@fedify/fedify 2.3.0-dev.1013 → 2.3.0-dev.1034

package/dist/{middleware-CKJC8DRf.js → middleware-fAuUxD9-.js}

@@ -2,13 +2,13 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 import { t as __exportAll } from "./chunk-nlSIicah.js";
 import { r as getDefaultActivityTransformers } from "./transformers-ve6e2xcg.js";
-import { _ as version, a as verifyRequestDetailed, d as validateCryptoKey, f as formatAcceptSignature, g as name, i as verifyRequest, n as parseRfc9421SignatureInput, o as exportJwk, t as doubleKnock, u as importJwk } from "./http-1NL30qCe.js";
-import { c as getKeyOwner, d as detachSignature, f as hasSignatureLike, i as verifyObject, m as verifyJsonLd, n as hasProofLike, o as normalizeOutgoingActivityJsonLd, p as signJsonLd, r as signObject, s as doesActorOwnKey } from "./proof-Dedf8md5.js";
+import { _ as version, a as verifyRequestDetailed, d as validateCryptoKey, f as formatAcceptSignature, g as name, i as verifyRequest, n as parseRfc9421SignatureInput, o as exportJwk, t as doubleKnock, u as importJwk } from "./http-BUr93aO6.js";
+import { c as getKeyOwner, d as detachSignature, f as hasSignatureLike, i as verifyObject, m as verifyJsonLd, n as hasProofLike, o as normalizeOutgoingActivityJsonLd, p as signJsonLd, r as signObject, s as doesActorOwnKey } from "./proof-k4mEvvdS.js";
 import { n as getNodeInfo, t as nodeInfoToJson } from "./types-hvL8ElAs.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-CsC3P4uu.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-C3esyJFP.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
-import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
+import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 import { cloneDeep, uniq } from "es-toolkit";
 import { Router } from "uri-template-router";
 import { parseTemplate } from "url-template";
@@ -160,6 +160,7 @@ var RouterError = class extends Error {
 };
 //#endregion
 //#region src/federation/builder.ts
+const ACTOR_ALIAS_PREFIX = "actorAlias:";
 function validateSingleIdentifierVariablePath(path, errorMessage) {
 	const operatorMatches = globalThis.Array.from(path.matchAll(/{([+#./;?&]?)([A-Za-z_][A-Za-z0-9_]*)}/g));
 	if (operatorMatches.length !== 1 || operatorMatches[0]?.[2] !== "identifier") throw new RouterError(errorMessage);
@@ -346,6 +347,15 @@ var FederationBuilderImpl = class {
 				callbacks.aliasMapper = mapper;
 				return setters;
 			},
+			mapActorAlias: (path, identifier) => {
+				if (identifier === "") throw new RouterError("Identifier cannot be empty.");
+				if (this.router.has(`actorAlias:${identifier}`)) throw new RouterError(`Actor alias for "${identifier}" already set.`);
+				if (new Router$1().add(path, "temp").size > 0) throw new RouterError("Path for actor alias must have no variables.");
+				const existingRoute = this.router.route(path);
+				if (existingRoute != null) throw new RouterError(`Actor alias path "${path}" conflicts with existing route "${existingRoute.name}".`);
+				this.router.add(path, `${ACTOR_ALIAS_PREFIX}${identifier}`);
+				return setters;
+			},
 			authorize(predicate) {
 				callbacks.authorizePredicate = predicate;
 				return setters;
@@ -769,8 +779,90 @@ async function buildCollectionSynchronizationHeader(collectionId, actorIds) {
 	return `collectionId="${collectionId}", url="${url}", digest="${encodeHex(await digest(actorIds))}"`;
 }
 //#endregion
+//#region src/federation/metrics.ts
+var FederationMetrics = class {
+	deliverySent;
+	deliveryPermanentFailure;
+	signatureVerificationFailure;
+	deliveryDuration;
+	inboxProcessingDuration;
+	constructor(meterProvider) {
+		const meter = meterProvider.getMeter(name, version);
+		this.deliverySent = meter.createCounter("activitypub.delivery.sent", {
+			description: "ActivityPub delivery attempts.",
+			unit: "{attempt}"
+		});
+		this.deliveryPermanentFailure = meter.createCounter("activitypub.delivery.permanent_failure", {
+			description: "ActivityPub deliveries abandoned as permanent failures.",
+			unit: "{failure}"
+		});
+		this.signatureVerificationFailure = meter.createCounter("activitypub.signature.verification_failure", {
+			description: "ActivityPub signature verification failures.",
+			unit: "{failure}"
+		});
+		this.deliveryDuration = meter.createHistogram("activitypub.delivery.duration", {
+			description: "Duration of ActivityPub delivery attempts.",
+			unit: "ms"
+		});
+		this.inboxProcessingDuration = meter.createHistogram("activitypub.inbox.processing_duration", {
+			description: "Duration of ActivityPub inbox listener processing.",
+			unit: "ms"
+		});
+	}
+	recordDelivery(inbox, durationMs, success, activityType) {
+		const deliveryAttributes = {
+			"activitypub.remote.host": getRemoteHost(inbox),
+			"activitypub.delivery.success": success
+		};
+		if (activityType != null) deliveryAttributes["activitypub.activity.type"] = activityType;
+		this.deliverySent.add(1, deliveryAttributes);
+		this.deliveryDuration.record(durationMs, deliveryAttributes);
+	}
+	recordPermanentFailure(inbox, statusCode) {
+		this.deliveryPermanentFailure.add(1, {
+			"activitypub.remote.host": getRemoteHost(inbox),
+			"http.response.status_code": statusCode
+		});
+	}
+	recordSignatureVerificationFailure(reason, remoteHost) {
+		const attributes = { "activitypub.verification.failure_reason": reason };
+		if (remoteHost != null) attributes["activitypub.remote.host"] = remoteHost;
+		this.signatureVerificationFailure.add(1, attributes);
+	}
+	recordInboxProcessingDuration(activityType, durationMs) {
+		this.inboxProcessingDuration.record(durationMs, { "activitypub.activity.type": activityType });
+	}
+};
+const federationMetrics = /* @__PURE__ */ new WeakMap();
+/**
+* Gets the cached Fedify metric instruments for a meter provider.
+* @since 2.3.0
+*/
+function getFederationMetrics(meterProvider = metrics.getMeterProvider()) {
+	let instruments = federationMetrics.get(meterProvider);
+	if (instruments == null) {
+		instruments = new FederationMetrics(meterProvider);
+		federationMetrics.set(meterProvider, instruments);
+	}
+	return instruments;
+}
+/**
+* Gets the bounded remote host attribute value for a URL.
+* @since 2.3.0
+*/
+function getRemoteHost(url) {
+	return url.hostname;
+}
+/**
+* Gets an elapsed duration in milliseconds from a `performance.now()` value.
+* @since 2.3.0
+*/
+function getDurationMs(start) {
+	return Math.max(0, performance.now() - start);
+}
+//#endregion
 //#region src/federation/inbox.ts
-async function routeActivity({ context: ctx, json, activity, recipient, inboxListeners, inboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, tracerProvider, idempotencyStrategy }) {
+async function routeActivity({ context: ctx, json, activity, recipient, inboxListeners, inboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
@@ -871,7 +963,13 @@ async function routeActivity({ context: ctx, json, activity, recipient, inboxLis
 		const { class: cls, listener } = dispatched;
 		span.updateName(`activitypub.dispatch_inbox_listener ${cls.name}`);
 		try {
-			await listener(inboxContextFactory(recipient, json, activity?.id?.href, getTypeId(activity).href), activity);
+			const activityType = getTypeId(activity).href;
+			const started = performance.now();
+			try {
+				await listener(inboxContextFactory(recipient, json, activity?.id?.href, activityType), activity);
+			} finally {
+				getFederationMetrics(meterProvider).recordInboxProcessingDuration(activityType, getDurationMs(started));
+			}
 		} catch (error) {
 			try {
 				await inboxErrorHandler?.(ctx, error);
@@ -1681,6 +1779,8 @@ async function handleInboxInternal(request, parameters, span) {
 			});
 			if (verification.verified === false) {
 				const reason = verification.reason;
+				const remoteHost = "keyId" in reason && reason.keyId != null ? getRemoteHost(reason.keyId) : void 0;
+				getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure(reason.type, remoteHost);
 				logger.error("Failed to verify the request's HTTP Signatures.", {
 					recipient,
 					reason: reason.type,
@@ -1767,6 +1867,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
 	if (httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, ctx)) {
+		getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("actorKeyMismatch", httpSigKey.id == null ? void 0 : getRemoteHost(httpSigKey.id));
 		logger.error("The signer ({keyId}) and the actor ({actorId}) do not match.", {
 			activity: json,
 			recipient,
@@ -1784,6 +1885,7 @@ async function handleInboxInternal(request, parameters, span) {
 	}
 	if (pendingNonceLabel != null) {
 		if (!await verifySignatureNonce(request, kv, kvPrefixes.acceptSignatureNonce, pendingNonceLabel)) {
+			getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("invalidNonce", httpSigKey?.id == null ? void 0 : getRemoteHost(httpSigKey.id));
 			logger.error("Signature nonce verification failed (missing, expired, or replayed).", { recipient });
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
@@ -1800,6 +1902,7 @@ async function handleInboxInternal(request, parameters, span) {
 		kvPrefixes,
 		queue,
 		span,
+		meterProvider: parameters.meterProvider,
 		tracerProvider,
 		idempotencyStrategy: parameters.idempotencyStrategy
 	});
@@ -2447,6 +2550,25 @@ function sendActivity(options) {
 	});
 }
 const MAX_ERROR_RESPONSE_BODY_BYTES = 1024;
+function getActivityActorId(activity) {
+	if (!isRecord(activity)) return void 0;
+	return getIdValue(activity.actor);
+}
+function getIdValue(value) {
+	if (typeof value === "string" && value !== "") return value;
+	if (value instanceof URL) return value.href;
+	if (Array.isArray(value)) {
+		for (const item of value) {
+			const id = getIdValue(item);
+			if (id != null) return id;
+		}
+		return;
+	}
+	if (isRecord(value)) return getIdValue(value.id);
+}
+function isRecord(value) {
+	return typeof value === "object" && value != null;
+}
 async function readLimitedResponseBody(response, maxBytes) {
 	if (response.body == null) return "";
 	const reader = response.body.getReader();
@@ -2474,12 +2596,15 @@ async function readLimitedResponseBody(response, maxBytes) {
 	if (truncated) result += "… (truncated)";
 	return result;
 }
-async function sendActivityInternal({ activity, activityId, keys, inbox, headers, specDeterminer, tracerProvider }, span) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, headers, specDeterminer, meterProvider, tracerProvider }, span) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
 		"outbox"
 	]);
+	const federationMetrics = getFederationMetrics(meterProvider);
+	const started = performance.now();
+	let deliverySuccess = false;
 	headers = new Headers(headers);
 	headers.set("Content-Type", "application/activity+json");
 	const request = new Request(inbox, {
@@ -2511,29 +2636,38 @@ async function sendActivityInternal({ activity, activityId, keys, inbox, headers
 			inbox: inbox.href,
 			error
 		});
+		federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
 		throw error;
 	}
-	if (!response.ok) {
-		let error;
-		try {
-			error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
-		} catch (_) {
-			error = "";
+	try {
+		if (!response.ok) {
+			let error;
+			try {
+				error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
+			} catch (_) {
+				error = "";
+			}
+			logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
+				activityId,
+				inbox: inbox.href,
+				status: response.status,
+				statusText: response.statusText,
+				error
+			});
+			throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error);
 		}
-		logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
-			activityId,
-			inbox: inbox.href,
-			status: response.status,
-			statusText: response.statusText,
-			error
-		});
-		throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error);
+		deliverySuccess = true;
+		const eventAttributes = {
+			"activitypub.inbox.url": inbox.href,
+			"activitypub.activity.id": activityId ?? ""
+		};
+		if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
+		const actorId = getActivityActorId(activity);
+		if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
+		span.addEvent("activitypub.activity.sent", eventAttributes);
+	} finally {
+		federationMetrics.recordDelivery(inbox, getDurationMs(started), deliverySuccess, activityType);
 	}
-	span.addEvent("activitypub.activity.sent", {
-		"activitypub.activity.json": JSON.stringify(activity),
-		"activitypub.inbox.url": inbox.href,
-		"activitypub.activity.id": activityId ?? ""
-	});
 }
 /**
 * An error that is thrown when an activity fails to send to a remote inbox.
@@ -2751,6 +2885,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 	inboxRetryPolicy;
 	activityTransformers;
 	_tracerProvider;
+	_meterProvider;
 	firstKnock;
 	inboxChallengePolicy;
 	constructor(options) {
@@ -2836,11 +2971,15 @@ var FederationImpl = class extends FederationBuilderImpl {
 		this.inboxRetryPolicy = options.inboxRetryPolicy ?? createExponentialBackoffPolicy();
 		this.activityTransformers = options.activityTransformers ?? getDefaultActivityTransformers();
 		this._tracerProvider = options.tracerProvider;
+		this._meterProvider = options.meterProvider;
 		this.firstKnock = options.firstKnock;
 	}
 	get tracerProvider() {
 		return this._tracerProvider ?? trace.getTracerProvider();
 	}
+	get meterProvider() {
+		return this._meterProvider ?? metrics.getMeterProvider();
+	}
 	_initializeRouter() {
 		this.router.add("/.well-known/webfinger", "webfinger");
 		this.router.add("/.well-known/nodeinfo", "nodeInfoJrd");
@@ -3019,6 +3158,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				sharedInbox: message.sharedInbox,
 				headers: new Headers(message.headers),
 				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock),
+				meterProvider: this.meterProvider,
 				tracerProvider: this.tracerProvider
 			});
 		} catch (error) {
@@ -3026,6 +3166,21 @@ var FederationImpl = class extends FederationBuilderImpl {
 				code: SpanStatusCode.ERROR,
 				message: String(error)
 			});
+			const remoteHost = (() => {
+				if (error instanceof SendActivityError) return getRemoteHost(error.inbox);
+				try {
+					return getRemoteHost(new URL(message.inbox));
+				} catch (_) {
+					logger.warn("Invalid inbox URL in queued outbox message: {inbox}", logData);
+					return;
+				}
+			})();
+			span.addEvent("activitypub.delivery.failed", {
+				...remoteHost == null ? {} : { "activitypub.remote.host": remoteHost },
+				"activitypub.delivery.attempt": message.attempt,
+				"activitypub.delivery.permanent_failure": error instanceof SendActivityError && this.permanentFailureStatusCodes.includes(error.statusCode),
+				...error instanceof SendActivityError ? { "http.response.status_code": error.statusCode } : {}
+			});
 			const loaderOptions = this.#getLoaderOptions(message.baseUrl);
 			const activity = await Activity.fromJsonLd(message.activity, {
 				contextLoader: this.contextLoaderFactory(loaderOptions),
@@ -3041,6 +3196,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				});
 			}
 			if (error instanceof SendActivityError && this.permanentFailureStatusCodes.includes(error.statusCode)) {
+				getFederationMetrics(this.meterProvider).recordPermanentFailure(error.inbox, error.statusCode);
 				logger.warn("Permanent delivery failure for activity {activityId} to {inbox} ({status}); not retrying.", {
 					...logData,
 					status: error.statusCode
@@ -3149,7 +3305,13 @@ var FederationImpl = class extends FederationBuilderImpl {
 			const { class: cls, listener } = dispatched;
 			span.updateName(`activitypub.dispatch_inbox_listener ${cls.name}`);
 			try {
-				await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, getTypeId(activity).href), activity);
+				const activityType = getTypeId(activity).href;
+				const started = performance.now();
+				try {
+					await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, activityType), activity);
+				} finally {
+					getFederationMetrics(this.meterProvider).recordInboxProcessingDuration(activityType, getDurationMs(started));
+				}
 			} catch (error) {
 				try {
 					await this.inboxErrorHandler?.(context, error);
@@ -3332,6 +3494,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				sharedInbox: inboxes[inbox].sharedInbox,
 				headers: collectionSync == null ? void 0 : new Headers({ "Collection-Synchronization": await buildCollectionSynchronizationHeader(collectionSync, inboxes[inbox].actorIds) }),
 				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock),
+				meterProvider: this.meterProvider,
 				tracerProvider: this.tracerProvider
 			}));
 			await Promise.all(promises);
@@ -3508,15 +3671,18 @@ var FederationImpl = class extends FederationBuilderImpl {
 		if (request.method !== "POST" && !acceptsJsonLd(request)) return await onNotAcceptable(request);
 		switch (routeName) {
 			case "actor":
-				context = this.#createContext(request, contextData, { invokedFromActorDispatcher: { identifier: route.values.identifier } });
+			case "actorAlias": {
+				const identifier = route.name.startsWith("actorAlias:") ? route.name.substring(11) : route.values.identifier;
+				context = this.#createContext(request, contextData, { invokedFromActorDispatcher: { identifier } });
 				return await handleActor(request, {
-					identifier: route.values.identifier,
+					identifier,
 					context,
 					actorDispatcher: this.actorCallbacks?.dispatcher,
 					authorizePredicate: this.actorCallbacks?.authorizePredicate,
 					onUnauthorized,
 					onNotFound
 				});
+			}
 			case "object": {
 				const typeId = route.name.replace(/^object:/, "");
 				const callbacks = this.objectCallbacks[typeId];
@@ -3598,6 +3764,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					signatureTimeWindow: this.signatureTimeWindow,
 					skipSignatureVerification: this.skipSignatureVerification,
 					inboxChallengePolicy: this.inboxChallengePolicy,
+					meterProvider: this.meterProvider,
 					tracerProvider: this.tracerProvider,
 					idempotencyStrategy: this.idempotencyStrategy
 				});
@@ -3759,13 +3926,16 @@ var ContextImpl = class ContextImpl {
 	get tracerProvider() {
 		return this.federation.tracerProvider;
 	}
+	get meterProvider() {
+		return this.federation.meterProvider;
+	}
 	getNodeInfoUri() {
 		const path = this.federation.router.build("nodeInfo", {});
 		if (path == null) throw new RouterError("No NodeInfo dispatcher registered.");
 		return new URL(path, this.canonicalOrigin);
 	}
 	getActorUri(identifier) {
-		const path = this.federation.router.build("actor", { identifier });
+		const path = this.federation.router.build(`actorAlias:${identifier}`, {}) ?? this.federation.router.build("actor", { identifier });
 		if (path == null) throw new RouterError("No actor dispatcher registered.");
 		return new URL(path, this.canonicalOrigin);
 	}
@@ -3831,8 +4001,8 @@ var ContextImpl = class ContextImpl {
 			type: "inbox",
 			identifier: void 0
 		};
-		const identifier = route.values.identifier;
-		if (route.name === "actor") return {
+		const identifier = route.name.startsWith("actorAlias:") ? route.name.substring(11) : route.values.identifier;
+		if (route.name === "actor" || route.name.startsWith("actorAlias:")) return {
 			type: "actor",
 			identifier
 		};
@@ -4508,6 +4678,7 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 			activityType: ctx.activityType,
 			inbox: new URL(inbox),
 			sharedInbox: inboxes[inbox].sharedInbox,
+			meterProvider: ctx.meterProvider,
 			tracerProvider: ctx.tracerProvider,
 			specDeterminer: new KvSpecDeterminer(ctx.federation.kv, ctx.federation.kvPrefixes.httpMessageSignaturesSpec, ctx.federation.firstKnock)
 		}));

package/dist/{middleware-BwC5U8zJ.cjs → middleware-ohzkLsW4.cjs}

@@ -1,4 +1,4 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
-const require_middleware = require("./middleware-BiFLcrEX.cjs");
+const require_middleware = require("./middleware-CKkBrsOD.cjs");
 exports.FederationImpl = require_middleware.FederationImpl;