@fedify/fedify 2.3.0-dev.994 → 2.3.0-pr.809.36

package/dist/{http-BrGqJDXL.cjs → http-gOiudB3g.cjs}

@@ -11,7 +11,7 @@ let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conve
 let byte_encodings_base64 = require("byte-encodings/base64");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.3.0-dev.994+9071ca0a";
+var version = "2.3.0-pr.809.36+c592d116";
 //#endregion
 //#region src/sig/accept.ts
 /**
@@ -152,6 +152,814 @@ function fulfillAcceptSignature(entry, localKeyId, localAlg) {
 	};
 }
 //#endregion
+//#region src/federation/metrics.ts
+var FederationMetrics = class {
+	deliverySent;
+	deliveryPermanentFailure;
+	signatureVerificationFailure;
+	signatureVerificationDuration;
+	signatureKeyFetchDuration;
+	deliveryDuration;
+	inboxProcessingDuration;
+	httpServerRequestCount;
+	httpServerRequestDuration;
+	queueTaskEnqueued;
+	queueTaskStarted;
+	queueTaskCompleted;
+	queueTaskFailed;
+	queueTaskDuration;
+	queueTaskInFlight;
+	queueDepth;
+	fanoutRecipients;
+	inboxActivity;
+	outboxActivity;
+	circuitBreakerStateChange;
+	keyLookup;
+	keyLookupDuration;
+	documentFetch;
+	documentFetchDuration;
+	documentCache;
+	webFingerHandle;
+	webFingerHandleDuration;
+	collectionRequest;
+	collectionDispatchDuration;
+	collectionPageItems;
+	collectionTotalItems;
+	constructor(meterProvider) {
+		const meter = meterProvider.getMeter(name, version);
+		this.deliverySent = meter.createCounter("activitypub.delivery.sent", {
+			description: "ActivityPub delivery attempts.",
+			unit: "{attempt}"
+		});
+		this.deliveryPermanentFailure = meter.createCounter("activitypub.delivery.permanent_failure", {
+			description: "ActivityPub deliveries abandoned as permanent failures.",
+			unit: "{failure}"
+		});
+		this.signatureVerificationFailure = meter.createCounter("activitypub.signature.verification_failure", {
+			description: "ActivityPub signature verification failures.",
+			unit: "{failure}"
+		});
+		this.signatureVerificationDuration = meter.createHistogram("activitypub.signature.verification.duration", {
+			description: "Duration of ActivityPub signature verification, including local key lookup and remote key fetches.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				.1,
+				.25,
+				.5,
+				1,
+				2.5,
+				5,
+				10,
+				25,
+				50,
+				100,
+				250,
+				500,
+				1e3
+			] }
+		});
+		this.signatureKeyFetchDuration = meter.createHistogram("activitypub.signature.key_fetch.duration", {
+			description: "Duration of public key lookup performed during ActivityPub signature verification.",
+			unit: "ms"
+		});
+		this.deliveryDuration = meter.createHistogram("activitypub.delivery.duration", {
+			description: "Duration of ActivityPub delivery attempts.",
+			unit: "ms"
+		});
+		this.inboxProcessingDuration = meter.createHistogram("activitypub.inbox.processing_duration", {
+			description: "Duration of ActivityPub inbox listener processing.",
+			unit: "ms"
+		});
+		this.httpServerRequestCount = meter.createCounter("fedify.http.server.request.count", {
+			description: "HTTP requests handled by Federation.fetch().",
+			unit: "{request}"
+		});
+		this.httpServerRequestDuration = meter.createHistogram("fedify.http.server.request.duration", {
+			description: "Duration of HTTP requests handled by Federation.fetch().",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.queueTaskEnqueued = meter.createCounter("fedify.queue.task.enqueued", {
+			description: "Tasks Fedify enqueued for inbox, outbox, or fanout work.",
+			unit: "{task}"
+		});
+		this.queueTaskStarted = meter.createCounter("fedify.queue.task.started", {
+			description: "Tasks Fedify began processing as a queue worker.",
+			unit: "{task}"
+		});
+		this.queueTaskCompleted = meter.createCounter("fedify.queue.task.completed", {
+			description: "Queue tasks Fedify finished processing without throwing.",
+			unit: "{task}"
+		});
+		this.queueTaskFailed = meter.createCounter("fedify.queue.task.failed", {
+			description: "Queue tasks Fedify abandoned because processing threw.",
+			unit: "{task}"
+		});
+		this.queueTaskDuration = meter.createHistogram("fedify.queue.task.duration", {
+			description: "Duration of queue task processing in Fedify workers.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.queueTaskInFlight = meter.createUpDownCounter("fedify.queue.task.in_flight", {
+			description: "Queue tasks currently being processed in this Fedify process.",
+			unit: "{task}"
+		});
+		this.queueDepth = meter.createObservableGauge("fedify.queue.depth", {
+			description: "Messages waiting in configured Fedify queues, as reported by the queue backend.",
+			unit: "{message}"
+		});
+		this.fanoutRecipients = meter.createHistogram("activitypub.fanout.recipients", {
+			description: "Number of recipient inboxes produced by an ActivityPub fanout task.",
+			unit: "{recipient}"
+		});
+		this.inboxActivity = meter.createCounter("activitypub.inbox.activity", {
+			description: "ActivityPub activities observed at the inbox lifecycle level: queued, processed, retried, rejected, or abandoned.",
+			unit: "{activity}"
+		});
+		this.outboxActivity = meter.createCounter("activitypub.outbox.activity", {
+			description: "ActivityPub activities observed at the outbox lifecycle level: queued, retried, or abandoned.  Per-recipient delivery counters live on `activitypub.delivery.*`.",
+			unit: "{activity}"
+		});
+		this.circuitBreakerStateChange = meter.createCounter("activitypub.circuit_breaker.state_change", {
+			description: "Outbound ActivityPub delivery circuit breaker changes.",
+			unit: "{change}"
+		});
+		this.keyLookup = meter.createCounter("activitypub.key.lookup", {
+			description: "Public-key lookup attempts performed by Fedify, including both cache hits and remote fetches.",
+			unit: "{lookup}"
+		});
+		this.keyLookupDuration = meter.createHistogram("activitypub.key.lookup.duration", {
+			description: "Duration of public-key lookups performed by Fedify, including any remote fetch.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.documentFetch = meter.createCounter("activitypub.document.fetch", {
+			description: "Remote JSON-LD document loader invocations made by Fedify-wrapped loaders.",
+			unit: "{fetch}"
+		});
+		this.documentFetchDuration = meter.createHistogram("activitypub.document.fetch.duration", {
+			description: "Duration of remote JSON-LD document loader invocations made by Fedify-wrapped loaders.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.documentCache = meter.createCounter("activitypub.document.cache", {
+			description: "KV-backed document loader cache lookups, with `hit` or `miss` classification.",
+			unit: "{lookup}"
+		});
+		this.webFingerHandle = meter.createCounter("webfinger.handle", {
+			description: "Incoming WebFinger requests handled by Fedify, classified by terminal outcome.",
+			unit: "{request}"
+		});
+		this.webFingerHandleDuration = meter.createHistogram("webfinger.handle.duration", {
+			description: "Duration of incoming WebFinger request handling in Fedify.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.collectionRequest = meter.createCounter("activitypub.collection.request", {
+			description: "ActivityPub collection and collection-page requests handled by Fedify.",
+			unit: "{request}"
+		});
+		this.collectionDispatchDuration = meter.createHistogram("activitypub.collection.dispatch.duration", {
+			description: "Duration of ActivityPub collection dispatcher callbacks.",
+			unit: "ms",
+			advice: { explicitBucketBoundaries: [
+				5,
+				10,
+				25,
+				50,
+				75,
+				100,
+				250,
+				500,
+				750,
+				1e3,
+				2500,
+				5e3,
+				7500,
+				1e4
+			] }
+		});
+		this.collectionPageItems = meter.createHistogram("activitypub.collection.page.items", {
+			description: "Number of items Fedify materialized for an ActivityPub collection response.",
+			unit: "{item}"
+		});
+		this.collectionTotalItems = meter.createHistogram("activitypub.collection.total_items", {
+			description: "Total item count reported by ActivityPub collection counters.",
+			unit: "{item}"
+		});
+	}
+	recordDelivery(inbox, durationMs, success, activityType) {
+		const deliveryAttributes = {
+			"activitypub.remote.host": getRemoteHost(inbox),
+			"activitypub.delivery.success": success
+		};
+		if (activityType != null) deliveryAttributes["activitypub.activity.type"] = activityType;
+		this.deliverySent.add(1, deliveryAttributes);
+		this.deliveryDuration.record(durationMs, deliveryAttributes);
+	}
+	recordPermanentFailure(inbox, statusCode) {
+		this.deliveryPermanentFailure.add(1, {
+			"activitypub.remote.host": getRemoteHost(inbox),
+			"http.response.status_code": statusCode
+		});
+	}
+	recordSignatureVerificationFailure(reason, remoteHost) {
+		const attributes = { "activitypub.verification.failure_reason": reason };
+		if (remoteHost != null) attributes["activitypub.remote.host"] = remoteHost;
+		this.signatureVerificationFailure.add(1, attributes);
+	}
+	recordSignatureVerificationDuration(durationMs, kind, result, extra = {}) {
+		const attributes = {
+			"activitypub.signature.kind": kind,
+			"activitypub.signature.result": result
+		};
+		if (extra.algorithm != null) attributes["http_signatures.algorithm"] = extra.algorithm;
+		if (extra.failureReason != null) attributes["http_signatures.failure_reason"] = extra.failureReason;
+		if (extra.ldType != null) attributes["ld_signatures.type"] = extra.ldType;
+		if (extra.cryptosuite != null) attributes["object_integrity_proofs.cryptosuite"] = extra.cryptosuite;
+		this.signatureVerificationDuration.record(durationMs, attributes);
+	}
+	recordSignatureKeyFetchDuration(durationMs, kind, result) {
+		this.signatureKeyFetchDuration.record(durationMs, {
+			"activitypub.signature.kind": kind,
+			"activitypub.signature.key_fetch.result": result
+		});
+	}
+	recordInboxProcessingDuration(activityType, durationMs) {
+		this.inboxProcessingDuration.record(durationMs, { "activitypub.activity.type": activityType });
+	}
+	recordHttpServerRequest(method, endpoint, durationMs, options = {}) {
+		const attributes = {
+			"http.request.method": normalizeHttpMethod(method),
+			"fedify.endpoint": endpoint
+		};
+		if (options.statusCode != null) attributes["http.response.status_code"] = options.statusCode;
+		if (options.routeTemplate != null) attributes["fedify.route.template"] = options.routeTemplate;
+		this.httpServerRequestCount.add(1, attributes);
+		this.httpServerRequestDuration.record(durationMs, attributes);
+	}
+	recordQueueTaskEnqueued(common, attempt) {
+		const attributes = buildQueueTaskAttributes(common);
+		attributes["fedify.queue.task.attempt"] = attempt;
+		this.queueTaskEnqueued.add(1, attributes);
+	}
+	recordQueueTaskStarted(common) {
+		this.queueTaskStarted.add(1, buildQueueTaskAttributes(common));
+	}
+	incrementQueueTaskInFlight(common) {
+		this.queueTaskInFlight.add(1, buildQueueTaskInFlightAttributes(common));
+	}
+	decrementQueueTaskInFlight(common) {
+		this.queueTaskInFlight.add(-1, buildQueueTaskInFlightAttributes(common));
+	}
+	recordQueueTaskOutcome(common, result, durationMs) {
+		const attributes = buildQueueTaskAttributes(common);
+		attributes["fedify.queue.task.result"] = result;
+		if (result === "completed") this.queueTaskCompleted.add(1, attributes);
+		else if (result === "failed") this.queueTaskFailed.add(1, attributes);
+		this.queueTaskDuration.record(durationMs, attributes);
+	}
+	recordFanoutRecipients(recipientCount, activityType) {
+		const attributes = {};
+		if (activityType != null) attributes["activitypub.activity.type"] = activityType;
+		this.fanoutRecipients.record(recipientCount, attributes);
+	}
+	recordInboxActivity(result, activityType) {
+		this.inboxActivity.add(1, buildActivityLifecycleAttributes(result, activityType));
+	}
+	recordOutboxActivity(result, activityType) {
+		this.outboxActivity.add(1, buildActivityLifecycleAttributes(result, activityType));
+	}
+	recordCircuitBreakerStateChange(remoteHost, state) {
+		this.circuitBreakerStateChange.add(1, {
+			"activitypub.remote.host": remoteHost,
+			"activitypub.circuit_breaker.state": state
+		});
+	}
+	recordKeyLookup(attrs) {
+		const attributes = {
+			"activitypub.lookup.kind": "public_key",
+			"activitypub.lookup.result": attrs.result,
+			"activitypub.cache.enabled": attrs.cacheEnabled
+		};
+		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
+		if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
+		this.keyLookup.add(1, attributes);
+		this.keyLookupDuration.record(attrs.durationMs, attributes);
+	}
+	recordDocumentFetch(attrs) {
+		const attributes = {
+			"activitypub.lookup.kind": attrs.kind,
+			"activitypub.lookup.result": attrs.result
+		};
+		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
+		if (attrs.cacheEnabled != null) attributes["activitypub.cache.enabled"] = attrs.cacheEnabled;
+		if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
+		this.documentFetch.add(1, attributes);
+		this.documentFetchDuration.record(attrs.durationMs, attributes);
+	}
+	recordDocumentCache(attrs) {
+		const attributes = {
+			"activitypub.lookup.kind": attrs.kind,
+			"activitypub.lookup.result": attrs.result
+		};
+		if (attrs.remoteUrl != null) attributes["activitypub.remote.host"] = getRemoteHost(attrs.remoteUrl);
+		this.documentCache.add(1, attributes);
+	}
+	recordWebFingerHandle(attrs) {
+		const attributes = { "webfinger.handle.result": attrs.result };
+		if (attrs.scheme != null) attributes["webfinger.resource.scheme"] = attrs.scheme;
+		if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
+		this.webFingerHandle.add(1, attributes);
+		this.webFingerHandleDuration.record(attrs.durationMs, attributes);
+	}
+	recordCollectionRequest(attrs) {
+		this.collectionRequest.add(1, buildCollectionAttributes(attrs));
+	}
+	recordCollectionDispatchDuration(durationMs, attrs) {
+		this.collectionDispatchDuration.record(durationMs, buildCollectionAttributes(attrs));
+	}
+	recordCollectionPageItems(itemCount, attrs) {
+		this.collectionPageItems.record(itemCount, buildCollectionAttributes(attrs));
+	}
+	recordCollectionTotalItems(totalItems, attrs) {
+		this.collectionTotalItems.record(totalItems, buildCollectionAttributes(attrs));
+	}
+};
+function buildCollectionAttributes(attrs) {
+	const attributes = {
+		"activitypub.collection.kind": attrs.kind,
+		"activitypub.collection.page": attrs.page,
+		"activitypub.collection.result": attrs.result,
+		"fedify.collection.dispatcher": attrs.dispatcher
+	};
+	if (attrs.statusCode != null) attributes["http.response.status_code"] = attrs.statusCode;
+	return attributes;
+}
+function buildActivityLifecycleAttributes(result, activityType) {
+	const attributes = { "activitypub.processing.result": result };
+	if (activityType != null) attributes["activitypub.activity.type"] = activityType;
+	return attributes;
+}
+function buildQueueTaskAttributes(common) {
+	const attributes = { "fedify.queue.role": common.role };
+	const backend = getQueueBackend(common.queue);
+	if (backend != null) attributes["fedify.queue.backend"] = backend;
+	const nativeRetrial = common.queue?.nativeRetrial;
+	if (typeof nativeRetrial === "boolean") attributes["fedify.queue.native_retrial"] = nativeRetrial;
+	if (common.activityType != null) attributes["activitypub.activity.type"] = common.activityType;
+	return attributes;
+}
+function buildQueueTaskInFlightAttributes(common) {
+	return buildQueueTaskAttributes({
+		role: common.role,
+		queue: common.queue
+	});
+}
+/**
+* Returns the constructor name of the given message queue, when it is a
+* meaningful identifier.  Used as a best-effort `fedify.queue.backend`
+* attribute on queue task metrics; returns `undefined` for plain object
+* literals (whose constructor is `Object`) so the attribute does not appear
+* with a non-informative value.
+* @since 2.3.0
+*/
+function getQueueBackend(queue) {
+	const name = queue?.constructor?.name;
+	if (name == null || name === "" || name === "Object") return void 0;
+	return name;
+}
+/**
+* Registers a callback for observing queue backend depth.
+* @since 2.3.0
+*/
+function registerQueueDepthGauge(meterProvider, entries, options = {}) {
+	const uniqueQueues = /* @__PURE__ */ new Map();
+	for (const { role, queue } of entries) {
+		if (queue?.getDepth == null) continue;
+		const roles = uniqueQueues.get(queue);
+		if (roles == null) uniqueQueues.set(queue, [role]);
+		else if (!roles.includes(role)) roles.push(role);
+	}
+	if (uniqueQueues.size < 1) return;
+	const queueEntries = Array.from(uniqueQueues.entries());
+	getFederationMetrics(meterProvider).queueDepth.addCallback(async (observableResult) => {
+		await Promise.all(queueEntries.map(async ([queue, roles]) => {
+			let depth;
+			try {
+				depth = await queue.getDepth();
+			} catch {
+				return;
+			}
+			if (depth == null) return;
+			const attributes = buildQueueDepthAttributes(queue, roles, options);
+			observableResult.observe(depth.queued, {
+				...attributes,
+				"fedify.queue.depth.state": "queued"
+			});
+			if (depth.ready != null) observableResult.observe(depth.ready, {
+				...attributes,
+				"fedify.queue.depth.state": "ready"
+			});
+			if (depth.delayed != null) observableResult.observe(depth.delayed, {
+				...attributes,
+				"fedify.queue.depth.state": "delayed"
+			});
+		}));
+	});
+}
+function buildQueueDepthAttributes(queue, roles, options) {
+	const sortedRoles = roles.toSorted();
+	const role = sortedRoles.length === 1 ? sortedRoles[0] : "shared";
+	const attributes = { "fedify.queue.role": role };
+	if (options.sourceId != null) attributes["fedify.federation.instance_id"] = options.sourceId;
+	if (role === "shared") attributes["fedify.queue.roles"] = sortedRoles.join(",");
+	const backend = getQueueBackend(queue);
+	if (backend != null) attributes["fedify.queue.backend"] = backend;
+	const nativeRetrial = queue.nativeRetrial;
+	if (typeof nativeRetrial === "boolean") attributes["fedify.queue.native_retrial"] = nativeRetrial;
+	return attributes;
+}
+/**
+* Records `fedify.queue.task.enqueued` for an outgoing outbox enqueue and,
+* for the initial attempt, also records
+* `activitypub.outbox.activity{queued}`.
+*
+* Both `Context.sendActivity()` and `OutboxContext.forwardActivity()` enqueue
+* outbox messages with the same metric attributes (role, queue, activity
+* type, attempt), so they share this helper rather than each defining a local
+* closure.  Retry enqueues (attempt > 0) intentionally do not record a
+* second `activitypub.outbox.activity{queued}`; retries are reported as
+* `result=retried` from the retry-scheduling site, which has the failure
+* context.
+* @since 2.3.0
+*/
+function recordOutboxEnqueue(meterProvider, outboxQueue, message) {
+	const metrics = getFederationMetrics(meterProvider);
+	metrics.recordQueueTaskEnqueued({
+		role: "outbox",
+		queue: outboxQueue,
+		activityType: message.activityType
+	}, message.attempt);
+	if (message.attempt === 0) metrics.recordOutboxActivity("queued", message.activityType);
+}
+/**
+* Records `activitypub.fanout.recipients` with the number of recipient
+* inboxes a single fanout produced.  The histogram is unitless count
+* (one measurement per fanout enqueue).  Recipient URLs are deliberately
+* not recorded; only the activity type, when known.
+* @since 2.3.0
+*/
+function recordFanoutRecipients(meterProvider, recipientCount, activityType) {
+	getFederationMetrics(meterProvider).recordFanoutRecipients(recipientCount, activityType);
+}
+/**
+* Records one `activitypub.inbox.activity` measurement.  The
+* `activitypub.processing.result` attribute is always present;
+* `activitypub.activity.type` is recorded only when Fedify already knows
+* the activity type.
+* @since 2.3.0
+*/
+function recordInboxActivity(meterProvider, result, activityType) {
+	getFederationMetrics(meterProvider).recordInboxActivity(result, activityType);
+}
+/**
+* Records one `activitypub.outbox.activity` measurement.  The
+* `activitypub.processing.result` attribute is always present;
+* `activitypub.activity.type` is recorded only when Fedify already knows
+* the activity type (it is always known for outbox lifecycle events).
+* @since 2.3.0
+*/
+function recordOutboxActivity(meterProvider, result, activityType) {
+	getFederationMetrics(meterProvider).recordOutboxActivity(result, activityType);
+}
+/**
+* Records one outbound delivery circuit breaker state transition.
+* @since 2.3.0
+*/
+function recordCircuitBreakerStateChange(meterProvider, remoteHost, state) {
+	getFederationMetrics(meterProvider).recordCircuitBreakerStateChange(remoteHost, state);
+}
+/**
+* Records one measurement on `activitypub.key.lookup` (counter) and
+* `activitypub.key.lookup.duration` (histogram) for a public-key lookup.
+*
+* `activitypub.lookup.kind` is always recorded as `public_key`; the result
+* classification, remote host, HTTP status code (when an HTTP response was
+* received), and `activitypub.cache.enabled` are recorded as attributes on
+* both measurements.  Full key URLs and key IDs are deliberately omitted to
+* keep cardinality bounded.
+* @since 2.3.0
+*/
+function recordKeyLookup(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordKeyLookup(attrs);
+}
+/**
+* Records one measurement each on `activitypub.document.fetch` (counter)
+* and `activitypub.document.fetch.duration` (histogram) for one remote
+* JSON-LD document loader invocation, with bounded
+* `activitypub.lookup.kind` and `activitypub.lookup.result` attributes
+* plus the optional remote-host, cache-enabled, and HTTP status-code
+* attributes.  Counter and histogram are always recorded together so
+* aggregate rate and latency views stay in sync.
+* @since 2.3.0
+*/
+function recordDocumentFetch(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordDocumentFetch(attrs);
+}
+/**
+* Records one `activitypub.document.cache` measurement, classifying the
+* lookup as `hit` (the cache returned an entry) or `miss` (the cache was
+* consulted and returned nothing, prompting a delegate fetch).
+* @since 2.3.0
+*/
+function recordDocumentCache(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordDocumentCache(attrs);
+}
+/**
+* Records one measurement on `webfinger.handle` (counter) and
+* `webfinger.handle.duration` (histogram) for an incoming WebFinger
+* request handled by Fedify.  Counter and histogram are always recorded
+* together, with `webfinger.handle.result` set to one of `resolved`,
+* `invalid`, `not_found`, `tombstoned`, or `error`.  The queried
+* resource string is deliberately excluded; it remains on the
+* `webfinger.handle` span for trace-level investigation.
+* @since 2.3.0
+*/
+function recordWebFingerHandle(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordWebFingerHandle(attrs);
+}
+/**
+* Records one `activitypub.collection.request` measurement for a
+* collection or collection-page request handled by Fedify.
+* @since 2.3.0
+*/
+function recordCollectionRequest(meterProvider, attrs) {
+	getFederationMetrics(meterProvider).recordCollectionRequest(attrs);
+}
+/**
+* Records one `activitypub.collection.dispatch.duration` measurement for a
+* collection dispatcher callback invocation.
+* @since 2.3.0
+*/
+function recordCollectionDispatchDuration(meterProvider, durationMs, attrs) {
+	getFederationMetrics(meterProvider).recordCollectionDispatchDuration(durationMs, attrs);
+}
+/**
+* Records one `activitypub.collection.page.items` measurement when Fedify
+* has materialized collection items in memory.
+* @since 2.3.0
+*/
+function recordCollectionPageItems(meterProvider, itemCount, attrs) {
+	getFederationMetrics(meterProvider).recordCollectionPageItems(itemCount, attrs);
+}
+/**
+* Records one `activitypub.collection.total_items` measurement when a
+* collection counter has already reported a total item count.
+* @since 2.3.0
+*/
+function recordCollectionTotalItems(meterProvider, totalItems, attrs) {
+	getFederationMetrics(meterProvider).recordCollectionTotalItems(totalItems, attrs);
+}
+/**
+* Classifies a thrown value from a key or document fetch into the bounded
+* {@link LookupResult} taxonomy and, when an HTTP response was received,
+* surfaces its status code.
+*
+*  -  `FetchError` with a `Response` whose status is `404` or `410`:
+*     `result=not_found` and the response status code.
+*  -  `FetchError` with any other `Response`: `result=error` and the
+*     response status code.
+*  -  `FetchError` without a `Response`: `result=network_error`.
+*  -  An `AbortError` (typically from a cancelled fetch): `result=network_error`.
+*  -  A bare `TypeError` (the shape native `fetch()` raises on DNS, connect,
+*     and TLS failures before any response is observed):
+*     `result=network_error`.
+*  -  Any other value: `result=error`.
+* @since 2.3.0
+*/
+function classifyFetchError(error) {
+	if (error instanceof _fedify_vocab_runtime.FetchError) {
+		if (error.response != null) {
+			const status = error.response.status;
+			return {
+				result: status === 404 || status === 410 ? "not_found" : "error",
+				statusCode: status
+			};
+		}
+		return { result: "network_error" };
+	}
+	if (isAbortError$1(error)) return { result: "network_error" };
+	if (error instanceof TypeError) return { result: "network_error" };
+	return { result: "error" };
+}
+/**
+* Wraps a {@link DocumentLoader} so each invocation records one
+* measurement on `activitypub.document.fetch` (counter) and one on
+* `activitypub.document.fetch.duration` (histogram), classifying the
+* outcome via {@link classifyFetchError} when the wrapped loader throws
+* and as `fetched` on success.  The wrapper rethrows whatever the
+* wrapped loader throws so caller behavior is unchanged.
+*
+* The wrapper records the host of the requested URL, including any
+* non-default port, on `activitypub.remote.host` when the URL parses; full
+* URLs, paths, and query strings are deliberately excluded to keep
+* cardinality bounded.
+* HTTP status codes are recorded only when the failure carries a
+* `Response` (currently, when the wrapped loader throws a
+* {@link FetchError} with a non-`null` `response`).
+* @since 2.3.0
+*/
+function instrumentDocumentLoader(loader, options) {
+	const meterProvider = options.meterProvider;
+	if (meterProvider == null) return loader;
+	return async (url, opts) => {
+		const start = performance.now();
+		let remoteUrl;
+		try {
+			remoteUrl = new URL(url);
+		} catch {
+			remoteUrl = void 0;
+		}
+		try {
+			const result = await loader(url, opts);
+			recordDocumentFetch(meterProvider, {
+				durationMs: getDurationMs(start),
+				kind: options.kind,
+				result: "fetched",
+				remoteUrl,
+				cacheEnabled: options.cacheEnabled
+			});
+			return result;
+		} catch (error) {
+			const classified = classifyFetchError(error);
+			recordDocumentFetch(meterProvider, {
+				durationMs: getDurationMs(start),
+				kind: options.kind,
+				result: classified.result,
+				remoteUrl,
+				cacheEnabled: options.cacheEnabled,
+				statusCode: classified.statusCode
+			});
+			throw error;
+		}
+	};
+}
+/**
+* Times an awaited public key fetch and records exactly one
+* `activitypub.signature.key_fetch.duration` measurement, classifying the
+* outcome as `hit`, `fetched`, or `error` based on the `cached` flag and
+* whether the returned key is non-null.  Errors thrown by the fetch are
+* reported as `error` and rethrown, so verifier behavior is unchanged.
+*
+* Shared by the three signature verifiers (HTTP, Linked Data, Object
+* Integrity Proofs); the only per-call variation is the
+* `activitypub.signature.kind` attribute value.
+* @since 2.3.0
+*/
+async function measureSignatureKeyFetch(meterProvider, kind, fetch) {
+	const start = performance.now();
+	try {
+		const result = await fetch();
+		getFederationMetrics(meterProvider).recordSignatureKeyFetchDuration(getDurationMs(start), kind, result.key != null ? result.cached ? "hit" : "fetched" : "error");
+		return result;
+	} catch (error) {
+		getFederationMetrics(meterProvider).recordSignatureKeyFetchDuration(getDurationMs(start), kind, "error");
+		throw error;
+	}
+}
+/**
+* Whether the given thrown value is an `AbortError`.
+*
+* `processQueuedTask` distinguishes aborted tasks (recorded as
+* `fedify.queue.task.result=aborted`) from other failures so that backend
+* shutdown signals do not inflate the `fedify.queue.task.failed` counter.
+* @since 2.3.0
+*/
+function isAbortError$1(error) {
+	if (error == null || typeof error !== "object") return false;
+	const name = error.name;
+	return typeof name === "string" && name === "AbortError";
+}
+const KNOWN_HTTP_METHODS = new Set([
+	"CONNECT",
+	"DELETE",
+	"GET",
+	"HEAD",
+	"OPTIONS",
+	"PATCH",
+	"POST",
+	"PUT",
+	"QUERY",
+	"TRACE"
+]);
+function normalizeHttpMethod(method) {
+	const upper = method.toUpperCase();
+	return KNOWN_HTTP_METHODS.has(upper) ? upper : "_OTHER";
+}
+const federationMetrics = /* @__PURE__ */ new WeakMap();
+/**
+* Gets the cached Fedify metric instruments for a meter provider.
+* @since 2.3.0
+*/
+function getFederationMetrics(meterProvider = _opentelemetry_api.metrics.getMeterProvider()) {
+	let instruments = federationMetrics.get(meterProvider);
+	if (instruments == null) {
+		instruments = new FederationMetrics(meterProvider);
+		federationMetrics.set(meterProvider, instruments);
+	}
+	return instruments;
+}
+/**
+* Gets the bounded remote host attribute value for a URL.
+* @since 2.3.0
+*/
+function getRemoteHost(url) {
+	return url.host;
+}
+/**
+* Gets an elapsed duration in milliseconds from a `performance.now()` value.
+* @since 2.3.0
+*/
+function getDurationMs(start) {
+	return Math.max(0, performance.now() - start);
+}
+//#endregion
 //#region src/sig/key.ts
 /**
 * Checks if the given key is valid and supported.  No-op if the key is valid,
@@ -452,24 +1260,48 @@ async function resolveFetchedKey(document, cacheKey, keyId, cls, { documentLoade
 	};
 }
 async function fetchKeyWithResult(cacheKey, cls, options, onCachedUnavailable, onFetchError) {
-	const logger = (0, _logtape_logtape.getLogger)([
-		"fedify",
-		"sig",
-		"key"
-	]);
-	const keyId = cacheKey.href;
-	const keyCache = options.keyCache;
-	const cached = await getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger);
-	if (cached?.key === null && cached.cached) return await onCachedUnavailable(cacheKey, keyId, keyCache, logger);
-	if (cached != null) return cached;
-	logger.debug("Fetching key {keyId} to verify signature...", { keyId });
-	let document;
+	const start = performance.now();
+	let outcome = { result: "error" };
 	try {
-		document = (await (options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)())(keyId)).document;
-	} catch (error) {
-		return await onFetchError(error, cacheKey, keyId, keyCache, logger);
+		const logger = (0, _logtape_logtape.getLogger)([
+			"fedify",
+			"sig",
+			"key"
+		]);
+		const keyId = cacheKey.href;
+		const keyCache = options.keyCache;
+		const cached = await getCachedFetchKey(cacheKey, keyId, cls, keyCache, logger);
+		if (cached?.key === null && cached.cached) {
+			const cachedUnavailable = await onCachedUnavailable(cacheKey, keyId, keyCache, logger);
+			outcome = { result: "hit" };
+			return cachedUnavailable;
+		}
+		if (cached != null) {
+			outcome = { result: "hit" };
+			return cached;
+		}
+		logger.debug("Fetching key {keyId} to verify signature...", { keyId });
+		let document;
+		try {
+			document = (await (options.documentLoader ?? (0, _fedify_vocab_runtime.getDocumentLoader)())(keyId)).document;
+		} catch (error) {
+			const classified = classifyFetchError(error);
+			const errored = await onFetchError(error, cacheKey, keyId, keyCache, logger);
+			outcome = classified;
+			return errored;
+		}
+		const resolved = await resolveFetchedKey(document, cacheKey, keyId, cls, options, logger);
+		outcome = { result: resolved.key != null ? "fetched" : "invalid" };
+		return resolved;
+	} finally {
+		recordKeyLookup(options.meterProvider, {
+			durationMs: getDurationMs(start),
+			result: outcome.result,
+			remoteUrl: cacheKey,
+			cacheEnabled: options.keyCache != null,
+			statusCode: outcome.statusCode
+		});
 	}
-	return await resolveFetchedKey(document, cacheKey, keyId, cls, options, logger);
 }
 async function fetchKeyInternal(keyId, cls, options = {}) {
 	return await fetchKeyWithResult(typeof keyId === "string" ? new URL(keyId) : keyId, cls, options, (_cacheKey, _keyId, _keyCache, _logger) => {
@@ -497,6 +1329,7 @@ async function fetchKeyInternal(keyId, cls, options = {}) {
 //#endregion
 //#region src/sig/http.ts
 const DEFAULT_MAX_REDIRECTION = 20;
+const DOUBLE_KNOCK_TRANSPORT_RETRY_DELAY_MS = 100;
 /**
 * Signs a request using the given private key.
 * @param request The request to sign.
@@ -799,6 +1632,27 @@ function parseKeyId(value) {
 function getKeyFetchErrorName(error) {
 	return error.name || error.constructor.name || "Error";
 }
+/**
+* Known draft-cavage `algorithm` parameter values, used to keep the
+* `http_signatures.algorithm` metric attribute on a bounded set.  The header
+* field is attacker-controlled and not used to select the verification
+* algorithm, so unknown values are dropped from the metric to prevent
+* cardinality blow-up.
+*/
+const DRAFT_KNOWN_ALGORITHMS = new Set([
+	"ecdsa-sha256",
+	"ecdsa-sha384",
+	"ecdsa-sha512",
+	"ed25519",
+	"hs2019",
+	"rsa-sha1",
+	"rsa-sha256",
+	"rsa-sha512"
+]);
+function classifyHttpVerifyResult(result) {
+	if (result.verified) return "verified";
+	return result.reason.type === "noSignature" ? "missing" : "rejected";
+}
 function recordVerificationResult(span, result) {
 	span.setAttribute("http_signatures.verified", result.verified);
 	if (result.verified === true) return;
@@ -842,27 +1696,37 @@ async function verifyRequestDetailed(request, options = {}) {
 			span.setAttribute(_opentelemetry_semantic_conventions.ATTR_URL_FULL, request.url);
 			for (const [name, value] of request.headers) span.setAttribute((0, _opentelemetry_semantic_conventions.ATTR_HTTP_REQUEST_HEADER)(name), value);
 		}
+		const start = performance.now();
+		const metricsContext = {};
+		let result;
+		let threw = false;
 		try {
 			let spec = options.spec;
 			if (spec == null) spec = request.headers.has("Signature-Input") ? "rfc9421" : "draft-cavage-http-signatures-12";
-			let result;
-			if (spec === "rfc9421") result = await verifyRequestRfc9421(request, span, options);
-			else result = await verifyRequestDraft(request, span, options);
+			if (spec === "rfc9421") result = await verifyRequestRfc9421(request, span, metricsContext, options);
+			else result = await verifyRequestDraft(request, span, metricsContext, options);
 			recordVerificationResult(span, result);
 			if (!result.verified) span.setStatus({ code: _opentelemetry_api.SpanStatusCode.ERROR });
 			return result;
 		} catch (error) {
+			threw = true;
 			span.setStatus({
 				code: _opentelemetry_api.SpanStatusCode.ERROR,
 				message: String(error)
 			});
 			throw error;
 		} finally {
+			const classified = threw ? "error" : classifyHttpVerifyResult(result);
+			const failureReason = result != null && !result.verified && result.reason.type !== "noSignature" ? result.reason.type : void 0;
+			getFederationMetrics(options.meterProvider).recordSignatureVerificationDuration(getDurationMs(start), "http", classified, {
+				algorithm: metricsContext.algorithm,
+				failureReason
+			});
 			span.end();
 		}
 	});
 }
-async function verifyRequestDraft(request, span, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, tracerProvider } = {}) {
+async function verifyRequestDraft(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, meterProvider, tracerProvider } = {}) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"sig",
@@ -1010,13 +1874,18 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 	const keyIdUrl = parseKeyId(keyId);
 	if (keyIdUrl == null) return invalidSignatureResult(null);
 	span?.setAttribute("http_signatures.key_id", keyId);
-	if ("algorithm" in sigValues) span?.setAttribute("http_signatures.algorithm", sigValues.algorithm);
-	const { key, cached, fetchError } = await fetchKeyDetailed(keyIdUrl, _fedify_vocab.CryptographicKey, {
+	if ("algorithm" in sigValues) {
+		span?.setAttribute("http_signatures.algorithm", sigValues.algorithm);
+		const normalizedAlgorithm = sigValues.algorithm.toLowerCase();
+		if (DRAFT_KNOWN_ALGORITHMS.has(normalizedAlgorithm)) metricsContext.algorithm = normalizedAlgorithm;
+	}
+	const { key, cached, fetchError } = await measureSignatureKeyFetch(meterProvider, "http", () => fetchKeyDetailed(keyIdUrl, _fedify_vocab.CryptographicKey, {
 		documentLoader,
 		contextLoader,
 		keyCache,
-		tracerProvider
-	});
+		tracerProvider,
+		meterProvider
+	}));
 	if (fetchError != null) return keyFetchErrorResult(keyIdUrl, fetchError);
 	if (key == null) return invalidSignatureResult(keyIdUrl);
 	const headerNames = headers.split(/\s+/g);
@@ -1038,7 +1907,7 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 				signature,
 				message
 			});
-			return await verifyRequestDetailed(originalRequest, {
+			return await verifyRequestDraft(originalRequest, span, metricsContext, {
 				documentLoader,
 				contextLoader,
 				timeWindow,
@@ -1046,7 +1915,9 @@ async function verifyRequestDraft(request, span, { documentLoader, contextLoader
 				keyCache: {
 					get: () => Promise.resolve(void 0),
 					set: async (keyId, key) => await keyCache?.set(keyId, key)
-				}
+				},
+				meterProvider,
+				tracerProvider
 			});
 		}
 		logger.debug("Failed to verify with the fetched key {keyId}; signature {signature} is invalid.  Check if the key is correct or if the signed message is correct.  The message to sign is:\n{message}", {
@@ -1122,7 +1993,7 @@ async function verifyRfc9421ContentDigest(digestHeader, body) {
 	}
 	return false;
 }
-async function verifyRequestRfc9421(request, span, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, tracerProvider } = {}) {
+async function verifyRequestRfc9421(request, span, metricsContext, { documentLoader, contextLoader, timeWindow, currentTime, keyCache, meterProvider, tracerProvider } = {}) {
 	const logger = (0, _logtape_logtape.getLogger)([
 		"fedify",
 		"sig",
@@ -1156,9 +2027,14 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 		return invalidSignatureResult(null);
 	}
 	let failure = noSignatureResult();
+	let failureAlgorithm;
+	const setFailure = (result, algorithm) => {
+		failure = result;
+		failureAlgorithm = algorithm;
+	};
 	for (const sigName of signatureNames) {
 		if (!signatures[sigName]) {
-			failure = invalidSignatureResult(parseKeyId(signatureInputs[sigName]?.keyId));
+			setFailure(invalidSignatureResult(parseKeyId(signatureInputs[sigName]?.keyId)));
 			continue;
 		}
 		const sigInput = signatureInputs[sigName];
@@ -1169,7 +2045,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 				signatureName: sigName,
 				signatureInput: signatureInputHeader
 			});
-			failure = invalidSignatureResult(null);
+			setFailure(invalidSignatureResult(null));
 			continue;
 		}
 		if (!sigInput.created) {
@@ -1177,7 +2053,7 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 				signatureName: sigName,
 				signatureInput: signatureInputHeader
 			});
-			failure = invalidSignatureResult(keyId);
+			setFailure(invalidSignatureResult(keyId));
 			continue;
 		}
 		const signatureCreated = Temporal.Instant.fromEpochMilliseconds(sigInput.created * 1e3);
@@ -1189,14 +2065,14 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 					created: signatureCreated.toString(),
 					now: now.toString()
 				});
-				failure = invalidSignatureResult(keyId);
+				setFailure(invalidSignatureResult(keyId));
 				continue;
 			} else if (Temporal.Instant.compare(signatureCreated, now.subtract(tw)) < 0) {
 				logger.debug("Failed to verify; signature created time is too far in the past.", {
 					created: signatureCreated.toString(),
 					now: now.toString()
 				});
-				failure = invalidSignatureResult(keyId);
+				setFailure(invalidSignatureResult(keyId));
 				continue;
 			}
 		}
@@ -1204,34 +2080,35 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 			const contentDigestHeader = request.headers.get("Content-Digest");
 			if (!contentDigestHeader) {
 				logger.debug("Failed to verify; Content-Digest header required but not found.", { components: sigInput.components });
-				failure = invalidSignatureResult(keyId);
+				setFailure(invalidSignatureResult(keyId));
 				continue;
 			}
 			if (!await verifyRfc9421ContentDigest(contentDigestHeader, await request.arrayBuffer())) {
 				logger.debug("Failed to verify; Content-Digest verification failed.", { contentDigest: contentDigestHeader });
-				failure = invalidSignatureResult(keyId);
+				setFailure(invalidSignatureResult(keyId));
 				continue;
 			}
 		}
 		span?.setAttribute("http_signatures.key_id", sigInput.keyId);
 		span?.setAttribute("http_signatures.created", sigInput.created.toString());
 		if (keyId == null) {
-			failure = invalidSignatureResult(null);
+			setFailure(invalidSignatureResult(null));
 			continue;
 		}
-		const { key, cached, fetchError } = await fetchKeyDetailed(keyId, _fedify_vocab.CryptographicKey, {
+		const { key, cached, fetchError } = await measureSignatureKeyFetch(meterProvider, "http", () => fetchKeyDetailed(keyId, _fedify_vocab.CryptographicKey, {
 			documentLoader,
 			contextLoader,
 			keyCache,
-			tracerProvider
-		});
+			tracerProvider,
+			meterProvider
+		}));
 		if (fetchError != null) {
-			failure = keyFetchErrorResult(keyId, fetchError);
+			setFailure(keyFetchErrorResult(keyId, fetchError));
 			continue;
 		}
 		if (!key) {
 			logger.debug("Failed to fetch key: {keyId}", { keyId: sigInput.keyId });
-			failure = invalidSignatureResult(keyId);
+			setFailure(invalidSignatureResult(keyId));
 			continue;
 		}
 		let alg = sigInput.alg?.toLowerCase();
@@ -1243,12 +2120,13 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 		}
 		if (alg) span?.setAttribute("http_signatures.algorithm", alg);
 		const algorithm = alg && rfc9421AlgorithmMap[alg];
+		const candidateAlgorithm = algorithm ? alg : void 0;
 		if (!algorithm) {
 			logger.debug("Failed to verify; unsupported algorithm: {algorithm}", {
 				algorithm: sigInput.alg,
 				supported: Object.keys(rfc9421AlgorithmMap)
 			});
-			failure = invalidSignatureResult(keyId);
+			setFailure(invalidSignatureResult(keyId));
 			continue;
 		}
 		let signatureBase;
@@ -1259,20 +2137,22 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 				error,
 				signatureInput: sigInput
 			});
-			failure = invalidSignatureResult(keyId);
+			setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
 			continue;
 		}
 		const signatureBaseBytes = new TextEncoder().encode(signatureBase);
 		span?.setAttribute("http_signatures.signature", (0, byte_encodings_hex.encodeHex)(sigBytes));
 		try {
-			if (await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes)) return {
-				verified: true,
-				key,
-				signatureLabel: sigName
-			};
-			else if (cached) {
+			if (await crypto.subtle.verify(algorithm, key.publicKey, sigBytes.slice(), signatureBaseBytes)) {
+				metricsContext.algorithm = candidateAlgorithm;
+				return {
+					verified: true,
+					key,
+					signatureLabel: sigName
+				};
+			} else if (cached) {
 				logger.debug("Failed to verify with cached key {keyId}; retrying with fresh key...", { keyId: sigInput.keyId });
-				return await verifyRequestDetailed(originalRequest, {
+				return await verifyRequestRfc9421(originalRequest, span, metricsContext, {
 					documentLoader,
 					contextLoader,
 					timeWindow,
@@ -1281,14 +2161,16 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 						get: () => Promise.resolve(void 0),
 						set: async (keyId, key) => await keyCache?.set(keyId, key)
 					},
-					spec: "rfc9421"
+					spec: "rfc9421",
+					meterProvider,
+					tracerProvider
 				});
 			} else {
 				logger.debug("Failed to verify signature with fetched key {keyId}; signature invalid.", {
 					keyId: sigInput.keyId,
 					signatureBase
 				});
-				failure = invalidSignatureResult(keyId);
+				setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
 			}
 		} catch (error) {
 			logger.debug("Error during signature verification: {error}", {
@@ -1296,9 +2178,10 @@ async function verifyRequestRfc9421(request, span, { documentLoader, contextLoad
 				keyId: sigInput.keyId,
 				algorithm: sigInput.alg
 			});
-			failure = invalidSignatureResult(keyId);
+			setFailure(invalidSignatureResult(keyId), candidateAlgorithm);
 		}
 	}
+	metricsContext.algorithm = failureAlgorithm;
 	return failure;
 }
 /**
@@ -1325,6 +2208,59 @@ function createRedirectRequest(request, location, body) {
 		cache: request.cache
 	});
 }
+async function fetchDoubleKnockRequest(request, signedRequest, signal) {
+	const maxAttempts = request.method === "GET" || request.method === "HEAD" ? 2 : 1;
+	for (let attempt = 1;; attempt++) try {
+		return await fetch(signedRequest, {
+			redirect: "manual",
+			signal
+		});
+	} catch (error) {
+		const abortedSignal = getAbortedSignal(signal, request.signal, signedRequest.signal);
+		if (abortedSignal != null) throw getAbortReason(abortedSignal);
+		if (isAbortError(error)) throw error;
+		if (attempt >= maxAttempts) throw createFetchError(request.url, error);
+		await sleep(DOUBLE_KNOCK_TRANSPORT_RETRY_DELAY_MS, signal, request.signal, signedRequest.signal);
+	}
+}
+function createFetchError(url, cause) {
+	const error = new _fedify_vocab_runtime.FetchError(url, cause instanceof Error ? cause.message : String(cause));
+	error.cause = cause;
+	return error;
+}
+function isAbortError(error) {
+	return error instanceof Error && error.name === "AbortError";
+}
+async function sleep(ms, ...signals) {
+	const abortSignals = signals.filter((signal) => signal != null);
+	const abortedSignal = getAbortedSignal(...abortSignals);
+	if (abortedSignal != null) throw getAbortReason(abortedSignal);
+	if (abortSignals.length < 1) {
+		await new Promise((resolve) => setTimeout(resolve, ms));
+		return;
+	}
+	await new Promise((resolve, reject) => {
+		const removeAbortListeners = () => {
+			for (const signal of abortSignals) signal.removeEventListener("abort", handleAbort);
+		};
+		const timeout = setTimeout(() => {
+			removeAbortListeners();
+			resolve();
+		}, ms);
+		function handleAbort(event) {
+			clearTimeout(timeout);
+			removeAbortListeners();
+			reject(getAbortReason(event.currentTarget));
+		}
+		for (const signal of abortSignals) signal.addEventListener("abort", handleAbort, { once: true });
+	});
+}
+function getAbortedSignal(...signals) {
+	return signals.find((signal) => signal?.aborted);
+}
+function getAbortReason(signal) {
+	return signal.reason ?? new DOMException("The operation was aborted.", "AbortError");
+}
 /**
 * Performs a double-knock request to the given URL.  For the details of
 * double-knocking, see
@@ -1351,10 +2287,7 @@ async function doubleKnockInternal(request, identity, options, redirected = 0, v
 		body
 	});
 	log?.(signedRequest);
-	let response = await fetch(signedRequest, {
-		redirect: "manual",
-		signal
-	});
+	let response = await fetchDoubleKnockRequest(request, signedRequest, signal);
 	if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
 		if (redirected >= maximumRedirection) throw new _fedify_vocab_runtime.FetchError(request.url, `Too many redirections (${redirected + 1})`);
 		const redirectRequest = createRedirectRequest(request, response.headers.get("Location"), body);
@@ -1429,10 +2362,7 @@ async function doubleKnockInternal(request, identity, options, redirected = 0, v
 			body
 		});
 		log?.(signedRequest);
-		response = await fetch(signedRequest, {
-			redirect: "manual",
-			signal
-		});
+		response = await fetchDoubleKnockRequest(request, signedRequest, signal);
 		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
 			if (redirected >= maximumRedirection) throw new _fedify_vocab_runtime.FetchError(request.url, `Too many redirections (${redirected + 1})`);
 			const redirectRequest = createRedirectRequest(request, response.headers.get("Location"), body);
@@ -1515,12 +2445,48 @@ Object.defineProperty(exports, "generateCryptoKeyPair", {
 		return generateCryptoKeyPair;
 	}
 });
+Object.defineProperty(exports, "getDurationMs", {
+	enumerable: true,
+	get: function() {
+		return getDurationMs;
+	}
+});
+Object.defineProperty(exports, "getFederationMetrics", {
+	enumerable: true,
+	get: function() {
+		return getFederationMetrics;
+	}
+});
+Object.defineProperty(exports, "getRemoteHost", {
+	enumerable: true,
+	get: function() {
+		return getRemoteHost;
+	}
+});
 Object.defineProperty(exports, "importJwk", {
 	enumerable: true,
 	get: function() {
 		return importJwk;
 	}
 });
+Object.defineProperty(exports, "instrumentDocumentLoader", {
+	enumerable: true,
+	get: function() {
+		return instrumentDocumentLoader;
+	}
+});
+Object.defineProperty(exports, "isAbortError", {
+	enumerable: true,
+	get: function() {
+		return isAbortError$1;
+	}
+});
+Object.defineProperty(exports, "measureSignatureKeyFetch", {
+	enumerable: true,
+	get: function() {
+		return measureSignatureKeyFetch;
+	}
+});
 Object.defineProperty(exports, "name", {
 	enumerable: true,
 	get: function() {
@@ -1539,6 +2505,78 @@ Object.defineProperty(exports, "parseRfc9421SignatureInput", {
 		return parseRfc9421SignatureInput;
 	}
 });
+Object.defineProperty(exports, "recordCircuitBreakerStateChange", {
+	enumerable: true,
+	get: function() {
+		return recordCircuitBreakerStateChange;
+	}
+});
+Object.defineProperty(exports, "recordCollectionDispatchDuration", {
+	enumerable: true,
+	get: function() {
+		return recordCollectionDispatchDuration;
+	}
+});
+Object.defineProperty(exports, "recordCollectionPageItems", {
+	enumerable: true,
+	get: function() {
+		return recordCollectionPageItems;
+	}
+});
+Object.defineProperty(exports, "recordCollectionRequest", {
+	enumerable: true,
+	get: function() {
+		return recordCollectionRequest;
+	}
+});
+Object.defineProperty(exports, "recordCollectionTotalItems", {
+	enumerable: true,
+	get: function() {
+		return recordCollectionTotalItems;
+	}
+});
+Object.defineProperty(exports, "recordDocumentCache", {
+	enumerable: true,
+	get: function() {
+		return recordDocumentCache;
+	}
+});
+Object.defineProperty(exports, "recordFanoutRecipients", {
+	enumerable: true,
+	get: function() {
+		return recordFanoutRecipients;
+	}
+});
+Object.defineProperty(exports, "recordInboxActivity", {
+	enumerable: true,
+	get: function() {
+		return recordInboxActivity;
+	}
+});
+Object.defineProperty(exports, "recordOutboxActivity", {
+	enumerable: true,
+	get: function() {
+		return recordOutboxActivity;
+	}
+});
+Object.defineProperty(exports, "recordOutboxEnqueue", {
+	enumerable: true,
+	get: function() {
+		return recordOutboxEnqueue;
+	}
+});
+Object.defineProperty(exports, "recordWebFingerHandle", {
+	enumerable: true,
+	get: function() {
+		return recordWebFingerHandle;
+	}
+});
+Object.defineProperty(exports, "registerQueueDepthGauge", {
+	enumerable: true,
+	get: function() {
+		return registerQueueDepthGauge;
+	}
+});
 Object.defineProperty(exports, "signRequest", {
 	enumerable: true,
 	get: function() {