@fedify/fedify 2.4.0-pr.934.40 → 2.4.0

package/dist/{middleware-O2LHXFEk.mjs → middleware-CqQ5Qahj.mjs}

@@ -1,38 +1,150 @@
 import { Temporal } from "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-D3c0o_N0.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-BMaatuZi.mjs";
-import { t as formatAcceptSignature } from "./accept-8PiolDP7.mjs";
-import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-C_gNKtxm.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-Dm0JAUa_.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-BCecHIxU.mjs";
-import { n as kvCache } from "./kv-cache-B7H7lZ84.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-DAPAVL_7.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-Dcx-czqn.mjs";
-import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-URuqsICz.mjs";
-import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-BkAxvrjt.mjs";
-import { t as getNodeInfo } from "./client-CjF5IYQS.mjs";
-import { t as nodeInfoToJson } from "./types-CrtdVuDP.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-D_j7E-oC.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-BBPwtB2v.mjs";
-import { t as CircuitBreaker } from "./circuit-breaker-CBGyz5F7.mjs";
-import { t as buildCollectionSynchronizationHeader } from "./collection-BIhlldqK.mjs";
-import { t as KvKeyCache } from "./keycache-_DHqz5z_.mjs";
-import { t as acceptsJsonLd } from "./negotiation-RuwrPFqi.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-yE5EcfNX.mjs";
-import { t as createExponentialBackoffPolicy } from "./retry-DgFqeS5k.mjs";
-import { t as TaskCodec } from "./codec-BBga-FWI.mjs";
+import { d as isPortableUri, f as isSameObjectId, i as getPortableDid, l as isPortableId, n as getCanonicalPortableId, o as hasPortableActor, r as getGatewayKeyBase, s as isCompatibleKeyId, t as getAuthenticationOrigin, u as isPortableKeyId } from "./portable-key-id-Ca30-hOa.mjs";
+import { n as isPubliclyAddressedNode, t as isInAudience } from "./audience-CHQ-FlLD.mjs";
+import { a as verificationObservation, r as snapshotKey, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
+import { n as version, t as name } from "./deno-D8wr4ikF.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DPdi_XK7.mjs";
+import { t as formatAcceptSignature } from "./accept-CPVqki78.mjs";
+import { c as validateCryptoKey, n as exportJwk, s as importJwk } from "./key-D979vduq.mjs";
+import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-wmqC-95l.mjs";
+import { a as signObject, c as verifyPortableObjectProof, i as hasProofLike, s as verifyObject, t as InvalidPortableObjectIdError, u as verifyPortableObjectProofWithRoot } from "./proof-DeC9pb6t.mjs";
+import { a as listRequestSignatures, c as selectRequestSignature, d as validateMaxSignatures, f as verifyRequest, p as verifyRequestDetailed, s as parseRfc9421SignatureInput } from "./http-BAgKAAGY.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-TCvsU9vF.mjs";
+import { n as kvCache } from "./kv-cache-Gh05Xv-P.mjs";
+import { d as readBoundedText, l as BodyTooLargeError, t as getNodeInfo, u as MAX_BODY_SIZE } from "./client-CEnNz8O7.mjs";
+import { t as nodeInfoToJson } from "./types-DE_LV1JB.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-BfygwLNy.mjs";
+import { t as verifyPortableObject } from "./portable-collection-idA006Sj.mjs";
+import { a as getOrderingDestination, i as sendActivityThroughGateways, n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-1tcGhW1h.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-lJDh222H.mjs";
+import { t as CircuitBreaker } from "./circuit-breaker-XJ53md4S.mjs";
+import { t as buildCollectionSynchronizationHeader } from "./collection-CnnP1UAv.mjs";
+import { a as inspectCompoundPortableObjectApplicability, c as verifyServedPortableObjects, i as findUnsupportedCompoundProofShape, o as verifyCompoundPortableObjectProofs, r as findEmbeddedProofWithoutContext, t as containsCompoundPortableObject } from "./compound-proof-zAjqsHiN.mjs";
+import { t as KvKeyCache } from "./keycache-Da8A8mZa.mjs";
+import { t as acceptsJsonLd } from "./negotiation-CCocWT_N.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-DA7r1fm3.mjs";
+import { t as createExponentialBackoffPolicy } from "./retry-zX5xw5e0.mjs";
+import { t as TaskCodec } from "./codec-C6rTrpIp.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
 import { RouterError } from "@fedify/uri-template";
-import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
+import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, isActor, lookupObject, traverseCollection } from "@fedify/vocab";
 import { lookupWebFinger } from "@fedify/webfinger";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
+import { FetchError, canonicalizePortableUri, decodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, parseDigestMultibase, parseHashlink, parseIri, resolveDocumentLoaderTimeout, toCompatibleEf61Id } from "@fedify/vocab-runtime";
+import { isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
 import { uniq } from "es-toolkit";
-import { FetchError, getDocumentLoader } from "@fedify/vocab-runtime";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_HTTP_RESPONSE_HEADER, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
+import jsonld from "@fedify/vocab-runtime/jsonld";
 import { DataPointType, MeterProvider as MeterProvider$1, MetricReader } from "@opentelemetry/sdk-metrics";
 import { domainToASCII } from "node:url";
+//#region src/federation/inbox-observation.ts
+/** Internal state owned by the ingress boundary, never serialized into queues. */
+var InboxObservation = class {
+	inbox;
+	payload = { status: "unavailable" };
+	activity = null;
+	authentication = { status: "notDetermined" };
+	hasException = false;
+	stage = "prepare";
+	result = {
+		disposition: "rejected",
+		reason: "recipientNotFound"
+	};
+	verification = {
+		attempts: [],
+		subject: {
+			id: null,
+			pointer: ""
+		},
+		parsedObject: (object) => {
+			if (object instanceof Activity) {
+				this.activity = object;
+				this.verification.subject.id = object.id == null ? null : new URL(object.id.href);
+			}
+		}
+	};
+	constructor(inbox) {
+		this.inbox = inbox;
+	}
+	/** Run an ingress operation and project telemetry; fetch owns completion. */
+	async run(operation, span) {
+		let response;
+		let outcome;
+		let threw = false;
+		let originalError;
+		try {
+			response = await operation();
+			outcome = {
+				type: "response",
+				status: response.status,
+				...this.result
+			};
+		} catch (error) {
+			threw = true;
+			this.hasException = true;
+			originalError = error;
+			outcome = {
+				type: "exception",
+				stage: this.stage,
+				error
+			};
+		}
+		if (span != null) this.project(span, outcome);
+		if (threw) throw originalError;
+		return response;
+	}
+	/** Complete standalone handler calls that have no enclosing fetch boundary. */
+	async runAndFinish(getContext, handler, operation) {
+		let response;
+		try {
+			response = await this.run(operation);
+		} catch (error) {
+			await this.finish(getContext(), handler, {
+				type: "exception",
+				stage: this.stage,
+				error
+			});
+			throw error;
+		}
+		await this.finish(getContext(), handler, {
+			type: "response",
+			status: response.status,
+			...this.result
+		});
+		return response;
+	}
+	project(span, outcome) {
+		span.setAttribute("activitypub.authentication.status", this.authentication.status);
+		if (this.authentication.status === "rejected") span.setAttribute("activitypub.verification.failure_reason", this.authentication.reason.type);
+		span.setAttribute("activitypub.inbox.disposition", outcome?.type === "exception" || this.hasException ? "exception" : this.result.disposition);
+	}
+	async finish(context, handler, outcome) {
+		if (handler == null) return;
+		const report = {
+			inbox: this.inbox,
+			payload: this.payload,
+			activity: this.activity,
+			attempts: this.verification.attempts,
+			authentication: this.authentication,
+			outcome
+		};
+		try {
+			await handler(context, report);
+		} catch (error) {
+			try {
+				getLogger([
+					"fedify",
+					"federation",
+					"inbox"
+				]).error("An unexpected error occurred in inbox request finished handler:\n{error}", { error });
+			} catch {}
+		}
+	}
+};
+//#endregion
 //#region src/compat/transformers.ts
 const logger$2 = getLogger([
 	"fedify",
@@ -353,6 +465,180 @@ function serializeDataPointType(dataPointType) {
 	}
 }
 //#endregion
+//#region src/federation/compatible-id-warning.ts
+/** Returns a verified first gateway, without dereferencing the actor. */
+async function getLocalFirstGateway(context, ownerId, did) {
+	try {
+		const parsed = context.parseUri(ownerId, { portable: true });
+		if (parsed?.type !== "actor" || parsed.authority !== did) return null;
+		return firstGateway(await context.getActor(parsed.identifier), did);
+	} catch (error) {
+		getLogger([
+			"fedify",
+			"federation",
+			"object"
+		]).debug("Could not check the first gateway of {ownerId}: {error}", {
+			ownerId: ownerId.href,
+			error
+		});
+		return null;
+	}
+}
+function firstGateway(actor, did) {
+	if (actor?.id == null || getPortableDid(actor.id) !== did) return null;
+	const gateway = actor.gateway;
+	return gateway != null && isGatewayUrl(gateway) ? gateway : null;
+}
+/** Looks for an actor already embedded in the document being published. */
+function getEmbeddedFirstGateway(json, ownerId, did) {
+	const owner = getCanonicalPortableId(ownerId);
+	if (owner == null) return null;
+	return visitJsonMaps(json, (map) => {
+		const id = parseMapId(map, isJsonMap(json) ? json : null);
+		if (id == null || getCanonicalPortableId(id) !== owner) return;
+		const gateways = map.gateways ?? map["https://w3id.org/fep/ef61/gateways"];
+		const first = Array.isArray(gateways) ? gateways[0] : isJsonMap(gateways) && Array.isArray(gateways["@list"]) ? gateways["@list"][0] : null;
+		const address = typeof first === "string" ? first : isJsonMap(first) ? first.id ?? first["@id"] : null;
+		if (typeof address !== "string") return;
+		try {
+			const gateway = new URL(address);
+			if (getPortableDid(id) === did && isGatewayUrl(gateway)) return gateway;
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+		}
+	}) ?? null;
+}
+function isJsonMap(value) {
+	return value != null && typeof value === "object" && !Array.isArray(value);
+}
+/** Warns only when the publisher's actual first gateway is known. */
+function warnCompatibleId(id, did, gateway, kind) {
+	if (!isCompatibleEf61Iri(id) || getPortableDid(id) !== did || id.origin === gateway.origin) return;
+	getLogger([
+		"fedify",
+		"federation",
+		kind === "activity" ? "outbox" : "object"
+	]).warn("The {kind} {id} has an FEP-ef61 compatible identifier on another gateway than its owner's first gateway, {gateway}.  FEP-ef61 requires publishers to use the first gateway in the actor's gateways.", {
+		kind,
+		id: id.href,
+		gateway: gateway.origin
+	});
+}
+/** Reads the root ID without dereferencing or expanding the document. */
+function getCompactRootId(json) {
+	return isJsonMap(json) ? parseMapId(json, json) : null;
+}
+/** Checks an activity and its embedded objects against each one's owner. */
+async function warnCompatibleIdsInJson(json, context) {
+	const root = isJsonMap(json) ? json : null;
+	const rootOwners = root == null ? [] : ownerIds(root, "actor", root);
+	const gateways = /* @__PURE__ */ new Map();
+	const maps = [];
+	visitJsonMaps(json, (map, path) => {
+		maps.push({
+			map,
+			path
+		});
+	});
+	for (const { map, path } of maps) {
+		const id = parseMapId(map, root);
+		if (id == null || !isCompatibleEf61Iri(id)) continue;
+		const type = map.type ?? map["@type"];
+		if ((Array.isArray(type) ? type : [type]).some((t) => typeof t === "string" && /(?:^|[#/:])(CryptographicKey|Multikey|JsonWebKey|Key)$/.test(t))) continue;
+		const did = getPortableDid(id);
+		if (did == null) continue;
+		const owners = path === "" ? rootOwners : [
+			...ownerIds(map, "actor", root),
+			...ownerIds(map, "attributedTo", root),
+			...rootOwners
+		];
+		for (const ownerId of owners) {
+			if (getPortableDid(ownerId) !== did) continue;
+			const key = getCanonicalPortableId(ownerId);
+			if (key == null) continue;
+			let gateway = gateways.get(key);
+			if (gateway === void 0) {
+				gateway = getEmbeddedFirstGateway(json, ownerId, did) ?? (context == null ? null : await getLocalFirstGateway(context, ownerId, did));
+				gateways.set(key, gateway);
+			}
+			if (gateway != null) {
+				warnCompatibleId(id, did, gateway, path === "" ? "activity" : "object");
+				break;
+			}
+		}
+	}
+}
+function ownerIds(map, term, root) {
+	const iri = `https://www.w3.org/ns/activitystreams#${term}`;
+	const values = [map[term], map[iri]];
+	for (const context of [map["@context"], root?.["@context"]]) for (const [alias, definition] of localContextEntries(context)) {
+		const mapped = typeof definition === "string" ? definition : isJsonMap(definition) ? definition["@id"] : null;
+		if (mapped === iri || mapped === `as:${term}`) values.push(map[alias]);
+	}
+	return values.flatMap((value) => parseOwnerIds(value, root));
+}
+function localContextEntries(context) {
+	if (Array.isArray(context)) return context.flatMap(localContextEntries);
+	return isJsonMap(context) ? Object.entries(context) : [];
+}
+function parseOwnerIds(value, root) {
+	if (Array.isArray(value)) return value.flatMap((item) => parseOwnerIds(item, root));
+	if (isJsonMap(value)) {
+		const id = parseMapId(value, root);
+		return id == null ? [] : [id];
+	}
+	if (typeof value !== "string") return [];
+	try {
+		return [parseIri(value)];
+	} catch (error) {
+		if (error instanceof TypeError) return [];
+		throw error;
+	}
+}
+function parseMapId(map, root) {
+	let raw = map["@id"] ?? map.id;
+	for (const context of [map["@context"], root?.["@context"]]) for (const [alias, definition] of localContextEntries(context)) if ((typeof definition === "string" ? definition : isJsonMap(definition) ? definition["@id"] : null) === "@id" && typeof map[alias] === "string") {
+		raw = map[alias];
+		break;
+	}
+	if (typeof raw !== "string") return null;
+	try {
+		return parseIri(raw);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+function visitJsonMaps(json, visit) {
+	const seen = /* @__PURE__ */ new Set();
+	const pending = [{
+		value: json,
+		path: ""
+	}];
+	while (pending.length > 0) {
+		const { value, path } = pending.pop();
+		if (value == null || typeof value !== "object" || seen.has(value)) continue;
+		seen.add(value);
+		if (Array.isArray(value)) {
+			for (let i = value.length - 1; i >= 0; i--) pending.push({
+				value: value[i],
+				path: `${path}/${i}`
+			});
+			continue;
+		}
+		const map = value;
+		const result = visit(map, path);
+		if (result !== void 0) return result;
+		for (const key of Object.keys(map).reverse()) {
+			if (key === "proof" || key === "@context") continue;
+			pending.push({
+				value: map[key],
+				path: `${path}/${key}`
+			});
+		}
+	}
+}
+//#endregion
 //#region src/federation/inbox.ts
 async function routeActivity({ context: ctx, json, originalJson, normalizedActivity, ldSignatureVerified, activity, recipient, inboxListeners, inboxContextFactory, listenerInboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
 	const logger = getLogger([
@@ -511,8 +797,602 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 	});
 }
 //#endregion
+//#region src/federation/portable.ts
+/**
+* The media type that FEP-ef61 gateways must use for portable objects.
+*/
+const PORTABLE_OBJECT_CONTENT_TYPE = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"";
+const GATEWAY_OBJECT_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
+const BARE_DID_PATTERN = /^did:[a-z0-9]+:[^/?#]+$/i;
+const DID_KEY_PREFIX = "did:key:";
+const BASE58BTC_MULTIBASE_PATTERN = /^z[1-9A-HJ-NP-Za-km-z]+$/;
+const GATEWAY_PATH_PREFIX = "/.well-known/apgateway/";
+const HASHLINK_SCHEME_PATTERN = /^hl(?::|%3A)/i;
+/**
+* The route template of hashlink media requests, used for metrics and traces.
+*/
+const HASHLINK_MEDIA_ROUTE_TEMPLATE = "/.well-known/apgateway/hl:{digestMultibase}";
+/**
+* Recognizes an FEP-ef61 gateway request for a portable object, e.g.,
+* `GET /.well-known/apgateway/did:key:z6Mk.../notes/123`.
+*
+* The query is not part of the portable ID, so it is ignored here.  It is not
+* removed from the request itself, which HTTP Signatures may cover.
+*
+* @param url The request URL.
+* @returns The parsed request, or `null` if the URL is not a gateway request
+*          for a portable object, e.g., the gateway discovery endpoint or
+*          a hashlink media URL.
+*/
+function parsePortableGatewayRequest(url) {
+	if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+	if (!GATEWAY_OBJECT_PATH_PATTERN.test(url.pathname)) return null;
+	let id;
+	let canonicalId;
+	try {
+		id = fromCompatibleEf61Id(url.origin + url.pathname);
+		if (id == null) return null;
+		canonicalId = canonicalizePortableUri(formatIri(id));
+	} catch (error) {
+		if (error instanceof TypeError) return {
+			type: "malformed",
+			error
+		};
+		throw error;
+	}
+	const authority = getFe34Origin(id);
+	try {
+		assertBase58BtcDidKey(authority);
+	} catch (error) {
+		if (error instanceof TypeError) return {
+			type: "malformed",
+			error
+		};
+		throw error;
+	}
+	const href = id.href;
+	return {
+		type: "object",
+		portableRequest: Object.freeze({
+			authority,
+			get id() {
+				return new URL(href);
+			}
+		}),
+		canonicalId,
+		path: id.pathname
+	};
+}
+/**
+* Recognizes an FEP-ef61 portable ID, i.e., an `ap:` or `ap+ef61:` URI, or
+* a compatible identifier on any gateway, and splits it into its DID and
+* the object path to route.
+*
+* It accepts the same IDs as the gateway endpoint does: the query, e.g.,
+* location hints, and the fragment are ignored, and a malformed DID, or
+* a `did:key` DID that is not encoded in base58-btc, is refused.
+*
+* @param uri The ID to recognize.
+* @returns The DID normalized as an FEP-fe34 origin, and the object path,
+*          or `null` if the ID is not a portable ID or is malformed.
+*/
+function parsePortableId(uri) {
+	if (uri.username !== "" || uri.password !== "") return null;
+	if (uri.protocol !== "ap:" && uri.protocol !== "ap+ef61:") {
+		const request = parsePortableGatewayRequest(uri);
+		if (request?.type !== "object") return null;
+		return {
+			authority: request.portableRequest.authority,
+			path: request.path
+		};
+	}
+	try {
+		const id = parseIri(uri);
+		canonicalizePortableUri(formatIri(id));
+		const authority = getFe34Origin(id);
+		assertBase58BtcDidKey(authority);
+		return {
+			authority,
+			path: id.pathname
+		};
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Builds a portable ID from a DID authority and an object path.
+* @param authority The bare DID, e.g., `did:key:z6Mk...`.
+* @param path The object path, e.g., `/notes/123`.
+* @returns The portable ID.
+* @throws {TypeError} If the authority is not a bare DID, or it is
+*                     a `did:key` DID that is not encoded in base58-btc.
+*/
+function buildPortableUri(authority, path) {
+	if (typeof authority !== "string" || !BARE_DID_PATTERN.test(authority)) throw new TypeError("The authority of a portable ID must be a DID without a path, query, or fragment.");
+	const did = getFe34Origin(authority);
+	assertBase58BtcDidKey(did);
+	return parseIri(`ap+ef61://${did}${path}`);
+}
+/**
+* Checks that a normalized DID, if it is a `did:key` DID, is encoded in
+* base58-btc, as FEP-ef61 requires so that the same key does not yield two
+* portable IDs.  This only checks the encoding, not whether the DID is
+* a valid key.
+* @param did The DID normalized by `getFe34Origin()`.
+* @throws {TypeError} If the DID is a `did:key` DID that is not encoded in
+*                     base58-btc.
+*/
+function assertBase58BtcDidKey(did) {
+	if (did.startsWith(DID_KEY_PREFIX) && !BASE58BTC_MULTIBASE_PATTERN.test(did.slice(8))) throw new TypeError("The did:key authority of a portable ID must be encoded in base58-btc, i.e., start with z.");
+}
+/**
+* Recognizes an FEP-ef61 gateway request for a resource addressed by
+* a hashlink, e.g.,
+* `GET /.well-known/apgateway/hl:zQmdfTbBqBPQ7VNxZEYEj14VmRuZBkqFbiwReogJgS1zR1n`.
+*
+* The rest of the path, including any slashes, is taken as the hashlink, as
+* a digest in a multibase encoding like base64 may contain slashes.  The query
+* is not part of the hashlink, so it is ignored here.
+*
+* @param url The request URL.
+* @returns The parsed request, or `null` if the URL is not a gateway request
+*          for a hashlink, e.g., a request for a portable object.
+*/
+function parseHashlinkGatewayRequest(url) {
+	if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+	if (!url.pathname.startsWith(GATEWAY_PATH_PREFIX)) return null;
+	const encoded = url.pathname.slice(23);
+	if (!HASHLINK_SCHEME_PATTERN.test(encoded)) return null;
+	let digestMultibase;
+	let digest;
+	let multihash;
+	try {
+		let hashlink;
+		try {
+			hashlink = decodeURIComponent(encoded);
+		} catch (error) {
+			throw new TypeError("Invalid percent-encoding in the hashlink.", { cause: error });
+		}
+		({digestMultibase} = parseHashlink(hashlink));
+		({digest} = parseDigestMultibase(digestMultibase));
+		multihash = decodeMultibase(digestMultibase);
+	} catch (error) {
+		if (error instanceof TypeError) return {
+			type: "malformed",
+			error
+		};
+		throw error;
+	}
+	return {
+		type: "media",
+		media: Object.freeze({
+			hashlink: `hl:${digestMultibase}`,
+			digestMultibase,
+			algorithm: "sha2-256",
+			digest,
+			multihash
+		})
+	};
+}
+//#endregion
+//#region src/federation/portable-inbox.ts
+const MAX_TIMEOUT_MS = 2 ** 31 - 1;
+/**
+* Fills in the defaults of {@link PortableInboxForwardingOptions} and
+* validates them.
+* @param options The options.
+* @returns The resolved options.
+* @throws {RangeError} If `maxTargets` is not a non-negative integer, if `ttl`
+*                      is not positive, if `deadline` is negative or longer
+*                      than 2,147,483,647 milliseconds (about 24.8 days), or
+*                      if either duration has calendar units, i.e., weeks,
+*                      months, or years, whose length depends on the date.
+*/
+function resolvePortableInboxForwardingOptions(options = {}) {
+	const maxTargets = options.maxTargets ?? 10;
+	if (!Number.isInteger(maxTargets) || maxTargets < 0) throw new RangeError("portableInboxForwarding.maxTargets must be a non-negative integer.");
+	const ttl = Temporal.Duration.from(options.ttl ?? { days: 30 });
+	if (ttl.total("millisecond") <= 0) throw new RangeError("portableInboxForwarding.ttl must be positive.");
+	const deadline = Temporal.Duration.from(options.deadline ?? { seconds: 10 });
+	const deadlineMs = deadline.total("millisecond");
+	if (deadlineMs < 0 || deadlineMs > MAX_TIMEOUT_MS) throw new RangeError(`portableInboxForwarding.deadline must be between 0 and ${MAX_TIMEOUT_MS} milliseconds.`);
+	return {
+		maxTargets,
+		ttl,
+		deadline
+	};
+}
+/**
+* Decides whether this server accepts a delivery to a portable inbox on behalf
+* of the given actor, which the actor dispatcher returned for the identifier
+* in the requested inbox path.
+*
+* The actor document comes from the application, so it is trusted as is and
+* its proof is not verified here.
+* @param actor The actor the actor dispatcher returned.
+* @param options The requested DID, the canonical form of the requested inbox
+*                ID, and the origin of this server.
+* @returns The resolution.
+*/
+function resolvePortableInboxRecipient(actor, { authority, canonicalInboxId, localOrigin }) {
+	if (actor == null) return {
+		status: "rejected",
+		reason: "notFound"
+	};
+	const id = actor.id;
+	const did = id == null || !isPortableId(id) ? null : getPortableDid(id);
+	if (id == null || did == null) return {
+		status: "rejected",
+		reason: "notPortable"
+	};
+	if (did !== authority) return {
+		status: "rejected",
+		reason: "authorityMismatch"
+	};
+	const inboxId = actor.inboxId == null ? null : toPortableUri(actor.inboxId);
+	if (inboxId == null || getCanonicalPortableId(inboxId) !== canonicalInboxId) return {
+		status: "rejected",
+		reason: "inboxMismatch"
+	};
+	const gateways = actor.gateways;
+	if (!gateways.some((g) => isGatewayUrl(g) && g.origin === localOrigin)) return {
+		status: "rejected",
+		reason: "notGateway"
+	};
+	return {
+		status: "accepted",
+		recipient: {
+			actorId: id,
+			inboxId,
+			canonicalInboxId,
+			gateways
+		}
+	};
+}
+/**
+* Gets the portable form of an `ap:` or `ap+ef61:` URI or a compatible
+* identifier, keeping its query.
+* @returns The portable URI, or `null` if the ID is neither, or is malformed.
+*/
+function toPortableUri(id) {
+	if (isPortableUri(id)) return id;
+	try {
+		return fromCompatibleEf61Id(id);
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+const RFC9421_DELIVERY_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"content-digest"
+];
+const DRAFT_DELIVERY_COMPONENTS = [
+	"(request-target)",
+	"host",
+	"digest"
+];
+/**
+* Checks whether an HTTP Signature covers the method, the target URI, and the
+* body of a request, which both Fedify and Mitra sign when forwarding.
+* @param signature The signature.
+* @returns `true` if the signature covers them.
+*/
+function coversDelivery(signature) {
+	return (signature.label == null ? DRAFT_DELIVERY_COMPONENTS : RFC9421_DELIVERY_COMPONENTS).every((name) => signature.components.some((c) => c.value === name && Object.keys(c.params).length < 1));
+}
+/**
+* Forwards an activity received in a portable inbox to the inboxes of the same
+* portable actor on its other gateways, as FEP-ef61 recommends.
+*
+* FEP-ef61 forbids forwarding an activity from an inbox more than once, so
+* each target gateway is claimed with an atomic compare-and-swap before the
+* activity is handed off, and a claim is never released, even if the hand-off
+* fails, since a failed hand-off does not prove that nothing was delivered.
+* Forwarding is therefore best effort.  Without {@link KvStore.cas}, nothing is
+* forwarded.
+*
+* Forwarded requests are signed with HTTP Signatures by the RSA key among
+* {@link ForwardPortableInboxActivityParameters.getKeys}, if any, so that
+* servers requiring HTTP Signatures accept them, and are sent unsigned
+* otherwise.  Either way, the receiving gateways authenticate the activity by
+* its own proof.
+*
+* If the delivery is signed with a gateway key of the recipient by one of its
+* other gateways, that gateway has the activity already, so it is claimed
+* without forwarding the activity to it.  See {@link identifySendingGateway}.
+* @param parameters The parameters.
+* @returns The target inbox URLs that the activity was handed off to.
+*/
+async function forwardPortableInboxActivity(parameters) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const { recipient, activityId, excludedOrigins, kv, kvPrefix, outboxQueue } = parameters;
+	const options = parameters.options ?? resolvePortableInboxForwardingOptions();
+	const { maxTargets, ttl } = options;
+	if (kv.cas == null || maxTargets < 1) return [];
+	const deadline = Date.now() + options.deadline.total("millisecond");
+	const canonicalActivityId = getCanonicalPortableId(activityId) ?? activityId.href;
+	const claimKey = (gateway) => [
+		...kvPrefix,
+		recipient.canonicalInboxId,
+		canonicalActivityId,
+		gateway
+	];
+	let targets = getForwardingTargets(recipient, excludedOrigins);
+	const sender = await identifySendingGateway(parameters, targets.map((t) => t.gateway), claimKey, deadline);
+	if (sender != null) {
+		logger.debug("Not forwarding activity {activityId} from the portable inbox {inbox} back to the gateway {gateway}, which delivered it.", {
+			activityId: activityId.href,
+			inbox: recipient.canonicalInboxId,
+			gateway: sender
+		});
+		await kv.cas(claimKey(sender), void 0, true, { ttl });
+		targets = targets.filter((t) => t.gateway !== sender);
+	}
+	if (targets.length > maxTargets) {
+		logger.warn("The portable actor that owns the inbox {inbox} has more than {max} other gateways; the activity {activityId} is forwarded only to the first {max} of them.", {
+			inbox: recipient.canonicalInboxId,
+			activityId: activityId.href,
+			max: maxTargets
+		});
+		targets.length = maxTargets;
+	}
+	const claimed = [];
+	for (const { gateway, inbox } of targets) if (await kv.cas(claimKey(gateway), void 0, true, { ttl })) claimed.push(inbox);
+	if (claimed.length < 1) return [];
+	logger.debug("Forwarding activity {activityId} from the portable inbox {inbox} to other gateways:\n{targets}", {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		targets: claimed.map((t) => t.href)
+	});
+	if (outboxQueue == null) await forwardImmediately(parameters, claimed, deadline);
+	else await enqueueForwarding(parameters, outboxQueue, claimed);
+	return claimed;
+}
+/**
+* Identifies the gateway of the recipient that forwarded a delivery to its
+* portable inbox, by the delivery's HTTP Signature made with the recipient's
+* gateway key, which FEP-ef61 has each gateway use for requests on behalf of
+* an actor.  Since the activity is authenticated by its own proof, the
+* signature only tells which gateway to skip, and a delivery whose signature
+* is invalid or cannot be verified is still forwarded to every gateway.
+*
+* Verifying the signature fetches the recipient's actor document from the
+* sending gateway, as gateway keys are not cached, so only the first signature
+* that may save a request is verified: one that covers the delivery and names
+* a gateway key of the recipient on one of the forwarding targets that the
+* activity has not been forwarded to yet.
+* @param parameters The forwarding parameters.
+* @param targets The origins of the gateways to forward to.
+* @param claimKey Gets the key of the claim for a gateway.
+* @param deadline The time by which identification has to finish, in
+*                 milliseconds since the epoch; afterwards, the sending
+*                 gateway is left unidentified.
+* @returns The origin of the sending gateway, or `null` if it is not
+*          identified.
+*/
+async function identifySendingGateway({ recipient, activityId, kv, signatures }, targets, claimKey, deadline) {
+	if (signatures == null || signatures.length < 1) return null;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const actorId = getCanonicalPortableId(recipient.actorId);
+	if (actorId == null) return null;
+	const isGatewayKeyOfRecipient = (keyId) => {
+		if (!isCompatibleKeyId(keyId) || !targets.includes(keyId.origin)) return false;
+		const base = new URL(keyId.href);
+		base.hash = "";
+		return getCanonicalPortableId(base) === actorId;
+	};
+	let signature;
+	for (const candidate of signatures) if (candidate.coversDelivery && isGatewayKeyOfRecipient(candidate.keyId) && await kv.get(claimKey(candidate.keyId.origin)) === void 0) {
+		signature = candidate;
+		break;
+	}
+	if (signature == null) return null;
+	const { keyId } = signature;
+	const logProperties = {
+		activityId: activityId.href,
+		inbox: recipient.canonicalInboxId,
+		keyId: keyId.href
+	};
+	const verification = Promise.resolve().then(() => signature.verify()).then((key) => {
+		if (key == null) logger.debug("The HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} is not verified with the key {keyId}; forwarding it without identifying the sending gateway.", logProperties);
+		return key;
+	}, (error) => {
+		logger.debug("Failed to verify the HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} with the key {keyId}; forwarding it without identifying the sending gateway:\n{error}", {
+			...logProperties,
+			error
+		});
+		return null;
+	});
+	let timer;
+	const key = await Promise.race([verification, new Promise((resolve) => {
+		timer = setTimeout(() => {
+			logger.debug("Verifying the HTTP Signature of the delivery of activity {activityId} to the portable inbox {inbox} did not finish in time; forwarding it without identifying the sending gateway.", logProperties);
+			resolve(null);
+		}, Math.max(0, deadline - Date.now()));
+	})]);
+	clearTimeout(timer);
+	if (key == null) return null;
+	if (key.id == null || key.id.href !== keyId.href || !isGatewayKeyOfRecipient(key.id) || key.ownerId == null || !isPortableId(key.ownerId) || getCanonicalPortableId(key.ownerId) !== actorId) {
+		logger.debug("The delivery of activity {activityId} to the portable inbox {inbox} is not signed with a gateway key of the recipient; forwarding it without identifying the sending gateway.", logProperties);
+		return null;
+	}
+	return key.id.origin;
+}
+function getForwardingTargets(recipient, excludedOrigins) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const seen = new Set(excludedOrigins);
+	const targets = [];
+	for (const gateway of recipient.gateways) {
+		if (!isGatewayUrl(gateway) || seen.has(gateway.origin)) continue;
+		seen.add(gateway.origin);
+		let inbox;
+		try {
+			inbox = toCompatibleEf61Id(recipient.inboxId, gateway.origin);
+		} catch (error) {
+			if (!(error instanceof TypeError)) throw error;
+			logger.warn("Cannot forward to the gateway {gateway}, as the portable inbox {inbox} cannot be represented as its compatible identifier.", {
+				gateway: gateway.origin,
+				inbox: recipient.canonicalInboxId
+			});
+			continue;
+		}
+		targets.push({
+			gateway: gateway.origin,
+			inbox
+		});
+	}
+	return targets;
+}
+/**
+* Resolves the key that signs forwarded requests: the first RSASSA-PKCS1-v1_5
+* key, as {@link sendActivity} signs requests only with such a key.  Since
+* the targets have already been claimed, the activity is forwarded unsigned
+* rather than not at all if the key cannot be resolved or used.
+*/
+async function resolveForwardingKey({ getKeys, activityId }) {
+	if (getKeys == null) return null;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	let key;
+	try {
+		key = (await getKeys()).find((k) => k.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5");
+	} catch (error) {
+		logger.error("Failed to get the gateway keys to sign forwarded requests with; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	if (key == null) return null;
+	try {
+		validateCryptoKey(key.privateKey, "private");
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		logger.warn("The gateway key {keyId} cannot sign forwarded requests; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+		return null;
+	}
+	return key;
+}
+async function forwardImmediately(parameters, inboxes, deadlineAt) {
+	const { activity, activityId, activityType, allowPrivateAddress, specDeterminer, meterProvider, tracerProvider } = parameters;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const deadline = Math.max(0, deadlineAt - Date.now());
+	const forwarding = resolveForwardingKey(parameters).then((key) => Promise.all(inboxes.map((inbox) => sendActivity({
+		activity,
+		activityId: activityId.href,
+		activityType,
+		keys: key == null ? [] : [key],
+		inbox,
+		allowPrivateAddress,
+		specDeterminer,
+		meterProvider,
+		tracerProvider
+	}).catch((error) => {
+		logger.error("Failed to forward activity {activityId} to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+			activityId: activityId.href,
+			inbox: inbox.href,
+			error
+		});
+	}))));
+	let timer;
+	const timedOut = await Promise.race([forwarding.then(() => false), new Promise((resolve) => {
+		timer = setTimeout(() => resolve(true), deadline);
+	})]);
+	clearTimeout(timer);
+	if (timedOut) logger.warn("Forwarding activity {activityId} to other gateways did not finish in {deadline} ms; responding to the delivery without waiting for it.", {
+		activityId: activityId.href,
+		deadline
+	});
+}
+async function enqueueForwarding(parameters, outboxQueue, inboxes) {
+	const { activity, activityId, activityType, baseUrl, startQueue, meterProvider } = parameters;
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"inbox"
+	]);
+	const key = await resolveForwardingKey(parameters);
+	const keys = [];
+	if (key != null) try {
+		keys.push({
+			keyId: key.keyId.href,
+			privateKey: await exportJwk(key.privateKey)
+		});
+	} catch (error) {
+		logger.error("Failed to export the gateway key {keyId}; forwarding activity {activityId} without HTTP Signatures:\n{error}", {
+			keyId: key.keyId.href,
+			activityId: activityId.href,
+			error
+		});
+	}
+	startQueue?.();
+	const started = (/* @__PURE__ */ new Date()).toISOString();
+	const traceContext = {};
+	propagation.inject(context.active(), traceContext);
+	await Promise.all(inboxes.map(async (inbox) => {
+		const message = {
+			type: "outbox",
+			id: crypto.randomUUID(),
+			baseUrl,
+			keys,
+			activity,
+			activityId: activityId.href,
+			activityType,
+			inbox: inbox.href,
+			sharedInbox: false,
+			started,
+			attempt: 0,
+			headers: {},
+			traceContext
+		};
+		try {
+			await outboxQueue.enqueue(message);
+		} catch (error) {
+			logger.error("Failed to enqueue activity {activityId} to forward to {inbox}; it will not be forwarded to the inbox again:\n{error}", {
+				activityId: activityId.href,
+				inbox: inbox.href,
+				error
+			});
+			return;
+		}
+		recordOutboxEnqueue(meterProvider, outboxQueue, message);
+	}));
+}
+//#endregion
 //#region src/federation/handler.ts
 const rawInboxContextFactorySymbol = Symbol("fedify.rawInboxContextFactory");
+const INBOX_COMPOUND_PROOF_LIMITS = {
+	maxDepth: 64,
+	maxMaps: 1e4,
+	maxProofs: 32,
+	maxBytes: 10 * 1024 * 1024
+};
 function isRemoteContextLoadingFailure$1(error) {
 	return error instanceof Error && typeof error.details === "object" && error.details != null && error.details.code === "loading remote context failed";
 }
@@ -528,7 +1408,7 @@ function isInvalidJsonLdError(error) {
 	return name === "UnsafeJsonLdError" || error instanceof InvalidContextReferenceError || isPermanentRemoteContextError$1(error) || name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure$1(error);
 }
 function isValidationTypeError(error) {
-	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || isInvalidUrlTypeError(error));
+	return error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:|Invalid FEP-ef61 gateway:)/.test(error.message) || isInvalidUrlTypeError(error));
 }
 function isPermanentActivityParseError(error) {
 	return isInvalidJsonLdError(error) || isValidationTypeError(error);
@@ -595,12 +1475,221 @@ async function handleObject(request, { values, context, objectDispatcher, author
 		if (!await authorizePredicate(context, values)) return await onUnauthorized(request);
 	}
 	const jsonLd = await object.toJsonLd(context);
+	if (object instanceof Tombstone) return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), {
+		status: 410,
+		headers: {
+			"Content-Type": "application/activity+json",
+			Vary: "Accept"
+		}
+	});
+	await warnServedCompatibleObject(context, object, getCompactRootId(jsonLd));
 	return new Response(JSON.stringify(jsonLd), { headers: {
 		"Content-Type": "application/activity+json",
 		Vary: "Accept"
 	} });
 }
-const BUILT_IN_COLLECTION_METRIC_KINDS = new Set([
+/**
+* Handles an FEP-ef61 gateway request for a portable object through an object
+* dispatcher, or the actor dispatcher adapted to one.  The object is served
+* only if its ID canonically matches the requested portable ID and it
+* satisfies the FEP-ef61 proof policy.
+*
+* FEP-ef61 forbids serving a non-public object to anyone but its intended
+* audience.  If the dispatcher has an authorization predicate, it decides who
+* may retrieve the object, and the response is marked with
+* `Cache-Control: private`, as it depends on the requester.  Otherwise, only
+* a publicly addressed object is served, and any other object is responded
+* to with `404 Not Found`, as if this server did not store it.  Actors, and
+* anything the actor dispatcher returns, are exempt from the latter, as
+* actors have no audience.
+*
+* A {@link Tombstone} is served with `410 Gone` if it has an Object Integrity
+* Proof made with a key of the DID in its ID.  An unsigned tombstone cannot
+* be served as a portable object, so the response is the same as for
+* an object that this server does not store, i.e., `404 Not Found`.
+* @template TContextData The context data to pass to the context.
+* @param request The HTTP request.
+* @param parameters The parameters for handling the portable object.
+* @returns A promise that resolves to an HTTP response.
+*/
+async function handlePortableObject(request, { values, context, objectDispatcher, authorizePredicate, canonicalId, kind, onNotFound, onUnauthorized }) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"object"
+	]);
+	if (objectDispatcher == null) return await onNotFound(request);
+	const object = await objectDispatcher(context, values);
+	if (object == null) return await onNotFound(request);
+	if (!isRequestedPortableObject(object, canonicalId)) {
+		logger.debug("The object {objectId} does not match the requested portable object {portableId}.", {
+			objectId: object.id?.href,
+			portableId: canonicalId
+		});
+		return await onNotFound(request);
+	}
+	if (authorizePredicate != null) {
+		if (!await authorizePredicate(context, values)) return await onUnauthorized(request);
+	}
+	const contextLoader = getNormalizationContextLoader(context.contextLoader);
+	let jsonLd;
+	let root;
+	try {
+		jsonLd = await object.toJsonLd(context);
+		root = await expandJsonLdRoot(jsonLd, contextLoader);
+	} catch (error) {
+		logger.error("Failed to serialize the portable object {portableId}:\n{error}", {
+			portableId: canonicalId,
+			error
+		});
+		return portableObjectInternalServerError(request);
+	}
+	const servedId = root?.["@id"];
+	if (root == null || typeof servedId !== "string" || !isRequestedPortableId(servedId, canonicalId)) {
+		logger.debug("The serialized object does not match the requested portable object {portableId}.", { portableId: canonicalId });
+		return await onNotFound(request);
+	}
+	if (authorizePredicate == null && kind === "object" && !isActor(object) && !isPubliclyAddressedNode(root)) {
+		logger.debug("Not serving the portable object {portableId}, as it is not publicly addressed and its object dispatcher has no authorization predicate; responding as if this server did not store the object.  Set an authorization predicate that checks if the request is signed by an actor in the object's audience to serve it.", { portableId: canonicalId });
+		return await onNotFound(request);
+	}
+	let result;
+	try {
+		result = await verifyPortableObjectProof(jsonLd, {
+			contextLoader,
+			documentLoader: context.documentLoader,
+			tracerProvider: context.tracerProvider,
+			meterProvider: context.meterProvider
+		});
+	} catch (error) {
+		logger.error("Failed to verify the Object Integrity Proofs of the portable object {portableId}:\n{error}", {
+			portableId: canonicalId,
+			error
+		});
+		return portableObjectInternalServerError(request);
+	}
+	const tombstone = object instanceof Tombstone;
+	if (!result.verified) {
+		if (tombstone && result.reason.type === "missingProof") {
+			logger.debug("Not serving the tombstone of the portable object {portableId}, as it has no Object Integrity Proof; responding as if this server did not store the object.", { portableId: canonicalId });
+			return await onNotFound(request);
+		}
+		if (tombstone || result.reason.type !== "unsecuredCollection" && result.reason.type !== "unsupportedObjectType") {
+			if (result.reason.type === "invalidGateways") logger.error("Refusing to serve the portable actor {portableId}, as its gateways property is missing, empty, or has an item that is not an HTTP(S) origin.  FEP-ef61 requires a portable actor to list at least one gateway where it can be retrieved.", {
+				portableId: canonicalId,
+				reason: result.reason.type
+			});
+			else logger.error("Refusing to serve the portable object {portableId}, as it does not satisfy the FEP-ef61 proof policy: {reason}.  Portable actors, activities, objects, and tombstones need an Object Integrity Proof made with a key of the DID in their ID.", {
+				portableId: canonicalId,
+				reason: result.reason.type
+			});
+			return portableObjectInternalServerError(request);
+		}
+	}
+	if (!tombstone) await warnServedCompatibleObject(context, object, servedId);
+	const headers = new Headers({
+		"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
+		Vary: "Accept"
+	});
+	if (authorizePredicate != null) headers.set("Cache-Control", "private");
+	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), {
+		status: tombstone ? 410 : 200,
+		headers
+	});
+}
+async function warnServedCompatibleObject(context, object, serializedId) {
+	try {
+		if (isActor(object)) return;
+		const id = typeof serializedId === "string" ? parseIri(serializedId) : serializedId ?? object.id;
+		if (id == null || !isCompatibleEf61Iri(id)) return;
+		const did = getPortableDid(id);
+		if (did == null) return;
+		const ownerIds = object instanceof Activity ? object.actorIds : object.attributionIds;
+		for (const ownerId of ownerIds) {
+			if (getPortableDid(ownerId) !== did) continue;
+			const gateway = await getLocalFirstGateway(context, ownerId, did);
+			if (gateway == null) continue;
+			warnCompatibleId(id, did, gateway, object instanceof Activity ? "activity" : "object");
+			break;
+		}
+	} catch (error) {
+		getLogger([
+			"fedify",
+			"federation",
+			"object"
+		]).debug("Could not check the first gateway of {objectId}: {error}", {
+			objectId: object.id?.href,
+			error
+		});
+	}
+}
+function isRequestedPortableObject(object, canonicalId) {
+	return object.id != null && getCanonicalPortableId(object.id) === canonicalId;
+}
+async function expandJsonLdRoot(jsonLd, contextLoader) {
+	const expanded = await jsonld.expand(jsonLd, {
+		documentLoader: contextLoader,
+		keepFreeFloatingNodes: true
+	});
+	if (expanded.length !== 1) return null;
+	return expanded[0];
+}
+function isRequestedPortableId(id, canonicalId) {
+	if (!/^ap(?:\+ef61)?:\/\//i.test(id)) return URL.canParse(id) && getCanonicalPortableId(new URL(id)) === canonicalId;
+	try {
+		return canonicalizePortableUri(id) === canonicalId;
+	} catch (error) {
+		if (error instanceof TypeError) return false;
+		throw error;
+	}
+}
+function portableObjectInternalServerError(request) {
+	return new Response(request.method === "HEAD" ? null : "Internal server error.", {
+		status: 500,
+		headers: { "Content-Type": "text/plain; charset=utf-8" }
+	});
+}
+/**
+* Checks the portable objects embedded in a portable collection or its page
+* that is about to be served against the FEP-ef61 proof policy.  See
+* `verifyServedPortableObjects()`.
+* @returns `true` if the collection can be served.
+*/
+async function verifyPortableCollection(jsonLd, context, portable) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"collection"
+	]);
+	try {
+		const result = await verifyServedPortableObjects(jsonLd, {
+			contextLoader: context.contextLoader,
+			documentLoader: context.documentLoader,
+			tracerProvider: context.tracerProvider,
+			meterProvider: context.meterProvider
+		});
+		if (result.verified) return true;
+		logger.error("Refusing to serve the portable collection {collectionId}, as the portable object {objectId} it embeds at {path} does not satisfy the FEP-ef61 proof policy: {reason}.  Embedded portable actors, activities, and objects need an Object Integrity Proof made with a key of the DID in their ID, and their own @context.", {
+			collectionId: portable.id.href,
+			objectId: result.id,
+			path: result.path,
+			reason: result.reason
+		});
+	} catch (error) {
+		logger.error("Failed to verify the portable objects embedded in the portable collection {collectionId}:\n{error}", {
+			collectionId: portable.id.href,
+			error
+		});
+	}
+	return false;
+}
+function respondWithPortableCollection(request, jsonLd) {
+	return new Response(request.method === "HEAD" ? null : JSON.stringify(jsonLd), { headers: {
+		"Content-Type": PORTABLE_OBJECT_CONTENT_TYPE,
+		Vary: "Accept"
+	} });
+}
+const BUILT_IN_COLLECTION_METRIC_KINDS = /* @__PURE__ */ new Set([
 	"inbox",
 	"outbox",
 	"following",
@@ -637,13 +1726,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$1.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$2.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$1),
+		kind: getCollectionMetricKind(name$2),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -661,8 +1750,13 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 	};
 	try {
 		if (collectionCallbacks == null) return finish(await onNotFound(request), "not_found");
+		if (portable != null && collectionCallbacks.authorizePredicate != null) {
+			if (!await collectionCallbacks.authorizePredicate(context, identifier)) return finish(await onUnauthorized(request), "unauthorized");
+		}
 		let collection;
-		const baseUri = uriGetter(identifier);
+		const baseUri = portable?.id ?? uriGetter(identifier);
+		const pageBase = portable?.view ?? context.url;
+		const attribution = portable?.attribution ?? null;
 		if (cursor == null) {
 			const firstCursor = await collectionCallbacks.firstCursor?.(context, identifier);
 			const totalItems = filter == null ? await collectionCallbacks.counter?.(context, identifier) : void 0;
@@ -684,7 +1778,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$1, filterPredicate);
+						const items = filterCollectionItems(page.items, name$2, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -702,29 +1796,31 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 				if (itemsOrResponse instanceof Response) return finish(itemsOrResponse, "not_found");
 				collection = new OrderedCollection({
 					id: baseUri,
-					totalItems: totalItemCount ?? null,
+					attribution,
+					totalItems: totalItemCount ?? (portable == null ? null : itemsOrResponse.length),
 					items: itemsOrResponse
 				});
 			} else {
 				const lastCursor = await collectionCallbacks.lastCursor?.(context, identifier);
-				const first = new URL(context.url);
+				const first = new URL(pageBase);
 				first.searchParams.set("cursor", firstCursor);
 				let last = null;
 				if (lastCursor != null) {
-					last = new URL(context.url);
+					last = new URL(pageBase);
 					last.searchParams.set("cursor", lastCursor);
 				}
 				collection = new OrderedCollection({
 					id: baseUri,
+					attribution,
 					totalItems: totalItemCount ?? null,
 					first,
 					last
 				});
 			}
 		} else {
-			const uri = new URL(baseUri);
+			const uri = new URL(portable == null ? baseUri : pageBase);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -740,7 +1836,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$1, filterPredicate);
+					const items = filterCollectionItems(page.items, name$2, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -762,28 +1858,30 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 			const { items, prevCursor, nextCursor } = pageOrResponse;
 			let prev = null;
 			if (prevCursor != null) {
-				prev = new URL(context.url);
+				prev = new URL(pageBase);
 				prev.searchParams.set("cursor", prevCursor);
 			}
 			let next = null;
 			if (nextCursor != null) {
-				next = new URL(context.url);
+				next = new URL(pageBase);
 				next.searchParams.set("cursor", nextCursor);
 			}
-			const partOf = new URL(context.url);
+			const partOf = new URL(pageBase);
 			partOf.searchParams.delete("cursor");
 			collection = new OrderedCollectionPage({
 				id: uri,
+				attribution,
 				prev,
 				next,
 				items,
 				partOf
 			});
 		}
-		if (collectionCallbacks.authorizePredicate != null) {
+		if (portable == null && collectionCallbacks.authorizePredicate != null) {
 			if (!await collectionCallbacks.authorizePredicate(context, identifier)) return finish(await onUnauthorized(request), "unauthorized");
 		}
 		const jsonLd = await collection.toJsonLd(context);
+		if (portable != null) return await verifyPortableCollection(jsonLd, context, portable) ? finish(respondWithPortableCollection(request, jsonLd), "served") : finish(portableObjectInternalServerError(request), "error");
 		return finish(new Response(JSON.stringify(jsonLd), { headers: {
 			"Content-Type": "application/activity+json",
 			Vary: "Accept"
@@ -950,7 +2048,7 @@ async function handleOutbox(request, { identifier, context: ctx, outboxContextFa
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
-	if (!activity.actorIds.every((actorId) => actorId.href === expectedActorId.href)) {
+	if (!activity.actorIds.every((actorId) => isSameObjectId(actorId, expectedActorId))) {
 		const error = /* @__PURE__ */ new Error("The activity actor does not match the outbox owner.");
 		logger.error("The posted activity actor does not match outbox owner {identifier}.", {
 			identifier,
@@ -1219,6 +2317,16 @@ async function handleMediaUpload(request, { identifier, context: ctx, mediaUploa
 * @returns A promise that resolves to an HTTP response.
 */
 async function handleInbox(request, options) {
+	if (options.observation == null) {
+		const observation = new InboxObservation({
+			kind: options.portableInbox != null ? "portable" : options.recipient == null ? "shared" : "personal",
+			recipient: options.recipient
+		});
+		return await observation.runAndFinish(() => options.context, options.inboxRequestFinishedHandler, () => handleInbox(request, {
+			...options,
+			observation
+		}));
+	}
 	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("activitypub.inbox", {
 		kind: options.queue == null ? SpanKind.SERVER : SpanKind.PRODUCER,
 		attributes: { "activitypub.shared_inbox": options.recipient == null }
@@ -1227,12 +2335,14 @@ async function handleInbox(request, options) {
 		try {
 			return await handleInboxInternal(request, options, span);
 		} catch (e) {
+			options.observation.hasException = true;
 			span.setStatus({
 				code: SpanStatusCode.ERROR,
 				message: String(e)
 			});
 			throw e;
 		} finally {
+			options.observation.project(span);
 			span.end();
 		}
 	});
@@ -1246,7 +2356,9 @@ async function handleInbox(request, options) {
 * @returns A promise that resolves to an HTTP response.
 */
 async function handleInboxInternal(request, parameters, span) {
-	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider } = parameters;
+	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, publicKeyTtl, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, maxHttpSignatures, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider, portableInbox } = parameters;
+	const observation = parameters.observation;
+	const signatureObservation = { [verificationObservation]: observation.verification };
 	const logger = getLogger([
 		"fedify",
 		"federation",
@@ -1259,7 +2371,7 @@ async function handleInboxInternal(request, parameters, span) {
 			message: "Actor dispatcher is not set."
 		});
 		return await onNotFound(request);
-	} else if (recipient != null) {
+	} else if (recipient != null && portableInbox == null) {
 		const actor = await actorDispatcher(ctx, recipient);
 		if (actor == null || actor instanceof Tombstone) {
 			logger.error("Actor {recipient} not found.", { recipient });
@@ -1271,6 +2383,10 @@ async function handleInboxInternal(request, parameters, span) {
 		}
 	}
 	if (request.bodyUsed) {
+		observation.result = {
+			disposition: "failed",
+			reason: "bodyUnavailable"
+		};
 		logger.error("Request body has already been read.", { recipient });
 		span.setStatus({
 			code: SpanStatusCode.ERROR,
@@ -1281,6 +2397,10 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	} else if (request.body?.locked) {
+		observation.result = {
+			disposition: "failed",
+			reason: "bodyUnavailable"
+		};
 		logger.error("Request body is locked.", { recipient });
 		span.setStatus({
 			code: SpanStatusCode.ERROR,
@@ -1291,10 +2411,27 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	observation.stage = "parse";
+	observation.result = {
+		disposition: "rejected",
+		reason: "invalidJson"
+	};
 	let json;
 	try {
-		json = await request.clone().json();
+		json = JSON.parse(await readBoundedText(request.clone(), MAX_BODY_SIZE, request.url));
 	} catch (error) {
+		if (error instanceof BodyTooLargeError) {
+			observation.result = {
+				disposition: "rejected",
+				reason: "bodyTooLarge"
+			};
+			request.body?.cancel(error).catch(() => {});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: String(error)
+			});
+			return new Response("Inbox body too large.", { status: 413 });
+		}
 		logger.error("Failed to parse JSON:\n{error}", {
 			recipient,
 			error
@@ -1317,7 +2454,21 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
-	const keyCache = new KvKeyCache(kv, kvPrefixes.publicKey, ctx);
+	observation.payload = {
+		status: "parsed",
+		value: structuredClone(json)
+	};
+	observation.result = {
+		disposition: "rejected",
+		reason: "invalidActivity"
+	};
+	observation.stage = "verify";
+	const keyCache = new KvKeyCache(kv, kvPrefixes.publicKey, {
+		documentLoader: ctx.documentLoader,
+		contextLoader: ctx.contextLoader,
+		tracerProvider,
+		keyTtl: publicKeyTtl
+	});
 	const jsonWithoutSig = detachSignature(json);
 	const hasLdSignature = hasSignature(json);
 	const canAttemptAlternateAuthAfterLdSignatureFailure = skipSignatureVerification || hasHttpSignatureHeaders(request) || hasObjectIntegrityProof(jsonWithoutSig);
@@ -1341,6 +2492,10 @@ async function handleInboxInternal(request, parameters, span) {
 			code: SpanStatusCode.ERROR,
 			message: `Failed to parse activity:\n${error}`
 		});
+		observation.result = {
+			disposition: "rejected",
+			reason: "invalidActivity"
+		};
 		return new Response("Invalid activity.", {
 			status: 400,
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
@@ -1358,11 +2513,25 @@ async function handleInboxInternal(request, parameters, span) {
 					recipient,
 					error
 				});
+				observation.result = {
+					disposition: "rejected",
+					reason: "invalidJsonLd"
+				};
 				return new Response("Invalid JSON-LD.", {
 					status: 400,
 					headers: { "Content-Type": "text/plain; charset=utf-8" }
 				});
 			}
+			observation.verification.attempts.push({
+				mechanism: "linkedData",
+				subject: {
+					id: null,
+					pointer: ""
+				},
+				checks: [],
+				status: "error",
+				error
+			});
 			if (!canAttemptAlternateAuthAfterLdSignatureFailure) throw error;
 			if (!skipSignatureVerification) deferredLdSignatureError = error;
 			logger.debug("Failed to normalize JSON-LD for Linked Data Signatures; deferring to another authentication path only if it verifies:\n{error}", {
@@ -1374,6 +2543,7 @@ async function handleInboxInternal(request, parameters, span) {
 			compactedJsonWithoutSig = detachSignature(compactedJson);
 			try {
 				ldSigVerified = await verifyCompactJsonLd(compactedJson, {
+					...signatureObservation,
 					contextLoader: ctx.contextLoader,
 					documentLoader: ctx.documentLoader,
 					keyCache,
@@ -1387,6 +2557,10 @@ async function handleInboxInternal(request, parameters, span) {
 						recipient,
 						error
 					});
+					observation.result = {
+						disposition: "rejected",
+						reason: "invalidJsonLd"
+					};
 					return new Response("Invalid JSON-LD.", {
 						status: 400,
 						headers: { "Content-Type": "text/plain; charset=utf-8" }
@@ -1406,6 +2580,10 @@ async function handleInboxInternal(request, parameters, span) {
 							recipient,
 							error: parseError
 						});
+						observation.result = {
+							disposition: "rejected",
+							reason: "invalidJsonLd"
+						};
 						return new Response("Invalid JSON-LD.", {
 							status: 400,
 							headers: { "Content-Type": "text/plain; charset=utf-8" }
@@ -1419,13 +2597,14 @@ async function handleInboxInternal(request, parameters, span) {
 	}
 	let activity = null;
 	let activityVerified = false;
+	let proofVerified = false;
 	if (ldSigVerified) {
 		logger.debug("Linked Data Signatures are verified.", {
 			recipient,
 			json
 		});
 		try {
-			activity = await Activity.fromJsonLd(compactedJsonWithoutSig, {
+			activity = observation.activity = await Activity.fromJsonLd(compactedJsonWithoutSig, {
 				...ctx,
 				contextLoader: getNormalizationContextLoader(ctx.contextLoader)
 			});
@@ -1435,6 +2614,22 @@ async function handleInboxInternal(request, parameters, span) {
 			return await respondInvalidActivity(error);
 		}
 		activityVerified = true;
+		if (!skipSignatureVerification && isPortableActivity(activity)) try {
+			proofVerified = await verifyObject(Activity, jsonWithoutSig, {
+				...signatureObservation,
+				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
+				documentLoader: ctx.documentLoader,
+				keyCache,
+				meterProvider,
+				tracerProvider
+			}) != null;
+		} catch (error) {
+			if (!isPermanentActivityParseError(error)) throw error;
+			logger.debug("Failed to verify the Object Integrity Proofs of the portable actor's activity:\n{error}", {
+				recipient,
+				error
+			});
+		}
 	} else {
 		logger.debug("Linked Data Signatures are not verified.", {
 			recipient,
@@ -1442,11 +2637,13 @@ async function handleInboxInternal(request, parameters, span) {
 		});
 		try {
 			activity = await verifyObject(Activity, jsonWithoutSig, {
+				...signatureObservation,
 				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
 				documentLoader: ctx.documentLoader,
 				keyCache,
 				meterProvider,
-				tracerProvider
+				tracerProvider,
+				verifyPortableObject: ctx.verifyPortableObject
 			});
 		} catch (error) {
 			if (error instanceof RangeError && await hasMalformedKnownTemporalLiteral(jsonWithoutSig, ctx.contextLoader)) return await respondInvalidActivity(error);
@@ -1476,6 +2673,10 @@ async function handleInboxInternal(request, parameters, span) {
 				code: SpanStatusCode.ERROR,
 				message: `Failed to parse activity:\n${error}`
 			});
+			observation.result = {
+				disposition: "rejected",
+				reason: "invalidActivity"
+			};
 			return new Response("Invalid activity.", {
 				status: 400,
 				headers: { "Content-Type": "text/plain; charset=utf-8" }
@@ -1491,6 +2692,7 @@ async function handleInboxInternal(request, parameters, span) {
 				activity: json
 			});
 			activityVerified = true;
+			proofVerified = true;
 		}
 	}
 	let httpSigKey = null;
@@ -1498,15 +2700,25 @@ async function handleInboxInternal(request, parameters, span) {
 	if (activity == null) {
 		if (!skipSignatureVerification) {
 			const verification = await verifyRequestDetailed(request, {
+				...signatureObservation,
 				contextLoader: ctx.contextLoader,
 				documentLoader: ctx.documentLoader,
 				timeWindow: signatureTimeWindow,
+				maxSignatures: maxHttpSignatures,
 				keyCache,
 				meterProvider,
 				tracerProvider
 			});
 			if (verification.verified === false) {
 				if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+				observation.authentication = {
+					status: "rejected",
+					reason: { type: "verificationFailed" }
+				};
+				observation.result = {
+					disposition: "rejected",
+					reason: "authentication"
+				};
 				const reason = verification.reason;
 				const remoteHost = "keyId" in reason && reason.keyId != null ? getRemoteHost(reason.keyId) : void 0;
 				getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure(reason.type, remoteHost);
@@ -1521,7 +2733,7 @@ async function handleInboxInternal(request, parameters, span) {
 				});
 				if (unverifiedActivityHandler == null) return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 				try {
-					activity = await Activity.fromJsonLd(jsonWithoutSig, ctx);
+					activity = observation.activity = await Activity.fromJsonLd(jsonWithoutSig, ctx);
 				} catch (error) {
 					logger.error("Failed to parse activity:\n{error}", {
 						recipient,
@@ -1537,6 +2749,10 @@ async function handleInboxInternal(request, parameters, span) {
 							recipient
 						});
 					}
+					observation.result = {
+						disposition: "rejected",
+						reason: "invalidActivity"
+					};
 					return new Response("Invalid activity.", {
 						status: 400,
 						headers: { "Content-Type": "text/plain; charset=utf-8" }
@@ -1559,6 +2775,11 @@ async function handleInboxInternal(request, parameters, span) {
 				try {
 					response = await unverifiedActivityHandler(ctx, activity, reason);
 				} catch (error) {
+					observation.result = {
+						disposition: "failed",
+						reason: "listenerError",
+						error
+					};
 					logger.error("An unexpected error occurred in unverified activity handler:\n{error}", {
 						error,
 						activity: json,
@@ -1575,7 +2796,10 @@ async function handleInboxInternal(request, parameters, span) {
 					}
 					return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 				}
-				if (response instanceof Response) return response;
+				if (response instanceof Response) {
+					observation.result = { disposition: "customResponse" };
+					return response;
+				}
 				return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 			} else {
 				if (inboxChallengePolicy?.enabled && inboxChallengePolicy.requestNonce) pendingNonceLabel = verification.signatureLabel;
@@ -1585,7 +2809,7 @@ async function handleInboxInternal(request, parameters, span) {
 			httpSigKey = verification.key;
 		}
 		try {
-			activity = await Activity.fromJsonLd(jsonWithoutSig, {
+			activity = observation.activity = await Activity.fromJsonLd(jsonWithoutSig, {
 				...ctx,
 				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader)
 			});
@@ -1594,6 +2818,12 @@ async function handleInboxInternal(request, parameters, span) {
 			return await respondInvalidActivity(error);
 		}
 	}
+	observation.activity = activity;
+	observation.stage = "policy";
+	observation.result = {
+		disposition: "rejected",
+		reason: "authentication"
+	};
 	if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
 	span.setAttribute("activitypub.activity.type", getTypeId(activity).href);
 	span.addEvent("activitypub.activity.received", {
@@ -1603,8 +2833,83 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.verified": httpSigKey != null,
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
+	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableActorKey(httpSigKey))) {
+		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+		observation.authentication = {
+			status: "rejected",
+			reason: {
+				type: "proofPolicy",
+				policy: "portableActor"
+			}
+		};
+		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
+			activity: json,
+			recipient,
+			activityId: activity.id?.href,
+			actorId: activity.actorId?.href,
+			keyId: httpSigKey?.id?.href
+		});
+		span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: `The activity of the portable actor (${activity.actorId?.href}) is not authenticated by a valid Object Integrity Proof.`
+		});
+		return new Response("Activities of portable actors must have valid Object Integrity Proofs.", {
+			status: 401,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
+	if (!skipSignatureVerification && activity.id != null && isPortableId(activity.id)) {
+		const rejection = await observeAttempt(signatureObservation, "objectIntegrity", async (verification) => {
+			const rejection = await verifyPortableActivityId(activity.id, jsonWithoutSig, {
+				[verificationObservation]: verification,
+				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
+				documentLoader: ctx.documentLoader,
+				keyCache,
+				meterProvider,
+				tracerProvider
+			});
+			if (rejection != null) verification.attempt.reason = {
+				type: "proofPolicy",
+				reason: rejection
+			};
+			return rejection;
+		}, (value) => value == null);
+		if (rejection != null) {
+			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+			observation.authentication = {
+				status: "rejected",
+				reason: {
+					type: "proofPolicy",
+					policy: "portableActivity",
+					detail: rejection
+				}
+			};
+			logger.error("The portable activity {activityId} is not authenticated by an Object Integrity Proof of its own DID: {reason}", {
+				activity: json,
+				recipient,
+				activityId: activity.id.href,
+				reason: rejection.type
+			});
+			span.setStatus({
+				code: SpanStatusCode.ERROR,
+				message: `The portable activity (${activity.id.href}) is not authenticated by an Object Integrity Proof of its own DID.`
+			});
+			return new Response("Portable activities must have valid Object Integrity Proofs made by their own DIDs.", {
+				status: 401,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+	}
 	if (httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+		observation.authentication = {
+			status: "rejected",
+			reason: {
+				type: "actorKeyMismatch",
+				key: snapshotKey(httpSigKey),
+				actorIds: activity.actorIds.map((id) => new URL(id.href))
+			}
+		};
 		getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("actorKeyMismatch", httpSigKey.id == null ? void 0 : getRemoteHost(httpSigKey.id));
 		logger.error("The signer ({keyId}) and the actor ({actorId}) do not match.", {
 			activity: json,
@@ -1621,13 +2926,70 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	if (!skipSignatureVerification) {
+		const compoundJson = Array.isArray(json) ? json : jsonWithoutSig;
+		if (inspectCompoundPortableObjectApplicability(compoundJson, INBOX_COMPOUND_PROOF_LIMITS) !== "absent") {
+			const compoundProof = await observeAttempt(signatureObservation, "objectIntegrity", async (verification) => {
+				const result = await verifyCompoundPortableObjectProofs(compoundJson, INBOX_COMPOUND_PROOF_LIMITS, {
+					[verificationObservation]: verification,
+					documentLoader: ctx.documentLoader,
+					keyCache,
+					meterProvider,
+					tracerProvider
+				});
+				if (result.status === "unsupported") verification.attempt.reason = {
+					type: "proofPolicy",
+					reason: result.reason
+				};
+				else if (!result.verified) {
+					const failed = result.portableObjects.find((object) => !object.verified);
+					verification.attempt.reason = {
+						type: "proofPolicy",
+						reason: failed?.verified === false ? failed.reason : { type: "invalidProof" }
+					};
+				}
+				return result;
+			}, (result) => result.status === "ok" && result.verified);
+			if (compoundProof.status !== "ok" || !compoundProof.verified) {
+				observation.authentication = {
+					status: "rejected",
+					reason: {
+						type: "proofPolicy",
+						policy: "compound"
+					}
+				};
+				logger.error("Failed to verify compound portable Object Integrity Proofs.", {
+					recipient,
+					activity: json,
+					reason: compoundProof.status === "unsupported" ? compoundProof.reason.type : "invalidProof"
+				});
+				span.setStatus({
+					code: SpanStatusCode.ERROR,
+					message: "Failed to verify compound portable Object Integrity Proofs."
+				});
+				return new Response("Failed to verify compound portable Object Integrity Proofs.", {
+					status: 401,
+					headers: { "Content-Type": "text/plain; charset=utf-8" }
+				});
+			}
+		}
+	}
 	if (pendingNonceLabel != null) {
 		if (!await verifySignatureNonce(request, kv, kvPrefixes.acceptSignatureNonce, pendingNonceLabel)) {
+			observation.authentication = {
+				status: "rejected",
+				reason: { type: "invalidNonce" }
+			};
 			getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("invalidNonce", httpSigKey?.id == null ? void 0 : getRemoteHost(httpSigKey.id));
 			logger.error("Signature nonce verification failed (missing, expired, or replayed).", { recipient });
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
 	}
+	observation.authentication = skipSignatureVerification ? { status: "skipped" } : {
+		status: "verified",
+		attempts: observation.verification.attempts.filter((attempt) => attempt.status === "verified")
+	};
+	observation.stage = "dispatch";
 	const routeResult = await routeActivity({
 		context: ctx,
 		json,
@@ -1639,7 +3001,14 @@ async function handleInboxInternal(request, parameters, span) {
 		inboxListeners,
 		inboxContextFactory,
 		listenerInboxContextFactory: ldSigVerified ? inboxContextFactory[rawInboxContextFactorySymbol] : void 0,
-		inboxErrorHandler,
+		inboxErrorHandler: async (context, error) => {
+			observation.result = {
+				disposition: "failed",
+				reason: "listenerError",
+				error
+			};
+			await inboxErrorHandler?.(context, error);
+		},
 		kv,
 		kvPrefixes,
 		queue,
@@ -1648,31 +3017,78 @@ async function handleInboxInternal(request, parameters, span) {
 		tracerProvider,
 		idempotencyStrategy: parameters.idempotencyStrategy
 	});
-	if (routeResult === "alreadyProcessed") return new Response(`Activity <${activity.id}> has already been processed.`, {
-		status: 202,
-		headers: { "Content-Type": "text/plain; charset=utf-8" }
-	});
-	else if (routeResult === "missingActor") return new Response("Missing actor.", {
-		status: 400,
-		headers: { "Content-Type": "text/plain; charset=utf-8" }
-	});
-	else if (routeResult === "enqueued") return new Response("Activity is enqueued.", {
-		status: 202,
-		headers: { "Content-Type": "text/plain; charset=utf-8" }
-	});
-	else if (routeResult === "unsupportedActivity") return new Response("", {
-		status: 202,
-		headers: { "Content-Type": "text/plain; charset=utf-8" }
+	if (portableInbox != null && activity.id != null && PORTABLE_INBOX_FORWARDABLE_RESULTS.has(routeResult)) if (skipSignatureVerification || !(ldSigVerified || proofVerified)) logger.debug("Not forwarding activity {activityId} to the other gateways of the portable inbox {inbox}, as it is not authenticated by its own proof.", {
+		activityId: activity.id.href,
+		inbox: portableInbox.recipient.canonicalInboxId
 	});
-	else if (routeResult === "error") return new Response("Internal server error.", {
+	else try {
+		await portableInbox.forward(json, activity.id, getTypeId(activity).href, listRequestSignatures(request, maxHttpSignatures).map((signature) => ({
+			keyId: signature.keyId,
+			coversDelivery: coversDelivery(signature),
+			verify: async () => {
+				const verification = await verifyRequestDetailed(selectRequestSignature(request, signature), {
+					contextLoader: ctx.contextLoader,
+					documentLoader: ctx.documentLoader,
+					timeWindow: signatureTimeWindow,
+					keyCache,
+					meterProvider,
+					tracerProvider
+				});
+				return verification.verified ? verification.key : null;
+			}
+		})));
+	} catch (error) {
+		logger.error("Failed to forward activity {activityId} to the other gateways of the portable inbox {inbox}:\n{error}", {
+			activityId: activity.id.href,
+			inbox: portableInbox.recipient.canonicalInboxId,
+			error
+		});
+	}
+	if (routeResult === "alreadyProcessed") {
+		observation.result = { disposition: "duplicate" };
+		return new Response(`Activity <${activity.id}> has already been processed.`, {
+			status: 202,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	} else if (routeResult === "missingActor") {
+		observation.result = {
+			disposition: "rejected",
+			reason: "missingActor"
+		};
+		return new Response("Missing actor.", {
+			status: 400,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	} else if (routeResult === "enqueued") {
+		observation.result = { disposition: "enqueued" };
+		return new Response("Activity is enqueued.", {
+			status: 202,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	} else if (routeResult === "unsupportedActivity") {
+		observation.result = { disposition: "unhandled" };
+		return new Response("", {
+			status: 202,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	} else if (routeResult === "error") return new Response("Internal server error.", {
 		status: 500,
 		headers: { "Content-Type": "text/plain; charset=utf-8" }
 	});
-	else return new Response("", {
-		status: 202,
-		headers: { "Content-Type": "text/plain; charset=utf-8" }
-	});
+	else {
+		observation.result = { disposition: "processed" };
+		return new Response("", {
+			status: 202,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 }
+const PORTABLE_INBOX_FORWARDABLE_RESULTS = /* @__PURE__ */ new Set([
+	"success",
+	"enqueued",
+	"alreadyProcessed",
+	"unsupportedActivity"
+]);
 /**
 * Handles a custom collection request.
 * @template TItem The type of items in the collection.
@@ -1697,19 +3113,11 @@ function recordDeferredPendingCollectionMetrics(error, result, response) {
 	pendingCollectionMetricRecorders.delete(error);
 	recorder?.(result, response);
 }
-async function _handleCustomCollection(request, { name, values, context, tracerProvider, meterProvider, collectionCallbacks: callbacks, filterPredicate }) {
+async function _handleCustomCollection(request, { name, values, context, tracerProvider, meterProvider, collectionCallbacks: callbacks, filterPredicate, portable }) {
 	verifyDefined(callbacks);
 	await authIfNeeded(context, values, callbacks);
 	const cursor = new URL(request.url).searchParams.get("cursor");
-	const handler = new CustomCollectionHandler(name, values, context, callbacks, tracerProvider, meterProvider, Collection, CollectionPage, filterPredicate).fetchCollection(cursor);
-	try {
-		const response = await handler.toJsonLd().then(respondAsActivity);
-		handler.recordPendingCollectionMetrics("served", response);
-		return response;
-	} catch (e) {
-		if (!deferPendingCollectionMetrics(e, (result, response) => handler.recordPendingCollectionMetrics(result, response))) handler.recordPendingCollectionMetrics("error");
-		throw e;
-	}
+	return await respondWithCustomCollection(request, new CustomCollectionHandler(name, values, context, callbacks, tracerProvider, meterProvider, Collection, CollectionPage, filterPredicate, portable).fetchCollection(cursor), context, portable);
 }
 /**
 * Handles an ordered collection request.
@@ -1723,13 +3131,19 @@ async function _handleCustomCollection(request, { name, values, context, tracerP
 * @since 1.8.0
 */
 const handleOrderedCollection = exceptWrapper(_handleOrderedCollection);
-async function _handleOrderedCollection(request, { name, values, context, tracerProvider, meterProvider, collectionCallbacks: callbacks, filterPredicate }) {
+async function _handleOrderedCollection(request, { name, values, context, tracerProvider, meterProvider, collectionCallbacks: callbacks, filterPredicate, portable }) {
 	verifyDefined(callbacks);
 	await authIfNeeded(context, values, callbacks);
 	const cursor = new URL(request.url).searchParams.get("cursor");
-	const handler = new CustomCollectionHandler(name, values, context, callbacks, tracerProvider, meterProvider, OrderedCollection, OrderedCollectionPage, filterPredicate).fetchCollection(cursor);
+	return await respondWithCustomCollection(request, new CustomCollectionHandler(name, values, context, callbacks, tracerProvider, meterProvider, OrderedCollection, OrderedCollectionPage, filterPredicate, portable).fetchCollection(cursor), context, portable);
+}
+async function respondWithCustomCollection(request, handler, context, portable) {
 	try {
-		const response = await handler.toJsonLd().then(respondAsActivity);
+		const jsonLd = await handler.toJsonLd();
+		let response;
+		if (portable == null) response = respondAsActivity(jsonLd);
+		else if (await verifyPortableCollection(jsonLd, context, portable)) response = respondWithPortableCollection(request, jsonLd);
+		else throw new PortableCollectionRefusedError();
 		handler.recordPendingCollectionMetrics("served", response);
 		return response;
 	} catch (e) {
@@ -1759,6 +3173,7 @@ var CustomCollectionHandler = class {
 	Collection;
 	CollectionPage;
 	filterPredicate;
+	portable;
 	/**
 	* The tracer for telemetry.
 	* @type {Tracer}
@@ -1795,8 +3210,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate) {
-		this.name = name$2;
+	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
+		this.name = name$1;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -1805,9 +3220,14 @@ var CustomCollectionHandler = class {
 		this.Collection = Collection;
 		this.CollectionPage = CollectionPage;
 		this.filterPredicate = filterPredicate;
+		this.portable = portable;
 		this.name = this.name.trim().replace(/\s+/g, "_");
 		this.#tracer = this.tracerProvider.getTracer(name, version);
-		this.#id = new URL(this.context.url);
+		if (portable == null) this.#id = new URL(this.context.url);
+		else {
+			const cursor = this.context.url.searchParams.get("cursor");
+			this.#id = cursor == null ? new URL(portable.view) : appendCursorIfExists(portable.view, cursor);
+		}
 		this.#dispatcher = callbacks.dispatcher.bind(callbacks);
 	}
 	/**
@@ -1858,6 +3278,7 @@ var CustomCollectionHandler = class {
 		this.recordPendingCollectionItemCount(true, items.length);
 		return {
 			id,
+			attribution: this.portable?.attribution ?? null,
 			partOf,
 			items,
 			prev: this.appendToUrl(prevCursor),
@@ -1879,6 +3300,7 @@ var CustomCollectionHandler = class {
 		});
 		return {
 			id: this.#id,
+			attribution: this.portable?.attribution ?? null,
 			first: this.appendToUrl(firstCursor),
 			last: this.appendToUrl(lastCursor),
 			totalItems
@@ -1895,6 +3317,7 @@ var CustomCollectionHandler = class {
 		this.recordPendingCollectionItemCount(false, items.length);
 		return {
 			id: this.#id,
+			attribution: this.portable?.attribution ?? null,
 			totalItems,
 			items
 		};
@@ -2012,7 +3435,7 @@ var CustomCollectionHandler = class {
 	* @returns The URL with cursor appended, or null if cursor is null/undefined.
 	*/
 	appendToUrl(cursor) {
-		return appendCursorIfExists(this.context.url, cursor);
+		return appendCursorIfExists(this.portable?.view ?? this.context.url, cursor);
 	}
 	/**
 	* Gets the stored collection or collection page.
@@ -2089,6 +3512,12 @@ function exceptWrapper(handler) {
 					recordCollectionRequest(meterProvider, collectionAttributes(metricBase, "not_found", response));
 					return response;
 				}
+				case PortableCollectionRefusedError: {
+					const response = portableObjectInternalServerError(request);
+					recordDeferredPendingCollectionMetrics(error, "error", response);
+					recordCollectionRequest(meterProvider, collectionAttributes(metricBase, "error", response));
+					return response;
+				}
 				case UnauthorizedError: {
 					const response = await onUnauthorized(request);
 					recordDeferredPendingCollectionMetrics(error, "unauthorized", response);
@@ -2185,6 +3614,16 @@ var UnauthorizedError = class extends HandlerError {
 	}
 };
 /**
+* Error thrown when a portable collection is not served because it embeds
+* portable objects that do not satisfy the FEP-ef61 proof policy.
+* @since 2.4.0
+*/
+var PortableCollectionRefusedError = class extends HandlerError {
+	constructor() {
+		super("The portable collection embeds unverifiable portable objects.");
+	}
+};
+/**
 * Responds with the given object in JSON-LD format.
 *
 * @param object The object to respond with.
@@ -2211,7 +3650,7 @@ async function respondWithObjectIfAcceptable(object, request, options) {
 	return response;
 }
 function generateNonce() {
-	const bytes = new Uint8Array(16);
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
 	crypto.getRandomValues(bytes);
 	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
@@ -2264,22 +3703,310 @@ async function buildAcceptSignatureHeader(policy, kv, noncePrefix) {
 		parameters
 	}]);
 }
-async function setKey(kv, key, policy) {
-	const seconds = policy.nonceTtlSeconds ?? 300;
-	const ttl = Temporal.Duration.from({ seconds });
-	await kv.set(key, true, { ttl });
+async function setKey(kv, key, policy) {
+	const seconds = policy.nonceTtlSeconds ?? 300;
+	const ttl = Temporal.Duration.from({ seconds });
+	await kv.set(key, true, { ttl });
+}
+const DEF_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"@authority",
+	"content-digest"
+];
+const MIN_COMPONENTS = [
+	"@method",
+	"@target-uri",
+	"@authority"
+];
+/**
+* Checks whether an HTTP Signature key is a key of an FEP-ef61 portable
+* actor, i.e., its ID is a compatible identifier or an `ap:` or `ap+ef61:`
+* URI, and it is owned by a portable actor, which only the portable actor's
+* signed document can establish.
+*/
+function isPortableActorKey(key) {
+	return key?.id != null && isPortableKeyId(key.id) && key.ownerId != null && isPortableId(key.ownerId);
+}
+/**
+* Checks whether an activity needs an Object Integrity Proof by its DID:
+* either it is performed by an [FEP-ef61] portable actor, or its own ID is
+* portable.  Both `ap:` URIs and compatible identifiers count as portable.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*/
+function isPortableActivity(activity) {
+	return hasPortableActor(activity) || activity.id != null && isPortableId(activity.id);
+}
+/**
+* Verifies that a portable activity's own ID belongs to the DID that signed
+* it, on the JSON-LD document received.  The ID the proof policy checks has
+* to be the parsed activity's ID, so that a remote context that changes
+* between loads cannot make the two name different objects.
+* @returns `null` if the ID is verified, or the reason why it is not.
+*/
+async function verifyPortableActivityId(activityId, jsonLd, options) {
+	const expectedId = getCanonicalPortableId(activityId);
+	if (expectedId == null) return { type: "invalidObjectId" };
+	let verification;
+	try {
+		verification = await verifyPortableObjectProofWithRoot(jsonLd, options);
+	} catch (error) {
+		if (error instanceof InvalidPortableObjectIdError) return { type: "invalidObjectId" };
+		if (!isPermanentActivityParseError(error)) throw error;
+		return { type: "invalidDocument" };
+	}
+	const { result, root } = verification;
+	if (!result.verified) return result.reason;
+	const rootId = root?.["@id"];
+	if (typeof rootId !== "string" || getCanonicalPortableId(parseIri(rootId)) !== expectedId) return { type: "subjectMismatch" };
+	return null;
+}
+//#endregion
+//#region src/federation/portable-collection.ts
+/**
+* The query parameters of a gateway request for a portable collection that
+* do not select a view of the collection: the page cursor, and FEP-ef61
+* location hints (`@gateway`, and the legacy `gateways`).
+*/
+const NON_VIEW_PARAMETERS = /* @__PURE__ */ new Set([
+	"cursor",
+	"@gateway",
+	"gateways"
+]);
+/**
+* Checks that a collection requested through the FEP-ef61 gateway endpoint
+* belongs to a portable actor under the requested DID, and determines
+* the collection's ID from the actor.
+*
+* Collection dispatchers return items, not documents with IDs, so unlike
+* object dispatchers, there is nothing else to tell whether the requested
+* DID controls the collection.
+*
+* @param actor The actor that owns the collection according to
+*              the application, dispatched without the portable request,
+*              or `null` if there is none.
+* @param options The requested DID, and either the requested collection's
+*                canonical ID and the actor's property that has to refer to
+*                it (for the built-in collections of an actor), or
+*                the requested collection's portable ID (for a custom
+*                collection, whose ID has the same form as the actor's).
+* @returns The resolution.
+*/
+function resolvePortableCollectionOwner(actor, options) {
+	if (!isActor(actor)) return {
+		status: "rejected",
+		reason: "notFound"
+	};
+	const ownerId = actor.id;
+	const did = ownerId == null || !isPortableId(ownerId) ? null : getPortableDid(ownerId);
+	if (ownerId == null || did == null) return {
+		status: "rejected",
+		reason: "notPortable"
+	};
+	if (did !== options.authority) return {
+		status: "rejected",
+		reason: "authorityMismatch"
+	};
+	if ("portableId" in options) return {
+		status: "accepted",
+		ownerId,
+		collectionId: getCustomCollectionId(ownerId, actor, options.portableId)
+	};
+	const property = options.property(actor);
+	if (property == null || getCanonicalPortableId(property) !== options.canonicalId) return {
+		status: "rejected",
+		reason: "collectionMismatch"
+	};
+	const collectionId = new URL(property);
+	collectionId.search = "";
+	collectionId.hash = "";
+	return {
+		status: "accepted",
+		ownerId,
+		collectionId
+	};
+}
+/**
+* Gets the ID of a custom portable collection in the same form as its owner's
+* ID: a portable ID if the owner has one, or otherwise a compatible identifier
+* on the owner's first gateway, as FEP-ef61 requires of publishers.
+*/
+function getCustomCollectionId(ownerId, owner, portableId) {
+	if (isPortableUri(ownerId)) return portableId;
+	const gateway = owner.gateways[0];
+	if (gateway == null || !isGatewayUrl(gateway)) return portableId;
+	try {
+		return toCompatibleEf61Id(portableId, gateway);
+	} catch (error) {
+		if (error instanceof TypeError) return portableId;
+		throw error;
+	}
+}
+/**
+* Builds the URI that the pages of a portable collection are relative to:
+* the collection's ID with the query parameters of the requested view, e.g.,
+* a filter, but without the page cursor and location hints.
+* @param collectionId The ID of the collection.
+* @param requestUrl The URL of the gateway request.
+* @returns The view URI.
+*/
+function buildPortableCollectionView(collectionId, requestUrl) {
+	const view = new URL(collectionId);
+	for (const [name, value] of requestUrl.searchParams) if (!NON_VIEW_PARAMETERS.has(name)) view.searchParams.append(name, value);
+	return view;
+}
+//#endregion
+//#region src/federation/outgoing-proof.ts
+function formatKeyIds(candidates) {
+	return candidates.map((c) => c.verificationMethod.href).join(", ");
+}
+/**
+* Rejects an activity of a portable actor whose ID cannot be authenticated by
+* the actor's DID: FEP-ef61 requires the activity to be a portable object
+* signed by that DID, so its ID has to be a portable ID, i.e., an `ap:` or
+* `ap+ef61:` URI or a compatible identifier, with the same DID.  A portable
+* actor is one whose ID is such an ID as well.
+* @throws {TypeError} If the activity is performed by a portable actor, but
+*                     its ID is not a portable ID of the actor's DID, its
+*                     portable actors do not share a DID, or the ID of one of
+*                     them is a malformed compatible identifier.
+* @internal
+*/
+function assertPortableActorActivity(activity) {
+	const portableActors = activity.actorIds.filter((id) => isPortableId(id));
+	if (portableActors.length < 1) return;
+	const dids = portableActors.map((actorId) => {
+		const did = getPortableDid(actorId);
+		if (did == null) throw new TypeError(`The activity ${activity.id?.href} is performed by the actor ${actorId.href}, whose ID is a malformed FEP-ef61 portable ID.  A compatible identifier must have a valid DID and an object path, and must not have credentials or @gateway location hints.`);
+		return did;
+	});
+	const did = dids[0];
+	if (dids.some((d) => d !== did)) throw new TypeError(`The activity ${activity.id?.href} has portable actors with different DIDs (${portableActors.map((a) => a.href).join(", ")}); a portable activity is signed by a single DID.`);
+	if (activity.id == null || !isPortableId(activity.id) || getPortableDid(activity.id) !== did) throw new TypeError(`The activity ${activity.id?.href} is performed by the portable actor ${portableActors[0].href}, so its ID has to be an ap: or ap+ef61: URI, or an FEP-ef61 compatible identifier, with the same DID (${did}), as FEP-ef61 requires it to carry an Object Integrity Proof made by that DID.`);
+	if (!isCompatibleEf61Iri(activity.id)) return;
+	const mismatched = portableActors.find((actorId) => isCompatibleEf61Iri(actorId) && actorId.origin !== activity.id?.origin);
+	if (mismatched == null) return;
+	getLogger([
+		"fedify",
+		"federation",
+		"outbox"
+	]).warn("The activity {activityId} and its actor {actorId} are identified by FEP-ef61 compatible identifiers on different gateways.  FEP-ef61 requires publishers to use the first gateway in the actor's gateways when constructing compatible identifiers.", {
+		activityId: activity.id.href,
+		actorId: mismatched.href
+	});
+}
+/**
+* Creates the Object Integrity Proofs Fedify attaches to an outgoing activity.
+*
+* Keys whose IDs are FEP-ef61 compatible identifiers are gateway keys, which
+* never sign proofs.  A portable activity, i.e., one with an `ap:` or
+* `ap+ef61:` ID or a compatible identifier, that carries no proof is signed only by the one Ed25519 key
+* whose verification method is a DID URL for its DID, even if it is the only
+* key; if no key or more than one key qualifies, this function throws.
+*
+* Outside the map-local compound-proof profile, i.e., when the activity
+* embeds no portable object, every Ed25519 key signs the activity, as it
+* always has.  Inside the profile, which accepts exactly one direct proof per
+* map, Fedify creates at most one proof:
+*
+*  -  An activity that already carries a proof is kept as is.
+*  -  A single Ed25519 key signs a non-portable activity.
+*  -  With several Ed25519 keys, a non-portable activity is ambiguous, and
+*     this function throws.
+*
+* @throws {TypeError} If a single proof key cannot be chosen, or the activity
+*                     is performed by a portable actor but is not a portable
+*                     activity of the same DID.
+* @internal
+*/
+async function signOutgoingActivity(activity, candidates, options) {
+	const { contextLoader, tracerProvider } = options;
+	assertPortableActorActivity(activity);
+	const sign = async (selected) => {
+		for (const { verificationMethod, privateKey } of selected) activity = await signObject(activity, privateKey, verificationMethod, {
+			contextLoader,
+			tracerProvider
+		});
+		return {
+			activity,
+			hasProof: true,
+			proofCreated: true
+		};
+	};
+	let hasProof = false;
+	for await (const _ of activity.getProofs({ contextLoader })) {
+		hasProof = true;
+		break;
+	}
+	const keys = candidates.filter((c) => c.privateKey.algorithm.name === "Ed25519" && !isPortableKeyId(c.verificationMethod));
+	if (!hasProof && activity.id != null && isPortableId(activity.id)) return await sign(selectPortableActivityKey(activity, activity.id, keys));
+	if (keys.length < 1 || hasProof && !options.appendToExistingProofs) return {
+		activity,
+		hasProof,
+		proofCreated: false
+	};
+	if (keys.length < 2 && !hasProof) return await sign(keys);
+	if (!containsCompoundPortableObject(await activity.toJsonLd({
+		format: "compact",
+		contextLoader
+	}))) return await sign(keys);
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"outbox"
+	]);
+	const activityId = activity.id?.href;
+	if (hasProof) {
+		logger.debug("The activity {activityId} embeds portable objects and already carries a proof, so no further proof is added; the map-local compound-proof profile accepts exactly one direct proof per map.", { activityId });
+		return {
+			activity,
+			hasProof,
+			proofCreated: false
+		};
+	}
+	throw new TypeError(`Cannot choose an Object Integrity Proof key for the activity ${activityId}: it embeds portable objects, so it falls under the map-local compound-proof profile, which accepts exactly one direct proof per map, but ${keys.length} Ed25519 keys were supplied (${formatKeyIds(keys)}).  Send it with explicit sender keys that contain exactly one Ed25519 key (RSA keys for HTTP Signatures may stay), or sign it with signObject() before sending it.`);
+}
+/**
+* Chooses the one Ed25519 key that can sign a portable activity: the key
+* whose verification method is a DID URL for the activity's DID.
+* @throws {TypeError} If no key or more than one key qualifies.
+*/
+function selectPortableActivityKey(activity, activityId, keys) {
+	const activityDid = getPortableDid(activityId);
+	if (activityDid == null) throw new TypeError(`Cannot sign the portable activity ${activityId.href}, as its ID is a malformed FEP-ef61 portable ID.  A compatible identifier must have a valid DID and an object path, and must not have credentials or @gateway location hints.`);
+	const eligible = keys.filter((c) => c.verificationMethod.protocol === "did:" && getPortableDid(c.verificationMethod) === activityDid);
+	if (eligible.length !== 1) throw new TypeError(`Cannot choose an Object Integrity Proof key for the portable activity ${activityId.href}: ` + (eligible.length < 1 ? `none of its ${keys.length} Ed25519 keys (${formatKeyIds(keys)}) ` : `${eligible.length} of its Ed25519 keys (${formatKeyIds(eligible)}) `) + `${eligible.length < 1 ? "is" : "are"} a DID URL verification method for ${activityDid}.  FEP-ef61 requires a portable activity's proof to be made by its DID, and the map-local compound-proof profile accepts exactly one direct proof per map.  Gateway keys, whose IDs are compatible identifiers, never sign proofs.  Supply exactly one Ed25519 key whose key ID is a DID URL for ${activityDid}, or sign the activity with signObject() before sending it.`);
+	getLogger([
+		"fedify",
+		"federation",
+		"outbox"
+	]).debug("The portable activity {activityId} is signed only by {keyId}, the one Ed25519 key whose verification method matches its DID.", {
+		activityId: activity.id?.href,
+		keyId: eligible[0].verificationMethod.href
+	});
+	return eligible;
+}
+/**
+* Rejects an outgoing activity whose proofs Fedify's own inbox would reject
+* as unsupported: a document with portable objects in which some map carries
+* a proof set or another value that is not a single proof map, or in which
+* an embedded map carries a proof but not its own `@context`, e.g., a signed
+* object parsed from a received document and rebuilt under the activity's
+* context.
+*
+* @param jsonLd The compact JSON-LD document about to be delivered.
+* @param activityId The activity ID, for the error message.
+* @throws {TypeError} If the document has an unsupported proof shape.
+* @internal
+*/
+function assertSupportedCompoundProofShape(jsonLd, activityId) {
+	if (!containsCompoundPortableObject(jsonLd)) return;
+	const path = findUnsupportedCompoundProofShape(jsonLd);
+	if (path != null) throw new TypeError(`Cannot send the activity ${activityId}: it embeds portable objects, but its proof at the JSON Pointer ${JSON.stringify(path)} is not a single proof map.  The map-local compound-proof profile accepts exactly one direct proof per map, so Fedify inboxes would reject the activity.  Sign each object with exactly one key.`);
+	const embedded = findEmbeddedProofWithoutContext(jsonLd);
+	if (embedded != null) throw new TypeError(`Cannot send the activity ${activityId}: it embeds portable objects, but the map at the JSON Pointer ${JSON.stringify(embedded)} carries a proof without its own @context.  The map-local compound-proof profile verifies each proof-bearing map on its own, so Fedify inboxes would reject the activity.  This happens when a signed object parsed from a received document, e.g., a Follow in an inbox listener, is embedded, as it is rebuilt under the activity's context and its proof no longer covers it.  Refer to such an object by its ID instead, e.g., new Accept({ object: follow.id }), or embed an object that you signed with signObject().`);
 }
-const DEF_COMPONENTS = [
-	"@method",
-	"@target-uri",
-	"@authority",
-	"content-digest"
-];
-const MIN_COMPONENTS = [
-	"@method",
-	"@target-uri",
-	"@authority"
-];
 //#endregion
 //#region src/federation/tasks/enqueue.ts
 /**
@@ -2480,6 +4207,73 @@ const logger = getLogger([
 	"webfinger",
 	"server"
 ]);
+function getWebFingerSubjectAndAliases({ resourceUrl, actorUri, preferredUsername, acctUsername, host, contextHost }) {
+	const aliases = [];
+	let subject = resourceUrl.href;
+	if (resourceUrl.protocol != "acct:" && preferredUsername != null) {
+		aliases.push(`acct:${preferredUsername}@${host ?? contextHost}`);
+		if (host != null && host !== contextHost) aliases.push(`acct:${preferredUsername}@${contextHost}`);
+	}
+	if (resourceUrl.href !== actorUri.href) aliases.push(actorUri.href);
+	if (resourceUrl.protocol === "acct:" && host != null && host !== contextHost && !resourceUrl.href.endsWith(`@${host}`)) {
+		subject = `acct:${preferredUsername ?? acctUsername}@${host}`;
+		aliases.push(resourceUrl.href);
+		if (preferredUsername != null && preferredUsername !== "" && preferredUsername !== acctUsername) aliases.push(`acct:${preferredUsername}@${contextHost}`);
+	}
+	return {
+		subject,
+		aliases
+	};
+}
+/**
+* Gets the compatible identifier that a WebFinger response links to for
+* an FEP-ef61 portable actor.  An actor identified by an `ap:` or `ap+ef61:`
+* URI is linked through its compatible identifier on the given gateway, while
+* an actor identified by a compatible identifier is linked through its ID as
+* is, so that software without FEP-ef61 support finds the same ID in the actor
+* document.
+* @param actorId The portable actor's ID.
+* @param gateway The actor's first gateway.
+* @returns The compatible identifier, or `null` if the actor ID is malformed
+*          or cannot be represented as a compatible identifier.
+*/
+function getCompatibleActorId(actorId, gateway) {
+	try {
+		if (isPortableUri(actorId)) return toCompatibleEf61Id(actorId, gateway);
+		return fromCompatibleEf61Id(actorId) == null ? null : actorId;
+	} catch (error) {
+		if (error instanceof TypeError) return null;
+		throw error;
+	}
+}
+/**
+* Computes the subject and aliases for an FEP-ef61 portable actor, whose
+* WebFinger address takes its domain from the first gateway of the actor
+* rather than from the actor ID.  The canonical `ap:` ID is not emitted,
+* since it is not a valid URI for software that does not support FEP-ef61;
+* the compatible identifier stands for it.
+*/
+function getPortableWebFingerSubjectAndAliases({ resourceUrl, compatibleId, preferredUsername, acctUsername, gatewayHost }) {
+	const aliases = [];
+	const add = (alias) => {
+		if (alias !== subject && !aliases.includes(alias)) aliases.push(alias);
+	};
+	let subject;
+	if (resourceUrl.protocol === "acct:") {
+		const username = preferredUsername ?? acctUsername;
+		subject = username == null ? resourceUrl.href : `acct:${username}@${gatewayHost}`;
+		add(compatibleId.href);
+		add(resourceUrl.href);
+	} else {
+		subject = preferredUsername == null ? compatibleId.href : `acct:${preferredUsername}@${gatewayHost}`;
+		add(compatibleId.href);
+		if (resourceUrl.protocol === "http:" || resourceUrl.protocol === "https:") add(resourceUrl.href);
+	}
+	return {
+		subject,
+		aliases
+	};
+}
 /**
 * Handles a WebFinger request.  You would not typically call this function
 * directly, but instead use {@link Federation.fetch} method.
@@ -2528,7 +4322,7 @@ async function handleWebFinger(request, options) {
 		});
 	}
 }
-const WEBFINGER_HANDLE_SCHEME_WHITELIST = new Set([
+const WEBFINGER_HANDLE_SCHEME_WHITELIST = /* @__PURE__ */ new Set([
 	"acct",
 	"http",
 	"https",
@@ -2565,7 +4359,7 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 	span?.setAttribute("webfinger.resource", resource);
 	let resourceUrl;
 	try {
-		resourceUrl = new URL(resource);
+		resourceUrl = parseIri(resource);
 	} catch (e) {
 		if (e instanceof TypeError) return new Response("Invalid resource URL.", { status: 400 });
 		throw e;
@@ -2584,6 +4378,7 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		return identifier;
 	}
 	let identifier = null;
+	let acctUsername = null;
 	const uriParsed = context.parseUri(resourceUrl);
 	if (uriParsed?.type != "actor") {
 		const match = /^acct:([^@]+)@([^@]+)$/.exec(resource);
@@ -2597,8 +4392,9 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 			const normalizedHost = portMatch == null ? domainToASCII(match[2].toLowerCase()) : domainToASCII(match[2].substring(0, portMatch.index).toLowerCase()) + portMatch[0];
 			if (normalizedHost != context.url.host && normalizedHost != host) return await onNotFound(request);
 			else {
-				identifier = await mapUsernameToIdentifier(match[1]);
-				resourceUrl = new URL(`acct:${match[1]}@${normalizedHost}`);
+				acctUsername = match[1];
+				identifier = await mapUsernameToIdentifier(acctUsername);
+				resourceUrl = new URL(`acct:${acctUsername}@${normalizedHost}`);
 			}
 		}
 	} else identifier = uriParsed.identifier;
@@ -2612,9 +4408,34 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		status: 410,
 		headers: { "Access-Control-Allow-Origin": "*" }
 	});
+	let actorUri = context.getActorUri(identifier);
+	let portable;
+	if (actor.id != null && isPortableId(actor.id)) {
+		const gateway = actor.gateway;
+		if (gateway == null || !isGatewayUrl(gateway)) {
+			logger.error("The portable actor {actorId} (identifier: {identifier}) needs an HTTP(S) origin as the first item of its gateways property to be discovered through WebFinger.", {
+				actorId: formatIri(actor.id),
+				identifier
+			});
+			return await onNotFound(request);
+		}
+		const compatibleId = getCompatibleActorId(actor.id, gateway);
+		if (compatibleId == null) {
+			logger.error("The portable actor {actorId} (identifier: {identifier}) cannot be discovered through WebFinger, as its ID is malformed or cannot be represented as an FEP-ef61 compatible identifier.", {
+				actorId: formatIri(actor.id),
+				identifier
+			});
+			return await onNotFound(request);
+		}
+		actorUri = compatibleId;
+		portable = {
+			compatibleId,
+			gatewayHost: gateway.host
+		};
+	}
 	const links = [{
 		rel: "self",
-		href: context.getActorUri(identifier).href,
+		href: actorUri.href,
 		type: "application/activity+json"
 	}];
 	for (const url of actor.urls) if (url instanceof Link && url.href != null) links.push({
@@ -2638,23 +4459,25 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		const customLinks = await webFingerLinksDispatcher(context, resourceUrl);
 		if (customLinks != null) for (const link of customLinks) links.push(link);
 	}
-	const aliases = [];
-	const preferredUsername = actor.preferredUsername;
-	if (resourceUrl.protocol != "acct:" && preferredUsername != null) {
-		aliases.push(`acct:${preferredUsername}@${host ?? context.url.host}`);
-		if (host != null && host !== context.url.host) aliases.push(`acct:${preferredUsername}@${context.url.host}`);
-	}
-	if (resourceUrl.href !== context.getActorUri(identifier).href) aliases.push(context.getActorUri(identifier).href);
-	if (resourceUrl.protocol === "acct:" && host != null && host !== context.url.host && !resourceUrl.href.endsWith(`@${host}`)) {
-		const username = resourceUrl.href.replace(/^acct:/, "").replace(/@.*$/, "");
-		aliases.push(`acct:${username}@${host}`);
-	}
-	const jrd = {
-		subject: resourceUrl.href,
+	const { subject, aliases } = portable == null ? getWebFingerSubjectAndAliases({
+		resourceUrl,
+		actorUri,
+		preferredUsername: actor.preferredUsername,
+		acctUsername,
+		host,
+		contextHost: context.url.host
+	}) : getPortableWebFingerSubjectAndAliases({
+		resourceUrl,
+		compatibleId: portable.compatibleId,
+		preferredUsername: actor.preferredUsername,
+		acctUsername,
+		gatewayHost: portable.gatewayHost
+	});
+	return new Response(JSON.stringify({
+		subject,
 		aliases,
 		links
-	};
-	return new Response(JSON.stringify(jrd), { headers: {
+	}), { headers: {
 		"Content-Type": "application/jrd+json",
 		"Access-Control-Allow-Origin": "*"
 	} });
@@ -2742,6 +4565,37 @@ function getBenchmarkTriggerOptions(benchmarkOptions) {
 function maxDelay(first, second) {
 	return Temporal.Duration.compare(first, second) >= 0 ? first : second;
 }
+/**
+* Gets the fields of a queued message that describe the FEP-ef61 portable
+* inbox an inbox stands for, if any, omitting the absent ones.
+*/
+function getPortableMessageFields(portableInbox, gatewayInboxes) {
+	return {
+		...portableInbox == null ? {} : { portableInbox },
+		...gatewayInboxes == null ? {} : { gatewayInboxes: [...gatewayInboxes] }
+	};
+}
+/**
+* Sends an activity to an inbox, or, if the inbox is the compatible
+* identifier of an FEP-ef61 portable inbox on more than one gateway, through
+* the first gateway that accepts it.
+*/
+function sendActivityToInbox(inbox, gatewayInboxes, parameters) {
+	if (gatewayInboxes == null || gatewayInboxes.length < 2) return sendActivity({
+		...parameters,
+		inbox: new URL(inbox)
+	});
+	return sendActivityThroughGateways(parameters, gatewayInboxes.map((i) => new URL(i)));
+}
+function parseInstant(value) {
+	if (value == null) return void 0;
+	try {
+		return Temporal.Instant.from(value);
+	} catch (error) {
+		if (error instanceof RangeError) return void 0;
+		throw error;
+	}
+}
 function isTransportDeliveryError(error) {
 	return error instanceof FetchError || isAbortError(error);
 }
@@ -2771,7 +4625,7 @@ function isPermanentRemoteContextError(error) {
 	return isRemoteContextLoadingFailure(error) && typeof details?.url === "string" && !URL.canParse(details.url) && isClearlyMalformedContextReference(details.url);
 }
 function isPermanentInboxParseError(error) {
-	return error instanceof Error && (error.name === "UnsafeJsonLdError" || error instanceof InvalidContextReferenceError || isPermanentRemoteContextError(error) || error.name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure(error)) || error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:)/.test(error.message) || isInvalidUrlTypeError(error));
+	return error instanceof Error && (error.name === "UnsafeJsonLdError" || error instanceof InvalidContextReferenceError || isPermanentRemoteContextError(error) || error.name === "jsonld.SyntaxError" && !isRemoteContextLoadingFailure(error)) || error instanceof TypeError && (/^(Invalid JSON-LD:|Invalid type:|Unexpected type:|Invalid @id:|Invalid FEP-ef61 gateway:)/.test(error.message) || isInvalidUrlTypeError(error));
 }
 function hasLinkedDataSignatureJsonLdProcessingError(error) {
 	if (error.message.startsWith("Maximum deep iterations exceeded")) return true;
@@ -2788,6 +4642,8 @@ function isLinkedDataSignatureJsonLdProcessingError(error) {
 * @returns A new {@link Federation} instance.
 * @throws {TypeError} If benchmark mode and `meterProvider` are both
 * specified.
+* @throws {RangeError} If {@link FederationOptions.maxHttpSignatures} is not
+* a positive integer or `Infinity`.
 * @since 0.10.0
 */
 function createFederation(options) {
@@ -2796,6 +4652,9 @@ function createFederation(options) {
 var FederationImpl = class extends FederationBuilderImpl {
 	kv;
 	kvPrefixes;
+	publicKeyTtl;
+	httpMessageSignaturesSpecTtl;
+	portableInboxForwarding;
 	inboxQueue;
 	outboxQueue;
 	fanoutQueue;
@@ -2811,6 +4670,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 	onOutboxError;
 	permanentFailureStatusCodes;
 	signatureTimeWindow;
+	maxHttpSignatures;
 	skipSignatureVerification;
 	outboxRetryPolicy;
 	inboxRetryPolicy;
@@ -2828,6 +4688,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 	benchmarkMetricReader;
 	benchmarkTriggerOptions;
 	#mediaUploaderNoAuthWarned = false;
+	#portableInboxForwardingWarned = false;
 	#queueDepthGaugeSourceId = `fedify-${(++nextQueueDepthGaugeSourceId).toString(36)}`;
 	#queueDepthGaugeEntries = [];
 	#queueDepthGaugeMeterProvider;
@@ -2838,6 +4699,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const hasCustomLoaderFactory = options.documentLoaderFactory != null || options.contextLoaderFactory != null;
 		const allowPrivateAddress = options.allowPrivateAddress ?? (benchmarkMode && !hasCustomLoaderFactory ? true : false);
 		const signatureTimeWindow = options.signatureTimeWindow ?? (benchmarkMode ? false : { hours: 1 });
+		if (options.maxHttpSignatures !== void 0) validateMaxSignatures(options.maxHttpSignatures, "maxHttpSignatures");
 		if (benchmarkMode && options.meterProvider != null) throw new TypeError("benchmarkMode requires Fedify to own the meterProvider; OpenTelemetry metric readers cannot be added after a MeterProvider is constructed.");
 		if (benchmarkMode) {
 			const relaxations = getBenchmarkRelaxations(allowPrivateAddress, signatureTimeWindow);
@@ -2859,8 +4721,12 @@ var FederationImpl = class extends FederationBuilderImpl {
 			acceptSignatureNonce: ["_fedify", "acceptSignatureNonce"],
 			circuitBreaker: ["_fedify", "circuit"],
 			taskDeduplication: ["_fedify", "taskDeduplication"],
+			portableInboxForwarding: ["_fedify", "portableInboxForwarding"],
 			...options.kvPrefixes ?? {}
 		};
+		this.publicKeyTtl = Temporal.Duration.from(options.publicKeyTtl ?? { days: 30 });
+		this.httpMessageSignaturesSpecTtl = Temporal.Duration.from(options.httpMessageSignaturesSpecTtl ?? { days: 90 });
+		this.portableInboxForwarding = resolvePortableInboxForwardingOptions(options.portableInboxForwarding);
 		if (options.queue == null) {
 			this.inboxQueue = void 0;
 			this.outboxQueue = void 0;
@@ -2926,13 +4792,15 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		const { userAgent } = options;
 		this.allowPrivateAddress = allowPrivateAddress;
+		const documentLoaderTimeout = resolveDocumentLoaderTimeout(options.documentLoaderTimeout == null ? options.documentLoaderTimeout : Temporal.Duration.from(options.documentLoaderTimeout).total("millisecond"));
 		const userDocumentLoaderFactory = options.documentLoaderFactory;
 		const userContextLoaderFactory = options.contextLoaderFactory;
 		const userAuthFactory = options.authenticatedDocumentLoaderFactory;
 		const builtinDocumentLoaderFactory = (opts) => kvCache({
 			loader: getDocumentLoader({
 				allowPrivateAddress: opts?.allowPrivateAddress ?? allowPrivateAddress,
-				userAgent: opts?.userAgent ?? userAgent
+				userAgent: opts?.userAgent ?? userAgent,
+				timeout: opts?.timeout !== void 0 ? opts.timeout : documentLoaderTimeout
 			}),
 			kv: options.kv,
 			prefix: this.kvPrefixes.remoteDocument,
@@ -2942,7 +4810,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const builtinContextLoaderFactory = (opts) => kvCache({
 			loader: getDocumentLoader({
 				allowPrivateAddress: opts?.allowPrivateAddress ?? allowPrivateAddress,
-				userAgent: opts?.userAgent ?? userAgent
+				userAgent: opts?.userAgent ?? userAgent,
+				timeout: opts?.timeout !== void 0 ? opts.timeout : documentLoaderTimeout
 			}),
 			kv: options.kv,
 			prefix: this.kvPrefixes.remoteDocument,
@@ -2963,7 +4832,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 		this.authenticatedDocumentLoaderFactory = (identity, factoryOpts) => instrumentDocumentLoader(userAuthFactory != null ? userAuthFactory(identity, factoryOpts) : getAuthenticatedDocumentLoader(identity, {
 			allowPrivateAddress: factoryOpts?.allowPrivateAddress ?? allowPrivateAddress,
 			userAgent: factoryOpts?.userAgent ?? userAgent,
-			specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, options.firstKnock),
+			timeout: factoryOpts?.timeout !== void 0 ? factoryOpts.timeout : documentLoaderTimeout,
+			specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, options.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
 			tracerProvider: this.tracerProvider
 		}), {
 			meterProvider: this._meterProvider,
@@ -2974,6 +4844,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 		this.onOutboxError = options.onOutboxError;
 		this.permanentFailureStatusCodes = options.permanentFailureStatusCodes ?? [404, 410];
 		this.signatureTimeWindow = signatureTimeWindow;
+		this.maxHttpSignatures = options.maxHttpSignatures ?? 3;
 		this.skipSignatureVerification = options.skipSignatureVerification ?? false;
 		this.inboxChallengePolicy = options.inboxChallengePolicy;
 		this.outboxRetryPolicy = options.outboxRetryPolicy ?? createExponentialBackoffPolicy();
@@ -3206,6 +5077,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 			collectionSync: message.collectionSync,
 			orderingKey: message.orderingKey,
 			normalizeExistingProofs: message.normalizeExistingProofs,
+			activityJsonLd: message.activity,
 			context
 		});
 	}
@@ -3246,11 +5118,16 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			return parsedActorIds;
 		};
-		const parseActivity = () => Activity.fromJsonLd(message.activity, {
-			contextLoader: this.contextLoaderFactory(loaderOptions),
-			documentLoader: rsaKeyPair == null ? this.documentLoaderFactory(loaderOptions) : this.authenticatedDocumentLoaderFactory(rsaKeyPair, loaderOptions),
-			tracerProvider: this.tracerProvider
-		});
+		const parseActivity = () => {
+			const contextLoader = this.contextLoaderFactory(loaderOptions);
+			const documentLoader = rsaKeyPair == null ? this.documentLoaderFactory(loaderOptions) : this.authenticatedDocumentLoaderFactory(rsaKeyPair, loaderOptions);
+			return Activity.fromJsonLd(message.activity, {
+				contextLoader,
+				documentLoader,
+				tracerProvider: this.tracerProvider,
+				verifyPortableObject: createPortableObjectVerifier(documentLoader, contextLoader, this)
+			});
+		};
 		const enqueueHeldOutboxMessage = async (delay, heldSince) => {
 			const { outboxQueue } = this;
 			if (outboxQueue == null) return;
@@ -3299,6 +5176,20 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}
 			recordOutboxActivity(this.meterProvider, "abandoned", message.activityType);
 		};
+		const { gatewayInboxes } = message;
+		if (gatewayInboxes != null && gatewayInboxes.length > 1) {
+			await this.#listenGatewayOutboxMessage(_, {
+				...message,
+				gatewayInboxes
+			}, span, {
+				keys,
+				logData,
+				getActorIds,
+				parseActivity,
+				dropHeldOutboxMessage
+			});
+			return;
+		}
 		try {
 			const inbox = new URL(message.inbox);
 			const circuit = this.outboxQueue == null ? void 0 : this.circuitBreaker;
@@ -3331,6 +5222,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				if (decision.stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, decision.stateChange);
 			}
 			await sendActivity({
+				allowPrivateAddress: this.allowPrivateAddress,
 				keys,
 				activity: message.activity,
 				activityId: message.activityId,
@@ -3338,7 +5230,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				inbox,
 				sharedInbox: message.sharedInbox,
 				headers: new Headers(message.headers),
-				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock),
+				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
 				meterProvider: this.meterProvider,
 				tracerProvider: this.tracerProvider
 			});
@@ -3520,6 +5412,308 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		logger.info("Successfully sent activity {activityId} to {inbox}.", { ...logData });
 	}
+	/**
+	* Delivers a queued activity to an FEP-ef61 portable inbox through the first
+	* of its gateways that accepts it, trying them one after another in a single
+	* round, so that the round counts as one attempt for the retry policy, keeps
+	* the message's place in its ordering key, and is replayed as a whole by
+	* queues that retry natively.
+	*
+	* A gateway that fails with a permanent failure status is not tried again.
+	* A gateway whose circuit is open, or which asked to be retried later with
+	* `Retry-After`, is skipped in this round.  If no gateway accepts the
+	* activity, the message is held while every remaining gateway is held, and
+	* otherwise retried according to the retry policy.
+	*/
+	async #listenGatewayOutboxMessage(contextData, message, span, helpers) {
+		const logger = getLogger([
+			"fedify",
+			"federation",
+			"outbox"
+		]);
+		const circuitLogger = getLogger([
+			"fedify",
+			"federation",
+			"circuit"
+		]);
+		const { keys, logData, getActorIds, parseActivity, dropHeldOutboxMessage } = helpers;
+		const circuit = this.outboxQueue == null ? void 0 : this.circuitBreaker;
+		const specDeterminer = new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl });
+		const survivors = [];
+		let lastError;
+		let lastPermanent;
+		let activity;
+		const getActivity = async () => activity ??= await parseActivity();
+		const drop = async (circuit, remoteHost, inbox, heldSince) => {
+			await dropHeldOutboxMessage(circuit, remoteHost, inbox, heldSince, await getActivity());
+		};
+		const heldSince = parseInstant(message.circuitHeldSince);
+		if (circuit != null && heldSince != null && Temporal.Instant.compare(heldSince.add(circuit.options.heldActivityTtl), Temporal.Now.instant()) <= 0) {
+			const inbox = new URL(message.gatewayInboxes[0]);
+			await drop(circuit, getRemoteHost(inbox), inbox, heldSince);
+			return;
+		}
+		for (const inboxHref of message.gatewayInboxes) {
+			const inbox = new URL(inboxHref);
+			const remoteHost = getRemoteHost(inbox);
+			const now = Temporal.Now.instant();
+			const notBefore = parseInstant(message.gatewayNotBefore?.[inboxHref]);
+			if (notBefore != null && Temporal.Instant.compare(notBefore, now) > 0) {
+				survivors.push({
+					inbox: inboxHref,
+					holdDelay: now.until(notBefore),
+					notBefore
+				});
+				continue;
+			}
+			let decision;
+			if (circuit != null) try {
+				decision = await circuit.beforeSend(remoteHost, message);
+			} catch (circuitError) {
+				circuitLogger.error("Failed to check circuit breaker state before sending; proceeding with delivery:\n{error}", {
+					...logData,
+					remoteHost,
+					error: circuitError
+				});
+			}
+			if (decision != null && circuit != null) {
+				if (decision.type === "drop") {
+					await drop(circuit, remoteHost, inbox, decision.heldSince);
+					return;
+				} else if (decision.type === "hold") {
+					recordCircuitBreakerHeldSpanEvent(span, remoteHost, decision.state);
+					survivors.push({
+						inbox: inboxHref,
+						holdDelay: decision.delay,
+						circuitHeld: true
+					});
+					continue;
+				} else if (decision.stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, decision.stateChange);
+			}
+			try {
+				await sendActivity({
+					allowPrivateAddress: this.allowPrivateAddress,
+					keys,
+					activity: message.activity,
+					activityId: message.activityId,
+					activityType: message.activityType,
+					inbox,
+					sharedInbox: message.sharedInbox,
+					headers: new Headers(message.headers),
+					specDeterminer,
+					meterProvider: this.meterProvider,
+					tracerProvider: this.tracerProvider
+				});
+			} catch (error) {
+				lastError = error;
+				const isPermanentFailure = error instanceof SendActivityError && this.permanentFailureStatusCodes.includes(error.statusCode);
+				let retryAfter = !isPermanentFailure && error instanceof SendActivityError && (error.statusCode === 429 || error.statusCode === 503) ? parseRetryAfter(error.responseHeaders) : void 0;
+				let retryAt;
+				if (retryAfter != null) try {
+					retryAt = Temporal.Now.instant().add(retryAfter);
+				} catch (e) {
+					if (!(e instanceof RangeError)) throw e;
+					retryAfter = void 0;
+				}
+				let postDecision;
+				if (circuit != null) try {
+					if (error instanceof SendActivityError) {
+						const { statusCode } = error;
+						const stateChange = isPermanentFailure || statusCode === 429 || statusCode >= 400 && statusCode < 500 ? await circuit.recordReachableFailure(remoteHost) : statusCode >= 500 ? await circuit.recordFailure(remoteHost) : void 0;
+						if (stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, stateChange);
+					} else if (isTransportDeliveryError(error)) {
+						const stateChange = await circuit.recordFailure(remoteHost);
+						if (stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, stateChange);
+					}
+					if (!isPermanentFailure) postDecision = await circuit.beforeSend(remoteHost, message);
+				} catch (circuitError) {
+					circuitLogger.error("Failed to update circuit breaker state after delivery failure; falling back to normal failure handling:\n{error}", {
+						...logData,
+						remoteHost,
+						error: circuitError
+					});
+				}
+				span.addEvent("activitypub.delivery.failed", {
+					"activitypub.remote.host": remoteHost,
+					"activitypub.delivery.attempt": message.attempt,
+					"activitypub.delivery.permanent_failure": isPermanentFailure,
+					...error instanceof SendActivityError ? { "http.response.status_code": error.statusCode } : {}
+				});
+				try {
+					await this.onOutboxError?.(error, await getActivity());
+				} catch (handlerError) {
+					logger.error("An unexpected error occurred in onError handler:\n{error}", {
+						...logData,
+						inbox: inboxHref,
+						error: handlerError
+					});
+				}
+				if (isPermanentFailure) {
+					logger.warn("Permanent delivery failure for activity {activityId} to {inbox} ({status}); not trying the gateway again.", {
+						...logData,
+						inbox: inboxHref,
+						status: error.statusCode
+					});
+					lastPermanent = {
+						error,
+						inbox
+					};
+					continue;
+				}
+				if (postDecision?.type === "drop" && circuit != null) {
+					await drop(circuit, remoteHost, inbox, postDecision.heldSince);
+					return;
+				} else if (postDecision?.type === "hold") {
+					recordCircuitBreakerHeldSpanEvent(span, remoteHost, postDecision.state);
+					survivors.push({
+						inbox: inboxHref,
+						holdDelay: retryAfter == null ? postDecision.delay : maxDelay(postDecision.delay, retryAfter),
+						circuitHeld: true,
+						postFailure: true,
+						notBefore: retryAt,
+						retryAfter
+					});
+				} else survivors.push({
+					inbox: inboxHref,
+					notBefore: retryAt,
+					retryAfter
+				});
+				logger.warn("Failed to send activity {activityId} to {inbox} (attempt #{attempt}); trying the next gateway if any:\n{error}", {
+					...logData,
+					inbox: inboxHref,
+					error
+				});
+				continue;
+			}
+			if (circuit != null) try {
+				const stateChange = await circuit.recordSuccess(remoteHost);
+				if (stateChange != null) recordCircuitBreakerSpanEvent(span, remoteHost, stateChange);
+			} catch (error) {
+				circuitLogger.error("Failed to record successful delivery in circuit breaker state; the activity was already delivered:\n{error}", {
+					...logData,
+					remoteHost,
+					error
+				});
+			}
+			logger.info("Successfully sent activity {activityId} to {inbox}.", {
+				...logData,
+				inbox: inboxHref
+			});
+			return;
+		}
+		if (lastError != null) span.setStatus({
+			code: SpanStatusCode.ERROR,
+			message: String(lastError)
+		});
+		if (survivors.length < 1) {
+			const { error, inbox } = lastPermanent;
+			this.metrics.recordPermanentFailure(error.inbox, error.statusCode);
+			logger.warn("Permanent delivery failure for activity {activityId} to every gateway of {portableInbox}; not retrying.", {
+				...logData,
+				portableInbox: message.portableInbox
+			});
+			if (this.outboxPermanentFailureHandler != null) {
+				const ctx = this.#createContext(new URL(message.baseUrl), contextData, { documentLoader: this.documentLoaderFactory(this.#getLoaderOptions(message.baseUrl)) });
+				try {
+					await this.outboxPermanentFailureHandler(ctx, {
+						reason: "http",
+						inbox,
+						activity: await getActivity(),
+						error,
+						statusCode: error.statusCode,
+						actorIds: getActorIds()
+					});
+				} catch (handlerError) {
+					logger.error("An unexpected error occurred in outboxPermanentFailureHandler:\n{error}", {
+						...logData,
+						error: handlerError
+					});
+				}
+			}
+			recordOutboxActivity(this.meterProvider, "abandoned", message.activityType);
+			return;
+		}
+		const now = Temporal.Now.instant();
+		const gatewayNotBefore = {};
+		for (const survivor of survivors) if (survivor.notBefore != null && Temporal.Instant.compare(survivor.notBefore, now) > 0) gatewayNotBefore[survivor.inbox] = survivor.notBefore.toString();
+		const { circuitHeld: _circuitHeld, gatewayNotBefore: _gatewayNotBefore, ...rest } = message;
+		const nextMessage = {
+			...rest,
+			inbox: survivors[0].inbox,
+			gatewayInboxes: survivors.map((s) => s.inbox),
+			...globalThis.Object.keys(gatewayNotBefore).length < 1 ? {} : { gatewayNotBefore }
+		};
+		const { outboxQueue } = this;
+		const policyDelay = this.outboxRetryPolicy({
+			elapsedTime: Temporal.Instant.from(message.started).until(now),
+			attempts: message.attempt
+		});
+		if (outboxQueue != null && survivors.every((s) => s.holdDelay != null) && (policyDelay != null || !survivors.some((s) => s.postFailure))) {
+			let delay = survivors.map((s) => s.holdDelay).reduce((a, b) => Temporal.Duration.compare(a, b) <= 0 ? a : b);
+			let heldMessage = nextMessage;
+			if (survivors.some((s) => s.circuitHeld)) {
+				const since = heldSince ?? now;
+				if (circuit != null) delay = circuit.capHeldDelay(since, delay);
+				heldMessage = {
+					...nextMessage,
+					circuitHeld: true,
+					circuitHeldSince: since.toString()
+				};
+			}
+			logger.warn("Failed to send activity {activityId} to {portableInbox}; holding it until one of its gateways can be tried again.", {
+				...logData,
+				portableInbox: message.portableInbox
+			});
+			await outboxQueue.enqueue(heldMessage, {
+				delay: clampNegativeDelay(delay),
+				orderingKey: message.orderingKey
+			});
+			this.metrics.recordQueueTaskEnqueued({
+				role: "outbox",
+				queue: outboxQueue,
+				activityType: heldMessage.activityType
+			}, heldMessage.attempt);
+			return;
+		}
+		const hasRetryAfter = survivors.some((s) => s.retryAfter != null);
+		if (outboxQueue?.nativeRetrial && !hasRetryAfter && survivors.length === message.gatewayInboxes.length && globalThis.Object.keys(gatewayNotBefore).length < 1) {
+			logger.error("Failed to send activity {activityId} to every gateway of {portableInbox}; backend will handle retry:\n{error}", {
+				...logData,
+				portableInbox: message.portableInbox,
+				error: lastError
+			});
+			throw lastError;
+		}
+		if (policyDelay == null || outboxQueue == null) {
+			logger.error("Failed to send activity {activityId} to every gateway of {portableInbox} after {attempt} attempts; giving up:\n{error}", {
+				...logData,
+				portableInbox: message.portableInbox,
+				error: lastError
+			});
+			recordOutboxActivity(this.meterProvider, "abandoned", message.activityType);
+			return;
+		}
+		const delay = survivors.map((s) => s.holdDelay ?? s.retryAfter ?? policyDelay).reduce((a, b) => Temporal.Duration.compare(a, b) <= 0 ? a : b);
+		const retryMessage = {
+			...nextMessage,
+			attempt: message.attempt + 1
+		};
+		logger.error("Failed to send activity {activityId} to every gateway of {portableInbox} (attempt #{attempt}); retry...:\n{error}", {
+			...logData,
+			portableInbox: message.portableInbox,
+			error: lastError
+		});
+		await outboxQueue.enqueue(retryMessage, {
+			delay: clampNegativeDelay(delay),
+			orderingKey: message.orderingKey
+		});
+		this.metrics.recordQueueTaskEnqueued({
+			role: "outbox",
+			queue: outboxQueue,
+			activityType: retryMessage.activityType
+		}, retryMessage.attempt);
+		recordOutboxActivity(this.meterProvider, "retried", retryMessage.activityType);
+	}
 	async #listenInboxMessage(ctxData, message, span, onActivityType) {
 		const logger = getLogger([
 			"fedify",
@@ -3528,8 +5722,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 		]);
 		const baseUrl = new URL(message.baseUrl);
 		let context = this.#createContext(baseUrl, ctxData);
-		if (message.identifier != null) context = this.#createContext(baseUrl, ctxData, { documentLoader: await context.getDocumentLoader({ identifier: message.identifier }) });
-		else if (this.sharedInboxKeyDispatcher != null) {
+		if (message.identifier != null && this.actorCallbacks?.keyPairsDispatcher != null) context = this.#createContext(baseUrl, ctxData, { documentLoader: await context.getDocumentLoader({ identifier: message.identifier }) });
+		else if (message.identifier == null && this.sharedInboxKeyDispatcher != null) {
 			const identity = await this.sharedInboxKeyDispatcher(context);
 			if (identity != null) context = this.#createContext(baseUrl, ctxData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
 		}
@@ -3861,7 +6055,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 			...ctxOptions,
 			request,
 			invokedFromActorDispatcher: opts.invokedFromActorDispatcher,
-			invokedFromObjectDispatcher: opts.invokedFromObjectDispatcher
+			invokedFromObjectDispatcher: opts.invokedFromObjectDispatcher,
+			portableRequest: opts.portableRequest
 		});
 	}
 	#getLoaderOptions(origin) {
@@ -3886,36 +6081,33 @@ var FederationImpl = class extends FederationBuilderImpl {
 		else if (keys.length < 1) throw new TypeError("The keys must not be empty.");
 		const contextLoader = this.contextLoaderFactory(this.#getLoaderOptions(ctx.origin));
 		const activityId = activity.id.href;
-		let hasProof = false;
-		let proofCreated = false;
 		let rsaKey = null;
+		const ldSignable = !hasPortableActor(activity);
 		for (const { keyId, privateKey } of keys) {
 			validateCryptoKey(privateKey, "private");
-			if (rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") rsaKey = {
+			if (ldSignable && rsaKey == null && privateKey.algorithm.name === "RSASSA-PKCS1-v1_5" && !isPortableKeyId(keyId)) rsaKey = {
 				keyId,
 				privateKey
 			};
 		}
-		for await (const _ of activity.getProofs({ contextLoader })) {
-			hasProof = true;
-			break;
-		}
-		if (!hasProof) {
-			for (const { keyId, privateKey } of keys) if (privateKey.algorithm.name === "Ed25519") {
-				activity = await signObject(activity, privateKey, keyId, {
-					contextLoader,
-					tracerProvider: this.tracerProvider
-				});
-				hasProof = true;
-				proofCreated = true;
-			}
-		}
-		let jsonLd = await activity.toJsonLd({
+		const signed = await signOutgoingActivity(activity, keys.map(({ keyId, privateKey }) => ({
+			verificationMethod: keyId,
+			privateKey
+		})), {
+			contextLoader,
+			tracerProvider: this.tracerProvider,
+			appendToExistingProofs: false
+		});
+		activity = signed.activity;
+		const { hasProof, proofCreated } = signed;
+		let jsonLd = !proofCreated && options.activityJsonLd != null ? options.activityJsonLd : await activity.toJsonLd({
 			format: "compact",
 			contextLoader
 		});
-		if (proofCreated || !hasProof || options.normalizeExistingProofs) jsonLd = await normalizeOutgoingActivityJsonLd(jsonLd, contextLoader);
-		if (rsaKey == null) logger.warn("No supported key found to create a Linked Data signature for the activity {activityId}.  The activity will be sent without a Linked Data signature.  In order to create a Linked Data signature, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
+		if (proofCreated || !hasProof || options.normalizeExistingProofs) jsonLd = await normalizeOutgoingActivityJsonLd(jsonLd, contextLoader, { preserveNestedSecuredDocuments: true });
+		assertSupportedCompoundProofShape(jsonLd, activityId);
+		if (rsaKey == null && !ldSignable) logger.debug("The activity {activityId} is performed by a portable actor, so it is sent without a Linked Data signature.", { activityId });
+		else if (rsaKey == null) logger.warn("No supported key found to create a Linked Data signature for the activity {activityId}.  The activity will be sent without a Linked Data signature.  In order to create a Linked Data signature, at least one RSASSA-PKCS1-v1_5 key must be provided.", {
 			activityId,
 			keys: keys.map((pair) => ({
 				keyId: pair.keyId.href,
@@ -3951,15 +6143,15 @@ var FederationImpl = class extends FederationBuilderImpl {
 				activity: jsonLd
 			});
 			const promises = [];
-			for (const inbox in inboxes) promises.push(sendActivity({
+			for (const inbox in inboxes) promises.push(sendActivityToInbox(inbox, inboxes[inbox].gatewayInboxes, {
+				allowPrivateAddress: this.allowPrivateAddress,
 				keys,
 				activity: jsonLd,
 				activityId: activity.id?.href,
 				activityType: getTypeId(activity).href,
-				inbox: new URL(inbox),
 				sharedInbox: inboxes[inbox].sharedInbox,
 				headers: collectionSync == null ? void 0 : new Headers({ "Collection-Synchronization": await buildCollectionSynchronizationHeader(collectionSync, inboxes[inbox].actorIds) }),
-				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock),
+				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
 				meterProvider: this.meterProvider,
 				tracerProvider: this.tracerProvider
 			}));
@@ -3983,8 +6175,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 		propagation.inject(context.active(), carrier);
 		const messages = [];
 		for (const inbox in inboxes) {
-			const inboxOrigin = new URL(inbox).origin;
-			const messageOrderingKey = orderingKey == null ? void 0 : `${orderingKey}\n${inboxOrigin}`;
+			const { portableInbox, gatewayInboxes } = inboxes[inbox];
+			const messageOrderingKey = orderingKey == null ? void 0 : `${orderingKey}\n${getOrderingDestination(inbox, portableInbox)}`;
 			const message = {
 				type: "outbox",
 				id: crypto.randomUUID(),
@@ -4000,6 +6192,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				attempt: 0,
 				headers: collectionSync == null ? {} : { "Collection-Synchronization": await buildCollectionSynchronizationHeader(collectionSync, inboxes[inbox].actorIds) },
 				orderingKey: messageOrderingKey,
+				...getPortableMessageFields(portableInbox, gatewayInboxes),
 				traceContext: carrier
 			};
 			messages.push({
@@ -4050,7 +6243,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				return await withContext({
 					traceId: spanCtx.traceId,
 					spanId: spanCtx.spanId
-				}, async () => {
+				}, () => this.#observeInboxFetch(metricState, async () => {
 					const logger = getLogger([
 						"fedify",
 						"federation",
@@ -4065,8 +6258,14 @@ var FederationImpl = class extends FederationBuilderImpl {
 							tracer,
 							metricState
 						});
-						if (acceptsJsonLd(request)) response.headers.set("Vary", "Accept");
+						if (metricState.inboxCompletion != null) metricState.inboxCompletion.observation.stage = "respond";
+						if (metricState.endpoint !== "hashlink_media" && acceptsJsonLd(request)) response.headers.set("Vary", "Accept");
 					} catch (error) {
+						metricState.inboxCompletion?.observation.project(span, {
+							type: "exception",
+							stage: metricState.inboxCompletion.observation.stage,
+							error
+						});
 						this.metrics.recordHttpServerRequest(request.method, metricState.endpoint ?? "error", getDurationMs(metricStart), { routeTemplate: metricState.routeTemplate });
 						span.setStatus({
 							code: SpanStatusCode.ERROR,
@@ -4105,7 +6304,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					else if (response.status >= 400) logger.warn(logTpl, values);
 					else logger.info(logTpl, values);
 					return response;
-				});
+				}));
 			});
 		});
 	}
@@ -4116,14 +6315,48 @@ var FederationImpl = class extends FederationBuilderImpl {
 		const url = new URL(request.url);
 		const route = this.router.route(url.pathname);
 		if (route == null) {
+			const media = this.hashlinkMediaDispatcher == null ? null : parseHashlinkGatewayRequest(url);
+			if (media != null) return await this.#fetchHashlinkMedia(request, media, {
+				onNotFound,
+				contextData,
+				span,
+				metricState
+			});
+			if (request.method === "POST") {
+				const portable = parsePortableGatewayRequest(url);
+				if (portable != null) return await this.#fetchPortableInbox(request, portable, {
+					onNotFound,
+					contextData,
+					span,
+					metricState
+				});
+			}
+			const portable = request.method === "GET" || request.method === "HEAD" ? parsePortableGatewayRequest(url) : null;
+			if (portable != null) return await discardBodyForHead(request, await this.#fetchPortableObject(request, portable, {
+				onNotFound,
+				onNotAcceptable,
+				onUnauthorized,
+				contextData,
+				span,
+				metricState
+			}));
 			metricState.endpoint = "not_found";
 			return await onNotFound(request);
 		}
 		metricState.routeTemplate = route.template;
 		metricState.endpoint = getEndpointCategory(route.name);
 		span.updateName(`${request.method} ${route.template}`);
-		let context = this.#createContext(request, contextData);
 		const routeName = route.name.replace(/:.*$/, "");
+		let context;
+		try {
+			context = this.#createContext(request, contextData);
+		} catch (error) {
+			if (request.method !== "POST" || routeName !== "inbox" && routeName !== "sharedInbox") throw error;
+			return await this.#reportInboxPreparationError(request, contextData, {
+				kind: routeName === "inbox" ? "personal" : "shared",
+				recipient: route.values.identifier ?? null
+			}, error, span, metricState);
+		}
 		switch (routeName) {
 			case "webfinger": return await handleWebFinger(request, {
 				context,
@@ -4182,6 +6415,28 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			return response;
 		}
+		if (request.method === "POST" && (routeName === "inbox" || routeName === "sharedInbox")) {
+			const recipient = route.values.identifier ?? null;
+			const observation = new InboxObservation({
+				kind: routeName === "inbox" ? "personal" : "shared",
+				recipient
+			});
+			this.#setInboxCompletion(metricState, observation, () => context);
+			return await observation.run(async () => {
+				if (routeName === "inbox") context = this.#createContext(request, contextData, { documentLoader: await context.getDocumentLoader({ identifier: recipient }) });
+				else if (this.sharedInboxKeyDispatcher != null) {
+					const identity = await this.sharedInboxKeyDispatcher(context);
+					if (identity != null) context = this.#createContext(request, contextData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
+				}
+				return await this.#handleInbox(request, {
+					recipient,
+					context,
+					contextData,
+					onNotFound,
+					observation
+				});
+			}, span);
+		}
 		switch (routeName) {
 			case "actor":
 			case "actorAlias": {
@@ -4257,35 +6512,18 @@ var FederationImpl = class extends FederationBuilderImpl {
 					onUnauthorized,
 					onNotFound
 				});
-				context = this.#createContext(request, contextData, { documentLoader: await context.getDocumentLoader({ identifier: route.values.identifier }) });
-			case "sharedInbox": {
-				if (routeName !== "inbox" && this.sharedInboxKeyDispatcher != null) {
+				throw new Error("Unreachable inbox delivery.");
+			case "sharedInbox":
+				if (this.sharedInboxKeyDispatcher != null) {
 					const identity = await this.sharedInboxKeyDispatcher(context);
 					if (identity != null) context = this.#createContext(request, contextData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
-				}
-				if (!this.manuallyStartQueue) this._startQueueInternal(contextData);
-				const inboxContextFactory = context.toInboxContext.bind(context);
-				inboxContextFactory[rawInboxContextFactorySymbol] = context.toInboxContext.bind(context);
-				return await handleInbox(request, {
-					recipient: route.values.identifier ?? null,
-					context,
-					inboxContextFactory,
-					kv: this.kv,
-					kvPrefixes: this.kvPrefixes,
-					queue: this.inboxQueue,
-					actorDispatcher: this.actorCallbacks?.dispatcher,
-					inboxListeners: this.inboxListeners,
-					inboxErrorHandler: this.inboxErrorHandler,
-					unverifiedActivityHandler: this.unverifiedActivityHandler,
-					onNotFound,
-					signatureTimeWindow: this.signatureTimeWindow,
-					skipSignatureVerification: this.skipSignatureVerification,
-					inboxChallengePolicy: this.inboxChallengePolicy,
-					meterProvider: this.meterProvider,
-					tracerProvider: this.tracerProvider,
-					idempotencyStrategy: this.idempotencyStrategy
+				}
+				return await this.#handleInbox(request, {
+					recipient: route.values.identifier ?? null,
+					context,
+					contextData,
+					onNotFound
 				});
-			}
 			case "following": return await handleCollection(request, {
 				name: "following",
 				identifier: route.values.identifier,
@@ -4298,12 +6536,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				onNotFound
 			});
 			case "followers": {
-				let baseUrl = url.searchParams.get("base-url");
-				if (baseUrl != null) try {
-					baseUrl = `${new URL(baseUrl).origin}/`;
-				} catch {
-					baseUrl = null;
-				}
+				const baseUrl = getFollowersBaseUrl(url);
 				return await handleCollection(request, {
 					name: "followers",
 					identifier: route.values.identifier,
@@ -4314,7 +6547,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					},
 					context,
 					filter: baseUrl != null ? new URL(baseUrl) : void 0,
-					filterPredicate: baseUrl != null ? ((i) => (i instanceof URL ? i.href : i.id?.href ?? "").startsWith(baseUrl)) : void 0,
+					filterPredicate: baseUrl != null ? getFollowersFilterPredicate(baseUrl) : void 0,
 					collectionCallbacks: this.followersCallbacks,
 					tracerProvider: this.tracerProvider,
 					meterProvider: this._meterProvider,
@@ -4356,10 +6589,10 @@ var FederationImpl = class extends FederationBuilderImpl {
 				onNotFound
 			});
 			case "collection": {
-				const name = route.name.replace(/^collection:/, "");
+				const name = this.getCollectionName(route.name);
 				const callbacks = this.collectionCallbacks[name];
 				return await handleCustomCollection(request, {
-					name,
+					name: String(name),
 					context,
 					values: route.values,
 					collectionCallbacks: callbacks,
@@ -4370,10 +6603,10 @@ var FederationImpl = class extends FederationBuilderImpl {
 				});
 			}
 			case "orderedCollection": {
-				const name = route.name.replace(/^orderedCollection:/, "");
+				const name = this.getCollectionName(route.name);
 				const callbacks = this.collectionCallbacks[name];
 				return await handleOrderedCollection(request, {
-					name,
+					name: String(name),
 					context,
 					values: route.values,
 					collectionCallbacks: callbacks,
@@ -4390,7 +6623,499 @@ var FederationImpl = class extends FederationBuilderImpl {
 			}
 		}
 	}
+	async #fetchPortableObject(request, portable, { onNotFound, onNotAcceptable, onUnauthorized, contextData, span, metricState }) {
+		if (portable.type === "malformed") {
+			metricState.endpoint = "not_found";
+			getLogger([
+				"fedify",
+				"federation",
+				"object"
+			]).debug("Malformed FEP-ef61 gateway request {url}: {error}", {
+				url: request.url,
+				error: portable.error
+			});
+			return new Response(request.method === "HEAD" ? null : "Malformed portable object ID.", {
+				status: 400,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+		const route = this.router.route(portable.path);
+		const isActor = route != null && (route.name === "actor" || route.name.startsWith("actorAlias:"));
+		const collectionRoute = route == null ? void 0 : getCollectionMetricRoute(route.name.replace(/:.*$/, ""));
+		if (route == null || !isActor && !route.name.startsWith("object:") && collectionRoute == null) {
+			metricState.endpoint = "not_found";
+			return await onNotFound(request);
+		}
+		metricState.routeTemplate = PORTABLE_GATEWAY_ROUTE_PREFIX + route.template;
+		metricState.endpoint = getEndpointCategory(route.name);
+		span.updateName(`${request.method} ${metricState.routeTemplate}`);
+		if (!acceptsJsonLd(request)) {
+			metricState.endpoint = "not_acceptable";
+			const response = await onNotAcceptable(request);
+			if (collectionRoute != null) recordCollectionRequest(this._meterProvider, {
+				...collectionRoute,
+				page: new URL(request.url).searchParams.get("cursor") != null,
+				result: "not_acceptable",
+				statusCode: response.status
+			});
+			return response;
+		}
+		if (collectionRoute != null) return await this.#fetchPortableCollection(request, portable, route, {
+			onNotFound,
+			onUnauthorized,
+			contextData
+		});
+		if (isActor) {
+			const identifier = route.name.startsWith("actorAlias:") ? route.name.substring(ACTOR_ALIAS_PREFIX.length) : route.values.identifier;
+			const context = this.#createContext(request, contextData, {
+				invokedFromActorDispatcher: { identifier },
+				portableRequest: portable.portableRequest
+			});
+			const actorDispatcher = this.actorCallbacks?.dispatcher;
+			const authorizePredicate = this.actorCallbacks?.authorizePredicate;
+			return await handlePortableObject(request, {
+				values: { identifier },
+				context,
+				objectDispatcher: actorDispatcher == null ? void 0 : (ctx) => actorDispatcher(ctx, identifier),
+				authorizePredicate: authorizePredicate == null ? void 0 : (ctx) => authorizePredicate(ctx, identifier),
+				canonicalId: portable.canonicalId,
+				kind: "actor",
+				onUnauthorized,
+				onNotFound
+			});
+		}
+		const typeId = route.name.replace(/^object:/, "");
+		const callbacks = this.objectCallbacks[typeId];
+		const cls = this.objectTypeIds[typeId];
+		const context = this.#createContext(request, contextData, {
+			invokedFromObjectDispatcher: {
+				cls,
+				values: route.values
+			},
+			portableRequest: portable.portableRequest
+		});
+		return await handlePortableObject(request, {
+			values: route.values,
+			context,
+			objectDispatcher: callbacks?.dispatcher,
+			authorizePredicate: callbacks?.authorizePredicate,
+			canonicalId: portable.canonicalId,
+			kind: "object",
+			onUnauthorized,
+			onNotFound
+		});
+	}
+	async #fetchPortableCollection(request, portable, route, { onNotFound, onUnauthorized, contextData }) {
+		const logger = getLogger([
+			"fedify",
+			"federation",
+			"collection"
+		]);
+		const url = new URL(request.url);
+		const { authority } = portable.portableRequest;
+		const ownerContext = this.#createContext(request, contextData);
+		const context = this.#createContext(request, contextData, { portableRequest: portable.portableRequest });
+		const reject = async (reason, identifier) => {
+			logger.debug("Not serving the portable collection {collection} of the actor {identifier}: {reason}.", {
+				collection: portable.canonicalId,
+				identifier,
+				reason
+			});
+			return await onNotFound(request);
+		};
+		const routeName = route.name.replace(/:.*$/, "");
+		if (routeName === "collection" || routeName === "orderedCollection") {
+			const name = route.name.replace(/^(?:ordered)?[cC]ollection:/, "");
+			const callbacks = this.collectionCallbacks[name];
+			if (callbacks == null) return await onNotFound(request);
+			const mapper = callbacks.portableOwnerMapper;
+			if (mapper == null) return await reject("noPortableOwnerMapper");
+			const identifier = await mapper(ownerContext, route.values);
+			if (identifier == null) return await reject("notPortable");
+			const resolution = resolvePortableCollectionOwner(await this.actorCallbacks?.dispatcher?.(ownerContext, identifier), {
+				authority,
+				portableId: portable.portableRequest.id
+			});
+			if (resolution.status === "rejected") return await reject(resolution.reason, identifier);
+			const view = buildPortableCollectionView(resolution.collectionId, url);
+			return await (routeName === "collection" ? handleCustomCollection : handleOrderedCollection)(request, {
+				name,
+				context,
+				values: route.values,
+				collectionCallbacks: callbacks,
+				portable: {
+					id: view,
+					view,
+					attribution: resolution.ownerId
+				},
+				tracerProvider: this.tracerProvider,
+				meterProvider: this._meterProvider,
+				onUnauthorized,
+				onNotFound
+			});
+		}
+		const identifier = route.values.identifier;
+		const serve = async (name, callbacks, property, filter) => {
+			if (callbacks == null) return await onNotFound(request);
+			const resolution = resolvePortableCollectionOwner(await this.actorCallbacks?.dispatcher?.(ownerContext, identifier), {
+				authority,
+				canonicalId: portable.canonicalId,
+				property
+			});
+			if (resolution.status === "rejected") return await reject(resolution.reason, identifier);
+			const id = new URL(resolution.collectionId);
+			if (filter != null) id.searchParams.set(...filter.parameter);
+			const view = buildPortableCollectionView(resolution.collectionId, url);
+			if (routeName === "followers") {
+				view.searchParams.delete("base-url");
+				if (filter != null) view.searchParams.set(...filter.parameter);
+			}
+			return await handleCollection(request, {
+				name,
+				identifier,
+				uriGetter: () => id,
+				context,
+				filter: filter?.value,
+				filterPredicate: filter?.predicate,
+				collectionCallbacks: callbacks,
+				portable: {
+					id,
+					view,
+					attribution: resolution.ownerId
+				},
+				tracerProvider: this.tracerProvider,
+				meterProvider: this._meterProvider,
+				onUnauthorized,
+				onNotFound
+			});
+		};
+		switch (routeName) {
+			case "outbox": return await serve("outbox", this.outboxCallbacks, (a) => a.outboxId);
+			case "inbox": return await serve("inbox", this.inboxCallbacks, (a) => a.inboxId);
+			case "following": return await serve("following", this.followingCallbacks, (a) => a.followingId);
+			case "followers": {
+				const baseUrl = getFollowersBaseUrl(url);
+				return await serve("followers", this.followersCallbacks, (a) => a.followersId, baseUrl == null ? void 0 : {
+					value: new URL(baseUrl),
+					predicate: getFollowersFilterPredicate(baseUrl),
+					parameter: ["base-url", baseUrl]
+				});
+			}
+			case "liked": return await serve("liked", this.likedCallbacks, (a) => a.likedId);
+			case "featured": return await serve("featured", this.featuredCallbacks, (a) => a.featuredId);
+			case "featuredTags": return await serve("featured tags", this.featuredTagsCallbacks, (a) => a.featuredTagsId);
+		}
+		return await onNotFound(request);
+	}
+	#setInboxCompletion(metricState, observation, getContext) {
+		const handler = this.inboxRequestFinishedHandler;
+		metricState.inboxCompletion = {
+			observation,
+			finish: (outcome) => observation.finish(getContext(), handler, outcome)
+		};
+	}
+	async #observeInboxFetch(metricState, operation) {
+		let response;
+		try {
+			response = await operation();
+		} catch (error) {
+			const completion = metricState.inboxCompletion;
+			if (completion != null) await completion.finish({
+				type: "exception",
+				stage: completion.observation.stage,
+				error
+			});
+			throw error;
+		}
+		const completion = metricState.inboxCompletion;
+		if (completion != null) await completion.finish({
+			type: "response",
+			status: response.status,
+			...completion.observation.result
+		});
+		return response;
+	}
+	async #reportInboxPreparationError(request, contextData, inbox, error, span, metricState) {
+		const unavailableLoader = () => Promise.reject(error);
+		const context = new RequestContextImpl({
+			url: new URL(request.url),
+			request,
+			federation: this,
+			data: contextData,
+			documentLoader: unavailableLoader,
+			contextLoader: unavailableLoader
+		});
+		const observation = new InboxObservation(inbox);
+		this.#setInboxCompletion(metricState, observation, () => context);
+		return await observation.run(() => Promise.reject(error), span);
+	}
+	async #handleInbox(request, { recipient, context, contextData, onNotFound, portableInbox, observation }) {
+		if (!this.manuallyStartQueue) this._startQueueInternal(contextData);
+		const inboxContextFactory = context.toInboxContext.bind(context);
+		inboxContextFactory[rawInboxContextFactorySymbol] = context.toInboxContext.bind(context);
+		return await handleInbox(request, {
+			recipient,
+			context,
+			inboxContextFactory,
+			kv: this.kv,
+			kvPrefixes: this.kvPrefixes,
+			publicKeyTtl: this.publicKeyTtl,
+			queue: this.inboxQueue,
+			actorDispatcher: this.actorCallbacks?.dispatcher,
+			inboxListeners: this.inboxListeners,
+			inboxErrorHandler: this.inboxErrorHandler,
+			unverifiedActivityHandler: this.unverifiedActivityHandler,
+			onNotFound,
+			signatureTimeWindow: this.signatureTimeWindow,
+			maxHttpSignatures: this.maxHttpSignatures,
+			skipSignatureVerification: this.skipSignatureVerification,
+			inboxChallengePolicy: this.inboxChallengePolicy,
+			meterProvider: this.meterProvider,
+			tracerProvider: this.tracerProvider,
+			idempotencyStrategy: this.idempotencyStrategy,
+			portableInbox,
+			observation
+		});
+	}
+	async #fetchPortableInbox(request, portable, { onNotFound, contextData, span, metricState }) {
+		const logger = getLogger([
+			"fedify",
+			"federation",
+			"inbox"
+		]);
+		if (portable.type === "malformed") {
+			metricState.endpoint = "not_found";
+			logger.debug("Malformed FEP-ef61 gateway inbox request {url}: {error}", {
+				url: request.url,
+				error: portable.error
+			});
+			return new Response("Malformed portable inbox ID.", {
+				status: 400,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+		const route = this.router.route(portable.path);
+		if (route == null || route.name !== "inbox") {
+			metricState.endpoint = "not_found";
+			return await onNotFound(request);
+		}
+		metricState.routeTemplate = PORTABLE_GATEWAY_ROUTE_PREFIX + route.template;
+		metricState.endpoint = "inbox";
+		span.updateName(`${request.method} ${metricState.routeTemplate}`);
+		const identifier = route.values.identifier;
+		let context;
+		try {
+			context = this.#createContext(request, contextData);
+		} catch (error) {
+			return await this.#reportInboxPreparationError(request, contextData, {
+				kind: "portable",
+				recipient: identifier
+			}, error, span, metricState);
+		}
+		const observation = new InboxObservation({
+			kind: "portable",
+			recipient: identifier
+		});
+		this.#setInboxCompletion(metricState, observation, () => context);
+		return await observation.run(async () => {
+			const actor = this.actorCallbacks?.dispatcher == null ? null : await this.actorCallbacks.dispatcher(context, identifier);
+			const localOrigin = context.canonicalOrigin;
+			const resolution = resolvePortableInboxRecipient(actor == null || actor instanceof Tombstone ? null : actor, {
+				authority: portable.portableRequest.authority,
+				canonicalInboxId: portable.canonicalId,
+				localOrigin
+			});
+			if (resolution.status === "rejected") {
+				logger.debug("Not accepting a delivery to the portable inbox {inbox} on behalf of the actor {identifier}: {reason}.", {
+					inbox: portable.canonicalId,
+					identifier,
+					reason: resolution.reason
+				});
+				return await onNotFound(request);
+			}
+			const { recipient } = resolution;
+			if (this.actorCallbacks?.keyPairsDispatcher != null) context = this.#createContext(request, contextData, { documentLoader: await context.getDocumentLoader({ identifier }) });
+			const excludedOrigins = [localOrigin, new URL(request.url).origin];
+			return await this.#handleInbox(request, {
+				recipient: identifier,
+				observation,
+				context,
+				contextData,
+				onNotFound,
+				portableInbox: {
+					recipient,
+					forward: async (activity, activityId, activityType, signatures) => {
+						if (this.portableInboxForwarding.maxTargets < 1) return;
+						if (this.kv.cas == null) {
+							if (!this.#portableInboxForwardingWarned) {
+								this.#portableInboxForwardingWarned = true;
+								logger.warn("Activities delivered to FEP-ef61 portable inboxes are not forwarded to the other gateways, as the key–value store does not support compare-and-swap (KvStore.cas()), which is needed to forward each activity at most once.");
+							}
+							return;
+						}
+						await forwardPortableInboxActivity({
+							recipient,
+							activity,
+							activityId,
+							activityType,
+							excludedOrigins,
+							baseUrl: context.origin,
+							kv: this.kv,
+							kvPrefix: this.kvPrefixes.portableInboxForwarding,
+							outboxQueue: this.outboxQueue,
+							startQueue: this.manuallyStartQueue ? void 0 : () => this._startQueueInternal(contextData),
+							allowPrivateAddress: this.allowPrivateAddress,
+							getKeys: () => this.#getPortableGatewayKeyPairs(context, identifier, recipient),
+							specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
+							signatures,
+							options: this.portableInboxForwarding,
+							meterProvider: this.meterProvider,
+							tracerProvider: this.tracerProvider
+						});
+					}
+				}
+			});
+		}, span);
+	}
+	/**
+	* Gets this server's gateway key pairs for the portable actor that owns
+	* a portable inbox, which sign the activities forwarded from the inbox.
+	* @param context The context.
+	* @param identifier The identifier of the portable actor.
+	* @param recipient The portable inbox.
+	* @returns The key pairs, or an empty array if the actor has no gateway
+	*          keys on this server.
+	*/
+	async #getPortableGatewayKeyPairs(context, identifier, recipient) {
+		const logger = getLogger([
+			"fedify",
+			"federation",
+			"inbox"
+		]);
+		if (this.actorCallbacks?.keyPairsDispatcher == null || this.actorCallbacks.portableActorIdMapper == null) {
+			logger.debug("Forwarding activities from the portable inbox {inbox} without HTTP Signatures, as gateway keys need both a key pairs dispatcher and a portable actor ID mapper.", { inbox: recipient.canonicalInboxId });
+			return [];
+		}
+		const actorId = getCanonicalPortableId(recipient.actorId);
+		if (actorId == null) return [];
+		const keyPairs = await context.getActorKeyPairs(identifier);
+		for (const { cryptographicKey } of keyPairs) {
+			const owner = cryptographicKey.ownerId;
+			const canonicalOwner = owner == null ? null : getCanonicalPortableId(owner);
+			if (canonicalOwner === actorId) continue;
+			if (canonicalOwner == null) logger.debug("Forwarding activities from the portable inbox {inbox} without HTTP Signatures, as the key pairs of the actor {identifier} are not the gateway keys of a portable actor.", {
+				inbox: recipient.canonicalInboxId,
+				identifier
+			});
+			else logger.warn("Forwarding activities from the portable inbox {inbox} without HTTP Signatures, as the key pairs of the actor {identifier} are the gateway keys of {owner}, not of the recipient {actorId}.", {
+				inbox: recipient.canonicalInboxId,
+				identifier,
+				owner: canonicalOwner,
+				actorId
+			});
+			return [];
+		}
+		return keyPairs.map(({ keyId, privateKey }) => ({
+			keyId,
+			privateKey
+		}));
+	}
+	async #fetchHashlinkMedia(request, media, { onNotFound, contextData, span, metricState }) {
+		metricState.endpoint = "hashlink_media";
+		metricState.routeTemplate = HASHLINK_MEDIA_ROUTE_TEMPLATE;
+		span.updateName(`${request.method} ${HASHLINK_MEDIA_ROUTE_TEMPLATE}`);
+		if (request.method !== "GET" && request.method !== "HEAD") return new Response("Method not allowed.", {
+			status: 405,
+			headers: {
+				Allow: "GET, HEAD",
+				"Content-Type": "text/plain; charset=utf-8"
+			}
+		});
+		if (media.type === "malformed") {
+			getLogger([
+				"fedify",
+				"federation",
+				"hashlinkMedia"
+			]).debug("Malformed FEP-ef61 hashlink media request {url}: {error}", {
+				url: request.url,
+				error: media.error
+			});
+			return new Response(request.method === "HEAD" ? null : "Malformed hashlink.", {
+				status: 400,
+				headers: { "Content-Type": "text/plain; charset=utf-8" }
+			});
+		}
+		const context = this.#createContext(request, contextData);
+		const response = await this.hashlinkMediaDispatcher(context, media.media);
+		if (response == null) return await onNotFound(request);
+		return await discardBodyForHead(request, response, false);
+	}
+};
+const PORTABLE_GATEWAY_ROUTE_PREFIX = "/.well-known/apgateway/{did}";
+/**
+* Gets the origin that a followers collection request filters followers by,
+* i.e., its normalized `base-url` query parameter (FEP-8fcf).
+* @returns The origin with a trailing slash, or `null` if the parameter is
+*          missing or invalid.
+*/
+function getFollowersBaseUrl(url) {
+	const baseUrl = url.searchParams.get("base-url");
+	if (baseUrl == null) return null;
+	try {
+		return `${new URL(baseUrl).origin}/`;
+	} catch {
+		return null;
+	}
+}
+function getFollowersFilterPredicate(baseUrl) {
+	return (i) => (i instanceof URL ? i.href : i.id?.href ?? "").startsWith(baseUrl);
+}
+const ACTOR_COLLECTION_ROUTE_ERRORS = {
+	outbox: "No outbox dispatcher registered.",
+	following: "No following collection path registered.",
+	followers: "No followers collection path registered.",
+	liked: "No liked collection path registered.",
+	featured: "No featured collection path registered.",
+	featuredTags: "No featured tags collection path registered."
 };
+/**
+* Checks that the authority of a portable ID to build is given, either
+* explicitly or by the FEP-ef61 gateway request being handled.
+* @throws {TypeError} If the authority is missing.
+*/
+function requirePortableAuthority(authority) {
+	if (authority == null) throw new TypeError("The authority of a portable ID is required outside an FEP-ef61 gateway request.");
+	return authority;
+}
+/**
+* Removes the body of a response to a `HEAD` request.
+* @param request The request.
+* @param response The response to the request.
+* @param waitForCancel Whether to wait until the discarded body is cancelled.
+* @returns The response without a body if the request is a `HEAD` request,
+*          or the response itself otherwise.
+*/
+async function discardBodyForHead(request, response, waitForCancel = true) {
+	if (request.method !== "HEAD" || response.body == null) return response;
+	const cancelled = response.body.cancel();
+	if (waitForCancel) await cancelled;
+	else cancelled.catch((error) => {
+		getLogger([
+			"fedify",
+			"federation",
+			"http"
+		]).debug("Failed to cancel the body of a response to {method} {url}: {error}", {
+			method: request.method,
+			url: request.url,
+			error
+		});
+	});
+	return new Response(null, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: response.headers
+	});
+}
 function getEndpointCategory(routeName) {
 	if (routeName.startsWith("object:")) return "object";
 	if (routeName.startsWith("collection:") || routeName.startsWith("orderedCollection:")) return "collection";
@@ -4438,12 +7163,28 @@ function getCollectionMetricRoute(routeName) {
 	}
 }
 const FANOUT_THRESHOLD = 5;
+/**
+* Creates the FEP-ef61 portable object verifier that a context applies to
+* portable objects it dereferences: `verifyPortableObject()` with the given
+* loaders and the federation's tracer provider as defaults.  Other options,
+* such as the document URL, gateways, and referrer, are passed through as
+* they are.
+*/
+function createPortableObjectVerifier(documentLoader, contextLoader, federation) {
+	return (document, options = {}) => verifyPortableObject(document, {
+		...options,
+		documentLoader: options.documentLoader ?? documentLoader,
+		contextLoader: options.contextLoader ?? contextLoader,
+		tracerProvider: options.tracerProvider ?? federation.tracerProvider
+	});
+}
 var ContextImpl = class ContextImpl {
 	url;
 	federation;
 	data;
 	documentLoader;
 	contextLoader;
+	verifyPortableObject;
 	invokedFromActorKeyPairsDispatcher;
 	#codec;
 	constructor({ url, federation, data, documentLoader, contextLoader, invokedFromActorKeyPairsDispatcher }) {
@@ -4452,6 +7193,7 @@ var ContextImpl = class ContextImpl {
 		this.data = data;
 		this.documentLoader = documentLoader;
 		this.contextLoader = contextLoader;
+		this.verifyPortableObject = createPortableObjectVerifier(documentLoader, contextLoader, federation);
 		this.invokedFromActorKeyPairsDispatcher = invokedFromActorKeyPairsDispatcher;
 	}
 	/**
@@ -4520,22 +7262,43 @@ var ContextImpl = class ContextImpl {
 		return new URL(path, this.canonicalOrigin);
 	}
 	getActorUri(identifier) {
+		return new URL(this.#getActorPath(identifier), this.canonicalOrigin);
+	}
+	getPortableActorUri(identifier, authority) {
+		const path = this.#getActorPath(identifier);
+		return buildPortableUri(requirePortableAuthority(authority), path);
+	}
+	#getActorPath(identifier) {
 		const path = this.federation.router.build(`actorAlias:${identifier}`, {}) ?? this.federation.router.build("actor", { identifier });
 		if (path == null) throw new RouterError("No actor dispatcher registered.");
-		return new URL(path, this.canonicalOrigin);
+		return path;
 	}
 	getObjectUri(cls, values) {
+		return new URL(this.#getObjectPath(cls, values), this.canonicalOrigin);
+	}
+	getPortableObjectUri(cls, values, authority) {
+		const path = this.#getObjectPath(cls, values);
+		return buildPortableUri(requirePortableAuthority(authority), path);
+	}
+	#getObjectPath(cls, values) {
 		const callbacks = this.federation.objectCallbacks[cls.typeId.href];
 		if (callbacks == null) throw new RouterError("No object dispatcher registered.");
 		for (const param of callbacks.parameters) if (!(param in values)) throw new TypeError(`Missing parameter: ${param}`);
 		const path = this.federation.router.build(`object:${cls.typeId.href}`, values);
 		if (path == null) throw new RouterError("No object dispatcher registered.");
-		return new URL(path, this.canonicalOrigin);
+		return path;
+	}
+	#getActorCollectionPath(route, identifier) {
+		const path = this.federation.router.build(route, { identifier });
+		if (path == null) throw new RouterError(ACTOR_COLLECTION_ROUTE_ERRORS[route]);
+		return path;
 	}
 	getOutboxUri(identifier) {
-		const path = this.federation.router.build("outbox", { identifier });
-		if (path == null) throw new RouterError("No outbox dispatcher registered.");
-		return new URL(path, this.canonicalOrigin);
+		return new URL(this.#getActorCollectionPath("outbox", identifier), this.canonicalOrigin);
+	}
+	getPortableOutboxUri(identifier, authority) {
+		const path = this.#getActorCollectionPath("outbox", identifier);
+		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
 	getMediaUploaderUri(identifier) {
 		const path = this.federation.router.build("mediaUploader", { identifier });
@@ -4552,42 +7315,75 @@ var ContextImpl = class ContextImpl {
 		if (path == null) throw new RouterError("No inbox path registered.");
 		return new URL(path, this.canonicalOrigin);
 	}
+	getPortableInboxUri(identifier, authority) {
+		const path = this.federation.router.build("inbox", { identifier });
+		if (path == null) throw new RouterError("No inbox path registered.");
+		return buildPortableUri(requirePortableAuthority(authority), path);
+	}
 	getFollowingUri(identifier) {
-		const path = this.federation.router.build("following", { identifier });
-		if (path == null) throw new RouterError("No following collection path registered.");
-		return new URL(path, this.canonicalOrigin);
+		return new URL(this.#getActorCollectionPath("following", identifier), this.canonicalOrigin);
+	}
+	getPortableFollowingUri(identifier, authority) {
+		const path = this.#getActorCollectionPath("following", identifier);
+		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
 	getFollowersUri(identifier) {
-		const path = this.federation.router.build("followers", { identifier });
-		if (path == null) throw new RouterError("No followers collection path registered.");
-		return new URL(path, this.canonicalOrigin);
+		return new URL(this.#getActorCollectionPath("followers", identifier), this.canonicalOrigin);
+	}
+	getPortableFollowersUri(identifier, authority) {
+		const path = this.#getActorCollectionPath("followers", identifier);
+		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
 	getLikedUri(identifier) {
-		const path = this.federation.router.build("liked", { identifier });
-		if (path == null) throw new RouterError("No liked collection path registered.");
-		return new URL(path, this.canonicalOrigin);
+		return new URL(this.#getActorCollectionPath("liked", identifier), this.canonicalOrigin);
+	}
+	getPortableLikedUri(identifier, authority) {
+		const path = this.#getActorCollectionPath("liked", identifier);
+		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
 	getFeaturedUri(identifier) {
-		const path = this.federation.router.build("featured", { identifier });
-		if (path == null) throw new RouterError("No featured collection path registered.");
-		return new URL(path, this.canonicalOrigin);
+		return new URL(this.#getActorCollectionPath("featured", identifier), this.canonicalOrigin);
+	}
+	getPortableFeaturedUri(identifier, authority) {
+		const path = this.#getActorCollectionPath("featured", identifier);
+		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
 	getFeaturedTagsUri(identifier) {
-		const path = this.federation.router.build("featuredTags", { identifier });
-		if (path == null) throw new RouterError("No featured tags collection path registered.");
-		return new URL(path, this.canonicalOrigin);
+		return new URL(this.#getActorCollectionPath("featuredTags", identifier), this.canonicalOrigin);
+	}
+	getPortableFeaturedTagsUri(identifier, authority) {
+		const path = this.#getActorCollectionPath("featuredTags", identifier);
+		return buildPortableUri(requirePortableAuthority(authority), path);
 	}
 	getCollectionUri(name, values) {
 		const path = this.federation.getCollectionPath(name, values);
 		if (path === null) throw new RouterError(`No collection dispatcher registered for "${String(name)}".`);
 		return new URL(path, this.canonicalOrigin);
 	}
-	parseUri(uri) {
+	getPortableCollectionUri(name, values, authority) {
+		const path = this.federation.getCollectionPath(name, values);
+		if (path === null) throw new RouterError(`No collection dispatcher registered for "${String(name)}".`);
+		return buildPortableUri(requirePortableAuthority(authority), path);
+	}
+	parseUri(uri, options = {}) {
 		if (uri == null) return null;
-		if (uri.origin !== this.origin && uri.origin !== this.canonicalOrigin) return null;
-		const route = this.federation.router.route(uri.pathname);
-		if (route == null) return null;
-		else if (route.name === "sharedInbox") return {
+		if (uri.origin === this.origin || uri.origin === this.canonicalOrigin) {
+			const route = this.federation.router.route(uri.pathname);
+			if (route != null) return this.#parseRoute(route);
+		}
+		if (!options.portable) return null;
+		const portable = parsePortableId(uri);
+		if (portable == null) return null;
+		const route = this.federation.router.route(portable.path);
+		if (route == null || route.name === "sharedInbox") return null;
+		const result = this.#parseRoute(route);
+		return result == null ? null : {
+			...result,
+			authority: portable.authority
+		};
+	}
+	#parseRoute(route) {
+		if (route.name === "sharedInbox") return {
 			type: "inbox",
 			identifier: void 0
 		};
@@ -4635,8 +7431,10 @@ var ContextImpl = class ContextImpl {
 		const collectionRegex = new RegExp(`^(${["collection", "orderedCollection"].join("|")}):(.*)$`);
 		const match = route.name.match(collectionRegex);
 		if (match !== null) {
-			const [, type, name] = match;
+			const [, type] = match;
+			const name = this.federation.getCollectionName(route.name);
 			const cls = this.federation.collectionTypeIds[name];
+			if (cls == null) return null;
 			return {
 				type,
 				name,
@@ -4657,14 +7455,15 @@ var ContextImpl = class ContextImpl {
 			getActorKeyPairsIdentifier: identifier,
 			actorKeyPairsDispatcherIdentifier: this.invokedFromActorKeyPairsDispatcher.identifier
 		});
+		const portableActor = await this.getPortableActorKeyOwner(identifier);
 		let keyPairs;
 		try {
-			keyPairs = await this.getKeyPairsFromIdentifier(identifier);
+			keyPairs = await this.getKeyPairsFromIdentifier(identifier, portableActor);
 		} catch (_) {
 			logger.warn("No actor key pairs dispatcher registered.");
 			return [];
 		}
-		const owner = this.getActorUri(identifier);
+		const owner = portableActor?.id ?? this.getActorUri(identifier);
 		const result = [];
 		let i = 1;
 		for (const keyPair of keyPairs) {
@@ -4676,7 +7475,7 @@ var ContextImpl = class ContextImpl {
 					publicKey: keyPair.publicKey
 				}),
 				multikey: new Multikey({
-					id: new URL(`#multikey-${i}`, owner),
+					id: portableActor == null ? new URL(`#multikey-${i}`, owner) : keyPair.keyId,
 					controller: owner,
 					publicKey: keyPair.publicKey
 				})
@@ -4686,7 +7485,26 @@ var ContextImpl = class ContextImpl {
 		}
 		return result;
 	}
-	async getKeyPairsFromIdentifier(identifier) {
+	/**
+	* Resolves the portable actor that the actor with the given identifier is,
+	* through the portable actor ID mapper, along with the base of its gateway
+	* key IDs on this server.
+	* @param identifier The actor's identifier.
+	* @returns The portable actor's ID and key ID base, or `null` if the actor
+	*          is not portable.
+	* @throws {TypeError} If the mapper returns an invalid portable actor ID.
+	*/
+	async getPortableActorKeyOwner(identifier) {
+		const mapper = this.federation.actorCallbacks?.portableActorIdMapper;
+		if (mapper == null) return null;
+		const id = await mapper(this, identifier);
+		if (id == null) return null;
+		return {
+			id,
+			keyBase: getGatewayKeyBase(id, this.canonicalOrigin)
+		};
+	}
+	async getKeyPairsFromIdentifier(identifier, portableActor) {
 		const logger = getLogger([
 			"fedify",
 			"federation",
@@ -4703,6 +7521,8 @@ var ContextImpl = class ContextImpl {
 			}
 			throw error;
 		}
+		if (portableActor === void 0) portableActor = await this.getPortableActorKeyOwner(identifier);
+		const keyBase = portableActor?.keyBase ?? actorUri;
 		const keyPairs = await this.federation.actorCallbacks?.keyPairsDispatcher(new ContextImpl({
 			...this,
 			invokedFromActorKeyPairsDispatcher: { identifier }
@@ -4713,7 +7533,7 @@ var ContextImpl = class ContextImpl {
 		for (const keyPair of keyPairs) {
 			result.push({
 				...keyPair,
-				keyId: new URL(i == 0 ? `#main-key` : `#key-${i + 1}`, actorUri)
+				keyId: new URL(i == 0 ? `#main-key` : `#key-${i + 1}`, keyBase)
 			});
 			i++;
 		}
@@ -4759,6 +7579,7 @@ var ContextImpl = class ContextImpl {
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
 			meterProvider: options.meterProvider ?? this.meterProvider,
+			verifyPortableObject: options.verifyPortableObject ?? this.verifyPortableObject,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}
@@ -4766,7 +7587,8 @@ var ContextImpl = class ContextImpl {
 		return traverseCollection(collection, {
 			...options,
 			documentLoader: options.documentLoader ?? this.documentLoader,
-			contextLoader: options.contextLoader ?? this.contextLoader
+			contextLoader: options.contextLoader ?? this.contextLoader,
+			verifyPortableObject: options.verifyPortableObject ?? this.verifyPortableObject
 		});
 	}
 	lookupNodeInfo(url, options = {}) {
@@ -4884,18 +7706,18 @@ var ContextImpl = class ContextImpl {
 			});
 			throw new TypeError("The activity to send must have at least one actor property.");
 		}
-		let proofCreated = false;
-		if (actorKeyPairs != null) {
-			const contextLoader = this.contextLoader;
-			for (const kp of actorKeyPairs) {
-				if (kp.privateKey.algorithm.name !== "Ed25519" || kp.multikey.id == null) continue;
-				activity = await signObject(activity, kp.privateKey, kp.multikey.id, {
-					contextLoader,
-					tracerProvider: this.tracerProvider
-				});
-				proofCreated = true;
-			}
-		}
+		const { activity: signedActivity, proofCreated } = await signOutgoingActivity(activity, actorKeyPairs == null ? keys.map(({ keyId, privateKey }) => ({
+			verificationMethod: keyId,
+			privateKey
+		})) : actorKeyPairs.flatMap((kp) => kp.multikey.id == null ? [] : [{
+			verificationMethod: kp.multikey.id,
+			privateKey: kp.privateKey
+		}]), {
+			contextLoader: this.contextLoader,
+			tracerProvider: this.tracerProvider,
+			appendToExistingProofs: actorKeyPairs != null
+		});
+		activity = signedActivity;
 		const inboxes = extractInboxes({
 			recipients: expandedRecipients,
 			preferSharedInbox: options.preferSharedInbox,
@@ -4913,13 +7735,27 @@ var ContextImpl = class ContextImpl {
 			activityId: activity.id?.href,
 			activity
 		});
+		const activityJsonLd = await activity.toJsonLd({
+			format: "compact",
+			contextLoader: this.contextLoader
+		});
+		try {
+			await warnCompatibleIdsInJson(activityJsonLd, this instanceof RequestContextImpl && !this.isInActorDispatcher() ? this : void 0);
+		} catch (error) {
+			logger.debug("Could not check the first gateway of activity {activityId}: {error}", {
+				activityId: activity.id?.href,
+				error
+			});
+		}
 		if (this.federation.fanoutQueue == null || options.immediate || options.fanout === "skip" || (options.fanout ?? "auto") === "auto" && globalThis.Object.keys(inboxes).length < FANOUT_THRESHOLD) {
 			await this.federation.sendActivity(keys, inboxes, activity, {
 				...opts,
+				activityJsonLd,
 				normalizeExistingProofs: proofCreated || options.normalizeExistingProofs
 			});
 			return true;
 		}
+		assertSupportedCompoundProofShape(activityJsonLd, activity.id?.href);
 		const keyJwkPairs = await Promise.all(keys.map(async ({ keyId, privateKey }) => ({
 			keyId: keyId.href,
 			privateKey: await exportJwk(privateKey)
@@ -4931,14 +7767,12 @@ var ContextImpl = class ContextImpl {
 			id: crypto.randomUUID(),
 			baseUrl: this.origin,
 			keys: keyJwkPairs,
-			inboxes: globalThis.Object.fromEntries(globalThis.Object.entries(inboxes).map(([k, { actorIds, sharedInbox }]) => [k, {
+			inboxes: globalThis.Object.fromEntries(globalThis.Object.entries(inboxes).map(([k, { actorIds, sharedInbox, portableInbox, gatewayInboxes }]) => [k, {
 				actorIds: [...actorIds],
-				sharedInbox
+				sharedInbox,
+				...getPortableMessageFields(portableInbox, gatewayInboxes)
 			}])),
-			activity: await activity.toJsonLd({
-				format: "compact",
-				contextLoader: this.contextLoader
-			}),
+			activity: activityJsonLd,
 			activityId: activity.id?.href,
 			activityType: getTypeId(activity).href,
 			collectionSync: opts.collectionSync,
@@ -5012,8 +7846,13 @@ var ContextImpl = class ContextImpl {
 			"inbox"
 		]);
 		const contextLoader = options.contextLoader ?? this.contextLoader;
-		const json = await activity.toJsonLd({ contextLoader });
-		const keyCache = new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, this);
+		let json = await activity.toJsonLd({ contextLoader });
+		const keyCache = new KvKeyCache(this.federation.kv, this.federation.kvPrefixes.publicKey, {
+			documentLoader: this.documentLoader,
+			contextLoader: this.contextLoader,
+			tracerProvider: this.tracerProvider,
+			keyTtl: this.federation.publicKeyTtl
+		});
 		if (await verifyObject(Activity, json, {
 			contextLoader,
 			documentLoader: options.documentLoader ?? this.documentLoader,
@@ -5046,7 +7885,7 @@ var ContextImpl = class ContextImpl {
 					activity: await fetched.toJsonLd({ contextLoader })
 				});
 				return false;
-			} else if (fetched.id?.href !== activity.id.href) {
+			} else if (fetched.id == null || !isSameObjectId(fetched.id, activity.id)) {
 				logger.debug("Fetched activity object has a different ID; failed to verify.", {
 					recipient,
 					activity: await fetched.toJsonLd({ contextLoader })
@@ -5059,8 +7898,8 @@ var ContextImpl = class ContextImpl {
 				});
 				return false;
 			}
-			const activityId = fetched.id;
-			if (!fetched.actorIds.every((actor) => actor.origin === activityId.origin)) {
+			const activityOrigin = getAuthenticationOrigin(fetched.id);
+			if (activityOrigin == null || !fetched.actorIds.every((actor) => getAuthenticationOrigin(actor) === activityOrigin)) {
 				logger.debug("Fetched activity object has actors from different origins; unable to verify.", {
 					recipient,
 					activity: await fetched.toJsonLd({ contextLoader })
@@ -5069,6 +7908,7 @@ var ContextImpl = class ContextImpl {
 			}
 			logger.debug("Successfully fetched the remote activity object {activityId}; ignore the original activity and use the fetched one, which is trustworthy.");
 			activity = fetched;
+			json = await fetched.toJsonLd({ contextLoader });
 		} else logger.debug("Object Integrity Proofs are verified.", {
 			recipient,
 			activity: json
@@ -5097,13 +7937,19 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 	#invokedFromActorDispatcher;
 	#invokedFromObjectDispatcher;
 	request;
+	/** Whether a diagnostic actor lookup would re-enter the actor dispatcher. */
+	isInActorDispatcher() {
+		return this.#invokedFromActorDispatcher != null;
+	}
 	url = void 0;
+	portableRequest;
 	constructor(options) {
 		super(options);
 		this.#invokedFromActorDispatcher = options.invokedFromActorDispatcher;
 		this.#invokedFromObjectDispatcher = options.invokedFromObjectDispatcher;
 		this.request = options.request;
 		this.url = options.url;
+		this.portableRequest = options.portableRequest;
 	}
 	clone(data) {
 		return new RequestContextImpl({
@@ -5115,9 +7961,40 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 			invokedFromActorKeyPairsDispatcher: this.invokedFromActorKeyPairsDispatcher,
 			invokedFromActorDispatcher: this.#invokedFromActorDispatcher,
 			invokedFromObjectDispatcher: this.#invokedFromObjectDispatcher,
+			portableRequest: this.portableRequest,
 			request: this.request
 		});
 	}
+	getPortableActorUri(identifier, authority) {
+		return super.getPortableActorUri(identifier, authority ?? this.portableRequest?.authority);
+	}
+	getPortableObjectUri(cls, values, authority) {
+		return super.getPortableObjectUri(cls, values, authority ?? this.portableRequest?.authority);
+	}
+	getPortableInboxUri(identifier, authority) {
+		return super.getPortableInboxUri(identifier, authority ?? this.portableRequest?.authority);
+	}
+	getPortableOutboxUri(identifier, authority) {
+		return super.getPortableOutboxUri(identifier, authority ?? this.portableRequest?.authority);
+	}
+	getPortableFollowingUri(identifier, authority) {
+		return super.getPortableFollowingUri(identifier, authority ?? this.portableRequest?.authority);
+	}
+	getPortableFollowersUri(identifier, authority) {
+		return super.getPortableFollowersUri(identifier, authority ?? this.portableRequest?.authority);
+	}
+	getPortableLikedUri(identifier, authority) {
+		return super.getPortableLikedUri(identifier, authority ?? this.portableRequest?.authority);
+	}
+	getPortableFeaturedUri(identifier, authority) {
+		return super.getPortableFeaturedUri(identifier, authority ?? this.portableRequest?.authority);
+	}
+	getPortableFeaturedTagsUri(identifier, authority) {
+		return super.getPortableFeaturedTagsUri(identifier, authority ?? this.portableRequest?.authority);
+	}
+	getPortableCollectionUri(name, values, authority) {
+		return super.getPortableCollectionUri(name, values, authority ?? this.portableRequest?.authority);
+	}
 	async getActor(identifier, options) {
 		if (this.federation.actorCallbacks == null || this.federation.actorCallbacks.dispatcher == null) throw new Error("No actor dispatcher registered.");
 		if (this.#invokedFromActorDispatcher != null) getLogger([
@@ -5135,7 +8012,7 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 		if (actor instanceof Tombstone && options?.tombstone !== "passthrough") return null;
 		return actor;
 	}
-	async getObject(cls, values) {
+	async getObject(cls, values, options) {
 		const callbacks = this.federation.objectCallbacks[cls.typeId.href];
 		if (callbacks == null) throw new Error("No object dispatcher registered.");
 		for (const param of callbacks.parameters) if (!(param in values)) throw new TypeError(`Missing parameter: ${param}`);
@@ -5145,13 +8022,15 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 			actorDispatcherClass: this.#invokedFromObjectDispatcher.cls.name,
 			actorDispatcherValues: this.#invokedFromObjectDispatcher.values
 		});
-		return await callbacks.dispatcher(new RequestContextImpl({
+		const object = await callbacks.dispatcher(new RequestContextImpl({
 			...this,
 			invokedFromObjectDispatcher: {
 				cls,
 				values
 			}
 		}), values);
+		if (object instanceof Tombstone && !(object instanceof cls) && options?.tombstone !== "passthrough") return null;
+		return object;
 	}
 	#signedKey = void 0;
 	async getSignedKey(options = {}) {
@@ -5161,6 +8040,7 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 			contextLoader: options.contextLoader ?? this.contextLoader,
 			documentLoader: options.documentLoader ?? this.documentLoader,
 			timeWindow: this.federation.signatureTimeWindow,
+			maxSignatures: this.federation.maxHttpSignatures,
 			meterProvider: this.meterProvider,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider
 		});
@@ -5192,6 +8072,9 @@ var RequestContextImpl = class RequestContextImpl extends ContextImpl {
 			throw error;
 		}
 	}
+	async isSignedByAudience(object, options = {}) {
+		return await isInAudience(object, null) || await isInAudience(object, await this.getSignedKeyOwner(options), options);
+	}
 };
 function forwardActivity(ctx, loggerCategory, forwarder, recipients, options) {
 	return ctx.tracerProvider.getTracer(name, version).startActiveSpan(ctx.federation.outboxQueue == null || options?.immediate ? `activitypub.${loggerCategory}` : "activitypub.fanout", {
@@ -5279,16 +8162,16 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 		if (options?.immediate) logger.debug("Forwarding activity immediately without queue since immediate option is set.");
 		else logger.debug("Forwarding activity immediately without queue since queue is not set.");
 		const promises = [];
-		for (const inbox in inboxes) promises.push(sendActivity({
+		for (const inbox in inboxes) promises.push(sendActivityToInbox(inbox, inboxes[inbox].gatewayInboxes, {
+			allowPrivateAddress: ctx.federation.allowPrivateAddress,
 			keys,
 			activity: ctx.activity,
 			activityId: ctx.activityId,
 			activityType: ctx.activityType,
-			inbox: new URL(inbox),
 			sharedInbox: inboxes[inbox].sharedInbox,
 			meterProvider: ctx.meterProvider,
 			tracerProvider: ctx.tracerProvider,
-			specDeterminer: new KvSpecDeterminer(ctx.federation.kv, ctx.federation.kvPrefixes.httpMessageSignaturesSpec, ctx.federation.firstKnock)
+			specDeterminer: new KvSpecDeterminer(ctx.federation.kv, ctx.federation.kvPrefixes.httpMessageSignaturesSpec, ctx.federation.firstKnock, { specTtl: ctx.federation.httpMessageSignaturesSpecTtl })
 		}));
 		await Promise.all(promises);
 		return true;
@@ -5312,7 +8195,7 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 	const started = (/* @__PURE__ */ new Date()).toISOString();
 	const messages = [];
 	for (const inbox in inboxes) {
-		const inboxUrl = new URL(inbox);
+		const { portableInbox, gatewayInboxes } = inboxes[inbox];
 		const message = {
 			type: "outbox",
 			id: crypto.randomUUID(),
@@ -5327,7 +8210,8 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 			started,
 			attempt: 0,
 			headers: {},
-			orderingKey: orderingKey == null ? void 0 : `${orderingKey}\n${inboxUrl.origin}`,
+			orderingKey: orderingKey == null ? void 0 : `${orderingKey}\n${getOrderingDestination(inbox, portableInbox)}`,
+			...getPortableMessageFields(portableInbox, gatewayInboxes),
 			traceContext: carrier
 		};
 		messages.push({
@@ -5459,16 +8343,18 @@ var KvSpecDeterminer = class {
 	kv;
 	prefix;
 	defaultSpec;
-	constructor(kv, prefix, defaultSpec = "rfc9421") {
+	specTtl;
+	constructor(kv, prefix, defaultSpec = "rfc9421", options = {}) {
 		this.kv = kv;
 		this.prefix = prefix;
 		this.defaultSpec = defaultSpec;
+		this.specTtl = options.specTtl ?? Temporal.Duration.from({ days: 90 });
 	}
 	async determineSpec(origin) {
 		return await this.kv.get([...this.prefix, origin]) ?? this.defaultSpec;
 	}
 	async rememberSpec(origin, spec) {
-		await this.kv.set([...this.prefix, origin], spec);
+		await this.kv.set([...this.prefix, origin], spec, { ttl: this.specTtl });
 	}
 };
 function notFound(_request) {
@@ -5505,4 +8391,4 @@ function getRequestId(request) {
 	return `req_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
 }
 //#endregion
-export { handleNodeInfo as _, OutboxContextImpl as a, autoIdAssigner as b, handleActor as c, handleInbox as d, handleObject as f, handleBenchmarkTrigger as g, respondWithObjectIfAcceptable as h, KvSpecDeterminer as i, handleCollection as l, respondWithObject as m, FederationImpl as n, createFederation as o, handleOutbox as p, InboxContextImpl as r, handleWebFinger as s, ContextImpl as t, handleCustomCollection as u, handleNodeInfoJrd as v, actorDehydrator as y };
+export { getEmbeddedFirstGateway as C, handleNodeInfoJrd as D, handleNodeInfo as E, actorDehydrator as O, getCompactRootId as S, handleBenchmarkTrigger as T, coversDelivery as _, OutboxContextImpl as a, PORTABLE_OBJECT_CONTENT_TYPE as b, assertPortableActorActivity as c, handleCustomCollection as d, handleInbox as f, respondWithObjectIfAcceptable as g, respondWithObject as h, KvSpecDeterminer as i, autoIdAssigner as k, handleActor as l, handleOutbox as m, FederationImpl as n, createFederation as o, handleObject as p, InboxContextImpl as r, handleWebFinger as s, ContextImpl as t, handleCollection as u, forwardPortableInboxActivity as v, warnCompatibleIdsInJson as w, parseHashlinkGatewayRequest as x, resolvePortableInboxForwardingOptions as y };