@fedify/fedify 2.4.0-dev.2200 → 2.4.0-dev.2212

package/dist/{middleware-BbTJ6C1-.mjs → middleware-BW7-tHAG.mjs}

@@ -1,29 +1,30 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-CxoV48e0.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-BVpdjsaR.mjs";
-import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
 import { d as isPortableUri, f as isSameObjectId, i as getPortableDid, l as isPortableId, n as getCanonicalPortableId, o as hasPortableActor, r as getGatewayKeyBase, s as isCompatibleKeyId, t as getAuthenticationOrigin, u as isPortableKeyId } from "./portable-key-id-Ca30-hOa.mjs";
-import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-DYgoirTo.mjs";
+import { n as isPubliclyAddressedNode, t as isInAudience } from "./audience-CHQ-FlLD.mjs";
+import { n as version, t as name } from "./deno-BKp9fYB3.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DPQKFkiJ.mjs";
+import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
+import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-ChfV9C3v.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-eIekvNtm.mjs";
-import { a as signObject, c as verifyPortableObjectProof, i as hasProofLike, s as verifyObject, t as InvalidPortableObjectIdError, u as verifyPortableObjectProofWithRoot } from "./proof-B9DEHHiO.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as validateMaxSignatures, f as verifyRequest, p as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-BQq1Uldg.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-U141HKIl.mjs";
-import { n as kvCache } from "./kv-cache-D0Mn-VQW.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-DBBVabBC.mjs";
+import { a as signObject, c as verifyPortableObjectProof, i as hasProofLike, s as verifyObject, t as InvalidPortableObjectIdError, u as verifyPortableObjectProofWithRoot } from "./proof-MFz2960e.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as validateMaxSignatures, f as verifyRequest, p as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http--IGUT1mg.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-BjJreYQU.mjs";
+import { n as kvCache } from "./kv-cache-DFIUR-E5.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-CEnNz8O7.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-DpxyMeo9.mjs";
-import { t as verifyPortableObject } from "./portable-collection-DOL3l2C9.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-CZckda2X.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-BGSNMnVH.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-BW5VsXG3.mjs";
+import { t as verifyPortableObject } from "./portable-collection-Ct99JsBe.mjs";
+import { a as getOrderingDestination, i as sendActivityThroughGateways, n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-Duj8xys1.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-CKAVFvcH.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-XJ53md4S.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, s as verifyServedPortableObjects, t as containsCompoundPortableObject } from "./compound-proof-Zpg7Fbk9.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, s as verifyServedPortableObjects, t as containsCompoundPortableObject } from "./compound-proof-BP5SOdXv.mjs";
 import { t as KvKeyCache } from "./keycache-Da8A8mZa.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-Cc1ymEup.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-CVcPKB1N.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -31,10 +32,10 @@ import { RouterError } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, isActor, lookupObject, traverseCollection } from "@fedify/vocab";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
-import { uniq } from "es-toolkit";
 import { FetchError, canonicalizePortableUri, decodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDigestMultibase, parseHashlink, parseIri, resolveDocumentLoaderTimeout, toCompatibleEf61Id } from "@fedify/vocab-runtime";
-import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_HTTP_RESPONSE_HEADER, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 import { isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
+import { uniq } from "es-toolkit";
+import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_HTTP_RESPONSE_HEADER, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 import { DataPointType, MeterProvider as MeterProvider$1, MetricReader } from "@opentelemetry/sdk-metrics";
 import { domainToASCII } from "node:url";
@@ -1212,6 +1213,15 @@ async function handleObject(request, { values, context, objectDispatcher, author
 * only if its ID canonically matches the requested portable ID and it
 * satisfies the FEP-ef61 proof policy.
 *
+* FEP-ef61 forbids serving a non-public object to anyone but its intended
+* audience.  If the dispatcher has an authorization predicate, it decides who
+* may retrieve the object, and the response is marked with
+* `Cache-Control: private`, as it depends on the requester.  Otherwise, only
+* a publicly addressed object is served, and any other object is responded
+* to with `404 Not Found`, as if this server did not store it.  Actors, and
+* anything the actor dispatcher returns, are exempt from the latter, as
+* actors have no audience.
+*
 * A {@link Tombstone} is served with `410 Gone` if it has an Object Integrity
 * Proof made with a key of the DID in its ID.  An unsigned tombstone cannot
 * be served as a portable object, so the response is the same as for
@@ -1221,7 +1231,7 @@ async function handleObject(request, { values, context, objectDispatcher, author
 * @param parameters The parameters for handling the portable object.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handlePortableObject(request, { values, context, objectDispatcher, authorizePredicate, canonicalId, onNotFound, onUnauthorized }) {
+async function handlePortableObject(request, { values, context, objectDispatcher, authorizePredicate, canonicalId, kind, onNotFound, onUnauthorized }) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
@@ -1240,14 +1250,32 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 	if (authorizePredicate != null) {
 		if (!await authorizePredicate(context, values)) return await onUnauthorized(request);
 	}
+	const contextLoader = getNormalizationContextLoader(context.contextLoader);
 	let jsonLd;
-	let servedId;
-	let result;
+	let root;
 	try {
 		jsonLd = await object.toJsonLd(context);
-		servedId = await getJsonLdRootId(jsonLd, context.contextLoader);
+		root = await expandJsonLdRoot(jsonLd, contextLoader);
+	} catch (error) {
+		logger.error("Failed to serialize the portable object {portableId}:\n{error}", {
+			portableId: canonicalId,
+			error
+		});
+		return portableObjectInternalServerError(request);
+	}
+	const servedId = root?.["@id"];
+	if (root == null || typeof servedId !== "string" || !isRequestedPortableId(servedId, canonicalId)) {
+		logger.debug("The serialized object does not match the requested portable object {portableId}.", { portableId: canonicalId });
+		return await onNotFound(request);
+	}
+	if (authorizePredicate == null && kind === "object" && !isActor(object) && !isPubliclyAddressedNode(root)) {
+		logger.debug("Not serving the portable object {portableId}, as it is not publicly addressed and its object dispatcher has no authorization predicate; responding as if this server did not store the object.  Set an authorization predicate that checks if the request is signed by an actor in the object's audience to serve it.", { portableId: canonicalId });
+		return await onNotFound(request);
+	}
+	let result;
+	try {
 		result = await verifyPortableObjectProof(jsonLd, {
-			contextLoader: context.contextLoader,
+			contextLoader,
 			documentLoader: context.documentLoader,
 			tracerProvider: context.tracerProvider,
 			meterProvider: context.meterProvider
@@ -1259,10 +1287,6 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 		});
 		return portableObjectInternalServerError(request);
 	}
-	if (servedId == null || !isRequestedPortableId(servedId, canonicalId)) {
-		logger.debug("The serialized object does not match the requested portable object {portableId}.", { portableId: canonicalId });
-		return await onNotFound(request);
-	}
 	const tombstone = object instanceof Tombstone;
 	if (!result.verified) {
 		if (tombstone && result.reason.type === "missingProof") {
@@ -1281,25 +1305,26 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 			return portableObjectInternalServerError(request);
 		}
 	}
+	const headers = new Headers({
+		"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
+		Vary: "Accept"
+	});
+	if (authorizePredicate != null) headers.set("Cache-Control", "private");
 	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), {
 		status: tombstone ? 410 : 200,
-		headers: {
-			"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
-			Vary: "Accept"
-		}
+		headers
 	});
 }
 function isRequestedPortableObject(object, canonicalId) {
 	return object.id != null && getCanonicalPortableId(object.id) === canonicalId;
 }
-async function getJsonLdRootId(jsonLd, contextLoader) {
+async function expandJsonLdRoot(jsonLd, contextLoader) {
 	const expanded = await jsonld.expand(jsonLd, {
-		documentLoader: getNormalizationContextLoader(contextLoader),
+		documentLoader: contextLoader,
 		keepFreeFloatingNodes: true
 	});
 	if (expanded.length !== 1) return null;
-	const id = expanded[0]["@id"];
-	return typeof id === "string" ? id : null;
+	return expanded[0];
 }
 function isRequestedPortableId(id, canonicalId) {
 	if (!/^ap(?:\+ef61)?:\/\//i.test(id)) return URL.canParse(id) && getCanonicalPortableId(new URL(id)) === canonicalId;
@@ -4045,6 +4070,37 @@ function getBenchmarkTriggerOptions(benchmarkOptions) {
 function maxDelay(first, second) {
 	return Temporal.Duration.compare(first, second) >= 0 ? first : second;
 }
+/**
+* Gets the fields of a queued message that describe the FEP-ef61 portable
+* inbox an inbox stands for, if any, omitting the absent ones.
+*/
+function getPortableMessageFields(portableInbox, gatewayInboxes) {
+	return {
+		...portableInbox == null ? {} : { portableInbox },
+		...gatewayInboxes == null ? {} : { gatewayInboxes: [...gatewayInboxes] }
+	};
+}
+/**
+* Sends an activity to an inbox, or, if the inbox is the compatible
+* identifier of an FEP-ef61 portable inbox on more than one gateway, through
+* the first gateway that accepts it.
+*/
+function sendActivityToInbox(inbox, gatewayInboxes, parameters) {
+	if (gatewayInboxes == null || gatewayInboxes.length < 2) return sendActivity({
+		...parameters,
+		inbox: new URL(inbox)
+	});
+	return sendActivityThroughGateways(parameters, gatewayInboxes.map((i) => new URL(i)));
+}
+function parseInstant(value) {
+	if (value == null) return void 0;
+	try {
+		return Temporal.Instant.from(value);
+	} catch (error) {
+		if (error instanceof RangeError) return void 0;
+		throw error;
+	}
+}
 function isTransportDeliveryError(error) {
 	return error instanceof FetchError || isAbortError(error);
 }
@@ -4625,6 +4681,20 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}
 			recordOutboxActivity(this.meterProvider, "abandoned", message.activityType);
 		};
+		const { gatewayInboxes } = message;
+		if (gatewayInboxes != null && gatewayInboxes.length > 1) {
+			await this.#listenGatewayOutboxMessage(_, {
+				...message,
+				gatewayInboxes
+			}, span, {
+				keys,
+				logData,
+				getActorIds,
+				parseActivity,
+				dropHeldOutboxMessage
+			});
+			return;
+		}
 		try {
 			const inbox = new URL(message.inbox);
 			const circuit = this.outboxQueue == null ? void 0 : this.circuitBreaker;
@@ -4847,6 +4917,308 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		logger.info("Successfully sent activity {activityId} to {inbox}.", { ...logData });
 	}
+	/**
+	* Delivers a queued activity to an FEP-ef61 portable inbox through the first
+	* of its gateways that accepts it, trying them one after another in a single
+	* round, so that the round counts as one attempt for the retry policy, keeps
+	* the message's place in its ordering key, and is replayed as a whole by
+	* queues that retry natively.
+	*
+	* A gateway that fails with a permanent failure status is not tried again.
+	* A gateway whose circuit is open, or which asked to be retried later with
+	* `Retry-After`, is skipped in this round.  If no gateway accepts the
+	* activity, the message is held while every remaining gateway is held, and
+	* otherwise retried according to the retry policy.
+	*/
+	async #listenGatewayOutboxMessage(contextData, message, span, helpers) {
+		const logger = getLogger([
+			"fedify",
+			"federation",
+			"outbox"
+		]);
+		const circuitLogger = getLogger([
+			"fedify",
+			"federation",
+			"circuit"
+		]);
+		const { keys, logData, getActorIds, parseActivity, dropHeldOutboxMessage } = helpers;
+		const circuit = this.outboxQueue == null ? void 0 : this.circuitBreaker;
+		const specDeterminer = new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl });
+		const survivors = [];
+		let lastError;
+		let lastPermanent;
+		let activity;
+		const getActivity = async () => activity ??= await parseActivity();
+		const drop = async (circuit, remoteHost, inbox, heldSince) => {
+			await dropHeldOutboxMessage(circuit, remoteHost, inbox, heldSince, await getActivity());
+		};
+		const heldSince = parseInstant(message.circuitHeldSince);
+		if (circuit != null && heldSince != null && Temporal.Instant.compare(heldSince.add(circuit.options.heldActivityTtl), Temporal.Now.instant()) <= 0) {
+			const inbox = new URL(message.gatewayInboxes[0]);
+			await drop(circuit, getRemoteHost(inbox), inbox, heldSince);
+			return;
+		}
+		for (const inboxHref of message.gatewayInboxes) {
+			const inbox = new URL(inboxHref);
+			const remoteHost = getRemoteHost(inbox);
+			const now = Temporal.Now.instant();
+			const notBefore = parseInstant(message.gatewayNotBefore?.[inboxHref]);
+			if (notBefore != null && Temporal.Instant.compare(notBefore, now) > 0) {
+				survivors.push({
+					inbox: inboxHref,
+					holdDelay: now.until(notBefore),
+					notBefore
+				});
+				continue;
+			}
+			let decision;
+			if (circuit != null) try {
+				decision = await circuit.beforeSend(remoteHost, message);
+			} catch (circuitError) {
+				circuitLogger.error("Failed to check circuit breaker state before sending; proceeding with delivery:\n{error}", {
+					...logData,
+					remoteHost,
+					error: circuitError
+				});
+			}
+			if (decision != null && circuit != null) {
+				if (decision.type === "drop") {
+					await drop(circuit, remoteHost, inbox, decision.heldSince);
+					return;
+				} else if (decision.type === "hold") {
+					recordCircuitBreakerHeldSpanEvent(span, remoteHost, decision.state);
+					survivors.push({
+						inbox: inboxHref,
+						holdDelay: decision.delay,
+						circuitHeld: true
+					});
+					continue;
+				} else if (decision.stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, decision.stateChange);
+			}
+			try {
+				await sendActivity({
+					allowPrivateAddress: this.allowPrivateAddress,
+					keys,
+					activity: message.activity,
+					activityId: message.activityId,
+					activityType: message.activityType,
+					inbox,
+					sharedInbox: message.sharedInbox,
+					headers: new Headers(message.headers),
+					specDeterminer,
+					meterProvider: this.meterProvider,
+					tracerProvider: this.tracerProvider
+				});
+			} catch (error) {
+				lastError = error;
+				const isPermanentFailure = error instanceof SendActivityError && this.permanentFailureStatusCodes.includes(error.statusCode);
+				let retryAfter = !isPermanentFailure && error instanceof SendActivityError && (error.statusCode === 429 || error.statusCode === 503) ? parseRetryAfter(error.responseHeaders) : void 0;
+				let retryAt;
+				if (retryAfter != null) try {
+					retryAt = Temporal.Now.instant().add(retryAfter);
+				} catch (e) {
+					if (!(e instanceof RangeError)) throw e;
+					retryAfter = void 0;
+				}
+				let postDecision;
+				if (circuit != null) try {
+					if (error instanceof SendActivityError) {
+						const { statusCode } = error;
+						const stateChange = isPermanentFailure || statusCode === 429 || statusCode >= 400 && statusCode < 500 ? await circuit.recordReachableFailure(remoteHost) : statusCode >= 500 ? await circuit.recordFailure(remoteHost) : void 0;
+						if (stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, stateChange);
+					} else if (isTransportDeliveryError(error)) {
+						const stateChange = await circuit.recordFailure(remoteHost);
+						if (stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, stateChange);
+					}
+					if (!isPermanentFailure) postDecision = await circuit.beforeSend(remoteHost, message);
+				} catch (circuitError) {
+					circuitLogger.error("Failed to update circuit breaker state after delivery failure; falling back to normal failure handling:\n{error}", {
+						...logData,
+						remoteHost,
+						error: circuitError
+					});
+				}
+				span.addEvent("activitypub.delivery.failed", {
+					"activitypub.remote.host": remoteHost,
+					"activitypub.delivery.attempt": message.attempt,
+					"activitypub.delivery.permanent_failure": isPermanentFailure,
+					...error instanceof SendActivityError ? { "http.response.status_code": error.statusCode } : {}
+				});
+				try {
+					await this.onOutboxError?.(error, await getActivity());
+				} catch (handlerError) {
+					logger.error("An unexpected error occurred in onError handler:\n{error}", {
+						...logData,
+						inbox: inboxHref,
+						error: handlerError
+					});
+				}
+				if (isPermanentFailure) {
+					logger.warn("Permanent delivery failure for activity {activityId} to {inbox} ({status}); not trying the gateway again.", {
+						...logData,
+						inbox: inboxHref,
+						status: error.statusCode
+					});
+					lastPermanent = {
+						error,
+						inbox
+					};
+					continue;
+				}
+				if (postDecision?.type === "drop" && circuit != null) {
+					await drop(circuit, remoteHost, inbox, postDecision.heldSince);
+					return;
+				} else if (postDecision?.type === "hold") {
+					recordCircuitBreakerHeldSpanEvent(span, remoteHost, postDecision.state);
+					survivors.push({
+						inbox: inboxHref,
+						holdDelay: retryAfter == null ? postDecision.delay : maxDelay(postDecision.delay, retryAfter),
+						circuitHeld: true,
+						postFailure: true,
+						notBefore: retryAt,
+						retryAfter
+					});
+				} else survivors.push({
+					inbox: inboxHref,
+					notBefore: retryAt,
+					retryAfter
+				});
+				logger.warn("Failed to send activity {activityId} to {inbox} (attempt #{attempt}); trying the next gateway if any:\n{error}", {
+					...logData,
+					inbox: inboxHref,
+					error
+				});
+				continue;
+			}
+			if (circuit != null) try {
+				const stateChange = await circuit.recordSuccess(remoteHost);
+				if (stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, stateChange);
+			} catch (error) {
+				circuitLogger.error("Failed to record successful delivery in circuit breaker state; the activity was already delivered:\n{error}", {
+					...logData,
+					remoteHost,
+					error
+				});
+			}
+			logger.info("Successfully sent activity {activityId} to {inbox}.", {
+				...logData,
+				inbox: inboxHref
+			});
+			return;
+		}
+		if (lastError != null) span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: String(lastError)
+		});
+		if (survivors.length < 1) {
+			const { error, inbox } = lastPermanent;
+			this.metrics.recordPermanentFailure(error.inbox, error.statusCode);
+			logger.warn("Permanent delivery failure for activity {activityId} to every gateway of {portableInbox}; not retrying.", {
+				...logData,
+				portableInbox: message.portableInbox
+			});
+			if (this.outboxPermanentFailureHandler != null) {
+				const ctx = this.#createContext(new URL(message.baseUrl), contextData, { documentLoader: this.documentLoaderFactory(this.#getLoaderOptions(message.baseUrl)) });
+				try {
+					await this.outboxPermanentFailureHandler(ctx, {
+						reason: "http",
+						inbox,
+						activity: await getActivity(),
+						error,
+						statusCode: error.statusCode,
+						actorIds: getActorIds()
+					});
+				} catch (handlerError) {
+					logger.error("An unexpected error occurred in outboxPermanentFailureHandler:\n{error}", {
+						...logData,
+						error: handlerError
+					});
+				}
+			}
+			recordOutboxActivity(this.meterProvider, "abandoned", message.activityType);
+			return;
+		}
+		const now = Temporal.Now.instant();
+		const gatewayNotBefore = {};
+		for (const survivor of survivors) if (survivor.notBefore != null && Temporal.Instant.compare(survivor.notBefore, now) > 0) gatewayNotBefore[survivor.inbox] = survivor.notBefore.toString();
+		const { circuitHeld: _circuitHeld, gatewayNotBefore: _gatewayNotBefore, ...rest } = message;
+		const nextMessage = {
+			...rest,
+			inbox: survivors[0].inbox,
+			gatewayInboxes: survivors.map((s) => s.inbox),
+			...globalThis.Object.keys(gatewayNotBefore).length < 1 ? {} : { gatewayNotBefore }
+		};
+		const { outboxQueue } = this;
+		const policyDelay = this.outboxRetryPolicy({
+			elapsedTime: Temporal.Instant.from(message.started).until(now),
+			attempts: message.attempt
+		});
+		if (outboxQueue != null && survivors.every((s) => s.holdDelay != null) && (policyDelay != null || !survivors.some((s) => s.postFailure))) {
+			let delay = survivors.map((s) => s.holdDelay).reduce((a, b) => Temporal.Duration.compare(a, b) <= 0 ? a : b);
+			let heldMessage = nextMessage;
+			if (survivors.some((s) => s.circuitHeld)) {
+				const since = heldSince ?? now;
+				if (circuit != null) delay = circuit.capHeldDelay(since, delay);
+				heldMessage = {
+					...nextMessage,
+					circuitHeld: true,
+					circuitHeldSince: since.toString()
+				};
+			}
+			logger.warn("Failed to send activity {activityId} to {portableInbox}; holding it until one of its gateways can be tried again.", {
+				...logData,
+				portableInbox: message.portableInbox
+			});
+			await outboxQueue.enqueue(heldMessage, {
+				delay: clampNegativeDelay(delay),
+				orderingKey: message.orderingKey
+			});
+			this.metrics.recordQueueTaskEnqueued({
+				role: "outbox",
+				queue: outboxQueue,
+				activityType: heldMessage.activityType
+			}, heldMessage.attempt);
+			return;
+		}
+		const hasRetryAfter = survivors.some((s) => s.retryAfter != null);
+		if (outboxQueue?.nativeRetrial && !hasRetryAfter && survivors.length === message.gatewayInboxes.length && globalThis.Object.keys(gatewayNotBefore).length < 1) {
+			logger.error("Failed to send activity {activityId} to every gateway of {portableInbox}; backend will handle retry:\n{error}", {
+				...logData,
+				portableInbox: message.portableInbox,
+				error: lastError
+			});
+			throw lastError;
+		}
+		if (policyDelay == null || outboxQueue == null) {
+			logger.error("Failed to send activity {activityId} to every gateway of {portableInbox} after {attempt} attempts; giving up:\n{error}", {
+				...logData,
+				portableInbox: message.portableInbox,
+				error: lastError
+			});
+			recordOutboxActivity(this.meterProvider, "abandoned", message.activityType);
+			return;
+		}
+		const delay = survivors.map((s) => s.holdDelay ?? s.retryAfter ?? policyDelay).reduce((a, b) => Temporal.Duration.compare(a, b) <= 0 ? a : b);
+		const retryMessage = {
+			...nextMessage,
+			attempt: message.attempt + 1
+		};
+		logger.error("Failed to send activity {activityId} to every gateway of {portableInbox} (attempt #{attempt}); retry...:\n{error}", {
+			...logData,
+			portableInbox: message.portableInbox,
+			error: lastError
+		});
+		await outboxQueue.enqueue(retryMessage, {
+			delay: clampNegativeDelay(delay),
+			orderingKey: message.orderingKey
+		});
+		this.metrics.recordQueueTaskEnqueued({
+			role: "outbox",
+			queue: outboxQueue,
+			activityType: retryMessage.activityType
+		}, retryMessage.attempt);
+		recordOutboxActivity(this.meterProvider, "retried", retryMessage.activityType);
+	}
 	async #listenInboxMessage(ctxData, message, span, onActivityType) {
 		const logger = getLogger([
 			"fedify",
@@ -5276,13 +5648,12 @@ var FederationImpl = class extends FederationBuilderImpl {
 				activity: jsonLd
 			});
 			const promises = [];
-			for (const inbox in inboxes) promises.push(sendActivity({
+			for (const inbox in inboxes) promises.push(sendActivityToInbox(inbox, inboxes[inbox].gatewayInboxes, {
 				allowPrivateAddress: this.allowPrivateAddress,
 				keys,
 				activity: jsonLd,
 				activityId: activity.id?.href,
 				activityType: getTypeId(activity).href,
-				inbox: new URL(inbox),
 				sharedInbox: inboxes[inbox].sharedInbox,
 				headers: collectionSync == null ? void 0 : new Headers({ "Collection-Synchronization": await buildCollectionSynchronizationHeader(collectionSync, inboxes[inbox].actorIds) }),
 				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
@@ -5309,8 +5680,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 		propagation.inject(context.active(), carrier);
 		const messages = [];
 		for (const inbox in inboxes) {
-			const inboxOrigin = new URL(inbox).origin;
-			const messageOrderingKey = orderingKey == null ? void 0 : `${orderingKey}\n${inboxOrigin}`;
+			const { portableInbox, gatewayInboxes } = inboxes[inbox];
+			const messageOrderingKey = orderingKey == null ? void 0 : `${orderingKey}\n${getOrderingDestination(inbox, portableInbox)}`;
 			const message = {
 				type: "outbox",
 				id: crypto.randomUUID(),
@@ -5326,6 +5697,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				attempt: 0,
 				headers: collectionSync == null ? {} : { "Collection-Synchronization": await buildCollectionSynchronizationHeader(collectionSync, inboxes[inbox].actorIds) },
 				orderingKey: messageOrderingKey,
+				...getPortableMessageFields(portableInbox, gatewayInboxes),
 				traceContext: carrier
 			};
 			messages.push({
@@ -5775,6 +6147,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				objectDispatcher: actorDispatcher == null ? void 0 : (ctx) => actorDispatcher(ctx, identifier),
 				authorizePredicate: authorizePredicate == null ? void 0 : (ctx) => authorizePredicate(ctx, identifier),
 				canonicalId: portable.canonicalId,
+				kind: "actor",
 				onUnauthorized,
 				onNotFound
 			});
@@ -5795,6 +6168,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			objectDispatcher: callbacks?.dispatcher,
 			authorizePredicate: callbacks?.authorizePredicate,
 			canonicalId: portable.canonicalId,
+			kind: "object",
 			onUnauthorized,
 			onNotFound
 		});
@@ -6791,9 +7165,10 @@ var ContextImpl = class ContextImpl {
 			id: crypto.randomUUID(),
 			baseUrl: this.origin,
 			keys: keyJwkPairs,
-			inboxes: globalThis.Object.fromEntries(globalThis.Object.entries(inboxes).map(([k, { actorIds, sharedInbox }]) => [k, {
+			inboxes: globalThis.Object.fromEntries(globalThis.Object.entries(inboxes).map(([k, { actorIds, sharedInbox, portableInbox, gatewayInboxes }]) => [k, {
 				actorIds: [...actorIds],
-				sharedInbox
+				sharedInbox,
+				...getPortableMessageFields(portableInbox, gatewayInboxes)
 			}])),
 			activity: activityJsonLd,
 			activityId: activity.id?.href,
@@ -7090,6 +7465,9 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 			throw error;
 		}
 	}
+	async isSignedByAudience(object, options = {}) {
+		return await isInAudience(object, null) || await isInAudience(object, await this.getSignedKeyOwner(options), options);
+	}
 };
 function forwardActivity(ctx, loggerCategory, forwarder, recipients, options) {
 	return ctx.tracerProvider.getTracer(name, version).startActiveSpan(ctx.federation.outboxQueue == null || options?.immediate ? `activitypub.${loggerCategory}` : "activitypub.fanout", {
@@ -7177,13 +7555,12 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 		if (options?.immediate) logger.debug("Forwarding activity immediately without queue since immediate option is set.");
 		else logger.debug("Forwarding activity immediately without queue since queue is not set.");
 		const promises = [];
-		for (const inbox in inboxes) promises.push(sendActivity({
+		for (const inbox in inboxes) promises.push(sendActivityToInbox(inbox, inboxes[inbox].gatewayInboxes, {
 			allowPrivateAddress: ctx.federation.allowPrivateAddress,
 			keys,
 			activity: ctx.activity,
 			activityId: ctx.activityId,
 			activityType: ctx.activityType,
-			inbox: new URL(inbox),
 			sharedInbox: inboxes[inbox].sharedInbox,
 			meterProvider: ctx.meterProvider,
 			tracerProvider: ctx.tracerProvider,
@@ -7211,7 +7588,7 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 	const started = (/* @__PURE__ */ new Date()).toISOString();
 	const messages = [];
 	for (const inbox in inboxes) {
-		const inboxUrl = new URL(inbox);
+		const { portableInbox, gatewayInboxes } = inboxes[inbox];
 		const message = {
 			type: "outbox",
 			id: crypto.randomUUID(),
@@ -7226,7 +7603,8 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 			started,
 			attempt: 0,
 			headers: {},
-			orderingKey: orderingKey == null ? void 0 : `${orderingKey}\n${inboxUrl.origin}`,
+			orderingKey: orderingKey == null ? void 0 : `${orderingKey}\n${getOrderingDestination(inbox, portableInbox)}`,
+			...getPortableMessageFields(portableInbox, gatewayInboxes),
 			traceContext: carrier
 		};
 		messages.push({

package/dist/{middleware-rpYJG85a.mjs → middleware-G9zpxUsD.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-BbTJ6C1-.mjs";
+import { n as FederationImpl } from "./middleware-BW7-tHAG.mjs";
 export { FederationImpl };