@fedify/fedify 2.4.0-dev.2149 → 2.4.0-dev.2157

package/dist/{middleware-CBGR92fz.mjs → middleware-xdukzV3x.mjs}

@@ -1,34 +1,34 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-yXpYZm4K.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DMqdDud_.mjs";
+import { n as version, t as name } from "./deno-D1gcWWqB.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-B41pRPfd.mjs";
 import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
 import { a as hasPortableActor, c as isPortableId, l as isPortableKeyId, n as getGatewayKeyBase, o as isCompatibleKeyId, r as getPortableDid, t as getCanonicalPortableId, u as isPortableUri } from "./portable-key-id-Bg259c4Z.mjs";
-import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-BtO7WCfP.mjs";
+import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-CPM4r6tP.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-YYBfDbe_.mjs";
-import { i as signObject, l as verifyPortableObjectProofWithRoot, o as verifyObject, r as hasProofLike, s as verifyPortableObjectProof, t as InvalidPortableObjectIdError } from "./proof-DWkXfZIU.mjs";
-import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-BoH-e8sR.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-C4h6PL7m.mjs";
-import { n as kvCache } from "./kv-cache-CMuTXrkC.mjs";
-import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-DpnpgjyX.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-lU_ZqzsQ.mjs";
+import { a as signObject, c as verifyPortableObjectProof, i as hasProofLike, s as verifyObject, t as InvalidPortableObjectIdError, u as verifyPortableObjectProofWithRoot } from "./proof-C2YwD8a_.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as verifyRequest, f as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-CGcLv8rh.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-BMqr3hji.mjs";
+import { n as kvCache } from "./kv-cache-bdPqTR1k.mjs";
+import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-CEnNz8O7.mjs";
 import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-Cn6CFYBy.mjs";
-import { t as verifyPortableObject } from "./portable-collection-B3swTTja.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-BQDT_8bc.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-W2fIPRjv.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-D63yPo_i.mjs";
+import { t as verifyPortableObject } from "./portable-collection-_lZg-osX.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-D9SGhxTB.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-CLaS4-yA.mjs";
 import { t as CircuitBreaker } from "./circuit-breaker-C5NqoLBJ.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
-import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "./compound-proof-B1QH25S6.mjs";
+import { a as verifyCompoundPortableObjectProofs, i as inspectCompoundPortableObjectApplicability, r as findUnsupportedCompoundProofShape, s as verifyServedPortableObjects, t as containsCompoundPortableObject } from "./compound-proof-D7K94KPz.mjs";
 import { t as KvKeyCache } from "./keycache-BInaECGj.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-CFI__wjQ.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-q6FSekcN.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
 import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
 import { RouterError } from "@fedify/uri-template";
-import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
+import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, isActor, lookupObject, traverseCollection } from "@fedify/vocab";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 import { uniq } from "es-toolkit";
@@ -1275,6 +1275,46 @@ function portableObjectInternalServerError(request) {
 		headers: { "Content-Type": "text/plain; charset=utf-8" }
 	});
 }
+/**
+* Checks the portable objects embedded in a portable collection or its page
+* that is about to be served against the FEP-ef61 proof policy.  See
+* `verifyServedPortableObjects()`.
+* @returns `true` if the collection can be served.
+*/
+async function verifyPortableCollection(jsonLd, context, portable) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"collection"
+	]);
+	try {
+		const result = await verifyServedPortableObjects(jsonLd, {
+			contextLoader: context.contextLoader,
+			documentLoader: context.documentLoader,
+			tracerProvider: context.tracerProvider,
+			meterProvider: context.meterProvider
+		});
+		if (result.verified) return true;
+		logger.error("Refusing to serve the portable collection {collectionId}, as the portable object {objectId} it embeds at {path} does not satisfy the FEP-ef61 proof policy: {reason}.  Embedded portable actors, activities, and objects need an Object Integrity Proof made with a key of the DID in their ID, and their own @context.", {
+			collectionId: portable.id.href,
+			objectId: result.id,
+			path: result.path,
+			reason: result.reason
+		});
+	} catch (error) {
+		logger.error("Failed to verify the portable objects embedded in the portable collection {collectionId}:\n{error}", {
+			collectionId: portable.id.href,
+			error
+		});
+	}
+	return false;
+}
+function respondWithPortableCollection(request, jsonLd) {
+	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), { headers: {
+		"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
+		Vary: "Accept"
+	} });
+}
 const BUILT_IN_COLLECTION_METRIC_KINDS = /* @__PURE__ */ new Set([
 	"inbox",
 	"outbox",
@@ -1312,13 +1352,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$2.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$1.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$2),
+		kind: getCollectionMetricKind(name$1),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -1336,8 +1376,13 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 	};
 	try {
 		if (collectionCallbacks == null) return finish(await onNotFound(request), "not_found");
+		if (portable != null && collectionCallbacks.authorizePredicate != null) {
+			if (!await collectionCallbacks.authorizePredicate(context, identifier)) return finish(await onUnauthorized(request), "unauthorized");
+		}
 		let collection;
-		const baseUri = uriGetter(identifier);
+		const baseUri = portable?.id ?? uriGetter(identifier);
+		const pageBase = portable?.view ?? context.url;
+		const attribution = portable?.attribution ?? null;
 		if (cursor == null) {
 			const firstCursor = await collectionCallbacks.firstCursor?.(context, identifier);
 			const totalItems = filter == null ? await collectionCallbacks.counter?.(context, identifier) : void 0;
@@ -1359,7 +1404,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$2, filterPredicate);
+						const items = filterCollectionItems(page.items, name$1, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -1377,29 +1422,31 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 				if (itemsOrResponse instanceof Response) return finish(itemsOrResponse, "not_found");
 				collection = new OrderedCollection({
 					id: baseUri,
+					attribution,
 					totalItems: totalItemCount ?? null,
 					items: itemsOrResponse
 				});
 			} else {
 				const lastCursor = await collectionCallbacks.lastCursor?.(context, identifier);
-				const first = new URL(context.url);
+				const first = new URL(pageBase);
 				first.searchParams.set("cursor", firstCursor);
 				let last = null;
 				if (lastCursor != null) {
-					last = new URL(context.url);
+					last = new URL(pageBase);
 					last.searchParams.set("cursor", lastCursor);
 				}
 				collection = new OrderedCollection({
 					id: baseUri,
+					attribution,
 					totalItems: totalItemCount ?? null,
 					first,
 					last
 				});
 			}
 		} else {
-			const uri = new URL(baseUri);
+			const uri = new URL(portable == null ? baseUri : pageBase);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -1415,7 +1462,7 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$2, filterPredicate);
+					const items = filterCollectionItems(page.items, name$1, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -1437,28 +1484,30 @@ async function handleCollection(request, { name: name$2, identifier, uriGetter,
 			const { items, prevCursor, nextCursor } = pageOrResponse;
 			let prev = null;
 			if (prevCursor != null) {
-				prev = new URL(context.url);
+				prev = new URL(pageBase);
 				prev.searchParams.set("cursor", prevCursor);
 			}
 			let next = null;
 			if (nextCursor != null) {
-				next = new URL(context.url);
+				next = new URL(pageBase);
 				next.searchParams.set("cursor", nextCursor);
 			}
-			const partOf = new URL(context.url);
+			const partOf = new URL(pageBase);
 			partOf.searchParams.delete("cursor");
 			collection = new OrderedCollectionPage({
 				id: uri,
+				attribution,
 				prev,
 				next,
 				items,
 				partOf
 			});
 		}
-		if (collectionCallbacks.authorizePredicate != null) {
+		if (portable == null && collectionCallbacks.authorizePredicate != null) {
 			if (!await collectionCallbacks.authorizePredicate(context, identifier)) return finish(await onUnauthorized(request), "unauthorized");
 		}
 		const jsonLd = await collection.toJsonLd(context);
+		if (portable != null) return await verifyPortableCollection(jsonLd, context, portable) ? finish(respondWithPortableCollection(request, jsonLd), "served") : finish(portableObjectInternalServerError(request), "error");
 		return finish(new Response(JSON.stringify(jsonLd), { headers: {
 			"Content-Type": "application/activity+json",
 			Vary: "Accept"
@@ -2506,19 +2555,11 @@ function recordDeferredPendingCollectionMetrics(error, result, response) {
 	pendingCollectionMetricRecorders.delete(error);
 	recorder?.(result, response);
 }
-async function _handleCustomCollection(request, { name, values, context, tracerProvider, meterProvider, collectionCallbacks: callbacks, filterPredicate }) {
+async function _handleCustomCollection(request, { name, values, context, tracerProvider, meterProvider, collectionCallbacks: callbacks, filterPredicate, portable }) {
 	verifyDefined(callbacks);
 	await authIfNeeded(context, values, callbacks);
 	const cursor = new URL(request.url).searchParams.get("cursor");
-	const handler = new CustomCollectionHandler(name, values, context, callbacks, tracerProvider, meterProvider, Collection, CollectionPage, filterPredicate).fetchCollection(cursor);
-	try {
-		const response = await handler.toJsonLd().then(respondAsActivity);
-		handler.recordPendingCollectionMetrics("served", response);
-		return response;
-	} catch (e) {
-		if (!deferPendingCollectionMetrics(e, (result, response) => handler.recordPendingCollectionMetrics(result, response))) handler.recordPendingCollectionMetrics("error");
-		throw e;
-	}
+	return await respondWithCustomCollection(request, new CustomCollectionHandler(name, values, context, callbacks, tracerProvider, meterProvider, Collection, CollectionPage, filterPredicate, portable).fetchCollection(cursor), context, portable);
 }
 /**
 * Handles an ordered collection request.
@@ -2532,13 +2573,19 @@ async function _handleCustomCollection(request, { name, values, context, tracerP
 * @since 1.8.0
 */
 const handleOrderedCollection = exceptWrapper(_handleOrderedCollection);
-async function _handleOrderedCollection(request, { name, values, context, tracerProvider, meterProvider, collectionCallbacks: callbacks, filterPredicate }) {
+async function _handleOrderedCollection(request, { name, values, context, tracerProvider, meterProvider, collectionCallbacks: callbacks, filterPredicate, portable }) {
 	verifyDefined(callbacks);
 	await authIfNeeded(context, values, callbacks);
 	const cursor = new URL(request.url).searchParams.get("cursor");
-	const handler = new CustomCollectionHandler(name, values, context, callbacks, tracerProvider, meterProvider, OrderedCollection, OrderedCollectionPage, filterPredicate).fetchCollection(cursor);
+	return await respondWithCustomCollection(request, new CustomCollectionHandler(name, values, context, callbacks, tracerProvider, meterProvider, OrderedCollection, OrderedCollectionPage, filterPredicate, portable).fetchCollection(cursor), context, portable);
+}
+async function respondWithCustomCollection(request, handler, context, portable) {
 	try {
-		const response = await handler.toJsonLd().then(respondAsActivity);
+		const jsonLd = await handler.toJsonLd();
+		let response;
+		if (portable == null) response = respondAsActivity(jsonLd);
+		else if (await verifyPortableCollection(jsonLd, context, portable)) response = respondWithPortableCollection(request, jsonLd);
+		else throw new PortableCollectionRefusedError();
 		handler.recordPendingCollectionMetrics("served", response);
 		return response;
 	} catch (e) {
@@ -2568,6 +2615,7 @@ var CustomCollectionHandler = class {
 	Collection;
 	CollectionPage;
 	filterPredicate;
+	portable;
 	/**
 	* The tracer for telemetry.
 	* @type {Tracer}
@@ -2604,8 +2652,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$1;
+	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
+		this.name = name$2;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -2614,9 +2662,14 @@ var CustomCollectionHandler = class {
 		this.Collection = Collection;
 		this.CollectionPage = CollectionPage;
 		this.filterPredicate = filterPredicate;
+		this.portable = portable;
 		this.name = this.name.trim().replace(/\s+/g, "_");
 		this.#tracer = this.tracerProvider.getTracer(name, version);
-		this.#id = new URL(this.context.url);
+		if (portable == null) this.#id = new URL(this.context.url);
+		else {
+			const cursor = this.context.url.searchParams.get("cursor");
+			this.#id = cursor == null ? new URL(portable.view) : appendCursorIfExists(portable.view, cursor);
+		}
 		this.#dispatcher = callbacks.dispatcher.bind(callbacks);
 	}
 	/**
@@ -2667,6 +2720,7 @@ var CustomCollectionHandler = class {
 		this.recordPendingCollectionItemCount(true, items.length);
 		return {
 			id,
+			attribution: this.portable?.attribution ?? null,
 			partOf,
 			items,
 			prev: this.appendToUrl(prevCursor),
@@ -2688,6 +2742,7 @@ var CustomCollectionHandler = class {
 		});
 		return {
 			id: this.#id,
+			attribution: this.portable?.attribution ?? null,
 			first: this.appendToUrl(firstCursor),
 			last: this.appendToUrl(lastCursor),
 			totalItems
@@ -2704,6 +2759,7 @@ var CustomCollectionHandler = class {
 		this.recordPendingCollectionItemCount(false, items.length);
 		return {
 			id: this.#id,
+			attribution: this.portable?.attribution ?? null,
 			totalItems,
 			items
 		};
@@ -2821,7 +2877,7 @@ var CustomCollectionHandler = class {
 	* @returns The URL with cursor appended, or null if cursor is null/undefined.
 	*/
 	appendToUrl(cursor) {
-		return appendCursorIfExists(this.context.url, cursor);
+		return appendCursorIfExists(this.portable?.view ?? this.context.url, cursor);
 	}
 	/**
 	* Gets the stored collection or collection page.
@@ -2898,6 +2954,12 @@ function exceptWrapper(handler) {
 					recordCollectionRequest(meterProvider, collectionAttributes(metricBase, "not_found", response));
 					return response;
 				}
+				case PortableCollectionRefusedError: {
+					const response = portableObjectInternalServerError(request);
+					recordDeferredPendingCollectionMetrics(error, "error", response);
+					recordCollectionRequest(meterProvider, collectionAttributes(metricBase, "error", response));
+					return response;
+				}
 				case UnauthorizedError: {
 					const response = await onUnauthorized(request);
 					recordDeferredPendingCollectionMetrics(error, "unauthorized", response);
@@ -2994,6 +3056,16 @@ var UnauthorizedError = class extends HandlerError {
 	}
 };
 /**
+* Error thrown when a portable collection is not served because it embeds
+* portable objects that do not satisfy the FEP-ef61 proof policy.
+* @since 2.4.0
+*/
+var PortableCollectionRefusedError = class extends HandlerError {
+	constructor() {
+		super("The portable collection embeds unverifiable portable objects.");
+	}
+};
+/**
 * Responds with the given object in JSON-LD format.
 *
 * @param object The object to respond with.
@@ -3133,6 +3205,100 @@ async function verifyPortableActivityId(activityId, jsonLd, options) {
 	return null;
 }
 //#endregion
+//#region src/federation/portable-collection.ts
+/**
+* The query parameters of a gateway request for a portable collection that
+* do not select a view of the collection: the page cursor, and FEP-ef61
+* location hints (`@gateway`, and the legacy `gateways`).
+*/
+const NON_VIEW_PARAMETERS = /* @__PURE__ */ new Set([
+	"cursor",
+	"@gateway",
+	"gateways"
+]);
+/**
+* Checks that a collection requested through the FEP-ef61 gateway endpoint
+* belongs to a portable actor under the requested DID, and determines
+* the collection's ID from the actor.
+*
+* Collection dispatchers return items, not documents with IDs, so unlike
+* object dispatchers, there is nothing else to tell whether the requested
+* DID controls the collection.
+*
+* @param actor The actor that owns the collection according to
+*              the application, dispatched without the portable request,
+*              or `null` if there is none.
+* @param options The requested DID, and either the requested collection's
+*                canonical ID and the actor's property that has to refer to
+*                it (for the built-in collections of an actor), or
+*                the requested collection's portable ID (for a custom
+*                collection, whose ID has the same form as the actor's).
+* @returns The resolution.
+*/
+function resolvePortableCollectionOwner(actor, options) {
+	if (!isActor(actor)) return {
+		status: "rejected",
+		reason: "notFound"
+	};
+	const ownerId = actor.id;
+	const did = ownerId == null || !isPortableId(ownerId) ? null : getPortableDid(ownerId);
+	if (ownerId == null || did == null) return {
+		status: "rejected",
+		reason: "notPortable"
+	};
+	if (did !== options.authority) return {
+		status: "rejected",
+		reason: "authorityMismatch"
+	};
+	if ("portableId" in options) return {
+		status: "accepted",
+		ownerId,
+		collectionId: getCustomCollectionId(ownerId, actor, options.portableId)
+	};
+	const property = options.property(actor);
+	if (property == null || getCanonicalPortableId(property) !== options.canonicalId) return {
+		status: "rejected",
+		reason: "collectionMismatch"
+	};
+	const collectionId = new URL(property);
+	collectionId.search = "";
+	collectionId.hash = "";
+	return {
+		status: "accepted",
+		ownerId,
+		collectionId
+	};
+}
+/**
+* Gets the ID of a custom portable collection in the same form as its owner's
+* ID: a portable ID if the owner has one, or otherwise a compatible identifier
+* on the owner's first gateway, as FEP-ef61 requires of publishers.
+*/
+function getCustomCollectionId(ownerId, owner, portableId) {
+	if (isPortableUri(ownerId)) return portableId;
+	const gateway = owner.gateways[0];
+	if (gateway == null || !isGatewayUrl(gateway)) return portableId;
+	try {
+		return toCompatibleEf61Id(portableId, gateway);
+	} catch (error) {
+		if (error instanceof TypeError) return portableId;
+		throw error;
+	}
+}
+/**
+* Builds the URI that the pages of a portable collection are relative to:
+* the collection's ID with the query parameters of the requested view, e.g.,
+* a filter, but without the page cursor and location hints.
+* @param collectionId The ID of the collection.
+* @param requestUrl The URL of the gateway request.
+* @returns The view URI.
+*/
+function buildPortableCollectionView(collectionId, requestUrl) {
+	const view = new URL(collectionId);
+	for (const [name, value] of requestUrl.searchParams) if (!NON_VIEW_PARAMETERS.has(name)) view.searchParams.append(name, value);
+	return view;
+}
+//#endregion
 //#region src/federation/outgoing-proof.ts
 function formatKeyIds(candidates) {
 	return candidates.map((c) => c.verificationMethod.href).join(", ");
@@ -5415,12 +5581,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				onNotFound
 			});
 			case "followers": {
-				let baseUrl = url.searchParams.get("base-url");
-				if (baseUrl != null) try {
-					baseUrl = `${new URL(baseUrl).origin}/`;
-				} catch {
-					baseUrl = null;
-				}
+				const baseUrl = getFollowersBaseUrl(url);
 				return await handleCollection(request, {
 					name: "followers",
 					identifier: route.values.identifier,
@@ -5431,7 +5592,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					},
 					context,
 					filter: baseUrl != null ? new URL(baseUrl) : void 0,
-					filterPredicate: baseUrl != null ? ((i) => (i instanceof URL ? i.href : i.id?.href ?? "").startsWith(baseUrl)) : void 0,
+					filterPredicate: baseUrl != null ? getFollowersFilterPredicate(baseUrl) : void 0,
 					collectionCallbacks: this.followersCallbacks,
 					tracerProvider: this.tracerProvider,
 					meterProvider: this._meterProvider,
@@ -5525,17 +5686,30 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		const route = this.router.route(portable.path);
 		const isActor = route != null && (route.name === "actor" || route.name.startsWith("actorAlias:"));
-		if (route == null || !isActor && !route.name.startsWith("object:")) {
+		const collectionRoute = route == null ? void 0 : getCollectionMetricRoute(route.name.replace(/:.*$/, ""));
+		if (route == null || !isActor && !route.name.startsWith("object:") && collectionRoute == null) {
 			metricState.endpoint = "not_found";
 			return await onNotFound(request);
 		}
 		metricState.routeTemplate = PORTABLE_GATEWAY_ROUTE_PREFIX + route.template;
-		metricState.endpoint = isActor ? "actor" : "object";
+		metricState.endpoint = getEndpointCategory(route.name);
 		span.updateName(`${request.method} ${metricState.routeTemplate}`);
 		if (!acceptsJsonLd(request)) {
 			metricState.endpoint = "not_acceptable";
-			return await onNotAcceptable(request);
+			const response = await onNotAcceptable(request);
+			if (collectionRoute != null) recordCollectionRequest(this._meterProvider, {
+				...collectionRoute,
+				page: new URL(request.url).searchParams.get("cursor") != null,
+				result: "not_acceptable",
+				statusCode: response.status
+			});
+			return response;
 		}
+		if (collectionRoute != null) return await this.#fetchPortableCollection(request, portable, route, {
+			onNotFound,
+			onUnauthorized,
+			contextData
+		});
 		if (isActor) {
 			const identifier = route.name.startsWith("actorAlias:") ? route.name.substring(ACTOR_ALIAS_PREFIX.length) : route.values.identifier;
 			const context = this.#createContext(request, contextData, {
@@ -5574,6 +5748,108 @@ var FederationImpl = class extends FederationBuilderImpl {
 			onNotFound
 		});
 	}
+	async #fetchPortableCollection(request, portable, route, { onNotFound, onUnauthorized, contextData }) {
+		const logger = getLogger([
+			"fedify",
+			"federation",
+			"collection"
+		]);
+		const url = new URL(request.url);
+		const { authority } = portable.portableRequest;
+		const ownerContext = this.#createContext(request, contextData);
+		const context = this.#createContext(request, contextData, { portableRequest: portable.portableRequest });
+		const reject = async (reason, identifier) => {
+			logger.debug("Not serving the portable collection {collection} of the actor {identifier}: {reason}.", {
+				collection: portable.canonicalId,
+				identifier,
+				reason
+			});
+			return await onNotFound(request);
+		};
+		const routeName = route.name.replace(/:.*$/, "");
+		if (routeName === "collection" || routeName === "orderedCollection") {
+			const name = route.name.replace(/^(?:ordered)?[cC]ollection:/, "");
+			const callbacks = this.collectionCallbacks[name];
+			if (callbacks == null) return await onNotFound(request);
+			const mapper = callbacks.portableOwnerMapper;
+			if (mapper == null) return await reject("noPortableOwnerMapper");
+			const identifier = await mapper(ownerContext, route.values);
+			if (identifier == null) return await reject("notPortable");
+			const resolution = resolvePortableCollectionOwner(await this.actorCallbacks?.dispatcher?.(ownerContext, identifier), {
+				authority,
+				portableId: portable.portableRequest.id
+			});
+			if (resolution.status === "rejected") return await reject(resolution.reason, identifier);
+			const view = buildPortableCollectionView(resolution.collectionId, url);
+			return await (routeName === "collection" ? handleCustomCollection : handleOrderedCollection)(request, {
+				name,
+				context,
+				values: route.values,
+				collectionCallbacks: callbacks,
+				portable: {
+					id: view,
+					view,
+					attribution: resolution.ownerId
+				},
+				tracerProvider: this.tracerProvider,
+				meterProvider: this._meterProvider,
+				onUnauthorized,
+				onNotFound
+			});
+		}
+		const identifier = route.values.identifier;
+		const serve = async (name, callbacks, property, filter) => {
+			if (callbacks == null) return await onNotFound(request);
+			const resolution = resolvePortableCollectionOwner(await this.actorCallbacks?.dispatcher?.(ownerContext, identifier), {
+				authority,
+				canonicalId: portable.canonicalId,
+				property
+			});
+			if (resolution.status === "rejected") return await reject(resolution.reason, identifier);
+			const id = new URL(resolution.collectionId);
+			if (filter != null) id.searchParams.set(...filter.parameter);
+			const view = buildPortableCollectionView(resolution.collectionId, url);
+			if (routeName === "followers") {
+				view.searchParams.delete("base-url");
+				if (filter != null) view.searchParams.set(...filter.parameter);
+			}
+			return await handleCollection(request, {
+				name,
+				identifier,
+				uriGetter: () => id,
+				context,
+				filter: filter?.value,
+				filterPredicate: filter?.predicate,
+				collectionCallbacks: callbacks,
+				portable: {
+					id,
+					view,
+					attribution: resolution.ownerId
+				},
+				tracerProvider: this.tracerProvider,
+				meterProvider: this._meterProvider,
+				onUnauthorized,
+				onNotFound
+			});
+		};
+		switch (routeName) {
+			case "outbox": return await serve("outbox", this.outboxCallbacks, (a) => a.outboxId);
+			case "inbox": return await serve("inbox", this.inboxCallbacks, (a) => a.inboxId);
+			case "following": return await serve("following", this.followingCallbacks, (a) => a.followingId);
+			case "followers": {
+				const baseUrl = getFollowersBaseUrl(url);
+				return await serve("followers", this.followersCallbacks, (a) => a.followersId, baseUrl == null ? void 0 : {
+					value: new URL(baseUrl),
+					predicate: getFollowersFilterPredicate(baseUrl),
+					parameter: ["base-url", baseUrl]
+				});
+			}
+			case "liked": return await serve("liked", this.likedCallbacks, (a) => a.likedId);
+			case "featured": return await serve("featured", this.featuredCallbacks, (a) => a.featuredId);
+			case "featuredTags": return await serve("featured tags", this.featuredTagsCallbacks, (a) => a.featuredTagsId);
+		}
+		return await onNotFound(request);
+	}
 	async #handleInbox(request, { recipient, context, contextData, onNotFound, portableInbox }) {
 		if (!this.manuallyStartQueue) this._startQueueInternal(contextData);
 		const inboxContextFactory = context.toInboxContext.bind(context);
@@ -5760,6 +6036,41 @@ var FederationImpl = class extends FederationBuilderImpl {
 };
 const PORTABLE_GATEWAY_ROUTE_PREFIX = "/.well-known/apgateway/{did}";
 /**
+* Gets the origin that a followers collection request filters followers by,
+* i.e., its normalized `base-url` query parameter (FEP-8fcf).
+* @returns The origin with a trailing slash, or `null` if the parameter is
+*          missing or invalid.
+*/
+function getFollowersBaseUrl(url) {
+	const baseUrl = url.searchParams.get("base-url");
+	if (baseUrl == null) return null;
+	try {
+		return `${new URL(baseUrl).origin}/`;
+	} catch {
+		return null;
+	}
+}
+function getFollowersFilterPredicate(baseUrl) {
+	return (i) => (i instanceof URL ? i.href : i.id?.href ?? "").startsWith(baseUrl);
+}
+const ACTOR_COLLECTION_ROUTE_ERRORS = {
+	outbox: "No outbox dispatcher registered.",
+	following: "No following collection path registered.",
+	followers: "No followers collection path registered.",
+	liked: "No liked collection path registered.",
+	featured: "No featured collection path registered.",
+	featuredTags: "No featured tags collection path registered."
+};
+/**
+* Checks that the authority of a portable ID to build is given, either
+* explicitly or by the FEP-ef61 gateway request being handled.
+* @throws {TypeError} If the authority is missing.
+*/
+function requirePortableAuthority(authority) {
+	if (authority == null) throw new TypeError("The authority of a portable ID is required outside an FEP-ef61 gateway request.");
+	return authority;
+}
+/**
 * Removes the body of a response to a `HEAD` request.
 * @param request The request.
 * @param response The response to the request.
@@ -5938,8 +6249,7 @@ var ContextImpl = class ContextImpl {
 	}
 	getPortableActorUri(identifier, authority) {
 		const path = this.#getActorPath(identifier);
-		if (authority == null) throw new TypeError("The authority of a portable ID is required outside an FEP-ef61 gateway request.");
-		return buildPortableUri(authority, path);
+		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
 	#getActorPath(identifier) {
 		const path = this.federation.router.build(`actorAlias:${identifier}`, {}) ?? this.federation.router.build("actor", { identifier });
@@ -5951,8 +6261,7 @@ var ContextImpl = class ContextImpl {
 	}
 	getPortableObjectUri(cls, values, authority) {
 		const path = this.#getObjectPath(cls, values);
-		if (authority == null) throw new TypeError("The authority of a portable ID is required outside an FEP-ef61 gateway request.");
-		return buildPortableUri(authority, path);
+		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
 	#getObjectPath(cls, values) {
 		const callbacks = this.federation.objectCallbacks[cls.typeId.href];
@@ -5962,10 +6271,17 @@ var ContextImpl = class ContextImpl {
 		if (path == null) throw new RouterError("No object dispatcher registered.");
 		return path;
 	}
+	#getActorCollectionPath(route, identifier) {
+		const path = this.federation.router.build(route, { identifier });
+		if (path == null) throw new RouterError(ACTOR_COLLECTION_ROUTE_ERRORS[route]);
+		return path;
+	}
 	getOutboxUri(identifier) {
-		const path = this.federation.router.build("outbox", { identifier });
-		if (path == null) throw new RouterError("No outbox dispatcher registered.");
-		return new URL(path, this.canonicalOrigin);
+		return new URL(this.#getActorCollectionPath("outbox", identifier), this.canonicalOrigin);
+	}
+	getPortableOutboxUri(identifier, authority) {
+		const path = this.#getActorCollectionPath("outbox", identifier);
+		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
 	getMediaUploaderUri(identifier) {
 		const path = this.federation.router.build("mediaUploader", { identifier });
@@ -5985,39 +6301,53 @@ var ContextImpl = class ContextImpl {
 	getPortableInboxUri(identifier, authority) {
 		const path = this.federation.router.build("inbox", { identifier });
 		if (path == null) throw new RouterError("No inbox path registered.");
-		if (authority == null) throw new TypeError("The authority of a portable ID is required outside an FEP-ef61 gateway request.");
-		return buildPortableUri(authority, path);
+		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
 	getFollowingUri(identifier) {
-		const path = this.federation.router.build("following", { identifier });
-		if (path == null) throw new RouterError("No following collection path registered.");
-		return new URL(path, this.canonicalOrigin);
+		return new URL(this.#getActorCollectionPath("following", identifier), this.canonicalOrigin);
+	}
+	getPortableFollowingUri(identifier, authority) {
+		const path = this.#getActorCollectionPath("following", identifier);
+		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
 	getFollowersUri(identifier) {
-		const path = this.federation.router.build("followers", { identifier });
-		if (path == null) throw new RouterError("No followers collection path registered.");
-		return new URL(path, this.canonicalOrigin);
+		return new URL(this.#getActorCollectionPath("followers", identifier), this.canonicalOrigin);
+	}
+	getPortableFollowersUri(identifier, authority) {
+		const path = this.#getActorCollectionPath("followers", identifier);
+		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
 	getLikedUri(identifier) {
-		const path = this.federation.router.build("liked", { identifier });
-		if (path == null) throw new RouterError("No liked collection path registered.");
-		return new URL(path, this.canonicalOrigin);
+		return new URL(this.#getActorCollectionPath("liked", identifier), this.canonicalOrigin);
+	}
+	getPortableLikedUri(identifier, authority) {
+		const path = this.#getActorCollectionPath("liked", identifier);
+		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
 	getFeaturedUri(identifier) {
-		const path = this.federation.router.build("featured", { identifier });
-		if (path == null) throw new RouterError("No featured collection path registered.");
-		return new URL(path, this.canonicalOrigin);
+		return new URL(this.#getActorCollectionPath("featured", identifier), this.canonicalOrigin);
+	}
+	getPortableFeaturedUri(identifier, authority) {
+		const path = this.#getActorCollectionPath("featured", identifier);
+		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
 	getFeaturedTagsUri(identifier) {
-		const path = this.federation.router.build("featuredTags", { identifier });
-		if (path == null) throw new RouterError("No featured tags collection path registered.");
-		return new URL(path, this.canonicalOrigin);
+		return new URL(this.#getActorCollectionPath("featuredTags", identifier), this.canonicalOrigin);
+	}
+	getPortableFeaturedTagsUri(identifier, authority) {
+		const path = this.#getActorCollectionPath("featuredTags", identifier);
+		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
 	getCollectionUri(name, values) {
 		const path = this.federation.getCollectionPath(name, values);
 		if (path === null) throw new RouterError(`No collection dispatcher registered for "${String(name)}".`);
 		return new URL(path, this.canonicalOrigin);
 	}
+	getPortableCollectionUri(name, values, authority) {
+		const path = this.federation.getCollectionPath(name, values);
+		if (path === null) throw new RouterError(`No collection dispatcher registered for "${String(name)}".`);
+		return buildPortableUri(requirePortableAuthority(authority), path);
+	}
 	parseUri(uri) {
 		if (uri == null) return null;
 		if (uri.origin !== this.origin && uri.origin !== this.canonicalOrigin) return null;
@@ -6597,6 +6927,27 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 	getPortableInboxUri(identifier, authority) {
 		return super.getPortableInboxUri(identifier, authority ?? this.portableRequest?.authority);
 	}
+	getPortableOutboxUri(identifier, authority) {
+		return super.getPortableOutboxUri(identifier, authority ?? this.portableRequest?.authority);
+	}
+	getPortableFollowingUri(identifier, authority) {
+		return super.getPortableFollowingUri(identifier, authority ?? this.portableRequest?.authority);
+	}
+	getPortableFollowersUri(identifier, authority) {
+		return super.getPortableFollowersUri(identifier, authority ?? this.portableRequest?.authority);
+	}
+	getPortableLikedUri(identifier, authority) {
+		return super.getPortableLikedUri(identifier, authority ?? this.portableRequest?.authority);
+	}
+	getPortableFeaturedUri(identifier, authority) {
+		return super.getPortableFeaturedUri(identifier, authority ?? this.portableRequest?.authority);
+	}
+	getPortableFeaturedTagsUri(identifier, authority) {
+		return super.getPortableFeaturedTagsUri(identifier, authority ?? this.portableRequest?.authority);
+	}
+	getPortableCollectionUri(name, values, authority) {
+		return super.getPortableCollectionUri(name, values, authority ?? this.portableRequest?.authority);
+	}
 	async getActor(identifier, options) {
 		if (this.federation.actorCallbacks == null || this.federation.actorCallbacks.dispatcher == null) throw new Error("No actor dispatcher registered.");
 		if (this.#invokedFromActorDispatcher != null) getLogger([