanceof TypeError) return false;
-		throw error;
-	}
+	return object.id != null && require_http.getCanonicalPortableId(object.id) === canonicalId;
 }
 async function getJsonLdRootId(jsonLd, contextLoader) {
 	const expanded = await _fedify_vocab_runtime_jsonld.default.expand(jsonLd, {
@@ -2588,6 +2783,7 @@ async function getJsonLdRootId(jsonLd, contextLoader) {
 	return typeof id === "string" ? id : null;
 }
 function isRequestedPortableId(id, canonicalId) {
+	if (!/^ap(?:\+ef61)?:\/\//i.test(id)) return URL.canParse(id) && require_http.getCanonicalPortableId(new URL(id)) === canonicalId;
 	try {
 		return (0, _fedify_vocab_runtime.canonicalizePortableUri)(id) === canonicalId;
 	} catch (error) {
@@ -3450,7 +3646,7 @@ async function handleInboxInternal(request, parameters, span) {
 			return await respondInvalidActivity(error);
 		}
 		activityVerified = true;
-		if (!skipSignatureVerification && require_http.hasPortableActor(activity)) try {
+		if (!skipSignatureVerification && isPortableActivity(activity)) try {
 			proofVerified = await require_http.verifyObject(_fedify_vocab.Activity, jsonWithoutSig, {
 				contextLoader: require_http.wrapContextLoaderForJsonLd(ctx.contextLoader),
 				documentLoader: ctx.documentLoader,
@@ -3634,7 +3830,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
-	if (!skipSignatureVerification && !proofVerified && (require_http.hasPortableActor(activity) || isPortableGatewayKey(httpSigKey))) {
+	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableGatewayKey(httpSigKey))) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
 			activity: json,
@@ -3652,6 +3848,32 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	if (!skipSignatureVerification && activity.id != null && require_http.isPortableId(activity.id)) {
+		const rejection = await verifyPortableActivityId(activity.id, jsonWithoutSig, {
+			contextLoader: require_http.wrapContextLoaderForJsonLd(ctx.contextLoader),
+			documentLoader: ctx.documentLoader,
+			keyCache,
+			meterProvider,
+			tracerProvider
+		});
+		if (rejection != null) {
+			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+			logger.error("The portable activity {activityId} is not authenticated by an Object Integrity Proof of its own DID: {reason}", {
+				activity: json,
+				recipient,
+				activityId: activity.id.href,
+				reason: rejection
+			});
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: `The portable activity (${activity.id.href}) is not authenticated by an Object Integrity Proof of its own DID.`
+			});
+			return new Response("Portable activities must have valid Object Integrity Proofs made by their own DIDs.", {
+				status: 401,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+	}
 	if (httpSigKey != null && !await require_owner.doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		require_http.getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("actorKeyMismatch", httpSigKey.id == null ? void 0 : require_http.getRemoteHost(httpSigKey.id));
@@ -4381,7 +4603,41 @@ const MIN_COMPONENTS = [
 * establish.
 */
 function isPortableGatewayKey(key) {
-	return key?.id != null && require_http.isCompatibleKeyId(key.id) && key.ownerId != null && require_http.isPortableUri(key.ownerId);
+	return key?.id != null && require_http.isCompatibleKeyId(key.id) && key.ownerId != null && require_http.isPortableId(key.ownerId);
+}
+/**
+* Checks whether an activity needs an Object Integrity Proof by its DID:
+* either it is performed by an [FEP-ef61] portable actor, or its own ID is
+* portable.  Both `ap:` URIs and compatible identifiers count as portable.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*/
+function isPortableActivity(activity) {
+	return require_http.hasPortableActor(activity) || activity.id != null && require_http.isPortableId(activity.id);
+}
+/**
+* Verifies that a portable activity's own ID belongs to the DID that signed
+* it, on the JSON-LD document received.  The ID the proof policy checks has
+* to be the parsed activity's ID, so that a remote context that changes
+* between loads cannot make the two name different objects.
+* @returns `null` if the ID is verified, or the reason why it is not.
+*/
+async function verifyPortableActivityId(activityId, jsonLd, options) {
+	const expectedId = require_http.getCanonicalPortableId(activityId);
+	if (expectedId == null) return "malformed portable ID";
+	let verification;
+	try {
+		verification = await require_http.verifyPortableObjectProofWithRoot(jsonLd, options);
+	} catch (error) {
+		if (error instanceof require_http.InvalidPortableObjectIdError) return "malformed portable ID";
+		if (!isPermanentActivityParseError(error)) throw error;
+		return "malformed document";
+	}
+	const { result, root } = verification;
+	if (!result.verified) return result.reason.type;
+	const rootId = root?.["@id"];
+	if (typeof rootId !== "string" || require_http.getCanonicalPortableId((0, _fedify_vocab_runtime.parseIri)(rootId)) !== expectedId) return "the verified document has another ID";
+	return null;
 }
 //#endregion
 //#region src/federation/kv.ts
@@ -5038,16 +5294,17 @@ function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, loc
 		reason: "notFound"
 	};
 	const id = actor.id;
-	if (id == null || id.protocol !== "ap:" && id.protocol !== "ap+ef61:") return {
+	const did = id == null || !require_http.isPortableId(id) ? null : require_http.getPortableDid(id);
+	if (id == null || did == null) return {
 		status: "rejected",
 		reason: "notPortable"
 	};
-	if (!isSameAuthority(id, authority)) return {
+	if (did !== authority) return {
 		status: "rejected",
 		reason: "authorityMismatch"
 	};
-	const inboxId = actor.inboxId;
-	if (inboxId == null || canonicalize(inboxId) !== canonicalInboxId) return {
+	const inboxId = actor.inboxId == null ? null : toPortableUri(actor.inboxId);
+	if (inboxId == null || require_http.getCanonicalPortableId(inboxId) !== canonicalInboxId) return {
 		status: "rejected",
 		reason: "inboxMismatch"
 	};
@@ -5059,23 +5316,22 @@ function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, loc
 	return {
 		status: "accepted",
 		recipient: {
+			actorId: id,
 			inboxId,
 			canonicalInboxId,
 			gateways
 		}
 	};
 }
-function isSameAuthority(id, authority) {
-	try {
-		return (0, _fedify_vocab_runtime.getFe34Origin)(id) === authority;
-	} catch (error) {
-		if (error instanceof TypeError) return false;
-		throw error;
-	}
-}
-function canonicalize(iri) {
+/**
+* Gets the portable form of an `ap:` or `ap+ef61:` URI or a compatible
+* identifier, keeping its query.
+* @returns The portable URI, or `null` if the ID is neither, or is malformed.
+*/
+function toPortableUri(id) {
+	if (require_http.isPortableUri(id)) return id;
 	try {
-		return (0, _fedify_vocab_runtime.canonicalizePortableUri)(typeof iri === "string" ? iri : (0, _fedify_vocab_runtime.formatIri)(iri));
+		return (0, _fedify_vocab_runtime.fromCompatibleEf61Id)(id);
 	} catch (error) {
 		if (error instanceof TypeError) return null;
 		throw error;
@@ -5092,8 +5348,11 @@ function canonicalize(iri) {
 * Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
 * forwarded.
 *
-* Forwarded requests are not signed with HTTP Signatures; the receiving
-* gateways authenticate the activity by its own proof.
+* Forwarded requests are signed with HTTP Signatures by the RSA key among
+* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
+* servers requiring HTTP Signatures accept them, and are sent unsigned
+* otherwise.  Either way, the receiving gateways authenticate the activity by
+* its own proof.
 * @param parameters The parameters.
 * @returns The target inbox URLs that the activity was handed off to.
 */
@@ -5106,7 +5365,7 @@ async function forwardPortableInboxActivity(parameters) {
 	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
 	const { maxTargets, ttl } = parameters.options ?? resolvePortableInboxForwardingOptions();
 	if (kv.cas == null || maxTargets < 1) return [];
-	const canonicalActivityId = canonicalize(activityId) ?? activityId.href;
+	const canonicalActivityId = require_http.getCanonicalPortableId(activityId) ?? activityId.href;
 	const targets = getForwardingTargets(recipient, excludedOrigins);
 	if (targets.length > maxTargets) {
 		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
@@ -5165,20 +5424,59 @@ function getForwardingTargets(recipient, excludedOrigins) {
 	}
 	return targets;
 }
-async function forwardImmediately({ activity, activityId, activityType, allowPrivateAddress, options, meterProvider, tracerProvider }, inboxes) {
+/**
+* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
+* key, as {@link sendActivity} signs requests only with such a key.  Since
+* the targets have already been claimed, the activity is forwarded unsigned
+* rather than not at all if the key cannot be resolved or used.
+*/
+async function resolveForwardingKey({ getKeys, activityId }) {
+	if (getKeys == null) return null;
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	let key;
+	try {
+		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
+	} catch (error) {
+		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	if (key == null) return null;
+	try {
+		require_http.validateCryptoKey(key.privateKey, "private");
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	return key;
+}
+async function forwardImmediately(parameters, inboxes) {
+	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, options, meterProvider, tracerProvider } = parameters;
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
 	const deadline = (options ?? resolvePortableInboxForwardingOptions()).deadline.total("millisecond");
-	const sends = inboxes.map((inbox) => sendActivity({
+	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
 		activity,
 		activityId: activityId.href,
 		activityType,
-		keys: [],
+		keys: key == null ? [] : [key],
 		inbox,
 		allowPrivateAddress,
+		specDeterminer,
 		meterProvider,
 		tracerProvider
 	}).catch((error) => {
@@ -5187,9 +5485,9 @@ async function forwardImmediately({ activity, activityId, activityType, allowPri
 			inbox: inbox.href,
 			error
 		});
-	}));
+	}))));
 	let timer;
-	const timedOut = await Promise.race([Promise.all(sends).then(() => false), new Promise((resolve) => {
+	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
 		timer = setTimeout(() => resolve(true), deadline);
 	})]);
 	clearTimeout(timer);
@@ -5198,12 +5496,27 @@ async function forwardImmediately({ activity, activityId, activityType, allowPri
 		deadline
 	});
 }
-async function enqueueForwarding({ activity, activityId, activityType, baseUrl, startQueue, meterProvider }, outboxQueue, inboxes) {
+async function enqueueForwarding(parameters, outboxQueue, inboxes) {
+	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
 		"inbox"
 	]);
+	const key = await resolveForwardingKey(parameters);
+	const keys = [];
+	if (key != null) try {
+		keys.push({
+			keyId: key.keyId.href,
+			privateKey: await require_http.exportJwk(key.privateKey)
+		});
+	} catch (error) {
+		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+	}
 	startQueue?.();
 	const started = (/* @__PURE__ */ new Date()).toISOString();
 	const traceContext = {};
@@ -5213,7 +5526,7 @@ async function enqueueForwarding({ activity, activityId, activityType, baseUrl,
 			type: "outbox",
 			id: crypto.randomUUID(),
 			baseUrl,
-			keys: [],
+			keys,
 			activity,
 			activityId: activityId.href,
 			activityType,
@@ -5239,34 +5552,50 @@ async function enqueueForwarding({ activity, activityId, activityType, baseUrl,
 }
 //#endregion
 //#region src/federation/outgoing-proof.ts
-function isPortableUrl(url) {
-	return url.protocol === "ap:" || url.protocol === "ap+ef61:";
-}
 function formatKeyIds(candidates) {
 	return candidates.map((c) => c.verificationMethod.href).join(", ");
 }
 /**
 * Rejects an activity of a portable actor whose ID cannot be authenticated by
 * the actor's DID: FEP-ef61 requires the activity to be a portable object
-* signed by that DID, so its ID has to be a portable ID with the same DID.
+* signed by that DID, so its ID has to be a portable ID, i.e., an `ap:` or
+* `ap+ef61:` URI or a compatible identifier, with the same DID.  A portable
+* actor is one whose ID is such an ID as well.
 * @throws {TypeError} If the activity is performed by a portable actor, but
-*                     its ID is not a portable ID of the actor's DID, or its
-*                     portable actors do not share a DID.
+*                     its ID is not a portable ID of the actor's DID, its
+*                     portable actors do not share a DID, or the ID of one of
+*                     them is a malformed compatible identifier.
 * @internal
 */
 function assertPortableActorActivity(activity) {
-	const portableActors = activity.actorIds.filter(isPortableUrl);
+	const portableActors = activity.actorIds.filter((id) => require_http.isPortableId(id));
 	if (portableActors.length < 1) return;
-	const did = (0, _fedify_vocab_runtime.getFe34Origin)(portableActors[0]);
-	if (portableActors.some((actorId) => (0, _fedify_vocab_runtime.getFe34Origin)(actorId) !== did)) throw new TypeError(`The activity ${activity.id?.href} has portable actors with different DIDs (${portableActors.map((a) => a.href).join(", ")}); a portable activity is signed by a single DID.`);
-	if (activity.id == null || !isPortableUrl(activity.id) || (0, _fedify_vocab_runtime.getFe34Origin)(activity.id) !== did) throw new TypeError(`The activity ${activity.id?.href} is performed by the portable actor ${portableActors[0].href}, so its ID has to be an ap: or ap+ef61: URI with the same DID (${did}), as FEP-ef61 requires it to carry an Object Integrity Proof made by that DID.`);
+	const dids = portableActors.map((actorId) => {
+		const did = require_http.getPortableDid(actorId);
+		if (did == null) throw new TypeError(`The activity ${activity.id?.href} is performed by the actor ${actorId.href}, whose ID is a malformed FEP-ef61 portable ID.  A compatible identifier must have a valid DID and an object path, and must not have credentials or @gateway location hints.`);
+		return did;
+	});
+	const did = dids[0];
+	if (dids.some((d) => d !== did)) throw new TypeError(`The activity ${activity.id?.href} has portable actors with different DIDs (${portableActors.map((a) => a.href).join(", ")}); a portable activity is signed by a single DID.`);
+	if (activity.id == null || !require_http.isPortableId(activity.id) || require_http.getPortableDid(activity.id) !== did) throw new TypeError(`The activity ${activity.id?.href} is performed by the portable actor ${portableActors[0].href}, so its ID has to be an ap: or ap+ef61: URI, or an FEP-ef61 compatible identifier, with the same DID (${did}), as FEP-ef61 requires it to carry an Object Integrity Proof made by that DID.`);
+	if (!(0, _fedify_vocab_runtime_internal_portable_dereference.isCompatibleEf61Iri)(activity.id)) return;
+	const mismatched = portableActors.find((actorId) => (0, _fedify_vocab_runtime_internal_portable_dereference.isCompatibleEf61Iri)(actorId) && actorId.origin !== activity.id?.origin);
+	if (mismatched == null) return;
+	(0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"outbox"
+	]).warn("The activity {activityId} and its actor {actorId} are identified by FEP-ef61 compatible identifiers on different gateways.  FEP-ef61 requires publishers to use the first gateway in the actor's gateways when constructing compatible identifiers.", {
+		activityId: activity.id.href,
+		actorId: mismatched.href
+	});
 }
 /**
 * Creates the Object Integrity Proofs Fedify attaches to an outgoing activity.
 *
 * Keys whose IDs are FEP-ef61 compatible identifiers are gateway keys, which
 * never sign proofs.  A portable activity, i.e., one with an `ap:` or
-* `ap+ef61:` ID, that carries no proof is signed only by the one Ed25519 key
+* `ap+ef61:` ID or a compatible identifier, that carries no proof is signed only by the one Ed25519 key
 * whose verification method is a DID URL for its DID, even if it is the only
 * key; if no key or more than one key qualifies, this function throws.
 *
@@ -5305,7 +5634,7 @@ async function signOutgoingActivity(activity, candidates, options) {
 		break;
 	}
 	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !require_http.isCompatibleKeyId(c.verificationMethod));
-	if (!hasProof && activity.id != null && isPortableUrl(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
+	if (!hasProof && activity.id != null && require_http.isPortableId(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
 	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
 		activity,
 		hasProof,
@@ -5338,8 +5667,9 @@ async function signOutgoingActivity(activity, candidates, options) {
 * @throws {TypeError} If no key or more than one key qualifies.
 */
 function selectPortableActivityKey(activity, activityId, keys) {
-	const activityDid = (0, _fedify_vocab_runtime.getFe34Origin)(activityId);
-	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && (0, _fedify_vocab_runtime.haveSameFe34Origin)(activityId, c.verificationMethod));
+	const activityDid = require_http.getPortableDid(activityId);
+	if (activityDid == null) throw new TypeError(`Cannot sign the portable activity ${activityId.href}, as its ID is a malformed FEP-ef61 portable ID.  A compatible identifier must have a valid DID and an object path, and must not have credentials or @gateway location hints.`);
+	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && require_http.getPortableDid(c.verificationMethod) === activityDid);
 	if (eligible.length !== 1) throw new TypeError(`Cannot choose an Object Integrity Proof key for the portable activity ${activityId.href}: ` + (eligible.length < 1 ? `none of its ${keys.length} Ed25519 keys (${formatKeyIds(keys)}) ` : `${eligible.length} of its Ed25519 keys (${formatKeyIds(eligible)}) `) + `${eligible.length < 1 ? "is" : "are"} a DID URL verification method for ${activityDid}.  FEP-ef61 requires a portable activity's proof to be made by its DID, and the map-local compound-proof profile accepts exactly one direct proof per map.  Gateway keys, whose IDs are compatible identifiers, never sign proofs.  Supply exactly one Ed25519 key whose key ID is a DID URL for ${activityDid}, or sign the activity with signObject() before sending it.`);
 	(0, _logtape_logtape.getLogger)([
 		"fedify",
@@ -5759,6 +6089,27 @@ function getWebFingerSubjectAndAliases({ resourceUrl, actorUri, preferredUsernam
 	};
 }
 /**
+* Gets the compatible identifier that a WebFinger response links to for
+* an FEP-ef61 portable actor.  An actor identified by an `ap:` or `ap+ef61:`
+* URI is linked through its compatible identifier on the given gateway, while
+* an actor identified by a compatible identifier is linked through its ID as
+* is, so that software without FEP-ef61 support finds the same ID in the actor
+* document.
+* @param actorId The portable actor's ID.
+* @param gateway The actor's first gateway.
+* @returns The compatible identifier, or `null` if the actor ID is malformed
+*          or cannot be represented as a compatible identifier.
+*/
+function getCompatibleActorId(actorId, gateway) {
+	try {
+		if (require_http.isPortableUri(actorId)) return (0, _fedify_vocab_runtime.toCompatibleEf61Id)(actorId, gateway);
+		return (0, _fedify_vocab_runtime.fromCompatibleEf61Id)(actorId) == null ? null : actorId;
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
 * Computes the subject and aliases for an FEP-ef61 portable actor, whose
 * WebFinger address takes its domain from the first gateway of the actor
 * rather than from the actor ID.  The canonical `ap:` ID is not emitted,
@@ -5922,21 +6273,23 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 	});
 	let actorUri = context.getActorUri(identifier);
 	let portable;
-	if (actor.id != null && (actor.id.protocol === "ap:" || actor.id.protocol === "ap+ef61:")) {
+	if (actor.id != null && require_http.isPortableId(actor.id)) {
 		const gateway = actor.gateway;
-		let compatibleId;
-		if (gateway != null && (0, _fedify_vocab_runtime.isGatewayUrl)(gateway)) try {
-			compatibleId = (0, _fedify_vocab_runtime.toCompatibleEf61Id)(actor.id, gateway);
-		} catch (error) {
-			if (!(error instanceof TypeError)) throw error;
-		}
-		if (gateway == null || compatibleId == null) {
+		if (gateway == null || !(0, _fedify_vocab_runtime.isGatewayUrl)(gateway)) {
 			logger$1.error("The portable actor {actorId} (identifier: {identifier}) needs an HTTP(S) origin as the first item of its gateways property to be discovered through WebFinger.", {
 				actorId: (0, _fedify_vocab_runtime.formatIri)(actor.id),
 				identifier
 			});
 			return await onNotFound(request);
 		}
+		const compatibleId = getCompatibleActorId(actor.id, gateway);
+		if (compatibleId == null) {
+			logger$1.error("The portable actor {actorId} (identifier: {identifier}) cannot be discovered through WebFinger, as its ID is malformed or cannot be represented as an FEP-ef61 compatible identifier.", {
+				actorId: (0, _fedify_vocab_runtime.formatIri)(actor.id),
+				identifier
+			});
+			return await onNotFound(request);
+		}
 		actorUri = compatibleId;
 		portable = {
 			compatibleId,
@@ -7896,6 +8249,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 						outboxQueue: this.outboxQueue,
 						startQueue: this.manuallyStartQueue ? void 0 : () => this._startQueueInternal(contextData),
 						allowPrivateAddress: this.allowPrivateAddress,
+						getKeys: () => this.#getPortableGatewayKeyPairs(context, identifier, recipient),
+						specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
 						options: this.portableInboxForwarding,
 						meterProvider: this.meterProvider,
 						tracerProvider: this.tracerProvider
@@ -7904,6 +8259,49 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}
 		});
 	}
+	/**
+	* Gets this server's gateway key pairs for the portable actor that owns
+	* a portable inbox, which sign the activities forwarded from the inbox.
+	* @param context The context.
+	* @param identifier The identifier of the portable actor.
+	* @param recipient The portable inbox.
+	* @returns The key pairs, or an empty array if the actor has no gateway
+	*          keys on this server.
+	*/
+	async #getPortableGatewayKeyPairs(context, identifier, recipient) {
+		const logger = (0, _logtape_logtape.getLogger)([
+			"fedify",
+			"federation",
+			"inbox"
+		]);
+		if (this.actorCallbacks?.keyPairsDispatcher == null || this.actorCallbacks.portableActorIdMapper == null) {
+			logger.debug("Forwarding activities from the portable inbox {inbox} without HTTP Signatures, as gateway keys need both a key pairs dispatcher and a portable actor ID mapper.", { inbox: recipient.canonicalInboxId });
+			return [];
+		}
+		const actorId = require_http.getCanonicalPortableId(recipient.actorId);
+		if (actorId == null) return [];
+		const keyPairs = await context.getActorKeyPairs(identifier);
+		for (const { cryptographicKey } of keyPairs) {
+			const owner = cryptographicKey.ownerId;
+			const canonicalOwner = owner == null ? null : require_http.getCanonicalPortableId(owner);
+			if (canonicalOwner === actorId) continue;
+			if (canonicalOwner == null) logger.debug("Forwarding activities from the portable inbox {inbox} without HTTP Signatures, as the key pairs of the actor {identifier} are not the gateway keys of a portable actor.", {
+				inbox: recipient.canonicalInboxId,
+				identifier
+			});
+			else logger.warn("Forwarding activities from the portable inbox {inbox} without HTTP Signatures, as the key pairs of the actor {identifier} are the gateway keys of {owner}, not of the recipient {actorId}.", {
+				inbox: recipient.canonicalInboxId,
+				identifier,
+				owner: canonicalOwner,
+				actorId
+			});
+			return [];
+		}
+		return keyPairs.map(({ keyId, privateKey }) => ({
+			keyId,
+			privateKey
+		}));
+	}
 	async #fetchHashlinkMedia(request, media, { onNotFound, contextData, span, metricState }) {
 		metricState.endpoint = "hashlink_media";
 		metricState.routeTemplate = HASHLINK_MEDIA_ROUTE_TEMPLATE;