@fedify/fedify 2.4.0-dev.2065 → 2.4.0-dev.2073

package/dist/{federation-Coi_bg12.cjs → federation-B1aeTKKN.cjs}

@@ -1,10 +1,10 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 const require_transformers = require("./transformers-BalCrSsr.cjs");
-const require_http = require("./http-BGShIsd6.cjs");
+const require_http = require("./http-DGk8XI38.cjs");
 const require_types = require("./types-Be2zbyeG.cjs");
-const require_owner = require("./owner-D8ZpRusc.cjs");
-const require_kv_cache = require("./kv-cache-CY6pDNoS.cjs");
+const require_owner = require("./owner-DCIH7Iq0.cjs");
+const require_kv_cache = require("./kv-cache-DvqkKNIj.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -281,6 +281,10 @@ var FederationBuilderImpl = class {
 				callbacks.aliasMapper = mapper;
 				return setters;
 			},
+			mapPortableActorId(mapper) {
+				callbacks.portableActorIdMapper = mapper;
+				return setters;
+			},
 			mapActorAlias: (path, identifier) => {
 				if (identifier === "") throw new _fedify_uri_template.RouterError("Identifier cannot be empty.");
 				if (this.router.has(`actorAlias:${identifier}`)) throw new _fedify_uri_template.RouterError(`Actor alias for "${identifier}" already set.`);
@@ -731,13 +735,13 @@ function createFederationBuilder() {
 }
 //#endregion
 //#region src/federation/circuit-breaker.ts
-const Temporal$10 = require_http.Temporal;
+const Temporal$11 = require_http.Temporal;
 const LEGACY_SWEEP_MARKER = ["__fedify_meta", "circuit_breaker_state_ttl_sweep_v2"];
 const LEGACY_SWEEP_DELETING_MARKER = { __fedifyDeletingCircuitBreakerLegacyState: true };
 const CIRCUIT_BREAKER_STATE_VERSION = 1;
-const LEGACY_SWEEP_LOCK_TTL = Temporal$10.Duration.from({ minutes: 5 });
-const LEGACY_SWEEP_RENEW_INTERVAL = Temporal$10.Duration.from({ minutes: 1 });
-const LEGACY_SWEEP_RETRY_WINDOW = Temporal$10.Duration.from({ hours: 168 });
+const LEGACY_SWEEP_LOCK_TTL = Temporal$11.Duration.from({ minutes: 5 });
+const LEGACY_SWEEP_RENEW_INTERVAL = Temporal$11.Duration.from({ minutes: 1 });
+const LEGACY_SWEEP_RETRY_WINDOW = Temporal$11.Duration.from({ hours: 168 });
 const LEGACY_SWEEP_WAIT_INTERVAL = 10;
 const LEGACY_SWEEP_CAS_ATTEMPTS = 3;
 /**
@@ -756,7 +760,7 @@ var CircuitBreaker = class {
 		this.#kv = options.kv;
 		this.#prefix = options.prefix;
 		this.#options = normalizeCircuitBreakerOptions(options.options ?? {});
-		this.#now = options.now ?? (() => Temporal$10.Now.instant());
+		this.#now = options.now ?? (() => Temporal$11.Now.instant());
 		this.#stateChangeObserver = options.stateChangeObserver;
 	}
 	get options() {
@@ -770,7 +774,7 @@ var CircuitBreaker = class {
 		this.#sweepLegacyStates();
 		const heldSince = parseHeldSince(message.circuitHeldSince);
 		const now = this.#now();
-		if (heldSince != null && Temporal$10.Instant.compare(heldSince.add(this.#options.heldActivityTtl), now) <= 0) return {
+		if (heldSince != null && Temporal$11.Instant.compare(heldSince.add(this.#options.heldActivityTtl), now) <= 0) return {
 			type: "drop",
 			heldSince
 		};
@@ -782,12 +786,12 @@ var CircuitBreaker = class {
 				probe: false
 			};
 			if (oldState.state === "half-open") {
-				const halfOpened = oldState.halfOpened == null ? void 0 : Temporal$10.Instant.from(oldState.halfOpened);
+				const halfOpened = oldState.halfOpened == null ? void 0 : Temporal$11.Instant.from(oldState.halfOpened);
 				if (halfOpened != null) {
 					const staleAt = halfOpened.add(this.#options.recoveryDelay);
-					if (Temporal$10.Instant.compare(now, staleAt) < 0) {
+					if (Temporal$11.Instant.compare(now, staleAt) < 0) {
 						const releaseAt = now.add(this.#options.releaseInterval);
-						const retryAt = Temporal$10.Instant.compare(releaseAt, staleAt) < 0 ? releaseAt : staleAt;
+						const retryAt = Temporal$11.Instant.compare(releaseAt, staleAt) < 0 ? releaseAt : staleAt;
 						const cappedRetryAt = this.#capHeldRetryAt(now, heldSince, retryAt);
 						return {
 							type: "hold",
@@ -809,8 +813,8 @@ var CircuitBreaker = class {
 				lastConflictingState = "half-open";
 				continue;
 			}
-			const probeAt = (oldState.opened == null ? now : Temporal$10.Instant.from(oldState.opened)).add(this.#options.recoveryDelay);
-			if (Temporal$10.Instant.compare(now, probeAt) < 0) {
+			const probeAt = (oldState.opened == null ? now : Temporal$11.Instant.from(oldState.opened)).add(this.#options.recoveryDelay);
+			if (Temporal$11.Instant.compare(now, probeAt) < 0) {
 				const retryAt = this.#capHeldRetryAt(now, heldSince, probeAt);
 				return {
 					type: "hold",
@@ -875,7 +879,7 @@ var CircuitBreaker = class {
 		for (let attempt = 0; attempt < 10; attempt++) {
 			const oldState = await this.#get(remoteHost);
 			if (oldState?.state === "open") return void 0;
-			const oldFailures = oldState?.failures.map(Temporal$10.Instant.from) ?? [];
+			const oldFailures = oldState?.failures.map(Temporal$11.Instant.from) ?? [];
 			const failures = this.#options.pruneFailures([...oldFailures, now], now);
 			let newState;
 			let transition;
@@ -959,7 +963,7 @@ var CircuitBreaker = class {
 			for await (const { key, value } of this.#kv.list(this.#prefix)) {
 				if (key.length !== this.#prefix.length + 1) continue;
 				await this.#migrateLegacyState(key, value);
-				if (Temporal$10.Instant.compare(this.#now(), leaseRenewedAt.add(LEGACY_SWEEP_RENEW_INTERVAL)) >= 0) {
+				if (Temporal$11.Instant.compare(this.#now(), leaseRenewedAt.add(LEGACY_SWEEP_RENEW_INTERVAL)) >= 0) {
 					const renewed = await this.#renewLegacySweep(markerKey, marker);
 					if (renewed == null) return;
 					marker = renewed;
@@ -983,7 +987,7 @@ var CircuitBreaker = class {
 	}
 	#finishLegacySweepMarker(marker) {
 		const retryUntil = getLegacySweepRetryUntil(marker);
-		if (retryUntil != null && Temporal$10.Instant.compare(this.#now(), Temporal$10.Instant.from(retryUntil)) < 0) return {
+		if (retryUntil != null && Temporal$11.Instant.compare(this.#now(), Temporal$11.Instant.from(retryUntil)) < 0) return {
 			state: "done",
 			retryUntil
 		};
@@ -1026,7 +1030,7 @@ var CircuitBreaker = class {
 	#isLegacySweepDone() {
 		if (this.#legacySweepDone === "final") return true;
 		if (this.#legacySweepDone == null) return false;
-		if (Temporal$10.Instant.compare(this.#now(), this.#legacySweepDone) < 0) return true;
+		if (Temporal$11.Instant.compare(this.#now(), this.#legacySweepDone) < 0) return true;
 		this.#legacySweepDone = void 0;
 		return false;
 	}
@@ -1036,7 +1040,7 @@ var CircuitBreaker = class {
 	}
 	#capHeldRetryAt(now, heldSince, retryAt) {
 		const expiresAt = (heldSince ?? now).add(this.#options.heldActivityTtl);
-		return Temporal$10.Instant.compare(expiresAt, retryAt) < 0 ? expiresAt : retryAt;
+		return Temporal$11.Instant.compare(expiresAt, retryAt) < 0 ? expiresAt : retryAt;
 	}
 	async #get(remoteHost) {
 		return parseStoredCircuitBreakerKvState(await this.#kv.get(this.#key(remoteHost)));
@@ -1106,7 +1110,7 @@ function normalizeCircuitBreakerOptions(options) {
 	assertPositiveDuration(releaseInterval, "releaseInterval");
 	if (configuredStateTtl != null) {
 		assertPositiveDuration(configuredStateTtl, "stateTtl");
-		if (Temporal$10.Duration.compare(configuredStateTtl, recoveryDelay) < 0) throw new RangeError("stateTtl must be at least recoveryDelay.");
+		if (Temporal$11.Duration.compare(configuredStateTtl, recoveryDelay) < 0) throw new RangeError("stateTtl must be at least recoveryDelay.");
 	}
 	let failure;
 	let pruneFailures;
@@ -1118,13 +1122,13 @@ function normalizeCircuitBreakerOptions(options) {
 		assertPositiveDuration(failureWindow, "failureWindow");
 		pruneFailures = (timestamps, now) => {
 			const earliest = now.subtract(failureWindow);
-			return timestamps.filter((timestamp) => Temporal$10.Instant.compare(timestamp, earliest) >= 0).slice(-failureThreshold);
+			return timestamps.filter((timestamp) => Temporal$11.Instant.compare(timestamp, earliest) >= 0).slice(-failureThreshold);
 		};
 		failure = (timestamps) => {
 			if (timestamps.length < failureThreshold) return false;
 			const first = timestamps[timestamps.length - failureThreshold];
 			const last = timestamps[timestamps.length - 1];
-			return Temporal$10.Duration.compare(first.until(last), failureWindow) <= 0;
+			return Temporal$11.Duration.compare(first.until(last), failureWindow) <= 0;
 		};
 		stateTtl = configuredStateTtl ?? maxDuration(recoveryDelay.add(failureWindow), recoveryDelay.add(heldActivityTtl));
 	} else {
@@ -1144,7 +1148,7 @@ function normalizeCircuitBreakerOptions(options) {
 	};
 }
 function maxDuration(duration, ...durations) {
-	return durations.reduce((max, candidate) => Temporal$10.Duration.compare(candidate, max) > 0 ? candidate : max, duration);
+	return durations.reduce((max, candidate) => Temporal$11.Duration.compare(candidate, max) > 0 ? candidate : max, duration);
 }
 function isLegacySweepDone(value, now) {
 	return getLegacySweepDoneUntil(value, now) != null;
@@ -1153,8 +1157,8 @@ function getLegacySweepDoneUntil(value, now) {
 	if (typeof value !== "object" || value == null || !("state" in value)) return;
 	if (value.state === "final") return "final";
 	if (value.state === "done" && "retryUntil" in value && typeof value.retryUntil === "string") try {
-		const retryUntil = Temporal$10.Instant.from(value.retryUntil);
-		return Temporal$10.Instant.compare(now, retryUntil) < 0 ? retryUntil : void 0;
+		const retryUntil = Temporal$11.Instant.from(value.retryUntil);
+		return Temporal$11.Instant.compare(now, retryUntil) < 0 ? retryUntil : void 0;
 	} catch {
 		return;
 	}
@@ -1162,7 +1166,7 @@ function getLegacySweepDoneUntil(value, now) {
 function isLegacySweepRetryDue(value, now) {
 	if (typeof value !== "object" || value == null || !("state" in value) || value.state !== "done" || !("retryUntil" in value) || typeof value.retryUntil !== "string") return false;
 	try {
-		return Temporal$10.Instant.compare(now, Temporal$10.Instant.from(value.retryUntil)) >= 0;
+		return Temporal$11.Instant.compare(now, Temporal$11.Instant.from(value.retryUntil)) >= 0;
 	} catch {
 		return false;
 	}
@@ -1173,7 +1177,7 @@ function isLegacySweepActive(value, now) {
 function isLegacySweepInProgress(value, now) {
 	if (typeof value !== "object" || value == null || !("state" in value) || value.state !== "sweeping" || !("started" in value) || typeof value.started !== "string") return false;
 	try {
-		return Temporal$10.Instant.compare(now, Temporal$10.Instant.from(value.started).add(LEGACY_SWEEP_LOCK_TTL)) < 0;
+		return Temporal$11.Instant.compare(now, Temporal$11.Instant.from(value.started).add(LEGACY_SWEEP_LOCK_TTL)) < 0;
 	} catch {
 		return false;
 	}
@@ -1181,7 +1185,7 @@ function isLegacySweepInProgress(value, now) {
 function getLegacySweepRetryUntil(value) {
 	if (typeof value !== "object" || value == null || !("retryUntil" in value) || typeof value.retryUntil !== "string") return;
 	try {
-		Temporal$10.Instant.from(value.retryUntil);
+		Temporal$11.Instant.from(value.retryUntil);
 		return value.retryUntil;
 	} catch {
 		return;
@@ -1205,19 +1209,19 @@ function delay(milliseconds) {
 	return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
 function toInstantDuration(duration) {
-	const parsed = Temporal$10.Duration.from(duration);
-	return Temporal$10.Duration.from({ milliseconds: Math.trunc(parsed.total({
+	const parsed = Temporal$11.Duration.from(duration);
+	return Temporal$11.Duration.from({ milliseconds: Math.trunc(parsed.total({
 		unit: "millisecond",
-		relativeTo: Temporal$10.PlainDateTime.from("2026-01-01T00:00:00")
+		relativeTo: Temporal$11.PlainDateTime.from("2026-01-01T00:00:00")
 	})) });
 }
 function assertPositiveDuration(duration, name) {
-	if (Temporal$10.Duration.compare(duration, { seconds: 0 }) <= 0) throw new RangeError(`${name} must be a positive duration.`);
+	if (Temporal$11.Duration.compare(duration, { seconds: 0 }) <= 0) throw new RangeError(`${name} must be a positive duration.`);
 }
 function parseHeldSince(value) {
 	if (value == null) return void 0;
 	try {
-		return Temporal$10.Instant.from(value);
+		return Temporal$11.Instant.from(value);
 	} catch (error) {
 		(0, _logtape_logtape.getLogger)([
 			"fedify",
@@ -1244,7 +1248,7 @@ function parseStoredCircuitBreakerKvState(value) {
 	const isInstantString = (v) => {
 		if (typeof v !== "string") return false;
 		try {
-			Temporal$10.Instant.from(v);
+			Temporal$11.Instant.from(v);
 			return true;
 		} catch {
 			return false;
@@ -1777,7 +1781,7 @@ async function verifyDiscoveredProofDocuments(discovered, options) {
 			verified: false,
 			reason: { type: "missingContext" }
 		});
-		const key = await require_owner.verifyMapLocalProof(document.securedDocument, options);
+		const key = await require_http.verifyMapLocalProof(document.securedDocument, options);
 		return key == null ? Object.freeze({
 			...metadata,
 			verified: false,
@@ -1815,7 +1819,7 @@ async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 		const proof = proofByPath.get(object.path);
 		const key = proof?.verified === true ? proof.key : null;
 		try {
-			const policy = await require_owner.verifyPortableObjectProofPolicy(object.document, key, options);
+			const policy = await require_http.verifyPortableObjectProofPolicy(object.document, key, options);
 			return policy.verified ? Object.freeze({
 				...metadata,
 				id: policy.objectId,
@@ -1845,7 +1849,7 @@ async function verifyCompoundPortableObjectProofs(json, limits, options = {}) {
 }
 //#endregion
 //#region src/federation/inbox.ts
-const Temporal$9 = require_http.Temporal;
+const Temporal$10 = require_http.Temporal;
 async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
@@ -1992,7 +1996,7 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 			return "error";
 		}
 		require_http.recordInboxActivity(meterProvider, "processed", (0, _fedify_vocab.getTypeId)(activity).href);
-		if (cacheKey != null) await kv.set(cacheKey, true, { ttl: Temporal$9.Duration.from({ days: 1 }) });
+		if (cacheKey != null) await kv.set(cacheKey, true, { ttl: Temporal$10.Duration.from({ days: 1 }) });
 		logger.info("Activity {activityId} has been processed.", {
 			activityId: activity.id?.href,
 			activity: json,
@@ -2004,7 +2008,7 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 }
 //#endregion
 //#region src/federation/keycache.ts
-const Temporal$8 = require_http.Temporal;
+const Temporal$9 = require_http.Temporal;
 const KEY_CACHE_GENERATION = "2";
 var KvKeyCache = class {
 	kv;
@@ -2017,8 +2021,8 @@ var KvKeyCache = class {
 		this.kv = kv;
 		this.prefix = prefix;
 		this.options = options;
-		this.unavailableKeyTtl = options.unavailableKeyTtl ?? Temporal$8.Duration.from({ minutes: 10 });
-		this.keyTtl = options.keyTtl ?? Temporal$8.Duration.from({ days: 30 });
+		this.unavailableKeyTtl = options.unavailableKeyTtl ?? Temporal$9.Duration.from({ minutes: 10 });
+		this.keyTtl = options.keyTtl ?? Temporal$9.Duration.from({ days: 30 });
 		this.nullKeys = /* @__PURE__ */ new Map();
 	}
 	#getFetchErrorKey(keyId) {
@@ -2038,13 +2042,13 @@ var KvKeyCache = class {
 	async get(keyId) {
 		const negativeExpiration = this.nullKeys.get(keyId.href);
 		if (negativeExpiration != null) {
-			if (Temporal$8.Now.instant().until(negativeExpiration).sign >= 0) return null;
+			if (Temporal$9.Now.instant().until(negativeExpiration).sign >= 0) return null;
 			this.nullKeys.delete(keyId.href);
 		}
 		const serialized = await this.kv.get(this.#entryKey(keyId));
 		if (serialized === void 0) return void 0;
 		if (serialized === null) {
-			this.nullKeys.set(keyId.href, Temporal$8.Now.instant().add(this.unavailableKeyTtl));
+			this.nullKeys.set(keyId.href, Temporal$9.Now.instant().add(this.unavailableKeyTtl));
 			return null;
 		}
 		try {
@@ -2060,7 +2064,7 @@ var KvKeyCache = class {
 	}
 	async set(keyId, key) {
 		if (key == null) {
-			this.nullKeys.set(keyId.href, Temporal$8.Now.instant().add(this.unavailableKeyTtl));
+			this.nullKeys.set(keyId.href, Temporal$9.Now.instant().add(this.unavailableKeyTtl));
 			await this.kv.set(this.#entryKey(keyId), null, { ttl: this.unavailableKeyTtl });
 			return;
 		}
@@ -2316,7 +2320,7 @@ function parseHashlinkGatewayRequest(url) {
 }
 //#endregion
 //#region src/federation/temporal.ts
-const Temporal$7 = require_http.Temporal;
+const Temporal$8 = require_http.Temporal;
 function isPlainObject$1(value) {
 	return typeof value === "object" && value != null && !Array.isArray(value);
 }
@@ -2326,7 +2330,7 @@ function normalizeDateTimeLiteral(value) {
 function isMalformedDateTimeLiteral(value) {
 	if (typeof value !== "string") return false;
 	try {
-		Temporal$7.Instant.from(normalizeDateTimeLiteral(value));
+		Temporal$8.Instant.from(normalizeDateTimeLiteral(value));
 		return false;
 	} catch {
 		return true;
@@ -2335,7 +2339,7 @@ function isMalformedDateTimeLiteral(value) {
 function isMalformedDurationLiteral(value) {
 	if (typeof value !== "string") return false;
 	try {
-		Temporal$7.Duration.from(value);
+		Temporal$8.Duration.from(value);
 		return false;
 	} catch {
 		return true;
@@ -2397,7 +2401,7 @@ function hasMalformedKnownTemporalLiteralInternal(value, visited) {
 async function hasMalformedKnownTemporalLiteral(value, contextLoader) {
 	try {
 		return hasMalformedKnownTemporalLiteralInternal(await _fedify_vocab_runtime_jsonld.default.expand(value, {
-			documentLoader: require_owner.getNormalizationContextLoader(contextLoader),
+			documentLoader: require_http.getNormalizationContextLoader(contextLoader),
 			keepFreeFloatingNodes: true
 		}), /* @__PURE__ */ new Set());
 	} catch {
@@ -2406,7 +2410,7 @@ async function hasMalformedKnownTemporalLiteral(value, contextLoader) {
 }
 //#endregion
 //#region src/federation/handler.ts
-const Temporal$6 = require_http.Temporal;
+const Temporal$7 = require_http.Temporal;
 const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
 const INBOX_COMPOUND_PROOF_LIMITS = {
 	maxDepth: 64,
@@ -2421,15 +2425,15 @@ function isPermanentRemoteContextError$1(error) {
 	if (!(error instanceof Error) || error.name !== "jsonld.InvalidUrl") return false;
 	const details = error.details;
 	if (details?.code === "invalid remote context") return true;
-	return isRemoteContextLoadingFailure$1(error) && typeof details?.url === "string" && !URL.canParse(details.url) && require_owner.isClearlyMalformedContextReference(details.url);
+	return isRemoteContextLoadingFailure$1(error) && typeof details?.url === "string" && !URL.canParse(details.url) && require_http.isClearlyMalformedContextReference(details.url);
 }
 function isInvalidJsonLdError(error) {
 	if (!(error instanceof Error)) return false;
 	const name = error.name;
-	return name === "UnsafeJsonLdError" || error instanceof require_owner.InvalidContextReferenceError || isPermanentRemoteContextError$1(error) || name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure$1(error);
+	return name === "UnsafeJsonLdError" || error instanceof require_http.InvalidContextReferenceError || isPermanentRemoteContextError$1(error) || name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure$1(error);
 }
 function isValidationTypeError(error) {
-	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || require_owner.isInvalidUrlTypeError(error));
+	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || require_http.isInvalidUrlTypeError(error));
 }
 function isPermanentActivityParseError(error) {
 	return isInvalidJsonLdError(error) || isValidationTypeError(error);
@@ -2535,7 +2539,7 @@ async function handlePortableObject(request, { values, context, objectDispatcher
 	try {
 		jsonLd = await object.toJsonLd(context);
 		servedId = await getJsonLdRootId(jsonLd, context.contextLoader);
-		result = await require_owner.verifyPortableObjectProof(jsonLd, {
+		result = await require_http.verifyPortableObjectProof(jsonLd, {
 			contextLoader: context.contextLoader,
 			documentLoader: context.documentLoader,
 			tracerProvider: context.tracerProvider,
@@ -2576,7 +2580,7 @@ function isRequestedPortableObject(object, canonicalId) {
 }
 async function getJsonLdRootId(jsonLd, contextLoader) {
 	const expanded = await _fedify_vocab_runtime_jsonld.default.expand(jsonLd, {
-		documentLoader: require_owner.getNormalizationContextLoader(contextLoader),
+		documentLoader: require_http.getNormalizationContextLoader(contextLoader),
 		keepFreeFloatingNodes: true
 	});
 	if (expanded.length !== 1) return null;
@@ -3243,7 +3247,7 @@ async function handleInbox(request, options) {
 * @returns A promise that resolves to an HTTP response.
 */
 async function handleInboxInternal(request, parameters, span) {
-	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, publicKeyTtl, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider } = parameters;
+	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, publicKeyTtl, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider, portableInbox } = parameters;
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
@@ -3256,7 +3260,7 @@ async function handleInboxInternal(request, parameters, span) {
 			message: "Actor dispatcher is not set."
 		});
 		return await onNotFound(request);
-	} else if (recipient != null) {
+	} else if (recipient != null && portableInbox == null) {
 		const actor = await actorDispatcher(ctx, recipient);
 		if (actor == null || actor instanceof _fedify_vocab.Tombstone) {
 			logger.error("Actor {recipient} not found.", { recipient });
@@ -3328,8 +3332,8 @@ async function handleInboxInternal(request, parameters, span) {
 		tracerProvider,
 		keyTtl: publicKeyTtl
 	});
-	const jsonWithoutSig = require_owner.detachSignature(json);
-	const hasLdSignature = require_owner.hasSignature(json);
+	const jsonWithoutSig = require_http.detachSignature(json);
+	const hasLdSignature = require_http.hasSignature(json);
 	const canAttemptAlternateAuthAfterLdSignatureFailure = skipSignatureVerification || hasHttpSignatureHeaders(request) || hasObjectIntegrityProof(jsonWithoutSig);
 	let deferredLdSignatureError = void 0;
 	const respondInvalidActivity = async (error) => {
@@ -3361,7 +3365,7 @@ async function handleInboxInternal(request, parameters, span) {
 	let ldSigVerified = false;
 	if (hasLdSignature) {
 		try {
-			compactedJson = await require_owner.compactJsonLd(json, ctx.contextLoader);
+			compactedJson = await require_http.compactJsonLd(json, ctx.contextLoader);
 		} catch (error) {
 			if (isInvalidJsonLdError(error)) {
 				logger.error("Failed to parse JSON-LD:\n{error}", {
@@ -3381,9 +3385,9 @@ async function handleInboxInternal(request, parameters, span) {
 			});
 		}
 		if (compactedJson !== json) {
-			compactedJsonWithoutSig = require_owner.detachSignature(compactedJson);
+			compactedJsonWithoutSig = require_http.detachSignature(compactedJson);
 			try {
-				ldSigVerified = await require_owner.verifyCompactJsonLd(compactedJson, {
+				ldSigVerified = await require_http.verifyCompactJsonLd(compactedJson, {
 					contextLoader: ctx.contextLoader,
 					documentLoader: ctx.documentLoader,
 					keyCache,
@@ -3405,7 +3409,7 @@ async function handleInboxInternal(request, parameters, span) {
 				if (!canAttemptAlternateAuthAfterLdSignatureFailure) throw error;
 				if (!skipSignatureVerification) try {
 					await _fedify_vocab.Object.fromJsonLd(compactedJson, {
-						contextLoader: require_owner.getNormalizationContextLoader(ctx.contextLoader),
+						contextLoader: require_http.getNormalizationContextLoader(ctx.contextLoader),
 						documentLoader: ctx.documentLoader,
 						tracerProvider
 					});
@@ -3429,6 +3433,7 @@ async function handleInboxInternal(request, parameters, span) {
 	}
 	let activity = null;
 	let activityVerified = false;
+	let proofVerified = false;
 	if (ldSigVerified) {
 		logger.debug("Linked Data Signatures are verified.", {
 			recipient,
@@ -3437,7 +3442,7 @@ async function handleInboxInternal(request, parameters, span) {
 		try {
 			activity = await _fedify_vocab.Activity.fromJsonLd(compactedJsonWithoutSig, {
 				...ctx,
-				contextLoader: require_owner.getNormalizationContextLoader(ctx.contextLoader)
+				contextLoader: require_http.getNormalizationContextLoader(ctx.contextLoader)
 			});
 		} catch (error) {
 			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(compactedJsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
@@ -3445,14 +3450,29 @@ async function handleInboxInternal(request, parameters, span) {
 			return await respondInvalidActivity(error);
 		}
 		activityVerified = true;
+		if (!skipSignatureVerification && require_http.hasPortableActor(activity)) try {
+			proofVerified = await require_http.verifyObject(_fedify_vocab.Activity, jsonWithoutSig, {
+				contextLoader: require_http.wrapContextLoaderForJsonLd(ctx.contextLoader),
+				documentLoader: ctx.documentLoader,
+				keyCache,
+				meterProvider,
+				tracerProvider
+			}) != null;
+		} catch (error) {
+			if (!isPermanentActivityParseError(error)) throw error;
+			logger.debug("Failed to verify the Object Integrity Proofs of the portable actor's activity:\n{error}", {
+				recipient,
+				error
+			});
+		}
 	} else {
 		logger.debug("Linked Data Signatures are not verified.", {
 			recipient,
 			json
 		});
 		try {
-			activity = await require_owner.verifyObject(_fedify_vocab.Activity, jsonWithoutSig, {
-				contextLoader: require_owner.wrapContextLoaderForJsonLd(ctx.contextLoader),
+			activity = await require_http.verifyObject(_fedify_vocab.Activity, jsonWithoutSig, {
+				contextLoader: require_http.wrapContextLoaderForJsonLd(ctx.contextLoader),
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
@@ -3501,6 +3521,7 @@ async function handleInboxInternal(request, parameters, span) {
 				activity: json
 			});
 			activityVerified = true;
+			proofVerified = true;
 		}
 	}
 	let httpSigKey = null;
@@ -3597,7 +3618,7 @@ async function handleInboxInternal(request, parameters, span) {
 		try {
 			activity = await _fedify_vocab.Activity.fromJsonLd(jsonWithoutSig, {
 				...ctx,
-				contextLoader: require_owner.wrapContextLoaderForJsonLd(ctx.contextLoader)
+				contextLoader: require_http.wrapContextLoaderForJsonLd(ctx.contextLoader)
 			});
 		} catch (error) {
 			if (!isPermanentActivityParseError(error)) throw error;
@@ -3613,6 +3634,24 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
+	if (!skipSignatureVerification && !proofVerified && (require_http.hasPortableActor(activity) || isPortableGatewayKey(httpSigKey))) {
+		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
+			activity: json,
+			recipient,
+			activityId: activity.id?.href,
+			actorId: activity.actorId?.href,
+			keyId: httpSigKey?.id?.href
+		});
+		span.setStatus({
+			code: _opentelemetry_api.SpanStatusCode.ERROR,
+			message: `The activity of the portable actor (${activity.actorId?.href}) is not authenticated by a valid Object Integrity Proof.`
+		});
+		return new Response("Activities of portable actors must have valid Object Integrity Proofs.", {
+			status: 401,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 	if (httpSigKey != null && !await require_owner.doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
 		require_http.getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("actorKeyMismatch", httpSigKey.id == null ? void 0 : require_http.getRemoteHost(httpSigKey.id));
@@ -3683,6 +3722,19 @@ async function handleInboxInternal(request, parameters, span) {
 		tracerProvider,
 		idempotencyStrategy: parameters.idempotencyStrategy
 	});
+	if (portableInbox != null && activity.id != null && PORTABLE_INBOX_FORWARDABLE_RESULTS.has(routeResult)) if (skipSignatureVerification || !(ldSigVerified || proofVerified)) logger.debug("Not forwarding activity {activityId} to the other gateways of the portable inbox {inbox}, as it is not authenticated by its own proof.", {
+		activityId: activity.id.href,
+		inbox: portableInbox.recipient.canonicalInboxId
+	});
+	else try {
+		await portableInbox.forward(json, activity.id, (0, _fedify_vocab.getTypeId)(activity).href);
+	} catch (error) {
+		logger.error("Failed to forward activity {activityId} to the other gateways of the portable inbox {inbox}:\n{error}", {
+			activityId: activity.id.href,
+			inbox: portableInbox.recipient.canonicalInboxId,
+			error
+		});
+	}
 	if (routeResult === "alreadyProcessed") return new Response(`Activity <${activity.id}> has already been processed.`, {
 		status: 202,
 		headers: { "Content-Type": "text/plain; charset=utf-8" }
@@ -3708,6 +3760,12 @@ async function handleInboxInternal(request, parameters, span) {
 		headers: { "Content-Type": "text/plain; charset=utf-8" }
 	});
 }
+const PORTABLE_INBOX_FORWARDABLE_RESULTS = /* @__PURE__ */ new Set([
+	"success",
+	"enqueued",
+	"alreadyProcessed",
+	"unsupportedActivity"
+]);
 /**
 * Handles a custom collection request.
 * @template TItem The type of items in the collection.
@@ -4301,7 +4359,7 @@ async function buildAcceptSignatureHeader(policy, kv, noncePrefix) {
 }
 async function setKey(kv, key, policy) {
 	const seconds = policy.nonceTtlSeconds ?? 300;
-	const ttl = Temporal$6.Duration.from({ seconds });
+	const ttl = Temporal$7.Duration.from({ seconds });
 	await kv.set(key, true, { ttl });
 }
 const DEF_COMPONENTS = [
@@ -4315,9 +4373,18 @@ const MIN_COMPONENTS = [
 	"@target-uri",
 	"@authority"
 ];
+/**
+* Checks whether an HTTP Signature key is a gateway key of an FEP-ef61
+* portable actor, i.e., its ID is a compatible identifier and it is owned by
+* a portable actor, which only the portable actor's signed document can
+* establish.
+*/
+function isPortableGatewayKey(key) {
+	return key?.id != null && require_http.isCompatibleKeyId(key.id) && key.ownerId != null && require_http.isPortableUri(key.ownerId);
+}
 //#endregion
 //#region src/federation/kv.ts
-const Temporal$5 = require_http.Temporal;
+const Temporal$6 = require_http.Temporal;
 /**
 * A key–value store that stores values in memory.
 * Do not use this in production as it does not persist values.
@@ -4337,7 +4404,7 @@ var MemoryKvStore = class {
 		const entry = this.#values[encodedKey];
 		if (entry == null) return Promise.resolve(void 0);
 		const [value, expiration] = entry;
-		if (expiration != null && Temporal$5.Now.instant().until(expiration).sign < 0) {
+		if (expiration != null && Temporal$6.Now.instant().until(expiration).sign < 0) {
 			delete this.#values[encodedKey];
 			return Promise.resolve(void 0);
 		}
@@ -4348,7 +4415,7 @@ var MemoryKvStore = class {
 	*/
 	set(key, value, options) {
 		const encodedKey = this.#encodeKey(key);
-		const expiration = options?.ttl == null ? null : Temporal$5.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
+		const expiration = options?.ttl == null ? null : Temporal$6.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
 		this.#values[encodedKey] = [value, expiration];
 		return Promise.resolve();
 	}
@@ -4370,13 +4437,13 @@ var MemoryKvStore = class {
 		if (entry == null) currentValue = void 0;
 		else {
 			const [value, expiration] = entry;
-			if (expiration != null && Temporal$5.Now.instant().until(expiration).sign < 0) {
+			if (expiration != null && Temporal$6.Now.instant().until(expiration).sign < 0) {
 				delete this.#values[encodedKey];
 				currentValue = void 0;
 			} else currentValue = value;
 		}
 		if (!(0, es_toolkit.isEqual)(currentValue, expectedValue)) return Promise.resolve(false);
-		const expiration = options?.ttl == null ? null : Temporal$5.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
+		const expiration = options?.ttl == null ? null : Temporal$6.Now.instant().add(options.ttl.round({ largestUnit: "hour" }));
 		this.#values[encodedKey] = [newValue, expiration];
 		return Promise.resolve(true);
 	}
@@ -4384,7 +4451,7 @@ var MemoryKvStore = class {
 	* {@inheritDoc KvStore.list}
 	*/
 	async *list(prefix) {
-		const now = Temporal$5.Now.instant();
+		const now = Temporal$6.Now.instant();
 		for (const [encodedKey, entry] of Object.entries(this.#values)) {
 			const key = JSON.parse(encodedKey);
 			if (prefix != null) {
@@ -4578,7 +4645,11 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 		rsaKey = key;
 		break;
 	}
-	if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
+	if (rsaKey == null && keys.length < 1) logger.debug("Sending the activity {activityId} to {inbox} without a signature.", {
+		activityId,
+		inbox: inbox.href
+	});
+	else if (rsaKey == null) logger.warn("No supported key found to sign the request to {inbox}.  The request will be sent without a signature.  In order to sign the request, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
 		inbox: inbox.href,
 		keys: keys.map((pair) => ({
 			keyId: pair.keyId.href,
@@ -4920,6 +4991,252 @@ function serializeDataPointType(dataPointType) {
 	}
 }
 //#endregion
+//#region src/federation/portable-inbox.ts
+const Temporal$5 = require_http.Temporal;
+const MAX_TIMEOUT_MS = 2 ** 31 - 1;
+/**
+* Fills in the defaults of {@link PortableInboxForwardingOptions} and
+* validates them.
+* @param options The options.
+* @returns The resolved options.
+* @throws {RangeError} If `maxTargets` is not a non-negative integer, if `ttl`
+*                      is not positive, if `deadline` is negative or longer
+*                      than 2,147,483,647 milliseconds (about 24.8 days), or
+*                      if either duration has calendar units, i.e., weeks,
+*                      months, or years, whose length depends on the date.
+*/
+function resolvePortableInboxForwardingOptions(options = {}) {
+	const maxTargets = options.maxTargets ?? 10;
+	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
+	const ttl = Temporal$5.Duration.from(options.ttl ?? { days: 30 });
+	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
+	const deadline = Temporal$5.Duration.from(options.deadline ?? { seconds: 10 });
+	const deadlineMs = deadline.total("millisecond");
+	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
+	return {
+		maxTargets,
+		ttl,
+		deadline
+	};
+}
+/**
+* Decides whether this server accepts a delivery to a portable inbox on behalf
+* of the given actor, which the actor dispatcher returned for the identifier
+* in the requested inbox path.
+*
+* The actor document comes from the application, so it is trusted as is and
+* its proof is not verified here.
+* @param actor The actor the actor dispatcher returned.
+* @param options The requested DID, the canonical form of the requested inbox
+*                ID, and the origin of this server.
+* @returns The resolution.
+*/
+function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, localOrigin }) {
+	if (actor == null) return {
+		status: "rejected",
+		reason: "notFound"
+	};
+	const id = actor.id;
+	if (id == null || id.protocol !== "ap:" && id.protocol !== "ap+ef61:") return {
+		status: "rejected",
+		reason: "notPortable"
+	};
+	if (!isSameAuthority(id, authority)) return {
+		status: "rejected",
+		reason: "authorityMismatch"
+	};
+	const inboxId = actor.inboxId;
+	if (inboxId == null || canonicalize(inboxId) !== canonicalInboxId) return {
+		status: "rejected",
+		reason: "inboxMismatch"
+	};
+	const gateways = actor.gateways;
+	if (!gateways.some((g) => (0, _fedify_vocab_runtime.isGatewayUrl)(g) && g.origin === localOrigin)) return {
+		status: "rejected",
+		reason: "notGateway"
+	};
+	return {
+		status: "accepted",
+		recipient: {
+			inboxId,
+			canonicalInboxId,
+			gateways
+		}
+	};
+}
+function isSameAuthority(id, authority) {
+	try {
+		return (0, _fedify_vocab_runtime.getFe34Origin)(id) === authority;
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+}
+function canonicalize(iri) {
+	try {
+		return (0, _fedify_vocab_runtime.canonicalizePortableUri)(typeof iri === "string" ? iri : (0, _fedify_vocab_runtime.formatIri)(iri));
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Forwards an activity received in a portable inbox to the inboxes of the same
+* portable actor on its other gateways, as FEP-ef61 recommends.
+*
+* FEP-ef61 forbids forwarding an activity from an inbox more than once, so
+* each target gateway is claimed with an atomic compare-and-swap before the
+* activity is handed off, and a claim is never released, even if the hand-off
+* fails, since a failed hand-off does not prove that nothing was delivered.
+* Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
+* forwarded.
+*
+* Forwarded requests are not signed with HTTP Signatures; the receiving
+* gateways authenticate the activity by its own proof.
+* @param parameters The parameters.
+* @returns The target inbox URLs that the activity was handed off to.
+*/
+async function forwardPortableInboxActivity(parameters) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
+	const { maxTargets, ttl } = parameters.options ?? resolvePortableInboxForwardingOptions();
+	if (kv.cas == null || maxTargets < 1) return [];
+	const canonicalActivityId = canonicalize(activityId) ?? activityId.href;
+	const targets = getForwardingTargets(recipient, excludedOrigins);
+	if (targets.length > maxTargets) {
+		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
+			inbox: recipient.canonicalInboxId,
+			activityId: activityId.href,
+			max: maxTargets
+		});
+		targets.length = maxTargets;
+	}
+	const claimed = [];
+	for (const { gateway, inbox } of targets) {
+		const key = [
+			...kvPrefix,
+			recipient.canonicalInboxId,
+			canonicalActivityId,
+			gateway
+		];
+		if (await kv.cas(key, void 0, true, { ttl })) claimed.push(inbox);
+	}
+	if (claimed.length < 1) return [];
+	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		targets: claimed.map((t) => t.href)
+	});
+	if (outboxQueue == null) await forwardImmediately(parameters, claimed);
+	else await enqueueForwarding(parameters, outboxQueue, claimed);
+	return claimed;
+}
+function getForwardingTargets(recipient, excludedOrigins) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const seen = new Set(excludedOrigins);
+	const targets = [];
+	for (const gateway of recipient.gateways) {
+		if (!(0, _fedify_vocab_runtime.isGatewayUrl)(gateway) || seen.has(gateway.origin)) continue;
+		seen.add(gateway.origin);
+		let inbox;
+		try {
+			inbox = (0, _fedify_vocab_runtime.toCompatibleEf61Id)(recipient.inboxId, gateway.origin);
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			logger.warn("Cannot forward to the gateway {gateway}, as the portable inbox {inbox} cannot be represented as its compatible identifier.", {
+				gateway: gateway.origin,
+				inbox: recipient.canonicalInboxId
+			});
+			continue;
+		}
+		targets.push({
+			gateway: gateway.origin,
+			inbox
+		});
+	}
+	return targets;
+}
+async function forwardImmediately({ activity, activityId, activityType, allowPrivateAddress, options, meterProvider, tracerProvider }, inboxes) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const deadline = (options ?? resolvePortableInboxForwardingOptions()).deadline.total("millisecond");
+	const sends = inboxes.map((inbox) => sendActivity({
+		activity,
+		activityId: activityId.href,
+		activityType,
+		keys: [],
+		inbox,
+		allowPrivateAddress,
+		meterProvider,
+		tracerProvider
+	}).catch((error) => {
+		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+			activityId: activityId.href,
+			inbox: inbox.href,
+			error
+		});
+	}));
+	let timer;
+	const timedOut = await Promise.race([Promise.all(sends).then(() => false), new Promise((resolve) => {
+		timer = setTimeout(() => resolve(true), deadline);
+	})]);
+	clearTimeout(timer);
+	if (timedOut) logger.warn("Forwarding activity {activityId} to other gateways did not finish in {deadline} ms; responding to the delivery without waiting for it.", {
+		activityId: activityId.href,
+		deadline
+	});
+}
+async function enqueueForwarding({ activity, activityId, activityType, baseUrl, startQueue, meterProvider }, outboxQueue, inboxes) {
+	const logger = (0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	startQueue?.();
+	const started = (/* @__PURE__ */ new Date()).toISOString();
+	const traceContext = {};
+	_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), traceContext);
+	await Promise.all(inboxes.map(async (inbox) => {
+		const message = {
+			type: "outbox",
+			id: crypto.randomUUID(),
+			baseUrl,
+			keys: [],
+			activity,
+			activityId: activityId.href,
+			activityType,
+			inbox: inbox.href,
+			sharedInbox: false,
+			started,
+			attempt: 0,
+			headers: {},
+			traceContext
+		};
+		try {
+			await outboxQueue.enqueue(message);
+		} catch (error) {
+			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+				activityId: activityId.href,
+				inbox: inbox.href,
+				error
+			});
+			return;
+		}
+		require_http.recordOutboxEnqueue(meterProvider, outboxQueue, message);
+	}));
+}
+//#endregion
 //#region src/federation/outgoing-proof.ts
 function isPortableUrl(url) {
 	return url.protocol === "ap:" || url.protocol === "ap+ef61:";
@@ -4928,39 +5245,50 @@ function formatKeyIds(candidates) {
 	return candidates.map((c) => c.verificationMethod.href).join(", ");
 }
 /**
+* Rejects an activity of a portable actor whose ID cannot be authenticated by
+* the actor's DID: FEP-ef61 requires the activity to be a portable object
+* signed by that DID, so its ID has to be a portable ID with the same DID.
+* @throws {TypeError} If the activity is performed by a portable actor, but
+*                     its ID is not a portable ID of the actor's DID, or its
+*                     portable actors do not share a DID.
+* @internal
+*/
+function assertPortableActorActivity(activity) {
+	const portableActors = activity.actorIds.filter(isPortableUrl);
+	if (portableActors.length < 1) return;
+	const did = (0, _fedify_vocab_runtime.getFe34Origin)(portableActors[0]);
+	if (portableActors.some((actorId) => (0, _fedify_vocab_runtime.getFe34Origin)(actorId) !== did)) throw new TypeError(`The activity ${activity.id?.href} has portable actors with different DIDs (${portableActors.map((a) => a.href).join(", ")}); a portable activity is signed by a single DID.`);
+	if (activity.id == null || !isPortableUrl(activity.id) || (0, _fedify_vocab_runtime.getFe34Origin)(activity.id) !== did) throw new TypeError(`The activity ${activity.id?.href} is performed by the portable actor ${portableActors[0].href}, so its ID has to be an ap: or ap+ef61: URI with the same DID (${did}), as FEP-ef61 requires it to carry an Object Integrity Proof made by that DID.`);
+}
+/**
 * Creates the Object Integrity Proofs Fedify attaches to an outgoing activity.
 *
+* Keys whose IDs are FEP-ef61 compatible identifiers are gateway keys, which
+* never sign proofs.  A portable activity, i.e., one with an `ap:` or
+* `ap+ef61:` ID, that carries no proof is signed only by the one Ed25519 key
+* whose verification method is a DID URL for its DID, even if it is the only
+* key; if no key or more than one key qualifies, this function throws.
+*
 * Outside the map-local compound-proof profile, i.e., when the activity
 * embeds no portable object, every Ed25519 key signs the activity, as it
 * always has.  Inside the profile, which accepts exactly one direct proof per
 * map, Fedify creates at most one proof:
 *
 *  -  An activity that already carries a proof is kept as is.
-*  -  A single Ed25519 key signs the activity.
-*  -  With several Ed25519 keys, a portable activity is signed by the one key
-*     whose verification method is a DID URL for the activity's DID, the only
-*     proof the FEP-ef61 policy can accept.  If no key or more than one key
-*     qualifies, or the activity is not portable itself, the choice is
-*     ambiguous and this function throws.
+*  -  A single Ed25519 key signs a non-portable activity.
+*  -  With several Ed25519 keys, a non-portable activity is ambiguous, and
+*     this function throws.
 *
-* @throws {TypeError} If a single proof key cannot be chosen.
+* @throws {TypeError} If a single proof key cannot be chosen, or the activity
+*                     is performed by a portable actor but is not a portable
+*                     activity of the same DID.
 * @internal
 */
 async function signOutgoingActivity(activity, candidates, options) {
 	const { contextLoader, tracerProvider } = options;
-	let hasProof = false;
-	for await (const _ of activity.getProofs({ contextLoader })) {
-		hasProof = true;
-		break;
-	}
-	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519");
-	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
-		activity,
-		hasProof,
-		proofCreated: false
-	};
+	assertPortableActorActivity(activity);
 	const sign = async (selected) => {
-		for (const { verificationMethod, privateKey } of selected) activity = await require_owner.signObject(activity, privateKey, verificationMethod, {
+		for (const { verificationMethod, privateKey } of selected) activity = await require_http.signObject(activity, privateKey, verificationMethod, {
 			contextLoader,
 			tracerProvider
 		});
@@ -4970,6 +5298,18 @@ async function signOutgoingActivity(activity, candidates, options) {
 			proofCreated: true
 		};
 	};
+	let hasProof = false;
+	for await (const _ of activity.getProofs({ contextLoader })) {
+		hasProof = true;
+		break;
+	}
+	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !require_http.isCompatibleKeyId(c.verificationMethod));
+	if (!hasProof && activity.id != null && isPortableUrl(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
+	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
+		activity,
+		hasProof,
+		proofCreated: false
+	};
 	if (keys.length < 2 && !hasProof) return await sign(keys);
 	if (!containsCompoundPortableObject(await activity.toJsonLd({
 		format: "compact",
@@ -4989,15 +5329,26 @@ async function signOutgoingActivity(activity, candidates, options) {
 			proofCreated: false
 		};
 	}
-	if (activity.id == null || !isPortableUrl(activity.id)) throw new TypeError(`Cannot choose an Object Integrity Proof key for the activity ${activityId}: it embeds portable objects, so it falls under the map-local compound-proof profile, which accepts exactly one direct proof per map, but ${keys.length} Ed25519 keys were supplied (${formatKeyIds(keys)}).  Send it with explicit sender keys that contain exactly one Ed25519 key (RSA keys for HTTP Signatures may stay), or sign it with signObject() before sending it.`);
-	const activityDid = (0, _fedify_vocab_runtime.getFe34Origin)(activity.id);
-	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && (0, _fedify_vocab_runtime.haveSameFe34Origin)(activity.id, c.verificationMethod));
-	if (eligible.length !== 1) throw new TypeError(`Cannot choose an Object Integrity Proof key for the portable activity ${activityId}: ` + (eligible.length < 1 ? `none of its ${keys.length} Ed25519 keys (${formatKeyIds(keys)}) ` : `${eligible.length} of its Ed25519 keys (${formatKeyIds(eligible)}) `) + `${eligible.length < 1 ? "is" : "are"} a DID URL verification method for ${activityDid}.  The map-local compound-proof profile accepts exactly one direct proof per map, and FEP-ef61 requires that proof's verification method to be a DID URL for the activity's DID.  Supply exactly one Ed25519 key whose key ID is a DID URL for ${activityDid}, or sign the activity with signObject() before sending it.`);
-	logger.debug("The portable activity {activityId} is signed only by {keyId}, the one Ed25519 key whose verification method matches its DID; the map-local compound-proof profile accepts exactly one direct proof per map.", {
-		activityId,
+	throw new TypeError(`Cannot choose an Object Integrity Proof key for the activity ${activityId}: it embeds portable objects, so it falls under the map-local compound-proof profile, which accepts exactly one direct proof per map, but ${keys.length} Ed25519 keys were supplied (${formatKeyIds(keys)}).  Send it with explicit sender keys that contain exactly one Ed25519 key (RSA keys for HTTP Signatures may stay), or sign it with signObject() before sending it.`);
+}
+/**
+* Chooses the one Ed25519 key that can sign a portable activity: the key
+* whose verification method is a DID URL for the activity's DID.
+* @throws {TypeError} If no key or more than one key qualifies.
+*/
+function selectPortableActivityKey(activity, activityId, keys) {
+	const activityDid = (0, _fedify_vocab_runtime.getFe34Origin)(activityId);
+	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && (0, _fedify_vocab_runtime.haveSameFe34Origin)(activityId, c.verificationMethod));
+	if (eligible.length !== 1) throw new TypeError(`Cannot choose an Object Integrity Proof key for the portable activity ${activityId.href}: ` + (eligible.length < 1 ? `none of its ${keys.length} Ed25519 keys (${formatKeyIds(keys)}) ` : `${eligible.length} of its Ed25519 keys (${formatKeyIds(eligible)}) `) + `${eligible.length < 1 ? "is" : "are"} a DID URL verification method for ${activityDid}.  FEP-ef61 requires a portable activity's proof to be made by its DID, and the map-local compound-proof profile accepts exactly one direct proof per map.  Gateway keys, whose IDs are compatible identifiers, never sign proofs.  Supply exactly one Ed25519 key whose key ID is a DID URL for ${activityDid}, or sign the activity with signObject() before sending it.`);
+	(0, _logtape_logtape.getLogger)([
+		"fedify",
+		"federation",
+		"outbox"
+	]).debug("The portable activity {activityId} is signed only by {keyId}, the one Ed25519 key whose verification method matches its DID.", {
+		activityId: activity.id?.href,
 		keyId: eligible[0].verificationMethod.href
 	});
-	return await sign(eligible);
+	return eligible;
 }
 /**
 * Rejects an outgoing activity whose proofs Fedify's own inbox would reject
@@ -5758,10 +6109,10 @@ function isPermanentRemoteContextError(error) {
 	if (!(error instanceof Error) || error.name !== "jsonld.InvalidUrl") return false;
 	const details = error.details;
 	if (details?.code === "invalid remote context") return true;
-	return isRemoteContextLoadingFailure(error) && typeof details?.url === "string" && !URL.canParse(details.url) && require_owner.isClearlyMalformedContextReference(details.url);
+	return isRemoteContextLoadingFailure(error) && typeof details?.url === "string" && !URL.canParse(details.url) && require_http.isClearlyMalformedContextReference(details.url);
 }
 function isPermanentInboxParseError(error) {
-	return error instanceof Error && (error.name === "UnsafeJsonLdError" || error instanceof require_owner.InvalidContextReferenceError || isPermanentRemoteContextError(error) || error.name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure(error)) || error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || require_owner.isInvalidUrlTypeError(error));
+	return error instanceof Error && (error.name === "UnsafeJsonLdError" || error instanceof require_http.InvalidContextReferenceError || isPermanentRemoteContextError(error) || error.name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure(error)) || error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || require_http.isInvalidUrlTypeError(error));
 }
 function hasLinkedDataSignatureJsonLdProcessingError(error) {
 	if (error.message.startsWith("Maximum deep iterations exceeded")) return true;
@@ -5788,6 +6139,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 	kvPrefixes;
 	publicKeyTtl;
 	httpMessageSignaturesSpecTtl;
+	portableInboxForwarding;
 	inboxQueue;
 	outboxQueue;
 	fanoutQueue;
@@ -5820,6 +6172,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 	benchmarkMetricReader;
 	benchmarkTriggerOptions;
 	#mediaUploaderNoAuthWarned = false;
+	#portableInboxForwardingWarned = false;
 	#queueDepthGaugeSourceId = `fedify-${(++nextQueueDepthGaugeSourceId).toString(36)}`;
 	#queueDepthGaugeEntries = [];
 	#queueDepthGaugeMeterProvider;
@@ -5851,10 +6204,12 @@ var FederationImpl = class extends FederationBuilderImpl {
 			acceptSignatureNonce: ["_fedify", "acceptSignatureNonce"],
 			circuitBreaker: ["_fedify", "circuit"],
 			taskDeduplication: ["_fedify", "taskDeduplication"],
+			portableInboxForwarding: ["_fedify", "portableInboxForwarding"],
 			...options.kvPrefixes ?? {}
 		};
 		this.publicKeyTtl = Temporal$2.Duration.from(options.publicKeyTtl ?? { days: 30 });
 		this.httpMessageSignaturesSpecTtl = Temporal$2.Duration.from(options.httpMessageSignaturesSpecTtl ?? { days: 90 });
+		this.portableInboxForwarding = resolvePortableInboxForwardingOptions(options.portableInboxForwarding);
 		if (options.queue == null) {
 			this.inboxQueue = void 0;
 			this.outboxQueue = void 0;
@@ -6524,8 +6879,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 		]);
 		const baseUrl = new URL(message.baseUrl);
 		let context = this.#createContext(baseUrl, ctxData);
-		if (message.identifier != null) context = this.#createContext(baseUrl, ctxData, { documentLoader: await context.getDocumentLoader({ identifier: message.identifier }) });
-		else if (this.sharedInboxKeyDispatcher != null) {
+		if (message.identifier != null && this.actorCallbacks?.keyPairsDispatcher != null) context = this.#createContext(baseUrl, ctxData, { documentLoader: await context.getDocumentLoader({ identifier: message.identifier }) });
+		else if (message.identifier == null && this.sharedInboxKeyDispatcher != null) {
 			const identity = await this.sharedInboxKeyDispatcher(context);
 			if (identity != null) context = this.#createContext(baseUrl, ctxData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
 		}
@@ -6614,22 +6969,22 @@ var FederationImpl = class extends FederationBuilderImpl {
 			let parseInput = void 0;
 			let parseContextLoader = context.contextLoader;
 			try {
-				const hasSignatureField = require_owner.hasSignature(message.activity);
+				const hasSignatureField = require_http.hasSignature(message.activity);
 				const shouldParseFromNormalizedSignedPayload = message.ldSignatureVerified === true || message.normalizedActivity != null || message.ldSignatureVerified == null && hasSignatureField;
 				const parseContext = hasSignatureField ? {
 					...context,
-					contextLoader: require_owner.getNormalizationContextLoader(context.contextLoader)
+					contextLoader: require_http.getNormalizationContextLoader(context.contextLoader)
 				} : {
 					...context,
-					contextLoader: require_owner.wrapContextLoaderForJsonLd(context.contextLoader)
+					contextLoader: require_http.wrapContextLoaderForJsonLd(context.contextLoader)
 				};
 				parseContextLoader = parseContext.contextLoader;
 				let normalizedActivity;
 				if (shouldParseFromNormalizedSignedPayload) {
-					normalizedActivity = message.normalizedActivity ?? await require_owner.compactJsonLd(message.activity, context.contextLoader);
-					require_owner.assertSafeJsonLd(normalizedActivity);
+					normalizedActivity = message.normalizedActivity ?? await require_http.compactJsonLd(message.activity, context.contextLoader);
+					require_http.assertSafeJsonLd(normalizedActivity);
 				}
-				parseInput = shouldParseFromNormalizedSignedPayload ? require_owner.detachSignature(normalizedActivity) : hasSignatureField ? require_owner.detachSignature(message.activity) : message.activity;
+				parseInput = shouldParseFromNormalizedSignedPayload ? require_http.detachSignature(normalizedActivity) : hasSignatureField ? require_http.detachSignature(message.activity) : message.activity;
 				activity = await _fedify_vocab.Activity.fromJsonLd(parseInput, parseContext);
 				activityType = (0, _fedify_vocab.getTypeId)(activity).href;
 				span.setAttribute("activitypub.activity.type", activityType);
@@ -6884,9 +7239,10 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const contextLoader = this.contextLoaderFactory(this.#getLoaderOptions(ctx.origin));
 		const activityId = activity.id.href;
 		let rsaKey = null;
+		const ldSignable = !require_http.hasPortableActor(activity);
 		for (const { keyId, privateKey } of keys) {
 			require_http.validateCryptoKey(privateKey, "private");
-			if (rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") rsaKey = {
+			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !require_http.isCompatibleKeyId(keyId)) rsaKey = {
 				keyId,
 				privateKey
 			};
@@ -6905,9 +7261,10 @@ var FederationImpl = class extends FederationBuilderImpl {
 			format: "compact",
 			contextLoader
 		});
-		if (proofCreated || !hasProof || options.normalizeExistingProofs) jsonLd = await require_owner.normalizeOutgoingActivityJsonLd(jsonLd, contextLoader, { preserveNestedSecuredDocuments: true });
+		if (proofCreated || !hasProof || options.normalizeExistingProofs) jsonLd = await require_http.normalizeOutgoingActivityJsonLd(jsonLd, contextLoader, { preserveNestedSecuredDocuments: true });
 		assertSupportedCompoundProofShape(jsonLd, activityId);
-		if (rsaKey == null) logger.warn("No supported key found to create a Linked Data signature for the activity {activityId}.  The activity will be sent without a Linked Data signature.  In order to create a Linked Data signature, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
+		if (rsaKey == null && !ldSignable) logger.debug("The activity {activityId} is performed by a portable actor, so it is sent without a Linked Data signature.", { activityId });
+		else if (rsaKey == null) logger.warn("No supported key found to create a Linked Data signature for the activity {activityId}.  The activity will be sent without a Linked Data signature.  In order to create a Linked Data signature, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
 			activityId,
 			keys: keys.map((pair) => ({
 				keyId: pair.keyId.href,
@@ -6915,7 +7272,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}))
 		});
 		else try {
-			jsonLd = await require_owner.signJsonLd(jsonLd, rsaKey.privateKey, rsaKey.keyId, {
+			jsonLd = await require_http.signJsonLd(jsonLd, rsaKey.privateKey, rsaKey.keyId, {
 				contextLoader,
 				tracerProvider: this.tracerProvider
 			});
@@ -7116,6 +7473,15 @@ var FederationImpl = class extends FederationBuilderImpl {
 				span,
 				metricState
 			});
+			if (request.method === "POST") {
+				const portable = parsePortableGatewayRequest(url);
+				if (portable != null) return await this.#fetchPortableInbox(request, portable, {
+					onNotFound,
+					contextData,
+					span,
+					metricState
+				});
+			}
 			const portable = request.method === "GET" || request.method === "HEAD" ? parsePortableGatewayRequest(url) : null;
 			if (portable != null) return await discardBodyForHead(request, await this.#fetchPortableObject(request, portable, {
 				onNotFound,
@@ -7267,35 +7633,17 @@ var FederationImpl = class extends FederationBuilderImpl {
 					onNotFound
 				});
 				context = this.#createContext(request, contextData, { documentLoader: await context.getDocumentLoader({ identifier: route.values.identifier }) });
-			case "sharedInbox": {
+			case "sharedInbox":
 				if (routeName !== "inbox" && this.sharedInboxKeyDispatcher != null) {
 					const identity = await this.sharedInboxKeyDispatcher(context);
 					if (identity != null) context = this.#createContext(request, contextData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
 				}
-				if (!this.manuallyStartQueue) this._startQueueInternal(contextData);
-				const inboxContextFactory = context.toInboxContext.bind(context);
-				inboxContextFactory[rawInboxContextFactorySymbol] = context.toInboxContext.bind(context);
-				return await handleInbox(request, {
+				return await this.#handleInbox(request, {
 					recipient: route.values.identifier ?? null,
 					context,
-					inboxContextFactory,
-					kv: this.kv,
-					kvPrefixes: this.kvPrefixes,
-					publicKeyTtl: this.publicKeyTtl,
-					queue: this.inboxQueue,
-					actorDispatcher: this.actorCallbacks?.dispatcher,
-					inboxListeners: this.inboxListeners,
-					inboxErrorHandler: this.inboxErrorHandler,
-					unverifiedActivityHandler: this.unverifiedActivityHandler,
-					onNotFound,
-					signatureTimeWindow: this.signatureTimeWindow,
-					skipSignatureVerification: this.skipSignatureVerification,
-					inboxChallengePolicy: this.inboxChallengePolicy,
-					meterProvider: this.meterProvider,
-					tracerProvider: this.tracerProvider,
-					idempotencyStrategy: this.idempotencyStrategy
+					contextData,
+					onNotFound
 				});
-			}
 			case "following": return await handleCollection(request, {
 				name: "following",
 				identifier: route.values.identifier,
@@ -7448,6 +7796,113 @@ var FederationImpl = class extends FederationBuilderImpl {
 			onNotFound
 		});
 	}
+	async #handleInbox(request, { recipient, context, contextData, onNotFound, portableInbox }) {
+		if (!this.manuallyStartQueue) this._startQueueInternal(contextData);
+		const inboxContextFactory = context.toInboxContext.bind(context);
+		inboxContextFactory[rawInboxContextFactorySymbol] = context.toInboxContext.bind(context);
+		return await handleInbox(request, {
+			recipient,
+			context,
+			inboxContextFactory,
+			kv: this.kv,
+			kvPrefixes: this.kvPrefixes,
+			publicKeyTtl: this.publicKeyTtl,
+			queue: this.inboxQueue,
+			actorDispatcher: this.actorCallbacks?.dispatcher,
+			inboxListeners: this.inboxListeners,
+			inboxErrorHandler: this.inboxErrorHandler,
+			unverifiedActivityHandler: this.unverifiedActivityHandler,
+			onNotFound,
+			signatureTimeWindow: this.signatureTimeWindow,
+			skipSignatureVerification: this.skipSignatureVerification,
+			inboxChallengePolicy: this.inboxChallengePolicy,
+			meterProvider: this.meterProvider,
+			tracerProvider: this.tracerProvider,
+			idempotencyStrategy: this.idempotencyStrategy,
+			portableInbox
+		});
+	}
+	async #fetchPortableInbox(request, portable, { onNotFound, contextData, span, metricState }) {
+		const logger = (0, _logtape_logtape.getLogger)([
+			"fedify",
+			"federation",
+			"inbox"
+		]);
+		if (portable.type === "malformed") {
+			metricState.endpoint = "not_found";
+			logger.debug("Malformed FEP-ef61 gateway inbox request {url}: {error}", {
+				url: request.url,
+				error: portable.error
+			});
+			return new Response("Malformed portable inbox ID.", {
+				status: 400,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+		const route = this.router.route(portable.path);
+		if (route == null || route.name !== "inbox") {
+			metricState.endpoint = "not_found";
+			return await onNotFound(request);
+		}
+		metricState.routeTemplate = PORTABLE_GATEWAY_ROUTE_PREFIX + route.template;
+		metricState.endpoint = "inbox";
+		span.updateName(`${request.method} ${metricState.routeTemplate}`);
+		const identifier = route.values.identifier;
+		let context = this.#createContext(request, contextData);
+		const actor = this.actorCallbacks?.dispatcher == null ? null : await this.actorCallbacks.dispatcher(context, identifier);
+		const localOrigin = context.canonicalOrigin;
+		const resolution = resolvePortableInboxRecipient(actor == null || actor instanceof _fedify_vocab.Tombstone ? null : actor, {
+			authority: portable.portableRequest.authority,
+			canonicalInboxId: portable.canonicalId,
+			localOrigin
+		});
+		if (resolution.status === "rejected") {
+			logger.debug("Not accepting a delivery to the portable inbox {inbox} on behalf of the actor {identifier}: {reason}.", {
+				inbox: portable.canonicalId,
+				identifier,
+				reason: resolution.reason
+			});
+			return await onNotFound(request);
+		}
+		const { recipient } = resolution;
+		if (this.actorCallbacks?.keyPairsDispatcher != null) context = this.#createContext(request, contextData, { documentLoader: await context.getDocumentLoader({ identifier }) });
+		const excludedOrigins = [localOrigin, new URL(request.url).origin];
+		return await this.#handleInbox(request, {
+			recipient: identifier,
+			context,
+			contextData,
+			onNotFound,
+			portableInbox: {
+				recipient,
+				forward: async (activity, activityId, activityType) => {
+					if (this.portableInboxForwarding.maxTargets < 1) return;
+					if (this.kv.cas == null) {
+						if (!this.#portableInboxForwardingWarned) {
+							this.#portableInboxForwardingWarned = true;
+							logger.warn("Activities delivered to FEP-ef61 portable inboxes are not forwarded to the other gateways, as the key–value store does not support compare-and-swap (KvStore.cas()), which is needed to forward each activity at most once.");
+						}
+						return;
+					}
+					await forwardPortableInboxActivity({
+						recipient,
+						activity,
+						activityId,
+						activityType,
+						excludedOrigins,
+						baseUrl: context.origin,
+						kv: this.kv,
+						kvPrefix: this.kvPrefixes.portableInboxForwarding,
+						outboxQueue: this.outboxQueue,
+						startQueue: this.manuallyStartQueue ? void 0 : () => this._startQueueInternal(contextData),
+						allowPrivateAddress: this.allowPrivateAddress,
+						options: this.portableInboxForwarding,
+						meterProvider: this.meterProvider,
+						tracerProvider: this.tracerProvider
+					});
+				}
+			}
+		});
+	}
 	async #fetchHashlinkMedia(request, media, { onNotFound, contextData, span, metricState }) {
 		metricState.endpoint = "hashlink_media";
 		metricState.routeTemplate = HASHLINK_MEDIA_ROUTE_TEMPLATE;
@@ -7678,6 +8133,12 @@ var ContextImpl = class ContextImpl {
 		if (path == null) throw new _fedify_uri_template.RouterError("No inbox path registered.");
 		return new URL(path, this.canonicalOrigin);
 	}
+	getPortableInboxUri(identifier, authority) {
+		const path = this.federation.router.build("inbox", { identifier });
+		if (path == null) throw new _fedify_uri_template.RouterError("No inbox path registered.");
+		if (authority == null) throw new TypeError("The authority of a portable ID is required outside an FEP-ef61 gateway request.");
+		return buildPortableUri(authority, path);
+	}
 	getFollowingUri(identifier) {
 		const path = this.federation.router.build("following", { identifier });
 		if (path == null) throw new _fedify_uri_template.RouterError("No following collection path registered.");
@@ -7783,14 +8244,15 @@ var ContextImpl = class ContextImpl {
 			getActorKeyPairsIdentifier: identifier,
 			actorKeyPairsDispatcherIdentifier: this.invokedFromActorKeyPairsDispatcher.identifier
 		});
+		const portableActor = await this.getPortableActorKeyOwner(identifier);
 		let keyPairs;
 		try {
-			keyPairs = await this.getKeyPairsFromIdentifier(identifier);
+			keyPairs = await this.getKeyPairsFromIdentifier(identifier, portableActor);
 		} catch (_) {
 			logger.warn("No actor key pairs dispatcher registered.");
 			return [];
 		}
-		const owner = this.getActorUri(identifier);
+		const owner = portableActor?.id ?? this.getActorUri(identifier);
 		const result = [];
 		let i = 1;
 		for (const keyPair of keyPairs) {
@@ -7802,7 +8264,7 @@ var ContextImpl = class ContextImpl {
 					publicKey: keyPair.publicKey
 				}),
 				multikey: new _fedify_vocab.Multikey({
-					id: new URL(`#multikey-${i}`, owner),
+					id: portableActor == null ? new URL(`#multikey-${i}`, owner) : keyPair.keyId,
 					controller: owner,
 					publicKey: keyPair.publicKey
 				})
@@ -7812,7 +8274,26 @@ var ContextImpl = class ContextImpl {
 		}
 		return result;
 	}
-	async getKeyPairsFromIdentifier(identifier) {
+	/**
+	* Resolves the portable actor that the actor with the given identifier is,
+	* through the portable actor ID mapper, along with the base of its gateway
+	* key IDs on this server.
+	* @param identifier The actor's identifier.
+	* @returns The portable actor's ID and key ID base, or `null` if the actor
+	*          is not portable.
+	* @throws {TypeError} If the mapper returns an invalid portable actor ID.
+	*/
+	async getPortableActorKeyOwner(identifier) {
+		const mapper = this.federation.actorCallbacks?.portableActorIdMapper;
+		if (mapper == null) return null;
+		const id = await mapper(this, identifier);
+		if (id == null) return null;
+		return {
+			id,
+			keyBase: require_http.getGatewayKeyBase(id, this.canonicalOrigin)
+		};
+	}
+	async getKeyPairsFromIdentifier(identifier, portableActor) {
 		const logger = (0, _logtape_logtape.getLogger)([
 			"fedify",
 			"federation",
@@ -7829,6 +8310,8 @@ var ContextImpl = class ContextImpl {
 			}
 			throw error;
 		}
+		if (portableActor === void 0) portableActor = await this.getPortableActorKeyOwner(identifier);
+		const keyBase = portableActor?.keyBase ?? actorUri;
 		const keyPairs = await this.federation.actorCallbacks?.keyPairsDispatcher(new ContextImpl({
 			...this,
 			invokedFromActorKeyPairsDispatcher: { identifier }
@@ -7839,7 +8322,7 @@ var ContextImpl = class ContextImpl {
 		for (const keyPair of keyPairs) {
 			result.push({
 				...keyPair,
-				keyId: new URL(i == 0 ? `#main-key` : `#key-${i + 1}`, actorUri)
+				keyId: new URL(i == 0 ? `#main-key` : `#key-${i + 1}`, keyBase)
 			});
 			i++;
 		}
@@ -7885,7 +8368,7 @@ var ContextImpl = class ContextImpl {
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			meterProvider: options.meterProvider ?? this.meterProvider,
-			verifyPortableObject: options.verifyPortableObject ?? require_owner.verifyPortableObjectProof,
+			verifyPortableObject: options.verifyPortableObject ?? require_http.verifyPortableObjectProof,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}
@@ -8148,7 +8631,7 @@ var ContextImpl = class ContextImpl {
 			tracerProvider: this.tracerProvider,
 			keyTtl: this.federation.publicKeyTtl
 		});
-		if (await require_owner.verifyObject(_fedify_vocab.Activity, json, {
+		if (await require_http.verifyObject(_fedify_vocab.Activity, json, {
 			contextLoader,
 			documentLoader: options.documentLoader ?? this.documentLoader,
 			meterProvider: this.meterProvider,
@@ -8258,6 +8741,9 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 	getPortableObjectUri(cls, values, authority) {
 		return super.getPortableObjectUri(cls, values, authority ?? this.portableRequest?.authority);
 	}
+	getPortableInboxUri(identifier, authority) {
+		return super.getPortableInboxUri(identifier, authority ?? this.portableRequest?.authority);
+	}
 	async getActor(identifier, options) {
 		if (this.federation.actorCallbacks == null || this.federation.actorCallbacks.dispatcher == null) throw new Error("No actor dispatcher registered.");
 		if (this.#invokedFromActorDispatcher != null) (0, _logtape_logtape.getLogger)([
@@ -8381,8 +8867,8 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 		if (forwarder.length < 1) throw new Error("The forwarder's key pairs are empty.");
 		keys = forwarder;
 	} else keys = [forwarder];
-	if (!require_owner.hasSignatureLike(ctx.activity)) {
-		if (!require_owner.hasProofLike(ctx.activity)) {
+	if (!require_http.hasSignatureLike(ctx.activity)) {
+		if (!require_http.hasProofLike(ctx.activity)) {
 			if (options?.skipIfUnsigned) return false;
 			logger.warn("The activity {activityId} is not signed; even if it is forwarded to other servers as is, it may not be accepted by them due to the lack of a signature/proof.", {
 				activityId: ctx.activityId,