@fedify/fedify 2.4.0-dev.2256 → 2.4.0-dev.2260

package/dist/{middleware-BfYke3YQ.js → middleware-DfUWPAa-.js}

@@ -2,10 +2,10 @@ import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
 import { t as __exportAll } from "./rolldown-runtime-BC-Eo5Mj.js";
 import { r as getDefaultActivityTransformers } from "./transformers-DAtXl_Kc.js";
-import { $ as instrumentDocumentLoader, A as hasSignature, At as name, C as InvalidContextReferenceError, Ct as hasPortableActor, Dt as isPortableUri, E as compactJsonLd, Et as isPortableKeyId, F as verifyCompactJsonLd, G as validateCryptoKey, M as isClearlyMalformedContextReference, N as isInvalidUrlTypeError, O as detachSignature, Ot as isSameObjectId, P as signJsonLd, Q as getRemoteHost, R as wrapContextLoaderForJsonLd, S as normalizeOutgoingActivityJsonLd, St as getRawCanonicalPortableId, Tt as isPortableId, W as importJwk, X as getDurationMs, Z as getFederationMetrics, _ as verifyObject, at as recordCollectionTotalItems, b as verifyPortableObjectProofWithRoot, bt as getGatewayKeyBase, c as verifyRequestDetailed, ct as recordInboxActivity, d as InvalidPortableObjectIdError, dt as recordWebFingerHandle, et as isAbortError, f as classifyFep2277CoreType, ft as registerQueueDepthGauge, g as verifyMapLocalProof, h as signObject, i as selectRequestSignature, it as recordCollectionRequest, j as hasSignatureLike, jt as version, k as getNormalizationContextLoader, lt as recordOutboxActivity, m as hasProofLike, mt as formatAcceptSignature, n as listRequestSignatures, nt as recordCollectionDispatchDuration, o as validateMaxSignatures, pt as preloadedOnlyDocumentLoader, q as MAX_PORTABLE_KEY_TTL, r as parseRfc9421SignatureInput, rt as recordCollectionPageItems, s as verifyRequest, st as recordFanoutRecipients, t as doubleKnock, tt as recordCircuitBreakerStateChange, ut as recordOutboxEnqueue, v as verifyPortableObjectProof, vt as getAuthenticationOrigin, w as assertSafeJsonLd, wt as isCompatibleKeyId, xt as getPortableDid, y as verifyPortableObjectProofPolicy, yt as getCanonicalPortableId, z as exportJwk } from "./http-BGb3QioZ.js";
+import { $ as instrumentDocumentLoader, A as hasSignature, At as isPortableUri, C as InvalidContextReferenceError, Ct as getGatewayKeyBase, Dt as isCompatibleKeyId, E as compactJsonLd, Et as hasPortableActor, F as verifyCompactJsonLd, G as validateCryptoKey, M as isClearlyMalformedContextReference, N as isInvalidUrlTypeError, Nt as name, O as detachSignature, Ot as isPortableId, P as signJsonLd, Pt as version, Q as getRemoteHost, R as wrapContextLoaderForJsonLd, S as normalizeOutgoingActivityJsonLd, St as getCanonicalPortableId, Tt as getRawCanonicalPortableId, W as importJwk, X as getDurationMs, Z as getFederationMetrics, _ as verifyObject, at as recordCollectionTotalItems, b as verifyPortableObjectProofWithRoot, bt as verificationObservation, c as verifyRequestDetailed, ct as recordInboxActivity, d as InvalidPortableObjectIdError, dt as recordWebFingerHandle, et as isAbortError, f as classifyFep2277CoreType, ft as registerQueueDepthGauge, g as verifyMapLocalProof, h as signObject, i as selectRequestSignature, it as recordCollectionRequest, j as hasSignatureLike, jt as isSameObjectId, k as getNormalizationContextLoader, kt as isPortableKeyId, lt as recordOutboxActivity, m as hasProofLike, mt as formatAcceptSignature, n as listRequestSignatures, nt as recordCollectionDispatchDuration, o as validateMaxSignatures, pt as preloadedOnlyDocumentLoader, q as MAX_PORTABLE_KEY_TTL, r as parseRfc9421SignatureInput, rt as recordCollectionPageItems, s as verifyRequest, st as recordFanoutRecipients, t as doubleKnock, tt as recordCircuitBreakerStateChange, ut as recordOutboxEnqueue, v as verifyPortableObjectProof, vt as observeAttempt, w as assertSafeJsonLd, wt as getPortableDid, xt as getAuthenticationOrigin, y as verifyPortableObjectProofPolicy, yt as snapshotKey, z as exportJwk } from "./http-DRMu1C2T.js";
 import { a as MAX_BODY_SIZE, i as BodyTooLargeError, n as getNodeInfo, o as readBoundedText, t as nodeInfoToJson } from "./types-_S2_MeLF.js";
-import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-BuBV6xTo.js";
-import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-CGhEgt98.js";
+import { n as doesActorOwnKey, r as getKeyOwner, t as verifyPortableObject } from "./portable-collection-COcJxZg_.js";
+import { n as getAuthenticatedDocumentLoader, t as kvCache } from "./kv-cache-DZLpqhW9.js";
 import { getLogger, withContext } from "@logtape/logtape";
 import { Router, RouterError, assertPath } from "@fedify/uri-template";
 import { Activity, Collection, CollectionPage, CryptographicKey, Link, Multikey, Object as Object$1, OrderedCollection, OrderedCollectionPage, PUBLIC_COLLECTION, Tombstone, getTypeId, isActor, lookupObject, traverseCollection } from "@fedify/vocab";
@@ -100,6 +100,7 @@ var FederationBuilderImpl = class {
 	featuredTagsCallbacks;
 	inboxListeners;
 	outboxListeners;
+	inboxRequestFinishedHandler;
 	inboxErrorHandler;
 	outboxListenerErrorHandler;
 	outboxAuthorizePredicate;
@@ -161,6 +162,7 @@ var FederationBuilderImpl = class {
 		f.featuredTagsCallbacks = this.featuredTagsCallbacks == null ? void 0 : { ...this.featuredTagsCallbacks };
 		f.inboxListeners = this.inboxListeners?.clone();
 		f.outboxListeners = this.outboxListeners?.clone();
+		f.inboxRequestFinishedHandler = this.inboxRequestFinishedHandler;
 		f.inboxErrorHandler = this.inboxErrorHandler;
 		f.outboxListenerErrorHandler = this.outboxListenerErrorHandler;
 		f.outboxAuthorizePredicate = this.outboxAuthorizePredicate;
@@ -641,6 +643,10 @@ var FederationBuilderImpl = class {
 				this.inboxErrorHandler = handler;
 				return setters;
 			},
+			onRequestFinished: (handler) => {
+				this.inboxRequestFinishedHandler = handler;
+				return setters;
+			},
 			onUnverifiedActivity: (handler) => {
 				this.unverifiedActivityHandler = handler;
 				return setters;
@@ -1446,6 +1452,111 @@ async function buildCollectionSynchronizationHeader(collectionId, actorIds) {
 	return `collectionId="${collectionId}", url="${url}", digest="${encodeHex(await digest(actorIds))}"`;
 }
 //#endregion
+//#region src/federation/inbox-observation.ts
+/** Internal state owned by the ingress boundary, never serialized into queues. */
+var InboxObservation = class {
+	inbox;
+	payload = { status: "unavailable" };
+	activity = null;
+	authentication = { status: "notDetermined" };
+	hasException = false;
+	stage = "prepare";
+	result = {
+		disposition: "rejected",
+		reason: "recipientNotFound"
+	};
+	verification = {
+		attempts: [],
+		subject: {
+			id: null,
+			pointer: ""
+		},
+		parsedObject: (object) => {
+			if (object instanceof Activity) {
+				this.activity = object;
+				this.verification.subject.id = object.id == null ? null : new URL(object.id.href);
+			}
+		}
+	};
+	constructor(inbox) {
+		this.inbox = inbox;
+	}
+	/** Run an ingress operation and project telemetry; fetch owns completion. */
+	async run(operation, span) {
+		let response;
+		let outcome;
+		let threw = false;
+		let originalError;
+		try {
+			response = await operation();
+			outcome = {
+				type: "response",
+				status: response.status,
+				...this.result
+			};
+		} catch (error) {
+			threw = true;
+			this.hasException = true;
+			originalError = error;
+			outcome = {
+				type: "exception",
+				stage: this.stage,
+				error
+			};
+		}
+		if (span != null) this.project(span, outcome);
+		if (threw) throw originalError;
+		return response;
+	}
+	/** Complete standalone handler calls that have no enclosing fetch boundary. */
+	async runAndFinish(getContext, handler, operation) {
+		let response;
+		try {
+			response = await this.run(operation);
+		} catch (error) {
+			await this.finish(getContext(), handler, {
+				type: "exception",
+				stage: this.stage,
+				error
+			});
+			throw error;
+		}
+		await this.finish(getContext(), handler, {
+			type: "response",
+			status: response.status,
+			...this.result
+		});
+		return response;
+	}
+	project(span, outcome) {
+		span.setAttribute("activitypub.authentication.status", this.authentication.status);
+		if (this.authentication.status === "rejected") span.setAttribute("activitypub.verification.failure_reason", this.authentication.reason.type);
+		span.setAttribute("activitypub.inbox.disposition", outcome?.type === "exception" || this.hasException ? "exception" : this.result.disposition);
+	}
+	async finish(context, handler, outcome) {
+		if (handler == null) return;
+		const report = {
+			inbox: this.inbox,
+			payload: this.payload,
+			activity: this.activity,
+			attempts: this.verification.attempts,
+			authentication: this.authentication,
+			outcome
+		};
+		try {
+			await handler(context, report);
+		} catch (error) {
+			try {
+				getLogger([
+					"fedify",
+					"federation",
+					"inbox"
+				]).error("An unexpected error occurred in inbox request finished handler:\n{error}", { error });
+			} catch {}
+		}
+	}
+};
+//#endregion
 //#region src/sig/compound-proof.ts
 const textEncoder = new TextEncoder();
 /**
@@ -1880,6 +1991,26 @@ function findUnsupportedCompoundProofShape(json) {
 	return findInJsonMaps(json, (map, path) => Object.hasOwn(map, "proof") && !isJsonMap$1(map.proof) ? childPath(path, "proof") : void 0) ?? null;
 }
 /**
+* Finds the first embedded map that carries a direct `proof` but not its own
+* `@context`.  The map-local compound-proof profile verifies each proof-bearing
+* map as a self-contained document, so the inbox rejects such a map with
+* `missingContext` whatever its proof.  An object embedded with its captured
+* signed representation, e.g., by {@link signObject}, always keeps its own
+* `@context`; one rebuilt under its parent's context, e.g., an object parsed
+* from a received document, never does, and its proof no longer covers what
+* it has become anyway.
+*
+* The input must be a finite, already-materialized JSON tree; see
+* {@link containsCompoundPortableObject}.
+*
+* @returns The RFC 6901 JSON Pointer to the map, or `null` if every embedded
+*          proof-bearing map has its own `@context`.
+* @internal
+*/
+function findEmbeddedProofWithoutContext(json) {
+	return findInJsonMaps(json, (map, path) => path !== "" && Object.hasOwn(map, "proof") && !Object.hasOwn(map, "@context") ? path : void 0) ?? null;
+}
+/**
 * Discovers direct literal proof-bearing maps in an immutable JSON snapshot.
 *
 * Discovery is bounded and atomic.  Unsupported proof shapes, non-JSON input,
@@ -1934,7 +2065,23 @@ async function verifyDiscoveredProofDocuments(discovered, options) {
 			verified: false,
 			reason: { type: "missingContext" }
 		});
-		const key = await verifyMapLocalProof(document.securedDocument, options);
+		const inherited = options[verificationObservation];
+		let subjectId = null;
+		if (inherited != null && document.id != null) try {
+			subjectId = parseIri(document.id);
+		} catch {}
+		const key = await observeAttempt({ [verificationObservation]: inherited == null ? void 0 : {
+			...inherited,
+			attempt: void 0,
+			check: void 0,
+			subject: {
+				id: subjectId,
+				pointer: document.path
+			}
+		} }, "objectIntegrity", (observation) => verifyMapLocalProof(document.securedDocument, {
+			...options,
+			[verificationObservation]: inherited == null ? void 0 : observation
+		}), (key) => key != null);
 		return key == null ? Object.freeze({
 			...metadata,
 			verified: false,
@@ -4573,13 +4720,13 @@ function recordCollectionMetrics(meterProvider, base, result, options = {}) {
 * @param parameters The parameters for handling the collection.
 * @returns A promise that resolves to an HTTP response.
 */
-async function handleCollection(request, { name: name$1, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
-	const spanName = name$1.trim().replace(/\s+/g, "_");
+async function handleCollection(request, { name: name$2, identifier, uriGetter, filter, filterPredicate, context, collectionCallbacks, portable, tracerProvider, meterProvider, onUnauthorized, onNotFound }) {
+	const spanName = name$2.trim().replace(/\s+/g, "_");
 	tracerProvider = tracerProvider ?? trace.getTracerProvider();
 	const tracer = tracerProvider.getTracer(name, version);
 	const cursor = new URL(request.url).searchParams.get("cursor");
 	const metricBase = {
-		kind: getCollectionMetricKind(name$1),
+		kind: getCollectionMetricKind(name$2),
 		page: cursor != null,
 		dispatcher: "built_in"
 	};
@@ -4625,7 +4772,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 							span.setStatus({ code: SpanStatusCode.ERROR });
 							return await onNotFound(request);
 						}
-						const items = filterCollectionItems(page.items, name$1, filterPredicate);
+						const items = filterCollectionItems(page.items, name$2, filterPredicate);
 						itemCount = items.length;
 						span.setAttribute("fedify.collection.items", itemCount);
 						return items;
@@ -4644,7 +4791,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 				collection = new OrderedCollection({
 					id: baseUri,
 					attribution,
-					totalItems: totalItemCount ?? null,
+					totalItems: totalItemCount ?? (portable == null ? null : itemsOrResponse.length),
 					items: itemsOrResponse
 				});
 			} else {
@@ -4667,7 +4814,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 		} else {
 			const uri = new URL(portable == null ? baseUri : pageBase);
 			uri.searchParams.set("cursor", cursor);
-			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$1}`, {
+			const pageOrResponse = await tracer.startActiveSpan(`activitypub.dispatch_collection_page ${name$2}`, {
 				kind: SpanKind.SERVER,
 				attributes: {
 					"activitypub.collection.id": uri.href,
@@ -4683,7 +4830,7 @@ async function handleCollection(request, { name: name$1, identifier, uriGetter,
 						span.setStatus({ code: SpanStatusCode.ERROR });
 						return await onNotFound(request);
 					}
-					const items = filterCollectionItems(page.items, name$1, filterPredicate);
+					const items = filterCollectionItems(page.items, name$2, filterPredicate);
 					itemCount = items.length;
 					span.setAttribute("fedify.collection.items", itemCount);
 					return {
@@ -5164,6 +5311,16 @@ async function handleMediaUpload(request, { identifier, context: ctx, mediaUploa
 * @returns A promise that resolves to an HTTP response.
 */
 async function handleInbox(request, options) {
+	if (options.observation == null) {
+		const observation = new InboxObservation({
+			kind: options.portableInbox != null ? "portable" : options.recipient == null ? "shared" : "personal",
+			recipient: options.recipient
+		});
+		return await observation.runAndFinish(() => options.context, options.inboxRequestFinishedHandler, () => handleInbox(request, {
+			...options,
+			observation
+		}));
+	}
 	return await (options.tracerProvider ?? trace.getTracerProvider()).getTracer(name, version).startActiveSpan("activitypub.inbox", {
 		kind: options.queue == null ? SpanKind.SERVER : SpanKind.PRODUCER,
 		attributes: { "activitypub.shared_inbox": options.recipient == null }
@@ -5172,12 +5329,14 @@ async function handleInbox(request, options) {
 		try {
 			return await handleInboxInternal(request, options, span);
 		} catch (e) {
+			options.observation.hasException = true;
 			span.setStatus({
 				code: SpanStatusCode.ERROR,
 				message: String(e)
 			});
 			throw e;
 		} finally {
+			options.observation.project(span);
 			span.end();
 		}
 	});
@@ -5192,6 +5351,8 @@ async function handleInbox(request, options) {
 */
 async function handleInboxInternal(request, parameters, span) {
 	const { recipient, context: ctx, inboxContextFactory, kv, kvPrefixes, publicKeyTtl, queue, actorDispatcher, inboxListeners, inboxErrorHandler, unverifiedActivityHandler, onNotFound, signatureTimeWindow, maxHttpSignatures, skipSignatureVerification, inboxChallengePolicy, meterProvider, tracerProvider, portableInbox } = parameters;
+	const observation = parameters.observation;
+	const signatureObservation = { [verificationObservation]: observation.verification };
 	const logger = getLogger([
 		"fedify",
 		"federation",
@@ -5216,6 +5377,10 @@ async function handleInboxInternal(request, parameters, span) {
 		}
 	}
 	if (request.bodyUsed) {
+		observation.result = {
+			disposition: "failed",
+			reason: "bodyUnavailable"
+		};
 		logger.error("Request body has already been read.", { recipient });
 		span.setStatus({
 			code: SpanStatusCode.ERROR,
@@ -5226,6 +5391,10 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	} else if (request.body?.locked) {
+		observation.result = {
+			disposition: "failed",
+			reason: "bodyUnavailable"
+		};
 		logger.error("Request body is locked.", { recipient });
 		span.setStatus({
 			code: SpanStatusCode.ERROR,
@@ -5236,11 +5405,20 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	observation.stage = "parse";
+	observation.result = {
+		disposition: "rejected",
+		reason: "invalidJson"
+	};
 	let json;
 	try {
 		json = JSON.parse(await readBoundedText(request.clone(), MAX_BODY_SIZE, request.url));
 	} catch (error) {
 		if (error instanceof BodyTooLargeError) {
+			observation.result = {
+				disposition: "rejected",
+				reason: "bodyTooLarge"
+			};
 			request.body?.cancel(error).catch(() => {});
 			span.setStatus({
 				code: SpanStatusCode.ERROR,
@@ -5270,6 +5448,15 @@ async function handleInboxInternal(request, parameters, span) {
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
 		});
 	}
+	observation.payload = {
+		status: "parsed",
+		value: structuredClone(json)
+	};
+	observation.result = {
+		disposition: "rejected",
+		reason: "invalidActivity"
+	};
+	observation.stage = "verify";
 	const keyCache = new KvKeyCache(kv, kvPrefixes.publicKey, {
 		documentLoader: ctx.documentLoader,
 		contextLoader: ctx.contextLoader,
@@ -5299,6 +5486,10 @@ async function handleInboxInternal(request, parameters, span) {
 			code: SpanStatusCode.ERROR,
 			message: `Failed to parse activity:\n${error}`
 		});
+		observation.result = {
+			disposition: "rejected",
+			reason: "invalidActivity"
+		};
 		return new Response("Invalid activity.", {
 			status: 400,
 			headers: { "Content-Type": "text/plain; charset=utf-8" }
@@ -5316,11 +5507,25 @@ async function handleInboxInternal(request, parameters, span) {
 					recipient,
 					error
 				});
+				observation.result = {
+					disposition: "rejected",
+					reason: "invalidJsonLd"
+				};
 				return new Response("Invalid JSON-LD.", {
 					status: 400,
 					headers: { "Content-Type": "text/plain; charset=utf-8" }
 				});
 			}
+			observation.verification.attempts.push({
+				mechanism: "linkedData",
+				subject: {
+					id: null,
+					pointer: ""
+				},
+				checks: [],
+				status: "error",
+				error
+			});
 			if (!canAttemptAlternateAuthAfterLdSignatureFailure) throw error;
 			if (!skipSignatureVerification) deferredLdSignatureError = error;
 			logger.debug("Failed to normalize JSON-LD for Linked Data Signatures; deferring to another authentication path only if it verifies:\n{error}", {
@@ -5332,6 +5537,7 @@ async function handleInboxInternal(request, parameters, span) {
 			compactedJsonWithoutSig = detachSignature(compactedJson);
 			try {
 				ldSigVerified = await verifyCompactJsonLd(compactedJson, {
+					...signatureObservation,
 					contextLoader: ctx.contextLoader,
 					documentLoader: ctx.documentLoader,
 					keyCache,
@@ -5345,6 +5551,10 @@ async function handleInboxInternal(request, parameters, span) {
 						recipient,
 						error
 					});
+					observation.result = {
+						disposition: "rejected",
+						reason: "invalidJsonLd"
+					};
 					return new Response("Invalid JSON-LD.", {
 						status: 400,
 						headers: { "Content-Type": "text/plain; charset=utf-8" }
@@ -5364,6 +5574,10 @@ async function handleInboxInternal(request, parameters, span) {
 							recipient,
 							error: parseError
 						});
+						observation.result = {
+							disposition: "rejected",
+							reason: "invalidJsonLd"
+						};
 						return new Response("Invalid JSON-LD.", {
 							status: 400,
 							headers: { "Content-Type": "text/plain; charset=utf-8" }
@@ -5384,7 +5598,7 @@ async function handleInboxInternal(request, parameters, span) {
 			json
 		});
 		try {
-			activity = await Activity.fromJsonLd(compactedJsonWithoutSig, {
+			activity = observation.activity = await Activity.fromJsonLd(compactedJsonWithoutSig, {
 				...ctx,
 				contextLoader: getNormalizationContextLoader(ctx.contextLoader)
 			});
@@ -5396,6 +5610,7 @@ async function handleInboxInternal(request, parameters, span) {
 		activityVerified = true;
 		if (!skipSignatureVerification && isPortableActivity(activity)) try {
 			proofVerified = await verifyObject(Activity, jsonWithoutSig, {
+				...signatureObservation,
 				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
 				documentLoader: ctx.documentLoader,
 				keyCache,
@@ -5416,6 +5631,7 @@ async function handleInboxInternal(request, parameters, span) {
 		});
 		try {
 			activity = await verifyObject(Activity, jsonWithoutSig, {
+				...signatureObservation,
 				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
 				documentLoader: ctx.documentLoader,
 				keyCache,
@@ -5451,6 +5667,10 @@ async function handleInboxInternal(request, parameters, span) {
 				code: SpanStatusCode.ERROR,
 				message: `Failed to parse activity:\n${error}`
 			});
+			observation.result = {
+				disposition: "rejected",
+				reason: "invalidActivity"
+			};
 			return new Response("Invalid activity.", {
 				status: 400,
 				headers: { "Content-Type": "text/plain; charset=utf-8" }
@@ -5474,6 +5694,7 @@ async function handleInboxInternal(request, parameters, span) {
 	if (activity == null) {
 		if (!skipSignatureVerification) {
 			const verification = await verifyRequestDetailed(request, {
+				...signatureObservation,
 				contextLoader: ctx.contextLoader,
 				documentLoader: ctx.documentLoader,
 				timeWindow: signatureTimeWindow,
@@ -5484,6 +5705,14 @@ async function handleInboxInternal(request, parameters, span) {
 			});
 			if (verification.verified === false) {
 				if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+				observation.authentication = {
+					status: "rejected",
+					reason: { type: "verificationFailed" }
+				};
+				observation.result = {
+					disposition: "rejected",
+					reason: "authentication"
+				};
 				const reason = verification.reason;
 				const remoteHost = "keyId" in reason && reason.keyId != null ? getRemoteHost(reason.keyId) : void 0;
 				getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure(reason.type, remoteHost);
@@ -5498,7 +5727,7 @@ async function handleInboxInternal(request, parameters, span) {
 				});
 				if (unverifiedActivityHandler == null) return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 				try {
-					activity = await Activity.fromJsonLd(jsonWithoutSig, ctx);
+					activity = observation.activity = await Activity.fromJsonLd(jsonWithoutSig, ctx);
 				} catch (error) {
 					logger.error("Failed to parse activity:\n{error}", {
 						recipient,
@@ -5514,6 +5743,10 @@ async function handleInboxInternal(request, parameters, span) {
 							recipient
 						});
 					}
+					observation.result = {
+						disposition: "rejected",
+						reason: "invalidActivity"
+					};
 					return new Response("Invalid activity.", {
 						status: 400,
 						headers: { "Content-Type": "text/plain; charset=utf-8" }
@@ -5536,6 +5769,11 @@ async function handleInboxInternal(request, parameters, span) {
 				try {
 					response = await unverifiedActivityHandler(ctx, activity, reason);
 				} catch (error) {
+					observation.result = {
+						disposition: "failed",
+						reason: "listenerError",
+						error
+					};
 					logger.error("An unexpected error occurred in unverified activity handler:\n{error}", {
 						error,
 						activity: json,
@@ -5552,7 +5790,10 @@ async function handleInboxInternal(request, parameters, span) {
 					}
 					return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 				}
-				if (response instanceof Response) return response;
+				if (response instanceof Response) {
+					observation.result = { disposition: "customResponse" };
+					return response;
+				}
 				return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 			} else {
 				if (inboxChallengePolicy?.enabled && inboxChallengePolicy.requestNonce) pendingNonceLabel = verification.signatureLabel;
@@ -5562,7 +5803,7 @@ async function handleInboxInternal(request, parameters, span) {
 			httpSigKey = verification.key;
 		}
 		try {
-			activity = await Activity.fromJsonLd(jsonWithoutSig, {
+			activity = observation.activity = await Activity.fromJsonLd(jsonWithoutSig, {
 				...ctx,
 				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader)
 			});
@@ -5571,6 +5812,12 @@ async function handleInboxInternal(request, parameters, span) {
 			return await respondInvalidActivity(error);
 		}
 	}
+	observation.activity = activity;
+	observation.stage = "policy";
+	observation.result = {
+		disposition: "rejected",
+		reason: "authentication"
+	};
 	if (activity.id != null) span.setAttribute("activitypub.activity.id", activity.id.href);
 	span.setAttribute("activitypub.activity.type", getTypeId(activity).href);
 	span.addEvent("activitypub.activity.received", {
@@ -5582,6 +5829,13 @@ async function handleInboxInternal(request, parameters, span) {
 	});
 	if (!skipSignatureVerification && !proofVerified && (isPortableActivity(activity) || isPortableActorKey(httpSigKey))) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+		observation.authentication = {
+			status: "rejected",
+			reason: {
+				type: "proofPolicy",
+				policy: "portableActor"
+			}
+		};
 		logger.error("The activity {activityId} of the portable actor {actorId} is not authenticated by a valid Object Integrity Proof.", {
 			activity: json,
 			recipient,
@@ -5599,20 +5853,36 @@ async function handleInboxInternal(request, parameters, span) {
 		});
 	}
 	if (!skipSignatureVerification && activity.id != null && isPortableId(activity.id)) {
-		const rejection = await verifyPortableActivityId(activity.id, jsonWithoutSig, {
-			contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
-			documentLoader: ctx.documentLoader,
-			keyCache,
-			meterProvider,
-			tracerProvider
-		});
+		const rejection = await observeAttempt(signatureObservation, "objectIntegrity", async (verification) => {
+			const rejection = await verifyPortableActivityId(activity.id, jsonWithoutSig, {
+				[verificationObservation]: verification,
+				contextLoader: wrapContextLoaderForJsonLd(ctx.contextLoader),
+				documentLoader: ctx.documentLoader,
+				keyCache,
+				meterProvider,
+				tracerProvider
+			});
+			if (rejection != null) verification.attempt.reason = {
+				type: "proofPolicy",
+				reason: rejection
+			};
+			return rejection;
+		}, (value) => value == null);
 		if (rejection != null) {
 			if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+			observation.authentication = {
+				status: "rejected",
+				reason: {
+					type: "proofPolicy",
+					policy: "portableActivity",
+					detail: rejection
+				}
+			};
 			logger.error("The portable activity {activityId} is not authenticated by an Object Integrity Proof of its own DID: {reason}", {
 				activity: json,
 				recipient,
 				activityId: activity.id.href,
-				reason: rejection
+				reason: rejection.type
 			});
 			span.setStatus({
 				code: SpanStatusCode.ERROR,
@@ -5626,6 +5896,14 @@ async function handleInboxInternal(request, parameters, span) {
 	}
 	if (httpSigKey != null && !await doesActorOwnKey(activity, httpSigKey, ctx)) {
 		if (deferredLdSignatureError != null) throw deferredLdSignatureError;
+		observation.authentication = {
+			status: "rejected",
+			reason: {
+				type: "actorKeyMismatch",
+				key: snapshotKey(httpSigKey),
+				actorIds: activity.actorIds.map((id) => new URL(id.href))
+			}
+		};
 		getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("actorKeyMismatch", httpSigKey.id == null ? void 0 : getRemoteHost(httpSigKey.id));
 		logger.error("The signer ({keyId}) and the actor ({actorId}) do not match.", {
 			activity: json,
@@ -5645,13 +5923,35 @@ async function handleInboxInternal(request, parameters, span) {
 	if (!skipSignatureVerification) {
 		const compoundJson = Array.isArray(json) ? json : jsonWithoutSig;
 		if (inspectCompoundPortableObjectApplicability(compoundJson, INBOX_COMPOUND_PROOF_LIMITS) !== "absent") {
-			const compoundProof = await verifyCompoundPortableObjectProofs(compoundJson, INBOX_COMPOUND_PROOF_LIMITS, {
-				documentLoader: ctx.documentLoader,
-				keyCache,
-				meterProvider,
-				tracerProvider
-			});
+			const compoundProof = await observeAttempt(signatureObservation, "objectIntegrity", async (verification) => {
+				const result = await verifyCompoundPortableObjectProofs(compoundJson, INBOX_COMPOUND_PROOF_LIMITS, {
+					[verificationObservation]: verification,
+					documentLoader: ctx.documentLoader,
+					keyCache,
+					meterProvider,
+					tracerProvider
+				});
+				if (result.status === "unsupported") verification.attempt.reason = {
+					type: "proofPolicy",
+					reason: result.reason
+				};
+				else if (!result.verified) {
+					const failed = result.portableObjects.find((object) => !object.verified);
+					verification.attempt.reason = {
+						type: "proofPolicy",
+						reason: failed?.verified === false ? failed.reason : { type: "invalidProof" }
+					};
+				}
+				return result;
+			}, (result) => result.status === "ok" && result.verified);
 			if (compoundProof.status !== "ok" || !compoundProof.verified) {
+				observation.authentication = {
+					status: "rejected",
+					reason: {
+						type: "proofPolicy",
+						policy: "compound"
+					}
+				};
 				logger.error("Failed to verify compound portable Object Integrity Proofs.", {
 					recipient,
 					activity: json,
@@ -5670,11 +5970,20 @@ async function handleInboxInternal(request, parameters, span) {
 	}
 	if (pendingNonceLabel != null) {
 		if (!await verifySignatureNonce(request, kv, kvPrefixes.acceptSignatureNonce, pendingNonceLabel)) {
+			observation.authentication = {
+				status: "rejected",
+				reason: { type: "invalidNonce" }
+			};
 			getFederationMetrics(parameters.meterProvider).recordSignatureVerificationFailure("invalidNonce", httpSigKey?.id == null ? void 0 : getRemoteHost(httpSigKey.id));
 			logger.error("Signature nonce verification failed (missing, expired, or replayed).", { recipient });
 			return await getFailedSignatureResponse(inboxChallengePolicy, kv, kvPrefixes);
 		}
 	}
+	observation.authentication = skipSignatureVerification ? { status: "skipped" } : {
+		status: "verified",
+		attempts: observation.verification.attempts.filter((attempt) => attempt.status === "verified")
+	};
+	observation.stage = "dispatch";
 	const routeResult = await routeActivity({
 		context: ctx,
 		json,
@@ -5686,7 +5995,14 @@ async function handleInboxInternal(request, parameters, span) {
 		inboxListeners,
 		inboxContextFactory,
 		listenerInboxContextFactory: ldSigVerified ? inboxContextFactory[rawInboxContextFactorySymbol] : void 0,
-		inboxErrorHandler,
+		inboxErrorHandler: async (context, error) => {
+			observation.result = {
+				disposition: "failed",
+				reason: "listenerError",
+				error
+			};
+			await inboxErrorHandler?.(context, error);
+		},
 		kv,
 		kvPrefixes,
 		queue,
@@ -5722,30 +6038,44 @@ async function handleInboxInternal(request, parameters, span) {
 			error
 		});
 	}
-	if (routeResult === "alreadyProcessed") return new Response(`Activity <${activity.id}> has already been processed.`, {
-		status: 202,
-		headers: { "Content-Type": "text/plain; charset=utf-8" }
-	});
-	else if (routeResult === "missingActor") return new Response("Missing actor.", {
-		status: 400,
-		headers: { "Content-Type": "text/plain; charset=utf-8" }
-	});
-	else if (routeResult === "enqueued") return new Response("Activity is enqueued.", {
-		status: 202,
-		headers: { "Content-Type": "text/plain; charset=utf-8" }
-	});
-	else if (routeResult === "unsupportedActivity") return new Response("", {
-		status: 202,
-		headers: { "Content-Type": "text/plain; charset=utf-8" }
-	});
-	else if (routeResult === "error") return new Response("Internal server error.", {
+	if (routeResult === "alreadyProcessed") {
+		observation.result = { disposition: "duplicate" };
+		return new Response(`Activity <${activity.id}> has already been processed.`, {
+			status: 202,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	} else if (routeResult === "missingActor") {
+		observation.result = {
+			disposition: "rejected",
+			reason: "missingActor"
+		};
+		return new Response("Missing actor.", {
+			status: 400,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	} else if (routeResult === "enqueued") {
+		observation.result = { disposition: "enqueued" };
+		return new Response("Activity is enqueued.", {
+			status: 202,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	} else if (routeResult === "unsupportedActivity") {
+		observation.result = { disposition: "unhandled" };
+		return new Response("", {
+			status: 202,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	} else if (routeResult === "error") return new Response("Internal server error.", {
 		status: 500,
 		headers: { "Content-Type": "text/plain; charset=utf-8" }
 	});
-	else return new Response("", {
-		status: 202,
-		headers: { "Content-Type": "text/plain; charset=utf-8" }
-	});
+	else {
+		observation.result = { disposition: "processed" };
+		return new Response("", {
+			status: 202,
+			headers: { "Content-Type": "text/plain; charset=utf-8" }
+		});
+	}
 }
 const PORTABLE_INBOX_FORWARDABLE_RESULTS = /* @__PURE__ */ new Set([
 	"success",
@@ -5874,8 +6204,8 @@ var CustomCollectionHandler = class {
 	* @param CollectionPage The CollectionPage constructor.
 	* @param filterPredicate Optional filter predicate for items.
 	*/
-	constructor(name$2, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
-		this.name = name$2;
+	constructor(name$1, values, context, callbacks, tracerProvider = trace.getTracerProvider(), meterProvider, Collection, CollectionPage, filterPredicate, portable) {
+		this.name = name$1;
 		this.values = values;
 		this.context = context;
 		this.callbacks = callbacks;
@@ -6411,19 +6741,19 @@ function isPortableActivity(activity) {
 */
 async function verifyPortableActivityId(activityId, jsonLd, options) {
 	const expectedId = getCanonicalPortableId(activityId);
-	if (expectedId == null) return "malformed portable ID";
+	if (expectedId == null) return { type: "invalidObjectId" };
 	let verification;
 	try {
 		verification = await verifyPortableObjectProofWithRoot(jsonLd, options);
 	} catch (error) {
-		if (error instanceof InvalidPortableObjectIdError) return "malformed portable ID";
+		if (error instanceof InvalidPortableObjectIdError) return { type: "invalidObjectId" };
 		if (!isPermanentActivityParseError(error)) throw error;
-		return "malformed document";
+		return { type: "invalidDocument" };
 	}
 	const { result, root } = verification;
-	if (!result.verified) return result.reason.type;
+	if (!result.verified) return result.reason;
 	const rootId = root?.["@id"];
-	if (typeof rootId !== "string" || getCanonicalPortableId(parseIri(rootId)) !== expectedId) return "the verified document has another ID";
+	if (typeof rootId !== "string" || getCanonicalPortableId(parseIri(rootId)) !== expectedId) return { type: "subjectMismatch" };
 	return null;
 }
 //#endregion
@@ -6884,7 +7214,10 @@ function selectPortableActivityKey(activity, activityId, keys) {
 /**
 * Rejects an outgoing activity whose proofs Fedify's own inbox would reject
 * as unsupported: a document with portable objects in which some map carries
-* a proof set or another value that is not a single proof map.
+* a proof set or another value that is not a single proof map, or in which
+* an embedded map carries a proof but not its own `@context`, e.g., a signed
+* object parsed from a received document and rebuilt under the activity's
+* context.
 *
 * @param jsonLd The compact JSON-LD document about to be delivered.
 * @param activityId The activity ID, for the error message.
@@ -6894,8 +7227,9 @@ function selectPortableActivityKey(activity, activityId, keys) {
 function assertSupportedCompoundProofShape(jsonLd, activityId) {
 	if (!containsCompoundPortableObject(jsonLd)) return;
 	const path = findUnsupportedCompoundProofShape(jsonLd);
-	if (path == null) return;
-	throw new TypeError(`Cannot send the activity ${activityId}: it embeds portable objects, but its proof at the JSON Pointer ${JSON.stringify(path)} is not a single proof map.  The map-local compound-proof profile accepts exactly one direct proof per map, so Fedify inboxes would reject the activity.  Sign each object with exactly one key.`);
+	if (path != null) throw new TypeError(`Cannot send the activity ${activityId}: it embeds portable objects, but its proof at the JSON Pointer ${JSON.stringify(path)} is not a single proof map.  The map-local compound-proof profile accepts exactly one direct proof per map, so Fedify inboxes would reject the activity.  Sign each object with exactly one key.`);
+	const embedded = findEmbeddedProofWithoutContext(jsonLd);
+	if (embedded != null) throw new TypeError(`Cannot send the activity ${activityId}: it embeds portable objects, but the map at the JSON Pointer ${JSON.stringify(embedded)} carries a proof without its own @context.  The map-local compound-proof profile verifies each proof-bearing map on its own, so Fedify inboxes would reject the activity.  This happens when a signed object parsed from a received document, e.g., a Follow in an inbox listener, is embedded, as it is rebuilt under the activity's context and its proof no longer covers it.  Refer to such an object by its ID instead, e.g., new Accept({ object: follow.id }), or embed an object that you signed with signObject().`);
 }
 //#endregion
 //#region src/federation/retry.ts
@@ -9312,7 +9646,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 				return await withContext({
 					traceId: spanCtx.traceId,
 					spanId: spanCtx.spanId
-				}, async () => {
+				}, () => this.#observeInboxFetch(metricState, async () => {
 					const logger = getLogger([
 						"fedify",
 						"federation",
@@ -9327,8 +9661,14 @@ var FederationImpl = class extends FederationBuilderImpl {
 							tracer,
 							metricState
 						});
+						if (metricState.inboxCompletion != null) metricState.inboxCompletion.observation.stage = "respond";
 						if (metricState.endpoint !== "hashlink_media" && acceptsJsonLd(request)) response.headers.set("Vary", "Accept");
 					} catch (error) {
+						metricState.inboxCompletion?.observation.project(span, {
+							type: "exception",
+							stage: metricState.inboxCompletion.observation.stage,
+							error
+						});
 						this.metrics.recordHttpServerRequest(request.method, metricState.endpoint ?? "error", getDurationMs(metricStart), { routeTemplate: metricState.routeTemplate });
 						span.setStatus({
 							code: SpanStatusCode.ERROR,
@@ -9367,7 +9707,7 @@ var FederationImpl = class extends FederationBuilderImpl {
 					else if (response.status >= 400) logger.warn(logTpl, values);
 					else logger.info(logTpl, values);
 					return response;
-				});
+				}));
 			});
 		});
 	}
@@ -9409,8 +9749,17 @@ var FederationImpl = class extends FederationBuilderImpl {
 		metricState.routeTemplate = route.template;
 		metricState.endpoint = getEndpointCategory(route.name);
 		span.updateName(`${request.method} ${route.template}`);
-		let context = this.#createContext(request, contextData);
 		const routeName = route.name.replace(/:.*$/, "");
+		let context;
+		try {
+			context = this.#createContext(request, contextData);
+		} catch (error) {
+			if (request.method !== "POST" || routeName !== "inbox" && routeName !== "sharedInbox") throw error;
+			return await this.#reportInboxPreparationError(request, contextData, {
+				kind: routeName === "inbox" ? "personal" : "shared",
+				recipient: route.values.identifier ?? null
+			}, error, span, metricState);
+		}
 		switch (routeName) {
 			case "webfinger": return await handleWebFinger(request, {
 				context,
@@ -9469,6 +9818,28 @@ var FederationImpl = class extends FederationBuilderImpl {
 			});
 			return response;
 		}
+		if (request.method === "POST" && (routeName === "inbox" || routeName === "sharedInbox")) {
+			const recipient = route.values.identifier ?? null;
+			const observation = new InboxObservation({
+				kind: routeName === "inbox" ? "personal" : "shared",
+				recipient
+			});
+			this.#setInboxCompletion(metricState, observation, () => context);
+			return await observation.run(async () => {
+				if (routeName === "inbox") context = this.#createContext(request, contextData, { documentLoader: await context.getDocumentLoader({ identifier: recipient }) });
+				else if (this.sharedInboxKeyDispatcher != null) {
+					const identity = await this.sharedInboxKeyDispatcher(context);
+					if (identity != null) context = this.#createContext(request, contextData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
+				}
+				return await this.#handleInbox(request, {
+					recipient,
+					context,
+					contextData,
+					onNotFound,
+					observation
+				});
+			}, span);
+		}
 		switch (routeName) {
 			case "actor":
 			case "actorAlias": {
@@ -9544,9 +9915,9 @@ var FederationImpl = class extends FederationBuilderImpl {
 					onUnauthorized,
 					onNotFound
 				});
-				context = this.#createContext(request, contextData, { documentLoader: await context.getDocumentLoader({ identifier: route.values.identifier }) });
+				throw new Error("Unreachable inbox delivery.");
 			case "sharedInbox":
-				if (routeName !== "inbox" && this.sharedInboxKeyDispatcher != null) {
+				if (this.sharedInboxKeyDispatcher != null) {
 					const identity = await this.sharedInboxKeyDispatcher(context);
 					if (identity != null) context = this.#createContext(request, contextData, { documentLoader: "identifier" in identity || "username" in identity ? await context.getDocumentLoader(identity) : context.getDocumentLoader(identity) });
 				}
@@ -9839,7 +10210,49 @@ var FederationImpl = class extends FederationBuilderImpl {
 		}
 		return await onNotFound(request);
 	}
-	async #handleInbox(request, { recipient, context, contextData, onNotFound, portableInbox }) {
+	#setInboxCompletion(metricState, observation, getContext) {
+		const handler = this.inboxRequestFinishedHandler;
+		metricState.inboxCompletion = {
+			observation,
+			finish: (outcome) => observation.finish(getContext(), handler, outcome)
+		};
+	}
+	async #observeInboxFetch(metricState, operation) {
+		let response;
+		try {
+			response = await operation();
+		} catch (error) {
+			const completion = metricState.inboxCompletion;
+			if (completion != null) await completion.finish({
+				type: "exception",
+				stage: completion.observation.stage,
+				error
+			});
+			throw error;
+		}
+		const completion = metricState.inboxCompletion;
+		if (completion != null) await completion.finish({
+			type: "response",
+			status: response.status,
+			...completion.observation.result
+		});
+		return response;
+	}
+	async #reportInboxPreparationError(request, contextData, inbox, error, span, metricState) {
+		const unavailableLoader = () => Promise.reject(error);
+		const context = new RequestContextImpl({
+			url: new URL(request.url),
+			request,
+			federation: this,
+			data: contextData,
+			documentLoader: unavailableLoader,
+			contextLoader: unavailableLoader
+		});
+		const observation = new InboxObservation(inbox);
+		this.#setInboxCompletion(metricState, observation, () => context);
+		return await observation.run(() => Promise.reject(error), span);
+	}
+	async #handleInbox(request, { recipient, context, contextData, onNotFound, portableInbox, observation }) {
 		if (!this.manuallyStartQueue) this._startQueueInternal(contextData);
 		const inboxContextFactory = context.toInboxContext.bind(context);
 		inboxContextFactory[rawInboxContextFactorySymbol] = context.toInboxContext.bind(context);
@@ -9863,7 +10276,8 @@ var FederationImpl = class extends FederationBuilderImpl {
 			meterProvider: this.meterProvider,
 			tracerProvider: this.tracerProvider,
 			idempotencyStrategy: this.idempotencyStrategy,
-			portableInbox
+			portableInbox,
+			observation
 		});
 	}
 	async #fetchPortableInbox(request, portable, { onNotFound, contextData, span, metricState }) {
@@ -9892,63 +10306,79 @@ var FederationImpl = class extends FederationBuilderImpl {
 		metricState.endpoint = "inbox";
 		span.updateName(`${request.method} ${metricState.routeTemplate}`);
 		const identifier = route.values.identifier;
-		let context = this.#createContext(request, contextData);
-		const actor = this.actorCallbacks?.dispatcher == null ? null : await this.actorCallbacks.dispatcher(context, identifier);
-		const localOrigin = context.canonicalOrigin;
-		const resolution = resolvePortableInboxRecipient(actor == null || actor instanceof Tombstone ? null : actor, {
-			authority: portable.portableRequest.authority,
-			canonicalInboxId: portable.canonicalId,
-			localOrigin
-		});
-		if (resolution.status === "rejected") {
-			logger.debug("Not accepting a delivery to the portable inbox {inbox} on behalf of the actor {identifier}: {reason}.", {
-				inbox: portable.canonicalId,
-				identifier,
-				reason: resolution.reason
-			});
-			return await onNotFound(request);
-		}
-		const { recipient } = resolution;
-		if (this.actorCallbacks?.keyPairsDispatcher != null) context = this.#createContext(request, contextData, { documentLoader: await context.getDocumentLoader({ identifier }) });
-		const excludedOrigins = [localOrigin, new URL(request.url).origin];
-		return await this.#handleInbox(request, {
-			recipient: identifier,
-			context,
-			contextData,
-			onNotFound,
-			portableInbox: {
-				recipient,
-				forward: async (activity, activityId, activityType, signatures) => {
-					if (this.portableInboxForwarding.maxTargets < 1) return;
-					if (this.kv.cas == null) {
-						if (!this.#portableInboxForwardingWarned) {
-							this.#portableInboxForwardingWarned = true;
-							logger.warn("Activities delivered to FEP-ef61 portable inboxes are not forwarded to the other gateways, as the key–value store does not support compare-and-swap (KvStore.cas()), which is needed to forward each activity at most once.");
+		let context;
+		try {
+			context = this.#createContext(request, contextData);
+		} catch (error) {
+			return await this.#reportInboxPreparationError(request, contextData, {
+				kind: "portable",
+				recipient: identifier
+			}, error, span, metricState);
+		}
+		const observation = new InboxObservation({
+			kind: "portable",
+			recipient: identifier
+		});
+		this.#setInboxCompletion(metricState, observation, () => context);
+		return await observation.run(async () => {
+			const actor = this.actorCallbacks?.dispatcher == null ? null : await this.actorCallbacks.dispatcher(context, identifier);
+			const localOrigin = context.canonicalOrigin;
+			const resolution = resolvePortableInboxRecipient(actor == null || actor instanceof Tombstone ? null : actor, {
+				authority: portable.portableRequest.authority,
+				canonicalInboxId: portable.canonicalId,
+				localOrigin
+			});
+			if (resolution.status === "rejected") {
+				logger.debug("Not accepting a delivery to the portable inbox {inbox} on behalf of the actor {identifier}: {reason}.", {
+					inbox: portable.canonicalId,
+					identifier,
+					reason: resolution.reason
+				});
+				return await onNotFound(request);
+			}
+			const { recipient } = resolution;
+			if (this.actorCallbacks?.keyPairsDispatcher != null) context = this.#createContext(request, contextData, { documentLoader: await context.getDocumentLoader({ identifier }) });
+			const excludedOrigins = [localOrigin, new URL(request.url).origin];
+			return await this.#handleInbox(request, {
+				recipient: identifier,
+				observation,
+				context,
+				contextData,
+				onNotFound,
+				portableInbox: {
+					recipient,
+					forward: async (activity, activityId, activityType, signatures) => {
+						if (this.portableInboxForwarding.maxTargets < 1) return;
+						if (this.kv.cas == null) {
+							if (!this.#portableInboxForwardingWarned) {
+								this.#portableInboxForwardingWarned = true;
+								logger.warn("Activities delivered to FEP-ef61 portable inboxes are not forwarded to the other gateways, as the key–value store does not support compare-and-swap (KvStore.cas()), which is needed to forward each activity at most once.");
+							}
+							return;
 						}
-						return;
+						await forwardPortableInboxActivity({
+							recipient,
+							activity,
+							activityId,
+							activityType,
+							excludedOrigins,
+							baseUrl: context.origin,
+							kv: this.kv,
+							kvPrefix: this.kvPrefixes.portableInboxForwarding,
+							outboxQueue: this.outboxQueue,
+							startQueue: this.manuallyStartQueue ? void 0 : () => this._startQueueInternal(contextData),
+							allowPrivateAddress: this.allowPrivateAddress,
+							getKeys: () => this.#getPortableGatewayKeyPairs(context, identifier, recipient),
+							specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
+							signatures,
+							options: this.portableInboxForwarding,
+							meterProvider: this.meterProvider,
+							tracerProvider: this.tracerProvider
+						});
 					}
-					await forwardPortableInboxActivity({
-						recipient,
-						activity,
-						activityId,
-						activityType,
-						excludedOrigins,
-						baseUrl: context.origin,
-						kv: this.kv,
-						kvPrefix: this.kvPrefixes.portableInboxForwarding,
-						outboxQueue: this.outboxQueue,
-						startQueue: this.manuallyStartQueue ? void 0 : () => this._startQueueInternal(contextData),
-						allowPrivateAddress: this.allowPrivateAddress,
-						getKeys: () => this.#getPortableGatewayKeyPairs(context, identifier, recipient),
-						specDeterminer: new KvSpecDeterminer(this.kv, this.kvPrefixes.httpMessageSignaturesSpec, this.firstKnock, { specTtl: this.httpMessageSignaturesSpecTtl }),
-						signatures,
-						options: this.portableInboxForwarding,
-						meterProvider: this.meterProvider,
-						tracerProvider: this.tracerProvider
-					});
 				}
-			}
-		});
+			});
+		}, span);
 	}
 	/**
 	* Gets this server's gateway key pairs for the portable actor that owns