@fedify/fedify 2.4.0-dev.2030 → 2.4.0-dev.2047

package/dist/{middleware-C7_hqDnl.mjs → middleware-CtFNjIUD.mjs}

@@ -1,27 +1,27 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Vj_9wePq.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DpQqUAmh.mjs";
+import { n as version, t as name } from "./deno-Dcj6O4LJ.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-CDoBPWjf.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
-import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-B_Zc5Jbd.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-D4WPcJUe.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-qUudHZVH.mjs";
-import { n as kvCache } from "./kv-cache-BXdT7pJQ.mjs";
+import { o as importJwk, s as validateCryptoKey, t as exportJwk } from "./key-CzCAq6D9.mjs";
+import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-CK6kjLnO.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-BRlNjHlQ.mjs";
+import { n as kvCache } from "./kv-cache-YATuzCy-.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
 import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-DpnpgjyX.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-B16KUSIQ.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-BIOIhZoM.mjs";
-import { a as verifyObject, n as hasProofLike, r as signObject } from "./proof-BVxJu5vv.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-Cr5FJ7iu.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-BYJ5otJa.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-CNWm8mJc.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-B3PgGiJ1.mjs";
+import { a as verifyObject, n as hasProofLike, o as verifyPortableObjectProof, r as signObject } from "./proof-fKycdssC.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-BqBILxYE.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-Cue1kVHU.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-C5NqoLBJ.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-BIvUoJxm.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-YT4tajyj.mjs";
 import { t as KvKeyCache } from "./keycache-BUDHB5rY.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-CCf0lZV3.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-SUiLJ0Co.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -30,8 +30,9 @@ import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey,
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 import { uniq } from "es-toolkit";
-import { FetchError, getDocumentLoader, getFe34Origin, haveSameFe34Origin } from "@fedify/vocab-runtime";
+import { FetchError, canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, haveSameFe34Origin, isGatewayUrl, parseIri, toCompatibleEf61Id } from "@fedify/vocab-runtime";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_HTTP_RESPONSE_HEADER, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
+import jsonld from "@fedify/vocab-runtime/jsonld";
 import { DataPointType, MeterProvider as MeterProvider$1, MetricReader } from "@opentelemetry/sdk-metrics";
 import { domainToASCII } from "node:url";
 //#region src/compat/transformers.ts
@@ -512,6 +513,68 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 	});
 }
 //#endregion
+//#region src/federation/portable.ts
+/**
+* The media type that FEP-ef61 gateways must use for portable objects.
+*/
+const PORTABLE_OBJECT_CONTENT_TYPE = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"";
+const GATEWAY_OBJECT_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
+const BARE_DID_PATTERN = /^did:[a-z0-9]+:[^/?#]+$/i;
+/**
+* Recognizes an FEP-ef61 gateway request for a portable object, e.g.,
+* `GET /.well-known/apgateway/did:key:z6Mk.../notes/123`.
+*
+* The query is not part of the portable ID, so it is ignored here.  It is not
+* removed from the request itself, which HTTP Signatures may cover.
+*
+* @param url The request URL.
+* @returns The parsed request, or `null` if the URL is not a gateway request
+*          for a portable object, e.g., the gateway discovery endpoint or
+*          a hashlink media URL.
+*/
+function parsePortableGatewayRequest(url) {
+	if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+	if (!GATEWAY_OBJECT_PATH_PATTERN.test(url.pathname)) return null;
+	let id;
+	let canonicalId;
+	try {
+		id = fromCompatibleEf61Id(url.origin + url.pathname);
+		if (id == null) return null;
+		canonicalId = canonicalizePortableUri(formatIri(id));
+	} catch (error) {
+		if (error instanceof TypeError) return {
+			type: "malformed",
+			error
+		};
+		throw error;
+	}
+	const authority = getFe34Origin(id);
+	const href = id.href;
+	return {
+		type: "object",
+		portableRequest: Object.freeze({
+			authority,
+			get id() {
+				return new URL(href);
+			}
+		}),
+		canonicalId,
+		path: id.pathname
+	};
+}
+/**
+* Builds a portable ID from a DID authority and an object path.
+* @param authority The bare DID, e.g., `did:key:z6Mk...`.
+* @param path The object path, e.g., `/notes/123`.
+* @returns The portable ID.
+* @throws {TypeError} If the authority is not a bare DID.
+*/
+function buildPortableUri(authority, path) {
+	if (typeof authority !== "string" || !BARE_DID_PATTERN.test(authority)) throw new TypeError("The authority of a portable ID must be a DID without a path, query, or fragment.");
+	getFe34Origin(authority);
+	return parseIri(`ap+ef61://${authority}${path}`);
+}
+//#endregion
 //#region src/federation/handler.ts
 const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
 const INBOX_COMPOUND_PROOF_LIMITS = {
@@ -607,6 +670,102 @@ async function handleObject(request, { values, context, objectDispatcher, author
 		Vary: "Accept"
 	} });
 }
+/**
+* Handles an FEP-ef61 gateway request for a portable object through an object
+* dispatcher.  The object is served only if its ID canonically matches the
+* requested portable ID and it satisfies the FEP-ef61 proof policy.
+* @template TContextData The context data to pass to the context.
+* @param request The HTTP request.
+* @param parameters The parameters for handling the portable object.
+* @returns A promise that resolves to an HTTP response.
+*/
+async function handlePortableObject(request, { values, context, objectDispatcher, authorizePredicate, canonicalId, onNotFound, onUnauthorized }) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"object"
+	]);
+	if (objectDispatcher == null) return await onNotFound(request);
+	const object = await objectDispatcher(context, values);
+	if (object == null) return await onNotFound(request);
+	if (!isRequestedPortableObject(object, canonicalId)) {
+		logger.debug("The object {objectId} does not match the requested portable object {portableId}.", {
+			objectId: object.id?.href,
+			portableId: canonicalId
+		});
+		return await onNotFound(request);
+	}
+	if (authorizePredicate != null) {
+		if (!await authorizePredicate(context, values)) return await onUnauthorized(request);
+	}
+	let jsonLd;
+	let servedId;
+	let result;
+	try {
+		jsonLd = await object.toJsonLd(context);
+		servedId = await getJsonLdRootId(jsonLd, context.contextLoader);
+		result = await verifyPortableObjectProof(jsonLd, {
+			contextLoader: context.contextLoader,
+			documentLoader: context.documentLoader,
+			tracerProvider: context.tracerProvider,
+			meterProvider: context.meterProvider
+		});
+	} catch (error) {
+		logger.error("Failed to verify the Object Integrity Proofs of the portable object {portableId}:\n{error}", {
+			portableId: canonicalId,
+			error
+		});
+		return portableObjectInternalServerError(request);
+	}
+	if (servedId == null || !isRequestedPortableId(servedId, canonicalId)) {
+		logger.debug("The serialized object does not match the requested portable object {portableId}.", { portableId: canonicalId });
+		return await onNotFound(request);
+	}
+	if (!result.verified && result.reason.type !== "unsecuredCollection" && result.reason.type !== "unsupportedObjectType") {
+		logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, and objects need an Object Integrity Proof made with a key of the DID in their ID.", {
+			portableId: canonicalId,
+			reason: result.reason.type
+		});
+		return portableObjectInternalServerError(request);
+	}
+	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), { headers: {
+		"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
+		Vary: "Accept"
+	} });
+}
+function isRequestedPortableObject(object, canonicalId) {
+	if (object.id == null) return false;
+	if (object.id.protocol !== "ap:" && object.id.protocol !== "ap+ef61:") return false;
+	try {
+		return canonicalizePortableUri(formatIri(object.id)) === canonicalId;
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+}
+async function getJsonLdRootId(jsonLd, contextLoader) {
+	const expanded = await jsonld.expand(jsonLd, {
+		documentLoader: getNormalizationContextLoader(contextLoader),
+		keepFreeFloatingNodes: true
+	});
+	if (expanded.length !== 1) return null;
+	const id = expanded[0]["@id"];
+	return typeof id === "string" ? id : null;
+}
+function isRequestedPortableId(id, canonicalId) {
+	try {
+		return canonicalizePortableUri(id) === canonicalId;
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+}
+function portableObjectInternalServerError(request) {
+	return new Response(request.method === "HEAD" ? null : "Internal server error.", {
+		status: 500,
+		headers: { "Content-Type": "text/plain; charset=utf-8" }
+	});
+}
 const BUILT_IN_COLLECTION_METRIC_KINDS = /* @__PURE__ */ new Set([
 	"inbox",
 	"outbox",
@@ -644,13 +803,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$1.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$2.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$1),
+		kind: getCollectionMetricKind(name$2),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -691,7 +850,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$1, filterPredicate);
+						const items = filterCollectionItems(page.items, name$2, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -731,7 +890,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 		} else {
 			const uri = new URL(baseUri);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -747,7 +906,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$1, filterPredicate);
+					const items = filterCollectionItems(page.items, name$2, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -1840,8 +1999,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$2;
+	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
+		this.name = name$1;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -2640,6 +2799,34 @@ function getWebFingerSubjectAndAliases({ resourceUrl, actorUri, preferredUsernam
 	};
 }
 /**
+* Computes the subject and aliases for an FEP-ef61 portable actor, whose
+* WebFinger address takes its domain from the first gateway of the actor
+* rather than from the actor ID.  The canonical `ap:` ID is not emitted,
+* since it is not a valid URI for software that does not support FEP-ef61;
+* the compatible identifier stands for it.
+*/
+function getPortableWebFingerSubjectAndAliases({ resourceUrl, compatibleId, preferredUsername, acctUsername, gatewayHost }) {
+	const aliases = [];
+	const add = (alias) => {
+		if (alias !== subject && !aliases.includes(alias)) aliases.push(alias);
+	};
+	let subject;
+	if (resourceUrl.protocol === "acct:") {
+		const username = preferredUsername ?? acctUsername;
+		subject = username == null ? resourceUrl.href : `acct:${username}@${gatewayHost}`;
+		add(compatibleId.href);
+		add(resourceUrl.href);
+	} else {
+		subject = preferredUsername == null ? compatibleId.href : `acct:${preferredUsername}@${gatewayHost}`;
+		add(compatibleId.href);
+		if (resourceUrl.protocol === "http:" || resourceUrl.protocol === "https:") add(resourceUrl.href);
+	}
+	return {
+		subject,
+		aliases
+	};
+}
+/**
 * Handles a WebFinger request.  You would not typically call this function
 * directly, but instead use {@link Federation.fetch} method.
 * @param request The WebFinger request to handle.
@@ -2724,7 +2911,7 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 	span?.setAttribute("webfinger.resource", resource);
 	let resourceUrl;
 	try {
-		resourceUrl = new URL(resource);
+		resourceUrl = parseIri(resource);
 	} catch (e) {
 		if (e instanceof TypeError) return new Response("Invalid resource URL.", { status: 400 });
 		throw e;
@@ -2773,7 +2960,29 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		status: 410,
 		headers: { "Access-Control-Allow-Origin": "*" }
 	});
-	const actorUri = context.getActorUri(identifier);
+	let actorUri = context.getActorUri(identifier);
+	let portable;
+	if (actor.id != null && (actor.id.protocol === "ap:" || actor.id.protocol === "ap+ef61:")) {
+		const gateway = actor.gateway;
+		let compatibleId;
+		if (gateway != null && isGatewayUrl(gateway)) try {
+			compatibleId = toCompatibleEf61Id(actor.id, gateway);
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+		}
+		if (gateway == null || compatibleId == null) {
+			logger.error("The portable actor {actorId} (identifier: {identifier}) needs an HTTP(S) origin as the first item of its gateways property to be discovered through WebFinger.", {
+				actorId: formatIri(actor.id),
+				identifier
+			});
+			return await onNotFound(request);
+		}
+		actorUri = compatibleId;
+		portable = {
+			compatibleId,
+			gatewayHost: gateway.host
+		};
+	}
 	const links = [{
 		rel: "self",
 		href: actorUri.href,
@@ -2800,13 +3009,19 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		const customLinks = await webFingerLinksDispatcher(context, resourceUrl);
 		if (customLinks != null) for (const link of customLinks) links.push(link);
 	}
-	const { subject, aliases } = getWebFingerSubjectAndAliases({
+	const { subject, aliases } = portable == null ? getWebFingerSubjectAndAliases({
 		resourceUrl,
 		actorUri,
 		preferredUsername: actor.preferredUsername,
 		acctUsername,
 		host,
 		contextHost: context.url.host
+	}) : getPortableWebFingerSubjectAndAliases({
+		resourceUrl,
+		compatibleId: portable.compatibleId,
+		preferredUsername: actor.preferredUsername,
+		acctUsername,
+		gatewayHost: portable.gatewayHost
 	});
 	return new Response(JSON.stringify({
 		subject,
@@ -4025,7 +4240,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 			...ctxOptions,
 			request,
 			invokedFromActorDispatcher: opts.invokedFromActorDispatcher,
-			invokedFromObjectDispatcher: opts.invokedFromObjectDispatcher
+			invokedFromObjectDispatcher: opts.invokedFromObjectDispatcher,
+			portableRequest: opts.portableRequest
 		});
 	}
 	#getLoaderOptions(origin) {
@@ -4276,6 +4492,24 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const url = new URL(request.url);
 		const route = this.router.route(url.pathname);
 		if (route == null) {
+			const portable = request.method === "GET" || request.method === "HEAD" ? parsePortableGatewayRequest(url) : null;
+			if (portable != null) {
+				const response = await this.#fetchPortableObject(request, portable, {
+					onNotFound,
+					onNotAcceptable,
+					onUnauthorized,
+					contextData,
+					span,
+					metricState
+				});
+				if (request.method !== "HEAD" || response.body == null) return response;
+				await response.body.cancel();
+				return new Response(null, {
+					status: response.status,
+					statusText: response.statusText,
+					headers: response.headers
+				});
+			}
 			metricState.endpoint = "not_found";
 			return await onNotFound(request);
 		}
@@ -4551,7 +4785,56 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}
 		}
 	}
+	async #fetchPortableObject(request, portable, { onNotFound, onNotAcceptable, onUnauthorized, contextData, span, metricState }) {
+		if (portable.type === "malformed") {
+			metricState.endpoint = "not_found";
+			getLogger([
+				"fedify",
+				"federation",
+				"object"
+			]).debug("Malformed FEP-ef61 gateway request {url}: {error}", {
+				url: request.url,
+				error: portable.error
+			});
+			return new Response(request.method === "HEAD" ? null : "Malformed portable object ID.", {
+				status: 400,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+		const route = this.router.route(portable.path);
+		if (route == null || !route.name.startsWith("object:")) {
+			metricState.endpoint = "not_found";
+			return await onNotFound(request);
+		}
+		metricState.routeTemplate = PORTABLE_GATEWAY_ROUTE_PREFIX + route.template;
+		metricState.endpoint = "object";
+		span.updateName(`${request.method} ${metricState.routeTemplate}`);
+		if (!acceptsJsonLd(request)) {
+			metricState.endpoint = "not_acceptable";
+			return await onNotAcceptable(request);
+		}
+		const typeId = route.name.replace(/^object:/, "");
+		const callbacks = this.objectCallbacks[typeId];
+		const cls = this.objectTypeIds[typeId];
+		const context = this.#createContext(request, contextData, {
+			invokedFromObjectDispatcher: {
+				cls,
+				values: route.values
+			},
+			portableRequest: portable.portableRequest
+		});
+		return await handlePortableObject(request, {
+			values: route.values,
+			context,
+			objectDispatcher: callbacks?.dispatcher,
+			authorizePredicate: callbacks?.authorizePredicate,
+			canonicalId: portable.canonicalId,
+			onUnauthorized,
+			onNotFound
+		});
+	}
 };
+const PORTABLE_GATEWAY_ROUTE_PREFIX = "/.well-known/apgateway/{did}";
 function getEndpointCategory(routeName) {
 	if (routeName.startsWith("object:")) return "object";
 	if (routeName.startsWith("collection:") || routeName.startsWith("orderedCollection:")) return "collection";
@@ -4686,12 +4969,20 @@ var ContextImpl = class ContextImpl {
 		return new URL(path, this.canonicalOrigin);
 	}
 	getObjectUri(cls, values) {
+		return new URL(this.#getObjectPath(cls, values), this.canonicalOrigin);
+	}
+	getPortableObjectUri(cls, values, authority) {
+		const path = this.#getObjectPath(cls, values);
+		if (authority == null) throw new TypeError("The authority of a portable ID is required outside an FEP-ef61 gateway request.");
+		return buildPortableUri(authority, path);
+	}
+	#getObjectPath(cls, values) {
 		const callbacks = this.federation.objectCallbacks[cls.typeId.href];
 		if (callbacks == null) throw new RouterError("No object dispatcher registered.");
 		for (const param of callbacks.parameters) if (!(param in values)) throw new TypeError(`Missing parameter: ${param}`);
 		const path = this.federation.router.build(`object:${cls.typeId.href}`, values);
 		if (path == null) throw new RouterError("No object dispatcher registered.");
-		return new URL(path, this.canonicalOrigin);
+		return path;
 	}
 	getOutboxUri(identifier) {
 		const path = this.federation.router.build("outbox", { identifier });
@@ -4920,6 +5211,7 @@ var ContextImpl = class ContextImpl {
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			meterProvider: options.meterProvider ?? this.meterProvider,
+			verifyPortableObject: options.verifyPortableObject ?? verifyPortableObjectProof,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}
@@ -5266,12 +5558,14 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 	#invokedFromObjectDispatcher;
 	request;
 	url = void 0;
+	portableRequest;
 	constructor(options) {
 		super(options);
 		this.#invokedFromActorDispatcher = options.invokedFromActorDispatcher;
 		this.#invokedFromObjectDispatcher = options.invokedFromObjectDispatcher;
 		this.request = options.request;
 		this.url = options.url;
+		this.portableRequest = options.portableRequest;
 	}
 	clone(data) {
 		return new RequestContextImpl({
@@ -5283,9 +5577,13 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher,
 			invokedFromActorDispatcher: this.#invokedFromActorDispatcher,
 			invokedFromObjectDispatcher: this.#invokedFromObjectDispatcher,
+			portableRequest: this.portableRequest,
 			request: this.request
 		});
 	}
+	getPortableObjectUri(cls, values, authority) {
+		return super.getPortableObjectUri(cls, values, authority ?? this.portableRequest?.authority);
+	}
 	async getActor(identifier, options) {
 		if (this.federation.actorCallbacks == null || this.federation.actorCallbacks.dispatcher == null) throw new Error("No actor dispatcher registered.");
 		if (this.#invokedFromActorDispatcher != null) getLogger([
@@ -5676,4 +5974,4 @@ function getRequestId(request) {
 	return `req_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
 }
 //#endregion
-export { handleNodeInfo as _, OutboxContextImpl as a, autoIdAssigner as b, handleActor as c, handleInbox as d, handleObject as f, handleBenchmarkTrigger as g, respondWithObjectIfAcceptable as h, KvSpecDeterminer as i, handleCollection as l, respondWithObject as m, FederationImpl as n, createFederation as o, handleOutbox as p, InboxContextImpl as r, handleWebFinger as s, ContextImpl as t, handleCustomCollection as u, handleNodeInfoJrd as v, actorDehydrator as y };
+export { handleBenchmarkTrigger as _, OutboxContextImpl as a, actorDehydrator as b, handleActor as c, handleInbox as d, handleObject as f, PORTABLE_OBJECT_CONTENT_TYPE as g, respondWithObjectIfAcceptable as h, KvSpecDeterminer as i, handleCollection as l, respondWithObject as m, FederationImpl as n, createFederation as o, handleOutbox as p, InboxContextImpl as r, handleWebFinger as s, ContextImpl as t, handleCustomCollection as u, handleNodeInfo as v, autoIdAssigner as x, handleNodeInfoJrd as y };