@fedify/fedify 2.4.0-dev.1666 → 2.4.0-dev.1727

package/dist/{middleware-_VQWtF1B.js → middleware-CZcuedl-.js}

@@ -1,11 +1,11 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { t as __exportAll } from "./chunk-D5IdezsZ.js";
-import { r as getDefaultActivityTransformers } from "./transformers-DXze6FUB.js";
-import { A as formatAcceptSignature, D as recordOutboxEnqueue, E as recordOutboxActivity, F as version, O as recordWebFingerHandle, P as name, S as recordCollectionTotalItems, T as recordInboxActivity, a as verifyRequestDetailed, b as recordCollectionPageItems, d as validateCryptoKey, f as getDurationMs, g as isAbortError, h as instrumentDocumentLoader, i as verifyRequest, k as registerQueueDepthGauge, m as getRemoteHost, n as parseRfc9421SignatureInput, o as exportJwk, p as getFederationMetrics, t as doubleKnock, u as importJwk, v as recordCircuitBreakerStateChange, w as recordFanoutRecipients, x as recordCollectionRequest, y as recordCollectionDispatchDuration } from "./http-BX5xiNUh.js";
-import { _ as hasSignatureLike, b as signJsonLd, c as getKeyOwner, f as compactJsonLd, g as hasSignature, h as getNormalizationContextLoader, i as verifyObject, l as InvalidContextReferenceError, m as detachSignature, n as hasProofLike, o as normalizeOutgoingActivityJsonLd, r as signObject, s as doesActorOwnKey, u as assertSafeJsonLd, v as isClearlyMalformedContextReference, w as wrapContextLoaderForJsonLd, x as verifyCompactJsonLd, y as isInvalidUrlTypeError } from "./proof-rOoEb_P4.js";
-import { n as getNodeInfo, t as nodeInfoToJson } from "./types-DC1pNgJA.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-C04NtL2n.js";
+import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
+import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
+import { A as formatAcceptSignature, D as recordOutboxEnqueue, E as recordOutboxActivity, F as version, O as recordWebFingerHandle, P as name, S as recordCollectionTotalItems, T as recordInboxActivity, a as verifyRequestDetailed, b as recordCollectionPageItems, d as validateCryptoKey, f as getDurationMs, g as isAbortError, h as instrumentDocumentLoader, i as verifyRequest, k as registerQueueDepthGauge, m as getRemoteHost, n as parseRfc9421SignatureInput, o as exportJwk, p as getFederationMetrics, t as doubleKnock, u as importJwk, v as recordCircuitBreakerStateChange, w as recordFanoutRecipients, x as recordCollectionRequest, y as recordCollectionDispatchDuration } from "./http-Bw6s_dOB.js";
+import { _ as hasSignatureLike, b as signJsonLd, c as getKeyOwner, f as compactJsonLd, g as hasSignature, h as getNormalizationContextLoader, i as verifyObject, l as InvalidContextReferenceError, m as detachSignature, n as hasProofLike, o as normalizeOutgoingActivityJsonLd, r as signObject, s as doesActorOwnKey, u as assertSafeJsonLd, v as isClearlyMalformedContextReference, w as wrapContextLoaderForJsonLd, x as verifyCompactJsonLd, y as isInvalidUrlTypeError } from "./proof-BTBolSnd.js";
+import { n as getNodeInfo, t as nodeInfoToJson } from "./types-Dtyf8lVj.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-CQsh-KUw.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, Tombstone, getTypeId, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -143,6 +143,8 @@ var FederationBuilderImpl = class {
 		f.webFingerLinksDispatcher = this.webFingerLinksDispatcher;
 		f.objectCallbacks = { ...this.objectCallbacks };
 		f.objectTypeIds = { ...this.objectTypeIds };
+		f.collectionCallbacks = { ...this.collectionCallbacks };
+		f.collectionTypeIds = { ...this.collectionTypeIds };
 		f.inboxPath = this.inboxPath;
 		f.outboxPath = this.outboxPath;
 		f.inboxCallbacks = this.inboxCallbacks == null ? void 0 : { ...this.inboxCallbacks };
@@ -722,7 +724,13 @@ function createFederationBuilder() {
 }
 //#endregion
 //#region src/federation/circuit-breaker.ts
-const MAX_CUSTOM_FAILURE_HISTORY = 100;
+const LEGACY_SWEEP_MARKER = ["__fedify_meta", "circuit_breaker_state_ttl_sweep_v1"];
+const LEGACY_SWEEP_DELETING_MARKER = { __fedifyDeletingCircuitBreakerLegacyState: true };
+const CIRCUIT_BREAKER_STATE_VERSION = 1;
+const LEGACY_SWEEP_LOCK_TTL = Temporal.Duration.from({ minutes: 5 });
+const LEGACY_SWEEP_RETRY_WINDOW = Temporal.Duration.from({ hours: 168 });
+const LEGACY_SWEEP_WAIT_INTERVAL = 10;
+const LEGACY_SWEEP_CAS_ATTEMPTS = 3;
 /**
 * Tracks reachability state for remote outbox delivery hosts.
 * @since 2.3.0
@@ -732,6 +740,8 @@ var CircuitBreaker = class {
 	#prefix;
 	#options;
 	#now;
+	#legacySweep;
+	#legacySweepDone;
 	#stateChangeObserver;
 	constructor(options) {
 		this.#kv = options.kv;
@@ -748,6 +758,7 @@ var CircuitBreaker = class {
 		return now.until(this.#capHeldRetryAt(now, heldSince, now.add(delay)));
 	}
 	async beforeSend(remoteHost, message) {
+		this.#sweepLegacyStates();
 		const heldSince = parseHeldSince(message.circuitHeldSince);
 		const now = this.#now();
 		if (heldSince != null && Temporal.Instant.compare(heldSince.add(this.#options.heldActivityTtl), now) <= 0) return {
@@ -829,6 +840,7 @@ var CircuitBreaker = class {
 		throw new Error(`Failed to update circuit breaker state for ${remoteHost}`);
 	}
 	async recordSuccess(remoteHost) {
+		this.#sweepLegacyStates();
 		for (let attempt = 0; attempt < 10; attempt++) {
 			const oldState = await this.#get(remoteHost);
 			if (oldState == null) return void 0;
@@ -849,6 +861,7 @@ var CircuitBreaker = class {
 		return await this.recordSuccess(remoteHost);
 	}
 	async recordFailure(remoteHost) {
+		this.#sweepLegacyStates();
 		const now = this.#now();
 		for (let attempt = 0; attempt < 10; attempt++) {
 			const oldState = await this.#get(remoteHost);
@@ -896,26 +909,122 @@ var CircuitBreaker = class {
 		}
 	}
 	async getState(remoteHost) {
-		return await this.#get(remoteHost);
+		this.#sweepLegacyStates();
+		return stripStoredCircuitBreakerState(await this.#get(remoteHost));
+	}
+	/**
+	* The currently running background legacy sweep, if any.
+	* @internal
+	*/
+	get pendingSweep() {
+		return this.#legacySweep;
 	}
 	#key(remoteHost) {
 		return [...this.#prefix, remoteHost];
 	}
+	#legacySweepMarkerKey() {
+		return [...this.#prefix, ...LEGACY_SWEEP_MARKER];
+	}
+	#sweepLegacyStates() {
+		if (this.#kv.cas == null) return;
+		if (this.#options.stateTtl == null) return;
+		if (this.#legacySweep != null) return;
+		if (this.#isLegacySweepDone()) return;
+		this.#legacySweep = this.#sweepLegacyStatesImpl().catch((error) => {
+			getLogger([
+				"fedify",
+				"federation",
+				"circuit"
+			]).warn("Failed to sweep legacy circuit breaker state:\n{error}", { error });
+		}).finally(() => {
+			this.#legacySweep = void 0;
+		});
+	}
+	async #sweepLegacyStatesImpl() {
+		const markerKey = this.#legacySweepMarkerKey();
+		const marker = await this.#acquireLegacySweep(markerKey);
+		if (marker === "done") return;
+		try {
+			for await (const { key, value } of this.#kv.list(this.#prefix)) {
+				if (key.length !== this.#prefix.length + 1) continue;
+				await this.#migrateLegacyState(key, value);
+			}
+		} catch (error) {
+			await this.#deleteIfUnchanged(markerKey, marker);
+			throw error;
+		}
+		const finishedMarker = this.#finishLegacySweepMarker(marker);
+		if (await this.#kv.cas(markerKey, marker, finishedMarker)) this.#rememberLegacySweepMarker(finishedMarker);
+	}
+	#finishLegacySweepMarker(marker) {
+		const retryUntil = getLegacySweepRetryUntil(marker);
+		if (retryUntil != null && Temporal.Instant.compare(this.#now(), Temporal.Instant.from(retryUntil)) < 0) return {
+			state: "done",
+			retryUntil
+		};
+		return { state: "final" };
+	}
+	async #migrateLegacyState(key, value) {
+		if (isCurrentCircuitBreakerState(value)) return;
+		const state = parseCircuitBreakerKvState(value);
+		if (state != null) {
+			await this.#kv.cas(key, value, markCircuitBreakerState(state), this.#setOptions());
+			return;
+		}
+		await this.#deleteIfUnchanged(key, value);
+	}
+	async #deleteIfUnchanged(key, value) {
+		if (await this.#kv.cas(key, value, LEGACY_SWEEP_DELETING_MARKER, { ttl: LEGACY_SWEEP_LOCK_TTL })) await this.#kv.delete(key);
+	}
+	async #acquireLegacySweep(markerKey) {
+		for (let attempt = 0; attempt < LEGACY_SWEEP_CAS_ATTEMPTS; attempt++) {
+			const marker = await this.#kv.get(markerKey);
+			const now = this.#now();
+			if (isLegacySweepActive(marker, now)) {
+				this.#rememberLegacySweepMarker(marker);
+				return "done";
+			}
+			const retryUntil = isLegacySweepRetryDue(marker, now) ? marker.retryUntil : getLegacySweepRetryUntil(marker) ?? now.add(LEGACY_SWEEP_RETRY_WINDOW).toString();
+			const sweeping = {
+				state: "sweeping",
+				started: now.toString(),
+				retryUntil
+			};
+			if (await this.#kv.cas(markerKey, marker ?? void 0, sweeping, { ttl: LEGACY_SWEEP_LOCK_TTL })) return sweeping;
+			await delay(LEGACY_SWEEP_WAIT_INTERVAL);
+		}
+		return "done";
+	}
+	#isLegacySweepDone() {
+		if (this.#legacySweepDone === "final") return true;
+		if (this.#legacySweepDone == null) return false;
+		if (Temporal.Instant.compare(this.#now(), this.#legacySweepDone) < 0) return true;
+		this.#legacySweepDone = void 0;
+		return false;
+	}
+	#rememberLegacySweepMarker(marker) {
+		const doneUntil = getLegacySweepDoneUntil(marker, this.#now());
+		if (doneUntil != null) this.#legacySweepDone = doneUntil;
+	}
 	#capHeldRetryAt(now, heldSince, retryAt) {
 		const expiresAt = (heldSince ?? now).add(this.#options.heldActivityTtl);
 		return Temporal.Instant.compare(expiresAt, retryAt) < 0 ? expiresAt : retryAt;
 	}
 	async #get(remoteHost) {
-		return parseCircuitBreakerKvState(await this.#kv.get(this.#key(remoteHost)));
+		return parseStoredCircuitBreakerKvState(await this.#kv.get(this.#key(remoteHost)));
 	}
 	async #replace(remoteHost, oldState, newState) {
 		const key = this.#key(remoteHost);
+		const storedState = newState == null ? void 0 : markCircuitBreakerState(newState);
 		if (this.#kv.cas == null) {
-			if (newState == null) await this.#kv.delete(key);
-			else await this.#kv.set(key, newState);
+			if (storedState == null) await this.#kv.delete(key);
+			else await this.#kv.set(key, storedState, this.#setOptions());
 			return true;
 		}
-		return await this.#kv.cas(key, oldState, newState);
+		return await this.#kv.cas(key, oldState, storedState, storedState == null ? void 0 : this.#setOptions());
+	}
+	#setOptions() {
+		return this.#options.stateTtl == null ? void 0 : { ttl: this.#options.stateTtl };
 	}
 	async #notifyStateChange(remoteHost, previousState, newState) {
 		try {
@@ -955,18 +1064,25 @@ var CircuitBreaker = class {
 * @param options The public circuit breaker options supplied to Fedify.
 * @returns The normalized failure predicate, failure pruning function,
 * duration values, and optional callbacks with defaults applied.
-* @throws {RangeError} If any configured duration is not positive.
+* @throws {RangeError} If any configured duration is not positive, or if
+* `stateTtl` is shorter than `recoveryDelay`.
 * @throws {TypeError} If `failureThreshold` is not a positive integer.
 */
 function normalizeCircuitBreakerOptions(options) {
 	const recoveryDelay = toInstantDuration(options.recoveryDelay ?? { minutes: 30 });
 	const heldActivityTtl = toInstantDuration(options.heldActivityTtl ?? { hours: 168 });
 	const releaseInterval = toInstantDuration(options.releaseInterval ?? { seconds: 1 });
+	const configuredStateTtl = options.stateTtl == null ? void 0 : toInstantDuration(options.stateTtl);
 	assertPositiveDuration(recoveryDelay, "recoveryDelay");
 	assertPositiveDuration(heldActivityTtl, "heldActivityTtl");
 	assertPositiveDuration(releaseInterval, "releaseInterval");
+	if (configuredStateTtl != null) {
+		assertPositiveDuration(configuredStateTtl, "stateTtl");
+		if (Temporal.Duration.compare(configuredStateTtl, recoveryDelay) < 0) throw new RangeError("stateTtl must be at least recoveryDelay.");
+	}
 	let failure;
 	let pruneFailures;
+	let stateTtl;
 	if (options.failure == null) {
 		const failureThreshold = options.failureThreshold ?? 5;
 		if (!Number.isInteger(failureThreshold) || failureThreshold <= 0) throw new TypeError("failureThreshold must be a positive integer.");
@@ -982,9 +1098,11 @@ function normalizeCircuitBreakerOptions(options) {
 			const last = timestamps[timestamps.length - 1];
 			return Temporal.Duration.compare(first.until(last), failureWindow) <= 0;
 		};
+		stateTtl = configuredStateTtl ?? maxDuration(recoveryDelay.add(failureWindow), recoveryDelay.add(heldActivityTtl));
 	} else {
 		failure = options.failure;
-		pruneFailures = (timestamps) => timestamps.slice(-MAX_CUSTOM_FAILURE_HISTORY);
+		pruneFailures = (timestamps) => timestamps.slice(-100);
+		stateTtl = configuredStateTtl;
 	}
 	return {
 		failure,
@@ -992,10 +1110,72 @@ function normalizeCircuitBreakerOptions(options) {
 		recoveryDelay,
 		heldActivityTtl,
 		releaseInterval,
+		stateTtl,
 		onStateChange: options.onStateChange,
 		onActivityDrop: options.onActivityDrop
 	};
 }
+function maxDuration(duration, ...durations) {
+	return durations.reduce((max, candidate) => Temporal.Duration.compare(candidate, max) > 0 ? candidate : max, duration);
+}
+function isLegacySweepDone(value, now) {
+	return getLegacySweepDoneUntil(value, now) != null;
+}
+function getLegacySweepDoneUntil(value, now) {
+	if (typeof value !== "object" || value == null || !("state" in value)) return;
+	if (value.state === "final") return "final";
+	if (value.state === "done" && "retryUntil" in value && typeof value.retryUntil === "string") try {
+		const retryUntil = Temporal.Instant.from(value.retryUntil);
+		return Temporal.Instant.compare(now, retryUntil) < 0 ? retryUntil : void 0;
+	} catch {
+		return;
+	}
+}
+function isLegacySweepRetryDue(value, now) {
+	if (typeof value !== "object" || value == null || !("state" in value) || value.state !== "done" || !("retryUntil" in value) || typeof value.retryUntil !== "string") return false;
+	try {
+		return Temporal.Instant.compare(now, Temporal.Instant.from(value.retryUntil)) >= 0;
+	} catch {
+		return false;
+	}
+}
+function isLegacySweepActive(value, now) {
+	return isLegacySweepDone(value, now) || isLegacySweepInProgress(value, now);
+}
+function isLegacySweepInProgress(value, now) {
+	if (typeof value !== "object" || value == null || !("state" in value) || value.state !== "sweeping" || !("started" in value) || typeof value.started !== "string") return false;
+	try {
+		return Temporal.Instant.compare(now, Temporal.Instant.from(value.started).add(LEGACY_SWEEP_LOCK_TTL)) < 0;
+	} catch {
+		return false;
+	}
+}
+function getLegacySweepRetryUntil(value) {
+	if (typeof value !== "object" || value == null || !("retryUntil" in value) || typeof value.retryUntil !== "string") return;
+	try {
+		Temporal.Instant.from(value.retryUntil);
+		return value.retryUntil;
+	} catch {
+		return;
+	}
+}
+function isCurrentCircuitBreakerState(value) {
+	return typeof value === "object" && value != null && "__fedifyCircuitBreakerStateVersion" in value && value.__fedifyCircuitBreakerStateVersion === CIRCUIT_BREAKER_STATE_VERSION;
+}
+function markCircuitBreakerState(state) {
+	return {
+		...state,
+		__fedifyCircuitBreakerStateVersion: CIRCUIT_BREAKER_STATE_VERSION
+	};
+}
+function stripStoredCircuitBreakerState(state) {
+	if (state == null) return void 0;
+	const { __fedifyCircuitBreakerStateVersion: _, ...publicState } = state;
+	return publicState;
+}
+function delay(milliseconds) {
+	return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
 function toInstantDuration(duration) {
 	const parsed = Temporal.Duration.from(duration);
 	return Temporal.Duration.from({ milliseconds: Math.trunc(parsed.total({
@@ -1030,6 +1210,9 @@ function parseHeldSince(value) {
 * valid instant strings, or `undefined` when the stored value is malformed.
 */
 function parseCircuitBreakerKvState(value) {
+	return stripStoredCircuitBreakerState(parseStoredCircuitBreakerKvState(value));
+}
+function parseStoredCircuitBreakerKvState(value) {
 	const isInstantString = (v) => {
 		if (typeof v !== "string") return false;
 		try {
@@ -1049,7 +1232,8 @@ function parseCircuitBreakerKvState(value) {
 		state: record.state,
 		failures: record.failures,
 		...record.opened == null ? {} : { opened: record.opened },
-		...record.halfOpened == null ? {} : { halfOpened: record.halfOpened }
+		...record.halfOpened == null ? {} : { halfOpened: record.halfOpened },
+		...record.__fedifyCircuitBreakerStateVersion === CIRCUIT_BREAKER_STATE_VERSION ? { __fedifyCircuitBreakerStateVersion: CIRCUIT_BREAKER_STATE_VERSION } : {}
 	};
 }
 //#endregion
@@ -1064,7 +1248,7 @@ function parseCircuitBreakerKvState(value) {
 async function digest(uris) {
 	const processed = /* @__PURE__ */ new Set();
 	const encoder = new TextEncoder();
-	const result = new Uint8Array(32);
+	const result = /* @__PURE__ */ new Uint8Array(32);
 	for (const uri of uris) {
 		const u = uri instanceof URL ? uri.href : uri;
 		if (processed.has(u)) continue;
@@ -1459,7 +1643,7 @@ function isMalformedDurationLiteral(value) {
 		return true;
 	}
 }
-const TEMPORAL_DATE_TIME_IRIS = new Set([
+const TEMPORAL_DATE_TIME_IRIS = /* @__PURE__ */ new Set([
 	"https://www.w3.org/ns/activitystreams#deleted",
 	"https://www.w3.org/ns/activitystreams#endTime",
 	"https://www.w3.org/ns/activitystreams#published",
@@ -1468,7 +1652,7 @@ const TEMPORAL_DATE_TIME_IRIS = new Set([
 	"http://purl.org/dc/terms/created",
 	"https://w3id.org/security#created"
 ]);
-const TEMPORAL_DURATION_IRIS = new Set(["https://www.w3.org/ns/activitystreams#duration"]);
+const TEMPORAL_DURATION_IRIS = /* @__PURE__ */ new Set(["https://www.w3.org/ns/activitystreams#duration"]);
 const QUESTION_CLOSED_IRI = "https://www.w3.org/ns/activitystreams#closed";
 const XSD_DATE_TIME_IRI = "http://www.w3.org/2001/XMLSchema#dateTime";
 function hasMalformedExpandedDateTimeLiteral(value) {
@@ -1612,7 +1796,7 @@ async function handleObject(request, { values, context, objectDispatcher, author
 		Vary: "Accept"
 	} });
 }
-const BUILT_IN_COLLECTION_METRIC_KINDS = new Set([
+const BUILT_IN_COLLECTION_METRIC_KINDS = /* @__PURE__ */ new Set([
 	"inbox",
 	"outbox",
 	"following",
@@ -3223,7 +3407,7 @@ async function respondWithObjectIfAcceptable(object, request, options) {
 	return response;
 }
 function generateNonce() {
-	const bytes = new Uint8Array(16);
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
 	crypto.getRandomValues(bytes);
 	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
@@ -4099,6 +4283,24 @@ const logger = getLogger([
 	"webfinger",
 	"server"
 ]);
+function getWebFingerSubjectAndAliases({ resourceUrl, actorUri, preferredUsername, acctUsername, host, contextHost }) {
+	const aliases = [];
+	let subject = resourceUrl.href;
+	if (resourceUrl.protocol != "acct:" && preferredUsername != null) {
+		aliases.push(`acct:${preferredUsername}@${host ?? contextHost}`);
+		if (host != null && host !== contextHost) aliases.push(`acct:${preferredUsername}@${contextHost}`);
+	}
+	if (resourceUrl.href !== actorUri.href) aliases.push(actorUri.href);
+	if (resourceUrl.protocol === "acct:" && host != null && host !== contextHost && !resourceUrl.href.endsWith(`@${host}`)) {
+		subject = `acct:${preferredUsername ?? acctUsername}@${host}`;
+		aliases.push(resourceUrl.href);
+		if (preferredUsername != null && preferredUsername !== "" && preferredUsername !== acctUsername) aliases.push(`acct:${preferredUsername}@${contextHost}`);
+	}
+	return {
+		subject,
+		aliases
+	};
+}
 /**
 * Handles a WebFinger request.  You would not typically call this function
 * directly, but instead use {@link Federation.fetch} method.
@@ -4147,7 +4349,7 @@ async function handleWebFinger(request, options) {
 		});
 	}
 }
-const WEBFINGER_HANDLE_SCHEME_WHITELIST = new Set([
+const WEBFINGER_HANDLE_SCHEME_WHITELIST = /* @__PURE__ */ new Set([
 	"acct",
 	"http",
 	"https",
@@ -4203,6 +4405,7 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		return identifier;
 	}
 	let identifier = null;
+	let acctUsername = null;
 	const uriParsed = context.parseUri(resourceUrl);
 	if (uriParsed?.type != "actor") {
 		const match = /^acct:([^@]+)@([^@]+)$/.exec(resource);
@@ -4216,8 +4419,9 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 			const normalizedHost = portMatch == null ? domainToASCII(match[2].toLowerCase()) : domainToASCII(match[2].substring(0, portMatch.index).toLowerCase()) + portMatch[0];
 			if (normalizedHost != context.url.host && normalizedHost != host) return await onNotFound(request);
 			else {
-				identifier = await mapUsernameToIdentifier(match[1]);
-				resourceUrl = new URL(`acct:${match[1]}@${normalizedHost}`);
+				acctUsername = match[1];
+				identifier = await mapUsernameToIdentifier(acctUsername);
+				resourceUrl = new URL(`acct:${acctUsername}@${normalizedHost}`);
 			}
 		}
 	} else identifier = uriParsed.identifier;
@@ -4231,9 +4435,10 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		status: 410,
 		headers: { "Access-Control-Allow-Origin": "*" }
 	});
+	const actorUri = context.getActorUri(identifier);
 	const links = [{
 		rel: "self",
-		href: context.getActorUri(identifier).href,
+		href: actorUri.href,
 		type: "application/activity+json"
 	}];
 	for (const url of actor.urls) if (url instanceof Link && url.href != null) links.push({
@@ -4257,23 +4462,19 @@ async function handleWebFingerInternal(request, { context, host, actorDispatcher
 		const customLinks = await webFingerLinksDispatcher(context, resourceUrl);
 		if (customLinks != null) for (const link of customLinks) links.push(link);
 	}
-	const aliases = [];
-	const preferredUsername = actor.preferredUsername;
-	if (resourceUrl.protocol != "acct:" && preferredUsername != null) {
-		aliases.push(`acct:${preferredUsername}@${host ?? context.url.host}`);
-		if (host != null && host !== context.url.host) aliases.push(`acct:${preferredUsername}@${context.url.host}`);
-	}
-	if (resourceUrl.href !== context.getActorUri(identifier).href) aliases.push(context.getActorUri(identifier).href);
-	if (resourceUrl.protocol === "acct:" && host != null && host !== context.url.host && !resourceUrl.href.endsWith(`@${host}`)) {
-		const username = resourceUrl.href.replace(/^acct:/, "").replace(/@.*$/, "");
-		aliases.push(`acct:${username}@${host}`);
-	}
-	const jrd = {
-		subject: resourceUrl.href,
+	const { subject, aliases } = getWebFingerSubjectAndAliases({
+		resourceUrl,
+		actorUri,
+		preferredUsername: actor.preferredUsername,
+		acctUsername,
+		host,
+		contextHost: context.url.host
+	});
+	return new Response(JSON.stringify({
+		subject,
 		aliases,
 		links
-	};
-	return new Response(JSON.stringify(jrd), { headers: {
+	}), { headers: {
 		"Content-Type": "application/jrd+json",
 		"Access-Control-Allow-Origin": "*"
 	} });
@@ -7132,4 +7333,4 @@ function getRequestId(request) {
 	return `req_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
 }
 //#endregion
-export { SendActivityError as a, buildCollectionSynchronizationHeader as c, normalizeCircuitBreakerOptions as d, parseCircuitBreakerKvState as f, createExponentialBackoffPolicy as i, digest as l, middleware_exports as n, respondWithObject as o, createFederationBuilder as p, handleWebFinger as r, respondWithObjectIfAcceptable as s, createFederation as t, CircuitBreaker as u };
+export { respondWithObject as a, digest as c, parseCircuitBreakerKvState as d, createFederationBuilder as f, SendActivityError as i, CircuitBreaker as l, handleWebFinger as n, respondWithObjectIfAcceptable as o, createExponentialBackoffPolicy as r, buildCollectionSynchronizationHeader as s, createFederation as t, normalizeCircuitBreakerOptions as u };

package/dist/{middleware-C4oS_tdq.mjs → middleware-LPbZz6-1.mjs}

@@ -1,5 +1,5 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as FederationImpl } from "./middleware-BEd40QBF.mjs";
+import { n as FederationImpl } from "./middleware-C9Y5lLZN.mjs";
 export { FederationImpl };

package/dist/{mod-BrpVsSfY.d.cts → mod-CLHkCwLm.d.cts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
-import { n as HttpMessageSignaturesSpecDeterminer } from "./http-VyDTd4G3.cjs";
-import { n as KvStore, t as KvKey } from "./kv-gJ8LYbxX.cjs";
-import { t as DocumentFetchKind } from "./metrics-DN13mCAw.cjs";
+import { n as HttpMessageSignaturesSpecDeterminer } from "./http-6TI0tI03.cjs";
+import { n as KvStore, t as KvKey } from "./kv-BhNbN8Ed.cjs";
+import { t as DocumentFetchKind } from "./metrics-DVKYY6K1.cjs";
 import { DocumentLoader, DocumentLoaderFactoryOptions } from "@fedify/vocab-runtime";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 

package/dist/{mod-B0hW12_O.d.cts → mod-CuDDaIIt.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { S as KeyCache } from "./http-VyDTd4G3.cjs";
+import { S as KeyCache } from "./http-6TI0tI03.cjs";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { DocumentLoader } from "@fedify/vocab-runtime";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";

package/dist/{mod-COIAjwRS.d.ts → mod-D-IhOEOP.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { S as KeyCache } from "./http-lf8Hsd91.js";
+import { S as KeyCache } from "./http-CdrSn2ip.js";
 import { CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader } from "@fedify/vocab-runtime";

package/dist/{mod-DdONo-ep.d.cts → mod-D-abvu2C.d.cts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Mt as WebFingerLinksDispatcher, ct as ActorAliasMapper, l as RequestContext, lt as ActorDispatcher, ut as ActorHandleMapper } from "./context-C05Rgxmu.cjs";
+import { _t as ActorHandleMapper, gt as ActorDispatcher, ht as ActorAliasMapper, l as RequestContext, zt as WebFingerLinksDispatcher } from "./context-B-dsBjZ9.cjs";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 

package/dist/{mod-BsCE5Ihq.d.ts → mod-D6O8C7eN.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { Mt as WebFingerLinksDispatcher, ct as ActorAliasMapper, l as RequestContext, lt as ActorDispatcher, ut as ActorHandleMapper } from "./context-Cjnr0ig1.js";
+import { _t as ActorHandleMapper, gt as ActorDispatcher, ht as ActorAliasMapper, l as RequestContext, zt as WebFingerLinksDispatcher } from "./context-DrLXudbA.js";
 import { RouterError, RouterOptions, RouterRouteResult } from "@fedify/uri-template";
 import { MeterProvider, Span, Tracer } from "@opentelemetry/api";
 

package/dist/{mod-CNef4in0.d.ts → mod-DypxPS9H.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
-import { n as HttpMessageSignaturesSpecDeterminer } from "./http-lf8Hsd91.js";
-import { n as KvStore, t as KvKey } from "./kv-D6hNiMTK.js";
-import { t as DocumentFetchKind } from "./metrics-v_e0n5GQ.js";
+import { n as HttpMessageSignaturesSpecDeterminer } from "./http-CdrSn2ip.js";
+import { n as KvStore, t as KvKey } from "./kv-BhNbN8Ed.js";
+import { t as DocumentFetchKind } from "./metrics-DoRtI0qU.js";
 import { MeterProvider, TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader, DocumentLoaderFactoryOptions } from "@fedify/vocab-runtime";
 

package/dist/mod.cjs

@@ -1,37 +1,36 @@
 const { URLPattern } = require("urlpattern-polyfill");
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("./chunk-Czpeue4M.cjs");
-const require_transformers = require("./transformers-DGwl-hD1.cjs");
+require("./rolldown-runtime-Dmm3t92W.cjs");
+const require_transformers = require("./transformers-BalCrSsr.cjs");
 require("./compat/mod.cjs");
-const require_http = require("./http-BIJdA1mF.cjs");
-const require_middleware = require("./middleware-Dnzqy4sk.cjs");
-const require_proof = require("./proof-DcbeTQMG.cjs");
-const require_types = require("./types-CPym83zc.cjs");
-const require_kv_cache = require("./kv-cache-BPapnm-V.cjs");
-const require_federation_mod = require("./federation/mod.cjs");
+const require_http = require("./http-AyKngJ_h.cjs");
+const require_federation = require("./federation-BzRjeOky.cjs");
+const require_proof = require("./proof-DcSm-2eG.cjs");
+const require_types = require("./types-RXm5YxpC.cjs");
+const require_kv_cache = require("./kv-cache-BTVaZrf-.cjs");
 require("./nodeinfo/mod.cjs");
 require("./runtime/mod.cjs");
 require("./sig/mod.cjs");
 require("./utils/mod.cjs");
 //#endregion
-exports.CircuitBreaker = require_middleware.CircuitBreaker;
-exports.InProcessMessageQueue = require_federation_mod.InProcessMessageQueue;
-exports.MemoryKvStore = require_federation_mod.MemoryKvStore;
-exports.ParallelMessageQueue = require_federation_mod.ParallelMessageQueue;
-exports.Router = require_federation_mod.Router;
-exports.RouterError = require_federation_mod.RouterError;
-exports.SendActivityError = require_middleware.SendActivityError;
+exports.CircuitBreaker = require_federation.CircuitBreaker;
+exports.InProcessMessageQueue = require_federation.InProcessMessageQueue;
+exports.MemoryKvStore = require_federation.MemoryKvStore;
+exports.ParallelMessageQueue = require_federation.ParallelMessageQueue;
+exports.Router = require_federation.Router;
+exports.RouterError = require_federation.RouterError;
+exports.SendActivityError = require_federation.SendActivityError;
 exports.actorDehydrator = require_transformers.actorDehydrator;
 exports.attachSignature = require_proof.attachSignature;
 exports.autoIdAssigner = require_transformers.autoIdAssigner;
-exports.buildCollectionSynchronizationHeader = require_middleware.buildCollectionSynchronizationHeader;
-exports.createExponentialBackoffPolicy = require_middleware.createExponentialBackoffPolicy;
-exports.createFederation = require_middleware.createFederation;
-exports.createFederationBuilder = require_middleware.createFederationBuilder;
+exports.buildCollectionSynchronizationHeader = require_federation.buildCollectionSynchronizationHeader;
+exports.createExponentialBackoffPolicy = require_federation.createExponentialBackoffPolicy;
+exports.createFederation = require_federation.createFederation;
+exports.createFederationBuilder = require_federation.createFederationBuilder;
 exports.createProof = require_proof.createProof;
 exports.createSignature = require_proof.createSignature;
 exports.detachSignature = require_proof.detachSignature;
-exports.digest = require_middleware.digest;
+exports.digest = require_federation.digest;
 exports.doesActorOwnKey = require_proof.doesActorOwnKey;
 exports.exportJwk = require_http.exportJwk;
 exports.fetchKey = require_http.fetchKey;
@@ -43,18 +42,18 @@ exports.getAuthenticatedDocumentLoader = require_kv_cache.getAuthenticatedDocume
 exports.getDefaultActivityTransformers = require_transformers.getDefaultActivityTransformers;
 exports.getKeyOwner = require_proof.getKeyOwner;
 exports.getNodeInfo = require_types.getNodeInfo;
-exports.handleWebFinger = require_middleware.handleWebFinger;
+exports.handleWebFinger = require_federation.handleWebFinger;
 exports.hasProofLike = require_proof.hasProofLike;
 exports.hasSignatureLike = require_proof.hasSignatureLike;
 exports.importJwk = require_http.importJwk;
 exports.kvCache = require_kv_cache.kvCache;
 exports.nodeInfoToJson = require_types.nodeInfoToJson;
-exports.normalizeCircuitBreakerOptions = require_middleware.normalizeCircuitBreakerOptions;
+exports.normalizeCircuitBreakerOptions = require_federation.normalizeCircuitBreakerOptions;
 exports.parseAcceptSignature = require_http.parseAcceptSignature;
-exports.parseCircuitBreakerKvState = require_middleware.parseCircuitBreakerKvState;
+exports.parseCircuitBreakerKvState = require_federation.parseCircuitBreakerKvState;
 exports.parseNodeInfo = require_types.parseNodeInfo;
-exports.respondWithObject = require_middleware.respondWithObject;
-exports.respondWithObjectIfAcceptable = require_middleware.respondWithObjectIfAcceptable;
+exports.respondWithObject = require_federation.respondWithObject;
+exports.respondWithObjectIfAcceptable = require_federation.respondWithObjectIfAcceptable;
 exports.signJsonLd = require_proof.signJsonLd;
 exports.signObject = require_proof.signObject;
 exports.signRequest = require_http.signRequest;