@fedify/fedify 2.0.35-dev.2470 → 2.0.35-dev.2485

package/dist/{http-C7d5tddX.cjs → http-CjkqnlR2.cjs}

@@ -11,7 +11,7 @@ let byte_encodings_base64 = require("byte-encodings/base64");
 let structured_field_values = require("structured-field-values");
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.0.35-dev.2470+891ba128";
+var version = "2.0.35-dev.2485+75206550";
 //#endregion
 //#region src/sig/key.ts
 /** Classifies decoding failures without hiding unexpected loader errors. */
@@ -1191,10 +1191,10 @@ async function createRedirectRequest(request, location, body, validateRedirect)
 		cache: request.cache
 	});
 }
-async function fetchDoubleKnockRequest(request, signedRequest, signal) {
+async function fetchDoubleKnockRequest(session, request, signedRequest, signal) {
 	const maxAttempts = request.method === "GET" || request.method === "HEAD" ? 2 : 1;
 	for (let attempt = 1;; attempt++) try {
-		return await fetch(signedRequest, {
+		return await session.fetch(signedRequest, {
 			redirect: "manual",
 			signal
 		});
@@ -1245,69 +1245,127 @@ function getAbortReason(signal) {
 	return signal.reason ?? new DOMException("The operation was aborted.", "AbortError");
 }
 /**
-* Performs a double-knock request to the given URL.  For the details of
-* double-knocking, see
-* <https://swicg.github.io/activitypub-http-signature/#how-to-upgrade-supported-versions>.
+* Performs a double-knock request like {@link doubleKnock}, opening a session
+* for every hop with the given function, and passes the final response to
+* the given function.  The final session is closed after `consume` settles,
+* so `consume` must read or cancel the response body before it returns.
+* This is not exported from any entry point.
 * @param request The request to send.
 * @param identity The identity to use for signing the request.
 * @param options The options for double-knock requests.
-* @returns The response to the request.
-* @since 1.6.0
+* @param openHop The function to open a session for each hop.  The session of
+*                a hop is closed before the next hop is opened.
+* @param consume The function to consume the final response.
+* @returns The value returned by `consume`.
 */
-async function doubleKnock(request, identity, options = {}) {
-	return await doubleKnockInternal(request, identity, options);
-}
-async function doubleKnockInternal(request, identity, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
-	const { specDeterminer, log, tracerProvider, signal } = options;
-	visited.add(request.url);
-	const origin = new URL(request.url).origin;
-	const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
-	const body = options.body !== void 0 ? options.body : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
-	let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
-		spec: firstTrySpec,
-		tracerProvider,
-		body
-	});
-	log?.(signedRequest);
-	let response = await fetchDoubleKnockRequest(request, signedRequest, signal);
-	if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-		if (redirected >= DEFAULT_MAX_REDIRECTION) throw new _fedify_vocab_runtime.FetchError(request.url, `Too many redirections (${redirected + 1})`);
-		const redirectRequest = await createRedirectRequest(request, response.headers.get("Location"), body, options.validateRedirect);
-		if (visited.has(redirectRequest.url)) throw new _fedify_vocab_runtime.FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
-		return doubleKnockInternal(redirectRequest, identity, {
-			...options,
-			body
-		}, redirected + 1, visited);
-	} else if (response.status === 400 || response.status === 401 || response.status > 401) {
-		const spec = firstTrySpec === "draft-cavage-http-signatures-12" ? "rfc9421" : "draft-cavage-http-signatures-12";
+async function doubleKnockScoped(request, identity, options, openHop, consume) {
+	const { response, session } = await doubleKnockCore(request, identity, options, openHop);
+	try {
+		return await consume(response);
+	} catch (error) {
 		(0, _logtape_logtape.getLogger)([
 			"fedify",
 			"sig",
 			"http"
-		]).debug("Failed to verify with the spec {spec} ({status} {statusText}); retrying with spec {secondSpec}... (double-knocking)", {
-			spec: firstTrySpec,
-			secondSpec: spec,
-			status: response.status,
-			statusText: response.statusText
+		]).debug("Failed to consume the response from {url}; closing the session: {error}", {
+			url: request.url,
+			error
 		});
-		signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
-			spec,
-			tracerProvider,
-			body
+		throw error;
+	} finally {
+		await session.close();
+	}
+}
+function isRedirectResponse(response) {
+	return response.status >= 300 && response.status < 400 && response.headers.has("Location");
+}
+/**
+* Starts cancelling the body of a response that is not passed to the caller,
+* without waiting for it to settle.  The cancellation of a branch of a tee
+* (e.g., a body cloned by a fetch mock) settles only after the other branch
+* is cancelled too, per the Streams standard, so awaiting it could block
+* forever.  Failures are only logged.
+*/
+function cancelResponseBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"sig",
+			"http"
+		]).debug("Failed to cancel the response body from {url}: {error}", {
+			url,
+			error
 		});
-		log?.(signedRequest);
-		response = await fetchDoubleKnockRequest(request, signedRequest, signal);
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+	});
+}
+async function doubleKnockCore(request, identity, options, openHop) {
+	const { specDeterminer, log, tracerProvider, signal } = options;
+	const visited = /* @__PURE__ */ new Set();
+	const body = options.body !== void 0 ? options.body : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
+	let session = await openHop(request.url);
+	try {
+		for (let redirected = 0;; redirected++) {
+			visited.add(request.url);
+			const origin = new URL(request.url).origin;
+			const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
+			let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+				spec: firstTrySpec,
+				tracerProvider,
+				body
+			});
+			log?.(signedRequest);
+			let response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
+			const firstRedirected = isRedirectResponse(response);
+			if (!firstRedirected && (response.status === 400 || response.status === 401 || response.status > 401)) {
+				const spec = firstTrySpec === "draft-cavage-http-signatures-12" ? "rfc9421" : "draft-cavage-http-signatures-12";
+				(0, _logtape_logtape.getLogger)([
+					"fedify",
+					"sig",
+					"http"
+				]).debug("Failed to verify with the spec {spec} ({status} {statusText}); retrying with spec {secondSpec}... (double-knocking)", {
+					spec: firstTrySpec,
+					secondSpec: spec,
+					status: response.status,
+					statusText: response.statusText
+				});
+				cancelResponseBody(response, request.url);
+				signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+					spec,
+					tracerProvider,
+					body
+				});
+				log?.(signedRequest);
+				response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
+				if (!isRedirectResponse(response) && response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
+			} else if (!firstRedirected) await specDeterminer?.rememberSpec(origin, firstTrySpec);
+			if (!isRedirectResponse(response)) return {
+				response,
+				session
+			};
+			cancelResponseBody(response, request.url);
+			await session.close();
 			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new _fedify_vocab_runtime.FetchError(request.url, `Too many redirections (${redirected + 1})`);
-			const redirectRequest = await createRedirectRequest(request, response.headers.get("Location"), body, options.validateRedirect);
+			const location = response.headers.get("Location");
+			const redirectRequest = await createRedirectRequest(request, location, body, options.validateRedirect);
 			if (visited.has(redirectRequest.url)) throw new _fedify_vocab_runtime.FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
-			return doubleKnockInternal(redirectRequest, identity, {
-				...options,
-				body
-			}, redirected + 1, visited);
-		} else if (response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
-	} else await specDeterminer?.rememberSpec(origin, firstTrySpec);
-	return response;
+			request = redirectRequest;
+			session = await openHop(request.url);
+		}
+	} catch (error) {
+		try {
+			await session.close();
+		} catch (closeError) {
+			(0, _logtape_logtape.getLogger)([
+				"fedify",
+				"sig",
+				"http"
+			]).debug("Failed to close the session for {url}: {error}", {
+				url: request.url,
+				error: closeError
+			});
+		}
+		throw error;
+	}
 }
 /**
 * Performs a timing-safe equality comparison between two `Uint8Array` values.
@@ -1337,10 +1395,10 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-Object.defineProperty(exports, "doubleKnock", {
+Object.defineProperty(exports, "doubleKnockScoped", {
 	enumerable: true,
 	get: function() {
-		return doubleKnock;
+		return doubleKnockScoped;
 	}
 });
 Object.defineProperty(exports, "exportJwk", {

package/dist/{http-CDupyfOc.d.ts → http-DFqAb11b.d.cts}

@@ -1,8 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { Actor, CryptographicKey, Multikey } from "@fedify/vocab";
-import { TracerProvider } from "@opentelemetry/api";
 import { DocumentLoader } from "@fedify/vocab-runtime";
-
+import { TracerProvider } from "@opentelemetry/api";
 //#region src/sig/key.d.ts
 /**
 * Generates a key pair which is appropriate for Fedify.

package/dist/{http-BTQ5wllw.js → http-DVEBwq6e.js}

@@ -10,7 +10,7 @@ import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { Item, decodeDict, encodeItem } from "structured-field-values";
 //#region deno.json
 var name = "@fedify/fedify";
-var version = "2.0.35-dev.2470+891ba128";
+var version = "2.0.35-dev.2485+75206550";
 //#endregion
 //#region src/sig/key.ts
 /** Classifies decoding failures without hiding unexpected loader errors. */
@@ -1190,10 +1190,10 @@ async function createRedirectRequest(request, location, body, validateRedirect)
 		cache: request.cache
 	});
 }
-async function fetchDoubleKnockRequest(request, signedRequest, signal) {
+async function fetchDoubleKnockRequest(session, request, signedRequest, signal) {
 	const maxAttempts = request.method === "GET" || request.method === "HEAD" ? 2 : 1;
 	for (let attempt = 1;; attempt++) try {
-		return await fetch(signedRequest, {
+		return await session.fetch(signedRequest, {
 			redirect: "manual",
 			signal
 		});
@@ -1244,69 +1244,127 @@ function getAbortReason(signal) {
 	return signal.reason ?? new DOMException("The operation was aborted.", "AbortError");
 }
 /**
-* Performs a double-knock request to the given URL.  For the details of
-* double-knocking, see
-* <https://swicg.github.io/activitypub-http-signature/#how-to-upgrade-supported-versions>.
+* Performs a double-knock request like {@link doubleKnock}, opening a session
+* for every hop with the given function, and passes the final response to
+* the given function.  The final session is closed after `consume` settles,
+* so `consume` must read or cancel the response body before it returns.
+* This is not exported from any entry point.
 * @param request The request to send.
 * @param identity The identity to use for signing the request.
 * @param options The options for double-knock requests.
-* @returns The response to the request.
-* @since 1.6.0
+* @param openHop The function to open a session for each hop.  The session of
+*                a hop is closed before the next hop is opened.
+* @param consume The function to consume the final response.
+* @returns The value returned by `consume`.
 */
-async function doubleKnock(request, identity, options = {}) {
-	return await doubleKnockInternal(request, identity, options);
-}
-async function doubleKnockInternal(request, identity, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
-	const { specDeterminer, log, tracerProvider, signal } = options;
-	visited.add(request.url);
-	const origin = new URL(request.url).origin;
-	const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
-	const body = options.body !== void 0 ? options.body : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
-	let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
-		spec: firstTrySpec,
-		tracerProvider,
-		body
-	});
-	log?.(signedRequest);
-	let response = await fetchDoubleKnockRequest(request, signedRequest, signal);
-	if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-		if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(request.url, `Too many redirections (${redirected + 1})`);
-		const redirectRequest = await createRedirectRequest(request, response.headers.get("Location"), body, options.validateRedirect);
-		if (visited.has(redirectRequest.url)) throw new FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
-		return doubleKnockInternal(redirectRequest, identity, {
-			...options,
-			body
-		}, redirected + 1, visited);
-	} else if (response.status === 400 || response.status === 401 || response.status > 401) {
-		const spec = firstTrySpec === "draft-cavage-http-signatures-12" ? "rfc9421" : "draft-cavage-http-signatures-12";
+async function doubleKnockScoped(request, identity, options, openHop, consume) {
+	const { response, session } = await doubleKnockCore(request, identity, options, openHop);
+	try {
+		return await consume(response);
+	} catch (error) {
 		getLogger([
 			"fedify",
 			"sig",
 			"http"
-		]).debug("Failed to verify with the spec {spec} ({status} {statusText}); retrying with spec {secondSpec}... (double-knocking)", {
-			spec: firstTrySpec,
-			secondSpec: spec,
-			status: response.status,
-			statusText: response.statusText
+		]).debug("Failed to consume the response from {url}; closing the session: {error}", {
+			url: request.url,
+			error
 		});
-		signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
-			spec,
-			tracerProvider,
-			body
+		throw error;
+	} finally {
+		await session.close();
+	}
+}
+function isRedirectResponse(response) {
+	return response.status >= 300 && response.status < 400 && response.headers.has("Location");
+}
+/**
+* Starts cancelling the body of a response that is not passed to the caller,
+* without waiting for it to settle.  The cancellation of a branch of a tee
+* (e.g., a body cloned by a fetch mock) settles only after the other branch
+* is cancelled too, per the Streams standard, so awaiting it could block
+* forever.  Failures are only logged.
+*/
+function cancelResponseBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		getLogger([
+			"fedify",
+			"sig",
+			"http"
+		]).debug("Failed to cancel the response body from {url}: {error}", {
+			url,
+			error
 		});
-		log?.(signedRequest);
-		response = await fetchDoubleKnockRequest(request, signedRequest, signal);
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+	});
+}
+async function doubleKnockCore(request, identity, options, openHop) {
+	const { specDeterminer, log, tracerProvider, signal } = options;
+	const visited = /* @__PURE__ */ new Set();
+	const body = options.body !== void 0 ? options.body : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
+	let session = await openHop(request.url);
+	try {
+		for (let redirected = 0;; redirected++) {
+			visited.add(request.url);
+			const origin = new URL(request.url).origin;
+			const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
+			let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+				spec: firstTrySpec,
+				tracerProvider,
+				body
+			});
+			log?.(signedRequest);
+			let response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
+			const firstRedirected = isRedirectResponse(response);
+			if (!firstRedirected && (response.status === 400 || response.status === 401 || response.status > 401)) {
+				const spec = firstTrySpec === "draft-cavage-http-signatures-12" ? "rfc9421" : "draft-cavage-http-signatures-12";
+				getLogger([
+					"fedify",
+					"sig",
+					"http"
+				]).debug("Failed to verify with the spec {spec} ({status} {statusText}); retrying with spec {secondSpec}... (double-knocking)", {
+					spec: firstTrySpec,
+					secondSpec: spec,
+					status: response.status,
+					statusText: response.statusText
+				});
+				cancelResponseBody(response, request.url);
+				signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+					spec,
+					tracerProvider,
+					body
+				});
+				log?.(signedRequest);
+				response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
+				if (!isRedirectResponse(response) && response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
+			} else if (!firstRedirected) await specDeterminer?.rememberSpec(origin, firstTrySpec);
+			if (!isRedirectResponse(response)) return {
+				response,
+				session
+			};
+			cancelResponseBody(response, request.url);
+			await session.close();
 			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(request.url, `Too many redirections (${redirected + 1})`);
-			const redirectRequest = await createRedirectRequest(request, response.headers.get("Location"), body, options.validateRedirect);
+			const location = response.headers.get("Location");
+			const redirectRequest = await createRedirectRequest(request, location, body, options.validateRedirect);
 			if (visited.has(redirectRequest.url)) throw new FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
-			return doubleKnockInternal(redirectRequest, identity, {
-				...options,
-				body
-			}, redirected + 1, visited);
-		} else if (response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
-	} else await specDeterminer?.rememberSpec(origin, firstTrySpec);
-	return response;
+			request = redirectRequest;
+			session = await openHop(request.url);
+		}
+	} catch (error) {
+		try {
+			await session.close();
+		} catch (closeError) {
+			getLogger([
+				"fedify",
+				"sig",
+				"http"
+			]).debug("Failed to close the session for {url}: {error}", {
+				url: request.url,
+				error: closeError
+			});
+		}
+		throw error;
+	}
 }
 /**
 * Performs a timing-safe equality comparison between two `Uint8Array` values.
@@ -1336,4 +1394,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { fetchActorDocument as a, importJwk as c, name as d, version as f, exportJwk as i, validateCryptoKey as l, signRequest as n, fetchKey as o, verifyRequest as r, generateCryptoKeyPair as s, doubleKnock as t, verifyKeyOwnership as u };
+export { fetchActorDocument as a, importJwk as c, name as d, version as f, exportJwk as i, validateCryptoKey as l, signRequest as n, fetchKey as o, verifyRequest as r, generateCryptoKeyPair as s, doubleKnockScoped as t, verifyKeyOwnership as u };

package/dist/{http-CMduEDST.mjs → http-Dvsq4uCu.mjs}

@@ -1,8 +1,8 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BtRoR9in.mjs";
-import { o as validateCryptoKey, r as fetchKey } from "./key-CDAqlyxF.mjs";
+import { n as version, t as name } from "./deno-DL_ifPJk.mjs";
+import { o as validateCryptoKey, r as fetchKey } from "./key-CgcWGw6W.mjs";
 import { CryptographicKey } from "@fedify/vocab";
 import { SpanStatusCode, trace } from "@opentelemetry/api";
 import { FetchError } from "@fedify/vocab-runtime";
@@ -710,10 +710,10 @@ async function createRedirectRequest(request, location, body, validateRedirect)
 		cache: request.cache
 	});
 }
-async function fetchDoubleKnockRequest(request, signedRequest, signal) {
+async function fetchDoubleKnockRequest(session, request, signedRequest, signal) {
 	const maxAttempts = request.method === "GET" || request.method === "HEAD" ? 2 : 1;
 	for (let attempt = 1;; attempt++) try {
-		return await fetch(signedRequest, {
+		return await session.fetch(signedRequest, {
 			redirect: "manual",
 			signal
 		});
@@ -774,59 +774,146 @@ function getAbortReason(signal) {
 * @since 1.6.0
 */
 async function doubleKnock(request, identity, options = {}) {
-	return await doubleKnockInternal(request, identity, options);
+	const { response } = await doubleKnockCore(request, identity, options, openGlobalFetchHop);
+	return response;
 }
-async function doubleKnockInternal(request, identity, options, redirected = 0, visited = /* @__PURE__ */ new Set()) {
-	const { specDeterminer, log, tracerProvider, signal } = options;
-	visited.add(request.url);
-	const origin = new URL(request.url).origin;
-	const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
-	const body = options.body !== void 0 ? options.body : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
-	let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
-		spec: firstTrySpec,
-		tracerProvider,
-		body
-	});
-	log?.(signedRequest);
-	let response = await fetchDoubleKnockRequest(request, signedRequest, signal);
-	if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
-		if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(request.url, `Too many redirections (${redirected + 1})`);
-		const redirectRequest = await createRedirectRequest(request, response.headers.get("Location"), body, options.validateRedirect);
-		if (visited.has(redirectRequest.url)) throw new FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
-		return doubleKnockInternal(redirectRequest, identity, {
-			...options,
-			body
-		}, redirected + 1, visited);
-	} else if (response.status === 400 || response.status === 401 || response.status > 401) {
-		const spec = firstTrySpec === "draft-cavage-http-signatures-12" ? "rfc9421" : "draft-cavage-http-signatures-12";
+/**
+* Performs a double-knock request like {@link doubleKnock}, opening a session
+* for every hop with the given function, and passes the final response to
+* the given function.  The final session is closed after `consume` settles,
+* so `consume` must read or cancel the response body before it returns.
+* This is not exported from any entry point.
+* @param request The request to send.
+* @param identity The identity to use for signing the request.
+* @param options The options for double-knock requests.
+* @param openHop The function to open a session for each hop.  The session of
+*                a hop is closed before the next hop is opened.
+* @param consume The function to consume the final response.
+* @returns The value returned by `consume`.
+*/
+async function doubleKnockScoped(request, identity, options, openHop, consume) {
+	const { response, session } = await doubleKnockCore(request, identity, options, openHop);
+	try {
+		return await consume(response);
+	} catch (error) {
 		getLogger([
 			"fedify",
 			"sig",
 			"http"
-		]).debug("Failed to verify with the spec {spec} ({status} {statusText}); retrying with spec {secondSpec}... (double-knocking)", {
-			spec: firstTrySpec,
-			secondSpec: spec,
-			status: response.status,
-			statusText: response.statusText
+		]).debug("Failed to consume the response from {url}; closing the session: {error}", {
+			url: request.url,
+			error
 		});
-		signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
-			spec,
-			tracerProvider,
-			body
+		throw error;
+	} finally {
+		await session.close();
+	}
+}
+/**
+* A hop session for {@link doubleKnock}: it uses the global `fetch()` without
+* validating or pinning addresses, and its `close()` does nothing, so that
+* the final response can be returned to the caller.
+*/
+function openGlobalFetchHop(url) {
+	const sessionUrl = new URL(url);
+	return Promise.resolve({
+		get url() {
+			return new URL(sessionUrl);
+		},
+		fetch: (input, init) => fetch(input, init),
+		close: () => Promise.resolve()
+	});
+}
+function isRedirectResponse(response) {
+	return response.status >= 300 && response.status < 400 && response.headers.has("Location");
+}
+/**
+* Starts cancelling the body of a response that is not passed to the caller,
+* without waiting for it to settle.  The cancellation of a branch of a tee
+* (e.g., a body cloned by a fetch mock) settles only after the other branch
+* is cancelled too, per the Streams standard, so awaiting it could block
+* forever.  Failures are only logged.
+*/
+function cancelResponseBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		getLogger([
+			"fedify",
+			"sig",
+			"http"
+		]).debug("Failed to cancel the response body from {url}: {error}", {
+			url,
+			error
 		});
-		log?.(signedRequest);
-		response = await fetchDoubleKnockRequest(request, signedRequest, signal);
-		if (response.status >= 300 && response.status < 400 && response.headers.has("Location")) {
+	});
+}
+async function doubleKnockCore(request, identity, options, openHop) {
+	const { specDeterminer, log, tracerProvider, signal } = options;
+	const visited = /* @__PURE__ */ new Set();
+	const body = options.body !== void 0 ? options.body : request.method !== "GET" && request.method !== "HEAD" ? await request.clone().arrayBuffer() : null;
+	let session = await openHop(request.url);
+	try {
+		for (let redirected = 0;; redirected++) {
+			visited.add(request.url);
+			const origin = new URL(request.url).origin;
+			const firstTrySpec = specDeterminer == null ? "rfc9421" : await specDeterminer.determineSpec(origin);
+			let signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+				spec: firstTrySpec,
+				tracerProvider,
+				body
+			});
+			log?.(signedRequest);
+			let response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
+			const firstRedirected = isRedirectResponse(response);
+			if (!firstRedirected && (response.status === 400 || response.status === 401 || response.status > 401)) {
+				const spec = firstTrySpec === "draft-cavage-http-signatures-12" ? "rfc9421" : "draft-cavage-http-signatures-12";
+				getLogger([
+					"fedify",
+					"sig",
+					"http"
+				]).debug("Failed to verify with the spec {spec} ({status} {statusText}); retrying with spec {secondSpec}... (double-knocking)", {
+					spec: firstTrySpec,
+					secondSpec: spec,
+					status: response.status,
+					statusText: response.statusText
+				});
+				cancelResponseBody(response, request.url);
+				signedRequest = await signRequest(request, identity.privateKey, identity.keyId, {
+					spec,
+					tracerProvider,
+					body
+				});
+				log?.(signedRequest);
+				response = await fetchDoubleKnockRequest(session, request, signedRequest, signal);
+				if (!isRedirectResponse(response) && response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
+			} else if (!firstRedirected) await specDeterminer?.rememberSpec(origin, firstTrySpec);
+			if (!isRedirectResponse(response)) return {
+				response,
+				session
+			};
+			cancelResponseBody(response, request.url);
+			await session.close();
 			if (redirected >= DEFAULT_MAX_REDIRECTION) throw new FetchError(request.url, `Too many redirections (${redirected + 1})`);
-			const redirectRequest = await createRedirectRequest(request, response.headers.get("Location"), body, options.validateRedirect);
+			const location = response.headers.get("Location");
+			const redirectRequest = await createRedirectRequest(request, location, body, options.validateRedirect);
 			if (visited.has(redirectRequest.url)) throw new FetchError(request.url, `Redirect loop detected: ${redirectRequest.url}`);
-			return doubleKnockInternal(redirectRequest, identity, {
-				...options,
-				body
-			}, redirected + 1, visited);
-		} else if (response.status !== 400 && response.status !== 401) await specDeterminer?.rememberSpec(origin, spec);
-	} else await specDeterminer?.rememberSpec(origin, firstTrySpec);
-	return response;
+			request = redirectRequest;
+			session = await openHop(request.url);
+		}
+	} catch (error) {
+		try {
+			await session.close();
+		} catch (closeError) {
+			getLogger([
+				"fedify",
+				"sig",
+				"http"
+			]).debug("Failed to close the session for {url}: {error}", {
+				url: request.url,
+				error: closeError
+			});
+		}
+		throw error;
+	}
 }
 /**
 * Performs a timing-safe equality comparison between two `Uint8Array` values.
@@ -856,4 +943,4 @@ function timingSafeEqual(a, b) {
 	return result === 0;
 }
 //#endregion
-export { parseRfc9421Signature as a, timingSafeEqual as c, formatRfc9421SignatureParameters as i, verifyRequest as l, doubleKnock as n, parseRfc9421SignatureInput as o, formatRfc9421Signature as r, signRequest as s, createRfc9421SignatureBase as t };
+export { formatRfc9421SignatureParameters as a, signRequest as c, formatRfc9421Signature as i, timingSafeEqual as l, doubleKnock as n, parseRfc9421Signature as o, doubleKnockScoped as r, parseRfc9421SignatureInput as s, createRfc9421SignatureBase as t, verifyRequest as u };