@fedify/vocab 2.4.0-dev.2233 → 2.4.0-dev.2240

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab",
-  "version": "2.4.0-dev.2233+abb4a6b2",
+  "version": "2.4.0-dev.2240+79613fa6",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts"

package/dist/mod.cjs

@@ -36,7 +36,7 @@ let _fedify_vocab_runtime_temporal = require("@fedify/vocab-runtime/temporal");
 let es_toolkit = require("es-toolkit");
 //#region deno.json
 var name = "@fedify/vocab";
-var version = "2.4.0-dev.2233+abb4a6b2";
+var version = "2.4.0-dev.2240+79613fa6";
 //#endregion
 //#region src/type.ts
 function getTypeId(object) {
@@ -79546,7 +79546,9 @@ const MAX_PORTABLE_ATTEMPTS = 5;
 *
 * [FEP-ef61] portable objects, including portable actors found through
 * WebFinger, are looked up only if the `verifyPortableObject` option is
-* given; see {@link LookupObjectOptions.verifyPortableObject}.
+* given; see {@link LookupObjectOptions.verifyPortableObject}.  Pass
+* {@link LookupObjectOptions.gateways} to look up a portable ID without
+* `@gateway` location hints.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 *
@@ -79604,7 +79606,8 @@ async function lookupObjectInternal(identifier, options = {}) {
 			if (candidate == null) return null;
 			return await lookupPortableObject(portable, candidate, void 0);
 		}
-		identifier = toAcctUrl(identifier) ?? new URL(identifier);
+		if (options.verifyPortableObject != null && (0, _fedify_vocab_runtime_internal_portable_dereference.parseCompatibleEf61Reference)(identifier) === null) return null;
+		identifier = toAcctUrl(identifier) ?? (0, _fedify_vocab_runtime.parseIri)(identifier);
 	}
 	if ((0, _fedify_vocab_runtime_internal_portable_dereference.isPortableIri)(identifier)) {
 		let candidate;
@@ -79649,7 +79652,7 @@ async function lookupObjectInternal(identifier, options = {}) {
 				const candidate = parsePortableCandidate(l.href);
 				if (candidate == null) continue;
 				const gateways = webFingerGateway == null ? [] : [webFingerGateway];
-				gateways.push(...(0, _fedify_vocab_runtime_internal_portable_dereference.getPortableGatewayCandidates)(candidate));
+				if (options.gateways == null) gateways.push(...(0, _fedify_vocab_runtime_internal_portable_dereference.getPortableGatewayCandidates)(candidate));
 				const object = await lookupPortableObject(portable, candidate, gateways);
 				if (object != null) return object;
 				if (options.signal?.aborted) return null;
@@ -79701,10 +79704,13 @@ async function lookupObjectInternal(identifier, options = {}) {
 			if (claim === null) {
 				logger.debug("Refusing the document {documentUrl}, as it claims to be a portable object with a malformed compatible identifier.", { documentUrl: remoteDoc.documentUrl });
 				return null;
-			} else if (claim != null) return await dereference(portable, claim.id, claim.inferredGateways, {
-				response: remoteDoc,
-				contextLoader: snapshot.loader
-			});
+			} else if (claim != null) {
+				const explicit = getExplicitGateways(portable, claim.id);
+				return await dereference(portable, claim.id, claim.inferredGateways, explicit, {
+					response: remoteDoc,
+					contextLoader: snapshot.loader
+				});
+			}
 		}
 		if (object.id != null && (options.crossOrigin !== "trust" || (0, _fedify_vocab_runtime_internal_portable_dereference.isPortableIri)(object.id)) && !(0, _fedify_vocab_runtime.haveSameIriOrigin)(object.id, documentUrl) && !(0, _fedify_vocab_runtime.haveSameFe34Origin)(object.id, documentUrl)) {
 			if (options.crossOrigin === "throw") throw new Error(`The object's @id (${object.id.href}) has a different origin than the document URL (${remoteDoc.documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to "trust".`);
@@ -79720,6 +79726,10 @@ async function lookupObjectInternal(identifier, options = {}) {
 	}
 }
 const PORTABLE_IRI_PATTERN = /^ap(?:\+ef61)?:/i;
+function getExplicitGateways(lookup, id) {
+	if (lookup.options.gateways == null) return void 0;
+	return lookup.explicitGateways ??= (0, _fedify_vocab_runtime_internal_portable_dereference.getPortableGatewayCandidates)(id, lookup.options.gateways);
+}
 /**
 * Parses a raw portable IRI.  URL parsing normalizes dot segments in the
 * opaque path, which would make the parsed IRI identify another portable
@@ -79773,29 +79783,29 @@ function getWebFingerGateway(identifier) {
 }
 /**
 * Looks up a portable object through FEP-ef61 gateways.
-* @param gateways The gateways to ask in order.  If omitted, the location
-*                 hints in the IRI are used, and if there are none, the
-*                 portable IRI itself is passed to the document loader.
+* @param inferredGateways Gateways inferred from a compatible identifier or
+*                         WebFinger.  If omitted, location hints in the IRI
+*                         are used unless explicit gateways were given.
 */
-async function lookupPortableObject(lookup, id, gateways) {
+async function lookupPortableObject(lookup, id, inferredGateways) {
 	const { options } = lookup;
 	const iri = (0, _fedify_vocab_runtime.formatIri)(id);
+	const explicitGateways = getExplicitGateways(lookup, id);
 	if (options.verifyPortableObject == null) {
 		logger.debug("Cannot look up the portable object {iri}, as the verifyPortableObject option is not given.", { iri });
 		return null;
 	}
 	const canonicalId = (0, _fedify_vocab_runtime.canonicalizePortableUri)(iri);
-	let candidates;
-	if (gateways == null) {
-		candidates = (0, _fedify_vocab_runtime_internal_portable_dereference.getPortableGatewayCandidates)(id);
-		if (candidates.length < 1) {
-			const key = `${canonicalId} `;
-			if (lookup.remaining < 1 || lookup.attempted.has(key)) return null;
-			lookup.attempted.add(key);
-			lookup.remaining--;
-			return await dereference(lookup, id, []);
-		}
-	} else candidates = [...gateways];
+	const inferred = inferredGateways ?? (explicitGateways == null ? (0, _fedify_vocab_runtime_internal_portable_dereference.getPortableGatewayCandidates)(id) : []);
+	const candidates = [...inferred];
+	for (const gateway of explicitGateways ?? []) if (!candidates.some((candidate) => candidate.href === gateway.href)) candidates.push(gateway);
+	if (candidates.length < 1 && inferredGateways == null) {
+		const key = `${canonicalId} `;
+		if (lookup.remaining < 1 || lookup.attempted.has(key)) return null;
+		lookup.attempted.add(key);
+		lookup.remaining--;
+		return await dereference(lookup, id, [], explicitGateways == null ? void 0 : []);
+	}
 	const selected = [];
 	for (const gateway of candidates) {
 		if (selected.length >= lookup.remaining) break;
@@ -79806,16 +79816,19 @@ async function lookupPortableObject(lookup, id, gateways) {
 	}
 	if (selected.length < 1) return null;
 	lookup.remaining -= selected.length;
-	return await dereference(lookup, id, selected);
+	const selectedInferred = selected.filter((candidate) => inferred.some((gateway) => gateway.href === candidate.href));
+	const selectedExplicit = explicitGateways?.filter((gateway) => selected.some((candidate) => candidate.href === gateway.href));
+	return await dereference(lookup, id, selectedInferred, selectedExplicit);
 }
-async function dereference({ options, documentLoader }, id, gateways, extra = {}) {
+async function dereference({ options, documentLoader }, id, inferredGateways, gateways, extra = {}) {
 	const tracerProvider = options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
 	try {
 		return await (0, _fedify_vocab_runtime_internal_portable_dereference.dereferencePortableIri)(id, {
 			documentLoader,
 			contextLoader: extra.contextLoader ?? options.contextLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)({ userAgent: options.userAgent }),
 			tracerProvider,
-			inferredGateways: gateways,
+			inferredGateways,
+			...gateways == null ? {} : { gateways },
 			response: extra.response,
 			verifyPortableObject: options.verifyPortableObject,
 			crossOrigin: options.crossOrigin === "throw" ? "throw" : "ignore",

package/dist/mod.d.cts

@@ -24298,6 +24298,18 @@ interface LookupObjectOptions {
   */
   signal?: AbortSignal;
   /**
+  * The [FEP-ef61] gateways to try when looking up a portable
+  * (`ap:`/`ap+ef61:`) object, in order.  Each must be an HTTP(S) origin.
+  * An explicit list replaces `@gateway` location hints, including when
+  * it is empty.  The gateway named by a compatible identifier or the
+  * WebFinger server is still tried first.  At most five gateways are
+  * requested per lookup, including those given here.
+  *
+  * [FEP-ef61]: https://w3id.org/fep/ef61
+  * @since 2.4.0
+  */
+  gateways?: readonly (string | URL)[];
+  /**
   * The [FEP-ef61] policy to apply to portable objects, typically
   * `verifyPortableObject()` from `@fedify/fedify`, which
   * `Context.lookupObject()` uses by default.
@@ -24355,7 +24367,9 @@ interface LookupObjectOptions {
 *
 * [FEP-ef61] portable objects, including portable actors found through
 * WebFinger, are looked up only if the `verifyPortableObject` option is
-* given; see {@link LookupObjectOptions.verifyPortableObject}.
+* given; see {@link LookupObjectOptions.verifyPortableObject}.  Pass
+* {@link LookupObjectOptions.gateways} to look up a portable ID without
+* `@gateway` location hints.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 *

package/dist/mod.d.ts

@@ -24298,6 +24298,18 @@ interface LookupObjectOptions {
   */
   signal?: AbortSignal;
   /**
+  * The [FEP-ef61] gateways to try when looking up a portable
+  * (`ap:`/`ap+ef61:`) object, in order.  Each must be an HTTP(S) origin.
+  * An explicit list replaces `@gateway` location hints, including when
+  * it is empty.  The gateway named by a compatible identifier or the
+  * WebFinger server is still tried first.  At most five gateways are
+  * requested per lookup, including those given here.
+  *
+  * [FEP-ef61]: https://w3id.org/fep/ef61
+  * @since 2.4.0
+  */
+  gateways?: readonly (string | URL)[];
+  /**
   * The [FEP-ef61] policy to apply to portable objects, typically
   * `verifyPortableObject()` from `@fedify/fedify`, which
   * `Context.lookupObject()` uses by default.
@@ -24355,7 +24367,9 @@ interface LookupObjectOptions {
 *
 * [FEP-ef61] portable objects, including portable actors found through
 * WebFinger, are looked up only if the `verifyPortableObject` option is
-* given; see {@link LookupObjectOptions.verifyPortableObject}.
+* given; see {@link LookupObjectOptions.verifyPortableObject}.  Pass
+* {@link LookupObjectOptions.gateways} to look up a portable ID without
+* `@gateway` location hints.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 *

package/dist/mod.js

@@ -12,7 +12,7 @@ import { isTemporalDuration, isTemporalInstant } from "@fedify/vocab-runtime/tem
 import { delay } from "es-toolkit";
 //#region deno.json
 var name = "@fedify/vocab";
-var version = "2.4.0-dev.2233+abb4a6b2";
+var version = "2.4.0-dev.2240+79613fa6";
 //#endregion
 //#region src/type.ts
 function getTypeId(object) {
@@ -75956,7 +75956,9 @@ const MAX_PORTABLE_ATTEMPTS = 5;
 *
 * [FEP-ef61] portable objects, including portable actors found through
 * WebFinger, are looked up only if the `verifyPortableObject` option is
-* given; see {@link LookupObjectOptions.verifyPortableObject}.
+* given; see {@link LookupObjectOptions.verifyPortableObject}.  Pass
+* {@link LookupObjectOptions.gateways} to look up a portable ID without
+* `@gateway` location hints.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 *
@@ -76014,7 +76016,8 @@ async function lookupObjectInternal(identifier, options = {}) {
 			if (candidate == null) return null;
 			return await lookupPortableObject(portable, candidate, void 0);
 		}
-		identifier = toAcctUrl(identifier) ?? new URL(identifier);
+		if (options.verifyPortableObject != null && parseCompatibleEf61Reference(identifier) === null) return null;
+		identifier = toAcctUrl(identifier) ?? parseIri(identifier);
 	}
 	if (isPortableIri(identifier)) {
 		let candidate;
@@ -76059,7 +76062,7 @@ async function lookupObjectInternal(identifier, options = {}) {
 				const candidate = parsePortableCandidate(l.href);
 				if (candidate == null) continue;
 				const gateways = webFingerGateway == null ? [] : [webFingerGateway];
-				gateways.push(...getPortableGatewayCandidates(candidate));
+				if (options.gateways == null) gateways.push(...getPortableGatewayCandidates(candidate));
 				const object = await lookupPortableObject(portable, candidate, gateways);
 				if (object != null) return object;
 				if (options.signal?.aborted) return null;
@@ -76111,10 +76114,13 @@ async function lookupObjectInternal(identifier, options = {}) {
 			if (claim === null) {
 				logger.debug("Refusing the document {documentUrl}, as it claims to be a portable object with a malformed compatible identifier.", { documentUrl: remoteDoc.documentUrl });
 				return null;
-			} else if (claim != null) return await dereference(portable, claim.id, claim.inferredGateways, {
-				response: remoteDoc,
-				contextLoader: snapshot.loader
-			});
+			} else if (claim != null) {
+				const explicit = getExplicitGateways(portable, claim.id);
+				return await dereference(portable, claim.id, claim.inferredGateways, explicit, {
+					response: remoteDoc,
+					contextLoader: snapshot.loader
+				});
+			}
 		}
 		if (object.id != null && (options.crossOrigin !== "trust" || isPortableIri(object.id)) && !haveSameIriOrigin(object.id, documentUrl) && !haveSameFe34Origin(object.id, documentUrl)) {
 			if (options.crossOrigin === "throw") throw new Error(`The object's @id (${object.id.href}) has a different origin than the document URL (${remoteDoc.documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to "trust".`);
@@ -76130,6 +76136,10 @@ async function lookupObjectInternal(identifier, options = {}) {
 	}
 }
 const PORTABLE_IRI_PATTERN = /^ap(?:\+ef61)?:/i;
+function getExplicitGateways(lookup, id) {
+	if (lookup.options.gateways == null) return void 0;
+	return lookup.explicitGateways ??= getPortableGatewayCandidates(id, lookup.options.gateways);
+}
 /**
 * Parses a raw portable IRI.  URL parsing normalizes dot segments in the
 * opaque path, which would make the parsed IRI identify another portable
@@ -76183,29 +76193,29 @@ function getWebFingerGateway(identifier) {
 }
 /**
 * Looks up a portable object through FEP-ef61 gateways.
-* @param gateways The gateways to ask in order.  If omitted, the location
-*                 hints in the IRI are used, and if there are none, the
-*                 portable IRI itself is passed to the document loader.
+* @param inferredGateways Gateways inferred from a compatible identifier or
+*                         WebFinger.  If omitted, location hints in the IRI
+*                         are used unless explicit gateways were given.
 */
-async function lookupPortableObject(lookup, id, gateways) {
+async function lookupPortableObject(lookup, id, inferredGateways) {
 	const { options } = lookup;
 	const iri = formatIri(id);
+	const explicitGateways = getExplicitGateways(lookup, id);
 	if (options.verifyPortableObject == null) {
 		logger.debug("Cannot look up the portable object {iri}, as the verifyPortableObject option is not given.", { iri });
 		return null;
 	}
 	const canonicalId = canonicalizePortableUri(iri);
-	let candidates;
-	if (gateways == null) {
-		candidates = getPortableGatewayCandidates(id);
-		if (candidates.length < 1) {
-			const key = `${canonicalId} `;
-			if (lookup.remaining < 1 || lookup.attempted.has(key)) return null;
-			lookup.attempted.add(key);
-			lookup.remaining--;
-			return await dereference(lookup, id, []);
-		}
-	} else candidates = [...gateways];
+	const inferred = inferredGateways ?? (explicitGateways == null ? getPortableGatewayCandidates(id) : []);
+	const candidates = [...inferred];
+	for (const gateway of explicitGateways ?? []) if (!candidates.some((candidate) => candidate.href === gateway.href)) candidates.push(gateway);
+	if (candidates.length < 1 && inferredGateways == null) {
+		const key = `${canonicalId} `;
+		if (lookup.remaining < 1 || lookup.attempted.has(key)) return null;
+		lookup.attempted.add(key);
+		lookup.remaining--;
+		return await dereference(lookup, id, [], explicitGateways == null ? void 0 : []);
+	}
 	const selected = [];
 	for (const gateway of candidates) {
 		if (selected.length >= lookup.remaining) break;
@@ -76216,16 +76226,19 @@ async function lookupPortableObject(lookup, id, gateways) {
 	}
 	if (selected.length < 1) return null;
 	lookup.remaining -= selected.length;
-	return await dereference(lookup, id, selected);
+	const selectedInferred = selected.filter((candidate) => inferred.some((gateway) => gateway.href === candidate.href));
+	const selectedExplicit = explicitGateways?.filter((gateway) => selected.some((candidate) => candidate.href === gateway.href));
+	return await dereference(lookup, id, selectedInferred, selectedExplicit);
 }
-async function dereference({ options, documentLoader }, id, gateways, extra = {}) {
+async function dereference({ options, documentLoader }, id, inferredGateways, gateways, extra = {}) {
 	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
 	try {
 		return await dereferencePortableIri(id, {
 			documentLoader,
 			contextLoader: extra.contextLoader ?? options.contextLoader ?? getDocumentLoader({ userAgent: options.userAgent }),
 			tracerProvider,
-			inferredGateways: gateways,
+			inferredGateways,
+			...gateways == null ? {} : { gateways },
 			response: extra.response,
 			verifyPortableObject: options.verifyPortableObject,
 			crossOrigin: options.crossOrigin === "throw" ? "throw" : "ignore",

package/dist-tests/{actor-C8V9Eu9k.mjs → actor-C-Bvqy6v.mjs}

@@ -8,7 +8,7 @@ import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { domainToASCII, domainToUnicode } from "node:url";
 //#region deno.json
 var name = "@fedify/vocab";
-var version = "2.4.0-dev.2233+abb4a6b2";
+var version = "2.4.0-dev.2240+79613fa6";
 //#endregion
 //#region src/actor.ts
 const ACTOR_DISCOVERY_HISTOGRAM_BUCKETS = [

package/dist-tests/actor.test.mjs

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 globalThis.addEventListener = () => {};
 import { F as Person, P as Organization, Q as __exportAll, U as Service, a as Application, b as Group } from "./vocab-D3C791xF.mjs";
 import { t as esm_default } from "./esm-2_Uqq_my.mjs";
-import { a as normalizeActorHandle, i as isActor, n as getActorHandle, r as getActorTypeName, t as getActorClassByTypeName } from "./actor-C8V9Eu9k.mjs";
+import { a as normalizeActorHandle, i as isActor, n as getActorHandle, r as getActorTypeName, t as getActorClassByTypeName } from "./actor-C-Bvqy6v.mjs";
 import { createTestMeterProvider, test } from "@fedify/fixture";
 import { deepStrictEqual, ok, rejects, strictEqual, throws } from "node:assert/strict";
 //#region ../../node_modules/.pnpm/fast-check@3.23.2/node_modules/fast-check/lib/esm/check/precondition/PreconditionFailure.js

package/dist-tests/gateway.test.mjs

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 globalThis.addEventListener = () => {};
 import { F as Person, M as OrderedCollection, S as Image, c as CollectionPage, k as Note, s as Collection, u as Create } from "./vocab-D3C791xF.mjs";
 import { t as esm_default } from "./esm-2_Uqq_my.mjs";
-import { n as traverseCollection, t as lookupObject } from "./lookup-2QrSuQR0.mjs";
+import { n as traverseCollection, t as lookupObject } from "./lookup-DiU8zIYx.mjs";
 import { t as assertInstanceOf } from "./utils-Df2odC27.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, ok, rejects } from "node:assert/strict";
@@ -1126,14 +1126,14 @@ test("accessors verify fetched documents that stand for portable objects", async
 			contextLoader: mockDocumentLoader,
 			verifyPortableObject: createVerifier()
 		}) instanceof Note, expected);
-		deepStrictEqual(await (await createHttpActivity(plainUrl)).getObject({
+		await rejects(() => createHttpActivity(plainUrl).then((activity) => activity.getObject({
 			documentLoader: createRedirectingLoader({ [plainUrl]: {
 				documentUrl: `ap://${did}/objects/x/../1`,
 				document: note()
 			} }),
 			contextLoader: mockDocumentLoader,
 			verifyPortableObject: createVerifier()
-		}), null);
+		})), TypeError);
 	});
 	await t.step("a malformed compatible final URL", async () => {
 		const malformed = `${compatibleNoteId}?@gateway=https%3A%2F%2Fgw2.example`;

package/dist-tests/{lookup-2QrSuQR0.mjs → lookup-DiU8zIYx.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "temporal-polyfill";
 globalThis.addEventListener = () => {};
 import { A as Object$1 } from "./vocab-D3C791xF.mjs";
-import { i as isActor, o as name, s as version } from "./actor-C8V9Eu9k.mjs";
+import { i as isActor, o as name, s as version } from "./actor-C-Bvqy6v.mjs";
 import { t as getTypeId } from "./type-BMdjm4Eg.mjs";
 import { canonicalizePortableUri, formatIri, getDocumentLoader, haveSameFe34Origin, haveSameIriOrigin, parseIri } from "@fedify/vocab-runtime";
 import { lookupWebFinger } from "@fedify/webfinger";
@@ -142,7 +142,9 @@ const MAX_PORTABLE_ATTEMPTS = 5;
 *
 * [FEP-ef61] portable objects, including portable actors found through
 * WebFinger, are looked up only if the `verifyPortableObject` option is
-* given; see {@link LookupObjectOptions.verifyPortableObject}.
+* given; see {@link LookupObjectOptions.verifyPortableObject}.  Pass
+* {@link LookupObjectOptions.gateways} to look up a portable ID without
+* `@gateway` location hints.
 *
 * [FEP-ef61]: https://w3id.org/fep/ef61
 *
@@ -200,7 +202,8 @@ async function lookupObjectInternal(identifier, options = {}) {
 			if (candidate == null) return null;
 			return await lookupPortableObject(portable, candidate, void 0);
 		}
-		identifier = toAcctUrl(identifier) ?? new URL(identifier);
+		if (options.verifyPortableObject != null && parseCompatibleEf61Reference(identifier) === null) return null;
+		identifier = toAcctUrl(identifier) ?? parseIri(identifier);
 	}
 	if (isPortableIri(identifier)) {
 		let candidate;
@@ -245,7 +248,7 @@ async function lookupObjectInternal(identifier, options = {}) {
 				const candidate = parsePortableCandidate(l.href);
 				if (candidate == null) continue;
 				const gateways = webFingerGateway == null ? [] : [webFingerGateway];
-				gateways.push(...getPortableGatewayCandidates(candidate));
+				if (options.gateways == null) gateways.push(...getPortableGatewayCandidates(candidate));
 				const object = await lookupPortableObject(portable, candidate, gateways);
 				if (object != null) return object;
 				if (options.signal?.aborted) return null;
@@ -297,10 +300,13 @@ async function lookupObjectInternal(identifier, options = {}) {
 			if (claim === null) {
 				logger.debug("Refusing the document {documentUrl}, as it claims to be a portable object with a malformed compatible identifier.", { documentUrl: remoteDoc.documentUrl });
 				return null;
-			} else if (claim != null) return await dereference(portable, claim.id, claim.inferredGateways, {
-				response: remoteDoc,
-				contextLoader: snapshot.loader
-			});
+			} else if (claim != null) {
+				const explicit = getExplicitGateways(portable, claim.id);
+				return await dereference(portable, claim.id, claim.inferredGateways, explicit, {
+					response: remoteDoc,
+					contextLoader: snapshot.loader
+				});
+			}
 		}
 		if (object.id != null && (options.crossOrigin !== "trust" || isPortableIri(object.id)) && !haveSameIriOrigin(object.id, documentUrl) && !haveSameFe34Origin(object.id, documentUrl)) {
 			if (options.crossOrigin === "throw") throw new Error(`The object's @id (${object.id.href}) has a different origin than the document URL (${remoteDoc.documentUrl}); refusing to return the object.  If you want to bypass this check and are aware of the security implications, set the crossOrigin option to "trust".`);
@@ -316,6 +322,10 @@ async function lookupObjectInternal(identifier, options = {}) {
 	}
 }
 const PORTABLE_IRI_PATTERN = /^ap(?:\+ef61)?:/i;
+function getExplicitGateways(lookup, id) {
+	if (lookup.options.gateways == null) return void 0;
+	return lookup.explicitGateways ??= getPortableGatewayCandidates(id, lookup.options.gateways);
+}
 /**
 * Parses a raw portable IRI.  URL parsing normalizes dot segments in the
 * opaque path, which would make the parsed IRI identify another portable
@@ -369,29 +379,29 @@ function getWebFingerGateway(identifier) {
 }
 /**
 * Looks up a portable object through FEP-ef61 gateways.
-* @param gateways The gateways to ask in order.  If omitted, the location
-*                 hints in the IRI are used, and if there are none, the
-*                 portable IRI itself is passed to the document loader.
+* @param inferredGateways Gateways inferred from a compatible identifier or
+*                         WebFinger.  If omitted, location hints in the IRI
+*                         are used unless explicit gateways were given.
 */
-async function lookupPortableObject(lookup, id, gateways) {
+async function lookupPortableObject(lookup, id, inferredGateways) {
 	const { options } = lookup;
 	const iri = formatIri(id);
+	const explicitGateways = getExplicitGateways(lookup, id);
 	if (options.verifyPortableObject == null) {
 		logger.debug("Cannot look up the portable object {iri}, as the verifyPortableObject option is not given.", { iri });
 		return null;
 	}
 	const canonicalId = canonicalizePortableUri(iri);
-	let candidates;
-	if (gateways == null) {
-		candidates = getPortableGatewayCandidates(id);
-		if (candidates.length < 1) {
-			const key = `${canonicalId} `;
-			if (lookup.remaining < 1 || lookup.attempted.has(key)) return null;
-			lookup.attempted.add(key);
-			lookup.remaining--;
-			return await dereference(lookup, id, []);
-		}
-	} else candidates = [...gateways];
+	const inferred = inferredGateways ?? (explicitGateways == null ? getPortableGatewayCandidates(id) : []);
+	const candidates = [...inferred];
+	for (const gateway of explicitGateways ?? []) if (!candidates.some((candidate) => candidate.href === gateway.href)) candidates.push(gateway);
+	if (candidates.length < 1 && inferredGateways == null) {
+		const key = `${canonicalId} `;
+		if (lookup.remaining < 1 || lookup.attempted.has(key)) return null;
+		lookup.attempted.add(key);
+		lookup.remaining--;
+		return await dereference(lookup, id, [], explicitGateways == null ? void 0 : []);
+	}
 	const selected = [];
 	for (const gateway of candidates) {
 		if (selected.length >= lookup.remaining) break;
@@ -402,16 +412,19 @@ async function lookupPortableObject(lookup, id, gateways) {
 	}
 	if (selected.length < 1) return null;
 	lookup.remaining -= selected.length;
-	return await dereference(lookup, id, selected);
+	const selectedInferred = selected.filter((candidate) => inferred.some((gateway) => gateway.href === candidate.href));
+	const selectedExplicit = explicitGateways?.filter((gateway) => selected.some((candidate) => candidate.href === gateway.href));
+	return await dereference(lookup, id, selectedInferred, selectedExplicit);
 }
-async function dereference({ options, documentLoader }, id, gateways, extra = {}) {
+async function dereference({ options, documentLoader }, id, inferredGateways, gateways, extra = {}) {
 	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
 	try {
 		return await dereferencePortableIri(id, {
 			documentLoader,
 			contextLoader: extra.contextLoader ?? options.contextLoader ?? getDocumentLoader({ userAgent: options.userAgent }),
 			tracerProvider,
-			inferredGateways: gateways,
+			inferredGateways,
+			...gateways == null ? {} : { gateways },
 			response: extra.response,
 			verifyPortableObject: options.verifyPortableObject,
 			crossOrigin: options.crossOrigin === "throw" ? "throw" : "ignore",

package/dist-tests/lookup.test.mjs

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 globalThis.addEventListener = () => {};
 import { A as Object$1, F as Person, k as Note, s as Collection } from "./vocab-D3C791xF.mjs";
 import { t as esm_default } from "./esm-2_Uqq_my.mjs";
-import { n as traverseCollection, t as lookupObject } from "./lookup-2QrSuQR0.mjs";
+import { n as traverseCollection, t as lookupObject } from "./lookup-DiU8zIYx.mjs";
 import { t as assertInstanceOf } from "./utils-Df2odC27.mjs";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { deepStrictEqual, equal, ok, rejects } from "node:assert/strict";