@fedify/fedify 2.4.0-pr.936.41 → 2.5.0-dev.2271

package/dist/testing/mod.d.mts

@@ -2,10 +2,10 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { ExportResultCode } from "@opentelemetry/core";
 import { Router } from "@fedify/uri-template";
-import { Activity, Actor, Collection, CryptographicKey, Hashtag, Link, LookupObjectOptions, Multikey, Note, Object as Object$1, Recipient, Tombstone, TraverseCollectionOptions } from "@fedify/vocab";
+import { Activity, Actor, Collection, CryptographicKey, DataIntegrityProof, Hashtag, Link, LookupObjectOptions, Multikey, Note, Object as Object$1, Recipient, Tombstone, TraverseCollectionOptions } from "@fedify/vocab";
 import { Link as Link$1, LookupWebFingerOptions, ResourceDescriptor } from "@fedify/webfinger";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
-import { AuthenticatedDocumentLoaderFactory, DocumentLoader, DocumentLoaderFactory, GetUserAgentOptions } from "@fedify/vocab-runtime";
+import { AuthenticatedDocumentLoaderFactory, DocumentLoader, DocumentLoaderFactory, GetUserAgentOptions, PortableObjectVerifier } from "@fedify/vocab-runtime";
 import { MeterProvider as MeterProvider$1, MetricReader } from "@opentelemetry/sdk-metrics";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 
@@ -169,6 +169,215 @@ interface GetNodeInfoOptions {
   userAgent?: GetUserAgentOptions | string;
 }
 //#endregion
+//#region src/sig/proof.d.ts
+/**
+ * The reason why {@link verifyPortableObjectProof} could not verify a portable
+ * object proof.
+ * @since 2.4.0
+ */
+type VerifyPortableObjectProofFailureReason = {
+  /**
+   * The document has neither a portable `ap:` or `ap+ef61:` ID nor an
+   * FEP-ef61 compatible identifier.
+   */
+  readonly type: "notPortableObject";
+} | {
+  /**
+   * The document is a portable collection without an Object Integrity
+   * Proof.  Its trust policy is outside this verifier.
+   */
+  readonly type: "unsecuredCollection";
+} | {
+  /** The portable document is a core type outside FEP-ef61 proof policy. */readonly type: "unsupportedObjectType"; /** The FEP-2277 core type of the document. */
+  readonly objectType: "verificationMethod" | "publicKey" | "link";
+} | {
+  /** A portable actor, activity, or object has no proof. */readonly type: "missingProof";
+} | {
+  /**
+   * A portable actor's `gateways` is missing or empty, or has an item that
+   * is not an HTTP(S) URI with an empty path, query, and fragment.
+   * The document is rejected before its proofs are verified, so this
+   * reason does not mean that the proofs are valid.
+   */
+  readonly type: "invalidGateways";
+} | {
+  /** The proof is malformed, unsupported, or cryptographically invalid. */readonly type: "invalidProof"; /** The zero-based index of the invalid proof. */
+  readonly proofIndex: number;
+} | {
+  /** The proof's verification method is not a valid DID URL. */readonly type: "unsupportedVerificationMethod"; /** The zero-based index of the proof. */
+  readonly proofIndex: number; /** The unsupported verification method. */
+  readonly verificationMethod: URL;
+} | {
+  /** The verification method DID does not match the portable ID authority. */readonly type: "verificationMethodMismatch"; /** The zero-based index of the proof. */
+  readonly proofIndex: number; /** The portable object ID. */
+  readonly objectId: URL; /** The mismatching verification method. */
+  readonly verificationMethod: URL;
+};
+//#endregion
+//#region src/sig/compound-proof.d.ts
+/** Why compound-proof discovery could not produce an atomic result. */
+type CompoundProofDiscoveryFailureReason = {
+  readonly type: "invalidJsonTree";
+  readonly path: string;
+} | {
+  readonly type: "unsupportedProofShape";
+  readonly path: string;
+} | {
+  readonly type: "limitExceeded";
+  readonly limit: "depth" | "maps" | "proofs" | "bytes";
+  readonly maximum: number;
+  readonly actual: number;
+  readonly path: string;
+};
+/** Why a discovered map-local proof did not verify. */
+type CompoundProofVerificationFailureReason = {
+  /** A nested secured map does not carry its own JSON-LD context. */readonly type: "missingContext";
+} | {
+  /** The direct proof is malformed, unsupported, or invalid. */readonly type: "invalidProof";
+};
+/** Why one portable map did not pass compound proof policy. */
+type CompoundPortableObjectFailureReason = CompoundProofVerificationFailureReason | VerifyPortableObjectProofFailureReason | {
+  /** The portable map could not be interpreted by the policy layer. */readonly type: "invalidPortableObject";
+};
+//#endregion
+//#region src/sig/http.d.ts
+/**
+ * The standard to use for signing and verifying HTTP signatures.
+ * @since 1.6.0
+ */
+type HttpMessageSignaturesSpec =
+/**
+ * The Signing HTTP Messages (draft-cavage-http-signatures-12) specification,
+ * which is widely adopted and used in the fediverse (as of May 2025).
+ */
+"draft-cavage-http-signatures-12"
+/**
+ * The HTTP Message Signatures (RFC 9421) specification, which is the
+ * finalized standard but not widely adopted yet (as of May 2025).
+ */
+| "rfc9421";
+/**
+ * The reason why {@link verifyRequestDetailed} could not verify a request.
+ * @since 2.1.0
+ */
+type VerifyRequestFailureReason = {
+  readonly type: "keyFetchError";
+  readonly keyId: URL;
+  readonly result: FetchKeyErrorResult;
+} | {
+  readonly type: "invalidSignature";
+  readonly keyId?: URL;
+} | {
+  readonly type: "noSignature";
+};
+//#endregion
+//#region src/sig/verification.d.ts
+/**
+ * A snapshot of a key actually used to check a signature.
+ * @since 2.4.0
+ */
+type InboxVerificationKey = {
+  readonly type: "cryptographicKey";
+  readonly id: URL | null;
+  readonly ownerId: URL | null;
+  readonly publicKey: CryptoKey;
+} | {
+  readonly type: "multikey";
+  readonly id: URL | null;
+  readonly controllerId: URL | null;
+  readonly publicKey: CryptoKey;
+};
+/**
+ * Why a cryptographic check failed.
+ * @since 2.4.0
+ */
+type InboxSignatureFailureReason = {
+  readonly type: "invalidSignature";
+} | {
+  readonly type: "keyFetchError";
+  readonly keyId: URL;
+  readonly result: FetchKeyErrorResult;
+};
+/**
+ * The signature or proof being checked.
+ * @since 2.4.0
+ */
+type InboxSignatureIdentity = {
+  readonly mechanism: "http";
+  readonly spec: HttpMessageSignaturesSpec;
+  readonly label: string | null;
+} | {
+  readonly mechanism: "linkedData";
+} | {
+  readonly mechanism: "objectIntegrity";
+  readonly proofId: string | null; /** Index within this evaluation, not a global proof identifier. */
+  readonly proofIndex: number | null;
+};
+/**
+ * Evidence from one signature/proof, including cached-key retries.
+ * @since 2.4.0
+ */
+type InboxSignatureCheck = InboxSignatureIdentity & {
+  /** The declaration as received, including invalid IRIs. */readonly declaredKeyId: string | null; /** Keys actually tried, in use order; refresh details are not a retry API. */
+  readonly triedKeys: readonly InboxVerificationKey[];
+} & ({
+  readonly status: "verified";
+  readonly key: InboxVerificationKey;
+} | {
+  readonly status: "rejected";
+  readonly reason: InboxSignatureFailureReason;
+} | {
+  readonly status: "error";
+  readonly error: unknown;
+});
+/**
+ * A bounded proof-policy diagnostic.
+ * @since 2.4.0
+ */
+type InboxProofPolicyFailureReason = VerifyPortableObjectProofFailureReason | CompoundPortableObjectFailureReason | CompoundProofDiscoveryFailureReason | {
+  readonly type: "invalidObjectId" | "invalidDocument" | "subjectMismatch";
+};
+/**
+ * Why a complete verification evaluation was rejected.
+ * @since 2.4.0
+ */
+type InboxVerificationFailureReason = {
+  readonly type: "noSignature";
+} | {
+  readonly type: "signatureVerificationFailed";
+} | {
+  readonly type: "uncoveredAttribution";
+  readonly attributionIds: readonly URL[];
+} | {
+  readonly type: "missingOwner";
+} | {
+  readonly type: "proofPolicy";
+  readonly reason: InboxProofPolicyFailureReason;
+};
+/**
+ * A logical verification evaluation, separate from inbox authentication.
+ * @since 2.4.0
+ */
+type InboxVerificationAttempt = {
+  readonly mechanism: "http" | "linkedData" | "objectIntegrity";
+  readonly subject: {
+    readonly id: URL | null; /** RFC 6901 pointer; empty for the root, null when unavailable. */
+    readonly pointer: string | null;
+  };
+  readonly checks: readonly InboxSignatureCheck[];
+} & ({
+  readonly status: "verified"; /** Direct references to successful members of checks. */
+  readonly signatures: readonly Extract<InboxSignatureCheck, {
+    status: "verified";
+  }>[];
+} | {
+  readonly status: "rejected";
+  readonly reason: InboxVerificationFailureReason;
+} | {
+  readonly status: "error";
+  readonly error: unknown;
+});
+//#endregion
 //#region src/sig/key.d.ts
 /**
  * Detailed fetch failure information from {@link fetchKeyDetailed}.
@@ -203,43 +412,111 @@ interface GetKeyOwnerOptions {
   tracerProvider?: TracerProvider;
 }
 //#endregion
-//#region src/compat/types.d.ts
+//#region src/federation/inbox-report.d.ts
 /**
- * A function that transforms an activity object.
- * @since 1.4.0
+ * A JSON value retained from the incoming request.
+ * @since 2.4.0
  */
-type ActivityTransformer<TContextData> = (activity: Activity, context: Context<TContextData>) => Activity;
-//#endregion
-//#region src/sig/http.d.ts
+type InboxJsonValue = null | boolean | number | string | readonly InboxJsonValue[] | {
+  readonly [key: string]: InboxJsonValue;
+};
 /**
- * The standard to use for signing and verifying HTTP signatures.
- * @since 1.6.0
+ * The final inbox authentication decision.
+ * @since 2.4.0
  */
-type HttpMessageSignaturesSpec =
+type InboxAuthentication = {
+  readonly status: "verified"; /** Direct references to the attempts that authenticated this delivery. */
+  readonly attempts: readonly Extract<InboxVerificationAttempt, {
+    status: "verified";
+  }>[];
+} | {
+  readonly status: "rejected";
+  readonly reason: {
+    readonly type: "verificationFailed";
+  } | {
+    readonly type: "actorKeyMismatch";
+    readonly key: InboxVerificationKey;
+    readonly actorIds: readonly URL[];
+  } | {
+    readonly type: "proofPolicy";
+    readonly policy: "portableActor" | "portableActivity" | "compound";
+    readonly detail?: InboxProofPolicyFailureReason;
+  } | {
+    readonly type: "invalidNonce";
+  };
+} | {
+  readonly status: "skipped";
+} | {
+  readonly status: "notDetermined";
+};
 /**
- * The Signing HTTP Messages (draft-cavage-http-signatures-12) specification,
- * which is widely adopted and used in the fediverse (as of May 2025).
+ * How an inbox request finished.
+ * @since 2.4.0
  */
-"draft-cavage-http-signatures-12"
+type InboxRequestOutcome = {
+  readonly type: "response";
+  readonly status: number;
+  readonly disposition: "processed" | "enqueued" | "duplicate" | "unhandled" | "customResponse";
+} | {
+  readonly type: "response";
+  readonly status: number;
+  readonly disposition: "rejected";
+  readonly reason: "recipientNotFound" | "invalidJson" | "invalidJsonLd" | "invalidActivity" | "bodyTooLarge" | "missingActor" | "authentication";
+} | {
+  readonly type: "response";
+  readonly status: number;
+  readonly disposition: "failed";
+  readonly reason: "bodyUnavailable" | "enqueueError" | "listenerError";
+  readonly error?: unknown;
+} | {
+  readonly type: "exception";
+  readonly stage: "prepare" | "parse" | "verify" | "policy" | "dispatch" | "respond"; /** The original thrown value, including null/undefined. */
+  readonly error: unknown;
+};
 /**
- * The HTTP Message Signatures (RFC 9421) specification, which is the
- * finalized standard but not widely adopted yet (as of May 2025).
+ * Observations of a single inbox delivery request.
+ * @since 2.4.0
  */
-| "rfc9421";
+interface InboxRequestReport {
+  /** The delivery route, including a portable gateway route. */
+  readonly inbox: {
+    readonly kind: "personal" | "shared" | "portable";
+    readonly recipient: string | null;
+  };
+  /** Unavailable differs from a successfully parsed JSON null. */
+  readonly payload: {
+    readonly status: "unavailable";
+  } | {
+    readonly status: "parsed";
+    readonly value: InboxJsonValue;
+  };
+  /** The Activity obtained by the normal processing flow, if any. */
+  readonly activity: Activity | null;
+  /** Logical evaluations, including unsuccessful fallback paths. */
+  readonly attempts: readonly InboxVerificationAttempt[];
+  /** Cryptographic success alone does not imply this decision is verified. */
+  readonly authentication: InboxAuthentication;
+  /** Response status snapshot or the original exception. */
+  readonly outcome: InboxRequestOutcome;
+}
 /**
- * The reason why {@link verifyRequestDetailed} could not verify a request.
- * @since 2.1.0
+ * Observes an inbox delivery after processing, before fetch resolves/rethrows.
+ * The callback is awaited.  Its errors are logged and swallowed, preserving
+ * the original response/exception.  The last registered callback replaces the
+ * previous one.  It excludes inbox collection GETs, unmatched routes,
+ * programmatic routing, and queue workers.  This is not an atomic persistence
+ * guarantee.  Keys/owner/controller declarations remain untrusted unless the
+ * final authentication decision verifies them.
+ * @since 2.4.0
  */
-type VerifyRequestFailureReason = {
-  readonly type: "keyFetchError";
-  readonly keyId: URL;
-  readonly result: FetchKeyErrorResult;
-} | {
-  readonly type: "invalidSignature";
-  readonly keyId?: URL;
-} | {
-  readonly type: "noSignature";
-};
+type InboxRequestFinishedHandler<TContextData> = (context: RequestContext<TContextData>, report: InboxRequestReport) => void | Promise<void>;
+//#endregion
+//#region src/compat/types.d.ts
+/**
+ * A function that transforms an activity object.
+ * @since 1.4.0
+ */
+type ActivityTransformer<TContextData> = (activity: Activity, context: Context<TContextData>) => Activity;
 //#endregion
 //#region src/federation/collection.d.ts
 /**
@@ -348,6 +625,25 @@ type ActorKeyPairsDispatcher<TContextData> = (context: Context<TContextData>, id
  * @since 0.15.0
  */
 type ActorHandleMapper<TContextData> = (context: Context<TContextData>, username: string) => string | null | Promise<string | null>;
+/**
+ * A callback that maps an actor's internal identifier to the ID of the
+ * [FEP-ef61] portable actor it dispatches, or `null` if the actor is not
+ * portable.
+ *
+ * The returned ID is an `ap:` or `ap+ef61:` URI, e.g.,
+ * `ap+ef61://did:key:z6Mk.../actors/alice`, or its compatible identifier.
+ * It must be the same ID that the actor dispatcher puts in the actor's `id`,
+ * and must not have a fragment.
+ *
+ * [FEP-ef61]: https://w3id.org/fep/ef61
+ *
+ * @template TContextData The context data to pass to the {@link Context}.
+ * @param context The context.
+ * @param identifier The actor's internal identifier.
+ * @returns The portable actor's ID, or `null` if the actor is not portable.
+ * @since 2.4.0
+ */
+type PortableActorIdMapper<TContextData> = (context: Context<TContextData>, identifier: string) => URL | null | Promise<URL | null>;
 /**
  * A callback that maps a WebFinger query to the corresponding actor's
  * internal identifier or username, or `null` if the query is not found.
@@ -368,14 +664,18 @@ type ActorAliasMapper<TContextData> = (context: RequestContext<TContextData>, re
   username: string;
 } | null>;
 /**
- * A callback that dispatches an object.
+ * A callback that dispatches an object or a {@link Tombstone}.
+ *
+ * Return a {@link Tombstone} if the object has been deleted; Fedify then
+ * responds with `410 Gone` and the serialized tombstone.  Return `null` if
+ * the object is not found.
  *
  * @template TContextData The context data to pass to the {@link Context}.
  * @template TObject The type of object to dispatch.
  * @template TParam The parameter names of the requested URL.
  * @since 0.7.0
  */
-type ObjectDispatcher<TContextData, TObject extends Object$1, TParam extends string> = (context: RequestContext<TContextData>, values: Record<TParam, string>) => TObject | null | Promise<TObject | null>;
+type ObjectDispatcher<TContextData, TObject extends Object$1, TParam extends string> = (context: RequestContext<TContextData>, values: Record<TParam, string>) => TObject | Tombstone | null | Promise<TObject | Tombstone | null>;
 /**
  * A callback that dispatches a collection.
  *
@@ -463,6 +763,60 @@ type OutboxListener<TContextData, TActivity extends Activity> = (context: Outbox
  * @since 2.4.0
  */
 type MediaUploaderCallback<TContextData> = (context: RequestContext<TContextData>, identifier: string, file: File, object: Object$1) => Object$1 | URL | Promise<Object$1 | URL>;
+/**
+ * A request for a resource addressed by a hashlink, which an
+ * [FEP-ef61](https://w3id.org/fep/ef61) gateway serves at
+ * `/.well-known/apgateway/hl:<digestMultibase>`.
+ *
+ * Fedify validates the hashlink before creating this object, so the digest is
+ * always a well-formed SHA-256 multihash.
+ *
+ * @since 2.4.0
+ */
+interface HashlinkMediaRequest {
+  /**
+   * The requested hashlink, i.e., `hl:` followed by
+   * {@link HashlinkMediaRequest.digestMultibase}, after percent-decoding and
+   * with its scheme lowercased.
+   */
+  readonly hashlink: `hl:${string}`;
+  /**
+   * The multibase-encoded multihash as requested, which is the value that
+   * publishers put in the `digestMultibase` property.  The same digest can be
+   * encoded in several multibase encodings; use
+   * {@link HashlinkMediaRequest.digest} as a storage key to find a resource
+   * regardless of the encoding.
+   */
+  readonly digestMultibase: string;
+  /** The hash algorithm of the digest. */
+  readonly algorithm: "sha2-256";
+  /** The raw 32-byte SHA-256 digest of the resource. */
+  readonly digest: Uint8Array;
+  /**
+   * The multihash decoded from
+   * {@link HashlinkMediaRequest.digestMultibase}, i.e., the hash algorithm
+   * code and the digest length followed by the digest.
+   */
+  readonly multihash: Uint8Array;
+}
+/**
+ * A callback that serves a resource addressed by a hashlink through the
+ * [FEP-ef61](https://w3id.org/fep/ef61) gateway endpoint.
+ *
+ * The returned response is sent as is, so the callback can stream its body
+ * and set headers such as `Content-Type` and `Cache-Control`.  Fedify does not
+ * verify the response body against the digest, so the complete
+ * representation must be the exact bytes that hash to the requested digest.
+ *
+ * @template TContextData The context data to pass to the {@link Context}.
+ * @param context The request context.
+ * @param media The requested hashlink and its digest.
+ * @returns The response to send, or `null` if the resource is not stored on
+ *          this server, which results in `404 Not Found`.  It may be returned
+ *          synchronously or wrapped in a `Promise`.
+ * @since 2.4.0
+ */
+type HashlinkMediaDispatcher<TContextData> = (context: RequestContext<TContextData>, media: HashlinkMediaRequest) => Response | null | Promise<Response | null>;
 /**
  * The reason why an incoming activity could not be verified.
  *
@@ -617,6 +971,28 @@ type ObjectAuthorizePredicate<TContextData, TParam extends string> = (context: R
  * @since 1.8.0
  */
 type CustomCollectionDispatcher<TItem, TParam extends string, TContext extends Context<TContextData>, TContextData> = (context: TContext, values: Record<TParam, string>, cursor: string | null) => PageItems<TItem> | null | Promise<PageItems<TItem> | null>;
+/**
+ * A callback that maps a custom collection to the identifier of the actor
+ * that owns it, so that the collection can be served as an [FEP-ef61]
+ * portable collection through the gateway endpoint, e.g.,
+ * `GET /.well-known/apgateway/did:key:z6Mk.../users/alice/bookmarks`.
+ *
+ * Fedify serves such a request only if the returned actor is a portable actor
+ * whose ID is under the requested DID.  The owner has to come from
+ * the application's data, not from the request, since the DID in the request
+ * path is not evidence that this server hosts collections for it.
+ *
+ * [FEP-ef61]: https://w3id.org/fep/ef61
+ *
+ * @template TContextData The context data to pass to the {@link Context}.
+ * @template TParam The parameter names of the requested URL.
+ * @param context The context.
+ * @param values The parameters of the requested URL.
+ * @returns The internal identifier of the actor that owns the collection, or
+ *          `null` if the collection is not a portable collection.
+ * @since 2.4.0
+ */
+type PortableCollectionOwnerMapper<TContextData, TParam extends string> = (context: Context<TContextData>, values: Record<TParam, string>) => string | null | Promise<string | null>;
 /**
  * A callback that counts the number of items in a custom collection.
  *
@@ -683,14 +1059,15 @@ interface KvStore {
   /**
    * Gets the value for the given key.
    * @param key The key to get the value for.
-   * @returns The value for the key, or `undefined` if the key does not exist.
+   * @returns The value for the key, including `null` if stored, or `undefined`
+   *          if the key does not exist.
    * @template T The type of the value to get.
    */
   get<T = unknown>(key: KvKey): Promise<T | undefined>;
   /**
    * Sets the value for the given key.
    * @param key The key to set the value for.
-   * @param value The value to set.
+   * @param value The value to set.  `null` is a storable value.
    * @param options Additional options for setting the value.
    */
   set(key: KvKey, value: unknown, options?: KvStoreSetOptions): Promise<void>;
@@ -782,6 +1159,17 @@ type CircuitBreakerOptions = CircuitBreakerFailurePolicy & {
    * @default `{ seconds: 1 }`
    */
   readonly releaseInterval?: Temporal.Duration | Temporal.DurationLike;
+  /**
+   * How long Fedify keeps circuit breaker state in the configured key-value
+   * store.
+   *
+   * When omitted, Fedify derives this from `failureWindow`, `recoveryDelay`, and
+   * `heldActivityTtl` for the default numeric failure policy.  Custom `failure`
+   * callbacks do not have an inspectable time window, so their state expires
+   * after `recoveryDelay` plus `heldActivityTtl` unless this option overrides
+   * it.
+   */
+  readonly stateTtl?: Temporal.Duration | Temporal.DurationLike;
   /**
    * Called whenever the circuit state changes.
    */
@@ -897,6 +1285,17 @@ interface MessageQueue {
    * @since 2.4.0
    */
   readonly nativeDeduplication?: boolean;
+  /**
+   * Whether {@link enqueueMany} accepts either every message or no messages.
+   * Backends that implement `enqueueMany()` by sending messages individually
+   * must set this to `false`, so Fedify does not use that method for a batch
+   * governed by one `deduplicationKey`.  `true` by default when `enqueueMany`
+   * is implemented.
+   *
+   * @default `true`
+   * @since 2.4.0
+   */
+  readonly atomicEnqueueMany?: boolean;
   /**
    * Enqueues a message in the queue.
    * @param message The message to enqueue.
@@ -906,7 +1305,9 @@ interface MessageQueue {
   /**
    * Enqueues multiple messages in the queue.  This operation is optional,
    * and may not be supported by all implementations.  If not supported,
-   * Fedify will invoke {@link enqueue} for each message.
+   * Fedify will invoke {@link enqueue} for each message.  An implementation
+   * that may accept only part of a batch before rejecting must declare
+   * {@link atomicEnqueueMany} `false`.
    *
    * @param messages The messages to enqueue.
    * @param options Additional options for enqueuing the messages.
@@ -1130,6 +1531,18 @@ interface FanoutMessage {
   readonly inboxes: Readonly<Record<string, {
     readonly actorIds: readonly string[];
     readonly sharedInbox: boolean;
+    /**
+     * The canonical form of the FEP-ef61 portable inbox that the inbox
+     * stands for.
+     * @internal
+     */
+    readonly portableInbox?: string;
+    /**
+     * The compatible identifiers of the portable inbox on each gateway to
+     * deliver through, in order.
+     * @internal
+     */
+    readonly gatewayInboxes?: readonly string[];
   }>>;
   readonly activity: unknown;
   readonly activityId?: string;
@@ -1173,6 +1586,27 @@ interface OutboxMessage {
    * @internal
    */
   readonly circuitHeldSince?: string;
+  /**
+   * The canonical form of the FEP-ef61 portable inbox that {@link inbox}, its
+   * compatible identifier on a gateway, stands for.
+   * @internal
+   */
+  readonly portableInbox?: string;
+  /**
+   * The compatible identifiers of the FEP-ef61 portable inbox on each gateway
+   * that is still to be tried, in order.  {@link inbox} is the first one.
+   * If there is more than one, the activity is delivered through the first
+   * gateway that accepts it.
+   * @internal
+   */
+  readonly gatewayInboxes?: readonly string[];
+  /**
+   * The times before which each of {@link gatewayInboxes} must not be tried
+   * again, as their responses' `Retry-After` headers requested, keyed by
+   * the inbox URL, in ISO 8601.
+   * @internal
+   */
+  readonly gatewayNotBefore?: Readonly<Record<string, string>>;
   readonly traceContext: Readonly<Record<string, string>>;
 }
 /**
@@ -1321,6 +1755,16 @@ interface FederationKvPrefixes {
    * @since 2.4.0
    */
   readonly taskDeduplication: KvKey;
+  /**
+   * The key prefix used for remembering which activities received in
+   * [FEP-ef61] portable inboxes have been forwarded to which gateways, so that
+   * each activity is forwarded at most once.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   * @default `["_fedify", "portableInboxForwarding"]`
+   * @since 2.4.0
+   */
+  readonly portableInboxForwarding: KvKey;
 }
 /**
  * Options for {@link FederationOptions.origin} when it is not a string.
@@ -1418,7 +1862,9 @@ interface Federatable<TContextData> extends TaskRegistry<TContextData> {
    *             based on URI Template
    *             ([RFC 6570](https://tools.ietf.org/html/rfc6570)).  The path
    *             must have one or more variables.
-   * @param dispatcher An object dispatcher callback to register.
+   * @param dispatcher An object dispatcher callback to register.  It may
+   *                   return an object, a `Tombstone` if the object has been
+   *                   deleted, or `null` if the object is not found.
    */
   setObjectDispatcher<TObject extends Object$1, TParam extends string>(cls: ConstructorWithTypeId<TObject>, path: `${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}`, dispatcher: ObjectDispatcher<TContextData, TObject, TParam>): ObjectCallbackSetters<TContextData, TObject, TParam>;
   /**
@@ -1432,7 +1878,9 @@ interface Federatable<TContextData> extends TaskRegistry<TContextData> {
    *             based on URI Template
    *             ([RFC 6570](https://tools.ietf.org/html/rfc6570)).  The path
    *             must have one or more variables.
-   * @param dispatcher An object dispatcher callback to register.
+   * @param dispatcher An object dispatcher callback to register.  It may
+   *                   return an object, a `Tombstone` if the object has been
+   *                   deleted, or `null` if the object is not found.
    */
   setObjectDispatcher<TObject extends Object$1, TParam extends string>(cls: ConstructorWithTypeId<TObject>, path: `${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}`, dispatcher: ObjectDispatcher<TContextData, TObject, TParam>): ObjectCallbackSetters<TContextData, TObject, TParam>;
   /**
@@ -1446,7 +1894,9 @@ interface Federatable<TContextData> extends TaskRegistry<TContextData> {
    *             based on URI Template
    *             ([RFC 6570](https://tools.ietf.org/html/rfc6570)).  The path
    *             must have one or more variables.
-   * @param dispatcher An object dispatcher callback to register.
+   * @param dispatcher An object dispatcher callback to register.  It may
+   *                   return an object, a `Tombstone` if the object has been
+   *                   deleted, or `null` if the object is not found.
    */
   setObjectDispatcher<TObject extends Object$1, TParam extends string>(cls: ConstructorWithTypeId<TObject>, path: `${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}{${TParam}}${string}`, dispatcher: ObjectDispatcher<TContextData, TObject, TParam>): ObjectCallbackSetters<TContextData, TObject, TParam>;
   /**
@@ -1460,7 +1910,9 @@ interface Federatable<TContextData> extends TaskRegistry<TContextData> {
    *             based on URI Template
    *             ([RFC 6570](https://tools.ietf.org/html/rfc6570)).  The path
    *             must have one or more variables.
-   * @param dispatcher An object dispatcher callback to register.
+   * @param dispatcher An object dispatcher callback to register.  It may
+   *                   return an object, a `Tombstone` if the object has been
+   *                   deleted, or `null` if the object is not found.
    */
   setObjectDispatcher<TObject extends Object$1, TParam extends string>(cls: ConstructorWithTypeId<TObject>, path: `${string}${Rfc6570Expression<TParam>}${string}${Rfc6570Expression<TParam>}${string}${Rfc6570Expression<TParam>}${string}`, dispatcher: ObjectDispatcher<TContextData, TObject, TParam>): ObjectCallbackSetters<TContextData, TObject, TParam>;
   /**
@@ -1474,7 +1926,9 @@ interface Federatable<TContextData> extends TaskRegistry<TContextData> {
    *             based on URI Template
    *             ([RFC 6570](https://tools.ietf.org/html/rfc6570)).  The path
    *             must have one or more variables.
-   * @param dispatcher An object dispatcher callback to register.
+   * @param dispatcher An object dispatcher callback to register.  It may
+   *                   return an object, a `Tombstone` if the object has been
+   *                   deleted, or `null` if the object is not found.
    */
   setObjectDispatcher<TObject extends Object$1, TParam extends string>(cls: ConstructorWithTypeId<TObject>, path: `${string}${Rfc6570Expression<TParam>}${string}${Rfc6570Expression<TParam>}${string}`, dispatcher: ObjectDispatcher<TContextData, TObject, TParam>): ObjectCallbackSetters<TContextData, TObject, TParam>;
   /**
@@ -1488,7 +1942,9 @@ interface Federatable<TContextData> extends TaskRegistry<TContextData> {
    *             based on URI Template
    *             ([RFC 6570](https://tools.ietf.org/html/rfc6570)).  The path
    *             must have one or more variables.
-   * @param dispatcher An object dispatcher callback to register.
+   * @param dispatcher An object dispatcher callback to register.  It may
+   *                   return an object, a `Tombstone` if the object has been
+   *                   deleted, or `null` if the object is not found.
    */
   setObjectDispatcher<TObject extends Object$1, TParam extends string>(cls: ConstructorWithTypeId<TObject>, path: `${string}${Rfc6570Expression<TParam>}${string}`, dispatcher: ObjectDispatcher<TContextData, TObject, TParam>): ObjectCallbackSetters<TContextData, TObject, TParam>;
   /**
@@ -1595,6 +2051,53 @@ interface Federatable<TContextData> extends TaskRegistry<TContextData> {
    * @since 2.4.0
    */
   setMediaUploader(path: `${string}${Rfc6570Expression<"identifier">}${string}`, callback: MediaUploaderCallback<TContextData>): MediaUploaderSetters<TContextData>;
+  /**
+   * Registers a dispatcher that serves resources addressed by hashlinks, such
+   * as media attached to portable objects, through the
+   * [FEP-ef61](https://w3id.org/fep/ef61) gateway endpoint, e.g.,
+   * `GET /.well-known/apgateway/hl:zQmdfTbBqBPQ7VNxZEYEj14VmRuZBkqFbiwReogJgS1zR1n`.
+   *
+   * Fedify responds with `400 Bad Request` without calling the dispatcher if
+   * the hashlink is malformed or its digest is not a SHA-256 multihash, and
+   * with `404 Not Found` if the dispatcher returns `null`.  Otherwise, the
+   * response returned by the dispatcher is sent as is.  Requests with methods
+   * other than `GET` and `HEAD` get `405 Method Not Allowed`.
+   *
+   * Fedify does not verify the served bytes against the digest, as that would
+   * require buffering the whole response body.  The dispatcher must serve only
+   * the resource whose complete representation hashes to the requested
+   * digest, e.g., by using the digest as the storage key.
+   *
+   * This is not the upload API of the ActivityPub Media Upload extension,
+   * which is registered through {@link Federatable.setMediaUploader}.
+   *
+   * @example
+   * ``` typescript
+   * federation.setHashlinkMediaDispatcher(async (ctx, media) => {
+   *   const file = await findPublicMedia(media.digest);
+   *   if (file == null) return null;
+   *   return new Response(
+   *     ctx.request.method === "HEAD" ? null : file.stream(),
+   *     {
+   *       headers: {
+   *         "Content-Type": file.mediaType,
+   *         "Content-Length": file.size.toString(),
+   *         "Cache-Control": "public, max-age=31536000, immutable",
+   *         "X-Content-Type-Options": "nosniff",
+   *       },
+   *     },
+   *   );
+   * });
+   * ```
+   *
+   * @param dispatcher A callback that returns the response serving the
+   *                   requested resource, or `null` if it is not stored on
+   *                   this server.
+   * @throws {RouterError} Thrown if a hashlink media dispatcher is already
+   *                       registered.
+   * @since 2.4.0
+   */
+  setHashlinkMediaDispatcher(dispatcher: HashlinkMediaDispatcher<TContextData>): void;
   /**
    * Registers a following collection dispatcher.
    * @param path The URI path pattern for the following collection.  The syntax
@@ -1852,6 +2355,47 @@ interface Federation<TContextData> extends Federatable<TContextData> {
    */
   fetch(request: Request, options: FederationFetchOptions<TContextData>): Promise<Response>;
 }
+/**
+ * Options for forwarding activities received in [FEP-ef61] portable inboxes to
+ * the other gateways of their actors.  See
+ * {@link FederationOptions.portableInboxForwarding}.
+ *
+ * [FEP-ef61]: https://w3id.org/fep/ef61
+ * @since 2.4.0
+ */
+interface PortableInboxForwardingOptions {
+  /**
+   * The maximum number of other gateways that a single delivery is forwarded
+   * to.  Gateways beyond it are skipped with a warning.  `0` turns off
+   * forwarding.
+   * @default `10`
+   */
+  maxTargets?: number;
+  /**
+   * How long Fedify remembers that it has forwarded an activity from
+   * a portable inbox to a gateway, under
+   * {@link FederationKvPrefixes.portableInboxForwarding}.  Within it, the same
+   * activity is never forwarded to the same gateway again; once it expires,
+   * a redelivery of the activity may be forwarded again.  It cannot have
+   * calendar units, i.e., weeks, months, or years.
+   * @default `{ days: 30 }`
+   */
+  ttl?: Temporal.DurationLike;
+  /**
+   * How long a delivery waits for forwarding requests made immediately, i.e.,
+   * when no outbox queue is configured, before Fedify responds to it.
+   * Requests still running afterwards continue in the background.  It also
+   * bounds verifying the HTTP Signature that identifies the gateway which
+   * forwarded the delivery, with or without an outbox queue; if the
+   * verification does not finish in time, the activity is forwarded to that
+   * gateway as well.  It cannot have calendar units,
+   * i.e., weeks, months, or years, and cannot be longer than
+   * 2,147,483,647 milliseconds (about 24.8 days), the longest delay timers
+   * support.
+   * @default `{ seconds: 10 }`
+   */
+  deadline?: Temporal.DurationLike;
+}
 /**
  * Policy for emitting `Accept-Signature` challenges on inbox `401`
  * responses, as defined in
@@ -1919,6 +2463,41 @@ interface FederationOptions<TContextData> {
    * are prefixed with `["_fedify"]`.
    */
   kvPrefixes?: Partial<FederationKvPrefixes>;
+  /**
+   * The time-to-live for a remote actor's public key cached under
+   * {@link FederationKvPrefixes.publicKey}.  Once it expires, the next
+   * signature verification that needs the key refetches it from the remote
+   * server and caches it again.
+   *
+   * Shortening it bounds how long a revoked or rotated key stays in the cache,
+   * at the cost of more requests to remote servers; refetching an expired key
+   * fails while the peer is unavailable, so a very short value makes
+   * verification depend on the peer being reachable.
+   * @default `{ days: 30 }`
+   * @since 2.4.0
+   */
+  publicKeyTtl?: Temporal.DurationLike;
+  /**
+   * The time-to-live for a remote origin's remembered HTTP Message Signatures
+   * spec cached under {@link FederationKvPrefixes.httpMessageSignaturesSpec}.
+   * Once it expires, the next delivery to that origin relearns the spec by
+   * double-knocking and remembers it again.
+   *
+   * Shortening it makes Fedify notice a peer's spec upgrade sooner, at the
+   * cost of an extra signed request per delivery whenever the first spec tried
+   * is rejected.
+   * @default `{ days: 90 }`
+   * @since 2.4.0
+   */
+  httpMessageSignaturesSpecTtl?: Temporal.DurationLike;
+  /**
+   * Options for forwarding activities received in [FEP-ef61] portable inboxes
+   * to the other gateways of their actors.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   * @since 2.4.0
+   */
+  portableInboxForwarding?: PortableInboxForwardingOptions;
   /**
    * The message queue for sending and receiving activities.  If not provided,
    * activities will not be queued and will be processed immediately.
@@ -1970,7 +2549,8 @@ interface FederationOptions<TContextData> {
    */
   authenticatedDocumentLoaderFactory?: AuthenticatedDocumentLoaderFactory;
   /**
-   * Whether to allow fetching private network addresses in the document loader.
+   * Whether to allow private network addresses in the document loader and
+   * outbound activity delivery, including redirects.
    *
    * If turned on, {@link FederationOptions.documentLoader},
    * {@link FederationOptions.contextLoader}, and
@@ -2007,7 +2587,36 @@ interface FederationOptions<TContextData> {
    */
   userAgent?: GetUserAgentOptions | string;
   /**
-   * A callback that handles errors during outbox processing.  Note that this
+   * The timeout for each call of the built-in document loader, context
+   * loader, and authenticated document loader, e.g., when Fedify fetches
+   * a key to verify a signature.  The timeout is shared by all the steps of
+   * a call, including every redirect it follows, retries, and reading the
+   * response body.  It does not cover the time spent reading from or
+   * writing to the cache.
+   *
+   * A timed-out call throws a `FetchError` without a response, whose
+   * `cause` is a `DOMException` named `"TimeoutError"`, so that, e.g.,
+   * a key fetch that times out is reported as a `keyFetchError` and cached
+   * like other failures to fetch a key.
+   *
+   * It does not affect loaders made by
+   * {@link FederationOptions.documentLoaderFactory},
+   * {@link FederationOptions.contextLoaderFactory}, or
+   * {@link FederationOptions.authenticatedDocumentLoaderFactory}.
+   * Note that if only {@link FederationOptions.documentLoaderFactory} is
+   * set, it also makes context loaders.
+   *
+   * Set it to `null` to turn off the timeout.
+   *
+   * 10 seconds by default.
+   * @throws {RangeError} If the duration is not positive, is longer than
+   *                      about 24.8 days, or is given in calendar units
+   *                      such as months.
+   * @since 2.4.0
+   */
+  documentLoaderTimeout?: Temporal.Duration | Temporal.DurationLike | null;
+  /**
+   * A callback that handles errors during outbox processing.  Note that this
    * callback can be called multiple times for the same activity, because
    * the delivery is retried according to the backoff schedule until it
    * succeeds or reaches the maximum retry count.
@@ -2034,6 +2643,29 @@ interface FederationOptions<TContextData> {
    * By default, the window is an hour.
    */
   signatureTimeWindow?: Temporal.Duration | Temporal.DurationLike | false;
+  /**
+   * The maximum number of [RFC 9421] signatures of an incoming request to
+   * verify, e.g., in the inbox and in
+   * {@link RequestContext.getSignedKey}.  A request can carry several
+   * signatures, each of which may make Fedify fetch the key that it names,
+   * so only the first ones in the order of the `Signature-Input` header are
+   * verified, and the rest are ignored as if they were absent.  Every
+   * signature among the first ones counts, even if it fails before its key
+   * is fetched.  See also the `maxSignatures` option of `verifyRequest()`.
+   *
+   * It has to be a positive integer, or `Infinity` to verify every
+   * signature, which lets a single request make Fedify fetch any number of
+   * keys.  Draft-cavage HTTP Signatures carry a single signature, so this
+   * option does not affect them.
+   *
+   * Three by default.
+   *
+   * [RFC 9421]: https://www.rfc-editor.org/rfc/rfc9421
+   * @throws {RangeError} Thrown when the federation is created if the value
+   *         is not a positive integer or `Infinity`.
+   * @since 2.4.0
+   */
+  maxHttpSignatures?: number;
   /**
    * Whether to skip HTTP Signatures verification for incoming activities.
    * This is useful for testing purposes, but should not be used in production.
@@ -2212,6 +2844,30 @@ interface ActorCallbackSetters<TContextData> {
    * @since 1.4.0
    */
   mapAlias(mapper: ActorAliasMapper<TContextData>): ActorCallbackSetters<TContextData>;
+  /**
+   * Sets the callback function that maps an actor's identifier to the ID of
+   * the [FEP-ef61] portable actor it dispatches.  If the callback returns
+   * a portable ID for an identifier, the key pairs of that actor are treated
+   * as this server's *gateway keys* for the portable actor:
+   * {@link Context.getActorKeyPairs} derives their key IDs from the actor's
+   * compatible identifier on this server, e.g.,
+   * `https://example.com/.well-known/apgateway/did:key:z6Mk.../actors/alice#main-key`,
+   * and makes the portable actor their owner, so that requests this server
+   * makes on behalf of the actor, such as activity deliveries and signed
+   * fetches, are signed with them.  Gateway keys are only used for HTTP
+   * Signatures; they never make Object Integrity Proofs or Linked Data
+   * Signatures.
+   *
+   * If it's omitted, or it returns `null`, the actor's keys are derived from
+   * {@link Context.getActorUri} as usual.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   * @param mapper A callback that maps an actor's identifier to its portable
+   *               ID, or `null` if the actor is not portable.
+   * @returns The setters object so that settings can be chained.
+   * @since 2.4.0
+   */
+  mapPortableActorId(mapper: PortableActorIdMapper<TContextData>): ActorCallbackSetters<TContextData>;
   /**
    * Maps a fixed path to a sentinel identifier.  It is useful for exposing
    * a single, instance-level actor at a fixed path, such as `/actor` for
@@ -2376,6 +3032,16 @@ interface InboxListenerSetters<TContextData> {
    * @returns The setters object so that settings can be chained.
    */
   onError(handler: InboxErrorHandler<TContextData>): InboxListenerSetters<TContextData>;
+  /**
+   * Observes each configured inbox delivery once, before fetch finishes.
+   * The callback is awaited and its errors do not alter delivery processing.
+   * Calling this again replaces the previous callback.  Built federations
+   * retain the callback registered at build time.
+   * @param handler The request completion observer.
+   * @returns This setter for chaining.
+   * @since 2.4.0
+   */
+  onRequestFinished(handler: InboxRequestFinishedHandler<TContextData>): InboxListenerSetters<TContextData>;
   /**
    * Registers a callback for incoming activities whose HTTP signatures could
    * not be verified.
@@ -2515,6 +3181,21 @@ interface CustomCollectionCallbackSetters<TParam extends string, TContext extend
    * @since 0.7.0
    */
   authorize(predicate: ObjectAuthorizePredicate<TContextData, string>): CustomCollectionCallbackSetters<TParam, TContext, TContextData>;
+  /**
+   * Maps the custom collection to the actor that owns it, so that it is also
+   * served as an [FEP-ef61] portable collection through the gateway endpoint,
+   * e.g., `GET /.well-known/apgateway/did:key:z6Mk.../users/alice/bookmarks`,
+   * if the owner is a portable actor under the requested DID.  Without it,
+   * the custom collection is not served through the gateway endpoint.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   * @param mapper A callback that returns the identifier of the actor that
+   *               owns the collection, or `null` if the collection is not
+   *               portable.
+   * @returns The setters object so that settings can be chained.
+   * @since 2.4.0
+   */
+  mapPortableOwner(mapper: PortableCollectionOwnerMapper<TContextData, TParam>): CustomCollectionCallbackSetters<TParam, TContext, TContextData>;
 }
 /**
  * Represents an object with a type ID, which is either a constructor or an
@@ -2610,6 +3291,28 @@ interface Context<TContextData> {
    * The context loader for loading remote JSON-LD contexts.
    */
   readonly contextLoader: DocumentLoader;
+  /**
+   * The [FEP-ef61] portable object policy that this context applies to
+   * portable objects it dereferences.  It is `verifyPortableObject()` with
+   * this context's document loader, context loader, and tracer provider as
+   * defaults, which the options passed to it override.
+   *
+   * Since its name is the same as the `verifyPortableObject` option of
+   * property accessors, `lookupObject()`, and `traverseCollection()`, passing
+   * a context as their options applies the policy, e.g.,
+   * `await create.getObject(ctx)`.  Objects parsed with a context as options,
+   * such as activities that inboxes receive, and objects that accessors
+   * fetch with a context as options also use it by default for their
+   * property accessors.  It never verifies an object by itself being
+   * there: it only applies to objects that are dereferenced.
+   *
+   * It is optional only so that custom implementations of this interface
+   * keep working; contexts that Fedify creates always have it.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   * @since 2.4.0
+   */
+  readonly verifyPortableObject?: PortableObjectVerifier;
   /**
    * The federation object that this context belongs to.
    * @since 1.6.0
@@ -2638,6 +3341,37 @@ interface Context<TContextData> {
    * @throws {RouterError} If no actor dispatcher is available.
    */
   getActorUri(identifier: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor with the given identifier
+   * under the given DID authority.
+   *
+   * The path is the same as the one {@link Context.getActorUri} builds, but
+   * the result is an `ap+ef61:` URI whose authority is the DID, e.g.,
+   * `ap+ef61://did:key:z6Mk.../users/alice`.  Such an actor can be served
+   * through the FEP-ef61 gateway endpoint,
+   * `/.well-known/apgateway/did:key:z6Mk.../users/alice`, by the same actor
+   * dispatcher.
+   *
+   * The returned `URL` keeps the DID authority percent-encoded, because
+   * the `URL` class cannot represent the canonical form.  Use `formatIri()`
+   * from `@fedify/vocab-runtime` to get the canonical string, e.g.,
+   * `ap+ef61://did:key:z6Mk.../users/alice`.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.  A `did:key` DID must be
+   *                  encoded in base58-btc, as FEP-ef61 requires; see
+   *                  `exportDidKey()` from `@fedify/vocab-runtime`.
+   * @returns The actor's portable ID.
+   * @throws {RouterError} If no actor dispatcher is available.
+   * @throws {TypeError} If the authority is not a DID, or it is a `did:key`
+   *                     DID that is not encoded in base58-btc.
+   * @since 2.4.0
+   */
+  getPortableActorUri(identifier: string, authority: string): URL;
   /**
    * Builds the URI of an object with the given class and values.
    * @param cls The class of the object.
@@ -2648,6 +3382,67 @@ interface Context<TContextData> {
    * @since 0.7.0
    */
   getObjectUri<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an object with the given class and
+   * values under the given DID authority.
+   *
+   * The path is the same as the one {@link Context.getObjectUri} builds from
+   * the object dispatcher's path, but the result is an `ap+ef61:` URI whose
+   * authority is the DID, e.g., `ap+ef61://did:key:z6Mk.../notes/123`.
+   * Such an object can be served through the FEP-ef61 gateway endpoint,
+   * `/.well-known/apgateway/did:key:z6Mk.../notes/123`, by the same object
+   * dispatcher.
+   *
+   * The returned `URL` keeps the DID authority percent-encoded, because
+   * the `URL` class cannot represent the canonical form.  Use `formatIri()`
+   * from `@fedify/vocab-runtime` to get the canonical string, e.g.,
+   * `ap+ef61://did:key:z6Mk.../notes/123`.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param cls The class of the object.
+   * @param values The values to pass to the object dispatcher.
+   * @param authority The DID that controls the object, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.
+   * @returns The object's portable ID.
+   * @throws {RouterError} If no object dispatcher is available for the class.
+   * @throws {TypeError} If values are invalid, or the authority is not a DID
+   *                     or is a `did:key` DID that is not encoded in
+   *                     base58-btc.
+   * @since 2.4.0
+   */
+  getPortableObjectUri<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>, authority: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's inbox with the given
+   * identifier under the given DID authority.
+   *
+   * The path is the same as the one {@link Context.getInboxUri} builds from
+   * the inbox path, but the result is an `ap+ef61:` URI whose authority is
+   * the DID, e.g., `ap+ef61://did:key:z6Mk.../users/alice/inbox`.  If
+   * a portable actor has it as its `inbox` and lists this server in its
+   * `gateways`, this server accepts deliveries to the inbox through
+   * the FEP-ef61 gateway endpoint, e.g.,
+   * `POST /.well-known/apgateway/did:key:z6Mk.../users/alice/inbox`, and
+   * dispatches them to the inbox listeners.
+   *
+   * The returned `URL` keeps the DID authority percent-encoded, because
+   * the `URL` class cannot represent the canonical form.  Use `formatIri()`
+   * from `@fedify/vocab-runtime` to get the canonical string.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.
+   * @returns The inbox's portable ID.
+   * @throws {RouterError} If no inbox path is registered.
+   * @throws {TypeError} If the authority is not a DID, or it is a `did:key`
+   *                     DID that is not encoded in base58-btc.
+   * @since 2.4.0
+   */
+  getPortableInboxUri(identifier: string, authority: string): URL;
   /**
    * Builds the URI of an actor's outbox with the given identifier.
    * @param identifier The actor's identifier.
@@ -2655,6 +3450,35 @@ interface Context<TContextData> {
    * @throws {RouterError} If no outbox dispatcher is available.
    */
   getOutboxUri(identifier: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's outbox with the given
+   * identifier under the given DID authority.
+   *
+   * The path is the same as the one {@link Context.getOutboxUri} builds, but
+   * the result is an `ap+ef61:` URI whose authority is the DID, e.g.,
+   * `ap+ef61://did:key:z6Mk.../users/alice/outbox`.  If a portable actor has
+   * it as its `outbox` and its ID is under the same DID, the collection is
+   * served through the FEP-ef61 gateway endpoint, e.g.,
+   * `/.well-known/apgateway/did:key:z6Mk.../users/alice/outbox`, by the same
+   * collection dispatcher.
+   *
+   * The returned `URL` keeps the DID authority percent-encoded, because
+   * the `URL` class cannot represent the canonical form.  Use `formatIri()`
+   * from `@fedify/vocab-runtime` to get the canonical string.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.
+   * @returns The outbox's portable ID.
+   * @throws {RouterError} If no outbox dispatcher is available.
+   * @throws {TypeError} If the authority is not a DID, or it is a `did:key`
+   *                     DID that is not encoded in base58-btc.
+   * @since 2.4.0
+   */
+  getPortableOutboxUri(identifier: string, authority: string): URL;
   /**
    * Builds the URI of an actor's media upload endpoint with the given
    * identifier.  This is the endpoint advertised under `endpoints.uploadMedia`
@@ -2686,6 +3510,35 @@ interface Context<TContextData> {
    * @throws {RouterError} If no following collection is available.
    */
   getFollowingUri(identifier: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's following collection with the given
+   * identifier under the given DID authority.
+   *
+   * The path is the same as the one {@link Context.getFollowingUri} builds, but
+   * the result is an `ap+ef61:` URI whose authority is the DID, e.g.,
+   * `ap+ef61://did:key:z6Mk.../users/alice/following`.  If a portable actor has
+   * it as its `following` and its ID is under the same DID, the collection is
+   * served through the FEP-ef61 gateway endpoint, e.g.,
+   * `/.well-known/apgateway/did:key:z6Mk.../users/alice/following`, by the same
+   * collection dispatcher.
+   *
+   * The returned `URL` keeps the DID authority percent-encoded, because
+   * the `URL` class cannot represent the canonical form.  Use `formatIri()`
+   * from `@fedify/vocab-runtime` to get the canonical string.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.
+   * @returns The following collection's portable ID.
+   * @throws {RouterError} If no following collection is available.
+   * @throws {TypeError} If the authority is not a DID, or it is a `did:key`
+   *                     DID that is not encoded in base58-btc.
+   * @since 2.4.0
+   */
+  getPortableFollowingUri(identifier: string, authority: string): URL;
   /**
    * Builds the URI of an actor's followers collection with the given
    * identifier.
@@ -2694,6 +3547,35 @@ interface Context<TContextData> {
    * @throws {RouterError} If no followers collection is available.
    */
   getFollowersUri(identifier: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's followers collection with the given
+   * identifier under the given DID authority.
+   *
+   * The path is the same as the one {@link Context.getFollowersUri} builds, but
+   * the result is an `ap+ef61:` URI whose authority is the DID, e.g.,
+   * `ap+ef61://did:key:z6Mk.../users/alice/followers`.  If a portable actor has
+   * it as its `followers` and its ID is under the same DID, the collection is
+   * served through the FEP-ef61 gateway endpoint, e.g.,
+   * `/.well-known/apgateway/did:key:z6Mk.../users/alice/followers`, by the same
+   * collection dispatcher.
+   *
+   * The returned `URL` keeps the DID authority percent-encoded, because
+   * the `URL` class cannot represent the canonical form.  Use `formatIri()`
+   * from `@fedify/vocab-runtime` to get the canonical string.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.
+   * @returns The followers collection's portable ID.
+   * @throws {RouterError} If no followers collection is available.
+   * @throws {TypeError} If the authority is not a DID, or it is a `did:key`
+   *                     DID that is not encoded in base58-btc.
+   * @since 2.4.0
+   */
+  getPortableFollowersUri(identifier: string, authority: string): URL;
   /**
    * Builds the URI of an actor's liked collection with the given identifier.
    * @param identifier The actor's identifier.
@@ -2702,6 +3584,35 @@ interface Context<TContextData> {
    * @since 0.11.0
    */
   getLikedUri(identifier: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's liked collection with the given
+   * identifier under the given DID authority.
+   *
+   * The path is the same as the one {@link Context.getLikedUri} builds, but
+   * the result is an `ap+ef61:` URI whose authority is the DID, e.g.,
+   * `ap+ef61://did:key:z6Mk.../users/alice/liked`.  If a portable actor has
+   * it as its `liked` and its ID is under the same DID, the collection is
+   * served through the FEP-ef61 gateway endpoint, e.g.,
+   * `/.well-known/apgateway/did:key:z6Mk.../users/alice/liked`, by the same
+   * collection dispatcher.
+   *
+   * The returned `URL` keeps the DID authority percent-encoded, because
+   * the `URL` class cannot represent the canonical form.  Use `formatIri()`
+   * from `@fedify/vocab-runtime` to get the canonical string.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.
+   * @returns The liked collection's portable ID.
+   * @throws {RouterError} If no liked collection is available.
+   * @throws {TypeError} If the authority is not a DID, or it is a `did:key`
+   *                     DID that is not encoded in base58-btc.
+   * @since 2.4.0
+   */
+  getPortableLikedUri(identifier: string, authority: string): URL;
   /**
    * Builds the URI of an actor's featured collection with the given identifier.
    * @param identifier The actor's identifier.
@@ -2710,6 +3621,35 @@ interface Context<TContextData> {
    * @since 0.11.0
    */
   getFeaturedUri(identifier: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's featured collection with the given
+   * identifier under the given DID authority.
+   *
+   * The path is the same as the one {@link Context.getFeaturedUri} builds, but
+   * the result is an `ap+ef61:` URI whose authority is the DID, e.g.,
+   * `ap+ef61://did:key:z6Mk.../users/alice/featured`.  If a portable actor has
+   * it as its `featured` and its ID is under the same DID, the collection is
+   * served through the FEP-ef61 gateway endpoint, e.g.,
+   * `/.well-known/apgateway/did:key:z6Mk.../users/alice/featured`, by the same
+   * collection dispatcher.
+   *
+   * The returned `URL` keeps the DID authority percent-encoded, because
+   * the `URL` class cannot represent the canonical form.  Use `formatIri()`
+   * from `@fedify/vocab-runtime` to get the canonical string.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.
+   * @returns The featured collection's portable ID.
+   * @throws {RouterError} If no featured collection is available.
+   * @throws {TypeError} If the authority is not a DID, or it is a `did:key`
+   *                     DID that is not encoded in base58-btc.
+   * @since 2.4.0
+   */
+  getPortableFeaturedUri(identifier: string, authority: string): URL;
   /**
    * Builds the URI of an actor's featured tags collection with the given
    * identifier.
@@ -2719,14 +3659,69 @@ interface Context<TContextData> {
    * @since 0.11.0
    */
   getFeaturedTagsUri(identifier: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's featured tags collection with the given
+   * identifier under the given DID authority.
+   *
+   * The path is the same as the one {@link Context.getFeaturedTagsUri} builds, but
+   * the result is an `ap+ef61:` URI whose authority is the DID, e.g.,
+   * `ap+ef61://did:key:z6Mk.../users/alice/tags`.  If a portable actor has
+   * it as its `featuredTags` and its ID is under the same DID, the collection is
+   * served through the FEP-ef61 gateway endpoint, e.g.,
+   * `/.well-known/apgateway/did:key:z6Mk.../users/alice/tags`, by the same
+   * collection dispatcher.
+   *
+   * The returned `URL` keeps the DID authority percent-encoded, because
+   * the `URL` class cannot represent the canonical form.  Use `formatIri()`
+   * from `@fedify/vocab-runtime` to get the canonical string.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.
+   * @returns The featured tags collection's portable ID.
+   * @throws {RouterError} If no featured tags collection is available.
+   * @throws {TypeError} If the authority is not a DID, or it is a `did:key`
+   *                     DID that is not encoded in base58-btc.
+   * @since 2.4.0
+   */
+  getPortableFeaturedTagsUri(identifier: string, authority: string): URL;
   /**
    * Determines the type of the URI and extracts the associated data.
+   *
+   * By default, only URIs on this server's origin are recognized.  With
+   * the `portable` option, [FEP-ef61] portable IDs, e.g.,
+   * `ap+ef61://did:key:z6Mk.../users/alice`, and their compatible
+   * identifiers on any gateway, e.g.,
+   * `https://example.com/.well-known/apgateway/did:key:z6Mk.../users/alice`,
+   * are also recognized by the same paths that the gateway endpoint routes
+   * to the dispatchers, and the result has the DID in its `authority`
+   * property.
+   *
+   * The DID of a portable ID is anyone's to choose, so recognizing it does
+   * not mean that this server hosts anything for the DID.  Check that
+   * `authority` is the DID that the application stores for the actor or
+   * object before acting on it:
+   *
+   * ~~~~ typescript
+   * const parsed = ctx.parseUri(follow.objectId, { portable: true });
+   * if (parsed?.type !== "actor") return;
+   * const user = await getUser(parsed.identifier);
+   * if (user == null) return;
+   * if (parsed.authority != null && parsed.authority !== user.did) return;
+   * ~~~~
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
    * @param uri The URI to parse.
+   * @param options Options for parsing the URI.  Since 2.4.0.
    * @returns The result of parsing the URI.  If `null` is given or
    *          the URI is not recognized, `null` is returned.
    * @since 0.9.0
    */
-  parseUri(uri: URL | null): ParseUriResult | null;
+  parseUri(uri: URL | null, options?: ParseUriOptions): ParseUriResult | null;
   /**
    * Gets the key pairs for an actor.
    * @param identifier The actor's identifier.
@@ -2794,7 +3789,16 @@ interface Context<TContextData> {
    * ```
    *
    * It's almost the same as the {@link lookupObject} function, but it uses
-   * the context's document loader and context loader by default.
+   * the context's document loader and context loader by default.  It also
+   * uses {@link Context.verifyPortableObject} as the `verifyPortableObject`
+   * option by default (since 2.4.0), so [FEP-ef61] portable objects,
+   * including portable actors found through WebFinger, are looked up through
+   * their gateways and returned only if they have valid proofs, or, for
+   * collections without proofs, if they are served by gateways that their
+   * owners list.  The returned object uses the same policy by default for
+   * its property accessors.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
    *
    * @param identifier The URI or fediverse handle to look up.
    * @param options Lookup options.
@@ -2818,7 +3822,9 @@ interface Context<TContextData> {
    * ```
    *
    * It's almost the same as the {@link traverseCollection} function, but it
-   * uses the context's document loader and context loader by default.
+   * uses the context's document loader and context loader by default.  It
+   * also uses {@link Context.verifyPortableObject} as the
+   * `verifyPortableObject` option by default (since 2.4.0).
    * @param collection The collection to traverse.
    * @param options Options for traversing the collection.
    * @returns An async iterable of each item in the collection.
@@ -2967,6 +3973,61 @@ interface Context<TContextData> {
    * @since 1.8.0
    */
   getCollectionUri<TParam extends Record<string, string>>(name: string | symbol, values: TParam): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of a custom collection with the given
+   * name and values under the given DID authority.
+   *
+   * The path is the same as the one {@link Context.getCollectionUri} builds,
+   * but the result is an `ap+ef61:` URI whose authority is the DID, e.g.,
+   * `ap+ef61://did:key:z6Mk.../users/alice/bookmarks`.  If the collection
+   * dispatcher maps the collection to a portable actor under the same DID
+   * with `CustomCollectionCallbackSetters.mapPortableOwner()`, the
+   * collection is served through the FEP-ef61 gateway endpoint, e.g.,
+   * `/.well-known/apgateway/did:key:z6Mk.../users/alice/bookmarks`.
+   *
+   * The returned `URL` keeps the DID authority percent-encoded, because
+   * the `URL` class cannot represent the canonical form.  Use `formatIri()`
+   * from `@fedify/vocab-runtime` to get the canonical string.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param name The name of the collection, which can be a string or a symbol.
+   * @param values The values of the URI parameters.
+   * @param authority The DID that controls the collection, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.
+   * @returns The collection's portable ID.
+   * @throws {RouterError} If no collection dispatcher is available for
+   *                       the name.
+   * @throws {TypeError} If values are invalid, or the authority is not a DID
+   *                     or is a `did:key` DID that is not encoded in
+   *                     base58-btc.
+   * @since 2.4.0
+   */
+  getPortableCollectionUri<TParam extends Record<string, string>>(name: string | symbol, values: TParam, authority: string): URL;
+}
+/**
+ * Information about an [FEP-ef61] portable object requested through
+ * the gateway endpoint.  See {@link RequestContext.portableRequest}.
+ *
+ * [FEP-ef61]: https://w3id.org/fep/ef61
+ * @since 2.4.0
+ */
+interface PortableRequest {
+  /**
+   * The DID authority of the requested portable object, e.g.,
+   * `did:key:z6Mk...`.  It comes from the request path, so it is not
+   * evidence that this server hosts objects for the DID.
+   */
+  readonly authority: string;
+  /**
+   * The ID of the requested portable object or collection, e.g.,
+   * `ap+ef61://did:key:z6Mk.../notes/123`, without a query.  Like other
+   * portable IDs, the `URL` keeps the DID authority percent-encoded; use
+   * `formatIri()` from `@fedify/vocab-runtime` to get the canonical string.
+   * Each access returns a new `URL` instance.
+   */
+  readonly id: URL;
 }
 /**
  * Options for {@link RequestContext.getActor}.
@@ -2981,6 +4042,23 @@ interface GetActorOptions {
    */
   readonly tombstone?: "suppress" | "passthrough";
 }
+/**
+ * Options for {@link RequestContext.getObject}.
+ * @since 2.4.0
+ */
+interface GetObjectOptions {
+  /**
+   * Controls how tombstoned objects are returned.
+   *
+   * By default, or if set to `"suppress"`, a {@link Tombstone} is returned as
+   * `null`, unless it is an instance of the requested class, e.g., when
+   * the requested class is `Object` or `Tombstone` itself.  In that case,
+   * the tombstone is returned as is, as it is an object of the requested
+   * class.  Set this to `"passthrough"` to always receive a {@link Tombstone}
+   * result instead of `null`.
+   */
+  readonly tombstone?: "suppress" | "passthrough";
+}
 /**
  * A context for a request.
  */
@@ -2993,6 +4071,243 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * The URL of the request.
    */
   readonly url: URL;
+  /**
+   * Information about the [FEP-ef61] portable object requested through
+   * the gateway endpoint, e.g.,
+   * `GET /.well-known/apgateway/did:key:z6Mk.../notes/123`, which is served
+   * by an object dispatcher, the actor dispatcher, or a collection
+   * dispatcher.  It is `undefined` for ordinary requests.
+   *
+   * The authority comes from the request path, so it is not evidence that
+   * this server hosts objects for the DID.  An object dispatcher or the actor
+   * dispatcher has to check that by itself.  A portable collection is served
+   * only if its owner, which the actor dispatcher looks up without this
+   * property, is a portable actor under the DID.
+   *
+   * It describes the incoming request, so it stays the same in contexts
+   * derived from this one, e.g., by {@link RequestContext.getObject}.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   * @since 2.4.0
+   */
+  readonly portableRequest?: PortableRequest;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor with the given identifier.
+   * It works the same as {@link Context.getPortableActorUri}, except that
+   * the authority can be omitted while handling a portable gateway request.
+   * In that case, the DID in {@link RequestContext.portableRequest} is used.
+   *
+   * The DID in the request comes from the request path, so the default is
+   * only a convenience for building IDs; it is not evidence that this server
+   * hosts the actor for the DID.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.  Defaults to the DID of
+   *                  the requested portable object.
+   * @returns The actor's portable ID.
+   * @throws {RouterError} If no actor dispatcher is available.
+   * @throws {TypeError} If the authority is not a DID, it is a `did:key` DID
+   *                     that is not encoded in base58-btc, or the authority
+   *                     is omitted outside a portable gateway request.
+   * @since 2.4.0
+   */
+  getPortableActorUri(identifier: string, authority?: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an object with the given class and
+   * values.  It works the same as {@link Context.getPortableObjectUri}, except
+   * that the authority can be omitted while handling a portable gateway
+   * request.  In that case, the DID in {@link RequestContext.portableRequest}
+   * is used.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param cls The class of the object.
+   * @param values The values to pass to the object dispatcher.
+   * @param authority The DID that controls the object, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.  Defaults to the DID of
+   *                  the requested portable object.
+   * @returns The object's portable ID.
+   * @throws {RouterError} If no object dispatcher is available for the class.
+   * @throws {TypeError} If values are invalid, the authority is not a DID,
+   *                     it is a `did:key` DID that is not encoded in
+   *                     base58-btc, or the authority is omitted outside
+   *                     a portable gateway request.
+   * @since 2.4.0
+   */
+  getPortableObjectUri<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>, authority?: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's inbox with the given
+   * identifier.  It works the same as {@link Context.getPortableInboxUri},
+   * except that the authority can be omitted while handling a portable object
+   * request, i.e., when {@link RequestContext.portableRequest} is set.  In
+   * that case, its DID is used.  Deliveries to portable inboxes do not set
+   * {@link RequestContext.portableRequest}, so pass the authority explicitly
+   * while handling them.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  It must be a bare DID, without
+   *                  a path, query, or fragment.  Defaults to the DID of
+   *                  the requested portable object, if any.
+   * @returns The inbox's portable ID.
+   * @throws {RouterError} If no inbox path is registered.
+   * @throws {TypeError} If the authority is not a DID, it is a `did:key` DID
+   *                     that is not encoded in base58-btc, or the authority
+   *                     is omitted outside a portable gateway request.
+   * @since 2.4.0
+   */
+  getPortableInboxUri(identifier: string, authority?: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's outbox with the given
+   * identifier.  It works the same as {@link Context.getPortableOutboxUri}, except that
+   * the authority can be omitted while handling a portable gateway request.
+   * In that case, the DID in {@link RequestContext.portableRequest} is used.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  Defaults to the DID of the requested
+   *                  portable object or collection.
+   * @returns The outbox's portable ID.
+   * @throws {RouterError} If no outbox dispatcher is available.
+   * @throws {TypeError} If the authority is not a DID, it is a `did:key` DID
+   *                     that is not encoded in base58-btc, or the authority
+   *                     is omitted outside a portable gateway request.
+   * @since 2.4.0
+   */
+  getPortableOutboxUri(identifier: string, authority?: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's following collection with the given
+   * identifier.  It works the same as {@link Context.getPortableFollowingUri}, except that
+   * the authority can be omitted while handling a portable gateway request.
+   * In that case, the DID in {@link RequestContext.portableRequest} is used.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  Defaults to the DID of the requested
+   *                  portable object or collection.
+   * @returns The following collection's portable ID.
+   * @throws {RouterError} If no following collection is available.
+   * @throws {TypeError} If the authority is not a DID, it is a `did:key` DID
+   *                     that is not encoded in base58-btc, or the authority
+   *                     is omitted outside a portable gateway request.
+   * @since 2.4.0
+   */
+  getPortableFollowingUri(identifier: string, authority?: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's followers collection with the given
+   * identifier.  It works the same as {@link Context.getPortableFollowersUri}, except that
+   * the authority can be omitted while handling a portable gateway request.
+   * In that case, the DID in {@link RequestContext.portableRequest} is used.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  Defaults to the DID of the requested
+   *                  portable object or collection.
+   * @returns The followers collection's portable ID.
+   * @throws {RouterError} If no followers collection is available.
+   * @throws {TypeError} If the authority is not a DID, it is a `did:key` DID
+   *                     that is not encoded in base58-btc, or the authority
+   *                     is omitted outside a portable gateway request.
+   * @since 2.4.0
+   */
+  getPortableFollowersUri(identifier: string, authority?: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's liked collection with the given
+   * identifier.  It works the same as {@link Context.getPortableLikedUri}, except that
+   * the authority can be omitted while handling a portable gateway request.
+   * In that case, the DID in {@link RequestContext.portableRequest} is used.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  Defaults to the DID of the requested
+   *                  portable object or collection.
+   * @returns The liked collection's portable ID.
+   * @throws {RouterError} If no liked collection is available.
+   * @throws {TypeError} If the authority is not a DID, it is a `did:key` DID
+   *                     that is not encoded in base58-btc, or the authority
+   *                     is omitted outside a portable gateway request.
+   * @since 2.4.0
+   */
+  getPortableLikedUri(identifier: string, authority?: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's featured collection with the given
+   * identifier.  It works the same as {@link Context.getPortableFeaturedUri}, except that
+   * the authority can be omitted while handling a portable gateway request.
+   * In that case, the DID in {@link RequestContext.portableRequest} is used.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  Defaults to the DID of the requested
+   *                  portable object or collection.
+   * @returns The featured collection's portable ID.
+   * @throws {RouterError} If no featured collection is available.
+   * @throws {TypeError} If the authority is not a DID, it is a `did:key` DID
+   *                     that is not encoded in base58-btc, or the authority
+   *                     is omitted outside a portable gateway request.
+   * @since 2.4.0
+   */
+  getPortableFeaturedUri(identifier: string, authority?: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of an actor's featured tags collection with the given
+   * identifier.  It works the same as {@link Context.getPortableFeaturedTagsUri}, except that
+   * the authority can be omitted while handling a portable gateway request.
+   * In that case, the DID in {@link RequestContext.portableRequest} is used.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param identifier The actor's identifier.
+   * @param authority The DID that controls the actor, e.g.,
+   *                  `did:key:z6Mk...`.  Defaults to the DID of the requested
+   *                  portable object or collection.
+   * @returns The featured tags collection's portable ID.
+   * @throws {RouterError} If no featured tags collection is available.
+   * @throws {TypeError} If the authority is not a DID, it is a `did:key` DID
+   *                     that is not encoded in base58-btc, or the authority
+   *                     is omitted outside a portable gateway request.
+   * @since 2.4.0
+   */
+  getPortableFeaturedTagsUri(identifier: string, authority?: string): URL;
+  /**
+   * Builds the [FEP-ef61] portable ID of a custom collection with the given
+   * name and values.  It works the same as
+   * {@link Context.getPortableCollectionUri}, except that the authority can
+   * be omitted while handling a portable gateway request.  In that case,
+   * the DID in {@link RequestContext.portableRequest} is used.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param name The name of the collection, which can be a string or a symbol.
+   * @param values The values of the URI parameters.
+   * @param authority The DID that controls the collection, e.g.,
+   *                  `did:key:z6Mk...`.  Defaults to the DID of the requested
+   *                  portable object or collection.
+   * @returns The collection's portable ID.
+   * @throws {RouterError} If no collection dispatcher is available for
+   *                       the name.
+   * @throws {TypeError} If values are invalid, the authority is not a DID,
+   *                     it is a `did:key` DID that is not encoded in
+   *                     base58-btc, or the authority is omitted outside
+   *                     a portable gateway request.
+   * @since 2.4.0
+   */
+  getPortableCollectionUri<TParam extends Record<string, string>>(name: string | symbol, values: TParam, authority?: string): URL;
   /**
    * Creates a new context with the same properties as this one,
    * but with the given data.
@@ -3055,12 +4370,61 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * @param cls The class to instantiate.
    * @param values The values to pass to the object dispatcher.
    * @returns The object of the given class with the given values, or `null`
-   *          if the object is not found.
+   *          if the object is not found.  Tombstoned objects are suppressed
+   *          unless the tombstone is an instance of `cls`.
    * @throws {Error} If no object dispatcher is available for the class.
    * @throws {TypeError} If values are invalid.
    * @since 0.7.0
    */
   getObject<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>): Promise<TObject | null>;
+  /**
+   * Gets an object of the given class, or a {@link Tombstone}, with the given
+   * values.
+   * @param cls The class to instantiate.
+   * @param values The values to pass to the object dispatcher.
+   * @param options Options for getting the object.  Set `options.tombstone`
+   *                to `"passthrough"` to receive tombstoned objects instead
+   *                of `null`.
+   * @returns The object of the given class with the given values,
+   *          a tombstone, or `null` if the object is not found.
+   * @throws {Error} If no object dispatcher is available for the class.
+   * @throws {TypeError} If values are invalid.
+   * @since 2.4.0
+   */
+  getObject<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>, options: GetObjectOptions & {
+    readonly tombstone: "passthrough";
+  }): Promise<TObject | Tombstone | null>;
+  /**
+   * Gets an object of the given class with the given values.
+   * @param cls The class to instantiate.
+   * @param values The values to pass to the object dispatcher.
+   * @param options Options for getting the object.
+   * @returns The object of the given class with the given values, or `null`
+   *          if the object is not found.  Tombstoned objects are suppressed
+   *          unless `options.tombstone` is `"passthrough"` or the tombstone
+   *          is an instance of `cls`.
+   * @throws {Error} If no object dispatcher is available for the class.
+   * @throws {TypeError} If values are invalid.
+   * @since 2.4.0
+   */
+  getObject<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>, options: GetObjectOptions & {
+    readonly tombstone?: "suppress" | undefined;
+  }): Promise<TObject | null>;
+  /**
+   * Gets an object of the given class, or a {@link Tombstone}, with the given
+   * values.
+   * @param cls The class to instantiate.
+   * @param values The values to pass to the object dispatcher.
+   * @param options Options for getting the object.
+   * @returns The object of the given class with the given values,
+   *          a tombstone, or `null` if the object is not found.  This broad
+   *          overload is used when the caller passes an options value whose
+   *          `tombstone` mode is not known statically.
+   * @throws {Error} If no object dispatcher is available for the class.
+   * @throws {TypeError} If values are invalid.
+   * @since 2.4.0
+   */
+  getObject<TObject extends Object$1>(cls: ConstructorWithTypeId<TObject>, values: Record<string, string>, options: GetObjectOptions): Promise<TObject | Tombstone | null>;
   /**
    * Gets the public key of the sender, if any exists and it is verified.
    * Otherwise, `null` is returned.
@@ -3127,6 +4491,52 @@ interface RequestContext<TContextData> extends Context<TContextData> {
    * [instance actor]: https://swicg.github.io/activitypub-http-signature/#instance-actor
    */
   getSignedKeyOwner(options: GetKeyOwnerOptions): Promise<Actor | null>;
+  /**
+   * Checks whether the request is signed by an actor who belongs to
+   * the intended audience of an object, i.e., the owner of the signed key
+   * (see {@link RequestContext.getSignedKeyOwner}) is one of the object's
+   * `to`, `cc`, `bto`, `bcc`, and `audience`, or a member of one of them
+   * according to the `isMember` option.
+   *
+   * Everyone belongs to the audience of a publicly addressed object, so it
+   * returns `true` for such an object even if the request is not signed.
+   *
+   * This can be used in authorization predicates for serving non-public
+   * objects, which [FEP-ef61] requires of gateways serving portable objects.
+   * [FEP-ef61] portable IDs are compared by their canonical forms, so
+   * an `ap:` URI, an `ap+ef61:` URI, and a compatible identifier on any
+   * gateway refer to the same actor.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   *
+   * @param object The object whose audience is checked.
+   * @param options Options for checking the audience.
+   * @returns `true` if the object is publicly addressed, or the request is
+   *          signed by an actor who belongs to its audience.
+   * @since 2.4.0
+   */
+  isSignedByAudience(object: Object$1, options?: IsSignedByAudienceOptions): Promise<boolean>;
+}
+/**
+ * Options for {@link RequestContext.isSignedByAudience} method.
+ * @since 2.4.0
+ */
+interface IsSignedByAudienceOptions extends GetKeyOwnerOptions {
+  /**
+   * Checks whether the actor who signed the request is a member of
+   * an addressee of the object that is not the actor itself, e.g.,
+   * a followers collection.  Fedify does not resolve collections by itself,
+   * as only the application can tell their members reliably.
+   *
+   * It is called for each such addressee in order until it returns `true`.
+   * If it is omitted, only the actors that the object addresses directly
+   * belong to its audience.
+   * @param addressee The ID of the addressee, e.g., the ID of a followers
+   *                  collection.
+   * @param actor The actor who signed the request.
+   * @returns `true` if the actor is a member of the addressee.
+   */
+  isMember?: (addressee: URL, actor: Actor) => boolean | Promise<boolean>;
 }
 /**
  * A context for inbox listeners.
@@ -3255,6 +4665,30 @@ interface OutboxContext<TContextData> extends Context<TContextData> {
    */
   clone(data: TContextData): OutboxContext<TContextData>;
 }
+/**
+ * Options for {@link Context.parseUri}.
+ * @since 2.4.0
+ */
+interface ParseUriOptions {
+  /**
+   * Whether to also recognize [FEP-ef61] portable IDs, i.e., `ap:` and
+   * `ap+ef61:` URIs, and their compatible identifiers on any gateway.
+   * The result of a portable ID has its DID, without percent-encoding, in
+   * the `authority` property, which the caller has to compare with the DID
+   * that it stores for the actor or object, since anyone can make a portable
+   * ID with the same path under another DID.
+   *
+   * Like URIs on this server's origin, a portable ID is recognized by its
+   * path, and its query, e.g., location hints, and fragment are ignored.
+   * A shared inbox is never recognized in a portable ID, and a portable ID
+   * with a malformed DID, or with a `did:key` DID that is not encoded in
+   * base58-btc, is not recognized either.
+   *
+   * [FEP-ef61]: https://w3id.org/fep/ef61
+   * @default `false`
+   */
+  readonly portable?: boolean;
+}
 /**
  * A result of parsing an URI.
  */
@@ -3265,6 +4699,12 @@ type ParseUriResult =
 {
   readonly type: "actor";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of an object URI.
@@ -3274,6 +4714,12 @@ type ParseUriResult =
   readonly class: ConstructorWithTypeId<Object$1>;
   readonly typeId: URL;
   readonly values: Record<string, string>;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of an shared inbox URI.
@@ -3281,6 +4727,7 @@ type ParseUriResult =
 | {
   readonly type: "inbox";
   readonly identifier: undefined;
+  readonly authority?: undefined;
 }
 /**
  * The case of an personal inbox URI.
@@ -3288,6 +4735,12 @@ type ParseUriResult =
 | {
   readonly type: "inbox";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of an outbox collection URI.
@@ -3295,6 +4748,12 @@ type ParseUriResult =
 | {
   readonly type: "outbox";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a following collection URI.
@@ -3302,6 +4761,12 @@ type ParseUriResult =
 | {
   readonly type: "following";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a followers collection URI.
@@ -3309,6 +4774,12 @@ type ParseUriResult =
 | {
   readonly type: "followers";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a liked collection URI.
@@ -3317,6 +4788,12 @@ type ParseUriResult =
 | {
   readonly type: "liked";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a featured collection URI.
@@ -3325,6 +4802,12 @@ type ParseUriResult =
 | {
   readonly type: "featured";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a featured tags collection URI.
@@ -3333,6 +4816,12 @@ type ParseUriResult =
 | {
   readonly type: "featuredTags";
   readonly identifier: string;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a custom collection URI.
@@ -3344,6 +4833,12 @@ type ParseUriResult =
   readonly class: ConstructorWithTypeId<Object$1>;
   readonly typeId: URL;
   readonly values: Record<string, string>;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 }
 /**
  * The case of a custom ordered collection URI.
@@ -3355,6 +4850,12 @@ type ParseUriResult =
   readonly class: ConstructorWithTypeId<Object$1>;
   readonly typeId: URL;
   readonly values: Record<string, string>;
+  /**
+   * The DID of the portable ID, e.g., `did:key:z6Mk...`, or `undefined`
+   * for a URI on this server's origin.  See {@link ParseUriOptions.portable}.
+   * @since 2.4.0
+   */
+  readonly authority?: string;
 };
 /**
  * Options for {@link Context.sendActivity} method.
@@ -3540,6 +5041,48 @@ declare function createOutboxContext<TContextData>(args: Partial<OutboxContext<T
   federation: Federation<TContextData>;
 }): OutboxContext<TContextData>;
 //#endregion
+//#region src/testing/kv.d.ts
+/**
+ * A {@link KvStore} decorator whose entry expiry is driven by a virtual clock
+ * instead of wall-clock time.
+ *
+ * {@link MemoryKvStore} decides expiry by comparing timestamps rather than by
+ * scheduling timers, so a test that wants to observe a TTL elapsing would
+ * otherwise have to sleep for longer than the TTL and hope the runner keeps
+ * up.  That makes such tests both slow and load-sensitive.
+ *
+ * This decorator keeps the TTLs itself and never passes them to the store it
+ * wraps, so nothing expires until {@link advance} moves the clock.  Cache
+ * hits, expiry, and repopulation therefore all become deterministic, without
+ * patching any global and without a test-only entry point in the library
+ * itself.  The clock starts at the Unix epoch and only ever moves forward.
+ */
+declare class ManualClockKvStore implements KvStore {
+  #private;
+  /**
+   * Present only when the wrapped store has its own `cas()`.  Callers such as
+   * the task deduplication planner test `kv.cas != null` to decide whether a
+   * conditional write is available, so the decorator must not advertise a
+   * capability the wrapped store lacks.
+   */
+  readonly cas?: (key: KvKey, expectedValue: unknown, newValue: unknown, options?: KvStoreSetOptions) => Promise<boolean>;
+  constructor(inner?: KvStore);
+  /**
+   * The current reading of the virtual clock.
+   */
+  get now(): Temporal.Instant;
+  /**
+   * Moves the virtual clock forward.  Any entry whose TTL has elapsed by the
+   * new time reads as missing from this point on, exactly as it would once a
+   * real `KvStore` had let it expire.
+   */
+  advance(duration: Temporal.DurationLike): void;
+  get<T = unknown>(key: KvKey): Promise<T | undefined>;
+  set(key: KvKey, value: unknown, options?: KvStoreSetOptions): Promise<void>;
+  delete(key: KvKey): Promise<void>;
+  list(prefix?: KvKey): AsyncIterable<KvStoreListEntry>;
+}
+//#endregion
 //#region src/testing/tasks.d.ts
 /** Federation options (sans `queue`) shared by the task suites. */
 declare const baseOptions: Omit<FederationOptions<void>, "queue">;
@@ -3598,6 +5141,32 @@ declare class MockQueue implements MessageQueue {
 //#region ../fixture/dist/mod.d.ts
 //#endregion
 //#region src/test.d.ts
-declare const testDefinitions: Deno.TestDefinition[];
+/** A test callback that uses only APIs supported by every test runtime. */
+type TestFunction = (t: TestContext) => void | Promise<void>;
+/** A nested test step supported by Deno, Node.js, Bun, and Workers. */
+interface TestStepDefinition {
+  name: string;
+  ignore?: boolean;
+  fn: TestFunction;
+}
+/** The common test context supported by every test runtime. */
+interface TestContext {
+  readonly name: string;
+  readonly origin: string;
+  step(definition: TestStepDefinition): Promise<boolean>;
+  step(name: string, fn: TestFunction): Promise<boolean>;
+  step(fn: TestFunction): Promise<boolean>;
+}
+/** A test definition supported by every test runtime. */
+interface TestDefinition {
+  name: string;
+  ignore?: boolean;
+  permissions?: Deno.TestDefinition["permissions"];
+  sanitizeExit?: Deno.TestDefinition["sanitizeExit"];
+  sanitizeOps?: Deno.TestDefinition["sanitizeOps"];
+  sanitizeResources?: Deno.TestDefinition["sanitizeResources"];
+  fn: TestFunction;
+}
+declare const testDefinitions: TestDefinition[];
 //#endregion
-export { type Envelope, MockQueue, type MockQueueOptions, baseOptions, createInboxContext, createOutboxContext, createRequestContext, envelopeSchema, makeSchema, numberSchema, stringSchema, testDefinitions };
+export { type Envelope, ManualClockKvStore, MockQueue, type MockQueueOptions, baseOptions, createInboxContext, createOutboxContext, createRequestContext, envelopeSchema, makeSchema, numberSchema, stringSchema, testDefinitions };