@fedify/fedify 2.3.0-dev.1021 → 2.3.0-dev.1048

package/dist/{middleware-I5XEZ_pZ.cjs → middleware-Ccpokmfe.cjs}

@@ -2,10 +2,10 @@ const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 require("./chunk-DDcVe30Y.cjs");
 const require_transformers = require("./transformers-NeAONrAq.cjs");
-const require_http = require("./http-D4xMqSqO.cjs");
-const require_proof = require("./proof-oGiWJkX0.cjs");
+const require_http = require("./http-Bj0uN6d-.cjs");
+const require_proof = require("./proof-C2QsttUL.cjs");
 const require_types = require("./types-KC4QAoxe.cjs");
-const require_kv_cache = require("./kv-cache-DRwOjOkl.cjs");
+const require_kv_cache = require("./kv-cache-BdSTsjLb.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
@@ -211,7 +211,7 @@ var FederationBuilderImpl = class {
 		this.collectionTypeIds = {};
 	}
 	async build(options) {
-		const { FederationImpl } = await Promise.resolve().then(() => require("./middleware-ASvK22Do.cjs"));
+		const { FederationImpl } = await Promise.resolve().then(() => require("./middleware-DTxZNOqy.cjs"));
 		const f = new FederationImpl(options);
 		const trailingSlashInsensitiveValue = f.router.trailingSlashInsensitive;
 		f.router = this.router.clone();
@@ -779,8 +779,90 @@ async function buildCollectionSynchronizationHeader(collectionId, actorIds) {
 	return `collectionId="${collectionId}", url="${url}", digest="${(0, byte_encodings_hex.encodeHex)(await digest(actorIds))}"`;
 }
 //#endregion
+//#region src/federation/metrics.ts
+var FederationMetrics = class {
+	deliverySent;
+	deliveryPermanentFailure;
+	signatureVerificationFailure;
+	deliveryDuration;
+	inboxProcessingDuration;
+	constructor(meterProvider) {
+		const meter = meterProvider.getMeter(require_http.name, require_http.version);
+		this.deliverySent = meter.createCounter("activitypub.delivery.sent", {
+			description: "ActivityPub delivery attempts.",
+			unit: "{attempt}"
+		});
+		this.deliveryPermanentFailure = meter.createCounter("activitypub.delivery.permanent_failure", {
+			description: "ActivityPub deliveries abandoned as permanent failures.",
+			unit: "{failure}"
+		});
+		this.signatureVerificationFailure = meter.createCounter("activitypub.signature.verification_failure", {
+			description: "ActivityPub signature verification failures.",
+			unit: "{failure}"
+		});
+		this.deliveryDuration = meter.createHistogram("activitypub.delivery.duration", {
+			description: "Duration of ActivityPub delivery attempts.",
+			unit: "ms"
+		});
+		this.inboxProcessingDuration = meter.createHistogram("activitypub.inbox.processing_duration", {
+			description: "Duration of ActivityPub inbox listener processing.",
+			unit: "ms"
+		});
+	}
+	recordDelivery(inbox, durationMs, success, activityType) {
+		const deliveryAttributes = {
+			"activitypub.remote.host": getRemoteHost(inbox),
+			"activitypub.delivery.success": success
+		};
+		if (activityType != null) deliveryAttributes["activitypub.activity.type"] = activityType;
+		this.deliverySent.add(1, deliveryAttributes);
+		this.deliveryDuration.record(durationMs, deliveryAttributes);
+	}
+	recordPermanentFailure(inbox, statusCode) {
+		this.deliveryPermanentFailure.add(1, {
+			"activitypub.remote.host": getRemoteHost(inbox),
+			"http.response.status_code": statusCode
+		});
+	}
+	recordSignatureVerificationFailure(reason, remoteHost) {
+		const attributes = { "activitypub.verification.failure_reason": reason };
+		if (remoteHost != null) attributes["activitypub.remote.host"] = remoteHost;
+		this.signatureVerificationFailure.add(1, attributes);
+	}
+	recordInboxProcessingDuration(activityType, durationMs) {
+		this.inboxProcessingDuration.record(durationMs, { "activitypub.activity.type": activityType });
+	}
+};
+const federationMetrics = /* @__PURE__ */ new WeakMap();
+/**
+* Gets the cached Fedify metric instruments for a meter provider.
+* @since 2.3.0
+*/
+function getFederationMetrics(meterProvider = _opentelemetry_api.metrics.getMeterProvider()) {
+	let instruments = federationMetrics.get(meterProvider);
+	if (instruments == null) {
+		instruments = new FederationMetrics(meterProvider);
+		federationMetrics.set(meterProvider, instruments);
+	}
+	return instruments;
+}
+/**
+* Gets the bounded remote host attribute value for a URL.
+* @since 2.3.0
+*/
+function getRemoteHost(url) {
+	return url.hostname;
+}
+/**
+* Gets an elapsed duration in milliseconds from a `performance.now()` value.
+* @since 2.3.0
+*/
+function getDurationMs(start) {
+	return Math.max(0, performance.now() - start);
+}
+//#endregion
 //#region src/federation/inbox.ts
-async function routeActivity({ context: ctx, json, activity, recipient, inboxListeners, inboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, tracerProvider, idempotencyStrategy }) {
+async function routeActivity({ context: ctx, json, activity, recipient, inboxListeners, inboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
@@ -881,7 +963,13 @@ async function routeActivity({ context: ctx, json, activity, recipient, inboxLis
 		const { class: cls, listener } = dispatched;
 		span.updateName(`activitypub.dispatch_inbox_listener ${cls.name}`);
 		try {
-			await listener(inboxContextFactory(recipient, json, activity?.id?.href, (0, _fedify_vocab.getTypeId)(activity).href), activity);
+			const activityType = (0, _fedify_vocab.getTypeId)(activity).href;
+			const started = performance.now();
+			try {
+				await listener(inboxContextFactory(recipient, json, activity?.id?.href, activityType), activity);
+			} finally {
+				getFederationMetrics(meterProvider).recordInboxProcessingDuration(activityType, getDurationMs(started));
+			}
 		} catch (error) {
 			try {
 				await inboxErrorHandler?.(ctx, error);
@@ -1691,6 +1779,8 @@ async function handleInboxInternal(request, parameters, span) {
 			});
 			if (verification.verified === false) {
 				const reason = verification.reason;
+				const remoteHost = "keyId" in reason && reason.keyId != null ? getRemoteHost(reason.keyId) : void 0;
+				getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure(reason.type, remoteHost);
 				logger.error("Failed to verify the request's HTTP Signatures.", {
 					recipient,
 					reason: reason.type,
@@ -1777,6 +1867,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
 	if (httpSigKey != null && !await require_proof.doesActorOwnKey(activity, httpSigKey, ctx)) {
+		getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("actorKeyMismatch", httpSigKey.id == null ? void 0 : getRemoteHost(httpSigKey.id));
 		logger.error("The signer ({keyId}) and the actor ({actorId}) do not match.", {
 			activity: json,
 			recipient,
@@ -1794,6 +1885,7 @@ async function handleInboxInternal(request, parameters, span) {
 	}
 	if (pendingNonceLabel != null) {
 		if (!await verifySignatureNonce(request, kv, kvPrefixes.acceptSignatureNonce, pendingNonceLabel)) {
+			getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("invalidNonce", httpSigKey?.id == null ? void 0 : getRemoteHost(httpSigKey.id));
 			logger.error("Signature nonce verification failed (missing, expired, or replayed).", { recipient });
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
@@ -1810,6 +1902,7 @@ async function handleInboxInternal(request, parameters, span) {
 		kvPrefixes,
 		queue,
 		span,
+		meterProvider: parameters.meterProvider,
 		tracerProvider,
 		idempotencyStrategy: parameters.idempotencyStrategy
 	});
@@ -2457,6 +2550,25 @@ function sendActivity(options) {
 	});
 }
 const MAX_ERROR_RESPONSE_BODY_BYTES = 1024;
+function getActivityActorId(activity) {
+	if (!isRecord(activity)) return void 0;
+	return getIdValue(activity.actor);
+}
+function getIdValue(value) {
+	if (typeof value === "string" && value !== "") return value;
+	if (value instanceof URL) return value.href;
+	if (Array.isArray(value)) {
+		for (const item of value) {
+			const id = getIdValue(item);
+			if (id != null) return id;
+		}
+		return;
+	}
+	if (isRecord(value)) return getIdValue(value.id);
+}
+function isRecord(value) {
+	return typeof value === "object" && value != null;
+}
 async function readLimitedResponseBody(response, maxBytes) {
 	if (response.body == null) return "";
 	const reader = response.body.getReader();
@@ -2484,12 +2596,15 @@ async function readLimitedResponseBody(response, maxBytes) {
 	if (truncated) result += "… (truncated)";
 	return result;
 }
-async function sendActivityInternal({ activity, activityId, keys, inbox, headers, specDeterminer, tracerProvider }, span) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, headers, specDeterminer, meterProvider, tracerProvider }, span) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"federation",
 		"outbox"
 	]);
+	const federationMetrics = getFederationMetrics(meterProvider);
+	const started = performance.now();
+	let deliverySuccess = false;
 	headers = new Headers(headers);
 	headers.set("Content-Type", "application/activity+json");
 	const request = new Request(inbox, {
@@ -2521,29 +2636,38 @@ async function sendActivityInternal({ activity, activityId, keys, inbox, headers
 			inbox: inbox.href,
 			error
 		});
+		federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
 		throw error;
 	}
-	if (!response.ok) {
-		let error;
-		try {
-			error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
-		} catch (_) {
-			error = "";
+	try {
+		if (!response.ok) {
+			let error;
+			try {
+				error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
+			} catch (_) {
+				error = "";
+			}
+			logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
+				activityId,
+				inbox: inbox.href,
+				status: response.status,
+				statusText: response.statusText,
+				error
+			});
+			throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error);
 		}
-		logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
-			activityId,
-			inbox: inbox.href,
-			status: response.status,
-			statusText: response.statusText,
-			error
-		});
-		throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error);
+		deliverySuccess = true;
+		const eventAttributes = {
+			"activitypub.inbox.url": inbox.href,
+			"activitypub.activity.id": activityId ?? ""
+		};
+		if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
+		const actorId = getActivityActorId(activity);
+		if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
+		span.addEvent("activitypub.activity.sent", eventAttributes);
+	} finally {
+		federationMetrics.recordDelivery(inbox, getDurationMs(started), deliverySuccess, activityType);
 	}
-	span.addEvent("activitypub.activity.sent", {
-		"activitypub.activity.json": JSON.stringify(activity),
-		"activitypub.inbox.url": inbox.href,
-		"activitypub.activity.id": activityId ?? ""
-	});
 }
 /**
 * An error that is thrown when an activity fails to send to a remote inbox.
@@ -2753,6 +2877,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 	inboxRetryPolicy;
 	activityTransformers;
 	_tracerProvider;
+	_meterProvider;
 	firstKnock;
 	inboxChallengePolicy;
 	constructor(options) {
@@ -2838,11 +2963,15 @@ var FederationImpl = class extends FederationBuilderImpl {
 		this.inboxRetryPolicy = options.inboxRetryPolicy ?? createExponentialBackoffPolicy();
 		this.activityTransformers = options.activityTransformers ?? require_transformers.getDefaultActivityTransformers();
 		this._tracerProvider = options.tracerProvider;
+		this._meterProvider = options.meterProvider;
 		this.firstKnock = options.firstKnock;
 	}
 	get tracerProvider() {
 		return this._tracerProvider ?? _opentelemetry_api.trace.getTracerProvider();
 	}
+	get meterProvider() {
+		return this._meterProvider ?? _opentelemetry_api.metrics.getMeterProvider();
+	}
 	_initializeRouter() {
 		this.router.add("/.well-known/webfinger", "webfinger");
 		this.router.add("/.well-known/nodeinfo", "nodeInfoJrd");
@@ -3021,6 +3150,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				sharedInbox: message.sharedInbox,
 				headers: new Headers(message.headers),
 				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock),
+				meterProvider: this.meterProvider,
 				tracerProvider: this.tracerProvider
 			});
 		} catch (error) {
@@ -3028,6 +3158,21 @@ var FederationImpl = class extends FederationBuilderImpl {
 				code: _opentelemetry_api.SpanStatusCode.ERROR,
 				message: String(error)
 			});
+			const remoteHost = (() => {
+				if (error instanceof SendActivityError) return getRemoteHost(error.inbox);
+				try {
+					return getRemoteHost(new URL(message.inbox));
+				} catch (_) {
+					logger.warn("Invalid inbox URL in queued outbox message: {inbox}", logData);
+					return;
+				}
+			})();
+			span.addEvent("activitypub.delivery.failed", {
+				...remoteHost == null ? {} : { "activitypub.remote.host": remoteHost },
+				"activitypub.delivery.attempt": message.attempt,
+				"activitypub.delivery.permanent_failure": error instanceof SendActivityError && this.permanentFailureStatusCodes.includes(error.statusCode),
+				...error instanceof SendActivityError ? { "http.response.status_code": error.statusCode } : {}
+			});
 			const loaderOptions = this.#getLoaderOptions(message.baseUrl);
 			const activity = await _fedify_vocab.Activity.fromJsonLd(message.activity, {
 				contextLoader: this.contextLoaderFactory(loaderOptions),
@@ -3043,6 +3188,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				});
 			}
 			if (error instanceof SendActivityError && this.permanentFailureStatusCodes.includes(error.statusCode)) {
+				getFederationMetrics(this.meterProvider).recordPermanentFailure(error.inbox, error.statusCode);
 				logger.warn("Permanent delivery failure for activity {activityId} to {inbox} ({status}); not retrying.", {
 					...logData,
 					status: error.statusCode
@@ -3151,7 +3297,13 @@ var FederationImpl = class extends FederationBuilderImpl {
 			const { class: cls, listener } = dispatched;
 			span.updateName(`activitypub.dispatch_inbox_listener ${cls.name}`);
 			try {
-				await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, (0, _fedify_vocab.getTypeId)(activity).href), activity);
+				const activityType = (0, _fedify_vocab.getTypeId)(activity).href;
+				const started = performance.now();
+				try {
+					await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, activityType), activity);
+				} finally {
+					getFederationMetrics(this.meterProvider).recordInboxProcessingDuration(activityType, getDurationMs(started));
+				}
 			} catch (error) {
 				try {
 					await this.inboxErrorHandler?.(context, error);
@@ -3334,6 +3486,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				sharedInbox: inboxes[inbox].sharedInbox,
 				headers: collectionSync == null ? void 0 : new Headers({ "Collection-Synchronization": await buildCollectionSynchronizationHeader(collectionSync, inboxes[inbox].actorIds) }),
 				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock),
+				meterProvider: this.meterProvider,
 				tracerProvider: this.tracerProvider
 			}));
 			await Promise.all(promises);
@@ -3603,6 +3756,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					signatureTimeWindow: this.signatureTimeWindow,
 					skipSignatureVerification: this.skipSignatureVerification,
 					inboxChallengePolicy: this.inboxChallengePolicy,
+					meterProvider: this.meterProvider,
 					tracerProvider: this.tracerProvider,
 					idempotencyStrategy: this.idempotencyStrategy
 				});
@@ -3764,6 +3918,9 @@ var ContextImpl = class ContextImpl {
 	get tracerProvider() {
 		return this.federation.tracerProvider;
 	}
+	get meterProvider() {
+		return this.federation.meterProvider;
+	}
 	getNodeInfoUri() {
 		const path = this.federation.router.build("nodeInfo", {});
 		if (path == null) throw new RouterError("No NodeInfo dispatcher registered.");
@@ -4513,6 +4670,7 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 			activityType: ctx.activityType,
 			inbox: new URL(inbox),
 			sharedInbox: inboxes[inbox].sharedInbox,
+			meterProvider: ctx.meterProvider,
 			tracerProvider: ctx.tracerProvider,
 			specDeterminer: new KvSpecDeterminer(ctx.federation.kv, ctx.federation.kvPrefixes.httpMessageSignaturesSpec, ctx.federation.firstKnock)
 		}));

package/dist/{middleware-ASvK22Do.cjs → middleware-DTxZNOqy.cjs}

@@ -1,4 +1,4 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
-const require_middleware = require("./middleware-I5XEZ_pZ.cjs");
+const require_middleware = require("./middleware-Ccpokmfe.cjs");
 exports.FederationImpl = require_middleware.FederationImpl;

package/dist/{middleware-BPZEcrMG.mjs → middleware-THfK90u_.mjs}

@@ -2,27 +2,27 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as RouterError } from "./router-CrMLXoOr.mjs";
-import { n as version, t as name } from "./deno-BnQyJ03o.mjs";
-import { t as formatAcceptSignature } from "./accept-CPkZzmGN.mjs";
-import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-CeANlo1H.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-CfToB_iu.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-mEJ3hsMB.mjs";
-import { n as kvCache } from "./kv-cache-U__xU4qR.mjs";
-import { a as signJsonLd, i as hasSignatureLike, o as verifyJsonLd, r as detachSignature } from "./ld-CUlVC-TS.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CuW0S2XY.mjs";
-import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-CNmZLixq.mjs";
-import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-CFPGr1xC.mjs";
-import { t as getNodeInfo } from "./client-D_1QpnWt.mjs";
-import { t as nodeInfoToJson } from "./types-J53Kw7so.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-Nn2r1dKd.mjs";
-import { t as buildCollectionSynchronizationHeader } from "./collection-D-HqUuA2.mjs";
-import { t as KvKeyCache } from "./keycache-EGATflN-.mjs";
-import { t as acceptsJsonLd } from "./negotiation-SQvQgUqe.mjs";
-import { t as createExponentialBackoffPolicy } from "./retry-bMXBL97A.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-dhl-s8G0.mjs";
+import { n as version, t as name } from "./deno-D9LpbVQR.mjs";
+import { t as formatAcceptSignature } from "./accept-CceiKpCy.mjs";
+import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-BPjHWwyv.mjs";
+import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-D6yvDhyL.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-y2viZ2Tx.mjs";
+import { n as kvCache } from "./kv-cache-Bmv7tUzz.mjs";
+import { a as signJsonLd, i as hasSignatureLike, o as verifyJsonLd, r as detachSignature } from "./ld-D9yQwfkO.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CebIXUof.mjs";
+import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-Bi7n-dEy.mjs";
+import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-UXZOysVc.mjs";
+import { t as getNodeInfo } from "./client-CIiz1WX7.mjs";
+import { t as nodeInfoToJson } from "./types-BFowWFTT.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-BhiIuyGK.mjs";
+import { t as buildCollectionSynchronizationHeader } from "./collection-CA3V5zyK.mjs";
+import { a as getFederationMetrics, i as getDurationMs, n as extractInboxes, o as getRemoteHost, r as sendActivity, t as SendActivityError } from "./send-_8qtDYZA.mjs";
+import { t as KvKeyCache } from "./keycache-BeU0LCII.mjs";
+import { t as acceptsJsonLd } from "./negotiation-VnHNB0Q5.mjs";
+import { t as createExponentialBackoffPolicy } from "./retry-_VvV0h9f.mjs";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { lookupWebFinger } from "@fedify/webfinger";
-import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
+import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 import { uniq } from "es-toolkit";
 import { FetchError, getDocumentLoader } from "@fedify/vocab-runtime";
 import { getLogger, withContext } from "@logtape/logtape";
@@ -154,7 +154,7 @@ function handleNodeInfoJrd(_request, context) {
 }
 //#endregion
 //#region src/federation/inbox.ts
-async function routeActivity({ context: ctx, json, activity, recipient, inboxListeners, inboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, tracerProvider, idempotencyStrategy }) {
+async function routeActivity({ context: ctx, json, activity, recipient, inboxListeners, inboxContextFactory, inboxErrorHandler, kv, kvPrefixes, queue, span, meterProvider, tracerProvider, idempotencyStrategy }) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
@@ -255,7 +255,13 @@ async function routeActivity({ context: ctx, json, activity, recipient, inboxLis
 		const { class: cls, listener } = dispatched;
 		span.updateName(`activitypub.dispatch_inbox_listener ${cls.name}`);
 		try {
-			await listener(inboxContextFactory(recipient, json, activity?.id?.href, getTypeId(activity).href), activity);
+			const activityType = getTypeId(activity).href;
+			const started = performance.now();
+			try {
+				await listener(inboxContextFactory(recipient, json, activity?.id?.href, activityType), activity);
+			} finally {
+				getFederationMetrics(meterProvider).recordInboxProcessingDuration(activityType, getDurationMs(started));
+			}
 		} catch (error) {
 			try {
 				await inboxErrorHandler?.(ctx, error);
@@ -910,6 +916,8 @@ async function handleInboxInternal(request, parameters, span) {
 			});
 			if (verification.verified === false) {
 				const reason = verification.reason;
+				const remoteHost = "keyId" in reason && reason.keyId != null ? getRemoteHost(reason.keyId) : void 0;
+				getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure(reason.type, remoteHost);
 				logger.error("Failed to verify the request's HTTP Signatures.", {
 					recipient,
 					reason: reason.type,
@@ -996,6 +1004,7 @@ async function handleInboxInternal(request, parameters, span) {
 		"http_signatures.key_id": httpSigKey?.id?.href ?? ""
 	});
 	if (httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, ctx)) {
+		getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("actorKeyMismatch", httpSigKey.id == null ? void 0 : getRemoteHost(httpSigKey.id));
 		logger.error("The signer ({keyId}) and the actor ({actorId}) do not match.", {
 			activity: json,
 			recipient,
@@ -1013,6 +1022,7 @@ async function handleInboxInternal(request, parameters, span) {
 	}
 	if (pendingNonceLabel != null) {
 		if (!await verifySignatureNonce(request, kv, kvPrefixes.acceptSignatureNonce, pendingNonceLabel)) {
+			getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("invalidNonce", httpSigKey?.id == null ? void 0 : getRemoteHost(httpSigKey.id));
 			logger.error("Signature nonce verification failed (missing, expired, or replayed).", { recipient });
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
@@ -1029,6 +1039,7 @@ async function handleInboxInternal(request, parameters, span) {
 		kvPrefixes,
 		queue,
 		span,
+		meterProvider: parameters.meterProvider,
 		tracerProvider,
 		idempotencyStrategy: parameters.idempotencyStrategy
 	});
@@ -1722,6 +1733,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 	inboxRetryPolicy;
 	activityTransformers;
 	_tracerProvider;
+	_meterProvider;
 	firstKnock;
 	inboxChallengePolicy;
 	constructor(options) {
@@ -1807,11 +1819,15 @@ var FederationImpl = class extends FederationBuilderImpl {
 		this.inboxRetryPolicy = options.inboxRetryPolicy ?? createExponentialBackoffPolicy();
 		this.activityTransformers = options.activityTransformers ?? getDefaultActivityTransformers();
 		this._tracerProvider = options.tracerProvider;
+		this._meterProvider = options.meterProvider;
 		this.firstKnock = options.firstKnock;
 	}
 	get tracerProvider() {
 		return this._tracerProvider ?? trace.getTracerProvider();
 	}
+	get meterProvider() {
+		return this._meterProvider ?? metrics.getMeterProvider();
+	}
 	_initializeRouter() {
 		this.router.add("/.well-known/webfinger", "webfinger");
 		this.router.add("/.well-known/nodeinfo", "nodeInfoJrd");
@@ -1990,6 +2006,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				sharedInbox: message.sharedInbox,
 				headers: new Headers(message.headers),
 				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock),
+				meterProvider: this.meterProvider,
 				tracerProvider: this.tracerProvider
 			});
 		} catch (error) {
@@ -1997,6 +2014,21 @@ var FederationImpl = class extends FederationBuilderImpl {
 				code: SpanStatusCode.ERROR,
 				message: String(error)
 			});
+			const remoteHost = (() => {
+				if (error instanceof SendActivityError) return getRemoteHost(error.inbox);
+				try {
+					return getRemoteHost(new URL(message.inbox));
+				} catch (_) {
+					logger.warn("Invalid inbox URL in queued outbox message: {inbox}", logData);
+					return;
+				}
+			})();
+			span.addEvent("activitypub.delivery.failed", {
+				...remoteHost == null ? {} : { "activitypub.remote.host": remoteHost },
+				"activitypub.delivery.attempt": message.attempt,
+				"activitypub.delivery.permanent_failure": error instanceof SendActivityError && this.permanentFailureStatusCodes.includes(error.statusCode),
+				...error instanceof SendActivityError ? { "http.response.status_code": error.statusCode } : {}
+			});
 			const loaderOptions = this.#getLoaderOptions(message.baseUrl);
 			const activity = await Activity.fromJsonLd(message.activity, {
 				contextLoader: this.contextLoaderFactory(loaderOptions),
@@ -2012,6 +2044,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				});
 			}
 			if (error instanceof SendActivityError && this.permanentFailureStatusCodes.includes(error.statusCode)) {
+				getFederationMetrics(this.meterProvider).recordPermanentFailure(error.inbox, error.statusCode);
 				logger.warn("Permanent delivery failure for activity {activityId} to {inbox} ({status}); not retrying.", {
 					...logData,
 					status: error.statusCode
@@ -2120,7 +2153,13 @@ var FederationImpl = class extends FederationBuilderImpl {
 			const { class: cls, listener } = dispatched;
 			span.updateName(`activitypub.dispatch_inbox_listener ${cls.name}`);
 			try {
-				await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, getTypeId(activity).href), activity);
+				const activityType = getTypeId(activity).href;
+				const started = performance.now();
+				try {
+					await listener(context.toInboxContext(message.identifier, message.activity, activity.id?.href, activityType), activity);
+				} finally {
+					getFederationMetrics(this.meterProvider).recordInboxProcessingDuration(activityType, getDurationMs(started));
+				}
 			} catch (error) {
 				try {
 					await this.inboxErrorHandler?.(context, error);
@@ -2303,6 +2342,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				sharedInbox: inboxes[inbox].sharedInbox,
 				headers: collectionSync == null ? void 0 : new Headers({ "Collection-Synchronization": await buildCollectionSynchronizationHeader(collectionSync, inboxes[inbox].actorIds) }),
 				specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock),
+				meterProvider: this.meterProvider,
 				tracerProvider: this.tracerProvider
 			}));
 			await Promise.all(promises);
@@ -2572,6 +2612,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					signatureTimeWindow: this.signatureTimeWindow,
 					skipSignatureVerification: this.skipSignatureVerification,
 					inboxChallengePolicy: this.inboxChallengePolicy,
+					meterProvider: this.meterProvider,
 					tracerProvider: this.tracerProvider,
 					idempotencyStrategy: this.idempotencyStrategy
 				});
@@ -2733,6 +2774,9 @@ var ContextImpl = class ContextImpl {
 	get tracerProvider() {
 		return this.federation.tracerProvider;
 	}
+	get meterProvider() {
+		return this.federation.meterProvider;
+	}
 	getNodeInfoUri() {
 		const path = this.federation.router.build("nodeInfo", {});
 		if (path == null) throw new RouterError("No NodeInfo dispatcher registered.");
@@ -3482,6 +3526,7 @@ async function forwardActivityInternal(ctx, loggerCategory, forwarder, recipient
 			activityType: ctx.activityType,
 			inbox: new URL(inbox),
 			sharedInbox: inboxes[inbox].sharedInbox,
+			meterProvider: ctx.meterProvider,
 			tracerProvider: ctx.tracerProvider,
 			specDeterminer: new KvSpecDeterminer(ctx.federation.kv, ctx.federation.kvPrefixes.httpMessageSignaturesSpec, ctx.federation.firstKnock)
 		}));

package/dist/{mod-Bc6p4npy.d.ts → mod-B8Z8mBLk.d.ts}

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { Ct as WebFingerLinksDispatcher, et as ActorAliasMapper, l as RequestContext, nt as ActorHandleMapper, tt as ActorDispatcher } from "./context-CVNXcFHR.js";
+import { Ct as WebFingerLinksDispatcher, et as ActorAliasMapper, l as RequestContext, nt as ActorHandleMapper, tt as ActorDispatcher } from "./context-DrNqYkPw.js";
 import { Span, Tracer } from "@opentelemetry/api";
 
 //#region src/federation/webfinger.d.ts

package/dist/{mod-zA6NZHUG.d.cts → mod-DClCOv0M.d.cts}

@@ -1,4 +1,4 @@
-import { Ct as WebFingerLinksDispatcher, et as ActorAliasMapper, l as RequestContext, nt as ActorHandleMapper, tt as ActorDispatcher } from "./context-Bxs4cdIZ.cjs";
+import { Ct as WebFingerLinksDispatcher, et as ActorAliasMapper, l as RequestContext, nt as ActorHandleMapper, tt as ActorDispatcher } from "./context-BKLGj9QO.cjs";
 import { Span, Tracer } from "@opentelemetry/api";
 
 //#region src/federation/webfinger.d.ts

package/dist/mod.cjs

@@ -4,11 +4,11 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-DDcVe30Y.cjs");
 const require_transformers = require("./transformers-NeAONrAq.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-D4xMqSqO.cjs");
-const require_middleware = require("./middleware-I5XEZ_pZ.cjs");
-const require_proof = require("./proof-oGiWJkX0.cjs");
+const require_http = require("./http-Bj0uN6d-.cjs");
+const require_middleware = require("./middleware-Ccpokmfe.cjs");
+const require_proof = require("./proof-C2QsttUL.cjs");
 const require_types = require("./types-KC4QAoxe.cjs");
-const require_kv_cache = require("./kv-cache-DRwOjOkl.cjs");
+const require_kv_cache = require("./kv-cache-BdSTsjLb.cjs");
 const require_federation_mod = require("./federation/mod.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");

package/dist/mod.d.cts

@@ -1,10 +1,10 @@
 import { a as InboundService, c as OutboundService, d as Software, f as Usage, i as parseNodeInfo, l as Protocol, n as ParseNodeInfoOptions, o as JsonValue, p as nodeInfoToJson, r as getNodeInfo, s as NodeInfo, t as GetNodeInfoOptions, u as Services } from "./client-z-8dc-e1.cjs";
 import { C as exportJwk, D as importJwk, E as generateCryptoKeyPair, S as KeyCache, T as fetchKeyDetailed, _ as validateAcceptSignature, a as VerifyRequestDetailedResult, b as FetchKeyOptions, c as signRequest, d as AcceptSignatureMember, f as AcceptSignatureParameters, g as parseAcceptSignature, h as fulfillAcceptSignature, i as SignRequestOptions, l as verifyRequest, m as formatAcceptSignature, n as HttpMessageSignaturesSpecDeterminer, o as VerifyRequestFailureReason, p as FulfillAcceptSignatureResult, r as Rfc9421SignRequestOptions, s as VerifyRequestOptions, t as HttpMessageSignaturesSpec, u as verifyRequestDetailed, v as FetchKeyDetailedResult, w as fetchKey, x as FetchKeyResult, y as FetchKeyErrorResult } from "./http-CrGuipxe.cjs";
 import { i as getKeyOwner, n as GetKeyOwnerOptions, r as doesActorOwnKey, t as DoesActorOwnKeyOptions } from "./owner-CptqhsOy.cjs";
-import { $ as ParallelMessageQueue, A as FederationKvPrefixes, B as Router, C as IdempotencyKeyCallback, Ct as WebFingerLinksDispatcher, D as ObjectCallbackSetters, Dt as buildCollectionSynchronizationHeader, E as InboxListenerSetters, Et as PageItems, F as RetryContext, G as respondWithObject, H as RouterOptions, I as RetryPolicy, J as InProcessMessageQueueOptions, K as respondWithObjectIfAcceptable, L as createExponentialBackoffPolicy, M as FederationQueueOptions, N as createFederation, O as OutboxListenerSetters, Ot as digest, P as CreateExponentialBackoffPolicyOptions, Q as MessageQueueListenOptions, R as Message, S as FederationStartQueueOptions, St as UnverifiedActivityReason, T as InboxChallengePolicy, Tt as SenderKeyPair, U as RouterRouteResult, V as RouterError, W as RespondWithObjectOptions, X as MessageQueueDepth, Y as MessageQueue, Z as MessageQueueEnqueueOptions, _ as Federatable, _t as OutboxListener, a as GetSignedKeyOptions, at as CollectionCounter, b as FederationFetchOptions, bt as SharedInboxKeyDispatcher, c as ParseUriResult, ct as CustomCollectionCounter, d as SendActivityOptions, dt as InboxErrorHandler, et as ActorAliasMapper, f as SendActivityOptionsForCollection, ft as InboxListener, g as CustomCollectionCallbackSetters, gt as OutboxErrorHandler, h as ConstructorWithTypeId, ht as ObjectDispatcher, i as GetActorOptions, it as AuthorizePredicate, j as FederationOrigin, k as Rfc6570Expression, kt as ActivityTransformer, l as RequestContext, lt as CustomCollectionCursor, m as CollectionCallbackSetters, mt as ObjectAuthorizePredicate, n as Context, nt as ActorHandleMapper, o as InboxContext, ot as CollectionCursor, p as ActorCallbackSetters, pt as NodeInfoDispatcher, q as InProcessMessageQueue, r as ForwardActivityOptions, rt as ActorKeyPairsDispatcher, s as OutboxContext, st as CollectionDispatcher, t as ActorKeyPair, tt as ActorDispatcher, u as RouteActivityOptions, ut as CustomCollectionDispatcher, v as Federation, vt as OutboxListenerErrorHandler, w as IdempotencyStrategy, wt as SendActivityError, x as FederationOptions, xt as UnverifiedActivityHandler, y as FederationBuilder, yt as OutboxPermanentFailureHandler, z as createFederationBuilder } from "./context-Bxs4cdIZ.cjs";
+import { $ as ParallelMessageQueue, A as FederationKvPrefixes, B as Router, C as IdempotencyKeyCallback, Ct as WebFingerLinksDispatcher, D as ObjectCallbackSetters, Dt as buildCollectionSynchronizationHeader, E as InboxListenerSetters, Et as PageItems, F as RetryContext, G as respondWithObject, H as RouterOptions, I as RetryPolicy, J as InProcessMessageQueueOptions, K as respondWithObjectIfAcceptable, L as createExponentialBackoffPolicy, M as FederationQueueOptions, N as createFederation, O as OutboxListenerSetters, Ot as digest, P as CreateExponentialBackoffPolicyOptions, Q as MessageQueueListenOptions, R as Message, S as FederationStartQueueOptions, St as UnverifiedActivityReason, T as InboxChallengePolicy, Tt as SenderKeyPair, U as RouterRouteResult, V as RouterError, W as RespondWithObjectOptions, X as MessageQueueDepth, Y as MessageQueue, Z as MessageQueueEnqueueOptions, _ as Federatable, _t as OutboxListener, a as GetSignedKeyOptions, at as CollectionCounter, b as FederationFetchOptions, bt as SharedInboxKeyDispatcher, c as ParseUriResult, ct as CustomCollectionCounter, d as SendActivityOptions, dt as InboxErrorHandler, et as ActorAliasMapper, f as SendActivityOptionsForCollection, ft as InboxListener, g as CustomCollectionCallbackSetters, gt as OutboxErrorHandler, h as ConstructorWithTypeId, ht as ObjectDispatcher, i as GetActorOptions, it as AuthorizePredicate, j as FederationOrigin, k as Rfc6570Expression, kt as ActivityTransformer, l as RequestContext, lt as CustomCollectionCursor, m as CollectionCallbackSetters, mt as ObjectAuthorizePredicate, n as Context, nt as ActorHandleMapper, o as InboxContext, ot as CollectionCursor, p as ActorCallbackSetters, pt as NodeInfoDispatcher, q as InProcessMessageQueue, r as ForwardActivityOptions, rt as ActorKeyPairsDispatcher, s as OutboxContext, st as CollectionDispatcher, t as ActorKeyPair, tt as ActorDispatcher, u as RouteActivityOptions, ut as CustomCollectionDispatcher, v as Federation, vt as OutboxListenerErrorHandler, w as IdempotencyStrategy, wt as SendActivityError, x as FederationOptions, xt as UnverifiedActivityHandler, y as FederationBuilder, yt as OutboxPermanentFailureHandler, z as createFederationBuilder } from "./context-BKLGj9QO.cjs";
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-CbLNp3zQ.cjs";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.cjs";
-import { n as handleWebFinger, t as WebFingerHandlerParameters } from "./mod-zA6NZHUG.cjs";
+import { n as handleWebFinger, t as WebFingerHandlerParameters } from "./mod-DClCOv0M.cjs";
 import { _ as hasSignatureLike, a as createProof, b as verifySignature, c as verifyObject, d as SignJsonLdOptions, f as VerifyJsonLdOptions, g as detachSignature, h as createSignature, i as VerifyProofOptions, l as verifyProof, m as attachSignature, n as SignObjectOptions, o as hasProofLike, p as VerifySignatureOptions, r as VerifyObjectOptions, s as signObject, t as CreateProofOptions, u as CreateSignatureOptions, v as signJsonLd, y as verifyJsonLd } from "./mod-Cr3f-ACa.cjs";
 import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-CMEbIaNh.cjs";
 export * from "@fedify/vocab-runtime";