@fedify/fedify 2.3.0-dev.994 → 2.3.0-pr.809.36

package/dist/federation/handler.test.mjs

@@ -1,19 +1,21 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-Dk_tacqz.mjs";
-import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import "../std__assert-CRDpx_HF.mjs";
-import { t as assertInstanceOf } from "../assert_instance_of-C4Ri6VuN.mjs";
-import { t as assert } from "../assert-DikXweDx.mjs";
+import { n as createOutboxContext, r as createRequestContext, t as createInboxContext } from "../context-DVoTs_wM.mjs";
+import { t as assertEquals } from "../assert_equals-C-ZRDbaf.mjs";
+import "../std__assert-BBjXFNOb.mjs";
+import { n as assertGreaterOrEqual, t as assertRejects } from "../assert_rejects-DN60FHPX.mjs";
+import { t as assertInstanceOf } from "../assert_instance_of-DBC5X09g.mjs";
+import { t as assert } from "../assert-OguE97r2.mjs";
 import { r as parseAcceptSignature } from "../accept-CPkZzmGN.mjs";
-import { s as signRequest } from "../http-CSlLA54v.mjs";
+import { s as signRequest } from "../http-BufbkLuW.mjs";
 import { a as rsaPrivateKey3, c as rsaPublicKey3, s as rsaPublicKey2 } from "../keys-DGu1NFwu.mjs";
+import { a as compactJsonLd, p as signJsonLd } from "../ld-0Lsznacf.mjs";
 import { t as MemoryKvStore } from "../kv-rV3vodCc.mjs";
-import { c as handleActor, d as handleInbox, f as handleObject, h as respondWithObjectIfAcceptable, l as handleCollection, m as respondWithObject, o as createFederation, p as handleOutbox, u as handleCustomCollection } from "../middleware-K1g6bEkV.mjs";
-import { t as ActivityListenerSet } from "../activity-listener-ell7W1s9.mjs";
-import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
+import { c as handleActor, d as handleInbox, f as handleObject, h as respondWithObjectIfAcceptable, l as handleCollection, m as respondWithObject, o as createFederation, p as handleOutbox, u as handleCustomCollection } from "../middleware-EV6J_eAc.mjs";
+import { t as ActivityListenerSet } from "../activity-listener-tztVvlNb.mjs";
 import { Activity, Create, Note, Person, Tombstone } from "@fedify/vocab";
+import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/handler.test.ts
 const QUOTE_CONTEXT_TERMS = {
@@ -926,6 +928,192 @@ test("handleCollection()", async () => {
 	assertEquals(onNotFoundCalled, null);
 	assertEquals(onUnauthorizedCalled, null);
 });
+test("handleCollection() records OpenTelemetry collection metrics", async () => {
+	const [meterProvider, recorder] = createTestMeterProvider();
+	const context = createRequestContext({
+		federation: createFederation({
+			kv: new MemoryKvStore(),
+			meterProvider
+		}),
+		data: void 0,
+		url: new URL("https://example.com/users/someone/followers"),
+		request: new Request("https://example.com/users/someone/followers", { headers: { Accept: "application/activity+json" } }),
+		getActorUri(identifier) {
+			return new URL(`https://example.com/users/${identifier}`);
+		}
+	});
+	const dispatcher = (_ctx, identifier) => identifier === "someone" ? { items: [
+		new Create({ id: new URL("https://example.com/activities/1") }),
+		new Create({ id: new URL("https://example.com/activities/2") }),
+		new Create({ id: new URL("https://example.com/activities/3") })
+	] } : null;
+	const counter = (_ctx, identifier) => identifier === "someone" ? 3 : null;
+	assertEquals((await handleCollection(context.request, {
+		context,
+		name: "followers",
+		identifier: "someone",
+		uriGetter(identifier) {
+			return new URL(`https://example.com/users/${identifier}/followers`);
+		},
+		collectionCallbacks: {
+			dispatcher,
+			counter
+		},
+		meterProvider,
+		onNotFound: () => new Response("Not found", { status: 404 }),
+		onUnauthorized: () => new Response("Unauthorized", { status: 401 })
+	})).status, 200);
+	const requests = recorder.getMeasurements("activitypub.collection.request");
+	assertEquals(requests.length, 1);
+	assertEquals(requests[0].type, "counter");
+	assertEquals(requests[0].value, 1);
+	assertEquals(requests[0].attributes["activitypub.collection.kind"], "followers");
+	assertEquals(requests[0].attributes["activitypub.collection.page"], false);
+	assertEquals(requests[0].attributes["fedify.collection.dispatcher"], "built_in");
+	assertEquals(requests[0].attributes["activitypub.collection.result"], "served");
+	assertEquals(requests[0].attributes["http.response.status_code"], 200);
+	assertEquals("activitypub.collection.id" in requests[0].attributes, false);
+	const durations = recorder.getMeasurements("activitypub.collection.dispatch.duration");
+	assertEquals(durations.length, 1);
+	assertEquals(durations[0].type, "histogram");
+	assert(durations[0].value >= 0);
+	assertEquals(durations[0].attributes["activitypub.collection.result"], "served");
+	const items = recorder.getMeasurements("activitypub.collection.page.items");
+	assertEquals(items.length, 1);
+	assertEquals(items[0].type, "histogram");
+	assertEquals(items[0].value, 3);
+	assertEquals(items[0].attributes["activitypub.collection.page"], false);
+	const totalItems = recorder.getMeasurements("activitypub.collection.total_items");
+	assertEquals(totalItems.length, 1);
+	assertEquals(totalItems[0].type, "histogram");
+	assertEquals(totalItems[0].value, 3);
+});
+test("handleCollection() classifies camelCase collection metric names", async () => {
+	const [meterProvider, recorder] = createTestMeterProvider();
+	const context = createRequestContext({
+		federation: createFederation({
+			kv: new MemoryKvStore(),
+			meterProvider
+		}),
+		data: void 0,
+		url: new URL("https://example.com/users/someone/collections/featured"),
+		request: new Request("https://example.com/users/someone/collections/featured", { headers: { Accept: "application/activity+json" } })
+	});
+	const dispatcher = () => ({ items: [] });
+	assertEquals((await handleCollection(context.request, {
+		context,
+		name: "featuredTags",
+		identifier: "someone",
+		uriGetter(identifier) {
+			return new URL(`https://example.com/users/${identifier}/collections/featured`);
+		},
+		collectionCallbacks: { dispatcher },
+		meterProvider,
+		onNotFound: () => new Response("Not found", { status: 404 }),
+		onUnauthorized: () => new Response("Unauthorized", { status: 401 })
+	})).status, 200);
+	const requests = recorder.getMeasurements("activitypub.collection.request");
+	assertEquals(requests.length, 1);
+	assertEquals(requests[0].attributes["activitypub.collection.kind"], "featured_tags");
+});
+test("handleCollection() records filtered collection item metrics", async () => {
+	const [meterProvider, recorder] = createTestMeterProvider();
+	const context = createRequestContext({
+		federation: createFederation({
+			kv: new MemoryKvStore(),
+			meterProvider
+		}),
+		data: void 0,
+		url: new URL("https://example.com/users/someone/followers"),
+		request: new Request("https://example.com/users/someone/followers", { headers: { Accept: "application/activity+json" } })
+	});
+	const dispatcher = () => ({ items: [new Create({ id: new URL("https://example.com/activities/1") }), new Create({ id: new URL("https://example.com/activities/2") })] });
+	assertEquals((await handleCollection(context.request, {
+		context,
+		name: "followers",
+		identifier: "someone",
+		uriGetter(identifier) {
+			return new URL(`https://example.com/users/${identifier}/followers`);
+		},
+		collectionCallbacks: { dispatcher },
+		filterPredicate: (item) => item.id?.href === "https://example.com/activities/1",
+		meterProvider,
+		onNotFound: () => new Response("Not found", { status: 404 }),
+		onUnauthorized: () => new Response("Unauthorized", { status: 401 })
+	})).status, 200);
+	const items = recorder.getMeasurements("activitypub.collection.page.items");
+	assertEquals(items.length, 1);
+	assertEquals(items[0].value, 1);
+	assertEquals(items[0].attributes["activitypub.collection.page"], false);
+	assertEquals(items[0].attributes["activitypub.collection.result"], "served");
+	assertEquals(items[0].attributes["http.response.status_code"], 200);
+});
+test("handleCollection() records filtered collection page item metrics", async () => {
+	const [meterProvider, recorder] = createTestMeterProvider();
+	const context = createRequestContext({
+		federation: createFederation({
+			kv: new MemoryKvStore(),
+			meterProvider
+		}),
+		data: void 0,
+		url: new URL("https://example.com/users/someone/followers?cursor=2"),
+		request: new Request("https://example.com/users/someone/followers?cursor=2", { headers: { Accept: "application/activity+json" } })
+	});
+	const dispatcher = () => ({ items: [new Create({ id: new URL("https://example.com/activities/1") }), new Create({ id: new URL("https://example.com/activities/2") })] });
+	assertEquals((await handleCollection(context.request, {
+		context,
+		name: "followers",
+		identifier: "someone",
+		uriGetter(identifier) {
+			return new URL(`https://example.com/users/${identifier}/followers`);
+		},
+		collectionCallbacks: { dispatcher },
+		filterPredicate: (item) => item.id?.href === "https://example.com/activities/1",
+		meterProvider,
+		onNotFound: () => new Response("Not found", { status: 404 }),
+		onUnauthorized: () => new Response("Unauthorized", { status: 401 })
+	})).status, 200);
+	const items = recorder.getMeasurements("activitypub.collection.page.items");
+	assertEquals(items.length, 1);
+	assertEquals(items[0].value, 1);
+	assertEquals(items[0].attributes["activitypub.collection.page"], true);
+	assertEquals(items[0].attributes["activitypub.collection.result"], "served");
+	assertEquals(items[0].attributes["http.response.status_code"], 200);
+});
+test("handleCollection() records not_found collection metrics", async () => {
+	const [meterProvider, recorder] = createTestMeterProvider();
+	const context = createRequestContext({
+		federation: createFederation({
+			kv: new MemoryKvStore(),
+			meterProvider
+		}),
+		data: void 0,
+		url: new URL("https://example.com/users/nobody/outbox"),
+		request: new Request("https://example.com/users/nobody/outbox", { headers: { Accept: "application/activity+json" } })
+	});
+	const dispatcher = () => null;
+	assertEquals((await handleCollection(context.request, {
+		context,
+		name: "outbox",
+		identifier: "nobody",
+		uriGetter(identifier) {
+			return new URL(`https://example.com/users/${identifier}/outbox`);
+		},
+		collectionCallbacks: { dispatcher },
+		meterProvider,
+		onNotFound: () => new Response("Not found", { status: 404 }),
+		onUnauthorized: () => new Response("Unauthorized", { status: 401 })
+	})).status, 404);
+	const requests = recorder.getMeasurements("activitypub.collection.request");
+	assertEquals(requests.length, 1);
+	assertEquals(requests[0].attributes["activitypub.collection.kind"], "outbox");
+	assertEquals(requests[0].attributes["activitypub.collection.result"], "not_found");
+	assertEquals(requests[0].attributes["http.response.status_code"], 404);
+	const durations = recorder.getMeasurements("activitypub.collection.dispatch.duration");
+	assertEquals(durations.length, 1);
+	assertEquals(durations[0].attributes["activitypub.collection.result"], "not_found");
+	assertEquals(recorder.getMeasurements("activitypub.collection.page.items").length, 0);
+});
 test("handleInbox()", async () => {
 	const activity = new Create({
 		id: new URL("https://example.com/activities/1"),
@@ -956,6 +1144,11 @@ test("handleInbox()", async () => {
 		if (identifier !== "someone") return null;
 		return new Person({ name: "Someone" });
 	};
+	const restrictiveContextLoader = async (resource) => {
+		const url = new URL(resource).href;
+		if (url === "https://www.w3.org/ns/activitystreams" || url === "https://w3id.org/identity/v1") return await mockDocumentLoader(url);
+		throw new Error(`Unexpected context: ${url}`);
+	};
 	const inboxOptions = {
 		kv: new MemoryKvStore(),
 		kvPrefixes: {
@@ -1016,37 +1209,1035 @@ test("handleInbox()", async () => {
 		context: unsignedContext,
 		inboxContextFactory(_activity) {
 			return createInboxContext({
-				...unsignedContext,
-				clone: void 0,
-				recipient: "someone"
+				...unsignedContext,
+				clone: void 0,
+				recipient: "someone"
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals(onNotFoundCalled, null);
+	assertEquals(response.status, 401);
+	const malformedProofCreatedRequest = new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/data-integrity/v1"],
+			id: "https://example.com/activities/invalid-proof-created",
+			type: "Create",
+			actor: "https://example.com/person2",
+			object: {
+				id: "https://example.com/notes/invalid-proof-created",
+				type: "Note",
+				attributedTo: "https://example.com/person2",
+				content: "Hello, world!"
+			},
+			proof: {
+				type: "DataIntegrityProof",
+				cryptosuite: "eddsa-jcs-2022",
+				verificationMethod: "https://example.com/person2#main-key",
+				proofPurpose: "assertionMethod",
+				created: { "@value": "not-a-date" },
+				proofValue: "zLaewdp4H9kqtwyrLatK4cjY5oRHwVcw4gibPSUDYDMhi4M49v8pcYk3ZB6D69dNpAPbUmY8ocuJ3m9KhKJEEg7z"
+			}
+		})
+	});
+	const malformedProofCreatedContext = createRequestContext({
+		federation,
+		request: malformedProofCreatedRequest,
+		url: new URL(malformedProofCreatedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	response = await handleInbox(malformedProofCreatedRequest, {
+		recipient: null,
+		context: malformedProofCreatedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...malformedProofCreatedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals([response.status, await response.text()], [400, "Invalid activity."]);
+	onNotFoundCalled = null;
+	const signedRequest = await signRequest(unsignedRequest.clone(), rsaPrivateKey3, rsaPublicKey3.id);
+	const signedContext = createRequestContext({
+		federation,
+		request: signedRequest,
+		url: new URL(signedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader
+	});
+	response = await handleInbox(signedRequest, {
+		recipient: null,
+		context: signedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...unsignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals(onNotFoundCalled, null);
+	assertEquals([response.status, await response.text()], [202, ""]);
+	const ldSignedRequest = new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(await signJsonLd({
+			"@context": [
+				"https://www.w3.org/ns/activitystreams",
+				"https://w3id.org/identity/v1",
+				"https://w3id.org/security/v1",
+				"https://w3id.org/security/data-integrity/v1"
+			],
+			id: "https://example.com/activities/ld-signed",
+			type: "Create",
+			actor: "https://example.com/person2",
+			object: {
+				id: "https://example.com/notes/ld-signed",
+				type: "Note",
+				attributedTo: "https://example.com/person2",
+				content: "Hello, world!"
+			}
+		}, rsaPrivateKey3, rsaPublicKey3.id, { contextLoader: mockDocumentLoader }))
+	});
+	const ldSignedContext = createRequestContext({
+		federation,
+		request: ldSignedRequest,
+		url: new URL(ldSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: restrictiveContextLoader
+	});
+	response = await handleInbox(ldSignedRequest, {
+		recipient: null,
+		context: ldSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...ldSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals(onNotFoundCalled, null);
+	assertEquals([response.status, await response.text()], [202, ""]);
+	const remoteContextUrl = "https://remote.example/contexts/ext";
+	let failRemoteContextOnce = true;
+	const flakyContextLoader = async (resource) => {
+		const url = new URL(resource).href;
+		if (url === remoteContextUrl) {
+			if (failRemoteContextOnce) {
+				failRemoteContextOnce = false;
+				throw new Error(`Unexpected context: ${url}`);
+			}
+			return {
+				contextUrl: null,
+				documentUrl: url,
+				document: { "@context": { ext: "https://example.com/ext" } }
+			};
+		}
+		return await mockDocumentLoader(url);
+	};
+	const httpSignedLdBody = {
+		"@context": [remoteContextUrl, "https://www.w3.org/ns/activitystreams"],
+		id: "https://example.com/activities/http-signed-ld",
+		type: "Create",
+		actor: "https://example.com/person2",
+		ext: "preserve-me",
+		object: {
+			id: "https://example.com/notes/http-signed-ld",
+			type: "Note",
+			attributedTo: "https://example.com/person2",
+			content: "Hello, world!"
+		},
+		signature: {
+			type: "RsaSignature2017",
+			creator: rsaPublicKey3.id.href,
+			created: "2024-01-01T00:00:00Z",
+			signatureValue: "bogus"
+		}
+	};
+	const httpSignedLdRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(httpSignedLdBody)
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const httpSignedLdContext = createRequestContext({
+		federation,
+		request: httpSignedLdRequest,
+		url: new URL(httpSignedLdRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: flakyContextLoader
+	});
+	response = await handleInbox(httpSignedLdRequest, {
+		recipient: null,
+		context: httpSignedLdContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...httpSignedLdContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals(onNotFoundCalled, null);
+	assertEquals([response.status, await response.text()], [202, ""]);
+	const ldSignedOnlyBody = await signJsonLd({
+		"@context": [remoteContextUrl, "https://www.w3.org/ns/activitystreams"],
+		id: "https://example.com/activities/ld-only-transient",
+		type: "Create",
+		actor: "https://example.com/person2",
+		ext: "preserve-me",
+		object: {
+			id: "https://example.com/notes/ld-only-transient",
+			type: "Note",
+			attributedTo: "https://example.com/person2",
+			content: "Hello, world!"
+		}
+	}, rsaPrivateKey3, rsaPublicKey3.id, { contextLoader: async (resource) => {
+		const url = new URL(resource).href;
+		if (url === remoteContextUrl) return {
+			contextUrl: null,
+			documentUrl: url,
+			document: { "@context": { ext: "https://example.com/ext" } }
+		};
+		return await mockDocumentLoader(url);
+	} });
+	const malformedTemporalLdSignedBody = await signJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://example.com/activities/ld-only-invalid-published",
+		type: "Create",
+		actor: "https://example.com/person2",
+		published: { "@value": "not-a-date" },
+		object: {
+			id: "https://example.com/notes/ld-only-invalid-published",
+			type: "Note",
+			attributedTo: "https://example.com/person2",
+			content: "Hello, world!"
+		}
+	}, rsaPrivateKey3, rsaPublicKey3.id, { contextLoader: mockDocumentLoader });
+	const malformedTemporalLdSignedRequest = new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(malformedTemporalLdSignedBody)
+	});
+	const malformedTemporalLdSignedContext = createRequestContext({
+		federation,
+		request: malformedTemporalLdSignedRequest,
+		url: new URL(malformedTemporalLdSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	response = await handleInbox(malformedTemporalLdSignedRequest, {
+		recipient: null,
+		context: malformedTemporalLdSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...malformedTemporalLdSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals([response.status, await response.text()], [400, "Invalid activity."]);
+	const malformedClosedLdSignedBody = await signJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://example.com/questions/ld-only-invalid-closed",
+		type: "Question",
+		closed: "2024-02-31T00:00:00Z"
+	}, rsaPrivateKey3, rsaPublicKey3.id, { contextLoader: mockDocumentLoader });
+	const malformedClosedLdSignedRequest = new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(malformedClosedLdSignedBody)
+	});
+	const malformedClosedLdSignedContext = createRequestContext({
+		federation,
+		request: malformedClosedLdSignedRequest,
+		url: new URL(malformedClosedLdSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	response = await handleInbox(malformedClosedLdSignedRequest, {
+		recipient: null,
+		context: malformedClosedLdSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...malformedClosedLdSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals([response.status, await response.text()], [400, "Invalid activity."]);
+	const malformedIriHttpSignedRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			"@context": "https://www.w3.org/ns/activitystreams",
+			id: "http://[",
+			type: "Create",
+			actor: "https://example.com/person2",
+			object: {
+				id: "https://example.com/notes/http-signed-invalid-iri",
+				type: "Note",
+				attributedTo: "https://example.com/person2",
+				content: "Hello, world!"
+			}
+		})
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const malformedIriHttpSignedContext = createRequestContext({
+		federation,
+		request: malformedIriHttpSignedRequest,
+		url: new URL(malformedIriHttpSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	response = await handleInbox(malformedIriHttpSignedRequest, {
+		recipient: null,
+		context: malformedIriHttpSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...malformedIriHttpSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals([response.status, await response.text()], [400, "Invalid activity."]);
+	const ldSignedOnlyRequest = new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(ldSignedOnlyBody)
+	});
+	const ldSignedOnlyContext = createRequestContext({
+		federation,
+		request: ldSignedOnlyRequest,
+		url: new URL(ldSignedOnlyRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: async (resource) => {
+			const url = new URL(resource).href;
+			if (url === remoteContextUrl) throw new Error(`Unexpected context: ${url}`);
+			return await mockDocumentLoader(url);
+		}
+	});
+	await assertRejects(() => handleInbox(ldSignedOnlyRequest, {
+		recipient: null,
+		context: ldSignedOnlyContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...ldSignedOnlyContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	}), Error);
+	failRemoteContextOnce = true;
+	const invalidHttpFallbackRequest = new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(ldSignedOnlyBody),
+		headers: { Signature: "bogus" }
+	});
+	const invalidHttpFallbackContext = createRequestContext({
+		federation,
+		request: invalidHttpFallbackRequest,
+		url: new URL(invalidHttpFallbackRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: flakyContextLoader
+	});
+	await assertRejects(() => handleInbox(invalidHttpFallbackRequest, {
+		recipient: null,
+		context: invalidHttpFallbackContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...invalidHttpFallbackContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	}), Error);
+	const transientKeyContextUrl = "https://remote.example/contexts/key";
+	const transientCreatorUrl = "https://remote.example/keys/transient#main-key";
+	const verificationFailureLdSignedBody = await signJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://example.com/activities/ld-key-fetch-transient",
+		type: "Create",
+		actor: "https://example.com/person2",
+		object: {
+			id: "https://example.com/notes/ld-key-fetch-transient",
+			type: "Note",
+			attributedTo: "https://example.com/person2",
+			content: "Hello, world!"
+		}
+	}, rsaPrivateKey3, new URL(transientCreatorUrl), { contextLoader: mockDocumentLoader });
+	const verificationFailureLdSignedRequest = new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(verificationFailureLdSignedBody),
+		headers: { Signature: "bogus" }
+	});
+	const verificationFailureLdSignedContext = createRequestContext({
+		federation,
+		request: verificationFailureLdSignedRequest,
+		url: new URL(verificationFailureLdSignedRequest.url),
+		data: void 0,
+		documentLoader: async (resource) => {
+			if (resource === transientCreatorUrl) return {
+				contextUrl: null,
+				documentUrl: resource,
+				document: {
+					"@context": [transientKeyContextUrl],
+					id: resource
+				}
+			};
+			return await mockDocumentLoader(new URL(resource).href);
+		},
+		contextLoader: async (resource) => {
+			if (resource === transientKeyContextUrl) throw new Error(`Transient key context failure: ${resource}`);
+			return await mockDocumentLoader(new URL(resource).href);
+		}
+	});
+	response = await handleInbox(verificationFailureLdSignedRequest, {
+		recipient: null,
+		context: verificationFailureLdSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...verificationFailureLdSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals([response.status, await response.text()], [401, "Failed to verify the request signature."]);
+	failRemoteContextOnce = true;
+	const deferredMalformedTemporalLdSignedBody = await signJsonLd({
+		"@context": [remoteContextUrl, "https://www.w3.org/ns/activitystreams"],
+		id: "https://example.com/activities/deferred-invalid-published",
+		type: "Create",
+		actor: "https://example.com/person2",
+		ext: "preserve-me",
+		published: { "@value": "not-a-date" },
+		object: {
+			id: "https://example.com/notes/deferred-invalid-published",
+			type: "Note",
+			attributedTo: "https://example.com/person2",
+			content: "Hello, world!"
+		}
+	}, rsaPrivateKey3, rsaPublicKey3.id, { contextLoader: async (resource) => {
+		const url = new URL(resource).href;
+		if (url === remoteContextUrl) return {
+			contextUrl: null,
+			documentUrl: url,
+			document: { "@context": { ext: "https://example.com/ext" } }
+		};
+		return await mockDocumentLoader(url);
+	} });
+	const deferredMalformedTemporalLdSignedRequest = new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(deferredMalformedTemporalLdSignedBody),
+		headers: { Signature: "bogus" }
+	});
+	const deferredMalformedTemporalLdSignedContext = createRequestContext({
+		federation,
+		request: deferredMalformedTemporalLdSignedRequest,
+		url: new URL(deferredMalformedTemporalLdSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: flakyContextLoader
+	});
+	response = await handleInbox(deferredMalformedTemporalLdSignedRequest, {
+		recipient: null,
+		context: deferredMalformedTemporalLdSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...deferredMalformedTemporalLdSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals([response.status, await response.text()], [400, "Invalid activity."]);
+	const malformedLdSignedRequest = new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			...ldSignedOnlyBody,
+			"@context": ["not a url", "https://www.w3.org/ns/activitystreams"]
+		})
+	});
+	const malformedLdSignedContext = createRequestContext({
+		federation,
+		request: malformedLdSignedRequest,
+		url: new URL(malformedLdSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	});
+	response = await handleInbox(malformedLdSignedRequest, {
+		recipient: null,
+		context: malformedLdSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...malformedLdSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals([response.status, await response.text()], [400, "Invalid JSON-LD."]);
+	const dualSignedInvalidCreatorRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			...httpSignedLdBody,
+			signature: {
+				...httpSignedLdBody.signature,
+				creator: "not a url"
+			}
+		})
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const dualSignedInvalidCreatorContext = createRequestContext({
+		federation,
+		request: dualSignedInvalidCreatorRequest,
+		url: new URL(dualSignedInvalidCreatorRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: flakyContextLoader
+	});
+	response = await handleInbox(dualSignedInvalidCreatorRequest, {
+		recipient: null,
+		context: dualSignedInvalidCreatorContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...dualSignedInvalidCreatorContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals(onNotFoundCalled, null);
+	assertEquals([response.status, await response.text()], [202, ""]);
+	const invalidUrlHttpSignedRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			"@context": [remoteContextUrl, "https://www.w3.org/ns/activitystreams"],
+			id: "https://example.com/activities/http-signed-invalid-context",
+			type: "Create",
+			actor: "https://example.com/person2",
+			ext: "preserve-me",
+			object: {
+				id: "https://example.com/notes/http-signed-invalid-context",
+				type: "Note",
+				attributedTo: "https://example.com/person2",
+				content: "Hello, world!"
+			}
+		})
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const invalidUrlHttpSignedContext = createRequestContext({
+		federation,
+		request: invalidUrlHttpSignedRequest,
+		url: new URL(invalidUrlHttpSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: async (resource) => {
+			const url = new URL(resource).href;
+			if (url === remoteContextUrl) {
+				const error = /* @__PURE__ */ new Error(`Transient remote context failure: ${url}`);
+				error.name = "jsonld.InvalidUrl";
+				error.details = {
+					code: "loading remote context failed",
+					url
+				};
+				throw error;
+			}
+			return await mockDocumentLoader(url);
+		}
+	});
+	await assertRejects(() => handleInbox(invalidUrlHttpSignedRequest, {
+		recipient: null,
+		context: invalidUrlHttpSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...invalidUrlHttpSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	}), Error);
+	const opaqueContextIdHttpSignedRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			"@context": ["app-context", "https://www.w3.org/ns/activitystreams"],
+			id: "https://example.com/activities/http-signed-opaque-context",
+			type: "Create",
+			actor: "https://example.com/person2",
+			object: {
+				id: "https://example.com/notes/http-signed-opaque-context",
+				type: "Note",
+				attributedTo: "https://example.com/person2",
+				content: "Hello, world!"
+			}
+		})
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const opaqueContextIdHttpSignedContext = createRequestContext({
+		federation,
+		request: opaqueContextIdHttpSignedRequest,
+		url: new URL(opaqueContextIdHttpSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: async (resource) => {
+			if (resource === "app-context") {
+				const error = /* @__PURE__ */ new Error(`Opaque context backend is unavailable: ${resource}`);
+				error.name = "jsonld.InvalidUrl";
+				error.details = {
+					code: "loading remote context failed",
+					url: resource
+				};
+				throw error;
+			}
+			return await mockDocumentLoader(new URL(resource).href);
+		}
+	});
+	await assertRejects(() => handleInbox(opaqueContextIdHttpSignedRequest, {
+		recipient: null,
+		context: opaqueContextIdHttpSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...opaqueContextIdHttpSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	}), Error);
+	const opaqueContextTypeErrorHttpSignedRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			"@context": ["app:context", "https://www.w3.org/ns/activitystreams"],
+			id: "https://example.com/activities/http-signed-opaque-typeerror",
+			type: "Create",
+			actor: "https://example.com/person2",
+			object: {
+				id: "https://example.com/notes/http-signed-opaque-typeerror",
+				type: "Note",
+				attributedTo: "https://example.com/person2",
+				content: "Hello, world!"
+			}
+		})
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const opaqueContextTypeErrorHttpSignedContext = createRequestContext({
+		federation,
+		request: opaqueContextTypeErrorHttpSignedRequest,
+		url: new URL(opaqueContextTypeErrorHttpSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: async (resource) => {
+			if (resource === "app:context") throw new TypeError(`Invalid URL: ${resource}`);
+			return await mockDocumentLoader(new URL(resource).href);
+		}
+	});
+	await assertRejects(() => handleInbox(opaqueContextTypeErrorHttpSignedRequest, {
+		recipient: null,
+		context: opaqueContextTypeErrorHttpSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...opaqueContextTypeErrorHttpSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	}), Error);
+	const networkPathContextHttpSignedRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			"@context": ["//cdn.example/ctx", "https://www.w3.org/ns/activitystreams"],
+			id: "https://example.com/activities/http-signed-network-path-context",
+			type: "Create",
+			actor: "https://example.com/person2",
+			object: {
+				id: "https://example.com/notes/http-signed-network-path-context",
+				type: "Note",
+				attributedTo: "https://example.com/person2",
+				content: "Hello, world!"
+			}
+		})
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const networkPathContextHttpSignedContext = createRequestContext({
+		federation,
+		request: networkPathContextHttpSignedRequest,
+		url: new URL(networkPathContextHttpSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: async (resource) => {
+			if (resource === "//cdn.example/ctx") {
+				const error = /* @__PURE__ */ new Error(`Network-path context backend is unavailable: ${resource}`);
+				error.name = "jsonld.InvalidUrl";
+				error.details = {
+					code: "loading remote context failed",
+					url: resource
+				};
+				throw error;
+			}
+			return await mockDocumentLoader(new URL(resource).href);
+		}
+	});
+	await assertRejects(() => handleInbox(networkPathContextHttpSignedRequest, {
+		recipient: null,
+		context: networkPathContextHttpSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...networkPathContextHttpSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	}), Error);
+	const malformedNetworkPathContextHttpSignedRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			"@context": ["//[", "https://www.w3.org/ns/activitystreams"],
+			id: "https://example.com/activities/http-signed-malformed-network-path-context",
+			type: "Create",
+			actor: "https://example.com/person2",
+			object: {
+				id: "https://example.com/notes/http-signed-malformed-network-path-context",
+				type: "Note",
+				attributedTo: "https://example.com/person2",
+				content: "Hello, world!"
+			}
+		})
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const malformedNetworkPathContextHttpSignedContext = createRequestContext({
+		federation,
+		request: malformedNetworkPathContextHttpSignedRequest,
+		url: new URL(malformedNetworkPathContextHttpSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: async (resource) => {
+			if (resource === "//[") {
+				const error = /* @__PURE__ */ new Error(`Malformed network-path context: ${resource}`);
+				error.name = "jsonld.InvalidUrl";
+				error.details = {
+					code: "loading remote context failed",
+					url: resource
+				};
+				throw error;
+			}
+			return await mockDocumentLoader(new URL(resource).href);
+		}
+	});
+	response = await handleInbox(malformedNetworkPathContextHttpSignedRequest, {
+		recipient: null,
+		context: malformedNetworkPathContextHttpSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...malformedNetworkPathContextHttpSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals(response.status, 400);
+	const malformedUrlLikeContextHttpSignedRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			"@context": ["http://[", "https://www.w3.org/ns/activitystreams"],
+			id: "https://example.com/activities/http-signed-malformed-url-like-context",
+			type: "Create",
+			actor: "https://example.com/person2",
+			object: {
+				id: "https://example.com/notes/http-signed-malformed-url-like-context",
+				type: "Note",
+				attributedTo: "https://example.com/person2",
+				content: "Hello, world!"
+			}
+		})
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const malformedUrlLikeContextHttpSignedContext = createRequestContext({
+		federation,
+		request: malformedUrlLikeContextHttpSignedRequest,
+		url: new URL(malformedUrlLikeContextHttpSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: async (resource) => {
+			if (resource === "http://[") {
+				const error = /* @__PURE__ */ new Error(`Invalid remote context URL: ${resource}`);
+				error.name = "jsonld.InvalidUrl";
+				error.details = {
+					code: "loading remote context failed",
+					url: resource
+				};
+				throw error;
+			}
+			return await mockDocumentLoader(new URL(resource).href);
+		}
+	});
+	response = await handleInbox(malformedUrlLikeContextHttpSignedRequest, {
+		recipient: null,
+		context: malformedUrlLikeContextHttpSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...malformedUrlLikeContextHttpSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals(response.status, 400);
+	const malformedContextUrlHttpSignedRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			"@context": ["not a url", "https://www.w3.org/ns/activitystreams"],
+			id: "https://example.com/activities/http-signed-malformed-context",
+			type: "Create",
+			actor: "https://example.com/person2",
+			object: {
+				id: "https://example.com/notes/http-signed-malformed-context",
+				type: "Note",
+				attributedTo: "https://example.com/person2",
+				content: "Hello, world!"
+			}
+		})
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const malformedContextUrlHttpSignedContext = createRequestContext({
+		federation,
+		request: malformedContextUrlHttpSignedRequest,
+		url: new URL(malformedContextUrlHttpSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: async (resource) => {
+			if (resource === "not a url") {
+				const error = /* @__PURE__ */ new Error(`Invalid remote context URL: ${resource}`);
+				error.name = "jsonld.InvalidUrl";
+				error.details = {
+					code: "loading remote context failed",
+					url: resource
+				};
+				throw error;
+			}
+			return await mockDocumentLoader(new URL(resource).href);
+		}
+	});
+	response = await handleInbox(malformedContextUrlHttpSignedRequest, {
+		recipient: null,
+		context: malformedContextUrlHttpSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...malformedContextUrlHttpSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals(response.status, 400);
+	const invalidRemoteContextHttpSignedRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			"@context": [remoteContextUrl, "https://www.w3.org/ns/activitystreams"],
+			id: "https://example.com/activities/http-signed-invalid-remote-context",
+			type: "Create",
+			actor: "https://example.com/person2",
+			object: {
+				id: "https://example.com/notes/http-signed-invalid-remote-context",
+				type: "Note",
+				attributedTo: "https://example.com/person2",
+				content: "Hello, world!"
+			}
+		})
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const invalidRemoteContextHttpSignedContext = createRequestContext({
+		federation,
+		request: invalidRemoteContextHttpSignedRequest,
+		url: new URL(invalidRemoteContextHttpSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: async (resource) => {
+			const url = new URL(resource).href;
+			if (url === remoteContextUrl) return {
+				contextUrl: null,
+				documentUrl: url,
+				document: [
+					"not",
+					"an",
+					"object"
+				]
+			};
+			return await mockDocumentLoader(url);
+		}
+	});
+	response = await handleInbox(invalidRemoteContextHttpSignedRequest, {
+		recipient: null,
+		context: invalidRemoteContextHttpSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...invalidRemoteContextHttpSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals(response.status, 400);
+	const invalidUrlAbsoluteContextHttpSignedRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			"@context": [remoteContextUrl, "https://www.w3.org/ns/activitystreams"],
+			id: "https://example.com/activities/http-signed-invalid-url-context",
+			type: "Create",
+			actor: "https://example.com/person2",
+			ext: "preserve-me",
+			object: {
+				id: "https://example.com/notes/http-signed-invalid-url-context",
+				type: "Note",
+				attributedTo: "https://example.com/person2",
+				content: "Hello, world!"
+			}
+		})
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const invalidUrlAbsoluteContextHttpSignedContext = createRequestContext({
+		federation,
+		request: invalidUrlAbsoluteContextHttpSignedRequest,
+		url: new URL(invalidUrlAbsoluteContextHttpSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: async (resource) => {
+			const url = new URL(resource).href;
+			if (url === remoteContextUrl) throw new TypeError(`Invalid URL: ${url}`);
+			return await mockDocumentLoader(url);
+		}
+	});
+	await assertRejects(() => handleInbox(invalidUrlAbsoluteContextHttpSignedRequest, {
+		recipient: null,
+		context: invalidUrlAbsoluteContextHttpSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...invalidUrlAbsoluteContextHttpSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	}), Error);
+	const typeErrorHttpSignedRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			"@context": [remoteContextUrl, "https://www.w3.org/ns/activitystreams"],
+			id: "https://example.com/activities/http-signed-typeerror-context",
+			type: "Create",
+			actor: "https://example.com/person2",
+			ext: "preserve-me",
+			object: {
+				id: "https://example.com/notes/http-signed-typeerror-context",
+				type: "Note",
+				attributedTo: "https://example.com/person2",
+				content: "Hello, world!"
+			}
+		})
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const typeErrorHttpSignedContext = createRequestContext({
+		federation,
+		request: typeErrorHttpSignedRequest,
+		url: new URL(typeErrorHttpSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: async (resource) => {
+			const url = new URL(resource).href;
+			if (url === remoteContextUrl) throw new TypeError(`The remote context host timed out: ${url}`);
+			return await mockDocumentLoader(url);
+		}
+	});
+	await assertRejects(() => handleInbox(typeErrorHttpSignedRequest, {
+		recipient: null,
+		context: typeErrorHttpSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...typeErrorHttpSignedContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	}), Error);
+	const rangeErrorHttpSignedRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			"@context": [remoteContextUrl, "https://www.w3.org/ns/activitystreams"],
+			id: "https://example.com/activities/http-signed-rangeerror-context",
+			type: "Create",
+			actor: "https://example.com/person2",
+			ext: "preserve-me",
+			object: {
+				id: "https://example.com/notes/http-signed-rangeerror-context",
+				type: "Note",
+				attributedTo: "https://example.com/person2",
+				content: "Hello, world!"
+			}
+		})
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const rangeErrorHttpSignedContext = createRequestContext({
+		federation,
+		request: rangeErrorHttpSignedRequest,
+		url: new URL(rangeErrorHttpSignedRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: async (resource) => {
+			const url = new URL(resource).href;
+			if (url === remoteContextUrl) throw new RangeError(`Temporary remote context cache window exceeded: ${url}`);
+			return await mockDocumentLoader(url);
+		}
+	});
+	await assertRejects(() => handleInbox(rangeErrorHttpSignedRequest, {
+		recipient: null,
+		context: rangeErrorHttpSignedContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...rangeErrorHttpSignedContext,
+				clone: void 0
 			});
 		},
 		...inboxOptions
-	});
-	assertEquals(onNotFoundCalled, null);
-	assertEquals(response.status, 401);
-	onNotFoundCalled = null;
-	const signedRequest = await signRequest(unsignedRequest.clone(), rsaPrivateKey3, rsaPublicKey3.id);
-	const signedContext = createRequestContext({
+	}), Error);
+	const syntaxErrorHttpSignedRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify({
+			"@context": [remoteContextUrl, "https://www.w3.org/ns/activitystreams"],
+			id: "https://example.com/activities/http-signed-syntax-context",
+			type: "Create",
+			actor: "https://example.com/person2",
+			ext: "preserve-me",
+			object: {
+				id: "https://example.com/notes/http-signed-syntax-context",
+				type: "Note",
+				attributedTo: "https://example.com/person2",
+				content: "Hello, world!"
+			}
+		})
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const syntaxErrorHttpSignedContext = createRequestContext({
 		federation,
-		request: signedRequest,
-		url: new URL(signedRequest.url),
+		request: syntaxErrorHttpSignedRequest,
+		url: new URL(syntaxErrorHttpSignedRequest.url),
 		data: void 0,
-		documentLoader: mockDocumentLoader
+		documentLoader: mockDocumentLoader,
+		contextLoader: async (resource) => {
+			const url = new URL(resource).href;
+			if (url === remoteContextUrl) {
+				const error = /* @__PURE__ */ new Error(`Transient syntax failure: ${url}`);
+				error.name = "jsonld.SyntaxError";
+				error.details = { code: "loading remote context failed" };
+				throw error;
+			}
+			return await mockDocumentLoader(url);
+		}
 	});
-	response = await handleInbox(signedRequest, {
+	await assertRejects(() => handleInbox(syntaxErrorHttpSignedRequest, {
 		recipient: null,
-		context: signedContext,
+		context: syntaxErrorHttpSignedContext,
 		inboxContextFactory(_activity) {
 			return createInboxContext({
-				...unsignedContext,
+				...syntaxErrorHttpSignedContext,
 				clone: void 0
 			});
 		},
 		...inboxOptions
-	});
-	assertEquals(onNotFoundCalled, null);
-	assertEquals([response.status, await response.text()], [202, ""]);
+	}), Error);
 	response = await handleInbox(signedRequest, {
 		recipient: "someone",
 		context: signedContext,
@@ -1090,6 +2281,64 @@ test("handleInbox()", async () => {
 	});
 	assertEquals(onNotFoundCalled, null);
 	assertEquals(response.status, 202);
+	const unsafeJson = {
+		"@context": ["https://www.w3.org/ns/activitystreams", { rev: "@reverse" }],
+		id: "https://example.com/activities/unsafe",
+		type: "Announce",
+		actor: "https://example.com/person2",
+		object: "https://example.com/notes/1",
+		rev: { object: {
+			id: "https://example.com/activities/undo",
+			type: "Undo",
+			actor: "https://example.com/person2"
+		} }
+	};
+	const unsafeRequest = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(unsafeJson)
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const unsafeContext = createRequestContext({
+		federation,
+		request: unsafeRequest,
+		url: new URL(unsafeRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader
+	});
+	response = await handleInbox(unsafeRequest, {
+		recipient: null,
+		context: unsafeContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...unsafeContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals(response.status, 202);
+	const unsafeLdRequest = new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(await signJsonLd(unsafeJson, rsaPrivateKey3, rsaPublicKey3.id, { contextLoader: mockDocumentLoader }))
+	});
+	const unsafeLdContext = createRequestContext({
+		federation,
+		request: unsafeLdRequest,
+		url: new URL(unsafeLdRequest.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader
+	});
+	response = await handleInbox(unsafeLdRequest, {
+		recipient: null,
+		context: unsafeLdContext,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...unsafeLdContext,
+				clone: void 0
+			});
+		},
+		...inboxOptions
+	});
+	assertEquals(response.status, 400);
 	const signedInvalidRequest = await signRequest(new Request("https://example.com/", {
 		method: "POST",
 		body: JSON.stringify({
@@ -1487,6 +2736,263 @@ test("handleOutbox()", async () => {
 	assertEquals(response.status, 500);
 	assertEquals(onErrorCalled, true);
 });
+test("handleInbox() preserves the raw signed payload for inboxContextFactory", async () => {
+	const federation = createFederation({ kv: new MemoryKvStore() });
+	const remoteContextUrl = "https://remote.example/contexts/ext";
+	const sourceContextLoader = async (resource) => {
+		const url = new URL(resource).href;
+		if (url === remoteContextUrl) return {
+			contextUrl: null,
+			documentUrl: url,
+			document: { "@context": { ext: "https://example.com/ext" } }
+		};
+		return await mockDocumentLoader(url);
+	};
+	const signed = await signJsonLd({
+		"@context": [remoteContextUrl, "https://www.w3.org/ns/activitystreams"],
+		id: "https://example.com/activities/preserve-raw",
+		type: "Create",
+		actor: "https://example.com/person2",
+		ext: "preserve-me",
+		object: {
+			id: "https://example.com/notes/preserve-raw",
+			type: "Note",
+			attributedTo: "https://example.com/person2",
+			content: "Hello, world!"
+		}
+	}, rsaPrivateKey3, rsaPublicKey3.id, { contextLoader: sourceContextLoader });
+	const request = new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(signed)
+	});
+	const context = createRequestContext({
+		federation,
+		request,
+		url: new URL(request.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: sourceContextLoader
+	});
+	let receivedRaw = null;
+	let receivedTyped = null;
+	const inboxListeners = new ActivityListenerSet();
+	inboxListeners.add(Create, (ctx, activity) => {
+		receivedRaw = ctx.activity;
+		receivedTyped = activity;
+	});
+	const response = await handleInbox(request, {
+		recipient: "someone",
+		context,
+		inboxContextFactory(recipient, activity, activityId, activityType) {
+			return {
+				...createInboxContext({
+					...context,
+					clone: void 0,
+					recipient
+				}),
+				activity,
+				activityId,
+				activityType
+			};
+		},
+		kv: new MemoryKvStore(),
+		kvPrefixes: {
+			activityIdempotence: ["_fedify", "activityIdempotence"],
+			publicKey: ["_fedify", "publicKey"],
+			acceptSignatureNonce: ["_fedify", "acceptSignatureNonce"]
+		},
+		actorDispatcher: (_ctx, identifier) => identifier === "someone" ? new Person({ name: "Someone" }) : null,
+		inboxListeners,
+		onNotFound: () => new Response("Not found", { status: 404 }),
+		signatureTimeWindow: { minutes: 5 },
+		skipSignatureVerification: false
+	});
+	assertEquals([response.status, await response.text()], [202, ""]);
+	assertEquals(receivedRaw, signed);
+	const delivered = receivedTyped;
+	assert(delivered != null);
+	assertEquals(delivered.id?.href, "https://example.com/activities/preserve-raw");
+});
+test("handleInbox() enqueues normalizedActivity for LD-signed inbox work", async () => {
+	const remoteContextUrl = "https://remote.example/contexts/ext";
+	const sourceContextLoader = async (resource) => {
+		const url = new URL(resource).href;
+		if (url === remoteContextUrl) return {
+			contextUrl: null,
+			documentUrl: url,
+			document: { "@context": { ext: "https://example.com/ext" } }
+		};
+		return await mockDocumentLoader(url);
+	};
+	let queuedMessage = null;
+	const queue = {
+		enqueue(message) {
+			queuedMessage = message;
+			return Promise.resolve();
+		},
+		async listen() {}
+	};
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		queue
+	});
+	const signed = await signJsonLd({
+		"@context": [remoteContextUrl, "https://www.w3.org/ns/activitystreams"],
+		id: "https://example.com/activities/enqueued-normalized",
+		type: "Create",
+		actor: "https://example.com/person2",
+		ext: "preserve-me",
+		object: {
+			id: "https://example.com/notes/enqueued-normalized",
+			type: "Note",
+			attributedTo: "https://example.com/person2",
+			content: "Hello, world!"
+		}
+	}, rsaPrivateKey3, rsaPublicKey3.id, { contextLoader: sourceContextLoader });
+	const request = new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(signed)
+	});
+	const context = createRequestContext({
+		federation,
+		request,
+		url: new URL(request.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: sourceContextLoader
+	});
+	const response = await handleInbox(request, {
+		recipient: "someone",
+		context,
+		inboxContextFactory(recipient, activity, activityId, activityType) {
+			return {
+				...createInboxContext({
+					...context,
+					clone: void 0,
+					recipient
+				}),
+				activity,
+				activityId,
+				activityType
+			};
+		},
+		kv: new MemoryKvStore(),
+		kvPrefixes: {
+			activityIdempotence: ["_fedify", "activityIdempotence"],
+			publicKey: ["_fedify", "publicKey"],
+			acceptSignatureNonce: ["_fedify", "acceptSignatureNonce"]
+		},
+		queue,
+		actorDispatcher: (_ctx, identifier) => identifier === "someone" ? new Person({ name: "Someone" }) : null,
+		onNotFound: () => new Response("Not found", { status: 404 }),
+		signatureTimeWindow: { minutes: 5 },
+		skipSignatureVerification: false
+	});
+	assertEquals([response.status, await response.text()], [202, "Activity is enqueued."]);
+	const enqueued = queuedMessage;
+	assert(enqueued != null);
+	const inboxMessage = enqueued;
+	assertEquals(inboxMessage.activity, signed);
+	assertEquals(inboxMessage.normalizedActivity, await compactJsonLd(signed, sourceContextLoader));
+	assertEquals(inboxMessage.ldSignatureVerified, true);
+});
+test("handleInbox() caches normalizedActivity for queued signature-bearing fallback traffic", async () => {
+	const remoteContextUrl = "https://remote.example/contexts/ext";
+	let queuedMessage = null;
+	const queue = {
+		enqueue(message) {
+			queuedMessage = message;
+			return Promise.resolve();
+		},
+		async listen() {}
+	};
+	const federation = createFederation({
+		kv: new MemoryKvStore(),
+		queue
+	});
+	const sourceContextLoader = async (resource) => {
+		const url = new URL(resource).href;
+		if (url === remoteContextUrl) return {
+			contextUrl: null,
+			documentUrl: url,
+			document: { "@context": { ext: "https://example.com/ext" } }
+		};
+		return await mockDocumentLoader(url);
+	};
+	const unsignedBody = {
+		"@context": [remoteContextUrl, "https://www.w3.org/ns/activitystreams"],
+		id: "https://example.com/activities/non-lds-queued-signature",
+		type: "Create",
+		actor: "https://example.com/person2",
+		ext: "preserve-me",
+		object: {
+			id: "https://example.com/notes/non-lds-queued-signature",
+			type: "Note",
+			attributedTo: "https://example.com/person2",
+			content: "Hello, world!"
+		},
+		signature: {
+			type: "RsaSignature2017",
+			creator: "not a url",
+			created: "2024-09-12T16:50:46Z",
+			signatureValue: "Zm9v"
+		}
+	};
+	const request = await signRequest(new Request("https://example.com/", {
+		method: "POST",
+		body: JSON.stringify(unsignedBody)
+	}), rsaPrivateKey3, rsaPublicKey3.id);
+	const context = createRequestContext({
+		federation,
+		request,
+		url: new URL(request.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: sourceContextLoader
+	});
+	const response = await handleInbox(request, {
+		recipient: "someone",
+		context,
+		inboxContextFactory(recipient, activity, activityId, activityType) {
+			return {
+				...createInboxContext({
+					...context,
+					clone: void 0,
+					recipient
+				}),
+				activity,
+				activityId,
+				activityType
+			};
+		},
+		kv: new MemoryKvStore(),
+		kvPrefixes: {
+			activityIdempotence: ["_fedify", "activityIdempotence"],
+			publicKey: ["_fedify", "publicKey"],
+			acceptSignatureNonce: ["_fedify", "acceptSignatureNonce"]
+		},
+		queue,
+		actorDispatcher: (_ctx, identifier) => identifier === "someone" ? new Person({ name: "Someone" }) : null,
+		onNotFound: () => new Response("Not found", { status: 404 }),
+		signatureTimeWindow: { minutes: 5 },
+		skipSignatureVerification: false
+	});
+	assertEquals([response.status, await response.text()], [202, "Activity is enqueued."]);
+	if (queuedMessage == null) throw new Error("Inbox message not queued.");
+	const inboxMessage = queuedMessage;
+	assertEquals(inboxMessage, {
+		type: "inbox",
+		id: inboxMessage.id,
+		baseUrl: "https://example.com",
+		activity: unsignedBody,
+		normalizedActivity: await compactJsonLd(unsignedBody, sourceContextLoader),
+		ldSignatureVerified: false,
+		started: inboxMessage.started,
+		attempt: 0,
+		identifier: "someone",
+		traceContext: inboxMessage.traceContext
+	});
+});
 test("respondWithObject()", async () => {
 	const response = await respondWithObject(new Note({
 		id: new URL("https://example.com/notes/1"),
@@ -1908,11 +3414,129 @@ test("handleCustomCollection()", async () => {
 	assertEquals(onNotFoundCalled, null);
 	assertEquals(onUnauthorizedCalled, null);
 });
+test("handleCustomCollection() records OpenTelemetry collection metrics", async () => {
+	const [meterProvider, recorder] = createTestMeterProvider();
+	const context = createRequestContext({
+		federation: createFederation({
+			kv: new MemoryKvStore(),
+			meterProvider
+		}),
+		data: void 0,
+		url: new URL("https://example.com/users/someone/custom"),
+		request: new Request("https://example.com/users/someone/custom", { headers: { Accept: "application/activity+json" } })
+	});
+	const dispatcher = (_ctx, values) => values.identifier === "someone" ? { items: [new Create({ id: new URL("https://example.com/activities/1") }), new Create({ id: new URL("https://example.com/activities/2") })] } : null;
+	const counter = (_ctx, values) => values.identifier === "someone" ? 2 : null;
+	assertEquals((await handleCustomCollection(context.request, {
+		context,
+		name: "custom collection",
+		values: { identifier: "someone" },
+		collectionCallbacks: {
+			dispatcher,
+			counter
+		},
+		filterPredicate: (item) => item.id?.href === "https://example.com/activities/1",
+		meterProvider,
+		onNotFound: () => new Response("Not found", { status: 404 }),
+		onUnauthorized: () => new Response("Unauthorized", { status: 401 })
+	})).status, 200);
+	const requests = recorder.getMeasurements("activitypub.collection.request");
+	assertEquals(requests.length, 1);
+	assertEquals(requests[0].attributes["activitypub.collection.kind"], "custom");
+	assertEquals(requests[0].attributes["activitypub.collection.page"], false);
+	assertEquals(requests[0].attributes["fedify.collection.dispatcher"], "custom");
+	assertEquals(requests[0].attributes["activitypub.collection.result"], "served");
+	assertEquals(requests[0].attributes["http.response.status_code"], 200);
+	const durations = recorder.getMeasurements("activitypub.collection.dispatch.duration");
+	assertEquals(durations.length, 1);
+	assertEquals(durations[0].attributes["fedify.collection.dispatcher"], "custom");
+	assertEquals(durations[0].attributes["http.response.status_code"], 200);
+	const items = recorder.getMeasurements("activitypub.collection.page.items");
+	assertEquals(items.length, 1);
+	assertEquals(items[0].value, 1);
+	assertEquals(items[0].attributes["http.response.status_code"], 200);
+	const totalItems = recorder.getMeasurements("activitypub.collection.total_items");
+	assertEquals(totalItems.length, 1);
+	assertEquals(totalItems[0].value, 2);
+	assertEquals(totalItems[0].attributes["http.response.status_code"], 200);
+});
+test("handleCustomCollection() records not_found status on dispatch metrics", async () => {
+	const [meterProvider, recorder] = createTestMeterProvider();
+	const context = createRequestContext({
+		federation: createFederation({
+			kv: new MemoryKvStore(),
+			meterProvider
+		}),
+		data: void 0,
+		url: new URL("https://example.com/users/nobody/custom"),
+		request: new Request("https://example.com/users/nobody/custom", { headers: { Accept: "application/activity+json" } })
+	});
+	const dispatcher = () => null;
+	assertEquals((await handleCustomCollection(context.request, {
+		context,
+		name: "custom collection",
+		values: { identifier: "nobody" },
+		collectionCallbacks: { dispatcher },
+		meterProvider,
+		onNotFound: () => new Response("Not found", { status: 404 }),
+		onUnauthorized: () => new Response("Unauthorized", { status: 401 })
+	})).status, 404);
+	const durations = recorder.getMeasurements("activitypub.collection.dispatch.duration");
+	assertEquals(durations.length, 1);
+	assertEquals(durations[0].attributes["activitypub.collection.result"], "not_found");
+	assertEquals(durations[0].attributes["http.response.status_code"], 404);
+});
+test("handleCustomCollection() classifies deferred collection metrics as error", async () => {
+	const [meterProvider, recorder] = createTestMeterProvider();
+	const context = createRequestContext({
+		federation: createFederation({
+			kv: new MemoryKvStore(),
+			meterProvider
+		}),
+		data: void 0,
+		url: new URL("https://example.com/users/someone/custom"),
+		request: new Request("https://example.com/users/someone/custom", { headers: { Accept: "application/activity+json" } })
+	});
+	const brokenActivity = new Create({ id: new URL("https://example.com/activities/1") });
+	globalThis.Object.defineProperty(brokenActivity, "toJsonLd", { value: () => {
+		throw new Error("serialization failed");
+	} });
+	const dispatcher = () => ({ items: [brokenActivity] });
+	const counter = () => 1;
+	await assertRejects(() => handleCustomCollection(context.request, {
+		context,
+		name: "custom collection",
+		values: { identifier: "someone" },
+		collectionCallbacks: {
+			dispatcher,
+			counter
+		},
+		meterProvider,
+		onNotFound: () => new Response("Not found", { status: 404 }),
+		onUnauthorized: () => new Response("Unauthorized", { status: 401 })
+	}), Error, "serialization failed");
+	const requests = recorder.getMeasurements("activitypub.collection.request");
+	assertEquals(requests.length, 1);
+	assertEquals(requests[0].attributes["activitypub.collection.result"], "error");
+	const durations = recorder.getMeasurements("activitypub.collection.dispatch.duration");
+	assertEquals(durations.length, 1);
+	assertEquals(durations[0].attributes["activitypub.collection.result"], "error");
+	const items = recorder.getMeasurements("activitypub.collection.page.items");
+	assertEquals(items.length, 1);
+	assertEquals(items[0].value, 1);
+	assertEquals(items[0].attributes["activitypub.collection.result"], "error");
+	const totalItems = recorder.getMeasurements("activitypub.collection.total_items");
+	assertEquals(totalItems.length, 1);
+	assertEquals(totalItems[0].value, 1);
+	assertEquals(totalItems[0].attributes["activitypub.collection.result"], "error");
+});
 test("handleInbox() records OpenTelemetry span events", async () => {
 	const [tracerProvider, exporter] = createTestTracerProvider();
+	const [meterProvider, recorder] = createTestMeterProvider();
 	const kv = new MemoryKvStore();
 	const federation = createFederation({
 		kv,
+		meterProvider,
 		tracerProvider
 	});
 	const activity = new Create({
@@ -1974,6 +3598,7 @@ test("handleInbox() records OpenTelemetry span events", async () => {
 		onNotFound: (_request) => new Response("Not found", { status: 404 }),
 		signatureTimeWindow: false,
 		skipSignatureVerification: true,
+		meterProvider,
 		tracerProvider
 	})).status, 202);
 	assert(receivedActivity != null);
@@ -1992,12 +3617,101 @@ test("handleInbox() records OpenTelemetry span events", async () => {
 	const recordedActivity = JSON.parse(event.attributes["activitypub.activity.json"]);
 	assertEquals(recordedActivity.id, "https://example.com/activity");
 	assertEquals(recordedActivity.type, "Create");
+	const durations = recorder.getMeasurements("activitypub.inbox.processing_duration");
+	assertEquals(durations.length, 1);
+	assertEquals(durations[0].type, "histogram");
+	assertGreaterOrEqual(durations[0].value, 0);
+	assertEquals(durations[0].attributes["activitypub.activity.type"], "https://www.w3.org/ns/activitystreams#Create");
+});
+test("handleInbox() records fedify.queue.task.enqueued when queued", async () => {
+	const [meterProvider, recorder] = createTestMeterProvider();
+	const kv = new MemoryKvStore();
+	const federation = createFederation({
+		kv,
+		meterProvider
+	});
+	const activity = new Create({
+		id: new URL("https://example.com/activities/queued"),
+		actor: new URL("https://example.com/users/someone"),
+		object: new Note({
+			id: new URL("https://example.com/note-queued"),
+			content: "Queue me up"
+		})
+	});
+	const signed = await signRequest(new Request("https://example.com/users/someone/inbox", {
+		method: "POST",
+		headers: { "Content-Type": "application/activity+json" },
+		body: JSON.stringify(await activity.toJsonLd())
+	}), rsaPrivateKey3, new URL("https://example.com/users/someone#main-key"));
+	const context = createRequestContext({
+		federation,
+		request: signed,
+		url: new URL(signed.url),
+		data: void 0,
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader,
+		getActorUri(identifier) {
+			return new URL(`https://example.com/users/${identifier}`);
+		}
+	});
+	const actorDispatcher = (ctx, identifier) => {
+		if (identifier !== "someone") return null;
+		return new Person({
+			id: ctx.getActorUri(identifier),
+			name: "Someone",
+			inbox: new URL("https://example.com/users/someone/inbox"),
+			publicKey: rsaPublicKey2
+		});
+	};
+	const queuedMessages = [];
+	assertEquals((await handleInbox(signed, {
+		recipient: "someone",
+		context,
+		inboxContextFactory(_activity) {
+			return createInboxContext({
+				...context,
+				clone: void 0
+			});
+		},
+		kv,
+		kvPrefixes: {
+			activityIdempotence: ["activityIdempotence"],
+			publicKey: ["publicKey"],
+			acceptSignatureNonce: ["acceptSignatureNonce"]
+		},
+		actorDispatcher,
+		inboxListeners: new ActivityListenerSet(),
+		inboxErrorHandler: void 0,
+		onNotFound: (_request) => new Response("Not found", { status: 404 }),
+		signatureTimeWindow: false,
+		skipSignatureVerification: true,
+		queue: {
+			enqueue(message, _options) {
+				queuedMessages.push(message);
+				return Promise.resolve();
+			},
+			listen(_handler, _options) {
+				return Promise.resolve();
+			}
+		},
+		meterProvider
+	})).status, 202);
+	assertEquals(queuedMessages.length, 1);
+	const enqueued = recorder.getMeasurements("fedify.queue.task.enqueued");
+	assertEquals(enqueued.length, 1);
+	assertEquals(enqueued[0].type, "counter");
+	assertEquals(enqueued[0].attributes["fedify.queue.role"], "inbox");
+	assertEquals(enqueued[0].attributes["fedify.queue.task.attempt"], 0);
+	assertEquals(enqueued[0].attributes["activitypub.activity.type"], "https://www.w3.org/ns/activitystreams#Create");
+	assertEquals(enqueued[0].attributes["fedify.queue.backend"], void 0);
 });
 test("handleInbox() records unverified HTTP signature details", async () => {
 	const [tracerProvider, exporter] = createTestTracerProvider();
+	const [meterProvider, recorder] = createTestMeterProvider();
 	const kv = new MemoryKvStore();
 	const federation = createFederation({
 		kv,
+		meterProvider,
 		tracerProvider
 	});
 	const keyId = new URL("https://gone.example/users/someone#main-key");
@@ -2062,6 +3776,7 @@ test("handleInbox() records unverified HTTP signature details", async () => {
 		onNotFound: (_request) => new Response("Not found", { status: 404 }),
 		signatureTimeWindow: false,
 		skipSignatureVerification: false,
+		meterProvider,
 		tracerProvider
 	})).status, 202);
 	const verifySpans = exporter.getSpans("http_signatures.verify");
@@ -2074,6 +3789,12 @@ test("handleInbox() records unverified HTTP signature details", async () => {
 	assert(event.attributes != null);
 	assertEquals(event.attributes["http_signatures.failure_reason"], "keyFetchError");
 	assertEquals(event.attributes["http_signatures.key_fetch_status"], 410);
+	const failures = recorder.getMeasurements("activitypub.signature.verification_failure");
+	assertEquals(failures.length, 1);
+	assertEquals(failures[0].type, "counter");
+	assertEquals(failures[0].value, 1);
+	assertEquals(failures[0].attributes["activitypub.remote.host"], "gone.example");
+	assertEquals(failures[0].attributes["activitypub.verification.failure_reason"], "keyFetchError");
 });
 test("handleInbox() challenge policy enabled + unsigned request", async () => {
 	const activity = new Create({
@@ -2476,6 +4197,7 @@ test("handleInbox() nonce consumption on valid signed request", async () => {
 	]), void 0, "Nonce must be consumed after use");
 });
 test("handleInbox() nonce replay prevention", async () => {
+	const [meterProvider, recorder] = createTestMeterProvider();
 	const activity = new Create({
 		id: new URL("https://example.com/activities/nonce-3"),
 		actor: new URL("https://example.com/person2"),
@@ -2496,7 +4218,10 @@ test("handleInbox() nonce replay prevention", async () => {
 		rfc9421: { nonce }
 	});
 	const context = createRequestContext({
-		federation: createFederation({ kv: new MemoryKvStore() }),
+		federation: createFederation({
+			kv: new MemoryKvStore(),
+			meterProvider
+		}),
 		request: signedRequest,
 		url: new URL(signedRequest.url),
 		data: void 0,
@@ -2526,6 +4251,7 @@ test("handleInbox() nonce replay prevention", async () => {
 		onNotFound: () => new Response("Not found", { status: 404 }),
 		signatureTimeWindow: { minutes: 5 },
 		skipSignatureVerification: false,
+		meterProvider,
 		inboxChallengePolicy: {
 			enabled: true,
 			requestNonce: true,
@@ -2540,6 +4266,11 @@ test("handleInbox() nonce replay prevention", async () => {
 	assert(parsed[0].parameters.nonce != null, "Fresh challenge must include a new nonce");
 	assert(parsed[0].parameters.nonce !== nonce, "Fresh nonce must differ from the replayed one");
 	assertEquals(response.headers.get("Cache-Control"), "no-store", "Challenge response must have Cache-Control: no-store");
+	const failures = recorder.getMeasurements("activitypub.signature.verification_failure");
+	assertEquals(failures.length, 1);
+	assertEquals(failures[0].value, 1);
+	assertEquals(failures[0].attributes["activitypub.remote.host"], "example.com");
+	assertEquals(failures[0].attributes["activitypub.verification.failure_reason"], "invalidNonce");
 });
 test("handleInbox() nonce bypass: valid sig without nonce + invalid sig with nonce", async () => {
 	const activity = new Create({
@@ -2619,6 +4350,7 @@ test("handleInbox() nonce bypass: valid sig without nonce + invalid sig with non
 	]), true, "Nonce must not be consumed when it comes from a non-verified signature");
 });
 test("handleInbox() actor/key mismatch does not consume nonce", async () => {
+	const [meterProvider, recorder] = createTestMeterProvider();
 	const maliciousActivity = new Create({
 		id: new URL("https://attacker.example.com/activities/mismatch-nonce-1"),
 		actor: new URL("https://victim.example.com/users/alice"),
@@ -2644,7 +4376,10 @@ test("handleInbox() actor/key mismatch does not consume nonce", async () => {
 		rfc9421: { nonce }
 	});
 	const context = createRequestContext({
-		federation: createFederation({ kv: new MemoryKvStore() }),
+		federation: createFederation({
+			kv: new MemoryKvStore(),
+			meterProvider
+		}),
 		request: maliciousRequest,
 		url: new URL(maliciousRequest.url),
 		data: void 0,
@@ -2674,6 +4409,7 @@ test("handleInbox() actor/key mismatch does not consume nonce", async () => {
 		onNotFound: () => new Response("Not found", { status: 404 }),
 		signatureTimeWindow: { minutes: 5 },
 		skipSignatureVerification: false,
+		meterProvider,
 		inboxChallengePolicy: {
 			enabled: true,
 			requestNonce: true,
@@ -2687,6 +4423,11 @@ test("handleInbox() actor/key mismatch does not consume nonce", async () => {
 		"acceptSignatureNonce",
 		nonce
 	]), true, "Nonce must not be consumed when actor/key ownership check fails");
+	const failures = recorder.getMeasurements("activitypub.signature.verification_failure");
+	assertEquals(failures.length, 1);
+	assertEquals(failures[0].value, 1);
+	assertEquals(failures[0].attributes["activitypub.remote.host"], "example.com");
+	assertEquals(failures[0].attributes["activitypub.verification.failure_reason"], "actorKeyMismatch");
 });
 test("handleInbox() challenge policy enabled + unverifiedActivityHandler returns undefined", async () => {
 	const activity = new Create({