@fedify/fedify 2.4.0-dev.2093 → 2.4.0-dev.2099

package/dist/{federation-aSHO04ob.cjs → federation-C4Ef3JKa.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-DSaSAN7X.cjs");
+const require_http = require("./http-C8cZTE3Y.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-szIZl4qI.cjs");
-const require_kv_cache = require("./kv-cache-BSJAlP4C.cjs");
+const require_owner = require("./owner-DSzH7wro.cjs");
+const require_kv_cache = require("./kv-cache-Dvd-Q-E2.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -2521,157 +2521,857 @@ function parseHashlinkGatewayRequest(url) {
 	};
 }
 //#endregion
-//#region src/federation/temporal.ts
-const Temporal$8 = require_http.Temporal;
-function isPlainObject$1(value) {
-	return typeof value === "object" && value != null && !Array.isArray(value);
-}
-function normalizeDateTimeLiteral(value) {
-	return value.substring(19).match(/[Z+-]/) ? value : value + "Z";
-}
-function isMalformedDateTimeLiteral(value) {
-	if (typeof value !== "string") return false;
-	try {
-		Temporal$8.Instant.from(normalizeDateTimeLiteral(value));
-		return false;
-	} catch {
-		return true;
-	}
-}
-function isMalformedDurationLiteral(value) {
-	if (typeof value !== "string") return false;
-	try {
-		Temporal$8.Duration.from(value);
-		return false;
-	} catch {
-		return true;
+//#region src/federation/send.ts
+/**
+* Extracts the inbox URLs from recipients.
+* @param parameters The parameters to extract the inboxes.
+*                   See also {@link ExtractInboxesParameters}.
+* @returns The inboxes as a map of inbox URL to actor URIs.
+*/
+function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
+	const inboxes = {};
+	for (const recipient of recipients) {
+		let inbox;
+		let sharedInbox = false;
+		if (preferSharedInbox && recipient.endpoints?.sharedInbox != null) {
+			inbox = recipient.endpoints.sharedInbox;
+			sharedInbox = true;
+		} else inbox = recipient.inboxId;
+		if (inbox != null && recipient.id != null) {
+			if (excludeBaseUris != null && excludeBaseUris.some((u) => u.origin === inbox?.origin)) continue;
+			inboxes[inbox.href] ??= {
+				actorIds: /* @__PURE__ */ new Set(),
+				sharedInbox
+			};
+			inboxes[inbox.href].actorIds.add(recipient.id.href);
+		}
 	}
+	return inboxes;
 }
-const TEMPORAL_DATE_TIME_IRIS = /* @__PURE__ */ new Set([
-	"https://www.w3.org/ns/activitystreams#deleted",
-	"https://www.w3.org/ns/activitystreams#endTime",
-	"https://www.w3.org/ns/activitystreams#published",
-	"https://www.w3.org/ns/activitystreams#startTime",
-	"https://www.w3.org/ns/activitystreams#updated",
-	"http://purl.org/dc/terms/created",
-	"https://w3id.org/security#created"
-]);
-const TEMPORAL_DURATION_IRIS = /* @__PURE__ */ new Set(["https://www.w3.org/ns/activitystreams#duration"]);
-const QUESTION_CLOSED_IRI = "https://www.w3.org/ns/activitystreams#closed";
-const XSD_DATE_TIME_IRI = "http://www.w3.org/2001/XMLSchema#dateTime";
-function hasMalformedExpandedDateTimeLiteral(value) {
-	if (Array.isArray(value)) return value.some(hasMalformedExpandedDateTimeLiteral);
-	return isPlainObject$1(value) && "@value" in value && isMalformedDateTimeLiteral(value["@value"]);
-}
-function hasMalformedExpandedQuestionClosedLiteral(value) {
-	if (Array.isArray(value)) return value.some(hasMalformedExpandedQuestionClosedLiteral);
-	if (!isPlainObject$1(value) || !("@value" in value)) return false;
-	const literal = value["@value"];
-	if (typeof literal === "boolean") return false;
-	if (typeof literal !== "string") return false;
-	if (value["@type"] !== XSD_DATE_TIME_IRI) return false;
-	if (new Date(literal).toString() === "Invalid Date") return false;
-	return isMalformedDateTimeLiteral(literal);
+/**
+* Sends an {@link Activity} to an inbox.
+*
+* @param parameters The parameters for sending the activity.
+*                   See also {@link SendActivityParameters}.
+* @throws {Error} If the activity fails to send.
+*/
+function sendActivity(options) {
+	const tracerProvider = options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
+	return tracerProvider.getTracer(require_http.name, require_http.version).startActiveSpan("activitypub.send_activity", {
+		kind: _opentelemetry_api.SpanKind.CLIENT,
+		attributes: { "activitypub.shared_inbox": options.sharedInbox ?? false }
+	}, async (span) => {
+		if (options.activityId != null) span.setAttribute("activitypub.activity.id", options.activityId);
+		if (options.activityType != null) span.setAttribute("activitypub.activity.type", options.activityType);
+		try {
+			await sendActivityInternal({
+				...options,
+				tracerProvider
+			}, span);
+		} catch (e) {
+			span.setStatus({
+				code: _opentelemetry_api.SpanStatusCode.ERROR,
+				message: String(e)
+			});
+			throw e;
+		} finally {
+			span.end();
+		}
+	});
 }
-function hasMalformedExpandedDurationLiteral(value) {
-	if (Array.isArray(value)) return value.some(hasMalformedExpandedDurationLiteral);
-	return isPlainObject$1(value) && "@value" in value && isMalformedDurationLiteral(value["@value"]);
+const MAX_ERROR_RESPONSE_BODY_BYTES = 1024;
+function getActivityActorId(activity) {
+	if (!isRecord(activity)) return void 0;
+	return getIdValue(activity.actor);
 }
-function hasMalformedKnownTemporalLiteralInternal(value, visited) {
-	if (Array.isArray(value)) return value.some((item) => hasMalformedKnownTemporalLiteralInternal(item, visited));
-	if (!isPlainObject$1(value)) return false;
-	if (visited.has(value)) return false;
-	visited.add(value);
-	if ("@value" in value) return false;
-	for (const [key, child] of Object.entries(value)) {
-		if (TEMPORAL_DATE_TIME_IRIS.has(key)) {
-			if (hasMalformedExpandedDateTimeLiteral(child)) return true;
-			continue;
-		}
-		if (key === QUESTION_CLOSED_IRI) {
-			if (hasMalformedExpandedQuestionClosedLiteral(child)) return true;
-			continue;
-		}
-		if (TEMPORAL_DURATION_IRIS.has(key)) {
-			if (hasMalformedExpandedDurationLiteral(child)) return true;
-			continue;
+function getIdValue(value) {
+	if (typeof value === "string" && value !== "") return value;
+	if (value instanceof URL) return value.href;
+	if (Array.isArray(value)) {
+		for (const item of value) {
+			const id = getIdValue(item);
+			if (id != null) return id;
 		}
-		if (hasMalformedKnownTemporalLiteralInternal(child, visited)) return true;
+		return;
 	}
-	return false;
+	if (isRecord(value)) return getIdValue(value.id);
 }
-async function hasMalformedKnownTemporalLiteral(value, contextLoader) {
+function isRecord(value) {
+	return typeof value === "object" && value != null;
+}
+async function readLimitedResponseBody(response, maxBytes) {
+	if (response.body == null) return "";
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	const chunks = [];
+	let totalBytes = 0;
+	let truncated = false;
 	try {
-		return hasMalformedKnownTemporalLiteralInternal(await _fedify_vocab_runtime_jsonld.default.expand(value, {
-			documentLoader: require_http.getNormalizationContextLoader(contextLoader),
-			keepFreeFloatingNodes: true
-		}), /* @__PURE__ */ new Set());
-	} catch {
-		return false;
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (totalBytes + value.length > maxBytes) {
+				const remaining = maxBytes - totalBytes;
+				if (remaining > 0) chunks.push(decoder.decode(value.slice(0, remaining), { stream: true }));
+				truncated = true;
+				break;
+			}
+			chunks.push(decoder.decode(value, { stream: true }));
+			totalBytes += value.length;
+		}
+	} finally {
+		reader.releaseLock();
 	}
+	let result = chunks.join("");
+	if (truncated) result += "… (truncated)";
+	return result;
 }
-//#endregion
-//#region src/federation/handler.ts
-const Temporal$7 = require_http.Temporal;
-const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
-const INBOX_COMPOUND_PROOF_LIMITS = {
-	maxDepth: 64,
-	maxMaps: 1e4,
-	maxProofs: 32,
-	maxBytes: 10 * 1024 * 1024
-};
-function isRemoteContextLoadingFailure$1(error) {
-	return error instanceof Error && typeof error.details === "object" && error.details != null && error.details.code === "loading remote context failed";
-}
-function isPermanentRemoteContextError$1(error) {
-	if (!(error instanceof Error) || error.name !== "jsonld.InvalidUrl") return false;
-	const details = error.details;
-	if (details?.code === "invalid remote context") return true;
-	return isRemoteContextLoadingFailure$1(error) && typeof details?.url === "string" && !URL.canParse(details.url) && require_http.isClearlyMalformedContextReference(details.url);
-}
-function isInvalidJsonLdError(error) {
-	if (!(error instanceof Error)) return false;
-	const name = error.name;
-	return name === "UnsafeJsonLdError" || error instanceof require_http.InvalidContextReferenceError || isPermanentRemoteContextError$1(error) || name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure$1(error);
-}
-function isValidationTypeError(error) {
-	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || require_http.isInvalidUrlTypeError(error));
-}
-function isPermanentActivityParseError(error) {
-	return isInvalidJsonLdError(error) || isValidationTypeError(error);
-}
-function hasHttpSignatureHeaders(request) {
-	return request.headers.has("Signature") || request.headers.has("Signature-Input");
-}
-function hasObjectIntegrityProof(json) {
-	return typeof json === "object" && json != null && "proof" in json;
-}
-/**
-* Handles an actor request.
-* @template TContextData The context data to pass to the context.
-* @param request The HTTP request.
-* @param parameters The parameters for handling the actor.
-* @returns A promise that resolves to an HTTP response.
-*/
-async function handleActor(request, { identifier, context, actorDispatcher, authorizePredicate, onNotFound, onUnauthorized }) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
-		"actor"
+		"outbox"
 	]);
-	if (actorDispatcher == null) {
-		logger.debug("Actor dispatcher is not set.", { identifier });
-		return await onNotFound(request);
-	}
-	const actor = await actorDispatcher(context, identifier);
-	if (actor == null) {
-		logger.debug("Actor {identifier} not found.", { identifier });
-		return await onNotFound(request);
+	const federationMetrics = require_http.getFederationMetrics(meterProvider);
+	const started = performance.now();
+	let deliverySuccess = false;
+	async function validateUrl(url) {
+		if (!allowPrivateAddress) try {
+			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
+		} catch (error) {
+			if (error instanceof _fedify_vocab_runtime.UrlError) logger.error("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
 	}
-	if (authorizePredicate != null) {
-		if (!await authorizePredicate(context, identifier)) return await onUnauthorized(request);
+	await validateUrl(inbox.href);
+	headers = new Headers(headers);
+	headers.set("Content-Type", "application/activity+json");
+	const request = new Request(inbox, {
+		method: "POST",
+		headers,
+		body: JSON.stringify(activity),
+		redirect: "manual"
+	});
+	let rsaKey = null;
+	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
+		rsaKey = key;
+		break;
 	}
-	if (actor instanceof _fedify_vocab.Tombstone) {
+	if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
+		activityId,
+		inbox: inbox.href
+	});
+	else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
+		inbox: inbox.href,
+		keys: keys.map((pair) => ({
+			keyId: pair.keyId.href,
+			privateKey: pair.privateKey
+		}))
+	});
+	let response;
+	try {
+		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await require_http.doubleKnock(request, rsaKey, {
+			tracerProvider,
+			specDeterminer,
+			validateRedirect: validateUrl
+		});
+	} catch (error) {
+		const failure = error instanceof _fedify_vocab_runtime.FetchError || error instanceof _fedify_vocab_runtime.UrlError ? error : createFetchError(inbox.href, error);
+		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
+			activityId,
+			inbox: inbox.href,
+			error: failure
+		});
+		federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), false, activityType);
+		throw failure;
+	}
+	try {
+		if (!response.ok) {
+			let error;
+			try {
+				error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
+			} catch (_) {
+				error = "";
+			}
+			logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
+				activityId,
+				inbox: inbox.href,
+				status: response.status,
+				statusText: response.statusText,
+				error
+			});
+			throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error, response.headers);
+		}
+		deliverySuccess = true;
+		const eventAttributes = {
+			"activitypub.inbox.url": inbox.href,
+			"activitypub.activity.id": activityId ?? ""
+		};
+		if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
+		const actorId = getActivityActorId(activity);
+		if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
+		span.addEvent("activitypub.activity.sent", eventAttributes);
+	} finally {
+		federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), deliverySuccess, activityType);
+	}
+}
+function createFetchError(url, cause) {
+	const error = new _fedify_vocab_runtime.FetchError(url, cause instanceof Error ? cause.message : String(cause));
+	error.cause = cause;
+	return error;
+}
+async function fetchWithValidatedRedirects(request, validateUrl) {
+	let body = await request.clone().text();
+	for (let redirects = 0;; redirects++) {
+		const response = await fetch(request, { redirect: "manual" });
+		const location = response.headers.get("Location");
+		if (![
+			301,
+			302,
+			303,
+			307,
+			308
+		].includes(response.status) || location == null) return response;
+		await response.body?.cancel();
+		if (redirects >= 20) throw new TypeError("Too many redirects");
+		const url = new URL(location, request.url);
+		await validateUrl(url.href);
+		const headers = new Headers(request.headers);
+		if (url.origin !== new URL(request.url).origin) {
+			headers.delete("Authorization");
+			headers.delete("Proxy-Authorization");
+			headers.delete("Cookie");
+			headers.delete("Host");
+		}
+		let method = request.method;
+		if ((response.status === 301 || response.status === 302) && method === "POST" || response.status === 303 && method !== "GET" && method !== "HEAD") {
+			method = "GET";
+			body = void 0;
+			for (const name of [
+				"Content-Encoding",
+				"Content-Language",
+				"Content-Length",
+				"Content-Location",
+				"Content-Type"
+			]) headers.delete(name);
+		}
+		request = new Request(url, {
+			method,
+			headers,
+			body,
+			redirect: "manual"
+		});
+	}
+}
+/**
+* An error that is thrown when an activity fails to send to a remote inbox.
+* It contains structured information about the failure, including the HTTP
+* status code, the inbox URL, and the response body.
+* @since 2.0.0
+*/
+var SendActivityError = class extends Error {
+	/**
+	* The inbox URL that the activity was being sent to.
+	*/
+	inbox;
+	/**
+	* The HTTP status code returned by the inbox.
+	*/
+	statusCode;
+	/**
+	* The response body from the inbox, if any.  Note that this may be
+	* truncated to a maximum of 1 KiB to prevent excessive memory consumption
+	* when remote servers return large error pages (e.g., Cloudflare error pages).
+	* If truncated, the string will end with `"… (truncated)"`.
+	*/
+	responseBody;
+	/**
+	* The response headers from the inbox.
+	* @since 2.3.0
+	*/
+	responseHeaders;
+	/**
+	* Creates a new {@link SendActivityError}.
+	* @param inbox The inbox URL.
+	* @param statusCode The HTTP status code.
+	* @param message The error message.
+	* @param responseBody The response body.
+	* @param responseHeaders The response headers.
+	*/
+	constructor(inbox, statusCode, message, responseBody, responseHeaders) {
+		super(message);
+		this.name = "SendActivityError";
+		this.inbox = inbox;
+		this.statusCode = statusCode;
+		this.responseBody = responseBody;
+		this.responseHeaders = new Headers(responseHeaders);
+	}
+};
+//#endregion
+//#region src/federation/portable-inbox.ts
+const Temporal$8 = require_http.Temporal;
+const MAX_TIMEOUT_MS = 2 ** 31 - 1;
+/**
+* Fills in the defaults of {@link PortableInboxForwardingOptions} and
+* validates them.
+* @param options The options.
+* @returns The resolved options.
+* @throws {RangeError} If `maxTargets` is not a non-negative integer, if `ttl`
+*                      is not positive, if `deadline` is negative or longer
+*                      than 2,147,483,647 milliseconds (about 24.8 days), or
+*                      if either duration has calendar units, i.e., weeks,
+*                      months, or years, whose length depends on the date.
+*/
+function resolvePortableInboxForwardingOptions(options = {}) {
+	const maxTargets = options.maxTargets ?? 10;
+	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
+	const ttl = Temporal$8.Duration.from(options.ttl ?? { days: 30 });
+	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
+	const deadline = Temporal$8.Duration.from(options.deadline ?? { seconds: 10 });
+	const deadlineMs = deadline.total("millisecond");
+	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
+	return {
+		maxTargets,
+		ttl,
+		deadline
+	};
+}
+/**
+* Decides whether this server accepts a delivery to a portable inbox on behalf
+* of the given actor, which the actor dispatcher returned for the identifier
+* in the requested inbox path.
+*
+* The actor document comes from the application, so it is trusted as is and
+* its proof is not verified here.
+* @param actor The actor the actor dispatcher returned.
+* @param options The requested DID, the canonical form of the requested inbox
+*                ID, and the origin of this server.
+* @returns The resolution.
+*/
+function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, localOrigin }) {
+	if (actor == null) return {
+		status: "rejected",
+		reason: "notFound"
+	};
+	const id = actor.id;
+	const did = id == null || !require_http.isPortableId(id) ? null : require_http.getPortableDid(id);
+	if (id == null || did == null) return {
+		status: "rejected",
+		reason: "notPortable"
+	};
+	if (did !== authority) return {
+		status: "rejected",
+		reason: "authorityMismatch"
+	};
+	const inboxId = actor.inboxId == null ? null : toPortableUri(actor.inboxId);
+	if (inboxId == null || require_http.getCanonicalPortableId(inboxId) !== canonicalInboxId) return {
+		status: "rejected",
+		reason: "inboxMismatch"
+	};
+	const gateways = actor.gateways;
+	if (!gateways.some((g) => (0, _fedify_vocab_runtime.isGatewayUrl)(g) && g.origin === localOrigin)) return {
+		status: "rejected",
+		reason: "notGateway"
+	};
+	return {
+		status: "accepted",
+		recipient: {
+			actorId: id,
+			inboxId,
+			canonicalInboxId,
+			gateways
+		}
+	};
+}
+/**
+* Gets the portable form of an `ap:` or `ap+ef61:` URI or a compatible
+* identifier, keeping its query.
+* @returns The portable URI, or `null` if the ID is neither, or is malformed.
+*/
+function toPortableUri(id) {
+	if (require_http.isPortableUri(id)) return id;
+	try {
+		return (0, _fedify_vocab_runtime.fromCompatibleEf61Id)(id);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+const RFC9421_DELIVERY_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"content-digest"
+];
+const DRAFT_DELIVERY_COMPONENTS = [
+	"(request-target)",
+	"host",
+	"digest"
+];
+/**
+* Checks whether an HTTP Signature covers the method, the target URI, and the
+* body of a request, which both Fedify and Mitra sign when forwarding.
+* @param signature The signature.
+* @returns `true` if the signature covers them.
+*/
+function coversDelivery(signature) {
+	return (signature.label == null ? DRAFT_DELIVERY_COMPONENTS : RFC9421_DELIVERY_COMPONENTS).every((name) => signature.components.some((c) => c.value === name && Object.keys(c.params).length < 1));
+}
+/**
+* Forwards an activity received in a portable inbox to the inboxes of the same
+* portable actor on its other gateways, as FEP-ef61 recommends.
+*
+* FEP-ef61 forbids forwarding an activity from an inbox more than once, so
+* each target gateway is claimed with an atomic compare-and-swap before the
+* activity is handed off, and a claim is never released, even if the hand-off
+* fails, since a failed hand-off does not prove that nothing was delivered.
+* Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
+* forwarded.
+*
+* Forwarded requests are signed with HTTP Signatures by the RSA key among
+* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
+* servers requiring HTTP Signatures accept them, and are sent unsigned
+* otherwise.  Either way, the receiving gateways authenticate the activity by
+* its own proof.
+*
+* If the delivery is signed with a gateway key of the recipient by one of its
+* other gateways, that gateway has the activity already, so it is claimed
+* without forwarding the activity to it.  See {@link identifySendingGateway}.
+* @param parameters The parameters.
+* @returns The target inbox URLs that the activity was handed off to.
+*/
+async function forwardPortableInboxActivity(parameters) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
+	const options = parameters.options ?? resolvePortableInboxForwardingOptions();
+	const { maxTargets, ttl } = options;
+	if (kv.cas == null || maxTargets < 1) return [];
+	const deadline = Date.now() + options.deadline.total("millisecond");
+	const canonicalActivityId = require_http.getCanonicalPortableId(activityId) ?? activityId.href;
+	const claimKey = (gateway) => [
+		...kvPrefix,
+		recipient.canonicalInboxId,
+		canonicalActivityId,
+		gateway
+	];
+	let targets = getForwardingTargets(recipient, excludedOrigins);
+	const sender = await identifySendingGateway(parameters, targets.map((t) => t.gateway), claimKey, deadline);
+	if (sender != null) {
+		logger.debug("Not forwarding activity {activityId} from the portable inbox {inbox} back to the gateway {gateway}, which delivered it.", {
+			activityId: activityId.href,
+			inbox: recipient.canonicalInboxId,
+			gateway: sender
+		});
+		await kv.cas(claimKey(sender), void 0, true, { ttl });
+		targets = targets.filter((t) => t.gateway !== sender);
+	}
+	if (targets.length > maxTargets) {
+		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
+			inbox: recipient.canonicalInboxId,
+			activityId: activityId.href,
+			max: maxTargets
+		});
+		targets.length = maxTargets;
+	}
+	const claimed = [];
+	for (const { gateway, inbox } of targets) if (await kv.cas(claimKey(gateway), void 0, true, { ttl })) claimed.push(inbox);
+	if (claimed.length < 1) return [];
+	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		targets: claimed.map((t) => t.href)
+	});
+	if (outboxQueue == null) await forwardImmediately(parameters, claimed, deadline);
+	else await enqueueForwarding(parameters, outboxQueue, claimed);
+	return claimed;
+}
+/**
+* Identifies the gateway of the recipient that forwarded a delivery to its
+* portable inbox, by the delivery's HTTP Signature made with the recipient's
+* gateway key, which FEP-ef61 has each gateway use for requests on behalf of
+* an actor.  Since the activity is authenticated by its own proof, the
+* signature only tells which gateway to skip, and a delivery whose signature
+* is invalid or cannot be verified is still forwarded to every gateway.
+*
+* Verifying the signature fetches the recipient's actor document from the
+* sending gateway, as gateway keys are not cached, so only the first signature
+* that may save a request is verified: one that covers the delivery and names
+* a gateway key of the recipient on one of the forwarding targets that the
+* activity has not been forwarded to yet.
+* @param parameters The forwarding parameters.
+* @param targets The origins of the gateways to forward to.
+* @param claimKey Gets the key of the claim for a gateway.
+* @param deadline The time by which identification has to finish, in
+*                 milliseconds since the epoch; afterwards, the sending
+*                 gateway is left unidentified.
+* @returns The origin of the sending gateway, or `null` if it is not
+*          identified.
+*/
+async function identifySendingGateway({ recipient, activityId, kv, signatures }, targets, claimKey, deadline) {
+	if (signatures == null || signatures.length < 1) return null;
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const actorId = require_http.getCanonicalPortableId(recipient.actorId);
+	if (actorId == null) return null;
+	const isGatewayKeyOfRecipient = (keyId) => {
+		if (!require_http.isCompatibleKeyId(keyId) || !targets.includes(keyId.origin)) return false;
+		const base = new URL(keyId.href);
+		base.hash = "";
+		return require_http.getCanonicalPortableId(base) === actorId;
+	};
+	let signature;
+	for (const candidate of signatures) if (candidate.coversDelivery && isGatewayKeyOfRecipient(candidate.keyId) && await kv.get(claimKey(candidate.keyId.origin)) === void 0) {
+		signature = candidate;
+		break;
+	}
+	if (signature == null) return null;
+	const { keyId } = signature;
+	const logProperties = {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		keyId: keyId.href
+	};
+	const verification = Promise.resolve().then(() => signature.verify()).then((key) => {
+		if (key == null) logger.debug("The HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} is not verified with the key {keyId}; forwarding it without identifying the sending gateway.", logProperties);
+		return key;
+	}, (error) => {
+		logger.debug("Failed to verify the HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} with the key {keyId}; forwarding it without identifying the sending gateway:\n{error}", {
+			...logProperties,
+			error
+		});
+		return null;
+	});
+	let timer;
+	const key = await Promise.race([verification, new Promise((resolve) => {
+		timer = setTimeout(() => {
+			logger.debug("Verifying the HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} did not finish in time; forwarding it without identifying the sending gateway.", logProperties);
+			resolve(null);
+		}, Math.max(0, deadline - Date.now()));
+	})]);
+	clearTimeout(timer);
+	if (key == null) return null;
+	if (key.id == null || key.id.href !== keyId.href || !isGatewayKeyOfRecipient(key.id) || key.ownerId == null || !require_http.isPortableId(key.ownerId) || require_http.getCanonicalPortableId(key.ownerId) !== actorId) {
+		logger.debug("The delivery of activity {activityId} to the portable inbox {inbox} is not signed with a gateway key of the recipient; forwarding it without identifying the sending gateway.", logProperties);
+		return null;
+	}
+	return key.id.origin;
+}
+function getForwardingTargets(recipient, excludedOrigins) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const seen = new Set(excludedOrigins);
+	const targets = [];
+	for (const gateway of recipient.gateways) {
+		if (!(0, _fedify_vocab_runtime.isGatewayUrl)(gateway) || seen.has(gateway.origin)) continue;
+		seen.add(gateway.origin);
+		let inbox;
+		try {
+			inbox = (0, _fedify_vocab_runtime.toCompatibleEf61Id)(recipient.inboxId, gateway.origin);
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			logger.warn("Cannot forward to the gateway {gateway}, as the portable inbox {inbox} cannot be represented as its compatible identifier.", {
+				gateway: gateway.origin,
+				inbox: recipient.canonicalInboxId
+			});
+			continue;
+		}
+		targets.push({
+			gateway: gateway.origin,
+			inbox
+		});
+	}
+	return targets;
+}
+/**
+* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
+* key, as {@link sendActivity} signs requests only with such a key.  Since
+* the targets have already been claimed, the activity is forwarded unsigned
+* rather than not at all if the key cannot be resolved or used.
+*/
+async function resolveForwardingKey({ getKeys, activityId }) {
+	if (getKeys == null) return null;
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	let key;
+	try {
+		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
+	} catch (error) {
+		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	if (key == null) return null;
+	try {
+		require_http.validateCryptoKey(key.privateKey, "private");
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	return key;
+}
+async function forwardImmediately(parameters, inboxes, deadlineAt) {
+	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, meterProvider, tracerProvider } = parameters;
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const deadline = Math.max(0, deadlineAt - Date.now());
+	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
+		activity,
+		activityId: activityId.href,
+		activityType,
+		keys: key == null ? [] : [key],
+		inbox,
+		allowPrivateAddress,
+		specDeterminer,
+		meterProvider,
+		tracerProvider
+	}).catch((error) => {
+		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+			activityId: activityId.href,
+			inbox: inbox.href,
+			error
+		});
+	}))));
+	let timer;
+	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
+		timer = setTimeout(() => resolve(true), deadline);
+	})]);
+	clearTimeout(timer);
+	if (timedOut) logger.warn("Forwarding activity {activityId} to other gateways did not finish in {deadline} ms; responding to the delivery without waiting for it.", {
+		activityId: activityId.href,
+		deadline
+	});
+}
+async function enqueueForwarding(parameters, outboxQueue, inboxes) {
+	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const key = await resolveForwardingKey(parameters);
+	const keys = [];
+	if (key != null) try {
+		keys.push({
+			keyId: key.keyId.href,
+			privateKey: await require_http.exportJwk(key.privateKey)
+		});
+	} catch (error) {
+		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+	}
+	startQueue?.();
+	const started = (/* @__PURE__ */ new Date()).toISOString();
+	const traceContext = {};
+	_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), traceContext);
+	await Promise.all(inboxes.map(async (inbox) => {
+		const message = {
+			type: "outbox",
+			id: crypto.randomUUID(),
+			baseUrl,
+			keys,
+			activity,
+			activityId: activityId.href,
+			activityType,
+			inbox: inbox.href,
+			sharedInbox: false,
+			started,
+			attempt: 0,
+			headers: {},
+			traceContext
+		};
+		try {
+			await outboxQueue.enqueue(message);
+		} catch (error) {
+			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+				activityId: activityId.href,
+				inbox: inbox.href,
+				error
+			});
+			return;
+		}
+		require_http.recordOutboxEnqueue(meterProvider, outboxQueue, message);
+	}));
+}
+//#endregion
+//#region src/federation/temporal.ts
+const Temporal$7 = require_http.Temporal;
+function isPlainObject$1(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value);
+}
+function normalizeDateTimeLiteral(value) {
+	return value.substring(19).match(/[Z+-]/) ? value : value + "Z";
+}
+function isMalformedDateTimeLiteral(value) {
+	if (typeof value !== "string") return false;
+	try {
+		Temporal$7.Instant.from(normalizeDateTimeLiteral(value));
+		return false;
+	} catch {
+		return true;
+	}
+}
+function isMalformedDurationLiteral(value) {
+	if (typeof value !== "string") return false;
+	try {
+		Temporal$7.Duration.from(value);
+		return false;
+	} catch {
+		return true;
+	}
+}
+const TEMPORAL_DATE_TIME_IRIS = /* @__PURE__ */ new Set([
+	"https://www.w3.org/ns/activitystreams#deleted",
+	"https://www.w3.org/ns/activitystreams#endTime",
+	"https://www.w3.org/ns/activitystreams#published",
+	"https://www.w3.org/ns/activitystreams#startTime",
+	"https://www.w3.org/ns/activitystreams#updated",
+	"http://purl.org/dc/terms/created",
+	"https://w3id.org/security#created"
+]);
+const TEMPORAL_DURATION_IRIS = /* @__PURE__ */ new Set(["https://www.w3.org/ns/activitystreams#duration"]);
+const QUESTION_CLOSED_IRI = "https://www.w3.org/ns/activitystreams#closed";
+const XSD_DATE_TIME_IRI = "http://www.w3.org/2001/XMLSchema#dateTime";
+function hasMalformedExpandedDateTimeLiteral(value) {
+	if (Array.isArray(value)) return value.some(hasMalformedExpandedDateTimeLiteral);
+	return isPlainObject$1(value) && "@value" in value && isMalformedDateTimeLiteral(value["@value"]);
+}
+function hasMalformedExpandedQuestionClosedLiteral(value) {
+	if (Array.isArray(value)) return value.some(hasMalformedExpandedQuestionClosedLiteral);
+	if (!isPlainObject$1(value) || !("@value" in value)) return false;
+	const literal = value["@value"];
+	if (typeof literal === "boolean") return false;
+	if (typeof literal !== "string") return false;
+	if (value["@type"] !== XSD_DATE_TIME_IRI) return false;
+	if (new Date(literal).toString() === "Invalid Date") return false;
+	return isMalformedDateTimeLiteral(literal);
+}
+function hasMalformedExpandedDurationLiteral(value) {
+	if (Array.isArray(value)) return value.some(hasMalformedExpandedDurationLiteral);
+	return isPlainObject$1(value) && "@value" in value && isMalformedDurationLiteral(value["@value"]);
+}
+function hasMalformedKnownTemporalLiteralInternal(value, visited) {
+	if (Array.isArray(value)) return value.some((item) => hasMalformedKnownTemporalLiteralInternal(item, visited));
+	if (!isPlainObject$1(value)) return false;
+	if (visited.has(value)) return false;
+	visited.add(value);
+	if ("@value" in value) return false;
+	for (const [key, child] of Object.entries(value)) {
+		if (TEMPORAL_DATE_TIME_IRIS.has(key)) {
+			if (hasMalformedExpandedDateTimeLiteral(child)) return true;
+			continue;
+		}
+		if (key === QUESTION_CLOSED_IRI) {
+			if (hasMalformedExpandedQuestionClosedLiteral(child)) return true;
+			continue;
+		}
+		if (TEMPORAL_DURATION_IRIS.has(key)) {
+			if (hasMalformedExpandedDurationLiteral(child)) return true;
+			continue;
+		}
+		if (hasMalformedKnownTemporalLiteralInternal(child, visited)) return true;
+	}
+	return false;
+}
+async function hasMalformedKnownTemporalLiteral(value, contextLoader) {
+	try {
+		return hasMalformedKnownTemporalLiteralInternal(await _fedify_vocab_runtime_jsonld.default.expand(value, {
+			documentLoader: require_http.getNormalizationContextLoader(contextLoader),
+			keepFreeFloatingNodes: true
+		}), /* @__PURE__ */ new Set());
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/federation/handler.ts
+const Temporal$6 = require_http.Temporal;
+const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
+const INBOX_COMPOUND_PROOF_LIMITS = {
+	maxDepth: 64,
+	maxMaps: 1e4,
+	maxProofs: 32,
+	maxBytes: 10 * 1024 * 1024
+};
+function isRemoteContextLoadingFailure$1(error) {
+	return error instanceof Error && typeof error.details === "object" && error.details != null && error.details.code === "loading remote context failed";
+}
+function isPermanentRemoteContextError$1(error) {
+	if (!(error instanceof Error) || error.name !== "jsonld.InvalidUrl") return false;
+	const details = error.details;
+	if (details?.code === "invalid remote context") return true;
+	return isRemoteContextLoadingFailure$1(error) && typeof details?.url === "string" && !URL.canParse(details.url) && require_http.isClearlyMalformedContextReference(details.url);
+}
+function isInvalidJsonLdError(error) {
+	if (!(error instanceof Error)) return false;
+	const name = error.name;
+	return name === "UnsafeJsonLdError" || error instanceof require_http.InvalidContextReferenceError || isPermanentRemoteContextError$1(error) || name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure$1(error);
+}
+function isValidationTypeError(error) {
+	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || require_http.isInvalidUrlTypeError(error));
+}
+function isPermanentActivityParseError(error) {
+	return isInvalidJsonLdError(error) || isValidationTypeError(error);
+}
+function hasHttpSignatureHeaders(request) {
+	return request.headers.has("Signature") || request.headers.has("Signature-Input");
+}
+function hasObjectIntegrityProof(json) {
+	return typeof json === "object" && json != null && "proof" in json;
+}
+/**
+* Handles an actor request.
+* @template TContextData The context data to pass to the context.
+* @param request The HTTP request.
+* @param parameters The parameters for handling the actor.
+* @returns A promise that resolves to an HTTP response.
+*/
+async function handleActor(request, { identifier, context, actorDispatcher, authorizePredicate, onNotFound, onUnauthorized }) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"actor"
+	]);
+	if (actorDispatcher == null) {
+		logger.debug("Actor dispatcher is not set.", { identifier });
+		return await onNotFound(request);
+	}
+	const actor = await actorDispatcher(context, identifier);
+	if (actor == null) {
+		logger.debug("Actor {identifier} not found.", { identifier });
+		return await onNotFound(request);
+	}
+	if (authorizePredicate != null) {
+		if (!await authorizePredicate(context, identifier)) return await onUnauthorized(request);
+	}
+	if (actor instanceof _fedify_vocab.Tombstone) {
 		const jsonLd = await actor.toJsonLd(context);
 		return new Response(JSON.stringify(jsonLd), {
 			status: 410,
@@ -3950,7 +4650,21 @@ async function handleInboxInternal(request, parameters, span) {
 		inbox: portableInbox.recipient.canonicalInboxId
 	});
 	else try {
-		await portableInbox.forward(json, activity.id, (0, _fedify_vocab.getTypeId)(activity).href);
+		await portableInbox.forward(json, activity.id, (0, _fedify_vocab.getTypeId)(activity).href, require_http.listRequestSignatures(request).map((signature) => ({
+			keyId: signature.keyId,
+			coversDelivery: coversDelivery(signature),
+			verify: async () => {
+				const verification = await require_http.verifyRequestDetailed(require_http.selectRequestSignature(request, signature), {
+					contextLoader: ctx.contextLoader,
+					documentLoader: ctx.documentLoader,
+					timeWindow: signatureTimeWindow,
+					keyCache,
+					meterProvider,
+					tracerProvider
+				});
+				return verification.verified ? verification.key : null;
+			}
+		})));
 	} catch (error) {
 		logger.error("Failed to forward activity {activityId} to the other gateways of the portable inbox {inbox}:\n{error}", {
 			activityId: activity.id.href,
@@ -4481,577 +5195,287 @@ var HandlerError = class extends Error {
 	throw() {
 		throw this;
 	}
-};
-/**
-* Error thrown when items are not found in a collection.
-* @since 1.8.0
-*/
-var ItemsNotFoundError = class extends HandlerError {
-	constructor() {
-		super("Items not found in the collection.");
-	}
-};
-/**
-* Error thrown when access to a collection is unauthorized.
-* @since 1.8.0
-*/
-var UnauthorizedError = class extends HandlerError {
-	constructor() {
-		super("Unauthorized access to the collection.");
-	}
-};
-/**
-* Responds with the given object in JSON-LD format.
-*
-* @param object The object to respond with.
-* @param options Options.
-* @since 0.3.0
-*/
-async function respondWithObject(object, options) {
-	const jsonLd = await object.toJsonLd(options);
-	return new Response(JSON.stringify(jsonLd), { headers: { "Content-Type": "application/activity+json" } });
-}
-/**
-* Responds with the given object in JSON-LD format if the request accepts
-* JSON-LD.
-*
-* @param object The object to respond with.
-* @param request The request to check for JSON-LD acceptability.
-* @param options Options.
-* @since 0.3.0
-*/
-async function respondWithObjectIfAcceptable(object, request, options) {
-	if (!acceptsJsonLd(request)) return null;
-	const response = await respondWithObject(object, options);
-	response.headers.set("Vary", "Accept");
-	return response;
-}
-function generateNonce() {
-	const bytes = /* @__PURE__ */ new Uint8Array(16);
-	crypto.getRandomValues(bytes);
-	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-async function verifySignatureNonce(request, kv, noncePrefix, verifiedLabel) {
-	const signatureInput = request.headers.get("Signature-Input");
-	if (signatureInput == null) return false;
-	const parsed = require_http.parseRfc9421SignatureInput(signatureInput);
-	if (verifiedLabel == null) return false;
-	const sig = parsed[verifiedLabel];
-	if (sig == null) return false;
-	const nonce = sig.nonce;
-	if (nonce == null) return false;
-	const key = [...noncePrefix, nonce];
-	if (kv.cas != null) return await kv.cas(key, true, void 0);
-	if (await kv.get(key) != null) {
-		await kv.delete(key);
-		return true;
-	}
-	return false;
-}
-const getFailedSignatureResponse = async (policy, kv, kvPrefixes) => {
-	const headers = await getFailedSignatureHeaders(policy, kv, kvPrefixes);
-	return new Response("Failed to verify the request signature.", {
-		status: 401,
-		headers
-	});
-};
-const getFailedSignatureHeaders = async (policy, kv, kvPrefixes) => ({
-	"Content-Type": "text/plain; charset=utf-8",
-	...policy?.enabled && {
-		"Accept-Signature": await buildAcceptSignatureHeader(policy, kv, kvPrefixes.acceptSignatureNonce),
-		"Cache-Control": "no-store",
-		"Vary": "Accept, Signature"
-	}
-});
-async function buildAcceptSignatureHeader(policy, kv, noncePrefix) {
-	const parameters = { created: true };
-	if (policy.requestNonce) {
-		const nonce = generateNonce();
-		await setKey(kv, [...noncePrefix, nonce], policy);
-		parameters.nonce = nonce;
-	}
-	const baseComponents = policy.components ?? DEF_COMPONENTS;
-	return require_http.formatAcceptSignature([{
-		label: "sig1",
-		components: (0, es_toolkit.uniq)(MIN_COMPONENTS.concat(baseComponents)).filter((c) => c !== "@status").map((v) => ({
-			value: v,
-			params: {}
-		})),
-		parameters
-	}]);
-}
-async function setKey(kv, key, policy) {
-	const seconds = policy.nonceTtlSeconds ?? 300;
-	const ttl = Temporal$7.Duration.from({ seconds });
-	await kv.set(key, true, { ttl });
-}
-const DEF_COMPONENTS = [
-	"@method",
-	"@target-uri",
-	"@authority",
-	"content-digest"
-];
-const MIN_COMPONENTS = [
-	"@method",
-	"@target-uri",
-	"@authority"
-];
-/**
-* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
-* portable actor, i.e., its ID is a compatible identifier and it is owned by
-* a portable actor, which only the portable actor's signed document can
-* establish.
-*/
-function isPortableGatewayKey(key) {
-	return key?.id != null && require_http.isCompatibleKeyId(key.id) && key.ownerId != null && require_http.isPortableId(key.ownerId);
-}
-/**
-* Checks whether an activity needs an Object Integrity Proof by its DID:
-* either it is performed by an [FEP-ef61] portable actor, or its own ID is
-* portable.  Both `ap:` URIs and compatible identifiers count as portable.
-*
-* [FEP-ef61]: https://w3id.org/fep/ef61
-*/
-function isPortableActivity(activity) {
-	return require_http.hasPortableActor(activity) || activity.id != null && require_http.isPortableId(activity.id);
-}
-/**
-* Verifies that a portable activity's own ID belongs to the DID that signed
-* it, on the JSON-LD document received.  The ID the proof policy checks has
-* to be the parsed activity's ID, so that a remote context that changes
-* between loads cannot make the two name different objects.
-* @returns `null` if the ID is verified, or the reason why it is not.
-*/
-async function verifyPortableActivityId(activityId, jsonLd, options) {
-	const expectedId = require_http.getCanonicalPortableId(activityId);
-	if (expectedId == null) return "malformed portable ID";
-	let verification;
-	try {
-		verification = await require_http.verifyPortableObjectProofWithRoot(jsonLd, options);
-	} catch (error) {
-		if (error instanceof require_http.InvalidPortableObjectIdError) return "malformed portable ID";
-		if (!isPermanentActivityParseError(error)) throw error;
-		return "malformed document";
-	}
-	const { result, root } = verification;
-	if (!result.verified) return result.reason.type;
-	const rootId = root?.["@id"];
-	if (typeof rootId !== "string" || require_http.getCanonicalPortableId((0, _fedify_vocab_runtime.parseIri)(rootId)) !== expectedId) return "the verified document has another ID";
-	return null;
-}
-//#endregion
-//#region src/federation/kv.ts
-const Temporal$6 = require_http.Temporal;
-/**
-* A key–value store that stores values in memory.
-* Do not use this in production as it does not persist values.
-*
-* @since 0.5.0
-*/
-var MemoryKvStore = class {
-	#values = {};
-	#encodeKey(key) {
-		return JSON.stringify(key);
-	}
-	/**
-	* {@inheritDoc KvStore.get}
-	*/
-	get(key) {
-		const encodedKey = this.#encodeKey(key);
-		const entry = this.#values[encodedKey];
-		if (entry == null) return Promise.resolve(void 0);
-		const [value, expiration] = entry;
-		if (expiration != null && Temporal$6.Now.instant().until(expiration).sign < 0) {
-			delete this.#values[encodedKey];
-			return Promise.resolve(void 0);
-		}
-		return Promise.resolve(value);
-	}
-	/**
-	* {@inheritDoc KvStore.set}
-	*/
-	set(key, value, options) {
-		const encodedKey = this.#encodeKey(key);
-		const expiration = options?.ttl == null ? null : Temporal$6.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
-		this.#values[encodedKey] = [value, expiration];
-		return Promise.resolve();
-	}
-	/**
-	* {@inheritDoc KvStore.delete}
-	*/
-	delete(key) {
-		const encodedKey = this.#encodeKey(key);
-		delete this.#values[encodedKey];
-		return Promise.resolve();
-	}
-	/**
-	* {@inheritDoc KvStore.cas}
-	*/
-	cas(key, expectedValue, newValue, options) {
-		const encodedKey = this.#encodeKey(key);
-		const entry = this.#values[encodedKey];
-		let currentValue;
-		if (entry == null) currentValue = void 0;
-		else {
-			const [value, expiration] = entry;
-			if (expiration != null && Temporal$6.Now.instant().until(expiration).sign < 0) {
-				delete this.#values[encodedKey];
-				currentValue = void 0;
-			} else currentValue = value;
-		}
-		if (!(0, es_toolkit.isEqual)(currentValue, expectedValue)) return Promise.resolve(false);
-		const expiration = options?.ttl == null ? null : Temporal$6.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
-		this.#values[encodedKey] = [newValue, expiration];
-		return Promise.resolve(true);
-	}
-	/**
-	* {@inheritDoc KvStore.list}
-	*/
-	async *list(prefix) {
-		const now = Temporal$6.Now.instant();
-		for (const [encodedKey, entry] of Object.entries(this.#values)) {
-			const key = JSON.parse(encodedKey);
-			if (prefix != null) {
-				if (key.length < prefix.length) continue;
-				if (!prefix.every((p, i) => key[i] === p)) continue;
-			}
-			const [value, expiration] = entry;
-			if (expiration != null && now.until(expiration).sign < 0) {
-				delete this.#values[encodedKey];
-				continue;
-			}
-			yield {
-				key,
-				value
-			};
-		}
-	}
-};
-//#endregion
-//#region src/nodeinfo/handler.ts
-/**
-* Handles a NodeInfo request.  You would not typically call this function
-* directly, but instead use {@link Federation.handle} method.
-* @param request The NodeInfo request to handle.
-* @param parameters The parameters for handling the request.
-* @returns The response to the request.
-*/
-async function handleNodeInfo(_request, { context, nodeInfoDispatcher }) {
-	const promise = nodeInfoDispatcher(context);
-	const json = require_types.nodeInfoToJson(promise instanceof Promise ? await promise : promise);
-	return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\"" } });
-}
+};
 /**
-* Handles a request to `/.well-known/nodeinfo`.  You would not typically call
-* this function directly, but instead use {@link Federation.handle} method.
-* @param request The request to handle.
-* @param context The request context.
-* @returns The response to the request.
+* Error thrown when items are not found in a collection.
+* @since 1.8.0
 */
-function handleNodeInfoJrd(_request, context) {
-	const links = [];
-	try {
-		links.push({
-			rel: "http://nodeinfo.diaspora.software/ns/schema/2.1",
-			href: context.getNodeInfoUri().href,
-			type: "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\""
-		});
-	} catch (e) {
-		if (!(e instanceof _fedify_uri_template.RouterError)) throw e;
+var ItemsNotFoundError = class extends HandlerError {
+	constructor() {
+		super("Items not found in the collection.");
 	}
-	const response = new Response(JSON.stringify({ links }), { headers: { "Content-Type": "application/jrd+json" } });
-	return Promise.resolve(response);
-}
-//#endregion
-//#region src/federation/send.ts
+};
 /**
-* Extracts the inbox URLs from recipients.
-* @param parameters The parameters to extract the inboxes.
-*                   See also {@link ExtractInboxesParameters}.
-* @returns The inboxes as a map of inbox URL to actor URIs.
+* Error thrown when access to a collection is unauthorized.
+* @since 1.8.0
 */
-function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
-	const inboxes = {};
-	for (const recipient of recipients) {
-		let inbox;
-		let sharedInbox = false;
-		if (preferSharedInbox && recipient.endpoints?.sharedInbox != null) {
-			inbox = recipient.endpoints.sharedInbox;
-			sharedInbox = true;
-		} else inbox = recipient.inboxId;
-		if (inbox != null && recipient.id != null) {
-			if (excludeBaseUris != null && excludeBaseUris.some((u) => u.origin === inbox?.origin)) continue;
-			inboxes[inbox.href] ??= {
-				actorIds: /* @__PURE__ */ new Set(),
-				sharedInbox
-			};
-			inboxes[inbox.href].actorIds.add(recipient.id.href);
-		}
+var UnauthorizedError = class extends HandlerError {
+	constructor() {
+		super("Unauthorized access to the collection.");
 	}
-	return inboxes;
-}
+};
 /**
-* Sends an {@link Activity} to an inbox.
+* Responds with the given object in JSON-LD format.
 *
-* @param parameters The parameters for sending the activity.
-*                   See also {@link SendActivityParameters}.
-* @throws {Error} If the activity fails to send.
+* @param object The object to respond with.
+* @param options Options.
+* @since 0.3.0
 */
-function sendActivity(options) {
-	const tracerProvider = options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
-	return tracerProvider.getTracer(require_http.name, require_http.version).startActiveSpan("activitypub.send_activity", {
-		kind: _opentelemetry_api.SpanKind.CLIENT,
-		attributes: { "activitypub.shared_inbox": options.sharedInbox ?? false }
-	}, async (span) => {
-		if (options.activityId != null) span.setAttribute("activitypub.activity.id", options.activityId);
-		if (options.activityType != null) span.setAttribute("activitypub.activity.type", options.activityType);
-		try {
-			await sendActivityInternal({
-				...options,
-				tracerProvider
-			}, span);
-		} catch (e) {
-			span.setStatus({
-				code: _opentelemetry_api.SpanStatusCode.ERROR,
-				message: String(e)
-			});
-			throw e;
-		} finally {
-			span.end();
-		}
-	});
-}
-const MAX_ERROR_RESPONSE_BODY_BYTES = 1024;
-function getActivityActorId(activity) {
-	if (!isRecord(activity)) return void 0;
-	return getIdValue(activity.actor);
+async function respondWithObject(object, options) {
+	const jsonLd = await object.toJsonLd(options);
+	return new Response(JSON.stringify(jsonLd), { headers: { "Content-Type": "application/activity+json" } });
 }
-function getIdValue(value) {
-	if (typeof value === "string" && value !== "") return value;
-	if (value instanceof URL) return value.href;
-	if (Array.isArray(value)) {
-		for (const item of value) {
-			const id = getIdValue(item);
-			if (id != null) return id;
-		}
-		return;
-	}
-	if (isRecord(value)) return getIdValue(value.id);
+/**
+* Responds with the given object in JSON-LD format if the request accepts
+* JSON-LD.
+*
+* @param object The object to respond with.
+* @param request The request to check for JSON-LD acceptability.
+* @param options Options.
+* @since 0.3.0
+*/
+async function respondWithObjectIfAcceptable(object, request, options) {
+	if (!acceptsJsonLd(request)) return null;
+	const response = await respondWithObject(object, options);
+	response.headers.set("Vary", "Accept");
+	return response;
 }
-function isRecord(value) {
-	return typeof value === "object" && value != null;
+function generateNonce() {
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	crypto.getRandomValues(bytes);
+	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-async function readLimitedResponseBody(response, maxBytes) {
-	if (response.body == null) return "";
-	const reader = response.body.getReader();
-	const decoder = new TextDecoder();
-	const chunks = [];
-	let totalBytes = 0;
-	let truncated = false;
-	try {
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			if (totalBytes + value.length > maxBytes) {
-				const remaining = maxBytes - totalBytes;
-				if (remaining > 0) chunks.push(decoder.decode(value.slice(0, remaining), { stream: true }));
-				truncated = true;
-				break;
-			}
-			chunks.push(decoder.decode(value, { stream: true }));
-			totalBytes += value.length;
-		}
-	} finally {
-		reader.releaseLock();
+async function verifySignatureNonce(request, kv, noncePrefix, verifiedLabel) {
+	const signatureInput = request.headers.get("Signature-Input");
+	if (signatureInput == null) return false;
+	const parsed = require_http.parseRfc9421SignatureInput(signatureInput);
+	if (verifiedLabel == null) return false;
+	const sig = parsed[verifiedLabel];
+	if (sig == null) return false;
+	const nonce = sig.nonce;
+	if (nonce == null) return false;
+	const key = [...noncePrefix, nonce];
+	if (kv.cas != null) return await kv.cas(key, true, void 0);
+	if (await kv.get(key) != null) {
+		await kv.delete(key);
+		return true;
 	}
-	let result = chunks.join("");
-	if (truncated) result += "… (truncated)";
-	return result;
+	return false;
 }
-async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span) {
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"federation",
-		"outbox"
-	]);
-	const federationMetrics = require_http.getFederationMetrics(meterProvider);
-	const started = performance.now();
-	let deliverySuccess = false;
-	async function validateUrl(url) {
-		if (!allowPrivateAddress) try {
-			await (0, _fedify_vocab_runtime.validatePublicUrl)(url);
-		} catch (error) {
-			if (error instanceof _fedify_vocab_runtime.UrlError) logger.error("Disallowed private URL: {url}", {
-				url,
-				error
-			});
-			throw error;
-		}
-	}
-	await validateUrl(inbox.href);
-	headers = new Headers(headers);
-	headers.set("Content-Type", "application/activity+json");
-	const request = new Request(inbox, {
-		method: "POST",
-		headers,
-		body: JSON.stringify(activity),
-		redirect: "manual"
-	});
-	let rsaKey = null;
-	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
-		rsaKey = key;
-		break;
-	}
-	if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
-		activityId,
-		inbox: inbox.href
-	});
-	else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
-		inbox: inbox.href,
-		keys: keys.map((pair) => ({
-			keyId: pair.keyId.href,
-			privateKey: pair.privateKey
-		}))
-	});
-	let response;
-	try {
-		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await require_http.doubleKnock(request, rsaKey, {
-			tracerProvider,
-			specDeterminer,
-			validateRedirect: validateUrl
-		});
-	} catch (error) {
-		const failure = error instanceof _fedify_vocab_runtime.FetchError || error instanceof _fedify_vocab_runtime.UrlError ? error : createFetchError(inbox.href, error);
-		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
-			activityId,
-			inbox: inbox.href,
-			error: failure
-		});
-		federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), false, activityType);
-		throw failure;
-	}
-	try {
-		if (!response.ok) {
-			let error;
-			try {
-				error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
-			} catch (_) {
-				error = "";
-			}
-			logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
-				activityId,
-				inbox: inbox.href,
-				status: response.status,
-				statusText: response.statusText,
-				error
-			});
-			throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error, response.headers);
-		}
-		deliverySuccess = true;
-		const eventAttributes = {
-			"activitypub.inbox.url": inbox.href,
-			"activitypub.activity.id": activityId ?? ""
-		};
-		if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
-		const actorId = getActivityActorId(activity);
-		if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
-		span.addEvent("activitypub.activity.sent", eventAttributes);
-	} finally {
-		federationMetrics.recordDelivery(inbox, require_http.getDurationMs(started), deliverySuccess, activityType);
+const getFailedSignatureResponse = async (policy, kv, kvPrefixes) => {
+	const headers = await getFailedSignatureHeaders(policy, kv, kvPrefixes);
+	return new Response("Failed to verify the request signature.", {
+		status: 401,
+		headers
+	});
+};
+const getFailedSignatureHeaders = async (policy, kv, kvPrefixes) => ({
+	"Content-Type": "text/plain; charset=utf-8",
+	...policy?.enabled && {
+		"Accept-Signature": await buildAcceptSignatureHeader(policy, kv, kvPrefixes.acceptSignatureNonce),
+		"Cache-Control": "no-store",
+		"Vary": "Accept, Signature"
+	}
+});
+async function buildAcceptSignatureHeader(policy, kv, noncePrefix) {
+	const parameters = { created: true };
+	if (policy.requestNonce) {
+		const nonce = generateNonce();
+		await setKey(kv, [...noncePrefix, nonce], policy);
+		parameters.nonce = nonce;
 	}
+	const baseComponents = policy.components ?? DEF_COMPONENTS;
+	return require_http.formatAcceptSignature([{
+		label: "sig1",
+		components: (0, es_toolkit.uniq)(MIN_COMPONENTS.concat(baseComponents)).filter((c) => c !== "@status").map((v) => ({
+			value: v,
+			params: {}
+		})),
+		parameters
+	}]);
 }
-function createFetchError(url, cause) {
-	const error = new _fedify_vocab_runtime.FetchError(url, cause instanceof Error ? cause.message : String(cause));
-	error.cause = cause;
-	return error;
+async function setKey(kv, key, policy) {
+	const seconds = policy.nonceTtlSeconds ?? 300;
+	const ttl = Temporal$6.Duration.from({ seconds });
+	await kv.set(key, true, { ttl });
 }
-async function fetchWithValidatedRedirects(request, validateUrl) {
-	let body = await request.clone().text();
-	for (let redirects = 0;; redirects++) {
-		const response = await fetch(request, { redirect: "manual" });
-		const location = response.headers.get("Location");
-		if (![
-			301,
-			302,
-			303,
-			307,
-			308
-		].includes(response.status) || location == null) return response;
-		await response.body?.cancel();
-		if (redirects >= 20) throw new TypeError("Too many redirects");
-		const url = new URL(location, request.url);
-		await validateUrl(url.href);
-		const headers = new Headers(request.headers);
-		if (url.origin !== new URL(request.url).origin) {
-			headers.delete("Authorization");
-			headers.delete("Proxy-Authorization");
-			headers.delete("Cookie");
-			headers.delete("Host");
-		}
-		let method = request.method;
-		if ((response.status === 301 || response.status === 302) && method === "POST" || response.status === 303 && method !== "GET" && method !== "HEAD") {
-			method = "GET";
-			body = void 0;
-			for (const name of [
-				"Content-Encoding",
-				"Content-Language",
-				"Content-Length",
-				"Content-Location",
-				"Content-Type"
-			]) headers.delete(name);
-		}
-		request = new Request(url, {
-			method,
-			headers,
-			body,
-			redirect: "manual"
-		});
+const DEF_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"@authority",
+	"content-digest"
+];
+const MIN_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"@authority"
+];
+/**
+* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
+* portable actor, i.e., its ID is a compatible identifier and it is owned by
+* a portable actor, which only the portable actor's signed document can
+* establish.
+*/
+function isPortableGatewayKey(key) {
+	return key?.id != null && require_http.isCompatibleKeyId(key.id) && key.ownerId != null && require_http.isPortableId(key.ownerId);
+}
+/**
+* Checks whether an activity needs an Object Integrity Proof by its DID:
+* either it is performed by an [FEP-ef61] portable actor, or its own ID is
+* portable.  Both `ap:` URIs and compatible identifiers count as portable.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*/
+function isPortableActivity(activity) {
+	return require_http.hasPortableActor(activity) || activity.id != null && require_http.isPortableId(activity.id);
+}
+/**
+* Verifies that a portable activity's own ID belongs to the DID that signed
+* it, on the JSON-LD document received.  The ID the proof policy checks has
+* to be the parsed activity's ID, so that a remote context that changes
+* between loads cannot make the two name different objects.
+* @returns `null` if the ID is verified, or the reason why it is not.
+*/
+async function verifyPortableActivityId(activityId, jsonLd, options) {
+	const expectedId = require_http.getCanonicalPortableId(activityId);
+	if (expectedId == null) return "malformed portable ID";
+	let verification;
+	try {
+		verification = await require_http.verifyPortableObjectProofWithRoot(jsonLd, options);
+	} catch (error) {
+		if (error instanceof require_http.InvalidPortableObjectIdError) return "malformed portable ID";
+		if (!isPermanentActivityParseError(error)) throw error;
+		return "malformed document";
 	}
+	const { result, root } = verification;
+	if (!result.verified) return result.reason.type;
+	const rootId = root?.["@id"];
+	if (typeof rootId !== "string" || require_http.getCanonicalPortableId((0, _fedify_vocab_runtime.parseIri)(rootId)) !== expectedId) return "the verified document has another ID";
+	return null;
 }
+//#endregion
+//#region src/federation/kv.ts
+const Temporal$5 = require_http.Temporal;
 /**
-* An error that is thrown when an activity fails to send to a remote inbox.
-* It contains structured information about the failure, including the HTTP
-* status code, the inbox URL, and the response body.
-* @since 2.0.0
+* A key–value store that stores values in memory.
+* Do not use this in production as it does not persist values.
+*
+* @since 0.5.0
 */
-var SendActivityError = class extends Error {
+var MemoryKvStore = class {
+	#values = {};
+	#encodeKey(key) {
+		return JSON.stringify(key);
+	}
 	/**
-	* The inbox URL that the activity was being sent to.
+	* {@inheritDoc KvStore.get}
 	*/
-	inbox;
+	get(key) {
+		const encodedKey = this.#encodeKey(key);
+		const entry = this.#values[encodedKey];
+		if (entry == null) return Promise.resolve(void 0);
+		const [value, expiration] = entry;
+		if (expiration != null && Temporal$5.Now.instant().until(expiration).sign < 0) {
+			delete this.#values[encodedKey];
+			return Promise.resolve(void 0);
+		}
+		return Promise.resolve(value);
+	}
 	/**
-	* The HTTP status code returned by the inbox.
+	* {@inheritDoc KvStore.set}
 	*/
-	statusCode;
+	set(key, value, options) {
+		const encodedKey = this.#encodeKey(key);
+		const expiration = options?.ttl == null ? null : Temporal$5.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
+		this.#values[encodedKey] = [value, expiration];
+		return Promise.resolve();
+	}
 	/**
-	* The response body from the inbox, if any.  Note that this may be
-	* truncated to a maximum of 1 KiB to prevent excessive memory consumption
-	* when remote servers return large error pages (e.g., Cloudflare error pages).
-	* If truncated, the string will end with `"… (truncated)"`.
+	* {@inheritDoc KvStore.delete}
 	*/
-	responseBody;
+	delete(key) {
+		const encodedKey = this.#encodeKey(key);
+		delete this.#values[encodedKey];
+		return Promise.resolve();
+	}
 	/**
-	* The response headers from the inbox.
-	* @since 2.3.0
+	* {@inheritDoc KvStore.cas}
 	*/
-	responseHeaders;
+	cas(key, expectedValue, newValue, options) {
+		const encodedKey = this.#encodeKey(key);
+		const entry = this.#values[encodedKey];
+		let currentValue;
+		if (entry == null) currentValue = void 0;
+		else {
+			const [value, expiration] = entry;
+			if (expiration != null && Temporal$5.Now.instant().until(expiration).sign < 0) {
+				delete this.#values[encodedKey];
+				currentValue = void 0;
+			} else currentValue = value;
+		}
+		if (!(0, es_toolkit.isEqual)(currentValue, expectedValue)) return Promise.resolve(false);
+		const expiration = options?.ttl == null ? null : Temporal$5.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
+		this.#values[encodedKey] = [newValue, expiration];
+		return Promise.resolve(true);
+	}
 	/**
-	* Creates a new {@link SendActivityError}.
-	* @param inbox The inbox URL.
-	* @param statusCode The HTTP status code.
-	* @param message The error message.
-	* @param responseBody The response body.
-	* @param responseHeaders The response headers.
+	* {@inheritDoc KvStore.list}
 	*/
-	constructor(inbox, statusCode, message, responseBody, responseHeaders) {
-		super(message);
-		this.name = "SendActivityError";
-		this.inbox = inbox;
-		this.statusCode = statusCode;
-		this.responseBody = responseBody;
-		this.responseHeaders = new Headers(responseHeaders);
+	async *list(prefix) {
+		const now = Temporal$5.Now.instant();
+		for (const [encodedKey, entry] of Object.entries(this.#values)) {
+			const key = JSON.parse(encodedKey);
+			if (prefix != null) {
+				if (key.length < prefix.length) continue;
+				if (!prefix.every((p, i) => key[i] === p)) continue;
+			}
+			const [value, expiration] = entry;
+			if (expiration != null && now.until(expiration).sign < 0) {
+				delete this.#values[encodedKey];
+				continue;
+			}
+			yield {
+				key,
+				value
+			};
+		}
+	}
+};
+//#endregion
+//#region src/nodeinfo/handler.ts
+/**
+* Handles a NodeInfo request.  You would not typically call this function
+* directly, but instead use {@link Federation.handle} method.
+* @param request The NodeInfo request to handle.
+* @param parameters The parameters for handling the request.
+* @returns The response to the request.
+*/
+async function handleNodeInfo(_request, { context, nodeInfoDispatcher }) {
+	const promise = nodeInfoDispatcher(context);
+	const json = require_types.nodeInfoToJson(promise instanceof Promise ? await promise : promise);
+	return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\"" } });
+}
+/**
+* Handles a request to `/.well-known/nodeinfo`.  You would not typically call
+* this function directly, but instead use {@link Federation.handle} method.
+* @param request The request to handle.
+* @param context The request context.
+* @returns The response to the request.
+*/
+function handleNodeInfoJrd(_request, context) {
+	const links = [];
+	try {
+		links.push({
+			rel: "http://nodeinfo.diaspora.software/ns/schema/2.1",
+			href: context.getNodeInfoUri().href,
+			type: "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\""
+		});
+	} catch (e) {
+		if (!(e instanceof _fedify_uri_template.RouterError)) throw e;
 	}
-};
+	const response = new Response(JSON.stringify({ links }), { headers: { "Content-Type": "application/jrd+json" } });
+	return Promise.resolve(response);
+}
 //#endregion
 //#region src/federation/bench.ts
 /**
@@ -5124,431 +5548,128 @@ async function handleBenchmarkTrigger(request, context, options = {}) {
 	if (request.method !== "POST") return new Response("Method not allowed", {
 		status: 405,
 		headers: { "Allow": "POST" }
-	});
-	let json;
-	try {
-		json = await request.json();
-	} catch {
-		return jsonResponse({ error: "Invalid JSON request body." }, 400);
-	}
-	try {
-		const body = asRecord(json, "request body");
-		const sender = parseSender(body.sender);
-		const recipients = await parseRecipients(body.recipients, context);
-		const activity = await parseActivity(body.activity, context);
-		if (activity.id == null) throw new BenchmarkTriggerError("activity must have an id.");
-		const activityId = activity.id.href;
-		const inboxes = extractInboxes({ recipients });
-		const inboxUrls = Object.keys(inboxes);
-		if (inboxUrls.length < 1) throw new BenchmarkTriggerError("No valid recipient inboxes found. The recipients list must not be empty.");
-		const unsafeInboxes = options.allowUnsafeRecipients ? [] : inboxUrls.filter((inbox) => !options.sinks?.has(inbox));
-		if (unsafeInboxes.length > 0) return jsonResponse({
-			error: "unsafe_recipient",
-			unsafeInboxes
-		}, 403);
-		await context.sendActivity(sender, recipients, activity);
-		return jsonResponse({
-			version: 1,
-			activityId,
-			queueCorrelationId: activityId,
-			recipientCount: recipients.length,
-			inboxCount: inboxUrls.length
-		}, 202);
-	} catch (error) {
-		if (error instanceof BenchmarkTriggerError) return jsonResponse({ error: error.message }, error.status);
-		throw error;
-	}
-}
-var BenchmarkTriggerError = class extends Error {
-	status;
-	constructor(message, status = 400) {
-		super(message);
-		this.status = status;
-	}
-};
-function parseSender(value) {
-	const sender = asRecord(value, "sender");
-	if (typeof sender.identifier === "string") return { identifier: sender.identifier };
-	if (typeof sender.username === "string") return { username: sender.username };
-	throw new BenchmarkTriggerError("sender must be { identifier } or { username }.");
-}
-async function parseRecipients(value, context) {
-	if (!Array.isArray(value)) throw new BenchmarkTriggerError("recipients must be an array.");
-	return await Promise.all(value.map(async (item) => {
-		let object;
-		try {
-			object = await _fedify_vocab.Object.fromJsonLd(item, {
-				documentLoader: context.documentLoader,
-				contextLoader: context.contextLoader
-			});
-		} catch (error) {
-			throw new BenchmarkTriggerError(`Invalid ActivityPub recipient: ${error}`);
-		}
-		if (!isRecipient(object)) throw new BenchmarkTriggerError("each recipient must be an ActivityPub actor.");
-		const recipient = object;
-		if (recipient.id == null || recipient.inboxId == null) throw new BenchmarkTriggerError("each recipient must have id and inbox properties.");
-		return recipient;
-	}));
-}
-function isRecipient(value) {
-	return value != null && typeof value === "object" && "id" in value && "inboxId" in value;
-}
-async function parseActivity(value, context) {
-	try {
-		return await _fedify_vocab.Activity.fromJsonLd(value, {
-			documentLoader: context.documentLoader,
-			contextLoader: context.contextLoader
-		});
-	} catch (error) {
-		throw new BenchmarkTriggerError(`Invalid ActivityPub activity: ${error}`);
-	}
-}
-function asRecord(value, name) {
-	if (value == null || typeof value !== "object" || Array.isArray(value)) throw new BenchmarkTriggerError(`${name} must be an object.`);
-	return value;
-}
-function jsonResponse(body, status = 200) {
-	return new Response(JSON.stringify(body), {
-		status,
-		headers: { "Content-Type": "application/json" }
-	});
-}
-function serializeScopeMetrics(resourceMetrics) {
-	return resourceMetrics.scopeMetrics.map(serializeScope);
-}
-function serializeScope(scopeMetrics) {
-	return {
-		scope: {
-			name: scopeMetrics.scope.name,
-			version: scopeMetrics.scope.version
-		},
-		metrics: scopeMetrics.metrics.map(serializeMetric)
-	};
-}
-function serializeMetric(metric) {
-	return {
-		name: metric.descriptor.name,
-		description: metric.descriptor.description,
-		unit: metric.descriptor.unit,
-		dataPointType: serializeDataPointType(metric.dataPointType),
-		dataPoints: metric.dataPoints.map((point) => ({
-			attributes: { ...point.attributes },
-			startTime: point.startTime,
-			endTime: point.endTime,
-			value: point.value
-		}))
-	};
-}
-function serializeDataPointType(dataPointType) {
-	switch (dataPointType) {
-		case _opentelemetry_sdk_metrics.DataPointType.HISTOGRAM: return "histogram";
-		case _opentelemetry_sdk_metrics.DataPointType.EXPONENTIAL_HISTOGRAM: return "exponential_histogram";
-		case _opentelemetry_sdk_metrics.DataPointType.GAUGE: return "gauge";
-		case _opentelemetry_sdk_metrics.DataPointType.SUM: return "sum";
-	}
-}
-//#endregion
-//#region src/federation/portable-inbox.ts
-const Temporal$5 = require_http.Temporal;
-const MAX_TIMEOUT_MS = 2 ** 31 - 1;
-/**
-* Fills in the defaults of {@link PortableInboxForwardingOptions} and
-* validates them.
-* @param options The options.
-* @returns The resolved options.
-* @throws {RangeError} If `maxTargets` is not a non-negative integer, if `ttl`
-*                      is not positive, if `deadline` is negative or longer
-*                      than 2,147,483,647 milliseconds (about 24.8 days), or
-*                      if either duration has calendar units, i.e., weeks,
-*                      months, or years, whose length depends on the date.
-*/
-function resolvePortableInboxForwardingOptions(options = {}) {
-	const maxTargets = options.maxTargets ?? 10;
-	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
-	const ttl = Temporal$5.Duration.from(options.ttl ?? { days: 30 });
-	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
-	const deadline = Temporal$5.Duration.from(options.deadline ?? { seconds: 10 });
-	const deadlineMs = deadline.total("millisecond");
-	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
-	return {
-		maxTargets,
-		ttl,
-		deadline
-	};
-}
-/**
-* Decides whether this server accepts a delivery to a portable inbox on behalf
-* of the given actor, which the actor dispatcher returned for the identifier
-* in the requested inbox path.
-*
-* The actor document comes from the application, so it is trusted as is and
-* its proof is not verified here.
-* @param actor The actor the actor dispatcher returned.
-* @param options The requested DID, the canonical form of the requested inbox
-*                ID, and the origin of this server.
-* @returns The resolution.
-*/
-function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, localOrigin }) {
-	if (actor == null) return {
-		status: "rejected",
-		reason: "notFound"
-	};
-	const id = actor.id;
-	const did = id == null || !require_http.isPortableId(id) ? null : require_http.getPortableDid(id);
-	if (id == null || did == null) return {
-		status: "rejected",
-		reason: "notPortable"
-	};
-	if (did !== authority) return {
-		status: "rejected",
-		reason: "authorityMismatch"
-	};
-	const inboxId = actor.inboxId == null ? null : toPortableUri(actor.inboxId);
-	if (inboxId == null || require_http.getCanonicalPortableId(inboxId) !== canonicalInboxId) return {
-		status: "rejected",
-		reason: "inboxMismatch"
-	};
-	const gateways = actor.gateways;
-	if (!gateways.some((g) => (0, _fedify_vocab_runtime.isGatewayUrl)(g) && g.origin === localOrigin)) return {
-		status: "rejected",
-		reason: "notGateway"
-	};
-	return {
-		status: "accepted",
-		recipient: {
-			actorId: id,
-			inboxId,
-			canonicalInboxId,
-			gateways
-		}
-	};
-}
-/**
-* Gets the portable form of an `ap:` or `ap+ef61:` URI or a compatible
-* identifier, keeping its query.
-* @returns The portable URI, or `null` if the ID is neither, or is malformed.
-*/
-function toPortableUri(id) {
-	if (require_http.isPortableUri(id)) return id;
-	try {
-		return (0, _fedify_vocab_runtime.fromCompatibleEf61Id)(id);
-	} catch (error) {
-		if (error instanceof TypeError) return null;
-		throw error;
-	}
-}
-/**
-* Forwards an activity received in a portable inbox to the inboxes of the same
-* portable actor on its other gateways, as FEP-ef61 recommends.
-*
-* FEP-ef61 forbids forwarding an activity from an inbox more than once, so
-* each target gateway is claimed with an atomic compare-and-swap before the
-* activity is handed off, and a claim is never released, even if the hand-off
-* fails, since a failed hand-off does not prove that nothing was delivered.
-* Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
-* forwarded.
-*
-* Forwarded requests are signed with HTTP Signatures by the RSA key among
-* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
-* servers requiring HTTP Signatures accept them, and are sent unsigned
-* otherwise.  Either way, the receiving gateways authenticate the activity by
-* its own proof.
-* @param parameters The parameters.
-* @returns The target inbox URLs that the activity was handed off to.
-*/
-async function forwardPortableInboxActivity(parameters) {
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
-	const { maxTargets, ttl } = parameters.options ?? resolvePortableInboxForwardingOptions();
-	if (kv.cas == null || maxTargets < 1) return [];
-	const canonicalActivityId = require_http.getCanonicalPortableId(activityId) ?? activityId.href;
-	const targets = getForwardingTargets(recipient, excludedOrigins);
-	if (targets.length > maxTargets) {
-		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
-			inbox: recipient.canonicalInboxId,
-			activityId: activityId.href,
-			max: maxTargets
-		});
-		targets.length = maxTargets;
+	});
+	let json;
+	try {
+		json = await request.json();
+	} catch {
+		return jsonResponse({ error: "Invalid JSON request body." }, 400);
 	}
-	const claimed = [];
-	for (const { gateway, inbox } of targets) {
-		const key = [
-			...kvPrefix,
-			recipient.canonicalInboxId,
-			canonicalActivityId,
-			gateway
-		];
-		if (await kv.cas(key, void 0, true, { ttl })) claimed.push(inbox);
+	try {
+		const body = asRecord(json, "request body");
+		const sender = parseSender(body.sender);
+		const recipients = await parseRecipients(body.recipients, context);
+		const activity = await parseActivity(body.activity, context);
+		if (activity.id == null) throw new BenchmarkTriggerError("activity must have an id.");
+		const activityId = activity.id.href;
+		const inboxes = extractInboxes({ recipients });
+		const inboxUrls = Object.keys(inboxes);
+		if (inboxUrls.length < 1) throw new BenchmarkTriggerError("No valid recipient inboxes found. The recipients list must not be empty.");
+		const unsafeInboxes = options.allowUnsafeRecipients ? [] : inboxUrls.filter((inbox) => !options.sinks?.has(inbox));
+		if (unsafeInboxes.length > 0) return jsonResponse({
+			error: "unsafe_recipient",
+			unsafeInboxes
+		}, 403);
+		await context.sendActivity(sender, recipients, activity);
+		return jsonResponse({
+			version: 1,
+			activityId,
+			queueCorrelationId: activityId,
+			recipientCount: recipients.length,
+			inboxCount: inboxUrls.length
+		}, 202);
+	} catch (error) {
+		if (error instanceof BenchmarkTriggerError) return jsonResponse({ error: error.message }, error.status);
+		throw error;
 	}
-	if (claimed.length < 1) return [];
-	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
-		activityId: activityId.href,
-		inbox: recipient.canonicalInboxId,
-		targets: claimed.map((t) => t.href)
-	});
-	if (outboxQueue == null) await forwardImmediately(parameters, claimed);
-	else await enqueueForwarding(parameters, outboxQueue, claimed);
-	return claimed;
 }
-function getForwardingTargets(recipient, excludedOrigins) {
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const seen = new Set(excludedOrigins);
-	const targets = [];
-	for (const gateway of recipient.gateways) {
-		if (!(0, _fedify_vocab_runtime.isGatewayUrl)(gateway) || seen.has(gateway.origin)) continue;
-		seen.add(gateway.origin);
-		let inbox;
+var BenchmarkTriggerError = class extends Error {
+	status;
+	constructor(message, status = 400) {
+		super(message);
+		this.status = status;
+	}
+};
+function parseSender(value) {
+	const sender = asRecord(value, "sender");
+	if (typeof sender.identifier === "string") return { identifier: sender.identifier };
+	if (typeof sender.username === "string") return { username: sender.username };
+	throw new BenchmarkTriggerError("sender must be { identifier } or { username }.");
+}
+async function parseRecipients(value, context) {
+	if (!Array.isArray(value)) throw new BenchmarkTriggerError("recipients must be an array.");
+	return await Promise.all(value.map(async (item) => {
+		let object;
 		try {
-			inbox = (0, _fedify_vocab_runtime.toCompatibleEf61Id)(recipient.inboxId, gateway.origin);
-		} catch (error) {
-			if (!(error instanceof TypeError)) throw error;
-			logger.warn("Cannot forward to the gateway {gateway}, as the portable inbox {inbox} cannot be represented as its compatible identifier.", {
-				gateway: gateway.origin,
-				inbox: recipient.canonicalInboxId
+			object = await _fedify_vocab.Object.fromJsonLd(item, {
+				documentLoader: context.documentLoader,
+				contextLoader: context.contextLoader
 			});
-			continue;
+		} catch (error) {
+			throw new BenchmarkTriggerError(`Invalid ActivityPub recipient: ${error}`);
 		}
-		targets.push({
-			gateway: gateway.origin,
-			inbox
-		});
-	}
-	return targets;
+		if (!isRecipient(object)) throw new BenchmarkTriggerError("each recipient must be an ActivityPub actor.");
+		const recipient = object;
+		if (recipient.id == null || recipient.inboxId == null) throw new BenchmarkTriggerError("each recipient must have id and inbox properties.");
+		return recipient;
+	}));
 }
-/**
-* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
-* key, as {@link sendActivity} signs requests only with such a key.  Since
-* the targets have already been claimed, the activity is forwarded unsigned
-* rather than not at all if the key cannot be resolved or used.
-*/
-async function resolveForwardingKey({ getKeys, activityId }) {
-	if (getKeys == null) return null;
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	let key;
+function isRecipient(value) {
+	return value != null && typeof value === "object" && "id" in value && "inboxId" in value;
+}
+async function parseActivity(value, context) {
 	try {
-		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
-	} catch (error) {
-		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			activityId: activityId.href,
-			error
+		return await _fedify_vocab.Activity.fromJsonLd(value, {
+			documentLoader: context.documentLoader,
+			contextLoader: context.contextLoader
 		});
-		return null;
-	}
-	if (key == null) return null;
-	try {
-		require_http.validateCryptoKey(key.privateKey, "private");
 	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			keyId: key.keyId.href,
-			activityId: activityId.href,
-			error
-		});
-		return null;
+		throw new BenchmarkTriggerError(`Invalid ActivityPub activity: ${error}`);
 	}
-	return key;
 }
-async function forwardImmediately(parameters, inboxes) {
-	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, options, meterProvider, tracerProvider } = parameters;
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const deadline = (options ?? resolvePortableInboxForwardingOptions()).deadline.total("millisecond");
-	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
-		activity,
-		activityId: activityId.href,
-		activityType,
-		keys: key == null ? [] : [key],
-		inbox,
-		allowPrivateAddress,
-		specDeterminer,
-		meterProvider,
-		tracerProvider
-	}).catch((error) => {
-		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
-			activityId: activityId.href,
-			inbox: inbox.href,
-			error
-		});
-	}))));
-	let timer;
-	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
-		timer = setTimeout(() => resolve(true), deadline);
-	})]);
-	clearTimeout(timer);
-	if (timedOut) logger.warn("Forwarding activity {activityId} to other gateways did not finish in {deadline} ms; responding to the delivery without waiting for it.", {
-		activityId: activityId.href,
-		deadline
+function asRecord(value, name) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) throw new BenchmarkTriggerError(`${name} must be an object.`);
+	return value;
+}
+function jsonResponse(body, status = 200) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: { "Content-Type": "application/json" }
 	});
 }
-async function enqueueForwarding(parameters, outboxQueue, inboxes) {
-	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const key = await resolveForwardingKey(parameters);
-	const keys = [];
-	if (key != null) try {
-		keys.push({
-			keyId: key.keyId.href,
-			privateKey: await require_http.exportJwk(key.privateKey)
-		});
-	} catch (error) {
-		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			keyId: key.keyId.href,
-			activityId: activityId.href,
-			error
-		});
+function serializeScopeMetrics(resourceMetrics) {
+	return resourceMetrics.scopeMetrics.map(serializeScope);
+}
+function serializeScope(scopeMetrics) {
+	return {
+		scope: {
+			name: scopeMetrics.scope.name,
+			version: scopeMetrics.scope.version
+		},
+		metrics: scopeMetrics.metrics.map(serializeMetric)
+	};
+}
+function serializeMetric(metric) {
+	return {
+		name: metric.descriptor.name,
+		description: metric.descriptor.description,
+		unit: metric.descriptor.unit,
+		dataPointType: serializeDataPointType(metric.dataPointType),
+		dataPoints: metric.dataPoints.map((point) => ({
+			attributes: { ...point.attributes },
+			startTime: point.startTime,
+			endTime: point.endTime,
+			value: point.value
+		}))
+	};
+}
+function serializeDataPointType(dataPointType) {
+	switch (dataPointType) {
+		case _opentelemetry_sdk_metrics.DataPointType.HISTOGRAM: return "histogram";
+		case _opentelemetry_sdk_metrics.DataPointType.EXPONENTIAL_HISTOGRAM: return "exponential_histogram";
+		case _opentelemetry_sdk_metrics.DataPointType.GAUGE: return "gauge";
+		case _opentelemetry_sdk_metrics.DataPointType.SUM: return "sum";
 	}
-	startQueue?.();
-	const started = (/* @__PURE__ */ new Date()).toISOString();
-	const traceContext = {};
-	_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), traceContext);
-	await Promise.all(inboxes.map(async (inbox) => {
-		const message = {
-			type: "outbox",
-			id: crypto.randomUUID(),
-			baseUrl,
-			keys,
-			activity,
-			activityId: activityId.href,
-			activityType,
-			inbox: inbox.href,
-			sharedInbox: false,
-			started,
-			attempt: 0,
-			headers: {},
-			traceContext
-		};
-		try {
-			await outboxQueue.enqueue(message);
-		} catch (error) {
-			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
-				activityId: activityId.href,
-				inbox: inbox.href,
-				error
-			});
-			return;
-		}
-		require_http.recordOutboxEnqueue(meterProvider, outboxQueue, message);
-	}));
 }
 //#endregion
 //#region src/federation/outgoing-proof.ts
@@ -8228,7 +8349,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			onNotFound,
 			portableInbox: {
 				recipient,
-				forward: async (activity, activityId, activityType) => {
+				forward: async (activity, activityId, activityType, signatures) => {
 					if (this.portableInboxForwarding.maxTargets < 1) return;
 					if (this.kv.cas == null) {
 						if (!this.#portableInboxForwardingWarned) {
@@ -8251,6 +8372,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 						allowPrivateAddress: this.allowPrivateAddress,
 						getKeys: () => this.#getPortableGatewayKeyPairs(context, identifier, recipient),
 						specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
+						signatures,
 						options: this.portableInboxForwarding,
 						meterProvider: this.meterProvider,
 						tracerProvider: this.tracerProvider