@fedify/fedify 2.4.0-dev.2093 → 2.4.0-dev.2103

package/dist/{middleware-Blq0882d.js → middleware-B6IVTVL0.js}

@@ -2,10 +2,10 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { $ as recordFanoutRecipients, A as verifyCompactJsonLd, B as validateCryptoKey, C as detachSignature, D as isClearlyMalformedContextReference, E as hasSignatureLike, G as instrumentDocumentLoader, H as getDurationMs, J as recordCollectionDispatchDuration, K as isAbortError, N as wrapContextLoaderForJsonLd, O as isInvalidUrlTypeError, P as exportJwk, T as hasSignature, U as getFederationMetrics, W as getRemoteHost, X as recordCollectionRequest, Y as recordCollectionPageItems, Z as recordCollectionTotalItems, _ as normalizeOutgoingActivityJsonLd, a as verifyRequestDetailed, at as preloadedOnlyDocumentLoader, d as verifyMapLocalProof, dt as getGatewayKeyBase, et as recordInboxActivity, f as verifyObject, ft as getPortableDid, gt as isPortableUri, h as verifyPortableObjectProofWithRoot, ht as isPortableId, i as verifyRequest, it as registerQueueDepthGauge, k as signJsonLd, l as hasProofLike, m as verifyPortableObjectProofPolicy, mt as isCompatibleKeyId, n as parseRfc9421SignatureInput, nt as recordOutboxEnqueue, ot as formatAcceptSignature, p as verifyPortableObjectProof, pt as hasPortableActor, q as recordCircuitBreakerStateChange, rt as recordWebFingerHandle, s as InvalidPortableObjectIdError, t as doubleKnock, tt as recordOutboxActivity, u as signObject, ut as getCanonicalPortableId, v as InvalidContextReferenceError, vt as name, w as getNormalizationContextLoader, x as compactJsonLd, y as assertSafeJsonLd, yt as version, z as importJwk } from "./http-DyT7DP1Y.js";
+import { $ as recordCollectionTotalItems, A as isInvalidUrlTypeError, C as compactJsonLd, D as hasSignature, E as getNormalizationContextLoader, F as wrapContextLoaderForJsonLd, G as getFederationMetrics, H as validateCryptoKey, I as exportJwk, J as isAbortError, K as getRemoteHost, M as verifyCompactJsonLd, O as hasSignatureLike, Q as recordCollectionRequest, T as detachSignature, V as importJwk, W as getDurationMs, X as recordCollectionDispatchDuration, Y as recordCircuitBreakerStateChange, Z as recordCollectionPageItems, _ as verifyPortableObjectProofWithRoot, _t as isPortableId, at as recordWebFingerHandle, b as InvalidContextReferenceError, bt as name, ct as formatAcceptSignature, d as hasProofLike, f as signObject, ft as getCanonicalPortableId, g as verifyPortableObjectProofPolicy, gt as isCompatibleKeyId, h as verifyPortableObjectProof, ht as hasPortableActor, i as selectRequestSignature, it as recordOutboxEnqueue, j as signJsonLd, k as isClearlyMalformedContextReference, l as InvalidPortableObjectIdError, m as verifyObject, mt as getPortableDid, n as listRequestSignatures, nt as recordInboxActivity, o as verifyRequest, ot as registerQueueDepthGauge, p as verifyMapLocalProof, pt as getGatewayKeyBase, q as instrumentDocumentLoader, r as parseRfc9421SignatureInput, rt as recordOutboxActivity, s as verifyRequestDetailed, st as preloadedOnlyDocumentLoader, t as doubleKnock, tt as recordFanoutRecipients, vt as isPortableUri, x as assertSafeJsonLd, xt as version, y as normalizeOutgoingActivityJsonLd } from "./http-tTlTeFa0.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-DAGSC5gX.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DmroAz3M.js";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-j5yrbXS1.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-CxQu_cd4.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -2408,6 +2408,8 @@ function acceptsJsonLd(request) {
 const PORTABLE_OBJECT_CONTENT_TYPE = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"";
 const GATEWAY_OBJECT_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
 const BARE_DID_PATTERN = /^did:[a-z0-9]+:[^/?#]+$/i;
+const DID_KEY_PREFIX = "did:key:";
+const BASE58BTC_MULTIBASE_PATTERN = /^z[1-9A-HJ-NP-Za-km-z]+$/;
 const GATEWAY_PATH_PREFIX = "/.well-known/apgateway/";
 const HASHLINK_SCHEME_PATTERN = /^hl(?::|%3A)/i;
 /**
@@ -2443,6 +2445,15 @@ function parsePortableGatewayRequest(url) {
 		throw error;
 	}
 	const authority = getFe34Origin(id);
+	try {
+		assertBase58BtcDidKey(authority);
+	} catch (error) {
+		if (error instanceof TypeError) return {
+			type: "malformed",
+			error
+		};
+		throw error;
+	}
 	const href = id.href;
 	return {
 		type: "object",
@@ -2461,12 +2472,26 @@ function parsePortableGatewayRequest(url) {
 * @param authority The bare DID, e.g., `did:key:z6Mk...`.
 * @param path The object path, e.g., `/notes/123`.
 * @returns The portable ID.
-* @throws {TypeError} If the authority is not a bare DID.
+* @throws {TypeError} If the authority is not a bare DID, or it is
+*                     a `did:key` DID that is not encoded in base58-btc.
 */
 function buildPortableUri(authority, path) {
 	if (typeof authority !== "string" || !BARE_DID_PATTERN.test(authority)) throw new TypeError("The authority of a portable ID must be a DID without a path, query, or fragment.");
-	getFe34Origin(authority);
-	return parseIri(`ap+ef61://${authority}${path}`);
+	const did = getFe34Origin(authority);
+	assertBase58BtcDidKey(did);
+	return parseIri(`ap+ef61://${did}${path}`);
+}
+/**
+* Checks that a normalized DID, if it is a `did:key` DID, is encoded in
+* base58-btc, as FEP-ef61 requires so that the same key does not yield two
+* portable IDs.  This only checks the encoding, not whether the DID is
+* a valid key.
+* @param did The DID normalized by `getFe34Origin()`.
+* @throws {TypeError} If the DID is a `did:key` DID that is not encoded in
+*                     base58-btc.
+*/
+function assertBase58BtcDidKey(did) {
+	if (did.startsWith(DID_KEY_PREFIX) && !BASE58BTC_MULTIBASE_PATTERN.test(did.slice(8))) throw new TypeError("The did:key authority of a portable ID must be encoded in base58-btc, i.e., start with z.");
 }
 /**
 * Recognizes an FEP-ef61 gateway request for a resource addressed by
@@ -2518,317 +2543,1017 @@ function parseHashlinkGatewayRequest(url) {
 	};
 }
 //#endregion
-//#region src/federation/temporal.ts
-function isPlainObject$1(value) {
-	return typeof value === "object" && value != null && !Array.isArray(value);
-}
-function normalizeDateTimeLiteral(value) {
-	return value.substring(19).match(/[Z+-]/) ? value : value + "Z";
-}
-function isMalformedDateTimeLiteral(value) {
-	if (typeof value !== "string") return false;
-	try {
-		Temporal.Instant.from(normalizeDateTimeLiteral(value));
-		return false;
-	} catch {
-		return true;
-	}
-}
-function isMalformedDurationLiteral(value) {
-	if (typeof value !== "string") return false;
-	try {
-		Temporal.Duration.from(value);
-		return false;
-	} catch {
-		return true;
+//#region src/federation/send.ts
+/**
+* Extracts the inbox URLs from recipients.
+* @param parameters The parameters to extract the inboxes.
+*                   See also {@link ExtractInboxesParameters}.
+* @returns The inboxes as a map of inbox URL to actor URIs.
+*/
+function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
+	const inboxes = {};
+	for (const recipient of recipients) {
+		let inbox;
+		let sharedInbox = false;
+		if (preferSharedInbox && recipient.endpoints?.sharedInbox != null) {
+			inbox = recipient.endpoints.sharedInbox;
+			sharedInbox = true;
+		} else inbox = recipient.inboxId;
+		if (inbox != null && recipient.id != null) {
+			if (excludeBaseUris != null && excludeBaseUris.some((u) => u.origin === inbox?.origin)) continue;
+			inboxes[inbox.href] ??= {
+				actorIds: /* @__PURE__ */ new Set(),
+				sharedInbox
+			};
+			inboxes[inbox.href].actorIds.add(recipient.id.href);
+		}
 	}
+	return inboxes;
 }
-const TEMPORAL_DATE_TIME_IRIS = /* @__PURE__ */ new Set([
-	"https://www.w3.org/ns/activitystreams#deleted",
-	"https://www.w3.org/ns/activitystreams#endTime",
-	"https://www.w3.org/ns/activitystreams#published",
-	"https://www.w3.org/ns/activitystreams#startTime",
-	"https://www.w3.org/ns/activitystreams#updated",
-	"http://purl.org/dc/terms/created",
-	"https://w3id.org/security#created"
-]);
-const TEMPORAL_DURATION_IRIS = /* @__PURE__ */ new Set(["https://www.w3.org/ns/activitystreams#duration"]);
-const QUESTION_CLOSED_IRI = "https://www.w3.org/ns/activitystreams#closed";
-const XSD_DATE_TIME_IRI = "http://www.w3.org/2001/XMLSchema#dateTime";
-function hasMalformedExpandedDateTimeLiteral(value) {
-	if (Array.isArray(value)) return value.some(hasMalformedExpandedDateTimeLiteral);
-	return isPlainObject$1(value) && "@value" in value && isMalformedDateTimeLiteral(value["@value"]);
-}
-function hasMalformedExpandedQuestionClosedLiteral(value) {
-	if (Array.isArray(value)) return value.some(hasMalformedExpandedQuestionClosedLiteral);
-	if (!isPlainObject$1(value) || !("@value" in value)) return false;
-	const literal = value["@value"];
-	if (typeof literal === "boolean") return false;
-	if (typeof literal !== "string") return false;
-	if (value["@type"] !== XSD_DATE_TIME_IRI) return false;
-	if (new Date(literal).toString() === "Invalid Date") return false;
-	return isMalformedDateTimeLiteral(literal);
+/**
+* Sends an {@link Activity} to an inbox.
+*
+* @param parameters The parameters for sending the activity.
+*                   See also {@link SendActivityParameters}.
+* @throws {Error} If the activity fails to send.
+*/
+function sendActivity(options) {
+	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
+	return tracerProvider.getTracer(name, version).startActiveSpan("activitypub.send_activity", {
+		kind: SpanKind.CLIENT,
+		attributes: { "activitypub.shared_inbox": options.sharedInbox ?? false }
+	}, async (span) => {
+		if (options.activityId != null) span.setAttribute("activitypub.activity.id", options.activityId);
+		if (options.activityType != null) span.setAttribute("activitypub.activity.type", options.activityType);
+		try {
+			await sendActivityInternal({
+				...options,
+				tracerProvider
+			}, span);
+		} catch (e) {
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(e)
+			});
+			throw e;
+		} finally {
+			span.end();
+		}
+	});
 }
-function hasMalformedExpandedDurationLiteral(value) {
-	if (Array.isArray(value)) return value.some(hasMalformedExpandedDurationLiteral);
-	return isPlainObject$1(value) && "@value" in value && isMalformedDurationLiteral(value["@value"]);
+const MAX_ERROR_RESPONSE_BODY_BYTES = 1024;
+function getActivityActorId(activity) {
+	if (!isRecord(activity)) return void 0;
+	return getIdValue(activity.actor);
 }
-function hasMalformedKnownTemporalLiteralInternal(value, visited) {
-	if (Array.isArray(value)) return value.some((item) => hasMalformedKnownTemporalLiteralInternal(item, visited));
-	if (!isPlainObject$1(value)) return false;
-	if (visited.has(value)) return false;
-	visited.add(value);
-	if ("@value" in value) return false;
-	for (const [key, child] of Object.entries(value)) {
-		if (TEMPORAL_DATE_TIME_IRIS.has(key)) {
-			if (hasMalformedExpandedDateTimeLiteral(child)) return true;
-			continue;
-		}
-		if (key === QUESTION_CLOSED_IRI) {
-			if (hasMalformedExpandedQuestionClosedLiteral(child)) return true;
-			continue;
-		}
-		if (TEMPORAL_DURATION_IRIS.has(key)) {
-			if (hasMalformedExpandedDurationLiteral(child)) return true;
-			continue;
+function getIdValue(value) {
+	if (typeof value === "string" && value !== "") return value;
+	if (value instanceof URL) return value.href;
+	if (Array.isArray(value)) {
+		for (const item of value) {
+			const id = getIdValue(item);
+			if (id != null) return id;
 		}
-		if (hasMalformedKnownTemporalLiteralInternal(child, visited)) return true;
+		return;
 	}
-	return false;
+	if (isRecord(value)) return getIdValue(value.id);
 }
-async function hasMalformedKnownTemporalLiteral(value, contextLoader) {
+function isRecord(value) {
+	return typeof value === "object" && value != null;
+}
+async function readLimitedResponseBody(response, maxBytes) {
+	if (response.body == null) return "";
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	const chunks = [];
+	let totalBytes = 0;
+	let truncated = false;
 	try {
-		return hasMalformedKnownTemporalLiteralInternal(await jsonld.expand(value, {
-			documentLoader: getNormalizationContextLoader(contextLoader),
-			keepFreeFloatingNodes: true
-		}), /* @__PURE__ */ new Set());
-	} catch {
-		return false;
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (totalBytes + value.length > maxBytes) {
+				const remaining = maxBytes - totalBytes;
+				if (remaining > 0) chunks.push(decoder.decode(value.slice(0, remaining), { stream: true }));
+				truncated = true;
+				break;
+			}
+			chunks.push(decoder.decode(value, { stream: true }));
+			totalBytes += value.length;
+		}
+	} finally {
+		reader.releaseLock();
 	}
+	let result = chunks.join("");
+	if (truncated) result += "… (truncated)";
+	return result;
 }
-//#endregion
-//#region src/federation/handler.ts
-const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
-const INBOX_COMPOUND_PROOF_LIMITS = {
-	maxDepth: 64,
-	maxMaps: 1e4,
-	maxProofs: 32,
-	maxBytes: 10 * 1024 * 1024
-};
-function isRemoteContextLoadingFailure$1(error) {
-	return error instanceof Error && typeof error.details === "object" && error.details != null && error.details.code === "loading remote context failed";
-}
-function isPermanentRemoteContextError$1(error) {
-	if (!(error instanceof Error) || error.name !== "jsonld.InvalidUrl") return false;
-	const details = error.details;
-	if (details?.code === "invalid remote context") return true;
-	return isRemoteContextLoadingFailure$1(error) && typeof details?.url === "string" && !URL.canParse(details.url) && isClearlyMalformedContextReference(details.url);
-}
-function isInvalidJsonLdError(error) {
-	if (!(error instanceof Error)) return false;
-	const name = error.name;
-	return name === "UnsafeJsonLdError" || error instanceof InvalidContextReferenceError || isPermanentRemoteContextError$1(error) || name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure$1(error);
-}
-function isValidationTypeError(error) {
-	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || isInvalidUrlTypeError(error));
-}
-function isPermanentActivityParseError(error) {
-	return isInvalidJsonLdError(error) || isValidationTypeError(error);
-}
-function hasHttpSignatureHeaders(request) {
-	return request.headers.has("Signature") || request.headers.has("Signature-Input");
-}
-function hasObjectIntegrityProof(json) {
-	return typeof json === "object" && json != null && "proof" in json;
-}
-/**
-* Handles an actor request.
-* @template TContextData The context data to pass to the context.
-* @param request The HTTP request.
-* @param parameters The parameters for handling the actor.
-* @returns A promise that resolves to an HTTP response.
-*/
-async function handleActor(request, { identifier, context, actorDispatcher, authorizePredicate, onNotFound, onUnauthorized }) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
-		"actor"
+		"outbox"
 	]);
-	if (actorDispatcher == null) {
-		logger.debug("Actor dispatcher is not set.", { identifier });
-		return await onNotFound(request);
-	}
-	const actor = await actorDispatcher(context, identifier);
-	if (actor == null) {
-		logger.debug("Actor {identifier} not found.", { identifier });
-		return await onNotFound(request);
-	}
-	if (authorizePredicate != null) {
-		if (!await authorizePredicate(context, identifier)) return await onUnauthorized(request);
+	const federationMetrics = getFederationMetrics(meterProvider);
+	const started = performance.now();
+	let deliverySuccess = false;
+	async function validateUrl(url) {
+		if (!allowPrivateAddress) try {
+			await validatePublicUrl(url);
+		} catch (error) {
+			if (error instanceof UrlError) logger.error("Disallowed private URL: {url}", {
+				url,
+				error
+			});
+			throw error;
+		}
 	}
-	if (actor instanceof Tombstone) {
-		const jsonLd = await actor.toJsonLd(context);
-		return new Response(JSON.stringify(jsonLd), {
-			status: 410,
-			headers: {
-				"Content-Type": "application/activity+json",
-				Vary: "Accept"
-			}
-		});
-	}
-	const jsonLd = await actor.toJsonLd(context);
-	return new Response(JSON.stringify(jsonLd), { headers: {
-		"Content-Type": "application/activity+json",
-		Vary: "Accept"
-	} });
-}
-/**
-* Handles an object request.
-* @template TContextData The context data to pass to the context.
-* @param request The HTTP request.
-* @param parameters The parameters for handling the object.
-* @returns A promise that resolves to an HTTP response.
-*/
-async function handleObject(request, { values, context, objectDispatcher, authorizePredicate, onNotFound, onUnauthorized }) {
-	if (objectDispatcher == null) return await onNotFound(request);
-	const object = await objectDispatcher(context, values);
-	if (object == null) return await onNotFound(request);
-	if (authorizePredicate != null) {
-		if (!await authorizePredicate(context, values)) return await onUnauthorized(request);
-	}
-	const jsonLd = await object.toJsonLd(context);
-	return new Response(JSON.stringify(jsonLd), { headers: {
-		"Content-Type": "application/activity+json",
-		Vary: "Accept"
-	} });
-}
-/**
-* Handles an FEP-ef61 gateway request for a portable object through an object
-* dispatcher.  The object is served only if its ID canonically matches the
-* requested portable ID and it satisfies the FEP-ef61 proof policy.
-* @template TContextData The context data to pass to the context.
-* @param request The HTTP request.
-* @param parameters The parameters for handling the portable object.
-* @returns A promise that resolves to an HTTP response.
-*/
-async function handlePortableObject(request, { values, context, objectDispatcher, authorizePredicate, canonicalId, onNotFound, onUnauthorized }) {
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"object"
-	]);
-	if (objectDispatcher == null) return await onNotFound(request);
-	const object = await objectDispatcher(context, values);
-	if (object == null) return await onNotFound(request);
-	if (!isRequestedPortableObject(object, canonicalId)) {
-		logger.debug("The object {objectId} does not match the requested portable object {portableId}.", {
-			objectId: object.id?.href,
-			portableId: canonicalId
-		});
-		return await onNotFound(request);
-	}
-	if (authorizePredicate != null) {
-		if (!await authorizePredicate(context, values)) return await onUnauthorized(request);
+	await validateUrl(inbox.href);
+	headers = new Headers(headers);
+	headers.set("Content-Type", "application/activity+json");
+	const request = new Request(inbox, {
+		method: "POST",
+		headers,
+		body: JSON.stringify(activity),
+		redirect: "manual"
+	});
+	let rsaKey = null;
+	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
+		rsaKey = key;
+		break;
 	}
-	let jsonLd;
-	let servedId;
-	let result;
+	if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
+		activityId,
+		inbox: inbox.href
+	});
+	else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
+		inbox: inbox.href,
+		keys: keys.map((pair) => ({
+			keyId: pair.keyId.href,
+			privateKey: pair.privateKey
+		}))
+	});
+	let response;
 	try {
-		jsonLd = await object.toJsonLd(context);
-		servedId = await getJsonLdRootId(jsonLd, context.contextLoader);
-		result = await verifyPortableObjectProof(jsonLd, {
-			contextLoader: context.contextLoader,
-			documentLoader: context.documentLoader,
-			tracerProvider: context.tracerProvider,
-			meterProvider: context.meterProvider
+		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await doubleKnock(request, rsaKey, {
+			tracerProvider,
+			specDeterminer,
+			validateRedirect: validateUrl
 		});
 	} catch (error) {
-		logger.error("Failed to verify the Object Integrity Proofs of the portable object {portableId}:\n{error}", {
-			portableId: canonicalId,
-			error
-		});
-		return portableObjectInternalServerError(request);
-	}
-	if (servedId == null || !isRequestedPortableId(servedId, canonicalId)) {
-		logger.debug("The serialized object does not match the requested portable object {portableId}.", { portableId: canonicalId });
-		return await onNotFound(request);
-	}
-	if (!result.verified && result.reason.type !== "unsecuredCollection" && result.reason.type !== "unsupportedObjectType") {
-		logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, and objects need an Object Integrity Proof made with a key of the DID in their ID.", {
-			portableId: canonicalId,
-			reason: result.reason.type
+		const failure = error instanceof FetchError || error instanceof UrlError ? error : createFetchError(inbox.href, error);
+		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
+			activityId,
+			inbox: inbox.href,
+			error: failure
 		});
-		return portableObjectInternalServerError(request);
+		federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
+		throw failure;
 	}
-	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), { headers: {
-		"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
-		Vary: "Accept"
-	} });
-}
-function isRequestedPortableObject(object, canonicalId) {
-	return object.id != null && getCanonicalPortableId(object.id) === canonicalId;
-}
-async function getJsonLdRootId(jsonLd, contextLoader) {
-	const expanded = await jsonld.expand(jsonLd, {
-		documentLoader: getNormalizationContextLoader(contextLoader),
-		keepFreeFloatingNodes: true
-	});
-	if (expanded.length !== 1) return null;
-	const id = expanded[0]["@id"];
-	return typeof id === "string" ? id : null;
-}
-function isRequestedPortableId(id, canonicalId) {
-	if (!/^ap(?:\+ef61)?:\/\//i.test(id)) return URL.canParse(id) && getCanonicalPortableId(new URL(id)) === canonicalId;
 	try {
-		return canonicalizePortableUri(id) === canonicalId;
-	} catch (error) {
-		if (error instanceof TypeError) return false;
-		throw error;
+		if (!response.ok) {
+			let error;
+			try {
+				error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
+			} catch (_) {
+				error = "";
+			}
+			logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
+				activityId,
+				inbox: inbox.href,
+				status: response.status,
+				statusText: response.statusText,
+				error
+			});
+			throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error, response.headers);
+		}
+		deliverySuccess = true;
+		const eventAttributes = {
+			"activitypub.inbox.url": inbox.href,
+			"activitypub.activity.id": activityId ?? ""
+		};
+		if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
+		const actorId = getActivityActorId(activity);
+		if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
+		span.addEvent("activitypub.activity.sent", eventAttributes);
+	} finally {
+		federationMetrics.recordDelivery(inbox, getDurationMs(started), deliverySuccess, activityType);
 	}
 }
-function portableObjectInternalServerError(request) {
-	return new Response(request.method === "HEAD" ? null : "Internal server error.", {
-		status: 500,
-		headers: { "Content-Type": "text/plain; charset=utf-8" }
-	});
-}
-const BUILT_IN_COLLECTION_METRIC_KINDS = /* @__PURE__ */ new Set([
-	"inbox",
-	"outbox",
-	"following",
-	"followers",
-	"liked",
-	"featured",
-	"featured_tags"
-]);
-function getCollectionMetricKind(name) {
-	const normalized = name.trim().replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/\s+/g, "_");
-	return BUILT_IN_COLLECTION_METRIC_KINDS.has(normalized) ? normalized : "custom";
-}
-function collectionAttributes(base, result, response) {
-	return {
-		...base,
-		result,
-		...response == null ? {} : { statusCode: response.status }
-	};
+function createFetchError(url, cause) {
+	const error = new FetchError(url, cause instanceof Error ? cause.message : String(cause));
+	error.cause = cause;
+	return error;
 }
-function recordCollectionMetrics(meterProvider, base, result, options = {}) {
-	const attrs = collectionAttributes(base, result, options.response);
-	recordCollectionRequest(meterProvider, attrs);
-	if (options.dispatchDurationMs != null) recordCollectionDispatchDuration(meterProvider, options.dispatchDurationMs, attrs);
-	if (options.itemCount != null) recordCollectionPageItems(meterProvider, options.itemCount, attrs);
-	if (options.totalItems != null) recordCollectionTotalItems(meterProvider, options.totalItems, attrs);
+async function fetchWithValidatedRedirects(request, validateUrl) {
+	let body = await request.clone().text();
+	for (let redirects = 0;; redirects++) {
+		const response = await fetch(request, { redirect: "manual" });
+		const location = response.headers.get("Location");
+		if (![
+			301,
+			302,
+			303,
+			307,
+			308
+		].includes(response.status) || location == null) return response;
+		await response.body?.cancel();
+		if (redirects >= 20) throw new TypeError("Too many redirects");
+		const url = new URL(location, request.url);
+		await validateUrl(url.href);
+		const headers = new Headers(request.headers);
+		if (url.origin !== new URL(request.url).origin) {
+			headers.delete("Authorization");
+			headers.delete("Proxy-Authorization");
+			headers.delete("Cookie");
+			headers.delete("Host");
+		}
+		let method = request.method;
+		if ((response.status === 301 || response.status === 302) && method === "POST" || response.status === 303 && method !== "GET" && method !== "HEAD") {
+			method = "GET";
+			body = void 0;
+			for (const name of [
+				"Content-Encoding",
+				"Content-Language",
+				"Content-Length",
+				"Content-Location",
+				"Content-Type"
+			]) headers.delete(name);
+		}
+		request = new Request(url, {
+			method,
+			headers,
+			body,
+			redirect: "manual"
+		});
+	}
 }
 /**
-* Handles a collection request.
-* @template TItem The type of items in the collection.
-* @template TContext The type of the context, extending {@link RequestContext}.
-* @template TContextData The context data to pass to the `TContext`.
-* @template TFilter The type of the filter.
-* @param request The HTTP request.
-* @param parameters The parameters for handling the collection.
-* @returns A promise that resolves to an HTTP response.
-*/
+* An error that is thrown when an activity fails to send to a remote inbox.
+* It contains structured information about the failure, including the HTTP
+* status code, the inbox URL, and the response body.
+* @since 2.0.0
+*/
+var SendActivityError = class extends Error {
+	/**
+	* The inbox URL that the activity was being sent to.
+	*/
+	inbox;
+	/**
+	* The HTTP status code returned by the inbox.
+	*/
+	statusCode;
+	/**
+	* The response body from the inbox, if any.  Note that this may be
+	* truncated to a maximum of 1 KiB to prevent excessive memory consumption
+	* when remote servers return large error pages (e.g., Cloudflare error pages).
+	* If truncated, the string will end with `"… (truncated)"`.
+	*/
+	responseBody;
+	/**
+	* The response headers from the inbox.
+	* @since 2.3.0
+	*/
+	responseHeaders;
+	/**
+	* Creates a new {@link SendActivityError}.
+	* @param inbox The inbox URL.
+	* @param statusCode The HTTP status code.
+	* @param message The error message.
+	* @param responseBody The response body.
+	* @param responseHeaders The response headers.
+	*/
+	constructor(inbox, statusCode, message, responseBody, responseHeaders) {
+		super(message);
+		this.name = "SendActivityError";
+		this.inbox = inbox;
+		this.statusCode = statusCode;
+		this.responseBody = responseBody;
+		this.responseHeaders = new Headers(responseHeaders);
+	}
+};
+//#endregion
+//#region src/federation/portable-inbox.ts
+const MAX_TIMEOUT_MS = 2 ** 31 - 1;
+/**
+* Fills in the defaults of {@link PortableInboxForwardingOptions} and
+* validates them.
+* @param options The options.
+* @returns The resolved options.
+* @throws {RangeError} If `maxTargets` is not a non-negative integer, if `ttl`
+*                      is not positive, if `deadline` is negative or longer
+*                      than 2,147,483,647 milliseconds (about 24.8 days), or
+*                      if either duration has calendar units, i.e., weeks,
+*                      months, or years, whose length depends on the date.
+*/
+function resolvePortableInboxForwardingOptions(options = {}) {
+	const maxTargets = options.maxTargets ?? 10;
+	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
+	const ttl = Temporal.Duration.from(options.ttl ?? { days: 30 });
+	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
+	const deadline = Temporal.Duration.from(options.deadline ?? { seconds: 10 });
+	const deadlineMs = deadline.total("millisecond");
+	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
+	return {
+		maxTargets,
+		ttl,
+		deadline
+	};
+}
+/**
+* Decides whether this server accepts a delivery to a portable inbox on behalf
+* of the given actor, which the actor dispatcher returned for the identifier
+* in the requested inbox path.
+*
+* The actor document comes from the application, so it is trusted as is and
+* its proof is not verified here.
+* @param actor The actor the actor dispatcher returned.
+* @param options The requested DID, the canonical form of the requested inbox
+*                ID, and the origin of this server.
+* @returns The resolution.
+*/
+function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, localOrigin }) {
+	if (actor == null) return {
+		status: "rejected",
+		reason: "notFound"
+	};
+	const id = actor.id;
+	const did = id == null || !isPortableId(id) ? null : getPortableDid(id);
+	if (id == null || did == null) return {
+		status: "rejected",
+		reason: "notPortable"
+	};
+	if (did !== authority) return {
+		status: "rejected",
+		reason: "authorityMismatch"
+	};
+	const inboxId = actor.inboxId == null ? null : toPortableUri(actor.inboxId);
+	if (inboxId == null || getCanonicalPortableId(inboxId) !== canonicalInboxId) return {
+		status: "rejected",
+		reason: "inboxMismatch"
+	};
+	const gateways = actor.gateways;
+	if (!gateways.some((g) => isGatewayUrl(g) && g.origin === localOrigin)) return {
+		status: "rejected",
+		reason: "notGateway"
+	};
+	return {
+		status: "accepted",
+		recipient: {
+			actorId: id,
+			inboxId,
+			canonicalInboxId,
+			gateways
+		}
+	};
+}
+/**
+* Gets the portable form of an `ap:` or `ap+ef61:` URI or a compatible
+* identifier, keeping its query.
+* @returns The portable URI, or `null` if the ID is neither, or is malformed.
+*/
+function toPortableUri(id) {
+	if (isPortableUri(id)) return id;
+	try {
+		return fromCompatibleEf61Id(id);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+const RFC9421_DELIVERY_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"content-digest"
+];
+const DRAFT_DELIVERY_COMPONENTS = [
+	"(request-target)",
+	"host",
+	"digest"
+];
+/**
+* Checks whether an HTTP Signature covers the method, the target URI, and the
+* body of a request, which both Fedify and Mitra sign when forwarding.
+* @param signature The signature.
+* @returns `true` if the signature covers them.
+*/
+function coversDelivery(signature) {
+	return (signature.label == null ? DRAFT_DELIVERY_COMPONENTS : RFC9421_DELIVERY_COMPONENTS).every((name) => signature.components.some((c) => c.value === name && Object.keys(c.params).length < 1));
+}
+/**
+* Forwards an activity received in a portable inbox to the inboxes of the same
+* portable actor on its other gateways, as FEP-ef61 recommends.
+*
+* FEP-ef61 forbids forwarding an activity from an inbox more than once, so
+* each target gateway is claimed with an atomic compare-and-swap before the
+* activity is handed off, and a claim is never released, even if the hand-off
+* fails, since a failed hand-off does not prove that nothing was delivered.
+* Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
+* forwarded.
+*
+* Forwarded requests are signed with HTTP Signatures by the RSA key among
+* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
+* servers requiring HTTP Signatures accept them, and are sent unsigned
+* otherwise.  Either way, the receiving gateways authenticate the activity by
+* its own proof.
+*
+* If the delivery is signed with a gateway key of the recipient by one of its
+* other gateways, that gateway has the activity already, so it is claimed
+* without forwarding the activity to it.  See {@link identifySendingGateway}.
+* @param parameters The parameters.
+* @returns The target inbox URLs that the activity was handed off to.
+*/
+async function forwardPortableInboxActivity(parameters) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
+	const options = parameters.options ?? resolvePortableInboxForwardingOptions();
+	const { maxTargets, ttl } = options;
+	if (kv.cas == null || maxTargets < 1) return [];
+	const deadline = Date.now() + options.deadline.total("millisecond");
+	const canonicalActivityId = getCanonicalPortableId(activityId) ?? activityId.href;
+	const claimKey = (gateway) => [
+		...kvPrefix,
+		recipient.canonicalInboxId,
+		canonicalActivityId,
+		gateway
+	];
+	let targets = getForwardingTargets(recipient, excludedOrigins);
+	const sender = await identifySendingGateway(parameters, targets.map((t) => t.gateway), claimKey, deadline);
+	if (sender != null) {
+		logger.debug("Not forwarding activity {activityId} from the portable inbox {inbox} back to the gateway {gateway}, which delivered it.", {
+			activityId: activityId.href,
+			inbox: recipient.canonicalInboxId,
+			gateway: sender
+		});
+		await kv.cas(claimKey(sender), void 0, true, { ttl });
+		targets = targets.filter((t) => t.gateway !== sender);
+	}
+	if (targets.length > maxTargets) {
+		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
+			inbox: recipient.canonicalInboxId,
+			activityId: activityId.href,
+			max: maxTargets
+		});
+		targets.length = maxTargets;
+	}
+	const claimed = [];
+	for (const { gateway, inbox } of targets) if (await kv.cas(claimKey(gateway), void 0, true, { ttl })) claimed.push(inbox);
+	if (claimed.length < 1) return [];
+	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		targets: claimed.map((t) => t.href)
+	});
+	if (outboxQueue == null) await forwardImmediately(parameters, claimed, deadline);
+	else await enqueueForwarding(parameters, outboxQueue, claimed);
+	return claimed;
+}
+/**
+* Identifies the gateway of the recipient that forwarded a delivery to its
+* portable inbox, by the delivery's HTTP Signature made with the recipient's
+* gateway key, which FEP-ef61 has each gateway use for requests on behalf of
+* an actor.  Since the activity is authenticated by its own proof, the
+* signature only tells which gateway to skip, and a delivery whose signature
+* is invalid or cannot be verified is still forwarded to every gateway.
+*
+* Verifying the signature fetches the recipient's actor document from the
+* sending gateway, as gateway keys are not cached, so only the first signature
+* that may save a request is verified: one that covers the delivery and names
+* a gateway key of the recipient on one of the forwarding targets that the
+* activity has not been forwarded to yet.
+* @param parameters The forwarding parameters.
+* @param targets The origins of the gateways to forward to.
+* @param claimKey Gets the key of the claim for a gateway.
+* @param deadline The time by which identification has to finish, in
+*                 milliseconds since the epoch; afterwards, the sending
+*                 gateway is left unidentified.
+* @returns The origin of the sending gateway, or `null` if it is not
+*          identified.
+*/
+async function identifySendingGateway({ recipient, activityId, kv, signatures }, targets, claimKey, deadline) {
+	if (signatures == null || signatures.length < 1) return null;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const actorId = getCanonicalPortableId(recipient.actorId);
+	if (actorId == null) return null;
+	const isGatewayKeyOfRecipient = (keyId) => {
+		if (!isCompatibleKeyId(keyId) || !targets.includes(keyId.origin)) return false;
+		const base = new URL(keyId.href);
+		base.hash = "";
+		return getCanonicalPortableId(base) === actorId;
+	};
+	let signature;
+	for (const candidate of signatures) if (candidate.coversDelivery && isGatewayKeyOfRecipient(candidate.keyId) && await kv.get(claimKey(candidate.keyId.origin)) === void 0) {
+		signature = candidate;
+		break;
+	}
+	if (signature == null) return null;
+	const { keyId } = signature;
+	const logProperties = {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		keyId: keyId.href
+	};
+	const verification = Promise.resolve().then(() => signature.verify()).then((key) => {
+		if (key == null) logger.debug("The HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} is not verified with the key {keyId}; forwarding it without identifying the sending gateway.", logProperties);
+		return key;
+	}, (error) => {
+		logger.debug("Failed to verify the HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} with the key {keyId}; forwarding it without identifying the sending gateway:\n{error}", {
+			...logProperties,
+			error
+		});
+		return null;
+	});
+	let timer;
+	const key = await Promise.race([verification, new Promise((resolve) => {
+		timer = setTimeout(() => {
+			logger.debug("Verifying the HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} did not finish in time; forwarding it without identifying the sending gateway.", logProperties);
+			resolve(null);
+		}, Math.max(0, deadline - Date.now()));
+	})]);
+	clearTimeout(timer);
+	if (key == null) return null;
+	if (key.id == null || key.id.href !== keyId.href || !isGatewayKeyOfRecipient(key.id) || key.ownerId == null || !isPortableId(key.ownerId) || getCanonicalPortableId(key.ownerId) !== actorId) {
+		logger.debug("The delivery of activity {activityId} to the portable inbox {inbox} is not signed with a gateway key of the recipient; forwarding it without identifying the sending gateway.", logProperties);
+		return null;
+	}
+	return key.id.origin;
+}
+function getForwardingTargets(recipient, excludedOrigins) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const seen = new Set(excludedOrigins);
+	const targets = [];
+	for (const gateway of recipient.gateways) {
+		if (!isGatewayUrl(gateway) || seen.has(gateway.origin)) continue;
+		seen.add(gateway.origin);
+		let inbox;
+		try {
+			inbox = toCompatibleEf61Id(recipient.inboxId, gateway.origin);
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			logger.warn("Cannot forward to the gateway {gateway}, as the portable inbox {inbox} cannot be represented as its compatible identifier.", {
+				gateway: gateway.origin,
+				inbox: recipient.canonicalInboxId
+			});
+			continue;
+		}
+		targets.push({
+			gateway: gateway.origin,
+			inbox
+		});
+	}
+	return targets;
+}
+/**
+* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
+* key, as {@link sendActivity} signs requests only with such a key.  Since
+* the targets have already been claimed, the activity is forwarded unsigned
+* rather than not at all if the key cannot be resolved or used.
+*/
+async function resolveForwardingKey({ getKeys, activityId }) {
+	if (getKeys == null) return null;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	let key;
+	try {
+		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
+	} catch (error) {
+		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	if (key == null) return null;
+	try {
+		validateCryptoKey(key.privateKey, "private");
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	return key;
+}
+async function forwardImmediately(parameters, inboxes, deadlineAt) {
+	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, meterProvider, tracerProvider } = parameters;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const deadline = Math.max(0, deadlineAt - Date.now());
+	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
+		activity,
+		activityId: activityId.href,
+		activityType,
+		keys: key == null ? [] : [key],
+		inbox,
+		allowPrivateAddress,
+		specDeterminer,
+		meterProvider,
+		tracerProvider
+	}).catch((error) => {
+		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+			activityId: activityId.href,
+			inbox: inbox.href,
+			error
+		});
+	}))));
+	let timer;
+	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
+		timer = setTimeout(() => resolve(true), deadline);
+	})]);
+	clearTimeout(timer);
+	if (timedOut) logger.warn("Forwarding activity {activityId} to other gateways did not finish in {deadline} ms; responding to the delivery without waiting for it.", {
+		activityId: activityId.href,
+		deadline
+	});
+}
+async function enqueueForwarding(parameters, outboxQueue, inboxes) {
+	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const key = await resolveForwardingKey(parameters);
+	const keys = [];
+	if (key != null) try {
+		keys.push({
+			keyId: key.keyId.href,
+			privateKey: await exportJwk(key.privateKey)
+		});
+	} catch (error) {
+		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+	}
+	startQueue?.();
+	const started = (/* @__PURE__ */ new Date()).toISOString();
+	const traceContext = {};
+	propagation.inject(context.active(), traceContext);
+	await Promise.all(inboxes.map(async (inbox) => {
+		const message = {
+			type: "outbox",
+			id: crypto.randomUUID(),
+			baseUrl,
+			keys,
+			activity,
+			activityId: activityId.href,
+			activityType,
+			inbox: inbox.href,
+			sharedInbox: false,
+			started,
+			attempt: 0,
+			headers: {},
+			traceContext
+		};
+		try {
+			await outboxQueue.enqueue(message);
+		} catch (error) {
+			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+				activityId: activityId.href,
+				inbox: inbox.href,
+				error
+			});
+			return;
+		}
+		recordOutboxEnqueue(meterProvider, outboxQueue, message);
+	}));
+}
+//#endregion
+//#region src/federation/temporal.ts
+function isPlainObject$1(value) {
+	return typeof value === "object" && value != null && !Array.isArray(value);
+}
+function normalizeDateTimeLiteral(value) {
+	return value.substring(19).match(/[Z+-]/) ? value : value + "Z";
+}
+function isMalformedDateTimeLiteral(value) {
+	if (typeof value !== "string") return false;
+	try {
+		Temporal.Instant.from(normalizeDateTimeLiteral(value));
+		return false;
+	} catch {
+		return true;
+	}
+}
+function isMalformedDurationLiteral(value) {
+	if (typeof value !== "string") return false;
+	try {
+		Temporal.Duration.from(value);
+		return false;
+	} catch {
+		return true;
+	}
+}
+const TEMPORAL_DATE_TIME_IRIS = /* @__PURE__ */ new Set([
+	"https://www.w3.org/ns/activitystreams#deleted",
+	"https://www.w3.org/ns/activitystreams#endTime",
+	"https://www.w3.org/ns/activitystreams#published",
+	"https://www.w3.org/ns/activitystreams#startTime",
+	"https://www.w3.org/ns/activitystreams#updated",
+	"http://purl.org/dc/terms/created",
+	"https://w3id.org/security#created"
+]);
+const TEMPORAL_DURATION_IRIS = /* @__PURE__ */ new Set(["https://www.w3.org/ns/activitystreams#duration"]);
+const QUESTION_CLOSED_IRI = "https://www.w3.org/ns/activitystreams#closed";
+const XSD_DATE_TIME_IRI = "http://www.w3.org/2001/XMLSchema#dateTime";
+function hasMalformedExpandedDateTimeLiteral(value) {
+	if (Array.isArray(value)) return value.some(hasMalformedExpandedDateTimeLiteral);
+	return isPlainObject$1(value) && "@value" in value && isMalformedDateTimeLiteral(value["@value"]);
+}
+function hasMalformedExpandedQuestionClosedLiteral(value) {
+	if (Array.isArray(value)) return value.some(hasMalformedExpandedQuestionClosedLiteral);
+	if (!isPlainObject$1(value) || !("@value" in value)) return false;
+	const literal = value["@value"];
+	if (typeof literal === "boolean") return false;
+	if (typeof literal !== "string") return false;
+	if (value["@type"] !== XSD_DATE_TIME_IRI) return false;
+	if (new Date(literal).toString() === "Invalid Date") return false;
+	return isMalformedDateTimeLiteral(literal);
+}
+function hasMalformedExpandedDurationLiteral(value) {
+	if (Array.isArray(value)) return value.some(hasMalformedExpandedDurationLiteral);
+	return isPlainObject$1(value) && "@value" in value && isMalformedDurationLiteral(value["@value"]);
+}
+function hasMalformedKnownTemporalLiteralInternal(value, visited) {
+	if (Array.isArray(value)) return value.some((item) => hasMalformedKnownTemporalLiteralInternal(item, visited));
+	if (!isPlainObject$1(value)) return false;
+	if (visited.has(value)) return false;
+	visited.add(value);
+	if ("@value" in value) return false;
+	for (const [key, child] of Object.entries(value)) {
+		if (TEMPORAL_DATE_TIME_IRIS.has(key)) {
+			if (hasMalformedExpandedDateTimeLiteral(child)) return true;
+			continue;
+		}
+		if (key === QUESTION_CLOSED_IRI) {
+			if (hasMalformedExpandedQuestionClosedLiteral(child)) return true;
+			continue;
+		}
+		if (TEMPORAL_DURATION_IRIS.has(key)) {
+			if (hasMalformedExpandedDurationLiteral(child)) return true;
+			continue;
+		}
+		if (hasMalformedKnownTemporalLiteralInternal(child, visited)) return true;
+	}
+	return false;
+}
+async function hasMalformedKnownTemporalLiteral(value, contextLoader) {
+	try {
+		return hasMalformedKnownTemporalLiteralInternal(await jsonld.expand(value, {
+			documentLoader: getNormalizationContextLoader(contextLoader),
+			keepFreeFloatingNodes: true
+		}), /* @__PURE__ */ new Set());
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/federation/handler.ts
+const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
+const INBOX_COMPOUND_PROOF_LIMITS = {
+	maxDepth: 64,
+	maxMaps: 1e4,
+	maxProofs: 32,
+	maxBytes: 10 * 1024 * 1024
+};
+function isRemoteContextLoadingFailure$1(error) {
+	return error instanceof Error && typeof error.details === "object" && error.details != null && error.details.code === "loading remote context failed";
+}
+function isPermanentRemoteContextError$1(error) {
+	if (!(error instanceof Error) || error.name !== "jsonld.InvalidUrl") return false;
+	const details = error.details;
+	if (details?.code === "invalid remote context") return true;
+	return isRemoteContextLoadingFailure$1(error) && typeof details?.url === "string" && !URL.canParse(details.url) && isClearlyMalformedContextReference(details.url);
+}
+function isInvalidJsonLdError(error) {
+	if (!(error instanceof Error)) return false;
+	const name = error.name;
+	return name === "UnsafeJsonLdError" || error instanceof InvalidContextReferenceError || isPermanentRemoteContextError$1(error) || name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure$1(error);
+}
+function isValidationTypeError(error) {
+	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || isInvalidUrlTypeError(error));
+}
+function isPermanentActivityParseError(error) {
+	return isInvalidJsonLdError(error) || isValidationTypeError(error);
+}
+function hasHttpSignatureHeaders(request) {
+	return request.headers.has("Signature") || request.headers.has("Signature-Input");
+}
+function hasObjectIntegrityProof(json) {
+	return typeof json === "object" && json != null && "proof" in json;
+}
+/**
+* Handles an actor request.
+* @template TContextData The context data to pass to the context.
+* @param request The HTTP request.
+* @param parameters The parameters for handling the actor.
+* @returns A promise that resolves to an HTTP response.
+*/
+async function handleActor(request, { identifier, context, actorDispatcher, authorizePredicate, onNotFound, onUnauthorized }) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"actor"
+	]);
+	if (actorDispatcher == null) {
+		logger.debug("Actor dispatcher is not set.", { identifier });
+		return await onNotFound(request);
+	}
+	const actor = await actorDispatcher(context, identifier);
+	if (actor == null) {
+		logger.debug("Actor {identifier} not found.", { identifier });
+		return await onNotFound(request);
+	}
+	if (authorizePredicate != null) {
+		if (!await authorizePredicate(context, identifier)) return await onUnauthorized(request);
+	}
+	if (actor instanceof Tombstone) {
+		const jsonLd = await actor.toJsonLd(context);
+		return new Response(JSON.stringify(jsonLd), {
+			status: 410,
+			headers: {
+				"Content-Type": "application/activity+json",
+				Vary: "Accept"
+			}
+		});
+	}
+	const jsonLd = await actor.toJsonLd(context);
+	return new Response(JSON.stringify(jsonLd), { headers: {
+		"Content-Type": "application/activity+json",
+		Vary: "Accept"
+	} });
+}
+/**
+* Handles an object request.
+* @template TContextData The context data to pass to the context.
+* @param request The HTTP request.
+* @param parameters The parameters for handling the object.
+* @returns A promise that resolves to an HTTP response.
+*/
+async function handleObject(request, { values, context, objectDispatcher, authorizePredicate, onNotFound, onUnauthorized }) {
+	if (objectDispatcher == null) return await onNotFound(request);
+	const object = await objectDispatcher(context, values);
+	if (object == null) return await onNotFound(request);
+	if (authorizePredicate != null) {
+		if (!await authorizePredicate(context, values)) return await onUnauthorized(request);
+	}
+	const jsonLd = await object.toJsonLd(context);
+	return new Response(JSON.stringify(jsonLd), { headers: {
+		"Content-Type": "application/activity+json",
+		Vary: "Accept"
+	} });
+}
+/**
+* Handles an FEP-ef61 gateway request for a portable object through an object
+* dispatcher, or the actor dispatcher adapted to one.  The object is served
+* only if its ID canonically matches the requested portable ID and it
+* satisfies the FEP-ef61 proof policy.
+* @template TContextData The context data to pass to the context.
+* @param request The HTTP request.
+* @param parameters The parameters for handling the portable object.
+* @returns A promise that resolves to an HTTP response.
+*/
+async function handlePortableObject(request, { values, context, objectDispatcher, authorizePredicate, canonicalId, onNotFound, onUnauthorized }) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"object"
+	]);
+	if (objectDispatcher == null) return await onNotFound(request);
+	const object = await objectDispatcher(context, values);
+	if (object == null) return await onNotFound(request);
+	if (!isRequestedPortableObject(object, canonicalId)) {
+		logger.debug("The object {objectId} does not match the requested portable object {portableId}.", {
+			objectId: object.id?.href,
+			portableId: canonicalId
+		});
+		return await onNotFound(request);
+	}
+	if (authorizePredicate != null) {
+		if (!await authorizePredicate(context, values)) return await onUnauthorized(request);
+	}
+	let jsonLd;
+	let servedId;
+	let result;
+	try {
+		jsonLd = await object.toJsonLd(context);
+		servedId = await getJsonLdRootId(jsonLd, context.contextLoader);
+		result = await verifyPortableObjectProof(jsonLd, {
+			contextLoader: context.contextLoader,
+			documentLoader: context.documentLoader,
+			tracerProvider: context.tracerProvider,
+			meterProvider: context.meterProvider
+		});
+	} catch (error) {
+		logger.error("Failed to verify the Object Integrity Proofs of the portable object {portableId}:\n{error}", {
+			portableId: canonicalId,
+			error
+		});
+		return portableObjectInternalServerError(request);
+	}
+	if (servedId == null || !isRequestedPortableId(servedId, canonicalId)) {
+		logger.debug("The serialized object does not match the requested portable object {portableId}.", { portableId: canonicalId });
+		return await onNotFound(request);
+	}
+	if (!result.verified && result.reason.type !== "unsecuredCollection" && result.reason.type !== "unsupportedObjectType") {
+		logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, and objects need an Object Integrity Proof made with a key of the DID in their ID.", {
+			portableId: canonicalId,
+			reason: result.reason.type
+		});
+		return portableObjectInternalServerError(request);
+	}
+	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), { headers: {
+		"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
+		Vary: "Accept"
+	} });
+}
+function isRequestedPortableObject(object, canonicalId) {
+	return object.id != null && getCanonicalPortableId(object.id) === canonicalId;
+}
+async function getJsonLdRootId(jsonLd, contextLoader) {
+	const expanded = await jsonld.expand(jsonLd, {
+		documentLoader: getNormalizationContextLoader(contextLoader),
+		keepFreeFloatingNodes: true
+	});
+	if (expanded.length !== 1) return null;
+	const id = expanded[0]["@id"];
+	return typeof id === "string" ? id : null;
+}
+function isRequestedPortableId(id, canonicalId) {
+	if (!/^ap(?:\+ef61)?:\/\//i.test(id)) return URL.canParse(id) && getCanonicalPortableId(new URL(id)) === canonicalId;
+	try {
+		return canonicalizePortableUri(id) === canonicalId;
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+}
+function portableObjectInternalServerError(request) {
+	return new Response(request.method === "HEAD" ? null : "Internal server error.", {
+		status: 500,
+		headers: { "Content-Type": "text/plain; charset=utf-8" }
+	});
+}
+const BUILT_IN_COLLECTION_METRIC_KINDS = /* @__PURE__ */ new Set([
+	"inbox",
+	"outbox",
+	"following",
+	"followers",
+	"liked",
+	"featured",
+	"featured_tags"
+]);
+function getCollectionMetricKind(name) {
+	const normalized = name.trim().replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/\s+/g, "_");
+	return BUILT_IN_COLLECTION_METRIC_KINDS.has(normalized) ? normalized : "custom";
+}
+function collectionAttributes(base, result, response) {
+	return {
+		...base,
+		result,
+		...response == null ? {} : { statusCode: response.status }
+	};
+}
+function recordCollectionMetrics(meterProvider, base, result, options = {}) {
+	const attrs = collectionAttributes(base, result, options.response);
+	recordCollectionRequest(meterProvider, attrs);
+	if (options.dispatchDurationMs != null) recordCollectionDispatchDuration(meterProvider, options.dispatchDurationMs, attrs);
+	if (options.itemCount != null) recordCollectionPageItems(meterProvider, options.itemCount, attrs);
+	if (options.totalItems != null) recordCollectionTotalItems(meterProvider, options.totalItems, attrs);
+}
+/**
+* Handles a collection request.
+* @template TItem The type of items in the collection.
+* @template TContext The type of the context, extending {@link RequestContext}.
+* @template TContextData The context data to pass to the `TContext`.
+* @template TFilter The type of the filter.
+* @param request The HTTP request.
+* @param parameters The parameters for handling the collection.
+* @returns A promise that resolves to an HTTP response.
+*/
 async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
 	const spanName = name$2.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
@@ -3945,7 +4670,21 @@ async function handleInboxInternal(request, parameters, span) {
 		inbox: portableInbox.recipient.canonicalInboxId
 	});
 	else try {
-		await portableInbox.forward(json, activity.id, getTypeId(activity).href);
+		await portableInbox.forward(json, activity.id, getTypeId(activity).href, listRequestSignatures(request).map((signature) => ({
+			keyId: signature.keyId,
+			coversDelivery: coversDelivery(signature),
+			verify: async () => {
+				const verification = await verifyRequestDetailed(selectRequestSignature(request, signature), {
+					contextLoader: ctx.contextLoader,
+					documentLoader: ctx.documentLoader,
+					timeWindow: signatureTimeWindow,
+					keyCache,
+					meterProvider,
+					tracerProvider
+				});
+				return verification.verified ? verification.key : null;
+			}
+		})));
 	} catch (error) {
 		logger.error("Failed to forward activity {activityId} to the other gateways of the portable inbox {inbox}:\n{error}", {
 			activityId: activity.id.href,
@@ -4442,523 +5181,233 @@ const authIfNeeded = async (context, values, { authorizePredicate: authorize = v
 * @template Cursor The type of the cursor (string, null, or undefined).
 * @param {URL} url The base URL to append the cursor to.
 * @param {string | null | undefined} cursor The cursor value to append.
-* @returns The URL with cursor appended if cursor is a string, null otherwise.
-* @since 1.8.0
-*/
-const appendCursorIfExists = (url, cursor) => {
-	if (cursor === null || cursor === void 0) return null;
-	const copied = new URL(url);
-	copied.searchParams.set("cursor", cursor);
-	return copied;
-};
-/**
-* Creates an HTTP response for ActivityPub data.
-* @param {unknown} data The data to serialize as JSON-LD.
-* @returns {Response} An HTTP response with the data as ActivityPub JSON.
-* @since 1.8.0
-*/
-const respondAsActivity = (data) => new Response(JSON.stringify(data), { headers: {
-	"Content-Type": "application/activity+json",
-	Vary: "Accept"
-} });
-/**
-* Base class for handler errors.
-* @since 1.8.0
-*/
-var HandlerError = class extends Error {
-	constructor(message) {
-		super(message);
-	}
-	/**
-	* Throws this error.
-	* @returns Never returns, always throws.
-	*/
-	throw() {
-		throw this;
-	}
-};
-/**
-* Error thrown when items are not found in a collection.
-* @since 1.8.0
-*/
-var ItemsNotFoundError = class extends HandlerError {
-	constructor() {
-		super("Items not found in the collection.");
-	}
-};
-/**
-* Error thrown when access to a collection is unauthorized.
-* @since 1.8.0
-*/
-var UnauthorizedError = class extends HandlerError {
-	constructor() {
-		super("Unauthorized access to the collection.");
-	}
-};
-/**
-* Responds with the given object in JSON-LD format.
-*
-* @param object The object to respond with.
-* @param options Options.
-* @since 0.3.0
-*/
-async function respondWithObject(object, options) {
-	const jsonLd = await object.toJsonLd(options);
-	return new Response(JSON.stringify(jsonLd), { headers: { "Content-Type": "application/activity+json" } });
-}
-/**
-* Responds with the given object in JSON-LD format if the request accepts
-* JSON-LD.
-*
-* @param object The object to respond with.
-* @param request The request to check for JSON-LD acceptability.
-* @param options Options.
-* @since 0.3.0
-*/
-async function respondWithObjectIfAcceptable(object, request, options) {
-	if (!acceptsJsonLd(request)) return null;
-	const response = await respondWithObject(object, options);
-	response.headers.set("Vary", "Accept");
-	return response;
-}
-function generateNonce() {
-	const bytes = /* @__PURE__ */ new Uint8Array(16);
-	crypto.getRandomValues(bytes);
-	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-async function verifySignatureNonce(request, kv, noncePrefix, verifiedLabel) {
-	const signatureInput = request.headers.get("Signature-Input");
-	if (signatureInput == null) return false;
-	const parsed = parseRfc9421SignatureInput(signatureInput);
-	if (verifiedLabel == null) return false;
-	const sig = parsed[verifiedLabel];
-	if (sig == null) return false;
-	const nonce = sig.nonce;
-	if (nonce == null) return false;
-	const key = [...noncePrefix, nonce];
-	if (kv.cas != null) return await kv.cas(key, true, void 0);
-	if (await kv.get(key) != null) {
-		await kv.delete(key);
-		return true;
-	}
-	return false;
-}
-const getFailedSignatureResponse = async (policy, kv, kvPrefixes) => {
-	const headers = await getFailedSignatureHeaders(policy, kv, kvPrefixes);
-	return new Response("Failed to verify the request signature.", {
-		status: 401,
-		headers
-	});
-};
-const getFailedSignatureHeaders = async (policy, kv, kvPrefixes) => ({
-	"Content-Type": "text/plain; charset=utf-8",
-	...policy?.enabled && {
-		"Accept-Signature": await buildAcceptSignatureHeader(policy, kv, kvPrefixes.acceptSignatureNonce),
-		"Cache-Control": "no-store",
-		"Vary": "Accept, Signature"
-	}
-});
-async function buildAcceptSignatureHeader(policy, kv, noncePrefix) {
-	const parameters = { created: true };
-	if (policy.requestNonce) {
-		const nonce = generateNonce();
-		await setKey(kv, [...noncePrefix, nonce], policy);
-		parameters.nonce = nonce;
-	}
-	const baseComponents = policy.components ?? DEF_COMPONENTS;
-	return formatAcceptSignature([{
-		label: "sig1",
-		components: uniq(MIN_COMPONENTS.concat(baseComponents)).filter((c) => c !== "@status").map((v) => ({
-			value: v,
-			params: {}
-		})),
-		parameters
-	}]);
-}
-async function setKey(kv, key, policy) {
-	const seconds = policy.nonceTtlSeconds ?? 300;
-	const ttl = Temporal.Duration.from({ seconds });
-	await kv.set(key, true, { ttl });
-}
-const DEF_COMPONENTS = [
-	"@method",
-	"@target-uri",
-	"@authority",
-	"content-digest"
-];
-const MIN_COMPONENTS = [
-	"@method",
-	"@target-uri",
-	"@authority"
-];
-/**
-* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
-* portable actor, i.e., its ID is a compatible identifier and it is owned by
-* a portable actor, which only the portable actor's signed document can
-* establish.
+* @returns The URL with cursor appended if cursor is a string, null otherwise.
+* @since 1.8.0
 */
-function isPortableGatewayKey(key) {
-	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
-}
+const appendCursorIfExists = (url, cursor) => {
+	if (cursor === null || cursor === void 0) return null;
+	const copied = new URL(url);
+	copied.searchParams.set("cursor", cursor);
+	return copied;
+};
 /**
-* Checks whether an activity needs an Object Integrity Proof by its DID:
-* either it is performed by an [FEP-ef61] portable actor, or its own ID is
-* portable.  Both `ap:` URIs and compatible identifiers count as portable.
-*
-* [FEP-ef61]: https://w3id.org/fep/ef61
+* Creates an HTTP response for ActivityPub data.
+* @param {unknown} data The data to serialize as JSON-LD.
+* @returns {Response} An HTTP response with the data as ActivityPub JSON.
+* @since 1.8.0
 */
-function isPortableActivity(activity) {
-	return hasPortableActor(activity) || activity.id != null && isPortableId(activity.id);
-}
+const respondAsActivity = (data) => new Response(JSON.stringify(data), { headers: {
+	"Content-Type": "application/activity+json",
+	Vary: "Accept"
+} });
 /**
-* Verifies that a portable activity's own ID belongs to the DID that signed
-* it, on the JSON-LD document received.  The ID the proof policy checks has
-* to be the parsed activity's ID, so that a remote context that changes
-* between loads cannot make the two name different objects.
-* @returns `null` if the ID is verified, or the reason why it is not.
+* Base class for handler errors.
+* @since 1.8.0
 */
-async function verifyPortableActivityId(activityId, jsonLd, options) {
-	const expectedId = getCanonicalPortableId(activityId);
-	if (expectedId == null) return "malformed portable ID";
-	let verification;
-	try {
-		verification = await verifyPortableObjectProofWithRoot(jsonLd, options);
-	} catch (error) {
-		if (error instanceof InvalidPortableObjectIdError) return "malformed portable ID";
-		if (!isPermanentActivityParseError(error)) throw error;
-		return "malformed document";
+var HandlerError = class extends Error {
+	constructor(message) {
+		super(message);
 	}
-	const { result, root } = verification;
-	if (!result.verified) return result.reason.type;
-	const rootId = root?.["@id"];
-	if (typeof rootId !== "string" || getCanonicalPortableId(parseIri(rootId)) !== expectedId) return "the verified document has another ID";
-	return null;
-}
-//#endregion
-//#region src/nodeinfo/handler.ts
+	/**
+	* Throws this error.
+	* @returns Never returns, always throws.
+	*/
+	throw() {
+		throw this;
+	}
+};
 /**
-* Handles a NodeInfo request.  You would not typically call this function
-* directly, but instead use {@link Federation.handle} method.
-* @param request The NodeInfo request to handle.
-* @param parameters The parameters for handling the request.
-* @returns The response to the request.
+* Error thrown when items are not found in a collection.
+* @since 1.8.0
 */
-async function handleNodeInfo(_request, { context, nodeInfoDispatcher }) {
-	const promise = nodeInfoDispatcher(context);
-	const json = nodeInfoToJson(promise instanceof Promise ? await promise : promise);
-	return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\"" } });
-}
+var ItemsNotFoundError = class extends HandlerError {
+	constructor() {
+		super("Items not found in the collection.");
+	}
+};
 /**
-* Handles a request to `/.well-known/nodeinfo`.  You would not typically call
-* this function directly, but instead use {@link Federation.handle} method.
-* @param request The request to handle.
-* @param context The request context.
-* @returns The response to the request.
+* Error thrown when access to a collection is unauthorized.
+* @since 1.8.0
 */
-function handleNodeInfoJrd(_request, context) {
-	const links = [];
-	try {
-		links.push({
-			rel: "http://nodeinfo.diaspora.software/ns/schema/2.1",
-			href: context.getNodeInfoUri().href,
-			type: "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\""
-		});
-	} catch (e) {
-		if (!(e instanceof RouterError)) throw e;
+var UnauthorizedError = class extends HandlerError {
+	constructor() {
+		super("Unauthorized access to the collection.");
 	}
-	const response = new Response(JSON.stringify({ links }), { headers: { "Content-Type": "application/jrd+json" } });
-	return Promise.resolve(response);
-}
-//#endregion
-//#region src/federation/send.ts
+};
 /**
-* Extracts the inbox URLs from recipients.
-* @param parameters The parameters to extract the inboxes.
-*                   See also {@link ExtractInboxesParameters}.
-* @returns The inboxes as a map of inbox URL to actor URIs.
+* Responds with the given object in JSON-LD format.
+*
+* @param object The object to respond with.
+* @param options Options.
+* @since 0.3.0
 */
-function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
-	const inboxes = {};
-	for (const recipient of recipients) {
-		let inbox;
-		let sharedInbox = false;
-		if (preferSharedInbox && recipient.endpoints?.sharedInbox != null) {
-			inbox = recipient.endpoints.sharedInbox;
-			sharedInbox = true;
-		} else inbox = recipient.inboxId;
-		if (inbox != null && recipient.id != null) {
-			if (excludeBaseUris != null && excludeBaseUris.some((u) => u.origin === inbox?.origin)) continue;
-			inboxes[inbox.href] ??= {
-				actorIds: /* @__PURE__ */ new Set(),
-				sharedInbox
-			};
-			inboxes[inbox.href].actorIds.add(recipient.id.href);
-		}
-	}
-	return inboxes;
+async function respondWithObject(object, options) {
+	const jsonLd = await object.toJsonLd(options);
+	return new Response(JSON.stringify(jsonLd), { headers: { "Content-Type": "application/activity+json" } });
 }
 /**
-* Sends an {@link Activity} to an inbox.
+* Responds with the given object in JSON-LD format if the request accepts
+* JSON-LD.
 *
-* @param parameters The parameters for sending the activity.
-*                   See also {@link SendActivityParameters}.
-* @throws {Error} If the activity fails to send.
+* @param object The object to respond with.
+* @param request The request to check for JSON-LD acceptability.
+* @param options Options.
+* @since 0.3.0
 */
-function sendActivity(options) {
-	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
-	return tracerProvider.getTracer(name, version).startActiveSpan("activitypub.send_activity", {
-		kind: SpanKind.CLIENT,
-		attributes: { "activitypub.shared_inbox": options.sharedInbox ?? false }
-	}, async (span) => {
-		if (options.activityId != null) span.setAttribute("activitypub.activity.id", options.activityId);
-		if (options.activityType != null) span.setAttribute("activitypub.activity.type", options.activityType);
-		try {
-			await sendActivityInternal({
-				...options,
-				tracerProvider
-			}, span);
-		} catch (e) {
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(e)
-			});
-			throw e;
-		} finally {
-			span.end();
-		}
-	});
-}
-const MAX_ERROR_RESPONSE_BODY_BYTES = 1024;
-function getActivityActorId(activity) {
-	if (!isRecord(activity)) return void 0;
-	return getIdValue(activity.actor);
-}
-function getIdValue(value) {
-	if (typeof value === "string" && value !== "") return value;
-	if (value instanceof URL) return value.href;
-	if (Array.isArray(value)) {
-		for (const item of value) {
-			const id = getIdValue(item);
-			if (id != null) return id;
-		}
-		return;
-	}
-	if (isRecord(value)) return getIdValue(value.id);
-}
-function isRecord(value) {
-	return typeof value === "object" && value != null;
-}
-async function readLimitedResponseBody(response, maxBytes) {
-	if (response.body == null) return "";
-	const reader = response.body.getReader();
-	const decoder = new TextDecoder();
-	const chunks = [];
-	let totalBytes = 0;
-	let truncated = false;
-	try {
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			if (totalBytes + value.length > maxBytes) {
-				const remaining = maxBytes - totalBytes;
-				if (remaining > 0) chunks.push(decoder.decode(value.slice(0, remaining), { stream: true }));
-				truncated = true;
-				break;
-			}
-			chunks.push(decoder.decode(value, { stream: true }));
-			totalBytes += value.length;
-		}
-	} finally {
-		reader.releaseLock();
-	}
-	let result = chunks.join("");
-	if (truncated) result += "… (truncated)";
-	return result;
-}
-async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span) {
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"outbox"
-	]);
-	const federationMetrics = getFederationMetrics(meterProvider);
-	const started = performance.now();
-	let deliverySuccess = false;
-	async function validateUrl(url) {
-		if (!allowPrivateAddress) try {
-			await validatePublicUrl(url);
-		} catch (error) {
-			if (error instanceof UrlError) logger.error("Disallowed private URL: {url}", {
-				url,
-				error
-			});
-			throw error;
-		}
-	}
-	await validateUrl(inbox.href);
-	headers = new Headers(headers);
-	headers.set("Content-Type", "application/activity+json");
-	const request = new Request(inbox, {
-		method: "POST",
-		headers,
-		body: JSON.stringify(activity),
-		redirect: "manual"
-	});
-	let rsaKey = null;
-	for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
-		rsaKey = key;
-		break;
+async function respondWithObjectIfAcceptable(object, request, options) {
+	if (!acceptsJsonLd(request)) return null;
+	const response = await respondWithObject(object, options);
+	response.headers.set("Vary", "Accept");
+	return response;
+}
+function generateNonce() {
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	crypto.getRandomValues(bytes);
+	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function verifySignatureNonce(request, kv, noncePrefix, verifiedLabel) {
+	const signatureInput = request.headers.get("Signature-Input");
+	if (signatureInput == null) return false;
+	const parsed = parseRfc9421SignatureInput(signatureInput);
+	if (verifiedLabel == null) return false;
+	const sig = parsed[verifiedLabel];
+	if (sig == null) return false;
+	const nonce = sig.nonce;
+	if (nonce == null) return false;
+	const key = [...noncePrefix, nonce];
+	if (kv.cas != null) return await kv.cas(key, true, void 0);
+	if (await kv.get(key) != null) {
+		await kv.delete(key);
+		return true;
 	}
-	if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
-		activityId,
-		inbox: inbox.href
-	});
-	else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
-		inbox: inbox.href,
-		keys: keys.map((pair) => ({
-			keyId: pair.keyId.href,
-			privateKey: pair.privateKey
-		}))
+	return false;
+}
+const getFailedSignatureResponse = async (policy, kv, kvPrefixes) => {
+	const headers = await getFailedSignatureHeaders(policy, kv, kvPrefixes);
+	return new Response("Failed to verify the request signature.", {
+		status: 401,
+		headers
 	});
-	let response;
-	try {
-		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await doubleKnock(request, rsaKey, {
-			tracerProvider,
-			specDeterminer,
-			validateRedirect: validateUrl
-		});
-	} catch (error) {
-		const failure = error instanceof FetchError || error instanceof UrlError ? error : createFetchError(inbox.href, error);
-		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
-			activityId,
-			inbox: inbox.href,
-			error: failure
-		});
-		federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
-		throw failure;
+};
+const getFailedSignatureHeaders = async (policy, kv, kvPrefixes) => ({
+	"Content-Type": "text/plain; charset=utf-8",
+	...policy?.enabled && {
+		"Accept-Signature": await buildAcceptSignatureHeader(policy, kv, kvPrefixes.acceptSignatureNonce),
+		"Cache-Control": "no-store",
+		"Vary": "Accept, Signature"
 	}
-	try {
-		if (!response.ok) {
-			let error;
-			try {
-				error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
-			} catch (_) {
-				error = "";
-			}
-			logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
-				activityId,
-				inbox: inbox.href,
-				status: response.status,
-				statusText: response.statusText,
-				error
-			});
-			throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error, response.headers);
-		}
-		deliverySuccess = true;
-		const eventAttributes = {
-			"activitypub.inbox.url": inbox.href,
-			"activitypub.activity.id": activityId ?? ""
-		};
-		if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
-		const actorId = getActivityActorId(activity);
-		if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
-		span.addEvent("activitypub.activity.sent", eventAttributes);
-	} finally {
-		federationMetrics.recordDelivery(inbox, getDurationMs(started), deliverySuccess, activityType);
+});
+async function buildAcceptSignatureHeader(policy, kv, noncePrefix) {
+	const parameters = { created: true };
+	if (policy.requestNonce) {
+		const nonce = generateNonce();
+		await setKey(kv, [...noncePrefix, nonce], policy);
+		parameters.nonce = nonce;
 	}
+	const baseComponents = policy.components ?? DEF_COMPONENTS;
+	return formatAcceptSignature([{
+		label: "sig1",
+		components: uniq(MIN_COMPONENTS.concat(baseComponents)).filter((c) => c !== "@status").map((v) => ({
+			value: v,
+			params: {}
+		})),
+		parameters
+	}]);
 }
-function createFetchError(url, cause) {
-	const error = new FetchError(url, cause instanceof Error ? cause.message : String(cause));
-	error.cause = cause;
-	return error;
+async function setKey(kv, key, policy) {
+	const seconds = policy.nonceTtlSeconds ?? 300;
+	const ttl = Temporal.Duration.from({ seconds });
+	await kv.set(key, true, { ttl });
 }
-async function fetchWithValidatedRedirects(request, validateUrl) {
-	let body = await request.clone().text();
-	for (let redirects = 0;; redirects++) {
-		const response = await fetch(request, { redirect: "manual" });
-		const location = response.headers.get("Location");
-		if (![
-			301,
-			302,
-			303,
-			307,
-			308
-		].includes(response.status) || location == null) return response;
-		await response.body?.cancel();
-		if (redirects >= 20) throw new TypeError("Too many redirects");
-		const url = new URL(location, request.url);
-		await validateUrl(url.href);
-		const headers = new Headers(request.headers);
-		if (url.origin !== new URL(request.url).origin) {
-			headers.delete("Authorization");
-			headers.delete("Proxy-Authorization");
-			headers.delete("Cookie");
-			headers.delete("Host");
-		}
-		let method = request.method;
-		if ((response.status === 301 || response.status === 302) && method === "POST" || response.status === 303 && method !== "GET" && method !== "HEAD") {
-			method = "GET";
-			body = void 0;
-			for (const name of [
-				"Content-Encoding",
-				"Content-Language",
-				"Content-Length",
-				"Content-Location",
-				"Content-Type"
-			]) headers.delete(name);
-		}
-		request = new Request(url, {
-			method,
-			headers,
-			body,
-			redirect: "manual"
-		});
+const DEF_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"@authority",
+	"content-digest"
+];
+const MIN_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"@authority"
+];
+/**
+* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
+* portable actor, i.e., its ID is a compatible identifier and it is owned by
+* a portable actor, which only the portable actor's signed document can
+* establish.
+*/
+function isPortableGatewayKey(key) {
+	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
+}
+/**
+* Checks whether an activity needs an Object Integrity Proof by its DID:
+* either it is performed by an [FEP-ef61] portable actor, or its own ID is
+* portable.  Both `ap:` URIs and compatible identifiers count as portable.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*/
+function isPortableActivity(activity) {
+	return hasPortableActor(activity) || activity.id != null && isPortableId(activity.id);
+}
+/**
+* Verifies that a portable activity's own ID belongs to the DID that signed
+* it, on the JSON-LD document received.  The ID the proof policy checks has
+* to be the parsed activity's ID, so that a remote context that changes
+* between loads cannot make the two name different objects.
+* @returns `null` if the ID is verified, or the reason why it is not.
+*/
+async function verifyPortableActivityId(activityId, jsonLd, options) {
+	const expectedId = getCanonicalPortableId(activityId);
+	if (expectedId == null) return "malformed portable ID";
+	let verification;
+	try {
+		verification = await verifyPortableObjectProofWithRoot(jsonLd, options);
+	} catch (error) {
+		if (error instanceof InvalidPortableObjectIdError) return "malformed portable ID";
+		if (!isPermanentActivityParseError(error)) throw error;
+		return "malformed document";
 	}
+	const { result, root } = verification;
+	if (!result.verified) return result.reason.type;
+	const rootId = root?.["@id"];
+	if (typeof rootId !== "string" || getCanonicalPortableId(parseIri(rootId)) !== expectedId) return "the verified document has another ID";
+	return null;
 }
+//#endregion
+//#region src/nodeinfo/handler.ts
 /**
-* An error that is thrown when an activity fails to send to a remote inbox.
-* It contains structured information about the failure, including the HTTP
-* status code, the inbox URL, and the response body.
-* @since 2.0.0
+* Handles a NodeInfo request.  You would not typically call this function
+* directly, but instead use {@link Federation.handle} method.
+* @param request The NodeInfo request to handle.
+* @param parameters The parameters for handling the request.
+* @returns The response to the request.
 */
-var SendActivityError = class extends Error {
-	/**
-	* The inbox URL that the activity was being sent to.
-	*/
-	inbox;
-	/**
-	* The HTTP status code returned by the inbox.
-	*/
-	statusCode;
-	/**
-	* The response body from the inbox, if any.  Note that this may be
-	* truncated to a maximum of 1 KiB to prevent excessive memory consumption
-	* when remote servers return large error pages (e.g., Cloudflare error pages).
-	* If truncated, the string will end with `"… (truncated)"`.
-	*/
-	responseBody;
-	/**
-	* The response headers from the inbox.
-	* @since 2.3.0
-	*/
-	responseHeaders;
-	/**
-	* Creates a new {@link SendActivityError}.
-	* @param inbox The inbox URL.
-	* @param statusCode The HTTP status code.
-	* @param message The error message.
-	* @param responseBody The response body.
-	* @param responseHeaders The response headers.
-	*/
-	constructor(inbox, statusCode, message, responseBody, responseHeaders) {
-		super(message);
-		this.name = "SendActivityError";
-		this.inbox = inbox;
-		this.statusCode = statusCode;
-		this.responseBody = responseBody;
-		this.responseHeaders = new Headers(responseHeaders);
+async function handleNodeInfo(_request, { context, nodeInfoDispatcher }) {
+	const promise = nodeInfoDispatcher(context);
+	const json = nodeInfoToJson(promise instanceof Promise ? await promise : promise);
+	return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\"" } });
+}
+/**
+* Handles a request to `/.well-known/nodeinfo`.  You would not typically call
+* this function directly, but instead use {@link Federation.handle} method.
+* @param request The request to handle.
+* @param context The request context.
+* @returns The response to the request.
+*/
+function handleNodeInfoJrd(_request, context) {
+	const links = [];
+	try {
+		links.push({
+			rel: "http://nodeinfo.diaspora.software/ns/schema/2.1",
+			href: context.getNodeInfoUri().href,
+			type: "application/json; profile=\"http://nodeinfo.diaspora.software/ns/schema/2.1#\""
+		});
+	} catch (e) {
+		if (!(e instanceof RouterError)) throw e;
 	}
-};
+	const response = new Response(JSON.stringify({ links }), { headers: { "Content-Type": "application/jrd+json" } });
+	return Promise.resolve(response);
+}
 //#endregion
 //#region src/federation/bench.ts
 /**
@@ -5044,417 +5493,115 @@ async function handleBenchmarkTrigger(request, context, options = {}) {
 		const recipients = await parseRecipients(body.recipients, context);
 		const activity = await parseActivity(body.activity, context);
 		if (activity.id == null) throw new BenchmarkTriggerError("activity must have an id.");
-		const activityId = activity.id.href;
-		const inboxes = extractInboxes({ recipients });
-		const inboxUrls = Object.keys(inboxes);
-		if (inboxUrls.length < 1) throw new BenchmarkTriggerError("No valid recipient inboxes found. The recipients list must not be empty.");
-		const unsafeInboxes = options.allowUnsafeRecipients ? [] : inboxUrls.filter((inbox) => !options.sinks?.has(inbox));
-		if (unsafeInboxes.length > 0) return jsonResponse({
-			error: "unsafe_recipient",
-			unsafeInboxes
-		}, 403);
-		await context.sendActivity(sender, recipients, activity);
-		return jsonResponse({
-			version: 1,
-			activityId,
-			queueCorrelationId: activityId,
-			recipientCount: recipients.length,
-			inboxCount: inboxUrls.length
-		}, 202);
-	} catch (error) {
-		if (error instanceof BenchmarkTriggerError) return jsonResponse({ error: error.message }, error.status);
-		throw error;
-	}
-}
-var BenchmarkTriggerError = class extends Error {
-	status;
-	constructor(message, status = 400) {
-		super(message);
-		this.status = status;
-	}
-};
-function parseSender(value) {
-	const sender = asRecord(value, "sender");
-	if (typeof sender.identifier === "string") return { identifier: sender.identifier };
-	if (typeof sender.username === "string") return { username: sender.username };
-	throw new BenchmarkTriggerError("sender must be { identifier } or { username }.");
-}
-async function parseRecipients(value, context) {
-	if (!Array.isArray(value)) throw new BenchmarkTriggerError("recipients must be an array.");
-	return await Promise.all(value.map(async (item) => {
-		let object;
-		try {
-			object = await Object$1.fromJsonLd(item, {
-				documentLoader: context.documentLoader,
-				contextLoader: context.contextLoader
-			});
-		} catch (error) {
-			throw new BenchmarkTriggerError(`Invalid ActivityPub recipient: ${error}`);
-		}
-		if (!isRecipient(object)) throw new BenchmarkTriggerError("each recipient must be an ActivityPub actor.");
-		const recipient = object;
-		if (recipient.id == null || recipient.inboxId == null) throw new BenchmarkTriggerError("each recipient must have id and inbox properties.");
-		return recipient;
-	}));
-}
-function isRecipient(value) {
-	return value != null && typeof value === "object" && "id" in value && "inboxId" in value;
-}
-async function parseActivity(value, context) {
-	try {
-		return await Activity.fromJsonLd(value, {
-			documentLoader: context.documentLoader,
-			contextLoader: context.contextLoader
-		});
-	} catch (error) {
-		throw new BenchmarkTriggerError(`Invalid ActivityPub activity: ${error}`);
-	}
-}
-function asRecord(value, name) {
-	if (value == null || typeof value !== "object" || Array.isArray(value)) throw new BenchmarkTriggerError(`${name} must be an object.`);
-	return value;
-}
-function jsonResponse(body, status = 200) {
-	return new Response(JSON.stringify(body), {
-		status,
-		headers: { "Content-Type": "application/json" }
-	});
-}
-function serializeScopeMetrics(resourceMetrics) {
-	return resourceMetrics.scopeMetrics.map(serializeScope);
-}
-function serializeScope(scopeMetrics) {
-	return {
-		scope: {
-			name: scopeMetrics.scope.name,
-			version: scopeMetrics.scope.version
-		},
-		metrics: scopeMetrics.metrics.map(serializeMetric)
-	};
-}
-function serializeMetric(metric) {
-	return {
-		name: metric.descriptor.name,
-		description: metric.descriptor.description,
-		unit: metric.descriptor.unit,
-		dataPointType: serializeDataPointType(metric.dataPointType),
-		dataPoints: metric.dataPoints.map((point) => ({
-			attributes: { ...point.attributes },
-			startTime: point.startTime,
-			endTime: point.endTime,
-			value: point.value
-		}))
-	};
-}
-function serializeDataPointType(dataPointType) {
-	switch (dataPointType) {
-		case DataPointType.HISTOGRAM: return "histogram";
-		case DataPointType.EXPONENTIAL_HISTOGRAM: return "exponential_histogram";
-		case DataPointType.GAUGE: return "gauge";
-		case DataPointType.SUM: return "sum";
-	}
-}
-//#endregion
-//#region src/federation/portable-inbox.ts
-const MAX_TIMEOUT_MS = 2 ** 31 - 1;
-/**
-* Fills in the defaults of {@link PortableInboxForwardingOptions} and
-* validates them.
-* @param options The options.
-* @returns The resolved options.
-* @throws {RangeError} If `maxTargets` is not a non-negative integer, if `ttl`
-*                      is not positive, if `deadline` is negative or longer
-*                      than 2,147,483,647 milliseconds (about 24.8 days), or
-*                      if either duration has calendar units, i.e., weeks,
-*                      months, or years, whose length depends on the date.
-*/
-function resolvePortableInboxForwardingOptions(options = {}) {
-	const maxTargets = options.maxTargets ?? 10;
-	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
-	const ttl = Temporal.Duration.from(options.ttl ?? { days: 30 });
-	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
-	const deadline = Temporal.Duration.from(options.deadline ?? { seconds: 10 });
-	const deadlineMs = deadline.total("millisecond");
-	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
-	return {
-		maxTargets,
-		ttl,
-		deadline
-	};
-}
-/**
-* Decides whether this server accepts a delivery to a portable inbox on behalf
-* of the given actor, which the actor dispatcher returned for the identifier
-* in the requested inbox path.
-*
-* The actor document comes from the application, so it is trusted as is and
-* its proof is not verified here.
-* @param actor The actor the actor dispatcher returned.
-* @param options The requested DID, the canonical form of the requested inbox
-*                ID, and the origin of this server.
-* @returns The resolution.
-*/
-function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, localOrigin }) {
-	if (actor == null) return {
-		status: "rejected",
-		reason: "notFound"
-	};
-	const id = actor.id;
-	const did = id == null || !isPortableId(id) ? null : getPortableDid(id);
-	if (id == null || did == null) return {
-		status: "rejected",
-		reason: "notPortable"
-	};
-	if (did !== authority) return {
-		status: "rejected",
-		reason: "authorityMismatch"
-	};
-	const inboxId = actor.inboxId == null ? null : toPortableUri(actor.inboxId);
-	if (inboxId == null || getCanonicalPortableId(inboxId) !== canonicalInboxId) return {
-		status: "rejected",
-		reason: "inboxMismatch"
-	};
-	const gateways = actor.gateways;
-	if (!gateways.some((g) => isGatewayUrl(g) && g.origin === localOrigin)) return {
-		status: "rejected",
-		reason: "notGateway"
-	};
-	return {
-		status: "accepted",
-		recipient: {
-			actorId: id,
-			inboxId,
-			canonicalInboxId,
-			gateways
-		}
-	};
-}
-/**
-* Gets the portable form of an `ap:` or `ap+ef61:` URI or a compatible
-* identifier, keeping its query.
-* @returns The portable URI, or `null` if the ID is neither, or is malformed.
-*/
-function toPortableUri(id) {
-	if (isPortableUri(id)) return id;
-	try {
-		return fromCompatibleEf61Id(id);
-	} catch (error) {
-		if (error instanceof TypeError) return null;
-		throw error;
-	}
-}
-/**
-* Forwards an activity received in a portable inbox to the inboxes of the same
-* portable actor on its other gateways, as FEP-ef61 recommends.
-*
-* FEP-ef61 forbids forwarding an activity from an inbox more than once, so
-* each target gateway is claimed with an atomic compare-and-swap before the
-* activity is handed off, and a claim is never released, even if the hand-off
-* fails, since a failed hand-off does not prove that nothing was delivered.
-* Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
-* forwarded.
-*
-* Forwarded requests are signed with HTTP Signatures by the RSA key among
-* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
-* servers requiring HTTP Signatures accept them, and are sent unsigned
-* otherwise.  Either way, the receiving gateways authenticate the activity by
-* its own proof.
-* @param parameters The parameters.
-* @returns The target inbox URLs that the activity was handed off to.
-*/
-async function forwardPortableInboxActivity(parameters) {
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
-	const { maxTargets, ttl } = parameters.options ?? resolvePortableInboxForwardingOptions();
-	if (kv.cas == null || maxTargets < 1) return [];
-	const canonicalActivityId = getCanonicalPortableId(activityId) ?? activityId.href;
-	const targets = getForwardingTargets(recipient, excludedOrigins);
-	if (targets.length > maxTargets) {
-		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
-			inbox: recipient.canonicalInboxId,
-			activityId: activityId.href,
-			max: maxTargets
-		});
-		targets.length = maxTargets;
+		const activityId = activity.id.href;
+		const inboxes = extractInboxes({ recipients });
+		const inboxUrls = Object.keys(inboxes);
+		if (inboxUrls.length < 1) throw new BenchmarkTriggerError("No valid recipient inboxes found. The recipients list must not be empty.");
+		const unsafeInboxes = options.allowUnsafeRecipients ? [] : inboxUrls.filter((inbox) => !options.sinks?.has(inbox));
+		if (unsafeInboxes.length > 0) return jsonResponse({
+			error: "unsafe_recipient",
+			unsafeInboxes
+		}, 403);
+		await context.sendActivity(sender, recipients, activity);
+		return jsonResponse({
+			version: 1,
+			activityId,
+			queueCorrelationId: activityId,
+			recipientCount: recipients.length,
+			inboxCount: inboxUrls.length
+		}, 202);
+	} catch (error) {
+		if (error instanceof BenchmarkTriggerError) return jsonResponse({ error: error.message }, error.status);
+		throw error;
 	}
-	const claimed = [];
-	for (const { gateway, inbox } of targets) {
-		const key = [
-			...kvPrefix,
-			recipient.canonicalInboxId,
-			canonicalActivityId,
-			gateway
-		];
-		if (await kv.cas(key, void 0, true, { ttl })) claimed.push(inbox);
+}
+var BenchmarkTriggerError = class extends Error {
+	status;
+	constructor(message, status = 400) {
+		super(message);
+		this.status = status;
 	}
-	if (claimed.length < 1) return [];
-	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
-		activityId: activityId.href,
-		inbox: recipient.canonicalInboxId,
-		targets: claimed.map((t) => t.href)
-	});
-	if (outboxQueue == null) await forwardImmediately(parameters, claimed);
-	else await enqueueForwarding(parameters, outboxQueue, claimed);
-	return claimed;
+};
+function parseSender(value) {
+	const sender = asRecord(value, "sender");
+	if (typeof sender.identifier === "string") return { identifier: sender.identifier };
+	if (typeof sender.username === "string") return { username: sender.username };
+	throw new BenchmarkTriggerError("sender must be { identifier } or { username }.");
 }
-function getForwardingTargets(recipient, excludedOrigins) {
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const seen = new Set(excludedOrigins);
-	const targets = [];
-	for (const gateway of recipient.gateways) {
-		if (!isGatewayUrl(gateway) || seen.has(gateway.origin)) continue;
-		seen.add(gateway.origin);
-		let inbox;
+async function parseRecipients(value, context) {
+	if (!Array.isArray(value)) throw new BenchmarkTriggerError("recipients must be an array.");
+	return await Promise.all(value.map(async (item) => {
+		let object;
 		try {
-			inbox = toCompatibleEf61Id(recipient.inboxId, gateway.origin);
-		} catch (error) {
-			if (!(error instanceof TypeError)) throw error;
-			logger.warn("Cannot forward to the gateway {gateway}, as the portable inbox {inbox} cannot be represented as its compatible identifier.", {
-				gateway: gateway.origin,
-				inbox: recipient.canonicalInboxId
+			object = await Object$1.fromJsonLd(item, {
+				documentLoader: context.documentLoader,
+				contextLoader: context.contextLoader
 			});
-			continue;
+		} catch (error) {
+			throw new BenchmarkTriggerError(`Invalid ActivityPub recipient: ${error}`);
 		}
-		targets.push({
-			gateway: gateway.origin,
-			inbox
-		});
-	}
-	return targets;
+		if (!isRecipient(object)) throw new BenchmarkTriggerError("each recipient must be an ActivityPub actor.");
+		const recipient = object;
+		if (recipient.id == null || recipient.inboxId == null) throw new BenchmarkTriggerError("each recipient must have id and inbox properties.");
+		return recipient;
+	}));
 }
-/**
-* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
-* key, as {@link sendActivity} signs requests only with such a key.  Since
-* the targets have already been claimed, the activity is forwarded unsigned
-* rather than not at all if the key cannot be resolved or used.
-*/
-async function resolveForwardingKey({ getKeys, activityId }) {
-	if (getKeys == null) return null;
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	let key;
+function isRecipient(value) {
+	return value != null && typeof value === "object" && "id" in value && "inboxId" in value;
+}
+async function parseActivity(value, context) {
 	try {
-		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
-	} catch (error) {
-		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			activityId: activityId.href,
-			error
+		return await Activity.fromJsonLd(value, {
+			documentLoader: context.documentLoader,
+			contextLoader: context.contextLoader
 		});
-		return null;
-	}
-	if (key == null) return null;
-	try {
-		validateCryptoKey(key.privateKey, "private");
 	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			keyId: key.keyId.href,
-			activityId: activityId.href,
-			error
-		});
-		return null;
+		throw new BenchmarkTriggerError(`Invalid ActivityPub activity: ${error}`);
 	}
-	return key;
 }
-async function forwardImmediately(parameters, inboxes) {
-	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, options, meterProvider, tracerProvider } = parameters;
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const deadline = (options ?? resolvePortableInboxForwardingOptions()).deadline.total("millisecond");
-	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
-		activity,
-		activityId: activityId.href,
-		activityType,
-		keys: key == null ? [] : [key],
-		inbox,
-		allowPrivateAddress,
-		specDeterminer,
-		meterProvider,
-		tracerProvider
-	}).catch((error) => {
-		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
-			activityId: activityId.href,
-			inbox: inbox.href,
-			error
-		});
-	}))));
-	let timer;
-	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
-		timer = setTimeout(() => resolve(true), deadline);
-	})]);
-	clearTimeout(timer);
-	if (timedOut) logger.warn("Forwarding activity {activityId} to other gateways did not finish in {deadline} ms; responding to the delivery without waiting for it.", {
-		activityId: activityId.href,
-		deadline
+function asRecord(value, name) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) throw new BenchmarkTriggerError(`${name} must be an object.`);
+	return value;
+}
+function jsonResponse(body, status = 200) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: { "Content-Type": "application/json" }
 	});
 }
-async function enqueueForwarding(parameters, outboxQueue, inboxes) {
-	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const key = await resolveForwardingKey(parameters);
-	const keys = [];
-	if (key != null) try {
-		keys.push({
-			keyId: key.keyId.href,
-			privateKey: await exportJwk(key.privateKey)
-		});
-	} catch (error) {
-		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			keyId: key.keyId.href,
-			activityId: activityId.href,
-			error
-		});
+function serializeScopeMetrics(resourceMetrics) {
+	return resourceMetrics.scopeMetrics.map(serializeScope);
+}
+function serializeScope(scopeMetrics) {
+	return {
+		scope: {
+			name: scopeMetrics.scope.name,
+			version: scopeMetrics.scope.version
+		},
+		metrics: scopeMetrics.metrics.map(serializeMetric)
+	};
+}
+function serializeMetric(metric) {
+	return {
+		name: metric.descriptor.name,
+		description: metric.descriptor.description,
+		unit: metric.descriptor.unit,
+		dataPointType: serializeDataPointType(metric.dataPointType),
+		dataPoints: metric.dataPoints.map((point) => ({
+			attributes: { ...point.attributes },
+			startTime: point.startTime,
+			endTime: point.endTime,
+			value: point.value
+		}))
+	};
+}
+function serializeDataPointType(dataPointType) {
+	switch (dataPointType) {
+		case DataPointType.HISTOGRAM: return "histogram";
+		case DataPointType.EXPONENTIAL_HISTOGRAM: return "exponential_histogram";
+		case DataPointType.GAUGE: return "gauge";
+		case DataPointType.SUM: return "sum";
 	}
-	startQueue?.();
-	const started = (/* @__PURE__ */ new Date()).toISOString();
-	const traceContext = {};
-	propagation.inject(context.active(), traceContext);
-	await Promise.all(inboxes.map(async (inbox) => {
-		const message = {
-			type: "outbox",
-			id: crypto.randomUUID(),
-			baseUrl,
-			keys,
-			activity,
-			activityId: activityId.href,
-			activityType,
-			inbox: inbox.href,
-			sharedInbox: false,
-			started,
-			attempt: 0,
-			headers: {},
-			traceContext
-		};
-		try {
-			await outboxQueue.enqueue(message);
-		} catch (error) {
-			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
-				activityId: activityId.href,
-				inbox: inbox.href,
-				error
-			});
-			return;
-		}
-		recordOutboxEnqueue(meterProvider, outboxQueue, message);
-	}));
 }
 //#endregion
 //#region src/federation/outgoing-proof.ts
@@ -8022,17 +8169,39 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 		}
 		const route = this.router.route(portable.path);
-		if (route == null || !route.name.startsWith("object:")) {
+		const isActor = route != null && (route.name === "actor" || route.name.startsWith("actorAlias:"));
+		if (route == null || !isActor && !route.name.startsWith("object:")) {
 			metricState.endpoint = "not_found";
 			return await onNotFound(request);
 		}
 		metricState.routeTemplate = PORTABLE_GATEWAY_ROUTE_PREFIX + route.template;
-		metricState.endpoint = "object";
+		metricState.endpoint = isActor ? "actor" : "object";
 		span.updateName(`${request.method} ${metricState.routeTemplate}`);
 		if (!acceptsJsonLd(request)) {
 			metricState.endpoint = "not_acceptable";
 			return await onNotAcceptable(request);
 		}
+		if (isActor) {
+			const identifier = route.name.startsWith("actorAlias:") ? route.name.substring(11) : route.values.identifier;
+			const context = this.#createContext(request, contextData, {
+				invokedFromActorDispatcher: { identifier },
+				portableRequest: portable.portableRequest
+			});
+			const actorDispatcher = this.actorCallbacks?.dispatcher;
+			const authorizePredicate = this.actorCallbacks?.authorizePredicate;
+			return await handlePortableObject(request, {
+				values: { identifier },
+				context,
+				objectDispatcher: actorDispatcher == null ? void 0 : async (ctx) => {
+					const actor = await actorDispatcher(ctx, identifier);
+					return actor instanceof Tombstone ? null : actor;
+				},
+				authorizePredicate: authorizePredicate == null ? void 0 : (ctx) => authorizePredicate(ctx, identifier),
+				canonicalId: portable.canonicalId,
+				onUnauthorized,
+				onNotFound
+			});
+		}
 		const typeId = route.name.replace(/^object:/, "");
 		const callbacks = this.objectCallbacks[typeId];
 		const cls = this.objectTypeIds[typeId];
@@ -8131,7 +8300,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			onNotFound,
 			portableInbox: {
 				recipient,
-				forward: async (activity, activityId, activityType) => {
+				forward: async (activity, activityId, activityType, signatures) => {
 					if (this.portableInboxForwarding.maxTargets < 1) return;
 					if (this.kv.cas == null) {
 						if (!this.#portableInboxForwardingWarned) {
@@ -8154,6 +8323,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 						allowPrivateAddress: this.allowPrivateAddress,
 						getKeys: () => this.#getPortableGatewayKeyPairs(context, identifier, recipient),
 						specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
+						signatures,
 						options: this.portableInboxForwarding,
 						meterProvider: this.meterProvider,
 						tracerProvider: this.tracerProvider
@@ -8395,9 +8565,17 @@ var ContextImpl = class ContextImpl {
 		return new URL(path, this.canonicalOrigin);
 	}
 	getActorUri(identifier) {
+		return new URL(this.#getActorPath(identifier), this.canonicalOrigin);
+	}
+	getPortableActorUri(identifier, authority) {
+		const path = this.#getActorPath(identifier);
+		if (authority == null) throw new TypeError("The authority of a portable ID is required outside an FEP-ef61 gateway request.");
+		return buildPortableUri(authority, path);
+	}
+	#getActorPath(identifier) {
 		const path = this.federation.router.build(`actorAlias:${identifier}`, {}) ?? this.federation.router.build("actor", { identifier });
 		if (path == null) throw new RouterError("No actor dispatcher registered.");
-		return new URL(path, this.canonicalOrigin);
+		return path;
 	}
 	getObjectUri(cls, values) {
 		return new URL(this.#getObjectPath(cls, values), this.canonicalOrigin);
@@ -9040,6 +9218,9 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 			request: this.request
 		});
 	}
+	getPortableActorUri(identifier, authority) {
+		return super.getPortableActorUri(identifier, authority ?? this.portableRequest?.authority);
+	}
 	getPortableObjectUri(cls, values, authority) {
 		return super.getPortableObjectUri(cls, values, authority ?? this.portableRequest?.authority);
 	}
@@ -9436,4 +9617,4 @@ function getRequestId(request) {
 	return `req_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
 }
 //#endregion
-export { respondWithObject as a, digest as c, parseCircuitBreakerKvState as d, createFederationBuilder as f, SendActivityError as i, CircuitBreaker as l, handleWebFinger as n, respondWithObjectIfAcceptable as o, createExponentialBackoffPolicy as r, buildCollectionSynchronizationHeader as s, createFederation as t, normalizeCircuitBreakerOptions as u };
+export { respondWithObjectIfAcceptable as a, digest as c, parseCircuitBreakerKvState as d, createFederationBuilder as f, respondWithObject as i, CircuitBreaker as l, handleWebFinger as n, SendActivityError as o, createExponentialBackoffPolicy as r, buildCollectionSynchronizationHeader as s, createFederation as t, normalizeCircuitBreakerOptions as u };