@fedify/fedify 2.4.0-dev.2219 → 2.4.0-dev.2233

package/dist/{middleware-BdzcazaN.js → middleware-D0t1NBIE.js}

@@ -2,10 +2,10 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { $ as instrumentDocumentLoader, A as hasSignature, At as name, C as InvalidContextReferenceError, Ct as hasPortableActor, Dt as isPortableUri, E as compactJsonLd, Et as isPortableKeyId, F as verifyCompactJsonLd, G as validateCryptoKey, M as isClearlyMalformedContextReference, N as isInvalidUrlTypeError, O as detachSignature, Ot as isSameObjectId, P as signJsonLd, Q as getRemoteHost, R as wrapContextLoaderForJsonLd, S as normalizeOutgoingActivityJsonLd, St as getRawCanonicalPortableId, Tt as isPortableId, W as importJwk, X as getDurationMs, Z as getFederationMetrics, _ as verifyObject, at as recordCollectionTotalItems, b as verifyPortableObjectProofWithRoot, bt as getGatewayKeyBase, c as verifyRequestDetailed, ct as recordInboxActivity, d as InvalidPortableObjectIdError, dt as recordWebFingerHandle, et as isAbortError, f as classifyFep2277CoreType, ft as registerQueueDepthGauge, g as verifyMapLocalProof, h as signObject, i as selectRequestSignature, it as recordCollectionRequest, j as hasSignatureLike, jt as version, k as getNormalizationContextLoader, lt as recordOutboxActivity, m as hasProofLike, mt as formatAcceptSignature, n as listRequestSignatures, nt as recordCollectionDispatchDuration, o as validateMaxSignatures, pt as preloadedOnlyDocumentLoader, q as MAX_PORTABLE_KEY_TTL, r as parseRfc9421SignatureInput, rt as recordCollectionPageItems, s as verifyRequest, st as recordFanoutRecipients, t as doubleKnock, tt as recordCircuitBreakerStateChange, ut as recordOutboxEnqueue, v as verifyPortableObjectProof, vt as getAuthenticationOrigin, w as assertSafeJsonLd, wt as isCompatibleKeyId, xt as getPortableDid, y as verifyPortableObjectProofPolicy, yt as getCanonicalPortableId, z as exportJwk } from "./http-Dx7yMmfw.js";
+import { $ as instrumentDocumentLoader, A as hasSignature, At as name, C as InvalidContextReferenceError, Ct as hasPortableActor, Dt as isPortableUri, E as compactJsonLd, Et as isPortableKeyId, F as verifyCompactJsonLd, G as validateCryptoKey, M as isClearlyMalformedContextReference, N as isInvalidUrlTypeError, O as detachSignature, Ot as isSameObjectId, P as signJsonLd, Q as getRemoteHost, R as wrapContextLoaderForJsonLd, S as normalizeOutgoingActivityJsonLd, St as getRawCanonicalPortableId, Tt as isPortableId, W as importJwk, X as getDurationMs, Z as getFederationMetrics, _ as verifyObject, at as recordCollectionTotalItems, b as verifyPortableObjectProofWithRoot, bt as getGatewayKeyBase, c as verifyRequestDetailed, ct as recordInboxActivity, d as InvalidPortableObjectIdError, dt as recordWebFingerHandle, et as isAbortError, f as classifyFep2277CoreType, ft as registerQueueDepthGauge, g as verifyMapLocalProof, h as signObject, i as selectRequestSignature, it as recordCollectionRequest, j as hasSignatureLike, jt as version, k as getNormalizationContextLoader, lt as recordOutboxActivity, m as hasProofLike, mt as formatAcceptSignature, n as listRequestSignatures, nt as recordCollectionDispatchDuration, o as validateMaxSignatures, pt as preloadedOnlyDocumentLoader, q as MAX_PORTABLE_KEY_TTL, r as parseRfc9421SignatureInput, rt as recordCollectionPageItems, s as verifyRequest, st as recordFanoutRecipients, t as doubleKnock, tt as recordCircuitBreakerStateChange, ut as recordOutboxEnqueue, v as verifyPortableObjectProof, vt as getAuthenticationOrigin, w as assertSafeJsonLd, wt as isCompatibleKeyId, xt as getPortableDid, y as verifyPortableObjectProofPolicy, yt as getCanonicalPortableId, z as exportJwk } from "./http-D4JQwy-3.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-_S2_MeLF.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-C0c0rUN9.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-CUZOCSKZ.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-ZczKiIeK.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DXFAaMh2.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, PUBLIC_COLLECTION, Tombstone, getTypeId, isActor, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -1456,7 +1456,7 @@ const textEncoder = new TextEncoder();
 function isPortableIdValue(value) {
 	return typeof value === "string" && isPortableId(value);
 }
-function isJsonMap(value) {
+function isJsonMap$1(value) {
 	return typeof value === "object" && value != null && !Array.isArray(value);
 }
 function isCompoundProofJsonObject(value) {
@@ -1522,7 +1522,7 @@ function addBytes(statistics, bytes, limits, path) {
 	if (statistics.byteLength > limits.maxBytes) return limitExceeded("bytes", limits.maxBytes, statistics.byteLength, path);
 }
 function inspectJsonTree(root, limits) {
-	if (!isJsonMap(root)) return {
+	if (!isJsonMap$1(root)) return {
 		status: "unsupported",
 		reason: {
 			type: "invalidJsonTree",
@@ -1585,7 +1585,7 @@ function inspectJsonTree(root, limits) {
 				insideProof: current.insideProof,
 				insideContext: current.insideContext
 			});
-		} else if (isJsonMap(value)) {
+		} else if (isJsonMap$1(value)) {
 			const prototype = Object.getPrototypeOf(value);
 			if (seen.has(value) || !hasOnlyDataProperties(value) || prototype !== Object.prototype && prototype !== null) return {
 				status: "unsupported",
@@ -1606,7 +1606,7 @@ function inspectJsonTree(root, limits) {
 			if (hasDirectProof) {
 				statistics.proofCount++;
 				if (statistics.proofCount > limits.maxProofs) return limitExceeded("proofs", limits.maxProofs, statistics.proofCount, childPath(current.path, "proof"));
-				if (!isJsonMap(value.proof)) return {
+				if (!isJsonMap$1(value.proof)) return {
 					status: "unsupported",
 					reason: {
 						type: "unsupportedProofShape",
@@ -1781,7 +1781,7 @@ function inspectCompoundPortableObjectApplicability(json, limits) {
 				iterator: value.values(),
 				depth: frame.depth + 1
 			});
-		} else if (isJsonMap(value)) {
+		} else if (isJsonMap$1(value)) {
 			mapCount++;
 			if (mapCount > limits.maxMaps) return "indeterminate";
 			if ([value.id, value["@id"]].some(isPortableIdValue)) return "present";
@@ -1877,7 +1877,7 @@ function containsCompoundPortableObject(json) {
 * @internal
 */
 function findUnsupportedCompoundProofShape(json) {
-	return findInJsonMaps(json, (map, path) => Object.hasOwn(map, "proof") && !isJsonMap(map.proof) ? childPath(path, "proof") : void 0) ?? null;
+	return findInJsonMaps(json, (map, path) => Object.hasOwn(map, "proof") && !isJsonMap$1(map.proof) ? childPath(path, "proof") : void 0) ?? null;
 }
 /**
 * Discovers direct literal proof-bearing maps in an immutable JSON snapshot.
@@ -2079,13 +2079,13 @@ async function isEmbeddedPortableKey(parent, member, key, parentId) {
 	}
 	if (expanded.length !== 1 || hasGraphKeyword(expanded)) return false;
 	const node = expanded[0];
-	if (!isJsonMap(node) || typeof node["@id"] !== "string" || getCanonicalPortableIdOf(node["@id"]) !== parentPortableId) return false;
+	if (!isJsonMap$1(node) || typeof node["@id"] !== "string" || getCanonicalPortableIdOf(node["@id"]) !== parentPortableId) return false;
 	const properties = Object.keys(node).filter((property) => property !== "@id" && property !== "@type");
 	if (properties.length !== 1 || properties[0] !== `${SECURITY}${member}`) return false;
 	const values = node[properties[0]];
 	if (!Array.isArray(values) || values.length !== 1) return false;
 	const expandedKey = values[0];
-	if (!isJsonMap(expandedKey) || expandedKey["@id"] !== literalIds[0] || Object.keys(expandedKey).some((property) => !KEY_PROPERTIES.has(property))) return false;
+	if (!isJsonMap$1(expandedKey) || expandedKey["@id"] !== literalIds[0] || Object.keys(expandedKey).some((property) => !KEY_PROPERTIES.has(property))) return false;
 	const types = expandedKey["@type"];
 	if (types !== void 0 && (!Array.isArray(types) || types.some((type) => typeof type !== "string" || !KEY_TYPES.has(type)))) return false;
 	const pem = expandedKey[`${SECURITY}publicKeyPem`];
@@ -2096,7 +2096,7 @@ async function isEmbeddedPortableKey(parent, member, key, parentId) {
 	for (const property of [`${SECURITY}owner`, `${SECURITY}controller`]) {
 		const owners = expandedKey[property];
 		if (owners === void 0) continue;
-		if (!Array.isArray(owners) || owners.length !== 1 || !isJsonMap(owners[0]) || Object.keys(owners[0]).length !== 1 || typeof owners[0]["@id"] !== "string" || getCanonicalPortableIdOf(owners[0]["@id"]) !== parentPortableId) return false;
+		if (!Array.isArray(owners) || owners.length !== 1 || !isJsonMap$1(owners[0]) || Object.keys(owners[0]).length !== 1 || typeof owners[0]["@id"] !== "string" || getCanonicalPortableIdOf(owners[0]["@id"]) !== parentPortableId) return false;
 	}
 	return true;
 }
@@ -2139,7 +2139,7 @@ function isSimpleContext(context) {
 }
 function hasGraphKeyword(value) {
 	if (Array.isArray(value)) return value.some(hasGraphKeyword);
-	if (!isJsonMap(value)) return false;
+	if (!isJsonMap$1(value)) return false;
 	return Object.entries(value).some(([key, child]) => key === "@graph" || key === "@included" || key === "@reverse" || hasGraphKeyword(child));
 }
 /**
@@ -2149,7 +2149,7 @@ function hasGraphKeyword(value) {
 function isSingleStringValue(values, datatype) {
 	if (!Array.isArray(values) || values.length !== 1) return false;
 	const value = values[0];
-	if (!isJsonMap(value) || typeof value["@value"] !== "string") return false;
+	if (!isJsonMap$1(value) || typeof value["@value"] !== "string") return false;
 	const keys = Object.keys(value);
 	return keys.length === 1 || datatype != null && keys.length === 2 && value["@type"] === datatype;
 }
@@ -2204,7 +2204,7 @@ async function verifyServedPortableObjects(json, options = {}) {
 	const maps = collected.maps;
 	const discovered = /* @__PURE__ */ new Map();
 	const ids = maps.map((candidate) => candidate.id);
-	const rootId = isJsonMap(json) ? [json.id, json["@id"]].find(isPortableIdValue) : void 0;
+	const rootId = isJsonMap$1(json) ? [json.id, json["@id"]].find(isPortableIdValue) : void 0;
 	if (rootId != null) ids.push(rootId);
 	for (const id of ids) discovered.set(id, (discovered.get(id) ?? 0) + 1);
 	let hidden;
@@ -2249,7 +2249,7 @@ function findHiddenPortableObject(expanded, discovered) {
 			pending.push(...value);
 			continue;
 		}
-		if (!isJsonMap(value)) continue;
+		if (!isJsonMap$1(value)) continue;
 		const id = value["@id"];
 		if (isPortableIdValue(id) && Object.keys(value).some((key) => key !== "@id")) {
 			const count = remaining.get(id) ?? 0;
@@ -2340,7 +2340,7 @@ function collectServedPortableMaps(json) {
 }
 async function checkServedPortableMap({ map, contexts }, options) {
 	if (Object.hasOwn(map, "proof")) {
-		if (!isJsonMap(map.proof)) return "unsupportedProofShape";
+		if (!isJsonMap$1(map.proof)) return "unsupportedProofShape";
 		if (!Object.hasOwn(map, "@context")) return "missingContext";
 		try {
 			const policy = await verifyPortableObjectProofPolicy(map, await verifyMapLocalProof(map, options), options);
@@ -2361,11 +2361,185 @@ async function checkServedPortableMap({ map, contexts }, options) {
 	} catch {
 		return "unsupportedContext";
 	}
-	if (expanded.length !== 1 || !isJsonMap(expanded[0])) return "invalidPortableObject";
+	if (expanded.length !== 1 || !isJsonMap$1(expanded[0])) return "invalidPortableObject";
 	const type = classifyFep2277CoreType(expanded[0]);
 	return UNSECURED_CORE_TYPES.has(type) ? null : "missingProof";
 }
 //#endregion
+//#region src/federation/compatible-id-warning.ts
+/** Returns a verified first gateway, without dereferencing the actor. */
+async function getLocalFirstGateway(context, ownerId, did) {
+	try {
+		const parsed = context.parseUri(ownerId, { portable: true });
+		if (parsed?.type !== "actor" || parsed.authority !== did) return null;
+		return firstGateway(await context.getActor(parsed.identifier), did);
+	} catch (error) {
+		getLogger([
+			"fedify",
+			"federation",
+			"object"
+		]).debug("Could not check the first gateway of {ownerId}: {error}", {
+			ownerId: ownerId.href,
+			error
+		});
+		return null;
+	}
+}
+function firstGateway(actor, did) {
+	if (actor?.id == null || getPortableDid(actor.id) !== did) return null;
+	const gateway = actor.gateway;
+	return gateway != null && isGatewayUrl(gateway) ? gateway : null;
+}
+/** Looks for an actor already embedded in the document being published. */
+function getEmbeddedFirstGateway(json, ownerId, did) {
+	const owner = getCanonicalPortableId(ownerId);
+	if (owner == null) return null;
+	return visitJsonMaps(json, (map) => {
+		const id = parseMapId(map, isJsonMap(json) ? json : null);
+		if (id == null || getCanonicalPortableId(id) !== owner) return;
+		const gateways = map.gateways ?? map["https://w3id.org/fep/ef61/gateways"];
+		const first = Array.isArray(gateways) ? gateways[0] : isJsonMap(gateways) && Array.isArray(gateways["@list"]) ? gateways["@list"][0] : null;
+		const address = typeof first === "string" ? first : isJsonMap(first) ? first.id ?? first["@id"] : null;
+		if (typeof address !== "string") return;
+		try {
+			const gateway = new URL(address);
+			if (getPortableDid(id) === did && isGatewayUrl(gateway)) return gateway;
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+		}
+	}) ?? null;
+}
+function isJsonMap(value) {
+	return value != null && typeof value === "object" && !Array.isArray(value);
+}
+/** Warns only when the publisher's actual first gateway is known. */
+function warnCompatibleId(id, did, gateway, kind) {
+	if (!isCompatibleEf61Iri(id) || getPortableDid(id) !== did || id.origin === gateway.origin) return;
+	getLogger([
+		"fedify",
+		"federation",
+		kind === "activity" ? "outbox" : "object"
+	]).warn("The {kind} {id} has an FEP-ef61 compatible identifier on another gateway than its owner's first gateway, {gateway}.  FEP-ef61 requires publishers to use the first gateway in the actor's gateways.", {
+		kind,
+		id: id.href,
+		gateway: gateway.origin
+	});
+}
+/** Reads the root ID without dereferencing or expanding the document. */
+function getCompactRootId(json) {
+	return isJsonMap(json) ? parseMapId(json, json) : null;
+}
+/** Checks an activity and its embedded objects against each one's owner. */
+async function warnCompatibleIdsInJson(json, context) {
+	const root = isJsonMap(json) ? json : null;
+	const rootOwners = root == null ? [] : ownerIds(root, "actor", root);
+	const gateways = /* @__PURE__ */ new Map();
+	const maps = [];
+	visitJsonMaps(json, (map, path) => {
+		maps.push({
+			map,
+			path
+		});
+	});
+	for (const { map, path } of maps) {
+		const id = parseMapId(map, root);
+		if (id == null || !isCompatibleEf61Iri(id)) continue;
+		const type = map.type ?? map["@type"];
+		if ((Array.isArray(type) ? type : [type]).some((t) => typeof t === "string" && /(?:^|[#/:])(CryptographicKey|Multikey|JsonWebKey|Key)$/.test(t))) continue;
+		const did = getPortableDid(id);
+		if (did == null) continue;
+		const owners = path === "" ? rootOwners : [
+			...ownerIds(map, "actor", root),
+			...ownerIds(map, "attributedTo", root),
+			...rootOwners
+		];
+		for (const ownerId of owners) {
+			if (getPortableDid(ownerId) !== did) continue;
+			const key = getCanonicalPortableId(ownerId);
+			if (key == null) continue;
+			let gateway = gateways.get(key);
+			if (gateway === void 0) {
+				gateway = getEmbeddedFirstGateway(json, ownerId, did) ?? (context == null ? null : await getLocalFirstGateway(context, ownerId, did));
+				gateways.set(key, gateway);
+			}
+			if (gateway != null) {
+				warnCompatibleId(id, did, gateway, path === "" ? "activity" : "object");
+				break;
+			}
+		}
+	}
+}
+function ownerIds(map, term, root) {
+	const iri = `https://www.w3.org/ns/activitystreams#${term}`;
+	const values = [map[term], map[iri]];
+	for (const context of [map["@context"], root?.["@context"]]) for (const [alias, definition] of localContextEntries(context)) {
+		const mapped = typeof definition === "string" ? definition : isJsonMap(definition) ? definition["@id"] : null;
+		if (mapped === iri || mapped === `as:${term}`) values.push(map[alias]);
+	}
+	return values.flatMap((value) => parseOwnerIds(value, root));
+}
+function localContextEntries(context) {
+	if (Array.isArray(context)) return context.flatMap(localContextEntries);
+	return isJsonMap(context) ? Object.entries(context) : [];
+}
+function parseOwnerIds(value, root) {
+	if (Array.isArray(value)) return value.flatMap((item) => parseOwnerIds(item, root));
+	if (isJsonMap(value)) {
+		const id = parseMapId(value, root);
+		return id == null ? [] : [id];
+	}
+	if (typeof value !== "string") return [];
+	try {
+		return [parseIri(value)];
+	} catch (error) {
+		if (error instanceof TypeError) return [];
+		throw error;
+	}
+}
+function parseMapId(map, root) {
+	let raw = map["@id"] ?? map.id;
+	for (const context of [map["@context"], root?.["@context"]]) for (const [alias, definition] of localContextEntries(context)) if ((typeof definition === "string" ? definition : isJsonMap(definition) ? definition["@id"] : null) === "@id" && typeof map[alias] === "string") {
+		raw = map[alias];
+		break;
+	}
+	if (typeof raw !== "string") return null;
+	try {
+		return parseIri(raw);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+function visitJsonMaps(json, visit) {
+	const seen = /* @__PURE__ */ new Set();
+	const pending = [{
+		value: json,
+		path: ""
+	}];
+	while (pending.length > 0) {
+		const { value, path } = pending.pop();
+		if (value == null || typeof value !== "object" || seen.has(value)) continue;
+		seen.add(value);
+		if (Array.isArray(value)) {
+			for (let i = value.length - 1; i >= 0; i--) pending.push({
+				value: value[i],
+				path: `${path}/${i}`
+			});
+			continue;
+		}
+		const map = value;
+		const result = visit(map, path);
+		if (result !== void 0) return result;
+		for (const key of Object.keys(map).reverse()) {
+			if (key === "proof" || key === "@context") continue;
+			pending.push({
+				value: map[key],
+				path: `${path}/${key}`
+			});
+		}
+	}
+}
+//#endregion
 //#region src/federation/audience.ts
 const AS_NAMESPACE = "https://www.w3.org/ns/activitystreams#";
 /**
@@ -4155,6 +4329,7 @@ async function handleObject(request, { values, context, objectDispatcher, author
 			Vary: "Accept"
 		}
 	});
+	await warnServedCompatibleObject(context, object, getCompactRootId(jsonLd));
 	return new Response(JSON.stringify(jsonLd), { headers: {
 		"Content-Type": "application/activity+json",
 		Vary: "Accept"
@@ -4258,6 +4433,7 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 			return portableObjectInternalServerError(request);
 		}
 	}
+	if (!tombstone) await warnServedCompatibleObject(context, object, servedId);
 	const headers = new Headers({
 		"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
 		Vary: "Accept"
@@ -4268,6 +4444,32 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 		headers
 	});
 }
+async function warnServedCompatibleObject(context, object, serializedId) {
+	try {
+		if (isActor(object)) return;
+		const id = typeof serializedId === "string" ? parseIri(serializedId) : serializedId ?? object.id;
+		if (id == null || !isCompatibleEf61Iri(id)) return;
+		const did = getPortableDid(id);
+		if (did == null) return;
+		const ownerIds = object instanceof Activity ? object.actorIds : object.attributionIds;
+		for (const ownerId of ownerIds) {
+			if (getPortableDid(ownerId) !== did) continue;
+			const gateway = await getLocalFirstGateway(context, ownerId, did);
+			if (gateway == null) continue;
+			warnCompatibleId(id, did, gateway, object instanceof Activity ? "activity" : "object");
+			break;
+		}
+	} catch (error) {
+		getLogger([
+			"fedify",
+			"federation",
+			"object"
+		]).debug("Could not check the first gateway of {objectId}: {error}", {
+			objectId: object.id?.href,
+			error
+		});
+	}
+}
 function isRequestedPortableObject(object, canonicalId) {
 	return object.id != null && getCanonicalPortableId(object.id) === canonicalId;
 }
@@ -4371,13 +4573,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$2.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$1.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$2),
+		kind: getCollectionMetricKind(name$1),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -4423,7 +4625,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$2, filterPredicate);
+						const items = filterCollectionItems(page.items, name$1, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -4465,7 +4667,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 		} else {
 			const uri = new URL(portable == null ? baseUri : pageBase);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -4481,7 +4683,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$2, filterPredicate);
+					const items = filterCollectionItems(page.items, name$1, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -4693,7 +4895,7 @@ async function handleOutbox(request, { identifier, context: ctx, outboxContextFa
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
-	if (!activity.actorIds.every((actorId) => actorId.href === expectedActorId.href)) {
+	if (!activity.actorIds.every((actorId) => isSameObjectId(actorId, expectedActorId))) {
 		const error = /* @__PURE__ */ new Error("The activity actor does not match the outbox owner.");
 		logger.error("The posted activity actor does not match outbox owner {identifier}.", {
 			identifier,
@@ -5672,8 +5874,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
-		this.name = name$1;
+	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
+		this.name = name$2;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -10506,17 +10708,26 @@ var ContextImpl = class ContextImpl {
 			activityId: activity.id?.href,
 			activity
 		});
+		const activityJsonLd = await activity.toJsonLd({
+			format: "compact",
+			contextLoader: this.contextLoader
+		});
+		try {
+			await warnCompatibleIdsInJson(activityJsonLd, this instanceof RequestContextImpl && !this.isInActorDispatcher() ? this : void 0);
+		} catch (error) {
+			logger.debug("Could not check the first gateway of activity {activityId}: {error}", {
+				activityId: activity.id?.href,
+				error
+			});
+		}
 		if (this.federation.fanoutQueue == null || options.immediate || options.fanout === "skip" || (options.fanout ?? "auto") === "auto" && globalThis.Object.keys(inboxes).length < FANOUT_THRESHOLD) {
 			await this.federation.sendActivity(keys, inboxes, activity, {
 				...opts,
+				activityJsonLd,
 				normalizeExistingProofs: proofCreated || options.normalizeExistingProofs
 			});
 			return true;
 		}
-		const activityJsonLd = await activity.toJsonLd({
-			format: "compact",
-			contextLoader: this.contextLoader
-		});
 		assertSupportedCompoundProofShape(activityJsonLd, activity.id?.href);
 		const keyJwkPairs = await Promise.all(keys.map(async ({ keyId, privateKey }) => ({
 			keyId: keyId.href,
@@ -10699,6 +10910,10 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 	#invokedFromActorDispatcher;
 	#invokedFromObjectDispatcher;
 	request;
+	/** Whether a diagnostic actor lookup would re-enter the actor dispatcher. */
+	isInActorDispatcher() {
+		return this.#invokedFromActorDispatcher != null;
+	}
 	url = void 0;
 	portableRequest;
 	constructor(options) {

package/dist/mod.cjs

@@ -3,11 +3,11 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-Cuk0w0rp.cjs");
-const require_federation = require("./federation-DC1yfb-8.cjs");
+const require_http = require("./http-BbDZCEnR.cjs");
+const require_federation = require("./federation-BVkPF8vF.cjs");
 const require_types = require("./types-poIao40f.cjs");
-const require_portable_collection = require("./portable-collection-DwJ8YJP2.cjs");
-const require_kv_cache = require("./kv-cache-BmLTVLXc.cjs");
+const require_portable_collection = require("./portable-collection-FLEUNFj5.cjs");
+const require_kv_cache = require("./kv-cache-DxLtK3Np.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");
 require("./sig/mod.cjs");

package/dist/mod.js

@@ -3,11 +3,11 @@ import { URLPattern } from "urlpattern-polyfill";
 import "./rolldown-runtime-BC-Eo5Mj.js";
 import { n as autoIdAssigner, r as getDefaultActivityTransformers, t as actorDehydrator } from "./transformers-DAtXl_Kc.js";
 import "./compat/mod.js";
-import { D as createSignature, H as fetchKeyDetailed, I as verifyJsonLd, L as verifySignature, O as detachSignature, P as signJsonLd, T as attachSignature, U as generateCryptoKeyPair, V as fetchKey, W as importJwk, _ as verifyObject, _t as validateAcceptSignature, a as signRequest, c as verifyRequestDetailed, gt as parseAcceptSignature, h as signObject, ht as fulfillAcceptSignature, j as hasSignatureLike, m as hasProofLike, mt as formatAcceptSignature, p as createProof, s as verifyRequest, v as verifyPortableObjectProof, x as verifyProof, z as exportJwk } from "./http-Dx7yMmfw.js";
-import { a as respondWithObjectIfAcceptable, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as respondWithObject, l as CircuitBreaker, n as handleWebFinger, o as SendActivityError, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-BdzcazaN.js";
+import { D as createSignature, H as fetchKeyDetailed, I as verifyJsonLd, L as verifySignature, O as detachSignature, P as signJsonLd, T as attachSignature, U as generateCryptoKeyPair, V as fetchKey, W as importJwk, _ as verifyObject, _t as validateAcceptSignature, a as signRequest, c as verifyRequestDetailed, gt as parseAcceptSignature, h as signObject, ht as fulfillAcceptSignature, j as hasSignatureLike, m as hasProofLike, mt as formatAcceptSignature, p as createProof, s as verifyRequest, v as verifyPortableObjectProof, x as verifyProof, z as exportJwk } from "./http-D4JQwy-3.js";
+import { a as respondWithObjectIfAcceptable, c as digest, d as parseCircuitBreakerKvState, f as createFederationBuilder, i as respondWithObject, l as CircuitBreaker, n as handleWebFinger, o as SendActivityError, r as createExponentialBackoffPolicy, s as buildCollectionSynchronizationHeader, t as createFederation, u as normalizeCircuitBreakerOptions } from "./middleware-D0t1NBIE.js";
 import { n as getNodeInfo, r as parseNodeInfo, t as nodeInfoToJson } from "./types-_S2_MeLF.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-C0c0rUN9.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-CUZOCSKZ.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-ZczKiIeK.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DXFAaMh2.js";
 import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue, Router, RouterError } from "./federation/mod.js";
 import "./nodeinfo/mod.js";
 import "./runtime/mod.js";

package/dist/nodeinfo/handler.test.mjs

@@ -5,7 +5,7 @@ import { r as createRequestContext } from "../context-8Tu9kea0.mjs";
 import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { C as handleNodeInfo, o as createFederation, w as handleNodeInfoJrd } from "../middleware-C2_LcbL3.mjs";
+import { D as handleNodeInfoJrd, E as handleNodeInfo, o as createFederation } from "../middleware-BhtaUtlt.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/handler.test.ts
 test("handleNodeInfo()", async () => {

package/dist/{owner-D_BDPwm2.mjs → owner-CoNYVTQp.mjs}

@@ -2,10 +2,10 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { d as isPortableUri, l as isPortableId, n as getCanonicalPortableId, p as isSamePublicKey$1, s as isCompatibleKeyId } from "./portable-key-id-Ca30-hOa.mjs";
-import { n as version, t as name } from "./deno-Dj1TFhf4.mjs";
+import { n as version, t as name } from "./deno-62DcBMwc.mjs";
 import { i as parseKeyOwnerEvidence, r as getVerifiedKeyOwnerEvidence } from "./key-owner-evidence-APB6NpSk.mjs";
-import { l as verifyKeyOwnership, n as exportJwk, r as fetchActorDocument } from "./key-Djyt1BFx.mjs";
-import { n as resolvePortableActorKey, t as fetchPortableGatewayKey } from "./portable-key-B880yVlC.mjs";
+import { l as verifyKeyOwnership, n as exportJwk, r as fetchActorDocument } from "./key-CtAhsSFI.mjs";
+import { n as resolvePortableActorKey, t as fetchPortableGatewayKey } from "./portable-key-90Ux6h7F.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{portable-collection-hcONGyUs.mjs → portable-collection-CxP30PWK.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Dj1TFhf4.mjs";
-import { c as verifyPortableObjectProof, u as verifyPortableObjectProofWithRoot } from "./proof-z6Prgi5I.mjs";
+import { n as version, t as name } from "./deno-62DcBMwc.mjs";
+import { c as verifyPortableObjectProof, u as verifyPortableObjectProofWithRoot } from "./proof-Bhsb_KYD.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CollectionPage, Object as Object$1, isActor } from "@fedify/vocab";
 import { trace } from "@opentelemetry/api";

package/dist/{portable-collection-DwJ8YJP2.cjs → portable-collection-FLEUNFj5.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-Cuk0w0rp.cjs");
+const require_http = require("./http-BbDZCEnR.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");

package/dist/{portable-collection-C0c0rUN9.js → portable-collection-ZczKiIeK.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { At as name, B as fetchActorDocument, Dt as isPortableUri, J as getVerifiedKeyOwnerEvidence, K as verifyKeyOwnership, Tt as isPortableId, Y as parseKeyOwnerEvidence, b as verifyPortableObjectProofWithRoot, jt as version, kt as isSamePublicKey$1, l as fetchPortableGatewayKey, u as resolvePortableActorKey, v as verifyPortableObjectProof, wt as isCompatibleKeyId, yt as getCanonicalPortableId, z as exportJwk } from "./http-Dx7yMmfw.js";
+import { At as name, B as fetchActorDocument, Dt as isPortableUri, J as getVerifiedKeyOwnerEvidence, K as verifyKeyOwnership, Tt as isPortableId, Y as parseKeyOwnerEvidence, b as verifyPortableObjectProofWithRoot, jt as version, kt as isSamePublicKey$1, l as fetchPortableGatewayKey, u as resolvePortableActorKey, v as verifyPortableObjectProof, wt as isCompatibleKeyId, yt as getCanonicalPortableId, z as exportJwk } from "./http-D4JQwy-3.js";
 import { getLogger } from "@logtape/logtape";
 import { CollectionPage, CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{portable-key-B880yVlC.mjs → portable-key-90Ux6h7F.mjs}

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { a as getRawCanonicalPortableId, c as isPortableActorDocument, d as isPortableUri, n as getCanonicalPortableId, p as isSamePublicKey } from "./portable-key-id-Ca30-hOa.mjs";
-import { u as verifyPortableObjectProofWithRoot } from "./proof-z6Prgi5I.mjs";
+import { u as verifyPortableObjectProofWithRoot } from "./proof-Bhsb_KYD.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { FetchError, formatIri, getDocumentLoader, isGatewayUrl, parseIri, toCompatibleEf61Id } from "@fedify/vocab-runtime";

package/dist/{proof-z6Prgi5I.mjs → proof-Bhsb_KYD.mjs}

@@ -2,12 +2,12 @@ import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { i as getPortableDid, l as isPortableId } from "./portable-key-id-Ca30-hOa.mjs";
-import { n as version, t as name } from "./deno-Dj1TFhf4.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-BnYleVpg.mjs";
-import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-Djyt1BFx.mjs";
+import { n as version, t as name } from "./deno-62DcBMwc.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-jr7IbGjd.mjs";
+import { c as validateCryptoKey, i as fetchKey, t as bypassKeyCacheReads } from "./key-CtAhsSFI.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { c as getNormalizationContextLoader } from "./ld-CNVWdooi.mjs";
+import { c as getNormalizationContextLoader } from "./ld-BuI0RakW.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, DataIntegrityProof, Multikey, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{send-Cw545L_2.mjs → send-CdRJj10a.mjs}

@@ -2,9 +2,9 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { d as isPortableUri } from "./portable-key-id-Ca30-hOa.mjs";
-import { n as version, t as name } from "./deno-Dj1TFhf4.mjs";
-import { n as getDurationMs, r as getFederationMetrics } from "./metrics-BnYleVpg.mjs";
-import { n as doubleKnock } from "./http-D-DpP4sd.mjs";
+import { n as version, t as name } from "./deno-62DcBMwc.mjs";
+import { n as getDurationMs, r as getFederationMetrics } from "./metrics-jr7IbGjd.mjs";
+import { n as doubleKnock } from "./http-SIEv_YGW.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, canonicalizePortableUri, getFe34Origin, isGatewayUrl, toCompatibleEf61Id, validatePublicUrl } from "@fedify/vocab-runtime";

package/dist/sig/compound-proof-discovery.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-D0xY7MBs.mjs";
+import { i as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-Pn8766TV.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-discovery.test.ts

package/dist/sig/compound-proof-producer.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-D0xY7MBs.mjs";
+import { i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-Pn8766TV.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-producer.test.ts
 const portableId = "ap+ef61://did:key:z6MkAlice/objects/1";