@fedify/fedify 2.4.0-dev.2200 → 2.4.0-dev.2212

package/dist/{federation-Ij8VLHpy.cjs → federation-B-0EXZPH.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-D8XakCKn.cjs");
+const require_http = require("./http-ByBlnY3D.cjs");
 const require_types = require("./types-poIao40f.cjs");
-const require_portable_collection = require("./portable-collection-DyJwtPz1.cjs");
-const require_kv_cache = require("./kv-cache-f_GNq0e7.cjs");
+const require_portable_collection = require("./portable-collection-CXcAlwei.cjs");
+const require_kv_cache = require("./kv-cache-BDwUzxBJ.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -2359,6 +2359,95 @@ async function checkServedPortableMap({ map, contexts }, options) {
 	return UNSECURED_CORE_TYPES.has(type) ? null : "missingProof";
 }
 //#endregion
+//#region src/federation/audience.ts
+const AS_NAMESPACE = "https://www.w3.org/ns/activitystreams#";
+/**
+* The addressing properties that determine the audience of an object.
+*/
+const ADDRESSING_PROPERTIES = [
+	"to",
+	"cc",
+	"bto",
+	"bcc",
+	"audience"
+];
+/**
+* The IDs that Fedify treats as the public collection.  Besides the full IRI,
+* the compact forms `as:Public` and `Public` are reserved as public for
+* compatibility with documents whose compact forms survive JSON-LD expansion,
+* e.g., bare `Public`, which expands to a relative IRI.
+*/
+const PUBLIC_IDS = /* @__PURE__ */ new Set([
+	_fedify_vocab.PUBLIC_COLLECTION.href,
+	"as:Public",
+	"Public"
+]);
+/**
+* Checks whether an expanded JSON-LD node is addressed to the public
+* collection, i.e., any of its `to`, `cc`, `bto`, `bcc`, and `audience` has
+* the public collection.  Only the node itself is checked, not the nodes
+* embedded in it.
+* @param node The expanded JSON-LD node.
+* @returns `true` if the node is publicly addressed.
+* @internal
+*/
+function isPubliclyAddressedNode(node) {
+	for (const property of ADDRESSING_PROPERTIES) {
+		const values = node[AS_NAMESPACE + property];
+		if (!Array.isArray(values)) continue;
+		for (const value of values) if (typeof value === "object" && value != null && "@id" in value && typeof value["@id"] === "string" && PUBLIC_IDS.has(value["@id"])) return true;
+	}
+	return false;
+}
+function getAudienceIds(object) {
+	return [
+		...object.toIds,
+		...object.ccIds,
+		...object.btoIds,
+		...object.bccIds,
+		...object.audienceIds
+	];
+}
+/**
+* Checks whether two actor IDs refer to the same actor.  [FEP-ef61] portable
+* IDs are compared by their canonical forms, so an `ap:` URI, an `ap+ef61:`
+* URI, and a compatible identifier on any gateway are the same actor if they
+* have the same canonical portable ID.  Other IDs are compared as they are.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*/
+function isSameActorId(a, b) {
+	const canonicalA = require_http.getCanonicalPortableId(a);
+	const canonicalB = require_http.getCanonicalPortableId(b);
+	if (canonicalA != null || canonicalB != null) return canonicalA === canonicalB;
+	return a.href === b.href;
+}
+/**
+* Checks whether an actor belongs to the audience of an object: the object is
+* publicly addressed, the actor is one of its addressees, or the actor is
+* a member of one of them according to `isMember()`.
+* @param object The object whose audience is checked.
+* @param actor The actor to check, or `null` if there is no actor.  No actor
+*              belongs to the audience of an object that is not public.
+* @param options Options for checking the audience.
+* @returns `true` if the actor belongs to the audience of the object.
+* @internal
+*/
+async function isInAudience(object, actor, options = {}) {
+	const addressees = getAudienceIds(object);
+	if (addressees.some((id) => PUBLIC_IDS.has(id.href))) return true;
+	const actorId = actor?.id;
+	if (actor == null || actorId == null) return false;
+	const others = [];
+	for (const addressee of addressees) {
+		if (isSameActorId(addressee, actorId)) return true;
+		others.push(addressee);
+	}
+	if (options.isMember == null) return false;
+	for (const addressee of others) if (await options.isMember(addressee, actor)) return true;
+	return false;
+}
+//#endregion
 //#region src/federation/inbox.ts
 const Temporal$10 = require_http.Temporal;
 async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
@@ -2983,31 +3072,177 @@ function parseHashlinkGatewayRequest(url) {
 		})
 	};
 }
+/**
+* Resolves a portable inbox, i.e., an `ap:` or `ap+ef61:` URI, to
+* the compatible identifiers of the inbox on the recipient's gateways.
+*
+* The gateways are taken from the recipient's `gateways`, or, if it has no
+* valid gateway, from the `@gateway` location hints of the inbox URI.  Both
+* come from the recipient object, so they are as trustworthy as its inbox.
+* Gateways whose origins are in `excludeBaseUris` are skipped.
+* @param recipient The recipient that owns the inbox.
+* @param inbox The portable inbox.
+* @param excludeBaseUris The base URIs whose origins are not delivered to.
+* @returns The delivery target, or `null` if the inbox is malformed, or no
+*          gateway is left to deliver through.
+*/
+function resolvePortableDeliveryTarget(recipient, inbox, excludeBaseUris) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"outbox"
+	]);
+	let portableInbox;
+	try {
+		portableInbox = (0, _fedify_vocab_runtime.canonicalizePortableUri)(inbox.href);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.warn("Skipping the recipient {recipient}, as its portable inbox {inbox} is malformed.", {
+			recipient: recipient.id?.href,
+			inbox: inbox.href,
+			error
+		});
+		return null;
+	}
+	let gateways = (recipient.gateways ?? []).filter(_fedify_vocab_runtime.isGatewayUrl);
+	if (gateways.length < 1) gateways = (0, _fedify_vocab_runtime_internal_portable_dereference.getPortableGatewayCandidates)(inbox);
+	if (gateways.length < 1) {
+		logger.warn("Skipping the recipient {recipient}, as it has no gateway to deliver to its portable inbox {inbox} through.", {
+			recipient: recipient.id?.href,
+			inbox: portableInbox
+		});
+		return null;
+	}
+	const excludedOrigins = new Set(excludeBaseUris?.map((u) => u.origin));
+	const seen = /* @__PURE__ */ new Set();
+	const inboxes = [];
+	for (const gateway of gateways) {
+		if (inboxes.length >= 5) break;
+		if (seen.has(gateway.origin)) continue;
+		seen.add(gateway.origin);
+		if (excludedOrigins.has(gateway.origin)) continue;
+		try {
+			inboxes.push((0, _fedify_vocab_runtime.toCompatibleEf61Id)(inbox, gateway.origin));
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			logger.warn("Cannot deliver to the portable inbox {inbox} through the gateway {gateway}, as the inbox cannot be represented as its compatible identifier.", {
+				inbox: portableInbox,
+				gateway: gateway.origin,
+				error
+			});
+		}
+	}
+	if (inboxes.length < 1) {
+		logger.debug("Skipping the recipient {recipient}, as no gateway is left to deliver to its portable inbox {inbox} through.", {
+			recipient: recipient.id?.href,
+			inbox: portableInbox
+		});
+		return null;
+	}
+	return {
+		portableInbox,
+		inboxes
+	};
+}
+/**
+* Merges two ordered lists of compatible inbox URLs, keeping the first URL
+* for each gateway origin and at most {@link MAX_DELIVERY_GATEWAYS} URLs.
+* @param a The preferred list.
+* @param b The other list.
+* @returns The merged list.
+*/
+function mergeGatewayInboxes(a, b) {
+	const seen = /* @__PURE__ */ new Set();
+	const merged = [];
+	for (const inbox of [...a, ...b]) {
+		if (merged.length >= 5) break;
+		const { origin } = new URL(inbox);
+		if (seen.has(origin)) continue;
+		seen.add(origin);
+		merged.push(inbox);
+	}
+	return merged;
+}
+/**
+* Gets the part of a delivery's ordering key that tells its destination
+* apart: the DID of a portable inbox, so that deliveries to it stay in order
+* whichever gateway they go through, or the origin of any other inbox.
+* @param inbox The inbox URL.
+* @param portableInbox The canonical portable inbox, if the inbox is
+*                      the compatible identifier of one.
+* @returns The destination part of the ordering key.
+*/
+function getOrderingDestination(inbox, portableInbox) {
+	return portableInbox == null ? new URL(inbox).origin : (0, _fedify_vocab_runtime.getFe34Origin)(portableInbox);
+}
 //#endregion
 //#region src/federation/send.ts
 /**
 * Extracts the inbox URLs from recipients.
+*
+* An [FEP-ef61] portable inbox, i.e., an `ap:` or `ap+ef61:` URI, is resolved
+* to its compatible identifiers on the recipient's gateways, or, if the
+* recipient has no valid gateway, on the gateways in the `@gateway` location
+* hints of the inbox URI.  The inbox is keyed by the compatible identifier on
+* the first gateway, and the others are listed in
+* {@link ExtractedInbox.gatewayInboxes}.  A recipient whose portable inbox
+* has no gateway to deliver through is skipped.  The shared inbox of
+* a recipient with a portable inbox is never preferred, since only a portable
+* inbox is synchronized between the gateways.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
 * @param parameters The parameters to extract the inboxes.
 *                   See also {@link ExtractInboxesParameters}.
 * @returns The inboxes as a map of inbox URL to actor URIs.
 */
 function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
 	const inboxes = {};
+	const portableKeys = /* @__PURE__ */ new Map();
+	const compatibleKeys = /* @__PURE__ */ new Map();
 	for (const recipient of recipients) {
+		if (recipient.id == null) continue;
 		let inbox;
 		let sharedInbox = false;
-		if (preferSharedInbox && recipient.endpoints?.sharedInbox != null) {
+		if (preferSharedInbox && recipient.endpoints?.sharedInbox != null && (recipient.inboxId == null || !require_http.isPortableUri(recipient.inboxId))) {
 			inbox = recipient.endpoints.sharedInbox;
 			sharedInbox = true;
 		} else inbox = recipient.inboxId;
-		if (inbox != null && recipient.id != null) {
-			if (excludeBaseUris != null && excludeBaseUris.some((u) => u.origin === inbox?.origin)) continue;
-			inboxes[inbox.href] ??= {
+		if (inbox == null) continue;
+		if (require_http.isPortableUri(inbox)) {
+			const target = resolvePortableDeliveryTarget(recipient, inbox, excludeBaseUris);
+			if (target == null) continue;
+			const gatewayInboxes = target.inboxes.map((u) => u.href);
+			const existingKeys = /* @__PURE__ */ new Set();
+			const portableKey = portableKeys.get(target.portableInbox);
+			if (portableKey != null) existingKeys.add(portableKey);
+			for (const i of gatewayInboxes) {
+				const k = compatibleKeys.get(i) ?? i;
+				if (Object.hasOwn(inboxes, k)) existingKeys.add(k);
+			}
+			const [key = gatewayInboxes[0], ...otherKeys] = existingKeys;
+			portableKeys.set(target.portableInbox, key);
+			const entry = inboxes[key] ??= {
 				actorIds: /* @__PURE__ */ new Set(),
 				sharedInbox
 			};
-			inboxes[inbox.href].actorIds.add(recipient.id.href);
+			for (const k of otherKeys) {
+				for (const actorId of inboxes[k].actorIds) entry.actorIds.add(actorId);
+				delete inboxes[k];
+			}
+			entry.sharedInbox = false;
+			entry.portableInbox = target.portableInbox;
+			entry.gatewayInboxes = mergeGatewayInboxes(entry.gatewayInboxes ?? [key], gatewayInboxes);
+			for (const i of entry.gatewayInboxes) compatibleKeys.set(i, key);
+			entry.actorIds.add(recipient.id.href);
+			continue;
 		}
+		if (excludeBaseUris != null && excludeBaseUris.some((u) => u.origin === inbox?.origin)) continue;
+		const key = compatibleKeys.get(inbox.href) ?? inbox.href;
+		inboxes[key] ??= {
+			actorIds: /* @__PURE__ */ new Set(),
+			sharedInbox
+		};
+		inboxes[key].actorIds.add(recipient.id.href);
 	}
 	return inboxes;
 }
@@ -3042,6 +3277,38 @@ function sendActivity(options) {
 		}
 	});
 }
+/**
+* Sends an activity to the first of the given inboxes that accepts it, i.e.,
+* the compatible identifiers of a portable inbox on its gateways, trying them
+* one after another.
+* @param parameters The parameters, except for the inbox.
+* @param inboxes The inboxes to try, in order.  Must not be empty.
+* @throws {Error} The error of the last inbox if no inbox accepts it.
+*/
+async function sendActivityThroughGateways(parameters, inboxes) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"outbox"
+	]);
+	let lastError;
+	for (const [i, inbox] of inboxes.entries()) try {
+		await sendActivity({
+			...parameters,
+			inbox
+		});
+		return;
+	} catch (error) {
+		lastError = error;
+		if (i < inboxes.length - 1) logger.warn("Failed to send activity {activityId} to {inbox}; trying the next gateway {next}:\n{error}", {
+			activityId: parameters.activityId,
+			inbox: inbox.href,
+			next: inboxes[i + 1].href,
+			error
+		});
+	}
+	throw lastError;
+}
 const MAX_ERROR_RESPONSE_BODY_BYTES = 1024;
 function getActivityActorId(activity) {
 	if (!isRecord(activity)) return void 0;
@@ -3897,6 +4164,15 @@ async function handleObject(request, { values, context, objectDispatcher, author
 * only if its ID canonically matches the requested portable ID and it
 * satisfies the FEP-ef61 proof policy.
 *
+* FEP-ef61 forbids serving a non-public object to anyone but its intended
+* audience.  If the dispatcher has an authorization predicate, it decides who
+* may retrieve the object, and the response is marked with
+* `Cache-Control: private`, as it depends on the requester.  Otherwise, only
+* a publicly addressed object is served, and any other object is responded
+* to with `404 Not Found`, as if this server did not store it.  Actors, and
+* anything the actor dispatcher returns, are exempt from the latter, as
+* actors have no audience.
+*
 * A {@link Tombstone} is served with `410 Gone` if it has an Object Integrity
 * Proof made with a key of the DID in its ID.  An unsigned tombstone cannot
 * be served as a portable object, so the response is the same as for
@@ -3906,7 +4182,7 @@ async function handleObject(request, { values, context, objectDispatcher, author
 * @param parameters The parameters for handling the portable object.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handlePortableObject(request, { values, context, objectDispatcher, authorizePredicate, canonicalId, onNotFound, onUnauthorized }) {
+async function handlePortableObject(request, { values, context, objectDispatcher, authorizePredicate, canonicalId, kind, onNotFound, onUnauthorized }) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
@@ -3925,14 +4201,32 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 	if (authorizePredicate != null) {
 		if (!await authorizePredicate(context, values)) return await onUnauthorized(request);
 	}
+	const contextLoader = require_http.getNormalizationContextLoader(context.contextLoader);
 	let jsonLd;
-	let servedId;
-	let result;
+	let root;
 	try {
 		jsonLd = await object.toJsonLd(context);
-		servedId = await getJsonLdRootId(jsonLd, context.contextLoader);
+		root = await expandJsonLdRoot(jsonLd, contextLoader);
+	} catch (error) {
+		logger.error("Failed to serialize the portable object {portableId}:\n{error}", {
+			portableId: canonicalId,
+			error
+		});
+		return portableObjectInternalServerError(request);
+	}
+	const servedId = root?.["@id"];
+	if (root == null || typeof servedId !== "string" || !isRequestedPortableId(servedId, canonicalId)) {
+		logger.debug("The serialized object does not match the requested portable object {portableId}.", { portableId: canonicalId });
+		return await onNotFound(request);
+	}
+	if (authorizePredicate == null && kind === "object" && !(0, _fedify_vocab.isActor)(object) && !isPubliclyAddressedNode(root)) {
+		logger.debug("Not serving the portable object {portableId}, as it is not publicly addressed and its object dispatcher has no authorization predicate; responding as if this server did not store the object.  Set an authorization predicate that checks if the request is signed by an actor in the object's audience to serve it.", { portableId: canonicalId });
+		return await onNotFound(request);
+	}
+	let result;
+	try {
 		result = await require_http.verifyPortableObjectProof(jsonLd, {
-			contextLoader: context.contextLoader,
+			contextLoader,
 			documentLoader: context.documentLoader,
 			tracerProvider: context.tracerProvider,
 			meterProvider: context.meterProvider
@@ -3944,10 +4238,6 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 		});
 		return portableObjectInternalServerError(request);
 	}
-	if (servedId == null || !isRequestedPortableId(servedId, canonicalId)) {
-		logger.debug("The serialized object does not match the requested portable object {portableId}.", { portableId: canonicalId });
-		return await onNotFound(request);
-	}
 	const tombstone = object instanceof _fedify_vocab.Tombstone;
 	if (!result.verified) {
 		if (tombstone && result.reason.type === "missingProof") {
@@ -3966,25 +4256,26 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 			return portableObjectInternalServerError(request);
 		}
 	}
+	const headers = new Headers({
+		"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
+		Vary: "Accept"
+	});
+	if (authorizePredicate != null) headers.set("Cache-Control", "private");
 	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), {
 		status: tombstone ? 410 : 200,
-		headers: {
-			"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
-			Vary: "Accept"
-		}
+		headers
 	});
 }
 function isRequestedPortableObject(object, canonicalId) {
 	return object.id != null && require_http.getCanonicalPortableId(object.id) === canonicalId;
 }
-async function getJsonLdRootId(jsonLd, contextLoader) {
+async function expandJsonLdRoot(jsonLd, contextLoader) {
 	const expanded = await _fedify_vocab_runtime_jsonld.default.expand(jsonLd, {
-		documentLoader: require_http.getNormalizationContextLoader(contextLoader),
+		documentLoader: contextLoader,
 		keepFreeFloatingNodes: true
 	});
 	if (expanded.length !== 1) return null;
-	const id = expanded[0]["@id"];
-	return typeof id === "string" ? id : null;
+	return expanded[0];
 }
 function isRequestedPortableId(id, canonicalId) {
 	if (!/^ap(?:\+ef61)?:\/\//i.test(id)) return URL.canParse(id) && require_http.getCanonicalPortableId(new URL(id)) === canonicalId;
@@ -7230,6 +7521,37 @@ function getBenchmarkTriggerOptions(benchmarkOptions) {
 function maxDelay(first, second) {
 	return Temporal$2.Duration.compare(first, second) >= 0 ? first : second;
 }
+/**
+* Gets the fields of a queued message that describe the FEP-ef61 portable
+* inbox an inbox stands for, if any, omitting the absent ones.
+*/
+function getPortableMessageFields(portableInbox, gatewayInboxes) {
+	return {
+		...portableInbox == null ? {} : { portableInbox },
+		...gatewayInboxes == null ? {} : { gatewayInboxes: [...gatewayInboxes] }
+	};
+}
+/**
+* Sends an activity to an inbox, or, if the inbox is the compatible
+* identifier of an FEP-ef61 portable inbox on more than one gateway, through
+* the first gateway that accepts it.
+*/
+function sendActivityToInbox(inbox, gatewayInboxes, parameters) {
+	if (gatewayInboxes == null || gatewayInboxes.length < 2) return sendActivity({
+		...parameters,
+		inbox: new URL(inbox)
+	});
+	return sendActivityThroughGateways(parameters, gatewayInboxes.map((i) => new URL(i)));
+}
+function parseInstant(value) {
+	if (value == null) return void 0;
+	try {
+		return Temporal$2.Instant.from(value);
+	} catch (error) {
+		if (error instanceof RangeError) return void 0;
+		throw error;
+	}
+}
 function isTransportDeliveryError(error) {
 	return error instanceof _fedify_vocab_runtime.FetchError || require_http.isAbortError(error);
 }
@@ -7810,6 +8132,20 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}
 			require_http.recordOutboxActivity(this.meterProvider, "abandoned", message.activityType);
 		};
+		const { gatewayInboxes } = message;
+		if (gatewayInboxes != null && gatewayInboxes.length > 1) {
+			await this.#listenGatewayOutboxMessage(_, {
+				...message,
+				gatewayInboxes
+			}, span, {
+				keys,
+				logData,
+				getActorIds,
+				parseActivity,
+				dropHeldOutboxMessage
+			});
+			return;
+		}
 		try {
 			const inbox = new URL(message.inbox);
 			const circuit = this.outboxQueue == null ? void 0 : this.circuitBreaker;
@@ -8032,6 +8368,308 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		logger.info("Successfully sent activity {activityId} to {inbox}.", { ...logData });
 	}
+	/**
+	* Delivers a queued activity to an FEP-ef61 portable inbox through the first
+	* of its gateways that accepts it, trying them one after another in a single
+	* round, so that the round counts as one attempt for the retry policy, keeps
+	* the message's place in its ordering key, and is replayed as a whole by
+	* queues that retry natively.
+	*
+	* A gateway that fails with a permanent failure status is not tried again.
+	* A gateway whose circuit is open, or which asked to be retried later with
+	* `Retry-After`, is skipped in this round.  If no gateway accepts the
+	* activity, the message is held while every remaining gateway is held, and
+	* otherwise retried according to the retry policy.
+	*/
+	async #listenGatewayOutboxMessage(contextData, message, span, helpers) {
+		const logger = (0, _logtape_logtape.getLogger)([
+			"fedify",
+			"federation",
+			"outbox"
+		]);
+		const circuitLogger = (0, _logtape_logtape.getLogger)([
+			"fedify",
+			"federation",
+			"circuit"
+		]);
+		const { keys, logData, getActorIds, parseActivity, dropHeldOutboxMessage } = helpers;
+		const circuit = this.outboxQueue == null ? void 0 : this.circuitBreaker;
+		const specDeterminer = new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl });
+		const survivors = [];
+		let lastError;
+		let lastPermanent;
+		let activity;
+		const getActivity = async () => activity ??= await parseActivity();
+		const drop = async (circuit, remoteHost, inbox, heldSince) => {
+			await dropHeldOutboxMessage(circuit, remoteHost, inbox, heldSince, await getActivity());
+		};
+		const heldSince = parseInstant(message.circuitHeldSince);
+		if (circuit != null && heldSince != null && Temporal$2.Instant.compare(heldSince.add(circuit.options.heldActivityTtl), Temporal$2.Now.instant()) <= 0) {
+			const inbox = new URL(message.gatewayInboxes[0]);
+			await drop(circuit, require_http.getRemoteHost(inbox), inbox, heldSince);
+			return;
+		}
+		for (const inboxHref of message.gatewayInboxes) {
+			const inbox = new URL(inboxHref);
+			const remoteHost = require_http.getRemoteHost(inbox);
+			const now = Temporal$2.Now.instant();
+			const notBefore = parseInstant(message.gatewayNotBefore?.[inboxHref]);
+			if (notBefore != null && Temporal$2.Instant.compare(notBefore, now) > 0) {
+				survivors.push({
+					inbox: inboxHref,
+					holdDelay: now.until(notBefore),
+					notBefore
+				});
+				continue;
+			}
+			let decision;
+			if (circuit != null) try {
+				decision = await circuit.beforeSend(remoteHost, message);
+			} catch (circuitError) {
+				circuitLogger.error("Failed to check circuit breaker state before sending; proceeding with delivery:\n{error}", {
+					...logData,
+					remoteHost,
+					error: circuitError
+				});
+			}
+			if (decision != null && circuit != null) {
+				if (decision.type === "drop") {
+					await drop(circuit, remoteHost, inbox, decision.heldSince);
+					return;
+				} else if (decision.type === "hold") {
+					recordCircuitBreakerHeldSpanEvent(span, remoteHost, decision.state);
+					survivors.push({
+						inbox: inboxHref,
+						holdDelay: decision.delay,
+						circuitHeld: true
+					});
+					continue;
+				} else if (decision.stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, decision.stateChange);
+			}
+			try {
+				await sendActivity({
+					allowPrivateAddress: this.allowPrivateAddress,
+					keys,
+					activity: message.activity,
+					activityId: message.activityId,
+					activityType: message.activityType,
+					inbox,
+					sharedInbox: message.sharedInbox,
+					headers: new Headers(message.headers),
+					specDeterminer,
+					meterProvider: this.meterProvider,
+					tracerProvider: this.tracerProvider
+				});
+			} catch (error) {
+				lastError = error;
+				const isPermanentFailure = error instanceof SendActivityError && this.permanentFailureStatusCodes.includes(error.statusCode);
+				let retryAfter = !isPermanentFailure && error instanceof SendActivityError && (error.statusCode === 429 || error.statusCode === 503) ? parseRetryAfter(error.responseHeaders) : void 0;
+				let retryAt;
+				if (retryAfter != null) try {
+					retryAt = Temporal$2.Now.instant().add(retryAfter);
+				} catch (e) {
+					if (!(e instanceof RangeError)) throw e;
+					retryAfter = void 0;
+				}
+				let postDecision;
+				if (circuit != null) try {
+					if (error instanceof SendActivityError) {
+						const { statusCode } = error;
+						const stateChange = isPermanentFailure || statusCode === 429 || statusCode >= 400 && statusCode < 500 ? await circuit.recordReachableFailure(remoteHost) : statusCode >= 500 ? await circuit.recordFailure(remoteHost) : void 0;
+						if (stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, stateChange);
+					} else if (isTransportDeliveryError(error)) {
+						const stateChange = await circuit.recordFailure(remoteHost);
+						if (stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, stateChange);
+					}
+					if (!isPermanentFailure) postDecision = await circuit.beforeSend(remoteHost, message);
+				} catch (circuitError) {
+					circuitLogger.error("Failed to update circuit breaker state after delivery failure; falling back to normal failure handling:\n{error}", {
+						...logData,
+						remoteHost,
+						error: circuitError
+					});
+				}
+				span.addEvent("activitypub.delivery.failed", {
+					"activitypub.remote.host": remoteHost,
+					"activitypub.delivery.attempt": message.attempt,
+					"activitypub.delivery.permanent_failure": isPermanentFailure,
+					...error instanceof SendActivityError ? { "http.response.status_code": error.statusCode } : {}
+				});
+				try {
+					await this.onOutboxError?.(error, await getActivity());
+				} catch (handlerError) {
+					logger.error("An unexpected error occurred in onError handler:\n{error}", {
+						...logData,
+						inbox: inboxHref,
+						error: handlerError
+					});
+				}
+				if (isPermanentFailure) {
+					logger.warn("Permanent delivery failure for activity {activityId} to {inbox} ({status}); not trying the gateway again.", {
+						...logData,
+						inbox: inboxHref,
+						status: error.statusCode
+					});
+					lastPermanent = {
+						error,
+						inbox
+					};
+					continue;
+				}
+				if (postDecision?.type === "drop" && circuit != null) {
+					await drop(circuit, remoteHost, inbox, postDecision.heldSince);
+					return;
+				} else if (postDecision?.type === "hold") {
+					recordCircuitBreakerHeldSpanEvent(span, remoteHost, postDecision.state);
+					survivors.push({
+						inbox: inboxHref,
+						holdDelay: retryAfter == null ? postDecision.delay : maxDelay(postDecision.delay, retryAfter),
+						circuitHeld: true,
+						postFailure: true,
+						notBefore: retryAt,
+						retryAfter
+					});
+				} else survivors.push({
+					inbox: inboxHref,
+					notBefore: retryAt,
+					retryAfter
+				});
+				logger.warn("Failed to send activity {activityId} to {inbox} (attempt #{attempt}); trying the next gateway if any:\n{error}", {
+					...logData,
+					inbox: inboxHref,
+					error
+				});
+				continue;
+			}
+			if (circuit != null) try {
+				const stateChange = await circuit.recordSuccess(remoteHost);
+				if (stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, stateChange);
+			} catch (error) {
+				circuitLogger.error("Failed to record successful delivery in circuit breaker state; the activity was already delivered:\n{error}", {
+					...logData,
+					remoteHost,
+					error
+				});
+			}
+			logger.info("Successfully sent activity {activityId} to {inbox}.", {
+				...logData,
+				inbox: inboxHref
+			});
+			return;
+		}
+		if (lastError != null) span.setStatus({
+			code: _opentelemetry_api.SpanStatusCode.ERROR,
+			message: String(lastError)
+		});
+		if (survivors.length < 1) {
+			const { error, inbox } = lastPermanent;
+			this.metrics.recordPermanentFailure(error.inbox, error.statusCode);
+			logger.warn("Permanent delivery failure for activity {activityId} to every gateway of {portableInbox}; not retrying.", {
+				...logData,
+				portableInbox: message.portableInbox
+			});
+			if (this.outboxPermanentFailureHandler != null) {
+				const ctx = this.#createContext(new URL(message.baseUrl), contextData, { documentLoader: this.documentLoaderFactory(this.#getLoaderOptions(message.baseUrl)) });
+				try {
+					await this.outboxPermanentFailureHandler(ctx, {
+						reason: "http",
+						inbox,
+						activity: await getActivity(),
+						error,
+						statusCode: error.statusCode,
+						actorIds: getActorIds()
+					});
+				} catch (handlerError) {
+					logger.error("An unexpected error occurred in outboxPermanentFailureHandler:\n{error}", {
+						...logData,
+						error: handlerError
+					});
+				}
+			}
+			require_http.recordOutboxActivity(this.meterProvider, "abandoned", message.activityType);
+			return;
+		}
+		const now = Temporal$2.Now.instant();
+		const gatewayNotBefore = {};
+		for (const survivor of survivors) if (survivor.notBefore != null && Temporal$2.Instant.compare(survivor.notBefore, now) > 0) gatewayNotBefore[survivor.inbox] = survivor.notBefore.toString();
+		const { circuitHeld: _circuitHeld, gatewayNotBefore: _gatewayNotBefore, ...rest } = message;
+		const nextMessage = {
+			...rest,
+			inbox: survivors[0].inbox,
+			gatewayInboxes: survivors.map((s) => s.inbox),
+			...globalThis.Object.keys(gatewayNotBefore).length < 1 ? {} : { gatewayNotBefore }
+		};
+		const { outboxQueue } = this;
+		const policyDelay = this.outboxRetryPolicy({
+			elapsedTime: Temporal$2.Instant.from(message.started).until(now),
+			attempts: message.attempt
+		});
+		if (outboxQueue != null && survivors.every((s) => s.holdDelay != null) && (policyDelay != null || !survivors.some((s) => s.postFailure))) {
+			let delay = survivors.map((s) => s.holdDelay).reduce((a, b) => Temporal$2.Duration.compare(a, b) <= 0 ? a : b);
+			let heldMessage = nextMessage;
+			if (survivors.some((s) => s.circuitHeld)) {
+				const since = heldSince ?? now;
+				if (circuit != null) delay = circuit.capHeldDelay(since, delay);
+				heldMessage = {
+					...nextMessage,
+					circuitHeld: true,
+					circuitHeldSince: since.toString()
+				};
+			}
+			logger.warn("Failed to send activity {activityId} to {portableInbox}; holding it until one of its gateways can be tried again.", {
+				...logData,
+				portableInbox: message.portableInbox
+			});
+			await outboxQueue.enqueue(heldMessage, {
+				delay: clampNegativeDelay(delay),
+				orderingKey: message.orderingKey
+			});
+			this.metrics.recordQueueTaskEnqueued({
+				role: "outbox",
+				queue: outboxQueue,
+				activityType: heldMessage.activityType
+			}, heldMessage.attempt);
+			return;
+		}
+		const hasRetryAfter = survivors.some((s) => s.retryAfter != null);
+		if (outboxQueue?.nativeRetrial && !hasRetryAfter && survivors.length === message.gatewayInboxes.length && globalThis.Object.keys(gatewayNotBefore).length < 1) {
+			logger.error("Failed to send activity {activityId} to every gateway of {portableInbox}; backend will handle retry:\n{error}", {
+				...logData,
+				portableInbox: message.portableInbox,
+				error: lastError
+			});
+			throw lastError;
+		}
+		if (policyDelay == null || outboxQueue == null) {
+			logger.error("Failed to send activity {activityId} to every gateway of {portableInbox} after {attempt} attempts; giving up:\n{error}", {
+				...logData,
+				portableInbox: message.portableInbox,
+				error: lastError
+			});
+			require_http.recordOutboxActivity(this.meterProvider, "abandoned", message.activityType);
+			return;
+		}
+		const delay = survivors.map((s) => s.holdDelay ?? s.retryAfter ?? policyDelay).reduce((a, b) => Temporal$2.Duration.compare(a, b) <= 0 ? a : b);
+		const retryMessage = {
+			...nextMessage,
+			attempt: message.attempt + 1
+		};
+		logger.error("Failed to send activity {activityId} to every gateway of {portableInbox} (attempt #{attempt}); retry...:\n{error}", {
+			...logData,
+			portableInbox: message.portableInbox,
+			error: lastError
+		});
+		await outboxQueue.enqueue(retryMessage, {
+			delay: clampNegativeDelay(delay),
+			orderingKey: message.orderingKey
+		});
+		this.metrics.recordQueueTaskEnqueued({
+			role: "outbox",
+			queue: outboxQueue,
+			activityType: retryMessage.activityType
+		}, retryMessage.attempt);
+		require_http.recordOutboxActivity(this.meterProvider, "retried", retryMessage.activityType);
+	}
 	async #listenInboxMessage(ctxData, message, span, onActivityType) {
 		const logger = (0, _logtape_logtape.getLogger)([
 			"fedify",
@@ -8461,13 +9099,12 @@ var FederationImpl = class extends FederationBuilderImpl {
 				activity: jsonLd
 			});
 			const promises = [];
-			for (const inbox in inboxes) promises.push(sendActivity({
+			for (const inbox in inboxes) promises.push(sendActivityToInbox(inbox, inboxes[inbox].gatewayInboxes, {
 				allowPrivateAddress: this.allowPrivateAddress,
 				keys,
 				activity: jsonLd,
 				activityId: activity.id?.href,
 				activityType: (0, _fedify_vocab.getTypeId)(activity).href,
-				inbox: new URL(inbox),
 				sharedInbox: inboxes[inbox].sharedInbox,
 				headers: collectionSync == null ? void 0 : new Headers({ "Collection-Synchronization": await buildCollectionSynchronizationHeader(collectionSync, inboxes[inbox].actorIds) }),
 				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
@@ -8494,8 +9131,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 		_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), carrier);
 		const messages = [];
 		for (const inbox in inboxes) {
-			const inboxOrigin = new URL(inbox).origin;
-			const messageOrderingKey = orderingKey == null ? void 0 : `${orderingKey}\n${inboxOrigin}`;
+			const { portableInbox, gatewayInboxes } = inboxes[inbox];
+			const messageOrderingKey = orderingKey == null ? void 0 : `${orderingKey}\n${getOrderingDestination(inbox, portableInbox)}`;
 			const message = {
 				type: "outbox",
 				id: crypto.randomUUID(),
@@ -8511,6 +9148,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				attempt: 0,
 				headers: collectionSync == null ? {} : { "Collection-Synchronization": await buildCollectionSynchronizationHeader(collectionSync, inboxes[inbox].actorIds) },
 				orderingKey: messageOrderingKey,
+				...getPortableMessageFields(portableInbox, gatewayInboxes),
 				traceContext: carrier
 			};
 			messages.push({
@@ -8960,6 +9598,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				objectDispatcher: actorDispatcher == null ? void 0 : (ctx) => actorDispatcher(ctx, identifier),
 				authorizePredicate: authorizePredicate == null ? void 0 : (ctx) => authorizePredicate(ctx, identifier),
 				canonicalId: portable.canonicalId,
+				kind: "actor",
 				onUnauthorized,
 				onNotFound
 			});
@@ -8980,6 +9619,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			objectDispatcher: callbacks?.dispatcher,
 			authorizePredicate: callbacks?.authorizePredicate,
 			canonicalId: portable.canonicalId,
+			kind: "object",
 			onUnauthorized,
 			onNotFound
 		});
@@ -9976,9 +10616,10 @@ var ContextImpl = class ContextImpl {
 			id: crypto.randomUUID(),
 			baseUrl: this.origin,
 			keys: keyJwkPairs,
-			inboxes: globalThis.Object.fromEntries(globalThis.Object.entries(inboxes).map(([k, { actorIds, sharedInbox }]) => [k, {
+			inboxes: globalThis.Object.fromEntries(globalThis.Object.entries(inboxes).map(([k, { actorIds, sharedInbox, portableInbox, gatewayInboxes }]) => [k, {
 				actorIds: [...actorIds],
-				sharedInbox
+				sharedInbox,
+				...getPortableMessageFields(portableInbox, gatewayInboxes)
 			}])),
 			activity: activityJsonLd,
 			activityId: activity.id?.href,
@@ -10275,6 +10916,9 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 			throw error;
 		}
 	}
+	async isSignedByAudience(object, options = {}) {
+		return await isInAudience(object, null) || await isInAudience(object, await this.getSignedKeyOwner(options), options);
+	}
 };
 function forwardActivity(ctx, loggerCategory, forwarder, recipients, options) {
 	return ctx.tracerProvider.getTracer(require_http.name, require_http.version).startActiveSpan(ctx.federation.outboxQueue == null || options?.immediate ? `activitypub.${loggerCategory}` : "activitypub.fanout", {
@@ -10362,13 +11006,12 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 		if (options?.immediate) logger.debug("Forwarding activity immediately without queue since immediate option is set.");
 		else logger.debug("Forwarding activity immediately without queue since queue is not set.");
 		const promises = [];
-		for (const inbox in inboxes) promises.push(sendActivity({
+		for (const inbox in inboxes) promises.push(sendActivityToInbox(inbox, inboxes[inbox].gatewayInboxes, {
 			allowPrivateAddress: ctx.federation.allowPrivateAddress,
 			keys,
 			activity: ctx.activity,
 			activityId: ctx.activityId,
 			activityType: ctx.activityType,
-			inbox: new URL(inbox),
 			sharedInbox: inboxes[inbox].sharedInbox,
 			meterProvider: ctx.meterProvider,
 			tracerProvider: ctx.tracerProvider,
@@ -10396,7 +11039,7 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 	const started = (/* @__PURE__ */ new Date()).toISOString();
 	const messages = [];
 	for (const inbox in inboxes) {
-		const inboxUrl = new URL(inbox);
+		const { portableInbox, gatewayInboxes } = inboxes[inbox];
 		const message = {
 			type: "outbox",
 			id: crypto.randomUUID(),
@@ -10411,7 +11054,8 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 			started,
 			attempt: 0,
 			headers: {},
-			orderingKey: orderingKey == null ? void 0 : `${orderingKey}\n${inboxUrl.origin}`,
+			orderingKey: orderingKey == null ? void 0 : `${orderingKey}\n${getOrderingDestination(inbox, portableInbox)}`,
+			...getPortableMessageFields(portableInbox, gatewayInboxes),
 			traceContext: carrier
 		};
 		messages.push({