@fedify/fedify 2.4.0-dev.2065 → 2.4.0-dev.2073

package/dist/sig/owner.test.mjs

@@ -6,7 +6,7 @@ import { t as assertFalse } from "../assert_false-CPdRnc3E.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-D_F22lfM.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-CDsVeZI7.mjs";
 import { Create, CryptographicKey, lookupObject } from "@fedify/vocab";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 //#region src/sig/owner.test.ts

package/dist/sig/portable-collection.test.mjs

@@ -1,16 +1,16 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "../deno-BuRFI7wk.mjs";
+import { n as version, t as name } from "../deno-LYTbBhYV.mjs";
+import { c as verifyPortableObjectProofWithRoot, o as verifyPortableObjectProof } from "../proof-CxsVG6vM.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { c as verifyPortableObjectProofWithRoot, o as verifyPortableObjectProof } from "../proof-B03JXhrk.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Collection, CollectionPage, Note, Object as Object$1, OrderedCollection, Person, isActor, traverseCollection } from "@fedify/vocab";
 import { trace } from "@opentelemetry/api";
 import { test } from "@fedify/fixture";
 import { FetchError, canonicalizePortableUri, encodeMultibase, exportDidKey, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, parseIri, preloadedContexts } from "@fedify/vocab-runtime";
-import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
 import serialize from "json-canon";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
 import { dereferencePortableIri, getPortableGatewayCandidates } from "@fedify/vocab-runtime/internal/portable-dereference";
 //#region src/sig/portable-collection.ts
 const logger = getLogger([

package/dist/sig/portable-key.test.d.mts

@@ -0,0 +1,2 @@
+import { Temporal } from "temporal-polyfill";
+import { URLPattern } from "urlpattern-polyfill";

package/dist/sig/portable-key.test.mjs

@@ -0,0 +1,275 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { r as fetchKey } from "../key-BYXnTGro.mjs";
+import { l as verifyRequest, s as signRequest } from "../http-C7qHlv-b.mjs";
+import { c as rsaPublicKey3, i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "../owner-CDsVeZI7.mjs";
+import { Create, CryptographicKey, Multikey, Person } from "@fedify/vocab";
+import { test } from "@fedify/fixture";
+import { FetchError, encodeMultibase, exportDidKey, parseIri, preloadedContexts } from "@fedify/vocab-runtime";
+import serialize from "json-canon";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+//#region src/sig/portable-key.test.ts
+const did = await exportDidKey(ed25519PublicKey.publicKey);
+const didKeyId = `${did}#${did.slice(8)}`;
+const otherKeyPair = await crypto.subtle.generateKey("Ed25519", true, ["sign", "verify"]);
+const otherDid = await exportDidKey(otherKeyPair.publicKey);
+const actorId = `ap+ef61://${did}/actor`;
+const gw1 = "https://gw1.example";
+const gw2 = "https://gw2.example";
+function compatibleId(gateway, id = actorId) {
+	return `${gateway}/.well-known/apgateway/${id.replace(/^ap\+ef61:\/\//, "")}`;
+}
+const keyId = new URL(`${compatibleId(gw1)}#main-key`);
+const gatewayPublicKey = rsaPublicKey2.publicKey;
+const contextLoader = (url) => {
+	const document = preloadedContexts[url];
+	if (document == null) return Promise.reject(/* @__PURE__ */ new Error(`No context: ${url}`));
+	return Promise.resolve({
+		contextUrl: null,
+		documentUrl: url,
+		document
+	});
+};
+function createLoader(responses) {
+	const fetched = [];
+	const loader = (url) => {
+		fetched.push(url);
+		const document = responses[url.replace(/#.*$/, "")];
+		if (document == null) return Promise.reject(new FetchError(url, "HTTP 404", new Response(null, { status: 404 })));
+		return Promise.resolve({
+			contextUrl: null,
+			documentUrl: url,
+			document: structuredClone(document)
+		});
+	};
+	return Object.assign(loader, { fetched });
+}
+async function sign(document, privateKey = ed25519PrivateKey, verificationMethod = didKeyId) {
+	const proofConfig = {
+		"@context": document["@context"],
+		type: "DataIntegrityProof",
+		cryptosuite: "eddsa-jcs-2022",
+		verificationMethod,
+		proofPurpose: "assertionMethod",
+		created: "2023-02-24T23:36:38Z"
+	};
+	const encoder = new TextEncoder();
+	const proofDigest = await crypto.subtle.digest("SHA-256", encoder.encode(serialize(proofConfig)));
+	const messageDigest = await crypto.subtle.digest("SHA-256", encoder.encode(serialize(document)));
+	const digest = /* @__PURE__ */ new Uint8Array(64);
+	digest.set(new Uint8Array(proofDigest), 0);
+	digest.set(new Uint8Array(messageDigest), 32);
+	const signature = await crypto.subtle.sign("Ed25519", privateKey, digest);
+	return {
+		...document,
+		proof: {
+			...proofConfig,
+			proofValue: new TextDecoder().decode(encodeMultibase("base58btc", new Uint8Array(signature)))
+		}
+	};
+}
+async function actorJson(options = {}) {
+	const id = parseIri(options.id ?? actorId);
+	const key = options.key ?? keyId;
+	const json = await new Person({
+		id,
+		preferredUsername: "alice",
+		inbox: parseIri(`${options.id ?? actorId}/inbox`),
+		gateways: (options.gateways ?? [gw1, gw2]).map((g) => new URL(g)),
+		assertionMethods: options.assertionMethod === false ? [] : [new Multikey({
+			id: key,
+			controller: id,
+			publicKey: gatewayPublicKey
+		})],
+		publicKeys: options.publicKey === null ? [] : [new CryptographicKey({
+			id: key,
+			owner: id,
+			publicKey: options.publicKey ?? gatewayPublicKey
+		})]
+	}).toJsonLd({
+		format: "compact",
+		contextLoader
+	});
+	const context = json["@context"];
+	if (!context.includes("https://w3id.org/security/data-integrity/v1")) json["@context"] = [...context, "https://w3id.org/security/data-integrity/v1"];
+	return json;
+}
+async function signedRequest(spec, key = keyId) {
+	return await signRequest(new Request("https://recipient.example/inbox", {
+		method: "POST",
+		body: "{}",
+		headers: { "Content-Type": "application/activity+json" }
+	}), rsaPrivateKey2, key, { spec });
+}
+test("verifyRequest() accepts gateway keys vouched for by portable actors", async () => {
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await actorJson()) });
+	for (const spec of ["draft-cavage-http-signatures-12", "rfc9421"]) {
+		const key = await verifyRequest(await signedRequest(spec), {
+			documentLoader,
+			contextLoader,
+			spec
+		});
+		ok(key != null, spec);
+		strictEqual(key.id?.href, keyId.href);
+		strictEqual(key.ownerId?.href, parseIri(actorId).href);
+	}
+});
+test("verifyRequest() accepts gateway keys only in assertionMethod", async () => {
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await actorJson({ publicKey: null })) });
+	strictEqual((await verifyRequest(await signedRequest(), {
+		documentLoader,
+		contextLoader
+	}))?.id?.href, keyId.href);
+});
+test("verifyRequest() rejects gateway keys that portable actors do not vouch for", async () => {
+	const unsigned = await actorJson();
+	const cases = {
+		"an unsigned actor document": unsigned,
+		"an actor document signed by another DID": await sign(unsigned, otherKeyPair.privateKey, `${otherDid}#${otherDid.slice(8)}`),
+		"an unlisted gateway": await sign(await actorJson({ gateways: [gw2] })),
+		"a key missing from assertionMethod": await sign(await actorJson({ assertionMethod: false })),
+		"a key referred to by URL": await sign({
+			...await actorJson({
+				publicKey: null,
+				assertionMethod: false
+			}),
+			assertionMethod: [keyId.href]
+		}),
+		"a publicKey entry with other key material": await sign(await actorJson({ publicKey: rsaPublicKey3.publicKey })),
+		"a key ID for another actor": await sign(await actorJson({ key: new URL(`${compatibleId(gw1, `${actorId}/other`)}#main-key`) }))
+	};
+	for (const [name, document] of Object.entries(cases)) {
+		const documentLoader = createLoader({ [compatibleId(gw1)]: document });
+		strictEqual(await verifyRequest(await signedRequest(), {
+			documentLoader,
+			contextLoader
+		}), null, name);
+	}
+	const otherActorKey = new URL(`${compatibleId(gw1, `${actorId}/other`)}#main-key`);
+	const documentLoader = createLoader({ [compatibleId(gw1, `${actorId}/other`)]: await sign(await actorJson()) });
+	strictEqual(await verifyRequest(await signedRequest(void 0, otherActorKey), {
+		documentLoader,
+		contextLoader
+	}), null);
+});
+test("verifyRequest() keeps web-origin trust for compatible-ID actors", async () => {
+	const id = compatibleId(gw1);
+	const documentLoader = createLoader({ [id]: await actorJson({
+		id,
+		gateways: [gw1]
+	}) });
+	const key = await verifyRequest(await signedRequest(), {
+		documentLoader,
+		contextLoader
+	});
+	strictEqual(key?.id?.href, keyId.href);
+	strictEqual(key?.ownerId?.href, id);
+});
+test("gateway keys are neither cached nor accepted outside HTTP Signatures", async () => {
+	const calls = [];
+	const keyCache = {
+		get(id) {
+			calls.push(`get ${id.href}`);
+			return Promise.resolve(void 0);
+		},
+		set(id) {
+			calls.push(`set ${id.href}`);
+			return Promise.resolve();
+		}
+	};
+	const documentLoader = createLoader({ [compatibleId(gw1)]: await sign(await actorJson()) });
+	ok(await verifyRequest(await signedRequest(), {
+		documentLoader,
+		contextLoader,
+		keyCache
+	}) != null);
+	const fetchOptions = {
+		documentLoader,
+		contextLoader,
+		keyCache
+	};
+	strictEqual((await fetchKey(keyId, CryptographicKey, fetchOptions)).key, null);
+	strictEqual((await fetchKey(keyId, Multikey, fetchOptions)).key, null);
+	deepStrictEqual(calls.filter((c) => c.includes(keyId.origin)), []);
+});
+test("doesActorOwnKey() and getKeyOwner() resolve gateway keys to portable actors", async () => {
+	const options = {
+		documentLoader: createLoader({ [compatibleId(gw1)]: await sign(await actorJson()) }),
+		contextLoader
+	};
+	const key = await verifyRequest(await signedRequest(), options);
+	ok(key != null);
+	const activity = (actor) => new Create({
+		id: parseIri(`ap+ef61://${did}/activities/1`),
+		actor: parseIri(actor)
+	});
+	ok(await doesActorOwnKey(activity(actorId), key, options));
+	ok(await doesActorOwnKey(activity(compatibleId(gw2)), key, options));
+	ok(!await doesActorOwnKey(activity(`${actorId}/other`), key, options));
+	strictEqual((await getKeyOwner(keyId, options))?.id?.href, parseIri(actorId).href);
+	strictEqual((await getKeyOwner(key, options))?.id?.href, key.ownerId?.href);
+	const forged = key.clone({ publicKey: rsaPublicKey3.publicKey });
+	strictEqual(await getKeyOwner(forged, options), null);
+	ok(!await doesActorOwnKey(activity(actorId), forged, options));
+});
+test("doesActorOwnKey() and getKeyOwner() do not fall back for rejected gateway keys", async () => {
+	const options = {
+		documentLoader: createLoader({ [compatibleId(gw1)]: await actorJson() }),
+		contextLoader
+	};
+	const key = new CryptographicKey({
+		id: keyId,
+		owner: parseIri(actorId),
+		publicKey: gatewayPublicKey
+	});
+	ok(!await doesActorOwnKey(new Create({
+		id: parseIri(`ap+ef61://${did}/activities/1`),
+		actor: parseIri(actorId)
+	}), key, options));
+	strictEqual(await getKeyOwner(keyId, options), null);
+	strictEqual(await getKeyOwner(key, options), null);
+});
+test("verifyRequest() binds gateway keys to the actor whose document is signed", async () => {
+	const attackerDid = otherDid;
+	const attackerActorId = `ap+ef61://${attackerDid}/actor`;
+	const shiftingContext = "https://attacker.example/context";
+	let loads = 0;
+	const shiftingContextLoader = (url) => {
+		if (url !== shiftingContext) return contextLoader(url);
+		loads++;
+		const document = { "@context": loads <= 2 ? {
+			victimId: "@id",
+			attackerId: "https://attacker.example/ns#a"
+		} : {
+			victimId: "https://attacker.example/ns#v",
+			attackerId: "@id"
+		} };
+		return Promise.resolve({
+			contextUrl: null,
+			documentUrl: url,
+			document
+		});
+	};
+	const { id: _, ...victim } = await actorJson({ gateways: [gw1] });
+	const document = await sign({
+		...victim,
+		"@context": [...victim["@context"], shiftingContext],
+		victimId: actorId,
+		attackerId: attackerActorId
+	}, otherKeyPair.privateKey, `${attackerDid}#${attackerDid.slice(8)}`);
+	const documentLoader = createLoader({ [compatibleId(gw1)]: document });
+	strictEqual(await verifyRequest(await signedRequest(), {
+		documentLoader,
+		contextLoader: shiftingContextLoader
+	}), null);
+	ok(loads > 2, "the shifting context was loaded for the proof");
+	loads = 0;
+	strictEqual(await getKeyOwner(keyId, {
+		documentLoader,
+		contextLoader: shiftingContextLoader
+	}), null);
+});
+//#endregion
+export {};

package/dist/sig/proof.test.mjs

@@ -9,11 +9,11 @@ import { t as assertInstanceOf } from "../assert_instance_of-mrXWWNY-.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { l as verifyRequest } from "../http-f1qaBtOh.mjs";
-import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-_aSNLA90.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { a as verifyObject, l as verifyProof, n as hasProofLike, o as verifyPortableObjectProof, r as signObject, t as createProof } from "../proof-B03JXhrk.mjs";
+import { a as verifyObject, l as verifyProof, n as hasProofLike, o as verifyPortableObjectProof, r as signObject, t as createProof } from "../proof-CxsVG6vM.mjs";
+import { l as verifyRequest } from "../http-C7qHlv-b.mjs";
+import { i as rsaPrivateKey2, n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-C0SWQylk.mjs";
 import { Create, DataIntegrityProof, Document, Multikey, Note, PUBLIC_COLLECTION, Place, Translation } from "@fedify/vocab";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { decodeMultibase, encodeMultibase, exportDidKey, exportMultibaseKey, formatIri, importMultibaseKey, parseIri } from "@fedify/vocab-runtime";

package/dist/{sig-B1E2uyhQ.cjs → sig-C6TnADze.cjs}

@@ -1,6 +1,6 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-BGShIsd6.cjs");
-const require_owner = require("./owner-D8ZpRusc.cjs");
+const require_http = require("./http-DGk8XI38.cjs");
+require("./owner-DCIH7Iq0.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
@@ -236,7 +236,7 @@ async function fetchOwner(candidate, options) {
 			contextLoader,
 			tracerProvider,
 			gateways,
-			verifyPortableObject: (document, verifierOptions) => require_owner.verifyPortableObjectProof(document, {
+			verifyPortableObject: (document, verifierOptions) => require_http.verifyPortableObjectProof(document, {
 				...options,
 				...verifierOptions
 			}),
@@ -340,7 +340,7 @@ function getSourceGateway(node, documentUrl) {
 * @since 2.4.0
 */
 async function verifyPortableObject(jsonLd, options = {}) {
-	const { result, root, objectType } = await require_owner.verifyPortableObjectProofWithRoot(jsonLd, options);
+	const { result, root, objectType } = await require_http.verifyPortableObjectProofWithRoot(jsonLd, options);
 	if (result.verified) {
 		const node = objectType === "collection" && root != null ? describeRoot(root) : null;
 		const chain = node == null ? null : resolveChain(node, options.referrer);

package/dist/{sig-Bb20Pyrd.js → sig-Cs9_ecdh.js}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { I as name, L as version } from "./http-z5n7chWw.js";
-import { c as verifyPortableObjectProof, u as verifyPortableObjectProofWithRoot } from "./owner-BLBWXCNt.js";
+import { f as verifyPortableObjectProof, ht as version, m as verifyPortableObjectProofWithRoot, mt as name } from "./http-vfTpzGEq.js";
+import "./owner-DfGz0cXm.js";
 import { getLogger } from "@logtape/logtape";
 import { CollectionPage, Object as Object$1, isActor } from "@fedify/vocab";
 import { trace } from "@opentelemetry/api";

package/dist/{temporal-VVVSuruq.mjs → temporal-CLzSfIOV.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as getNormalizationContextLoader } from "./ld-CqJq5erX.mjs";
+import { c as getNormalizationContextLoader } from "./ld-DT3e2hOv.mjs";
 import jsonld from "@fedify/vocab-runtime/jsonld";
 //#region src/federation/temporal.ts
 function isPlainObject(value) {

package/dist/testing/kv.test.mjs

@@ -6,7 +6,7 @@ import { t as MemoryKvStore } from "../kv-DCHkaJ9-.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { n as baseOptions, o as stringSchema, t as MockQueue } from "../tasks-dbCShlCb.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
-import { o as createFederation } from "../middleware-s-AZzx4r.mjs";
+import { o as createFederation } from "../middleware-CpyCNOW_.mjs";
 //#region src/testing/kv.test.ts
 test("ManualClockKvStore keeps an entry at its exact expiration instant", async () => {
 	const kv = new ManualClockKvStore();

package/dist/testing/mod.d.mts

@@ -348,6 +348,25 @@ type ActorKeyPairsDispatcher<TContextData> = (context: Context<TContextData>, id
  * @since 0.15.0
  */
 type ActorHandleMapper<TContextData> = (context: Context<TContextData>, username: string) => string | null | Promise<string | null>;
+/**
+ * A callback that maps an actor's internal identifier to the ID of the
+ * [FEP-ef61] portable actor it dispatches, or `null` if the actor is not
+ * portable.
+ *
+ * The returned ID is an `ap:` or `ap+ef61:` URI, e.g.,
+ * `ap+ef61://did:key:z6Mk.../actors/alice`, or its compatible identifier.
+ * It must be the same ID that the actor dispatcher puts in the actor's `id`,
+ * and must not have a fragment.
+ *
+ * [FEP-ef61]: https://w3id.org/fep/ef61
+ *
+ * @template TContextData The context data to pass to the {@link Context}.
+ * @param context The context.
+ * @param identifier The actor's internal identifier.
+ * @returns The portable actor's ID, or `null` if the actor is not portable.
+ * @since 2.4.0
+ */
+type PortableActorIdMapper<TContextData> = (context: Context<TContextData>, identifier: string) => URL | null | Promise<URL | null>;
 /**
  * A callback that maps a WebFinger query to the corresponding actor's
  * internal identifier or username, or `null` if the query is not found.
@@ -1399,6 +1418,16 @@ interface FederationKvPrefixes {
    * @since 2.4.0
    */
   readonly taskDeduplication: KvKey;
+  /**
+   * The key prefix used for remembering which activities received in
+   * [FEP-ef61] portable inboxes have been forwarded to which gateways, so that
+   * each activity is forwarded at most once.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   * @default `["_fedify", "portableInboxForwarding"]`
+   * @since 2.4.0
+   */
+  readonly portableInboxForwarding: KvKey;
 }
 /**
  * Options for {@link FederationOptions.origin} when it is not a string.
@@ -1977,6 +2006,44 @@ interface Federation<TContextData> extends Federatable<TContextData> {
    */
   fetch(request: Request, options: FederationFetchOptions<TContextData>): Promise<Response>;
 }
+/**
+ * Options for forwarding activities received in [FEP-ef61] portable inboxes to
+ * the other gateways of their actors.  See
+ * {@link FederationOptions.portableInboxForwarding}.
+ *
+ * [FEP-ef61]: https://w3id.org/fep/ef61
+ * @since 2.4.0
+ */
+interface PortableInboxForwardingOptions {
+  /**
+   * The maximum number of other gateways that a single delivery is forwarded
+   * to.  Gateways beyond it are skipped with a warning.  `0` turns off
+   * forwarding.
+   * @default `10`
+   */
+  maxTargets?: number;
+  /**
+   * How long Fedify remembers that it has forwarded an activity from
+   * a portable inbox to a gateway, under
+   * {@link FederationKvPrefixes.portableInboxForwarding}.  Within it, the same
+   * activity is never forwarded to the same gateway again; once it expires,
+   * a redelivery of the activity may be forwarded again.  It cannot have
+   * calendar units, i.e., weeks, months, or years.
+   * @default `{ days: 30 }`
+   */
+  ttl?: Temporal.DurationLike;
+  /**
+   * How long a delivery waits for forwarding requests made immediately, i.e.,
+   * when no outbox queue is configured, before Fedify responds to it.
+   * Requests still running afterwards continue in the background.  It does
+   * not apply when forwarding is queued.  It cannot have calendar units,
+   * i.e., weeks, months, or years, and cannot be longer than
+   * 2,147,483,647 milliseconds (about 24.8 days), the longest delay timers
+   * support.
+   * @default `{ seconds: 10 }`
+   */
+  deadline?: Temporal.DurationLike;
+}
 /**
  * Policy for emitting `Accept-Signature` challenges on inbox `401`
  * responses, as defined in
@@ -2071,6 +2138,14 @@ interface FederationOptions<TContextData> {
    * @since 2.4.0
    */
   httpMessageSignaturesSpecTtl?: Temporal.DurationLike;
+  /**
+   * Options for forwarding activities received in [FEP-ef61] portable inboxes
+   * to the other gateways of their actors.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   * @since 2.4.0
+   */
+  portableInboxForwarding?: PortableInboxForwardingOptions;
   /**
    * The message queue for sending and receiving activities.  If not provided,
    * activities will not be queued and will be processed immediately.
@@ -2365,6 +2440,30 @@ interface ActorCallbackSetters<TContextData> {
    * @since 1.4.0
    */
   mapAlias(mapper: ActorAliasMapper<TContextData>): ActorCallbackSetters<TContextData>;
+  /**
+   * Sets the callback function that maps an actor's identifier to the ID of
+   * the [FEP-ef61] portable actor it dispatches.  If the callback returns
+   * a portable ID for an identifier, the key pairs of that actor are treated
+   * as this server's *gateway keys* for the portable actor:
+   * {@link Context.getActorKeyPairs} derives their key IDs from the actor's
+   * compatible identifier on this server, e.g.,
+   * `https://example.com/.well-known/apgateway/did:key:z6Mk.../actors/alice#main-key`,
+   * and makes the portable actor their owner, so that requests this server
+   * makes on behalf of the actor, such as activity deliveries and signed
+   * fetches, are signed with them.  Gateway keys are only used for HTTP
+   * Signatures; they never make Object Integrity Proofs or Linked Data
+   * Signatures.
+   *
+   * If it's omitted, or it returns `null`, the actor's keys are derived from
+   * {@link Context.getActorUri} as usual.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   * @param mapper A callback that maps an actor's identifier to its portable
+   *               ID, or `null` if the actor is not portable.
+   * @returns The setters object so that settings can be chained.
+   * @since 2.4.0
+   */
+  mapPortableActorId(mapper: PortableActorIdMapper<TContextData>): ActorCallbackSetters<TContextData>;
   /**
    * Maps a fixed path to a sentinel identifier.  It is useful for exposing
    * a single, instance-level actor at a fixed path, such as `/actor` for
@@ -2830,6 +2929,35 @@ interface Context<TContextData> {
    * @since 2.4.0
    */
   getPortableObjectUri<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>, authority: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's inbox with the given
+   * identifier under the given DID authority.
+   *
+   * The path is the same as the one {@link Context.getInboxUri} builds from
+   * the inbox path, but the result is an `ap+ef61:` URI whose authority is
+   * the DID, e.g., `ap+ef61://did:key:z6Mk.../users/alice/inbox`.  If
+   * a portable actor has it as its `inbox` and lists this server in its
+   * `gateways`, this server accepts deliveries to the inbox through
+   * the FEP-ef61 gateway endpoint, e.g.,
+   * `POST /.well-known/apgateway/did:key:z6Mk.../users/alice/inbox`, and
+   * dispatches them to the inbox listeners.
+   *
+   * The returned `URL` keeps the DID authority percent-encoded, because
+   * the `URL` class cannot represent the canonical form.  Use `formatIri()`
+   * from `@fedify/vocab-runtime` to get the canonical string.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.
+   * @returns The inbox's portable ID.
+   * @throws {RouterError} If no inbox path is registered.
+   * @throws {TypeError} If the authority is not a DID.
+   * @since 2.4.0
+   */
+  getPortableInboxUri(identifier: string, authority: string): URL;
   /**
    * Builds the URI of an actor's outbox with the given identifier.
    * @param identifier The actor's identifier.
@@ -3244,6 +3372,29 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * @since 2.4.0
    */
   getPortableObjectUri<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>, authority?: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's inbox with the given
+   * identifier.  It works the same as {@link Context.getPortableInboxUri},
+   * except that the authority can be omitted while handling a portable object
+   * request, i.e., when {@link RequestContext.portableRequest} is set.  In
+   * that case, its DID is used.  Deliveries to portable inboxes do not set
+   * {@link RequestContext.portableRequest}, so pass the authority explicitly
+   * while handling them.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.  Defaults to the DID of
+   *                  the requested portable object, if any.
+   * @returns The inbox's portable ID.
+   * @throws {RouterError} If no inbox path is registered.
+   * @throws {TypeError} If the authority is not a DID, or the authority is
+   *                     omitted outside a portable gateway request.
+   * @since 2.4.0
+   */
+  getPortableInboxUri(identifier: string, authority?: string): URL;
   /**
    * Creates a new context with the same properties as this one,
    * but with the given data.

package/dist/testing/mod.mjs

@@ -2,8 +2,8 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { r as testDefinitions } from "../dist-BQvArojP.mjs";
-import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-DG5QeQ8W.mjs";
+import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-DlZhxdFT.mjs";
 import { t as ManualClockKvStore } from "../kv-DBRWVx3Q.mjs";
 import { a as numberSchema, i as makeSchema, n as baseOptions, o as stringSchema, r as envelopeSchema, t as MockQueue } from "../tasks-dbCShlCb.mjs";
-import "../testing-By1YYsIK.mjs";
+import "../testing-CO_cEvQc.mjs";
 export { ManualClockKvStore, MockQueue, baseOptions, createInboxContext, createOutboxContext, createRequestContext, envelopeSchema, makeSchema, numberSchema, stringSchema, testDefinitions };

package/dist/{testing-By1YYsIK.mjs → testing-CO_cEvQc.mjs}

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import "./dist-BQvArojP.mjs";
-import "./context-DG5QeQ8W.mjs";
+import "./context-DlZhxdFT.mjs";
 import "./kv-DBRWVx3Q.mjs";
 import "./tasks-dbCShlCb.mjs";
 export {};

package/dist/utils/docloader.test.mjs

@@ -5,9 +5,9 @@ import { t as esm_default } from "../esm-BHXXx4Wx.mjs";
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
-import { l as verifyRequest } from "../http-f1qaBtOh.mjs";
+import { l as verifyRequest } from "../http-C7qHlv-b.mjs";
 import { i as rsaPrivateKey2 } from "../keys-DIJNHW-Y.mjs";
-import { t as getAuthenticatedDocumentLoader } from "../docloader-_aSNLA90.mjs";
+import { t as getAuthenticatedDocumentLoader } from "../docloader-C0SWQylk.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";
 //#region src/utils/docloader.test.ts

package/dist/utils/kv-cache.test.mjs

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as kvCache, t as MockKvStore } from "../kv-cache-C9IY-FMN.mjs";
+import { n as kvCache, t as MockKvStore } from "../kv-cache-DEH5jyND.mjs";
 import { deepStrictEqual, throws } from "node:assert";
 import { createTestMeterProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { preloadedContexts } from "@fedify/vocab-runtime";

package/dist/utils/mod.cjs

@@ -1,5 +1,5 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_kv_cache = require("../kv-cache-CY6pDNoS.cjs");
+const require_kv_cache = require("../kv-cache-DvqkKNIj.cjs");
 exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocumentLoader;
 exports.kvCache = require_kv_cache.kvCache;

package/dist/utils/mod.d.cts

@@ -1,3 +1,3 @@
 /// <reference lib="esnext.temporal" />
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-CyiSjRkk.cjs";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-xGFCHqq_.cjs";
 export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.d.ts

@@ -1,3 +1,3 @@
 /// <reference lib="esnext.temporal" />
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-C0BYc0OU.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../mod-CVZrXSdm.js";
 export { getAuthenticatedDocumentLoader, kvCache };

package/dist/utils/mod.js

@@ -1,4 +1,4 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-Cgj-kpQS.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "../kv-cache-DCJuwdnB.js";
 export { getAuthenticatedDocumentLoader, kvCache };