@fedify/fedify 2.5.0-dev.2597 → 2.5.0-dev.2614

package/dist/{http-DQP4rw46.js → http-C2H4DT6t.js}

@@ -1,9 +1,9 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { getLogger } from "@logtape/logtape";
+import { FetchError, UrlError, canonicalizePortableUri, encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, isTransientFetchError, parseDidKeyVerificationMethod, parseGatewayUrl, parseIri, preloadedContexts, toCompatibleEf61Id } from "@fedify/vocab-runtime";
 import { Activity, CryptographicKey, DataIntegrityProof, Multikey, Object as Object$1, PUBLIC_COLLECTION, getTypeId, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, metrics, trace } from "@opentelemetry/api";
-import { FetchError, UrlError, canonicalizePortableUri, encodeMultibase, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, isGatewayUrl, isTransientFetchError, parseDidKeyVerificationMethod, parseGatewayUrl, parseIri, preloadedContexts, toCompatibleEf61Id } from "@fedify/vocab-runtime";
 import { getPortableGatewayCandidates, isCompatibleEf61Iri } from "@fedify/vocab-runtime/internal/portable-dereference";
 import { encodeHex } from "byte-encodings/hex";
 import jsonld from "@fedify/vocab-runtime/jsonld";
@@ -15,7 +15,7 @@ import serialize from "json-canon";
 import { ATTR_HTTP_REQUEST_HEADER, ATTR_HTTP_REQUEST_METHOD, ATTR_URL_FULL } from "@opentelemetry/semantic-conventions";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.5.0-dev.2597+7bed9e2b";
+var version = "2.5.0-dev.2614+a776599e";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -6595,13 +6595,29 @@ async function createRedirectRequest(request, location, body, validateRedirect)
 		cache: request.cache
 	});
 }
-async function fetchDoubleKnockRequest(session, request, signedRequest, signal) {
+function observeDoubleKnockOperation(observation, phase, operation) {
+	if (observation == null) return operation();
+	try {
+		return Promise.resolve(operation()).catch((error) => {
+			observation.error(phase, error);
+			throw error;
+		});
+	} catch (error) {
+		observation.error(phase, error);
+		throw error;
+	}
+}
+function submitDoubleKnockRequest(session, request, signal, observation) {
+	const submit = () => session.fetch(request, {
+		redirect: "manual",
+		signal
+	});
+	return observation == null ? submit() : observation.fetch(request, submit);
+}
+async function fetchDoubleKnockRequest(session, request, signedRequest, signal, observation) {
 	const maxAttempts = request.method === "GET" || request.method === "HEAD" ? 2 : 1;
 	for (let attempt = 1;; attempt++) try {
-		return await session.fetch(signedRequest, {
-			redirect: "manual",
-			signal
-		});
+		return await submitDoubleKnockRequest(session, signedRequest, signal, observation);
 	} catch (error) {
 		const abortedSignal = getAbortedSignal(signal, request.signal, signedRequest.signal);
 		if (abortedSignal != null) throw getAbortReason(abortedSignal);
@@ -6660,10 +6676,11 @@ function getAbortReason(signal) {
 * @param openHop The function to open a session for each hop.  The session of
 *                a hop is closed before the next hop is opened.
 * @param consume The function to consume the final response.
+* @param observation The in-process transport/finality hooks, if registered.
 * @returns The value returned by `consume`.
 */
-async function doubleKnockScoped(request, identity, options, openHop, consume) {
-	const { response, session } = await doubleKnockCore(request, identity, options, openHop);
+async function doubleKnockScoped(request, identity, options, openHop, consume, observation) {
+	const { response, session } = await doubleKnockCore(request, identity, options, openHop, observation);
 	try {
 		return await consume(response);
 	} catch (error) {
@@ -6702,7 +6719,7 @@ function cancelResponseBody(response, url) {
 		});
 	});
 }
-async function doubleKnockCore(request, identity, options, openHop) {
+async function doubleKnockCore(request, identity, options, openHop, observation) {
 	const { specDeterminer, log, tracerProvider, signal } = options;
 	signal?.throwIfAborted();
 	const maximumRedirection = options.maxRedirection ?? DEFAULT_MAX_REDIRECTION;
@@ -6713,16 +6730,16 @@ async function doubleKnockCore(request, identity, options, openHop) {
 		for (let redirected = 0;; redirected++) {
 			visited.add(request.url);
 			const origin = new URL(request.url).origin;
-			const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
+			const firstTrySpec = specDeterminer == null ? "rfc9421" : await observeDoubleKnockOperation(observation, "spec-lookup", () => specDeterminer.determineSpec(origin));
 			signal?.throwIfAborted();
-			let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+			let signedRequest = await observeDoubleKnockOperation(observation, "signing", () => signRequest(request, identity.privateKey, identity.keyId, {
 				spec: firstTrySpec,
 				tracerProvider,
 				body
-			});
+			}));
 			signal?.throwIfAborted();
 			log?.(signedRequest);
-			let response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
+			let response = await fetchDoubleKnockRequest(session, request, signedRequest, signal, observation);
 			const firstRedirected = isRedirectResponse(response);
 			if (!firstRedirected && (response.status === 400 || response.status === 401 || response.status > 401)) {
 				const logger = getLogger([
@@ -6761,30 +6778,33 @@ async function doubleKnockCore(request, identity, options, openHop) {
 						}
 					}
 					if (fulfilled && challengeRequest != null) {
+						observation?.response(response, "intermediate");
 						signal?.throwIfAborted();
 						cancelResponseBody(response, request.url);
 						signedRequest = challengeRequest;
 						log?.(signedRequest);
-						response = await session.fetch(signedRequest, {
-							redirect: "manual",
-							signal
-						});
+						response = await submitDoubleKnockRequest(session, signedRequest, signal, observation);
 					}
 					if (fulfilled && !isRedirectResponse(response)) {
 						if (response.status < 300) {
-							await specDeterminer?.rememberSpec(origin, "rfc9421");
+							observation?.response(response, "final");
+							await observeDoubleKnockOperation(observation, "post-response", () => specDeterminer?.rememberSpec(origin, "rfc9421") ?? Promise.resolve());
+							return {
+								response,
+								session
+							};
+						}
+						if (response.status !== 400 && response.status !== 401) {
+							observation?.response(response, "final");
 							return {
 								response,
 								session
 							};
 						}
-						if (response.status !== 400 && response.status !== 401) return {
-							response,
-							session
-						};
 					}
 				}
 				if (!isRedirectResponse(response)) {
+					observation?.response(response, "intermediate");
 					const spec = firstTrySpec === "draft-cavage-http-signatures-12" ? "rfc9421" : "draft-cavage-http-signatures-12";
 					getLogger([
 						"fedify",
@@ -6798,21 +6818,31 @@ async function doubleKnockCore(request, identity, options, openHop) {
 					});
 					cancelResponseBody(response, request.url);
 					signal?.throwIfAborted();
-					signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+					signedRequest = await observeDoubleKnockOperation(observation, "signing", () => signRequest(request, identity.privateKey, identity.keyId, {
 						spec,
 						tracerProvider,
 						body
-					});
+					}));
 					signal?.throwIfAborted();
 					log?.(signedRequest);
-					response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
-					if (!isRedirectResponse(response) && response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
+					response = await fetchDoubleKnockRequest(session, request, signedRequest, signal, observation);
+					if (!isRedirectResponse(response) && response.status !== 400 && response.status !== 401) {
+						observation?.response(response, "final");
+						await observeDoubleKnockOperation(observation, "post-response", () => specDeterminer?.rememberSpec(origin, spec) ?? Promise.resolve());
+					}
 				}
-			} else if (!firstRedirected) await specDeterminer?.rememberSpec(origin, firstTrySpec);
-			if (!isRedirectResponse(response)) return {
-				response,
-				session
-			};
+			} else if (!firstRedirected) {
+				observation?.response(response, "final");
+				await observeDoubleKnockOperation(observation, "post-response", () => specDeterminer?.rememberSpec(origin, firstTrySpec) ?? Promise.resolve());
+			}
+			if (!isRedirectResponse(response)) {
+				observation?.response(response, "final");
+				return {
+					response,
+					session
+				};
+			}
+			observation?.response(response, "intermediate");
 			cancelResponseBody(response, request.url);
 			await session.close();
 			if (redirected >= maximumRedirection) throw new FetchError(request.url, `Too many redirections (${redirected + 1})`);

package/dist/{http-KU7_TLD9.cjs → http-DHSIMipE.cjs}

@@ -1,9 +1,9 @@
 const { URLPattern } = require("urlpattern-polyfill");
 const require_rolldown_runtime = require("./rolldown-runtime-Dmm3t92W.cjs");
 let _logtape_logtape = require("@logtape/logtape");
+let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
-let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let _fedify_vocab_runtime_internal_portable_dereference = require("@fedify/vocab-runtime/internal/portable-dereference");
 let byte_encodings_hex = require("byte-encodings/hex");
 let _fedify_vocab_runtime_jsonld = require("@fedify/vocab-runtime/jsonld");
@@ -17,7 +17,7 @@ json_canon = require_rolldown_runtime.__toESM(json_canon, 1);
 let _opentelemetry_semantic_conventions = require("@opentelemetry/semantic-conventions");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.5.0-dev.2597+7bed9e2b";
+var version = "2.5.0-dev.2614+a776599e";
 //#endregion
 //#region src/sig/portable-key-id.ts
 const COMPATIBLE_KEY_ID_PATH_PATTERN = /^\/\.well-known\/apgateway\/did(?::|%3A)/i;
@@ -10165,13 +10165,29 @@ async function createRedirectRequest(request, location, body, validateRedirect)
 		cache: request.cache
 	});
 }
-async function fetchDoubleKnockRequest(session, request, signedRequest, signal) {
+function observeDoubleKnockOperation(observation, phase, operation) {
+	if (observation == null) return operation();
+	try {
+		return Promise.resolve(operation()).catch((error) => {
+			observation.error(phase, error);
+			throw error;
+		});
+	} catch (error) {
+		observation.error(phase, error);
+		throw error;
+	}
+}
+function submitDoubleKnockRequest(session, request, signal, observation) {
+	const submit = () => session.fetch(request, {
+		redirect: "manual",
+		signal
+	});
+	return observation == null ? submit() : observation.fetch(request, submit);
+}
+async function fetchDoubleKnockRequest(session, request, signedRequest, signal, observation) {
 	const maxAttempts = request.method === "GET" || request.method === "HEAD" ? 2 : 1;
 	for (let attempt = 1;; attempt++) try {
-		return await session.fetch(signedRequest, {
-			redirect: "manual",
-			signal
-		});
+		return await submitDoubleKnockRequest(session, signedRequest, signal, observation);
 	} catch (error) {
 		const abortedSignal = getAbortedSignal(signal, request.signal, signedRequest.signal);
 		if (abortedSignal != null) throw getAbortReason(abortedSignal);
@@ -10230,10 +10246,11 @@ function getAbortReason(signal) {
 * @param openHop The function to open a session for each hop.  The session of
 *                a hop is closed before the next hop is opened.
 * @param consume The function to consume the final response.
+* @param observation The in-process transport/finality hooks, if registered.
 * @returns The value returned by `consume`.
 */
-async function doubleKnockScoped(request, identity, options, openHop, consume) {
-	const { response, session } = await doubleKnockCore(request, identity, options, openHop);
+async function doubleKnockScoped(request, identity, options, openHop, consume, observation) {
+	const { response, session } = await doubleKnockCore(request, identity, options, openHop, observation);
 	try {
 		return await consume(response);
 	} catch (error) {
@@ -10272,7 +10289,7 @@ function cancelResponseBody(response, url) {
 		});
 	});
 }
-async function doubleKnockCore(request, identity, options, openHop) {
+async function doubleKnockCore(request, identity, options, openHop, observation) {
 	const { specDeterminer, log, tracerProvider, signal } = options;
 	signal?.throwIfAborted();
 	const maximumRedirection = options.maxRedirection ?? DEFAULT_MAX_REDIRECTION;
@@ -10283,16 +10300,16 @@ async function doubleKnockCore(request, identity, options, openHop) {
 		for (let redirected = 0;; redirected++) {
 			visited.add(request.url);
 			const origin = new URL(request.url).origin;
-			const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
+			const firstTrySpec = specDeterminer == null ? "rfc9421" : await observeDoubleKnockOperation(observation, "spec-lookup", () => specDeterminer.determineSpec(origin));
 			signal?.throwIfAborted();
-			let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+			let signedRequest = await observeDoubleKnockOperation(observation, "signing", () => signRequest(request, identity.privateKey, identity.keyId, {
 				spec: firstTrySpec,
 				tracerProvider,
 				body
-			});
+			}));
 			signal?.throwIfAborted();
 			log?.(signedRequest);
-			let response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
+			let response = await fetchDoubleKnockRequest(session, request, signedRequest, signal, observation);
 			const firstRedirected = isRedirectResponse(response);
 			if (!firstRedirected && (response.status === 400 || response.status === 401 || response.status > 401)) {
 				const logger = (0, _logtape_logtape.getLogger)([
@@ -10331,30 +10348,33 @@ async function doubleKnockCore(request, identity, options, openHop) {
 						}
 					}
 					if (fulfilled && challengeRequest != null) {
+						observation?.response(response, "intermediate");
 						signal?.throwIfAborted();
 						cancelResponseBody(response, request.url);
 						signedRequest = challengeRequest;
 						log?.(signedRequest);
-						response = await session.fetch(signedRequest, {
-							redirect: "manual",
-							signal
-						});
+						response = await submitDoubleKnockRequest(session, signedRequest, signal, observation);
 					}
 					if (fulfilled && !isRedirectResponse(response)) {
 						if (response.status < 300) {
-							await specDeterminer?.rememberSpec(origin, "rfc9421");
+							observation?.response(response, "final");
+							await observeDoubleKnockOperation(observation, "post-response", () => specDeterminer?.rememberSpec(origin, "rfc9421") ?? Promise.resolve());
+							return {
+								response,
+								session
+							};
+						}
+						if (response.status !== 400 && response.status !== 401) {
+							observation?.response(response, "final");
 							return {
 								response,
 								session
 							};
 						}
-						if (response.status !== 400 && response.status !== 401) return {
-							response,
-							session
-						};
 					}
 				}
 				if (!isRedirectResponse(response)) {
+					observation?.response(response, "intermediate");
 					const spec = firstTrySpec === "draft-cavage-http-signatures-12" ? "rfc9421" : "draft-cavage-http-signatures-12";
 					(0, _logtape_logtape.getLogger)([
 						"fedify",
@@ -10368,21 +10388,31 @@ async function doubleKnockCore(request, identity, options, openHop) {
 					});
 					cancelResponseBody(response, request.url);
 					signal?.throwIfAborted();
-					signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+					signedRequest = await observeDoubleKnockOperation(observation, "signing", () => signRequest(request, identity.privateKey, identity.keyId, {
 						spec,
 						tracerProvider,
 						body
-					});
+					}));
 					signal?.throwIfAborted();
 					log?.(signedRequest);
-					response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
-					if (!isRedirectResponse(response) && response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
+					response = await fetchDoubleKnockRequest(session, request, signedRequest, signal, observation);
+					if (!isRedirectResponse(response) && response.status !== 400 && response.status !== 401) {
+						observation?.response(response, "final");
+						await observeDoubleKnockOperation(observation, "post-response", () => specDeterminer?.rememberSpec(origin, spec) ?? Promise.resolve());
+					}
 				}
-			} else if (!firstRedirected) await specDeterminer?.rememberSpec(origin, firstTrySpec);
-			if (!isRedirectResponse(response)) return {
-				response,
-				session
-			};
+			} else if (!firstRedirected) {
+				observation?.response(response, "final");
+				await observeDoubleKnockOperation(observation, "post-response", () => specDeterminer?.rememberSpec(origin, firstTrySpec) ?? Promise.resolve());
+			}
+			if (!isRedirectResponse(response)) {
+				observation?.response(response, "final");
+				return {
+					response,
+					session
+				};
+			}
+			observation?.response(response, "intermediate");
 			cancelResponseBody(response, request.url);
 			await session.close();
 			if (redirected >= maximumRedirection) throw new _fedify_vocab_runtime.FetchError(request.url, `Too many redirections (${redirected + 1})`);

package/dist/{http-D5n4S1oL.mjs → http-DqOXkYbX.mjs}

@@ -3,12 +3,12 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { m as parseKeyIdString } from "./portable-key-id-Ca30-hOa.mjs";
 import { a as verificationObservation, i as triedKey, n as observeCheck, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
-import { n as version, t as name } from "./deno-4cGKg59R.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-BvV60TwE.mjs";
+import { n as version, t as name } from "./deno-CRXki9-m.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CTteRnEr.mjs";
 import { i as validateAcceptSignature, n as fulfillAcceptSignature, r as parseAcceptSignature } from "./accept-CPVqki78.mjs";
 import { a as promoteKeyOwnerEvidence } from "./key-owner-evidence-APB6NpSk.mjs";
-import { D as validateCryptoKey, b as bypassKeyCacheReads, w as fetchKeyDetailed } from "./ld-CmAQYDWE.mjs";
-import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-jtaxB7TD.mjs";
+import { D as validateCryptoKey, b as bypassKeyCacheReads, w as fetchKeyDetailed } from "./ld-C5JOBBFj.mjs";
+import { n as resolvePortableActorKey, r as verifyPortableGatewayKeyDocument } from "./portable-key-Clg0IH8C.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
@@ -1116,13 +1116,29 @@ async function createRedirectRequest(request, location, body, validateRedirect)
 		cache: request.cache
 	});
 }
-async function fetchDoubleKnockRequest(session, request, signedRequest, signal) {
+function observeDoubleKnockOperation(observation, phase, operation) {
+	if (observation == null) return operation();
+	try {
+		return Promise.resolve(operation()).catch((error) => {
+			observation.error(phase, error);
+			throw error;
+		});
+	} catch (error) {
+		observation.error(phase, error);
+		throw error;
+	}
+}
+function submitDoubleKnockRequest(session, request, signal, observation) {
+	const submit = () => session.fetch(request, {
+		redirect: "manual",
+		signal
+	});
+	return observation == null ? submit() : observation.fetch(request, submit);
+}
+async function fetchDoubleKnockRequest(session, request, signedRequest, signal, observation) {
 	const maxAttempts = request.method === "GET" || request.method === "HEAD" ? 2 : 1;
 	for (let attempt = 1;; attempt++) try {
-		return await session.fetch(signedRequest, {
-			redirect: "manual",
-			signal
-		});
+		return await submitDoubleKnockRequest(session, signedRequest, signal, observation);
 	} catch (error) {
 		const abortedSignal = getAbortedSignal(signal, request.signal, signedRequest.signal);
 		if (abortedSignal != null) throw getAbortReason(abortedSignal);
@@ -1195,10 +1211,11 @@ async function doubleKnock(request, identity, options = {}) {
 * @param openHop The function to open a session for each hop.  The session of
 *                a hop is closed before the next hop is opened.
 * @param consume The function to consume the final response.
+* @param observation The in-process transport/finality hooks, if registered.
 * @returns The value returned by `consume`.
 */
-async function doubleKnockScoped(request, identity, options, openHop, consume) {
-	const { response, session } = await doubleKnockCore(request, identity, options, openHop);
+async function doubleKnockScoped(request, identity, options, openHop, consume, observation) {
+	const { response, session } = await doubleKnockCore(request, identity, options, openHop, observation);
 	try {
 		return await consume(response);
 	} catch (error) {
@@ -1252,7 +1269,7 @@ function cancelResponseBody(response, url) {
 		});
 	});
 }
-async function doubleKnockCore(request, identity, options, openHop) {
+async function doubleKnockCore(request, identity, options, openHop, observation) {
 	const { specDeterminer, log, tracerProvider, signal } = options;
 	signal?.throwIfAborted();
 	const maximumRedirection = options.maxRedirection ?? DEFAULT_MAX_REDIRECTION;
@@ -1263,16 +1280,16 @@ async function doubleKnockCore(request, identity, options, openHop) {
 		for (let redirected = 0;; redirected++) {
 			visited.add(request.url);
 			const origin = new URL(request.url).origin;
-			const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
+			const firstTrySpec = specDeterminer == null ? "rfc9421" : await observeDoubleKnockOperation(observation, "spec-lookup", () => specDeterminer.determineSpec(origin));
 			signal?.throwIfAborted();
-			let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+			let signedRequest = await observeDoubleKnockOperation(observation, "signing", () => signRequest(request, identity.privateKey, identity.keyId, {
 				spec: firstTrySpec,
 				tracerProvider,
 				body
-			});
+			}));
 			signal?.throwIfAborted();
 			log?.(signedRequest);
-			let response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
+			let response = await fetchDoubleKnockRequest(session, request, signedRequest, signal, observation);
 			const firstRedirected = isRedirectResponse(response);
 			if (!firstRedirected && (response.status === 400 || response.status === 401 || response.status > 401)) {
 				const logger = getLogger([
@@ -1311,30 +1328,33 @@ async function doubleKnockCore(request, identity, options, openHop) {
 						}
 					}
 					if (fulfilled && challengeRequest != null) {
+						observation?.response(response, "intermediate");
 						signal?.throwIfAborted();
 						cancelResponseBody(response, request.url);
 						signedRequest = challengeRequest;
 						log?.(signedRequest);
-						response = await session.fetch(signedRequest, {
-							redirect: "manual",
-							signal
-						});
+						response = await submitDoubleKnockRequest(session, signedRequest, signal, observation);
 					}
 					if (fulfilled && !isRedirectResponse(response)) {
 						if (response.status < 300) {
-							await specDeterminer?.rememberSpec(origin, "rfc9421");
+							observation?.response(response, "final");
+							await observeDoubleKnockOperation(observation, "post-response", () => specDeterminer?.rememberSpec(origin, "rfc9421") ?? Promise.resolve());
+							return {
+								response,
+								session
+							};
+						}
+						if (response.status !== 400 && response.status !== 401) {
+							observation?.response(response, "final");
 							return {
 								response,
 								session
 							};
 						}
-						if (response.status !== 400 && response.status !== 401) return {
-							response,
-							session
-						};
 					}
 				}
 				if (!isRedirectResponse(response)) {
+					observation?.response(response, "intermediate");
 					const spec = firstTrySpec === "draft-cavage-http-signatures-12" ? "rfc9421" : "draft-cavage-http-signatures-12";
 					getLogger([
 						"fedify",
@@ -1348,21 +1368,31 @@ async function doubleKnockCore(request, identity, options, openHop) {
 					});
 					cancelResponseBody(response, request.url);
 					signal?.throwIfAborted();
-					signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+					signedRequest = await observeDoubleKnockOperation(observation, "signing", () => signRequest(request, identity.privateKey, identity.keyId, {
 						spec,
 						tracerProvider,
 						body
-					});
+					}));
 					signal?.throwIfAborted();
 					log?.(signedRequest);
-					response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
-					if (!isRedirectResponse(response) && response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
+					response = await fetchDoubleKnockRequest(session, request, signedRequest, signal, observation);
+					if (!isRedirectResponse(response) && response.status !== 400 && response.status !== 401) {
+						observation?.response(response, "final");
+						await observeDoubleKnockOperation(observation, "post-response", () => specDeterminer?.rememberSpec(origin, spec) ?? Promise.resolve());
+					}
 				}
-			} else if (!firstRedirected) await specDeterminer?.rememberSpec(origin, firstTrySpec);
-			if (!isRedirectResponse(response)) return {
-				response,
-				session
-			};
+			} else if (!firstRedirected) {
+				observation?.response(response, "final");
+				await observeDoubleKnockOperation(observation, "post-response", () => specDeterminer?.rememberSpec(origin, firstTrySpec) ?? Promise.resolve());
+			}
+			if (!isRedirectResponse(response)) {
+				observation?.response(response, "final");
+				return {
+					response,
+					session
+				};
+			}
+			observation?.response(response, "intermediate");
 			cancelResponseBody(response, request.url);
 			await session.close();
 			if (redirected >= maximumRedirection) throw new FetchError(request.url, `Too many redirections (${redirected + 1})`);

package/dist/{inbox-CElAglrC.mjs → inbox-C4iW1g0F.mjs}

@@ -3,11 +3,97 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as getAuthenticationOrigin } from "./portable-key-id-Ca30-hOa.mjs";
 import { o as serializeAuthentication, r as getEffectivePrincipals } from "./inbox-authentication-CgonVRkg.mjs";
-import { n as version, t as name } from "./deno-4cGKg59R.mjs";
-import { g as recordInboxActivity, n as getDurationMs, r as getFederationMetrics } from "./metrics-BvV60TwE.mjs";
+import { n as version, t as name } from "./deno-CRXki9-m.mjs";
+import { g as recordInboxActivity, n as getDurationMs, r as getFederationMetrics } from "./metrics-CTteRnEr.mjs";
 import { getLogger } from "@logtape/logtape";
 import { getTypeId } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, context, propagation, trace } from "@opentelemetry/api";
+//#region src/federation/outbound-provenance.ts
+const outboundProvenance = Symbol("outboundProvenance");
+const emptyProvenance = Object.freeze({});
+function getOutboundProvenance(context) {
+	return context[outboundProvenance] ?? emptyProvenance;
+}
+function snapshotLocalContext(context) {
+	return Object.freeze({
+		origin: context.origin,
+		host: context.host,
+		hostname: context.hostname,
+		canonicalOrigin: context.canonicalOrigin
+	});
+}
+function createInboxRequestSource(request, requestId, canonicalOrigin) {
+	const url = new URL(request.url);
+	return Object.freeze({
+		inboxRequestId: crypto.randomUUID(),
+		requestId,
+		context: snapshotLocalContext({
+			origin: url.origin,
+			host: url.host,
+			hostname: url.hostname,
+			canonicalOrigin: canonicalOrigin ?? url.origin
+		})
+	});
+}
+/** The same exact-string budget applies to public input and queued metadata. */
+function validateDispatchId(value) {
+	if (value === void 0) return;
+	if (typeof value !== "string") throw new TypeError("dispatchId must be a string.");
+	if (value.length > 1024 || new TextEncoder().encode(value).byteLength > 1024) throw new RangeError("dispatchId must not exceed 1,024 UTF-8 bytes.");
+}
+/** A new public invocation keeps its HTTP source, with its own dispatch ID. */
+function invocationProvenance(context, dispatchId) {
+	validateDispatchId(dispatchId);
+	const { dispatchId: _previous, ...source } = getOutboundProvenance(context);
+	return Object.freeze({
+		...source,
+		...dispatchId === void 0 ? {} : { dispatchId }
+	});
+}
+/** Restore only explicit source facts; never infer them from queue/trace IDs. */
+function restoreProvenance(value) {
+	if (value === void 0) return emptyProvenance;
+	const record = (v) => v != null && typeof v === "object" && !Array.isArray(v);
+	const invalid = () => /* @__PURE__ */ new TypeError("Invalid provenance in queue metadata.");
+	if (!record(value)) throw invalid();
+	validateDispatchId(value.dispatchId);
+	if (value.originatingRequestId !== void 0 && typeof value.originatingRequestId !== "string") throw invalid();
+	let inboxRequest;
+	if (value.inboxRequest !== void 0) {
+		const source = value.inboxRequest;
+		if (!record(source) || typeof source.inboxRequestId !== "string" || source.inboxRequestId.length < 1 || typeof source.requestId !== "string" || !record(source.context)) throw invalid();
+		const facts = source.context;
+		if (typeof facts.origin !== "string" || typeof facts.host !== "string" || typeof facts.hostname !== "string" || typeof facts.canonicalOrigin !== "string") throw invalid();
+		inboxRequest = Object.freeze({
+			inboxRequestId: source.inboxRequestId,
+			requestId: source.requestId,
+			context: Object.freeze({
+				origin: facts.origin,
+				host: facts.host,
+				hostname: facts.hostname,
+				canonicalOrigin: facts.canonicalOrigin
+			})
+		});
+	}
+	return Object.freeze({
+		...value.dispatchId === void 0 ? {} : { dispatchId: value.dispatchId },
+		...inboxRequest == null ? {} : { inboxRequest },
+		...value.originatingRequestId === void 0 ? {} : { originatingRequestId: value.originatingRequestId }
+	});
+}
+/** Omit absent provenance on legacy and independent producers. */
+function serializeProvenance(value) {
+	const provenance = restoreProvenance(value);
+	return provenance.dispatchId === void 0 && provenance.inboxRequest == null && provenance.originatingRequestId == null ? {} : { provenance };
+}
+function sourceLogContext(source) {
+	return {
+		dispatchId: source.dispatchId,
+		sourceInboxRequestId: source.inboxRequest?.inboxRequestId,
+		sourceRequestId: source.inboxRequest?.requestId ?? source.originatingRequestId
+	};
+}
+//#endregion
 //#region src/federation/inbox.ts
 /**
 * Checks whether an activity's ID and all of its actor IDs have the same
@@ -188,6 +274,7 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 		propagation.inject(context.active(), carrier);
 		message = {
 			type: "inbox",
+			...serializeProvenance(getOutboundProvenance(ctx)),
 			id: crypto.randomUUID(),
 			baseUrl: ctx.origin,
 			activity: originalJson ?? json,
@@ -309,4 +396,4 @@ async function routeActivity({ context: ctx, json, originalJson, normalizedActiv
 	});
 }
 //#endregion
-export { isActorlessActivityAuthenticated as a, getInboxIdempotencyKey as i, checkActorlessActivity as n, isInboxActivityProcessed as o, estimateQueuedMessageSize as r, routeActivity as s, actorsHaveSameOrigin as t };
+export { isActorlessActivityAuthenticated as a, createInboxRequestSource as c, invocationProvenance as d, outboundProvenance as f, sourceLogContext as g, snapshotLocalContext as h, getInboxIdempotencyKey as i, emptyProvenance as l, serializeProvenance as m, checkActorlessActivity as n, isInboxActivityProcessed as o, restoreProvenance as p, estimateQueuedMessageSize as r, routeActivity as s, actorsHaveSameOrigin as t, getOutboundProvenance as u };