@fedify/fedify 2.0.35-dev.2480 → 2.0.35-dev.2485

package/dist/{send-CDaWmeqV.mjs → send-ZWmjk2Zf.mjs}

@@ -1,10 +1,11 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-BcnGeGr2.mjs";
-import { n as doubleKnock } from "./http-D0cjeL8a.mjs";
+import { n as version, t as name } from "./deno-DL_ifPJk.mjs";
+import { r as doubleKnockScoped } from "./http-Dvsq4uCu.mjs";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
-import { FetchError, UrlError, validatePublicUrl } from "@fedify/vocab-runtime";
+import { FetchError, UrlError } from "@fedify/vocab-runtime";
+import { openDirectFetch, openPublicFetch } from "@fedify/vocab-runtime/internal";
 import { getLogger } from "@logtape/logtape";
 //#region src/federation/send.ts
 /**
@@ -38,9 +39,10 @@ function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
 *
 * @param parameters The parameters for sending the activity.
 *                   See also {@link SendActivityParameters}.
+* @param deps The dependencies, for tests.
 * @throws {Error} If the activity fails to send.
 */
-function sendActivity(options) {
+function sendActivity(options, deps = {}) {
 	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
 	return tracerProvider.getTracer(name, version).startActiveSpan("activitypub.send_activity", {
 		kind: SpanKind.CLIENT,
@@ -52,7 +54,7 @@ function sendActivity(options) {
 			await sendActivityInternal({
 				...options,
 				tracerProvider
-			}, span);
+			}, span, deps);
 		} catch (e) {
 			span.setStatus({
 				code: SpanStatusCode.ERROR,
@@ -86,21 +88,25 @@ async function readLimitedResponseBody(response, maxBytes) {
 			totalBytes += value.length;
 		}
 	} finally {
+		if (truncated) reader.cancel().catch(() => {});
 		reader.releaseLock();
 	}
 	let result = chunks.join("");
 	if (truncated) result += "… (truncated)";
 	return result;
 }
-async function sendActivityInternal({ activity, activityId, keys, inbox, allowPrivateAddress, headers, specDeterminer, tracerProvider }, span) {
+async function sendActivityInternal({ activity, activityId, keys, inbox, allowPrivateAddress, headers, specDeterminer, tracerProvider }, span, deps) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
 		"outbox"
 	]);
-	async function validateUrl(url) {
-		if (!allowPrivateAddress) try {
-			await validatePublicUrl(url);
+	const openUnvalidatedHop = deps.openHop ?? (allowPrivateAddress ? openDirectFetch : (url) => openPublicFetch(url));
+	let opened = false;
+	async function openHop(url) {
+		let session;
+		try {
+			session = await openUnvalidatedHop(url);
 		} catch (error) {
 			if (error instanceof UrlError && error.reason === "dns") {
 				logger.error("DNS resolution failed for URL: {url}", {
@@ -117,8 +123,9 @@ async function sendActivityInternal({ activity, activityId, keys, inbox, allowPr
 			});
 			throw error;
 		}
+		opened = true;
+		return session;
 	}
-	await validateUrl(inbox.href);
 	headers = new Headers(headers);
 	headers.set("Content-Type", "application/activity+json");
 	const request = new Request(inbox, {
@@ -139,36 +146,30 @@ async function sendActivityInternal({ activity, activityId, keys, inbox, allowPr
 			privateKey: pair.privateKey
 		}))
 	});
-	let response;
+	let outcome;
 	try {
-		response = rsaKey == null ? await fetchWithValidatedRedirects(request, validateUrl) : await doubleKnock(request, rsaKey, {
+		outcome = rsaKey == null ? await fetchWithValidatedRedirects(request, openHop, (response) => consumeSendActivityResponse(response, inbox)) : await doubleKnockScoped(request, rsaKey, {
 			tracerProvider,
-			specDeterminer,
-			validateRedirect: validateUrl
-		});
+			specDeterminer
+		}, openHop, (response) => consumeSendActivityResponse(response, inbox));
 	} catch (error) {
-		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
+		if (opened) logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
 			activityId,
 			inbox: inbox.href,
 			error
 		});
 		throw error;
 	}
-	if (!response.ok) {
-		let error;
-		try {
-			error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
-		} catch (_) {
-			error = "";
-		}
+	if (!outcome.ok) {
+		const { status, statusText, error } = outcome;
 		logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
 			activityId,
 			inbox: inbox.href,
-			status: response.status,
-			statusText: response.statusText,
+			status,
+			statusText,
 			error
 		});
-		throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error);
+		throw new SendActivityError(inbox, status, `Failed to send activity ${activityId} to ${inbox.href} (${status} ${statusText}):\n${error}`, error);
 	}
 	span.addEvent("activitypub.activity.sent", {
 		"activitypub.activity.json": JSON.stringify(activity),
@@ -176,10 +177,74 @@ async function sendActivityInternal({ activity, activityId, keys, inbox, allowPr
 		"activitypub.activity.id": activityId ?? ""
 	});
 }
-async function fetchWithValidatedRedirects(request, validateUrl) {
+/**
+* Starts cancelling the body of a response without waiting for it to settle.
+* The cancellation of a branch of a tee (e.g., a body cloned by a fetch mock)
+* settles only after the other branch is cancelled too, per the Streams
+* standard, so awaiting it could block forever.  Failures are only logged.
+*/
+function cancelResponseBody(response, url) {
+	response.body?.cancel().catch((error) => {
+		getLogger([
+			"fedify",
+			"federation",
+			"outbox"
+		]).debug("Failed to cancel the response body from {url}: {error}", {
+			url,
+			error
+		});
+	});
+}
+/**
+* Reads what is needed from the final response of a delivery while its
+* session is open: the body of a successful response is cancelled, and at
+* most 1 KiB of an error response body is read.
+*/
+async function consumeSendActivityResponse(response, inbox) {
+	if (response.ok) {
+		cancelResponseBody(response, response.url || inbox.href);
+		return { ok: true };
+	}
+	let error;
+	try {
+		error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
+	} catch (_) {
+		error = "";
+	}
+	return {
+		ok: false,
+		status: response.status,
+		statusText: response.statusText,
+		error
+	};
+}
+/**
+* Sends a request without signing it, following redirects manually like the
+* Fetch standard does.  Every hop is opened with `openHop()`, which validates
+* the destination, after the previous hop is closed.  The final response is
+* passed to `consume()`, and its session is closed after that.
+* This is exported only for tests; it is not exported from any entry point.
+* @param request The request to send.
+* @param openHop The function to open a session for each hop.
+* @param consume The function to consume the final response.
+* @returns The value returned by `consume`.
+*/
+async function fetchWithValidatedRedirects(request, openHop, consume) {
+	const logger = getLogger([
+		"fedify",
+		"federation",
+		"outbox"
+	]);
 	let body = await request.clone().text();
 	for (let redirects = 0;; redirects++) {
-		const response = await fetch(request, { redirect: "manual" });
+		const session = await openHop(request.url);
+		let response;
+		try {
+			response = await session.fetch(request, { redirect: "manual" });
+		} catch (error) {
+			await closeAfterError(session, logger);
+			throw error;
+		}
 		const location = response.headers.get("Location");
 		if (![
 			301,
@@ -187,11 +252,21 @@ async function fetchWithValidatedRedirects(request, validateUrl) {
 			303,
 			307,
 			308
-		].includes(response.status) || location == null) return response;
-		await response.body?.cancel();
+		].includes(response.status) || location == null) try {
+			return await consume(response);
+		} catch (error) {
+			logger.debug("Failed to consume the response from {url}; closing the session: {error}", {
+				url: request.url,
+				error
+			});
+			throw error;
+		} finally {
+			await session.close();
+		}
+		cancelResponseBody(response, request.url);
+		await session.close();
 		if (redirects >= 20) throw new TypeError("Too many redirects");
 		const url = new URL(location, request.url);
-		await validateUrl(url.href);
 		const headers = new Headers(request.headers);
 		if (url.origin !== new URL(request.url).origin) {
 			headers.delete("Authorization");
@@ -219,6 +294,16 @@ async function fetchWithValidatedRedirects(request, validateUrl) {
 		});
 	}
 }
+async function closeAfterError(session, logger) {
+	try {
+		await session.close();
+	} catch (error) {
+		logger.debug("Failed to close the session for {url}: {error}", {
+			url: session.url.href,
+			error
+		});
+	}
+}
 /**
 * An error that is thrown when an activity fails to send to a remote inbox.
 * It contains structured information about the failure, including the HTTP
@@ -257,4 +342,4 @@ var SendActivityError = class extends Error {
 	}
 };
 //#endregion
-export { extractInboxes as n, sendActivity as r, SendActivityError as t };
+export { sendActivity as i, extractInboxes as n, fetchWithValidatedRedirects as r, SendActivityError as t };

package/dist/sig/http.test.mjs

@@ -7,11 +7,13 @@ import { i as assertExists, t as assertStringIncludes } from "../std__assert-Dfl
 import { r as assertFalse, t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
-import { t as exportJwk } from "../key-BFzQ3Hef.mjs";
-import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase } from "../http-D0cjeL8a.mjs";
+import { t as exportJwk } from "../key-CgcWGw6W.mjs";
+import { a as formatRfc9421SignatureParameters, c as signRequest, i as formatRfc9421Signature, l as timingSafeEqual, n as doubleKnock, o as parseRfc9421Signature, r as doubleKnockScoped, s as parseRfc9421SignatureInput, t as createRfc9421SignatureBase, u as verifyRequest } from "../http-Dvsq4uCu.mjs";
 import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-CCxRJhWa.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, exportSpki } from "@fedify/vocab-runtime";
+import { openDirectFetch } from "@fedify/vocab-runtime/internal";
+import { configure, reset } from "@logtape/logtape";
 import { encodeBase64 } from "byte-encodings/base64";
 //#region src/sig/http.test.ts
 test("signRequest() [draft-cavage]", async () => {
@@ -1054,6 +1056,330 @@ test("doubleKnock() async specDeterminer test", async () => {
 	assertEquals(specUsed, "draft-cavage-http-signatures-12", "Should use spec from async determiner");
 	esm_default.hardReset();
 });
+const lifecycleIdentity = {
+	keyId: rsaPublicKey2.id,
+	privateKey: rsaPrivateKey2
+};
+test("doubleKnockScoped() retries another spec on the same hop", async () => {
+	const url = "https://example.com/lifecycle/retry";
+	const hops = recordHops((_, index) => index === 1 ? {
+		status: 401,
+		body: "Unauthorized"
+	} : {
+		status: 202,
+		body: "Accepted"
+	});
+	assertEquals(await doubleKnockScoped(new Request(url, {
+		method: "POST",
+		body: "activity"
+	}), lifecycleIdentity, {}, hops.openHop, (response) => response.text()), "Accepted");
+	assertEquals(hops.events, [
+		`open ${url}`,
+		`fetch #1 ${url}`,
+		"cancel #1",
+		`fetch #2 ${url}`,
+		"consumed #2",
+		`close ${url}`
+	]);
+	assertEquals(hops.requests.map((r) => r.headers.has("Signature-Input")), [true, false]);
+	hops.assertInvariants();
+});
+test("doubleKnockScoped() closes the retried hop before a redirect", async () => {
+	const url = "https://example.com/lifecycle/retry-redirect";
+	const next = "https://example.com/lifecycle/final";
+	const hops = recordHops((_, index) => index === 1 ? {
+		status: 401,
+		body: "Unauthorized"
+	} : index === 2 ? {
+		status: 302,
+		headers: { Location: next },
+		body: "Found"
+	} : {
+		status: 200,
+		body: "Done"
+	});
+	assertEquals(await doubleKnockScoped(new Request(url, {
+		method: "POST",
+		body: "activity"
+	}), lifecycleIdentity, {}, hops.openHop, (response) => response.text()), "Done");
+	assertEquals(hops.events, [
+		`open ${url}`,
+		`fetch #1 ${url}`,
+		"cancel #1",
+		`fetch #2 ${url}`,
+		"cancel #2",
+		`close ${url}`,
+		`open ${next}`,
+		`fetch #3 ${next}`,
+		"consumed #3",
+		`close ${next}`
+	]);
+	assertEquals(await hops.requests[2].text(), "activity");
+	hops.assertInvariants();
+});
+test("doubleKnockScoped() retries transport errors on the same hop", async (t) => {
+	await t.step("GET", async () => {
+		const url = "https://example.com/lifecycle/flaky";
+		const hops = recordHops((_, index) => {
+			if (index === 1) throw new TypeError("connection reset");
+			return { body: "Success" };
+		});
+		assertEquals(await doubleKnockScoped(new Request(url), lifecycleIdentity, {}, hops.openHop, (response) => response.text()), "Success");
+		assertEquals(hops.events, [
+			`open ${url}`,
+			`fetch #1 ${url}`,
+			`fetch #2 ${url}`,
+			"consumed #2",
+			`close ${url}`
+		]);
+		hops.assertInvariants();
+	});
+	await t.step("POST", async () => {
+		const url = "https://example.com/lifecycle/flaky-inbox";
+		const hops = recordHops(() => {
+			throw new TypeError("connection reset");
+		});
+		await assertRejects(() => doubleKnockScoped(new Request(url, {
+			method: "POST",
+			body: "activity"
+		}), lifecycleIdentity, {}, hops.openHop, (response) => response.text()), FetchError);
+		assertEquals(hops.events, [
+			`open ${url}`,
+			`fetch #1 ${url}`,
+			`close ${url}`
+		]);
+		hops.assertInvariants();
+	});
+});
+async function captureLogs(fn) {
+	const records = [];
+	await configure({
+		sinks: { buffer: (record) => records.push(record) },
+		loggers: [{
+			category: "fedify",
+			sinks: ["buffer"],
+			lowestLevel: "debug"
+		}, {
+			category: ["logtape", "meta"],
+			sinks: []
+		}],
+		reset: true
+	});
+	try {
+		await fn();
+		await new Promise((resolve) => setTimeout(resolve, 0));
+	} finally {
+		await reset();
+	}
+	return records;
+}
+test("doubleKnockScoped() logs a redirect body failing to cancel and follows the redirect", async () => {
+	const url = "https://example.com/lifecycle/cancel-failure";
+	const next = "https://example.com/lifecycle/cancel-failure-final";
+	const hops = recordHops((_, index) => index === 1 ? {
+		status: 302,
+		headers: { Location: next },
+		body: "Found",
+		failCancel: true
+	} : {
+		status: 200,
+		body: "Done"
+	});
+	let result;
+	const records = await captureLogs(async () => {
+		result = await doubleKnockScoped(new Request(url), lifecycleIdentity, {}, hops.openHop, (response) => response.text());
+	});
+	assertEquals(result, "Done");
+	assertEquals(hops.events, [
+		`open ${url}`,
+		`fetch #1 ${url}`,
+		"cancel #1",
+		`close ${url}`,
+		`open ${next}`,
+		`fetch #2 ${next}`,
+		"consumed #2",
+		`close ${next}`
+	]);
+	const failures = records.filter((r) => r.rawMessage === "Failed to cancel the response body from {url}: {error}");
+	assertEquals(failures.map((r) => [r.level, r.properties.url]), [["debug", url]]);
+	assertEquals(failures[0].properties.error.message, "cancel #1 failed");
+	hops.assertInvariants();
+});
+test("doubleKnockScoped() is not blocked by a body cancellation that never settles", async () => {
+	const url = "https://example.com/lifecycle/hanging-cancel";
+	const next = "https://example.com/lifecycle/hanging-cancel-final";
+	const hops = recordHops((_, index) => index === 1 ? {
+		status: 401,
+		body: "Unauthorized",
+		hangCancel: true
+	} : index === 2 ? {
+		status: 302,
+		headers: { Location: next },
+		body: "Found",
+		hangCancel: true
+	} : {
+		status: 200,
+		body: "Done",
+		hangCancel: true
+	});
+	assertEquals(await doubleKnockScoped(new Request(url, {
+		method: "POST",
+		body: "activity"
+	}), lifecycleIdentity, {}, hops.openHop, (response) => Promise.resolve(response.status)), 200);
+	assertEquals(hops.events, [
+		`open ${url}`,
+		`fetch #1 ${url}`,
+		"cancel #1",
+		`fetch #2 ${url}`,
+		"cancel #2",
+		`close ${url}`,
+		`open ${next}`,
+		`fetch #3 ${next}`,
+		"cancel #3 by close",
+		`close ${next}`
+	]);
+	hops.assertInvariants();
+});
+test("doubleKnockScoped() completes with responses cloned by fetch-mock", async () => {
+	esm_default.spyGlobal();
+	try {
+		let attempts = 0;
+		esm_default.post("https://example.com/tee/redirect", () => {
+			attempts++;
+			return attempts === 1 ? new Response("Unauthorized", { status: 401 }) : new Response("Found", {
+				status: 302,
+				headers: { Location: "https://example.com/tee/final" }
+			});
+		});
+		esm_default.post("https://example.com/tee/final", () => new Response("Accepted", { status: 202 }));
+		const request = () => new Request("https://example.com/tee/redirect", {
+			method: "POST",
+			body: "activity"
+		});
+		assertEquals(await doubleKnockScoped(request(), lifecycleIdentity, {}, openDirectFetch, (response) => Promise.resolve(response.status)), 202);
+		assertEquals(attempts, 2);
+		attempts = 0;
+		const response = await doubleKnock(request(), lifecycleIdentity);
+		assertEquals(response.status, 202);
+		assertEquals(await response.text(), "Accepted");
+		assertEquals(attempts, 2);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("doubleKnockScoped() closes the session when consuming fails", async (t) => {
+	const url = "https://example.com/lifecycle/consume";
+	await t.step("exception", async () => {
+		const hops = recordHops(() => ({ body: "x".repeat(1024) }));
+		const error = /* @__PURE__ */ new Error("consume failed");
+		await assertRejects(() => doubleKnockScoped(new Request(url), lifecycleIdentity, {}, hops.openHop, async (response) => {
+			const reader = response.body.getReader();
+			await reader.read();
+			reader.releaseLock();
+			throw error;
+		}), Error, "consume failed");
+		assertEquals(hops.events, [
+			`open ${url}`,
+			`fetch #1 ${url}`,
+			"cancel #1 by close",
+			`close ${url}`
+		]);
+		hops.assertInvariants();
+	});
+	await t.step("abort", async () => {
+		const hops = recordHops(() => ({ body: "Success" }));
+		const controller = new AbortController();
+		const reason = /* @__PURE__ */ new Error("aborted while consuming");
+		assert(await assertRejects(() => doubleKnockScoped(new Request(url), lifecycleIdentity, { signal: controller.signal }, hops.openHop, () => {
+			controller.abort(reason);
+			controller.signal.throwIfAborted();
+			return Promise.resolve();
+		})) === reason);
+		assertEquals(hops.events, [
+			`open ${url}`,
+			`fetch #1 ${url}`,
+			"cancel #1 by close",
+			`close ${url}`
+		]);
+		hops.assertInvariants();
+	});
+});
+test("doubleKnock() returns the final response without cancelling its body", async () => {
+	const url = "https://example.com/lifecycle/public";
+	const next = "https://example.com/lifecycle/public-final";
+	const events = [];
+	const responses = [];
+	const originalFetch = globalThis.fetch;
+	globalThis.fetch = ((input) => {
+		const requestUrl = input instanceof Request ? input.url : String(input);
+		const index = responses.length + 1;
+		events.push(`fetch #${index} ${requestUrl}`);
+		const recorded = createRecordedResponse(events, index, requestUrl === url ? {
+			status: 302,
+			headers: { Location: next },
+			body: "Found"
+		} : {
+			status: 200,
+			body: "Done"
+		});
+		responses.push(recorded);
+		return Promise.resolve(recorded.response);
+	});
+	try {
+		const response = await doubleKnock(new Request(url), lifecycleIdentity);
+		assertEquals(events, [
+			`fetch #1 ${url}`,
+			"cancel #1",
+			`fetch #2 ${next}`
+		]);
+		assertFalse(responses[1].settled());
+		assertEquals(await response.text(), "Done");
+		assertEquals(events.at(-1), "consumed #2");
+	} finally {
+		globalThis.fetch = originalFetch;
+	}
+});
+test("doubleKnock() is not blocked by a body cancellation that never settles", async () => {
+	const url = "https://example.com/lifecycle/public-hanging";
+	const next = "https://example.com/lifecycle/public-hanging-final";
+	const events = [];
+	const originalFetch = globalThis.fetch;
+	let index = 0;
+	globalThis.fetch = ((input) => {
+		const requestUrl = input instanceof Request ? input.url : String(input);
+		index++;
+		events.push(`fetch #${index} ${requestUrl}`);
+		return Promise.resolve(createRecordedResponse(events, index, index === 1 ? {
+			status: 401,
+			body: "Unauthorized",
+			hangCancel: true
+		} : index === 2 ? {
+			status: 302,
+			headers: { Location: next },
+			body: "Found",
+			hangCancel: true
+		} : {
+			status: 200,
+			body: "Done"
+		}).response);
+	});
+	try {
+		const response = await doubleKnock(new Request(url, {
+			method: "POST",
+			body: "activity"
+		}), lifecycleIdentity);
+		assertEquals(events, [
+			`fetch #1 ${url}`,
+			"cancel #1",
+			`fetch #2 ${url}`,
+			"cancel #2",
+			`fetch #3 ${next}`
+		]);
+		assertEquals(await response.text(), "Done");
+	} finally {
+		globalThis.fetch = originalFetch;
+	}
+});
 test("timingSafeEqual()", async (t) => {
 	await t.step("should return true for equal empty arrays", () => {
 		assert(timingSafeEqual(new Uint8Array([]), new Uint8Array([])));
@@ -1382,5 +1708,88 @@ test("signRequest() and verifyRequest() cancellation", {
 	});
 	esm_default.hardReset();
 });
+function createRecordedResponse(events, index, init, cancelSuffix = () => "") {
+	const bytes = new TextEncoder().encode(init.body ?? "");
+	const chunkSize = init.chunkSize ?? 256;
+	let offset = 0;
+	let settled = false;
+	const body = new ReadableStream({
+		pull(controller) {
+			if (offset >= bytes.length) {
+				settled = true;
+				events.push(`consumed #${index}`);
+				controller.close();
+				return;
+			}
+			controller.enqueue(bytes.slice(offset, offset + chunkSize));
+			offset += chunkSize;
+		},
+		cancel() {
+			settled = true;
+			events.push(`cancel #${index}${cancelSuffix()}`);
+			if (init.failCancel) throw new Error(`cancel #${index} failed`);
+			if (init.hangCancel) return new Promise(() => {});
+		}
+	}, { highWaterMark: 0 });
+	return {
+		response: new Response(body, {
+			status: init.status ?? 200,
+			headers: init.headers
+		}),
+		settled: () => settled
+	};
+}
+function recordHops(respond) {
+	const events = [];
+	const requests = [];
+	const unsettledAtClose = [];
+	let opens = 0;
+	let closes = 0;
+	let fetches = 0;
+	return {
+		events,
+		requests,
+		openHop(url) {
+			opens++;
+			events.push(`open ${url}`);
+			const tracked = [];
+			let closed = false;
+			let closing = false;
+			return Promise.resolve({
+				url: new URL(url),
+				async fetch(input, init) {
+					if (closed) throw new TypeError("The session is closed.");
+					const request = new Request(input instanceof Request ? input.clone() : input, init);
+					const index = ++fetches;
+					requests.push(request);
+					events.push(`fetch #${index} ${request.url}`);
+					const recorded = createRecordedResponse(events, index, await respond(request, index), () => closing ? " by close" : "");
+					tracked.push({
+						...recorded,
+						index
+					});
+					return recorded.response;
+				},
+				close() {
+					if (closed) return Promise.resolve();
+					closed = true;
+					closes++;
+					closing = true;
+					for (const { response, settled, index } of tracked) {
+						if (settled()) continue;
+						if (response.body?.locked) unsettledAtClose.push(index);
+						else response.body?.cancel().catch(() => {});
+					}
+					events.push(`close ${url}`);
+					return Promise.resolve();
+				}
+			});
+		},
+		assertInvariants() {
+			assertEquals(opens, closes);
+			assertEquals(unsettledAtClose, []);
+		}
+	};
+}
 //#endregion
 export {};

package/dist/sig/key.test.mjs

@@ -6,9 +6,9 @@ import { n as assertStrictEquals } from "../std__assert-DflMZha5.mjs";
 import { r as assertFalse, t as assertThrows } from "../assert_throws-D4DNWrux.mjs";
 import { t as assert } from "../assert-BhQd8QHP.mjs";
 import { t as assertRejects } from "../assert_rejects-WyYSTDDX.mjs";
-import { a as importJwk, i as generateCryptoKeyPair, o as validateCryptoKey, r as fetchKey, t as exportJwk } from "../key-BFzQ3Hef.mjs";
+import { a as importJwk, i as generateCryptoKeyPair, o as validateCryptoKey, r as fetchKey, t as exportJwk } from "../key-CgcWGw6W.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-CCxRJhWa.mjs";
-import { g as wrapContextLoaderForJsonLd } from "../ld-D2bkYBIz.mjs";
+import { g as wrapContextLoaderForJsonLd } from "../ld-CfOIwHup.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
 import { CryptographicKey, Multikey, Person } from "@fedify/vocab";
 import { FetchError, UrlError, getDocumentLoader } from "@fedify/vocab-runtime";