@fedify/fedify 2.3.0-dev.994 → 2.3.0-pr.809.36

package/dist/{send-05pJLcb6.mjs → send-DIbBYN5P.mjs}

@@ -1,10 +1,12 @@
 import "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-XBVlKnOX.mjs";
-import { n as doubleKnock } from "./http-CSlLA54v.mjs";
-import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
+import { n as version, t as name } from "./deno-DCdM7d93.mjs";
+import { n as getDurationMs, r as getFederationMetrics } from "./metrics-BHeWd24f.mjs";
+import { n as doubleKnock } from "./http-BufbkLuW.mjs";
 import { getLogger } from "@logtape/logtape";
+import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
+import { FetchError } from "@fedify/vocab-runtime";
 //#region src/federation/send.ts
 /**
 * Extracts the inbox URLs from recipients.
@@ -64,6 +66,25 @@ function sendActivity(options) {
 	});
 }
 const MAX_ERROR_RESPONSE_BODY_BYTES = 1024;
+function getActivityActorId(activity) {
+	if (!isRecord(activity)) return void 0;
+	return getIdValue(activity.actor);
+}
+function getIdValue(value) {
+	if (typeof value === "string" && value !== "") return value;
+	if (value instanceof URL) return value.href;
+	if (Array.isArray(value)) {
+		for (const item of value) {
+			const id = getIdValue(item);
+			if (id != null) return id;
+		}
+		return;
+	}
+	if (isRecord(value)) return getIdValue(value.id);
+}
+function isRecord(value) {
+	return typeof value === "object" && value != null;
+}
 async function readLimitedResponseBody(response, maxBytes) {
 	if (response.body == null) return "";
 	const reader = response.body.getReader();
@@ -91,12 +112,15 @@ async function readLimitedResponseBody(response, maxBytes) {
 	if (truncated) result += "… (truncated)";
 	return result;
 }
-async function sendActivityInternal({ activity, activityId, keys, inbox, headers, specDeterminer, tracerProvider }, span) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, headers, specDeterminer, meterProvider, tracerProvider }, span) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
 		"outbox"
 	]);
+	const federationMetrics = getFederationMetrics(meterProvider);
+	const started = performance.now();
+	let deliverySuccess = false;
 	headers = new Headers(headers);
 	headers.set("Content-Type", "application/activity+json");
 	const request = new Request(inbox, {
@@ -123,34 +147,49 @@ async function sendActivityInternal({ activity, activityId, keys, inbox, headers
 			specDeterminer
 		});
 	} catch (error) {
+		const transportError = error instanceof FetchError ? error : createFetchError(inbox.href, error);
 		logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
 			activityId,
 			inbox: inbox.href,
-			error
+			error: transportError
 		});
-		throw error;
+		federationMetrics.recordDelivery(inbox, getDurationMs(started), false, activityType);
+		throw transportError;
 	}
-	if (!response.ok) {
-		let error;
-		try {
-			error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
-		} catch (_) {
-			error = "";
+	try {
+		if (!response.ok) {
+			let error;
+			try {
+				error = await readLimitedResponseBody(response, MAX_ERROR_RESPONSE_BODY_BYTES);
+			} catch (_) {
+				error = "";
+			}
+			logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
+				activityId,
+				inbox: inbox.href,
+				status: response.status,
+				statusText: response.statusText,
+				error
+			});
+			throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error, response.headers);
 		}
-		logger.error("Failed to send activity {activityId} to {inbox} ({status} {statusText}):\n{error}", {
-			activityId,
-			inbox: inbox.href,
-			status: response.status,
-			statusText: response.statusText,
-			error
-		});
-		throw new SendActivityError(inbox, response.status, `Failed to send activity ${activityId} to ${inbox.href} (${response.status} ${response.statusText}):\n${error}`, error);
+		deliverySuccess = true;
+		const eventAttributes = {
+			"activitypub.inbox.url": inbox.href,
+			"activitypub.activity.id": activityId ?? ""
+		};
+		if (activityType != null) eventAttributes["activitypub.activity.type"] = activityType;
+		const actorId = getActivityActorId(activity);
+		if (actorId != null) eventAttributes["activitypub.actor.id"] = actorId;
+		span.addEvent("activitypub.activity.sent", eventAttributes);
+	} finally {
+		federationMetrics.recordDelivery(inbox, getDurationMs(started), deliverySuccess, activityType);
 	}
-	span.addEvent("activitypub.activity.sent", {
-		"activitypub.activity.json": JSON.stringify(activity),
-		"activitypub.inbox.url": inbox.href,
-		"activitypub.activity.id": activityId ?? ""
-	});
+}
+function createFetchError(url, cause) {
+	const error = new FetchError(url, cause instanceof Error ? cause.message : String(cause));
+	error.cause = cause;
+	return error;
 }
 /**
 * An error that is thrown when an activity fails to send to a remote inbox.
@@ -175,18 +214,25 @@ var SendActivityError = class extends Error {
 	*/
 	responseBody;
 	/**
+	* The response headers from the inbox.
+	* @since 2.3.0
+	*/
+	responseHeaders;
+	/**
 	* Creates a new {@link SendActivityError}.
 	* @param inbox The inbox URL.
 	* @param statusCode The HTTP status code.
 	* @param message The error message.
 	* @param responseBody The response body.
+	* @param responseHeaders The response headers.
 	*/
-	constructor(inbox, statusCode, message, responseBody) {
+	constructor(inbox, statusCode, message, responseBody, responseHeaders) {
 		super(message);
 		this.name = "SendActivityError";
 		this.inbox = inbox;
 		this.statusCode = statusCode;
 		this.responseBody = responseBody;
+		this.responseHeaders = new Headers(responseHeaders);
 	}
 };
 //#endregion

package/dist/sig/http.test.mjs

@@ -1,16 +1,16 @@
 import { Temporal } from "@js-temporal/polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { t as esm_default } from "../esm-DVILvP5e.mjs";
-import { t as assertEquals } from "../assert_equals-Ew3jOFa3.mjs";
-import { i as assertExists, t as assertStringIncludes } from "../std__assert-CRDpx_HF.mjs";
-import { n as assertFalse, t as assertRejects } from "../assert_rejects-B-qJtC9Z.mjs";
-import { t as assertThrows } from "../assert_throws-4NwKEy2q.mjs";
-import { t as assert } from "../assert-DikXweDx.mjs";
-import { t as exportJwk } from "../key-Bzx--sHD.mjs";
-import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase, u as verifyRequestDetailed } from "../http-CSlLA54v.mjs";
+import { t as esm_default } from "../esm-vrlUxr60.mjs";
+import { t as assertEquals } from "../assert_equals-C-ZRDbaf.mjs";
+import { r as assertExists, t as assertStringIncludes } from "../std__assert-BBjXFNOb.mjs";
+import { n as assertGreaterOrEqual, r as assertFalse, t as assertRejects } from "../assert_rejects-DN60FHPX.mjs";
+import { t as assertThrows } from "../assert_throws-BOkhLGYc.mjs";
+import { t as assert } from "../assert-OguE97r2.mjs";
+import { t as exportJwk } from "../key-DZdKLJXT.mjs";
+import { a as parseRfc9421Signature, c as timingSafeEqual, i as formatRfc9421SignatureParameters, l as verifyRequest, n as doubleKnock, o as parseRfc9421SignatureInput, r as formatRfc9421Signature, s as signRequest, t as createRfc9421SignatureBase, u as verifyRequestDetailed } from "../http-BufbkLuW.mjs";
 import { i as rsaPrivateKey2, l as rsaPublicKey5, o as rsaPublicKey1, s as rsaPublicKey2 } from "../keys-DGu1NFwu.mjs";
-import { createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
+import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
 import { FetchError, exportSpki } from "@fedify/vocab-runtime";
 import { encodeBase64 } from "byte-encodings/base64";
 //#region src/sig/http.test.ts
@@ -230,6 +230,216 @@ test("verifyRequestDetailed() records failure details on span", async () => {
 	assertEquals(span.attributes["http_signatures.key_id"], keyId.href);
 	assertEquals(span.attributes["http_signatures.key_fetch_status"], 410);
 });
+test("verifyRequestDetailed() records verification duration metric", async (t) => {
+	const buildSignedRequest = () => signRequest(new Request("https://example.com/inbox", {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/activity+json",
+			accept: "application/ld+json"
+		},
+		body: JSON.stringify({
+			"@context": "https://www.w3.org/ns/activitystreams",
+			type: "Create",
+			actor: "https://example.com/key2"
+		})
+	}), rsaPrivateKey2, new URL("https://example.com/key2"));
+	await t.step("verified path emits one measurement", async () => {
+		const [meterProvider, recorder] = createTestMeterProvider();
+		assert((await verifyRequestDetailed(await buildSignedRequest(), {
+			contextLoader: mockDocumentLoader,
+			documentLoader: mockDocumentLoader,
+			meterProvider
+		})).verified);
+		const measurements = recorder.getMeasurements("activitypub.signature.verification.duration");
+		assertEquals(measurements.length, 1);
+		const measurement = measurements[0];
+		assertEquals(measurement.type, "histogram");
+		assertGreaterOrEqual(measurement.value, 0);
+		assertEquals(measurement.attributes["activitypub.signature.kind"], "http");
+		assertEquals(measurement.attributes["activitypub.signature.result"], "verified");
+		assertEquals(measurement.attributes["http_signatures.algorithm"], "rsa-sha256");
+		assertFalse("http_signatures.failure_reason" in measurement.attributes);
+		const keyLookups = recorder.getMeasurements("activitypub.key.lookup");
+		assertEquals(keyLookups.length, 1);
+		assertEquals(keyLookups[0].attributes["activitypub.lookup.kind"], "public_key");
+		assertEquals(keyLookups[0].attributes["activitypub.lookup.result"], "fetched");
+	});
+	await t.step("missing signature is recorded as result=missing", async () => {
+		const [meterProvider, recorder] = createTestMeterProvider();
+		const result = await verifyRequestDetailed(new Request("https://example.com/inbox", {
+			method: "POST",
+			headers: { "Content-Type": "application/activity+json" },
+			body: "{}"
+		}), {
+			contextLoader: mockDocumentLoader,
+			documentLoader: mockDocumentLoader,
+			meterProvider
+		});
+		assertFalse(result.verified);
+		assertEquals(result.reason.type, "noSignature");
+		const measurements = recorder.getMeasurements("activitypub.signature.verification.duration");
+		assertEquals(measurements.length, 1);
+		assertEquals(measurements[0].attributes["activitypub.signature.kind"], "http");
+		assertEquals(measurements[0].attributes["activitypub.signature.result"], "missing");
+		assertFalse("http_signatures.failure_reason" in measurements[0].attributes);
+	});
+	await t.step("invalid signature is recorded as result=rejected with failure_reason", async () => {
+		const [meterProvider, recorder] = createTestMeterProvider();
+		const result = await verifyRequestDetailed(new Request("https://example.com/", {
+			method: "POST",
+			headers: {
+				Date: "Tue, 05 Mar 2024 07:49:44 GMT",
+				Digest: "sha-256=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=",
+				Signature: "keyId=\"https://example.com/key2\",headers=\"(request-target) date digest\",signature=\"AAAA\""
+			},
+			body: ""
+		}), {
+			documentLoader: mockDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			meterProvider
+		});
+		assertFalse(result.verified);
+		assertEquals(result.reason.type, "invalidSignature");
+		const measurements = recorder.getMeasurements("activitypub.signature.verification.duration");
+		assertEquals(measurements.length, 1);
+		assertEquals(measurements[0].attributes["activitypub.signature.kind"], "http");
+		assertEquals(measurements[0].attributes["activitypub.signature.result"], "rejected");
+		assertEquals(measurements[0].attributes["http_signatures.failure_reason"], "invalidSignature");
+	});
+	await t.step("key fetch failure is recorded as result=rejected with failure_reason=keyFetchError", async () => {
+		const [meterProvider, recorder] = createTestMeterProvider();
+		const keyId = new URL("https://gone.example/actors/alice#main-key");
+		const result = await verifyRequestDetailed(await signRequest(new Request("https://example.com/inbox", {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/activity+json",
+				accept: "application/ld+json"
+			},
+			body: JSON.stringify({
+				"@context": "https://www.w3.org/ns/activitystreams",
+				type: "Create",
+				actor: "https://gone.example/actors/alice"
+			})
+		}), rsaPrivateKey2, keyId), {
+			contextLoader: mockDocumentLoader,
+			documentLoader(url) {
+				if (url === keyId.href) throw new FetchError(keyId, `HTTP 410: ${keyId.href}`, new Response(null, { status: 410 }));
+				return mockDocumentLoader(url);
+			},
+			meterProvider
+		});
+		assertFalse(result.verified);
+		assertEquals(result.reason.type, "keyFetchError");
+		const measurements = recorder.getMeasurements("activitypub.signature.verification.duration");
+		assertEquals(measurements.length, 1);
+		assertEquals(measurements[0].attributes["activitypub.signature.result"], "rejected");
+		assertEquals(measurements[0].attributes["http_signatures.failure_reason"], "keyFetchError");
+	});
+	await t.step("verifyRequest() wrapper emits exactly one measurement, not two", async () => {
+		const [meterProvider, recorder] = createTestMeterProvider();
+		assertExists(await verifyRequest(await buildSignedRequest(), {
+			contextLoader: mockDocumentLoader,
+			documentLoader: mockDocumentLoader,
+			meterProvider
+		}));
+		assertEquals(recorder.getMeasurements("activitypub.signature.verification.duration").length, 1);
+	});
+	await t.step("cached-key retry emits one measurement, not two", async () => {
+		const [meterProvider, recorder] = createTestMeterProvider();
+		const cache = { "https://example.com/key2": rsaPublicKey1 };
+		assertExists(await verifyRequest(await buildSignedRequest(), {
+			contextLoader: mockDocumentLoader,
+			documentLoader: mockDocumentLoader,
+			meterProvider,
+			keyCache: {
+				get(keyId) {
+					return Promise.resolve(cache[keyId.href]);
+				},
+				set(keyId, k) {
+					cache[keyId.href] = k;
+					return Promise.resolve();
+				}
+			}
+		}));
+		assertEquals(recorder.getMeasurements("activitypub.signature.verification.duration").length, 1);
+	});
+	await t.step("key fetch records result=fetched on a cold cache", async () => {
+		const [meterProvider, recorder] = createTestMeterProvider();
+		assertExists(await verifyRequest(await buildSignedRequest(), {
+			contextLoader: mockDocumentLoader,
+			documentLoader: mockDocumentLoader,
+			meterProvider
+		}));
+		const measurements = recorder.getMeasurements("activitypub.signature.key_fetch.duration");
+		assertEquals(measurements.length, 1);
+		assertEquals(measurements[0].type, "histogram");
+		assertGreaterOrEqual(measurements[0].value, 0);
+		assertEquals(measurements[0].attributes["activitypub.signature.kind"], "http");
+		assertEquals(measurements[0].attributes["activitypub.signature.key_fetch.result"], "fetched");
+	});
+	await t.step("key fetch records result=hit when served from the key cache", async () => {
+		const [meterProvider, recorder] = createTestMeterProvider();
+		const cache = { "https://example.com/key2": rsaPublicKey2 };
+		assertExists(await verifyRequest(await buildSignedRequest(), {
+			contextLoader: mockDocumentLoader,
+			documentLoader: mockDocumentLoader,
+			meterProvider,
+			keyCache: {
+				get(keyId) {
+					return Promise.resolve(cache[keyId.href]);
+				},
+				set(keyId, k) {
+					cache[keyId.href] = k;
+					return Promise.resolve();
+				}
+			}
+		}));
+		const measurements = recorder.getMeasurements("activitypub.signature.key_fetch.duration");
+		assertEquals(measurements.length, 1);
+		assertEquals(measurements[0].attributes["activitypub.signature.key_fetch.result"], "hit");
+	});
+	await t.step("key fetch records result=error when the remote key returns HTTP 410", async () => {
+		const [meterProvider, recorder] = createTestMeterProvider();
+		const keyId = new URL("https://gone.example/actors/alice#main-key");
+		assertFalse((await verifyRequestDetailed(await signRequest(new Request("https://example.com/inbox", {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/activity+json",
+				accept: "application/ld+json"
+			},
+			body: "{}"
+		}), rsaPrivateKey2, keyId), {
+			contextLoader: mockDocumentLoader,
+			documentLoader(url) {
+				if (url === keyId.href) throw new FetchError(keyId, `HTTP 410: ${keyId.href}`, new Response(null, { status: 410 }));
+				return mockDocumentLoader(url);
+			},
+			meterProvider
+		})).verified);
+		const measurements = recorder.getMeasurements("activitypub.signature.key_fetch.duration");
+		assertEquals(measurements.length, 1);
+		assertEquals(measurements[0].attributes["activitypub.signature.key_fetch.result"], "error");
+	});
+	await t.step("draft-cavage with unknown algorithm omits the algorithm metric attribute", async () => {
+		const [meterProvider, recorder] = createTestMeterProvider();
+		assertFalse((await verifyRequestDetailed(new Request("https://example.com/", {
+			method: "POST",
+			headers: {
+				Date: "Tue, 05 Mar 2024 07:49:44 GMT",
+				Digest: "sha-256=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=",
+				Signature: "keyId=\"https://example.com/key2\",algorithm=\"x-attacker-supplied\",headers=\"(request-target) date digest\",signature=\"AAAA\""
+			},
+			body: ""
+		}), {
+			documentLoader: mockDocumentLoader,
+			contextLoader: mockDocumentLoader,
+			meterProvider
+		})).verified);
+		const measurements = recorder.getMeasurements("activitypub.signature.verification.duration");
+		assertEquals(measurements.length, 1);
+		assertFalse("http_signatures.algorithm" in measurements[0].attributes);
+	});
+});
 test("signRequest() and verifyRequest() [rfc9421] implementation", async () => {
 	const currentTimestamp = 1709626184;
 	const currentTime = Temporal.Instant.from("2024-03-05T08:09:44Z");
@@ -335,15 +545,12 @@ test("createRfc9421SignatureBase()", () => {
 	].join("\n"));
 });
 test("formatRfc9421Signature()", () => {
-	const signature = new Uint8Array([
+	const [signatureInput, signatureHeader] = formatRfc9421Signature(new Uint8Array([
 		1,
 		2,
 		3,
 		4
-	]);
-	const keyId = new URL("https://example.com/key");
-	const algorithm = "rsa-v1_5-sha256";
-	const [signatureInput, signatureHeader] = formatRfc9421Signature(signature, [
+	]), [
 		{
 			"value": "@method",
 			params: {}
@@ -357,8 +564,8 @@ test("formatRfc9421Signature()", () => {
 			params: {}
 		}
 	], formatRfc9421SignatureParameters({
-		algorithm,
-		keyId,
+		algorithm: "rsa-v1_5-sha256",
+		keyId: new URL("https://example.com/key"),
 		created: 1709626184
 	}));
 	assertEquals(signatureInput, `sig1=("@method" "@target-uri" "host");alg="rsa-v1_5-sha256";keyid="https://example.com/key";created=1709626184`);
@@ -855,12 +1062,6 @@ test("doubleKnock() function with specDeterminer choosing draft-cavage first", a
 		else if (req.headers.has("Signature")) firstSpec = "draft-cavage";
 		return new Response("", { status: 202 });
 	});
-	const specDeterminer = {
-		determineSpec(_origin) {
-			return "draft-cavage-http-signatures-12";
-		},
-		rememberSpec(_origin, _spec) {}
-	};
 	assertEquals((await doubleKnock(new Request("https://example.com/inbox-accepts-any", {
 		method: "POST",
 		body: "Test message with draft-cavage preference",
@@ -868,7 +1069,12 @@ test("doubleKnock() function with specDeterminer choosing draft-cavage first", a
 	}), {
 		keyId: rsaPublicKey2.id,
 		privateKey: rsaPrivateKey2
-	}, { specDeterminer })).status, 202, "Response status should be 202 Accepted");
+	}, { specDeterminer: {
+		determineSpec(_origin) {
+			return "draft-cavage-http-signatures-12";
+		},
+		rememberSpec(_origin, _spec) {}
+	} })).status, 202, "Response status should be 202 Accepted");
 	assertEquals(requestCount, 1, "Only one request should have been made");
 	assertEquals(firstSpec, "draft-cavage", "First attempt should use draft-cavage");
 	esm_default.hardReset();
@@ -979,6 +1185,124 @@ test("doubleKnock() detects redirect loops", async () => {
 	assertEquals(requestCount, 2);
 	esm_default.hardReset();
 });
+test("doubleKnock() retries idempotent request transport errors", async () => {
+	esm_default.spyGlobal();
+	try {
+		let requestCount = 0;
+		esm_default.get("https://example.com/flaky-document", () => {
+			requestCount++;
+			if (requestCount === 1) throw new TypeError("temporary DNS failure");
+			return new Response("Success", { status: 200 });
+		});
+		const response = await doubleKnock(new Request("https://example.com/flaky-document"), {
+			keyId: rsaPublicKey2.id,
+			privateKey: rsaPrivateKey2
+		});
+		assertEquals(response.status, 200);
+		assertEquals(await response.text(), "Success");
+		assertEquals(requestCount, 2);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("doubleKnock() wraps repeated transport errors", async () => {
+	esm_default.spyGlobal();
+	try {
+		let requestCount = 0;
+		const failure = /* @__PURE__ */ new TypeError("DNS lookup failed");
+		esm_default.get("https://example.com/unreachable-document", () => {
+			requestCount++;
+			throw failure;
+		});
+		const request = new Request("https://example.com/unreachable-document");
+		const error = await assertRejects(() => doubleKnock(request, {
+			keyId: rsaPublicKey2.id,
+			privateKey: rsaPrivateKey2
+		}), FetchError, "DNS lookup failed");
+		assertEquals(error.url.href, "https://example.com/unreachable-document");
+		assertEquals(error.cause, failure);
+		assertEquals(requestCount, 2);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("doubleKnock() does not retry non-idempotent transport errors", async () => {
+	esm_default.spyGlobal();
+	try {
+		let requestCount = 0;
+		const failure = /* @__PURE__ */ new TypeError("connection reset");
+		esm_default.post("https://example.com/flaky-inbox", () => {
+			requestCount++;
+			throw failure;
+		});
+		const request = new Request("https://example.com/flaky-inbox", {
+			method: "POST",
+			body: "Test activity content",
+			headers: { "Content-Type": "application/activity+json" }
+		});
+		const error = await assertRejects(() => doubleKnock(request, {
+			keyId: rsaPublicKey2.id,
+			privateKey: rsaPrivateKey2
+		}), FetchError, "connection reset");
+		assertEquals(error.url.href, "https://example.com/flaky-inbox");
+		assertEquals(error.cause, failure);
+		assertEquals(requestCount, 1);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("doubleKnock() preserves Request signal abort reasons", async () => {
+	const controller = new AbortController();
+	const abortReason = "request aborted";
+	controller.abort(abortReason);
+	const request = new Request("https://example.com/request-abort", { signal: controller.signal });
+	assertEquals(await assertRejects(() => doubleKnock(request, {
+		keyId: rsaPublicKey2.id,
+		privateKey: rsaPrivateKey2
+	})), abortReason);
+});
+test("doubleKnock() preserves Request signal aborts during retry delay", async () => {
+	esm_default.spyGlobal();
+	try {
+		let requestCount = 0;
+		const controller = new AbortController();
+		const abortReason = "retry aborted";
+		esm_default.get("https://example.com/aborted-retry", () => {
+			requestCount++;
+			setTimeout(() => controller.abort(abortReason));
+			throw new TypeError("temporary DNS failure");
+		});
+		const request = new Request("https://example.com/aborted-retry", { signal: controller.signal });
+		assertEquals(await assertRejects(() => doubleKnock(request, {
+			keyId: rsaPublicKey2.id,
+			privateKey: rsaPrivateKey2
+		})), abortReason);
+		assertEquals(requestCount, 1);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("doubleKnock() prefers Request aborts over transport errors", async () => {
+	esm_default.spyGlobal();
+	try {
+		let requestCount = 0;
+		const controller = new AbortController();
+		const abortReason = "transport aborted";
+		esm_default.get("https://example.com/abort-with-transport-error", () => {
+			requestCount++;
+			controller.abort(abortReason);
+			throw new TypeError("temporary DNS failure");
+		});
+		const request = new Request("https://example.com/abort-with-transport-error", { signal: controller.signal });
+		assertEquals(await assertRejects(() => doubleKnock(request, {
+			keyId: rsaPublicKey2.id,
+			privateKey: rsaPrivateKey2
+		})), abortReason);
+		assertEquals(requestCount, 1);
+	} finally {
+		esm_default.hardReset();
+	}
+});
 test("doubleKnock() async specDeterminer test", async () => {
 	esm_default.spyGlobal();
 	let requestCount = 0;
@@ -990,15 +1314,6 @@ test("doubleKnock() async specDeterminer test", async () => {
 		else if (req.headers.has("Signature")) specUsed = "draft-cavage-http-signatures-12";
 		return new Response("", { status: 202 });
 	});
-	const specDeterminer = {
-		async determineSpec(_origin) {
-			await new Promise((resolve) => setTimeout(resolve, 10));
-			return "draft-cavage-http-signatures-12";
-		},
-		async rememberSpec(_origin, _spec) {
-			await new Promise((resolve) => setTimeout(resolve, 10));
-		}
-	};
 	assertEquals((await doubleKnock(new Request("https://example.com/inbox-async-determiner", {
 		method: "POST",
 		body: "Test message with async spec determiner",
@@ -1006,7 +1321,15 @@ test("doubleKnock() async specDeterminer test", async () => {
 	}), {
 		keyId: rsaPublicKey2.id,
 		privateKey: rsaPrivateKey2
-	}, { specDeterminer })).status, 202, "Response status should be 202 Accepted");
+	}, { specDeterminer: {
+		async determineSpec(_origin) {
+			await new Promise((resolve) => setTimeout(resolve, 10));
+			return "draft-cavage-http-signatures-12";
+		},
+		async rememberSpec(_origin, _spec) {
+			await new Promise((resolve) => setTimeout(resolve, 10));
+		}
+	} })).status, 202, "Response status should be 202 Accepted");
 	assertEquals(requestCount, 1, "Only one request should have been made");
 	assertEquals(specUsed, "draft-cavage-http-signatures-12", "Should use spec from async determiner");
 	esm_default.hardReset();