@fedify/fedify 2.5.0-dev.2448 → 2.5.0-dev.2494

package/dist/federation/send.test.mjs

@@ -11,19 +11,22 @@ import { t as assertNotEquals } from "../assert_not_equals-CpPK2t89.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assertRejects } from "../assert_rejects-CTptdYck.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { f as verifyRequest } from "../http-BZkyQIkb.mjs";
+import { p as verifyRequest } from "../http-CxKd10Lq.mjs";
 import { i as rsaPrivateKey2, n as ed25519PrivateKey, s as rsaPublicKey2, t as ed25519Multikey } from "../keys-DIJNHW-Y.mjs";
-import { t as doesActorOwnKey } from "../owner-ccKkQOAf.mjs";
-import { n as extractInboxes, r as sendActivity, t as SendActivityError } from "../send-CF44O1Df.mjs";
-import { t as FedifySpanExporter } from "../exporter-DThFfe7P.mjs";
+import { t as doesActorOwnKey } from "../owner-CwijV0c5.mjs";
+import { i as sendActivity, n as extractInboxes, r as fetchWithValidatedRedirects, t as SendActivityError } from "../send-DN5HNBv-.mjs";
+import { t as FedifySpanExporter } from "../exporter-DVG68ozH.mjs";
 import { configure, getLogger, reset, withContext } from "@logtape/logtape";
 import { Activity, Application, Endpoints, Group, Person, Service } from "@fedify/vocab";
 import { FetchError, UrlError } from "@fedify/vocab-runtime";
 import { createTestMeterProvider, createTestTracerProvider, mockDocumentLoader, test } from "@fedify/fixture";
-import dns from "node:dns/promises";
+import { openDirectFetch, openPublicFetch } from "@fedify/vocab-runtime/internal";
 import { AggregationTemporality, InMemoryMetricExporter, MeterProvider, PeriodicExportingMetricReader } from "@opentelemetry/sdk-metrics";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/federation/send.test.ts
+function sendDirect(options) {
+	return sendActivity(options, { openHop: openDirectFetch });
+}
 test("extractInboxes()", () => {
 	const recipients = [
 		new Person({
@@ -159,7 +162,7 @@ test("sendActivity()", async (t) => {
 			"id": "https://example.com/activity",
 			"actor": "https://example.com/person"
 		};
-		await sendActivity({
+		await sendDirect({
 			activity,
 			keys: [{
 				privateKey: rsaPrivateKey2,
@@ -175,7 +178,7 @@ test("sendActivity()", async (t) => {
 		assertEquals(request?.headers.get("Content-Type"), "application/activity+json");
 		assertEquals(request?.headers.get("X-Test"), "test");
 		httpSigVerified = null;
-		await assertRejects(() => sendActivity({
+		await assertRejects(() => sendDirect({
 			activity: {
 				...activity,
 				actor: "https://example.com/person2"
@@ -204,7 +207,7 @@ test("sendActivity()", async (t) => {
 			"id": "https://example.com/activity",
 			"actor": "https://example.com/person"
 		};
-		await assertRejects(() => sendActivity({
+		await assertRejects(() => sendDirect({
 			activity,
 			activityId: "https://example.com/activity",
 			keys: [{
@@ -222,7 +225,7 @@ test("sendActivity()", async (t) => {
 			"actor": "https://example.com/person"
 		};
 		try {
-			await sendActivity({
+			await sendDirect({
 				activity,
 				activityId: "https://example.com/activity",
 				keys: [{
@@ -257,7 +260,7 @@ test("sendActivity()", async (t) => {
 			});
 			throw failure;
 		});
-		const error = await assertRejects(() => sendActivity({
+		const error = await assertRejects(() => sendDirect({
 			activity,
 			activityId: "https://example.com/activity",
 			keys: [{
@@ -282,7 +285,7 @@ test("sendActivity()", async (t) => {
 			"actor": "https://example.com/person"
 		};
 		try {
-			await sendActivity({
+			await sendDirect({
 				activity,
 				activityId: "https://example.com/activity",
 				keys: [{
@@ -311,7 +314,7 @@ test("sendActivity()", async (t) => {
 			"actor": "https://example.com/person"
 		};
 		try {
-			await sendActivity({
+			await sendDirect({
 				activity,
 				activityId: "https://example.com/activity",
 				keys: [{
@@ -341,7 +344,7 @@ test("sendActivity()", async (t) => {
 			"actor": "https://example.com/person"
 		};
 		try {
-			await sendActivity({
+			await sendDirect({
 				activity,
 				activityId: "https://example.com/activity",
 				keys: [{
@@ -368,7 +371,7 @@ test("sendActivity()", async (t) => {
 			"actor": "https://example.com/person"
 		};
 		try {
-			await sendActivity({
+			await sendDirect({
 				activity,
 				activityId: "https://example.com/activity",
 				keys: [{
@@ -397,7 +400,7 @@ test("sendActivity()", async (t) => {
 			"actor": "https://example.com/person"
 		};
 		try {
-			await sendActivity({
+			await sendDirect({
 				activity,
 				activityId: "https://example.com/activity",
 				keys: [{
@@ -421,7 +424,7 @@ test("sendActivity() records OpenTelemetry span events", async (t) => {
 	await t.step("successful send", async () => {
 		esm_default.get("https://example.com/", { status: 404 });
 		esm_default.post("https://example.com/inbox", { status: 202 });
-		await sendActivity({
+		await sendDirect({
 			activity: {
 				"@context": "https://www.w3.org/ns/activitystreams",
 				type: "Create",
@@ -504,7 +507,7 @@ test("sendActivity() aligns the LogTape context with its own span", async (t) =>
 			try {
 				esm_default.post("https://example.com/inbox-warn", { status: 202 });
 				await withContext({ requestId: "outer-request-warn" }, async () => {
-					await sendActivity({
+					await sendDirect({
 						...deliveryParams("https://example.com/activity/warn", "https://example.com/inbox-warn", tracerProvider),
 						keys: [{
 							keyId: ed25519Multikey.id,
@@ -542,7 +545,7 @@ test("sendActivity() aligns the LogTape context with its own span", async (t) =>
 					body: "Internal Server Error"
 				});
 				await withContext(outerContext, async () => {
-					await assertRejects(() => sendActivity(deliveryParams("https://example.com/activity/failing", "https://example.com/inbox-failing", tracerProvider)), SendActivityError);
+					await assertRejects(() => sendDirect(deliveryParams("https://example.com/activity/failing", "https://example.com/inbox-failing", tracerProvider)), SendActivityError);
 					getLogger([
 						"fedify",
 						"federation",
@@ -578,7 +581,7 @@ test("sendActivity() aligns the LogTape context with its own span", async (t) =>
 			try {
 				esm_default.post("https://example.com/inbox-ok", { status: 202 });
 				await withContext(outerContext, async () => {
-					await sendActivity(deliveryParams("https://example.com/activity/ok", "https://example.com/inbox-ok", tracerProvider));
+					await sendDirect(deliveryParams("https://example.com/activity/ok", "https://example.com/inbox-ok", tracerProvider));
 					getLogger([
 						"fedify",
 						"federation",
@@ -619,7 +622,7 @@ test("sendActivity() aligns the LogTape context with its own span", async (t) =>
 				};
 				esm_default.post("https://example.com/inbox-concurrent-a", handler());
 				esm_default.post("https://example.com/inbox-concurrent-b", handler());
-				const [resultA, resultB] = await Promise.allSettled([sendActivity(deliveryParams("https://example.com/activity/a", "https://example.com/inbox-concurrent-a", tracerProvider)).finally(release), sendActivity(deliveryParams("https://example.com/activity/b", "https://example.com/inbox-concurrent-b", tracerProvider)).finally(release)]);
+				const [resultA, resultB] = await Promise.allSettled([sendDirect(deliveryParams("https://example.com/activity/a", "https://example.com/inbox-concurrent-a", tracerProvider)).finally(release), sendDirect(deliveryParams("https://example.com/activity/b", "https://example.com/inbox-concurrent-b", tracerProvider)).finally(release)]);
 				assertEquals(resultA.status, "rejected");
 				assertEquals(resultB.status, "rejected");
 				const spans = exporter.getSpans("activitypub.send_activity");
@@ -647,6 +650,41 @@ test("sendActivity() aligns the LogTape context with its own span", async (t) =>
 		esm_default.hardReset();
 	}
 });
+test("sendActivity() validates the initial policy before serializing", async () => {
+	const [meterProvider, recorder] = createTestMeterProvider();
+	let serialized = false;
+	await assertRejects(() => sendActivity({
+		activity: { toJSON() {
+			serialized = true;
+			throw new Error("must not serialize");
+		} },
+		keys: [],
+		inbox: new URL("http://127.0.0.1/inbox"),
+		meterProvider
+	}), UrlError);
+	assertFalse(serialized);
+	assertEquals(recorder.getMeasurements("activitypub.delivery.sent"), []);
+});
+test("sendActivity() closes the initial session when serialization fails", async () => {
+	const [meterProvider, recorder] = createTestMeterProvider();
+	const url = "https://example.com/lifecycle/serialization-failure";
+	const hops = recordHops(() => ({
+		status: 202,
+		body: "Accepted"
+	}));
+	const failure = /* @__PURE__ */ new Error("serialization failed");
+	assertEquals(await assertRejects(() => sendActivity({
+		activity: { toJSON() {
+			throw failure;
+		} },
+		keys: [],
+		inbox: new URL(url),
+		meterProvider
+	}, { openHop: hops.openHop }), Error, "serialization failed"), failure);
+	assertEquals(hops.events, [`open ${url}`, `close ${url}`]);
+	assertEquals(recorder.getMeasurements("activitypub.delivery.sent"), []);
+	hops.assertInvariants();
+});
 test("sendActivity() records OpenTelemetry delivery metrics", async (t) => {
 	const [meterProvider, recorder] = createTestMeterProvider();
 	esm_default.spyGlobal();
@@ -887,85 +925,456 @@ for (const signed of [false, true]) {
 		});
 	});
 }
-for (const signed of [false, true]) test({
-	name: `sendActivity() classifies DNS failures (signed: ${signed})`,
-	ignore: "Deno" in globalThis && (await Deno.permissions.query({ name: "net" })).state !== "granted",
-	async fn(t) {
-		const activity = {
-			type: "Create",
-			id: "https://example.com/activity"
+for (const signed of [false, true]) test(`sendActivity() classifies DNS failures (signed: ${signed})`, async (t) => {
+	const activity = {
+		type: "Create",
+		id: "https://example.com/activity"
+	};
+	const destination = "https://delivery.invalid/inbox";
+	const publicInbox = "https://8.8.8.8/inbox";
+	const keys = signed ? [{
+		privateKey: rsaPrivateKey2,
+		keyId: rsaPublicKey2.id
+	}] : [];
+	for (const result of [
+		"throws",
+		"empty",
+		"cname",
+		"private"
+	]) for (const redirected of [false, true]) await t.step(`${result}, redirected: ${redirected}`, async () => {
+		const [meterProvider, recorder] = createTestMeterProvider();
+		const resolverError = /* @__PURE__ */ new Error("Resolver unavailable");
+		const lookups = [];
+		const lookup = (hostname) => {
+			lookups.push(hostname);
+			assertEquals(hostname, "delivery.invalid");
+			if (result === "throws") return Promise.reject(resolverError);
+			return Promise.resolve(result === "empty" ? [] : [{
+				address: result === "private" ? "127.0.0.1" : "alias.invalid.",
+				family: 4
+			}]);
 		};
-		const destination = "https://delivery.invalid/inbox";
-		const publicInbox = "https://8.8.8.8/inbox";
-		const keys = signed ? [{
-			privateKey: rsaPrivateKey2,
-			keyId: rsaPublicKey2.id
-		}] : [];
-		for (const result of [
-			"throws",
-			"empty",
-			"cname",
-			"private"
-		]) for (const redirected of [false, true]) await t.step(`${result}, redirected: ${redirected}`, async () => {
-			const [meterProvider, recorder] = createTestMeterProvider();
-			const originalLookup = dns.lookup;
-			const resolverError = /* @__PURE__ */ new Error("Resolver unavailable");
-			const lookups = [];
-			dns.lookup = ((hostname, options) => {
-				lookups.push(hostname);
-				assertEquals(hostname, "delivery.invalid");
-				assertEquals(options, { all: true });
-				if (result === "throws") return Promise.reject(resolverError);
-				return Promise.resolve(result === "empty" ? [] : [{
-					address: result === "private" ? "127.0.0.1" : "alias.invalid.",
-					family: 4
-				}]);
+		try {
+			esm_default.mockGlobal().catch(202);
+			if (redirected) esm_default.route(publicInbox, {
+				status: 307,
+				headers: { Location: destination }
 			});
-			try {
-				esm_default.mockGlobal().catch(202);
-				if (redirected) esm_default.route(publicInbox, {
-					status: 307,
-					headers: { Location: destination }
-				});
-				const send = () => sendActivity({
-					activity,
-					activityType: "https://www.w3.org/ns/activitystreams#Create",
-					meterProvider,
-					keys,
-					inbox: new URL(redirected ? publicInbox : destination)
+			const send = () => sendActivity({
+				activity,
+				activityType: "https://www.w3.org/ns/activitystreams#Create",
+				meterProvider,
+				keys,
+				inbox: new URL(redirected ? publicInbox : destination)
+			}, { openHop: (url) => openPublicFetch(url, { lookup }) });
+			if (result === "private") assertEquals((await assertRejects(send, UrlError)).reason, "disallowed");
+			else {
+				const error = await assertRejects(send, FetchError);
+				assertEquals(error.url.href, destination);
+				assertInstanceOf(error.cause, UrlError);
+				assertEquals(error.cause.reason, "dns");
+				assertEquals(error.cause.cause, result === "throws" ? resolverError : void 0);
+			}
+			const expectedCount = result === "private" && !redirected ? 0 : 1;
+			const sent = recorder.getMeasurements("activitypub.delivery.sent");
+			const durations = recorder.getMeasurements("activitypub.delivery.duration");
+			assertEquals(sent.length, expectedCount);
+			assertEquals(durations.length, expectedCount);
+			if (expectedCount === 1) {
+				assertEquals(sent[0].value, 1);
+				assertEquals(sent[0].attributes, {
+					"activitypub.remote.host": redirected ? "8.8.8.8" : "delivery.invalid",
+					"activitypub.activity.type": "https://www.w3.org/ns/activitystreams#Create",
+					"activitypub.delivery.success": false
 				});
-				if (result === "private") assertEquals((await assertRejects(send, UrlError)).reason, "disallowed");
-				else {
-					const error = await assertRejects(send, FetchError);
-					assertEquals(error.url.href, destination);
-					assertInstanceOf(error.cause, UrlError);
-					assertEquals(error.cause.reason, "dns");
-					assertEquals(error.cause.cause, result === "throws" ? resolverError : void 0);
-				}
-				const expectedCount = result === "private" && !redirected ? 0 : 1;
-				const sent = recorder.getMeasurements("activitypub.delivery.sent");
-				const durations = recorder.getMeasurements("activitypub.delivery.duration");
-				assertEquals(sent.length, expectedCount);
-				assertEquals(durations.length, expectedCount);
-				if (expectedCount === 1) {
-					assertEquals(sent[0].value, 1);
-					assertEquals(sent[0].attributes, {
-						"activitypub.remote.host": redirected ? "8.8.8.8" : "delivery.invalid",
-						"activitypub.activity.type": "https://www.w3.org/ns/activitystreams#Create",
-						"activitypub.delivery.success": false
-					});
-					assertEquals(durations[0].attributes, sent[0].attributes);
-					assertGreaterOrEqual(durations[0].value, 0);
-				}
-				assertEquals(lookups, ["delivery.invalid"]);
-				assertEquals(esm_default.callHistory.calls(destination).length, 0);
-				assertEquals(esm_default.callHistory.calls().length, redirected ? 1 : 0);
-			} finally {
-				dns.lookup = originalLookup;
-				esm_default.hardReset();
+				assertEquals(durations[0].attributes, sent[0].attributes);
+				assertGreaterOrEqual(durations[0].value, 0);
 			}
+			assertEquals(lookups, ["delivery.invalid"]);
+			assertEquals(esm_default.callHistory.calls(destination).length, 0);
+			assertEquals(esm_default.callHistory.calls().length, redirected ? 1 : 0);
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+});
+const lifecycleActivity = {
+	"@context": "https://www.w3.org/ns/activitystreams",
+	type: "Create",
+	id: "https://example.com/activity",
+	actor: "https://example.com/person"
+};
+const signedKeys = [{
+	privateKey: rsaPrivateKey2,
+	keyId: rsaPublicKey2.id
+}];
+const unsignedKeys = [{
+	privateKey: ed25519PrivateKey,
+	keyId: ed25519Multikey.id
+}];
+test("sendActivity() cancels a successful response body", async (t) => {
+	for (const signed of [true, false]) await t.step(`signed: ${signed}`, async () => {
+		const inbox = "https://example.com/lifecycle/inbox";
+		const hops = recordHops(() => ({
+			status: 202,
+			body: "Accepted"
+		}));
+		await sendActivity({
+			activity: lifecycleActivity,
+			keys: signed ? signedKeys : unsignedKeys,
+			inbox: new URL(inbox)
+		}, { openHop: hops.openHop });
+		assertEquals(hops.events, [
+			`open ${inbox}`,
+			`fetch #1 ${inbox}`,
+			"cancel #1",
+			`close ${inbox}`
+		]);
+		hops.assertInvariants();
+	});
+});
+test("sendActivity() reads at most 1 KiB of an error response body", async (t) => {
+	for (const signed of [true, false]) await t.step(`signed: ${signed}`, async () => {
+		const inbox = "https://example.com/lifecycle/error";
+		const hops = recordHops(() => ({
+			status: 500,
+			body: "x".repeat(4096)
+		}));
+		const error = await assertRejects(() => sendActivity({
+			activity: lifecycleActivity,
+			activityId: lifecycleActivity.id,
+			keys: signed ? signedKeys : unsignedKeys,
+			inbox: new URL(inbox)
+		}, { openHop: hops.openHop }), SendActivityError);
+		assertEquals(error.responseBody, "x".repeat(1024) + "… (truncated)");
+		assert(error.message.includes("… (truncated)"));
+		assertEquals(hops.events, [
+			`open ${inbox}`,
+			`fetch #1 ${inbox}`,
+			"cancel #1",
+			...signed ? [`fetch #2 ${inbox}`, "cancel #2"] : [],
+			`close ${inbox}`
+		]);
+		hops.assertInvariants();
+	});
+});
+test("sendActivity() closes each redirect hop before opening the next", async (t) => {
+	for (const [signed, status] of [[true, 307], [false, 308]]) await t.step(`signed: ${signed}, ${status}`, async () => {
+		const inbox = "https://example.com/lifecycle/redirect";
+		const next = "https://example.com/lifecycle/redirected";
+		const hops = recordHops((request) => request.url === inbox ? {
+			status,
+			headers: { Location: next },
+			body: "Moved"
+		} : {
+			status: 202,
+			body: "Accepted"
 		});
+		await sendActivity({
+			activity: lifecycleActivity,
+			keys: signed ? signedKeys : unsignedKeys,
+			inbox: new URL(inbox)
+		}, { openHop: hops.openHop });
+		assertEquals(hops.events, [
+			`open ${inbox}`,
+			`fetch #1 ${inbox}`,
+			"cancel #1",
+			`close ${inbox}`,
+			`open ${next}`,
+			`fetch #2 ${next}`,
+			"cancel #2",
+			`close ${next}`
+		]);
+		assertEquals(hops.requests[1].method, "POST");
+		assertEquals(await hops.requests[1].text(), JSON.stringify(lifecycleActivity));
+		hops.assertInvariants();
+	});
+});
+async function captureLogs(fn) {
+	const records = [];
+	await configure({
+		sinks: { buffer: (record) => records.push(record) },
+		loggers: [{
+			category: "fedify",
+			sinks: ["buffer"],
+			lowestLevel: "debug"
+		}, {
+			category: ["logtape", "meta"],
+			sinks: []
+		}],
+		reset: true
+	});
+	try {
+		await fn();
+		await new Promise((resolve) => setTimeout(resolve, 0));
+	} finally {
+		await reset();
 	}
+	return records;
+}
+function getCancelFailureUrls(records) {
+	return records.filter((r) => r.rawMessage === "Failed to cancel the response body from {url}: {error}").map((r) => r.properties.url);
+}
+test("fetchWithValidatedRedirects() logs a redirect body failing to cancel and follows the redirect", async (t) => {
+	const url = "https://example.com/lifecycle/cancel-failure";
+	const next = "https://example.com/lifecycle/cancel-failure-final";
+	const respond = (_, index) => index === 1 ? {
+		status: 302,
+		headers: { Location: next },
+		body: "Found",
+		failCancel: true
+	} : {
+		status: 202,
+		body: "Accepted"
+	};
+	await t.step("fetchWithValidatedRedirects()", async () => {
+		const hops = recordHops(respond);
+		let result;
+		const records = await captureLogs(async () => {
+			result = await fetchWithValidatedRedirects(new Request(url, {
+				method: "POST",
+				body: "activity"
+			}), hops.openHop, (response) => response.text());
+		});
+		assertEquals(result, "Accepted");
+		assertEquals(hops.events, [
+			`open ${url}`,
+			`fetch #1 ${url}`,
+			"cancel #1",
+			`close ${url}`,
+			`open ${next}`,
+			`fetch #2 ${next}`,
+			"consumed #2",
+			`close ${next}`
+		]);
+		assertEquals(getCancelFailureUrls(records), [url]);
+		hops.assertInvariants();
+	});
+	for (const signed of [true, false]) await t.step(`signed sendActivity(): ${signed}`, async () => {
+		const hops = recordHops(respond);
+		const records = await captureLogs(() => sendActivity({
+			activity: lifecycleActivity,
+			keys: signed ? signedKeys : unsignedKeys,
+			inbox: new URL(url)
+		}, { openHop: hops.openHop }));
+		assertEquals(hops.events, [
+			`open ${url}`,
+			`fetch #1 ${url}`,
+			"cancel #1",
+			`close ${url}`,
+			`open ${next}`,
+			`fetch #2 ${next}`,
+			"cancel #2",
+			`close ${next}`
+		]);
+		assertEquals(getCancelFailureUrls(records), [url]);
+		hops.assertInvariants();
+	});
+});
+test("fetchWithValidatedRedirects() closes the session when consuming fails", async () => {
+	const url = "https://example.com/lifecycle/consume-failure";
+	const hops = recordHops(() => ({
+		status: 200,
+		body: "x".repeat(1024)
+	}));
+	await assertRejects(() => fetchWithValidatedRedirects(new Request(url, {
+		method: "POST",
+		body: "activity"
+	}), hops.openHop, () => Promise.reject(/* @__PURE__ */ new Error("consume failed"))), Error, "consume failed");
+	assertEquals(hops.events, [
+		`open ${url}`,
+		`fetch #1 ${url}`,
+		"cancel #1 by close",
+		`close ${url}`
+	]);
+	hops.assertInvariants();
+});
+test("sendActivity() logs a successful response body failing to cancel", async (t) => {
+	for (const signed of [true, false]) await t.step(`signed: ${signed}`, async () => {
+		const inbox = "https://example.com/lifecycle/cancel-failure-inbox";
+		const hops = recordHops(() => ({
+			status: 202,
+			body: "Accepted",
+			failCancel: true
+		}));
+		const records = await captureLogs(() => sendActivity({
+			activity: lifecycleActivity,
+			keys: signed ? signedKeys : unsignedKeys,
+			inbox: new URL(inbox)
+		}, { openHop: hops.openHop }));
+		assertEquals(hops.events, [
+			`open ${inbox}`,
+			`fetch #1 ${inbox}`,
+			"cancel #1",
+			`close ${inbox}`
+		]);
+		assertEquals(getCancelFailureUrls(records), [inbox]);
+		hops.assertInvariants();
+	});
+});
+test("sendActivity() is not blocked by a body cancellation that never settles", async (t) => {
+	for (const signed of [true, false]) await t.step(`signed: ${signed}`, async () => {
+		const inbox = "https://example.com/lifecycle/hanging-cancel";
+		const next = "https://example.com/lifecycle/hanging-cancel-final";
+		const hops = recordHops((request) => request.url === inbox ? {
+			status: 302,
+			headers: { Location: next },
+			body: "Found",
+			hangCancel: true
+		} : {
+			status: 202,
+			body: "Accepted",
+			hangCancel: true
+		});
+		await sendActivity({
+			activity: lifecycleActivity,
+			keys: signed ? signedKeys : unsignedKeys,
+			inbox: new URL(inbox)
+		}, { openHop: hops.openHop });
+		assertEquals(hops.events, [
+			`open ${inbox}`,
+			`fetch #1 ${inbox}`,
+			"cancel #1",
+			`close ${inbox}`,
+			`open ${next}`,
+			`fetch #2 ${next}`,
+			"cancel #2",
+			`close ${next}`
+		]);
+		hops.assertInvariants();
+	});
+	await t.step("truncated error body", async () => {
+		const inbox = "https://example.com/lifecycle/hanging-error";
+		const hops = recordHops(() => ({
+			status: 500,
+			body: "x".repeat(4096),
+			hangCancel: true
+		}));
+		assertEquals((await assertRejects(() => sendActivity({
+			activity: lifecycleActivity,
+			keys: unsignedKeys,
+			inbox: new URL(inbox)
+		}, { openHop: hops.openHop }), SendActivityError)).responseBody, "x".repeat(1024) + "… (truncated)");
+		assertEquals(hops.events, [
+			`open ${inbox}`,
+			`fetch #1 ${inbox}`,
+			"cancel #1",
+			`close ${inbox}`
+		]);
+		hops.assertInvariants();
+	});
 });
+test("sendActivity() completes with responses cloned by fetch-mock", async (t) => {
+	for (const signed of [true, false]) await t.step(`signed: ${signed}`, async () => {
+		esm_default.spyGlobal();
+		try {
+			esm_default.post("https://example.com/tee/inbox", () => new Response("Moved", {
+				status: 307,
+				headers: { Location: "https://example.com/tee/final" }
+			}));
+			esm_default.post("https://example.com/tee/final", () => new Response("Accepted", { status: 202 }));
+			esm_default.post("https://example.com/tee/error", () => new Response("x".repeat(4096), { status: 404 }));
+			const keys = signed ? signedKeys : unsignedKeys;
+			await sendDirect({
+				activity: lifecycleActivity,
+				keys,
+				inbox: new URL("https://example.com/tee/inbox")
+			});
+			assertEquals(esm_default.callHistory.calls("https://example.com/tee/final").length, 1);
+			const error = await assertRejects(() => sendDirect({
+				activity: lifecycleActivity,
+				keys,
+				inbox: new URL("https://example.com/tee/error")
+			}), SendActivityError);
+			assertEquals(error.statusCode, 404);
+			assertEquals(error.responseBody, "x".repeat(1024) + "… (truncated)");
+		} finally {
+			esm_default.hardReset();
+		}
+	});
+});
+function createRecordedResponse(events, index, init, cancelSuffix = () => "") {
+	const bytes = new TextEncoder().encode(init.body ?? "");
+	const chunkSize = init.chunkSize ?? 256;
+	let offset = 0;
+	let settled = false;
+	const body = new ReadableStream({
+		pull(controller) {
+			if (offset >= bytes.length) {
+				settled = true;
+				events.push(`consumed #${index}`);
+				controller.close();
+				return;
+			}
+			controller.enqueue(bytes.slice(offset, offset + chunkSize));
+			offset += chunkSize;
+		},
+		cancel() {
+			settled = true;
+			events.push(`cancel #${index}${cancelSuffix()}`);
+			if (init.failCancel) throw new Error(`cancel #${index} failed`);
+			if (init.hangCancel) return new Promise(() => {});
+		}
+	}, { highWaterMark: 0 });
+	return {
+		response: new Response(body, {
+			status: init.status ?? 200,
+			headers: init.headers
+		}),
+		settled: () => settled
+	};
+}
+function recordHops(respond) {
+	const events = [];
+	const requests = [];
+	const unsettledAtClose = [];
+	let opens = 0;
+	let closes = 0;
+	let fetches = 0;
+	return {
+		events,
+		requests,
+		openHop(url) {
+			opens++;
+			events.push(`open ${url}`);
+			const tracked = [];
+			let closed = false;
+			let closing = false;
+			return Promise.resolve({
+				url: new URL(url),
+				async fetch(input, init) {
+					if (closed) throw new TypeError("The session is closed.");
+					const request = new Request(input instanceof Request ? input.clone() : input, init);
+					const index = ++fetches;
+					requests.push(request);
+					events.push(`fetch #${index} ${request.url}`);
+					const recorded = createRecordedResponse(events, index, await respond(request, index), () => closing ? " by close" : "");
+					tracked.push({
+						...recorded,
+						index
+					});
+					return recorded.response;
+				},
+				close() {
+					if (closed) return Promise.resolve();
+					closed = true;
+					closes++;
+					closing = true;
+					for (const { response, settled, index } of tracked) {
+						if (settled()) continue;
+						if (response.body?.locked) unsettledAtClose.push(index);
+						else response.body?.cancel().catch(() => {});
+					}
+					events.push(`close ${url}`);
+					return Promise.resolve();
+				}
+			});
+		},
+		assertInvariants() {
+			assertEquals(opens, closes);
+			assertEquals(unsettledAtClose, []);
+		}
+	};
+}
 //#endregion
 export {};