@fedify/fedify 2.4.0-dev.2093 → 2.4.0-dev.2103

package/dist/{middleware-E_0IH72m.mjs → middleware-FnITXhtz.mjs}

@@ -1,28 +1,28 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-8t8k_6Yv.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-B7YwKTFr.mjs";
+import { n as version, t as name } from "./deno-CkjiYK_Z.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-BCAa5-kE.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
 import { a as isCompatibleKeyId, c as isPortableUri, i as hasPortableActor, n as getGatewayKeyBase, r as getPortableDid, s as isPortableId, t as getCanonicalPortableId } from "./portable-key-id-Bva5iT3W.mjs";
-import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-Dwm4VswT.mjs";
+import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-I8gLBkcf.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-BYZOoDzZ.mjs";
-import { i as signObject, l as verifyPortableObjectProofWithRoot, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, t as InvalidPortableObjectIdError } from "./proof-DVXC6nYz.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-B2ftY0Ha.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-DJKcsAiF.mjs";
-import { n as kvCache } from "./kv-cache-D0yYukqk.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-wiJbqJHa.mjs";
+import { i as signObject, l as verifyPortableObjectProofWithRoot, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, t as InvalidPortableObjectIdError } from "./proof-BE4T5zF6.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-BU-8fUrz.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-C1hAJnWc.mjs";
+import { n as kvCache } from "./kv-cache-DJFoGRWQ.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-DpnpgjyX.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-Cgx2Dc7I.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-D-hOvYKy.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-Ld4Y9ymR.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-BJp47LxN.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-BFITuKHw.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-CHht75pX.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-C5NqoLBJ.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-CTx_lewQ.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-DKKH_Nr1.mjs";
 import { t as KvKeyCache } from "./keycache-BUDHB5rY.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-CqpKGEPk.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-CyDDbE4i.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -522,6 +522,8 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 const PORTABLE_OBJECT_CONTENT_TYPE = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"";
 const GATEWAY_OBJECT_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
 const BARE_DID_PATTERN = /^did:[a-z0-9]+:[^/?#]+$/i;
+const DID_KEY_PREFIX = "did:key:";
+const BASE58BTC_MULTIBASE_PATTERN = /^z[1-9A-HJ-NP-Za-km-z]+$/;
 const GATEWAY_PATH_PREFIX = "/.well-known/apgateway/";
 const HASHLINK_SCHEME_PATTERN = /^hl(?::|%3A)/i;
 /**
@@ -557,6 +559,15 @@ function parsePortableGatewayRequest(url) {
 		throw error;
 	}
 	const authority = getFe34Origin(id);
+	try {
+		assertBase58BtcDidKey(authority);
+	} catch (error) {
+		if (error instanceof TypeError) return {
+			type: "malformed",
+			error
+		};
+		throw error;
+	}
 	const href = id.href;
 	return {
 		type: "object",
@@ -575,12 +586,26 @@ function parsePortableGatewayRequest(url) {
 * @param authority The bare DID, e.g., `did:key:z6Mk...`.
 * @param path The object path, e.g., `/notes/123`.
 * @returns The portable ID.
-* @throws {TypeError} If the authority is not a bare DID.
+* @throws {TypeError} If the authority is not a bare DID, or it is
+*                     a `did:key` DID that is not encoded in base58-btc.
 */
 function buildPortableUri(authority, path) {
 	if (typeof authority !== "string" || !BARE_DID_PATTERN.test(authority)) throw new TypeError("The authority of a portable ID must be a DID without a path, query, or fragment.");
-	getFe34Origin(authority);
-	return parseIri(`ap+ef61://${authority}${path}`);
+	const did = getFe34Origin(authority);
+	assertBase58BtcDidKey(did);
+	return parseIri(`ap+ef61://${did}${path}`);
+}
+/**
+* Checks that a normalized DID, if it is a `did:key` DID, is encoded in
+* base58-btc, as FEP-ef61 requires so that the same key does not yield two
+* portable IDs.  This only checks the encoding, not whether the DID is
+* a valid key.
+* @param did The DID normalized by `getFe34Origin()`.
+* @throws {TypeError} If the DID is a `did:key` DID that is not encoded in
+*                     base58-btc.
+*/
+function assertBase58BtcDidKey(did) {
+	if (did.startsWith(DID_KEY_PREFIX) && !BASE58BTC_MULTIBASE_PATTERN.test(did.slice(8))) throw new TypeError("The did:key authority of a portable ID must be encoded in base58-btc, i.e., start with z.");
 }
 /**
 * Recognizes an FEP-ef61 gateway request for a resource addressed by
@@ -632,6 +657,415 @@ function parseHashlinkGatewayRequest(url) {
 	};
 }
 //#endregion
+//#region src/federation/portable-inbox.ts
+const MAX_TIMEOUT_MS = 2 ** 31 - 1;
+/**
+* Fills in the defaults of {@link PortableInboxForwardingOptions} and
+* validates them.
+* @param options The options.
+* @returns The resolved options.
+* @throws {RangeError} If `maxTargets` is not a non-negative integer, if `ttl`
+*                      is not positive, if `deadline` is negative or longer
+*                      than 2,147,483,647 milliseconds (about 24.8 days), or
+*                      if either duration has calendar units, i.e., weeks,
+*                      months, or years, whose length depends on the date.
+*/
+function resolvePortableInboxForwardingOptions(options = {}) {
+	const maxTargets = options.maxTargets ?? 10;
+	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
+	const ttl = Temporal.Duration.from(options.ttl ?? { days: 30 });
+	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
+	const deadline = Temporal.Duration.from(options.deadline ?? { seconds: 10 });
+	const deadlineMs = deadline.total("millisecond");
+	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
+	return {
+		maxTargets,
+		ttl,
+		deadline
+	};
+}
+/**
+* Decides whether this server accepts a delivery to a portable inbox on behalf
+* of the given actor, which the actor dispatcher returned for the identifier
+* in the requested inbox path.
+*
+* The actor document comes from the application, so it is trusted as is and
+* its proof is not verified here.
+* @param actor The actor the actor dispatcher returned.
+* @param options The requested DID, the canonical form of the requested inbox
+*                ID, and the origin of this server.
+* @returns The resolution.
+*/
+function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, localOrigin }) {
+	if (actor == null) return {
+		status: "rejected",
+		reason: "notFound"
+	};
+	const id = actor.id;
+	const did = id == null || !isPortableId(id) ? null : getPortableDid(id);
+	if (id == null || did == null) return {
+		status: "rejected",
+		reason: "notPortable"
+	};
+	if (did !== authority) return {
+		status: "rejected",
+		reason: "authorityMismatch"
+	};
+	const inboxId = actor.inboxId == null ? null : toPortableUri(actor.inboxId);
+	if (inboxId == null || getCanonicalPortableId(inboxId) !== canonicalInboxId) return {
+		status: "rejected",
+		reason: "inboxMismatch"
+	};
+	const gateways = actor.gateways;
+	if (!gateways.some((g) => isGatewayUrl(g) && g.origin === localOrigin)) return {
+		status: "rejected",
+		reason: "notGateway"
+	};
+	return {
+		status: "accepted",
+		recipient: {
+			actorId: id,
+			inboxId,
+			canonicalInboxId,
+			gateways
+		}
+	};
+}
+/**
+* Gets the portable form of an `ap:` or `ap+ef61:` URI or a compatible
+* identifier, keeping its query.
+* @returns The portable URI, or `null` if the ID is neither, or is malformed.
+*/
+function toPortableUri(id) {
+	if (isPortableUri(id)) return id;
+	try {
+		return fromCompatibleEf61Id(id);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+const RFC9421_DELIVERY_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"content-digest"
+];
+const DRAFT_DELIVERY_COMPONENTS = [
+	"(request-target)",
+	"host",
+	"digest"
+];
+/**
+* Checks whether an HTTP Signature covers the method, the target URI, and the
+* body of a request, which both Fedify and Mitra sign when forwarding.
+* @param signature The signature.
+* @returns `true` if the signature covers them.
+*/
+function coversDelivery(signature) {
+	return (signature.label == null ? DRAFT_DELIVERY_COMPONENTS : RFC9421_DELIVERY_COMPONENTS).every((name) => signature.components.some((c) => c.value === name && Object.keys(c.params).length < 1));
+}
+/**
+* Forwards an activity received in a portable inbox to the inboxes of the same
+* portable actor on its other gateways, as FEP-ef61 recommends.
+*
+* FEP-ef61 forbids forwarding an activity from an inbox more than once, so
+* each target gateway is claimed with an atomic compare-and-swap before the
+* activity is handed off, and a claim is never released, even if the hand-off
+* fails, since a failed hand-off does not prove that nothing was delivered.
+* Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
+* forwarded.
+*
+* Forwarded requests are signed with HTTP Signatures by the RSA key among
+* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
+* servers requiring HTTP Signatures accept them, and are sent unsigned
+* otherwise.  Either way, the receiving gateways authenticate the activity by
+* its own proof.
+*
+* If the delivery is signed with a gateway key of the recipient by one of its
+* other gateways, that gateway has the activity already, so it is claimed
+* without forwarding the activity to it.  See {@link identifySendingGateway}.
+* @param parameters The parameters.
+* @returns The target inbox URLs that the activity was handed off to.
+*/
+async function forwardPortableInboxActivity(parameters) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
+	const options = parameters.options ?? resolvePortableInboxForwardingOptions();
+	const { maxTargets, ttl } = options;
+	if (kv.cas == null || maxTargets < 1) return [];
+	const deadline = Date.now() + options.deadline.total("millisecond");
+	const canonicalActivityId = getCanonicalPortableId(activityId) ?? activityId.href;
+	const claimKey = (gateway) => [
+		...kvPrefix,
+		recipient.canonicalInboxId,
+		canonicalActivityId,
+		gateway
+	];
+	let targets = getForwardingTargets(recipient, excludedOrigins);
+	const sender = await identifySendingGateway(parameters, targets.map((t) => t.gateway), claimKey, deadline);
+	if (sender != null) {
+		logger.debug("Not forwarding activity {activityId} from the portable inbox {inbox} back to the gateway {gateway}, which delivered it.", {
+			activityId: activityId.href,
+			inbox: recipient.canonicalInboxId,
+			gateway: sender
+		});
+		await kv.cas(claimKey(sender), void 0, true, { ttl });
+		targets = targets.filter((t) => t.gateway !== sender);
+	}
+	if (targets.length > maxTargets) {
+		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
+			inbox: recipient.canonicalInboxId,
+			activityId: activityId.href,
+			max: maxTargets
+		});
+		targets.length = maxTargets;
+	}
+	const claimed = [];
+	for (const { gateway, inbox } of targets) if (await kv.cas(claimKey(gateway), void 0, true, { ttl })) claimed.push(inbox);
+	if (claimed.length < 1) return [];
+	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		targets: claimed.map((t) => t.href)
+	});
+	if (outboxQueue == null) await forwardImmediately(parameters, claimed, deadline);
+	else await enqueueForwarding(parameters, outboxQueue, claimed);
+	return claimed;
+}
+/**
+* Identifies the gateway of the recipient that forwarded a delivery to its
+* portable inbox, by the delivery's HTTP Signature made with the recipient's
+* gateway key, which FEP-ef61 has each gateway use for requests on behalf of
+* an actor.  Since the activity is authenticated by its own proof, the
+* signature only tells which gateway to skip, and a delivery whose signature
+* is invalid or cannot be verified is still forwarded to every gateway.
+*
+* Verifying the signature fetches the recipient's actor document from the
+* sending gateway, as gateway keys are not cached, so only the first signature
+* that may save a request is verified: one that covers the delivery and names
+* a gateway key of the recipient on one of the forwarding targets that the
+* activity has not been forwarded to yet.
+* @param parameters The forwarding parameters.
+* @param targets The origins of the gateways to forward to.
+* @param claimKey Gets the key of the claim for a gateway.
+* @param deadline The time by which identification has to finish, in
+*                 milliseconds since the epoch; afterwards, the sending
+*                 gateway is left unidentified.
+* @returns The origin of the sending gateway, or `null` if it is not
+*          identified.
+*/
+async function identifySendingGateway({ recipient, activityId, kv, signatures }, targets, claimKey, deadline) {
+	if (signatures == null || signatures.length < 1) return null;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const actorId = getCanonicalPortableId(recipient.actorId);
+	if (actorId == null) return null;
+	const isGatewayKeyOfRecipient = (keyId) => {
+		if (!isCompatibleKeyId(keyId) || !targets.includes(keyId.origin)) return false;
+		const base = new URL(keyId.href);
+		base.hash = "";
+		return getCanonicalPortableId(base) === actorId;
+	};
+	let signature;
+	for (const candidate of signatures) if (candidate.coversDelivery && isGatewayKeyOfRecipient(candidate.keyId) && await kv.get(claimKey(candidate.keyId.origin)) === void 0) {
+		signature = candidate;
+		break;
+	}
+	if (signature == null) return null;
+	const { keyId } = signature;
+	const logProperties = {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		keyId: keyId.href
+	};
+	const verification = Promise.resolve().then(() => signature.verify()).then((key) => {
+		if (key == null) logger.debug("The HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} is not verified with the key {keyId}; forwarding it without identifying the sending gateway.", logProperties);
+		return key;
+	}, (error) => {
+		logger.debug("Failed to verify the HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} with the key {keyId}; forwarding it without identifying the sending gateway:\n{error}", {
+			...logProperties,
+			error
+		});
+		return null;
+	});
+	let timer;
+	const key = await Promise.race([verification, new Promise((resolve) => {
+		timer = setTimeout(() => {
+			logger.debug("Verifying the HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} did not finish in time; forwarding it without identifying the sending gateway.", logProperties);
+			resolve(null);
+		}, Math.max(0, deadline - Date.now()));
+	})]);
+	clearTimeout(timer);
+	if (key == null) return null;
+	if (key.id == null || key.id.href !== keyId.href || !isGatewayKeyOfRecipient(key.id) || key.ownerId == null || !isPortableId(key.ownerId) || getCanonicalPortableId(key.ownerId) !== actorId) {
+		logger.debug("The delivery of activity {activityId} to the portable inbox {inbox} is not signed with a gateway key of the recipient; forwarding it without identifying the sending gateway.", logProperties);
+		return null;
+	}
+	return key.id.origin;
+}
+function getForwardingTargets(recipient, excludedOrigins) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const seen = new Set(excludedOrigins);
+	const targets = [];
+	for (const gateway of recipient.gateways) {
+		if (!isGatewayUrl(gateway) || seen.has(gateway.origin)) continue;
+		seen.add(gateway.origin);
+		let inbox;
+		try {
+			inbox = toCompatibleEf61Id(recipient.inboxId, gateway.origin);
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			logger.warn("Cannot forward to the gateway {gateway}, as the portable inbox {inbox} cannot be represented as its compatible identifier.", {
+				gateway: gateway.origin,
+				inbox: recipient.canonicalInboxId
+			});
+			continue;
+		}
+		targets.push({
+			gateway: gateway.origin,
+			inbox
+		});
+	}
+	return targets;
+}
+/**
+* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
+* key, as {@link sendActivity} signs requests only with such a key.  Since
+* the targets have already been claimed, the activity is forwarded unsigned
+* rather than not at all if the key cannot be resolved or used.
+*/
+async function resolveForwardingKey({ getKeys, activityId }) {
+	if (getKeys == null) return null;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	let key;
+	try {
+		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
+	} catch (error) {
+		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	if (key == null) return null;
+	try {
+		validateCryptoKey(key.privateKey, "private");
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	return key;
+}
+async function forwardImmediately(parameters, inboxes, deadlineAt) {
+	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, meterProvider, tracerProvider } = parameters;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const deadline = Math.max(0, deadlineAt - Date.now());
+	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
+		activity,
+		activityId: activityId.href,
+		activityType,
+		keys: key == null ? [] : [key],
+		inbox,
+		allowPrivateAddress,
+		specDeterminer,
+		meterProvider,
+		tracerProvider
+	}).catch((error) => {
+		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+			activityId: activityId.href,
+			inbox: inbox.href,
+			error
+		});
+	}))));
+	let timer;
+	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
+		timer = setTimeout(() => resolve(true), deadline);
+	})]);
+	clearTimeout(timer);
+	if (timedOut) logger.warn("Forwarding activity {activityId} to other gateways did not finish in {deadline} ms; responding to the delivery without waiting for it.", {
+		activityId: activityId.href,
+		deadline
+	});
+}
+async function enqueueForwarding(parameters, outboxQueue, inboxes) {
+	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const key = await resolveForwardingKey(parameters);
+	const keys = [];
+	if (key != null) try {
+		keys.push({
+			keyId: key.keyId.href,
+			privateKey: await exportJwk(key.privateKey)
+		});
+	} catch (error) {
+		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+	}
+	startQueue?.();
+	const started = (/* @__PURE__ */ new Date()).toISOString();
+	const traceContext = {};
+	propagation.inject(context.active(), traceContext);
+	await Promise.all(inboxes.map(async (inbox) => {
+		const message = {
+			type: "outbox",
+			id: crypto.randomUUID(),
+			baseUrl,
+			keys,
+			activity,
+			activityId: activityId.href,
+			activityType,
+			inbox: inbox.href,
+			sharedInbox: false,
+			started,
+			attempt: 0,
+			headers: {},
+			traceContext
+		};
+		try {
+			await outboxQueue.enqueue(message);
+		} catch (error) {
+			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+				activityId: activityId.href,
+				inbox: inbox.href,
+				error
+			});
+			return;
+		}
+		recordOutboxEnqueue(meterProvider, outboxQueue, message);
+	}));
+}
+//#endregion
 //#region src/federation/handler.ts
 const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
 const INBOX_COMPOUND_PROOF_LIMITS = {
@@ -729,8 +1163,9 @@ async function handleObject(request, { values, context, objectDispatcher, author
 }
 /**
 * Handles an FEP-ef61 gateway request for a portable object through an object
-* dispatcher.  The object is served only if its ID canonically matches the
-* requested portable ID and it satisfies the FEP-ef61 proof policy.
+* dispatcher, or the actor dispatcher adapted to one.  The object is served
+* only if its ID canonically matches the requested portable ID and it
+* satisfies the FEP-ef61 proof policy.
 * @template TContextData The context data to pass to the context.
 * @param request The HTTP request.
 * @param parameters The parameters for handling the portable object.
@@ -1970,7 +2405,21 @@ async function handleInboxInternal(request, parameters, span) {
 		inbox: portableInbox.recipient.canonicalInboxId
 	});
 	else try {
-		await portableInbox.forward(json, activity.id, getTypeId(activity).href);
+		await portableInbox.forward(json, activity.id, getTypeId(activity).href, listRequestSignatures(request).map((signature) => ({
+			keyId: signature.keyId,
+			coversDelivery: coversDelivery(signature),
+			verify: async () => {
+				const verification = await verifyRequestDetailed(selectRequestSignature(request, signature), {
+					contextLoader: ctx.contextLoader,
+					documentLoader: ctx.documentLoader,
+					timeWindow: signatureTimeWindow,
+					keyCache,
+					meterProvider,
+					tracerProvider
+				});
+				return verification.verified ? verification.key : null;
+			}
+		})));
 	} catch (error) {
 		logger.error("Failed to forward activity {activityId} to the other gateways of the portable inbox {inbox}:\n{error}", {
 			activityId: activity.id.href,
@@ -2603,363 +3052,61 @@ async function buildAcceptSignatureHeader(policy, kv, noncePrefix) {
 async function setKey(kv, key, policy) {
 	const seconds = policy.nonceTtlSeconds ?? 300;
 	const ttl = Temporal.Duration.from({ seconds });
-	await kv.set(key, true, { ttl });
-}
-const DEF_COMPONENTS = [
-	"@method",
-	"@target-uri",
-	"@authority",
-	"content-digest"
-];
-const MIN_COMPONENTS = [
-	"@method",
-	"@target-uri",
-	"@authority"
-];
-/**
-* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
-* portable actor, i.e., its ID is a compatible identifier and it is owned by
-* a portable actor, which only the portable actor's signed document can
-* establish.
-*/
-function isPortableGatewayKey(key) {
-	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
-}
-/**
-* Checks whether an activity needs an Object Integrity Proof by its DID:
-* either it is performed by an [FEP-ef61] portable actor, or its own ID is
-* portable.  Both `ap:` URIs and compatible identifiers count as portable.
-*
-* [FEP-ef61]: https://w3id.org/fep/ef61
-*/
-function isPortableActivity(activity) {
-	return hasPortableActor(activity) || activity.id != null && isPortableId(activity.id);
-}
-/**
-* Verifies that a portable activity's own ID belongs to the DID that signed
-* it, on the JSON-LD document received.  The ID the proof policy checks has
-* to be the parsed activity's ID, so that a remote context that changes
-* between loads cannot make the two name different objects.
-* @returns `null` if the ID is verified, or the reason why it is not.
-*/
-async function verifyPortableActivityId(activityId, jsonLd, options) {
-	const expectedId = getCanonicalPortableId(activityId);
-	if (expectedId == null) return "malformed portable ID";
-	let verification;
-	try {
-		verification = await verifyPortableObjectProofWithRoot(jsonLd, options);
-	} catch (error) {
-		if (error instanceof InvalidPortableObjectIdError) return "malformed portable ID";
-		if (!isPermanentActivityParseError(error)) throw error;
-		return "malformed document";
-	}
-	const { result, root } = verification;
-	if (!result.verified) return result.reason.type;
-	const rootId = root?.["@id"];
-	if (typeof rootId !== "string" || getCanonicalPortableId(parseIri(rootId)) !== expectedId) return "the verified document has another ID";
-	return null;
-}
-//#endregion
-//#region src/federation/portable-inbox.ts
-const MAX_TIMEOUT_MS = 2 ** 31 - 1;
-/**
-* Fills in the defaults of {@link PortableInboxForwardingOptions} and
-* validates them.
-* @param options The options.
-* @returns The resolved options.
-* @throws {RangeError} If `maxTargets` is not a non-negative integer, if `ttl`
-*                      is not positive, if `deadline` is negative or longer
-*                      than 2,147,483,647 milliseconds (about 24.8 days), or
-*                      if either duration has calendar units, i.e., weeks,
-*                      months, or years, whose length depends on the date.
-*/
-function resolvePortableInboxForwardingOptions(options = {}) {
-	const maxTargets = options.maxTargets ?? 10;
-	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
-	const ttl = Temporal.Duration.from(options.ttl ?? { days: 30 });
-	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
-	const deadline = Temporal.Duration.from(options.deadline ?? { seconds: 10 });
-	const deadlineMs = deadline.total("millisecond");
-	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
-	return {
-		maxTargets,
-		ttl,
-		deadline
-	};
-}
-/**
-* Decides whether this server accepts a delivery to a portable inbox on behalf
-* of the given actor, which the actor dispatcher returned for the identifier
-* in the requested inbox path.
-*
-* The actor document comes from the application, so it is trusted as is and
-* its proof is not verified here.
-* @param actor The actor the actor dispatcher returned.
-* @param options The requested DID, the canonical form of the requested inbox
-*                ID, and the origin of this server.
-* @returns The resolution.
-*/
-function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, localOrigin }) {
-	if (actor == null) return {
-		status: "rejected",
-		reason: "notFound"
-	};
-	const id = actor.id;
-	const did = id == null || !isPortableId(id) ? null : getPortableDid(id);
-	if (id == null || did == null) return {
-		status: "rejected",
-		reason: "notPortable"
-	};
-	if (did !== authority) return {
-		status: "rejected",
-		reason: "authorityMismatch"
-	};
-	const inboxId = actor.inboxId == null ? null : toPortableUri(actor.inboxId);
-	if (inboxId == null || getCanonicalPortableId(inboxId) !== canonicalInboxId) return {
-		status: "rejected",
-		reason: "inboxMismatch"
-	};
-	const gateways = actor.gateways;
-	if (!gateways.some((g) => isGatewayUrl(g) && g.origin === localOrigin)) return {
-		status: "rejected",
-		reason: "notGateway"
-	};
-	return {
-		status: "accepted",
-		recipient: {
-			actorId: id,
-			inboxId,
-			canonicalInboxId,
-			gateways
-		}
-	};
+	await kv.set(key, true, { ttl });
 }
+const DEF_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"@authority",
+	"content-digest"
+];
+const MIN_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"@authority"
+];
 /**
-* Gets the portable form of an `ap:` or `ap+ef61:` URI or a compatible
-* identifier, keeping its query.
-* @returns The portable URI, or `null` if the ID is neither, or is malformed.
+* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
+* portable actor, i.e., its ID is a compatible identifier and it is owned by
+* a portable actor, which only the portable actor's signed document can
+* establish.
 */
-function toPortableUri(id) {
-	if (isPortableUri(id)) return id;
-	try {
-		return fromCompatibleEf61Id(id);
-	} catch (error) {
-		if (error instanceof TypeError) return null;
-		throw error;
-	}
+function isPortableGatewayKey(key) {
+	return key?.id != null && isCompatibleKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
 }
 /**
-* Forwards an activity received in a portable inbox to the inboxes of the same
-* portable actor on its other gateways, as FEP-ef61 recommends.
-*
-* FEP-ef61 forbids forwarding an activity from an inbox more than once, so
-* each target gateway is claimed with an atomic compare-and-swap before the
-* activity is handed off, and a claim is never released, even if the hand-off
-* fails, since a failed hand-off does not prove that nothing was delivered.
-* Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
-* forwarded.
+* Checks whether an activity needs an Object Integrity Proof by its DID:
+* either it is performed by an [FEP-ef61] portable actor, or its own ID is
+* portable.  Both `ap:` URIs and compatible identifiers count as portable.
 *
-* Forwarded requests are signed with HTTP Signatures by the RSA key among
-* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
-* servers requiring HTTP Signatures accept them, and are sent unsigned
-* otherwise.  Either way, the receiving gateways authenticate the activity by
-* its own proof.
-* @param parameters The parameters.
-* @returns The target inbox URLs that the activity was handed off to.
+* [FEP-ef61]: https://w3id.org/fep/ef61
 */
-async function forwardPortableInboxActivity(parameters) {
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
-	const { maxTargets, ttl } = parameters.options ?? resolvePortableInboxForwardingOptions();
-	if (kv.cas == null || maxTargets < 1) return [];
-	const canonicalActivityId = getCanonicalPortableId(activityId) ?? activityId.href;
-	const targets = getForwardingTargets(recipient, excludedOrigins);
-	if (targets.length > maxTargets) {
-		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
-			inbox: recipient.canonicalInboxId,
-			activityId: activityId.href,
-			max: maxTargets
-		});
-		targets.length = maxTargets;
-	}
-	const claimed = [];
-	for (const { gateway, inbox } of targets) {
-		const key = [
-			...kvPrefix,
-			recipient.canonicalInboxId,
-			canonicalActivityId,
-			gateway
-		];
-		if (await kv.cas(key, void 0, true, { ttl })) claimed.push(inbox);
-	}
-	if (claimed.length < 1) return [];
-	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
-		activityId: activityId.href,
-		inbox: recipient.canonicalInboxId,
-		targets: claimed.map((t) => t.href)
-	});
-	if (outboxQueue == null) await forwardImmediately(parameters, claimed);
-	else await enqueueForwarding(parameters, outboxQueue, claimed);
-	return claimed;
-}
-function getForwardingTargets(recipient, excludedOrigins) {
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const seen = new Set(excludedOrigins);
-	const targets = [];
-	for (const gateway of recipient.gateways) {
-		if (!isGatewayUrl(gateway) || seen.has(gateway.origin)) continue;
-		seen.add(gateway.origin);
-		let inbox;
-		try {
-			inbox = toCompatibleEf61Id(recipient.inboxId, gateway.origin);
-		} catch (error) {
-			if (!(error instanceof TypeError)) throw error;
-			logger.warn("Cannot forward to the gateway {gateway}, as the portable inbox {inbox} cannot be represented as its compatible identifier.", {
-				gateway: gateway.origin,
-				inbox: recipient.canonicalInboxId
-			});
-			continue;
-		}
-		targets.push({
-			gateway: gateway.origin,
-			inbox
-		});
-	}
-	return targets;
+function isPortableActivity(activity) {
+	return hasPortableActor(activity) || activity.id != null && isPortableId(activity.id);
 }
 /**
-* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
-* key, as {@link sendActivity} signs requests only with such a key.  Since
-* the targets have already been claimed, the activity is forwarded unsigned
-* rather than not at all if the key cannot be resolved or used.
+* Verifies that a portable activity's own ID belongs to the DID that signed
+* it, on the JSON-LD document received.  The ID the proof policy checks has
+* to be the parsed activity's ID, so that a remote context that changes
+* between loads cannot make the two name different objects.
+* @returns `null` if the ID is verified, or the reason why it is not.
 */
-async function resolveForwardingKey({ getKeys, activityId }) {
-	if (getKeys == null) return null;
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	let key;
-	try {
-		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
-	} catch (error) {
-		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			activityId: activityId.href,
-			error
-		});
-		return null;
-	}
-	if (key == null) return null;
+async function verifyPortableActivityId(activityId, jsonLd, options) {
+	const expectedId = getCanonicalPortableId(activityId);
+	if (expectedId == null) return "malformed portable ID";
+	let verification;
 	try {
-		validateCryptoKey(key.privateKey, "private");
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			keyId: key.keyId.href,
-			activityId: activityId.href,
-			error
-		});
-		return null;
-	}
-	return key;
-}
-async function forwardImmediately(parameters, inboxes) {
-	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, options, meterProvider, tracerProvider } = parameters;
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const deadline = (options ?? resolvePortableInboxForwardingOptions()).deadline.total("millisecond");
-	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
-		activity,
-		activityId: activityId.href,
-		activityType,
-		keys: key == null ? [] : [key],
-		inbox,
-		allowPrivateAddress,
-		specDeterminer,
-		meterProvider,
-		tracerProvider
-	}).catch((error) => {
-		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
-			activityId: activityId.href,
-			inbox: inbox.href,
-			error
-		});
-	}))));
-	let timer;
-	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
-		timer = setTimeout(() => resolve(true), deadline);
-	})]);
-	clearTimeout(timer);
-	if (timedOut) logger.warn("Forwarding activity {activityId} to other gateways did not finish in {deadline} ms; responding to the delivery without waiting for it.", {
-		activityId: activityId.href,
-		deadline
-	});
-}
-async function enqueueForwarding(parameters, outboxQueue, inboxes) {
-	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
-	const logger = getLogger([
-		"fedify",
-		"federation",
-		"inbox"
-	]);
-	const key = await resolveForwardingKey(parameters);
-	const keys = [];
-	if (key != null) try {
-		keys.push({
-			keyId: key.keyId.href,
-			privateKey: await exportJwk(key.privateKey)
-		});
+		verification = await verifyPortableObjectProofWithRoot(jsonLd, options);
 	} catch (error) {
-		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
-			keyId: key.keyId.href,
-			activityId: activityId.href,
-			error
-		});
+		if (error instanceof InvalidPortableObjectIdError) return "malformed portable ID";
+		if (!isPermanentActivityParseError(error)) throw error;
+		return "malformed document";
 	}
-	startQueue?.();
-	const started = (/* @__PURE__ */ new Date()).toISOString();
-	const traceContext = {};
-	propagation.inject(context.active(), traceContext);
-	await Promise.all(inboxes.map(async (inbox) => {
-		const message = {
-			type: "outbox",
-			id: crypto.randomUUID(),
-			baseUrl,
-			keys,
-			activity,
-			activityId: activityId.href,
-			activityType,
-			inbox: inbox.href,
-			sharedInbox: false,
-			started,
-			attempt: 0,
-			headers: {},
-			traceContext
-		};
-		try {
-			await outboxQueue.enqueue(message);
-		} catch (error) {
-			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
-				activityId: activityId.href,
-				inbox: inbox.href,
-				error
-			});
-			return;
-		}
-		recordOutboxEnqueue(meterProvider, outboxQueue, message);
-	}));
+	const { result, root } = verification;
+	if (!result.verified) return result.reason.type;
+	const rootId = root?.["@id"];
+	if (typeof rootId !== "string" || getCanonicalPortableId(parseIri(rootId)) !== expectedId) return "the verified document has another ID";
+	return null;
 }
 //#endregion
 //#region src/federation/outgoing-proof.ts
@@ -5348,17 +5495,39 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 		}
 		const route = this.router.route(portable.path);
-		if (route == null || !route.name.startsWith("object:")) {
+		const isActor = route != null && (route.name === "actor" || route.name.startsWith("actorAlias:"));
+		if (route == null || !isActor && !route.name.startsWith("object:")) {
 			metricState.endpoint = "not_found";
 			return await onNotFound(request);
 		}
 		metricState.routeTemplate = PORTABLE_GATEWAY_ROUTE_PREFIX + route.template;
-		metricState.endpoint = "object";
+		metricState.endpoint = isActor ? "actor" : "object";
 		span.updateName(`${request.method} ${metricState.routeTemplate}`);
 		if (!acceptsJsonLd(request)) {
 			metricState.endpoint = "not_acceptable";
 			return await onNotAcceptable(request);
 		}
+		if (isActor) {
+			const identifier = route.name.startsWith("actorAlias:") ? route.name.substring(ACTOR_ALIAS_PREFIX.length) : route.values.identifier;
+			const context = this.#createContext(request, contextData, {
+				invokedFromActorDispatcher: { identifier },
+				portableRequest: portable.portableRequest
+			});
+			const actorDispatcher = this.actorCallbacks?.dispatcher;
+			const authorizePredicate = this.actorCallbacks?.authorizePredicate;
+			return await handlePortableObject(request, {
+				values: { identifier },
+				context,
+				objectDispatcher: actorDispatcher == null ? void 0 : async (ctx) => {
+					const actor = await actorDispatcher(ctx, identifier);
+					return actor instanceof Tombstone ? null : actor;
+				},
+				authorizePredicate: authorizePredicate == null ? void 0 : (ctx) => authorizePredicate(ctx, identifier),
+				canonicalId: portable.canonicalId,
+				onUnauthorized,
+				onNotFound
+			});
+		}
 		const typeId = route.name.replace(/^object:/, "");
 		const callbacks = this.objectCallbacks[typeId];
 		const cls = this.objectTypeIds[typeId];
@@ -5457,7 +5626,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			onNotFound,
 			portableInbox: {
 				recipient,
-				forward: async (activity, activityId, activityType) => {
+				forward: async (activity, activityId, activityType, signatures) => {
 					if (this.portableInboxForwarding.maxTargets < 1) return;
 					if (this.kv.cas == null) {
 						if (!this.#portableInboxForwardingWarned) {
@@ -5480,6 +5649,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 						allowPrivateAddress: this.allowPrivateAddress,
 						getKeys: () => this.#getPortableGatewayKeyPairs(context, identifier, recipient),
 						specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
+						signatures,
 						options: this.portableInboxForwarding,
 						meterProvider: this.meterProvider,
 						tracerProvider: this.tracerProvider
@@ -5721,9 +5891,17 @@ var ContextImpl = class ContextImpl {
 		return new URL(path, this.canonicalOrigin);
 	}
 	getActorUri(identifier) {
+		return new URL(this.#getActorPath(identifier), this.canonicalOrigin);
+	}
+	getPortableActorUri(identifier, authority) {
+		const path = this.#getActorPath(identifier);
+		if (authority == null) throw new TypeError("The authority of a portable ID is required outside an FEP-ef61 gateway request.");
+		return buildPortableUri(authority, path);
+	}
+	#getActorPath(identifier) {
 		const path = this.federation.router.build(`actorAlias:${identifier}`, {}) ?? this.federation.router.build("actor", { identifier });
 		if (path == null) throw new RouterError("No actor dispatcher registered.");
-		return new URL(path, this.canonicalOrigin);
+		return path;
 	}
 	getObjectUri(cls, values) {
 		return new URL(this.#getObjectPath(cls, values), this.canonicalOrigin);
@@ -6366,6 +6544,9 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 			request: this.request
 		});
 	}
+	getPortableActorUri(identifier, authority) {
+		return super.getPortableActorUri(identifier, authority ?? this.portableRequest?.authority);
+	}
 	getPortableObjectUri(cls, values, authority) {
 		return super.getPortableObjectUri(cls, values, authority ?? this.portableRequest?.authority);
 	}
@@ -6762,4 +6943,4 @@ function getRequestId(request) {
 	return `req_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
 }
 //#endregion
-export { handleNodeInfoJrd as C, handleNodeInfo as S, autoIdAssigner as T, respondWithObject as _, OutboxContextImpl as a, parseHashlinkGatewayRequest as b, assertPortableActorActivity as c, handleActor as d, handleCollection as f, handleOutbox as g, handleObject as h, KvSpecDeterminer as i, forwardPortableInboxActivity as l, handleInbox as m, FederationImpl as n, createFederation as o, handleCustomCollection as p, InboxContextImpl as r, handleWebFinger as s, ContextImpl as t, resolvePortableInboxForwardingOptions as u, respondWithObjectIfAcceptable as v, actorDehydrator as w, handleBenchmarkTrigger as x, PORTABLE_OBJECT_CONTENT_TYPE as y };
+export { handleNodeInfo as C, autoIdAssigner as E, handleBenchmarkTrigger as S, actorDehydrator as T, coversDelivery as _, OutboxContextImpl as a, PORTABLE_OBJECT_CONTENT_TYPE as b, assertPortableActorActivity as c, handleCustomCollection as d, handleInbox as f, respondWithObjectIfAcceptable as g, respondWithObject as h, KvSpecDeterminer as i, handleActor as l, handleOutbox as m, FederationImpl as n, createFederation as o, handleObject as p, InboxContextImpl as r, handleWebFinger as s, ContextImpl as t, handleCollection as u, forwardPortableInboxActivity as v, handleNodeInfoJrd as w, parseHashlinkGatewayRequest as x, resolvePortableInboxForwardingOptions as y };