@fedify/fedify 2.3.0-dev.1119 → 2.3.0-dev.1131

package/dist/{metrics-C4attqv0.mjs → metrics-BTOMkW8C.mjs}

@@ -1,8 +1,9 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-DVsHS7rA.mjs";
+import { n as version, t as name } from "./deno--CS-SBS9.mjs";
 import { metrics } from "@opentelemetry/api";
+import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts
 var FederationMetrics = class {
 	deliverySent;
@@ -23,6 +24,11 @@ var FederationMetrics = class {
 	fanoutRecipients;
 	inboxActivity;
 	outboxActivity;
+	keyLookup;
+	keyLookupDuration;
+	documentFetch;
+	documentFetchDuration;
+	documentCache;
 	constructor(meterProvider) {
 		const meter = meterProvider.getMeter(name, version);
 		this.deliverySent = meter.createCounter("activitypub.delivery.sent", {
@@ -129,6 +135,58 @@ var FederationMetrics = class {
 			description: "ActivityPub activities observed at the outbox lifecycle level: queued, retried, or abandoned.  Per-recipient delivery counters live on `activitypub.delivery.*`.",
 			unit: "{activity}"
 		});
+		this.keyLookup = meter.createCounter("activitypub.key.lookup", {
+			description: "Public-key lookup attempts performed by Fedify, including both cache hits and remote fetches.",
+			unit: "{lookup}"
+		});
+		this.keyLookupDuration = meter.createHistogram("activitypub.key.lookup.duration", {
+			description: "Duration of public-key lookups performed by Fedify, including any remote fetch.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.documentFetch = meter.createCounter("activitypub.document.fetch", {
+			description: "Remote JSON-LD document loader invocations made by Fedify-wrapped loaders.",
+			unit: "{fetch}"
+		});
+		this.documentFetchDuration = meter.createHistogram("activitypub.document.fetch.duration", {
+			description: "Duration of remote JSON-LD document loader invocations made by Fedify-wrapped loaders.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.documentCache = meter.createCounter("activitypub.document.cache", {
+			description: "KV-backed document loader cache lookups, with `hit` or `miss` classification.",
+			unit: "{lookup}"
+		});
 	}
 	recordDelivery(inbox, durationMs, success, activityType) {
 		const deliveryAttributes = {
@@ -212,6 +270,36 @@ var FederationMetrics = class {
 	recordOutboxActivity(result, activityType) {
 		this.outboxActivity.add(1, buildActivityLifecycleAttributes(result, activityType));
 	}
+	recordKeyLookup(attrs) {
+		const attributes = {
+			"activitypub.lookup.kind": "public_key",
+			"activitypub.lookup.result": attrs.result,
+			"activitypub.cache.enabled": attrs.cacheEnabled
+		};
+		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
+		if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
+		this.keyLookup.add(1, attributes);
+		this.keyLookupDuration.record(attrs.durationMs, attributes);
+	}
+	recordDocumentFetch(attrs) {
+		const attributes = {
+			"activitypub.lookup.kind": attrs.kind,
+			"activitypub.lookup.result": attrs.result
+		};
+		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
+		if (attrs.cacheEnabled != null) attributes["activitypub.cache.enabled"] = attrs.cacheEnabled;
+		if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
+		this.documentFetch.add(1, attributes);
+		this.documentFetchDuration.record(attrs.durationMs, attributes);
+	}
+	recordDocumentCache(attrs) {
+		const attributes = {
+			"activitypub.lookup.kind": attrs.kind,
+			"activitypub.lookup.result": attrs.result
+		};
+		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
+		this.documentCache.add(1, attributes);
+	}
 };
 function buildActivityLifecycleAttributes(result, activityType) {
 	const attributes = { "activitypub.processing.result": result };
@@ -300,6 +388,125 @@ function recordOutboxActivity(meterProvider, result, activityType) {
 	getFederationMetrics(meterProvider).recordOutboxActivity(result, activityType);
 }
 /**
+* Records one measurement on `activitypub.key.lookup` (counter) and
+* `activitypub.key.lookup.duration` (histogram) for a public-key lookup.
+*
+* `activitypub.lookup.kind` is always recorded as `public_key`; the result
+* classification, remote host, HTTP status code (when an HTTP response was
+* received), and `activitypub.cache.enabled` are recorded as attributes on
+* both measurements.  Full key URLs and key IDs are deliberately omitted to
+* keep cardinality bounded.
+* @since 2.3.0
+*/
+function recordKeyLookup(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordKeyLookup(attrs);
+}
+/**
+* Records one measurement each on `activitypub.document.fetch` (counter)
+* and `activitypub.document.fetch.duration` (histogram) for one remote
+* JSON-LD document loader invocation, with bounded
+* `activitypub.lookup.kind` and `activitypub.lookup.result` attributes
+* plus the optional remote-host, cache-enabled, and HTTP status-code
+* attributes.  Counter and histogram are always recorded together so
+* aggregate rate and latency views stay in sync.
+* @since 2.3.0
+*/
+function recordDocumentFetch(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordDocumentFetch(attrs);
+}
+/**
+* Records one `activitypub.document.cache` measurement, classifying the
+* lookup as `hit` (the cache returned an entry) or `miss` (the cache was
+* consulted and returned nothing, prompting a delegate fetch).
+* @since 2.3.0
+*/
+function recordDocumentCache(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordDocumentCache(attrs);
+}
+/**
+* Classifies a thrown value from a key or document fetch into the bounded
+* {@link LookupResult} taxonomy and, when an HTTP response was received,
+* surfaces its status code.
+*
+*  -  `FetchError` with a `Response` whose status is `404` or `410`:
+*     `result=not_found` and the response status code.
+*  -  `FetchError` with any other `Response`: `result=error` and the
+*     response status code.
+*  -  `FetchError` without a `Response`: `result=network_error`.
+*  -  An `AbortError` (typically from a cancelled fetch): `result=network_error`.
+*  -  A bare `TypeError` (the shape native `fetch()` raises on DNS, connect,
+*     and TLS failures before any response is observed):
+*     `result=network_error`.
+*  -  Any other value: `result=error`.
+* @since 2.3.0
+*/
+function classifyFetchError(error) {
+	if (error instanceof FetchError) {
+		if (error.response != null) {
+			const status = error.response.status;
+			return {
+				result: status === 404 || status === 410 ? "not_found" : "error",
+				statusCode: status
+			};
+		}
+		return { result: "network_error" };
+	}
+	if (isAbortError(error)) return { result: "network_error" };
+	if (error instanceof TypeError) return { result: "network_error" };
+	return { result: "error" };
+}
+/**
+* Wraps a {@link DocumentLoader} so each invocation records one
+* measurement on `activitypub.document.fetch` (counter) and one on
+* `activitypub.document.fetch.duration` (histogram), classifying the
+* outcome via {@link classifyFetchError} when the wrapped loader throws
+* and as `fetched` on success.  The wrapper rethrows whatever the
+* wrapped loader throws so caller behavior is unchanged.
+*
+* The wrapper records the hostname of the requested URL on
+* `activitypub.remote.host` when the URL parses; full URLs, paths, and
+* query strings are deliberately excluded to keep cardinality bounded.
+* HTTP status codes are recorded only when the failure carries a
+* `Response` (currently, when the wrapped loader throws a
+* {@link FetchError} with a non-`null` `response`).
+* @since 2.3.0
+*/
+function instrumentDocumentLoader(loader, options) {
+	const meterProvider = options.meterProvider;
+	if (meterProvider == null) return loader;
+	return async (url, opts) => {
+		const start = performance.now();
+		let remoteUrl;
+		try {
+			remoteUrl = new URL(url);
+		} catch {
+			remoteUrl = void 0;
+		}
+		try {
+			const result = await loader(url, opts);
+			recordDocumentFetch(meterProvider, {
+				durationMs: getDurationMs(start),
+				kind: options.kind,
+				result: "fetched",
+				remoteUrl,
+				cacheEnabled: options.cacheEnabled
+			});
+			return result;
+		} catch (error) {
+			const classified = classifyFetchError(error);
+			recordDocumentFetch(meterProvider, {
+				durationMs: getDurationMs(start),
+				kind: options.kind,
+				result: classified.result,
+				remoteUrl,
+				cacheEnabled: options.cacheEnabled,
+				statusCode: classified.statusCode
+			});
+			throw error;
+		}
+	};
+}
+/**
 * Times an awaited public key fetch and records exactly one
 * `activitypub.signature.key_fetch.duration` measurement, classifying the
 * outcome as `hit`, `fetched`, or `error` based on the `cached` flag and
@@ -379,4 +586,4 @@ function getDurationMs(start) {
 	return Math.max(0, performance.now() - start);
 }
 //#endregion
-export { measureSignatureKeyFetch as a, recordOutboxActivity as c, isAbortError as i, recordOutboxEnqueue as l, getFederationMetrics as n, recordFanoutRecipients as o, getRemoteHost as r, recordInboxActivity as s, getDurationMs as t };
+export { instrumentDocumentLoader as a, recordDocumentCache as c, recordInboxActivity as d, recordKeyLookup as f, getRemoteHost as i, recordDocumentFetch as l, recordOutboxEnqueue as m, getDurationMs as n, isAbortError as o, recordOutboxActivity as p, getFederationMetrics as r, measureSignatureKeyFetch as s, classifyFetchError as t, recordFanoutRecipients as u };

package/dist/{middleware-CmsDtIHI.cjs → middleware-B2rtdpFV.cjs}

@@ -2,10 +2,10 @@ const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 const require_chunk = require("./chunk-DDcVe30Y.cjs");
 const require_transformers = require("./transformers-NeAONrAq.cjs");
-const require_http = require("./http-CubOB9wq.cjs");
-const require_proof = require("./proof-BUWfVr6Q.cjs");
+const require_http = require("./http-CJfvRL7D.cjs");
+const require_proof = require("./proof-B1_u25UV.cjs");
 const require_types = require("./types-KC4QAoxe.cjs");
-const require_kv_cache = require("./kv-cache-Dz31ATUT.cjs");
+const require_kv_cache = require("./kv-cache-L0SMQkcd.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
@@ -2913,23 +2913,50 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		const { allowPrivateAddress, userAgent } = options;
 		this.allowPrivateAddress = allowPrivateAddress ?? false;
-		this.documentLoaderFactory = options.documentLoaderFactory ?? ((opts) => {
-			return require_kv_cache.kvCache({
-				loader: (0, _fedify_vocab_runtime.getDocumentLoader)({
-					allowPrivateAddress: opts?.allowPrivateAddress ?? allowPrivateAddress,
-					userAgent: opts?.userAgent ?? userAgent
-				}),
-				kv: options.kv,
-				prefix: this.kvPrefixes.remoteDocument
-			});
+		const userDocumentLoaderFactory = options.documentLoaderFactory;
+		const userContextLoaderFactory = options.contextLoaderFactory;
+		const userAuthFactory = options.authenticatedDocumentLoaderFactory;
+		const builtinDocumentLoaderFactory = (opts) => require_kv_cache.kvCache({
+			loader: (0, _fedify_vocab_runtime.getDocumentLoader)({
+				allowPrivateAddress: opts?.allowPrivateAddress ?? allowPrivateAddress,
+				userAgent: opts?.userAgent ?? userAgent
+			}),
+			kv: options.kv,
+			prefix: this.kvPrefixes.remoteDocument,
+			meterProvider: this._meterProvider,
+			kind: "object"
+		});
+		const builtinContextLoaderFactory = (opts) => require_kv_cache.kvCache({
+			loader: (0, _fedify_vocab_runtime.getDocumentLoader)({
+				allowPrivateAddress: opts?.allowPrivateAddress ?? allowPrivateAddress,
+				userAgent: opts?.userAgent ?? userAgent
+			}),
+			kv: options.kv,
+			prefix: this.kvPrefixes.remoteDocument,
+			meterProvider: this._meterProvider,
+			kind: "context"
 		});
-		this.contextLoaderFactory = options.contextLoaderFactory ?? this.documentLoaderFactory;
-		this.authenticatedDocumentLoaderFactory = options.authenticatedDocumentLoaderFactory ?? ((identity) => require_kv_cache.getAuthenticatedDocumentLoader(identity, {
-			allowPrivateAddress,
-			userAgent,
+		this.documentLoaderFactory = (opts) => require_http.instrumentDocumentLoader((userDocumentLoaderFactory ?? builtinDocumentLoaderFactory)(opts), {
+			meterProvider: this._meterProvider,
+			kind: "object",
+			cacheEnabled: userDocumentLoaderFactory == null ? true : void 0
+		});
+		const resolvedContextLoaderFactory = userContextLoaderFactory ?? userDocumentLoaderFactory ?? builtinContextLoaderFactory;
+		this.contextLoaderFactory = (opts) => require_http.instrumentDocumentLoader(resolvedContextLoaderFactory(opts), {
+			meterProvider: this._meterProvider,
+			kind: "context",
+			cacheEnabled: userContextLoaderFactory == null && userDocumentLoaderFactory == null ? true : void 0
+		});
+		this.authenticatedDocumentLoaderFactory = (identity, factoryOpts) => require_http.instrumentDocumentLoader(userAuthFactory != null ? userAuthFactory(identity, factoryOpts) : require_kv_cache.getAuthenticatedDocumentLoader(identity, {
+			allowPrivateAddress: factoryOpts?.allowPrivateAddress ?? allowPrivateAddress,
+			userAgent: factoryOpts?.userAgent ?? userAgent,
 			specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, options.firstKnock),
 			tracerProvider: this.tracerProvider
-		}));
+		}), {
+			meterProvider: this._meterProvider,
+			kind: "object",
+			cacheEnabled: userAuthFactory == null ? false : void 0
+		});
 		this.userAgent = userAgent;
 		this.onOutboxError = options.onOutboxError;
 		this.permanentFailureStatusCodes = options.permanentFailureStatusCodes ?? [404, 410];
@@ -4244,6 +4271,7 @@ var ContextImpl = class ContextImpl {
 			contextLoader: options.contextLoader ?? this.contextLoader,
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
+			meterProvider: options.meterProvider ?? this.meterProvider,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}

package/dist/{middleware-t0jC8I99.mjs → middleware-BB0IbDow.mjs}

@@ -2,25 +2,25 @@ import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as RouterError } from "./router-BT_F5748.mjs";
-import { n as version, t as name } from "./deno-DVsHS7rA.mjs";
-import { c as recordOutboxActivity, i as isAbortError, l as recordOutboxEnqueue, n as getFederationMetrics, o as recordFanoutRecipients, r as getRemoteHost, s as recordInboxActivity, t as getDurationMs } from "./metrics-C4attqv0.mjs";
+import { n as version, t as name } from "./deno--CS-SBS9.mjs";
+import { a as instrumentDocumentLoader, d as recordInboxActivity, i as getRemoteHost, m as recordOutboxEnqueue, n as getDurationMs, o as isAbortError, p as recordOutboxActivity, r as getFederationMetrics, u as recordFanoutRecipients } from "./metrics-BTOMkW8C.mjs";
 import { t as formatAcceptSignature } from "./accept-CgDcxvjV.mjs";
-import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-BoWaYRHm.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-DUV8ysti.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-WsWfKaE5.mjs";
-import { n as kvCache } from "./kv-cache-DihufyAQ.mjs";
-import { a as signJsonLd, i as hasSignatureLike, o as verifyJsonLd, r as detachSignature } from "./ld-B5K1mSuG.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-hDxI0ufu.mjs";
+import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-Df3tMleh.mjs";
+import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-IywnQdiX.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-k6huZLQL.mjs";
+import { n as kvCache } from "./kv-cache-q9Ec2ryS.mjs";
+import { a as signJsonLd, i as hasSignatureLike, o as verifyJsonLd, r as detachSignature } from "./ld-BGwiJpl3.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-CIt4hvmM.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-BNL8AC14.mjs";
-import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-DhVuz4bc.mjs";
+import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-BYlrRSmZ.mjs";
 import { t as getNodeInfo } from "./client-Bneh_DYR.mjs";
 import { t as nodeInfoToJson } from "./types-D09GN0uZ.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-Ond_h57y.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-DckAhD27.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-Cc3DVAhE.mjs";
 import { t as KvKeyCache } from "./keycache-BeU0LCII.mjs";
 import { t as acceptsJsonLd } from "./negotiation-DDstyBvc.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-_VvV0h9f.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-BPhyR5Oo.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-DJFpze7B.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { lookupWebFinger } from "@fedify/webfinger";
@@ -1815,23 +1815,50 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		const { allowPrivateAddress, userAgent } = options;
 		this.allowPrivateAddress = allowPrivateAddress ?? false;
-		this.documentLoaderFactory = options.documentLoaderFactory ?? ((opts) => {
-			return kvCache({
-				loader: getDocumentLoader({
-					allowPrivateAddress: opts?.allowPrivateAddress ?? allowPrivateAddress,
-					userAgent: opts?.userAgent ?? userAgent
-				}),
-				kv: options.kv,
-				prefix: this.kvPrefixes.remoteDocument
-			});
-		});
-		this.contextLoaderFactory = options.contextLoaderFactory ?? this.documentLoaderFactory;
-		this.authenticatedDocumentLoaderFactory = options.authenticatedDocumentLoaderFactory ?? ((identity) => getAuthenticatedDocumentLoader(identity, {
-			allowPrivateAddress,
-			userAgent,
+		const userDocumentLoaderFactory = options.documentLoaderFactory;
+		const userContextLoaderFactory = options.contextLoaderFactory;
+		const userAuthFactory = options.authenticatedDocumentLoaderFactory;
+		const builtinDocumentLoaderFactory = (opts) => kvCache({
+			loader: getDocumentLoader({
+				allowPrivateAddress: opts?.allowPrivateAddress ?? allowPrivateAddress,
+				userAgent: opts?.userAgent ?? userAgent
+			}),
+			kv: options.kv,
+			prefix: this.kvPrefixes.remoteDocument,
+			meterProvider: this._meterProvider,
+			kind: "object"
+		});
+		const builtinContextLoaderFactory = (opts) => kvCache({
+			loader: getDocumentLoader({
+				allowPrivateAddress: opts?.allowPrivateAddress ?? allowPrivateAddress,
+				userAgent: opts?.userAgent ?? userAgent
+			}),
+			kv: options.kv,
+			prefix: this.kvPrefixes.remoteDocument,
+			meterProvider: this._meterProvider,
+			kind: "context"
+		});
+		this.documentLoaderFactory = (opts) => instrumentDocumentLoader((userDocumentLoaderFactory ?? builtinDocumentLoaderFactory)(opts), {
+			meterProvider: this._meterProvider,
+			kind: "object",
+			cacheEnabled: userDocumentLoaderFactory == null ? true : void 0
+		});
+		const resolvedContextLoaderFactory = userContextLoaderFactory ?? userDocumentLoaderFactory ?? builtinContextLoaderFactory;
+		this.contextLoaderFactory = (opts) => instrumentDocumentLoader(resolvedContextLoaderFactory(opts), {
+			meterProvider: this._meterProvider,
+			kind: "context",
+			cacheEnabled: userContextLoaderFactory == null && userDocumentLoaderFactory == null ? true : void 0
+		});
+		this.authenticatedDocumentLoaderFactory = (identity, factoryOpts) => instrumentDocumentLoader(userAuthFactory != null ? userAuthFactory(identity, factoryOpts) : getAuthenticatedDocumentLoader(identity, {
+			allowPrivateAddress: factoryOpts?.allowPrivateAddress ?? allowPrivateAddress,
+			userAgent: factoryOpts?.userAgent ?? userAgent,
 			specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, options.firstKnock),
 			tracerProvider: this.tracerProvider
-		}));
+		}), {
+			meterProvider: this._meterProvider,
+			kind: "object",
+			cacheEnabled: userAuthFactory == null ? false : void 0
+		});
 		this.userAgent = userAgent;
 		this.onOutboxError = options.onOutboxError;
 		this.permanentFailureStatusCodes = options.permanentFailureStatusCodes ?? [404, 410];
@@ -3146,6 +3173,7 @@ var ContextImpl = class ContextImpl {
 			contextLoader: options.contextLoader ?? this.contextLoader,
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
+			meterProvider: options.meterProvider ?? this.meterProvider,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}

package/dist/{middleware-BDKFRjue.mjs → middleware-Dnql59Y8.mjs}

@@ -1,5 +1,5 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-t0jC8I99.mjs";
+import { n as FederationImpl } from "./middleware-BB0IbDow.mjs";
 export { FederationImpl };

package/dist/{middleware-Dtjz-hSk.js → middleware-DtOddSVg.js}

@@ -2,10 +2,10 @@ import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./chunk-CRNNMoPX.js";
 import { r as getDefaultActivityTransformers } from "./transformers-BGMIq1cs.js";
-import { E as version, T as name, _ as recordFanoutRecipients, a as verifyRequestDetailed, b as recordOutboxEnqueue, d as validateCryptoKey, f as getDurationMs, h as isAbortError, i as verifyRequest, m as getRemoteHost, n as parseRfc9421SignatureInput, o as exportJwk, p as getFederationMetrics, t as doubleKnock, u as importJwk, v as recordInboxActivity, x as formatAcceptSignature, y as recordOutboxActivity } from "./http-CouJSFVK.js";
-import { c as getKeyOwner, d as detachSignature, f as hasSignatureLike, i as verifyObject, m as verifyJsonLd, n as hasProofLike, o as normalizeOutgoingActivityJsonLd, p as signJsonLd, r as signObject, s as doesActorOwnKey } from "./proof-n60t8o9P.js";
+import { C as formatAcceptSignature, D as name, O as version, S as recordOutboxEnqueue, a as verifyRequestDetailed, b as recordInboxActivity, d as validateCryptoKey, f as getDurationMs, g as isAbortError, h as instrumentDocumentLoader, i as verifyRequest, m as getRemoteHost, n as parseRfc9421SignatureInput, o as exportJwk, p as getFederationMetrics, t as doubleKnock, u as importJwk, x as recordOutboxActivity, y as recordFanoutRecipients } from "./http-cqujdCRz.js";
+import { c as getKeyOwner, d as detachSignature, f as hasSignatureLike, i as verifyObject, m as verifyJsonLd, n as hasProofLike, o as normalizeOutgoingActivityJsonLd, p as signJsonLd, r as signObject, s as doesActorOwnKey } from "./proof-DMGIjHYH.js";
 import { n as getNodeInfo, t as nodeInfoToJson } from "./types-CAY3OdLq.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DBNpsneh.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-pEejzYq4.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
@@ -2913,23 +2913,50 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		const { allowPrivateAddress, userAgent } = options;
 		this.allowPrivateAddress = allowPrivateAddress ?? false;
-		this.documentLoaderFactory = options.documentLoaderFactory ?? ((opts) => {
-			return kvCache({
-				loader: getDocumentLoader({
-					allowPrivateAddress: opts?.allowPrivateAddress ?? allowPrivateAddress,
-					userAgent: opts?.userAgent ?? userAgent
-				}),
-				kv: options.kv,
-				prefix: this.kvPrefixes.remoteDocument
-			});
+		const userDocumentLoaderFactory = options.documentLoaderFactory;
+		const userContextLoaderFactory = options.contextLoaderFactory;
+		const userAuthFactory = options.authenticatedDocumentLoaderFactory;
+		const builtinDocumentLoaderFactory = (opts) => kvCache({
+			loader: getDocumentLoader({
+				allowPrivateAddress: opts?.allowPrivateAddress ?? allowPrivateAddress,
+				userAgent: opts?.userAgent ?? userAgent
+			}),
+			kv: options.kv,
+			prefix: this.kvPrefixes.remoteDocument,
+			meterProvider: this._meterProvider,
+			kind: "object"
+		});
+		const builtinContextLoaderFactory = (opts) => kvCache({
+			loader: getDocumentLoader({
+				allowPrivateAddress: opts?.allowPrivateAddress ?? allowPrivateAddress,
+				userAgent: opts?.userAgent ?? userAgent
+			}),
+			kv: options.kv,
+			prefix: this.kvPrefixes.remoteDocument,
+			meterProvider: this._meterProvider,
+			kind: "context"
 		});
-		this.contextLoaderFactory = options.contextLoaderFactory ?? this.documentLoaderFactory;
-		this.authenticatedDocumentLoaderFactory = options.authenticatedDocumentLoaderFactory ?? ((identity) => getAuthenticatedDocumentLoader(identity, {
-			allowPrivateAddress,
-			userAgent,
+		this.documentLoaderFactory = (opts) => instrumentDocumentLoader((userDocumentLoaderFactory ?? builtinDocumentLoaderFactory)(opts), {
+			meterProvider: this._meterProvider,
+			kind: "object",
+			cacheEnabled: userDocumentLoaderFactory == null ? true : void 0
+		});
+		const resolvedContextLoaderFactory = userContextLoaderFactory ?? userDocumentLoaderFactory ?? builtinContextLoaderFactory;
+		this.contextLoaderFactory = (opts) => instrumentDocumentLoader(resolvedContextLoaderFactory(opts), {
+			meterProvider: this._meterProvider,
+			kind: "context",
+			cacheEnabled: userContextLoaderFactory == null && userDocumentLoaderFactory == null ? true : void 0
+		});
+		this.authenticatedDocumentLoaderFactory = (identity, factoryOpts) => instrumentDocumentLoader(userAuthFactory != null ? userAuthFactory(identity, factoryOpts) : getAuthenticatedDocumentLoader(identity, {
+			allowPrivateAddress: factoryOpts?.allowPrivateAddress ?? allowPrivateAddress,
+			userAgent: factoryOpts?.userAgent ?? userAgent,
 			specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, options.firstKnock),
 			tracerProvider: this.tracerProvider
-		}));
+		}), {
+			meterProvider: this._meterProvider,
+			kind: "object",
+			cacheEnabled: userAuthFactory == null ? false : void 0
+		});
 		this.userAgent = userAgent;
 		this.onOutboxError = options.onOutboxError;
 		this.permanentFailureStatusCodes = options.permanentFailureStatusCodes ?? [404, 410];
@@ -4244,6 +4271,7 @@ var ContextImpl = class ContextImpl {
 			contextLoader: options.contextLoader ?? this.contextLoader,
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
+			meterProvider: options.meterProvider ?? this.meterProvider,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}

package/dist/{mod-BDhgfjP7.d.cts → mod-B0hW12_O.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { S as KeyCache } from "./http-D6aw3j2U.cjs";
+import { S as KeyCache } from "./http-VyDTd4G3.cjs";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { DocumentLoader } from "@fedify/vocab-runtime";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";

package/dist/{mod-B-Lin9Sy.d.ts → mod-COIAjwRS.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { S as KeyCache } from "./http-D6LP89UO.js";
+import { S as KeyCache } from "./http-lf8Hsd91.js";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader } from "@fedify/vocab-runtime";

package/dist/{mod-C6E8rkcz.d.ts → mod-CajNYYkt.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Ct as WebFingerLinksDispatcher, et as ActorAliasMapper, l as RequestContext, nt as ActorHandleMapper, tt as ActorDispatcher } from "./context-cSUMk2da.js";
+import { J as ActorDispatcher, Y as ActorHandleMapper, gt as WebFingerLinksDispatcher, l as RequestContext, q as ActorAliasMapper } from "./context-Cq18Gplu.js";
 import { Span, Tracer } from "@opentelemetry/api";
 
 //#region src/federation/webfinger.d.ts

package/dist/{mod-DLrRb0dx.d.ts → mod-DFvNJcNb.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
-import { n as HttpMessageSignaturesSpecDeterminer } from "./http-D6LP89UO.js";
+import { n as HttpMessageSignaturesSpecDeterminer } from "./http-lf8Hsd91.js";
 import { n as KvStore, t as KvKey } from "./kv-D6hNiMTK.js";
-import { TracerProvider } from "@opentelemetry/api";
+import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader, DocumentLoaderFactoryOptions } from "@fedify/vocab-runtime";
 
 //#region src/utils/docloader.d.ts
@@ -48,6 +48,37 @@ declare function getAuthenticatedDocumentLoader(identity: {
   tracerProvider
 }?: GetAuthenticatedDocumentLoaderOptions): DocumentLoader;
 //#endregion
+//#region src/federation/metrics.d.ts
+/**
+* The kind of remote ActivityPub lookup, recorded as
+* `activitypub.lookup.kind` on the public-key lookup and remote document
+* fetch metric families.
+*
+*  -  `public_key`: a public key lookup performed by `fetchKey` /
+*     `fetchKeyDetailed` (always recorded on `activitypub.key.lookup*`).
+*  -  `actor`: a document fetch whose resolved value is an Actor.  The
+*     bucket exists in the taxonomy for future actor-aware call sites;
+*     today, actor documents fetched through Fedify's generic document
+*     loader are still classified as `object` because the kind is decided
+*     at the loader boundary, before the response is parsed.
+*  -  `object`: a generic ActivityPub object fetch through Fedify's
+*     document loader.  This is the default classification for
+*     `documentLoader` invocations that do not match a more specific
+*     bucket.
+*  -  `context`: a JSON-LD `@context` document fetch through Fedify's
+*     context loader.
+*  -  `other`: a fetch that does not fit any of the above classifications.
+* @since 2.3.0
+*/
+type LookupKind = "public_key" | "actor" | "object" | "context" | "other";
+/**
+* The {@link LookupKind} values that can appear on remote document fetch
+* metrics.  `public_key` lookups are reported on the
+* `activitypub.key.lookup` metric family instead, so it is excluded here.
+* @since 2.3.0
+*/
+type DocumentFetchKind = Exclude<LookupKind, "public_key">;
+//#endregion
 //#region src/utils/kv-cache.d.ts
 /**
 * The parameters for {@link kvCache} function.
@@ -75,6 +106,24 @@ interface KvCacheParameters {
   * By default, 5 minutes for all URLs.
   */
   readonly rules?: readonly [string | URL | URLPattern, Temporal.Duration | Temporal.DurationLike][];
+  /**
+  * The OpenTelemetry meter provider used to record
+  * `activitypub.document.cache` measurements.  When omitted, the wrapper
+  * does not emit any metric measurements, preserving the previous
+  * unobserved-cache behavior.
+  * @since 2.3.0
+  */
+  readonly meterProvider?: MeterProvider;
+  /**
+  * The lookup kind to record on the `activitypub.lookup.kind` attribute of
+  * `activitypub.document.cache` measurements.  Defaults to `"object"` so
+  * the generic document loader case does not require an explicit option.
+  * Set to `"context"` for context-loader wrappers; the
+  * authenticated-loader path does not use `kvCache()` and is therefore
+  * out of scope.
+  * @since 2.3.0
+  */
+  readonly kind?: DocumentFetchKind;
 }
 /**
 * Decorates a {@link DocumentLoader} with a cache backed by a {@link KvStore}.
@@ -85,7 +134,9 @@ declare function kvCache({
   loader,
   kv,
   prefix,
-  rules
+  rules,
+  meterProvider,
+  kind
 }: KvCacheParameters): DocumentLoader;
 //#endregion
 export { getAuthenticatedDocumentLoader as n, kvCache as t };