@fedify/vocab-runtime 2.4.0-dev.2219 → 2.4.0-dev.2233

package/dist/tests/internal/portable-dereference.test.mjs

@@ -1,6 +1,6 @@
 import { t as preloadedContexts } from "../contexts-CIKsin4e.mjs";
-import { a as formatIri, m as parseIri } from "../url-DfS-cvwr.mjs";
-import { n as createScopedContextLoader, o as registerDocumentLoaderWrapper, s as unwrapReleasedDocumentLoader } from "../jsonld-cache-DUmuWRwp.mjs";
+import { S as withGatewayHints, _ as parseIri, h as parseGatewayOrigin, o as formatIri, t as GATEWAY_HINT_PARAMETER } from "../url-Cdu4ASgJ.mjs";
+import { n as createScopedContextLoader, o as registerDocumentLoaderWrapper, s as unwrapReleasedDocumentLoader } from "../jsonld-cache-BKrsWPCQ.mjs";
 import { deepStrictEqual, ok, throws } from "node:assert/strict";
 import { test } from "node:test";
 import { getLogger } from "@logtape/logtape";
@@ -17,7 +17,6 @@ const logger = getLogger([
 * a single accessor call from fanning out to many servers.
 */
 const MAX_GATEWAY_HINTS = 5;
-const LOCATION_HINT_PARAMETER = "@gateway";
 const BASELINE_CONTEXT_URLS = /* @__PURE__ */ new Set([
 	"https://w3id.org/identity/v1",
 	"https://www.w3.org/ns/activitystreams",
@@ -61,7 +60,7 @@ function getPortableGatewayCandidates(url, gateways) {
 		}
 		return candidates;
 	}
-	for (const hint of new URLSearchParams(url.search).getAll(LOCATION_HINT_PARAMETER)) {
+	for (const hint of new URLSearchParams(url.search).getAll(GATEWAY_HINT_PARAMETER)) {
 		if (candidates.length >= MAX_GATEWAY_HINTS) break;
 		const parsed = parseGatewayOrigin(hint);
 		if (parsed == null) {
@@ -75,14 +74,6 @@ function getPortableGatewayCandidates(url, gateways) {
 	}
 	return candidates;
 }
-function parseGatewayOrigin(gateway) {
-	let url;
-	if (gateway instanceof URL) url = new URL(gateway.href);
-	else if (typeof gateway === "string" && URL.canParse(gateway)) url = new URL(gateway);
-	else return null;
-	if (url.protocol !== "http:" && url.protocol !== "https:" || url.href !== `${url.origin}/`) return null;
-	return url;
-}
 /**
 * Creates a context loader that returns the same context documents for the
 * whole dereference operation, so that the identity check, the proof
@@ -172,7 +163,7 @@ test("getPortableGatewayCandidates() uses explicit gateways", () => {
 	]) throws(() => getPortableGatewayCandidates(url, [gateway]), TypeError);
 });
 test("getPortableGatewayCandidates() reads @gateway hints", () => {
-	deepStrictEqual(hrefs(getPortableGatewayCandidates(parseIri("ap://did:key:z6Mkabc/actor?page=1&@gateway=https%3A%2F%2Fa.example&gateways=https%3A%2F%2Flegacy.example&@gateway=not%20a%20URL&@gateway=https%3A%2F%2Fb.example%2Fpath&%40gateway=https%3A%2F%2Fb.example&@gateway=https%3A%2F%2Fa.example%2F"))), ["https://a.example/", "https://b.example/"]);
+	deepStrictEqual(hrefs(getPortableGatewayCandidates(parseIri("ap://did:key:z6Mkabc/actor?page=1&@gateway=https%3A%2F%2Fa.example&gateways=https%3A%2F%2Flegacy.example&@gateway=not%20a%20URL&@gateway=https%3A%2F%2Fb.example%2Fpath&@gateway=https%3A%2F%2Fquery.example%2F%3F&@gateway=https%3A%2F%2Ffragment.example%2F%23&%40gateway=https%3A%2F%2Fb.example&@gateway=https%3A%2F%2Fa.example%2F"))), ["https://a.example/", "https://b.example/"]);
 	deepStrictEqual(getPortableGatewayCandidates(parseIri("ap://did:key:z6Mkabc/actor")), []);
 	const hints = Array.from({ length: 7 }, (_, i) => `@gateway=https%3A%2F%2Fg${i}.example`);
 	deepStrictEqual(hrefs(getPortableGatewayCandidates(parseIri(`ap://did:key:z6Mkabc/actor?${hints.join("&")}`))), [
@@ -183,6 +174,16 @@ test("getPortableGatewayCandidates() reads @gateway hints", () => {
 		4
 	].map((i) => `https://g${i}.example/`));
 });
+test("getPortableGatewayCandidates() reads hints from withGatewayHints()", () => {
+	const gateways = Array.from({ length: 7 }, (_, i) => `https://g${i}.example`);
+	deepStrictEqual(hrefs(getPortableGatewayCandidates(withGatewayHints("ap://did:key:z6Mkabc/actor?page=1", gateways))), [
+		0,
+		1,
+		2,
+		3,
+		4
+	].map((i) => `https://g${i}.example/`));
+});
 test("createSnapshotContextLoader() does not nest released snapshots", async () => {
 	const calls = [];
 	const base = (url) => {

package/dist/tests/{jsonld-cache-DUmuWRwp.mjs → jsonld-cache-BKrsWPCQ.mjs}

@@ -1,4 +1,4 @@
-import { a as formatIri, c as haveSameFe34Origin, l as haveSameIriOrigin } from "./url-DfS-cvwr.mjs";
+import { d as haveSameIriOrigin, o as formatIri, u as haveSameFe34Origin } from "./url-Cdu4ASgJ.mjs";
 import jsonld from "jsonld/dist/jsonld.esm.js";
 //#region src/jsonld.ts
 var jsonld_default = jsonld;

package/dist/tests/{jsonld-cache-BQMn_ILF.cjs → jsonld-cache-BTgizq9A.cjs}

@@ -1,5 +1,5 @@
 const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
-const require_url = require("./url-B8xyTwP-.cjs");
+const require_url = require("./url-CtHyzMR4.cjs");
 let jsonld_dist_jsonld_esm_js = require("jsonld/dist/jsonld.esm.js");
 jsonld_dist_jsonld_esm_js = require_rolldown_runtime.__toESM(jsonld_dist_jsonld_esm_js, 1);
 //#region src/jsonld.ts

package/dist/tests/jsonld-cache.test.cjs

@@ -1,5 +1,5 @@
-const require_url = require("./url-B8xyTwP-.cjs");
-const require_jsonld_cache = require("./jsonld-cache-BQMn_ILF.cjs");
+const require_url = require("./url-CtHyzMR4.cjs");
+const require_jsonld_cache = require("./jsonld-cache-BTgizq9A.cjs");
 let node_test = require("node:test");
 let node_assert = require("node:assert");
 //#region src/jsonld-cache.test.ts

package/dist/tests/jsonld-cache.test.mjs

@@ -1,5 +1,5 @@
-import { m as parseIri } from "./url-DfS-cvwr.mjs";
-import { a as normalizeJsonLdIris, c as jsonld_default, i as isTrustedIriOrigin, r as getJsonLdContext, t as compactJsonLdCache } from "./jsonld-cache-DUmuWRwp.mjs";
+import { _ as parseIri } from "./url-Cdu4ASgJ.mjs";
+import { a as normalizeJsonLdIris, c as jsonld_default, i as isTrustedIriOrigin, r as getJsonLdContext, t as compactJsonLdCache } from "./jsonld-cache-BKrsWPCQ.mjs";
 import { test } from "node:test";
 import { deepStrictEqual, ok, strictEqual } from "node:assert";
 //#region src/jsonld-cache.test.ts

package/dist/tests/{portable-media-BERS_tX_.mjs → portable-media-1NjUQari.mjs}

@@ -1,6 +1,6 @@
-import { r as getUserAgent } from "./request-CWTG9_Xx.mjs";
-import { r as readBoundedBytes } from "./body-BzhhuMI0.mjs";
-import { p as parseGatewayUrl, v as validatePublicUrl } from "./url-DfS-cvwr.mjs";
+import { r as getUserAgent } from "./request-D3elVRyB.mjs";
+import { r as readBoundedBytes } from "./body-BEYUpKvX.mjs";
+import { g as parseGatewayUrl, x as validatePublicUrl } from "./url-Cdu4ASgJ.mjs";
 import { a as verifyDigestMultibase, i as parseHashlink, r as parseDigestMultibase } from "./digest-COC7xDiQ.mjs";
 //#region src/portable-media.ts
 function resolveTimeout(value, fallback) {

package/dist/tests/{portable-media-C_Q9GmqU.cjs → portable-media-DHaAEpaQ.cjs}

@@ -1,6 +1,6 @@
-const require_request = require("./request-qq1N2cl6.cjs");
-const require_body = require("./body-GaHFfkaq.cjs");
-const require_url = require("./url-B8xyTwP-.cjs");
+const require_request = require("./request-BQlkB8du.cjs");
+const require_body = require("./body-DQKTFMsH.cjs");
+const require_url = require("./url-CtHyzMR4.cjs");
 const require_digest = require("./digest-3FeH2Y-Q.cjs");
 //#region src/portable-media.ts
 function resolveTimeout(value, fallback) {

package/dist/tests/portable-media.test.cjs

@@ -1,5 +1,5 @@
 const require_digest = require("./digest-3FeH2Y-Q.cjs");
-const require_portable_media = require("./portable-media-C_Q9GmqU.cjs");
+const require_portable_media = require("./portable-media-DHaAEpaQ.cjs");
 let node_assert_strict = require("node:assert/strict");
 let node_test = require("node:test");
 let node_http = require("node:http");

package/dist/tests/portable-media.test.mjs

@@ -1,5 +1,5 @@
 import { n as createHashlink, t as computeDigestMultibase } from "./digest-COC7xDiQ.mjs";
-import { t as fetchPortableMedia } from "./portable-media-BERS_tX_.mjs";
+import { t as fetchPortableMedia } from "./portable-media-1NjUQari.mjs";
 import { deepStrictEqual, equal, rejects } from "node:assert/strict";
 import { test } from "node:test";
 import { createServer } from "node:http";

package/dist/tests/{request-qq1N2cl6.cjs → request-BQlkB8du.cjs}

@@ -3,7 +3,7 @@ let node_process = require("node:process");
 node_process = require_rolldown_runtime.__toESM(node_process, 1);
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.2219+eb70f060";
+var version = "2.4.0-dev.2233+abb4a6b2";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/{request-CWTG9_Xx.mjs → request-D3elVRyB.mjs}

@@ -1,7 +1,7 @@
 import process from "node:process";
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.2219+eb70f060";
+var version = "2.4.0-dev.2233+abb4a6b2";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/request.test.cjs

@@ -1,5 +1,5 @@
 const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
-const require_request = require("./request-qq1N2cl6.cjs");
+const require_request = require("./request-BQlkB8du.cjs");
 let node_test = require("node:test");
 let node_process = require("node:process");
 node_process = require_rolldown_runtime.__toESM(node_process, 1);

package/dist/tests/request.test.mjs

@@ -1,4 +1,4 @@
-import { n as createActivityPubRequest, o as version, r as getUserAgent } from "./request-CWTG9_Xx.mjs";
+import { n as createActivityPubRequest, o as version, r as getUserAgent } from "./request-D3elVRyB.mjs";
 import { test } from "node:test";
 import process from "node:process";
 import { deepStrictEqual } from "node:assert";

package/dist/tests/{url-DfS-cvwr.mjs → url-Cdu4ASgJ.mjs}

@@ -218,9 +218,10 @@ function parseAtUri(uri) {
 }
 /**
 * Checks whether the URL is an FEP-ef61 gateway base URI.
+* @since 2.4.0
 */
 function isGatewayUrl(url) {
-	return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "" && url.pathname === "/" && url.search === "" && url.hash === "";
+	return (url.protocol === "http:" || url.protocol === "https:") && url.href === `${url.origin}/`;
 }
 /**
 * Parses and validates an FEP-ef61 gateway base URI.
@@ -228,6 +229,7 @@ function isGatewayUrl(url) {
 *                     with no credentials, path, query, or fragment.  In the
 *                     latter case, the message starts with
 *                     `Invalid FEP-ef61 gateway:`.
+* @since 2.4.0
 */
 function parseGatewayUrl(url) {
 	const parsed = parseIri(url);
@@ -355,7 +357,7 @@ function toCompatibleEf61Id(portableId, gateway) {
 }
 function parseCompatibleEf61Gateway(gateway) {
 	const url = gateway instanceof URL ? gateway : typeof gateway === "string" && URL.canParse(gateway) ? new URL(gateway) : null;
-	if (url == null || url.protocol !== "http:" && url.protocol !== "https:" || url.href !== `${url.origin}/`) throw new TypeError("FEP-ef61 gateways for compatible identifiers must be HTTP(S) origins with no credentials, path, query, or fragment.");
+	if (url == null || !isGatewayUrl(url)) throw new TypeError("FEP-ef61 gateways for compatible identifiers must be HTTP(S) origins with no credentials, path, query, or fragment.");
 	return url;
 }
 function getRawPortableIri(portableId) {
@@ -381,6 +383,166 @@ function isLocationHint(pair) {
 	}
 }
 /**
+* The name of the FEP-ef61 location hint query parameter.
+* @internal
+*/
+const GATEWAY_HINT_PARAMETER = "@gateway";
+/**
+* Parses an FEP-ef61 gateway, which has to be an HTTP(S) origin with no
+* credentials, path, query, or fragment.
+* @returns The gateway, or `null` if it is not a valid gateway.
+* @internal
+*/
+function parseGatewayOrigin(gateway) {
+	let url;
+	if (gateway instanceof URL) url = new URL(gateway.href);
+	else if (typeof gateway === "string" && URL.canParse(gateway)) url = new URL(gateway);
+	else return null;
+	return isGatewayUrl(url) ? url : null;
+}
+/**
+* Returns a copy of an [FEP-ef61] portable ActivityPub URI with `@gateway`
+* location hints for the given gateways, which tell consumers where they can
+* retrieve the object.  Put hints on *references* to portable actors, e.g.,
+* in `actor`, `attributedTo`, `to`, or `cc`, when constructing an object, as
+* FEP-ef61 recommends:
+*
+* ~~~~ typescript
+* withGatewayHints("ap://did:key:z6Mk.../actor", [
+*   "https://server1.example",
+*   "https://server2.example",
+* ]);
+* // ap+ef61://did:key:z6Mk.../actor?@gateway=https%3A%2F%2Fserver1.example&@gateway=https%3A%2F%2Fserver2.example
+* ~~~~
+*
+* Do not put hints on an object's own `id`.  Hints do not change the
+* identity of a portable URI, since FEP-ef61 drops the query when comparing
+* portable URIs, but implementations that do not canonicalize portable URIs
+* would take a hinted ID for another object.  Add hints before signing the
+* object, since its Object Integrity Proof covers its references too.
+*
+* The hints that the URI already has, including the legacy `gateways`
+* parameter, are replaced.  Each gateway becomes a `@gateway` query
+* parameter whose value is its URI-encoded origin, e.g.,
+* `@gateway=https%3A%2F%2Fserver1.example`, in the given order after the
+* other query parameters.  Duplicate gateways are dropped, and an empty list
+* removes the hints as {@link withoutGatewayHints} does.  The other query
+* parameters, their order, and the fragment are kept, but percent-encoding
+* is normalized the same way as {@link canonicalizePortableUri} does it.
+*
+* Fedify follows at most five hints when dereferencing a portable URI
+* (three for the key ID of an HTTP Signature), so list the preferred
+* gateways first; there is no limit on the number of hints added here.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param portableId The `ap:` or `ap+ef61:` URI.  Pass the raw string rather
+*                   than a `URL` if its path may have `.` or `..` segments,
+*                   because the `URL` class resolves them.
+* @param gateways The gateways, e.g., the `gateways` of the actor that the
+*                 URI refers to.  Each has to be an HTTP(S) origin with no
+*                 credentials, path, query, or fragment.
+* @returns The portable URI with the hints, in the same internal `URL` form
+*          as {@link parseIri} returns.  Use {@link formatIri} to get its
+*          canonical string.
+* @throws {TypeError} If the portable ID is not a valid `ap:` or `ap+ef61:`
+*                     URI, e.g., it is a compatible identifier, which must
+*                     not have location hints; if its path has `.` or `..`
+*                     segments, which the `URL` class cannot represent; or
+*                     if a gateway is invalid.
+* @since 2.4.0
+*/
+function withGatewayHints(portableId, gateways) {
+	const parts = splitPortableIri(portableId);
+	if (typeof gateways === "string") throw new TypeError("The gateways must be an iterable of gateways, not a string.");
+	const hints = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const gateway of gateways) {
+		const url = parseGatewayOrigin(gateway);
+		if (url == null) throw new TypeError("FEP-ef61 gateways must be HTTP(S) origins with no credentials, path, query, or fragment: " + String(gateway));
+		if (seen.has(url.href)) continue;
+		seen.add(url.href);
+		hints.push(url);
+	}
+	return replaceGatewayHints(parts, hints);
+}
+/**
+* Returns a copy of an [FEP-ef61] portable ActivityPub URI without its
+* location hints, i.e., `@gateway` query parameters and the legacy
+* `gateways` parameter.  The other query parameters, their order, and the
+* fragment are kept, but percent-encoding is normalized the same way as
+* {@link canonicalizePortableUri} does it.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param portableId The `ap:` or `ap+ef61:` URI.  Pass the raw string rather
+*                   than a `URL` if its path may have `.` or `..` segments,
+*                   because the `URL` class resolves them.
+* @returns The portable URI without the hints, in the same internal `URL`
+*          form as {@link parseIri} returns.
+* @throws {TypeError} If the portable ID is not a valid `ap:` or `ap+ef61:`
+*                     URI, or if its path has `.` or `..` segments, which
+*                     the `URL` class cannot represent.
+* @since 2.4.0
+*/
+function withoutGatewayHints(portableId) {
+	return replaceGatewayHints(splitPortableIri(portableId), []);
+}
+/**
+* Gets the gateways in the `@gateway` location hints of an [FEP-ef61]
+* portable ActivityPub URI, in order.  Hints that are not valid gateways,
+* i.e., HTTP(S) origins with no credentials, path, query, or fragment, are
+* skipped, and so are duplicates.  The legacy `gateways` parameter is not
+* read.
+*
+* Unlike Fedify's dereferencing, which follows at most five hints, this
+* returns all of them.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param portableId The `ap:` or `ap+ef61:` URI.
+* @returns The gateways, e.g., `https://server1.example/`.
+* @throws {TypeError} If the portable ID is not a valid `ap:` or `ap+ef61:`
+*                     URI.
+* @since 2.4.0
+*/
+function getGatewayHints(portableId) {
+	const { query } = splitPortableIri(portableId);
+	return query == null ? [] : parseGatewayHints(query);
+}
+function splitPortableIri(portableId) {
+	const raw = getRawPortableIri(portableId);
+	const match = raw.match(PORTABLE_IRI_PATTERN);
+	const parsed = parsePortableIri(raw);
+	if (match == null || parsed == null) throw new TypeError("Invalid portable ActivityPub IRI.");
+	return {
+		raw,
+		parsed,
+		path: normalizePortableComponent(match[3]),
+		query: match[4] == null ? null : normalizePortableComponent(match[4].slice(1)),
+		fragment: match[5] == null ? "" : normalizePortableComponent(match[5])
+	};
+}
+function parseGatewayHints(query) {
+	const hints = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const hint of new URLSearchParams(`?${query}`).getAll(GATEWAY_HINT_PARAMETER)) {
+		const url = parseGatewayOrigin(hint);
+		if (url == null || seen.has(url.href)) continue;
+		seen.add(url.href);
+		hints.push(url);
+	}
+	return hints;
+}
+function replaceGatewayHints(parts, hints) {
+	const pairs = parts.query == null ? [] : parts.query.split("&").filter((pair) => pair !== "" && !isLocationHint(pair));
+	for (const hint of hints) pairs.push(`${GATEWAY_HINT_PARAMETER}=${encodeURIComponent(hint.origin)}`);
+	const query = pairs.length < 1 ? "" : `?${pairs.join("&")}`;
+	const result = parsePortableIri(`ap+ef61://${parts.parsed.host}${parts.path}${query}${parts.fragment}`);
+	if (result == null || canonicalizePortableUri(result.href) !== canonicalizePortableUri(parts.raw) || parseGatewayHints(result.search.slice(1)).map((url) => url.href).join(" ") !== hints.map((url) => url.href).join(" ")) throw new TypeError("The portable ActivityPub IRI cannot be represented as a URL without changing the object it refers to.");
+	return result;
+}
+/**
 * Validates a URL to prevent SSRF attacks.
 */
 async function validatePublicUrl(url) {
@@ -576,4 +738,4 @@ function matchesIPv6Prefix(address, prefixWords, prefixLength) {
 	return true;
 }
 //#endregion
-export { validateLookupAddresses as _, formatIri as a, haveSameFe34Origin as c, isValidPublicIPv4Address as d, isValidPublicIPv6Address as f, toCompatibleEf61Id as g, parseJsonLdId as h, expandIPv6Address as i, haveSameIriOrigin as l, parseIri as m, arePortableUrisEqual as n, fromCompatibleEf61Id as o, parseGatewayUrl as p, canonicalizePortableUri as r, getFe34Origin as s, UrlError as t, isGatewayUrl as u, validatePublicUrl as v };
+export { withoutGatewayHints as C, withGatewayHints as S, parseIri as _, expandIPv6Address as a, validateLookupAddresses as b, getFe34Origin as c, haveSameIriOrigin as d, isGatewayUrl as f, parseGatewayUrl as g, parseGatewayOrigin as h, canonicalizePortableUri as i, getGatewayHints as l, isValidPublicIPv6Address as m, UrlError as n, formatIri as o, isValidPublicIPv4Address as p, arePortableUrisEqual as r, fromCompatibleEf61Id as s, GATEWAY_HINT_PARAMETER as t, haveSameFe34Origin as u, parseJsonLdId as v, validatePublicUrl as x, toCompatibleEf61Id as y };

package/dist/tests/{url-B8xyTwP-.cjs → url-CtHyzMR4.cjs}

@@ -220,9 +220,10 @@ function parseAtUri(uri) {
 }
 /**
 * Checks whether the URL is an FEP-ef61 gateway base URI.
+* @since 2.4.0
 */
 function isGatewayUrl(url) {
-	return (url.protocol === "http:" || url.protocol === "https:") && url.username === "" && url.password === "" && url.pathname === "/" && url.search === "" && url.hash === "";
+	return (url.protocol === "http:" || url.protocol === "https:") && url.href === `${url.origin}/`;
 }
 /**
 * Parses and validates an FEP-ef61 gateway base URI.
@@ -230,6 +231,7 @@ function isGatewayUrl(url) {
 *                     with no credentials, path, query, or fragment.  In the
 *                     latter case, the message starts with
 *                     `Invalid FEP-ef61 gateway:`.
+* @since 2.4.0
 */
 function parseGatewayUrl(url) {
 	const parsed = parseIri(url);
@@ -357,7 +359,7 @@ function toCompatibleEf61Id(portableId, gateway) {
 }
 function parseCompatibleEf61Gateway(gateway) {
 	const url = gateway instanceof URL ? gateway : typeof gateway === "string" && URL.canParse(gateway) ? new URL(gateway) : null;
-	if (url == null || url.protocol !== "http:" && url.protocol !== "https:" || url.href !== `${url.origin}/`) throw new TypeError("FEP-ef61 gateways for compatible identifiers must be HTTP(S) origins with no credentials, path, query, or fragment.");
+	if (url == null || !isGatewayUrl(url)) throw new TypeError("FEP-ef61 gateways for compatible identifiers must be HTTP(S) origins with no credentials, path, query, or fragment.");
 	return url;
 }
 function getRawPortableIri(portableId) {
@@ -383,6 +385,166 @@ function isLocationHint(pair) {
 	}
 }
 /**
+* The name of the FEP-ef61 location hint query parameter.
+* @internal
+*/
+const GATEWAY_HINT_PARAMETER = "@gateway";
+/**
+* Parses an FEP-ef61 gateway, which has to be an HTTP(S) origin with no
+* credentials, path, query, or fragment.
+* @returns The gateway, or `null` if it is not a valid gateway.
+* @internal
+*/
+function parseGatewayOrigin(gateway) {
+	let url;
+	if (gateway instanceof URL) url = new URL(gateway.href);
+	else if (typeof gateway === "string" && URL.canParse(gateway)) url = new URL(gateway);
+	else return null;
+	return isGatewayUrl(url) ? url : null;
+}
+/**
+* Returns a copy of an [FEP-ef61] portable ActivityPub URI with `@gateway`
+* location hints for the given gateways, which tell consumers where they can
+* retrieve the object.  Put hints on *references* to portable actors, e.g.,
+* in `actor`, `attributedTo`, `to`, or `cc`, when constructing an object, as
+* FEP-ef61 recommends:
+*
+* ~~~~ typescript
+* withGatewayHints("ap://did:key:z6Mk.../actor", [
+*   "https://server1.example",
+*   "https://server2.example",
+* ]);
+* // ap+ef61://did:key:z6Mk.../actor?@gateway=https%3A%2F%2Fserver1.example&@gateway=https%3A%2F%2Fserver2.example
+* ~~~~
+*
+* Do not put hints on an object's own `id`.  Hints do not change the
+* identity of a portable URI, since FEP-ef61 drops the query when comparing
+* portable URIs, but implementations that do not canonicalize portable URIs
+* would take a hinted ID for another object.  Add hints before signing the
+* object, since its Object Integrity Proof covers its references too.
+*
+* The hints that the URI already has, including the legacy `gateways`
+* parameter, are replaced.  Each gateway becomes a `@gateway` query
+* parameter whose value is its URI-encoded origin, e.g.,
+* `@gateway=https%3A%2F%2Fserver1.example`, in the given order after the
+* other query parameters.  Duplicate gateways are dropped, and an empty list
+* removes the hints as {@link withoutGatewayHints} does.  The other query
+* parameters, their order, and the fragment are kept, but percent-encoding
+* is normalized the same way as {@link canonicalizePortableUri} does it.
+*
+* Fedify follows at most five hints when dereferencing a portable URI
+* (three for the key ID of an HTTP Signature), so list the preferred
+* gateways first; there is no limit on the number of hints added here.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param portableId The `ap:` or `ap+ef61:` URI.  Pass the raw string rather
+*                   than a `URL` if its path may have `.` or `..` segments,
+*                   because the `URL` class resolves them.
+* @param gateways The gateways, e.g., the `gateways` of the actor that the
+*                 URI refers to.  Each has to be an HTTP(S) origin with no
+*                 credentials, path, query, or fragment.
+* @returns The portable URI with the hints, in the same internal `URL` form
+*          as {@link parseIri} returns.  Use {@link formatIri} to get its
+*          canonical string.
+* @throws {TypeError} If the portable ID is not a valid `ap:` or `ap+ef61:`
+*                     URI, e.g., it is a compatible identifier, which must
+*                     not have location hints; if its path has `.` or `..`
+*                     segments, which the `URL` class cannot represent; or
+*                     if a gateway is invalid.
+* @since 2.4.0
+*/
+function withGatewayHints(portableId, gateways) {
+	const parts = splitPortableIri(portableId);
+	if (typeof gateways === "string") throw new TypeError("The gateways must be an iterable of gateways, not a string.");
+	const hints = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const gateway of gateways) {
+		const url = parseGatewayOrigin(gateway);
+		if (url == null) throw new TypeError("FEP-ef61 gateways must be HTTP(S) origins with no credentials, path, query, or fragment: " + String(gateway));
+		if (seen.has(url.href)) continue;
+		seen.add(url.href);
+		hints.push(url);
+	}
+	return replaceGatewayHints(parts, hints);
+}
+/**
+* Returns a copy of an [FEP-ef61] portable ActivityPub URI without its
+* location hints, i.e., `@gateway` query parameters and the legacy
+* `gateways` parameter.  The other query parameters, their order, and the
+* fragment are kept, but percent-encoding is normalized the same way as
+* {@link canonicalizePortableUri} does it.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param portableId The `ap:` or `ap+ef61:` URI.  Pass the raw string rather
+*                   than a `URL` if its path may have `.` or `..` segments,
+*                   because the `URL` class resolves them.
+* @returns The portable URI without the hints, in the same internal `URL`
+*          form as {@link parseIri} returns.
+* @throws {TypeError} If the portable ID is not a valid `ap:` or `ap+ef61:`
+*                     URI, or if its path has `.` or `..` segments, which
+*                     the `URL` class cannot represent.
+* @since 2.4.0
+*/
+function withoutGatewayHints(portableId) {
+	return replaceGatewayHints(splitPortableIri(portableId), []);
+}
+/**
+* Gets the gateways in the `@gateway` location hints of an [FEP-ef61]
+* portable ActivityPub URI, in order.  Hints that are not valid gateways,
+* i.e., HTTP(S) origins with no credentials, path, query, or fragment, are
+* skipped, and so are duplicates.  The legacy `gateways` parameter is not
+* read.
+*
+* Unlike Fedify's dereferencing, which follows at most five hints, this
+* returns all of them.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+*
+* @param portableId The `ap:` or `ap+ef61:` URI.
+* @returns The gateways, e.g., `https://server1.example/`.
+* @throws {TypeError} If the portable ID is not a valid `ap:` or `ap+ef61:`
+*                     URI.
+* @since 2.4.0
+*/
+function getGatewayHints(portableId) {
+	const { query } = splitPortableIri(portableId);
+	return query == null ? [] : parseGatewayHints(query);
+}
+function splitPortableIri(portableId) {
+	const raw = getRawPortableIri(portableId);
+	const match = raw.match(PORTABLE_IRI_PATTERN);
+	const parsed = parsePortableIri(raw);
+	if (match == null || parsed == null) throw new TypeError("Invalid portable ActivityPub IRI.");
+	return {
+		raw,
+		parsed,
+		path: normalizePortableComponent(match[3]),
+		query: match[4] == null ? null : normalizePortableComponent(match[4].slice(1)),
+		fragment: match[5] == null ? "" : normalizePortableComponent(match[5])
+	};
+}
+function parseGatewayHints(query) {
+	const hints = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const hint of new URLSearchParams(`?${query}`).getAll(GATEWAY_HINT_PARAMETER)) {
+		const url = parseGatewayOrigin(hint);
+		if (url == null || seen.has(url.href)) continue;
+		seen.add(url.href);
+		hints.push(url);
+	}
+	return hints;
+}
+function replaceGatewayHints(parts, hints) {
+	const pairs = parts.query == null ? [] : parts.query.split("&").filter((pair) => pair !== "" && !isLocationHint(pair));
+	for (const hint of hints) pairs.push(`${GATEWAY_HINT_PARAMETER}=${encodeURIComponent(hint.origin)}`);
+	const query = pairs.length < 1 ? "" : `?${pairs.join("&")}`;
+	const result = parsePortableIri(`ap+ef61://${parts.parsed.host}${parts.path}${query}${parts.fragment}`);
+	if (result == null || canonicalizePortableUri(result.href) !== canonicalizePortableUri(parts.raw) || parseGatewayHints(result.search.slice(1)).map((url) => url.href).join(" ") !== hints.map((url) => url.href).join(" ")) throw new TypeError("The portable ActivityPub IRI cannot be represented as a URL without changing the object it refers to.");
+	return result;
+}
+/**
 * Validates a URL to prevent SSRF attacks.
 */
 async function validatePublicUrl(url) {
@@ -578,6 +740,12 @@ function matchesIPv6Prefix(address, prefixWords, prefixLength) {
 	return true;
 }
 //#endregion
+Object.defineProperty(exports, "GATEWAY_HINT_PARAMETER", {
+	enumerable: true,
+	get: function() {
+		return GATEWAY_HINT_PARAMETER;
+	}
+});
 Object.defineProperty(exports, "UrlError", {
 	enumerable: true,
 	get: function() {
@@ -620,6 +788,12 @@ Object.defineProperty(exports, "getFe34Origin", {
 		return getFe34Origin;
 	}
 });
+Object.defineProperty(exports, "getGatewayHints", {
+	enumerable: true,
+	get: function() {
+		return getGatewayHints;
+	}
+});
 Object.defineProperty(exports, "haveSameFe34Origin", {
 	enumerable: true,
 	get: function() {
@@ -650,6 +824,12 @@ Object.defineProperty(exports, "isValidPublicIPv6Address", {
 		return isValidPublicIPv6Address;
 	}
 });
+Object.defineProperty(exports, "parseGatewayOrigin", {
+	enumerable: true,
+	get: function() {
+		return parseGatewayOrigin;
+	}
+});
 Object.defineProperty(exports, "parseGatewayUrl", {
 	enumerable: true,
 	get: function() {
@@ -686,3 +866,15 @@ Object.defineProperty(exports, "validatePublicUrl", {
 		return validatePublicUrl;
 	}
 });
+Object.defineProperty(exports, "withGatewayHints", {
+	enumerable: true,
+	get: function() {
+		return withGatewayHints;
+	}
+});
+Object.defineProperty(exports, "withoutGatewayHints", {
+	enumerable: true,
+	get: function() {
+		return withoutGatewayHints;
+	}
+});