@fedify/fedify 2.3.0-dev.1119 → 2.3.0-dev.1137

package/dist/federation/router.test.mjs

@@ -1,16 +1,167 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as RouterError, t as Router } from "../router-BT_F5748.mjs";
-import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-BTEgfoJo.mjs";
-import { r as assertFalse } from "../assert_rejects-DQP-q39h.mjs";
-import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
-import { t as assert } from "../assert-DikXweDx.mjs";
+import { t as assertEquals } from "../assert_equals-C-ZRDbaf.mjs";
+import "../std__assert-BBjXFNOb.mjs";
+import { r as assertFalse } from "../assert_rejects-DN60FHPX.mjs";
+import { t as assertThrows } from "../assert_throws-BOkhLGYc.mjs";
+import { t as assert } from "../assert-OguE97r2.mjs";
+import { getLogger } from "@logtape/logtape";
+import { Router, RouterError, assertPath, isPath } from "@fedify/uri-template";
 import { test } from "@fedify/fixture";
+//#region src/federation/router.ts
+const logger = getLogger([
+	"fedify",
+	"federation",
+	"router",
+	"deprecated"
+]);
+let deprecationWarned = false;
+function warnDeprecated() {
+	if (deprecationWarned) return;
+	deprecationWarned = true;
+	logger.warn("The `Router` and `RouterError` classes from `@fedify/fedify` are deprecated.  Please use `Router` from `@fedify/uri-template` instead.");
+}
+/**
+* URL router and constructor based on URI Template
+* ([RFC 6570](https://tools.ietf.org/html/rfc6570)).
+*
+* @deprecated Import `Router` from `@fedify/uri-template` instead.  This class
+*             remains only for compatibility with older Fedify code.  The
+*             `@fedify/uri-template` router is the replacement implementation
+*             and should be used directly in new code.
+*/
+var Router$1 = class Router$1 {
+	#router;
+	/**
+	* Create a new {@link Router}.
+	* @param options Options for the router.
+	* @deprecated Use `new Router(options)` from `@fedify/uri-template`
+	*             instead.
+	*/
+	constructor(options) {
+		this.#router = convertRouterError(() => new Router(options));
+	}
+	/**
+	* Whether to ignore trailing slashes when matching paths.
+	* @deprecated Use `Router` from `@fedify/uri-template` instead.  This
+	*             accessor forwards to the underlying `@fedify/uri-template`
+	*             router so that post-construction mutation keeps working as
+	*             in older Fedify code.
+	*/
+	get trailingSlashInsensitive() {
+		return this.#router.trailingSlashInsensitive;
+	}
+	set trailingSlashInsensitive(value) {
+		this.#router.trailingSlashInsensitive = value;
+	}
+	/**
+	* Clones this router.
+	* @deprecated Use `Router` from `@fedify/uri-template` instead.
+	*/
+	clone() {
+		return convertRouterError(() => {
+			const clone = new Router$1();
+			clone.#router = this.#router.clone();
+			return clone;
+		});
+	}
+	/**
+	* Checks if a path name exists in the router.
+	* @param name The name of the path.
+	* @returns `true` if the path name exists, otherwise `false`.
+	* @deprecated Use `Router` from `@fedify/uri-template` instead.
+	*/
+	has(name) {
+		return convertRouterError(() => this.#router.has(name));
+	}
+	/**
+	* Adds a new path rule to the router.
+	* @param template The path pattern.
+	* @param name The name of the path.
+	* @returns The names of the variables in the path pattern.
+	* @deprecated Use `Router` from `@fedify/uri-template` instead.  In this
+	*             compatibility class, `add()` both registers the route and
+	*             returns the variables in the path pattern.  In
+	*             `@fedify/uri-template`, these two responsibilities are split:
+	*             `router.add(template, name)` registers the route and returns
+	*             `void`, while the pure static method
+	*             `Router.variables(template)` returns the variable names.  To
+	*             migrate, call `Router.variables(template)` when variables are
+	*             needed, then call `router.add(template, name)` to register the
+	*             route.
+	*/
+	add(template, name) {
+		return convertRouterError(() => {
+			assertPath(template);
+			this.#router.add(template, name);
+			return Router.variables(template);
+		});
+	}
+	/**
+	* Resolves a path name and values from a URL, if any match.
+	* @param url The URL to resolve.
+	* @returns The name of the path and its values, if any match.  Otherwise,
+	*          `null`.
+	* @deprecated Use `Router` from `@fedify/uri-template` instead.  Unlike the
+	*             stricter `@fedify/uri-template` router, this compatibility
+	*             method keeps the old Fedify 2.x contract of returning `null`
+	*             (rather than throwing) for inputs that are not router paths.
+	*/
+	route(url) {
+		return convertRouterError(() => {
+			if (!isPath(url)) return null;
+			return this.#router.route(url);
+		});
+	}
+	/**
+	* Constructs a URL/path from a path name and values.
+	* @param name The name of the path.
+	* @param values The values to expand the path with.
+	* @returns The URL/path, if the name exists.  Otherwise, `null`.
+	* @deprecated Use `Router` from `@fedify/uri-template` instead.
+	*/
+	build(name, values) {
+		return convertRouterError(() => this.#router.build(name, values));
+	}
+};
+/**
+* An error thrown by the {@link Router}.
+* @deprecated Import `RouterError` from `@fedify/uri-template` instead.
+*/
+var RouterError$1 = class extends RouterError {
+	/**
+	* Treats every `RouterError` from `@fedify/uri-template` as an instance of
+	* this deprecated class.
+	*
+	* @deprecated Import `RouterError` from `@fedify/uri-template` instead.
+	*/
+	static [Symbol.hasInstance](instance) {
+		return instance instanceof RouterError;
+	}
+	/**
+	* Create a new {@link RouterError}.
+	* @param message The error message.
+	* @deprecated Import `RouterError` from `@fedify/uri-template` instead.
+	*/
+	constructor(message) {
+		super(message);
+		warnDeprecated();
+	}
+};
+function convertRouterError(func) {
+	try {
+		warnDeprecated();
+		return func();
+	} catch (error) {
+		if (error instanceof RouterError) throw new RouterError$1(error.message);
+		throw error;
+	}
+}
+//#endregion
 //#region src/federation/router.test.ts
 function setUp(options = {}) {
-	const router = new Router(options);
+	const router = new Router$1(options);
 	router.add("/users/{name}", "user");
 	router.add("/users/{name}/posts/{postId}" + (options.trailingSlashInsensitive ? "/" : ""), "post");
 	return router;
@@ -29,11 +180,11 @@ test("Router.clone()", () => {
 	assertEquals(original.route("/users/alice/friends"), null);
 });
 test("Router.add()", () => {
-	const router = new Router();
+	const router = new Router$1();
 	assertEquals(router.add("/users", "users"), /* @__PURE__ */ new Set());
 	assertEquals(router.add("/users/{name}", "user"), new Set(["name"]));
 	assertEquals(router.add("/users/{name}/posts/{postId}", "post"), new Set(["name", "postId"]));
-	assertThrows(() => router.add("foo", "name"), RouterError);
+	assertThrows(() => router.add("foo", "name"), RouterError$1);
 });
 test("Router.route()", () => {
 	let router = setUp();
@@ -80,6 +231,21 @@ test("Router.route()", () => {
 		}
 	});
 });
+test("Router.trailingSlashInsensitive (post-construction mutation)", () => {
+	const router = setUp();
+	assertFalse(router.trailingSlashInsensitive);
+	assertEquals(router.route("/users/bob/"), null);
+	router.trailingSlashInsensitive = true;
+	assert(router.trailingSlashInsensitive);
+	assertEquals(router.route("/users/bob/"), {
+		name: "user",
+		template: "/users/{name}",
+		values: { name: "bob" }
+	});
+	router.trailingSlashInsensitive = false;
+	assertFalse(router.trailingSlashInsensitive);
+	assertEquals(router.route("/users/bob/"), null);
+});
 test("Router.build()", () => {
 	const router = setUp();
 	assertEquals(router.build("user", { name: "alice" }), "/users/alice");
@@ -88,5 +254,20 @@ test("Router.build()", () => {
 		postId: "123"
 	}), "/users/alice/posts/123");
 });
+test("Router.route() returns null for non-path inputs", () => {
+	const router = setUp();
+	assertEquals(router.route("https://example.com/users/alice"), null);
+	assertEquals(router.route("users/alice"), null);
+	assertEquals(router.route("not a path"), null);
+	assertEquals(router.route("/unknown"), null);
+});
+test("Compatibility between RouterErrors", () => {
+	const newError = new RouterError("boom");
+	assert(newError instanceof RouterError);
+	assert(newError instanceof RouterError$1);
+	const previousError = new RouterError$1("boom");
+	assert(previousError instanceof RouterError$1);
+	assert(previousError instanceof RouterError);
+});
 //#endregion
 export {};

package/dist/federation/send.test.mjs

@@ -2,17 +2,17 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as __require, r as __toESM, t as __commonJSMin } from "../chunk-DNRtMIoB.mjs";
-import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-BTEgfoJo.mjs";
-import { n as assertGreaterOrEqual, r as assertFalse, t as assertRejects } from "../assert_rejects-DQP-q39h.mjs";
-import { t as assertInstanceOf } from "../assert_instance_of-C4Ri6VuN.mjs";
-import { t as assertNotEquals } from "../assert_not_equals--wG9hV7u.mjs";
-import { t as assert } from "../assert-DikXweDx.mjs";
-import { t as esm_default } from "../esm-sdtqOUPu.mjs";
-import { l as verifyRequest } from "../http-DUV8ysti.mjs";
-import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CSYsOMFG.mjs";
-import { t as doesActorOwnKey } from "../owner-hDxI0ufu.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-BPhyR5Oo.mjs";
+import { t as assertEquals } from "../assert_equals-C-ZRDbaf.mjs";
+import "../std__assert-BBjXFNOb.mjs";
+import { n as assertGreaterOrEqual, r as assertFalse, t as assertRejects } from "../assert_rejects-DN60FHPX.mjs";
+import { t as assertInstanceOf } from "../assert_instance_of-DBC5X09g.mjs";
+import { t as assertNotEquals } from "../assert_not_equals-DkVK8oqV.mjs";
+import { t as assert } from "../assert-OguE97r2.mjs";
+import { t as esm_default } from "../esm-BQRw925N.mjs";
+import { l as verifyRequest } from "../http-Cyx5SNuu.mjs";
+import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-C3kae-6B.mjs";
+import { t as doesActorOwnKey } from "../owner-nmXdvXpc.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-DvX2tYyZ.mjs";
 import { Activity, Application, Endpoints, Group, Person, Service } from "@fedify/vocab";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 //#region ../../node_modules/.pnpm/@opentelemetry+sdk-metrics@2.7.1_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/sdk-metrics/build/src/export/AggregationTemporality.js
@@ -2525,19 +2525,19 @@ var require_getMachineId = /* @__PURE__ */ __commonJSMin(((exports) => {
 	async function getMachineId() {
 		if (!getMachineIdImpl) switch (process$1.platform) {
 			case "darwin":
-				getMachineIdImpl = (await import("../getMachineId-darwin-Dr1gkBkp.mjs").then((m) => /* @__PURE__ */ __toESM(m.default))).getMachineId;
+				getMachineIdImpl = (await import("../getMachineId-darwin-D23zTf4g.mjs").then((m) => /* @__PURE__ */ __toESM(m.default))).getMachineId;
 				break;
 			case "linux":
-				getMachineIdImpl = (await import("../getMachineId-linux-Bbhofx-s.mjs").then((m) => /* @__PURE__ */ __toESM(m.default))).getMachineId;
+				getMachineIdImpl = (await import("../getMachineId-linux-ObI47Hql.mjs").then((m) => /* @__PURE__ */ __toESM(m.default))).getMachineId;
 				break;
 			case "freebsd":
-				getMachineIdImpl = (await import("../getMachineId-bsd-BY01PL1n.mjs").then((m) => /* @__PURE__ */ __toESM(m.default))).getMachineId;
+				getMachineIdImpl = (await import("../getMachineId-bsd-etIyxDet.mjs").then((m) => /* @__PURE__ */ __toESM(m.default))).getMachineId;
 				break;
 			case "win32":
-				getMachineIdImpl = (await import("../getMachineId-win-QEYwcJiy.mjs").then((m) => /* @__PURE__ */ __toESM(m.default))).getMachineId;
+				getMachineIdImpl = (await import("../getMachineId-win-Dpap6v5i.mjs").then((m) => /* @__PURE__ */ __toESM(m.default))).getMachineId;
 				break;
 			default:
-				getMachineIdImpl = (await import("../getMachineId-unsupported-dIOte2Ct.mjs").then((m) => /* @__PURE__ */ __toESM(m.default))).getMachineId;
+				getMachineIdImpl = (await import("../getMachineId-unsupported-Ddu-PFeh.mjs").then((m) => /* @__PURE__ */ __toESM(m.default))).getMachineId;
 				break;
 		}
 		return getMachineIdImpl();

package/dist/federation/webfinger.test.mjs

@@ -1,11 +1,11 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { r as createRequestContext } from "../context-BAE7AKLA.mjs";
-import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-BTEgfoJo.mjs";
-import { t as MemoryKvStore } from "../kv-QHE0oeM3.mjs";
-import { o as createFederation, s as handleWebFinger } from "../middleware-t0jC8I99.mjs";
+import { r as createRequestContext } from "../context-DVoTs_wM.mjs";
+import { t as assertEquals } from "../assert_equals-C-ZRDbaf.mjs";
+import "../std__assert-BBjXFNOb.mjs";
+import { t as MemoryKvStore } from "../kv-x2IvBUyq.mjs";
+import { o as createFederation, s as handleWebFinger } from "../middleware-DQEgdr83.mjs";
 import { Image, Link, Person, Tombstone } from "@fedify/vocab";
 import { test } from "@fedify/fixture";
 //#region src/federation/webfinger.test.ts

package/dist/{getMachineId-bsd-BY01PL1n.mjs → getMachineId-bsd-etIyxDet.mjs}

@@ -2,7 +2,7 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as __require, t as __commonJSMin } from "./chunk-DNRtMIoB.mjs";
-import { t as require_execAsync } from "./execAsync-Dxb7rNf3.mjs";
+import { t as require_execAsync } from "./execAsync-DCBrgFiV.mjs";
 //#region ../../node_modules/.pnpm/@opentelemetry+resources@2.7.1_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/getMachineId-bsd.js
 var require_getMachineId_bsd = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });

package/dist/{getMachineId-darwin-Dr1gkBkp.mjs → getMachineId-darwin-D23zTf4g.mjs}

@@ -2,7 +2,7 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as __require, t as __commonJSMin } from "./chunk-DNRtMIoB.mjs";
-import { t as require_execAsync } from "./execAsync-Dxb7rNf3.mjs";
+import { t as require_execAsync } from "./execAsync-DCBrgFiV.mjs";
 //#region ../../node_modules/.pnpm/@opentelemetry+resources@2.7.1_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/getMachineId-darwin.js
 var require_getMachineId_darwin = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });

package/dist/{getMachineId-win-QEYwcJiy.mjs → getMachineId-win-Dpap6v5i.mjs}

@@ -2,7 +2,7 @@ import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { n as __require, t as __commonJSMin } from "./chunk-DNRtMIoB.mjs";
-import { t as require_execAsync } from "./execAsync-Dxb7rNf3.mjs";
+import { t as require_execAsync } from "./execAsync-DCBrgFiV.mjs";
 //#region ../../node_modules/.pnpm/@opentelemetry+resources@2.7.1_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/getMachineId-win.js
 var require_getMachineId_win = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });

package/dist/{http-CouJSFVK.js → http-CToqG5ap.js}

@@ -10,7 +10,7 @@ import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } fro
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.3.0-dev.1119+6cc02662";
+var version = "2.3.0-dev.1137+53a1f26d";
 //#endregion
 //#region src/sig/accept.ts
 /**
@@ -171,6 +171,11 @@ var FederationMetrics = class {
 	fanoutRecipients;
 	inboxActivity;
 	outboxActivity;
+	keyLookup;
+	keyLookupDuration;
+	documentFetch;
+	documentFetchDuration;
+	documentCache;
 	constructor(meterProvider) {
 		const meter = meterProvider.getMeter(name, version);
 		this.deliverySent = meter.createCounter("activitypub.delivery.sent", {
@@ -277,6 +282,58 @@ var FederationMetrics = class {
 			description: "ActivityPub activities observed at the outbox lifecycle level: queued, retried, or abandoned.  Per-recipient delivery counters live on `activitypub.delivery.*`.",
 			unit: "{activity}"
 		});
+		this.keyLookup = meter.createCounter("activitypub.key.lookup", {
+			description: "Public-key lookup attempts performed by Fedify, including both cache hits and remote fetches.",
+			unit: "{lookup}"
+		});
+		this.keyLookupDuration = meter.createHistogram("activitypub.key.lookup.duration", {
+			description: "Duration of public-key lookups performed by Fedify, including any remote fetch.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.documentFetch = meter.createCounter("activitypub.document.fetch", {
+			description: "Remote JSON-LD document loader invocations made by Fedify-wrapped loaders.",
+			unit: "{fetch}"
+		});
+		this.documentFetchDuration = meter.createHistogram("activitypub.document.fetch.duration", {
+			description: "Duration of remote JSON-LD document loader invocations made by Fedify-wrapped loaders.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.documentCache = meter.createCounter("activitypub.document.cache", {
+			description: "KV-backed document loader cache lookups, with `hit` or `miss` classification.",
+			unit: "{lookup}"
+		});
 	}
 	recordDelivery(inbox, durationMs, success, activityType) {
 		const deliveryAttributes = {
@@ -360,6 +417,36 @@ var FederationMetrics = class {
 	recordOutboxActivity(result, activityType) {
 		this.outboxActivity.add(1, buildActivityLifecycleAttributes(result, activityType));
 	}
+	recordKeyLookup(attrs) {
+		const attributes = {
+			"activitypub.lookup.kind": "public_key",
+			"activitypub.lookup.result": attrs.result,
+			"activitypub.cache.enabled": attrs.cacheEnabled
+		};
+		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
+		if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
+		this.keyLookup.add(1, attributes);
+		this.keyLookupDuration.record(attrs.durationMs, attributes);
+	}
+	recordDocumentFetch(attrs) {
+		const attributes = {
+			"activitypub.lookup.kind": attrs.kind,
+			"activitypub.lookup.result": attrs.result
+		};
+		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
+		if (attrs.cacheEnabled != null) attributes["activitypub.cache.enabled"] = attrs.cacheEnabled;
+		if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
+		this.documentFetch.add(1, attributes);
+		this.documentFetchDuration.record(attrs.durationMs, attributes);
+	}
+	recordDocumentCache(attrs) {
+		const attributes = {
+			"activitypub.lookup.kind": attrs.kind,
+			"activitypub.lookup.result": attrs.result
+		};
+		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
+		this.documentCache.add(1, attributes);
+	}
 };
 function buildActivityLifecycleAttributes(result, activityType) {
 	const attributes = { "activitypub.processing.result": result };
@@ -448,6 +535,125 @@ function recordOutboxActivity(meterProvider, result, activityType) {
 	getFederationMetrics(meterProvider).recordOutboxActivity(result, activityType);
 }
 /**
+* Records one measurement on `activitypub.key.lookup` (counter) and
+* `activitypub.key.lookup.duration` (histogram) for a public-key lookup.
+*
+* `activitypub.lookup.kind` is always recorded as `public_key`; the result
+* classification, remote host, HTTP status code (when an HTTP response was
+* received), and `activitypub.cache.enabled` are recorded as attributes on
+* both measurements.  Full key URLs and key IDs are deliberately omitted to
+* keep cardinality bounded.
+* @since 2.3.0
+*/
+function recordKeyLookup(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordKeyLookup(attrs);
+}
+/**
+* Records one measurement each on `activitypub.document.fetch` (counter)
+* and `activitypub.document.fetch.duration` (histogram) for one remote
+* JSON-LD document loader invocation, with bounded
+* `activitypub.lookup.kind` and `activitypub.lookup.result` attributes
+* plus the optional remote-host, cache-enabled, and HTTP status-code
+* attributes.  Counter and histogram are always recorded together so
+* aggregate rate and latency views stay in sync.
+* @since 2.3.0
+*/
+function recordDocumentFetch(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordDocumentFetch(attrs);
+}
+/**
+* Records one `activitypub.document.cache` measurement, classifying the
+* lookup as `hit` (the cache returned an entry) or `miss` (the cache was
+* consulted and returned nothing, prompting a delegate fetch).
+* @since 2.3.0
+*/
+function recordDocumentCache(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordDocumentCache(attrs);
+}
+/**
+* Classifies a thrown value from a key or document fetch into the bounded
+* {@link LookupResult} taxonomy and, when an HTTP response was received,
+* surfaces its status code.
+*
+*  -  `FetchError` with a `Response` whose status is `404` or `410`:
+*     `result=not_found` and the response status code.
+*  -  `FetchError` with any other `Response`: `result=error` and the
+*     response status code.
+*  -  `FetchError` without a `Response`: `result=network_error`.
+*  -  An `AbortError` (typically from a cancelled fetch): `result=network_error`.
+*  -  A bare `TypeError` (the shape native `fetch()` raises on DNS, connect,
+*     and TLS failures before any response is observed):
+*     `result=network_error`.
+*  -  Any other value: `result=error`.
+* @since 2.3.0
+*/
+function classifyFetchError(error) {
+	if (error instanceof FetchError) {
+		if (error.response != null) {
+			const status = error.response.status;
+			return {
+				result: status === 404 || status === 410 ? "not_found" : "error",
+				statusCode: status
+			};
+		}
+		return { result: "network_error" };
+	}
+	if (isAbortError$1(error)) return { result: "network_error" };
+	if (error instanceof TypeError) return { result: "network_error" };
+	return { result: "error" };
+}
+/**
+* Wraps a {@link DocumentLoader} so each invocation records one
+* measurement on `activitypub.document.fetch` (counter) and one on
+* `activitypub.document.fetch.duration` (histogram), classifying the
+* outcome via {@link classifyFetchError} when the wrapped loader throws
+* and as `fetched` on success.  The wrapper rethrows whatever the
+* wrapped loader throws so caller behavior is unchanged.
+*
+* The wrapper records the hostname of the requested URL on
+* `activitypub.remote.host` when the URL parses; full URLs, paths, and
+* query strings are deliberately excluded to keep cardinality bounded.
+* HTTP status codes are recorded only when the failure carries a
+* `Response` (currently, when the wrapped loader throws a
+* {@link FetchError} with a non-`null` `response`).
+* @since 2.3.0
+*/
+function instrumentDocumentLoader(loader, options) {
+	const meterProvider = options.meterProvider;
+	if (meterProvider == null) return loader;
+	return async (url, opts) => {
+		const start = performance.now();
+		let remoteUrl;
+		try {
+			remoteUrl = new URL(url);
+		} catch {
+			remoteUrl = void 0;
+		}
+		try {
+			const result = await loader(url, opts);
+			recordDocumentFetch(meterProvider, {
+				durationMs: getDurationMs(start),
+				kind: options.kind,
+				result: "fetched",
+				remoteUrl,
+				cacheEnabled: options.cacheEnabled
+			});
+			return result;
+		} catch (error) {
+			const classified = classifyFetchError(error);
+			recordDocumentFetch(meterProvider, {
+				durationMs: getDurationMs(start),
+				kind: options.kind,
+				result: classified.result,
+				remoteUrl,
+				cacheEnabled: options.cacheEnabled,
+				statusCode: classified.statusCode
+			});
+			throw error;
+		}
+	};
+}
+/**
 * Times an awaited public key fetch and records exactly one
 * `activitypub.signature.key_fetch.duration` measurement, classifying the
 * outcome as `hit`, `fetched`, or `error` based on the `cached` flag and
@@ -827,24 +1033,48 @@ async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoade
 	};
 }
 async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, onFetchError) {
-	const logger = getLogger([
-		"fedify",
-		"sig",
-		"key"
-	]);
-	const keyId = cacheKey.href;
-	const keyCache = options.keyCache;
-	const cached = await getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger);
-	if (cached?.key === null && cached.cached) return await onCachedUnavailable(cacheKey, keyId, keyCache, logger);
-	if (cached != null) return cached;
-	logger.debug("Fetching key {keyId} to verify signature...", { keyId });
-	let document;
+	const start = performance.now();
+	let outcome = { result: "error" };
 	try {
-		document = (await (options.documentLoader ?? getDocumentLoader())(keyId)).document;
-	} catch (error) {
-		return await onFetchError(error, cacheKey, keyId, keyCache, logger);
+		const logger = getLogger([
+			"fedify",
+			"sig",
+			"key"
+		]);
+		const keyId = cacheKey.href;
+		const keyCache = options.keyCache;
+		const cached = await getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger);
+		if (cached?.key === null && cached.cached) {
+			const cachedUnavailable = await onCachedUnavailable(cacheKey, keyId, keyCache, logger);
+			outcome = { result: "hit" };
+			return cachedUnavailable;
+		}
+		if (cached != null) {
+			outcome = { result: "hit" };
+			return cached;
+		}
+		logger.debug("Fetching key {keyId} to verify signature...", { keyId });
+		let document;
+		try {
+			document = (await (options.documentLoader ?? getDocumentLoader())(keyId)).document;
+		} catch (error) {
+			const classified = classifyFetchError(error);
+			const errored = await onFetchError(error, cacheKey, keyId, keyCache, logger);
+			outcome = classified;
+			return errored;
+		}
+		const resolved = await resolveFetchedKey(document, cacheKey, keyId, cls, options, logger);
+		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
+		return resolved;
+	} finally {
+		recordKeyLookup(options.meterProvider, {
+			durationMs: getDurationMs(start),
+			result: outcome.result,
+			remoteUrl: cacheKey,
+			cacheEnabled: options.keyCache != null,
+			statusCode: outcome.statusCode
+		});
 	}
-	return await resolveFetchedKey(document, cacheKey, keyId, cls, options, logger);
 }
 async function fetchKeyInternal(keyId, cls, options = {}) {
 	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
@@ -1426,7 +1656,8 @@ async function verifyRequestDraft(request, span, metricsContext, { documentLoade
 		documentLoader,
 		contextLoader,
 		keyCache,
-		tracerProvider
+		tracerProvider,
+		meterProvider
 	}));
 	if (fetchError != null) return keyFetchErrorResult(keyIdUrl, fetchError);
 	if (key == null) return invalidSignatureResult(keyIdUrl);
@@ -1641,7 +1872,8 @@ async function verifyRequestRfc9421(request, span, metricsContext, { documentLoa
 			documentLoader,
 			contextLoader,
 			keyCache,
-			tracerProvider
+			tracerProvider,
+			meterProvider
 		}));
 		if (fetchError != null) {
 			setFailure(keyFetchErrorResult(keyId, fetchError));
@@ -1944,4 +2176,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { parseAcceptSignature as C, version as E, fulfillAcceptSignature as S, name as T, recordFanoutRecipients as _, verifyRequestDetailed as a, recordOutboxEnqueue as b, fetchKeyDetailed as c, validateCryptoKey as d, getDurationMs as f, measureSignatureKeyFetch as g, isAbortError$1 as h, verifyRequest as i, generateCryptoKeyPair as l, getRemoteHost as m, parseRfc9421SignatureInput as n, exportJwk as o, getFederationMetrics as p, signRequest as r, fetchKey as s, doubleKnock as t, importJwk as u, recordInboxActivity as v, validateAcceptSignature as w, formatAcceptSignature as x, recordOutboxActivity as y };
+export { formatAcceptSignature as C, name as D, validateAcceptSignature as E, version as O, recordOutboxEnqueue as S, parseAcceptSignature as T, measureSignatureKeyFetch as _, verifyRequestDetailed as a, recordInboxActivity as b, fetchKeyDetailed as c, validateCryptoKey as d, getDurationMs as f, isAbortError$1 as g, instrumentDocumentLoader as h, verifyRequest as i, generateCryptoKeyPair as l, getRemoteHost as m, parseRfc9421SignatureInput as n, exportJwk as o, getFederationMetrics as p, signRequest as r, fetchKey as s, doubleKnock as t, importJwk as u, recordDocumentCache as v, fulfillAcceptSignature as w, recordOutboxActivity as x, recordFanoutRecipients as y };