@fedify/fedify 2.4.0-dev.2084 → 2.4.0-dev.2099

package/dist/{middleware-BKeQYPm0.mjs → middleware-Br1_d-Ga.mjs}

@@ -1,27 +1,28 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Dn-py9Zy.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-Beod6tzO.mjs";
+import { n as version, t as name } from "./deno-dxdvl2XZ.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-BP3vdBpb.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
-import { d as hasPortableActor, f as isCompatibleKeyId, l as getCanonicalPortableId, m as isPortableUri, o as importJwk, s as validateCryptoKey, t as exportJwk, u as getGatewayKeyBase } from "./key-BJrp524f.mjs";
+import { a as isCompatibleKeyId, c as isPortableUri, i as hasPortableActor, n as getGatewayKeyBase, r as getPortableDid, s as isPortableId, t as getCanonicalPortableId } from "./portable-key-id-Bva5iT3W.mjs";
+import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-DYfmjnmp.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-BmFz5NLA.mjs";
-import { a as verifyObject, n as hasProofLike, o as verifyPortableObjectProof, r as signObject } from "./proof-ozG4HfcQ.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-B0VRNipE.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-BUq5bYJr.mjs";
-import { n as kvCache } from "./kv-cache-C4C3LyYW.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-B00wWHzc.mjs";
+import { i as signObject, l as verifyPortableObjectProofWithRoot, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, t as InvalidPortableObjectIdError } from "./proof-ChjBwnep.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-DsgawTd8.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-eBxQDsk9.mjs";
+import { n as kvCache } from "./kv-cache-EvOgrFsS.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-DpnpgjyX.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CsKVgMzk.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-ClPt8nYu.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-BGlpUocK.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-BJPDRDRq.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-yFX0E-ye.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-Bno54o_-.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-C5NqoLBJ.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-B6Aj2kGY.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-X3SxXVbc.mjs";
 import { t as KvKeyCache } from "./keycache-BUDHB5rY.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-Ba0EAZAI.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-Dl9x-Qw4.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -30,8 +31,9 @@ import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey,
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 import { uniq } from "es-toolkit";
-import { FetchError, canonicalizePortableUri, decodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, haveSameFe34Origin, isGatewayUrl, parseDigestMultibase, parseHashlink, parseIri, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+import { FetchError, canonicalizePortableUri, decodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDigestMultibase, parseHashlink, parseIri, toCompatibleEf61Id } from "@fedify/vocab-runtime";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_HTTP_RESPONSE_HEADER, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
+import { isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 import { DataPointType, MeterProvider as MeterProvider$1, MetricReader } from "@opentelemetry/sdk-metrics";
 import { domainToASCII } from "node:url";
@@ -630,6 +632,415 @@ function parseHashlinkGatewayRequest(url) {
 	};
 }
 //#endregion
+//#region src/federation/portable-inbox.ts
+const MAX_TIMEOUT_MS = 2 ** 31 - 1;
+/**
+* Fills in the defaults of {@link PortableInboxForwardingOptions} and
+* validates them.
+* @param options The options.
+* @returns The resolved options.
+* @throws {RangeError} If `maxTargets` is not a non-negative integer, if `ttl`
+*                      is not positive, if `deadline` is negative or longer
+*                      than 2,147,483,647 milliseconds (about 24.8 days), or
+*                      if either duration has calendar units, i.e., weeks,
+*                      months, or years, whose length depends on the date.
+*/
+function resolvePortableInboxForwardingOptions(options = {}) {
+	const maxTargets = options.maxTargets ?? 10;
+	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
+	const ttl = Temporal.Duration.from(options.ttl ?? { days: 30 });
+	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
+	const deadline = Temporal.Duration.from(options.deadline ?? { seconds: 10 });
+	const deadlineMs = deadline.total("millisecond");
+	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
+	return {
+		maxTargets,
+		ttl,
+		deadline
+	};
+}
+/**
+* Decides whether this server accepts a delivery to a portable inbox on behalf
+* of the given actor, which the actor dispatcher returned for the identifier
+* in the requested inbox path.
+*
+* The actor document comes from the application, so it is trusted as is and
+* its proof is not verified here.
+* @param actor The actor the actor dispatcher returned.
+* @param options The requested DID, the canonical form of the requested inbox
+*                ID, and the origin of this server.
+* @returns The resolution.
+*/
+function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, localOrigin }) {
+	if (actor == null) return {
+		status: "rejected",
+		reason: "notFound"
+	};
+	const id = actor.id;
+	const did = id == null || !isPortableId(id) ? null : getPortableDid(id);
+	if (id == null || did == null) return {
+		status: "rejected",
+		reason: "notPortable"
+	};
+	if (did !== authority) return {
+		status: "rejected",
+		reason: "authorityMismatch"
+	};
+	const inboxId = actor.inboxId == null ? null : toPortableUri(actor.inboxId);
+	if (inboxId == null || getCanonicalPortableId(inboxId) !== canonicalInboxId) return {
+		status: "rejected",
+		reason: "inboxMismatch"
+	};
+	const gateways = actor.gateways;
+	if (!gateways.some((g) => isGatewayUrl(g) && g.origin === localOrigin)) return {
+		status: "rejected",
+		reason: "notGateway"
+	};
+	return {
+		status: "accepted",
+		recipient: {
+			actorId: id,
+			inboxId,
+			canonicalInboxId,
+			gateways
+		}
+	};
+}
+/**
+* Gets the portable form of an `ap:` or `ap+ef61:` URI or a compatible
+* identifier, keeping its query.
+* @returns The portable URI, or `null` if the ID is neither, or is malformed.
+*/
+function toPortableUri(id) {
+	if (isPortableUri(id)) return id;
+	try {
+		return fromCompatibleEf61Id(id);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+const RFC9421_DELIVERY_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"content-digest"
+];
+const DRAFT_DELIVERY_COMPONENTS = [
+	"(request-target)",
+	"host",
+	"digest"
+];
+/**
+* Checks whether an HTTP Signature covers the method, the target URI, and the
+* body of a request, which both Fedify and Mitra sign when forwarding.
+* @param signature The signature.
+* @returns `true` if the signature covers them.
+*/
+function coversDelivery(signature) {
+	return (signature.label == null ? DRAFT_DELIVERY_COMPONENTS : RFC9421_DELIVERY_COMPONENTS).every((name) => signature.components.some((c) => c.value === name && Object.keys(c.params).length < 1));
+}
+/**
+* Forwards an activity received in a portable inbox to the inboxes of the same
+* portable actor on its other gateways, as FEP-ef61 recommends.
+*
+* FEP-ef61 forbids forwarding an activity from an inbox more than once, so
+* each target gateway is claimed with an atomic compare-and-swap before the
+* activity is handed off, and a claim is never released, even if the hand-off
+* fails, since a failed hand-off does not prove that nothing was delivered.
+* Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
+* forwarded.
+*
+* Forwarded requests are signed with HTTP Signatures by the RSA key among
+* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
+* servers requiring HTTP Signatures accept them, and are sent unsigned
+* otherwise.  Either way, the receiving gateways authenticate the activity by
+* its own proof.
+*
+* If the delivery is signed with a gateway key of the recipient by one of its
+* other gateways, that gateway has the activity already, so it is claimed
+* without forwarding the activity to it.  See {@link identifySendingGateway}.
+* @param parameters The parameters.
+* @returns The target inbox URLs that the activity was handed off to.
+*/
+async function forwardPortableInboxActivity(parameters) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
+	const options = parameters.options ?? resolvePortableInboxForwardingOptions();
+	const { maxTargets, ttl } = options;
+	if (kv.cas == null || maxTargets < 1) return [];
+	const deadline = Date.now() + options.deadline.total("millisecond");
+	const canonicalActivityId = getCanonicalPortableId(activityId) ?? activityId.href;
+	const claimKey = (gateway) => [
+		...kvPrefix,
+		recipient.canonicalInboxId,
+		canonicalActivityId,
+		gateway
+	];
+	let targets = getForwardingTargets(recipient, excludedOrigins);
+	const sender = await identifySendingGateway(parameters, targets.map((t) => t.gateway), claimKey, deadline);
+	if (sender != null) {
+		logger.debug("Not forwarding activity {activityId} from the portable inbox {inbox} back to the gateway {gateway}, which delivered it.", {
+			activityId: activityId.href,
+			inbox: recipient.canonicalInboxId,
+			gateway: sender
+		});
+		await kv.cas(claimKey(sender), void 0, true, { ttl });
+		targets = targets.filter((t) => t.gateway !== sender);
+	}
+	if (targets.length > maxTargets) {
+		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
+			inbox: recipient.canonicalInboxId,
+			activityId: activityId.href,
+			max: maxTargets
+		});
+		targets.length = maxTargets;
+	}
+	const claimed = [];
+	for (const { gateway, inbox } of targets) if (await kv.cas(claimKey(gateway), void 0, true, { ttl })) claimed.push(inbox);
+	if (claimed.length < 1) return [];
+	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		targets: claimed.map((t) => t.href)
+	});
+	if (outboxQueue == null) await forwardImmediately(parameters, claimed, deadline);
+	else await enqueueForwarding(parameters, outboxQueue, claimed);
+	return claimed;
+}
+/**
+* Identifies the gateway of the recipient that forwarded a delivery to its
+* portable inbox, by the delivery's HTTP Signature made with the recipient's
+* gateway key, which FEP-ef61 has each gateway use for requests on behalf of
+* an actor.  Since the activity is authenticated by its own proof, the
+* signature only tells which gateway to skip, and a delivery whose signature
+* is invalid or cannot be verified is still forwarded to every gateway.
+*
+* Verifying the signature fetches the recipient's actor document from the
+* sending gateway, as gateway keys are not cached, so only the first signature
+* that may save a request is verified: one that covers the delivery and names
+* a gateway key of the recipient on one of the forwarding targets that the
+* activity has not been forwarded to yet.
+* @param parameters The forwarding parameters.
+* @param targets The origins of the gateways to forward to.
+* @param claimKey Gets the key of the claim for a gateway.
+* @param deadline The time by which identification has to finish, in
+*                 milliseconds since the epoch; afterwards, the sending
+*                 gateway is left unidentified.
+* @returns The origin of the sending gateway, or `null` if it is not
+*          identified.
+*/
+async function identifySendingGateway({ recipient, activityId, kv, signatures }, targets, claimKey, deadline) {
+	if (signatures == null || signatures.length < 1) return null;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const actorId = getCanonicalPortableId(recipient.actorId);
+	if (actorId == null) return null;
+	const isGatewayKeyOfRecipient = (keyId) => {
+		if (!isCompatibleKeyId(keyId) || !targets.includes(keyId.origin)) return false;
+		const base = new URL(keyId.href);
+		base.hash = "";
+		return getCanonicalPortableId(base) === actorId;
+	};
+	let signature;
+	for (const candidate of signatures) if (candidate.coversDelivery && isGatewayKeyOfRecipient(candidate.keyId) && await kv.get(claimKey(candidate.keyId.origin)) === void 0) {
+		signature = candidate;
+		break;
+	}
+	if (signature == null) return null;
+	const { keyId } = signature;
+	const logProperties = {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		keyId: keyId.href
+	};
+	const verification = Promise.resolve().then(() => signature.verify()).then((key) => {
+		if (key == null) logger.debug("The HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} is not verified with the key {keyId}; forwarding it without identifying the sending gateway.", logProperties);
+		return key;
+	}, (error) => {
+		logger.debug("Failed to verify the HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} with the key {keyId}; forwarding it without identifying the sending gateway:\n{error}", {
+			...logProperties,
+			error
+		});
+		return null;
+	});
+	let timer;
+	const key = await Promise.race([verification, new Promise((resolve) => {
+		timer = setTimeout(() => {
+			logger.debug("Verifying the HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} did not finish in time; forwarding it without identifying the sending gateway.", logProperties);
+			resolve(null);
+		}, Math.max(0, deadline - Date.now()));
+	})]);
+	clearTimeout(timer);
+	if (key == null) return null;
+	if (key.id == null || key.id.href !== keyId.href || !isGatewayKeyOfRecipient(key.id) || key.ownerId == null || !isPortableId(key.ownerId) || getCanonicalPortableId(key.ownerId) !== actorId) {
+		logger.debug("The delivery of activity {activityId} to the portable inbox {inbox} is not signed with a gateway key of the recipient; forwarding it without identifying the sending gateway.", logProperties);
+		return null;
+	}
+	return key.id.origin;
+}
+function getForwardingTargets(recipient, excludedOrigins) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const seen = new Set(excludedOrigins);
+	const targets = [];
+	for (const gateway of recipient.gateways) {
+		if (!isGatewayUrl(gateway) || seen.has(gateway.origin)) continue;
+		seen.add(gateway.origin);
+		let inbox;
+		try {
+			inbox = toCompatibleEf61Id(recipient.inboxId, gateway.origin);
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			logger.warn("Cannot forward to the gateway {gateway}, as the portable inbox {inbox} cannot be represented as its compatible identifier.", {
+				gateway: gateway.origin,
+				inbox: recipient.canonicalInboxId
+			});
+			continue;
+		}
+		targets.push({
+			gateway: gateway.origin,
+			inbox
+		});
+	}
+	return targets;
+}
+/**
+* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
+* key, as {@link sendActivity} signs requests only with such a key.  Since
+* the targets have already been claimed, the activity is forwarded unsigned
+* rather than not at all if the key cannot be resolved or used.
+*/
+async function resolveForwardingKey({ getKeys, activityId }) {
+	if (getKeys == null) return null;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	let key;
+	try {
+		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
+	} catch (error) {
+		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	if (key == null) return null;
+	try {
+		validateCryptoKey(key.privateKey, "private");
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	return key;
+}
+async function forwardImmediately(parameters, inboxes, deadlineAt) {
+	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, meterProvider, tracerProvider } = parameters;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const deadline = Math.max(0, deadlineAt - Date.now());
+	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
+		activity,
+		activityId: activityId.href,
+		activityType,
+		keys: key == null ? [] : [key],
+		inbox,
+		allowPrivateAddress,
+		specDeterminer,
+		meterProvider,
+		tracerProvider
+	}).catch((error) => {
+		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+			activityId: activityId.href,
+			inbox: inbox.href,
+			error
+		});
+	}))));
+	let timer;
+	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
+		timer = setTimeout(() => resolve(true), deadline);
+	})]);
+	clearTimeout(timer);
+	if (timedOut) logger.warn("Forwarding activity {activityId} to other gateways did not finish in {deadline} ms; responding to the delivery without waiting for it.", {
+		activityId: activityId.href,
+		deadline
+	});
+}
+async function enqueueForwarding(parameters, outboxQueue, inboxes) {
+	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const key = await resolveForwardingKey(parameters);
+	const keys = [];
+	if (key != null) try {
+		keys.push({
+			keyId: key.keyId.href,
+			privateKey: await exportJwk(key.privateKey)
+		});
+	} catch (error) {
+		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+	}
+	startQueue?.();
+	const started = (/* @__PURE__ */ new Date()).toISOString();
+	const traceContext = {};
+	propagation.inject(context.active(), traceContext);
+	await Promise.all(inboxes.map(async (inbox) => {
+		const message = {
+			type: "outbox",
+			id: crypto.randomUUID(),
+			baseUrl,
+			keys,
+			activity,
+			activityId: activityId.href,
+			activityType,
+			inbox: inbox.href,
+			sharedInbox: false,
+			started,
+			attempt: 0,
+			headers: {},
+			traceContext
+		};
+		try {
+			await outboxQueue.enqueue(message);
+		} catch (error) {
+			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+				activityId: activityId.href,
+				inbox: inbox.href,
+				error
+			});
+			return;
+		}
+		recordOutboxEnqueue(meterProvider, outboxQueue, message);
+	}));
+}
+//#endregion
 //#region src/federation/handler.ts
 const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
 const INBOX_COMPOUND_PROOF_LIMITS = {
@@ -789,14 +1200,7 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 	} });
 }
 function isRequestedPortableObject(object, canonicalId) {
-	if (object.id == null) return false;
-	if (object.id.protocol !== "ap:" && object.id.protocol !== "ap+ef61:") return false;
-	try {
-		return canonicalizePortableUri(formatIri(object.id)) === canonicalId;
-	} catch (error) {
-		if (error instanceof TypeError) return false;
-		throw error;
-	}
+	return object.id != null && getCanonicalPortableId(object.id) === canonicalId;
 }
 async function getJsonLdRootId(jsonLd, contextLoader) {
 	const expanded = await jsonld.expand(jsonLd, {
@@ -808,6 +1212,7 @@ async function getJsonLdRootId(jsonLd, contextLoader) {
 	return typeof id === "string" ? id : null;
 }
 function isRequestedPortableId(id, canonicalId) {
+	if (!/^ap(?:\+ef61)?:\/\//i.test(id)) return URL.canParse(id) && getCanonicalPortableId(new URL(id)) === canonicalId;
 	try {
 		return canonicalizePortableUri(id) === canonicalId;
 	} catch (error) {
@@ -858,13 +1263,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$1.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$2.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$1),
+		kind: getCollectionMetricKind(name$2),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -905,7 +1310,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$1, filterPredicate);
+						const items = filterCollectionItems(page.items, name$2, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -945,7 +1350,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 		} else {
 			const uri = new URL(baseUri);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -961,7 +1366,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$1, filterPredicate);
+					const items = filterCollectionItems(page.items, name$2, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -1670,7 +2075,7 @@ async function handleInboxInternal(request, parameters, span) {
 			return await respondInvalidActivity(error);
 		}
 		activityVerified = true;
-		if (!skipSignatureVerification && hasPortableActor(activity)) try {
+		if (!skipSignatureVerification && isPortableActivity(activity)) try {
 			proofVerified = await verifyObject(Activity, jsonWithoutSig, {
 				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
 				documentLoader: ctx.documentLoader,
@@ -1854,7 +2259,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
-	if (!skipSignatureVerification && !proofVerified && (hasPortableActor(activity) || isPortableGatewayKey(httpSigKey))) {
+	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableGatewayKey(httpSigKey))) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
 			activity: json,
@@ -1872,6 +2277,32 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	if (!skipSignatureVerification && activity.id != null && isPortableId(activity.id)) {
+		const rejection = await verifyPortableActivityId(activity.id, jsonWithoutSig, {
+			contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
+			documentLoader: ctx.documentLoader,
+			keyCache,
+			meterProvider,
+			tracerProvider
+		});
+		if (rejection != null) {
+			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+			logger.error("The portable activity {activityId} is not authenticated by an Object Integrity Proof of its own DID: {reason}", {
+				activity: json,
+				recipient,
+				activityId: activity.id.href,
+				reason: rejection
+			});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: `The portable activity (${activity.id.href}) is not authenticated by an Object Integrity Proof of its own DID.`
+			});
+			return new Response("Portable activities must have valid Object Integrity Proofs made by their own DIDs.", {
+				status: 401,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+	}
 	if (httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("actorKeyMismatch", httpSigKey.id == null ? void 0 : getRemoteHost(httpSigKey.id));
@@ -1948,7 +2379,21 @@ async function handleInboxInternal(request, parameters, span) {
 		inbox: portableInbox.recipient.canonicalInboxId
 	});
 	else try {
-		await portableInbox.forward(json, activity.id, getTypeId(activity).href);
+		await portableInbox.forward(json, activity.id, getTypeId(activity).href, listRequestSignatures(request).map((signature) => ({
+			keyId: signature.keyId,
+			coversDelivery: coversDelivery(signature),
+			verify: async () => {
+				const verification = await verifyRequestDetailed(selectRequestSignature(request, signature), {
+					contextLoader: ctx.contextLoader,
+					documentLoader: ctx.documentLoader,
+					timeWindow: signatureTimeWindow,
+					keyCache,
+					meterProvider,
+					tracerProvider
+				});
+				return verification.verified ? verification.key : null;
+			}
+		})));
 	} catch (error) {
 		logger.error("Failed to forward activity {activityId} to the other gateways of the portable inbox {inbox}:\n{error}", {
 			activityId: activity.id.href,
@@ -2109,8 +2554,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$2;
+	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
+		this.name = name$1;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -2562,380 +3007,127 @@ const getFailedSignatureHeaders = async (policy, kv, kvPrefixes) => ({
 	}
 });
 async function buildAcceptSignatureHeader(policy, kv, noncePrefix) {
-	const parameters = { created: true };
-	if (policy.requestNonce) {
-		const nonce = generateNonce();
-		await setKey(kv, [...noncePrefix, nonce], policy);
-		parameters.nonce = nonce;
-	}
-	const baseComponents = policy.components ?? DEF_COMPONENTS;
-	return formatAcceptSignature([{
-		label: "sig1",
-		components: uniq(MIN_COMPONENTS.concat(baseComponents)).filter((c) => c !== "@status").map((v) => ({
-			value: v,
-			params: {}
-		})),
-		parameters
-	}]);
-}
-async function setKey(kv, key, policy) {
-	const seconds = policy.nonceTtlSeconds ?? 300;
-	const ttl = Temporal.Duration.from({ seconds });
-	await kv.set(key, true, { ttl });
-}
-const DEF_COMPONENTS = [
-	"@method",
-	"@target-uri",
-	"@authority",
-	"content-digest"
-];
-const MIN_COMPONENTS = [
-	"@method",
-	"@target-uri",
-	"@authority"
-];
-/**
-* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
-* portable actor, i.e., its ID is a compatible identifier and it is owned by
-* a portable actor, which only the portable actor's signed document can
-* establish.
-*/
-function isPortableGatewayKey(key) {
-	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableUri(key.ownerId);
-}
-//#endregion
-//#region src/federation/portable-inbox.ts
-const MAX_TIMEOUT_MS = 2 ** 31 - 1;
-/**
-* Fills in the defaults of {@link PortableInboxForwardingOptions} and
-* validates them.
-* @param options The options.
-* @returns The resolved options.
-* @throws {RangeError} If `maxTargets` is not a non-negative integer, if `ttl`
-*                      is not positive, if `deadline` is negative or longer
-*                      than 2,147,483,647 milliseconds (about 24.8 days), or
-*                      if either duration has calendar units, i.e., weeks,
-*                      months, or years, whose length depends on the date.
-*/
-function resolvePortableInboxForwardingOptions(options = {}) {
-	const maxTargets = options.maxTargets ?? 10;
-	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
-	const ttl = Temporal.Duration.from(options.ttl ?? { days: 30 });
-	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
-	const deadline = Temporal.Duration.from(options.deadline ?? { seconds: 10 });
-	const deadlineMs = deadline.total("millisecond");
-	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
-	return {
-		maxTargets,
-		ttl,
-		deadline
-	};
-}
-/**
-* Decides whether this server accepts a delivery to a portable inbox on behalf
-* of the given actor, which the actor dispatcher returned for the identifier
-* in the requested inbox path.
-*
-* The actor document comes from the application, so it is trusted as is and
-* its proof is not verified here.
-* @param actor The actor the actor dispatcher returned.
-* @param options The requested DID, the canonical form of the requested inbox
-*                ID, and the origin of this server.
-* @returns The resolution.
-*/
-function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, localOrigin }) {
-	if (actor == null) return {
-		status: "rejected",
-		reason: "notFound"
-	};
-	const id = actor.id;
-	if (id == null || id.protocol !== "ap:" && id.protocol !== "ap+ef61:") return {
-		status: "rejected",
-		reason: "notPortable"
-	};
-	if (!isSameAuthority(id, authority)) return {
-		status: "rejected",
-		reason: "authorityMismatch"
-	};
-	const inboxId = actor.inboxId;
-	if (inboxId == null || canonicalize(inboxId) !== canonicalInboxId) return {
-		status: "rejected",
-		reason: "inboxMismatch"
-	};
-	const gateways = actor.gateways;
-	if (!gateways.some((g) => isGatewayUrl(g) && g.origin === localOrigin)) return {
-		status: "rejected",
-		reason: "notGateway"
-	};
-	return {
-		status: "accepted",
-		recipient: {
-			actorId: id,
-			inboxId,
-			canonicalInboxId,
-			gateways
-		}
-	};
-}
-function isSameAuthority(id, authority) {
-	try {
-		return getFe34Origin(id) === authority;
-	} catch (error) {
-		if (error instanceof TypeError) return false;
-		throw error;
+	const parameters = { created: true };
+	if (policy.requestNonce) {
+		const nonce = generateNonce();
+		await setKey(kv, [...noncePrefix, nonce], policy);
+		parameters.nonce = nonce;
 	}
+	const baseComponents = policy.components ?? DEF_COMPONENTS;
+	return formatAcceptSignature([{
+		label: "sig1",
+		components: uniq(MIN_COMPONENTS.concat(baseComponents)).filter((c) => c !== "@status").map((v) => ({
+			value: v,
+			params: {}
+		})),
+		parameters
+	}]);
 }
-function canonicalize(iri) {
-	try {
-		return canonicalizePortableUri(typeof iri === "string" ? iri : formatIri(iri));
-	} catch (error) {
-		if (error instanceof TypeError) return null;
-		throw error;
-	}
+async function setKey(kv, key, policy) {
+	const seconds = policy.nonceTtlSeconds ?? 300;
+	const ttl = Temporal.Duration.from({ seconds });
+	await kv.set(key, true, { ttl });
 }
+const DEF_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"@authority",
+	"content-digest"
+];
+const MIN_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"@authority"
+];
 /**
-* Forwards an activity received in a portable inbox to the inboxes of the same
-* portable actor on its other gateways, as FEP-ef61 recommends.
-*
-* FEP-ef61 forbids forwarding an activity from an inbox more than once, so
-* each target gateway is claimed with an atomic compare-and-swap before the
-* activity is handed off, and a claim is never released, even if the hand-off
-* fails, since a failed hand-off does not prove that nothing was delivered.
-* Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
-* forwarded.
-*
-* Forwarded requests are signed with HTTP Signatures by the RSA key among
-* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
-* servers requiring HTTP Signatures accept them, and are sent unsigned
-* otherwise.  Either way, the receiving gateways authenticate the activity by
-* its own proof.
-* @param parameters The parameters.
-* @returns The target inbox URLs that the activity was handed off to.
+* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
+* portable actor, i.e., its ID is a compatible identifier and it is owned by
+* a portable actor, which only the portable actor's signed document can
+* establish.
 */
-async function forwardPortableInboxActivity(parameters) {
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
-	const { maxTargets, ttl } = parameters.options ?? resolvePortableInboxForwardingOptions();
-	if (kv.cas == null || maxTargets < 1) return [];
-	const canonicalActivityId = canonicalize(activityId) ?? activityId.href;
-	const targets = getForwardingTargets(recipient, excludedOrigins);
-	if (targets.length > maxTargets) {
-		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
-			inbox: recipient.canonicalInboxId,
-			activityId: activityId.href,
-			max: maxTargets
-		});
-		targets.length = maxTargets;
-	}
-	const claimed = [];
-	for (const { gateway, inbox } of targets) {
-		const key = [
-			...kvPrefix,
-			recipient.canonicalInboxId,
-			canonicalActivityId,
-			gateway
-		];
-		if (await kv.cas(key, void 0, true, { ttl })) claimed.push(inbox);
-	}
-	if (claimed.length < 1) return [];
-	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
-		activityId: activityId.href,
-		inbox: recipient.canonicalInboxId,
-		targets: claimed.map((t) => t.href)
-	});
-	if (outboxQueue == null) await forwardImmediately(parameters, claimed);
-	else await enqueueForwarding(parameters, outboxQueue, claimed);
-	return claimed;
+function isPortableGatewayKey(key) {
+	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
 }
-function getForwardingTargets(recipient, excludedOrigins) {
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const seen = new Set(excludedOrigins);
-	const targets = [];
-	for (const gateway of recipient.gateways) {
-		if (!isGatewayUrl(gateway) || seen.has(gateway.origin)) continue;
-		seen.add(gateway.origin);
-		let inbox;
-		try {
-			inbox = toCompatibleEf61Id(recipient.inboxId, gateway.origin);
-		} catch (error) {
-			if (!(error instanceof TypeError)) throw error;
-			logger.warn("Cannot forward to the gateway {gateway}, as the portable inbox {inbox} cannot be represented as its compatible identifier.", {
-				gateway: gateway.origin,
-				inbox: recipient.canonicalInboxId
-			});
-			continue;
-		}
-		targets.push({
-			gateway: gateway.origin,
-			inbox
-		});
-	}
-	return targets;
+/**
+* Checks whether an activity needs an Object Integrity Proof by its DID:
+* either it is performed by an [FEP-ef61] portable actor, or its own ID is
+* portable.  Both `ap:` URIs and compatible identifiers count as portable.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*/
+function isPortableActivity(activity) {
+	return hasPortableActor(activity) || activity.id != null && isPortableId(activity.id);
 }
 /**
-* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
-* key, as {@link sendActivity} signs requests only with such a key.  Since
-* the targets have already been claimed, the activity is forwarded unsigned
-* rather than not at all if the key cannot be resolved or used.
+* Verifies that a portable activity's own ID belongs to the DID that signed
+* it, on the JSON-LD document received.  The ID the proof policy checks has
+* to be the parsed activity's ID, so that a remote context that changes
+* between loads cannot make the two name different objects.
+* @returns `null` if the ID is verified, or the reason why it is not.
 */
-async function resolveForwardingKey({ getKeys, activityId }) {
-	if (getKeys == null) return null;
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	let key;
-	try {
-		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
-	} catch (error) {
-		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			activityId: activityId.href,
-			error
-		});
-		return null;
-	}
-	if (key == null) return null;
+async function verifyPortableActivityId(activityId, jsonLd, options) {
+	const expectedId = getCanonicalPortableId(activityId);
+	if (expectedId == null) return "malformed portable ID";
+	let verification;
 	try {
-		validateCryptoKey(key.privateKey, "private");
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			keyId: key.keyId.href,
-			activityId: activityId.href,
-			error
-		});
-		return null;
-	}
-	return key;
-}
-async function forwardImmediately(parameters, inboxes) {
-	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, options, meterProvider, tracerProvider } = parameters;
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const deadline = (options ?? resolvePortableInboxForwardingOptions()).deadline.total("millisecond");
-	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
-		activity,
-		activityId: activityId.href,
-		activityType,
-		keys: key == null ? [] : [key],
-		inbox,
-		allowPrivateAddress,
-		specDeterminer,
-		meterProvider,
-		tracerProvider
-	}).catch((error) => {
-		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
-			activityId: activityId.href,
-			inbox: inbox.href,
-			error
-		});
-	}))));
-	let timer;
-	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
-		timer = setTimeout(() => resolve(true), deadline);
-	})]);
-	clearTimeout(timer);
-	if (timedOut) logger.warn("Forwarding activity {activityId} to other gateways did not finish in {deadline} ms; responding to the delivery without waiting for it.", {
-		activityId: activityId.href,
-		deadline
-	});
-}
-async function enqueueForwarding(parameters, outboxQueue, inboxes) {
-	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const key = await resolveForwardingKey(parameters);
-	const keys = [];
-	if (key != null) try {
-		keys.push({
-			keyId: key.keyId.href,
-			privateKey: await exportJwk(key.privateKey)
-		});
+		verification = await verifyPortableObjectProofWithRoot(jsonLd, options);
 	} catch (error) {
-		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			keyId: key.keyId.href,
-			activityId: activityId.href,
-			error
-		});
-	}
-	startQueue?.();
-	const started = (/* @__PURE__ */ new Date()).toISOString();
-	const traceContext = {};
-	propagation.inject(context.active(), traceContext);
-	await Promise.all(inboxes.map(async (inbox) => {
-		const message = {
-			type: "outbox",
-			id: crypto.randomUUID(),
-			baseUrl,
-			keys,
-			activity,
-			activityId: activityId.href,
-			activityType,
-			inbox: inbox.href,
-			sharedInbox: false,
-			started,
-			attempt: 0,
-			headers: {},
-			traceContext
-		};
-		try {
-			await outboxQueue.enqueue(message);
-		} catch (error) {
-			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
-				activityId: activityId.href,
-				inbox: inbox.href,
-				error
-			});
-			return;
-		}
-		recordOutboxEnqueue(meterProvider, outboxQueue, message);
-	}));
+		if (error instanceof InvalidPortableObjectIdError) return "malformed portable ID";
+		if (!isPermanentActivityParseError(error)) throw error;
+		return "malformed document";
+	}
+	const { result, root } = verification;
+	if (!result.verified) return result.reason.type;
+	const rootId = root?.["@id"];
+	if (typeof rootId !== "string" || getCanonicalPortableId(parseIri(rootId)) !== expectedId) return "the verified document has another ID";
+	return null;
 }
 //#endregion
 //#region src/federation/outgoing-proof.ts
-function isPortableUrl(url) {
-	return url.protocol === "ap:" || url.protocol === "ap+ef61:";
-}
 function formatKeyIds(candidates) {
 	return candidates.map((c) => c.verificationMethod.href).join(", ");
 }
 /**
 * Rejects an activity of a portable actor whose ID cannot be authenticated by
 * the actor's DID: FEP-ef61 requires the activity to be a portable object
-* signed by that DID, so its ID has to be a portable ID with the same DID.
+* signed by that DID, so its ID has to be a portable ID, i.e., an `ap:` or
+* `ap+ef61:` URI or a compatible identifier, with the same DID.  A portable
+* actor is one whose ID is such an ID as well.
 * @throws {TypeError} If the activity is performed by a portable actor, but
-*                     its ID is not a portable ID of the actor's DID, or its
-*                     portable actors do not share a DID.
+*                     its ID is not a portable ID of the actor's DID, its
+*                     portable actors do not share a DID, or the ID of one of
+*                     them is a malformed compatible identifier.
 * @internal
 */
 function assertPortableActorActivity(activity) {
-	const portableActors = activity.actorIds.filter(isPortableUrl);
+	const portableActors = activity.actorIds.filter((id) => isPortableId(id));
 	if (portableActors.length < 1) return;
-	const did = getFe34Origin(portableActors[0]);
-	if (portableActors.some((actorId) => getFe34Origin(actorId) !== did)) throw new TypeError(`The activity ${activity.id?.href} has portable actors with different DIDs (${portableActors.map((a) => a.href).join(", ")}); a portable activity is signed by a single DID.`);
-	if (activity.id == null || !isPortableUrl(activity.id) || getFe34Origin(activity.id) !== did) throw new TypeError(`The activity ${activity.id?.href} is performed by the portable actor ${portableActors[0].href}, so its ID has to be an ap: or ap+ef61: URI with the same DID (${did}), as FEP-ef61 requires it to carry an Object Integrity Proof made by that DID.`);
+	const dids = portableActors.map((actorId) => {
+		const did = getPortableDid(actorId);
+		if (did == null) throw new TypeError(`The activity ${activity.id?.href} is performed by the actor ${actorId.href}, whose ID is a malformed FEP-ef61 portable ID.  A compatible identifier must have a valid DID and an object path, and must not have credentials or @gateway location hints.`);
+		return did;
+	});
+	const did = dids[0];
+	if (dids.some((d) => d !== did)) throw new TypeError(`The activity ${activity.id?.href} has portable actors with different DIDs (${portableActors.map((a) => a.href).join(", ")}); a portable activity is signed by a single DID.`);
+	if (activity.id == null || !isPortableId(activity.id) || getPortableDid(activity.id) !== did) throw new TypeError(`The activity ${activity.id?.href} is performed by the portable actor ${portableActors[0].href}, so its ID has to be an ap: or ap+ef61: URI, or an FEP-ef61 compatible identifier, with the same DID (${did}), as FEP-ef61 requires it to carry an Object Integrity Proof made by that DID.`);
+	if (!isCompatibleEf61Iri(activity.id)) return;
+	const mismatched = portableActors.find((actorId) => isCompatibleEf61Iri(actorId) && actorId.origin !== activity.id?.origin);
+	if (mismatched == null) return;
+	getLogger([
+		"fedify",
+		"federation",
+		"outbox"
+	]).warn("The activity {activityId} and its actor {actorId} are identified by FEP-ef61 compatible identifiers on different gateways.  FEP-ef61 requires publishers to use the first gateway in the actor's gateways when constructing compatible identifiers.", {
+		activityId: activity.id.href,
+		actorId: mismatched.href
+	});
 }
 /**
 * Creates the Object Integrity Proofs Fedify attaches to an outgoing activity.
 *
 * Keys whose IDs are FEP-ef61 compatible identifiers are gateway keys, which
 * never sign proofs.  A portable activity, i.e., one with an `ap:` or
-* `ap+ef61:` ID, that carries no proof is signed only by the one Ed25519 key
+* `ap+ef61:` ID or a compatible identifier, that carries no proof is signed only by the one Ed25519 key
 * whose verification method is a DID URL for its DID, even if it is the only
 * key; if no key or more than one key qualifies, this function throws.
 *
@@ -2974,7 +3166,7 @@ async function signOutgoingActivity(activity, candidates, options) {
 		break;
 	}
 	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isCompatibleKeyId(c.verificationMethod));
-	if (!hasProof && activity.id != null && isPortableUrl(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
+	if (!hasProof && activity.id != null && isPortableId(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
 	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
 		activity,
 		hasProof,
@@ -3007,8 +3199,9 @@ async function signOutgoingActivity(activity, candidates, options) {
 * @throws {TypeError} If no key or more than one key qualifies.
 */
 function selectPortableActivityKey(activity, activityId, keys) {
-	const activityDid = getFe34Origin(activityId);
-	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && haveSameFe34Origin(activityId, c.verificationMethod));
+	const activityDid = getPortableDid(activityId);
+	if (activityDid == null) throw new TypeError(`Cannot sign the portable activity ${activityId.href}, as its ID is a malformed FEP-ef61 portable ID.  A compatible identifier must have a valid DID and an object path, and must not have credentials or @gateway location hints.`);
+	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && getPortableDid(c.verificationMethod) === activityDid);
 	if (eligible.length !== 1) throw new TypeError(`Cannot choose an Object Integrity Proof key for the portable activity ${activityId.href}: ` + (eligible.length < 1 ? `none of its ${keys.length} Ed25519 keys (${formatKeyIds(keys)}) ` : `${eligible.length} of its Ed25519 keys (${formatKeyIds(eligible)}) `) + `${eligible.length < 1 ? "is" : "are"} a DID URL verification method for ${activityDid}.  FEP-ef61 requires a portable activity's proof to be made by its DID, and the map-local compound-proof profile accepts exactly one direct proof per map.  Gateway keys, whose IDs are compatible identifiers, never sign proofs.  Supply exactly one Ed25519 key whose key ID is a DID URL for ${activityDid}, or sign the activity with signObject() before sending it.`);
 	getLogger([
 		"fedify",
@@ -3255,6 +3448,27 @@ function getWebFingerSubjectAndAliases({ resourceUrl, actorUri, preferredUsernam
 	};
 }
 /**
+* Gets the compatible identifier that a WebFinger response links to for
+* an FEP-ef61 portable actor.  An actor identified by an `ap:` or `ap+ef61:`
+* URI is linked through its compatible identifier on the given gateway, while
+* an actor identified by a compatible identifier is linked through its ID as
+* is, so that software without FEP-ef61 support finds the same ID in the actor
+* document.
+* @param actorId The portable actor's ID.
+* @param gateway The actor's first gateway.
+* @returns The compatible identifier, or `null` if the actor ID is malformed
+*          or cannot be represented as a compatible identifier.
+*/
+function getCompatibleActorId(actorId, gateway) {
+	try {
+		if (isPortableUri(actorId)) return toCompatibleEf61Id(actorId, gateway);
+		return fromCompatibleEf61Id(actorId) == null ? null : actorId;
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
 * Computes the subject and aliases for an FEP-ef61 portable actor, whose
 * WebFinger address takes its domain from the first gateway of the actor
 * rather than from the actor ID.  The canonical `ap:` ID is not emitted,
@@ -3418,21 +3632,23 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 	});
 	let actorUri = context.getActorUri(identifier);
 	let portable;
-	if (actor.id != null && (actor.id.protocol === "ap:" || actor.id.protocol === "ap+ef61:")) {
+	if (actor.id != null && isPortableId(actor.id)) {
 		const gateway = actor.gateway;
-		let compatibleId;
-		if (gateway != null && isGatewayUrl(gateway)) try {
-			compatibleId = toCompatibleEf61Id(actor.id, gateway);
-		} catch (error) {
-			if (!(error instanceof TypeError)) throw error;
-		}
-		if (gateway == null || compatibleId == null) {
+		if (gateway == null || !isGatewayUrl(gateway)) {
 			logger.error("The portable actor {actorId} (identifier: {identifier}) needs an HTTP(S) origin as the first item of its gateways property to be discovered through WebFinger.", {
 				actorId: formatIri(actor.id),
 				identifier
 			});
 			return await onNotFound(request);
 		}
+		const compatibleId = getCompatibleActorId(actor.id, gateway);
+		if (compatibleId == null) {
+			logger.error("The portable actor {actorId} (identifier: {identifier}) cannot be discovered through WebFinger, as its ID is malformed or cannot be represented as an FEP-ef61 compatible identifier.", {
+				actorId: formatIri(actor.id),
+				identifier
+			});
+			return await onNotFound(request);
+		}
 		actorUri = compatibleId;
 		portable = {
 			compatibleId,
@@ -5362,7 +5578,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			onNotFound,
 			portableInbox: {
 				recipient,
-				forward: async (activity, activityId, activityType) => {
+				forward: async (activity, activityId, activityType, signatures) => {
 					if (this.portableInboxForwarding.maxTargets < 1) return;
 					if (this.kv.cas == null) {
 						if (!this.#portableInboxForwardingWarned) {
@@ -5385,6 +5601,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 						allowPrivateAddress: this.allowPrivateAddress,
 						getKeys: () => this.#getPortableGatewayKeyPairs(context, identifier, recipient),
 						specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
+						signatures,
 						options: this.portableInboxForwarding,
 						meterProvider: this.meterProvider,
 						tracerProvider: this.tracerProvider
@@ -6667,4 +6884,4 @@ function getRequestId(request) {
 	return `req_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
 }
 //#endregion
-export { actorDehydrator as C, handleNodeInfoJrd as S, respondWithObjectIfAcceptable as _, OutboxContextImpl as a, handleBenchmarkTrigger as b, forwardPortableInboxActivity as c, handleCollection as d, handleCustomCollection as f, respondWithObject as g, handleOutbox as h, KvSpecDeterminer as i, resolvePortableInboxForwardingOptions as l, handleObject as m, FederationImpl as n, createFederation as o, handleInbox as p, InboxContextImpl as r, handleWebFinger as s, ContextImpl as t, handleActor as u, PORTABLE_OBJECT_CONTENT_TYPE as v, autoIdAssigner as w, handleNodeInfo as x, parseHashlinkGatewayRequest as y };
+export { handleNodeInfo as C, autoIdAssigner as E, handleBenchmarkTrigger as S, actorDehydrator as T, coversDelivery as _, OutboxContextImpl as a, PORTABLE_OBJECT_CONTENT_TYPE as b, assertPortableActorActivity as c, handleCustomCollection as d, handleInbox as f, respondWithObjectIfAcceptable as g, respondWithObject as h, KvSpecDeterminer as i, handleActor as l, handleOutbox as m, FederationImpl as n, createFederation as o, handleObject as p, InboxContextImpl as r, handleWebFinger as s, ContextImpl as t, handleCollection as u, forwardPortableInboxActivity as v, handleNodeInfoJrd as w, parseHashlinkGatewayRequest as x, resolvePortableInboxForwardingOptions as y };