@fedify/fedify 2.4.0-dev.2030 → 2.4.0-dev.2047

package/dist/{middleware-Cxto6Bq2.js → middleware-Drzx-OID.js}

@@ -2,18 +2,18 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { A as recordWebFingerHandle, C as recordCollectionRequest, D as recordInboxActivity, E as recordFanoutRecipients, I as name, L as version, M as formatAcceptSignature, O as recordOutboxActivity, S as recordCollectionPageItems, _ as instrumentDocumentLoader, a as verifyRequestDetailed, b as recordCircuitBreakerStateChange, d as importJwk, f as validateCryptoKey, g as getRemoteHost, h as getFederationMetrics, i as verifyRequest, j as registerQueueDepthGauge, k as recordOutboxEnqueue, m as getDurationMs, n as parseRfc9421SignatureInput, o as exportJwk, t as doubleKnock, v as isAbortError, w as recordCollectionTotalItems, x as recordCollectionDispatchDuration } from "./http-By8tnmEr.js";
+import { A as recordWebFingerHandle, C as recordCollectionRequest, D as recordInboxActivity, E as recordFanoutRecipients, I as name, L as version, M as formatAcceptSignature, O as recordOutboxActivity, S as recordCollectionPageItems, _ as instrumentDocumentLoader, a as verifyRequestDetailed, b as recordCircuitBreakerStateChange, d as importJwk, f as validateCryptoKey, g as getRemoteHost, h as getFederationMetrics, i as verifyRequest, j as registerQueueDepthGauge, k as recordOutboxEnqueue, m as getDurationMs, n as parseRfc9421SignatureInput, o as exportJwk, t as doubleKnock, v as isAbortError, w as recordCollectionTotalItems, x as recordCollectionDispatchDuration } from "./http-BmdqHyms.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-C_cNlNVK.js";
-import { C as verifyCompactJsonLd, D as normalizeOutgoingActivityJsonLd, E as wrapContextLoaderForJsonLd, S as signJsonLd, _ as getNormalizationContextLoader, a as signObject, b as isClearlyMalformedContextReference, d as InvalidContextReferenceError, f as assertSafeJsonLd, g as detachSignature, i as hasProofLike, l as verifyPortableObjectProofPolicy, m as compactJsonLd, n as getKeyOwner, o as verifyMapLocalProof, s as verifyObject, t as doesActorOwnKey, v as hasSignature, x as isInvalidUrlTypeError, y as hasSignatureLike } from "./owner-D-E0bT2O.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-BswMKQjC.js";
+import { C as verifyCompactJsonLd, D as normalizeOutgoingActivityJsonLd, E as wrapContextLoaderForJsonLd, S as signJsonLd, _ as getNormalizationContextLoader, a as signObject, b as isClearlyMalformedContextReference, c as verifyPortableObjectProof, d as InvalidContextReferenceError, f as assertSafeJsonLd, g as detachSignature, i as hasProofLike, l as verifyPortableObjectProofPolicy, m as compactJsonLd, n as getKeyOwner, o as verifyMapLocalProof, s as verifyObject, t as doesActorOwnKey, v as hasSignature, x as isInvalidUrlTypeError, y as hasSignatureLike } from "./owner-CMnmv7S9.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-fi_-XZco.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 import { encodeHex } from "byte-encodings/hex";
-import { FetchError, UrlError, getDocumentLoader, getFe34Origin, haveSameFe34Origin, validatePublicUrl } from "@fedify/vocab-runtime";
-import { uniq } from "es-toolkit";
+import { FetchError, UrlError, canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, haveSameFe34Origin, isGatewayUrl, parseIri, toCompatibleEf61Id, validatePublicUrl } from "@fedify/vocab-runtime";
 import jsonld from "@fedify/vocab-runtime/jsonld";
+import { uniq } from "es-toolkit";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_HTTP_RESPONSE_HEADER, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { DataPointType, MeterProvider as MeterProvider$1, MetricReader } from "@opentelemetry/sdk-metrics";
@@ -203,38 +203,39 @@ var FederationBuilderImpl = class {
 				"federation",
 				"actor"
 			]);
+			const portable = actor.id?.protocol === "ap:" || actor.id?.protocol === "ap+ef61:";
 			if (actor.id == null) logger.warn("Actor dispatcher returned an actor without an id property.  Set the property with Context.getActorUri(identifier).");
-			else if (actor.id.href != context.getActorUri(identifier).href) logger.warn("Actor dispatcher returned an actor with an id property that does not match the actor URI.  Set the property with Context.getActorUri(identifier).");
+			else if (!portable && actor.id.href != context.getActorUri(identifier).href) logger.warn("Actor dispatcher returned an actor with an id property that does not match the actor URI.  Set the property with Context.getActorUri(identifier).");
 			if (actor instanceof Tombstone) return actor;
 			if (this.followingCallbacks != null && this.followingCallbacks.dispatcher != null) {
 				if (actor.followingId == null) logger.warn("You configured a following collection dispatcher, but the actor does not have a following property.  Set the property with Context.getFollowingUri(identifier).");
-				else if (actor.followingId.href != context.getFollowingUri(identifier).href) logger.warn("You configured a following collection dispatcher, but the actor's following property does not match the following collection URI.  Set the property with Context.getFollowingUri(identifier).");
+				else if (!portable && actor.followingId.href != context.getFollowingUri(identifier).href) logger.warn("You configured a following collection dispatcher, but the actor's following property does not match the following collection URI.  Set the property with Context.getFollowingUri(identifier).");
 			}
 			if (this.followersCallbacks != null && this.followersCallbacks.dispatcher != null) {
 				if (actor.followersId == null) logger.warn("You configured a followers collection dispatcher, but the actor does not have a followers property.  Set the property with Context.getFollowersUri(identifier).");
-				else if (actor.followersId.href != context.getFollowersUri(identifier).href) logger.warn("You configured a followers collection dispatcher, but the actor's followers property does not match the followers collection URI.  Set the property with Context.getFollowersUri(identifier).");
+				else if (!portable && actor.followersId.href != context.getFollowersUri(identifier).href) logger.warn("You configured a followers collection dispatcher, but the actor's followers property does not match the followers collection URI.  Set the property with Context.getFollowersUri(identifier).");
 			}
 			if (this.outboxCallbacks != null && this.outboxCallbacks.dispatcher != null) {
 				if (actor?.outboxId == null) logger.warn("You configured an outbox collection dispatcher, but the actor does not have an outbox property.  Set the property with Context.getOutboxUri(identifier).");
-				else if (actor.outboxId.href != context.getOutboxUri(identifier).href) logger.warn("You configured an outbox collection dispatcher, but the actor's outbox property does not match the outbox collection URI.  Set the property with Context.getOutboxUri(identifier).");
+				else if (!portable && actor.outboxId.href != context.getOutboxUri(identifier).href) logger.warn("You configured an outbox collection dispatcher, but the actor's outbox property does not match the outbox collection URI.  Set the property with Context.getOutboxUri(identifier).");
 			}
 			if (this.likedCallbacks != null && this.likedCallbacks.dispatcher != null) {
 				if (actor?.likedId == null) logger.warn("You configured a liked collection dispatcher, but the actor does not have a liked property.  Set the property with Context.getLikedUri(identifier).");
-				else if (actor.likedId.href != context.getLikedUri(identifier).href) logger.warn("You configured a liked collection dispatcher, but the actor's liked property does not match the liked collection URI.  Set the property with Context.getLikedUri(identifier).");
+				else if (!portable && actor.likedId.href != context.getLikedUri(identifier).href) logger.warn("You configured a liked collection dispatcher, but the actor's liked property does not match the liked collection URI.  Set the property with Context.getLikedUri(identifier).");
 			}
 			if (this.featuredCallbacks != null && this.featuredCallbacks.dispatcher != null) {
 				if (actor?.featuredId == null) logger.warn("You configured a featured collection dispatcher, but the actor does not have a featured property.  Set the property with Context.getFeaturedUri(identifier).");
-				else if (actor.featuredId.href != context.getFeaturedUri(identifier).href) logger.warn("You configured a featured collection dispatcher, but the actor's featured property does not match the featured collection URI.  Set the property with Context.getFeaturedUri(identifier).");
+				else if (!portable && actor.featuredId.href != context.getFeaturedUri(identifier).href) logger.warn("You configured a featured collection dispatcher, but the actor's featured property does not match the featured collection URI.  Set the property with Context.getFeaturedUri(identifier).");
 			}
 			if (this.featuredTagsCallbacks != null && this.featuredTagsCallbacks.dispatcher != null) {
 				if (actor?.featuredTagsId == null) logger.warn("You configured a featured tags collection dispatcher, but the actor does not have a featuredTags property.  Set the property with Context.getFeaturedTagsUri(identifier).");
-				else if (actor.featuredTagsId.href != context.getFeaturedTagsUri(identifier).href) logger.warn("You configured a featured tags collection dispatcher, but the actor's featuredTags property does not match the featured tags collection URI.  Set the property with Context.getFeaturedTagsUri(identifier).");
+				else if (!portable && actor.featuredTagsId.href != context.getFeaturedTagsUri(identifier).href) logger.warn("You configured a featured tags collection dispatcher, but the actor's featuredTags property does not match the featured tags collection URI.  Set the property with Context.getFeaturedTagsUri(identifier).");
 			}
 			if (this.router.has("inbox")) {
 				if (actor.inboxId == null) logger.warn("You configured inbox listeners, but the actor does not have an inbox property.  Set the property with Context.getInboxUri(identifier).");
-				else if (actor.inboxId.href != context.getInboxUri(identifier).href) logger.warn("You configured inbox listeners, but the actor's inbox property does not match the inbox URI.  Set the property with Context.getInboxUri(identifier).");
+				else if (!portable && actor.inboxId.href != context.getInboxUri(identifier).href) logger.warn("You configured inbox listeners, but the actor's inbox property does not match the inbox URI.  Set the property with Context.getInboxUri(identifier).");
 				if (actor.endpoints == null || actor.endpoints.sharedInbox == null) logger.warn("You configured inbox listeners, but the actor does not have a endpoints.sharedInbox property.  Set the property with Context.getInboxUri().");
-				else if (actor.endpoints.sharedInbox.href != context.getInboxUri().href) logger.warn("You configured inbox listeners, but the actor's endpoints.sharedInbox property does not match the shared inbox URI.  Set the property with Context.getInboxUri().");
+				else if (!portable && actor.endpoints.sharedInbox.href != context.getInboxUri().href) logger.warn("You configured inbox listeners, but the actor's endpoints.sharedInbox property does not match the shared inbox URI.  Set the property with Context.getInboxUri().");
 			}
 			if (callbacks.keyPairsDispatcher != null) {
 				if (actor.publicKeyId == null) logger.warn("You configured a key pairs dispatcher, but the actor does not have a publicKey property.  Set the property with Context.getActorKeyPairs(identifier).");
@@ -2188,6 +2189,68 @@ function acceptsJsonLd(request) {
 	return types.includes("application/activity+json") || types.includes("application/ld+json") || types.includes("application/json");
 }
 //#endregion
+//#region src/federation/portable.ts
+/**
+* The media type that FEP-ef61 gateways must use for portable objects.
+*/
+const PORTABLE_OBJECT_CONTENT_TYPE = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"";
+const GATEWAY_OBJECT_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
+const BARE_DID_PATTERN = /^did:[a-z0-9]+:[^/?#]+$/i;
+/**
+* Recognizes an FEP-ef61 gateway request for a portable object, e.g.,
+* `GET /.well-known/apgateway/did:key:z6Mk.../notes/123`.
+*
+* The query is not part of the portable ID, so it is ignored here.  It is not
+* removed from the request itself, which HTTP Signatures may cover.
+*
+* @param url The request URL.
+* @returns The parsed request, or `null` if the URL is not a gateway request
+*          for a portable object, e.g., the gateway discovery endpoint or
+*          a hashlink media URL.
+*/
+function parsePortableGatewayRequest(url) {
+	if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+	if (!GATEWAY_OBJECT_PATH_PATTERN.test(url.pathname)) return null;
+	let id;
+	let canonicalId;
+	try {
+		id = fromCompatibleEf61Id(url.origin + url.pathname);
+		if (id == null) return null;
+		canonicalId = canonicalizePortableUri(formatIri(id));
+	} catch (error) {
+		if (error instanceof TypeError) return {
+			type: "malformed",
+			error
+		};
+		throw error;
+	}
+	const authority = getFe34Origin(id);
+	const href = id.href;
+	return {
+		type: "object",
+		portableRequest: Object.freeze({
+			authority,
+			get id() {
+				return new URL(href);
+			}
+		}),
+		canonicalId,
+		path: id.pathname
+	};
+}
+/**
+* Builds a portable ID from a DID authority and an object path.
+* @param authority The bare DID, e.g., `did:key:z6Mk...`.
+* @param path The object path, e.g., `/notes/123`.
+* @returns The portable ID.
+* @throws {TypeError} If the authority is not a bare DID.
+*/
+function buildPortableUri(authority, path) {
+	if (typeof authority !== "string" || !BARE_DID_PATTERN.test(authority)) throw new TypeError("The authority of a portable ID must be a DID without a path, query, or fragment.");
+	getFe34Origin(authority);
+	return parseIri(`ap+ef61://${authority}${path}`);
+}
+//#endregion
 //#region src/federation/temporal.ts
 function isPlainObject$1(value) {
 	return typeof value === "object" && value != null && !Array.isArray(value);
@@ -2372,6 +2435,102 @@ async function handleObject(request, { values, context, objectDispatcher, author
 		Vary: "Accept"
 	} });
 }
+/**
+* Handles an FEP-ef61 gateway request for a portable object through an object
+* dispatcher.  The object is served only if its ID canonically matches the
+* requested portable ID and it satisfies the FEP-ef61 proof policy.
+* @template TContextData The context data to pass to the context.
+* @param request The HTTP request.
+* @param parameters The parameters for handling the portable object.
+* @returns A promise that resolves to an HTTP response.
+*/
+async function handlePortableObject(request, { values, context, objectDispatcher, authorizePredicate, canonicalId, onNotFound, onUnauthorized }) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"object"
+	]);
+	if (objectDispatcher == null) return await onNotFound(request);
+	const object = await objectDispatcher(context, values);
+	if (object == null) return await onNotFound(request);
+	if (!isRequestedPortableObject(object, canonicalId)) {
+		logger.debug("The object {objectId} does not match the requested portable object {portableId}.", {
+			objectId: object.id?.href,
+			portableId: canonicalId
+		});
+		return await onNotFound(request);
+	}
+	if (authorizePredicate != null) {
+		if (!await authorizePredicate(context, values)) return await onUnauthorized(request);
+	}
+	let jsonLd;
+	let servedId;
+	let result;
+	try {
+		jsonLd = await object.toJsonLd(context);
+		servedId = await getJsonLdRootId(jsonLd, context.contextLoader);
+		result = await verifyPortableObjectProof(jsonLd, {
+			contextLoader: context.contextLoader,
+			documentLoader: context.documentLoader,
+			tracerProvider: context.tracerProvider,
+			meterProvider: context.meterProvider
+		});
+	} catch (error) {
+		logger.error("Failed to verify the Object Integrity Proofs of the portable object {portableId}:\n{error}", {
+			portableId: canonicalId,
+			error
+		});
+		return portableObjectInternalServerError(request);
+	}
+	if (servedId == null || !isRequestedPortableId(servedId, canonicalId)) {
+		logger.debug("The serialized object does not match the requested portable object {portableId}.", { portableId: canonicalId });
+		return await onNotFound(request);
+	}
+	if (!result.verified && result.reason.type !== "unsecuredCollection" && result.reason.type !== "unsupportedObjectType") {
+		logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, and objects need an Object Integrity Proof made with a key of the DID in their ID.", {
+			portableId: canonicalId,
+			reason: result.reason.type
+		});
+		return portableObjectInternalServerError(request);
+	}
+	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), { headers: {
+		"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
+		Vary: "Accept"
+	} });
+}
+function isRequestedPortableObject(object, canonicalId) {
+	if (object.id == null) return false;
+	if (object.id.protocol !== "ap:" && object.id.protocol !== "ap+ef61:") return false;
+	try {
+		return canonicalizePortableUri(formatIri(object.id)) === canonicalId;
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+}
+async function getJsonLdRootId(jsonLd, contextLoader) {
+	const expanded = await jsonld.expand(jsonLd, {
+		documentLoader: getNormalizationContextLoader(contextLoader),
+		keepFreeFloatingNodes: true
+	});
+	if (expanded.length !== 1) return null;
+	const id = expanded[0]["@id"];
+	return typeof id === "string" ? id : null;
+}
+function isRequestedPortableId(id, canonicalId) {
+	try {
+		return canonicalizePortableUri(id) === canonicalId;
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+}
+function portableObjectInternalServerError(request) {
+	return new Response(request.method === "HEAD" ? null : "Internal server error.", {
+		status: 500,
+		headers: { "Content-Type": "text/plain; charset=utf-8" }
+	});
+}
 const BUILT_IN_COLLECTION_METRIC_KINDS = /* @__PURE__ */ new Set([
 	"inbox",
 	"outbox",
@@ -2409,13 +2568,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$1.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$2.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$1),
+		kind: getCollectionMetricKind(name$2),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -2456,7 +2615,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$1, filterPredicate);
+						const items = filterCollectionItems(page.items, name$2, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -2496,7 +2655,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 		} else {
 			const uri = new URL(baseUri);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -2512,7 +2671,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$1, filterPredicate);
+					const items = filterCollectionItems(page.items, name$2, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -3605,8 +3764,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$2;
+	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
+		this.name = name$1;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -5092,6 +5251,34 @@ function getWebFingerSubjectAndAliases({ resourceUrl, actorUri, preferredUsernam
 	};
 }
 /**
+* Computes the subject and aliases for an FEP-ef61 portable actor, whose
+* WebFinger address takes its domain from the first gateway of the actor
+* rather than from the actor ID.  The canonical `ap:` ID is not emitted,
+* since it is not a valid URI for software that does not support FEP-ef61;
+* the compatible identifier stands for it.
+*/
+function getPortableWebFingerSubjectAndAliases({ resourceUrl, compatibleId, preferredUsername, acctUsername, gatewayHost }) {
+	const aliases = [];
+	const add = (alias) => {
+		if (alias !== subject && !aliases.includes(alias)) aliases.push(alias);
+	};
+	let subject;
+	if (resourceUrl.protocol === "acct:") {
+		const username = preferredUsername ?? acctUsername;
+		subject = username == null ? resourceUrl.href : `acct:${username}@${gatewayHost}`;
+		add(compatibleId.href);
+		add(resourceUrl.href);
+	} else {
+		subject = preferredUsername == null ? compatibleId.href : `acct:${preferredUsername}@${gatewayHost}`;
+		add(compatibleId.href);
+		if (resourceUrl.protocol === "http:" || resourceUrl.protocol === "https:") add(resourceUrl.href);
+	}
+	return {
+		subject,
+		aliases
+	};
+}
+/**
 * Handles a WebFinger request.  You would not typically call this function
 * directly, but instead use {@link Federation.fetch} method.
 * @param request The WebFinger request to handle.
@@ -5176,7 +5363,7 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 	span?.setAttribute("webfinger.resource", resource);
 	let resourceUrl;
 	try {
-		resourceUrl = new URL(resource);
+		resourceUrl = parseIri(resource);
 	} catch (e) {
 		if (e instanceof TypeError) return new Response("Invalid resource URL.", { status: 400 });
 		throw e;
@@ -5225,7 +5412,29 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		status: 410,
 		headers: { "Access-Control-Allow-Origin": "*" }
 	});
-	const actorUri = context.getActorUri(identifier);
+	let actorUri = context.getActorUri(identifier);
+	let portable;
+	if (actor.id != null && (actor.id.protocol === "ap:" || actor.id.protocol === "ap+ef61:")) {
+		const gateway = actor.gateway;
+		let compatibleId;
+		if (gateway != null && isGatewayUrl(gateway)) try {
+			compatibleId = toCompatibleEf61Id(actor.id, gateway);
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+		}
+		if (gateway == null || compatibleId == null) {
+			logger.error("The portable actor {actorId} (identifier: {identifier}) needs an HTTP(S) origin as the first item of its gateways property to be discovered through WebFinger.", {
+				actorId: formatIri(actor.id),
+				identifier
+			});
+			return await onNotFound(request);
+		}
+		actorUri = compatibleId;
+		portable = {
+			compatibleId,
+			gatewayHost: gateway.host
+		};
+	}
 	const links = [{
 		rel: "self",
 		href: actorUri.href,
@@ -5252,13 +5461,19 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		const customLinks = await webFingerLinksDispatcher(context, resourceUrl);
 		if (customLinks != null) for (const link of customLinks) links.push(link);
 	}
-	const { subject, aliases } = getWebFingerSubjectAndAliases({
+	const { subject, aliases } = portable == null ? getWebFingerSubjectAndAliases({
 		resourceUrl,
 		actorUri,
 		preferredUsername: actor.preferredUsername,
 		acctUsername,
 		host,
 		contextHost: context.url.host
+	}) : getPortableWebFingerSubjectAndAliases({
+		resourceUrl,
+		compatibleId: portable.compatibleId,
+		preferredUsername: actor.preferredUsername,
+		acctUsername,
+		gatewayHost: portable.gatewayHost
 	});
 	return new Response(JSON.stringify({
 		subject,
@@ -6485,7 +6700,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 			...ctxOptions,
 			request,
 			invokedFromActorDispatcher: opts.invokedFromActorDispatcher,
-			invokedFromObjectDispatcher: opts.invokedFromObjectDispatcher
+			invokedFromObjectDispatcher: opts.invokedFromObjectDispatcher,
+			portableRequest: opts.portableRequest
 		});
 	}
 	#getLoaderOptions(origin) {
@@ -6736,6 +6952,24 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const url = new URL(request.url);
 		const route = this.router.route(url.pathname);
 		if (route == null) {
+			const portable = request.method === "GET" || request.method === "HEAD" ? parsePortableGatewayRequest(url) : null;
+			if (portable != null) {
+				const response = await this.#fetchPortableObject(request, portable, {
+					onNotFound,
+					onNotAcceptable,
+					onUnauthorized,
+					contextData,
+					span,
+					metricState
+				});
+				if (request.method !== "HEAD" || response.body == null) return response;
+				await response.body.cancel();
+				return new Response(null, {
+					status: response.status,
+					statusText: response.statusText,
+					headers: response.headers
+				});
+			}
 			metricState.endpoint = "not_found";
 			return await onNotFound(request);
 		}
@@ -7011,7 +7245,56 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}
 		}
 	}
+	async #fetchPortableObject(request, portable, { onNotFound, onNotAcceptable, onUnauthorized, contextData, span, metricState }) {
+		if (portable.type === "malformed") {
+			metricState.endpoint = "not_found";
+			getLogger([
+				"fedify",
+				"federation",
+				"object"
+			]).debug("Malformed FEP-ef61 gateway request {url}: {error}", {
+				url: request.url,
+				error: portable.error
+			});
+			return new Response(request.method === "HEAD" ? null : "Malformed portable object ID.", {
+				status: 400,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+		const route = this.router.route(portable.path);
+		if (route == null || !route.name.startsWith("object:")) {
+			metricState.endpoint = "not_found";
+			return await onNotFound(request);
+		}
+		metricState.routeTemplate = PORTABLE_GATEWAY_ROUTE_PREFIX + route.template;
+		metricState.endpoint = "object";
+		span.updateName(`${request.method} ${metricState.routeTemplate}`);
+		if (!acceptsJsonLd(request)) {
+			metricState.endpoint = "not_acceptable";
+			return await onNotAcceptable(request);
+		}
+		const typeId = route.name.replace(/^object:/, "");
+		const callbacks = this.objectCallbacks[typeId];
+		const cls = this.objectTypeIds[typeId];
+		const context = this.#createContext(request, contextData, {
+			invokedFromObjectDispatcher: {
+				cls,
+				values: route.values
+			},
+			portableRequest: portable.portableRequest
+		});
+		return await handlePortableObject(request, {
+			values: route.values,
+			context,
+			objectDispatcher: callbacks?.dispatcher,
+			authorizePredicate: callbacks?.authorizePredicate,
+			canonicalId: portable.canonicalId,
+			onUnauthorized,
+			onNotFound
+		});
+	}
 };
+const PORTABLE_GATEWAY_ROUTE_PREFIX = "/.well-known/apgateway/{did}";
 function getEndpointCategory(routeName) {
 	if (routeName.startsWith("object:")) return "object";
 	if (routeName.startsWith("collection:") || routeName.startsWith("orderedCollection:")) return "collection";
@@ -7146,12 +7429,20 @@ var ContextImpl = class ContextImpl {
 		return new URL(path, this.canonicalOrigin);
 	}
 	getObjectUri(cls, values) {
+		return new URL(this.#getObjectPath(cls, values), this.canonicalOrigin);
+	}
+	getPortableObjectUri(cls, values, authority) {
+		const path = this.#getObjectPath(cls, values);
+		if (authority == null) throw new TypeError("The authority of a portable ID is required outside an FEP-ef61 gateway request.");
+		return buildPortableUri(authority, path);
+	}
+	#getObjectPath(cls, values) {
 		const callbacks = this.federation.objectCallbacks[cls.typeId.href];
 		if (callbacks == null) throw new RouterError("No object dispatcher registered.");
 		for (const param of callbacks.parameters) if (!(param in values)) throw new TypeError(`Missing parameter: ${param}`);
 		const path = this.federation.router.build(`object:${cls.typeId.href}`, values);
 		if (path == null) throw new RouterError("No object dispatcher registered.");
-		return new URL(path, this.canonicalOrigin);
+		return path;
 	}
 	getOutboxUri(identifier) {
 		const path = this.federation.router.build("outbox", { identifier });
@@ -7380,6 +7671,7 @@ var ContextImpl = class ContextImpl {
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			meterProvider: options.meterProvider ?? this.meterProvider,
+			verifyPortableObject: options.verifyPortableObject ?? verifyPortableObjectProof,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}
@@ -7726,12 +8018,14 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 	#invokedFromObjectDispatcher;
 	request;
 	url = void 0;
+	portableRequest;
 	constructor(options) {
 		super(options);
 		this.#invokedFromActorDispatcher = options.invokedFromActorDispatcher;
 		this.#invokedFromObjectDispatcher = options.invokedFromObjectDispatcher;
 		this.request = options.request;
 		this.url = options.url;
+		this.portableRequest = options.portableRequest;
 	}
 	clone(data) {
 		return new RequestContextImpl({
@@ -7743,9 +8037,13 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher,
 			invokedFromActorDispatcher: this.#invokedFromActorDispatcher,
 			invokedFromObjectDispatcher: this.#invokedFromObjectDispatcher,
+			portableRequest: this.portableRequest,
 			request: this.request
 		});
 	}
+	getPortableObjectUri(cls, values, authority) {
+		return super.getPortableObjectUri(cls, values, authority ?? this.portableRequest?.authority);
+	}
 	async getActor(identifier, options) {
 		if (this.federation.actorCallbacks == null || this.federation.actorCallbacks.dispatcher == null) throw new Error("No actor dispatcher registered.");
 		if (this.#invokedFromActorDispatcher != null) getLogger([

package/dist/{mod-D882_Xsg.d.ts → mod-BofpDIcU.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { _t as ActorHandleMapper, gt as ActorDispatcher, ht as ActorAliasMapper, l as RequestContext, zt as WebFingerLinksDispatcher } from "./context-uyRUWoZQ.js";
+import { Bt as WebFingerLinksDispatcher, _t as ActorDispatcher, gt as ActorAliasMapper, u as RequestContext, vt as ActorHandleMapper } from "./context-BJPHhBmD.js";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 

package/dist/{mod-x9W0d0Pk.d.cts → mod-DU8aVzQJ.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { _t as ActorHandleMapper, gt as ActorDispatcher, ht as ActorAliasMapper, l as RequestContext, zt as WebFingerLinksDispatcher } from "./context-BeDnDuF3.cjs";
+import { Bt as WebFingerLinksDispatcher, _t as ActorDispatcher, gt as ActorAliasMapper, u as RequestContext, vt as ActorHandleMapper } from "./context-Bh_mJfbD.cjs";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 

package/dist/mod.cjs

@@ -3,11 +3,11 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-B5F1JMh0.cjs");
-const require_federation = require("./federation-CTnaljmy.cjs");
+const require_http = require("./http-CGjvl34X.cjs");
+const require_federation = require("./federation-Bdu06LEl.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-WUYke16i.cjs");
-const require_kv_cache = require("./kv-cache-8K70pjtX.cjs");
+const require_owner = require("./owner-Hurn_ocn.cjs");
+const require_kv_cache = require("./kv-cache-CvEicbrf.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");
 require("./sig/mod.cjs");