@fedify/webfinger 2.5.0-dev.2446 → 2.5.0-dev.2492

package/dist/lookup.test.cjs

@@ -26,9 +26,9 @@ let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let _logtape_logtape = require("@logtape/logtape");
 let es_toolkit = require("es-toolkit");
 let node_assert_strict = require("node:assert/strict");
-let node_dns_promises = require("node:dns/promises");
-node_dns_promises = __toESM(node_dns_promises, 1);
 let _opentelemetry_api = require("@opentelemetry/api");
+let _fedify_vocab_runtime_internal = require("@fedify/vocab-runtime/internal");
+let node_test = require("node:test");
 //#endregion
 //#region ../../node_modules/.pnpm/regexparam@3.0.0/node_modules/regexparam/dist/index.mjs
 var import_glob_to_regexp = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -1237,7 +1237,7 @@ var esm_default = new class FetchMock {
 //#endregion
 //#region deno.json
 var name = "@fedify/webfinger";
-var version = "2.5.0-dev.2446+2014cb03";
+var version = "2.5.0-dev.2492+4648c04e";
 //#endregion
 //#region src/body.ts
 /** Decoded JSON body limit: 16 MiB.  @internal */
@@ -1313,13 +1313,230 @@ async function readBoundedText(message, maxBytes, url) {
 	}
 }
 //#endregion
-//#region src/lookup.ts
+//#region src/lookup-impl.ts
 const logger = (0, _logtape_logtape.getLogger)([
 	"fedify",
 	"webfinger",
 	"lookup"
 ]);
 const DEFAULT_MAX_REDIRECTION = 5;
+/**
+* Looks up a WebFinger resource, opening a fetch session per hop.  This is
+* the implementation of {@link lookupWebFinger}, which is not exported from
+* the package entry point.
+* @param resource The resource URL to look up.
+* @param options Extra options for looking up the resource.
+* @param deps The dependencies.
+* @returns The resource descriptor and terminal lookup classification.
+* @internal
+*/
+async function lookupWebFingerInternal(resource, options = {}, deps = {}) {
+	if (typeof resource === "string") resource = new URL(resource);
+	let protocol = "https:";
+	let server;
+	if (resource.protocol === "acct:" || resource.protocol === "mailto:") {
+		const atPos = resource.pathname.lastIndexOf("@");
+		if (atPos < 0) return {
+			resource: null,
+			result: "invalid"
+		};
+		server = resource.pathname.substring(atPos + 1);
+		if (server === "" || /[/?#]/.test(server)) return {
+			resource: null,
+			result: "invalid"
+		};
+		if (resource.protocol === "acct:" && (resource.search !== "" || resource.hash !== "")) return {
+			resource: null,
+			result: "invalid"
+		};
+	} else {
+		protocol = resource.protocol;
+		server = resource.host;
+	}
+	let url = new URL(`${protocol}//${server}/.well-known/webfinger`);
+	url.searchParams.set("resource", resource.href);
+	const openHop = deps.openHop ?? ((hopUrl) => options.allowPrivateAddress === true ? (0, _fedify_vocab_runtime_internal.openDirectFetch)(hopUrl) : (0, _fedify_vocab_runtime_internal.openPublicFetch)(hopUrl, { signal: options.signal }));
+	let redirected = 0;
+	while (true) {
+		logger.debug("Fetching WebFinger resource descriptor from {url}...", { url: url.href });
+		const remoteHost = url.host;
+		const session = await openSession(url, openHop, options.signal);
+		if (session == null) return {
+			resource: null,
+			result: "network_error",
+			remoteHost
+		};
+		let hop;
+		try {
+			hop = await fetchHop(session, url, options);
+		} finally {
+			await session.close();
+		}
+		if ("outcome" in hop) return hop.outcome;
+		redirected++;
+		const maxRedirection = options.maxRedirection ?? DEFAULT_MAX_REDIRECTION;
+		if (redirected > maxRedirection) {
+			logger.error("Too many redirections ({redirections}) while fetching WebFinger resource descriptor.", { redirections: redirected });
+			return {
+				resource: null,
+				result: "invalid",
+				statusCode: hop.statusCode,
+				remoteHost
+			};
+		}
+		let redirectedUrl;
+		try {
+			redirectedUrl = new URL(hop.redirect, url);
+		} catch (error) {
+			logger.error("Invalid Location header while following WebFinger redirect: {error}", {
+				url: url.href,
+				error
+			});
+			return {
+				resource: null,
+				result: "invalid",
+				statusCode: hop.statusCode,
+				remoteHost
+			};
+		}
+		if (redirectedUrl.protocol !== url.protocol) {
+			logger.error("Redirected to a different protocol ({protocol} to {redirectedProtocol}) while fetching WebFinger resource descriptor.", {
+				protocol: url.protocol,
+				redirectedProtocol: redirectedUrl.protocol
+			});
+			return {
+				resource: null,
+				result: "invalid",
+				statusCode: hop.statusCode,
+				remoteHost
+			};
+		}
+		url = redirectedUrl;
+	}
+}
+/**
+* Opens a fetch session for a hop.  A disallowed URL, a failed DNS lookup,
+* or an aborted lookup yields `null` instead of an error.
+*/
+async function openSession(url, openHop, signal) {
+	try {
+		return await openHop(url.href);
+	} catch (e) {
+		if (e instanceof _fedify_vocab_runtime.UrlError) {
+			if (e.reason === "dns") logger.debug("DNS lookup failed for {url}", {
+				url: url.href,
+				error: e
+			});
+			else logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
+			return null;
+		}
+		if (signal?.aborted) {
+			logger.debug("Failed to fetch WebFinger resource descriptor: {error}", {
+				url: url.href,
+				error: e
+			});
+			return null;
+		}
+		throw e;
+	}
+}
+/**
+* Fetches a hop with the given session, and consumes the response body or
+* starts cancelling it before returning.  The caller closes the session.
+*/
+async function fetchHop(session, url, options) {
+	let response;
+	try {
+		response = await session.fetch(url, {
+			headers: {
+				Accept: "application/jrd+json",
+				"User-Agent": typeof options.userAgent === "string" ? options.userAgent : (0, _fedify_vocab_runtime.getUserAgent)(options.userAgent)
+			},
+			redirect: "manual",
+			signal: options.signal
+		});
+	} catch (error) {
+		logger.debug("Failed to fetch WebFinger resource descriptor: {error}", {
+			url: url.href,
+			error
+		});
+		return { outcome: {
+			resource: null,
+			result: "network_error",
+			remoteHost: url.host
+		} };
+	}
+	if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+		cancelBody(response, url);
+		return {
+			redirect: response.headers.get("Location"),
+			statusCode: response.status
+		};
+	}
+	if (!response.ok) {
+		logger.debug("Failed to fetch WebFinger resource descriptor: {status} {statusText}.", {
+			url: url.href,
+			status: response.status,
+			statusText: response.statusText
+		});
+		cancelBody(response, url);
+		return { outcome: {
+			resource: null,
+			result: response.status === 404 || response.status === 410 ? "not_found" : "error",
+			statusCode: response.status,
+			remoteHost: url.host
+		} };
+	}
+	try {
+		const parsed = JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url));
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return { outcome: {
+			resource: null,
+			result: "invalid",
+			statusCode: response.status,
+			remoteHost: url.host
+		} };
+		return { outcome: {
+			resource: parsed,
+			result: "found",
+			statusCode: response.status,
+			remoteHost: url.host
+		} };
+	} catch (e) {
+		if (e instanceof BodyTooLargeError) return { outcome: {
+			resource: null,
+			result: "invalid",
+			statusCode: response.status,
+			remoteHost: url.host
+		} };
+		if (e instanceof SyntaxError) {
+			logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
+			return { outcome: {
+				resource: null,
+				result: "invalid",
+				statusCode: response.status,
+				remoteHost: url.host
+			} };
+		}
+		throw e;
+	}
+}
+/**
+* Starts cancelling a response body that is not read, without waiting for it
+* to settle.  The cancellation of a branch of a tee (e.g., a body cloned by
+* a fetch mock) settles only after the other branch is cancelled too, per
+* the Streams standard, so awaiting it could block forever.  A failure is
+* only logged.
+*/
+function cancelBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		logger.debug("Failed to cancel the response body from {url}: {error}", {
+			url: url.href,
+			error
+		});
+	});
+}
+//#endregion
+//#region src/lookup.ts
 const WEBFINGER_HISTOGRAM_BUCKETS = [
 	5,
 	10,
@@ -1373,6 +1590,9 @@ function getMetricResourceScheme(scheme) {
 	return WEBFINGER_LOOKUP_SCHEME_WHITELIST.has(scheme) ? scheme : "other";
 }
 async function lookupWebFinger(resource, options = {}) {
+	return await lookupWebFingerWithDependencies(resource, options);
+}
+async function lookupWebFingerWithDependencies(resource, options = {}, deps = {}) {
 	const tracer = (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(name, version);
 	const scheme = getResourceScheme(resource);
 	return await tracer.startActiveSpan("webfinger.lookup", {
@@ -1389,7 +1609,7 @@ async function lookupWebFinger(resource, options = {}) {
 			result: "error"
 		};
 		try {
-			outcome = await lookupWebFingerInternal(resource, options);
+			outcome = await lookupWebFingerInternal(resource, options, deps);
 			span.setStatus({ code: outcome.resource === null ? _opentelemetry_api.SpanStatusCode.ERROR : _opentelemetry_api.SpanStatusCode.OK });
 			return options.withDiagnostics ? outcome : outcome.resource;
 		} catch (error) {
@@ -1415,188 +1635,56 @@ function recordWebFingerLookup(meterProvider, durationMs, scheme, outcome) {
 	instruments.lookup.add(1, attributes);
 	instruments.lookupDuration.record(durationMs, attributes);
 }
-async function lookupWebFingerInternal(resource, options = {}) {
-	if (typeof resource === "string") resource = new URL(resource);
-	let protocol = "https:";
-	let server;
-	if (resource.protocol === "acct:" || resource.protocol === "mailto:") {
-		const atPos = resource.pathname.lastIndexOf("@");
-		if (atPos < 0) return {
-			resource: null,
-			result: "invalid"
-		};
-		server = resource.pathname.substring(atPos + 1);
-		if (server === "" || /[/?#]/.test(server)) return {
-			resource: null,
-			result: "invalid"
-		};
-		if (resource.protocol === "acct:" && (resource.search !== "" || resource.hash !== "")) return {
-			resource: null,
-			result: "invalid"
-		};
-	} else {
-		protocol = resource.protocol;
-		server = resource.host;
-	}
-	let url = new URL(`${protocol}//${server}/.well-known/webfinger`);
-	url.searchParams.set("resource", resource.href);
-	let redirected = 0;
-	while (true) {
-		const remoteHost = url.host;
-		logger.debug("Fetching WebFinger resource descriptor from {url}...", { url: url.href });
-		let response;
-		if (options.allowPrivateAddress !== true) try {
-			await (0, _fedify_vocab_runtime.validatePublicUrl)(url.href);
-		} catch (e) {
-			if (e instanceof _fedify_vocab_runtime.UrlError) {
-				if (e.reason === "dns") logger.debug("DNS lookup failed for {url}", {
-					url: url.href,
-					error: e
-				});
-				else logger.error("Invalid URL for WebFinger resource descriptor: {error}", { error: e });
-				return {
-					resource: null,
-					result: "network_error",
-					remoteHost
-				};
-			}
-			throw e;
-		}
-		try {
-			response = await fetch(url, {
-				headers: {
-					Accept: "application/jrd+json",
-					"User-Agent": typeof options.userAgent === "string" ? options.userAgent : (0, _fedify_vocab_runtime.getUserAgent)(options.userAgent)
-				},
-				redirect: "manual",
-				signal: options.signal
-			});
-		} catch (error) {
-			logger.debug("Failed to fetch WebFinger resource descriptor: {error}", {
-				url: url.href,
-				error
-			});
-			return {
-				resource: null,
-				result: "network_error",
-				remoteHost
-			};
-		}
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-			redirected++;
-			const maxRedirection = options.maxRedirection ?? DEFAULT_MAX_REDIRECTION;
-			if (redirected > maxRedirection) {
-				logger.error("Too many redirections ({redirections}) while fetching WebFinger resource descriptor.", { redirections: redirected });
-				return {
-					resource: null,
-					result: "invalid",
-					statusCode: response.status,
-					remoteHost
-				};
-			}
-			let redirectedUrl;
-			try {
-				redirectedUrl = new URL(response.headers.get("Location"), response.url == null || response.url === "" ? url : response.url);
-			} catch (e) {
-				logger.error("Invalid Location header while following WebFinger redirect: {error}", {
-					url: url.href,
-					error: e
-				});
-				return {
-					resource: null,
-					result: "invalid",
-					statusCode: response.status,
-					remoteHost
-				};
-			}
-			if (redirectedUrl.protocol !== url.protocol) {
-				logger.error("Redirected to a different protocol ({protocol} to {redirectedProtocol}) while fetching WebFinger resource descriptor.", {
-					protocol: url.protocol,
-					redirectedProtocol: redirectedUrl.protocol
-				});
-				return {
-					resource: null,
-					result: "invalid",
-					statusCode: response.status,
-					remoteHost
-				};
-			}
-			url = redirectedUrl;
-			continue;
-		}
-		if (!response.ok) {
-			logger.debug("Failed to fetch WebFinger resource descriptor: {status} {statusText}.", {
-				url: url.href,
-				status: response.status,
-				statusText: response.statusText
-			});
-			return {
-				resource: null,
-				result: response.status === 404 || response.status === 410 ? "not_found" : "error",
-				statusCode: response.status,
-				remoteHost
-			};
-		}
-		try {
-			const parsed = JSON.parse(await readBoundedText(response, MAX_BODY_SIZE, url));
-			if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {
-				resource: null,
-				result: "invalid",
-				statusCode: response.status,
-				remoteHost
-			};
-			return {
-				resource: parsed,
-				result: "found",
-				statusCode: response.status,
-				remoteHost
-			};
-		} catch (e) {
-			if (e instanceof BodyTooLargeError) return {
-				resource: null,
-				result: "invalid",
-				statusCode: response.status,
-				remoteHost
-			};
-			if (e instanceof SyntaxError) {
-				logger.debug("Failed to parse WebFinger resource descriptor as JSON: {error}", { error: e });
-				return {
-					resource: null,
-					result: "invalid",
-					statusCode: response.status,
-					remoteHost
-				};
-			}
-			throw e;
-		}
-	}
-}
 //#endregion
 //#region src/lookup.test.ts
+function lookupMock(resource, options = {}) {
+	if (resource.toString().includes("fedify-test.internal")) return lookupWebFingerWithDependencies(resource, options, { openHop: (url) => Promise.resolve({
+		url: new URL(url),
+		fetch: () => Promise.reject(/* @__PURE__ */ new TypeError("Connection refused")),
+		close: () => Promise.resolve()
+	}) });
+	return lookupWebFingerWithDependencies(resource, options, { openHop: options.allowPrivateAddress === true ? _fedify_vocab_runtime_internal.openDirectFetch : openExampleDirectly });
+}
+function lookupDirect(resource, options) {
+	return lookupWebFingerWithDependencies(resource, options, { openHop: _fedify_vocab_runtime_internal.openDirectFetch });
+}
+function lookupResolving(addresses) {
+	return () => Promise.resolve(addresses);
+}
+function openExampleDirectly(url) {
+	return new URL(url).hostname === "example.com" ? (0, _fedify_vocab_runtime_internal.openDirectFetch)(url) : (0, _fedify_vocab_runtime_internal.openPublicFetch)(url, { lookup: lookupResolving([{
+		address: "93.184.215.14",
+		family: 4
+	}]) });
+}
+async function lookupResourceWithDependencies(resource, options, deps) {
+	return (await lookupWebFingerInternal(resource, options, deps)).resource;
+}
 (0, _fedify_fixture.test)({
 	name: "lookupWebFinger()",
 	sanitizeOps: false,
 	sanitizeResources: false,
 	async fn(t) {
+		const responseTimers = [];
 		await t.step("invalid resource", async () => {
-			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe"), null);
-			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger(new URL("acct:johndoe")), null);
-			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@"), null);
-			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger(new URL("acct:johndoe@")), null);
-			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com/exploit"), null);
-			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com?x=1"), null);
-			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com#frag"), null);
+			(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe"), null);
+			(0, node_assert_strict.deepStrictEqual)(await lookupMock(new URL("acct:johndoe")), null);
+			(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@"), null);
+			(0, node_assert_strict.deepStrictEqual)(await lookupMock(new URL("acct:johndoe@")), null);
+			(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com/exploit"), null);
+			(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com?x=1"), null);
+			(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com#frag"), null);
 		});
 		await t.step("connection refused", async () => {
-			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@fedify-test.internal"), null);
-			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("https://fedify-test.internal/foo"), null);
+			(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@fedify-test.internal"), null);
+			(0, node_assert_strict.deepStrictEqual)(await lookupMock("https://fedify-test.internal/foo"), null);
 		});
 		esm_default.spyGlobal();
 		try {
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", { status: 404 });
 			await t.step("not found", async () => {
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com"), null);
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("https://example.com/foo"), null);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com"), null);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("https://example.com/foo"), null);
 			});
 			const expected = {
 				subject: "acct:johndoe@example.com",
@@ -1605,7 +1693,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			esm_default.removeRoutes();
 			esm_default.get("https://example.com/.well-known/webfinger?resource=acct%3Ajohndoe%40example.com", { body: expected });
 			await t.step("acct", async () => {
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com"), expected);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com"), expected);
 			});
 			const expected2 = {
 				subject: "https://example.com/foo",
@@ -1614,7 +1702,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			esm_default.removeRoutes();
 			esm_default.get("https://example.com/.well-known/webfinger?resource=https%3A%2F%2Fexample.com%2Ffoo", { body: expected2 });
 			await t.step("https", async () => {
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("https://example.com/foo"), expected2);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("https://example.com/foo"), expected2);
 			});
 			const mailtoExpected = {
 				subject: "mailto:juliet@example.com",
@@ -1623,7 +1711,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			esm_default.removeRoutes();
 			esm_default.get("https://example.com/.well-known/webfinger?resource=mailto%3Ajuliet%40example.com", { body: mailtoExpected });
 			await t.step("mailto", async () => {
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("mailto:juliet@example.com"), mailtoExpected);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("mailto:juliet@example.com"), mailtoExpected);
 			});
 			const mailtoQueryExpected = {
 				subject: "mailto:juliet@example.com?subject=Hi",
@@ -1632,12 +1720,12 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			esm_default.removeRoutes();
 			esm_default.get("https://example.com/.well-known/webfinger?resource=mailto%3Ajuliet%40example.com%3Fsubject%3DHi", { body: mailtoQueryExpected });
 			await t.step("mailto with hfields", async () => {
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("mailto:juliet@example.com?subject=Hi"), mailtoQueryExpected);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("mailto:juliet@example.com?subject=Hi"), mailtoQueryExpected);
 			});
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", { body: "not json" });
 			await t.step("invalid response", async () => {
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com"), null);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com"), null);
 			});
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://localhost/.well-known/webfinger?", {
@@ -1649,8 +1737,8 @@ async function lookupWebFingerInternal(resource, options = {}) {
 				}]
 			});
 			await t.step("private address", async () => {
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:test@localhost"), null);
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:test@localhost", { allowPrivateAddress: true }), {
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:test@localhost"), null);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:test@localhost", { allowPrivateAddress: true }), {
 					subject: "acct:test@localhost",
 					links: [{
 						rel: "self",
@@ -1666,7 +1754,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			});
 			esm_default.get("begin:https://example.com/.well-known/webfinger2", { body: expected });
 			await t.step("redirection", async () => {
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com"), expected);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com"), expected);
 			});
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", {
@@ -1674,7 +1762,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 				headers: { Location: "/.well-known/webfinger" }
 			});
 			await t.step("infinite redirection", async () => {
-				(0, node_assert_strict.deepStrictEqual)(await (0, es_toolkit.withTimeout)(() => lookupWebFinger("acct:johndoe@example.com"), 2e3), null);
+				(0, node_assert_strict.deepStrictEqual)(await (0, es_toolkit.withTimeout)(() => lookupMock("acct:johndoe@example.com"), 2e3), null);
 			});
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", {
@@ -1682,7 +1770,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 				headers: { Location: "ftp://example.com/" }
 			});
 			await t.step("redirection to different protocol", async () => {
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com"), null);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com"), null);
 			});
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", {
@@ -1690,7 +1778,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 				headers: { Location: "https://localhost/" }
 			});
 			await t.step("redirection to private address", async () => {
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com"), null);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com"), null);
 			});
 			esm_default.removeRoutes();
 			let redirectCount = 0;
@@ -1704,13 +1792,13 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			});
 			await t.step("custom maxRedirection", async () => {
 				redirectCount = 0;
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com", { maxRedirection: 1 }), null);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com", { maxRedirection: 1 }), null);
 				redirectCount = 0;
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com", { maxRedirection: 2 }), expected);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com", { maxRedirection: 2 }), expected);
 				redirectCount = 0;
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com", { maxRedirection: 3 }), expected);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com", { maxRedirection: 3 }), expected);
 				redirectCount = 0;
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com"), expected);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com"), expected);
 			});
 			await t.step("maxRedirection: 1 follows exactly one redirect", async () => {
 				esm_default.removeRoutes();
@@ -1722,7 +1810,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 						headers: { Location: "/.well-known/webfinger?after=1" }
 					} : { body: expected };
 				});
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com", { maxRedirection: 1 }), expected);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com", { maxRedirection: 1 }), expected);
 				esm_default.removeRoutes();
 				count = 0;
 				esm_default.get("begin:https://example.com/.well-known/webfinger", () => {
@@ -1732,18 +1820,18 @@ async function lookupWebFingerInternal(resource, options = {}) {
 						headers: { Location: `/.well-known/webfinger?after=${count}` }
 					} : { body: expected };
 				});
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com", { maxRedirection: 1 }), null);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com", { maxRedirection: 1 }), null);
 			});
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", () => new Promise((resolve) => {
 				const timeoutId = setTimeout(() => {
 					resolve({ body: expected });
 				}, 1e3);
-				return () => clearTimeout(timeoutId);
+				responseTimers.push(timeoutId);
 			}));
 			await t.step("request cancellation", async () => {
 				const controller = new AbortController();
-				const promise = lookupWebFinger("acct:johndoe@example.com", { signal: controller.signal });
+				const promise = lookupMock("acct:johndoe@example.com", { signal: controller.signal });
 				controller.abort();
 				(0, node_assert_strict.deepStrictEqual)(await promise, null);
 			});
@@ -1759,12 +1847,12 @@ async function lookupWebFingerInternal(resource, options = {}) {
 					const timeoutId = setTimeout(() => {
 						resolve({ body: expected });
 					}, 1e3);
-					return () => clearTimeout(timeoutId);
+					responseTimers.push(timeoutId);
 				});
 			});
 			await t.step("cancellation during redirection", async () => {
 				const controller = new AbortController();
-				const promise = lookupWebFinger("acct:johndoe@example.com", { signal: controller.signal });
+				const promise = lookupMock("acct:johndoe@example.com", { signal: controller.signal });
 				setTimeout(() => controller.abort(), 100);
 				(0, node_assert_strict.deepStrictEqual)(await promise, null);
 			});
@@ -1773,19 +1861,20 @@ async function lookupWebFingerInternal(resource, options = {}) {
 				const timeoutId = setTimeout(() => {
 					resolve({ body: expected });
 				}, 500);
-				return () => clearTimeout(timeoutId);
+				responseTimers.push(timeoutId);
 			}));
 			await t.step("cancellation with immediate abort", async () => {
 				const controller = new AbortController();
 				controller.abort();
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com", { signal: controller.signal }), null);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com", { signal: controller.signal }), null);
 			});
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", { body: expected });
 			await t.step("successful request with signal", async () => {
-				(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com", { signal: new AbortController().signal }), expected);
+				(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com", { signal: new AbortController().signal }), expected);
 			});
 		} finally {
+			for (const timer of responseTimers) clearTimeout(timer);
 			esm_default.removeRoutes();
 			esm_default.hardReset();
 		}
@@ -1805,7 +1894,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			esm_default.removeRoutes();
 			esm_default.get("https://example.com/.well-known/webfinger?resource=acct%3Ajohndoe%40example.com", { body: expected });
 			const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
-			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com", { meterProvider }), expected);
+			(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com", { meterProvider }), expected);
 			const counters = recorder.getMeasurements("webfinger.lookup");
 			(0, node_assert_strict.deepStrictEqual)(counters.length, 1);
 			(0, node_assert_strict.deepStrictEqual)(counters[0].type, "counter");
@@ -1828,7 +1917,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 				links: []
 			} });
 			const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
-			await lookupWebFinger("https://example.com/foo", { meterProvider });
+			await lookupMock("https://example.com/foo", { meterProvider });
 			const counters = recorder.getMeasurements("webfinger.lookup");
 			(0, node_assert_strict.deepStrictEqual)(counters.length, 1);
 			(0, node_assert_strict.deepStrictEqual)(counters[0].attributes["webfinger.resource.scheme"], "https");
@@ -1841,7 +1930,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 				links: []
 			} });
 			const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
-			await lookupWebFinger("https://example.com:8443/foo", { meterProvider });
+			await lookupMock("https://example.com:8443/foo", { meterProvider });
 			const counter = recorder.getMeasurement("webfinger.lookup");
 			(0, node_assert_strict.ok)(counter != null);
 			(0, node_assert_strict.deepStrictEqual)(counter.attributes["activitypub.remote.host"], "example.com:8443");
@@ -1850,7 +1939,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", { status: 404 });
 			const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
-			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com", { meterProvider }), null);
+			(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@example.com", { meterProvider }), null);
 			const counters = recorder.getMeasurements("webfinger.lookup");
 			(0, node_assert_strict.deepStrictEqual)(counters.length, 1);
 			(0, node_assert_strict.deepStrictEqual)(counters[0].attributes["webfinger.lookup.result"], "not_found");
@@ -1864,7 +1953,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", { status: 410 });
 			const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
-			await lookupWebFinger("acct:johndoe@example.com", { meterProvider });
+			await lookupMock("acct:johndoe@example.com", { meterProvider });
 			const counter = recorder.getMeasurement("webfinger.lookup");
 			(0, node_assert_strict.ok)(counter != null);
 			(0, node_assert_strict.deepStrictEqual)(counter.attributes["webfinger.lookup.result"], "not_found");
@@ -1874,7 +1963,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", { status: 500 });
 			const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
-			await lookupWebFinger("acct:johndoe@example.com", { meterProvider });
+			await lookupMock("acct:johndoe@example.com", { meterProvider });
 			const counter = recorder.getMeasurement("webfinger.lookup");
 			(0, node_assert_strict.ok)(counter != null);
 			(0, node_assert_strict.deepStrictEqual)(counter.attributes["webfinger.lookup.result"], "error");
@@ -1884,7 +1973,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", { body: "not json" });
 			const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
-			await lookupWebFinger("acct:johndoe@example.com", { meterProvider });
+			await lookupMock("acct:johndoe@example.com", { meterProvider });
 			const counter = recorder.getMeasurement("webfinger.lookup");
 			(0, node_assert_strict.ok)(counter != null);
 			(0, node_assert_strict.deepStrictEqual)(counter.attributes["webfinger.lookup.result"], "invalid");
@@ -1893,7 +1982,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		await t.step("records result=network_error when fetch never reaches the remote", async () => {
 			esm_default.removeRoutes();
 			const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
-			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@fedify-test.internal", { meterProvider }), null);
+			(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe@fedify-test.internal", { meterProvider }), null);
 			const counter = recorder.getMeasurement("webfinger.lookup");
 			(0, node_assert_strict.ok)(counter != null);
 			(0, node_assert_strict.deepStrictEqual)(counter.attributes["webfinger.lookup.result"], "network_error");
@@ -1902,7 +1991,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		});
 		await t.step("records result=invalid for malformed acct: resources", async () => {
 			const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
-			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe", { meterProvider }), null);
+			(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:johndoe", { meterProvider }), null);
 			const counter = recorder.getMeasurement("webfinger.lookup");
 			(0, node_assert_strict.ok)(counter != null);
 			(0, node_assert_strict.deepStrictEqual)(counter.attributes["webfinger.lookup.result"], "invalid");
@@ -1916,7 +2005,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 				headers: { Location: "/.well-known/webfinger" }
 			});
 			const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
-			(0, node_assert_strict.deepStrictEqual)(await (0, es_toolkit.withTimeout)(() => lookupWebFinger("acct:johndoe@example.com", {
+			(0, node_assert_strict.deepStrictEqual)(await (0, es_toolkit.withTimeout)(() => lookupMock("acct:johndoe@example.com", {
 				meterProvider,
 				maxRedirection: 3
 			}), 2e3), null);
@@ -1933,7 +2022,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 				headers: { Location: "ftp://example.com/" }
 			});
 			const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
-			await lookupWebFinger("acct:johndoe@example.com", { meterProvider });
+			await lookupMock("acct:johndoe@example.com", { meterProvider });
 			const counter = recorder.getMeasurement("webfinger.lookup");
 			(0, node_assert_strict.ok)(counter != null);
 			(0, node_assert_strict.deepStrictEqual)(counter.attributes["webfinger.lookup.result"], "invalid");
@@ -1946,7 +2035,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 				headers: { Location: "https://localhost/" }
 			});
 			const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
-			await lookupWebFinger("acct:johndoe@example.com", { meterProvider });
+			await lookupMock("acct:johndoe@example.com", { meterProvider });
 			const counter = recorder.getMeasurement("webfinger.lookup");
 			(0, node_assert_strict.ok)(counter != null);
 			(0, node_assert_strict.deepStrictEqual)(counter.attributes["webfinger.lookup.result"], "network_error");
@@ -1959,7 +2048,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 				headers: { Location: "http://[bad" }
 			});
 			const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
-			await lookupWebFinger("acct:johndoe@example.com", { meterProvider });
+			await lookupMock("acct:johndoe@example.com", { meterProvider });
 			const counter = recorder.getMeasurement("webfinger.lookup");
 			(0, node_assert_strict.ok)(counter != null);
 			(0, node_assert_strict.deepStrictEqual)(counter.attributes["webfinger.lookup.result"], "invalid");
@@ -1969,7 +2058,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		await t.step("buckets unknown resource schemes as 'other' to keep metric cardinality bounded", async () => {
 			esm_default.removeRoutes();
 			const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
-			await lookupWebFinger("ssh://example.com/foo", { meterProvider });
+			await lookupMock("ssh://example.com/foo", { meterProvider });
 			const counter = recorder.getMeasurement("webfinger.lookup");
 			(0, node_assert_strict.ok)(counter != null);
 			(0, node_assert_strict.deepStrictEqual)(counter.attributes["webfinger.resource.scheme"], "other");
@@ -1978,7 +2067,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			esm_default.removeRoutes();
 			esm_default.get("https://example.com/.well-known/webfinger?resource=acct%3Ajohndoe%40example.com", { body: expected });
 			const [_unused, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
-			await lookupWebFinger("acct:johndoe@example.com");
+			await lookupMock("acct:johndoe@example.com");
 			(0, node_assert_strict.deepStrictEqual)(recorder.getMeasurements("webfinger.lookup").length, 0);
 			(0, node_assert_strict.deepStrictEqual)(recorder.getMeasurements("webfinger.lookup.duration").length, 0);
 		});
@@ -1995,25 +2084,23 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			"Content-Type": "application/jrd+json",
 			"Content-Length": "1"
 		} }));
-		(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), null);
+		(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:alice@example.com", { allowPrivateAddress: true }), null);
 		oversized = false;
-		(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:alice@example.com", { allowPrivateAddress: true }), { subject: "acct:alice@example.com" });
+		(0, node_assert_strict.deepStrictEqual)(await lookupMock("acct:alice@example.com", { allowPrivateAddress: true }), { subject: "acct:alice@example.com" });
 	} finally {
 		esm_default.hardReset();
 	}
 });
 (0, _fedify_fixture.test)("lookupWebFinger() logs DNS failures as such", async (t) => {
-	if ("Deno" in globalThis && (await Deno.permissions.query({ name: "net" })).state !== "granted") return;
 	for (const result of [
 		"throws",
 		"empty",
 		"private"
 	]) await t.step(result, async () => {
-		const originalLookup = node_dns_promises.default.lookup;
-		node_dns_promises.default.lookup = (() => result === "throws" ? Promise.reject(/* @__PURE__ */ new Error("Resolver unavailable")) : Promise.resolve(result === "empty" ? [] : [{
+		const lookup = () => result === "throws" ? Promise.reject(/* @__PURE__ */ new Error("Resolver unavailable")) : Promise.resolve(result === "empty" ? [] : [{
 			address: "127.0.0.1",
 			family: 4
-		}]));
+		}]);
 		const records = [];
 		await (0, _logtape_logtape.configure)({
 			sinks: { buffer: (record) => records.push(record) },
@@ -2028,7 +2115,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			reset: true
 		});
 		try {
-			(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:alice@dns-failure.invalid"), null);
+			(0, node_assert_strict.deepStrictEqual)(await lookupResourceWithDependencies("acct:alice@dns-failure.invalid", {}, { openHop: (url) => (0, _fedify_vocab_runtime_internal.openPublicFetch)(url, { lookup }) }), null);
 			const failures = records.filter((r) => r.rawMessage !== "Fetching WebFinger resource descriptor from {url}...");
 			(0, node_assert_strict.deepStrictEqual)(failures.map((r) => [r.level, r.rawMessage]), [result === "private" ? ["error", "Invalid URL for WebFinger resource descriptor: {error}"] : ["debug", "DNS lookup failed for {url}"]]);
 			const { error } = failures[0].properties;
@@ -2036,7 +2123,6 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			(0, node_assert_strict.deepStrictEqual)(error.reason, result === "private" ? "disallowed" : "dns");
 		} finally {
 			await (0, _logtape_logtape.reset)();
-			node_dns_promises.default.lookup = originalLookup;
 		}
 	});
 });
@@ -2045,7 +2131,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 	sanitizeResources: false
 }, async (t) => {
 	await t.step("network_error", async () => {
-		const outcome = await lookupWebFinger("acct:johndoe@fedify-test.internal", { withDiagnostics: true });
+		const outcome = await lookupMock("acct:johndoe@fedify-test.internal", { withDiagnostics: true });
 		(0, node_assert_strict.deepStrictEqual)(outcome.resource, null);
 		(0, node_assert_strict.deepStrictEqual)(outcome.result, "network_error");
 		(0, node_assert_strict.deepStrictEqual)("statusCode" in outcome, false, "no HTTP response means no status code");
@@ -2059,7 +2145,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 				links: []
 			};
 			esm_default.get("https://example.com/.well-known/webfinger?resource=acct%3Ajohndoe%40example.com", { body: expected });
-			const outcome = await lookupWebFinger("acct:johndoe@example.com", { withDiagnostics: true });
+			const outcome = await lookupMock("acct:johndoe@example.com", { withDiagnostics: true });
 			(0, node_assert_strict.deepStrictEqual)(outcome.resource, expected);
 			(0, node_assert_strict.deepStrictEqual)(outcome.result, "found");
 			(0, node_assert_strict.deepStrictEqual)(outcome.statusCode, 200);
@@ -2068,7 +2154,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		await t.step("not_found", async () => {
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", { status: 404 });
-			const outcome = await lookupWebFinger("acct:johndoe@example.com", { withDiagnostics: true });
+			const outcome = await lookupMock("acct:johndoe@example.com", { withDiagnostics: true });
 			(0, node_assert_strict.deepStrictEqual)(outcome.resource, null);
 			(0, node_assert_strict.deepStrictEqual)(outcome.result, "not_found");
 			(0, node_assert_strict.deepStrictEqual)(outcome.statusCode, 404);
@@ -2077,7 +2163,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		await t.step("invalid", async () => {
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", { body: "not json" });
-			const outcome = await lookupWebFinger("acct:johndoe@example.com", { withDiagnostics: true });
+			const outcome = await lookupMock("acct:johndoe@example.com", { withDiagnostics: true });
 			(0, node_assert_strict.deepStrictEqual)(outcome.resource, null);
 			(0, node_assert_strict.deepStrictEqual)(outcome.result, "invalid");
 			(0, node_assert_strict.deepStrictEqual)(outcome.statusCode, 200);
@@ -2086,7 +2172,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		await t.step("invalid: a literal JSON null body is not a resource descriptor", async () => {
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", { body: "null" });
-			const outcome = await lookupWebFinger("acct:johndoe@example.com", { withDiagnostics: true });
+			const outcome = await lookupMock("acct:johndoe@example.com", { withDiagnostics: true });
 			(0, node_assert_strict.deepStrictEqual)(outcome.resource, null);
 			(0, node_assert_strict.deepStrictEqual)(outcome.result, "invalid");
 			(0, node_assert_strict.deepStrictEqual)(outcome.statusCode, 200);
@@ -2095,7 +2181,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		await t.step("invalid: a JSON array body is not a resource descriptor", async () => {
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", { body: "[]" });
-			const outcome = await lookupWebFinger("acct:johndoe@example.com", { withDiagnostics: true });
+			const outcome = await lookupMock("acct:johndoe@example.com", { withDiagnostics: true });
 			(0, node_assert_strict.deepStrictEqual)(outcome.resource, null);
 			(0, node_assert_strict.deepStrictEqual)(outcome.result, "invalid");
 			(0, node_assert_strict.deepStrictEqual)(outcome.statusCode, 200);
@@ -2104,7 +2190,7 @@ async function lookupWebFingerInternal(resource, options = {}) {
 		await t.step("error", async () => {
 			esm_default.removeRoutes();
 			esm_default.get("begin:https://example.com/.well-known/webfinger?", { status: 500 });
-			const outcome = await lookupWebFinger("acct:johndoe@example.com", { withDiagnostics: true });
+			const outcome = await lookupMock("acct:johndoe@example.com", { withDiagnostics: true });
 			(0, node_assert_strict.deepStrictEqual)(outcome.resource, null);
 			(0, node_assert_strict.deepStrictEqual)(outcome.result, "error");
 			(0, node_assert_strict.deepStrictEqual)(outcome.statusCode, 500);
@@ -2123,10 +2209,296 @@ async function lookupWebFingerInternal(resource, options = {}) {
 			links: []
 		};
 		esm_default.get("https://example.com/.well-known/webfinger?resource=acct%3Ajohndoe%40example.com", { body: expected });
-		(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com", { userAgent: "test-agent" }), expected);
+		(0, node_assert_strict.deepStrictEqual)(await lookupWebFinger("acct:johndoe@example.com", {
+			userAgent: "test-agent",
+			allowPrivateAddress: true
+		}), expected);
 	} finally {
 		esm_default.removeRoutes();
 		esm_default.hardReset();
 	}
 });
+function recordHops(respond) {
+	const events = [];
+	const unsettled = [];
+	let opens = 0;
+	let closes = 0;
+	let responses = 0;
+	return {
+		events,
+		async openHop(url) {
+			opens++;
+			events.push(`open ${url}`);
+			const states = [];
+			let closed = false;
+			return {
+				url: new URL(url),
+				async fetch(input) {
+					if (closed) throw new TypeError("The fetch session is closed.");
+					const target = new URL(input instanceof Request ? input.url : input);
+					const id = ++responses;
+					events.push(`fetch ${target.href} #${id}`);
+					const fake = respond(target);
+					const state = {
+						id,
+						settled: false
+					};
+					states.push(state);
+					let sent = false;
+					const body = new ReadableStream({
+						pull(controller) {
+							if (!sent && fake.body != null && fake.body !== "") {
+								sent = true;
+								controller.enqueue(new TextEncoder().encode(fake.body));
+								return;
+							}
+							state.settled = true;
+							events.push(`consumed #${id}`);
+							controller.close();
+						},
+						cancel() {
+							state.settled = true;
+							events.push(`cancel #${id}`);
+							if (fake.cancelFails) throw new Error("Cancellation failed");
+							if (fake.cancelNeverSettles) return new Promise(() => {});
+						}
+					}, { highWaterMark: 0 });
+					const response = new Response(body, {
+						status: fake.status ?? 200,
+						headers: fake.headers
+					});
+					if (fake.url != null) Object.defineProperty(response, "url", { value: fake.url });
+					return response;
+				},
+				async close() {
+					if (closed) return;
+					closed = true;
+					closes++;
+					for (const state of states) if (!state.settled) unsettled.push(`#${state.id}`);
+					events.push(`close ${url}`);
+				}
+			};
+		},
+		assertInvariants() {
+			(0, node_assert_strict.deepStrictEqual)(closes, opens);
+			(0, node_assert_strict.deepStrictEqual)(unsettled, []);
+		}
+	};
+}
+(0, _fedify_fixture.test)("lookupWebFinger() closes each hop after cleaning up its body", async (t) => {
+	const descriptor = {
+		subject: "acct:johndoe@example.com",
+		links: []
+	};
+	const first = "https://example.com/.well-known/webfinger?resource=acct%3Ajohndoe%40example.com";
+	const second = "https://example.com/.well-known/webfinger2";
+	await t.step("redirect", async () => {
+		const recorder = recordHops((url) => url.pathname === "/.well-known/webfinger" ? {
+			status: 302,
+			headers: { Location: "/.well-known/webfinger2" },
+			body: "redirecting",
+			url: url.href.replace("example.com", "93.184.215.14")
+		} : { body: JSON.stringify(descriptor) });
+		(0, node_assert_strict.deepStrictEqual)(await lookupResourceWithDependencies("acct:johndoe@example.com", {}, { openHop: recorder.openHop }), descriptor);
+		(0, node_assert_strict.deepStrictEqual)(recorder.events, [
+			`open ${first}`,
+			`fetch ${first} #1`,
+			"cancel #1",
+			`close ${first}`,
+			`open ${second}`,
+			`fetch ${second} #2`,
+			"consumed #2",
+			`close ${second}`
+		]);
+		recorder.assertInvariants();
+	});
+	await t.step("non-2xx response", async () => {
+		const recorder = recordHops(() => ({
+			status: 404,
+			body: "not found"
+		}));
+		(0, node_assert_strict.deepStrictEqual)(await lookupResourceWithDependencies("acct:johndoe@example.com", {}, { openHop: recorder.openHop }), null);
+		(0, node_assert_strict.deepStrictEqual)(recorder.events, [
+			`open ${first}`,
+			`fetch ${first} #1`,
+			"cancel #1",
+			`close ${first}`
+		]);
+		recorder.assertInvariants();
+	});
+	await t.step("too many redirections", async () => {
+		const recorder = recordHops(() => ({
+			status: 302,
+			headers: { Location: "/.well-known/webfinger2" },
+			body: "redirecting"
+		}));
+		(0, node_assert_strict.deepStrictEqual)(await lookupResourceWithDependencies("acct:johndoe@example.com", { maxRedirection: 1 }, { openHop: recorder.openHop }), null);
+		(0, node_assert_strict.deepStrictEqual)(recorder.events, [
+			`open ${first}`,
+			`fetch ${first} #1`,
+			"cancel #1",
+			`close ${first}`,
+			`open ${second}`,
+			`fetch ${second} #2`,
+			"cancel #2",
+			`close ${second}`
+		]);
+		recorder.assertInvariants();
+	});
+	await t.step("failed redirect body cancellation", async () => {
+		const recorder = recordHops((url) => url.pathname === "/.well-known/webfinger" ? {
+			status: 302,
+			headers: { Location: "/.well-known/webfinger2" },
+			body: "redirecting",
+			cancelFails: true
+		} : { body: JSON.stringify(descriptor) });
+		const records = [];
+		await (0, _logtape_logtape.configure)({
+			sinks: { buffer: (record) => records.push(record) },
+			loggers: [{
+				category: "fedify",
+				sinks: ["buffer"],
+				lowestLevel: "debug"
+			}, {
+				category: ["logtape", "meta"],
+				sinks: []
+			}],
+			reset: true
+		});
+		try {
+			(0, node_assert_strict.deepStrictEqual)(await lookupResourceWithDependencies("acct:johndoe@example.com", {}, { openHop: recorder.openHop }), descriptor);
+			const failures = records.filter((r) => r.rawMessage === "Failed to cancel the response body from {url}: {error}");
+			(0, node_assert_strict.deepStrictEqual)(failures.map((r) => [r.level, r.properties.url]), [["debug", first]]);
+			const { error } = failures[0].properties;
+			(0, node_assert_strict.ok)(error instanceof Error);
+			(0, node_assert_strict.deepStrictEqual)(error.message, "Cancellation failed");
+		} finally {
+			await (0, _logtape_logtape.reset)();
+		}
+		(0, node_assert_strict.deepStrictEqual)(recorder.events, [
+			`open ${first}`,
+			`fetch ${first} #1`,
+			"cancel #1",
+			`close ${first}`,
+			`open ${second}`,
+			`fetch ${second} #2`,
+			"consumed #2",
+			`close ${second}`
+		]);
+		recorder.assertInvariants();
+	});
+	await t.step("never-settling body cancellation", async () => {
+		const recorder = recordHops((url) => url.pathname === "/.well-known/webfinger" ? {
+			status: 302,
+			headers: { Location: "/.well-known/webfinger2" },
+			body: "redirecting",
+			cancelNeverSettles: true
+		} : {
+			status: 404,
+			body: "not found",
+			cancelNeverSettles: true
+		});
+		(0, node_assert_strict.deepStrictEqual)(await settleWithin(lookupResourceWithDependencies("acct:johndoe@example.com", {}, { openHop: recorder.openHop })), null);
+		(0, node_assert_strict.deepStrictEqual)(recorder.events, [
+			`open ${first}`,
+			`fetch ${first} #1`,
+			"cancel #1",
+			`close ${first}`,
+			`open ${second}`,
+			`fetch ${second} #2`,
+			"cancel #2",
+			`close ${second}`
+		]);
+		recorder.assertInvariants();
+	});
+});
+/**
+* Rejects if the given promise does not settle within the timeout, so that
+* a hang fails the test instead of blocking it.
+*/
+async function settleWithin(promise, ms = 5e3) {
+	let timer;
+	try {
+		return await Promise.race([promise, new Promise((_, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`Did not settle within ${ms} ms.`)), ms);
+		})]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+function neverCancellableResponse(init) {
+	return new Response(new ReadableStream({
+		start(controller) {
+			controller.enqueue(new TextEncoder().encode("never cancelled"));
+		},
+		cancel: () => new Promise(() => {})
+	}), init);
+}
+(0, _fedify_fixture.test)("lookupWebFinger() does not wait for cancelling response bodies", async (t) => {
+	const descriptor = {
+		subject: "acct:johndoe@example.com",
+		links: []
+	};
+	esm_default.mockGlobal();
+	try {
+		await t.step("redirect", async () => {
+			esm_default.removeRoutes();
+			esm_default.get("begin:https://example.com/.well-known/webfinger?", () => neverCancellableResponse({
+				status: 302,
+				headers: { Location: "/.well-known/webfinger2" }
+			}));
+			esm_default.get("https://example.com/.well-known/webfinger2", () => new Response(JSON.stringify(descriptor), { headers: { "Content-Type": "application/jrd+json" } }));
+			(0, node_assert_strict.deepStrictEqual)(await settleWithin(lookupDirect("acct:johndoe@example.com")), descriptor);
+		});
+		await t.step("non-2xx response", async () => {
+			esm_default.removeRoutes();
+			esm_default.get("begin:https://example.com/.well-known/webfinger?", () => neverCancellableResponse({ status: 404 }));
+			(0, node_assert_strict.deepStrictEqual)(await settleWithin(lookupDirect("acct:johndoe@example.com")), null);
+		});
+	} finally {
+		esm_default.hardReset();
+	}
+});
+(0, node_test.test)("lookupWebFinger() records network_error for rejected hop addresses", async () => {
+	for (const lookup of [
+		() => Promise.reject(/* @__PURE__ */ new Error("DNS unavailable")),
+		() => Promise.resolve([]),
+		() => Promise.resolve([{
+			address: "127.0.0.1",
+			family: 4
+		}])
+	]) {
+		const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
+		(0, node_assert_strict.deepStrictEqual)(await lookupWebFingerWithDependencies("acct:alice@dns-failure.invalid", { meterProvider }, { openHop: (url) => (0, _fedify_vocab_runtime_internal.openPublicFetch)(url, { lookup }) }), null);
+		const counter = recorder.getMeasurement("webfinger.lookup");
+		(0, node_assert_strict.ok)(counter != null);
+		(0, node_assert_strict.deepStrictEqual)(counter.attributes["webfinger.lookup.result"], "network_error");
+		(0, node_assert_strict.deepStrictEqual)(counter.attributes["activitypub.remote.host"], "dns-failure.invalid");
+		(0, node_assert_strict.deepStrictEqual)("http.response.status_code" in counter.attributes, false);
+	}
+});
+(0, node_test.test)("WebFinger diagnostics classify non-object JSON after closing the hop", async () => {
+	for (const body of [
+		"null",
+		"[]",
+		"42",
+		"\"text\"",
+		"true"
+	]) {
+		const hops = recordHops(() => ({ body }));
+		const [meterProvider, recorder] = (0, _fedify_fixture.createTestMeterProvider)();
+		(0, node_assert_strict.deepStrictEqual)(await lookupWebFingerWithDependencies("acct:alice@example.com", {
+			withDiagnostics: true,
+			meterProvider
+		}, { openHop: hops.openHop }), {
+			resource: null,
+			result: "invalid",
+			statusCode: 200,
+			remoteHost: "example.com"
+		});
+		(0, node_assert_strict.deepStrictEqual)(hops.events.at(-1), "close https://example.com/.well-known/webfinger?resource=acct%3Aalice%40example.com");
+		hops.assertInvariants();
+		(0, node_assert_strict.deepStrictEqual)(recorder.getMeasurement("webfinger.lookup")?.attributes["webfinger.lookup.result"], "invalid");
+	}
+});
 //#endregion