@fedify/fedify 2.4.0-dev.2084 → 2.4.0-dev.2099

package/dist/{middleware-D_9pNYe9.js → middleware-CcXMe400.js}

@@ -2,16 +2,17 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { $ as recordCollectionPageItems, B as getCanonicalPortableId, C as hasSignature, D as signJsonLd, E as isInvalidUrlTypeError, H as hasPortableActor, J as getRemoteHost, K as getDurationMs, L as importJwk, M as exportJwk, O as verifyCompactJsonLd, Q as recordCollectionDispatchDuration, R as validateCryptoKey, S as getNormalizationContextLoader, T as isClearlyMalformedContextReference, U as isCompatibleKeyId, V as getGatewayKeyBase, W as isPortableUri, X as isAbortError, Y as instrumentDocumentLoader, Z as recordCircuitBreakerStateChange, _ as assertSafeJsonLd, a as verifyRequestDetailed, at as recordOutboxActivity, c as hasProofLike, ct as registerQueueDepthGauge, d as verifyObject, et as recordCollectionRequest, f as verifyPortableObjectProof, g as InvalidContextReferenceError, ht as version, i as verifyRequest, it as recordInboxActivity, j as wrapContextLoaderForJsonLd, l as signObject, lt as normalizeOutgoingActivityJsonLd, mt as name, n as parseRfc9421SignatureInput, ot as recordOutboxEnqueue, p as verifyPortableObjectProofPolicy, q as getFederationMetrics, rt as recordFanoutRecipients, st as recordWebFingerHandle, t as doubleKnock, tt as recordCollectionTotalItems, u as verifyMapLocalProof, ut as formatAcceptSignature, w as hasSignatureLike, x as detachSignature, y as compactJsonLd } from "./http-4PCCvhsU.js";
+import { $ as recordCollectionTotalItems, A as isInvalidUrlTypeError, C as compactJsonLd, D as hasSignature, E as getNormalizationContextLoader, F as wrapContextLoaderForJsonLd, G as getFederationMetrics, H as validateCryptoKey, I as exportJwk, J as isAbortError, K as getRemoteHost, M as verifyCompactJsonLd, O as hasSignatureLike, Q as recordCollectionRequest, T as detachSignature, V as importJwk, W as getDurationMs, X as recordCollectionDispatchDuration, Y as recordCircuitBreakerStateChange, Z as recordCollectionPageItems, _ as verifyPortableObjectProofWithRoot, _t as isPortableId, at as recordWebFingerHandle, b as InvalidContextReferenceError, bt as name, ct as formatAcceptSignature, d as hasProofLike, f as signObject, ft as getCanonicalPortableId, g as verifyPortableObjectProofPolicy, gt as isCompatibleKeyId, h as verifyPortableObjectProof, ht as hasPortableActor, i as selectRequestSignature, it as recordOutboxEnqueue, j as signJsonLd, k as isClearlyMalformedContextReference, l as InvalidPortableObjectIdError, m as verifyObject, mt as getPortableDid, n as listRequestSignatures, nt as recordInboxActivity, o as verifyRequest, ot as registerQueueDepthGauge, p as verifyMapLocalProof, pt as getGatewayKeyBase, q as instrumentDocumentLoader, r as parseRfc9421SignatureInput, rt as recordOutboxActivity, s as verifyRequestDetailed, st as preloadedOnlyDocumentLoader, t as doubleKnock, tt as recordFanoutRecipients, vt as isPortableUri, x as assertSafeJsonLd, xt as version, y as normalizeOutgoingActivityJsonLd } from "./http-D-rbr_Sy.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-_pbbgLJK.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-1KUmAPH7.js";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-U12fDpQW.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DIxwMeNi.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
+import { FetchError, UrlError, canonicalizePortableUri, decodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDigestMultibase, parseHashlink, parseIri, toCompatibleEf61Id, validatePublicUrl } from "@fedify/vocab-runtime";
+import { isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
 import { encodeHex } from "byte-encodings/hex";
-import { FetchError, UrlError, canonicalizePortableUri, decodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, haveSameFe34Origin, isGatewayUrl, parseDigestMultibase, parseHashlink, parseIri, toCompatibleEf61Id, validatePublicUrl } from "@fedify/vocab-runtime";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 import { uniq } from "es-toolkit";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_HTTP_RESPONSE_HEADER, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
@@ -205,10 +206,11 @@ var FederationBuilderImpl = class {
 				"federation",
 				"actor"
 			]);
-			const portable = actor.id?.protocol === "ap:" || actor.id?.protocol === "ap+ef61:";
+			const portable = actor.id != null && isPortableId(actor.id);
 			if (actor.id == null) logger.warn("Actor dispatcher returned an actor without an id property.  Set the property with Context.getActorUri(identifier).");
 			else if (!portable && actor.id.href != context.getActorUri(identifier).href) logger.warn("Actor dispatcher returned an actor with an id property that does not match the actor URI.  Set the property with Context.getActorUri(identifier).");
 			if (actor instanceof Tombstone) return actor;
+			if (actor.id != null && isCompatibleEf61Iri(actor.id)) warnCompatibleActorId(actor.id, actor.gateway);
 			if (this.followingCallbacks != null && this.followingCallbacks.dispatcher != null) {
 				if (actor.followingId == null) logger.warn("You configured a following collection dispatcher, but the actor does not have a following property.  Set the property with Context.getFollowingUri(identifier).");
 				else if (!portable && actor.followingId.href != context.getFollowingUri(identifier).href) logger.warn("You configured a following collection dispatcher, but the actor's following property does not match the following collection URI.  Set the property with Context.getFollowingUri(identifier).");
@@ -733,6 +735,33 @@ var FederationBuilderImpl = class {
 function createFederationBuilder() {
 	return new FederationBuilderImpl();
 }
+/**
+* Warns about an FEP-ef61 portable actor identified by a compatible identifier
+* that is malformed, or is not on the actor's first gateway, where FEP-ef61
+* requires publishers to construct compatible identifiers.
+*/
+function warnCompatibleActorId(actorId, gateway) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"actor"
+	]);
+	try {
+		fromCompatibleEf61Id(actorId);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.warn("Actor dispatcher returned an actor whose id property, {actorId}, is a malformed FEP-ef61 compatible identifier: {error}", {
+			actorId: actorId.href,
+			error
+		});
+		return;
+	}
+	if (gateway == null || !isGatewayUrl(gateway)) logger.warn("Actor dispatcher returned an actor whose id property, {actorId}, is an FEP-ef61 compatible identifier, but whose first gateway is not an HTTP(S) origin.  Set the gateways property, and construct the compatible identifier with its first gateway.", { actorId: actorId.href });
+	else if (actorId.origin !== gateway.origin) logger.warn("Actor dispatcher returned an actor whose id property, {actorId}, is an FEP-ef61 compatible identifier on another gateway than its first gateway, {gateway}.  FEP-ef61 requires publishers to construct compatible identifiers with the first gateway in the actor's gateways.", {
+		actorId: actorId.href,
+		gateway: gateway.origin
+	});
+}
 //#endregion
 //#region src/federation/circuit-breaker.ts
 const LEGACY_SWEEP_MARKER = ["__fedify_meta", "circuit_breaker_state_ttl_sweep_v2"];
@@ -1309,7 +1338,14 @@ async function buildCollectionSynchronizationHeader(collectionId, actorIds) {
 //#endregion
 //#region src/sig/compound-proof.ts
 const textEncoder = new TextEncoder();
-const PORTABLE_OBJECT_ID_PATTERN = /^ap(?:\+ef61)?:\/\//i;
+/**
+* Checks whether a literal `id` or `@id` value makes a map a portable object:
+* an `ap:` or `ap+ef61:` URI, or anything that looks like an FEP-ef61
+* compatible identifier, even a malformed one, which then fails the policy.
+*/
+function isPortableIdValue(value) {
+	return typeof value === "string" && isPortableId(value);
+}
 function isJsonMap(value) {
 	return typeof value === "object" && value != null && !Array.isArray(value);
 }
@@ -1555,18 +1591,20 @@ function collectPortableObjects(snapshot) {
 			for (let index = current.value.length - 1; index >= 0; index--) pending.push({
 				value: current.value[index],
 				path: childPath(current.path, String(index)),
-				depth: current.depth + 1
+				depth: current.depth + 1,
+				keyOf: current.keyOf
 			});
 			continue;
 		}
 		if (!isCompoundProofJsonObject(current.value)) continue;
 		const document = current.value;
-		const id = [document.id, document["@id"]].find((value) => typeof value === "string" && PORTABLE_OBJECT_ID_PATTERN.test(value));
+		const id = [document.id, document["@id"]].find(isPortableIdValue);
 		if (typeof id === "string") objects.push(Object.freeze({
 			path: current.path,
 			id,
 			depth: current.depth,
-			document
+			document,
+			...current.keyOf == null ? {} : { keyOf: current.keyOf }
 		}));
 		const entries = Object.entries(document).sort(([left], [right]) => comparePaths(left, right));
 		for (let index = entries.length - 1; index >= 0; index--) {
@@ -1575,7 +1613,11 @@ function collectPortableObjects(snapshot) {
 			pending.push({
 				value,
 				path: childPath(current.path, key),
-				depth: current.depth + 1
+				depth: current.depth + 1,
+				...typeof id === "string" && (key === "publicKey" || key === "assertionMethod") ? { keyOf: {
+					path: current.path,
+					member: key
+				} } : {}
 			});
 		}
 	}
@@ -1583,8 +1625,9 @@ function collectPortableObjects(snapshot) {
 	return objects;
 }
 /**
-* Determines whether a received JSON tree contains a portable object ID
-* outside a proof or context definition, without exceeding discovery limits.
+* Determines whether a received JSON tree contains a portable object ID, i.e.,
+* an `ap:` or `ap+ef61:` URI or an FEP-ef61 compatible identifier, outside
+* a proof or context definition, without exceeding discovery limits.
 *
 * This is only an applicability check.  It does not authenticate the input;
 * callers must still use {@link verifyCompoundPortableObjectProofs} to obtain
@@ -1631,7 +1674,7 @@ function inspectCompoundPortableObjectApplicability(json, limits) {
 		} else if (isJsonMap(value)) {
 			mapCount++;
 			if (mapCount > limits.maxMaps) return "indeterminate";
-			if ([value.id, value["@id"]].some((id) => typeof id === "string" && PORTABLE_OBJECT_ID_PATTERN.test(id))) return "present";
+			if ([value.id, value["@id"]].some(isPortableIdValue)) return "present";
 			if (!addByteLength(2)) return "indeterminate";
 			const children = function* () {
 				let first = true;
@@ -1694,7 +1737,8 @@ function findInJsonMaps(json, visit) {
 /**
 * Determines whether an outgoing JSON tree contains portable content that
 * requires producer-side proof-shape checks: a map, outside proof and context
-* values, whose direct `id` or `@id` is a portable ActivityPub URI.
+* values, whose direct `id` or `@id` is a portable ActivityPub URI or an
+* FEP-ef61 compatible identifier.
 *
 * This deliberately differs from
 * {@link inspectCompoundPortableObjectApplicability}: it applies no resource
@@ -1707,7 +1751,7 @@ function findInJsonMaps(json, visit) {
 * @internal
 */
 function containsCompoundPortableObject(json) {
-	return findInJsonMaps(json, (map) => [map.id, map["@id"]].some((id) => typeof id === "string" && PORTABLE_OBJECT_ID_PATTERN.test(id)) ? true : void 0) ?? false;
+	return findInJsonMaps(json, (map) => [map.id, map["@id"]].some(isPortableIdValue) ? true : void 0) ?? false;
 }
 /**
 * Finds the first direct `proof` member whose value the map-local
@@ -1804,7 +1848,7 @@ async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 	if (discovered.status !== "ok") return discovered;
 	const proofs = await verifyDiscoveredProofDocuments(discovered, options);
 	const proofByPath = new Map(proofs.map((proof) => [proof.path, proof]));
-	const portableObjects = await Promise.all(collectPortableObjects(discovered.snapshot).map(async (object) => {
+	const verifyPortableObject = async (object) => {
 		const metadata = {
 			path: object.path,
 			id: object.id,
@@ -1836,16 +1880,174 @@ async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 				reason: { type: "invalidPortableObject" }
 			});
 		}
+	};
+	const collected = collectPortableObjects(discovered.snapshot);
+	const objectByPath = new Map(collected.map((object) => [object.path, object]));
+	const isKeyCandidate = (object) => object.keyOf != null && !Object.hasOwn(object.document, "proof");
+	const results = /* @__PURE__ */ new Map();
+	for (const result of await Promise.all(collected.filter((object) => !isKeyCandidate(object)).map(verifyPortableObject))) results.set(result.path, result);
+	let projections = 0;
+	for (const object of collected) {
+		if (!isKeyCandidate(object)) continue;
+		const { path, member } = object.keyOf;
+		const parent = results.get(path);
+		const parentObject = objectByPath.get(path);
+		if (parent?.verified === true && parentObject != null && projections++ < MAX_KEY_PROJECTIONS && await isEmbeddedPortableKey(parentObject.document, member, object.document, parent.id)) continue;
+		results.set(object.path, await verifyPortableObject(object));
+	}
+	const portableObjects = Object.freeze(collected.flatMap((object) => {
+		const result = results.get(object.path);
+		return result == null ? [] : [result];
 	}));
 	return {
 		status: "ok",
 		verified: portableObjects.length > 0 && proofs.every((proof) => proof.verified) && portableObjects.every((object) => object.verified),
 		snapshot: discovered.snapshot,
 		proofs,
-		portableObjects: Object.freeze(portableObjects),
+		portableObjects,
 		statistics: discovered.statistics
 	};
 }
+/**
+* The maximum number of embedded keys per compound document that are checked
+* by {@link isEmbeddedPortableKey}, each of which expands a projection of its
+* parent.  Keys beyond it have to carry their own proofs.
+*/
+const MAX_KEY_PROJECTIONS = 64;
+const SECURITY = "https://w3id.org/security#";
+const KEY_TYPES = /* @__PURE__ */ new Set([`${SECURITY}Key`, `${SECURITY}Multikey`]);
+const KEY_PROPERTIES = /* @__PURE__ */ new Set([
+	"@id",
+	"@type",
+	`${SECURITY}owner`,
+	`${SECURITY}controller`,
+	`${SECURITY}publicKeyPem`,
+	`${SECURITY}publicKeyMultibase`
+]);
+/**
+* Tells whether an unsigned map embedded in a verified portable map is just
+* a key of the portable object the parent is, e.g., a gateway key of
+* a portable actor, which the parent's proof covers.
+*
+* The key's meaning depends on the contexts active where it sits, so it is
+* decided on a projection of the parent that keeps only what those contexts
+* depend on: the parent's `@context`, its types and ID, and the member that
+* holds the key.  That holds only if nothing else in the parent can change
+* them, so both documents may only use contexts that define no keyword
+* aliases and no scoped contexts; Fedify's preloaded contexts, the only
+* remote ones the compound policy loads, alias just `id` and `type`.
+*
+* The projection must expand to the parent's verified ID with the key as the
+* single value of `publicKey` or `assertionMethod`, and the key must be
+* nothing but a `CryptographicKey` or `Multikey` whose ID is a compatible
+* identifier of the parent plus a fragment, and whose owner or controller,
+* if any, is the parent.
+*/
+async function isEmbeddedPortableKey(parent, member, key, parentId) {
+	const parentPortableId = getCanonicalPortableIdOf(parentId);
+	if (parentPortableId == null) return false;
+	if (!isSimpleContext(parent["@context"]) || Object.hasOwn(key, "@context") && !isSimpleContext(key["@context"])) return false;
+	const literalIds = [key.id, key["@id"]].filter((id) => id !== void 0);
+	if (literalIds.length < 1 || literalIds.some((id) => id !== literalIds[0]) || typeof literalIds[0] !== "string" || !isKeyIdOf(literalIds[0], parentPortableId)) return false;
+	const projection = {};
+	for (const property of [
+		"@context",
+		"type",
+		"@type",
+		"id",
+		"@id"
+	]) if (Object.hasOwn(parent, property)) projection[property] = parent[property];
+	projection[member] = key;
+	let expanded;
+	try {
+		expanded = await jsonld.expand(structuredClone(projection), {
+			documentLoader: getNormalizationContextLoader(preloadedOnlyDocumentLoader),
+			keepFreeFloatingNodes: true
+		});
+	} catch {
+		return false;
+	}
+	if (expanded.length !== 1 || hasGraphKeyword(expanded)) return false;
+	const node = expanded[0];
+	if (!isJsonMap(node) || typeof node["@id"] !== "string" || getCanonicalPortableIdOf(node["@id"]) !== parentPortableId) return false;
+	const properties = Object.keys(node).filter((property) => property !== "@id" && property !== "@type");
+	if (properties.length !== 1 || properties[0] !== `${SECURITY}${member}`) return false;
+	const values = node[properties[0]];
+	if (!Array.isArray(values) || values.length !== 1) return false;
+	const expandedKey = values[0];
+	if (!isJsonMap(expandedKey) || expandedKey["@id"] !== literalIds[0] || Object.keys(expandedKey).some((property) => !KEY_PROPERTIES.has(property))) return false;
+	const types = expandedKey["@type"];
+	if (types !== void 0 && (!Array.isArray(types) || types.some((type) => typeof type !== "string" || !KEY_TYPES.has(type)))) return false;
+	const pem = expandedKey[`${SECURITY}publicKeyPem`];
+	const multibase = expandedKey[`${SECURITY}publicKeyMultibase`];
+	if (pem === void 0 && multibase === void 0) return false;
+	if (pem !== void 0 && !isSingleStringValue(pem)) return false;
+	if (multibase !== void 0 && !isSingleStringValue(multibase, `${SECURITY}multibase`)) return false;
+	for (const property of [`${SECURITY}owner`, `${SECURITY}controller`]) {
+		const owners = expandedKey[property];
+		if (owners === void 0) continue;
+		if (!Array.isArray(owners) || owners.length !== 1 || !isJsonMap(owners[0]) || Object.keys(owners[0]).length !== 1 || typeof owners[0]["@id"] !== "string" || getCanonicalPortableIdOf(owners[0]["@id"]) !== parentPortableId) return false;
+	}
+	return true;
+}
+function getCanonicalPortableIdOf(id) {
+	try {
+		return getCanonicalPortableId(parseIri(id));
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Checks whether an ID is a compatible identifier of the given portable
+* object plus a fragment.
+*/
+function isKeyIdOf(id, portableId) {
+	let url;
+	try {
+		if (fromCompatibleEf61Id(id) == null) return false;
+		url = new URL(id);
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+	if (url.hash.length < 2) return false;
+	url.hash = "";
+	return getCanonicalPortableId(url) === portableId;
+}
+/**
+* Checks whether a `@context` value defines no keyword aliases and no scoped
+* contexts: only references to contexts and term definitions that map terms
+* to IRIs, optionally with an `@id` or `@vocab` type coercion or a datatype.
+*/
+function isSimpleContext(context) {
+	if (typeof context === "string") return true;
+	if (Array.isArray(context)) return context.every(isSimpleContext);
+	if (context === void 0 || !isCompoundProofJsonObject(context)) return false;
+	return Object.entries(context).every(([term, definition]) => {
+		if (term.startsWith("@")) return false;
+		if (typeof definition === "string") return !definition.startsWith("@");
+		if (!isCompoundProofJsonObject(definition)) return false;
+		const { "@id": id, "@type": type, ...rest } = definition;
+		return Object.keys(rest).length < 1 && typeof id === "string" && !id.startsWith("@") && (type === void 0 || type === "@id" || type === "@vocab" || typeof type === "string" && !type.startsWith("@"));
+	});
+}
+function hasGraphKeyword(value) {
+	if (Array.isArray(value)) return value.some(hasGraphKeyword);
+	if (!isJsonMap(value)) return false;
+	return Object.entries(value).some(([key, child]) => key === "@graph" || key === "@included" || key === "@reverse" || hasGraphKeyword(child));
+}
+/**
+* Checks whether expanded values are a single plain string, optionally with
+* the given datatype.
+*/
+function isSingleStringValue(values, datatype) {
+	if (!Array.isArray(values) || values.length !== 1) return false;
+	const value = values[0];
+	if (!isJsonMap(value) || typeof value["@value"] !== "string") return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 || datatype != null && keys.length === 2 && value["@type"] === datatype;
+}
 //#endregion
 //#region src/federation/inbox.ts
 async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
@@ -2316,282 +2518,975 @@ function parseHashlinkGatewayRequest(url) {
 	};
 }
 //#endregion
-//#region src/federation/temporal.ts
-function isPlainObject$1(value) {
-	return typeof value === "object" && value != null && !Array.isArray(value);
-}
-function normalizeDateTimeLiteral(value) {
-	return value.substring(19).match(/[Z+-]/) ? value : value + "Z";
-}
-function isMalformedDateTimeLiteral(value) {
-	if (typeof value !== "string") return false;
-	try {
-		Temporal.Instant.from(normalizeDateTimeLiteral(value));
-		return false;
-	} catch {
-		return true;
-	}
-}
-function isMalformedDurationLiteral(value) {
-	if (typeof value !== "string") return false;
-	try {
-		Temporal.Duration.from(value);
-		return false;
-	} catch {
-		return true;
+//#region src/federation/send.ts
+/**
+* Extracts the inbox URLs from recipients.
+* @param parameters The parameters to extract the inboxes.
+*                   See also {@link ExtractInboxesParameters}.
+* @returns The inboxes as a map of inbox URL to actor URIs.
+*/
+function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
+	const inboxes = {};
+	for (const recipient of recipients) {
+		let inbox;
+		let sharedInbox = false;
+		if (preferSharedInbox && recipient.endpoints?.sharedInbox != null) {
+			inbox = recipient.endpoints.sharedInbox;
+			sharedInbox = true;
+		} else inbox = recipient.inboxId;
+		if (inbox != null && recipient.id != null) {
+			if (excludeBaseUris != null && excludeBaseUris.some((u) => u.origin === inbox?.origin)) continue;
+			inboxes[inbox.href] ??= {
+				actorIds: /* @__PURE__ */ new Set(),
+				sharedInbox
+			};
+			inboxes[inbox.href].actorIds.add(recipient.id.href);
+		}
 	}
+	return inboxes;
 }
-const TEMPORAL_DATE_TIME_IRIS = /* @__PURE__ */ new Set([
-	"https://www.w3.org/ns/activitystreams#deleted",
-	"https://www.w3.org/ns/activitystreams#endTime",
-	"https://www.w3.org/ns/activitystreams#published",
-	"https://www.w3.org/ns/activitystreams#startTime",
-	"https://www.w3.org/ns/activitystreams#updated",
-	"http://purl.org/dc/terms/created",
-	"https://w3id.org/security#created"
-]);
-const TEMPORAL_DURATION_IRIS = /* @__PURE__ */ new Set(["https://www.w3.org/ns/activitystreams#duration"]);
-const QUESTION_CLOSED_IRI = "https://www.w3.org/ns/activitystreams#closed";
-const XSD_DATE_TIME_IRI = "http://www.w3.org/2001/XMLSchema#dateTime";
-function hasMalformedExpandedDateTimeLiteral(value) {
-	if (Array.isArray(value)) return value.some(hasMalformedExpandedDateTimeLiteral);
-	return isPlainObject$1(value) && "@value" in value && isMalformedDateTimeLiteral(value["@value"]);
-}
-function hasMalformedExpandedQuestionClosedLiteral(value) {
-	if (Array.isArray(value)) return value.some(hasMalformedExpandedQuestionClosedLiteral);
-	if (!isPlainObject$1(value) || !("@value" in value)) return false;
-	const literal = value["@value"];
-	if (typeof literal === "boolean") return false;
-	if (typeof literal !== "string") return false;
-	if (value["@type"] !== XSD_DATE_TIME_IRI) return false;
-	if (new Date(literal).toString() === "Invalid Date") return false;
-	return isMalformedDateTimeLiteral(literal);
+/**
+* Sends an {@link Activity} to an inbox.
+*
+* @param parameters The parameters for sending the activity.
+*                   See also {@link SendActivityParameters}.
+* @throws {Error} If the activity fails to send.
+*/
+function sendActivity(options) {
+	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
+	return tracerProvider.getTracer(name, version).startActiveSpan("activitypub.send_activity", {
+		kind: SpanKind.CLIENT,
+		attributes: { "activitypub.shared_inbox": options.sharedInbox ?? false }
+	}, async (span) => {
+		if (options.activityId != null) span.setAttribute("activitypub.activity.id", options.activityId);
+		if (options.activityType != null) span.setAttribute("activitypub.activity.type", options.activityType);
+		try {
+			await sendActivityInternal({
+				...options,
+				tracerProvider
+			}, span);
+		} catch (e) {
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(e)
+			});
+			throw e;
+		} finally {
+			span.end();
+		}
+	});
 }
-function hasMalformedExpandedDurationLiteral(value) {
-	if (Array.isArray(value)) return value.some(hasMalformedExpandedDurationLiteral);
-	return isPlainObject$1(value) && "@value" in value && isMalformedDurationLiteral(value["@value"]);
+const MAX_ERROR_RESPONSE_BODY_BYTES = 1024;
+function getActivityActorId(activity) {
+	if (!isRecord(activity)) return void 0;
+	return getIdValue(activity.actor);
 }
-function hasMalformedKnownTemporalLiteralInternal(value, visited) {
-	if (Array.isArray(value)) return value.some((item) => hasMalformedKnownTemporalLiteralInternal(item, visited));
-	if (!isPlainObject$1(value)) return false;
-	if (visited.has(value)) return false;
-	visited.add(value);
-	if ("@value" in value) return false;
-	for (const [key, child] of Object.entries(value)) {
-		if (TEMPORAL_DATE_TIME_IRIS.has(key)) {
-			if (hasMalformedExpandedDateTimeLiteral(child)) return true;
-			continue;
-		}
-		if (key === QUESTION_CLOSED_IRI) {
-			if (hasMalformedExpandedQuestionClosedLiteral(child)) return true;
-			continue;
-		}
-		if (TEMPORAL_DURATION_IRIS.has(key)) {
-			if (hasMalformedExpandedDurationLiteral(child)) return true;
-			continue;
+function getIdValue(value) {
+	if (typeof value === "string" && value !== "") return value;
+	if (value instanceof URL) return value.href;
+	if (Array.isArray(value)) {
+		for (const item of value) {
+			const id = getIdValue(item);
+			if (id != null) return id;
 		}
-		if (hasMalformedKnownTemporalLiteralInternal(child, visited)) return true;
+		return;
 	}
-	return false;
+	if (isRecord(value)) return getIdValue(value.id);
 }
-async function hasMalformedKnownTemporalLiteral(value, contextLoader) {
+function isRecord(value) {
+	return typeof value === "object" && value != null;
+}
+async function readLimitedResponseBody(response, maxBytes) {
+	if (response.body == null) return "";
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	const chunks = [];
+	let totalBytes = 0;
+	let truncated = false;
 	try {
-		return hasMalformedKnownTemporalLiteralInternal(await jsonld.expand(value, {
-			documentLoader: getNormalizationContextLoader(contextLoader),
-			keepFreeFloatingNodes: true
-		}), /* @__PURE__ */ new Set());
-	} catch {
-		return false;
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (totalBytes + value.length > maxBytes) {
+				const remaining = maxBytes - totalBytes;
+				if (remaining > 0) chunks.push(decoder.decode(value.slice(0, remaining), { stream: true }));
+				truncated = true;
+				break;
+			}
+			chunks.push(decoder.decode(value, { stream: true }));
+			totalBytes += value.length;
+		}
+	} finally {
+		reader.releaseLock();
 	}
+	let result = chunks.join("");
+	if (truncated) result += "… (truncated)";
+	return result;
 }
-//#endregion
-//#region src/federation/handler.ts
-const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
-const INBOX_COMPOUND_PROOF_LIMITS = {
-	maxDepth: 64,
-	maxMaps: 1e4,
-	maxProofs: 32,
-	maxBytes: 10 * 1024 * 1024
-};
-function isRemoteContextLoadingFailure$1(error) {
-	return error instanceof Error && typeof error.details === "object" && error.details != null && error.details.code === "loading remote context failed";
-}
-function isPermanentRemoteContextError$1(error) {
-	if (!(error instanceof Error) || error.name !== "jsonld.InvalidUrl") return false;
-	const details = error.details;
-	if (details?.code === "invalid remote context") return true;
-	return isRemoteContextLoadingFailure$1(error) && typeof details?.url === "string" && !URL.canParse(details.url) && isClearlyMalformedContextReference(details.url);
-}
-function isInvalidJsonLdError(error) {
-	if (!(error instanceof Error)) return false;
-	const name = error.name;
-	return name === "UnsafeJsonLdError" || error instanceof InvalidContextReferenceError || isPermanentRemoteContextError$1(error) || name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure$1(error);
-}
-function isValidationTypeError(error) {
-	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || isInvalidUrlTypeError(error));
-}
-function isPermanentActivityParseError(error) {
-	return isInvalidJsonLdError(error) || isValidationTypeError(error);
-}
-function hasHttpSignatureHeaders(request) {
-	return request.headers.has("Signature") || request.headers.has("Signature-Input");
-}
-function hasObjectIntegrityProof(json) {
-	return typeof json === "object" && json != null && "proof" in json;
-}
-/**
-* Handles an actor request.
-* @template TContextData The context data to pass to the context.
-* @param request The HTTP request.
-* @param parameters The parameters for handling the actor.
-* @returns A promise that resolves to an HTTP response.
-*/
-async function handleActor(request, { identifier, context, actorDispatcher, authorizePredicate, onNotFound, onUnauthorized }) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
-		"actor"
+		"outbox"
 	]);
-	if (actorDispatcher == null) {
-		logger.debug("Actor dispatcher is not set.", { identifier });
-		return await onNotFound(request);
+	const federationMetrics = getFederationMetrics(meterProvider);
+	const started = performance.now();
+	let deliverySuccess = false;
+	async function validateUrl(url) {
+		if (!allowPrivateAddress) try {
+			await validatePublicUrl(url);
+		} catch (error) {
+			if (error instanceof UrlError) logger.error("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
 	}
-	const actor = await actorDispatcher(context, identifier);
-	if (actor == null) {
-		logger.debug("Actor {identifier} not found.", { identifier });
-		return await onNotFound(request);
+	await validateUrl(inbox.href);
+	headers = new Headers(headers);
+	headers.set("Content-Type", "application/activity+json");
+	const request = new Request(inbox, {
+		method: "POST",
+		headers,
+		body: JSON.stringify(activity),
+		redirect: "manual"
+	});
+	let rsaKey = null;
+	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
+		rsaKey = key;
+		break;
 	}
-	if (authorizePredicate != null) {
-		if (!await authorizePredicate(context, identifier)) return await onUnauthorized(request);
+	if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
+		activityId,
+		inbox: inbox.href
+	});
+	else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
+		inbox: inbox.href,
+		keys: keys.map((pair) => ({
+			keyId: pair.keyId.href,
+			privateKey: pair.privateKey
+		}))
+	});
+	let response;
+	try {
+		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await doubleKnock(request, rsaKey, {
+			tracerProvider,
+			specDeterminer,
+			validateRedirect: validateUrl
+		});
+	} catch (error) {
+		const failure = error instanceof FetchError || error instanceof UrlError ? error : createFetchError(inbox.href, error);
+		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
+			activityId,
+			inbox: inbox.href,
+			error: failure
+		});
+		federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
+		throw failure;
 	}
-	if (actor instanceof Tombstone) {
-		const jsonLd = await actor.toJsonLd(context);
-		return new Response(JSON.stringify(jsonLd), {
-			status: 410,
-			headers: {
-				"Content-Type": "application/activity+json",
-				Vary: "Accept"
+	try {
+		if (!response.ok) {
+			let error;
+			try {
+				error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
+			} catch (_) {
+				error = "";
 			}
+			logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
+				activityId,
+				inbox: inbox.href,
+				status: response.status,
+				statusText: response.statusText,
+				error
+			});
+			throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error, response.headers);
+		}
+		deliverySuccess = true;
+		const eventAttributes = {
+			"activitypub.inbox.url": inbox.href,
+			"activitypub.activity.id": activityId ?? ""
+		};
+		if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
+		const actorId = getActivityActorId(activity);
+		if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
+		span.addEvent("activitypub.activity.sent", eventAttributes);
+	} finally {
+		federationMetrics.recordDelivery(inbox, getDurationMs(started), deliverySuccess, activityType);
+	}
+}
+function createFetchError(url, cause) {
+	const error = new FetchError(url, cause instanceof Error ? cause.message : String(cause));
+	error.cause = cause;
+	return error;
+}
+async function fetchWithValidatedRedirects(request, validateUrl) {
+	let body = await request.clone().text();
+	for (let redirects = 0;; redirects++) {
+		const response = await fetch(request, { redirect: "manual" });
+		const location = response.headers.get("Location");
+		if (![
+			301,
+			302,
+			303,
+			307,
+			308
+		].includes(response.status) || location == null) return response;
+		await response.body?.cancel();
+		if (redirects >= 20) throw new TypeError("Too many redirects");
+		const url = new URL(location, request.url);
+		await validateUrl(url.href);
+		const headers = new Headers(request.headers);
+		if (url.origin !== new URL(request.url).origin) {
+			headers.delete("Authorization");
+			headers.delete("Proxy-Authorization");
+			headers.delete("Cookie");
+			headers.delete("Host");
+		}
+		let method = request.method;
+		if ((response.status === 301 || response.status === 302) && method === "POST" || response.status === 303 && method !== "GET" && method !== "HEAD") {
+			method = "GET";
+			body = void 0;
+			for (const name of [
+				"Content-Encoding",
+				"Content-Language",
+				"Content-Length",
+				"Content-Location",
+				"Content-Type"
+			]) headers.delete(name);
+		}
+		request = new Request(url, {
+			method,
+			headers,
+			body,
+			redirect: "manual"
 		});
 	}
-	const jsonLd = await actor.toJsonLd(context);
-	return new Response(JSON.stringify(jsonLd), { headers: {
-		"Content-Type": "application/activity+json",
-		Vary: "Accept"
-	} });
 }
 /**
-* Handles an object request.
-* @template TContextData The context data to pass to the context.
-* @param request The HTTP request.
-* @param parameters The parameters for handling the object.
-* @returns A promise that resolves to an HTTP response.
+* An error that is thrown when an activity fails to send to a remote inbox.
+* It contains structured information about the failure, including the HTTP
+* status code, the inbox URL, and the response body.
+* @since 2.0.0
 */
-async function handleObject(request, { values, context, objectDispatcher, authorizePredicate, onNotFound, onUnauthorized }) {
-	if (objectDispatcher == null) return await onNotFound(request);
-	const object = await objectDispatcher(context, values);
-	if (object == null) return await onNotFound(request);
-	if (authorizePredicate != null) {
-		if (!await authorizePredicate(context, values)) return await onUnauthorized(request);
+var SendActivityError = class extends Error {
+	/**
+	* The inbox URL that the activity was being sent to.
+	*/
+	inbox;
+	/**
+	* The HTTP status code returned by the inbox.
+	*/
+	statusCode;
+	/**
+	* The response body from the inbox, if any.  Note that this may be
+	* truncated to a maximum of 1 KiB to prevent excessive memory consumption
+	* when remote servers return large error pages (e.g., Cloudflare error pages).
+	* If truncated, the string will end with `"… (truncated)"`.
+	*/
+	responseBody;
+	/**
+	* The response headers from the inbox.
+	* @since 2.3.0
+	*/
+	responseHeaders;
+	/**
+	* Creates a new {@link SendActivityError}.
+	* @param inbox The inbox URL.
+	* @param statusCode The HTTP status code.
+	* @param message The error message.
+	* @param responseBody The response body.
+	* @param responseHeaders The response headers.
+	*/
+	constructor(inbox, statusCode, message, responseBody, responseHeaders) {
+		super(message);
+		this.name = "SendActivityError";
+		this.inbox = inbox;
+		this.statusCode = statusCode;
+		this.responseBody = responseBody;
+		this.responseHeaders = new Headers(responseHeaders);
 	}
-	const jsonLd = await object.toJsonLd(context);
-	return new Response(JSON.stringify(jsonLd), { headers: {
-		"Content-Type": "application/activity+json",
-		Vary: "Accept"
-	} });
-}
+};
+//#endregion
+//#region src/federation/portable-inbox.ts
+const MAX_TIMEOUT_MS = 2 ** 31 - 1;
 /**
-* Handles an FEP-ef61 gateway request for a portable object through an object
-* dispatcher.  The object is served only if its ID canonically matches the
-* requested portable ID and it satisfies the FEP-ef61 proof policy.
-* @template TContextData The context data to pass to the context.
-* @param request The HTTP request.
-* @param parameters The parameters for handling the portable object.
-* @returns A promise that resolves to an HTTP response.
+* Fills in the defaults of {@link PortableInboxForwardingOptions} and
+* validates them.
+* @param options The options.
+* @returns The resolved options.
+* @throws {RangeError} If `maxTargets` is not a non-negative integer, if `ttl`
+*                      is not positive, if `deadline` is negative or longer
+*                      than 2,147,483,647 milliseconds (about 24.8 days), or
+*                      if either duration has calendar units, i.e., weeks,
+*                      months, or years, whose length depends on the date.
 */
-async function handlePortableObject(request, { values, context, objectDispatcher, authorizePredicate, canonicalId, onNotFound, onUnauthorized }) {
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"object"
-	]);
-	if (objectDispatcher == null) return await onNotFound(request);
-	const object = await objectDispatcher(context, values);
-	if (object == null) return await onNotFound(request);
-	if (!isRequestedPortableObject(object, canonicalId)) {
-		logger.debug("The object {objectId} does not match the requested portable object {portableId}.", {
-			objectId: object.id?.href,
-			portableId: canonicalId
-		});
-		return await onNotFound(request);
+function resolvePortableInboxForwardingOptions(options = {}) {
+	const maxTargets = options.maxTargets ?? 10;
+	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
+	const ttl = Temporal.Duration.from(options.ttl ?? { days: 30 });
+	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
+	const deadline = Temporal.Duration.from(options.deadline ?? { seconds: 10 });
+	const deadlineMs = deadline.total("millisecond");
+	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
+	return {
+		maxTargets,
+		ttl,
+		deadline
+	};
+}
+/**
+* Decides whether this server accepts a delivery to a portable inbox on behalf
+* of the given actor, which the actor dispatcher returned for the identifier
+* in the requested inbox path.
+*
+* The actor document comes from the application, so it is trusted as is and
+* its proof is not verified here.
+* @param actor The actor the actor dispatcher returned.
+* @param options The requested DID, the canonical form of the requested inbox
+*                ID, and the origin of this server.
+* @returns The resolution.
+*/
+function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, localOrigin }) {
+	if (actor == null) return {
+		status: "rejected",
+		reason: "notFound"
+	};
+	const id = actor.id;
+	const did = id == null || !isPortableId(id) ? null : getPortableDid(id);
+	if (id == null || did == null) return {
+		status: "rejected",
+		reason: "notPortable"
+	};
+	if (did !== authority) return {
+		status: "rejected",
+		reason: "authorityMismatch"
+	};
+	const inboxId = actor.inboxId == null ? null : toPortableUri(actor.inboxId);
+	if (inboxId == null || getCanonicalPortableId(inboxId) !== canonicalInboxId) return {
+		status: "rejected",
+		reason: "inboxMismatch"
+	};
+	const gateways = actor.gateways;
+	if (!gateways.some((g) => isGatewayUrl(g) && g.origin === localOrigin)) return {
+		status: "rejected",
+		reason: "notGateway"
+	};
+	return {
+		status: "accepted",
+		recipient: {
+			actorId: id,
+			inboxId,
+			canonicalInboxId,
+			gateways
+		}
+	};
+}
+/**
+* Gets the portable form of an `ap:` or `ap+ef61:` URI or a compatible
+* identifier, keeping its query.
+* @returns The portable URI, or `null` if the ID is neither, or is malformed.
+*/
+function toPortableUri(id) {
+	if (isPortableUri(id)) return id;
+	try {
+		return fromCompatibleEf61Id(id);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
 	}
-	if (authorizePredicate != null) {
-		if (!await authorizePredicate(context, values)) return await onUnauthorized(request);
+}
+const RFC9421_DELIVERY_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"content-digest"
+];
+const DRAFT_DELIVERY_COMPONENTS = [
+	"(request-target)",
+	"host",
+	"digest"
+];
+/**
+* Checks whether an HTTP Signature covers the method, the target URI, and the
+* body of a request, which both Fedify and Mitra sign when forwarding.
+* @param signature The signature.
+* @returns `true` if the signature covers them.
+*/
+function coversDelivery(signature) {
+	return (signature.label == null ? DRAFT_DELIVERY_COMPONENTS : RFC9421_DELIVERY_COMPONENTS).every((name) => signature.components.some((c) => c.value === name && Object.keys(c.params).length < 1));
+}
+/**
+* Forwards an activity received in a portable inbox to the inboxes of the same
+* portable actor on its other gateways, as FEP-ef61 recommends.
+*
+* FEP-ef61 forbids forwarding an activity from an inbox more than once, so
+* each target gateway is claimed with an atomic compare-and-swap before the
+* activity is handed off, and a claim is never released, even if the hand-off
+* fails, since a failed hand-off does not prove that nothing was delivered.
+* Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
+* forwarded.
+*
+* Forwarded requests are signed with HTTP Signatures by the RSA key among
+* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
+* servers requiring HTTP Signatures accept them, and are sent unsigned
+* otherwise.  Either way, the receiving gateways authenticate the activity by
+* its own proof.
+*
+* If the delivery is signed with a gateway key of the recipient by one of its
+* other gateways, that gateway has the activity already, so it is claimed
+* without forwarding the activity to it.  See {@link identifySendingGateway}.
+* @param parameters The parameters.
+* @returns The target inbox URLs that the activity was handed off to.
+*/
+async function forwardPortableInboxActivity(parameters) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
+	const options = parameters.options ?? resolvePortableInboxForwardingOptions();
+	const { maxTargets, ttl } = options;
+	if (kv.cas == null || maxTargets < 1) return [];
+	const deadline = Date.now() + options.deadline.total("millisecond");
+	const canonicalActivityId = getCanonicalPortableId(activityId) ?? activityId.href;
+	const claimKey = (gateway) => [
+		...kvPrefix,
+		recipient.canonicalInboxId,
+		canonicalActivityId,
+		gateway
+	];
+	let targets = getForwardingTargets(recipient, excludedOrigins);
+	const sender = await identifySendingGateway(parameters, targets.map((t) => t.gateway), claimKey, deadline);
+	if (sender != null) {
+		logger.debug("Not forwarding activity {activityId} from the portable inbox {inbox} back to the gateway {gateway}, which delivered it.", {
+			activityId: activityId.href,
+			inbox: recipient.canonicalInboxId,
+			gateway: sender
+		});
+		await kv.cas(claimKey(sender), void 0, true, { ttl });
+		targets = targets.filter((t) => t.gateway !== sender);
 	}
-	let jsonLd;
-	let servedId;
-	let result;
-	try {
-		jsonLd = await object.toJsonLd(context);
-		servedId = await getJsonLdRootId(jsonLd, context.contextLoader);
-		result = await verifyPortableObjectProof(jsonLd, {
-			contextLoader: context.contextLoader,
-			documentLoader: context.documentLoader,
-			tracerProvider: context.tracerProvider,
-			meterProvider: context.meterProvider
+	if (targets.length > maxTargets) {
+		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
+			inbox: recipient.canonicalInboxId,
+			activityId: activityId.href,
+			max: maxTargets
 		});
-	} catch (error) {
-		logger.error("Failed to verify the Object Integrity Proofs of the portable object {portableId}:\n{error}", {
-			portableId: canonicalId,
+		targets.length = maxTargets;
+	}
+	const claimed = [];
+	for (const { gateway, inbox } of targets) if (await kv.cas(claimKey(gateway), void 0, true, { ttl })) claimed.push(inbox);
+	if (claimed.length < 1) return [];
+	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		targets: claimed.map((t) => t.href)
+	});
+	if (outboxQueue == null) await forwardImmediately(parameters, claimed, deadline);
+	else await enqueueForwarding(parameters, outboxQueue, claimed);
+	return claimed;
+}
+/**
+* Identifies the gateway of the recipient that forwarded a delivery to its
+* portable inbox, by the delivery's HTTP Signature made with the recipient's
+* gateway key, which FEP-ef61 has each gateway use for requests on behalf of
+* an actor.  Since the activity is authenticated by its own proof, the
+* signature only tells which gateway to skip, and a delivery whose signature
+* is invalid or cannot be verified is still forwarded to every gateway.
+*
+* Verifying the signature fetches the recipient's actor document from the
+* sending gateway, as gateway keys are not cached, so only the first signature
+* that may save a request is verified: one that covers the delivery and names
+* a gateway key of the recipient on one of the forwarding targets that the
+* activity has not been forwarded to yet.
+* @param parameters The forwarding parameters.
+* @param targets The origins of the gateways to forward to.
+* @param claimKey Gets the key of the claim for a gateway.
+* @param deadline The time by which identification has to finish, in
+*                 milliseconds since the epoch; afterwards, the sending
+*                 gateway is left unidentified.
+* @returns The origin of the sending gateway, or `null` if it is not
+*          identified.
+*/
+async function identifySendingGateway({ recipient, activityId, kv, signatures }, targets, claimKey, deadline) {
+	if (signatures == null || signatures.length < 1) return null;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const actorId = getCanonicalPortableId(recipient.actorId);
+	if (actorId == null) return null;
+	const isGatewayKeyOfRecipient = (keyId) => {
+		if (!isCompatibleKeyId(keyId) || !targets.includes(keyId.origin)) return false;
+		const base = new URL(keyId.href);
+		base.hash = "";
+		return getCanonicalPortableId(base) === actorId;
+	};
+	let signature;
+	for (const candidate of signatures) if (candidate.coversDelivery && isGatewayKeyOfRecipient(candidate.keyId) && await kv.get(claimKey(candidate.keyId.origin)) === void 0) {
+		signature = candidate;
+		break;
+	}
+	if (signature == null) return null;
+	const { keyId } = signature;
+	const logProperties = {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		keyId: keyId.href
+	};
+	const verification = Promise.resolve().then(() => signature.verify()).then((key) => {
+		if (key == null) logger.debug("The HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} is not verified with the key {keyId}; forwarding it without identifying the sending gateway.", logProperties);
+		return key;
+	}, (error) => {
+		logger.debug("Failed to verify the HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} with the key {keyId}; forwarding it without identifying the sending gateway:\n{error}", {
+			...logProperties,
 			error
 		});
-		return portableObjectInternalServerError(request);
-	}
-	if (servedId == null || !isRequestedPortableId(servedId, canonicalId)) {
-		logger.debug("The serialized object does not match the requested portable object {portableId}.", { portableId: canonicalId });
-		return await onNotFound(request);
+		return null;
+	});
+	let timer;
+	const key = await Promise.race([verification, new Promise((resolve) => {
+		timer = setTimeout(() => {
+			logger.debug("Verifying the HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} did not finish in time; forwarding it without identifying the sending gateway.", logProperties);
+			resolve(null);
+		}, Math.max(0, deadline - Date.now()));
+	})]);
+	clearTimeout(timer);
+	if (key == null) return null;
+	if (key.id == null || key.id.href !== keyId.href || !isGatewayKeyOfRecipient(key.id) || key.ownerId == null || !isPortableId(key.ownerId) || getCanonicalPortableId(key.ownerId) !== actorId) {
+		logger.debug("The delivery of activity {activityId} to the portable inbox {inbox} is not signed with a gateway key of the recipient; forwarding it without identifying the sending gateway.", logProperties);
+		return null;
 	}
-	if (!result.verified && result.reason.type !== "unsecuredCollection" && result.reason.type !== "unsupportedObjectType") {
-		logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, and objects need an Object Integrity Proof made with a key of the DID in their ID.", {
-			portableId: canonicalId,
-			reason: result.reason.type
+	return key.id.origin;
+}
+function getForwardingTargets(recipient, excludedOrigins) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const seen = new Set(excludedOrigins);
+	const targets = [];
+	for (const gateway of recipient.gateways) {
+		if (!isGatewayUrl(gateway) || seen.has(gateway.origin)) continue;
+		seen.add(gateway.origin);
+		let inbox;
+		try {
+			inbox = toCompatibleEf61Id(recipient.inboxId, gateway.origin);
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			logger.warn("Cannot forward to the gateway {gateway}, as the portable inbox {inbox} cannot be represented as its compatible identifier.", {
+				gateway: gateway.origin,
+				inbox: recipient.canonicalInboxId
+			});
+			continue;
+		}
+		targets.push({
+			gateway: gateway.origin,
+			inbox
 		});
-		return portableObjectInternalServerError(request);
 	}
-	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), { headers: {
-		"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
-		Vary: "Accept"
-	} });
+	return targets;
 }
-function isRequestedPortableObject(object, canonicalId) {
-	if (object.id == null) return false;
-	if (object.id.protocol !== "ap:" && object.id.protocol !== "ap+ef61:") return false;
+/**
+* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
+* key, as {@link sendActivity} signs requests only with such a key.  Since
+* the targets have already been claimed, the activity is forwarded unsigned
+* rather than not at all if the key cannot be resolved or used.
+*/
+async function resolveForwardingKey({ getKeys, activityId }) {
+	if (getKeys == null) return null;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	let key;
 	try {
-		return canonicalizePortableUri(formatIri(object.id)) === canonicalId;
+		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
 	} catch (error) {
-		if (error instanceof TypeError) return false;
-		throw error;
+		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			activityId: activityId.href,
+			error
+		});
+		return null;
 	}
-}
-async function getJsonLdRootId(jsonLd, contextLoader) {
-	const expanded = await jsonld.expand(jsonLd, {
-		documentLoader: getNormalizationContextLoader(contextLoader),
-		keepFreeFloatingNodes: true
-	});
-	if (expanded.length !== 1) return null;
-	const id = expanded[0]["@id"];
-	return typeof id === "string" ? id : null;
-}
-function isRequestedPortableId(id, canonicalId) {
+	if (key == null) return null;
 	try {
-		return canonicalizePortableUri(id) === canonicalId;
+		validateCryptoKey(key.privateKey, "private");
 	} catch (error) {
-		if (error instanceof TypeError) return false;
-		throw error;
+		if (!(error instanceof TypeError)) throw error;
+		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+		return null;
 	}
+	return key;
 }
-function portableObjectInternalServerError(request) {
-	return new Response(request.method === "HEAD" ? null : "Internal server error.", {
+async function forwardImmediately(parameters, inboxes, deadlineAt) {
+	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, meterProvider, tracerProvider } = parameters;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const deadline = Math.max(0, deadlineAt - Date.now());
+	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
+		activity,
+		activityId: activityId.href,
+		activityType,
+		keys: key == null ? [] : [key],
+		inbox,
+		allowPrivateAddress,
+		specDeterminer,
+		meterProvider,
+		tracerProvider
+	}).catch((error) => {
+		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+			activityId: activityId.href,
+			inbox: inbox.href,
+			error
+		});
+	}))));
+	let timer;
+	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
+		timer = setTimeout(() => resolve(true), deadline);
+	})]);
+	clearTimeout(timer);
+	if (timedOut) logger.warn("Forwarding activity {activityId} to other gateways did not finish in {deadline} ms; responding to the delivery without waiting for it.", {
+		activityId: activityId.href,
+		deadline
+	});
+}
+async function enqueueForwarding(parameters, outboxQueue, inboxes) {
+	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const key = await resolveForwardingKey(parameters);
+	const keys = [];
+	if (key != null) try {
+		keys.push({
+			keyId: key.keyId.href,
+			privateKey: await exportJwk(key.privateKey)
+		});
+	} catch (error) {
+		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+	}
+	startQueue?.();
+	const started = (/* @__PURE__ */ new Date()).toISOString();
+	const traceContext = {};
+	propagation.inject(context.active(), traceContext);
+	await Promise.all(inboxes.map(async (inbox) => {
+		const message = {
+			type: "outbox",
+			id: crypto.randomUUID(),
+			baseUrl,
+			keys,
+			activity,
+			activityId: activityId.href,
+			activityType,
+			inbox: inbox.href,
+			sharedInbox: false,
+			started,
+			attempt: 0,
+			headers: {},
+			traceContext
+		};
+		try {
+			await outboxQueue.enqueue(message);
+		} catch (error) {
+			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+				activityId: activityId.href,
+				inbox: inbox.href,
+				error
+			});
+			return;
+		}
+		recordOutboxEnqueue(meterProvider, outboxQueue, message);
+	}));
+}
+//#endregion
+//#region src/federation/temporal.ts
+function isPlainObject$1(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value);
+}
+function normalizeDateTimeLiteral(value) {
+	return value.substring(19).match(/[Z+-]/) ? value : value + "Z";
+}
+function isMalformedDateTimeLiteral(value) {
+	if (typeof value !== "string") return false;
+	try {
+		Temporal.Instant.from(normalizeDateTimeLiteral(value));
+		return false;
+	} catch {
+		return true;
+	}
+}
+function isMalformedDurationLiteral(value) {
+	if (typeof value !== "string") return false;
+	try {
+		Temporal.Duration.from(value);
+		return false;
+	} catch {
+		return true;
+	}
+}
+const TEMPORAL_DATE_TIME_IRIS = /* @__PURE__ */ new Set([
+	"https://www.w3.org/ns/activitystreams#deleted",
+	"https://www.w3.org/ns/activitystreams#endTime",
+	"https://www.w3.org/ns/activitystreams#published",
+	"https://www.w3.org/ns/activitystreams#startTime",
+	"https://www.w3.org/ns/activitystreams#updated",
+	"http://purl.org/dc/terms/created",
+	"https://w3id.org/security#created"
+]);
+const TEMPORAL_DURATION_IRIS = /* @__PURE__ */ new Set(["https://www.w3.org/ns/activitystreams#duration"]);
+const QUESTION_CLOSED_IRI = "https://www.w3.org/ns/activitystreams#closed";
+const XSD_DATE_TIME_IRI = "http://www.w3.org/2001/XMLSchema#dateTime";
+function hasMalformedExpandedDateTimeLiteral(value) {
+	if (Array.isArray(value)) return value.some(hasMalformedExpandedDateTimeLiteral);
+	return isPlainObject$1(value) && "@value" in value && isMalformedDateTimeLiteral(value["@value"]);
+}
+function hasMalformedExpandedQuestionClosedLiteral(value) {
+	if (Array.isArray(value)) return value.some(hasMalformedExpandedQuestionClosedLiteral);
+	if (!isPlainObject$1(value) || !("@value" in value)) return false;
+	const literal = value["@value"];
+	if (typeof literal === "boolean") return false;
+	if (typeof literal !== "string") return false;
+	if (value["@type"] !== XSD_DATE_TIME_IRI) return false;
+	if (new Date(literal).toString() === "Invalid Date") return false;
+	return isMalformedDateTimeLiteral(literal);
+}
+function hasMalformedExpandedDurationLiteral(value) {
+	if (Array.isArray(value)) return value.some(hasMalformedExpandedDurationLiteral);
+	return isPlainObject$1(value) && "@value" in value && isMalformedDurationLiteral(value["@value"]);
+}
+function hasMalformedKnownTemporalLiteralInternal(value, visited) {
+	if (Array.isArray(value)) return value.some((item) => hasMalformedKnownTemporalLiteralInternal(item, visited));
+	if (!isPlainObject$1(value)) return false;
+	if (visited.has(value)) return false;
+	visited.add(value);
+	if ("@value" in value) return false;
+	for (const [key, child] of Object.entries(value)) {
+		if (TEMPORAL_DATE_TIME_IRIS.has(key)) {
+			if (hasMalformedExpandedDateTimeLiteral(child)) return true;
+			continue;
+		}
+		if (key === QUESTION_CLOSED_IRI) {
+			if (hasMalformedExpandedQuestionClosedLiteral(child)) return true;
+			continue;
+		}
+		if (TEMPORAL_DURATION_IRIS.has(key)) {
+			if (hasMalformedExpandedDurationLiteral(child)) return true;
+			continue;
+		}
+		if (hasMalformedKnownTemporalLiteralInternal(child, visited)) return true;
+	}
+	return false;
+}
+async function hasMalformedKnownTemporalLiteral(value, contextLoader) {
+	try {
+		return hasMalformedKnownTemporalLiteralInternal(await jsonld.expand(value, {
+			documentLoader: getNormalizationContextLoader(contextLoader),
+			keepFreeFloatingNodes: true
+		}), /* @__PURE__ */ new Set());
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/federation/handler.ts
+const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
+const INBOX_COMPOUND_PROOF_LIMITS = {
+	maxDepth: 64,
+	maxMaps: 1e4,
+	maxProofs: 32,
+	maxBytes: 10 * 1024 * 1024
+};
+function isRemoteContextLoadingFailure$1(error) {
+	return error instanceof Error && typeof error.details === "object" && error.details != null && error.details.code === "loading remote context failed";
+}
+function isPermanentRemoteContextError$1(error) {
+	if (!(error instanceof Error) || error.name !== "jsonld.InvalidUrl") return false;
+	const details = error.details;
+	if (details?.code === "invalid remote context") return true;
+	return isRemoteContextLoadingFailure$1(error) && typeof details?.url === "string" && !URL.canParse(details.url) && isClearlyMalformedContextReference(details.url);
+}
+function isInvalidJsonLdError(error) {
+	if (!(error instanceof Error)) return false;
+	const name = error.name;
+	return name === "UnsafeJsonLdError" || error instanceof InvalidContextReferenceError || isPermanentRemoteContextError$1(error) || name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure$1(error);
+}
+function isValidationTypeError(error) {
+	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || isInvalidUrlTypeError(error));
+}
+function isPermanentActivityParseError(error) {
+	return isInvalidJsonLdError(error) || isValidationTypeError(error);
+}
+function hasHttpSignatureHeaders(request) {
+	return request.headers.has("Signature") || request.headers.has("Signature-Input");
+}
+function hasObjectIntegrityProof(json) {
+	return typeof json === "object" && json != null && "proof" in json;
+}
+/**
+* Handles an actor request.
+* @template TContextData The context data to pass to the context.
+* @param request The HTTP request.
+* @param parameters The parameters for handling the actor.
+* @returns A promise that resolves to an HTTP response.
+*/
+async function handleActor(request, { identifier, context, actorDispatcher, authorizePredicate, onNotFound, onUnauthorized }) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"actor"
+	]);
+	if (actorDispatcher == null) {
+		logger.debug("Actor dispatcher is not set.", { identifier });
+		return await onNotFound(request);
+	}
+	const actor = await actorDispatcher(context, identifier);
+	if (actor == null) {
+		logger.debug("Actor {identifier} not found.", { identifier });
+		return await onNotFound(request);
+	}
+	if (authorizePredicate != null) {
+		if (!await authorizePredicate(context, identifier)) return await onUnauthorized(request);
+	}
+	if (actor instanceof Tombstone) {
+		const jsonLd = await actor.toJsonLd(context);
+		return new Response(JSON.stringify(jsonLd), {
+			status: 410,
+			headers: {
+				"Content-Type": "application/activity+json",
+				Vary: "Accept"
+			}
+		});
+	}
+	const jsonLd = await actor.toJsonLd(context);
+	return new Response(JSON.stringify(jsonLd), { headers: {
+		"Content-Type": "application/activity+json",
+		Vary: "Accept"
+	} });
+}
+/**
+* Handles an object request.
+* @template TContextData The context data to pass to the context.
+* @param request The HTTP request.
+* @param parameters The parameters for handling the object.
+* @returns A promise that resolves to an HTTP response.
+*/
+async function handleObject(request, { values, context, objectDispatcher, authorizePredicate, onNotFound, onUnauthorized }) {
+	if (objectDispatcher == null) return await onNotFound(request);
+	const object = await objectDispatcher(context, values);
+	if (object == null) return await onNotFound(request);
+	if (authorizePredicate != null) {
+		if (!await authorizePredicate(context, values)) return await onUnauthorized(request);
+	}
+	const jsonLd = await object.toJsonLd(context);
+	return new Response(JSON.stringify(jsonLd), { headers: {
+		"Content-Type": "application/activity+json",
+		Vary: "Accept"
+	} });
+}
+/**
+* Handles an FEP-ef61 gateway request for a portable object through an object
+* dispatcher.  The object is served only if its ID canonically matches the
+* requested portable ID and it satisfies the FEP-ef61 proof policy.
+* @template TContextData The context data to pass to the context.
+* @param request The HTTP request.
+* @param parameters The parameters for handling the portable object.
+* @returns A promise that resolves to an HTTP response.
+*/
+async function handlePortableObject(request, { values, context, objectDispatcher, authorizePredicate, canonicalId, onNotFound, onUnauthorized }) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"object"
+	]);
+	if (objectDispatcher == null) return await onNotFound(request);
+	const object = await objectDispatcher(context, values);
+	if (object == null) return await onNotFound(request);
+	if (!isRequestedPortableObject(object, canonicalId)) {
+		logger.debug("The object {objectId} does not match the requested portable object {portableId}.", {
+			objectId: object.id?.href,
+			portableId: canonicalId
+		});
+		return await onNotFound(request);
+	}
+	if (authorizePredicate != null) {
+		if (!await authorizePredicate(context, values)) return await onUnauthorized(request);
+	}
+	let jsonLd;
+	let servedId;
+	let result;
+	try {
+		jsonLd = await object.toJsonLd(context);
+		servedId = await getJsonLdRootId(jsonLd, context.contextLoader);
+		result = await verifyPortableObjectProof(jsonLd, {
+			contextLoader: context.contextLoader,
+			documentLoader: context.documentLoader,
+			tracerProvider: context.tracerProvider,
+			meterProvider: context.meterProvider
+		});
+	} catch (error) {
+		logger.error("Failed to verify the Object Integrity Proofs of the portable object {portableId}:\n{error}", {
+			portableId: canonicalId,
+			error
+		});
+		return portableObjectInternalServerError(request);
+	}
+	if (servedId == null || !isRequestedPortableId(servedId, canonicalId)) {
+		logger.debug("The serialized object does not match the requested portable object {portableId}.", { portableId: canonicalId });
+		return await onNotFound(request);
+	}
+	if (!result.verified && result.reason.type !== "unsecuredCollection" && result.reason.type !== "unsupportedObjectType") {
+		logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, and objects need an Object Integrity Proof made with a key of the DID in their ID.", {
+			portableId: canonicalId,
+			reason: result.reason.type
+		});
+		return portableObjectInternalServerError(request);
+	}
+	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), { headers: {
+		"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
+		Vary: "Accept"
+	} });
+}
+function isRequestedPortableObject(object, canonicalId) {
+	return object.id != null && getCanonicalPortableId(object.id) === canonicalId;
+}
+async function getJsonLdRootId(jsonLd, contextLoader) {
+	const expanded = await jsonld.expand(jsonLd, {
+		documentLoader: getNormalizationContextLoader(contextLoader),
+		keepFreeFloatingNodes: true
+	});
+	if (expanded.length !== 1) return null;
+	const id = expanded[0]["@id"];
+	return typeof id === "string" ? id : null;
+}
+function isRequestedPortableId(id, canonicalId) {
+	if (!/^ap(?:\+ef61)?:\/\//i.test(id)) return URL.canParse(id) && getCanonicalPortableId(new URL(id)) === canonicalId;
+	try {
+		return canonicalizePortableUri(id) === canonicalId;
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+}
+function portableObjectInternalServerError(request) {
+	return new Response(request.method === "HEAD" ? null : "Internal server error.", {
 		status: 500,
 		headers: { "Content-Type": "text/plain; charset=utf-8" }
 	});
@@ -2633,13 +3528,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$1.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$2.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$1),
+		kind: getCollectionMetricKind(name$2),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -2680,7 +3575,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$1, filterPredicate);
+						const items = filterCollectionItems(page.items, name$2, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -2720,7 +3615,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 		} else {
 			const uri = new URL(baseUri);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -2736,7 +3631,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$1, filterPredicate);
+					const items = filterCollectionItems(page.items, name$2, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -3445,7 +4340,7 @@ async function handleInboxInternal(request, parameters, span) {
 			return await respondInvalidActivity(error);
 		}
 		activityVerified = true;
-		if (!skipSignatureVerification && hasPortableActor(activity)) try {
+		if (!skipSignatureVerification && isPortableActivity(activity)) try {
 			proofVerified = await verifyObject(Activity, jsonWithoutSig, {
 				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
 				documentLoader: ctx.documentLoader,
@@ -3629,7 +4524,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
-	if (!skipSignatureVerification && !proofVerified && (hasPortableActor(activity) || isPortableGatewayKey(httpSigKey))) {
+	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableGatewayKey(httpSigKey))) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
 			activity: json,
@@ -3647,6 +4542,32 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	if (!skipSignatureVerification && activity.id != null && isPortableId(activity.id)) {
+		const rejection = await verifyPortableActivityId(activity.id, jsonWithoutSig, {
+			contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
+			documentLoader: ctx.documentLoader,
+			keyCache,
+			meterProvider,
+			tracerProvider
+		});
+		if (rejection != null) {
+			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+			logger.error("The portable activity {activityId} is not authenticated by an Object Integrity Proof of its own DID: {reason}", {
+				activity: json,
+				recipient,
+				activityId: activity.id.href,
+				reason: rejection
+			});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: `The portable activity (${activity.id.href}) is not authenticated by an Object Integrity Proof of its own DID.`
+			});
+			return new Response("Portable activities must have valid Object Integrity Proofs made by their own DIDs.", {
+				status: 401,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+	}
 	if (httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("actorKeyMismatch", httpSigKey.id == null ? void 0 : getRemoteHost(httpSigKey.id));
@@ -3723,7 +4644,21 @@ async function handleInboxInternal(request, parameters, span) {
 		inbox: portableInbox.recipient.canonicalInboxId
 	});
 	else try {
-		await portableInbox.forward(json, activity.id, getTypeId(activity).href);
+		await portableInbox.forward(json, activity.id, getTypeId(activity).href, listRequestSignatures(request).map((signature) => ({
+			keyId: signature.keyId,
+			coversDelivery: coversDelivery(signature),
+			verify: async () => {
+				const verification = await verifyRequestDetailed(selectRequestSignature(request, signature), {
+					contextLoader: ctx.contextLoader,
+					documentLoader: ctx.documentLoader,
+					timeWindow: signatureTimeWindow,
+					keyCache,
+					meterProvider,
+					tracerProvider
+				});
+				return verification.verified ? verification.key : null;
+			}
+		})));
 	} catch (error) {
 		logger.error("Failed to forward activity {activityId} to the other gateways of the portable inbox {inbox}:\n{error}", {
 			activityId: activity.id.href,
@@ -3884,8 +4819,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$2;
+	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
+		this.name = name$1;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -4166,543 +5101,287 @@ function exceptWrapper(handler) {
 			dispatcher: "custom"
 		};
 		try {
-			const response = await handler(request, handlerParams);
-			recordCollectionRequest(meterProvider, collectionAttributes(metricBase, "served", response));
-			return response;
-		} catch (error) {
-			const { onNotFound, onUnauthorized } = handlerParams;
-			switch (error?.constructor) {
-				case ItemsNotFoundError: {
-					const response = await onNotFound(request);
-					recordDeferredPendingCollectionMetrics(error, "not_found", response);
-					recordCollectionRequest(meterProvider, collectionAttributes(metricBase, "not_found", response));
-					return response;
-				}
-				case UnauthorizedError: {
-					const response = await onUnauthorized(request);
-					recordDeferredPendingCollectionMetrics(error, "unauthorized", response);
-					recordCollectionRequest(meterProvider, collectionAttributes(metricBase, "unauthorized", response));
-					return response;
-				}
-				default:
-					recordDeferredPendingCollectionMetrics(error, "error");
-					recordCollectionRequest(meterProvider, collectionAttributes(metricBase, "error"));
-					throw error;
-			}
-		}
-	};
-}
-/**
-* Verifies that a value is defined (not undefined).
-* @template T The type of the value, excluding undefined.
-* @param callbacks The value to verify.
-* @throws {ItemsNotFoundError} If the value is undefined.
-* @since 1.8.0
-*/
-const verifyDefined = (callbacks) => {
-	if (callbacks === void 0) throw new ItemsNotFoundError();
-};
-/**
-* Performs authorization if needed based on the authorization predicate.
-* @template TContextData The context data type.
-* @param {RequestContext<TContextData>} context The request context.
-* @param {Record<string, string>} values The parameter values.
-* @param options Options containing the authorization predicate.
-* @throws {UnauthorizedError} If authorization fails.
-* @since 1.8.0
-*/
-const authIfNeeded = async (context, values, { authorizePredicate: authorize = void 0 }) => {
-	if (authorize === void 0) return;
-	if (!await authorize(context, values)) throw new UnauthorizedError();
-};
-/**
-* Appends a cursor parameter to a URL if the cursor exists.
-* @template Cursor The type of the cursor (string, null, or undefined).
-* @param {URL} url The base URL to append the cursor to.
-* @param {string | null | undefined} cursor The cursor value to append.
-* @returns The URL with cursor appended if cursor is a string, null otherwise.
-* @since 1.8.0
-*/
-const appendCursorIfExists = (url, cursor) => {
-	if (cursor === null || cursor === void 0) return null;
-	const copied = new URL(url);
-	copied.searchParams.set("cursor", cursor);
-	return copied;
-};
-/**
-* Creates an HTTP response for ActivityPub data.
-* @param {unknown} data The data to serialize as JSON-LD.
-* @returns {Response} An HTTP response with the data as ActivityPub JSON.
-* @since 1.8.0
-*/
-const respondAsActivity = (data) => new Response(JSON.stringify(data), { headers: {
-	"Content-Type": "application/activity+json",
-	Vary: "Accept"
-} });
-/**
-* Base class for handler errors.
-* @since 1.8.0
-*/
-var HandlerError = class extends Error {
-	constructor(message) {
-		super(message);
-	}
-	/**
-	* Throws this error.
-	* @returns Never returns, always throws.
-	*/
-	throw() {
-		throw this;
-	}
-};
-/**
-* Error thrown when items are not found in a collection.
-* @since 1.8.0
-*/
-var ItemsNotFoundError = class extends HandlerError {
-	constructor() {
-		super("Items not found in the collection.");
-	}
-};
-/**
-* Error thrown when access to a collection is unauthorized.
-* @since 1.8.0
-*/
-var UnauthorizedError = class extends HandlerError {
-	constructor() {
-		super("Unauthorized access to the collection.");
-	}
-};
-/**
-* Responds with the given object in JSON-LD format.
-*
-* @param object The object to respond with.
-* @param options Options.
-* @since 0.3.0
-*/
-async function respondWithObject(object, options) {
-	const jsonLd = await object.toJsonLd(options);
-	return new Response(JSON.stringify(jsonLd), { headers: { "Content-Type": "application/activity+json" } });
-}
-/**
-* Responds with the given object in JSON-LD format if the request accepts
-* JSON-LD.
-*
-* @param object The object to respond with.
-* @param request The request to check for JSON-LD acceptability.
-* @param options Options.
-* @since 0.3.0
-*/
-async function respondWithObjectIfAcceptable(object, request, options) {
-	if (!acceptsJsonLd(request)) return null;
-	const response = await respondWithObject(object, options);
-	response.headers.set("Vary", "Accept");
-	return response;
-}
-function generateNonce() {
-	const bytes = /* @__PURE__ */ new Uint8Array(16);
-	crypto.getRandomValues(bytes);
-	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-async function verifySignatureNonce(request, kv, noncePrefix, verifiedLabel) {
-	const signatureInput = request.headers.get("Signature-Input");
-	if (signatureInput == null) return false;
-	const parsed = parseRfc9421SignatureInput(signatureInput);
-	if (verifiedLabel == null) return false;
-	const sig = parsed[verifiedLabel];
-	if (sig == null) return false;
-	const nonce = sig.nonce;
-	if (nonce == null) return false;
-	const key = [...noncePrefix, nonce];
-	if (kv.cas != null) return await kv.cas(key, true, void 0);
-	if (await kv.get(key) != null) {
-		await kv.delete(key);
-		return true;
-	}
-	return false;
-}
-const getFailedSignatureResponse = async (policy, kv, kvPrefixes) => {
-	const headers = await getFailedSignatureHeaders(policy, kv, kvPrefixes);
-	return new Response("Failed to verify the request signature.", {
-		status: 401,
-		headers
-	});
-};
-const getFailedSignatureHeaders = async (policy, kv, kvPrefixes) => ({
-	"Content-Type": "text/plain; charset=utf-8",
-	...policy?.enabled && {
-		"Accept-Signature": await buildAcceptSignatureHeader(policy, kv, kvPrefixes.acceptSignatureNonce),
-		"Cache-Control": "no-store",
-		"Vary": "Accept, Signature"
-	}
-});
-async function buildAcceptSignatureHeader(policy, kv, noncePrefix) {
-	const parameters = { created: true };
-	if (policy.requestNonce) {
-		const nonce = generateNonce();
-		await setKey(kv, [...noncePrefix, nonce], policy);
-		parameters.nonce = nonce;
-	}
-	const baseComponents = policy.components ?? DEF_COMPONENTS;
-	return formatAcceptSignature([{
-		label: "sig1",
-		components: uniq(MIN_COMPONENTS.concat(baseComponents)).filter((c) => c !== "@status").map((v) => ({
-			value: v,
-			params: {}
-		})),
-		parameters
-	}]);
-}
-async function setKey(kv, key, policy) {
-	const seconds = policy.nonceTtlSeconds ?? 300;
-	const ttl = Temporal.Duration.from({ seconds });
-	await kv.set(key, true, { ttl });
+			const response = await handler(request, handlerParams);
+			recordCollectionRequest(meterProvider, collectionAttributes(metricBase, "served", response));
+			return response;
+		} catch (error) {
+			const { onNotFound, onUnauthorized } = handlerParams;
+			switch (error?.constructor) {
+				case ItemsNotFoundError: {
+					const response = await onNotFound(request);
+					recordDeferredPendingCollectionMetrics(error, "not_found", response);
+					recordCollectionRequest(meterProvider, collectionAttributes(metricBase, "not_found", response));
+					return response;
+				}
+				case UnauthorizedError: {
+					const response = await onUnauthorized(request);
+					recordDeferredPendingCollectionMetrics(error, "unauthorized", response);
+					recordCollectionRequest(meterProvider, collectionAttributes(metricBase, "unauthorized", response));
+					return response;
+				}
+				default:
+					recordDeferredPendingCollectionMetrics(error, "error");
+					recordCollectionRequest(meterProvider, collectionAttributes(metricBase, "error"));
+					throw error;
+			}
+		}
+	};
 }
-const DEF_COMPONENTS = [
-	"@method",
-	"@target-uri",
-	"@authority",
-	"content-digest"
-];
-const MIN_COMPONENTS = [
-	"@method",
-	"@target-uri",
-	"@authority"
-];
 /**
-* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
-* portable actor, i.e., its ID is a compatible identifier and it is owned by
-* a portable actor, which only the portable actor's signed document can
-* establish.
+* Verifies that a value is defined (not undefined).
+* @template T The type of the value, excluding undefined.
+* @param callbacks The value to verify.
+* @throws {ItemsNotFoundError} If the value is undefined.
+* @since 1.8.0
 */
-function isPortableGatewayKey(key) {
-	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableUri(key.ownerId);
-}
-//#endregion
-//#region src/nodeinfo/handler.ts
+const verifyDefined = (callbacks) => {
+	if (callbacks === void 0) throw new ItemsNotFoundError();
+};
 /**
-* Handles a NodeInfo request.  You would not typically call this function
-* directly, but instead use {@link Federation.handle} method.
-* @param request The NodeInfo request to handle.
-* @param parameters The parameters for handling the request.
-* @returns The response to the request.
+* Performs authorization if needed based on the authorization predicate.
+* @template TContextData The context data type.
+* @param {RequestContext<TContextData>} context The request context.
+* @param {Record<string, string>} values The parameter values.
+* @param options Options containing the authorization predicate.
+* @throws {UnauthorizedError} If authorization fails.
+* @since 1.8.0
 */
-async function handleNodeInfo(_request, { context, nodeInfoDispatcher }) {
-	const promise = nodeInfoDispatcher(context);
-	const json = nodeInfoToJson(promise instanceof Promise ? await promise : promise);
-	return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\"" } });
-}
+const authIfNeeded = async (context, values, { authorizePredicate: authorize = void 0 }) => {
+	if (authorize === void 0) return;
+	if (!await authorize(context, values)) throw new UnauthorizedError();
+};
 /**
-* Handles a request to `/.well-known/nodeinfo`.  You would not typically call
-* this function directly, but instead use {@link Federation.handle} method.
-* @param request The request to handle.
-* @param context The request context.
-* @returns The response to the request.
+* Appends a cursor parameter to a URL if the cursor exists.
+* @template Cursor The type of the cursor (string, null, or undefined).
+* @param {URL} url The base URL to append the cursor to.
+* @param {string | null | undefined} cursor The cursor value to append.
+* @returns The URL with cursor appended if cursor is a string, null otherwise.
+* @since 1.8.0
 */
-function handleNodeInfoJrd(_request, context) {
-	const links = [];
-	try {
-		links.push({
-			rel: "http://nodeinfo.diaspora.software/ns/schema/2.1",
-			href: context.getNodeInfoUri().href,
-			type: "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\""
-		});
-	} catch (e) {
-		if (!(e instanceof RouterError)) throw e;
-	}
-	const response = new Response(JSON.stringify({ links }), { headers: { "Content-Type": "application/jrd+json" } });
-	return Promise.resolve(response);
-}
-//#endregion
-//#region src/federation/send.ts
+const appendCursorIfExists = (url, cursor) => {
+	if (cursor === null || cursor === void 0) return null;
+	const copied = new URL(url);
+	copied.searchParams.set("cursor", cursor);
+	return copied;
+};
 /**
-* Extracts the inbox URLs from recipients.
-* @param parameters The parameters to extract the inboxes.
-*                   See also {@link ExtractInboxesParameters}.
-* @returns The inboxes as a map of inbox URL to actor URIs.
+* Creates an HTTP response for ActivityPub data.
+* @param {unknown} data The data to serialize as JSON-LD.
+* @returns {Response} An HTTP response with the data as ActivityPub JSON.
+* @since 1.8.0
 */
-function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
-	const inboxes = {};
-	for (const recipient of recipients) {
-		let inbox;
-		let sharedInbox = false;
-		if (preferSharedInbox && recipient.endpoints?.sharedInbox != null) {
-			inbox = recipient.endpoints.sharedInbox;
-			sharedInbox = true;
-		} else inbox = recipient.inboxId;
-		if (inbox != null && recipient.id != null) {
-			if (excludeBaseUris != null && excludeBaseUris.some((u) => u.origin === inbox?.origin)) continue;
-			inboxes[inbox.href] ??= {
-				actorIds: /* @__PURE__ */ new Set(),
-				sharedInbox
-			};
-			inboxes[inbox.href].actorIds.add(recipient.id.href);
-		}
-	}
-	return inboxes;
-}
+const respondAsActivity = (data) => new Response(JSON.stringify(data), { headers: {
+	"Content-Type": "application/activity+json",
+	Vary: "Accept"
+} });
 /**
-* Sends an {@link Activity} to an inbox.
-*
-* @param parameters The parameters for sending the activity.
-*                   See also {@link SendActivityParameters}.
-* @throws {Error} If the activity fails to send.
+* Base class for handler errors.
+* @since 1.8.0
 */
-function sendActivity(options) {
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	return tracerProvider.getTracer(name, version).startActiveSpan("activitypub.send_activity", {
-		kind: SpanKind.CLIENT,
-		attributes: { "activitypub.shared_inbox": options.sharedInbox ?? false }
-	}, async (span) => {
-		if (options.activityId != null) span.setAttribute("activitypub.activity.id", options.activityId);
-		if (options.activityType != null) span.setAttribute("activitypub.activity.type", options.activityType);
-		try {
-			await sendActivityInternal({
-				...options,
-				tracerProvider
-			}, span);
-		} catch (e) {
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(e)
-			});
-			throw e;
-		} finally {
-			span.end();
-		}
-	});
-}
-const MAX_ERROR_RESPONSE_BODY_BYTES = 1024;
-function getActivityActorId(activity) {
-	if (!isRecord(activity)) return void 0;
-	return getIdValue(activity.actor);
-}
-function getIdValue(value) {
-	if (typeof value === "string" && value !== "") return value;
-	if (value instanceof URL) return value.href;
-	if (Array.isArray(value)) {
-		for (const item of value) {
-			const id = getIdValue(item);
-			if (id != null) return id;
-		}
-		return;
+var HandlerError = class extends Error {
+	constructor(message) {
+		super(message);
 	}
-	if (isRecord(value)) return getIdValue(value.id);
-}
-function isRecord(value) {
-	return typeof value === "object" && value != null;
-}
-async function readLimitedResponseBody(response, maxBytes) {
-	if (response.body == null) return "";
-	const reader = response.body.getReader();
-	const decoder = new TextDecoder();
-	const chunks = [];
-	let totalBytes = 0;
-	let truncated = false;
-	try {
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			if (totalBytes + value.length > maxBytes) {
-				const remaining = maxBytes - totalBytes;
-				if (remaining > 0) chunks.push(decoder.decode(value.slice(0, remaining), { stream: true }));
-				truncated = true;
-				break;
-			}
-			chunks.push(decoder.decode(value, { stream: true }));
-			totalBytes += value.length;
-		}
-	} finally {
-		reader.releaseLock();
+	/**
+	* Throws this error.
+	* @returns Never returns, always throws.
+	*/
+	throw() {
+		throw this;
 	}
-	let result = chunks.join("");
-	if (truncated) result += "… (truncated)";
-	return result;
-}
-async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span) {
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"outbox"
-	]);
-	const federationMetrics = getFederationMetrics(meterProvider);
-	const started = performance.now();
-	let deliverySuccess = false;
-	async function validateUrl(url) {
-		if (!allowPrivateAddress) try {
-			await validatePublicUrl(url);
-		} catch (error) {
-			if (error instanceof UrlError) logger.error("Disallowed private URL: {url}", {
-				url,
-				error
-			});
-			throw error;
-		}
+};
+/**
+* Error thrown when items are not found in a collection.
+* @since 1.8.0
+*/
+var ItemsNotFoundError = class extends HandlerError {
+	constructor() {
+		super("Items not found in the collection.");
+	}
+};
+/**
+* Error thrown when access to a collection is unauthorized.
+* @since 1.8.0
+*/
+var UnauthorizedError = class extends HandlerError {
+	constructor() {
+		super("Unauthorized access to the collection.");
 	}
-	await validateUrl(inbox.href);
-	headers = new Headers(headers);
-	headers.set("Content-Type", "application/activity+json");
-	const request = new Request(inbox, {
-		method: "POST",
-		headers,
-		body: JSON.stringify(activity),
-		redirect: "manual"
-	});
-	let rsaKey = null;
-	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
-		rsaKey = key;
-		break;
+};
+/**
+* Responds with the given object in JSON-LD format.
+*
+* @param object The object to respond with.
+* @param options Options.
+* @since 0.3.0
+*/
+async function respondWithObject(object, options) {
+	const jsonLd = await object.toJsonLd(options);
+	return new Response(JSON.stringify(jsonLd), { headers: { "Content-Type": "application/activity+json" } });
+}
+/**
+* Responds with the given object in JSON-LD format if the request accepts
+* JSON-LD.
+*
+* @param object The object to respond with.
+* @param request The request to check for JSON-LD acceptability.
+* @param options Options.
+* @since 0.3.0
+*/
+async function respondWithObjectIfAcceptable(object, request, options) {
+	if (!acceptsJsonLd(request)) return null;
+	const response = await respondWithObject(object, options);
+	response.headers.set("Vary", "Accept");
+	return response;
+}
+function generateNonce() {
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	crypto.getRandomValues(bytes);
+	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function verifySignatureNonce(request, kv, noncePrefix, verifiedLabel) {
+	const signatureInput = request.headers.get("Signature-Input");
+	if (signatureInput == null) return false;
+	const parsed = parseRfc9421SignatureInput(signatureInput);
+	if (verifiedLabel == null) return false;
+	const sig = parsed[verifiedLabel];
+	if (sig == null) return false;
+	const nonce = sig.nonce;
+	if (nonce == null) return false;
+	const key = [...noncePrefix, nonce];
+	if (kv.cas != null) return await kv.cas(key, true, void 0);
+	if (await kv.get(key) != null) {
+		await kv.delete(key);
+		return true;
 	}
-	if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
-		activityId,
-		inbox: inbox.href
-	});
-	else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
-		inbox: inbox.href,
-		keys: keys.map((pair) => ({
-			keyId: pair.keyId.href,
-			privateKey: pair.privateKey
-		}))
+	return false;
+}
+const getFailedSignatureResponse = async (policy, kv, kvPrefixes) => {
+	const headers = await getFailedSignatureHeaders(policy, kv, kvPrefixes);
+	return new Response("Failed to verify the request signature.", {
+		status: 401,
+		headers
 	});
-	let response;
-	try {
-		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await doubleKnock(request, rsaKey, {
-			tracerProvider,
-			specDeterminer,
-			validateRedirect: validateUrl
-		});
-	} catch (error) {
-		const failure = error instanceof FetchError || error instanceof UrlError ? error : createFetchError(inbox.href, error);
-		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
-			activityId,
-			inbox: inbox.href,
-			error: failure
-		});
-		federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
-		throw failure;
+};
+const getFailedSignatureHeaders = async (policy, kv, kvPrefixes) => ({
+	"Content-Type": "text/plain; charset=utf-8",
+	...policy?.enabled && {
+		"Accept-Signature": await buildAcceptSignatureHeader(policy, kv, kvPrefixes.acceptSignatureNonce),
+		"Cache-Control": "no-store",
+		"Vary": "Accept, Signature"
 	}
-	try {
-		if (!response.ok) {
-			let error;
-			try {
-				error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
-			} catch (_) {
-				error = "";
-			}
-			logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
-				activityId,
-				inbox: inbox.href,
-				status: response.status,
-				statusText: response.statusText,
-				error
-			});
-			throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error, response.headers);
-		}
-		deliverySuccess = true;
-		const eventAttributes = {
-			"activitypub.inbox.url": inbox.href,
-			"activitypub.activity.id": activityId ?? ""
-		};
-		if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
-		const actorId = getActivityActorId(activity);
-		if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
-		span.addEvent("activitypub.activity.sent", eventAttributes);
-	} finally {
-		federationMetrics.recordDelivery(inbox, getDurationMs(started), deliverySuccess, activityType);
+});
+async function buildAcceptSignatureHeader(policy, kv, noncePrefix) {
+	const parameters = { created: true };
+	if (policy.requestNonce) {
+		const nonce = generateNonce();
+		await setKey(kv, [...noncePrefix, nonce], policy);
+		parameters.nonce = nonce;
 	}
+	const baseComponents = policy.components ?? DEF_COMPONENTS;
+	return formatAcceptSignature([{
+		label: "sig1",
+		components: uniq(MIN_COMPONENTS.concat(baseComponents)).filter((c) => c !== "@status").map((v) => ({
+			value: v,
+			params: {}
+		})),
+		parameters
+	}]);
 }
-function createFetchError(url, cause) {
-	const error = new FetchError(url, cause instanceof Error ? cause.message : String(cause));
-	error.cause = cause;
-	return error;
+async function setKey(kv, key, policy) {
+	const seconds = policy.nonceTtlSeconds ?? 300;
+	const ttl = Temporal.Duration.from({ seconds });
+	await kv.set(key, true, { ttl });
 }
-async function fetchWithValidatedRedirects(request, validateUrl) {
-	let body = await request.clone().text();
-	for (let redirects = 0;; redirects++) {
-		const response = await fetch(request, { redirect: "manual" });
-		const location = response.headers.get("Location");
-		if (![
-			301,
-			302,
-			303,
-			307,
-			308
-		].includes(response.status) || location == null) return response;
-		await response.body?.cancel();
-		if (redirects >= 20) throw new TypeError("Too many redirects");
-		const url = new URL(location, request.url);
-		await validateUrl(url.href);
-		const headers = new Headers(request.headers);
-		if (url.origin !== new URL(request.url).origin) {
-			headers.delete("Authorization");
-			headers.delete("Proxy-Authorization");
-			headers.delete("Cookie");
-			headers.delete("Host");
-		}
-		let method = request.method;
-		if ((response.status === 301 || response.status === 302) && method === "POST" || response.status === 303 && method !== "GET" && method !== "HEAD") {
-			method = "GET";
-			body = void 0;
-			for (const name of [
-				"Content-Encoding",
-				"Content-Language",
-				"Content-Length",
-				"Content-Location",
-				"Content-Type"
-			]) headers.delete(name);
-		}
-		request = new Request(url, {
-			method,
-			headers,
-			body,
-			redirect: "manual"
-		});
-	}
+const DEF_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"@authority",
+	"content-digest"
+];
+const MIN_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"@authority"
+];
+/**
+* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
+* portable actor, i.e., its ID is a compatible identifier and it is owned by
+* a portable actor, which only the portable actor's signed document can
+* establish.
+*/
+function isPortableGatewayKey(key) {
+	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
 }
 /**
-* An error that is thrown when an activity fails to send to a remote inbox.
-* It contains structured information about the failure, including the HTTP
-* status code, the inbox URL, and the response body.
-* @since 2.0.0
+* Checks whether an activity needs an Object Integrity Proof by its DID:
+* either it is performed by an [FEP-ef61] portable actor, or its own ID is
+* portable.  Both `ap:` URIs and compatible identifiers count as portable.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
 */
-var SendActivityError = class extends Error {
-	/**
-	* The inbox URL that the activity was being sent to.
-	*/
-	inbox;
-	/**
-	* The HTTP status code returned by the inbox.
-	*/
-	statusCode;
-	/**
-	* The response body from the inbox, if any.  Note that this may be
-	* truncated to a maximum of 1 KiB to prevent excessive memory consumption
-	* when remote servers return large error pages (e.g., Cloudflare error pages).
-	* If truncated, the string will end with `"… (truncated)"`.
-	*/
-	responseBody;
-	/**
-	* The response headers from the inbox.
-	* @since 2.3.0
-	*/
-	responseHeaders;
-	/**
-	* Creates a new {@link SendActivityError}.
-	* @param inbox The inbox URL.
-	* @param statusCode The HTTP status code.
-	* @param message The error message.
-	* @param responseBody The response body.
-	* @param responseHeaders The response headers.
-	*/
-	constructor(inbox, statusCode, message, responseBody, responseHeaders) {
-		super(message);
-		this.name = "SendActivityError";
-		this.inbox = inbox;
-		this.statusCode = statusCode;
-		this.responseBody = responseBody;
-		this.responseHeaders = new Headers(responseHeaders);
+function isPortableActivity(activity) {
+	return hasPortableActor(activity) || activity.id != null && isPortableId(activity.id);
+}
+/**
+* Verifies that a portable activity's own ID belongs to the DID that signed
+* it, on the JSON-LD document received.  The ID the proof policy checks has
+* to be the parsed activity's ID, so that a remote context that changes
+* between loads cannot make the two name different objects.
+* @returns `null` if the ID is verified, or the reason why it is not.
+*/
+async function verifyPortableActivityId(activityId, jsonLd, options) {
+	const expectedId = getCanonicalPortableId(activityId);
+	if (expectedId == null) return "malformed portable ID";
+	let verification;
+	try {
+		verification = await verifyPortableObjectProofWithRoot(jsonLd, options);
+	} catch (error) {
+		if (error instanceof InvalidPortableObjectIdError) return "malformed portable ID";
+		if (!isPermanentActivityParseError(error)) throw error;
+		return "malformed document";
 	}
-};
+	const { result, root } = verification;
+	if (!result.verified) return result.reason.type;
+	const rootId = root?.["@id"];
+	if (typeof rootId !== "string" || getCanonicalPortableId(parseIri(rootId)) !== expectedId) return "the verified document has another ID";
+	return null;
+}
+//#endregion
+//#region src/nodeinfo/handler.ts
+/**
+* Handles a NodeInfo request.  You would not typically call this function
+* directly, but instead use {@link Federation.handle} method.
+* @param request The NodeInfo request to handle.
+* @param parameters The parameters for handling the request.
+* @returns The response to the request.
+*/
+async function handleNodeInfo(_request, { context, nodeInfoDispatcher }) {
+	const promise = nodeInfoDispatcher(context);
+	const json = nodeInfoToJson(promise instanceof Promise ? await promise : promise);
+	return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\"" } });
+}
+/**
+* Handles a request to `/.well-known/nodeinfo`.  You would not typically call
+* this function directly, but instead use {@link Federation.handle} method.
+* @param request The request to handle.
+* @param context The request context.
+* @returns The response to the request.
+*/
+function handleNodeInfoJrd(_request, context) {
+	const links = [];
+	try {
+		links.push({
+			rel: "http://nodeinfo.diaspora.software/ns/schema/2.1",
+			href: context.getNodeInfoUri().href,
+			type: "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\""
+		});
+	} catch (e) {
+		if (!(e instanceof RouterError)) throw e;
+	}
+	const response = new Response(JSON.stringify({ links }), { headers: { "Content-Type": "application/jrd+json" } });
+	return Promise.resolve(response);
+}
 //#endregion
 //#region src/federation/bench.ts
 /**
@@ -4799,438 +5478,151 @@ async function handleBenchmarkTrigger(request, context, options = {}) {
 		}, 403);
 		await context.sendActivity(sender, recipients, activity);
 		return jsonResponse({
-			version: 1,
-			activityId,
-			queueCorrelationId: activityId,
-			recipientCount: recipients.length,
-			inboxCount: inboxUrls.length
-		}, 202);
-	} catch (error) {
-		if (error instanceof BenchmarkTriggerError) return jsonResponse({ error: error.message }, error.status);
-		throw error;
-	}
-}
-var BenchmarkTriggerError = class extends Error {
-	status;
-	constructor(message, status = 400) {
-		super(message);
-		this.status = status;
-	}
-};
-function parseSender(value) {
-	const sender = asRecord(value, "sender");
-	if (typeof sender.identifier === "string") return { identifier: sender.identifier };
-	if (typeof sender.username === "string") return { username: sender.username };
-	throw new BenchmarkTriggerError("sender must be { identifier } or { username }.");
-}
-async function parseRecipients(value, context) {
-	if (!Array.isArray(value)) throw new BenchmarkTriggerError("recipients must be an array.");
-	return await Promise.all(value.map(async (item) => {
-		let object;
-		try {
-			object = await Object$1.fromJsonLd(item, {
-				documentLoader: context.documentLoader,
-				contextLoader: context.contextLoader
-			});
-		} catch (error) {
-			throw new BenchmarkTriggerError(`Invalid ActivityPub recipient: ${error}`);
-		}
-		if (!isRecipient(object)) throw new BenchmarkTriggerError("each recipient must be an ActivityPub actor.");
-		const recipient = object;
-		if (recipient.id == null || recipient.inboxId == null) throw new BenchmarkTriggerError("each recipient must have id and inbox properties.");
-		return recipient;
-	}));
-}
-function isRecipient(value) {
-	return value != null && typeof value === "object" && "id" in value && "inboxId" in value;
-}
-async function parseActivity(value, context) {
-	try {
-		return await Activity.fromJsonLd(value, {
-			documentLoader: context.documentLoader,
-			contextLoader: context.contextLoader
-		});
-	} catch (error) {
-		throw new BenchmarkTriggerError(`Invalid ActivityPub activity: ${error}`);
-	}
-}
-function asRecord(value, name) {
-	if (value == null || typeof value !== "object" || Array.isArray(value)) throw new BenchmarkTriggerError(`${name} must be an object.`);
-	return value;
-}
-function jsonResponse(body, status = 200) {
-	return new Response(JSON.stringify(body), {
-		status,
-		headers: { "Content-Type": "application/json" }
-	});
-}
-function serializeScopeMetrics(resourceMetrics) {
-	return resourceMetrics.scopeMetrics.map(serializeScope);
-}
-function serializeScope(scopeMetrics) {
-	return {
-		scope: {
-			name: scopeMetrics.scope.name,
-			version: scopeMetrics.scope.version
-		},
-		metrics: scopeMetrics.metrics.map(serializeMetric)
-	};
-}
-function serializeMetric(metric) {
-	return {
-		name: metric.descriptor.name,
-		description: metric.descriptor.description,
-		unit: metric.descriptor.unit,
-		dataPointType: serializeDataPointType(metric.dataPointType),
-		dataPoints: metric.dataPoints.map((point) => ({
-			attributes: { ...point.attributes },
-			startTime: point.startTime,
-			endTime: point.endTime,
-			value: point.value
-		}))
-	};
-}
-function serializeDataPointType(dataPointType) {
-	switch (dataPointType) {
-		case DataPointType.HISTOGRAM: return "histogram";
-		case DataPointType.EXPONENTIAL_HISTOGRAM: return "exponential_histogram";
-		case DataPointType.GAUGE: return "gauge";
-		case DataPointType.SUM: return "sum";
-	}
-}
-//#endregion
-//#region src/federation/portable-inbox.ts
-const MAX_TIMEOUT_MS = 2 ** 31 - 1;
-/**
-* Fills in the defaults of {@link PortableInboxForwardingOptions} and
-* validates them.
-* @param options The options.
-* @returns The resolved options.
-* @throws {RangeError} If `maxTargets` is not a non-negative integer, if `ttl`
-*                      is not positive, if `deadline` is negative or longer
-*                      than 2,147,483,647 milliseconds (about 24.8 days), or
-*                      if either duration has calendar units, i.e., weeks,
-*                      months, or years, whose length depends on the date.
-*/
-function resolvePortableInboxForwardingOptions(options = {}) {
-	const maxTargets = options.maxTargets ?? 10;
-	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
-	const ttl = Temporal.Duration.from(options.ttl ?? { days: 30 });
-	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
-	const deadline = Temporal.Duration.from(options.deadline ?? { seconds: 10 });
-	const deadlineMs = deadline.total("millisecond");
-	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
-	return {
-		maxTargets,
-		ttl,
-		deadline
-	};
-}
-/**
-* Decides whether this server accepts a delivery to a portable inbox on behalf
-* of the given actor, which the actor dispatcher returned for the identifier
-* in the requested inbox path.
-*
-* The actor document comes from the application, so it is trusted as is and
-* its proof is not verified here.
-* @param actor The actor the actor dispatcher returned.
-* @param options The requested DID, the canonical form of the requested inbox
-*                ID, and the origin of this server.
-* @returns The resolution.
-*/
-function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, localOrigin }) {
-	if (actor == null) return {
-		status: "rejected",
-		reason: "notFound"
-	};
-	const id = actor.id;
-	if (id == null || id.protocol !== "ap:" && id.protocol !== "ap+ef61:") return {
-		status: "rejected",
-		reason: "notPortable"
-	};
-	if (!isSameAuthority(id, authority)) return {
-		status: "rejected",
-		reason: "authorityMismatch"
-	};
-	const inboxId = actor.inboxId;
-	if (inboxId == null || canonicalize(inboxId) !== canonicalInboxId) return {
-		status: "rejected",
-		reason: "inboxMismatch"
-	};
-	const gateways = actor.gateways;
-	if (!gateways.some((g) => isGatewayUrl(g) && g.origin === localOrigin)) return {
-		status: "rejected",
-		reason: "notGateway"
-	};
-	return {
-		status: "accepted",
-		recipient: {
-			actorId: id,
-			inboxId,
-			canonicalInboxId,
-			gateways
-		}
-	};
-}
-function isSameAuthority(id, authority) {
-	try {
-		return getFe34Origin(id) === authority;
-	} catch (error) {
-		if (error instanceof TypeError) return false;
-		throw error;
-	}
-}
-function canonicalize(iri) {
-	try {
-		return canonicalizePortableUri(typeof iri === "string" ? iri : formatIri(iri));
-	} catch (error) {
-		if (error instanceof TypeError) return null;
-		throw error;
-	}
-}
-/**
-* Forwards an activity received in a portable inbox to the inboxes of the same
-* portable actor on its other gateways, as FEP-ef61 recommends.
-*
-* FEP-ef61 forbids forwarding an activity from an inbox more than once, so
-* each target gateway is claimed with an atomic compare-and-swap before the
-* activity is handed off, and a claim is never released, even if the hand-off
-* fails, since a failed hand-off does not prove that nothing was delivered.
-* Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
-* forwarded.
-*
-* Forwarded requests are signed with HTTP Signatures by the RSA key among
-* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
-* servers requiring HTTP Signatures accept them, and are sent unsigned
-* otherwise.  Either way, the receiving gateways authenticate the activity by
-* its own proof.
-* @param parameters The parameters.
-* @returns The target inbox URLs that the activity was handed off to.
-*/
-async function forwardPortableInboxActivity(parameters) {
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
-	const { maxTargets, ttl } = parameters.options ?? resolvePortableInboxForwardingOptions();
-	if (kv.cas == null || maxTargets < 1) return [];
-	const canonicalActivityId = canonicalize(activityId) ?? activityId.href;
-	const targets = getForwardingTargets(recipient, excludedOrigins);
-	if (targets.length > maxTargets) {
-		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
-			inbox: recipient.canonicalInboxId,
-			activityId: activityId.href,
-			max: maxTargets
-		});
-		targets.length = maxTargets;
+			version: 1,
+			activityId,
+			queueCorrelationId: activityId,
+			recipientCount: recipients.length,
+			inboxCount: inboxUrls.length
+		}, 202);
+	} catch (error) {
+		if (error instanceof BenchmarkTriggerError) return jsonResponse({ error: error.message }, error.status);
+		throw error;
 	}
-	const claimed = [];
-	for (const { gateway, inbox } of targets) {
-		const key = [
-			...kvPrefix,
-			recipient.canonicalInboxId,
-			canonicalActivityId,
-			gateway
-		];
-		if (await kv.cas(key, void 0, true, { ttl })) claimed.push(inbox);
+}
+var BenchmarkTriggerError = class extends Error {
+	status;
+	constructor(message, status = 400) {
+		super(message);
+		this.status = status;
 	}
-	if (claimed.length < 1) return [];
-	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
-		activityId: activityId.href,
-		inbox: recipient.canonicalInboxId,
-		targets: claimed.map((t) => t.href)
-	});
-	if (outboxQueue == null) await forwardImmediately(parameters, claimed);
-	else await enqueueForwarding(parameters, outboxQueue, claimed);
-	return claimed;
+};
+function parseSender(value) {
+	const sender = asRecord(value, "sender");
+	if (typeof sender.identifier === "string") return { identifier: sender.identifier };
+	if (typeof sender.username === "string") return { username: sender.username };
+	throw new BenchmarkTriggerError("sender must be { identifier } or { username }.");
 }
-function getForwardingTargets(recipient, excludedOrigins) {
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const seen = new Set(excludedOrigins);
-	const targets = [];
-	for (const gateway of recipient.gateways) {
-		if (!isGatewayUrl(gateway) || seen.has(gateway.origin)) continue;
-		seen.add(gateway.origin);
-		let inbox;
+async function parseRecipients(value, context) {
+	if (!Array.isArray(value)) throw new BenchmarkTriggerError("recipients must be an array.");
+	return await Promise.all(value.map(async (item) => {
+		let object;
 		try {
-			inbox = toCompatibleEf61Id(recipient.inboxId, gateway.origin);
-		} catch (error) {
-			if (!(error instanceof TypeError)) throw error;
-			logger.warn("Cannot forward to the gateway {gateway}, as the portable inbox {inbox} cannot be represented as its compatible identifier.", {
-				gateway: gateway.origin,
-				inbox: recipient.canonicalInboxId
+			object = await Object$1.fromJsonLd(item, {
+				documentLoader: context.documentLoader,
+				contextLoader: context.contextLoader
 			});
-			continue;
+		} catch (error) {
+			throw new BenchmarkTriggerError(`Invalid ActivityPub recipient: ${error}`);
 		}
-		targets.push({
-			gateway: gateway.origin,
-			inbox
-		});
-	}
-	return targets;
+		if (!isRecipient(object)) throw new BenchmarkTriggerError("each recipient must be an ActivityPub actor.");
+		const recipient = object;
+		if (recipient.id == null || recipient.inboxId == null) throw new BenchmarkTriggerError("each recipient must have id and inbox properties.");
+		return recipient;
+	}));
 }
-/**
-* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
-* key, as {@link sendActivity} signs requests only with such a key.  Since
-* the targets have already been claimed, the activity is forwarded unsigned
-* rather than not at all if the key cannot be resolved or used.
-*/
-async function resolveForwardingKey({ getKeys, activityId }) {
-	if (getKeys == null) return null;
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	let key;
+function isRecipient(value) {
+	return value != null && typeof value === "object" && "id" in value && "inboxId" in value;
+}
+async function parseActivity(value, context) {
 	try {
-		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
-	} catch (error) {
-		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			activityId: activityId.href,
-			error
+		return await Activity.fromJsonLd(value, {
+			documentLoader: context.documentLoader,
+			contextLoader: context.contextLoader
 		});
-		return null;
-	}
-	if (key == null) return null;
-	try {
-		validateCryptoKey(key.privateKey, "private");
 	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			keyId: key.keyId.href,
-			activityId: activityId.href,
-			error
-		});
-		return null;
+		throw new BenchmarkTriggerError(`Invalid ActivityPub activity: ${error}`);
 	}
-	return key;
 }
-async function forwardImmediately(parameters, inboxes) {
-	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, options, meterProvider, tracerProvider } = parameters;
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const deadline = (options ?? resolvePortableInboxForwardingOptions()).deadline.total("millisecond");
-	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
-		activity,
-		activityId: activityId.href,
-		activityType,
-		keys: key == null ? [] : [key],
-		inbox,
-		allowPrivateAddress,
-		specDeterminer,
-		meterProvider,
-		tracerProvider
-	}).catch((error) => {
-		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
-			activityId: activityId.href,
-			inbox: inbox.href,
-			error
-		});
-	}))));
-	let timer;
-	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
-		timer = setTimeout(() => resolve(true), deadline);
-	})]);
-	clearTimeout(timer);
-	if (timedOut) logger.warn("Forwarding activity {activityId} to other gateways did not finish in {deadline} ms; responding to the delivery without waiting for it.", {
-		activityId: activityId.href,
-		deadline
+function asRecord(value, name) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) throw new BenchmarkTriggerError(`${name} must be an object.`);
+	return value;
+}
+function jsonResponse(body, status = 200) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: { "Content-Type": "application/json" }
 	});
 }
-async function enqueueForwarding(parameters, outboxQueue, inboxes) {
-	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const key = await resolveForwardingKey(parameters);
-	const keys = [];
-	if (key != null) try {
-		keys.push({
-			keyId: key.keyId.href,
-			privateKey: await exportJwk(key.privateKey)
-		});
-	} catch (error) {
-		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			keyId: key.keyId.href,
-			activityId: activityId.href,
-			error
-		});
+function serializeScopeMetrics(resourceMetrics) {
+	return resourceMetrics.scopeMetrics.map(serializeScope);
+}
+function serializeScope(scopeMetrics) {
+	return {
+		scope: {
+			name: scopeMetrics.scope.name,
+			version: scopeMetrics.scope.version
+		},
+		metrics: scopeMetrics.metrics.map(serializeMetric)
+	};
+}
+function serializeMetric(metric) {
+	return {
+		name: metric.descriptor.name,
+		description: metric.descriptor.description,
+		unit: metric.descriptor.unit,
+		dataPointType: serializeDataPointType(metric.dataPointType),
+		dataPoints: metric.dataPoints.map((point) => ({
+			attributes: { ...point.attributes },
+			startTime: point.startTime,
+			endTime: point.endTime,
+			value: point.value
+		}))
+	};
+}
+function serializeDataPointType(dataPointType) {
+	switch (dataPointType) {
+		case DataPointType.HISTOGRAM: return "histogram";
+		case DataPointType.EXPONENTIAL_HISTOGRAM: return "exponential_histogram";
+		case DataPointType.GAUGE: return "gauge";
+		case DataPointType.SUM: return "sum";
 	}
-	startQueue?.();
-	const started = (/* @__PURE__ */ new Date()).toISOString();
-	const traceContext = {};
-	propagation.inject(context.active(), traceContext);
-	await Promise.all(inboxes.map(async (inbox) => {
-		const message = {
-			type: "outbox",
-			id: crypto.randomUUID(),
-			baseUrl,
-			keys,
-			activity,
-			activityId: activityId.href,
-			activityType,
-			inbox: inbox.href,
-			sharedInbox: false,
-			started,
-			attempt: 0,
-			headers: {},
-			traceContext
-		};
-		try {
-			await outboxQueue.enqueue(message);
-		} catch (error) {
-			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
-				activityId: activityId.href,
-				inbox: inbox.href,
-				error
-			});
-			return;
-		}
-		recordOutboxEnqueue(meterProvider, outboxQueue, message);
-	}));
 }
 //#endregion
 //#region src/federation/outgoing-proof.ts
-function isPortableUrl(url) {
-	return url.protocol === "ap:" || url.protocol === "ap+ef61:";
-}
 function formatKeyIds(candidates) {
 	return candidates.map((c) => c.verificationMethod.href).join(", ");
 }
 /**
 * Rejects an activity of a portable actor whose ID cannot be authenticated by
 * the actor's DID: FEP-ef61 requires the activity to be a portable object
-* signed by that DID, so its ID has to be a portable ID with the same DID.
+* signed by that DID, so its ID has to be a portable ID, i.e., an `ap:` or
+* `ap+ef61:` URI or a compatible identifier, with the same DID.  A portable
+* actor is one whose ID is such an ID as well.
 * @throws {TypeError} If the activity is performed by a portable actor, but
-*                     its ID is not a portable ID of the actor's DID, or its
-*                     portable actors do not share a DID.
+*                     its ID is not a portable ID of the actor's DID, its
+*                     portable actors do not share a DID, or the ID of one of
+*                     them is a malformed compatible identifier.
 * @internal
 */
 function assertPortableActorActivity(activity) {
-	const portableActors = activity.actorIds.filter(isPortableUrl);
+	const portableActors = activity.actorIds.filter((id) => isPortableId(id));
 	if (portableActors.length < 1) return;
-	const did = getFe34Origin(portableActors[0]);
-	if (portableActors.some((actorId) => getFe34Origin(actorId) !== did)) throw new TypeError(`The activity ${activity.id?.href} has portable actors with different DIDs (${portableActors.map((a) => a.href).join(", ")}); a portable activity is signed by a single DID.`);
-	if (activity.id == null || !isPortableUrl(activity.id) || getFe34Origin(activity.id) !== did) throw new TypeError(`The activity ${activity.id?.href} is performed by the portable actor ${portableActors[0].href}, so its ID has to be an ap: or ap+ef61: URI with the same DID (${did}), as FEP-ef61 requires it to carry an Object Integrity Proof made by that DID.`);
+	const dids = portableActors.map((actorId) => {
+		const did = getPortableDid(actorId);
+		if (did == null) throw new TypeError(`The activity ${activity.id?.href} is performed by the actor ${actorId.href}, whose ID is a malformed FEP-ef61 portable ID.  A compatible identifier must have a valid DID and an object path, and must not have credentials or @gateway location hints.`);
+		return did;
+	});
+	const did = dids[0];
+	if (dids.some((d) => d !== did)) throw new TypeError(`The activity ${activity.id?.href} has portable actors with different DIDs (${portableActors.map((a) => a.href).join(", ")}); a portable activity is signed by a single DID.`);
+	if (activity.id == null || !isPortableId(activity.id) || getPortableDid(activity.id) !== did) throw new TypeError(`The activity ${activity.id?.href} is performed by the portable actor ${portableActors[0].href}, so its ID has to be an ap: or ap+ef61: URI, or an FEP-ef61 compatible identifier, with the same DID (${did}), as FEP-ef61 requires it to carry an Object Integrity Proof made by that DID.`);
+	if (!isCompatibleEf61Iri(activity.id)) return;
+	const mismatched = portableActors.find((actorId) => isCompatibleEf61Iri(actorId) && actorId.origin !== activity.id?.origin);
+	if (mismatched == null) return;
+	getLogger([
+		"fedify",
+		"federation",
+		"outbox"
+	]).warn("The activity {activityId} and its actor {actorId} are identified by FEP-ef61 compatible identifiers on different gateways.  FEP-ef61 requires publishers to use the first gateway in the actor's gateways when constructing compatible identifiers.", {
+		activityId: activity.id.href,
+		actorId: mismatched.href
+	});
 }
 /**
 * Creates the Object Integrity Proofs Fedify attaches to an outgoing activity.
 *
 * Keys whose IDs are FEP-ef61 compatible identifiers are gateway keys, which
 * never sign proofs.  A portable activity, i.e., one with an `ap:` or
-* `ap+ef61:` ID, that carries no proof is signed only by the one Ed25519 key
+* `ap+ef61:` ID or a compatible identifier, that carries no proof is signed only by the one Ed25519 key
 * whose verification method is a DID URL for its DID, even if it is the only
 * key; if no key or more than one key qualifies, this function throws.
 *
@@ -5269,7 +5661,7 @@ async function signOutgoingActivity(activity, candidates, options) {
 		break;
 	}
 	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isCompatibleKeyId(c.verificationMethod));
-	if (!hasProof && activity.id != null && isPortableUrl(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
+	if (!hasProof && activity.id != null && isPortableId(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
 	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
 		activity,
 		hasProof,
@@ -5302,8 +5694,9 @@ async function signOutgoingActivity(activity, candidates, options) {
 * @throws {TypeError} If no key or more than one key qualifies.
 */
 function selectPortableActivityKey(activity, activityId, keys) {
-	const activityDid = getFe34Origin(activityId);
-	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && haveSameFe34Origin(activityId, c.verificationMethod));
+	const activityDid = getPortableDid(activityId);
+	if (activityDid == null) throw new TypeError(`Cannot sign the portable activity ${activityId.href}, as its ID is a malformed FEP-ef61 portable ID.  A compatible identifier must have a valid DID and an object path, and must not have credentials or @gateway location hints.`);
+	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && getPortableDid(c.verificationMethod) === activityDid);
 	if (eligible.length !== 1) throw new TypeError(`Cannot choose an Object Integrity Proof key for the portable activity ${activityId.href}: ` + (eligible.length < 1 ? `none of its ${keys.length} Ed25519 keys (${formatKeyIds(keys)}) ` : `${eligible.length} of its Ed25519 keys (${formatKeyIds(eligible)}) `) + `${eligible.length < 1 ? "is" : "are"} a DID URL verification method for ${activityDid}.  FEP-ef61 requires a portable activity's proof to be made by its DID, and the map-local compound-proof profile accepts exactly one direct proof per map.  Gateway keys, whose IDs are compatible identifiers, never sign proofs.  Supply exactly one Ed25519 key whose key ID is a DID URL for ${activityDid}, or sign the activity with signObject() before sending it.`);
 	getLogger([
 		"fedify",
@@ -5721,6 +6114,27 @@ function getWebFingerSubjectAndAliases({ resourceUrl, actorUri, preferredUsernam
 	};
 }
 /**
+* Gets the compatible identifier that a WebFinger response links to for
+* an FEP-ef61 portable actor.  An actor identified by an `ap:` or `ap+ef61:`
+* URI is linked through its compatible identifier on the given gateway, while
+* an actor identified by a compatible identifier is linked through its ID as
+* is, so that software without FEP-ef61 support finds the same ID in the actor
+* document.
+* @param actorId The portable actor's ID.
+* @param gateway The actor's first gateway.
+* @returns The compatible identifier, or `null` if the actor ID is malformed
+*          or cannot be represented as a compatible identifier.
+*/
+function getCompatibleActorId(actorId, gateway) {
+	try {
+		if (isPortableUri(actorId)) return toCompatibleEf61Id(actorId, gateway);
+		return fromCompatibleEf61Id(actorId) == null ? null : actorId;
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
 * Computes the subject and aliases for an FEP-ef61 portable actor, whose
 * WebFinger address takes its domain from the first gateway of the actor
 * rather than from the actor ID.  The canonical `ap:` ID is not emitted,
@@ -5884,21 +6298,23 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 	});
 	let actorUri = context.getActorUri(identifier);
 	let portable;
-	if (actor.id != null && (actor.id.protocol === "ap:" || actor.id.protocol === "ap+ef61:")) {
+	if (actor.id != null && isPortableId(actor.id)) {
 		const gateway = actor.gateway;
-		let compatibleId;
-		if (gateway != null && isGatewayUrl(gateway)) try {
-			compatibleId = toCompatibleEf61Id(actor.id, gateway);
-		} catch (error) {
-			if (!(error instanceof TypeError)) throw error;
-		}
-		if (gateway == null || compatibleId == null) {
+		if (gateway == null || !isGatewayUrl(gateway)) {
 			logger.error("The portable actor {actorId} (identifier: {identifier}) needs an HTTP(S) origin as the first item of its gateways property to be discovered through WebFinger.", {
 				actorId: formatIri(actor.id),
 				identifier
 			});
 			return await onNotFound(request);
 		}
+		const compatibleId = getCompatibleActorId(actor.id, gateway);
+		if (compatibleId == null) {
+			logger.error("The portable actor {actorId} (identifier: {identifier}) cannot be discovered through WebFinger, as its ID is malformed or cannot be represented as an FEP-ef61 compatible identifier.", {
+				actorId: formatIri(actor.id),
+				identifier
+			});
+			return await onNotFound(request);
+		}
 		actorUri = compatibleId;
 		portable = {
 			compatibleId,
@@ -7836,7 +8252,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			onNotFound,
 			portableInbox: {
 				recipient,
-				forward: async (activity, activityId, activityType) => {
+				forward: async (activity, activityId, activityType, signatures) => {
 					if (this.portableInboxForwarding.maxTargets < 1) return;
 					if (this.kv.cas == null) {
 						if (!this.#portableInboxForwardingWarned) {
@@ -7859,6 +8275,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 						allowPrivateAddress: this.allowPrivateAddress,
 						getKeys: () => this.#getPortableGatewayKeyPairs(context, identifier, recipient),
 						specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
+						signatures,
 						options: this.portableInboxForwarding,
 						meterProvider: this.meterProvider,
 						tracerProvider: this.tracerProvider
@@ -9141,4 +9558,4 @@ function getRequestId(request) {
 	return `req_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
 }
 //#endregion
-export { respondWithObject as a, digest as c, parseCircuitBreakerKvState as d, createFederationBuilder as f, SendActivityError as i, CircuitBreaker as l, handleWebFinger as n, respondWithObjectIfAcceptable as o, createExponentialBackoffPolicy as r, buildCollectionSynchronizationHeader as s, createFederation as t, normalizeCircuitBreakerOptions as u };
+export { respondWithObjectIfAcceptable as a, digest as c, parseCircuitBreakerKvState as d, createFederationBuilder as f, respondWithObject as i, CircuitBreaker as l, handleWebFinger as n, SendActivityError as o, createExponentialBackoffPolicy as r, buildCollectionSynchronizationHeader as s, createFederation as t, normalizeCircuitBreakerOptions as u };