@fedify/fedify 2.1.12 → 2.1.14

package/dist/{proof-kuTIVfyZ.cjs → proof-JEoW3ODq.cjs}

@@ -1,7 +1,7 @@
 const { Temporal } = require("@js-temporal/polyfill");
 const { URLPattern } = require("urlpattern-polyfill");
 const require_chunk = require("./chunk-DDcVe30Y.cjs");
-const require_http = require("./http-CmDErAnD.cjs");
+const require_http = require("./http-CEXtUHix.cjs");
 let _logtape_logtape = require("@logtape/logtape");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
@@ -18,6 +18,288 @@ const logger$1 = (0, _logtape_logtape.getLogger)([
 	"sig",
 	"ld"
 ]);
+const localContext = [
+	"https://w3id.org/identity/v1",
+	"https://www.w3.org/ns/activitystreams",
+	"https://w3id.org/security/v1",
+	"https://w3id.org/security/data-integrity/v1"
+];
+const localContextUrls = new Set(localContext);
+const builtInContextLoader = (0, _fedify_vocab_runtime.getDocumentLoader)();
+const disallowedJsonLdKeywords = new Set([
+	"@graph",
+	"@included",
+	"@reverse"
+]);
+/** @internal */
+var UnsafeJsonLdError = class extends TypeError {
+	constructor(keyword) {
+		super(`Unsupported JSON-LD keyword: ${keyword}.`);
+		this.keyword = keyword;
+		this.name = "UnsafeJsonLdError";
+	}
+};
+/** @internal */
+var InvalidContextReferenceError = class extends TypeError {
+	constructor(reference) {
+		super(`Invalid JSON-LD context reference: ${reference}.`);
+		this.reference = reference;
+		this.name = "InvalidContextReferenceError";
+	}
+};
+function createLoadingRemoteContextFailedError(reference, cause) {
+	const message = cause instanceof Error ? cause.message : String(cause);
+	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a valid JSON-LD context: ${reference}. ${message}`);
+	error.name = "jsonld.InvalidUrl";
+	error.details = {
+		code: "loading remote context failed",
+		url: reference
+	};
+	error.cause = cause;
+	return error;
+}
+/** @internal */
+function isClearlyMalformedContextReference(reference) {
+	for (const char of reference) {
+		const code = char.charCodeAt(0);
+		if (code <= 32 || code === 127) return true;
+	}
+	if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(reference) && !URL.canParse(reference)) return true;
+	for (let i = 0; i < reference.length; i++) {
+		if (reference[i] !== "%") continue;
+		if (i + 2 >= reference.length || !/[0-9A-Fa-f]/.test(reference[i + 1]) || !/[0-9A-Fa-f]/.test(reference[i + 2])) return true;
+		i += 2;
+	}
+	if (reference.startsWith("./") || reference.startsWith("../") || reference.startsWith("/") || reference.startsWith("//")) {
+		for (const char of reference) if ("[]<>\"\\^`{|}".includes(char)) return true;
+	}
+	return false;
+}
+function cloneRemoteDocument(remoteDocument) {
+	return structuredClone(remoteDocument);
+}
+function createMemoizedDocumentLoader(documentLoader) {
+	const cache = /* @__PURE__ */ new Map();
+	return async (url, options) => {
+		const cacheKey = URL.canParse(url) ? new URL(url).href : url;
+		let remoteDocument = cache.get(cacheKey);
+		if (remoteDocument == null) {
+			remoteDocument = Promise.resolve(documentLoader(url, options)).then(cloneRemoteDocument);
+			remoteDocument.catch(() => {
+				if (cache.get(cacheKey) === remoteDocument) cache.delete(cacheKey);
+			});
+			cache.set(cacheKey, remoteDocument);
+		}
+		return cloneRemoteDocument(await remoteDocument);
+	};
+}
+/** @internal */
+function wrapContextLoaderForJsonLd(contextLoader) {
+	const loader = contextLoader ?? builtInContextLoader;
+	return async (url, options) => {
+		try {
+			return await loader(url, options);
+		} catch (error) {
+			if (!isInvalidUrlTypeError(error)) throw error;
+			if (isClearlyMalformedContextReference(url)) throw new InvalidContextReferenceError(url);
+			throw createLoadingRemoteContextFailedError(url, error);
+		}
+	};
+}
+/** @internal */
+function getNormalizationContextLoader(contextLoader) {
+	const loader = wrapContextLoaderForJsonLd(contextLoader);
+	return createMemoizedDocumentLoader(async (url, options) => {
+		if (URL.canParse(url)) {
+			const normalizedUrl = new URL(url).href;
+			if (localContextUrls.has(normalizedUrl)) return await builtInContextLoader(normalizedUrl, options);
+		}
+		return await loader(url, options);
+	});
+}
+/** @internal */
+async function compactJsonLd(jsonLd, contextLoader) {
+	const hasLds = typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd;
+	const signature = hasLds ? jsonLd.signature : void 0;
+	const normalizationContextLoader = getNormalizationContextLoader(contextLoader);
+	const document = hasLds ? detachSignature(jsonLd) : jsonLd;
+	await assertNoGraphBeforeCompaction(document, normalizationContextLoader);
+	const compacted = await _fedify_vocab_runtime_jsonld.default.compact(document, localContext, { documentLoader: normalizationContextLoader });
+	if (hasLds && typeof compacted === "object" && compacted != null) compacted.signature = signature;
+	assertSafeJsonLd(compacted);
+	return compacted;
+}
+function createInvalidRemoteContextError(reference) {
+	const error = /* @__PURE__ */ new Error(`Dereferencing a URL did not result in a JSON object. The response was valid JSON, but it was not a JSON object. URL: "${reference}".`);
+	error.name = "jsonld.InvalidUrl";
+	error.details = {
+		code: "invalid remote context",
+		url: reference
+	};
+	return error;
+}
+function getRemoteContext(remoteDocument, reference) {
+	const { contextUrl, documentUrl } = remoteDocument;
+	let { document } = remoteDocument;
+	if (typeof document === "string") document = JSON.parse(document);
+	if (typeof document !== "object" || document == null || Array.isArray(document)) throw createInvalidRemoteContextError(reference);
+	let context = "@context" in document ? document["@context"] : {};
+	if (contextUrl != null) context = Array.isArray(context) ? [...context, contextUrl] : [context, contextUrl];
+	return {
+		context,
+		baseUrl: documentUrl ?? reference
+	};
+}
+function createGraphAliasContextState() {
+	return {
+		graphTerms: /* @__PURE__ */ new Set(),
+		jsonTerms: /* @__PURE__ */ new Set(),
+		propertyContexts: /* @__PURE__ */ new Map(),
+		termTargets: /* @__PURE__ */ new Map()
+	};
+}
+function cloneGraphAliasContextState(state) {
+	return {
+		graphTerms: new Set(state.graphTerms),
+		jsonTerms: new Set(state.jsonTerms),
+		propertyContexts: new Map(state.propertyContexts),
+		termTargets: new Map(state.termTargets)
+	};
+}
+function resolveContextTarget(target, state) {
+	if (target === "@graph") return target;
+	const mapped = state.termTargets.get(target);
+	if (mapped == null) return target;
+	return mapped;
+}
+function getDirectContextTarget(definition) {
+	if (definition === null) return null;
+	if (typeof definition === "string") return definition;
+	if (typeof definition === "object" && definition != null && "@id" in definition) {
+		const id = definition["@id"];
+		if (id === null) return null;
+		if (typeof id === "string") return id;
+	}
+}
+function isJsonTypedDefinition(definition) {
+	return typeof definition === "object" && definition != null && "@type" in definition && definition["@type"] === "@json";
+}
+function resolveLocalContextTarget(target, state, localTargets, seen = /* @__PURE__ */ new Set()) {
+	if (target === "@graph") return target;
+	if (seen.has(target)) return target;
+	seen.add(target);
+	if (localTargets.has(target)) {
+		const localTarget = localTargets.get(target);
+		return localTarget == null ? target : resolveLocalContextTarget(localTarget, state, localTargets, seen);
+	}
+	return resolveContextTarget(target, state);
+}
+function refreshGraphAliases(state) {
+	state.graphTerms.clear();
+	for (const [term, target] of state.termTargets) if (target === "@graph") state.graphTerms.add(term);
+}
+function normalizeContextReference(reference, baseUrl) {
+	if (baseUrl != null) return new URL(reference, baseUrl).href;
+	return URL.canParse(reference) ? new URL(reference).href : reference;
+}
+/** @internal */
+function isInvalidUrlTypeError(error) {
+	const code = error.code;
+	return error instanceof TypeError && (code === "ERR_INVALID_URL" || /^Invalid URL(?::|$)/.test(error.message) || / cannot be parsed as a URL\.?$/.test(error.message));
+}
+async function applyGraphAliasContext(state, context, documentLoader, remoteContextCache, baseUrl = null, processingContexts = /* @__PURE__ */ new Set()) {
+	if (context === null) return createGraphAliasContextState();
+	let nextState = cloneGraphAliasContextState(state);
+	if (Array.isArray(context)) {
+		for (const item of context) nextState = await applyGraphAliasContext(nextState, item, documentLoader, remoteContextCache, baseUrl, processingContexts);
+		return nextState;
+	}
+	if (typeof context === "string") {
+		const reference = normalizeContextReference(context, baseUrl);
+		const cacheKey = `${baseUrl ?? ""}\n${reference}`;
+		if (processingContexts.has(cacheKey)) return nextState;
+		processingContexts.add(cacheKey);
+		try {
+			let remoteContext = remoteContextCache.get(cacheKey);
+			if (remoteContext == null) {
+				remoteContext = (async () => {
+					try {
+						return getRemoteContext(await documentLoader(reference), reference);
+					} catch (error) {
+						if (reference === context && isInvalidUrlTypeError(error) && isClearlyMalformedContextReference(context)) throw new InvalidContextReferenceError(context);
+						throw error;
+					}
+				})();
+				remoteContextCache.set(cacheKey, remoteContext);
+			}
+			const loadedRemoteContext = await remoteContext;
+			return await applyGraphAliasContext(nextState, loadedRemoteContext.context, documentLoader, remoteContextCache, loadedRemoteContext.baseUrl, processingContexts);
+		} finally {
+			processingContexts.delete(cacheKey);
+		}
+	}
+	if (typeof context === "object" && context != null) {
+		if ("@import" in context && typeof context["@import"] === "string") nextState = await applyGraphAliasContext(nextState, context["@import"], documentLoader, remoteContextCache, baseUrl, processingContexts);
+		const localTargets = /* @__PURE__ */ new Map();
+		for (const [term, definition] of globalThis.Object.entries(context)) {
+			if (term.startsWith("@")) continue;
+			const target = getDirectContextTarget(definition);
+			if (target == null) localTargets.set(term, null);
+			else if (typeof target === "string") localTargets.set(term, target);
+			else localTargets.delete(term);
+		}
+		for (const [term, definition] of globalThis.Object.entries(context)) {
+			if (term.startsWith("@")) continue;
+			if (localTargets.has(term)) {
+				const directTarget = localTargets.get(term);
+				if (directTarget == null) nextState.termTargets.set(term, null);
+				else nextState.termTargets.set(term, resolveLocalContextTarget(directTarget, nextState, localTargets));
+			} else nextState.termTargets.delete(term);
+			if (typeof definition === "object" && definition != null && "@context" in definition) nextState.propertyContexts.set(term, {
+				context: definition["@context"],
+				baseUrl
+			});
+			else nextState.propertyContexts.delete(term);
+			if (isJsonTypedDefinition(definition)) nextState.jsonTerms.add(term);
+			else nextState.jsonTerms.delete(term);
+		}
+		refreshGraphAliases(nextState);
+	}
+	return nextState;
+}
+async function assertNoGraphBeforeCompaction(jsonLd, documentLoader, inheritedState = createGraphAliasContextState(), propertyContext, remoteContextCache = /* @__PURE__ */ new Map()) {
+	if (Array.isArray(jsonLd)) {
+		for (const item of jsonLd) await assertNoGraphBeforeCompaction(item, documentLoader, inheritedState, propertyContext, remoteContextCache);
+		return;
+	}
+	if (typeof jsonLd !== "object" || jsonLd == null) return;
+	const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
+	let state = inheritedState;
+	if (propertyContext !== void 0) state = await applyGraphAliasContext(state, propertyContext.context, documentLoader, remoteContextCache, propertyContext.baseUrl);
+	if ("@context" in jsonLd) state = await applyGraphAliasContext(state, jsonLd["@context"], documentLoader, remoteContextCache);
+	for (const [key, value] of globalThis.Object.entries(jsonLd)) {
+		if (key === "@context") continue;
+		if (jsonLiteralWrapper && key === "@value") continue;
+		if (key === "@graph" || state.graphTerms.has(key)) throw new UnsafeJsonLdError("@graph");
+		if (state.jsonTerms.has(key)) continue;
+		await assertNoGraphBeforeCompaction(value, documentLoader, state, state.propertyContexts.get(key), remoteContextCache);
+	}
+}
+function isJsonLiteralWrapper(value) {
+	return "@value" in value && (value["@type"] === "@json" || value.type === "@json");
+}
+/** @internal */
+function assertSafeJsonLd(jsonLd) {
+	if (Array.isArray(jsonLd)) for (const item of jsonLd) assertSafeJsonLd(item);
+	else if (typeof jsonLd === "object" && jsonLd != null) {
+		const jsonLiteralWrapper = isJsonLiteralWrapper(jsonLd);
+		for (const [key, value] of globalThis.Object.entries(jsonLd)) {
+			if (disallowedJsonLdKeywords.has(key)) throw new UnsafeJsonLdError(key);
+			if (jsonLiteralWrapper && key === "@value") continue;
+			assertSafeJsonLd(value);
+		}
+	}
+}
 /**
 * Attaches a LD signature to the given JSON-LD document.
 * @param jsonLd The JSON-LD document to attach the signature to.  It is not
@@ -211,9 +493,21 @@ async function verifySignature(jsonLd, options = {}) {
 * @returns `true` if the document is authentic; `false` otherwise.
 */
 async function verifyJsonLd(jsonLd, options = {}) {
+	return await verifyJsonLdInternal(jsonLd, options, true);
+}
+/** @internal */
+async function verifyCompactJsonLd(jsonLd, options = {}) {
+	return await verifyJsonLdInternal(jsonLd, options, false);
+}
+async function verifyJsonLdInternal(jsonLd, options, compact) {
 	return await (options.tracerProvider ?? _opentelemetry_api.trace.getTracerProvider()).getTracer(require_http.name, require_http.version).startActiveSpan("ld_signatures.verify", async (span) => {
 		try {
-			const object = await _fedify_vocab.Object.fromJsonLd(jsonLd, options);
+			const verificationOptions = hasSignature(jsonLd) ? {
+				...options,
+				contextLoader: getNormalizationContextLoader(options.contextLoader)
+			} : options;
+			const compacted = compact ? hasSignature(jsonLd) ? await compactJsonLd(jsonLd, options.contextLoader) : jsonLd : jsonLd;
+			const object = await _fedify_vocab.Object.fromJsonLd(compacted, verificationOptions);
 			if (object.id != null) span.setAttribute("activitypub.object.id", object.id.href);
 			span.setAttribute("activitypub.object.type", (0, _fedify_vocab.getTypeId)(object).href);
 			if (typeof jsonLd === "object" && jsonLd != null && "signature" in jsonLd && typeof jsonLd.signature === "object" && jsonLd.signature != null) {
@@ -223,7 +517,7 @@ async function verifyJsonLd(jsonLd, options = {}) {
 			}
 			const attributions = new Set(object.attributionIds.map((uri) => uri.href));
 			if (object instanceof _fedify_vocab.Activity) for (const uri of object.actorIds) attributions.add(uri.href);
-			const key = await verifySignature(jsonLd, options);
+			const key = await verifySignature(compacted, verificationOptions);
 			if (key == null) return false;
 			if (key.ownerId == null) {
 				logger$1.debug("Key {keyId} has no owner.", { keyId: key.id?.href });
@@ -605,12 +899,30 @@ async function verifyObject(cls, jsonLd, options = {}) {
 	return object;
 }
 //#endregion
+Object.defineProperty(exports, "InvalidContextReferenceError", {
+	enumerable: true,
+	get: function() {
+		return InvalidContextReferenceError;
+	}
+});
+Object.defineProperty(exports, "assertSafeJsonLd", {
+	enumerable: true,
+	get: function() {
+		return assertSafeJsonLd;
+	}
+});
 Object.defineProperty(exports, "attachSignature", {
 	enumerable: true,
 	get: function() {
 		return attachSignature;
 	}
 });
+Object.defineProperty(exports, "compactJsonLd", {
+	enumerable: true,
+	get: function() {
+		return compactJsonLd;
+	}
+});
 Object.defineProperty(exports, "createProof", {
 	enumerable: true,
 	get: function() {
@@ -641,12 +953,30 @@ Object.defineProperty(exports, "getKeyOwner", {
 		return getKeyOwner;
 	}
 });
+Object.defineProperty(exports, "getNormalizationContextLoader", {
+	enumerable: true,
+	get: function() {
+		return getNormalizationContextLoader;
+	}
+});
 Object.defineProperty(exports, "hasSignature", {
 	enumerable: true,
 	get: function() {
 		return hasSignature;
 	}
 });
+Object.defineProperty(exports, "isClearlyMalformedContextReference", {
+	enumerable: true,
+	get: function() {
+		return isClearlyMalformedContextReference;
+	}
+});
+Object.defineProperty(exports, "isInvalidUrlTypeError", {
+	enumerable: true,
+	get: function() {
+		return isInvalidUrlTypeError;
+	}
+});
 Object.defineProperty(exports, "signJsonLd", {
 	enumerable: true,
 	get: function() {
@@ -659,6 +989,12 @@ Object.defineProperty(exports, "signObject", {
 		return signObject;
 	}
 });
+Object.defineProperty(exports, "verifyCompactJsonLd", {
+	enumerable: true,
+	get: function() {
+		return verifyCompactJsonLd;
+	}
+});
 Object.defineProperty(exports, "verifyJsonLd", {
 	enumerable: true,
 	get: function() {
@@ -683,3 +1019,9 @@ Object.defineProperty(exports, "verifySignature", {
 		return verifySignature;
 	}
 });
+Object.defineProperty(exports, "wrapContextLoaderForJsonLd", {
+	enumerable: true,
+	get: function() {
+		return wrapContextLoaderForJsonLd;
+	}
+});

package/dist/runtime/mod.d.cts

@@ -1,3 +1,4 @@
+/// <reference lib="esnext.temporal" />
 export * from "@fedify/vocab-runtime";
 
 //#region \0rolldown/runtime.js

package/dist/runtime/mod.d.ts

@@ -1,3 +1,2 @@
-import { Temporal } from "@js-temporal/polyfill";
-import { URLPattern } from "urlpattern-polyfill";
+/// <reference lib="esnext.temporal" />
 export * from "@fedify/vocab-runtime";

package/dist/runtime/mod.js

@@ -1,4 +1,4 @@
-import "@js-temporal/polyfill";
-import "urlpattern-polyfill";
-import "../chunk-nlSIicah.js";
+import { Temporal } from "@js-temporal/polyfill";
+import { URLPattern } from "urlpattern-polyfill";
+import "../chunk-CRNNMoPX.js";
 export * from "@fedify/vocab-runtime";

package/dist/{send-Buz5Gy8x.mjs → send-5ulOKVCW.mjs}

@@ -1,8 +1,8 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-Ddb3P7G7.mjs";
-import { n as doubleKnock } from "./http-DRDpStn2.mjs";
+import { n as version, t as name } from "./deno-bqnW1QlD.mjs";
+import { n as doubleKnock } from "./http-DvhFwy2E.mjs";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import { getLogger } from "@logtape/logtape";
 //#region src/federation/send.ts

package/dist/sig/http.test.mjs

@@ -7,8 +7,8 @@ import { a as assertExists, t as assertStringIncludes } from "../std__assert-Dui
 import { n as assertFalse, t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
 import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
 import { t as assert } from "../assert-ddO5KLpe.mjs";
-import { t as exportJwk } from "../key-WSedbAA-.mjs";
-import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase, u as verifyRequestDetailed } from "../http-DRDpStn2.mjs";
+import { t as exportJwk } from "../key-B3OBz6A_.mjs";
+import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase, u as verifyRequestDetailed } from "../http-DvhFwy2E.mjs";
 import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-BAK-tUlf.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, exportSpki } from "@fedify/vocab-runtime";
@@ -959,6 +959,124 @@ test("doubleKnock() detects redirect loops", async () => {
 	assertEquals(requestCount, 2);
 	esm_default.hardReset();
 });
+test("doubleKnock() retries idempotent request transport errors", async () => {
+	esm_default.spyGlobal();
+	try {
+		let requestCount = 0;
+		esm_default.get("https://example.com/flaky-document", () => {
+			requestCount++;
+			if (requestCount === 1) throw new TypeError("temporary DNS failure");
+			return new Response("Success", { status: 200 });
+		});
+		const response = await doubleKnock(new Request("https://example.com/flaky-document"), {
+			keyId: rsaPublicKey2.id,
+			privateKey: rsaPrivateKey2
+		});
+		assertEquals(response.status, 200);
+		assertEquals(await response.text(), "Success");
+		assertEquals(requestCount, 2);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("doubleKnock() wraps repeated transport errors", async () => {
+	esm_default.spyGlobal();
+	try {
+		let requestCount = 0;
+		const failure = /* @__PURE__ */ new TypeError("DNS lookup failed");
+		esm_default.get("https://example.com/unreachable-document", () => {
+			requestCount++;
+			throw failure;
+		});
+		const request = new Request("https://example.com/unreachable-document");
+		const error = await assertRejects(() => doubleKnock(request, {
+			keyId: rsaPublicKey2.id,
+			privateKey: rsaPrivateKey2
+		}), FetchError, "DNS lookup failed");
+		assertEquals(error.url.href, "https://example.com/unreachable-document");
+		assertEquals(error.cause, failure);
+		assertEquals(requestCount, 2);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("doubleKnock() does not retry non-idempotent transport errors", async () => {
+	esm_default.spyGlobal();
+	try {
+		let requestCount = 0;
+		const failure = /* @__PURE__ */ new TypeError("connection reset");
+		esm_default.post("https://example.com/flaky-inbox", () => {
+			requestCount++;
+			throw failure;
+		});
+		const request = new Request("https://example.com/flaky-inbox", {
+			method: "POST",
+			body: "Test activity content",
+			headers: { "Content-Type": "application/activity+json" }
+		});
+		const error = await assertRejects(() => doubleKnock(request, {
+			keyId: rsaPublicKey2.id,
+			privateKey: rsaPrivateKey2
+		}), FetchError, "connection reset");
+		assertEquals(error.url.href, "https://example.com/flaky-inbox");
+		assertEquals(error.cause, failure);
+		assertEquals(requestCount, 1);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("doubleKnock() preserves Request signal abort reasons", async () => {
+	const controller = new AbortController();
+	const abortReason = "request aborted";
+	controller.abort(abortReason);
+	const request = new Request("https://example.com/request-abort", { signal: controller.signal });
+	assertEquals(await assertRejects(() => doubleKnock(request, {
+		keyId: rsaPublicKey2.id,
+		privateKey: rsaPrivateKey2
+	})), abortReason);
+});
+test("doubleKnock() preserves Request signal aborts during retry delay", async () => {
+	esm_default.spyGlobal();
+	try {
+		let requestCount = 0;
+		const controller = new AbortController();
+		const abortReason = "retry aborted";
+		esm_default.get("https://example.com/aborted-retry", () => {
+			requestCount++;
+			setTimeout(() => controller.abort(abortReason));
+			throw new TypeError("temporary DNS failure");
+		});
+		const request = new Request("https://example.com/aborted-retry", { signal: controller.signal });
+		assertEquals(await assertRejects(() => doubleKnock(request, {
+			keyId: rsaPublicKey2.id,
+			privateKey: rsaPrivateKey2
+		})), abortReason);
+		assertEquals(requestCount, 1);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("doubleKnock() prefers Request aborts over transport errors", async () => {
+	esm_default.spyGlobal();
+	try {
+		let requestCount = 0;
+		const controller = new AbortController();
+		const abortReason = "transport aborted";
+		esm_default.get("https://example.com/abort-with-transport-error", () => {
+			requestCount++;
+			controller.abort(abortReason);
+			throw new TypeError("temporary DNS failure");
+		});
+		const request = new Request("https://example.com/abort-with-transport-error", { signal: controller.signal });
+		assertEquals(await assertRejects(() => doubleKnock(request, {
+			keyId: rsaPublicKey2.id,
+			privateKey: rsaPrivateKey2
+		})), abortReason);
+		assertEquals(requestCount, 1);
+	} finally {
+		esm_default.hardReset();
+	}
+});
 test("doubleKnock() async specDeterminer test", async () => {
 	esm_default.spyGlobal();
 	let requestCount = 0;

package/dist/sig/key.test.mjs

@@ -5,7 +5,7 @@ import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
 import "../std__assert-Duiq_YC9.mjs";
 import { t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
 import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
-import { a as importJwk, i as generateCryptoKeyPair, n as fetchKey, o as validateCryptoKey, r as fetchKeyDetailed, t as exportJwk } from "../key-WSedbAA-.mjs";
+import { a as importJwk, i as generateCryptoKeyPair, n as fetchKey, o as validateCryptoKey, r as fetchKeyDetailed, t as exportJwk } from "../key-B3OBz6A_.mjs";
 import { c as rsaPublicKey3, i as rsaPrivateKey2, o as rsaPublicKey1, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-BAK-tUlf.mjs";
 import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { CryptographicKey, Multikey } from "@fedify/vocab";