generateActors builds a Fedify context from the instance's stored host:
const fedCtx = ctx.federation.createContext(
new URL(`${ctx.rootOrigin.protocol}//${host}`),
undefined,
);new URL() throws if that host is not a parseable authority, and the call sits inside the transaction, so the failure surfaces as an unhandled GraphQL error rather than one of the results the mutation declares.
A host like that can be there. The slug rule only constrains shape, and whether an xn-- label is decodable Punycode is answered by the runtime's own ICU: a slug accepted on one Node build composes a host another refuses to parse. createInstance guards against this at creation time, but only against the runtime it is running on, so an instance created before a Node upgrade, or on a different machine, can outlive the guard. Rows predating the tightened slug constraint are another way in.
generateActors is served on the control surface, so reaching it does not depend on the instance's own host parsing. A member of the affected instance calling it is enough.
The startup scan already treats such a host as something to report rather than to crash on: findStrandedInstances in packages/drfed/src/serving.ts guards with URL.canParse and lists the instance as unreachable. The same guard here would let the mutation return a declared error instead of throwing. Whether that should be InstanceNotFound or a new member of CreateActorsErrorType is worth deciding rather than assuming.
Found by review while fixing the ICU dependency in #83.
generateActorsbuilds a Fedify context from the instance's stored host:new URL()throws if that host is not a parseable authority, and the call sits inside the transaction, so the failure surfaces as an unhandled GraphQL error rather than one of the results the mutation declares.A host like that can be there. The slug rule only constrains shape, and whether an
xn--label is decodable Punycode is answered by the runtime's own ICU: a slug accepted on one Node build composes a host another refuses to parse.createInstanceguards against this at creation time, but only against the runtime it is running on, so an instance created before a Node upgrade, or on a different machine, can outlive the guard. Rows predating the tightened slug constraint are another way in.generateActorsis served on the control surface, so reaching it does not depend on the instance's own host parsing. A member of the affected instance calling it is enough.The startup scan already treats such a host as something to report rather than to crash on:
findStrandedInstancesin packages/drfed/src/serving.ts guards withURL.canParseand lists the instance as unreachable. The same guard here would let the mutation return a declared error instead of throwing. Whether that should beInstanceNotFoundor a new member ofCreateActorsErrorTypeis worth deciding rather than assuming.Found by review while fixing the ICU dependency in #83.