@fedify/fedify 2.4.0-dev.2084 → 2.4.0-dev.2099

package/dist/{federation-BLGx8JUH.cjs → federation-C4Ef3JKa.cjs}

@@ -1,16 +1,17 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-B5q1CHtL.cjs");
+const require_http = require("./http-C8cZTE3Y.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-BQFZtFV4.cjs");
-const require_kv_cache = require("./kv-cache-Dhhhrryv.cjs");
+const require_owner = require("./owner-DSzH7wro.cjs");
+const require_kv_cache = require("./kv-cache-Dvd-Q-E2.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
-let byte_encodings_hex = require("byte-encodings/hex");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
+let _fedify_vocab_runtime_internal_portable_dereference = require("@fedify/vocab-runtime/internal/portable-dereference");
+let byte_encodings_hex = require("byte-encodings/hex");
 let _fedify_vocab_runtime_jsonld = require("@fedify/vocab-runtime/jsonld");
 _fedify_vocab_runtime_jsonld = require_rolldown_runtime.__toESM(_fedify_vocab_runtime_jsonld, 1);
 let es_toolkit = require("es-toolkit");
@@ -205,10 +206,11 @@ var FederationBuilderImpl = class {
 				"federation",
 				"actor"
 			]);
-			const portable = actor.id?.protocol === "ap:" || actor.id?.protocol === "ap+ef61:";
+			const portable = actor.id != null && require_http.isPortableId(actor.id);
 			if (actor.id == null) logger.warn("Actor dispatcher returned an actor without an id property.  Set the property with Context.getActorUri(identifier).");
 			else if (!portable && actor.id.href != context.getActorUri(identifier).href) logger.warn("Actor dispatcher returned an actor with an id property that does not match the actor URI.  Set the property with Context.getActorUri(identifier).");
 			if (actor instanceof _fedify_vocab.Tombstone) return actor;
+			if (actor.id != null && (0, _fedify_vocab_runtime_internal_portable_dereference.isCompatibleEf61Iri)(actor.id)) warnCompatibleActorId(actor.id, actor.gateway);
 			if (this.followingCallbacks != null && this.followingCallbacks.dispatcher != null) {
 				if (actor.followingId == null) logger.warn("You configured a following collection dispatcher, but the actor does not have a following property.  Set the property with Context.getFollowingUri(identifier).");
 				else if (!portable && actor.followingId.href != context.getFollowingUri(identifier).href) logger.warn("You configured a following collection dispatcher, but the actor's following property does not match the following collection URI.  Set the property with Context.getFollowingUri(identifier).");
@@ -733,6 +735,33 @@ var FederationBuilderImpl = class {
 function createFederationBuilder() {
 	return new FederationBuilderImpl();
 }
+/**
+* Warns about an FEP-ef61 portable actor identified by a compatible identifier
+* that is malformed, or is not on the actor's first gateway, where FEP-ef61
+* requires publishers to construct compatible identifiers.
+*/
+function warnCompatibleActorId(actorId, gateway) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"actor"
+	]);
+	try {
+		(0, _fedify_vocab_runtime.fromCompatibleEf61Id)(actorId);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.warn("Actor dispatcher returned an actor whose id property, {actorId}, is a malformed FEP-ef61 compatible identifier: {error}", {
+			actorId: actorId.href,
+			error
+		});
+		return;
+	}
+	if (gateway == null || !(0, _fedify_vocab_runtime.isGatewayUrl)(gateway)) logger.warn("Actor dispatcher returned an actor whose id property, {actorId}, is an FEP-ef61 compatible identifier, but whose first gateway is not an HTTP(S) origin.  Set the gateways property, and construct the compatible identifier with its first gateway.", { actorId: actorId.href });
+	else if (actorId.origin !== gateway.origin) logger.warn("Actor dispatcher returned an actor whose id property, {actorId}, is an FEP-ef61 compatible identifier on another gateway than its first gateway, {gateway}.  FEP-ef61 requires publishers to construct compatible identifiers with the first gateway in the actor's gateways.", {
+		actorId: actorId.href,
+		gateway: gateway.origin
+	});
+}
 //#endregion
 //#region src/federation/circuit-breaker.ts
 const Temporal$11 = require_http.Temporal;
@@ -1310,7 +1339,14 @@ async function buildCollectionSynchronizationHeader(collectionId, actorIds) {
 //#endregion
 //#region src/sig/compound-proof.ts
 const textEncoder = new TextEncoder();
-const PORTABLE_OBJECT_ID_PATTERN = /^ap(?:\+ef61)?:\/\//i;
+/**
+* Checks whether a literal `id` or `@id` value makes a map a portable object:
+* an `ap:` or `ap+ef61:` URI, or anything that looks like an FEP-ef61
+* compatible identifier, even a malformed one, which then fails the policy.
+*/
+function isPortableIdValue(value) {
+	return typeof value === "string" && require_http.isPortableId(value);
+}
 function isJsonMap(value) {
 	return typeof value === "object" && value != null && !Array.isArray(value);
 }
@@ -1556,18 +1592,20 @@ function collectPortableObjects(snapshot) {
 			for (let index = current.value.length - 1; index >= 0; index--) pending.push({
 				value: current.value[index],
 				path: childPath(current.path, String(index)),
-				depth: current.depth + 1
+				depth: current.depth + 1,
+				keyOf: current.keyOf
 			});
 			continue;
 		}
 		if (!isCompoundProofJsonObject(current.value)) continue;
 		const document = current.value;
-		const id = [document.id, document["@id"]].find((value) => typeof value === "string" && PORTABLE_OBJECT_ID_PATTERN.test(value));
+		const id = [document.id, document["@id"]].find(isPortableIdValue);
 		if (typeof id === "string") objects.push(Object.freeze({
 			path: current.path,
 			id,
 			depth: current.depth,
-			document
+			document,
+			...current.keyOf == null ? {} : { keyOf: current.keyOf }
 		}));
 		const entries = Object.entries(document).sort(([left], [right]) => comparePaths(left, right));
 		for (let index = entries.length - 1; index >= 0; index--) {
@@ -1576,7 +1614,11 @@ function collectPortableObjects(snapshot) {
 			pending.push({
 				value,
 				path: childPath(current.path, key),
-				depth: current.depth + 1
+				depth: current.depth + 1,
+				...typeof id === "string" && (key === "publicKey" || key === "assertionMethod") ? { keyOf: {
+					path: current.path,
+					member: key
+				} } : {}
 			});
 		}
 	}
@@ -1584,8 +1626,9 @@ function collectPortableObjects(snapshot) {
 	return objects;
 }
 /**
-* Determines whether a received JSON tree contains a portable object ID
-* outside a proof or context definition, without exceeding discovery limits.
+* Determines whether a received JSON tree contains a portable object ID, i.e.,
+* an `ap:` or `ap+ef61:` URI or an FEP-ef61 compatible identifier, outside
+* a proof or context definition, without exceeding discovery limits.
 *
 * This is only an applicability check.  It does not authenticate the input;
 * callers must still use {@link verifyCompoundPortableObjectProofs} to obtain
@@ -1632,7 +1675,7 @@ function inspectCompoundPortableObjectApplicability(json, limits) {
 		} else if (isJsonMap(value)) {
 			mapCount++;
 			if (mapCount > limits.maxMaps) return "indeterminate";
-			if ([value.id, value["@id"]].some((id) => typeof id === "string" && PORTABLE_OBJECT_ID_PATTERN.test(id))) return "present";
+			if ([value.id, value["@id"]].some(isPortableIdValue)) return "present";
 			if (!addByteLength(2)) return "indeterminate";
 			const children = function* () {
 				let first = true;
@@ -1695,7 +1738,8 @@ function findInJsonMaps(json, visit) {
 /**
 * Determines whether an outgoing JSON tree contains portable content that
 * requires producer-side proof-shape checks: a map, outside proof and context
-* values, whose direct `id` or `@id` is a portable ActivityPub URI.
+* values, whose direct `id` or `@id` is a portable ActivityPub URI or an
+* FEP-ef61 compatible identifier.
 *
 * This deliberately differs from
 * {@link inspectCompoundPortableObjectApplicability}: it applies no resource
@@ -1708,7 +1752,7 @@ function findInJsonMaps(json, visit) {
 * @internal
 */
 function containsCompoundPortableObject(json) {
-	return findInJsonMaps(json, (map) => [map.id, map["@id"]].some((id) => typeof id === "string" && PORTABLE_OBJECT_ID_PATTERN.test(id)) ? true : void 0) ?? false;
+	return findInJsonMaps(json, (map) => [map.id, map["@id"]].some(isPortableIdValue) ? true : void 0) ?? false;
 }
 /**
 * Finds the first direct `proof` member whose value the map-local
@@ -1805,7 +1849,7 @@ async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 	if (discovered.status !== "ok") return discovered;
 	const proofs = await verifyDiscoveredProofDocuments(discovered, options);
 	const proofByPath = new Map(proofs.map((proof) => [proof.path, proof]));
-	const portableObjects = await Promise.all(collectPortableObjects(discovered.snapshot).map(async (object) => {
+	const verifyPortableObject = async (object) => {
 		const metadata = {
 			path: object.path,
 			id: object.id,
@@ -1837,16 +1881,174 @@ async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 				reason: { type: "invalidPortableObject" }
 			});
 		}
+	};
+	const collected = collectPortableObjects(discovered.snapshot);
+	const objectByPath = new Map(collected.map((object) => [object.path, object]));
+	const isKeyCandidate = (object) => object.keyOf != null && !Object.hasOwn(object.document, "proof");
+	const results = /* @__PURE__ */ new Map();
+	for (const result of await Promise.all(collected.filter((object) => !isKeyCandidate(object)).map(verifyPortableObject))) results.set(result.path, result);
+	let projections = 0;
+	for (const object of collected) {
+		if (!isKeyCandidate(object)) continue;
+		const { path, member } = object.keyOf;
+		const parent = results.get(path);
+		const parentObject = objectByPath.get(path);
+		if (parent?.verified === true && parentObject != null && projections++ < MAX_KEY_PROJECTIONS && await isEmbeddedPortableKey(parentObject.document, member, object.document, parent.id)) continue;
+		results.set(object.path, await verifyPortableObject(object));
+	}
+	const portableObjects = Object.freeze(collected.flatMap((object) => {
+		const result = results.get(object.path);
+		return result == null ? [] : [result];
 	}));
 	return {
 		status: "ok",
 		verified: portableObjects.length > 0 && proofs.every((proof) => proof.verified) && portableObjects.every((object) => object.verified),
 		snapshot: discovered.snapshot,
 		proofs,
-		portableObjects: Object.freeze(portableObjects),
+		portableObjects,
 		statistics: discovered.statistics
 	};
 }
+/**
+* The maximum number of embedded keys per compound document that are checked
+* by {@link isEmbeddedPortableKey}, each of which expands a projection of its
+* parent.  Keys beyond it have to carry their own proofs.
+*/
+const MAX_KEY_PROJECTIONS = 64;
+const SECURITY = "https://w3id.org/security#";
+const KEY_TYPES = /* @__PURE__ */ new Set([`${SECURITY}Key`, `${SECURITY}Multikey`]);
+const KEY_PROPERTIES = /* @__PURE__ */ new Set([
+	"@id",
+	"@type",
+	`${SECURITY}owner`,
+	`${SECURITY}controller`,
+	`${SECURITY}publicKeyPem`,
+	`${SECURITY}publicKeyMultibase`
+]);
+/**
+* Tells whether an unsigned map embedded in a verified portable map is just
+* a key of the portable object the parent is, e.g., a gateway key of
+* a portable actor, which the parent's proof covers.
+*
+* The key's meaning depends on the contexts active where it sits, so it is
+* decided on a projection of the parent that keeps only what those contexts
+* depend on: the parent's `@context`, its types and ID, and the member that
+* holds the key.  That holds only if nothing else in the parent can change
+* them, so both documents may only use contexts that define no keyword
+* aliases and no scoped contexts; Fedify's preloaded contexts, the only
+* remote ones the compound policy loads, alias just `id` and `type`.
+*
+* The projection must expand to the parent's verified ID with the key as the
+* single value of `publicKey` or `assertionMethod`, and the key must be
+* nothing but a `CryptographicKey` or `Multikey` whose ID is a compatible
+* identifier of the parent plus a fragment, and whose owner or controller,
+* if any, is the parent.
+*/
+async function isEmbeddedPortableKey(parent, member, key, parentId) {
+	const parentPortableId = getCanonicalPortableIdOf(parentId);
+	if (parentPortableId == null) return false;
+	if (!isSimpleContext(parent["@context"]) || Object.hasOwn(key, "@context") && !isSimpleContext(key["@context"])) return false;
+	const literalIds = [key.id, key["@id"]].filter((id) => id !== void 0);
+	if (literalIds.length < 1 || literalIds.some((id) => id !== literalIds[0]) || typeof literalIds[0] !== "string" || !isKeyIdOf(literalIds[0], parentPortableId)) return false;
+	const projection = {};
+	for (const property of [
+		"@context",
+		"type",
+		"@type",
+		"id",
+		"@id"
+	]) if (Object.hasOwn(parent, property)) projection[property] = parent[property];
+	projection[member] = key;
+	let expanded;
+	try {
+		expanded = await _fedify_vocab_runtime_jsonld.default.expand(structuredClone(projection), {
+			documentLoader: require_http.getNormalizationContextLoader(require_http.preloadedOnlyDocumentLoader),
+			keepFreeFloatingNodes: true
+		});
+	} catch {
+		return false;
+	}
+	if (expanded.length !== 1 || hasGraphKeyword(expanded)) return false;
+	const node = expanded[0];
+	if (!isJsonMap(node) || typeof node["@id"] !== "string" || getCanonicalPortableIdOf(node["@id"]) !== parentPortableId) return false;
+	const properties = Object.keys(node).filter((property) => property !== "@id" && property !== "@type");
+	if (properties.length !== 1 || properties[0] !== `${SECURITY}${member}`) return false;
+	const values = node[properties[0]];
+	if (!Array.isArray(values) || values.length !== 1) return false;
+	const expandedKey = values[0];
+	if (!isJsonMap(expandedKey) || expandedKey["@id"] !== literalIds[0] || Object.keys(expandedKey).some((property) => !KEY_PROPERTIES.has(property))) return false;
+	const types = expandedKey["@type"];
+	if (types !== void 0 && (!Array.isArray(types) || types.some((type) => typeof type !== "string" || !KEY_TYPES.has(type)))) return false;
+	const pem = expandedKey[`${SECURITY}publicKeyPem`];
+	const multibase = expandedKey[`${SECURITY}publicKeyMultibase`];
+	if (pem === void 0 && multibase === void 0) return false;
+	if (pem !== void 0 && !isSingleStringValue(pem)) return false;
+	if (multibase !== void 0 && !isSingleStringValue(multibase, `${SECURITY}multibase`)) return false;
+	for (const property of [`${SECURITY}owner`, `${SECURITY}controller`]) {
+		const owners = expandedKey[property];
+		if (owners === void 0) continue;
+		if (!Array.isArray(owners) || owners.length !== 1 || !isJsonMap(owners[0]) || Object.keys(owners[0]).length !== 1 || typeof owners[0]["@id"] !== "string" || getCanonicalPortableIdOf(owners[0]["@id"]) !== parentPortableId) return false;
+	}
+	return true;
+}
+function getCanonicalPortableIdOf(id) {
+	try {
+		return require_http.getCanonicalPortableId((0, _fedify_vocab_runtime.parseIri)(id));
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Checks whether an ID is a compatible identifier of the given portable
+* object plus a fragment.
+*/
+function isKeyIdOf(id, portableId) {
+	let url;
+	try {
+		if ((0, _fedify_vocab_runtime.fromCompatibleEf61Id)(id) == null) return false;
+		url = new URL(id);
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+	if (url.hash.length < 2) return false;
+	url.hash = "";
+	return require_http.getCanonicalPortableId(url) === portableId;
+}
+/**
+* Checks whether a `@context` value defines no keyword aliases and no scoped
+* contexts: only references to contexts and term definitions that map terms
+* to IRIs, optionally with an `@id` or `@vocab` type coercion or a datatype.
+*/
+function isSimpleContext(context) {
+	if (typeof context === "string") return true;
+	if (Array.isArray(context)) return context.every(isSimpleContext);
+	if (context === void 0 || !isCompoundProofJsonObject(context)) return false;
+	return Object.entries(context).every(([term, definition]) => {
+		if (term.startsWith("@")) return false;
+		if (typeof definition === "string") return !definition.startsWith("@");
+		if (!isCompoundProofJsonObject(definition)) return false;
+		const { "@id": id, "@type": type, ...rest } = definition;
+		return Object.keys(rest).length < 1 && typeof id === "string" && !id.startsWith("@") && (type === void 0 || type === "@id" || type === "@vocab" || typeof type === "string" && !type.startsWith("@"));
+	});
+}
+function hasGraphKeyword(value) {
+	if (Array.isArray(value)) return value.some(hasGraphKeyword);
+	if (!isJsonMap(value)) return false;
+	return Object.entries(value).some(([key, child]) => key === "@graph" || key === "@included" || key === "@reverse" || hasGraphKeyword(child));
+}
+/**
+* Checks whether expanded values are a single plain string, optionally with
+* the given datatype.
+*/
+function isSingleStringValue(values, datatype) {
+	if (!Array.isArray(values) || values.length !== 1) return false;
+	const value = values[0];
+	if (!isJsonMap(value) || typeof value["@value"] !== "string") return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 || datatype != null && keys.length === 2 && value["@type"] === datatype;
+}
 //#endregion
 //#region src/federation/inbox.ts
 const Temporal$10 = require_http.Temporal;
@@ -2319,115 +2521,815 @@ function parseHashlinkGatewayRequest(url) {
 	};
 }
 //#endregion
-//#region src/federation/temporal.ts
-const Temporal$8 = require_http.Temporal;
-function isPlainObject$1(value) {
-	return typeof value === "object" && value != null && !Array.isArray(value);
-}
-function normalizeDateTimeLiteral(value) {
-	return value.substring(19).match(/[Z+-]/) ? value : value + "Z";
-}
-function isMalformedDateTimeLiteral(value) {
-	if (typeof value !== "string") return false;
-	try {
-		Temporal$8.Instant.from(normalizeDateTimeLiteral(value));
-		return false;
-	} catch {
-		return true;
-	}
-}
-function isMalformedDurationLiteral(value) {
-	if (typeof value !== "string") return false;
-	try {
-		Temporal$8.Duration.from(value);
-		return false;
-	} catch {
-		return true;
+//#region src/federation/send.ts
+/**
+* Extracts the inbox URLs from recipients.
+* @param parameters The parameters to extract the inboxes.
+*                   See also {@link ExtractInboxesParameters}.
+* @returns The inboxes as a map of inbox URL to actor URIs.
+*/
+function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
+	const inboxes = {};
+	for (const recipient of recipients) {
+		let inbox;
+		let sharedInbox = false;
+		if (preferSharedInbox && recipient.endpoints?.sharedInbox != null) {
+			inbox = recipient.endpoints.sharedInbox;
+			sharedInbox = true;
+		} else inbox = recipient.inboxId;
+		if (inbox != null && recipient.id != null) {
+			if (excludeBaseUris != null && excludeBaseUris.some((u) => u.origin === inbox?.origin)) continue;
+			inboxes[inbox.href] ??= {
+				actorIds: /* @__PURE__ */ new Set(),
+				sharedInbox
+			};
+			inboxes[inbox.href].actorIds.add(recipient.id.href);
+		}
 	}
+	return inboxes;
 }
-const TEMPORAL_DATE_TIME_IRIS = /* @__PURE__ */ new Set([
-	"https://www.w3.org/ns/activitystreams#deleted",
-	"https://www.w3.org/ns/activitystreams#endTime",
-	"https://www.w3.org/ns/activitystreams#published",
-	"https://www.w3.org/ns/activitystreams#startTime",
-	"https://www.w3.org/ns/activitystreams#updated",
-	"http://purl.org/dc/terms/created",
-	"https://w3id.org/security#created"
-]);
-const TEMPORAL_DURATION_IRIS = /* @__PURE__ */ new Set(["https://www.w3.org/ns/activitystreams#duration"]);
-const QUESTION_CLOSED_IRI = "https://www.w3.org/ns/activitystreams#closed";
-const XSD_DATE_TIME_IRI = "http://www.w3.org/2001/XMLSchema#dateTime";
-function hasMalformedExpandedDateTimeLiteral(value) {
-	if (Array.isArray(value)) return value.some(hasMalformedExpandedDateTimeLiteral);
-	return isPlainObject$1(value) && "@value" in value && isMalformedDateTimeLiteral(value["@value"]);
-}
-function hasMalformedExpandedQuestionClosedLiteral(value) {
-	if (Array.isArray(value)) return value.some(hasMalformedExpandedQuestionClosedLiteral);
-	if (!isPlainObject$1(value) || !("@value" in value)) return false;
-	const literal = value["@value"];
-	if (typeof literal === "boolean") return false;
-	if (typeof literal !== "string") return false;
-	if (value["@type"] !== XSD_DATE_TIME_IRI) return false;
-	if (new Date(literal).toString() === "Invalid Date") return false;
-	return isMalformedDateTimeLiteral(literal);
+/**
+* Sends an {@link Activity} to an inbox.
+*
+* @param parameters The parameters for sending the activity.
+*                   See also {@link SendActivityParameters}.
+* @throws {Error} If the activity fails to send.
+*/
+function sendActivity(options) {
+	const tracerProvider = options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
+	return tracerProvider.getTracer(require_http.name, require_http.version).startActiveSpan("activitypub.send_activity", {
+		kind: _opentelemetry_api.SpanKind.CLIENT,
+		attributes: { "activitypub.shared_inbox": options.sharedInbox ?? false }
+	}, async (span) => {
+		if (options.activityId != null) span.setAttribute("activitypub.activity.id", options.activityId);
+		if (options.activityType != null) span.setAttribute("activitypub.activity.type", options.activityType);
+		try {
+			await sendActivityInternal({
+				...options,
+				tracerProvider
+			}, span);
+		} catch (e) {
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: String(e)
+			});
+			throw e;
+		} finally {
+			span.end();
+		}
+	});
 }
-function hasMalformedExpandedDurationLiteral(value) {
-	if (Array.isArray(value)) return value.some(hasMalformedExpandedDurationLiteral);
-	return isPlainObject$1(value) && "@value" in value && isMalformedDurationLiteral(value["@value"]);
+const MAX_ERROR_RESPONSE_BODY_BYTES = 1024;
+function getActivityActorId(activity) {
+	if (!isRecord(activity)) return void 0;
+	return getIdValue(activity.actor);
 }
-function hasMalformedKnownTemporalLiteralInternal(value, visited) {
-	if (Array.isArray(value)) return value.some((item) => hasMalformedKnownTemporalLiteralInternal(item, visited));
-	if (!isPlainObject$1(value)) return false;
-	if (visited.has(value)) return false;
-	visited.add(value);
-	if ("@value" in value) return false;
-	for (const [key, child] of Object.entries(value)) {
-		if (TEMPORAL_DATE_TIME_IRIS.has(key)) {
-			if (hasMalformedExpandedDateTimeLiteral(child)) return true;
-			continue;
-		}
-		if (key === QUESTION_CLOSED_IRI) {
-			if (hasMalformedExpandedQuestionClosedLiteral(child)) return true;
-			continue;
-		}
-		if (TEMPORAL_DURATION_IRIS.has(key)) {
-			if (hasMalformedExpandedDurationLiteral(child)) return true;
-			continue;
+function getIdValue(value) {
+	if (typeof value === "string" && value !== "") return value;
+	if (value instanceof URL) return value.href;
+	if (Array.isArray(value)) {
+		for (const item of value) {
+			const id = getIdValue(item);
+			if (id != null) return id;
 		}
-		if (hasMalformedKnownTemporalLiteralInternal(child, visited)) return true;
+		return;
 	}
-	return false;
+	if (isRecord(value)) return getIdValue(value.id);
 }
-async function hasMalformedKnownTemporalLiteral(value, contextLoader) {
+function isRecord(value) {
+	return typeof value === "object" && value != null;
+}
+async function readLimitedResponseBody(response, maxBytes) {
+	if (response.body == null) return "";
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	const chunks = [];
+	let totalBytes = 0;
+	let truncated = false;
 	try {
-		return hasMalformedKnownTemporalLiteralInternal(await _fedify_vocab_runtime_jsonld.default.expand(value, {
-			documentLoader: require_http.getNormalizationContextLoader(contextLoader),
-			keepFreeFloatingNodes: true
-		}), /* @__PURE__ */ new Set());
-	} catch {
-		return false;
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (totalBytes + value.length > maxBytes) {
+				const remaining = maxBytes - totalBytes;
+				if (remaining > 0) chunks.push(decoder.decode(value.slice(0, remaining), { stream: true }));
+				truncated = true;
+				break;
+			}
+			chunks.push(decoder.decode(value, { stream: true }));
+			totalBytes += value.length;
+		}
+	} finally {
+		reader.releaseLock();
 	}
+	let result = chunks.join("");
+	if (truncated) result += "… (truncated)";
+	return result;
 }
-//#endregion
-//#region src/federation/handler.ts
-const Temporal$7 = require_http.Temporal;
-const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
-const INBOX_COMPOUND_PROOF_LIMITS = {
-	maxDepth: 64,
-	maxMaps: 1e4,
-	maxProofs: 32,
-	maxBytes: 10 * 1024 * 1024
-};
-function isRemoteContextLoadingFailure$1(error) {
-	return error instanceof Error && typeof error.details === "object" && error.details != null && error.details.code === "loading remote context failed";
-}
-function isPermanentRemoteContextError$1(error) {
-	if (!(error instanceof Error) || error.name !== "jsonld.InvalidUrl") return false;
-	const details = error.details;
-	if (details?.code === "invalid remote context") return true;
-	return isRemoteContextLoadingFailure$1(error) && typeof details?.url === "string" && !URL.canParse(details.url) && require_http.isClearlyMalformedContextReference(details.url);
-}
-function isInvalidJsonLdError(error) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"outbox"
+	]);
+	const federationMetrics = require_http.getFederationMetrics(meterProvider);
+	const started = performance.now();
+	let deliverySuccess = false;
+	async function validateUrl(url) {
+		if (!allowPrivateAddress) try {
+			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
+		} catch (error) {
+			if (error instanceof _fedify_vocab_runtime.UrlError) logger.error("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
+	}
+	await validateUrl(inbox.href);
+	headers = new Headers(headers);
+	headers.set("Content-Type", "application/activity+json");
+	const request = new Request(inbox, {
+		method: "POST",
+		headers,
+		body: JSON.stringify(activity),
+		redirect: "manual"
+	});
+	let rsaKey = null;
+	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
+		rsaKey = key;
+		break;
+	}
+	if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
+		activityId,
+		inbox: inbox.href
+	});
+	else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
+		inbox: inbox.href,
+		keys: keys.map((pair) => ({
+			keyId: pair.keyId.href,
+			privateKey: pair.privateKey
+		}))
+	});
+	let response;
+	try {
+		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await require_http.doubleKnock(request, rsaKey, {
+			tracerProvider,
+			specDeterminer,
+			validateRedirect: validateUrl
+		});
+	} catch (error) {
+		const failure = error instanceof _fedify_vocab_runtime.FetchError || error instanceof _fedify_vocab_runtime.UrlError ? error : createFetchError(inbox.href, error);
+		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
+			activityId,
+			inbox: inbox.href,
+			error: failure
+		});
+		federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), false, activityType);
+		throw failure;
+	}
+	try {
+		if (!response.ok) {
+			let error;
+			try {
+				error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
+			} catch (_) {
+				error = "";
+			}
+			logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
+				activityId,
+				inbox: inbox.href,
+				status: response.status,
+				statusText: response.statusText,
+				error
+			});
+			throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error, response.headers);
+		}
+		deliverySuccess = true;
+		const eventAttributes = {
+			"activitypub.inbox.url": inbox.href,
+			"activitypub.activity.id": activityId ?? ""
+		};
+		if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
+		const actorId = getActivityActorId(activity);
+		if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
+		span.addEvent("activitypub.activity.sent", eventAttributes);
+	} finally {
+		federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), deliverySuccess, activityType);
+	}
+}
+function createFetchError(url, cause) {
+	const error = new _fedify_vocab_runtime.FetchError(url, cause instanceof Error ? cause.message : String(cause));
+	error.cause = cause;
+	return error;
+}
+async function fetchWithValidatedRedirects(request, validateUrl) {
+	let body = await request.clone().text();
+	for (let redirects = 0;; redirects++) {
+		const response = await fetch(request, { redirect: "manual" });
+		const location = response.headers.get("Location");
+		if (![
+			301,
+			302,
+			303,
+			307,
+			308
+		].includes(response.status) || location == null) return response;
+		await response.body?.cancel();
+		if (redirects >= 20) throw new TypeError("Too many redirects");
+		const url = new URL(location, request.url);
+		await validateUrl(url.href);
+		const headers = new Headers(request.headers);
+		if (url.origin !== new URL(request.url).origin) {
+			headers.delete("Authorization");
+			headers.delete("Proxy-Authorization");
+			headers.delete("Cookie");
+			headers.delete("Host");
+		}
+		let method = request.method;
+		if ((response.status === 301 || response.status === 302) && method === "POST" || response.status === 303 && method !== "GET" && method !== "HEAD") {
+			method = "GET";
+			body = void 0;
+			for (const name of [
+				"Content-Encoding",
+				"Content-Language",
+				"Content-Length",
+				"Content-Location",
+				"Content-Type"
+			]) headers.delete(name);
+		}
+		request = new Request(url, {
+			method,
+			headers,
+			body,
+			redirect: "manual"
+		});
+	}
+}
+/**
+* An error that is thrown when an activity fails to send to a remote inbox.
+* It contains structured information about the failure, including the HTTP
+* status code, the inbox URL, and the response body.
+* @since 2.0.0
+*/
+var SendActivityError = class extends Error {
+	/**
+	* The inbox URL that the activity was being sent to.
+	*/
+	inbox;
+	/**
+	* The HTTP status code returned by the inbox.
+	*/
+	statusCode;
+	/**
+	* The response body from the inbox, if any.  Note that this may be
+	* truncated to a maximum of 1 KiB to prevent excessive memory consumption
+	* when remote servers return large error pages (e.g., Cloudflare error pages).
+	* If truncated, the string will end with `"… (truncated)"`.
+	*/
+	responseBody;
+	/**
+	* The response headers from the inbox.
+	* @since 2.3.0
+	*/
+	responseHeaders;
+	/**
+	* Creates a new {@link SendActivityError}.
+	* @param inbox The inbox URL.
+	* @param statusCode The HTTP status code.
+	* @param message The error message.
+	* @param responseBody The response body.
+	* @param responseHeaders The response headers.
+	*/
+	constructor(inbox, statusCode, message, responseBody, responseHeaders) {
+		super(message);
+		this.name = "SendActivityError";
+		this.inbox = inbox;
+		this.statusCode = statusCode;
+		this.responseBody = responseBody;
+		this.responseHeaders = new Headers(responseHeaders);
+	}
+};
+//#endregion
+//#region src/federation/portable-inbox.ts
+const Temporal$8 = require_http.Temporal;
+const MAX_TIMEOUT_MS = 2 ** 31 - 1;
+/**
+* Fills in the defaults of {@link PortableInboxForwardingOptions} and
+* validates them.
+* @param options The options.
+* @returns The resolved options.
+* @throws {RangeError} If `maxTargets` is not a non-negative integer, if `ttl`
+*                      is not positive, if `deadline` is negative or longer
+*                      than 2,147,483,647 milliseconds (about 24.8 days), or
+*                      if either duration has calendar units, i.e., weeks,
+*                      months, or years, whose length depends on the date.
+*/
+function resolvePortableInboxForwardingOptions(options = {}) {
+	const maxTargets = options.maxTargets ?? 10;
+	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
+	const ttl = Temporal$8.Duration.from(options.ttl ?? { days: 30 });
+	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
+	const deadline = Temporal$8.Duration.from(options.deadline ?? { seconds: 10 });
+	const deadlineMs = deadline.total("millisecond");
+	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
+	return {
+		maxTargets,
+		ttl,
+		deadline
+	};
+}
+/**
+* Decides whether this server accepts a delivery to a portable inbox on behalf
+* of the given actor, which the actor dispatcher returned for the identifier
+* in the requested inbox path.
+*
+* The actor document comes from the application, so it is trusted as is and
+* its proof is not verified here.
+* @param actor The actor the actor dispatcher returned.
+* @param options The requested DID, the canonical form of the requested inbox
+*                ID, and the origin of this server.
+* @returns The resolution.
+*/
+function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, localOrigin }) {
+	if (actor == null) return {
+		status: "rejected",
+		reason: "notFound"
+	};
+	const id = actor.id;
+	const did = id == null || !require_http.isPortableId(id) ? null : require_http.getPortableDid(id);
+	if (id == null || did == null) return {
+		status: "rejected",
+		reason: "notPortable"
+	};
+	if (did !== authority) return {
+		status: "rejected",
+		reason: "authorityMismatch"
+	};
+	const inboxId = actor.inboxId == null ? null : toPortableUri(actor.inboxId);
+	if (inboxId == null || require_http.getCanonicalPortableId(inboxId) !== canonicalInboxId) return {
+		status: "rejected",
+		reason: "inboxMismatch"
+	};
+	const gateways = actor.gateways;
+	if (!gateways.some((g) => (0, _fedify_vocab_runtime.isGatewayUrl)(g) && g.origin === localOrigin)) return {
+		status: "rejected",
+		reason: "notGateway"
+	};
+	return {
+		status: "accepted",
+		recipient: {
+			actorId: id,
+			inboxId,
+			canonicalInboxId,
+			gateways
+		}
+	};
+}
+/**
+* Gets the portable form of an `ap:` or `ap+ef61:` URI or a compatible
+* identifier, keeping its query.
+* @returns The portable URI, or `null` if the ID is neither, or is malformed.
+*/
+function toPortableUri(id) {
+	if (require_http.isPortableUri(id)) return id;
+	try {
+		return (0, _fedify_vocab_runtime.fromCompatibleEf61Id)(id);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+const RFC9421_DELIVERY_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"content-digest"
+];
+const DRAFT_DELIVERY_COMPONENTS = [
+	"(request-target)",
+	"host",
+	"digest"
+];
+/**
+* Checks whether an HTTP Signature covers the method, the target URI, and the
+* body of a request, which both Fedify and Mitra sign when forwarding.
+* @param signature The signature.
+* @returns `true` if the signature covers them.
+*/
+function coversDelivery(signature) {
+	return (signature.label == null ? DRAFT_DELIVERY_COMPONENTS : RFC9421_DELIVERY_COMPONENTS).every((name) => signature.components.some((c) => c.value === name && Object.keys(c.params).length < 1));
+}
+/**
+* Forwards an activity received in a portable inbox to the inboxes of the same
+* portable actor on its other gateways, as FEP-ef61 recommends.
+*
+* FEP-ef61 forbids forwarding an activity from an inbox more than once, so
+* each target gateway is claimed with an atomic compare-and-swap before the
+* activity is handed off, and a claim is never released, even if the hand-off
+* fails, since a failed hand-off does not prove that nothing was delivered.
+* Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
+* forwarded.
+*
+* Forwarded requests are signed with HTTP Signatures by the RSA key among
+* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
+* servers requiring HTTP Signatures accept them, and are sent unsigned
+* otherwise.  Either way, the receiving gateways authenticate the activity by
+* its own proof.
+*
+* If the delivery is signed with a gateway key of the recipient by one of its
+* other gateways, that gateway has the activity already, so it is claimed
+* without forwarding the activity to it.  See {@link identifySendingGateway}.
+* @param parameters The parameters.
+* @returns The target inbox URLs that the activity was handed off to.
+*/
+async function forwardPortableInboxActivity(parameters) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
+	const options = parameters.options ?? resolvePortableInboxForwardingOptions();
+	const { maxTargets, ttl } = options;
+	if (kv.cas == null || maxTargets < 1) return [];
+	const deadline = Date.now() + options.deadline.total("millisecond");
+	const canonicalActivityId = require_http.getCanonicalPortableId(activityId) ?? activityId.href;
+	const claimKey = (gateway) => [
+		...kvPrefix,
+		recipient.canonicalInboxId,
+		canonicalActivityId,
+		gateway
+	];
+	let targets = getForwardingTargets(recipient, excludedOrigins);
+	const sender = await identifySendingGateway(parameters, targets.map((t) => t.gateway), claimKey, deadline);
+	if (sender != null) {
+		logger.debug("Not forwarding activity {activityId} from the portable inbox {inbox} back to the gateway {gateway}, which delivered it.", {
+			activityId: activityId.href,
+			inbox: recipient.canonicalInboxId,
+			gateway: sender
+		});
+		await kv.cas(claimKey(sender), void 0, true, { ttl });
+		targets = targets.filter((t) => t.gateway !== sender);
+	}
+	if (targets.length > maxTargets) {
+		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
+			inbox: recipient.canonicalInboxId,
+			activityId: activityId.href,
+			max: maxTargets
+		});
+		targets.length = maxTargets;
+	}
+	const claimed = [];
+	for (const { gateway, inbox } of targets) if (await kv.cas(claimKey(gateway), void 0, true, { ttl })) claimed.push(inbox);
+	if (claimed.length < 1) return [];
+	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		targets: claimed.map((t) => t.href)
+	});
+	if (outboxQueue == null) await forwardImmediately(parameters, claimed, deadline);
+	else await enqueueForwarding(parameters, outboxQueue, claimed);
+	return claimed;
+}
+/**
+* Identifies the gateway of the recipient that forwarded a delivery to its
+* portable inbox, by the delivery's HTTP Signature made with the recipient's
+* gateway key, which FEP-ef61 has each gateway use for requests on behalf of
+* an actor.  Since the activity is authenticated by its own proof, the
+* signature only tells which gateway to skip, and a delivery whose signature
+* is invalid or cannot be verified is still forwarded to every gateway.
+*
+* Verifying the signature fetches the recipient's actor document from the
+* sending gateway, as gateway keys are not cached, so only the first signature
+* that may save a request is verified: one that covers the delivery and names
+* a gateway key of the recipient on one of the forwarding targets that the
+* activity has not been forwarded to yet.
+* @param parameters The forwarding parameters.
+* @param targets The origins of the gateways to forward to.
+* @param claimKey Gets the key of the claim for a gateway.
+* @param deadline The time by which identification has to finish, in
+*                 milliseconds since the epoch; afterwards, the sending
+*                 gateway is left unidentified.
+* @returns The origin of the sending gateway, or `null` if it is not
+*          identified.
+*/
+async function identifySendingGateway({ recipient, activityId, kv, signatures }, targets, claimKey, deadline) {
+	if (signatures == null || signatures.length < 1) return null;
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const actorId = require_http.getCanonicalPortableId(recipient.actorId);
+	if (actorId == null) return null;
+	const isGatewayKeyOfRecipient = (keyId) => {
+		if (!require_http.isCompatibleKeyId(keyId) || !targets.includes(keyId.origin)) return false;
+		const base = new URL(keyId.href);
+		base.hash = "";
+		return require_http.getCanonicalPortableId(base) === actorId;
+	};
+	let signature;
+	for (const candidate of signatures) if (candidate.coversDelivery && isGatewayKeyOfRecipient(candidate.keyId) && await kv.get(claimKey(candidate.keyId.origin)) === void 0) {
+		signature = candidate;
+		break;
+	}
+	if (signature == null) return null;
+	const { keyId } = signature;
+	const logProperties = {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		keyId: keyId.href
+	};
+	const verification = Promise.resolve().then(() => signature.verify()).then((key) => {
+		if (key == null) logger.debug("The HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} is not verified with the key {keyId}; forwarding it without identifying the sending gateway.", logProperties);
+		return key;
+	}, (error) => {
+		logger.debug("Failed to verify the HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} with the key {keyId}; forwarding it without identifying the sending gateway:\n{error}", {
+			...logProperties,
+			error
+		});
+		return null;
+	});
+	let timer;
+	const key = await Promise.race([verification, new Promise((resolve) => {
+		timer = setTimeout(() => {
+			logger.debug("Verifying the HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} did not finish in time; forwarding it without identifying the sending gateway.", logProperties);
+			resolve(null);
+		}, Math.max(0, deadline - Date.now()));
+	})]);
+	clearTimeout(timer);
+	if (key == null) return null;
+	if (key.id == null || key.id.href !== keyId.href || !isGatewayKeyOfRecipient(key.id) || key.ownerId == null || !require_http.isPortableId(key.ownerId) || require_http.getCanonicalPortableId(key.ownerId) !== actorId) {
+		logger.debug("The delivery of activity {activityId} to the portable inbox {inbox} is not signed with a gateway key of the recipient; forwarding it without identifying the sending gateway.", logProperties);
+		return null;
+	}
+	return key.id.origin;
+}
+function getForwardingTargets(recipient, excludedOrigins) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const seen = new Set(excludedOrigins);
+	const targets = [];
+	for (const gateway of recipient.gateways) {
+		if (!(0, _fedify_vocab_runtime.isGatewayUrl)(gateway) || seen.has(gateway.origin)) continue;
+		seen.add(gateway.origin);
+		let inbox;
+		try {
+			inbox = (0, _fedify_vocab_runtime.toCompatibleEf61Id)(recipient.inboxId, gateway.origin);
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			logger.warn("Cannot forward to the gateway {gateway}, as the portable inbox {inbox} cannot be represented as its compatible identifier.", {
+				gateway: gateway.origin,
+				inbox: recipient.canonicalInboxId
+			});
+			continue;
+		}
+		targets.push({
+			gateway: gateway.origin,
+			inbox
+		});
+	}
+	return targets;
+}
+/**
+* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
+* key, as {@link sendActivity} signs requests only with such a key.  Since
+* the targets have already been claimed, the activity is forwarded unsigned
+* rather than not at all if the key cannot be resolved or used.
+*/
+async function resolveForwardingKey({ getKeys, activityId }) {
+	if (getKeys == null) return null;
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	let key;
+	try {
+		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
+	} catch (error) {
+		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	if (key == null) return null;
+	try {
+		require_http.validateCryptoKey(key.privateKey, "private");
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	return key;
+}
+async function forwardImmediately(parameters, inboxes, deadlineAt) {
+	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, meterProvider, tracerProvider } = parameters;
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const deadline = Math.max(0, deadlineAt - Date.now());
+	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
+		activity,
+		activityId: activityId.href,
+		activityType,
+		keys: key == null ? [] : [key],
+		inbox,
+		allowPrivateAddress,
+		specDeterminer,
+		meterProvider,
+		tracerProvider
+	}).catch((error) => {
+		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+			activityId: activityId.href,
+			inbox: inbox.href,
+			error
+		});
+	}))));
+	let timer;
+	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
+		timer = setTimeout(() => resolve(true), deadline);
+	})]);
+	clearTimeout(timer);
+	if (timedOut) logger.warn("Forwarding activity {activityId} to other gateways did not finish in {deadline} ms; responding to the delivery without waiting for it.", {
+		activityId: activityId.href,
+		deadline
+	});
+}
+async function enqueueForwarding(parameters, outboxQueue, inboxes) {
+	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const key = await resolveForwardingKey(parameters);
+	const keys = [];
+	if (key != null) try {
+		keys.push({
+			keyId: key.keyId.href,
+			privateKey: await require_http.exportJwk(key.privateKey)
+		});
+	} catch (error) {
+		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+	}
+	startQueue?.();
+	const started = (/* @__PURE__ */ new Date()).toISOString();
+	const traceContext = {};
+	_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), traceContext);
+	await Promise.all(inboxes.map(async (inbox) => {
+		const message = {
+			type: "outbox",
+			id: crypto.randomUUID(),
+			baseUrl,
+			keys,
+			activity,
+			activityId: activityId.href,
+			activityType,
+			inbox: inbox.href,
+			sharedInbox: false,
+			started,
+			attempt: 0,
+			headers: {},
+			traceContext
+		};
+		try {
+			await outboxQueue.enqueue(message);
+		} catch (error) {
+			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+				activityId: activityId.href,
+				inbox: inbox.href,
+				error
+			});
+			return;
+		}
+		require_http.recordOutboxEnqueue(meterProvider, outboxQueue, message);
+	}));
+}
+//#endregion
+//#region src/federation/temporal.ts
+const Temporal$7 = require_http.Temporal;
+function isPlainObject$1(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value);
+}
+function normalizeDateTimeLiteral(value) {
+	return value.substring(19).match(/[Z+-]/) ? value : value + "Z";
+}
+function isMalformedDateTimeLiteral(value) {
+	if (typeof value !== "string") return false;
+	try {
+		Temporal$7.Instant.from(normalizeDateTimeLiteral(value));
+		return false;
+	} catch {
+		return true;
+	}
+}
+function isMalformedDurationLiteral(value) {
+	if (typeof value !== "string") return false;
+	try {
+		Temporal$7.Duration.from(value);
+		return false;
+	} catch {
+		return true;
+	}
+}
+const TEMPORAL_DATE_TIME_IRIS = /* @__PURE__ */ new Set([
+	"https://www.w3.org/ns/activitystreams#deleted",
+	"https://www.w3.org/ns/activitystreams#endTime",
+	"https://www.w3.org/ns/activitystreams#published",
+	"https://www.w3.org/ns/activitystreams#startTime",
+	"https://www.w3.org/ns/activitystreams#updated",
+	"http://purl.org/dc/terms/created",
+	"https://w3id.org/security#created"
+]);
+const TEMPORAL_DURATION_IRIS = /* @__PURE__ */ new Set(["https://www.w3.org/ns/activitystreams#duration"]);
+const QUESTION_CLOSED_IRI = "https://www.w3.org/ns/activitystreams#closed";
+const XSD_DATE_TIME_IRI = "http://www.w3.org/2001/XMLSchema#dateTime";
+function hasMalformedExpandedDateTimeLiteral(value) {
+	if (Array.isArray(value)) return value.some(hasMalformedExpandedDateTimeLiteral);
+	return isPlainObject$1(value) && "@value" in value && isMalformedDateTimeLiteral(value["@value"]);
+}
+function hasMalformedExpandedQuestionClosedLiteral(value) {
+	if (Array.isArray(value)) return value.some(hasMalformedExpandedQuestionClosedLiteral);
+	if (!isPlainObject$1(value) || !("@value" in value)) return false;
+	const literal = value["@value"];
+	if (typeof literal === "boolean") return false;
+	if (typeof literal !== "string") return false;
+	if (value["@type"] !== XSD_DATE_TIME_IRI) return false;
+	if (new Date(literal).toString() === "Invalid Date") return false;
+	return isMalformedDateTimeLiteral(literal);
+}
+function hasMalformedExpandedDurationLiteral(value) {
+	if (Array.isArray(value)) return value.some(hasMalformedExpandedDurationLiteral);
+	return isPlainObject$1(value) && "@value" in value && isMalformedDurationLiteral(value["@value"]);
+}
+function hasMalformedKnownTemporalLiteralInternal(value, visited) {
+	if (Array.isArray(value)) return value.some((item) => hasMalformedKnownTemporalLiteralInternal(item, visited));
+	if (!isPlainObject$1(value)) return false;
+	if (visited.has(value)) return false;
+	visited.add(value);
+	if ("@value" in value) return false;
+	for (const [key, child] of Object.entries(value)) {
+		if (TEMPORAL_DATE_TIME_IRIS.has(key)) {
+			if (hasMalformedExpandedDateTimeLiteral(child)) return true;
+			continue;
+		}
+		if (key === QUESTION_CLOSED_IRI) {
+			if (hasMalformedExpandedQuestionClosedLiteral(child)) return true;
+			continue;
+		}
+		if (TEMPORAL_DURATION_IRIS.has(key)) {
+			if (hasMalformedExpandedDurationLiteral(child)) return true;
+			continue;
+		}
+		if (hasMalformedKnownTemporalLiteralInternal(child, visited)) return true;
+	}
+	return false;
+}
+async function hasMalformedKnownTemporalLiteral(value, contextLoader) {
+	try {
+		return hasMalformedKnownTemporalLiteralInternal(await _fedify_vocab_runtime_jsonld.default.expand(value, {
+			documentLoader: require_http.getNormalizationContextLoader(contextLoader),
+			keepFreeFloatingNodes: true
+		}), /* @__PURE__ */ new Set());
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/federation/handler.ts
+const Temporal$6 = require_http.Temporal;
+const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
+const INBOX_COMPOUND_PROOF_LIMITS = {
+	maxDepth: 64,
+	maxMaps: 1e4,
+	maxProofs: 32,
+	maxBytes: 10 * 1024 * 1024
+};
+function isRemoteContextLoadingFailure$1(error) {
+	return error instanceof Error && typeof error.details === "object" && error.details != null && error.details.code === "loading remote context failed";
+}
+function isPermanentRemoteContextError$1(error) {
+	if (!(error instanceof Error) || error.name !== "jsonld.InvalidUrl") return false;
+	const details = error.details;
+	if (details?.code === "invalid remote context") return true;
+	return isRemoteContextLoadingFailure$1(error) && typeof details?.url === "string" && !URL.canParse(details.url) && require_http.isClearlyMalformedContextReference(details.url);
+}
+function isInvalidJsonLdError(error) {
 	if (!(error instanceof Error)) return false;
 	const name = error.name;
 	return name === "UnsafeJsonLdError" || error instanceof require_http.InvalidContextReferenceError || isPermanentRemoteContextError$1(error) || name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure$1(error);
@@ -2569,14 +3471,7 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 	} });
 }
 function isRequestedPortableObject(object, canonicalId) {
-	if (object.id == null) return false;
-	if (object.id.protocol !== "ap:" && object.id.protocol !== "ap+ef61:") return false;
-	try {
-		return (0, _fedify_vocab_runtime.canonicalizePortableUri)((0, _fedify_vocab_runtime.formatIri)(object.id)) === canonicalId;
-	} catch (error) {
-		if (error instanceof TypeError) return false;
-		throw error;
-	}
+	return object.id != null && require_http.getCanonicalPortableId(object.id) === canonicalId;
 }
 async function getJsonLdRootId(jsonLd, contextLoader) {
 	const expanded = await _fedify_vocab_runtime_jsonld.default.expand(jsonLd, {
@@ -2588,6 +3483,7 @@ async function getJsonLdRootId(jsonLd, contextLoader) {
 	return typeof id === "string" ? id : null;
 }
 function isRequestedPortableId(id, canonicalId) {
+	if (!/^ap(?:\+ef61)?:\/\//i.test(id)) return URL.canParse(id) && require_http.getCanonicalPortableId(new URL(id)) === canonicalId;
 	try {
 		return (0, _fedify_vocab_runtime.canonicalizePortableUri)(id) === canonicalId;
 	} catch (error) {
@@ -3450,7 +4346,7 @@ async function handleInboxInternal(request, parameters, span) {
 			return await respondInvalidActivity(error);
 		}
 		activityVerified = true;
-		if (!skipSignatureVerification && require_http.hasPortableActor(activity)) try {
+		if (!skipSignatureVerification && isPortableActivity(activity)) try {
 			proofVerified = await require_http.verifyObject(_fedify_vocab.Activity, jsonWithoutSig, {
 				contextLoader: require_http.wrapContextLoaderForJsonLd(ctx.contextLoader),
 				documentLoader: ctx.documentLoader,
@@ -3634,7 +4530,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
-	if (!skipSignatureVerification && !proofVerified && (require_http.hasPortableActor(activity) || isPortableGatewayKey(httpSigKey))) {
+	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableGatewayKey(httpSigKey))) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
 			activity: json,
@@ -3652,6 +4548,32 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	if (!skipSignatureVerification && activity.id != null && require_http.isPortableId(activity.id)) {
+		const rejection = await verifyPortableActivityId(activity.id, jsonWithoutSig, {
+			contextLoader: require_http.wrapContextLoaderForJsonLd(ctx.contextLoader),
+			documentLoader: ctx.documentLoader,
+			keyCache,
+			meterProvider,
+			tracerProvider
+		});
+		if (rejection != null) {
+			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+			logger.error("The portable activity {activityId} is not authenticated by an Object Integrity Proof of its own DID: {reason}", {
+				activity: json,
+				recipient,
+				activityId: activity.id.href,
+				reason: rejection
+			});
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: `The portable activity (${activity.id.href}) is not authenticated by an Object Integrity Proof of its own DID.`
+			});
+			return new Response("Portable activities must have valid Object Integrity Proofs made by their own DIDs.", {
+				status: 401,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+	}
 	if (httpSigKey != null && !await require_owner.doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		require_http.getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("actorKeyMismatch", httpSigKey.id == null ? void 0 : require_http.getRemoteHost(httpSigKey.id));
@@ -3728,7 +4650,21 @@ async function handleInboxInternal(request, parameters, span) {
 		inbox: portableInbox.recipient.canonicalInboxId
 	});
 	else try {
-		await portableInbox.forward(json, activity.id, (0, _fedify_vocab.getTypeId)(activity).href);
+		await portableInbox.forward(json, activity.id, (0, _fedify_vocab.getTypeId)(activity).href, require_http.listRequestSignatures(request).map((signature) => ({
+			keyId: signature.keyId,
+			coversDelivery: coversDelivery(signature),
+			verify: async () => {
+				const verification = await require_http.verifyRequestDetailed(require_http.selectRequestSignature(request, signature), {
+					contextLoader: ctx.contextLoader,
+					documentLoader: ctx.documentLoader,
+					timeWindow: signatureTimeWindow,
+					keyCache,
+					meterProvider,
+					tracerProvider
+				});
+				return verification.verified ? verification.key : null;
+			}
+		})));
 	} catch (error) {
 		logger.error("Failed to forward activity {activityId} to the other gateways of the portable inbox {inbox}:\n{error}", {
 			activityId: activity.id.href,
@@ -4223,580 +5159,324 @@ const authIfNeeded = async (context, values, { authorizePredicate: authorize = v
 /**
 * Appends a cursor parameter to a URL if the cursor exists.
 * @template Cursor The type of the cursor (string, null, or undefined).
-* @param {URL} url The base URL to append the cursor to.
-* @param {string | null | undefined} cursor The cursor value to append.
-* @returns The URL with cursor appended if cursor is a string, null otherwise.
-* @since 1.8.0
-*/
-const appendCursorIfExists = (url, cursor) => {
-	if (cursor === null || cursor === void 0) return null;
-	const copied = new URL(url);
-	copied.searchParams.set("cursor", cursor);
-	return copied;
-};
-/**
-* Creates an HTTP response for ActivityPub data.
-* @param {unknown} data The data to serialize as JSON-LD.
-* @returns {Response} An HTTP response with the data as ActivityPub JSON.
-* @since 1.8.0
-*/
-const respondAsActivity = (data) => new Response(JSON.stringify(data), { headers: {
-	"Content-Type": "application/activity+json",
-	Vary: "Accept"
-} });
-/**
-* Base class for handler errors.
-* @since 1.8.0
-*/
-var HandlerError = class extends Error {
-	constructor(message) {
-		super(message);
-	}
-	/**
-	* Throws this error.
-	* @returns Never returns, always throws.
-	*/
-	throw() {
-		throw this;
-	}
-};
-/**
-* Error thrown when items are not found in a collection.
-* @since 1.8.0
-*/
-var ItemsNotFoundError = class extends HandlerError {
-	constructor() {
-		super("Items not found in the collection.");
-	}
-};
-/**
-* Error thrown when access to a collection is unauthorized.
-* @since 1.8.0
-*/
-var UnauthorizedError = class extends HandlerError {
-	constructor() {
-		super("Unauthorized access to the collection.");
-	}
-};
-/**
-* Responds with the given object in JSON-LD format.
-*
-* @param object The object to respond with.
-* @param options Options.
-* @since 0.3.0
-*/
-async function respondWithObject(object, options) {
-	const jsonLd = await object.toJsonLd(options);
-	return new Response(JSON.stringify(jsonLd), { headers: { "Content-Type": "application/activity+json" } });
-}
-/**
-* Responds with the given object in JSON-LD format if the request accepts
-* JSON-LD.
-*
-* @param object The object to respond with.
-* @param request The request to check for JSON-LD acceptability.
-* @param options Options.
-* @since 0.3.0
-*/
-async function respondWithObjectIfAcceptable(object, request, options) {
-	if (!acceptsJsonLd(request)) return null;
-	const response = await respondWithObject(object, options);
-	response.headers.set("Vary", "Accept");
-	return response;
-}
-function generateNonce() {
-	const bytes = /* @__PURE__ */ new Uint8Array(16);
-	crypto.getRandomValues(bytes);
-	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-async function verifySignatureNonce(request, kv, noncePrefix, verifiedLabel) {
-	const signatureInput = request.headers.get("Signature-Input");
-	if (signatureInput == null) return false;
-	const parsed = require_http.parseRfc9421SignatureInput(signatureInput);
-	if (verifiedLabel == null) return false;
-	const sig = parsed[verifiedLabel];
-	if (sig == null) return false;
-	const nonce = sig.nonce;
-	if (nonce == null) return false;
-	const key = [...noncePrefix, nonce];
-	if (kv.cas != null) return await kv.cas(key, true, void 0);
-	if (await kv.get(key) != null) {
-		await kv.delete(key);
-		return true;
-	}
-	return false;
-}
-const getFailedSignatureResponse = async (policy, kv, kvPrefixes) => {
-	const headers = await getFailedSignatureHeaders(policy, kv, kvPrefixes);
-	return new Response("Failed to verify the request signature.", {
-		status: 401,
-		headers
-	});
-};
-const getFailedSignatureHeaders = async (policy, kv, kvPrefixes) => ({
-	"Content-Type": "text/plain; charset=utf-8",
-	...policy?.enabled && {
-		"Accept-Signature": await buildAcceptSignatureHeader(policy, kv, kvPrefixes.acceptSignatureNonce),
-		"Cache-Control": "no-store",
-		"Vary": "Accept, Signature"
-	}
-});
-async function buildAcceptSignatureHeader(policy, kv, noncePrefix) {
-	const parameters = { created: true };
-	if (policy.requestNonce) {
-		const nonce = generateNonce();
-		await setKey(kv, [...noncePrefix, nonce], policy);
-		parameters.nonce = nonce;
-	}
-	const baseComponents = policy.components ?? DEF_COMPONENTS;
-	return require_http.formatAcceptSignature([{
-		label: "sig1",
-		components: (0, es_toolkit.uniq)(MIN_COMPONENTS.concat(baseComponents)).filter((c) => c !== "@status").map((v) => ({
-			value: v,
-			params: {}
-		})),
-		parameters
-	}]);
-}
-async function setKey(kv, key, policy) {
-	const seconds = policy.nonceTtlSeconds ?? 300;
-	const ttl = Temporal$7.Duration.from({ seconds });
-	await kv.set(key, true, { ttl });
-}
-const DEF_COMPONENTS = [
-	"@method",
-	"@target-uri",
-	"@authority",
-	"content-digest"
-];
-const MIN_COMPONENTS = [
-	"@method",
-	"@target-uri",
-	"@authority"
-];
-/**
-* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
-* portable actor, i.e., its ID is a compatible identifier and it is owned by
-* a portable actor, which only the portable actor's signed document can
-* establish.
-*/
-function isPortableGatewayKey(key) {
-	return key?.id != null && require_http.isCompatibleKeyId(key.id) && key.ownerId != null && require_http.isPortableUri(key.ownerId);
-}
-//#endregion
-//#region src/federation/kv.ts
-const Temporal$6 = require_http.Temporal;
-/**
-* A key–value store that stores values in memory.
-* Do not use this in production as it does not persist values.
-*
-* @since 0.5.0
-*/
-var MemoryKvStore = class {
-	#values = {};
-	#encodeKey(key) {
-		return JSON.stringify(key);
-	}
-	/**
-	* {@inheritDoc KvStore.get}
-	*/
-	get(key) {
-		const encodedKey = this.#encodeKey(key);
-		const entry = this.#values[encodedKey];
-		if (entry == null) return Promise.resolve(void 0);
-		const [value, expiration] = entry;
-		if (expiration != null && Temporal$6.Now.instant().until(expiration).sign < 0) {
-			delete this.#values[encodedKey];
-			return Promise.resolve(void 0);
-		}
-		return Promise.resolve(value);
-	}
-	/**
-	* {@inheritDoc KvStore.set}
-	*/
-	set(key, value, options) {
-		const encodedKey = this.#encodeKey(key);
-		const expiration = options?.ttl == null ? null : Temporal$6.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
-		this.#values[encodedKey] = [value, expiration];
-		return Promise.resolve();
-	}
-	/**
-	* {@inheritDoc KvStore.delete}
-	*/
-	delete(key) {
-		const encodedKey = this.#encodeKey(key);
-		delete this.#values[encodedKey];
-		return Promise.resolve();
-	}
-	/**
-	* {@inheritDoc KvStore.cas}
-	*/
-	cas(key, expectedValue, newValue, options) {
-		const encodedKey = this.#encodeKey(key);
-		const entry = this.#values[encodedKey];
-		let currentValue;
-		if (entry == null) currentValue = void 0;
-		else {
-			const [value, expiration] = entry;
-			if (expiration != null && Temporal$6.Now.instant().until(expiration).sign < 0) {
-				delete this.#values[encodedKey];
-				currentValue = void 0;
-			} else currentValue = value;
-		}
-		if (!(0, es_toolkit.isEqual)(currentValue, expectedValue)) return Promise.resolve(false);
-		const expiration = options?.ttl == null ? null : Temporal$6.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
-		this.#values[encodedKey] = [newValue, expiration];
-		return Promise.resolve(true);
+* @param {URL} url The base URL to append the cursor to.
+* @param {string | null | undefined} cursor The cursor value to append.
+* @returns The URL with cursor appended if cursor is a string, null otherwise.
+* @since 1.8.0
+*/
+const appendCursorIfExists = (url, cursor) => {
+	if (cursor === null || cursor === void 0) return null;
+	const copied = new URL(url);
+	copied.searchParams.set("cursor", cursor);
+	return copied;
+};
+/**
+* Creates an HTTP response for ActivityPub data.
+* @param {unknown} data The data to serialize as JSON-LD.
+* @returns {Response} An HTTP response with the data as ActivityPub JSON.
+* @since 1.8.0
+*/
+const respondAsActivity = (data) => new Response(JSON.stringify(data), { headers: {
+	"Content-Type": "application/activity+json",
+	Vary: "Accept"
+} });
+/**
+* Base class for handler errors.
+* @since 1.8.0
+*/
+var HandlerError = class extends Error {
+	constructor(message) {
+		super(message);
 	}
 	/**
-	* {@inheritDoc KvStore.list}
+	* Throws this error.
+	* @returns Never returns, always throws.
 	*/
-	async *list(prefix) {
-		const now = Temporal$6.Now.instant();
-		for (const [encodedKey, entry] of Object.entries(this.#values)) {
-			const key = JSON.parse(encodedKey);
-			if (prefix != null) {
-				if (key.length < prefix.length) continue;
-				if (!prefix.every((p, i) => key[i] === p)) continue;
-			}
-			const [value, expiration] = entry;
-			if (expiration != null && now.until(expiration).sign < 0) {
-				delete this.#values[encodedKey];
-				continue;
-			}
-			yield {
-				key,
-				value
-			};
-		}
+	throw() {
+		throw this;
 	}
 };
-//#endregion
-//#region src/nodeinfo/handler.ts
 /**
-* Handles a NodeInfo request.  You would not typically call this function
-* directly, but instead use {@link Federation.handle} method.
-* @param request The NodeInfo request to handle.
-* @param parameters The parameters for handling the request.
-* @returns The response to the request.
+* Error thrown when items are not found in a collection.
+* @since 1.8.0
 */
-async function handleNodeInfo(_request, { context, nodeInfoDispatcher }) {
-	const promise = nodeInfoDispatcher(context);
-	const json = require_types.nodeInfoToJson(promise instanceof Promise ? await promise : promise);
-	return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\"" } });
-}
+var ItemsNotFoundError = class extends HandlerError {
+	constructor() {
+		super("Items not found in the collection.");
+	}
+};
 /**
-* Handles a request to `/.well-known/nodeinfo`.  You would not typically call
-* this function directly, but instead use {@link Federation.handle} method.
-* @param request The request to handle.
-* @param context The request context.
-* @returns The response to the request.
+* Error thrown when access to a collection is unauthorized.
+* @since 1.8.0
 */
-function handleNodeInfoJrd(_request, context) {
-	const links = [];
-	try {
-		links.push({
-			rel: "http://nodeinfo.diaspora.software/ns/schema/2.1",
-			href: context.getNodeInfoUri().href,
-			type: "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\""
-		});
-	} catch (e) {
-		if (!(e instanceof _fedify_uri_template.RouterError)) throw e;
+var UnauthorizedError = class extends HandlerError {
+	constructor() {
+		super("Unauthorized access to the collection.");
 	}
-	const response = new Response(JSON.stringify({ links }), { headers: { "Content-Type": "application/jrd+json" } });
-	return Promise.resolve(response);
-}
-//#endregion
-//#region src/federation/send.ts
+};
 /**
-* Extracts the inbox URLs from recipients.
-* @param parameters The parameters to extract the inboxes.
-*                   See also {@link ExtractInboxesParameters}.
-* @returns The inboxes as a map of inbox URL to actor URIs.
+* Responds with the given object in JSON-LD format.
+*
+* @param object The object to respond with.
+* @param options Options.
+* @since 0.3.0
 */
-function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
-	const inboxes = {};
-	for (const recipient of recipients) {
-		let inbox;
-		let sharedInbox = false;
-		if (preferSharedInbox && recipient.endpoints?.sharedInbox != null) {
-			inbox = recipient.endpoints.sharedInbox;
-			sharedInbox = true;
-		} else inbox = recipient.inboxId;
-		if (inbox != null && recipient.id != null) {
-			if (excludeBaseUris != null && excludeBaseUris.some((u) => u.origin === inbox?.origin)) continue;
-			inboxes[inbox.href] ??= {
-				actorIds: /* @__PURE__ */ new Set(),
-				sharedInbox
-			};
-			inboxes[inbox.href].actorIds.add(recipient.id.href);
-		}
-	}
-	return inboxes;
+async function respondWithObject(object, options) {
+	const jsonLd = await object.toJsonLd(options);
+	return new Response(JSON.stringify(jsonLd), { headers: { "Content-Type": "application/activity+json" } });
 }
 /**
-* Sends an {@link Activity} to an inbox.
+* Responds with the given object in JSON-LD format if the request accepts
+* JSON-LD.
 *
-* @param parameters The parameters for sending the activity.
-*                   See also {@link SendActivityParameters}.
-* @throws {Error} If the activity fails to send.
+* @param object The object to respond with.
+* @param request The request to check for JSON-LD acceptability.
+* @param options Options.
+* @since 0.3.0
 */
-function sendActivity(options) {
-	const tracerProvider = options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
-	return tracerProvider.getTracer(require_http.name, require_http.version).startActiveSpan("activitypub.send_activity", {
-		kind: _opentelemetry_api.SpanKind.CLIENT,
-		attributes: { "activitypub.shared_inbox": options.sharedInbox ?? false }
-	}, async (span) => {
-		if (options.activityId != null) span.setAttribute("activitypub.activity.id", options.activityId);
-		if (options.activityType != null) span.setAttribute("activitypub.activity.type", options.activityType);
-		try {
-			await sendActivityInternal({
-				...options,
-				tracerProvider
-			}, span);
-		} catch (e) {
-			span.setStatus({
-				code: _opentelemetry_api.SpanStatusCode.ERROR,
-				message: String(e)
-			});
-			throw e;
-		} finally {
-			span.end();
-		}
-	});
-}
-const MAX_ERROR_RESPONSE_BODY_BYTES = 1024;
-function getActivityActorId(activity) {
-	if (!isRecord(activity)) return void 0;
-	return getIdValue(activity.actor);
-}
-function getIdValue(value) {
-	if (typeof value === "string" && value !== "") return value;
-	if (value instanceof URL) return value.href;
-	if (Array.isArray(value)) {
-		for (const item of value) {
-			const id = getIdValue(item);
-			if (id != null) return id;
-		}
-		return;
-	}
-	if (isRecord(value)) return getIdValue(value.id);
-}
-function isRecord(value) {
-	return typeof value === "object" && value != null;
+async function respondWithObjectIfAcceptable(object, request, options) {
+	if (!acceptsJsonLd(request)) return null;
+	const response = await respondWithObject(object, options);
+	response.headers.set("Vary", "Accept");
+	return response;
 }
-async function readLimitedResponseBody(response, maxBytes) {
-	if (response.body == null) return "";
-	const reader = response.body.getReader();
-	const decoder = new TextDecoder();
-	const chunks = [];
-	let totalBytes = 0;
-	let truncated = false;
-	try {
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			if (totalBytes + value.length > maxBytes) {
-				const remaining = maxBytes - totalBytes;
-				if (remaining > 0) chunks.push(decoder.decode(value.slice(0, remaining), { stream: true }));
-				truncated = true;
-				break;
-			}
-			chunks.push(decoder.decode(value, { stream: true }));
-			totalBytes += value.length;
-		}
-	} finally {
-		reader.releaseLock();
-	}
-	let result = chunks.join("");
-	if (truncated) result += "… (truncated)";
-	return result;
+function generateNonce() {
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	crypto.getRandomValues(bytes);
+	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span) {
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"federation",
-		"outbox"
-	]);
-	const federationMetrics = require_http.getFederationMetrics(meterProvider);
-	const started = performance.now();
-	let deliverySuccess = false;
-	async function validateUrl(url) {
-		if (!allowPrivateAddress) try {
-			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
-		} catch (error) {
-			if (error instanceof _fedify_vocab_runtime.UrlError) logger.error("Disallowed private URL: {url}", {
-				url,
-				error
-			});
-			throw error;
-		}
-	}
-	await validateUrl(inbox.href);
-	headers = new Headers(headers);
-	headers.set("Content-Type", "application/activity+json");
-	const request = new Request(inbox, {
-		method: "POST",
-		headers,
-		body: JSON.stringify(activity),
-		redirect: "manual"
-	});
-	let rsaKey = null;
-	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
-		rsaKey = key;
-		break;
+async function verifySignatureNonce(request, kv, noncePrefix, verifiedLabel) {
+	const signatureInput = request.headers.get("Signature-Input");
+	if (signatureInput == null) return false;
+	const parsed = require_http.parseRfc9421SignatureInput(signatureInput);
+	if (verifiedLabel == null) return false;
+	const sig = parsed[verifiedLabel];
+	if (sig == null) return false;
+	const nonce = sig.nonce;
+	if (nonce == null) return false;
+	const key = [...noncePrefix, nonce];
+	if (kv.cas != null) return await kv.cas(key, true, void 0);
+	if (await kv.get(key) != null) {
+		await kv.delete(key);
+		return true;
 	}
-	if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
-		activityId,
-		inbox: inbox.href
-	});
-	else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
-		inbox: inbox.href,
-		keys: keys.map((pair) => ({
-			keyId: pair.keyId.href,
-			privateKey: pair.privateKey
-		}))
+	return false;
+}
+const getFailedSignatureResponse = async (policy, kv, kvPrefixes) => {
+	const headers = await getFailedSignatureHeaders(policy, kv, kvPrefixes);
+	return new Response("Failed to verify the request signature.", {
+		status: 401,
+		headers
 	});
-	let response;
-	try {
-		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await require_http.doubleKnock(request, rsaKey, {
-			tracerProvider,
-			specDeterminer,
-			validateRedirect: validateUrl
-		});
-	} catch (error) {
-		const failure = error instanceof _fedify_vocab_runtime.FetchError || error instanceof _fedify_vocab_runtime.UrlError ? error : createFetchError(inbox.href, error);
-		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
-			activityId,
-			inbox: inbox.href,
-			error: failure
-		});
-		federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), false, activityType);
-		throw failure;
+};
+const getFailedSignatureHeaders = async (policy, kv, kvPrefixes) => ({
+	"Content-Type": "text/plain; charset=utf-8",
+	...policy?.enabled && {
+		"Accept-Signature": await buildAcceptSignatureHeader(policy, kv, kvPrefixes.acceptSignatureNonce),
+		"Cache-Control": "no-store",
+		"Vary": "Accept, Signature"
 	}
-	try {
-		if (!response.ok) {
-			let error;
-			try {
-				error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
-			} catch (_) {
-				error = "";
-			}
-			logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
-				activityId,
-				inbox: inbox.href,
-				status: response.status,
-				statusText: response.statusText,
-				error
-			});
-			throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error, response.headers);
-		}
-		deliverySuccess = true;
-		const eventAttributes = {
-			"activitypub.inbox.url": inbox.href,
-			"activitypub.activity.id": activityId ?? ""
-		};
-		if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
-		const actorId = getActivityActorId(activity);
-		if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
-		span.addEvent("activitypub.activity.sent", eventAttributes);
-	} finally {
-		federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), deliverySuccess, activityType);
+});
+async function buildAcceptSignatureHeader(policy, kv, noncePrefix) {
+	const parameters = { created: true };
+	if (policy.requestNonce) {
+		const nonce = generateNonce();
+		await setKey(kv, [...noncePrefix, nonce], policy);
+		parameters.nonce = nonce;
 	}
+	const baseComponents = policy.components ?? DEF_COMPONENTS;
+	return require_http.formatAcceptSignature([{
+		label: "sig1",
+		components: (0, es_toolkit.uniq)(MIN_COMPONENTS.concat(baseComponents)).filter((c) => c !== "@status").map((v) => ({
+			value: v,
+			params: {}
+		})),
+		parameters
+	}]);
 }
-function createFetchError(url, cause) {
-	const error = new _fedify_vocab_runtime.FetchError(url, cause instanceof Error ? cause.message : String(cause));
-	error.cause = cause;
-	return error;
+async function setKey(kv, key, policy) {
+	const seconds = policy.nonceTtlSeconds ?? 300;
+	const ttl = Temporal$6.Duration.from({ seconds });
+	await kv.set(key, true, { ttl });
 }
-async function fetchWithValidatedRedirects(request, validateUrl) {
-	let body = await request.clone().text();
-	for (let redirects = 0;; redirects++) {
-		const response = await fetch(request, { redirect: "manual" });
-		const location = response.headers.get("Location");
-		if (![
-			301,
-			302,
-			303,
-			307,
-			308
-		].includes(response.status) || location == null) return response;
-		await response.body?.cancel();
-		if (redirects >= 20) throw new TypeError("Too many redirects");
-		const url = new URL(location, request.url);
-		await validateUrl(url.href);
-		const headers = new Headers(request.headers);
-		if (url.origin !== new URL(request.url).origin) {
-			headers.delete("Authorization");
-			headers.delete("Proxy-Authorization");
-			headers.delete("Cookie");
-			headers.delete("Host");
-		}
-		let method = request.method;
-		if ((response.status === 301 || response.status === 302) && method === "POST" || response.status === 303 && method !== "GET" && method !== "HEAD") {
-			method = "GET";
-			body = void 0;
-			for (const name of [
-				"Content-Encoding",
-				"Content-Language",
-				"Content-Length",
-				"Content-Location",
-				"Content-Type"
-			]) headers.delete(name);
-		}
-		request = new Request(url, {
-			method,
-			headers,
-			body,
-			redirect: "manual"
-		});
+const DEF_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"@authority",
+	"content-digest"
+];
+const MIN_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"@authority"
+];
+/**
+* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
+* portable actor, i.e., its ID is a compatible identifier and it is owned by
+* a portable actor, which only the portable actor's signed document can
+* establish.
+*/
+function isPortableGatewayKey(key) {
+	return key?.id != null && require_http.isCompatibleKeyId(key.id) && key.ownerId != null && require_http.isPortableId(key.ownerId);
+}
+/**
+* Checks whether an activity needs an Object Integrity Proof by its DID:
+* either it is performed by an [FEP-ef61] portable actor, or its own ID is
+* portable.  Both `ap:` URIs and compatible identifiers count as portable.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*/
+function isPortableActivity(activity) {
+	return require_http.hasPortableActor(activity) || activity.id != null && require_http.isPortableId(activity.id);
+}
+/**
+* Verifies that a portable activity's own ID belongs to the DID that signed
+* it, on the JSON-LD document received.  The ID the proof policy checks has
+* to be the parsed activity's ID, so that a remote context that changes
+* between loads cannot make the two name different objects.
+* @returns `null` if the ID is verified, or the reason why it is not.
+*/
+async function verifyPortableActivityId(activityId, jsonLd, options) {
+	const expectedId = require_http.getCanonicalPortableId(activityId);
+	if (expectedId == null) return "malformed portable ID";
+	let verification;
+	try {
+		verification = await require_http.verifyPortableObjectProofWithRoot(jsonLd, options);
+	} catch (error) {
+		if (error instanceof require_http.InvalidPortableObjectIdError) return "malformed portable ID";
+		if (!isPermanentActivityParseError(error)) throw error;
+		return "malformed document";
 	}
+	const { result, root } = verification;
+	if (!result.verified) return result.reason.type;
+	const rootId = root?.["@id"];
+	if (typeof rootId !== "string" || require_http.getCanonicalPortableId((0, _fedify_vocab_runtime.parseIri)(rootId)) !== expectedId) return "the verified document has another ID";
+	return null;
 }
+//#endregion
+//#region src/federation/kv.ts
+const Temporal$5 = require_http.Temporal;
 /**
-* An error that is thrown when an activity fails to send to a remote inbox.
-* It contains structured information about the failure, including the HTTP
-* status code, the inbox URL, and the response body.
-* @since 2.0.0
+* A key–value store that stores values in memory.
+* Do not use this in production as it does not persist values.
+*
+* @since 0.5.0
 */
-var SendActivityError = class extends Error {
+var MemoryKvStore = class {
+	#values = {};
+	#encodeKey(key) {
+		return JSON.stringify(key);
+	}
 	/**
-	* The inbox URL that the activity was being sent to.
+	* {@inheritDoc KvStore.get}
 	*/
-	inbox;
+	get(key) {
+		const encodedKey = this.#encodeKey(key);
+		const entry = this.#values[encodedKey];
+		if (entry == null) return Promise.resolve(void 0);
+		const [value, expiration] = entry;
+		if (expiration != null && Temporal$5.Now.instant().until(expiration).sign < 0) {
+			delete this.#values[encodedKey];
+			return Promise.resolve(void 0);
+		}
+		return Promise.resolve(value);
+	}
 	/**
-	* The HTTP status code returned by the inbox.
+	* {@inheritDoc KvStore.set}
 	*/
-	statusCode;
+	set(key, value, options) {
+		const encodedKey = this.#encodeKey(key);
+		const expiration = options?.ttl == null ? null : Temporal$5.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
+		this.#values[encodedKey] = [value, expiration];
+		return Promise.resolve();
+	}
 	/**
-	* The response body from the inbox, if any.  Note that this may be
-	* truncated to a maximum of 1 KiB to prevent excessive memory consumption
-	* when remote servers return large error pages (e.g., Cloudflare error pages).
-	* If truncated, the string will end with `"… (truncated)"`.
+	* {@inheritDoc KvStore.delete}
 	*/
-	responseBody;
+	delete(key) {
+		const encodedKey = this.#encodeKey(key);
+		delete this.#values[encodedKey];
+		return Promise.resolve();
+	}
 	/**
-	* The response headers from the inbox.
-	* @since 2.3.0
+	* {@inheritDoc KvStore.cas}
 	*/
-	responseHeaders;
+	cas(key, expectedValue, newValue, options) {
+		const encodedKey = this.#encodeKey(key);
+		const entry = this.#values[encodedKey];
+		let currentValue;
+		if (entry == null) currentValue = void 0;
+		else {
+			const [value, expiration] = entry;
+			if (expiration != null && Temporal$5.Now.instant().until(expiration).sign < 0) {
+				delete this.#values[encodedKey];
+				currentValue = void 0;
+			} else currentValue = value;
+		}
+		if (!(0, es_toolkit.isEqual)(currentValue, expectedValue)) return Promise.resolve(false);
+		const expiration = options?.ttl == null ? null : Temporal$5.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
+		this.#values[encodedKey] = [newValue, expiration];
+		return Promise.resolve(true);
+	}
 	/**
-	* Creates a new {@link SendActivityError}.
-	* @param inbox The inbox URL.
-	* @param statusCode The HTTP status code.
-	* @param message The error message.
-	* @param responseBody The response body.
-	* @param responseHeaders The response headers.
+	* {@inheritDoc KvStore.list}
 	*/
-	constructor(inbox, statusCode, message, responseBody, responseHeaders) {
-		super(message);
-		this.name = "SendActivityError";
-		this.inbox = inbox;
-		this.statusCode = statusCode;
-		this.responseBody = responseBody;
-		this.responseHeaders = new Headers(responseHeaders);
+	async *list(prefix) {
+		const now = Temporal$5.Now.instant();
+		for (const [encodedKey, entry] of Object.entries(this.#values)) {
+			const key = JSON.parse(encodedKey);
+			if (prefix != null) {
+				if (key.length < prefix.length) continue;
+				if (!prefix.every((p, i) => key[i] === p)) continue;
+			}
+			const [value, expiration] = entry;
+			if (expiration != null && now.until(expiration).sign < 0) {
+				delete this.#values[encodedKey];
+				continue;
+			}
+			yield {
+				key,
+				value
+			};
+		}
 	}
 };
 //#endregion
+//#region src/nodeinfo/handler.ts
+/**
+* Handles a NodeInfo request.  You would not typically call this function
+* directly, but instead use {@link Federation.handle} method.
+* @param request The NodeInfo request to handle.
+* @param parameters The parameters for handling the request.
+* @returns The response to the request.
+*/
+async function handleNodeInfo(_request, { context, nodeInfoDispatcher }) {
+	const promise = nodeInfoDispatcher(context);
+	const json = require_types.nodeInfoToJson(promise instanceof Promise ? await promise : promise);
+	return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\"" } });
+}
+/**
+* Handles a request to `/.well-known/nodeinfo`.  You would not typically call
+* this function directly, but instead use {@link Federation.handle} method.
+* @param request The request to handle.
+* @param context The request context.
+* @returns The response to the request.
+*/
+function handleNodeInfoJrd(_request, context) {
+	const links = [];
+	try {
+		links.push({
+			rel: "http://nodeinfo.diaspora.software/ns/schema/2.1",
+			href: context.getNodeInfoUri().href,
+			type: "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\""
+		});
+	} catch (e) {
+		if (!(e instanceof _fedify_uri_template.RouterError)) throw e;
+	}
+	const response = new Response(JSON.stringify({ links }), { headers: { "Content-Type": "application/jrd+json" } });
+	return Promise.resolve(response);
+}
+//#endregion
 //#region src/federation/bench.ts
 /**
 * Metric reader owned by `benchmarkMode`.
@@ -4892,439 +5572,151 @@ async function handleBenchmarkTrigger(request, context, options = {}) {
 		}, 403);
 		await context.sendActivity(sender, recipients, activity);
 		return jsonResponse({
-			version: 1,
-			activityId,
-			queueCorrelationId: activityId,
-			recipientCount: recipients.length,
-			inboxCount: inboxUrls.length
-		}, 202);
-	} catch (error) {
-		if (error instanceof BenchmarkTriggerError) return jsonResponse({ error: error.message }, error.status);
-		throw error;
-	}
-}
-var BenchmarkTriggerError = class extends Error {
-	status;
-	constructor(message, status = 400) {
-		super(message);
-		this.status = status;
-	}
-};
-function parseSender(value) {
-	const sender = asRecord(value, "sender");
-	if (typeof sender.identifier === "string") return { identifier: sender.identifier };
-	if (typeof sender.username === "string") return { username: sender.username };
-	throw new BenchmarkTriggerError("sender must be { identifier } or { username }.");
-}
-async function parseRecipients(value, context) {
-	if (!Array.isArray(value)) throw new BenchmarkTriggerError("recipients must be an array.");
-	return await Promise.all(value.map(async (item) => {
-		let object;
-		try {
-			object = await _fedify_vocab.Object.fromJsonLd(item, {
-				documentLoader: context.documentLoader,
-				contextLoader: context.contextLoader
-			});
-		} catch (error) {
-			throw new BenchmarkTriggerError(`Invalid ActivityPub recipient: ${error}`);
-		}
-		if (!isRecipient(object)) throw new BenchmarkTriggerError("each recipient must be an ActivityPub actor.");
-		const recipient = object;
-		if (recipient.id == null || recipient.inboxId == null) throw new BenchmarkTriggerError("each recipient must have id and inbox properties.");
-		return recipient;
-	}));
-}
-function isRecipient(value) {
-	return value != null && typeof value === "object" && "id" in value && "inboxId" in value;
-}
-async function parseActivity(value, context) {
-	try {
-		return await _fedify_vocab.Activity.fromJsonLd(value, {
-			documentLoader: context.documentLoader,
-			contextLoader: context.contextLoader
-		});
-	} catch (error) {
-		throw new BenchmarkTriggerError(`Invalid ActivityPub activity: ${error}`);
-	}
-}
-function asRecord(value, name) {
-	if (value == null || typeof value !== "object" || Array.isArray(value)) throw new BenchmarkTriggerError(`${name} must be an object.`);
-	return value;
-}
-function jsonResponse(body, status = 200) {
-	return new Response(JSON.stringify(body), {
-		status,
-		headers: { "Content-Type": "application/json" }
-	});
-}
-function serializeScopeMetrics(resourceMetrics) {
-	return resourceMetrics.scopeMetrics.map(serializeScope);
-}
-function serializeScope(scopeMetrics) {
-	return {
-		scope: {
-			name: scopeMetrics.scope.name,
-			version: scopeMetrics.scope.version
-		},
-		metrics: scopeMetrics.metrics.map(serializeMetric)
-	};
-}
-function serializeMetric(metric) {
-	return {
-		name: metric.descriptor.name,
-		description: metric.descriptor.description,
-		unit: metric.descriptor.unit,
-		dataPointType: serializeDataPointType(metric.dataPointType),
-		dataPoints: metric.dataPoints.map((point) => ({
-			attributes: { ...point.attributes },
-			startTime: point.startTime,
-			endTime: point.endTime,
-			value: point.value
-		}))
-	};
-}
-function serializeDataPointType(dataPointType) {
-	switch (dataPointType) {
-		case _opentelemetry_sdk_metrics.DataPointType.HISTOGRAM: return "histogram";
-		case _opentelemetry_sdk_metrics.DataPointType.EXPONENTIAL_HISTOGRAM: return "exponential_histogram";
-		case _opentelemetry_sdk_metrics.DataPointType.GAUGE: return "gauge";
-		case _opentelemetry_sdk_metrics.DataPointType.SUM: return "sum";
-	}
-}
-//#endregion
-//#region src/federation/portable-inbox.ts
-const Temporal$5 = require_http.Temporal;
-const MAX_TIMEOUT_MS = 2 ** 31 - 1;
-/**
-* Fills in the defaults of {@link PortableInboxForwardingOptions} and
-* validates them.
-* @param options The options.
-* @returns The resolved options.
-* @throws {RangeError} If `maxTargets` is not a non-negative integer, if `ttl`
-*                      is not positive, if `deadline` is negative or longer
-*                      than 2,147,483,647 milliseconds (about 24.8 days), or
-*                      if either duration has calendar units, i.e., weeks,
-*                      months, or years, whose length depends on the date.
-*/
-function resolvePortableInboxForwardingOptions(options = {}) {
-	const maxTargets = options.maxTargets ?? 10;
-	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
-	const ttl = Temporal$5.Duration.from(options.ttl ?? { days: 30 });
-	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
-	const deadline = Temporal$5.Duration.from(options.deadline ?? { seconds: 10 });
-	const deadlineMs = deadline.total("millisecond");
-	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
-	return {
-		maxTargets,
-		ttl,
-		deadline
-	};
-}
-/**
-* Decides whether this server accepts a delivery to a portable inbox on behalf
-* of the given actor, which the actor dispatcher returned for the identifier
-* in the requested inbox path.
-*
-* The actor document comes from the application, so it is trusted as is and
-* its proof is not verified here.
-* @param actor The actor the actor dispatcher returned.
-* @param options The requested DID, the canonical form of the requested inbox
-*                ID, and the origin of this server.
-* @returns The resolution.
-*/
-function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, localOrigin }) {
-	if (actor == null) return {
-		status: "rejected",
-		reason: "notFound"
-	};
-	const id = actor.id;
-	if (id == null || id.protocol !== "ap:" && id.protocol !== "ap+ef61:") return {
-		status: "rejected",
-		reason: "notPortable"
-	};
-	if (!isSameAuthority(id, authority)) return {
-		status: "rejected",
-		reason: "authorityMismatch"
-	};
-	const inboxId = actor.inboxId;
-	if (inboxId == null || canonicalize(inboxId) !== canonicalInboxId) return {
-		status: "rejected",
-		reason: "inboxMismatch"
-	};
-	const gateways = actor.gateways;
-	if (!gateways.some((g) => (0, _fedify_vocab_runtime.isGatewayUrl)(g) && g.origin === localOrigin)) return {
-		status: "rejected",
-		reason: "notGateway"
-	};
-	return {
-		status: "accepted",
-		recipient: {
-			actorId: id,
-			inboxId,
-			canonicalInboxId,
-			gateways
-		}
-	};
-}
-function isSameAuthority(id, authority) {
-	try {
-		return (0, _fedify_vocab_runtime.getFe34Origin)(id) === authority;
-	} catch (error) {
-		if (error instanceof TypeError) return false;
-		throw error;
-	}
-}
-function canonicalize(iri) {
-	try {
-		return (0, _fedify_vocab_runtime.canonicalizePortableUri)(typeof iri === "string" ? iri : (0, _fedify_vocab_runtime.formatIri)(iri));
-	} catch (error) {
-		if (error instanceof TypeError) return null;
-		throw error;
-	}
-}
-/**
-* Forwards an activity received in a portable inbox to the inboxes of the same
-* portable actor on its other gateways, as FEP-ef61 recommends.
-*
-* FEP-ef61 forbids forwarding an activity from an inbox more than once, so
-* each target gateway is claimed with an atomic compare-and-swap before the
-* activity is handed off, and a claim is never released, even if the hand-off
-* fails, since a failed hand-off does not prove that nothing was delivered.
-* Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
-* forwarded.
-*
-* Forwarded requests are signed with HTTP Signatures by the RSA key among
-* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
-* servers requiring HTTP Signatures accept them, and are sent unsigned
-* otherwise.  Either way, the receiving gateways authenticate the activity by
-* its own proof.
-* @param parameters The parameters.
-* @returns The target inbox URLs that the activity was handed off to.
-*/
-async function forwardPortableInboxActivity(parameters) {
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
-	const { maxTargets, ttl } = parameters.options ?? resolvePortableInboxForwardingOptions();
-	if (kv.cas == null || maxTargets < 1) return [];
-	const canonicalActivityId = canonicalize(activityId) ?? activityId.href;
-	const targets = getForwardingTargets(recipient, excludedOrigins);
-	if (targets.length > maxTargets) {
-		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
-			inbox: recipient.canonicalInboxId,
-			activityId: activityId.href,
-			max: maxTargets
-		});
-		targets.length = maxTargets;
+			version: 1,
+			activityId,
+			queueCorrelationId: activityId,
+			recipientCount: recipients.length,
+			inboxCount: inboxUrls.length
+		}, 202);
+	} catch (error) {
+		if (error instanceof BenchmarkTriggerError) return jsonResponse({ error: error.message }, error.status);
+		throw error;
 	}
-	const claimed = [];
-	for (const { gateway, inbox } of targets) {
-		const key = [
-			...kvPrefix,
-			recipient.canonicalInboxId,
-			canonicalActivityId,
-			gateway
-		];
-		if (await kv.cas(key, void 0, true, { ttl })) claimed.push(inbox);
+}
+var BenchmarkTriggerError = class extends Error {
+	status;
+	constructor(message, status = 400) {
+		super(message);
+		this.status = status;
 	}
-	if (claimed.length < 1) return [];
-	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
-		activityId: activityId.href,
-		inbox: recipient.canonicalInboxId,
-		targets: claimed.map((t) => t.href)
-	});
-	if (outboxQueue == null) await forwardImmediately(parameters, claimed);
-	else await enqueueForwarding(parameters, outboxQueue, claimed);
-	return claimed;
+};
+function parseSender(value) {
+	const sender = asRecord(value, "sender");
+	if (typeof sender.identifier === "string") return { identifier: sender.identifier };
+	if (typeof sender.username === "string") return { username: sender.username };
+	throw new BenchmarkTriggerError("sender must be { identifier } or { username }.");
 }
-function getForwardingTargets(recipient, excludedOrigins) {
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const seen = new Set(excludedOrigins);
-	const targets = [];
-	for (const gateway of recipient.gateways) {
-		if (!(0, _fedify_vocab_runtime.isGatewayUrl)(gateway) || seen.has(gateway.origin)) continue;
-		seen.add(gateway.origin);
-		let inbox;
+async function parseRecipients(value, context) {
+	if (!Array.isArray(value)) throw new BenchmarkTriggerError("recipients must be an array.");
+	return await Promise.all(value.map(async (item) => {
+		let object;
 		try {
-			inbox = (0, _fedify_vocab_runtime.toCompatibleEf61Id)(recipient.inboxId, gateway.origin);
-		} catch (error) {
-			if (!(error instanceof TypeError)) throw error;
-			logger.warn("Cannot forward to the gateway {gateway}, as the portable inbox {inbox} cannot be represented as its compatible identifier.", {
-				gateway: gateway.origin,
-				inbox: recipient.canonicalInboxId
+			object = await _fedify_vocab.Object.fromJsonLd(item, {
+				documentLoader: context.documentLoader,
+				contextLoader: context.contextLoader
 			});
-			continue;
+		} catch (error) {
+			throw new BenchmarkTriggerError(`Invalid ActivityPub recipient: ${error}`);
 		}
-		targets.push({
-			gateway: gateway.origin,
-			inbox
-		});
-	}
-	return targets;
+		if (!isRecipient(object)) throw new BenchmarkTriggerError("each recipient must be an ActivityPub actor.");
+		const recipient = object;
+		if (recipient.id == null || recipient.inboxId == null) throw new BenchmarkTriggerError("each recipient must have id and inbox properties.");
+		return recipient;
+	}));
 }
-/**
-* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
-* key, as {@link sendActivity} signs requests only with such a key.  Since
-* the targets have already been claimed, the activity is forwarded unsigned
-* rather than not at all if the key cannot be resolved or used.
-*/
-async function resolveForwardingKey({ getKeys, activityId }) {
-	if (getKeys == null) return null;
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	let key;
+function isRecipient(value) {
+	return value != null && typeof value === "object" && "id" in value && "inboxId" in value;
+}
+async function parseActivity(value, context) {
 	try {
-		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
-	} catch (error) {
-		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			activityId: activityId.href,
-			error
+		return await _fedify_vocab.Activity.fromJsonLd(value, {
+			documentLoader: context.documentLoader,
+			contextLoader: context.contextLoader
 		});
-		return null;
-	}
-	if (key == null) return null;
-	try {
-		require_http.validateCryptoKey(key.privateKey, "private");
 	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			keyId: key.keyId.href,
-			activityId: activityId.href,
-			error
-		});
-		return null;
+		throw new BenchmarkTriggerError(`Invalid ActivityPub activity: ${error}`);
 	}
-	return key;
 }
-async function forwardImmediately(parameters, inboxes) {
-	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, options, meterProvider, tracerProvider } = parameters;
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const deadline = (options ?? resolvePortableInboxForwardingOptions()).deadline.total("millisecond");
-	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
-		activity,
-		activityId: activityId.href,
-		activityType,
-		keys: key == null ? [] : [key],
-		inbox,
-		allowPrivateAddress,
-		specDeterminer,
-		meterProvider,
-		tracerProvider
-	}).catch((error) => {
-		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
-			activityId: activityId.href,
-			inbox: inbox.href,
-			error
-		});
-	}))));
-	let timer;
-	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
-		timer = setTimeout(() => resolve(true), deadline);
-	})]);
-	clearTimeout(timer);
-	if (timedOut) logger.warn("Forwarding activity {activityId} to other gateways did not finish in {deadline} ms; responding to the delivery without waiting for it.", {
-		activityId: activityId.href,
-		deadline
+function asRecord(value, name) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) throw new BenchmarkTriggerError(`${name} must be an object.`);
+	return value;
+}
+function jsonResponse(body, status = 200) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: { "Content-Type": "application/json" }
 	});
 }
-async function enqueueForwarding(parameters, outboxQueue, inboxes) {
-	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const key = await resolveForwardingKey(parameters);
-	const keys = [];
-	if (key != null) try {
-		keys.push({
-			keyId: key.keyId.href,
-			privateKey: await require_http.exportJwk(key.privateKey)
-		});
-	} catch (error) {
-		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			keyId: key.keyId.href,
-			activityId: activityId.href,
-			error
-		});
+function serializeScopeMetrics(resourceMetrics) {
+	return resourceMetrics.scopeMetrics.map(serializeScope);
+}
+function serializeScope(scopeMetrics) {
+	return {
+		scope: {
+			name: scopeMetrics.scope.name,
+			version: scopeMetrics.scope.version
+		},
+		metrics: scopeMetrics.metrics.map(serializeMetric)
+	};
+}
+function serializeMetric(metric) {
+	return {
+		name: metric.descriptor.name,
+		description: metric.descriptor.description,
+		unit: metric.descriptor.unit,
+		dataPointType: serializeDataPointType(metric.dataPointType),
+		dataPoints: metric.dataPoints.map((point) => ({
+			attributes: { ...point.attributes },
+			startTime: point.startTime,
+			endTime: point.endTime,
+			value: point.value
+		}))
+	};
+}
+function serializeDataPointType(dataPointType) {
+	switch (dataPointType) {
+		case _opentelemetry_sdk_metrics.DataPointType.HISTOGRAM: return "histogram";
+		case _opentelemetry_sdk_metrics.DataPointType.EXPONENTIAL_HISTOGRAM: return "exponential_histogram";
+		case _opentelemetry_sdk_metrics.DataPointType.GAUGE: return "gauge";
+		case _opentelemetry_sdk_metrics.DataPointType.SUM: return "sum";
 	}
-	startQueue?.();
-	const started = (/* @__PURE__ */ new Date()).toISOString();
-	const traceContext = {};
-	_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), traceContext);
-	await Promise.all(inboxes.map(async (inbox) => {
-		const message = {
-			type: "outbox",
-			id: crypto.randomUUID(),
-			baseUrl,
-			keys,
-			activity,
-			activityId: activityId.href,
-			activityType,
-			inbox: inbox.href,
-			sharedInbox: false,
-			started,
-			attempt: 0,
-			headers: {},
-			traceContext
-		};
-		try {
-			await outboxQueue.enqueue(message);
-		} catch (error) {
-			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
-				activityId: activityId.href,
-				inbox: inbox.href,
-				error
-			});
-			return;
-		}
-		require_http.recordOutboxEnqueue(meterProvider, outboxQueue, message);
-	}));
 }
 //#endregion
 //#region src/federation/outgoing-proof.ts
-function isPortableUrl(url) {
-	return url.protocol === "ap:" || url.protocol === "ap+ef61:";
-}
 function formatKeyIds(candidates) {
 	return candidates.map((c) => c.verificationMethod.href).join(", ");
 }
 /**
 * Rejects an activity of a portable actor whose ID cannot be authenticated by
 * the actor's DID: FEP-ef61 requires the activity to be a portable object
-* signed by that DID, so its ID has to be a portable ID with the same DID.
+* signed by that DID, so its ID has to be a portable ID, i.e., an `ap:` or
+* `ap+ef61:` URI or a compatible identifier, with the same DID.  A portable
+* actor is one whose ID is such an ID as well.
 * @throws {TypeError} If the activity is performed by a portable actor, but
-*                     its ID is not a portable ID of the actor's DID, or its
-*                     portable actors do not share a DID.
+*                     its ID is not a portable ID of the actor's DID, its
+*                     portable actors do not share a DID, or the ID of one of
+*                     them is a malformed compatible identifier.
 * @internal
 */
 function assertPortableActorActivity(activity) {
-	const portableActors = activity.actorIds.filter(isPortableUrl);
+	const portableActors = activity.actorIds.filter((id) => require_http.isPortableId(id));
 	if (portableActors.length < 1) return;
-	const did = (0, _fedify_vocab_runtime.getFe34Origin)(portableActors[0]);
-	if (portableActors.some((actorId) => (0, _fedify_vocab_runtime.getFe34Origin)(actorId) !== did)) throw new TypeError(`The activity ${activity.id?.href} has portable actors with different DIDs (${portableActors.map((a) => a.href).join(", ")}); a portable activity is signed by a single DID.`);
-	if (activity.id == null || !isPortableUrl(activity.id) || (0, _fedify_vocab_runtime.getFe34Origin)(activity.id) !== did) throw new TypeError(`The activity ${activity.id?.href} is performed by the portable actor ${portableActors[0].href}, so its ID has to be an ap: or ap+ef61: URI with the same DID (${did}), as FEP-ef61 requires it to carry an Object Integrity Proof made by that DID.`);
+	const dids = portableActors.map((actorId) => {
+		const did = require_http.getPortableDid(actorId);
+		if (did == null) throw new TypeError(`The activity ${activity.id?.href} is performed by the actor ${actorId.href}, whose ID is a malformed FEP-ef61 portable ID.  A compatible identifier must have a valid DID and an object path, and must not have credentials or @gateway location hints.`);
+		return did;
+	});
+	const did = dids[0];
+	if (dids.some((d) => d !== did)) throw new TypeError(`The activity ${activity.id?.href} has portable actors with different DIDs (${portableActors.map((a) => a.href).join(", ")}); a portable activity is signed by a single DID.`);
+	if (activity.id == null || !require_http.isPortableId(activity.id) || require_http.getPortableDid(activity.id) !== did) throw new TypeError(`The activity ${activity.id?.href} is performed by the portable actor ${portableActors[0].href}, so its ID has to be an ap: or ap+ef61: URI, or an FEP-ef61 compatible identifier, with the same DID (${did}), as FEP-ef61 requires it to carry an Object Integrity Proof made by that DID.`);
+	if (!(0, _fedify_vocab_runtime_internal_portable_dereference.isCompatibleEf61Iri)(activity.id)) return;
+	const mismatched = portableActors.find((actorId) => (0, _fedify_vocab_runtime_internal_portable_dereference.isCompatibleEf61Iri)(actorId) && actorId.origin !== activity.id?.origin);
+	if (mismatched == null) return;
+	(0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"outbox"
+	]).warn("The activity {activityId} and its actor {actorId} are identified by FEP-ef61 compatible identifiers on different gateways.  FEP-ef61 requires publishers to use the first gateway in the actor's gateways when constructing compatible identifiers.", {
+		activityId: activity.id.href,
+		actorId: mismatched.href
+	});
 }
 /**
 * Creates the Object Integrity Proofs Fedify attaches to an outgoing activity.
 *
 * Keys whose IDs are FEP-ef61 compatible identifiers are gateway keys, which
 * never sign proofs.  A portable activity, i.e., one with an `ap:` or
-* `ap+ef61:` ID, that carries no proof is signed only by the one Ed25519 key
+* `ap+ef61:` ID or a compatible identifier, that carries no proof is signed only by the one Ed25519 key
 * whose verification method is a DID URL for its DID, even if it is the only
 * key; if no key or more than one key qualifies, this function throws.
 *
@@ -5363,7 +5755,7 @@ async function signOutgoingActivity(activity, candidates, options) {
 		break;
 	}
 	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !require_http.isCompatibleKeyId(c.verificationMethod));
-	if (!hasProof && activity.id != null && isPortableUrl(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
+	if (!hasProof && activity.id != null && require_http.isPortableId(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
 	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
 		activity,
 		hasProof,
@@ -5396,8 +5788,9 @@ async function signOutgoingActivity(activity, candidates, options) {
 * @throws {TypeError} If no key or more than one key qualifies.
 */
 function selectPortableActivityKey(activity, activityId, keys) {
-	const activityDid = (0, _fedify_vocab_runtime.getFe34Origin)(activityId);
-	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && (0, _fedify_vocab_runtime.haveSameFe34Origin)(activityId, c.verificationMethod));
+	const activityDid = require_http.getPortableDid(activityId);
+	if (activityDid == null) throw new TypeError(`Cannot sign the portable activity ${activityId.href}, as its ID is a malformed FEP-ef61 portable ID.  A compatible identifier must have a valid DID and an object path, and must not have credentials or @gateway location hints.`);
+	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && require_http.getPortableDid(c.verificationMethod) === activityDid);
 	if (eligible.length !== 1) throw new TypeError(`Cannot choose an Object Integrity Proof key for the portable activity ${activityId.href}: ` + (eligible.length < 1 ? `none of its ${keys.length} Ed25519 keys (${formatKeyIds(keys)}) ` : `${eligible.length} of its Ed25519 keys (${formatKeyIds(eligible)}) `) + `${eligible.length < 1 ? "is" : "are"} a DID URL verification method for ${activityDid}.  FEP-ef61 requires a portable activity's proof to be made by its DID, and the map-local compound-proof profile accepts exactly one direct proof per map.  Gateway keys, whose IDs are compatible identifiers, never sign proofs.  Supply exactly one Ed25519 key whose key ID is a DID URL for ${activityDid}, or sign the activity with signObject() before sending it.`);
 	(0, _logtape_logtape.getLogger)([
 		"fedify",
@@ -5817,6 +6210,27 @@ function getWebFingerSubjectAndAliases({ resourceUrl, actorUri, preferredUsernam
 	};
 }
 /**
+* Gets the compatible identifier that a WebFinger response links to for
+* an FEP-ef61 portable actor.  An actor identified by an `ap:` or `ap+ef61:`
+* URI is linked through its compatible identifier on the given gateway, while
+* an actor identified by a compatible identifier is linked through its ID as
+* is, so that software without FEP-ef61 support finds the same ID in the actor
+* document.
+* @param actorId The portable actor's ID.
+* @param gateway The actor's first gateway.
+* @returns The compatible identifier, or `null` if the actor ID is malformed
+*          or cannot be represented as a compatible identifier.
+*/
+function getCompatibleActorId(actorId, gateway) {
+	try {
+		if (require_http.isPortableUri(actorId)) return (0, _fedify_vocab_runtime.toCompatibleEf61Id)(actorId, gateway);
+		return (0, _fedify_vocab_runtime.fromCompatibleEf61Id)(actorId) == null ? null : actorId;
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
 * Computes the subject and aliases for an FEP-ef61 portable actor, whose
 * WebFinger address takes its domain from the first gateway of the actor
 * rather than from the actor ID.  The canonical `ap:` ID is not emitted,
@@ -5980,21 +6394,23 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 	});
 	let actorUri = context.getActorUri(identifier);
 	let portable;
-	if (actor.id != null && (actor.id.protocol === "ap:" || actor.id.protocol === "ap+ef61:")) {
+	if (actor.id != null && require_http.isPortableId(actor.id)) {
 		const gateway = actor.gateway;
-		let compatibleId;
-		if (gateway != null && (0, _fedify_vocab_runtime.isGatewayUrl)(gateway)) try {
-			compatibleId = (0, _fedify_vocab_runtime.toCompatibleEf61Id)(actor.id, gateway);
-		} catch (error) {
-			if (!(error instanceof TypeError)) throw error;
-		}
-		if (gateway == null || compatibleId == null) {
+		if (gateway == null || !(0, _fedify_vocab_runtime.isGatewayUrl)(gateway)) {
 			logger$1.error("The portable actor {actorId} (identifier: {identifier}) needs an HTTP(S) origin as the first item of its gateways property to be discovered through WebFinger.", {
 				actorId: (0, _fedify_vocab_runtime.formatIri)(actor.id),
 				identifier
 			});
 			return await onNotFound(request);
 		}
+		const compatibleId = getCompatibleActorId(actor.id, gateway);
+		if (compatibleId == null) {
+			logger$1.error("The portable actor {actorId} (identifier: {identifier}) cannot be discovered through WebFinger, as its ID is malformed or cannot be represented as an FEP-ef61 compatible identifier.", {
+				actorId: (0, _fedify_vocab_runtime.formatIri)(actor.id),
+				identifier
+			});
+			return await onNotFound(request);
+		}
 		actorUri = compatibleId;
 		portable = {
 			compatibleId,
@@ -7933,7 +8349,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			onNotFound,
 			portableInbox: {
 				recipient,
-				forward: async (activity, activityId, activityType) => {
+				forward: async (activity, activityId, activityType, signatures) => {
 					if (this.portableInboxForwarding.maxTargets < 1) return;
 					if (this.kv.cas == null) {
 						if (!this.#portableInboxForwardingWarned) {
@@ -7956,6 +8372,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 						allowPrivateAddress: this.allowPrivateAddress,
 						getKeys: () => this.#getPortableGatewayKeyPairs(context, identifier, recipient),
 						specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
+						signatures,
 						options: this.portableInboxForwarding,
 						meterProvider: this.meterProvider,
 						tracerProvider: this.tracerProvider