@fedify/fedify 2.3.0-dev.1137 → 2.3.0-dev.1145

package/dist/{kv-cache-VHFP42vY.mjs → kv-cache-EZRIPZXD.mjs}

@@ -1,7 +1,7 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { c as recordDocumentCache } from "./metrics-iRBg8jTk.mjs";
+import { c as recordDocumentCache } from "./metrics-E0hAHtLZ.mjs";
 import { getLogger } from "@logtape/logtape";
 import { preloadedContexts } from "@fedify/vocab-runtime";
 //#region src/utils/kv-cache.ts

package/dist/{kv-cache-CuCn2xvM.js → kv-cache-b22dNkjt.js}

@@ -1,6 +1,6 @@
 import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { d as validateCryptoKey, t as doubleKnock, v as recordDocumentCache } from "./http-CToqG5ap.js";
+import { d as validateCryptoKey, t as doubleKnock, v as recordDocumentCache } from "./http-B2hxA7dO.js";
 import { getLogger } from "@logtape/logtape";
 import { curry } from "es-toolkit";
 import { UrlError, createActivityPubRequest, getRemoteDocument, logRequest, preloadedContexts, validatePublicUrl } from "@fedify/vocab-runtime";

package/dist/{ld-k8yqD2a-.mjs → ld-eZbar1rr.mjs}

@@ -1,9 +1,9 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-B_9yJW3w.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-iRBg8jTk.mjs";
-import { n as fetchKey, o as validateCryptoKey } from "./key-CkkMJBjF.mjs";
+import { n as version, t as name } from "./deno-h0TWFuEz.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-E0hAHtLZ.mjs";
+import { n as fetchKey, o as validateCryptoKey } from "./key-Dh2OK1XQ.mjs";
 import { getLogger } from "@logtape/logtape";
 import { Activity, CryptographicKey, Object as Object$1, getTypeId } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{metrics-iRBg8jTk.mjs → metrics-E0hAHtLZ.mjs}

@@ -1,7 +1,7 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-B_9yJW3w.mjs";
+import { n as version, t as name } from "./deno-h0TWFuEz.mjs";
 import { metrics } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/metrics.ts
@@ -29,6 +29,8 @@ var FederationMetrics = class {
 	documentFetch;
 	documentFetchDuration;
 	documentCache;
+	webFingerHandle;
+	webFingerHandleDuration;
 	constructor(meterProvider) {
 		const meter = meterProvider.getMeter(name, version);
 		this.deliverySent = meter.createCounter("activitypub.delivery.sent", {
@@ -187,6 +189,30 @@ var FederationMetrics = class {
 			description: "KV-backed document loader cache lookups, with `hit` or `miss` classification.",
 			unit: "{lookup}"
 		});
+		this.webFingerHandle = meter.createCounter("webfinger.handle", {
+			description: "Incoming WebFinger requests handled by Fedify, classified by terminal outcome.",
+			unit: "{request}"
+		});
+		this.webFingerHandleDuration = meter.createHistogram("webfinger.handle.duration", {
+			description: "Duration of incoming WebFinger request handling in Fedify.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
 	}
 	recordDelivery(inbox, durationMs, success, activityType) {
 		const deliveryAttributes = {
@@ -300,6 +326,13 @@ var FederationMetrics = class {
 		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
 		this.documentCache.add(1, attributes);
 	}
+	recordWebFingerHandle(attrs) {
+		const attributes = { "webfinger.handle.result": attrs.result };
+		if (attrs.scheme != null) attributes["webfinger.resource.scheme"] = attrs.scheme;
+		if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
+		this.webFingerHandle.add(1, attributes);
+		this.webFingerHandleDuration.record(attrs.durationMs, attributes);
+	}
 };
 function buildActivityLifecycleAttributes(result, activityType) {
 	const attributes = { "activitypub.processing.result": result };
@@ -424,6 +457,19 @@ function recordDocumentCache(meterProvider, attrs) {
 	getFederationMetrics(meterProvider).recordDocumentCache(attrs);
 }
 /**
+* Records one measurement on `webfinger.handle` (counter) and
+* `webfinger.handle.duration` (histogram) for an incoming WebFinger
+* request handled by Fedify.  Counter and histogram are always recorded
+* together, with `webfinger.handle.result` set to one of `resolved`,
+* `invalid`, `not_found`, `tombstoned`, or `error`.  The queried
+* resource string is deliberately excluded; it remains on the
+* `webfinger.handle` span for trace-level investigation.
+* @since 2.3.0
+*/
+function recordWebFingerHandle(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordWebFingerHandle(attrs);
+}
+/**
 * Classifies a thrown value from a key or document fetch into the bounded
 * {@link LookupResult} taxonomy and, when an HTTP response was received,
 * surfaces its status code.
@@ -586,4 +632,4 @@ function getDurationMs(start) {
 	return Math.max(0, performance.now() - start);
 }
 //#endregion
-export { instrumentDocumentLoader as a, recordDocumentCache as c, recordInboxActivity as d, recordKeyLookup as f, getRemoteHost as i, recordDocumentFetch as l, recordOutboxEnqueue as m, getDurationMs as n, isAbortError as o, recordOutboxActivity as p, getFederationMetrics as r, measureSignatureKeyFetch as s, classifyFetchError as t, recordFanoutRecipients as u };
+export { instrumentDocumentLoader as a, recordDocumentCache as c, recordInboxActivity as d, recordKeyLookup as f, recordWebFingerHandle as h, getRemoteHost as i, recordDocumentFetch as l, recordOutboxEnqueue as m, getDurationMs as n, isAbortError as o, recordOutboxActivity as p, getFederationMetrics as r, measureSignatureKeyFetch as s, classifyFetchError as t, recordFanoutRecipients as u };

package/dist/{middleware-BWLUrbS9.cjs → middleware-BUl1BH4x.cjs}

@@ -2,10 +2,10 @@ const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 const require_chunk = require("./chunk-DDcVe30Y.cjs");
 const require_transformers = require("./transformers-NeAONrAq.cjs");
-const require_http = require("./http-CWoeyogl.cjs");
-const require_proof = require("./proof-CcsIJLTn.cjs");
+const require_http = require("./http-7kAB7PVx.cjs");
+const require_proof = require("./proof-jVqClF49.cjs");
 const require_types = require("./types-KC4QAoxe.cjs");
-const require_kv_cache = require("./kv-cache-DuEwFYcN.cjs");
+const require_kv_cache = require("./kv-cache-DCPp-MT0.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_uri_template = require("@fedify/uri-template");
 let _fedify_vocab = require("@fedify/vocab");
@@ -2601,22 +2601,72 @@ const logger = (0, _logtape_logtape.getLogger)([
 * @returns The response to the request.
 */
 async function handleWebFinger(request, options) {
-	if (options.tracer == null) return await handleWebFingerInternal(request, options);
-	return await options.tracer.startActiveSpan("webfinger.handle", { kind: _opentelemetry_api.SpanKind.SERVER }, async (span) => {
-		try {
-			const response = await handleWebFingerInternal(request, options);
-			span.setStatus({ code: response.ok ? _opentelemetry_api.SpanStatusCode.UNSET : _opentelemetry_api.SpanStatusCode.ERROR });
-			return response;
-		} catch (error) {
-			span.setStatus({
-				code: _opentelemetry_api.SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			span.end();
+	const meterProvider = options.meterProvider;
+	const start = meterProvider == null ? 0 : performance.now();
+	const scheme = computeResourceScheme(options.context.url.searchParams.get("resource"));
+	let notFoundResponse;
+	const wrappedOptions = {
+		...options,
+		async onNotFound(req) {
+			const r = await options.onNotFound(req);
+			notFoundResponse = r;
+			return r;
 		}
-	});
+	};
+	let response;
+	try {
+		if (options.tracer == null) response = await handleWebFingerInternal(request, wrappedOptions);
+		else response = await options.tracer.startActiveSpan("webfinger.handle", { kind: _opentelemetry_api.SpanKind.SERVER }, async (span) => {
+			try {
+				const inner = await handleWebFingerInternal(request, wrappedOptions);
+				span.setStatus({ code: inner.ok ? _opentelemetry_api.SpanStatusCode.UNSET : _opentelemetry_api.SpanStatusCode.ERROR });
+				return inner;
+			} catch (error) {
+				span.setStatus({
+					code: _opentelemetry_api.SpanStatusCode.ERROR,
+					message: String(error)
+				});
+				throw error;
+			} finally {
+				span.end();
+			}
+		});
+		return response;
+	} finally {
+		if (meterProvider != null) require_http.recordWebFingerHandle(meterProvider, {
+			durationMs: Math.max(0, performance.now() - start),
+			result: classifyWebFingerHandleResult(response, notFoundResponse),
+			scheme,
+			statusCode: response?.status
+		});
+	}
+}
+const WEBFINGER_HANDLE_SCHEME_WHITELIST = new Set([
+	"acct",
+	"http",
+	"https",
+	"mailto"
+]);
+function isAllowedResourceScheme(scheme) {
+	return WEBFINGER_HANDLE_SCHEME_WHITELIST.has(scheme);
+}
+function computeResourceScheme(resource) {
+	if (resource == null) return void 0;
+	const colon = resource.indexOf(":");
+	if (colon <= 0) return void 0;
+	const candidate = resource.substring(0, colon).toLowerCase();
+	return isAllowedResourceScheme(candidate) ? candidate : "other";
+}
+function classifyWebFingerHandleResult(response, notFoundResponse) {
+	if (response == null) return "error";
+	if (notFoundResponse != null && response === notFoundResponse) return "not_found";
+	switch (response.status) {
+		case 200: return "resolved";
+		case 400: return "invalid";
+		case 404: return "not_found";
+		case 410: return "tombstoned";
+		default: return "error";
+	}
 }
 async function handleWebFingerInternal(request, { context, host, actorDispatcher, actorHandleMapper, actorAliasMapper, onNotFound, span, webFingerLinksDispatcher }) {
 	if (actorDispatcher == null) {
@@ -3650,7 +3700,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 				actorAliasMapper: this.actorCallbacks?.aliasMapper,
 				webFingerLinksDispatcher: this.webFingerLinksDispatcher,
 				onNotFound,
-				tracer
+				tracer,
+				meterProvider: this._meterProvider
 			});
 			case "nodeInfoJrd": return await handleNodeInfoJrd(request, context);
 			case "nodeInfo": return await handleNodeInfo(request, {
@@ -4209,6 +4260,7 @@ var ContextImpl = class ContextImpl {
 			...options,
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
+			meterProvider: options.meterProvider ?? this.federation._meterProvider,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}

package/dist/{middleware-D7FrhN9q.js → middleware-BrGIM_Ra.js}

@@ -2,10 +2,10 @@ import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./chunk-CRNNMoPX.js";
 import { r as getDefaultActivityTransformers } from "./transformers-BGMIq1cs.js";
-import { C as formatAcceptSignature, D as name, O as version, S as recordOutboxEnqueue, a as verifyRequestDetailed, b as recordInboxActivity, d as validateCryptoKey, f as getDurationMs, g as isAbortError, h as instrumentDocumentLoader, i as verifyRequest, m as getRemoteHost, n as parseRfc9421SignatureInput, o as exportJwk, p as getFederationMetrics, t as doubleKnock, u as importJwk, x as recordOutboxActivity, y as recordFanoutRecipients } from "./http-CToqG5ap.js";
-import { c as getKeyOwner, d as detachSignature, f as hasSignatureLike, i as verifyObject, m as verifyJsonLd, n as hasProofLike, o as normalizeOutgoingActivityJsonLd, p as signJsonLd, r as signObject, s as doesActorOwnKey } from "./proof-NRmtrTDu.js";
+import { C as recordWebFingerHandle, O as name, S as recordOutboxEnqueue, a as verifyRequestDetailed, b as recordInboxActivity, d as validateCryptoKey, f as getDurationMs, g as isAbortError, h as instrumentDocumentLoader, i as verifyRequest, k as version, m as getRemoteHost, n as parseRfc9421SignatureInput, o as exportJwk, p as getFederationMetrics, t as doubleKnock, u as importJwk, w as formatAcceptSignature, x as recordOutboxActivity, y as recordFanoutRecipients } from "./http-B2hxA7dO.js";
+import { c as getKeyOwner, d as detachSignature, f as hasSignatureLike, i as verifyObject, m as verifyJsonLd, n as hasProofLike, o as normalizeOutgoingActivityJsonLd, p as signJsonLd, r as signObject, s as doesActorOwnKey } from "./proof-BkRyFchv.js";
 import { n as getNodeInfo, t as nodeInfoToJson } from "./types-CAY3OdLq.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-CuCn2xvM.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-b22dNkjt.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -2601,22 +2601,72 @@ const logger = getLogger([
 * @returns The response to the request.
 */
 async function handleWebFinger(request, options) {
-	if (options.tracer == null) return await handleWebFingerInternal(request, options);
-	return await options.tracer.startActiveSpan("webfinger.handle", { kind: SpanKind.SERVER }, async (span) => {
-		try {
-			const response = await handleWebFingerInternal(request, options);
-			span.setStatus({ code: response.ok ? SpanStatusCode.UNSET : SpanStatusCode.ERROR });
-			return response;
-		} catch (error) {
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			span.end();
+	const meterProvider = options.meterProvider;
+	const start = meterProvider == null ? 0 : performance.now();
+	const scheme = computeResourceScheme(options.context.url.searchParams.get("resource"));
+	let notFoundResponse;
+	const wrappedOptions = {
+		...options,
+		async onNotFound(req) {
+			const r = await options.onNotFound(req);
+			notFoundResponse = r;
+			return r;
 		}
-	});
+	};
+	let response;
+	try {
+		if (options.tracer == null) response = await handleWebFingerInternal(request, wrappedOptions);
+		else response = await options.tracer.startActiveSpan("webfinger.handle", { kind: SpanKind.SERVER }, async (span) => {
+			try {
+				const inner = await handleWebFingerInternal(request, wrappedOptions);
+				span.setStatus({ code: inner.ok ? SpanStatusCode.UNSET : SpanStatusCode.ERROR });
+				return inner;
+			} catch (error) {
+				span.setStatus({
+					code: SpanStatusCode.ERROR,
+					message: String(error)
+				});
+				throw error;
+			} finally {
+				span.end();
+			}
+		});
+		return response;
+	} finally {
+		if (meterProvider != null) recordWebFingerHandle(meterProvider, {
+			durationMs: Math.max(0, performance.now() - start),
+			result: classifyWebFingerHandleResult(response, notFoundResponse),
+			scheme,
+			statusCode: response?.status
+		});
+	}
+}
+const WEBFINGER_HANDLE_SCHEME_WHITELIST = new Set([
+	"acct",
+	"http",
+	"https",
+	"mailto"
+]);
+function isAllowedResourceScheme(scheme) {
+	return WEBFINGER_HANDLE_SCHEME_WHITELIST.has(scheme);
+}
+function computeResourceScheme(resource) {
+	if (resource == null) return void 0;
+	const colon = resource.indexOf(":");
+	if (colon <= 0) return void 0;
+	const candidate = resource.substring(0, colon).toLowerCase();
+	return isAllowedResourceScheme(candidate) ? candidate : "other";
+}
+function classifyWebFingerHandleResult(response, notFoundResponse) {
+	if (response == null) return "error";
+	if (notFoundResponse != null && response === notFoundResponse) return "not_found";
+	switch (response.status) {
+		case 200: return "resolved";
+		case 400: return "invalid";
+		case 404: return "not_found";
+		case 410: return "tombstoned";
+		default: return "error";
+	}
 }
 async function handleWebFingerInternal(request, { context, host, actorDispatcher, actorHandleMapper, actorAliasMapper, onNotFound, span, webFingerLinksDispatcher }) {
 	if (actorDispatcher == null) {
@@ -3650,7 +3700,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 				actorAliasMapper: this.actorCallbacks?.aliasMapper,
 				webFingerLinksDispatcher: this.webFingerLinksDispatcher,
 				onNotFound,
-				tracer
+				tracer,
+				meterProvider: this._meterProvider
 			});
 			case "nodeInfoJrd": return await handleNodeInfoJrd(request, context);
 			case "nodeInfo": return await handleNodeInfo(request, {
@@ -4209,6 +4260,7 @@ var ContextImpl = class ContextImpl {
 			...options,
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
+			meterProvider: options.meterProvider ?? this.federation._meterProvider,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}

package/dist/{middleware-DQEgdr83.mjs → middleware-CyJDCmNg.mjs}

@@ -1,25 +1,25 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-B_9yJW3w.mjs";
-import { a as instrumentDocumentLoader, d as recordInboxActivity, i as getRemoteHost, m as recordOutboxEnqueue, n as getDurationMs, o as isAbortError, p as recordOutboxActivity, r as getFederationMetrics, u as recordFanoutRecipients } from "./metrics-iRBg8jTk.mjs";
+import { n as version, t as name } from "./deno-h0TWFuEz.mjs";
+import { a as instrumentDocumentLoader, d as recordInboxActivity, h as recordWebFingerHandle, i as getRemoteHost, m as recordOutboxEnqueue, n as getDurationMs, o as isAbortError, p as recordOutboxActivity, r as getFederationMetrics, u as recordFanoutRecipients } from "./metrics-E0hAHtLZ.mjs";
 import { t as formatAcceptSignature } from "./accept-CceiKpCy.mjs";
-import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-CkkMJBjF.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-Cyx5SNuu.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-BT89tyFr.mjs";
-import { n as kvCache } from "./kv-cache-VHFP42vY.mjs";
-import { a as signJsonLd, i as hasSignatureLike, o as verifyJsonLd, r as detachSignature } from "./ld-k8yqD2a-.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-nmXdvXpc.mjs";
+import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-Dh2OK1XQ.mjs";
+import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-QzW9IWfs.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-BdDN0Aqx.mjs";
+import { n as kvCache } from "./kv-cache-EZRIPZXD.mjs";
+import { a as signJsonLd, i as hasSignatureLike, o as verifyJsonLd, r as detachSignature } from "./ld-eZbar1rr.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-ByO_Fw6U.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-BgFLCJQ_.mjs";
-import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-DpwO1T4S.mjs";
+import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-CSo0S8OK.mjs";
 import { t as getNodeInfo } from "./client-B_A6mfn3.mjs";
 import { t as nodeInfoToJson } from "./types-BFowWFTT.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-BCkBXxky.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-ShiR1K6b.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-CA3V5zyK.mjs";
 import { t as KvKeyCache } from "./keycache-BYMd8q7F.mjs";
 import { t as acceptsJsonLd } from "./negotiation-CDW-_gUU.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-v_sGLH1d.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-DvX2tYyZ.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-jzrTV1FU.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
 import { RouterError } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -1600,22 +1600,72 @@ const logger = getLogger([
 * @returns The response to the request.
 */
 async function handleWebFinger(request, options) {
-	if (options.tracer == null) return await handleWebFingerInternal(request, options);
-	return await options.tracer.startActiveSpan("webfinger.handle", { kind: SpanKind.SERVER }, async (span) => {
-		try {
-			const response = await handleWebFingerInternal(request, options);
-			span.setStatus({ code: response.ok ? SpanStatusCode.UNSET : SpanStatusCode.ERROR });
-			return response;
-		} catch (error) {
-			span.setStatus({
-				code: SpanStatusCode.ERROR,
-				message: String(error)
-			});
-			throw error;
-		} finally {
-			span.end();
+	const meterProvider = options.meterProvider;
+	const start = meterProvider == null ? 0 : performance.now();
+	const scheme = computeResourceScheme(options.context.url.searchParams.get("resource"));
+	let notFoundResponse;
+	const wrappedOptions = {
+		...options,
+		async onNotFound(req) {
+			const r = await options.onNotFound(req);
+			notFoundResponse = r;
+			return r;
 		}
-	});
+	};
+	let response;
+	try {
+		if (options.tracer == null) response = await handleWebFingerInternal(request, wrappedOptions);
+		else response = await options.tracer.startActiveSpan("webfinger.handle", { kind: SpanKind.SERVER }, async (span) => {
+			try {
+				const inner = await handleWebFingerInternal(request, wrappedOptions);
+				span.setStatus({ code: inner.ok ? SpanStatusCode.UNSET : SpanStatusCode.ERROR });
+				return inner;
+			} catch (error) {
+				span.setStatus({
+					code: SpanStatusCode.ERROR,
+					message: String(error)
+				});
+				throw error;
+			} finally {
+				span.end();
+			}
+		});
+		return response;
+	} finally {
+		if (meterProvider != null) recordWebFingerHandle(meterProvider, {
+			durationMs: Math.max(0, performance.now() - start),
+			result: classifyWebFingerHandleResult(response, notFoundResponse),
+			scheme,
+			statusCode: response?.status
+		});
+	}
+}
+const WEBFINGER_HANDLE_SCHEME_WHITELIST = new Set([
+	"acct",
+	"http",
+	"https",
+	"mailto"
+]);
+function isAllowedResourceScheme(scheme) {
+	return WEBFINGER_HANDLE_SCHEME_WHITELIST.has(scheme);
+}
+function computeResourceScheme(resource) {
+	if (resource == null) return void 0;
+	const colon = resource.indexOf(":");
+	if (colon <= 0) return void 0;
+	const candidate = resource.substring(0, colon).toLowerCase();
+	return isAllowedResourceScheme(candidate) ? candidate : "other";
+}
+function classifyWebFingerHandleResult(response, notFoundResponse) {
+	if (response == null) return "error";
+	if (notFoundResponse != null && response === notFoundResponse) return "not_found";
+	switch (response.status) {
+		case 200: return "resolved";
+		case 400: return "invalid";
+		case 404: return "not_found";
+		case 410: return "tombstoned";
+		default: return "error";
+	}
 }
 async function handleWebFingerInternal(request, { context, host, actorDispatcher, actorHandleMapper, actorAliasMapper, onNotFound, span, webFingerLinksDispatcher }) {
 	if (actorDispatcher == null) {
@@ -2641,7 +2691,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 				actorAliasMapper: this.actorCallbacks?.aliasMapper,
 				webFingerLinksDispatcher: this.webFingerLinksDispatcher,
 				onNotFound,
-				tracer
+				tracer,
+				meterProvider: this._meterProvider
 			});
 			case "nodeInfoJrd": return await handleNodeInfoJrd(request, context);
 			case "nodeInfo": return await handleNodeInfo(request, {
@@ -3200,6 +3251,7 @@ var ContextImpl = class ContextImpl {
 			...options,
 			userAgent: options.userAgent ?? this.federation.userAgent,
 			tracerProvider: options.tracerProvider ?? this.tracerProvider,
+			meterProvider: options.meterProvider ?? this.federation._meterProvider,
 			allowPrivateAddress: this.federation.allowPrivateAddress
 		});
 	}

package/dist/{middleware-CztxpARM.mjs → middleware-mToCR2tG.mjs}

@@ -1,5 +1,5 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-DQEgdr83.mjs";
+import { n as FederationImpl } from "./middleware-CyJDCmNg.mjs";
 export { FederationImpl };

package/dist/{mod-C504qevA.d.cts → mod-CI9fduEi.d.cts}

@@ -1,6 +1,6 @@
 /// <reference lib="esnext.temporal" />
 import { G as ActorHandleMapper, U as ActorAliasMapper, W as ActorDispatcher, ft as WebFingerLinksDispatcher, l as RequestContext } from "./context-DI2gRbyN.cjs";
-import { Span, Tracer } from "@opentelemetry/api";
+import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 
 //#region src/federation/router.d.ts
@@ -160,6 +160,15 @@ interface WebFingerHandlerParameters<TContextData> {
   * @since 1.3.0
   */
   span?: Span;
+  /**
+  * The OpenTelemetry meter provider used to record the `webfinger.handle`
+  * counter and `webfinger.handle.duration` histogram.  When omitted, no
+  * WebFinger-specific measurements are emitted (the request still
+  * contributes to `fedify.http.server.request.*` because that metric is
+  * recorded one layer up in `Federation.fetch`).
+  * @since 2.3.0
+  */
+  meterProvider?: MeterProvider;
 }
 /**
 * Handles a WebFinger request.  You would not typically call this function

package/dist/{mod-wYfuXeDE.d.ts → mod-CkRiJHGA.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { G as ActorHandleMapper, U as ActorAliasMapper, W as ActorDispatcher, ft as WebFingerLinksDispatcher, l as RequestContext } from "./context-DCtsSHDv.js";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
-import { Span, Tracer } from "@opentelemetry/api";
+import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 
 //#region src/federation/router.d.ts
 /**
@@ -160,6 +160,15 @@ interface WebFingerHandlerParameters<TContextData> {
   * @since 1.3.0
   */
   span?: Span;
+  /**
+  * The OpenTelemetry meter provider used to record the `webfinger.handle`
+  * counter and `webfinger.handle.duration` histogram.  When omitted, no
+  * WebFinger-specific measurements are emitted (the request still
+  * contributes to `fedify.http.server.request.*` because that metric is
+  * recorded one layer up in `Federation.fetch`).
+  * @since 2.3.0
+  */
+  meterProvider?: MeterProvider;
 }
 /**
 * Handles a WebFinger request.  You would not typically call this function

package/dist/mod.cjs

@@ -4,11 +4,11 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-DDcVe30Y.cjs");
 const require_transformers = require("./transformers-NeAONrAq.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-CWoeyogl.cjs");
-const require_middleware = require("./middleware-BWLUrbS9.cjs");
-const require_proof = require("./proof-CcsIJLTn.cjs");
+const require_http = require("./http-7kAB7PVx.cjs");
+const require_middleware = require("./middleware-BUl1BH4x.cjs");
+const require_proof = require("./proof-jVqClF49.cjs");
 const require_types = require("./types-KC4QAoxe.cjs");
-const require_kv_cache = require("./kv-cache-DuEwFYcN.cjs");
+const require_kv_cache = require("./kv-cache-DCPp-MT0.cjs");
 const require_federation_mod = require("./federation/mod.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");

package/dist/mod.d.cts

@@ -6,7 +6,7 @@ import { $ as CustomCollectionDispatcher, A as FederationKvPrefixes, B as Respon
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-gJ8LYbxX.cjs";
 import { a as MessageQueueEnqueueOptions, i as MessageQueueDepth, n as InProcessMessageQueueOptions, o as MessageQueueListenOptions, r as MessageQueue, s as ParallelMessageQueue, t as InProcessMessageQueue } from "./mq-D8uSFzxe.cjs";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.cjs";
-import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-C504qevA.cjs";
+import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-CI9fduEi.cjs";
 import { _ as hasSignatureLike, a as createProof, b as verifySignature, c as verifyObject, d as SignJsonLdOptions, f as VerifyJsonLdOptions, g as detachSignature, h as createSignature, i as VerifyProofOptions, l as verifyProof, m as attachSignature, n as SignObjectOptions, o as hasProofLike, p as VerifySignatureOptions, r as VerifyObjectOptions, s as signObject, t as CreateProofOptions, u as CreateSignatureOptions, v as signJsonLd, y as verifyJsonLd } from "./mod-B0hW12_O.cjs";
 import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-yvIXFAEi.cjs";
 export * from "@fedify/vocab-runtime";

package/dist/mod.d.ts

@@ -6,7 +6,7 @@ import { $ as CustomCollectionDispatcher, A as FederationKvPrefixes, B as Respon
 import { a as MemoryKvStore, i as KvStoreSetOptions, n as KvStore, r as KvStoreListEntry, t as KvKey } from "./kv-D6hNiMTK.js";
 import { a as MessageQueueEnqueueOptions, i as MessageQueueDepth, n as InProcessMessageQueueOptions, o as MessageQueueListenOptions, r as MessageQueue, s as ParallelMessageQueue, t as InProcessMessageQueue } from "./mq-D-nlpY04.js";
 import { actorDehydrator, autoIdAssigner, getDefaultActivityTransformers } from "./compat/mod.js";
-import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-wYfuXeDE.js";
+import { a as RouterOptions, i as RouterError, n as handleWebFinger, o as RouterRouteResult, r as Router, t as WebFingerHandlerParameters } from "./mod-CkRiJHGA.js";
 import { _ as hasSignatureLike, a as createProof, b as verifySignature, c as verifyObject, d as SignJsonLdOptions, f as VerifyJsonLdOptions, g as detachSignature, h as createSignature, i as VerifyProofOptions, l as verifyProof, m as attachSignature, n as SignObjectOptions, o as hasProofLike, p as VerifySignatureOptions, r as VerifyObjectOptions, s as signObject, t as CreateProofOptions, u as CreateSignatureOptions, v as signJsonLd, y as verifyJsonLd } from "./mod-COIAjwRS.js";
 import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./mod-DFvNJcNb.js";
 export * from "@fedify/vocab-runtime";

package/dist/mod.js

@@ -3,11 +3,11 @@ import { URLPattern } from "urlpattern-polyfill";
 import "./chunk-CRNNMoPX.js";
 import { n as autoIdAssigner, r as getDefaultActivityTransformers, t as actorDehydrator } from "./transformers-BGMIq1cs.js";
 import "./compat/mod.js";
-import { C as formatAcceptSignature, E as validateAcceptSignature, T as parseAcceptSignature, a as verifyRequestDetailed, c as fetchKeyDetailed, i as verifyRequest, l as generateCryptoKeyPair, o as exportJwk, r as signRequest, s as fetchKey, u as importJwk, w as fulfillAcceptSignature } from "./http-CToqG5ap.js";
-import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "./middleware-D7FrhN9q.js";
-import { a as verifyProof, c as getKeyOwner, d as detachSignature, f as hasSignatureLike, h as verifySignature, i as verifyObject, l as attachSignature, m as verifyJsonLd, n as hasProofLike, p as signJsonLd, r as signObject, s as doesActorOwnKey, t as createProof, u as createSignature } from "./proof-NRmtrTDu.js";
+import { D as validateAcceptSignature, E as parseAcceptSignature, T as fulfillAcceptSignature, a as verifyRequestDetailed, c as fetchKeyDetailed, i as verifyRequest, l as generateCryptoKeyPair, o as exportJwk, r as signRequest, s as fetchKey, u as importJwk, w as formatAcceptSignature } from "./http-B2hxA7dO.js";
+import { a as createExponentialBackoffPolicy, c as buildCollectionSynchronizationHeader, i as SendActivityError, l as digest, o as respondWithObject, r as handleWebFinger, s as respondWithObjectIfAcceptable, t as createFederation, u as createFederationBuilder } from "./middleware-BrGIM_Ra.js";
+import { a as verifyProof, c as getKeyOwner, d as detachSignature, f as hasSignatureLike, h as verifySignature, i as verifyObject, l as attachSignature, m as verifyJsonLd, n as hasProofLike, p as signJsonLd, r as signObject, s as doesActorOwnKey, t as createProof, u as createSignature } from "./proof-BkRyFchv.js";
 import { n as getNodeInfo, r as parseNodeInfo, t as nodeInfoToJson } from "./types-CAY3OdLq.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-CuCn2xvM.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-b22dNkjt.js";
 import { InProcessMessageQueue, MemoryKvStore, ParallelMessageQueue, Router, RouterError } from "./federation/mod.js";
 import "./nodeinfo/mod.js";
 import "./runtime/mod.js";

package/dist/nodeinfo/handler.test.mjs

@@ -5,7 +5,7 @@ import { r as createRequestContext } from "../context-DVoTs_wM.mjs";
 import { t as assertEquals } from "../assert_equals-C-ZRDbaf.mjs";
 import "../std__assert-BBjXFNOb.mjs";
 import { t as MemoryKvStore } from "../kv-x2IvBUyq.mjs";
-import { _ as handleNodeInfoJrd, g as handleNodeInfo, o as createFederation } from "../middleware-DQEgdr83.mjs";
+import { _ as handleNodeInfoJrd, g as handleNodeInfo, o as createFederation } from "../middleware-CyJDCmNg.mjs";
 import { test } from "@fedify/fixture";
 //#region src/nodeinfo/handler.test.ts
 test("handleNodeInfo()", async () => {

package/dist/{owner-nmXdvXpc.mjs → owner-ByO_Fw6U.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-B_9yJW3w.mjs";
-import "./key-CkkMJBjF.mjs";
+import { n as version, t as name } from "./deno-h0TWFuEz.mjs";
+import "./key-Dh2OK1XQ.mjs";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { getDocumentLoader } from "@fedify/vocab-runtime";