@fedify/fedify 2.3.1 → 2.3.2

package/dist/{middleware-By8lqc18.js → middleware-B2rDMvhv.js}

@@ -2,10 +2,10 @@ import { Temporal } from "@js-temporal/polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./chunk-CRNNMoPX.js";
 import { r as getDefaultActivityTransformers } from "./transformers-BGMIq1cs.js";
-import { A as formatAcceptSignature, D as recordOutboxEnqueue, E as recordOutboxActivity, F as version, O as recordWebFingerHandle, P as name, S as recordCollectionTotalItems, T as recordInboxActivity, a as verifyRequestDetailed, b as recordCollectionPageItems, d as validateCryptoKey, f as getDurationMs, g as isAbortError, h as instrumentDocumentLoader, i as verifyRequest, k as registerQueueDepthGauge, m as getRemoteHost, n as parseRfc9421SignatureInput, o as exportJwk, p as getFederationMetrics, t as doubleKnock, u as importJwk, v as recordCircuitBreakerStateChange, w as recordFanoutRecipients, x as recordCollectionRequest, y as recordCollectionDispatchDuration } from "./http-DPOMa1DD.js";
-import { _ as hasSignatureLike, b as signJsonLd, c as getKeyOwner, f as compactJsonLd, g as hasSignature, h as getNormalizationContextLoader, i as verifyObject, l as InvalidContextReferenceError, m as detachSignature, n as hasProofLike, o as normalizeOutgoingActivityJsonLd, r as signObject, s as doesActorOwnKey, u as assertSafeJsonLd, v as isClearlyMalformedContextReference, w as wrapContextLoaderForJsonLd, x as verifyCompactJsonLd, y as isInvalidUrlTypeError } from "./proof-DA8Kbchf.js";
-import { n as getNodeInfo, t as nodeInfoToJson } from "./types-CAY3OdLq.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-IjRceERu.js";
+import { A as formatAcceptSignature, D as recordOutboxEnqueue, E as recordOutboxActivity, F as version, O as recordWebFingerHandle, P as name, S as recordCollectionTotalItems, T as recordInboxActivity, a as verifyRequestDetailed, b as recordCollectionPageItems, d as validateCryptoKey, f as getDurationMs, g as isAbortError, h as instrumentDocumentLoader, i as verifyRequest, k as registerQueueDepthGauge, m as getRemoteHost, n as parseRfc9421SignatureInput, o as exportJwk, p as getFederationMetrics, t as doubleKnock, u as importJwk, v as recordCircuitBreakerStateChange, w as recordFanoutRecipients, x as recordCollectionRequest, y as recordCollectionDispatchDuration } from "./http-DVZxcZEr.js";
+import { _ as hasSignatureLike, b as signJsonLd, c as getKeyOwner, f as compactJsonLd, g as hasSignature, h as getNormalizationContextLoader, i as verifyObject, l as InvalidContextReferenceError, m as detachSignature, n as hasProofLike, o as normalizeOutgoingActivityJsonLd, r as signObject, s as doesActorOwnKey, u as assertSafeJsonLd, v as isClearlyMalformedContextReference, w as wrapContextLoaderForJsonLd, x as verifyCompactJsonLd, y as isInvalidUrlTypeError } from "./proof-C_kcg7vF.js";
+import { n as getNodeInfo, t as nodeInfoToJson } from "./types-DTONwNqL.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-B52kTPj4.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -137,6 +137,8 @@ var FederationBuilderImpl = class {
 		f.webFingerLinksDispatcher = this.webFingerLinksDispatcher;
 		f.objectCallbacks = { ...this.objectCallbacks };
 		f.objectTypeIds = { ...this.objectTypeIds };
+		f.collectionCallbacks = { ...this.collectionCallbacks };
+		f.collectionTypeIds = { ...this.collectionTypeIds };
 		f.inboxPath = this.inboxPath;
 		f.outboxPath = this.outboxPath;
 		f.inboxCallbacks = this.inboxCallbacks == null ? void 0 : { ...this.inboxCallbacks };
@@ -680,6 +682,13 @@ function createFederationBuilder() {
 //#endregion
 //#region src/federation/circuit-breaker.ts
 const MAX_CUSTOM_FAILURE_HISTORY = 100;
+const LEGACY_SWEEP_MARKER = ["__fedify_meta", "circuit_breaker_state_ttl_sweep_v1"];
+const LEGACY_SWEEP_DELETING_MARKER = { __fedifyDeletingCircuitBreakerLegacyState: true };
+const CIRCUIT_BREAKER_STATE_VERSION = 1;
+const LEGACY_SWEEP_LOCK_TTL = Temporal.Duration.from({ minutes: 5 });
+const LEGACY_SWEEP_RETRY_WINDOW = Temporal.Duration.from({ hours: 168 });
+const LEGACY_SWEEP_WAIT_INTERVAL = 10;
+const LEGACY_SWEEP_CAS_ATTEMPTS = 3;
 /**
 * Tracks reachability state for remote outbox delivery hosts.
 * @since 2.3.0
@@ -689,6 +698,8 @@ var CircuitBreaker = class {
 	#prefix;
 	#options;
 	#now;
+	#legacySweep;
+	#legacySweepDone;
 	#stateChangeObserver;
 	constructor(options) {
 		this.#kv = options.kv;
@@ -705,6 +716,7 @@ var CircuitBreaker = class {
 		return now.until(this.#capHeldRetryAt(now, heldSince, now.add(delay)));
 	}
 	async beforeSend(remoteHost, message) {
+		this.#sweepLegacyStates();
 		const heldSince = parseHeldSince(message.circuitHeldSince);
 		const now = this.#now();
 		if (heldSince != null && Temporal.Instant.compare(heldSince.add(this.#options.heldActivityTtl), now) <= 0) return {
@@ -786,6 +798,7 @@ var CircuitBreaker = class {
 		throw new Error(`Failed to update circuit breaker state for ${remoteHost}`);
 	}
 	async recordSuccess(remoteHost) {
+		this.#sweepLegacyStates();
 		for (let attempt = 0; attempt < 10; attempt++) {
 			const oldState = await this.#get(remoteHost);
 			if (oldState == null) return void 0;
@@ -806,6 +819,7 @@ var CircuitBreaker = class {
 		return await this.recordSuccess(remoteHost);
 	}
 	async recordFailure(remoteHost) {
+		this.#sweepLegacyStates();
 		const now = this.#now();
 		for (let attempt = 0; attempt < 10; attempt++) {
 			const oldState = await this.#get(remoteHost);
@@ -853,26 +867,122 @@ var CircuitBreaker = class {
 		}
 	}
 	async getState(remoteHost) {
-		return await this.#get(remoteHost);
+		this.#sweepLegacyStates();
+		return stripStoredCircuitBreakerState(await this.#get(remoteHost));
+	}
+	/**
+	* The currently running background legacy sweep, if any.
+	* @internal
+	*/
+	get pendingSweep() {
+		return this.#legacySweep;
 	}
 	#key(remoteHost) {
 		return [...this.#prefix, remoteHost];
 	}
+	#legacySweepMarkerKey() {
+		return [...this.#prefix, ...LEGACY_SWEEP_MARKER];
+	}
+	#sweepLegacyStates() {
+		if (this.#kv.cas == null) return;
+		if (this.#options.stateTtl == null) return;
+		if (this.#legacySweep != null) return;
+		if (this.#isLegacySweepDone()) return;
+		this.#legacySweep = this.#sweepLegacyStatesImpl().catch((error) => {
+			getLogger([
+				"fedify",
+				"federation",
+				"circuit"
+			]).warn("Failed to sweep legacy circuit breaker state:\n{error}", { error });
+		}).finally(() => {
+			this.#legacySweep = void 0;
+		});
+	}
+	async #sweepLegacyStatesImpl() {
+		const markerKey = this.#legacySweepMarkerKey();
+		const marker = await this.#acquireLegacySweep(markerKey);
+		if (marker === "done") return;
+		try {
+			for await (const { key, value } of this.#kv.list(this.#prefix)) {
+				if (key.length !== this.#prefix.length + 1) continue;
+				await this.#migrateLegacyState(key, value);
+			}
+		} catch (error) {
+			await this.#deleteIfUnchanged(markerKey, marker);
+			throw error;
+		}
+		const finishedMarker = this.#finishLegacySweepMarker(marker);
+		if (await this.#kv.cas(markerKey, marker, finishedMarker)) this.#rememberLegacySweepMarker(finishedMarker);
+	}
+	#finishLegacySweepMarker(marker) {
+		const retryUntil = getLegacySweepRetryUntil(marker);
+		if (retryUntil != null && Temporal.Instant.compare(this.#now(), Temporal.Instant.from(retryUntil)) < 0) return {
+			state: "done",
+			retryUntil
+		};
+		return { state: "final" };
+	}
+	async #migrateLegacyState(key, value) {
+		if (isCurrentCircuitBreakerState(value)) return;
+		const state = parseCircuitBreakerKvState(value);
+		if (state != null) {
+			await this.#kv.cas(key, value, markCircuitBreakerState(state), this.#setOptions());
+			return;
+		}
+		await this.#deleteIfUnchanged(key, value);
+	}
+	async #deleteIfUnchanged(key, value) {
+		if (await this.#kv.cas(key, value, LEGACY_SWEEP_DELETING_MARKER, { ttl: LEGACY_SWEEP_LOCK_TTL })) await this.#kv.delete(key);
+	}
+	async #acquireLegacySweep(markerKey) {
+		for (let attempt = 0; attempt < LEGACY_SWEEP_CAS_ATTEMPTS; attempt++) {
+			const marker = await this.#kv.get(markerKey);
+			const now = this.#now();
+			if (isLegacySweepActive(marker, now)) {
+				this.#rememberLegacySweepMarker(marker);
+				return "done";
+			}
+			const retryUntil = isLegacySweepRetryDue(marker, now) ? marker.retryUntil : getLegacySweepRetryUntil(marker) ?? now.add(LEGACY_SWEEP_RETRY_WINDOW).toString();
+			const sweeping = {
+				state: "sweeping",
+				started: now.toString(),
+				retryUntil
+			};
+			if (await this.#kv.cas(markerKey, marker ?? void 0, sweeping, { ttl: LEGACY_SWEEP_LOCK_TTL })) return sweeping;
+			await delay(LEGACY_SWEEP_WAIT_INTERVAL);
+		}
+		return "done";
+	}
+	#isLegacySweepDone() {
+		if (this.#legacySweepDone === "final") return true;
+		if (this.#legacySweepDone == null) return false;
+		if (Temporal.Instant.compare(this.#now(), this.#legacySweepDone) < 0) return true;
+		this.#legacySweepDone = void 0;
+		return false;
+	}
+	#rememberLegacySweepMarker(marker) {
+		const doneUntil = getLegacySweepDoneUntil(marker, this.#now());
+		if (doneUntil != null) this.#legacySweepDone = doneUntil;
+	}
 	#capHeldRetryAt(now, heldSince, retryAt) {
 		const expiresAt = (heldSince ?? now).add(this.#options.heldActivityTtl);
 		return Temporal.Instant.compare(expiresAt, retryAt) < 0 ? expiresAt : retryAt;
 	}
 	async #get(remoteHost) {
-		return parseCircuitBreakerKvState(await this.#kv.get(this.#key(remoteHost)));
+		return parseStoredCircuitBreakerKvState(await this.#kv.get(this.#key(remoteHost)));
 	}
 	async #replace(remoteHost, oldState, newState) {
 		const key = this.#key(remoteHost);
+		const storedState = newState == null ? void 0 : markCircuitBreakerState(newState);
 		if (this.#kv.cas == null) {
-			if (newState == null) await this.#kv.delete(key);
-			else await this.#kv.set(key, newState);
+			if (storedState == null) await this.#kv.delete(key);
+			else await this.#kv.set(key, storedState, this.#setOptions());
 			return true;
 		}
-		return await this.#kv.cas(key, oldState, newState);
+		return await this.#kv.cas(key, oldState, storedState, storedState == null ? void 0 : this.#setOptions());
+	}
+	#setOptions() {
+		return this.#options.stateTtl == null ? void 0 : { ttl: this.#options.stateTtl };
 	}
 	async #notifyStateChange(remoteHost, previousState, newState) {
 		try {
@@ -912,18 +1022,25 @@ var CircuitBreaker = class {
 * @param options The public circuit breaker options supplied to Fedify.
 * @returns The normalized failure predicate, failure pruning function,
 * duration values, and optional callbacks with defaults applied.
-* @throws {RangeError} If any configured duration is not positive.
+* @throws {RangeError} If any configured duration is not positive, or if
+* `stateTtl` is shorter than `recoveryDelay`.
 * @throws {TypeError} If `failureThreshold` is not a positive integer.
 */
 function normalizeCircuitBreakerOptions(options) {
 	const recoveryDelay = toInstantDuration(options.recoveryDelay ?? { minutes: 30 });
 	const heldActivityTtl = toInstantDuration(options.heldActivityTtl ?? { hours: 168 });
 	const releaseInterval = toInstantDuration(options.releaseInterval ?? { seconds: 1 });
+	const configuredStateTtl = options.stateTtl == null ? void 0 : toInstantDuration(options.stateTtl);
 	assertPositiveDuration(recoveryDelay, "recoveryDelay");
 	assertPositiveDuration(heldActivityTtl, "heldActivityTtl");
 	assertPositiveDuration(releaseInterval, "releaseInterval");
+	if (configuredStateTtl != null) {
+		assertPositiveDuration(configuredStateTtl, "stateTtl");
+		if (Temporal.Duration.compare(configuredStateTtl, recoveryDelay) < 0) throw new RangeError("stateTtl must be at least recoveryDelay.");
+	}
 	let failure;
 	let pruneFailures;
+	let stateTtl;
 	if (options.failure == null) {
 		const failureThreshold = options.failureThreshold ?? 5;
 		if (!Number.isInteger(failureThreshold) || failureThreshold <= 0) throw new TypeError("failureThreshold must be a positive integer.");
@@ -939,9 +1056,11 @@ function normalizeCircuitBreakerOptions(options) {
 			const last = timestamps[timestamps.length - 1];
 			return Temporal.Duration.compare(first.until(last), failureWindow) <= 0;
 		};
+		stateTtl = configuredStateTtl ?? maxDuration(recoveryDelay.add(failureWindow), recoveryDelay.add(heldActivityTtl));
 	} else {
 		failure = options.failure;
 		pruneFailures = (timestamps) => timestamps.slice(-MAX_CUSTOM_FAILURE_HISTORY);
+		stateTtl = configuredStateTtl;
 	}
 	return {
 		failure,
@@ -949,10 +1068,72 @@ function normalizeCircuitBreakerOptions(options) {
 		recoveryDelay,
 		heldActivityTtl,
 		releaseInterval,
+		stateTtl,
 		onStateChange: options.onStateChange,
 		onActivityDrop: options.onActivityDrop
 	};
 }
+function maxDuration(duration, ...durations) {
+	return durations.reduce((max, candidate) => Temporal.Duration.compare(candidate, max) > 0 ? candidate : max, duration);
+}
+function isLegacySweepDone(value, now) {
+	return getLegacySweepDoneUntil(value, now) != null;
+}
+function getLegacySweepDoneUntil(value, now) {
+	if (typeof value !== "object" || value == null || !("state" in value)) return;
+	if (value.state === "final") return "final";
+	if (value.state === "done" && "retryUntil" in value && typeof value.retryUntil === "string") try {
+		const retryUntil = Temporal.Instant.from(value.retryUntil);
+		return Temporal.Instant.compare(now, retryUntil) < 0 ? retryUntil : void 0;
+	} catch {
+		return;
+	}
+}
+function isLegacySweepRetryDue(value, now) {
+	if (typeof value !== "object" || value == null || !("state" in value) || value.state !== "done" || !("retryUntil" in value) || typeof value.retryUntil !== "string") return false;
+	try {
+		return Temporal.Instant.compare(now, Temporal.Instant.from(value.retryUntil)) >= 0;
+	} catch {
+		return false;
+	}
+}
+function isLegacySweepActive(value, now) {
+	return isLegacySweepDone(value, now) || isLegacySweepInProgress(value, now);
+}
+function isLegacySweepInProgress(value, now) {
+	if (typeof value !== "object" || value == null || !("state" in value) || value.state !== "sweeping" || !("started" in value) || typeof value.started !== "string") return false;
+	try {
+		return Temporal.Instant.compare(now, Temporal.Instant.from(value.started).add(LEGACY_SWEEP_LOCK_TTL)) < 0;
+	} catch {
+		return false;
+	}
+}
+function getLegacySweepRetryUntil(value) {
+	if (typeof value !== "object" || value == null || !("retryUntil" in value) || typeof value.retryUntil !== "string") return;
+	try {
+		Temporal.Instant.from(value.retryUntil);
+		return value.retryUntil;
+	} catch {
+		return;
+	}
+}
+function isCurrentCircuitBreakerState(value) {
+	return typeof value === "object" && value != null && "__fedifyCircuitBreakerStateVersion" in value && value.__fedifyCircuitBreakerStateVersion === CIRCUIT_BREAKER_STATE_VERSION;
+}
+function markCircuitBreakerState(state) {
+	return {
+		...state,
+		__fedifyCircuitBreakerStateVersion: CIRCUIT_BREAKER_STATE_VERSION
+	};
+}
+function stripStoredCircuitBreakerState(state) {
+	if (state == null) return void 0;
+	const { __fedifyCircuitBreakerStateVersion: _, ...publicState } = state;
+	return publicState;
+}
+function delay(milliseconds) {
+	return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
 function toInstantDuration(duration) {
 	const parsed = Temporal.Duration.from(duration);
 	return Temporal.Duration.from({ milliseconds: Math.trunc(parsed.total({
@@ -987,6 +1168,9 @@ function parseHeldSince(value) {
 * valid instant strings, or `undefined` when the stored value is malformed.
 */
 function parseCircuitBreakerKvState(value) {
+	return stripStoredCircuitBreakerState(parseStoredCircuitBreakerKvState(value));
+}
+function parseStoredCircuitBreakerKvState(value) {
 	const isInstantString = (v) => {
 		if (typeof v !== "string") return false;
 		try {
@@ -1006,7 +1190,8 @@ function parseCircuitBreakerKvState(value) {
 		state: record.state,
 		failures: record.failures,
 		...record.opened == null ? {} : { opened: record.opened },
-		...record.halfOpened == null ? {} : { halfOpened: record.halfOpened }
+		...record.halfOpened == null ? {} : { halfOpened: record.halfOpened },
+		...record.__fedifyCircuitBreakerStateVersion === CIRCUIT_BREAKER_STATE_VERSION ? { __fedifyCircuitBreakerStateVersion: CIRCUIT_BREAKER_STATE_VERSION } : {}
 	};
 }
 //#endregion
@@ -3558,6 +3743,24 @@ const logger = getLogger([
 	"webfinger",
 	"server"
 ]);
+function getWebFingerSubjectAndAliases({ resourceUrl, actorUri, preferredUsername, acctUsername, host, contextHost }) {
+	const aliases = [];
+	let subject = resourceUrl.href;
+	if (resourceUrl.protocol != "acct:" && preferredUsername != null) {
+		aliases.push(`acct:${preferredUsername}@${host ?? contextHost}`);
+		if (host != null && host !== contextHost) aliases.push(`acct:${preferredUsername}@${contextHost}`);
+	}
+	if (resourceUrl.href !== actorUri.href) aliases.push(actorUri.href);
+	if (resourceUrl.protocol === "acct:" && host != null && host !== contextHost && !resourceUrl.href.endsWith(`@${host}`)) {
+		subject = `acct:${preferredUsername ?? acctUsername}@${host}`;
+		aliases.push(resourceUrl.href);
+		if (preferredUsername != null && preferredUsername !== "" && preferredUsername !== acctUsername) aliases.push(`acct:${preferredUsername}@${contextHost}`);
+	}
+	return {
+		subject,
+		aliases
+	};
+}
 /**
 * Handles a WebFinger request.  You would not typically call this function
 * directly, but instead use {@link Federation.fetch} method.
@@ -3662,6 +3865,7 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		return identifier;
 	}
 	let identifier = null;
+	let acctUsername = null;
 	const uriParsed = context.parseUri(resourceUrl);
 	if (uriParsed?.type != "actor") {
 		const match = /^acct:([^@]+)@([^@]+)$/.exec(resource);
@@ -3675,8 +3879,9 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 			const normalizedHost = portMatch == null ? domainToASCII(match[2].toLowerCase()) : domainToASCII(match[2].substring(0, portMatch.index).toLowerCase()) + portMatch[0];
 			if (normalizedHost != context.url.host && normalizedHost != host) return await onNotFound(request);
 			else {
-				identifier = await mapUsernameToIdentifier(match[1]);
-				resourceUrl = new URL(`acct:${match[1]}@${normalizedHost}`);
+				acctUsername = match[1];
+				identifier = await mapUsernameToIdentifier(acctUsername);
+				resourceUrl = new URL(`acct:${acctUsername}@${normalizedHost}`);
 			}
 		}
 	} else identifier = uriParsed.identifier;
@@ -3690,9 +3895,10 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		status: 410,
 		headers: { "Access-Control-Allow-Origin": "*" }
 	});
+	const actorUri = context.getActorUri(identifier);
 	const links = [{
 		rel: "self",
-		href: context.getActorUri(identifier).href,
+		href: actorUri.href,
 		type: "application/activity+json"
 	}];
 	for (const url of actor.urls) if (url instanceof Link && url.href != null) links.push({
@@ -3716,23 +3922,19 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		const customLinks = await webFingerLinksDispatcher(context, resourceUrl);
 		if (customLinks != null) for (const link of customLinks) links.push(link);
 	}
-	const aliases = [];
-	const preferredUsername = actor.preferredUsername;
-	if (resourceUrl.protocol != "acct:" && preferredUsername != null) {
-		aliases.push(`acct:${preferredUsername}@${host ?? context.url.host}`);
-		if (host != null && host !== context.url.host) aliases.push(`acct:${preferredUsername}@${context.url.host}`);
-	}
-	if (resourceUrl.href !== context.getActorUri(identifier).href) aliases.push(context.getActorUri(identifier).href);
-	if (resourceUrl.protocol === "acct:" && host != null && host !== context.url.host && !resourceUrl.href.endsWith(`@${host}`)) {
-		const username = resourceUrl.href.replace(/^acct:/, "").replace(/@.*$/, "");
-		aliases.push(`acct:${username}@${host}`);
-	}
-	const jrd = {
-		subject: resourceUrl.href,
+	const { subject, aliases } = getWebFingerSubjectAndAliases({
+		resourceUrl,
+		actorUri,
+		preferredUsername: actor.preferredUsername,
+		acctUsername,
+		host,
+		contextHost: context.url.host
+	});
+	return new Response(JSON.stringify({
+		subject,
 		aliases,
 		links
-	};
-	return new Response(JSON.stringify(jrd), { headers: {
+	}), { headers: {
 		"Content-Type": "application/jrd+json",
 		"Access-Control-Allow-Origin": "*"
 	} });

package/dist/{middleware-WU_5fbGS.mjs → middleware-CubmqVku.mjs}

@@ -1,26 +1,26 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-C8RG0HM3.mjs";
-import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-Pue1x4ta.mjs";
+import { n as version, t as name } from "./deno-B8lcQ4Ms.mjs";
+import { a as instrumentDocumentLoader, b as recordWebFingerHandle, c as recordCircuitBreakerStateChange, d as recordCollectionRequest, f as recordCollectionTotalItems, g as recordInboxActivity, h as recordFanoutRecipients, i as getRemoteHost, l as recordCollectionDispatchDuration, n as getDurationMs, o as isAbortError, r as getFederationMetrics, u as recordCollectionPageItems, v as recordOutboxActivity, x as registerQueueDepthGauge, y as recordOutboxEnqueue } from "./metrics-DxJzdAgZ.mjs";
 import { t as formatAcceptSignature } from "./accept-CPkZzmGN.mjs";
-import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-BKYwmbur.mjs";
-import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-PCt0862M.mjs";
-import { t as getAuthenticatedDocumentLoader } from "./docloader-YZA0m_3O.mjs";
-import { n as kvCache } from "./kv-cache-Ceg0c1wh.mjs";
-import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-Dcw2skfn.mjs";
-import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-pVJ0Twi7.mjs";
+import { a as importJwk, o as validateCryptoKey, t as exportJwk } from "./key-BqT9YrM3.mjs";
+import { l as verifyRequest, o as parseRfc9421SignatureInput, u as verifyRequestDetailed } from "./http-DlSQMJsb.mjs";
+import { t as getAuthenticatedDocumentLoader } from "./docloader-BMjxpyJD.mjs";
+import { n as kvCache } from "./kv-cache-BD6BgCTF.mjs";
+import { _ as wrapContextLoaderForJsonLd, a as compactJsonLd, c as getNormalizationContextLoader, d as isClearlyMalformedContextReference, f as isInvalidUrlTypeError, l as hasSignature, m as verifyCompactJsonLd, p as signJsonLd, r as assertSafeJsonLd, s as detachSignature, t as InvalidContextReferenceError, u as hasSignatureLike } from "./ld-hwRDfZqq.mjs";
+import { n as getKeyOwner, t as doesActorOwnKey } from "./owner-Btzxz2vj.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-L_DbOaFe.mjs";
-import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-pXYODmNV.mjs";
-import { t as getNodeInfo } from "./client-ByXmQhYD.mjs";
+import { i as verifyObject, n as hasProofLike, r as signObject } from "./proof-D2Z0Wa9X.mjs";
+import { t as getNodeInfo } from "./client-D1KuWxjH.mjs";
 import { t as nodeInfoToJson } from "./types-J53Kw7so.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-BfAp60BJ.mjs";
-import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-hivpmhlD.mjs";
-import { t as CircuitBreaker } from "./circuit-breaker-CSWsyoef.mjs";
+import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "./send-BljvjEOa.mjs";
+import { n as FederationBuilderImpl, t as ACTOR_ALIAS_PREFIX } from "./builder-Dx4EI2YS.mjs";
+import { t as CircuitBreaker } from "./circuit-breaker-DLS_n1x5.mjs";
 import { t as buildCollectionSynchronizationHeader } from "./collection-Cc3DVAhE.mjs";
 import { t as KvKeyCache } from "./keycache-BeU0LCII.mjs";
 import { t as acceptsJsonLd } from "./negotiation-DDstyBvc.mjs";
-import { t as hasMalformedKnownTemporalLiteral } from "./temporal-HZHBbbk4.mjs";
+import { t as hasMalformedKnownTemporalLiteral } from "./temporal-Dg8Hb3lz.mjs";
 import { t as createExponentialBackoffPolicy } from "./retry-CXg_MBI-.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
 import { RouterError } from "@fedify/uri-template";
@@ -2099,6 +2099,24 @@ const logger = getLogger([
 	"webfinger",
 	"server"
 ]);
+function getWebFingerSubjectAndAliases({ resourceUrl, actorUri, preferredUsername, acctUsername, host, contextHost }) {
+	const aliases = [];
+	let subject = resourceUrl.href;
+	if (resourceUrl.protocol != "acct:" && preferredUsername != null) {
+		aliases.push(`acct:${preferredUsername}@${host ?? contextHost}`);
+		if (host != null && host !== contextHost) aliases.push(`acct:${preferredUsername}@${contextHost}`);
+	}
+	if (resourceUrl.href !== actorUri.href) aliases.push(actorUri.href);
+	if (resourceUrl.protocol === "acct:" && host != null && host !== contextHost && !resourceUrl.href.endsWith(`@${host}`)) {
+		subject = `acct:${preferredUsername ?? acctUsername}@${host}`;
+		aliases.push(resourceUrl.href);
+		if (preferredUsername != null && preferredUsername !== "" && preferredUsername !== acctUsername) aliases.push(`acct:${preferredUsername}@${contextHost}`);
+	}
+	return {
+		subject,
+		aliases
+	};
+}
 /**
 * Handles a WebFinger request.  You would not typically call this function
 * directly, but instead use {@link Federation.fetch} method.
@@ -2203,6 +2221,7 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		return identifier;
 	}
 	let identifier = null;
+	let acctUsername = null;
 	const uriParsed = context.parseUri(resourceUrl);
 	if (uriParsed?.type != "actor") {
 		const match = /^acct:([^@]+)@([^@]+)$/.exec(resource);
@@ -2216,8 +2235,9 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 			const normalizedHost = portMatch == null ? domainToASCII(match[2].toLowerCase()) : domainToASCII(match[2].substring(0, portMatch.index).toLowerCase()) + portMatch[0];
 			if (normalizedHost != context.url.host && normalizedHost != host) return await onNotFound(request);
 			else {
-				identifier = await mapUsernameToIdentifier(match[1]);
-				resourceUrl = new URL(`acct:${match[1]}@${normalizedHost}`);
+				acctUsername = match[1];
+				identifier = await mapUsernameToIdentifier(acctUsername);
+				resourceUrl = new URL(`acct:${acctUsername}@${normalizedHost}`);
 			}
 		}
 	} else identifier = uriParsed.identifier;
@@ -2231,9 +2251,10 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		status: 410,
 		headers: { "Access-Control-Allow-Origin": "*" }
 	});
+	const actorUri = context.getActorUri(identifier);
 	const links = [{
 		rel: "self",
-		href: context.getActorUri(identifier).href,
+		href: actorUri.href,
 		type: "application/activity+json"
 	}];
 	for (const url of actor.urls) if (url instanceof Link && url.href != null) links.push({
@@ -2257,23 +2278,19 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		const customLinks = await webFingerLinksDispatcher(context, resourceUrl);
 		if (customLinks != null) for (const link of customLinks) links.push(link);
 	}
-	const aliases = [];
-	const preferredUsername = actor.preferredUsername;
-	if (resourceUrl.protocol != "acct:" && preferredUsername != null) {
-		aliases.push(`acct:${preferredUsername}@${host ?? context.url.host}`);
-		if (host != null && host !== context.url.host) aliases.push(`acct:${preferredUsername}@${context.url.host}`);
-	}
-	if (resourceUrl.href !== context.getActorUri(identifier).href) aliases.push(context.getActorUri(identifier).href);
-	if (resourceUrl.protocol === "acct:" && host != null && host !== context.url.host && !resourceUrl.href.endsWith(`@${host}`)) {
-		const username = resourceUrl.href.replace(/^acct:/, "").replace(/@.*$/, "");
-		aliases.push(`acct:${username}@${host}`);
-	}
-	const jrd = {
-		subject: resourceUrl.href,
+	const { subject, aliases } = getWebFingerSubjectAndAliases({
+		resourceUrl,
+		actorUri,
+		preferredUsername: actor.preferredUsername,
+		acctUsername,
+		host,
+		contextHost: context.url.host
+	});
+	return new Response(JSON.stringify({
+		subject,
 		aliases,
 		links
-	};
-	return new Response(JSON.stringify(jrd), { headers: {
+	}), { headers: {
 		"Content-Type": "application/jrd+json",
 		"Access-Control-Allow-Origin": "*"
 	} });