@fedify/fedify 2.4.0-dev.2030 → 2.4.0-dev.2047

package/dist/{federation-CTnaljmy.cjs → federation-Bdu06LEl.cjs}

@@ -1,19 +1,19 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-B5F1JMh0.cjs");
+const require_http = require("./http-CGjvl34X.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-WUYke16i.cjs");
-const require_kv_cache = require("./kv-cache-8K70pjtX.cjs");
+const require_owner = require("./owner-Hurn_ocn.cjs");
+const require_kv_cache = require("./kv-cache-CvEicbrf.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
 let byte_encodings_hex = require("byte-encodings/hex");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
-let es_toolkit = require("es-toolkit");
 let _fedify_vocab_runtime_jsonld = require("@fedify/vocab-runtime/jsonld");
 _fedify_vocab_runtime_jsonld = require_rolldown_runtime.__toESM(_fedify_vocab_runtime_jsonld, 1);
+let es_toolkit = require("es-toolkit");
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 let _fedify_webfinger = require("@fedify/webfinger");
 let _opentelemetry_sdk_metrics = require("@opentelemetry/sdk-metrics");
@@ -203,38 +203,39 @@ var FederationBuilderImpl = class {
 				"federation",
 				"actor"
 			]);
+			const portable = actor.id?.protocol === "ap:" || actor.id?.protocol === "ap+ef61:";
 			if (actor.id == null) logger.warn("Actor dispatcher returned an actor without an id property.  Set the property with Context.getActorUri(identifier).");
-			else if (actor.id.href != context.getActorUri(identifier).href) logger.warn("Actor dispatcher returned an actor with an id property that does not match the actor URI.  Set the property with Context.getActorUri(identifier).");
+			else if (!portable && actor.id.href != context.getActorUri(identifier).href) logger.warn("Actor dispatcher returned an actor with an id property that does not match the actor URI.  Set the property with Context.getActorUri(identifier).");
 			if (actor instanceof _fedify_vocab.Tombstone) return actor;
 			if (this.followingCallbacks != null && this.followingCallbacks.dispatcher != null) {
 				if (actor.followingId == null) logger.warn("You configured a following collection dispatcher, but the actor does not have a following property.  Set the property with Context.getFollowingUri(identifier).");
-				else if (actor.followingId.href != context.getFollowingUri(identifier).href) logger.warn("You configured a following collection dispatcher, but the actor's following property does not match the following collection URI.  Set the property with Context.getFollowingUri(identifier).");
+				else if (!portable && actor.followingId.href != context.getFollowingUri(identifier).href) logger.warn("You configured a following collection dispatcher, but the actor's following property does not match the following collection URI.  Set the property with Context.getFollowingUri(identifier).");
 			}
 			if (this.followersCallbacks != null && this.followersCallbacks.dispatcher != null) {
 				if (actor.followersId == null) logger.warn("You configured a followers collection dispatcher, but the actor does not have a followers property.  Set the property with Context.getFollowersUri(identifier).");
-				else if (actor.followersId.href != context.getFollowersUri(identifier).href) logger.warn("You configured a followers collection dispatcher, but the actor's followers property does not match the followers collection URI.  Set the property with Context.getFollowersUri(identifier).");
+				else if (!portable && actor.followersId.href != context.getFollowersUri(identifier).href) logger.warn("You configured a followers collection dispatcher, but the actor's followers property does not match the followers collection URI.  Set the property with Context.getFollowersUri(identifier).");
 			}
 			if (this.outboxCallbacks != null && this.outboxCallbacks.dispatcher != null) {
 				if (actor?.outboxId == null) logger.warn("You configured an outbox collection dispatcher, but the actor does not have an outbox property.  Set the property with Context.getOutboxUri(identifier).");
-				else if (actor.outboxId.href != context.getOutboxUri(identifier).href) logger.warn("You configured an outbox collection dispatcher, but the actor's outbox property does not match the outbox collection URI.  Set the property with Context.getOutboxUri(identifier).");
+				else if (!portable && actor.outboxId.href != context.getOutboxUri(identifier).href) logger.warn("You configured an outbox collection dispatcher, but the actor's outbox property does not match the outbox collection URI.  Set the property with Context.getOutboxUri(identifier).");
 			}
 			if (this.likedCallbacks != null && this.likedCallbacks.dispatcher != null) {
 				if (actor?.likedId == null) logger.warn("You configured a liked collection dispatcher, but the actor does not have a liked property.  Set the property with Context.getLikedUri(identifier).");
-				else if (actor.likedId.href != context.getLikedUri(identifier).href) logger.warn("You configured a liked collection dispatcher, but the actor's liked property does not match the liked collection URI.  Set the property with Context.getLikedUri(identifier).");
+				else if (!portable && actor.likedId.href != context.getLikedUri(identifier).href) logger.warn("You configured a liked collection dispatcher, but the actor's liked property does not match the liked collection URI.  Set the property with Context.getLikedUri(identifier).");
 			}
 			if (this.featuredCallbacks != null && this.featuredCallbacks.dispatcher != null) {
 				if (actor?.featuredId == null) logger.warn("You configured a featured collection dispatcher, but the actor does not have a featured property.  Set the property with Context.getFeaturedUri(identifier).");
-				else if (actor.featuredId.href != context.getFeaturedUri(identifier).href) logger.warn("You configured a featured collection dispatcher, but the actor's featured property does not match the featured collection URI.  Set the property with Context.getFeaturedUri(identifier).");
+				else if (!portable && actor.featuredId.href != context.getFeaturedUri(identifier).href) logger.warn("You configured a featured collection dispatcher, but the actor's featured property does not match the featured collection URI.  Set the property with Context.getFeaturedUri(identifier).");
 			}
 			if (this.featuredTagsCallbacks != null && this.featuredTagsCallbacks.dispatcher != null) {
 				if (actor?.featuredTagsId == null) logger.warn("You configured a featured tags collection dispatcher, but the actor does not have a featuredTags property.  Set the property with Context.getFeaturedTagsUri(identifier).");
-				else if (actor.featuredTagsId.href != context.getFeaturedTagsUri(identifier).href) logger.warn("You configured a featured tags collection dispatcher, but the actor's featuredTags property does not match the featured tags collection URI.  Set the property with Context.getFeaturedTagsUri(identifier).");
+				else if (!portable && actor.featuredTagsId.href != context.getFeaturedTagsUri(identifier).href) logger.warn("You configured a featured tags collection dispatcher, but the actor's featuredTags property does not match the featured tags collection URI.  Set the property with Context.getFeaturedTagsUri(identifier).");
 			}
 			if (this.router.has("inbox")) {
 				if (actor.inboxId == null) logger.warn("You configured inbox listeners, but the actor does not have an inbox property.  Set the property with Context.getInboxUri(identifier).");
-				else if (actor.inboxId.href != context.getInboxUri(identifier).href) logger.warn("You configured inbox listeners, but the actor's inbox property does not match the inbox URI.  Set the property with Context.getInboxUri(identifier).");
+				else if (!portable && actor.inboxId.href != context.getInboxUri(identifier).href) logger.warn("You configured inbox listeners, but the actor's inbox property does not match the inbox URI.  Set the property with Context.getInboxUri(identifier).");
 				if (actor.endpoints == null || actor.endpoints.sharedInbox == null) logger.warn("You configured inbox listeners, but the actor does not have a endpoints.sharedInbox property.  Set the property with Context.getInboxUri().");
-				else if (actor.endpoints.sharedInbox.href != context.getInboxUri().href) logger.warn("You configured inbox listeners, but the actor's endpoints.sharedInbox property does not match the shared inbox URI.  Set the property with Context.getInboxUri().");
+				else if (!portable && actor.endpoints.sharedInbox.href != context.getInboxUri().href) logger.warn("You configured inbox listeners, but the actor's endpoints.sharedInbox property does not match the shared inbox URI.  Set the property with Context.getInboxUri().");
 			}
 			if (callbacks.keyPairsDispatcher != null) {
 				if (actor.publicKeyId == null) logger.warn("You configured a key pairs dispatcher, but the actor does not have a publicKey property.  Set the property with Context.getActorKeyPairs(identifier).");
@@ -2191,6 +2192,68 @@ function acceptsJsonLd(request) {
 	return types.includes("application/activity+json") || types.includes("application/ld+json") || types.includes("application/json");
 }
 //#endregion
+//#region src/federation/portable.ts
+/**
+* The media type that FEP-ef61 gateways must use for portable objects.
+*/
+const PORTABLE_OBJECT_CONTENT_TYPE = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"";
+const GATEWAY_OBJECT_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
+const BARE_DID_PATTERN = /^did:[a-z0-9]+:[^/?#]+$/i;
+/**
+* Recognizes an FEP-ef61 gateway request for a portable object, e.g.,
+* `GET /.well-known/apgateway/did:key:z6Mk.../notes/123`.
+*
+* The query is not part of the portable ID, so it is ignored here.  It is not
+* removed from the request itself, which HTTP Signatures may cover.
+*
+* @param url The request URL.
+* @returns The parsed request, or `null` if the URL is not a gateway request
+*          for a portable object, e.g., the gateway discovery endpoint or
+*          a hashlink media URL.
+*/
+function parsePortableGatewayRequest(url) {
+	if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+	if (!GATEWAY_OBJECT_PATH_PATTERN.test(url.pathname)) return null;
+	let id;
+	let canonicalId;
+	try {
+		id = (0, _fedify_vocab_runtime.fromCompatibleEf61Id)(url.origin + url.pathname);
+		if (id == null) return null;
+		canonicalId = (0, _fedify_vocab_runtime.canonicalizePortableUri)((0, _fedify_vocab_runtime.formatIri)(id));
+	} catch (error) {
+		if (error instanceof TypeError) return {
+			type: "malformed",
+			error
+		};
+		throw error;
+	}
+	const authority = (0, _fedify_vocab_runtime.getFe34Origin)(id);
+	const href = id.href;
+	return {
+		type: "object",
+		portableRequest: Object.freeze({
+			authority,
+			get id() {
+				return new URL(href);
+			}
+		}),
+		canonicalId,
+		path: id.pathname
+	};
+}
+/**
+* Builds a portable ID from a DID authority and an object path.
+* @param authority The bare DID, e.g., `did:key:z6Mk...`.
+* @param path The object path, e.g., `/notes/123`.
+* @returns The portable ID.
+* @throws {TypeError} If the authority is not a bare DID.
+*/
+function buildPortableUri(authority, path) {
+	if (typeof authority !== "string" || !BARE_DID_PATTERN.test(authority)) throw new TypeError("The authority of a portable ID must be a DID without a path, query, or fragment.");
+	(0, _fedify_vocab_runtime.getFe34Origin)(authority);
+	return (0, _fedify_vocab_runtime.parseIri)(`ap+ef61://${authority}${path}`);
+}
+//#endregion
 //#region src/federation/temporal.ts
 const Temporal$7 = require_http.Temporal;
 function isPlainObject$1(value) {
@@ -2377,6 +2440,102 @@ async function handleObject(request, { values, context, objectDispatcher, author
 		Vary: "Accept"
 	} });
 }
+/**
+* Handles an FEP-ef61 gateway request for a portable object through an object
+* dispatcher.  The object is served only if its ID canonically matches the
+* requested portable ID and it satisfies the FEP-ef61 proof policy.
+* @template TContextData The context data to pass to the context.
+* @param request The HTTP request.
+* @param parameters The parameters for handling the portable object.
+* @returns A promise that resolves to an HTTP response.
+*/
+async function handlePortableObject(request, { values, context, objectDispatcher, authorizePredicate, canonicalId, onNotFound, onUnauthorized }) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"object"
+	]);
+	if (objectDispatcher == null) return await onNotFound(request);
+	const object = await objectDispatcher(context, values);
+	if (object == null) return await onNotFound(request);
+	if (!isRequestedPortableObject(object, canonicalId)) {
+		logger.debug("The object {objectId} does not match the requested portable object {portableId}.", {
+			objectId: object.id?.href,
+			portableId: canonicalId
+		});
+		return await onNotFound(request);
+	}
+	if (authorizePredicate != null) {
+		if (!await authorizePredicate(context, values)) return await onUnauthorized(request);
+	}
+	let jsonLd;
+	let servedId;
+	let result;
+	try {
+		jsonLd = await object.toJsonLd(context);
+		servedId = await getJsonLdRootId(jsonLd, context.contextLoader);
+		result = await require_owner.verifyPortableObjectProof(jsonLd, {
+			contextLoader: context.contextLoader,
+			documentLoader: context.documentLoader,
+			tracerProvider: context.tracerProvider,
+			meterProvider: context.meterProvider
+		});
+	} catch (error) {
+		logger.error("Failed to verify the Object Integrity Proofs of the portable object {portableId}:\n{error}", {
+			portableId: canonicalId,
+			error
+		});
+		return portableObjectInternalServerError(request);
+	}
+	if (servedId == null || !isRequestedPortableId(servedId, canonicalId)) {
+		logger.debug("The serialized object does not match the requested portable object {portableId}.", { portableId: canonicalId });
+		return await onNotFound(request);
+	}
+	if (!result.verified && result.reason.type !== "unsecuredCollection" && result.reason.type !== "unsupportedObjectType") {
+		logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, and objects need an Object Integrity Proof made with a key of the DID in their ID.", {
+			portableId: canonicalId,
+			reason: result.reason.type
+		});
+		return portableObjectInternalServerError(request);
+	}
+	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), { headers: {
+		"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
+		Vary: "Accept"
+	} });
+}
+function isRequestedPortableObject(object, canonicalId) {
+	if (object.id == null) return false;
+	if (object.id.protocol !== "ap:" && object.id.protocol !== "ap+ef61:") return false;
+	try {
+		return (0, _fedify_vocab_runtime.canonicalizePortableUri)((0, _fedify_vocab_runtime.formatIri)(object.id)) === canonicalId;
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+}
+async function getJsonLdRootId(jsonLd, contextLoader) {
+	const expanded = await _fedify_vocab_runtime_jsonld.default.expand(jsonLd, {
+		documentLoader: require_owner.getNormalizationContextLoader(contextLoader),
+		keepFreeFloatingNodes: true
+	});
+	if (expanded.length !== 1) return null;
+	const id = expanded[0]["@id"];
+	return typeof id === "string" ? id : null;
+}
+function isRequestedPortableId(id, canonicalId) {
+	try {
+		return (0, _fedify_vocab_runtime.canonicalizePortableUri)(id) === canonicalId;
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+}
+function portableObjectInternalServerError(request) {
+	return new Response(request.method === "HEAD" ? null : "Internal server error.", {
+		status: 500,
+		headers: { "Content-Type": "text/plain; charset=utf-8" }
+	});
+}
 const BUILT_IN_COLLECTION_METRIC_KINDS = /* @__PURE__ */ new Set([
 	"inbox",
 	"outbox",
@@ -2414,13 +2573,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$1.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$2.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(require_http.name, require_http.version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$1),
+		kind: getCollectionMetricKind(name$2),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -2461,7 +2620,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 							span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$1, filterPredicate);
+						const items = filterCollectionItems(page.items, name$2, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -2501,7 +2660,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 		} else {
 			const uri = new URL(baseUri);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
 				kind: _opentelemetry_api.SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -2517,7 +2676,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 						span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$1, filterPredicate);
+					const items = filterCollectionItems(page.items, name$2, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -3610,8 +3769,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$2, values, context, callbacks, tracerProvider = _opentelemetry_api.trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$2;
+	constructor(name$1, values, context, callbacks, tracerProvider = _opentelemetry_api.trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
+		this.name = name$1;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -5187,6 +5346,34 @@ function getWebFingerSubjectAndAliases({ resourceUrl, actorUri, preferredUsernam
 	};
 }
 /**
+* Computes the subject and aliases for an FEP-ef61 portable actor, whose
+* WebFinger address takes its domain from the first gateway of the actor
+* rather than from the actor ID.  The canonical `ap:` ID is not emitted,
+* since it is not a valid URI for software that does not support FEP-ef61;
+* the compatible identifier stands for it.
+*/
+function getPortableWebFingerSubjectAndAliases({ resourceUrl, compatibleId, preferredUsername, acctUsername, gatewayHost }) {
+	const aliases = [];
+	const add = (alias) => {
+		if (alias !== subject && !aliases.includes(alias)) aliases.push(alias);
+	};
+	let subject;
+	if (resourceUrl.protocol === "acct:") {
+		const username = preferredUsername ?? acctUsername;
+		subject = username == null ? resourceUrl.href : `acct:${username}@${gatewayHost}`;
+		add(compatibleId.href);
+		add(resourceUrl.href);
+	} else {
+		subject = preferredUsername == null ? compatibleId.href : `acct:${preferredUsername}@${gatewayHost}`;
+		add(compatibleId.href);
+		if (resourceUrl.protocol === "http:" || resourceUrl.protocol === "https:") add(resourceUrl.href);
+	}
+	return {
+		subject,
+		aliases
+	};
+}
+/**
 * Handles a WebFinger request.  You would not typically call this function
 * directly, but instead use {@link Federation.fetch} method.
 * @param request The WebFinger request to handle.
@@ -5271,7 +5458,7 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 	span?.setAttribute("webfinger.resource", resource);
 	let resourceUrl;
 	try {
-		resourceUrl = new URL(resource);
+		resourceUrl = (0, _fedify_vocab_runtime.parseIri)(resource);
 	} catch (e) {
 		if (e instanceof TypeError) return new Response("Invalid resource URL.", { status: 400 });
 		throw e;
@@ -5320,7 +5507,29 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		status: 410,
 		headers: { "Access-Control-Allow-Origin": "*" }
 	});
-	const actorUri = context.getActorUri(identifier);
+	let actorUri = context.getActorUri(identifier);
+	let portable;
+	if (actor.id != null && (actor.id.protocol === "ap:" || actor.id.protocol === "ap+ef61:")) {
+		const gateway = actor.gateway;
+		let compatibleId;
+		if (gateway != null && (0, _fedify_vocab_runtime.isGatewayUrl)(gateway)) try {
+			compatibleId = (0, _fedify_vocab_runtime.toCompatibleEf61Id)(actor.id, gateway);
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+		}
+		if (gateway == null || compatibleId == null) {
+			logger$1.error("The portable actor {actorId} (identifier: {identifier}) needs an HTTP(S) origin as the first item of its gateways property to be discovered through WebFinger.", {
+				actorId: (0, _fedify_vocab_runtime.formatIri)(actor.id),
+				identifier
+			});
+			return await onNotFound(request);
+		}
+		actorUri = compatibleId;
+		portable = {
+			compatibleId,
+			gatewayHost: gateway.host
+		};
+	}
 	const links = [{
 		rel: "self",
 		href: actorUri.href,
@@ -5347,13 +5556,19 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		const customLinks = await webFingerLinksDispatcher(context, resourceUrl);
 		if (customLinks != null) for (const link of customLinks) links.push(link);
 	}
-	const { subject, aliases } = getWebFingerSubjectAndAliases({
+	const { subject, aliases } = portable == null ? getWebFingerSubjectAndAliases({
 		resourceUrl,
 		actorUri,
 		preferredUsername: actor.preferredUsername,
 		acctUsername,
 		host,
 		contextHost: context.url.host
+	}) : getPortableWebFingerSubjectAndAliases({
+		resourceUrl,
+		compatibleId: portable.compatibleId,
+		preferredUsername: actor.preferredUsername,
+		acctUsername,
+		gatewayHost: portable.gatewayHost
 	});
 	return new Response(JSON.stringify({
 		subject,
@@ -6581,7 +6796,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 			...ctxOptions,
 			request,
 			invokedFromActorDispatcher: opts.invokedFromActorDispatcher,
-			invokedFromObjectDispatcher: opts.invokedFromObjectDispatcher
+			invokedFromObjectDispatcher: opts.invokedFromObjectDispatcher,
+			portableRequest: opts.portableRequest
 		});
 	}
 	#getLoaderOptions(origin) {
@@ -6832,6 +7048,24 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const url = new URL(request.url);
 		const route = this.router.route(url.pathname);
 		if (route == null) {
+			const portable = request.method === "GET" || request.method === "HEAD" ? parsePortableGatewayRequest(url) : null;
+			if (portable != null) {
+				const response = await this.#fetchPortableObject(request, portable, {
+					onNotFound,
+					onNotAcceptable,
+					onUnauthorized,
+					contextData,
+					span,
+					metricState
+				});
+				if (request.method !== "HEAD" || response.body == null) return response;
+				await response.body.cancel();
+				return new Response(null, {
+					status: response.status,
+					statusText: response.statusText,
+					headers: response.headers
+				});
+			}
 			metricState.endpoint = "not_found";
 			return await onNotFound(request);
 		}
@@ -7107,7 +7341,56 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}
 		}
 	}
+	async #fetchPortableObject(request, portable, { onNotFound, onNotAcceptable, onUnauthorized, contextData, span, metricState }) {
+		if (portable.type === "malformed") {
+			metricState.endpoint = "not_found";
+			(0, _logtape_logtape.getLogger)([
+				"fedify",
+				"federation",
+				"object"
+			]).debug("Malformed FEP-ef61 gateway request {url}: {error}", {
+				url: request.url,
+				error: portable.error
+			});
+			return new Response(request.method === "HEAD" ? null : "Malformed portable object ID.", {
+				status: 400,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+		const route = this.router.route(portable.path);
+		if (route == null || !route.name.startsWith("object:")) {
+			metricState.endpoint = "not_found";
+			return await onNotFound(request);
+		}
+		metricState.routeTemplate = PORTABLE_GATEWAY_ROUTE_PREFIX + route.template;
+		metricState.endpoint = "object";
+		span.updateName(`${request.method} ${metricState.routeTemplate}`);
+		if (!acceptsJsonLd(request)) {
+			metricState.endpoint = "not_acceptable";
+			return await onNotAcceptable(request);
+		}
+		const typeId = route.name.replace(/^object:/, "");
+		const callbacks = this.objectCallbacks[typeId];
+		const cls = this.objectTypeIds[typeId];
+		const context = this.#createContext(request, contextData, {
+			invokedFromObjectDispatcher: {
+				cls,
+				values: route.values
+			},
+			portableRequest: portable.portableRequest
+		});
+		return await handlePortableObject(request, {
+			values: route.values,
+			context,
+			objectDispatcher: callbacks?.dispatcher,
+			authorizePredicate: callbacks?.authorizePredicate,
+			canonicalId: portable.canonicalId,
+			onUnauthorized,
+			onNotFound
+		});
+	}
 };
+const PORTABLE_GATEWAY_ROUTE_PREFIX = "/.well-known/apgateway/{did}";
 function getEndpointCategory(routeName) {
 	if (routeName.startsWith("object:")) return "object";
 	if (routeName.startsWith("collection:") || routeName.startsWith("orderedCollection:")) return "collection";
@@ -7242,12 +7525,20 @@ var ContextImpl = class ContextImpl {
 		return new URL(path, this.canonicalOrigin);
 	}
 	getObjectUri(cls, values) {
+		return new URL(this.#getObjectPath(cls, values), this.canonicalOrigin);
+	}
+	getPortableObjectUri(cls, values, authority) {
+		const path = this.#getObjectPath(cls, values);
+		if (authority == null) throw new TypeError("The authority of a portable ID is required outside an FEP-ef61 gateway request.");
+		return buildPortableUri(authority, path);
+	}
+	#getObjectPath(cls, values) {
 		const callbacks = this.federation.objectCallbacks[cls.typeId.href];
 		if (callbacks == null) throw new _fedify_uri_template.RouterError("No object dispatcher registered.");
 		for (const param of callbacks.parameters) if (!(param in values)) throw new TypeError(`Missing parameter: ${param}`);
 		const path = this.federation.router.build(`object:${cls.typeId.href}`, values);
 		if (path == null) throw new _fedify_uri_template.RouterError("No object dispatcher registered.");
-		return new URL(path, this.canonicalOrigin);
+		return path;
 	}
 	getOutboxUri(identifier) {
 		const path = this.federation.router.build("outbox", { identifier });
@@ -7476,6 +7767,7 @@ var ContextImpl = class ContextImpl {
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			meterProvider: options.meterProvider ?? this.meterProvider,
+			verifyPortableObject: options.verifyPortableObject ?? require_owner.verifyPortableObjectProof,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}
@@ -7822,12 +8114,14 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 	#invokedFromObjectDispatcher;
 	request;
 	url = void 0;
+	portableRequest;
 	constructor(options) {
 		super(options);
 		this.#invokedFromActorDispatcher = options.invokedFromActorDispatcher;
 		this.#invokedFromObjectDispatcher = options.invokedFromObjectDispatcher;
 		this.request = options.request;
 		this.url = options.url;
+		this.portableRequest = options.portableRequest;
 	}
 	clone(data) {
 		return new RequestContextImpl({
@@ -7839,9 +8133,13 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher,
 			invokedFromActorDispatcher: this.#invokedFromActorDispatcher,
 			invokedFromObjectDispatcher: this.#invokedFromObjectDispatcher,
+			portableRequest: this.portableRequest,
 			request: this.request
 		});
 	}
+	getPortableObjectUri(cls, values, authority) {
+		return super.getPortableObjectUri(cls, values, authority ?? this.portableRequest?.authority);
+	}
 	async getActor(identifier, options) {
 		if (this.federation.actorCallbacks == null || this.federation.actorCallbacks.dispatcher == null) throw new Error("No actor dispatcher registered.");
 		if (this.#invokedFromActorDispatcher != null) (0, _logtape_logtape.getLogger)([

package/dist/{http-By8tnmEr.js → http-BmdqHyms.js}

@@ -10,7 +10,7 @@ import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2030+e6b3de3d";
+var version = "2.4.0-dev.2047+140b94db";
 //#endregion
 //#region src/sig/accept.ts
 /**

package/dist/{http-B5F1JMh0.cjs → http-CGjvl34X.cjs}

@@ -9,7 +9,7 @@ let byte_encodings_base64 = require("byte-encodings/base64");
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.4.0-dev.2030+e6b3de3d";
+var version = "2.4.0-dev.2047+140b94db";
 //#endregion
 //#region ../../node_modules/.pnpm/temporal-polyfill@1.0.1/node_modules/temporal-polyfill/chunks/root.js
 const NativeTemporal = globalThis.Temporal;

package/dist/{http-D4WPcJUe.mjs → http-CK6kjLnO.mjs}

@@ -1,10 +1,10 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Vj_9wePq.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DpQqUAmh.mjs";
+import { n as version, t as name } from "./deno-Dcj6O4LJ.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CDoBPWjf.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
-import { i as fetchKeyDetailed, s as validateCryptoKey } from "./key-B_Zc5Jbd.mjs";
+import { i as fetchKeyDetailed, s as validateCryptoKey } from "./key-CzCAq6D9.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{key-B_Zc5Jbd.mjs → key-CzCAq6D9.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Vj_9wePq.mjs";
-import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-DpQqUAmh.mjs";
+import { n as version, t as name } from "./deno-Dcj6O4LJ.mjs";
+import { _ as recordKeyLookup, n as getDurationMs, t as classifyFetchError } from "./metrics-CDoBPWjf.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{kv-cache-8K70pjtX.cjs → kv-cache-CvEicbrf.cjs}

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-B5F1JMh0.cjs");
+const require_http = require("./http-CGjvl34X.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let es_toolkit = require("es-toolkit");

package/dist/{kv-cache-BXdT7pJQ.mjs → kv-cache-YATuzCy-.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { p as recordDocumentCache } from "./metrics-DpQqUAmh.mjs";
+import { p as recordDocumentCache } from "./metrics-CDoBPWjf.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-BswMKQjC.js → kv-cache-fi_-XZco.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { T as recordDocumentCache, f as validateCryptoKey, t as doubleKnock } from "./http-By8tnmEr.js";
+import { T as recordDocumentCache, f as validateCryptoKey, t as doubleKnock } from "./http-BmdqHyms.js";
 import { getLogger } from "@logtape/logtape";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";
 import { curry } from "es-toolkit";

package/dist/{ld-B16KUSIQ.mjs → ld-CNWm8mJc.mjs}

@@ -1,9 +1,9 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Vj_9wePq.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-DpQqUAmh.mjs";
-import { r as fetchKey, s as validateCryptoKey } from "./key-B_Zc5Jbd.mjs";
+import { n as version, t as name } from "./deno-Dcj6O4LJ.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CDoBPWjf.mjs";
+import { r as fetchKey, s as validateCryptoKey } from "./key-CzCAq6D9.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{metrics-DpQqUAmh.mjs → metrics-CDoBPWjf.mjs}

@@ -1,7 +1,7 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Vj_9wePq.mjs";
+import { n as version, t as name } from "./deno-Dcj6O4LJ.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts

package/dist/{middleware-BL5HFFVU.mjs → middleware-CF6uz8wa.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-C7_hqDnl.mjs";
+import { n as FederationImpl } from "./middleware-CtFNjIUD.mjs";
 export { FederationImpl };