@fedify/fedify 2.5.0-dev.2597 → 2.5.0-dev.2614

package/dist/outbound-document-BMgwLXTY.mjs

@@ -0,0 +1,179 @@
+import "temporal-polyfill";
+import "urlpattern-polyfill";
+globalThis.addEventListener = () => {};
+import { preloadedContexts } from "@fedify/vocab-runtime";
+//#region src/federation/outbound-document.ts
+const asContext = "https://www.w3.org/ns/activitystreams";
+const asNamespace = `${asContext}#`;
+const blind = /* @__PURE__ */ new Set([
+	"bto",
+	"bcc",
+	"as:bto",
+	"as:bcc",
+	`${asNamespace}bto`,
+	`${asNamespace}bcc`
+]);
+const contextCandidates = [
+	asContext,
+	"https://w3id.org/security/v1",
+	"https://w3id.org/identity/v1",
+	"https://gotosocial.org/ns",
+	"https://w3id.org/security/data-integrity/v1",
+	"https://w3id.org/security/data-integrity/v2"
+];
+function safeContext(context) {
+	if (Array.isArray(context)) return context.every(safeContext);
+	if (context == null || typeof context !== "object") return false;
+	for (const [name, definition] of Object.entries(context)) {
+		if (name === "@import") return false;
+		const mapping = typeof definition === "string" ? definition : definition != null && typeof definition === "object" ? definition["@id"] : void 0;
+		if (name === "as" && mapping !== asNamespace) return false;
+		if (name !== "as" && typeof mapping === "string" && mapping.startsWith(asNamespace) && (mapping.endsWith("#") || mapping.endsWith("/") || typeof definition === "object" && definition["@prefix"] === true)) return false;
+		if (typeof mapping === "string" && blind.has(mapping) && name !== "bto" && name !== "bcc") return false;
+		if ((name === "bto" || name === "bcc") && mapping !== `as:${name}` && mapping !== `${asNamespace}${name}`) return false;
+		if (name === "@vocab" && typeof mapping === "string" && mapping.startsWith(asNamespace)) return false;
+		if (definition != null && typeof definition === "object" && "@context" in definition && !safeContext(definition["@context"])) return false;
+	}
+	return true;
+}
+const contexts = new Set(contextCandidates.filter((url) => {
+	const document = preloadedContexts[url];
+	return document != null && typeof document === "object" && safeContext(document["@context"]);
+}));
+const generatedTerms = {
+	toot: "http://joinmastodon.org/ns#",
+	misskey: "https://misskey-hub.net/ns#",
+	fedibird: "http://fedibird.com/ns#",
+	sensitive: "as:sensitive",
+	votersCount: {
+		"@id": "toot:votersCount",
+		"@type": "http://www.w3.org/2001/XMLSchema#nonNegativeInteger"
+	},
+	Emoji: "toot:Emoji",
+	Hashtag: "as:Hashtag",
+	ChatMessage: "http://litepub.social/ns#ChatMessage",
+	quote: {
+		"@id": "https://w3id.org/fep/044f#quote",
+		"@type": "@id"
+	},
+	quoteUrl: "as:quoteUrl",
+	_misskey_quote: "misskey:_misskey_quote",
+	quoteUri: "fedibird:quoteUri",
+	QuoteAuthorization: "https://w3id.org/fep/044f#QuoteAuthorization",
+	QuoteRequest: "https://w3id.org/fep/044f#QuoteRequest",
+	quoteAuthorization: {
+		"@id": "https://w3id.org/fep/044f#quoteAuthorization",
+		"@type": "@id"
+	},
+	emojiReactions: {
+		"@id": "fedibird:emojiReactions",
+		"@type": "@id"
+	}
+};
+function sameDefinition(value, expected) {
+	if (value === expected) return true;
+	if (value == null || expected == null || typeof value !== "object" || typeof expected !== "object" || Array.isArray(value)) return false;
+	const actual = value;
+	const reference = expected;
+	return Object.keys(actual).length === Object.keys(reference).length && Object.keys(actual).every((name) => Object.hasOwn(reference, name) && sameDefinition(actual[name], reference[name]));
+}
+function generatedContext(value) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) return false;
+	return Object.entries(value).every(([name, definition]) => Object.hasOwn(generatedTerms, name) && sameDefinition(definition, generatedTerms[name]));
+}
+const keywords = /* @__PURE__ */ new Set([
+	"@id",
+	"@type",
+	"@value",
+	"@language",
+	"@direction",
+	"@index",
+	"@list",
+	"@set",
+	"@graph",
+	"@reverse",
+	"@included",
+	"@nest"
+]);
+/** Validate the explicit opt-in before replacing observer registration. */
+function snapshotSenderPayloadOption(value) {
+	if (value === void 0) return false;
+	if (typeof value !== "boolean") throw new TypeError("Outbound senderPayload must be a boolean.");
+	return value;
+}
+/** Project existing plain JSON only; no getters, JSON-LD processing or serializers. */
+function projectSenderPayload(input) {
+	try {
+		let compact = false;
+		let redacted = false;
+		const seen = /* @__PURE__ */ new WeakSet();
+		const copy = (value, depth, contextData = false) => {
+			if (depth >= 64) throw new TypeError("Unsafe document depth.");
+			if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+			if (typeof value === "number" && Number.isFinite(value)) return value;
+			if (typeof value !== "object" || value == null || seen.has(value)) throw new TypeError("Not independent JSON data.");
+			const array = Array.isArray(value);
+			const prototype = Object.getPrototypeOf(value);
+			if (array ? prototype !== Array.prototype : prototype !== Object.prototype && prototype !== null) throw new TypeError("Unsupported document object.");
+			seen.add(value);
+			try {
+				const descriptors = Object.getOwnPropertyDescriptors(value);
+				if (Object.hasOwn(descriptors, "toJSON")) throw new TypeError("Custom JSON conversion is not projected.");
+				const names = Reflect.ownKeys(descriptors).filter((name) => descriptors[name].enumerable);
+				if (names.some((name) => typeof name !== "string" || !("value" in descriptors[name]))) throw new TypeError("Not plain JSON properties.");
+				let contextValue;
+				if (!contextData && !array && descriptors["@context"]?.enumerable) {
+					const context = copy(descriptors["@context"].value, depth + 1, true);
+					contextValue = context;
+					const urls = typeof context === "string" ? [context] : context;
+					if (!Array.isArray(urls) || urls.length === 0 || (depth === 0 ? !urls.includes(asContext) : !compact) || !urls.every((url) => typeof url === "string" ? contexts.has(url) : depth === 0 && generatedContext(url))) throw new TypeError("Unsupported document context.");
+					compact = true;
+				}
+				if (array) {
+					const length = descriptors.length.value;
+					if (names.length !== length || names.some((name, index) => name !== String(index))) throw new TypeError("Not a JSON array.");
+					return Object.freeze(names.map((name) => copy(descriptors[name].value, depth + 1, contextData)));
+				}
+				const result = Object.create(null);
+				for (const name of names) {
+					if (contextData) {
+						result[name] = copy(descriptors[name].value, depth + 1, true);
+						continue;
+					}
+					if (name === "@context") {
+						if (contextValue === void 0 || !compact) throw new TypeError("Scoped context not supported.");
+						result[name] = contextValue;
+						continue;
+					}
+					if (!compact && !keywords.has(name) && !/^[A-Za-z][A-Za-z0-9+.-]*:/.test(name)) throw new TypeError("Unresolved document property.");
+					const next = copy(descriptors[name].value, depth + 1);
+					if (blind.has(name)) {
+						redacted = true;
+						continue;
+					}
+					result[name] = next;
+				}
+				return Object.freeze(result);
+			} finally {
+				seen.delete(value);
+			}
+		};
+		if (input == null || typeof input !== "object") throw new TypeError("Not an outgoing document.");
+		const value = copy(input, 0);
+		return Object.freeze({
+			stage: "sender-payload",
+			type: "available",
+			representation: "privacy-projection",
+			redacted,
+			value
+		});
+	} catch {
+		return Object.freeze({
+			stage: "sender-payload",
+			type: "unavailable",
+			reason: "privacy-filter-unavailable"
+		});
+	}
+}
+//#endregion
+export { snapshotSenderPayloadOption as n, projectSenderPayload as t };

package/dist/{owner-C1-csjTo.mjs → owner-CKlRIkeF.mjs}

@@ -2,10 +2,10 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { d as isPortableUri, l as isPortableId, n as getCanonicalPortableId, p as isSamePublicKey$1, s as isCompatibleKeyId } from "./portable-key-id-Ca30-hOa.mjs";
-import { n as version, t as name } from "./deno-4cGKg59R.mjs";
+import { n as version, t as name } from "./deno-CRXki9-m.mjs";
 import { i as parseKeyOwnerEvidence, r as getVerifiedKeyOwnerEvidence } from "./key-owner-evidence-APB6NpSk.mjs";
-import { O as verifyKeyOwnership, S as fetchActorDocument, x as exportJwk } from "./ld-CmAQYDWE.mjs";
-import { n as resolvePortableActorKey, t as fetchPortableGatewayKey } from "./portable-key-jtaxB7TD.mjs";
+import { O as verifyKeyOwnership, S as fetchActorDocument, x as exportJwk } from "./ld-C5JOBBFj.mjs";
+import { n as resolvePortableActorKey, t as fetchPortableGatewayKey } from "./portable-key-Clg0IH8C.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";

package/dist/{portable-collection-C0MNEEED.mjs → portable-collection-B7RBHVGl.mjs}

@@ -1,8 +1,8 @@
 import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
-import { n as version, t as name } from "./deno-4cGKg59R.mjs";
-import { d as verifyPortableObjectProof, p as verifyPortableObjectProofWithRoot } from "./proof-CzWCRhnC.mjs";
+import { n as version, t as name } from "./deno-CRXki9-m.mjs";
+import { d as verifyPortableObjectProof, p as verifyPortableObjectProofWithRoot } from "./proof-tAb5_Dq4.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CollectionPage, Object as Object$1, isActor } from "@fedify/vocab";
 import { trace } from "@opentelemetry/api";

package/dist/{portable-collection-DkTLVfoM.js → portable-collection-CByyPjLc.js}

@@ -1,10 +1,10 @@
 import { Temporal } from "temporal-polyfill";
 import { URLPattern } from "urlpattern-polyfill";
-import { $ as getVerifiedKeyOwnerEvidence, C as verifyPortableObjectProofWithRoot, Dt as getCanonicalPortableId, Ft as isPortableUri, G as fetchActorDocument, Lt as isSamePublicKey$1, Mt as isCompatibleKeyId, Nt as isPortableId, Rt as name, W as exportJwk, Z as verifyKeyOwnership, et as parseKeyOwnerEvidence, l as fetchPortableGatewayKey, u as resolvePortableActorKey, x as verifyPortableObjectProof, zt as version } from "./http-DQP4rw46.js";
+import { $ as getVerifiedKeyOwnerEvidence, C as verifyPortableObjectProofWithRoot, Dt as getCanonicalPortableId, Ft as isPortableUri, G as fetchActorDocument, Lt as isSamePublicKey$1, Mt as isCompatibleKeyId, Nt as isPortableId, Rt as name, W as exportJwk, Z as verifyKeyOwnership, et as parseKeyOwnerEvidence, l as fetchPortableGatewayKey, u as resolvePortableActorKey, x as verifyPortableObjectProof, zt as version } from "./http-C2H4DT6t.js";
 import { getLogger } from "@logtape/logtape";
+import { canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, parseIri } from "@fedify/vocab-runtime";
 import { CollectionPage, CryptographicKey, Object as Object$1, isActor } from "@fedify/vocab";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
-import { canonicalizePortableUri, formatIri, fromCompatibleEf61Id, getDocumentLoader, getFe34Origin, parseIri } from "@fedify/vocab-runtime";
 import { dereferencePortableIri, getPortableGatewayCandidates } from "@fedify/vocab-runtime/internal/portable-dereference";
 //#region src/sig/owner.ts
 const logger$1 = getLogger([

package/dist/{portable-collection-w6Qn-vJ3.cjs → portable-collection-CmLjeKsP.cjs}

@@ -1,9 +1,9 @@
 const { URLPattern } = require("urlpattern-polyfill");
-const require_http = require("./http-KU7_TLD9.cjs");
+const require_http = require("./http-DHSIMipE.cjs");
 let _logtape_logtape = require("@logtape/logtape");
+let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let _fedify_vocab = require("@fedify/vocab");
 let _opentelemetry_api = require("@opentelemetry/api");
-let _fedify_vocab_runtime = require("@fedify/vocab-runtime");
 let _fedify_vocab_runtime_internal_portable_dereference = require("@fedify/vocab-runtime/internal/portable-dereference");
 //#region src/sig/owner.ts
 const logger$1 = (0, _logtape_logtape.getLogger)([

package/dist/{portable-key-jtaxB7TD.mjs → portable-key-Clg0IH8C.mjs}

@@ -2,7 +2,7 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { a as getRawCanonicalPortableId, c as isPortableActorDocument, d as isPortableUri, n as getCanonicalPortableId, p as isSamePublicKey } from "./portable-key-id-Ca30-hOa.mjs";
-import { p as verifyPortableObjectProofWithRoot } from "./proof-CzWCRhnC.mjs";
+import { p as verifyPortableObjectProofWithRoot } from "./proof-tAb5_Dq4.mjs";
 import { getLogger } from "@logtape/logtape";
 import { CryptographicKey, Multikey, Object as Object$1 } from "@fedify/vocab";
 import { FetchError, formatIri, getDocumentLoader, isGatewayUrl, parseIri, toCompatibleEf61Id } from "@fedify/vocab-runtime";

package/dist/{proof-CzWCRhnC.mjs → proof-tAb5_Dq4.mjs}

@@ -3,9 +3,9 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { i as getPortableDid, l as isPortableId } from "./portable-key-id-Ca30-hOa.mjs";
 import { a as verificationObservation, i as triedKey, n as observeCheck, t as observeAttempt } from "./verification-Dpfcw8ml.mjs";
-import { n as version, t as name } from "./deno-4cGKg59R.mjs";
-import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-BvV60TwE.mjs";
-import { C as fetchKey, D as validateCryptoKey, b as bypassKeyCacheReads, c as getNormalizationContextLoader } from "./ld-CmAQYDWE.mjs";
+import { n as version, t as name } from "./deno-CRXki9-m.mjs";
+import { n as getDurationMs, r as getFederationMetrics, s as measureSignatureKeyFetch } from "./metrics-CTteRnEr.mjs";
+import { C as fetchKey, D as validateCryptoKey, b as bypassKeyCacheReads, c as getNormalizationContextLoader } from "./ld-C5JOBBFj.mjs";
 import { n as preloadedOnlyDocumentLoader } from "./public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "./outgoing-jsonld-4IJqPYos.mjs";
 import { getLogger } from "@logtape/logtape";

package/dist/{send-C9-dwpEH.mjs → send-DzfFREML.mjs}

@@ -2,11 +2,13 @@ import "temporal-polyfill";
 import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { d as isPortableUri } from "./portable-key-id-Ca30-hOa.mjs";
-import { n as version, t as name } from "./deno-4cGKg59R.mjs";
-import { n as getDurationMs, r as getFederationMetrics } from "./metrics-BvV60TwE.mjs";
-import { r as doubleKnockScoped } from "./http-D5n4S1oL.mjs";
+import { n as version, t as name } from "./deno-CRXki9-m.mjs";
+import { n as getDurationMs, r as getFederationMetrics } from "./metrics-CTteRnEr.mjs";
+import { r as doubleKnockScoped } from "./http-DqOXkYbX.mjs";
+import { t as ResponseBodyPump } from "./outbound-body-CckPA5gc.mjs";
+import { r as takeCapturedDiagnostic } from "./outbound-capture-DVgnRzlf.mjs";
 import { getLogger, withContext } from "@logtape/logtape";
-import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
+import { SpanKind, SpanStatusCode, context, trace } from "@opentelemetry/api";
 import { FetchError, UrlError, canonicalizePortableUri, getFe34Origin, isGatewayUrl, toCompatibleEf61Id } from "@fedify/vocab-runtime";
 import { getPortableGatewayCandidates } from "@fedify/vocab-runtime/internal/portable-dereference";
 import { openDirectFetch, openPublicFetch } from "@fedify/vocab-runtime/internal";
@@ -193,11 +195,15 @@ function extractInboxes({ recipients, preferSharedInbox, excludeBaseUris }) {
 * @throws {Error} If the activity fails to send.
 */
 function sendActivity(options, deps = {}) {
+	options.attemptStarted?.(options.inbox.href);
+	const attempt = options.observation?.startAttempt(options.inbox.href);
+	const parentSpanContext = trace.getSpanContext(context.active());
 	const tracerProvider = options.tracerProvider ?? trace.getTracerProvider();
 	return tracerProvider.getTracer(name, version).startActiveSpan("activitypub.send_activity", {
 		kind: SpanKind.CLIENT,
 		attributes: { "activitypub.shared_inbox": options.sharedInbox ?? false }
 	}, async (span) => {
+		attempt?.setSpan(span, parentSpanContext);
 		if (options.activityId != null) span.setAttribute("activitypub.activity.id", options.activityId);
 		if (options.activityType != null) span.setAttribute("activitypub.activity.type", options.activityType);
 		const spanContext = span.spanContext();
@@ -208,12 +214,14 @@ function sendActivity(options, deps = {}) {
 			}, () => sendActivityInternal({
 				...options,
 				tracerProvider
-			}, span, deps));
+			}, span, deps, attempt));
+			await attempt?.succeeded();
 		} catch (e) {
 			span.setStatus({
 				code: SpanStatusCode.ERROR,
 				message: String(e)
 			});
+			await attempt?.failed(e);
 			throw e;
 		} finally {
 			span.end();
@@ -253,6 +261,7 @@ async function sendActivityThroughGateways(parameters, inboxes) {
 	throw lastError;
 }
 const MAX_ERROR_RESPONSE_BODY_BYTES = 1024;
+const ERROR_RESPONSE_BODY_TIMEOUT_MS = 1e3;
 function getActivityActorId(activity) {
 	if (!isRecord(activity)) return void 0;
 	return getIdValue(activity.actor);
@@ -273,16 +282,25 @@ function isRecord(value) {
 	return typeof value === "object" && value != null;
 }
 async function readLimitedResponseBody(response, maxBytes) {
+	const captured = takeCapturedDiagnostic(response);
+	if (captured !== void 0) return captured;
 	if (response.body == null) return "";
-	const reader = response.body.getReader();
+	const pump = new ResponseBodyPump(response.body, ERROR_RESPONSE_BODY_TIMEOUT_MS);
 	const decoder = new TextDecoder();
 	const chunks = [];
 	let totalBytes = 0;
 	let truncated = false;
+	let timedOut = false;
 	try {
 		while (true) {
-			const { done, value } = await reader.read();
+			const result = await pump.read();
+			if (result == null) {
+				timedOut = true;
+				break;
+			}
+			const { done, value } = result;
 			if (done) break;
+			if (value.length === 0) continue;
 			if (totalBytes + value.length > maxBytes) {
 				const remaining = maxBytes - totalBytes;
 				if (remaining > 0) chunks.push(decoder.decode(value.slice(0, remaining), { stream: true }));
@@ -293,14 +311,14 @@ async function readLimitedResponseBody(response, maxBytes) {
 			totalBytes += value.length;
 		}
 	} finally {
-		if (truncated) reader.cancel().catch(() => {});
-		reader.releaseLock();
+		pump.close();
 	}
 	let result = chunks.join("");
 	if (truncated) result += "… (truncated)";
+	else if (timedOut) result += "… (timed out)";
 	return result;
 }
-async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span, deps) {
+async function sendActivityInternal({ activity, activityId, activityType, keys, inbox, allowPrivateAddress, headers, specDeterminer, meterProvider, tracerProvider }, span, deps, attempt) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
@@ -316,6 +334,11 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 			session = await openUnvalidatedHop(url);
 		} catch (error) {
 			if (error instanceof UrlError && error.reason === "dns") {
+				attempt?.failure({
+					kind: "transport",
+					phase: "validation",
+					error
+				});
 				logger.error("DNS resolution failed for URL: {url}", {
 					url,
 					error
@@ -324,13 +347,47 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 				failure.cause = error;
 				throw failure;
 			}
-			if (error instanceof UrlError) logger.error("Disallowed private URL: {url}", {
-				url,
-				error
-			});
+			if (error instanceof UrlError) {
+				if (error.reason === "disallowed") attempt?.failure({
+					kind: "policy",
+					phase: "validation",
+					error
+				});
+				logger.error("Disallowed private URL: {url}", {
+					url,
+					error
+				});
+			}
 			throw error;
 		}
-		return session;
+		if (attempt == null) return session;
+		return {
+			url: session.url,
+			async fetch(input, init) {
+				try {
+					return await session.fetch(input, init);
+				} catch (error) {
+					attempt.failure({
+						kind: "transport",
+						phase: "request",
+						error
+					});
+					throw error;
+				}
+			},
+			async close() {
+				try {
+					await session.close();
+				} catch (error) {
+					attempt.failure({
+						kind: "local",
+						phase: "cleanup",
+						error
+					});
+					throw error;
+				}
+			}
+		};
 	}
 	let initialSession;
 	try {
@@ -348,14 +405,45 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 		return openHop(url);
 	};
 	try {
-		headers = new Headers(headers);
-		headers.set("Content-Type", "application/activity+json");
-		const request = new Request(inbox, {
-			method: "POST",
-			headers,
-			body: JSON.stringify(activity),
-			redirect: "manual"
-		});
+		let request;
+		let body;
+		try {
+			headers = new Headers(headers);
+			headers.set("Content-Type", "application/activity+json");
+		} catch (error) {
+			attempt?.failure({
+				kind: "local",
+				phase: "request-preparation",
+				error
+			});
+			throw error;
+		}
+		try {
+			attempt?.snapshotSenderPayload(activity);
+			body = JSON.stringify(activity);
+		} catch (error) {
+			attempt?.failure({
+				kind: "local",
+				phase: "serialization",
+				error
+			});
+			throw error;
+		}
+		try {
+			request = new Request(inbox, {
+				method: "POST",
+				headers,
+				body,
+				redirect: "manual"
+			});
+		} catch (error) {
+			attempt?.failure({
+				kind: "local",
+				phase: "request-preparation",
+				error
+			});
+			throw error;
+		}
 		let rsaKey = null;
 		for (const key of keys) if (key.privateKey.algorithm.name === "RSASSA-PKCS1-v1_5") {
 			rsaKey = key;
@@ -372,13 +460,25 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 				privateKey: pair.privateKey
 			}))
 		});
+		const consume = (response) => {
+			return consumeSendActivityResponse(response, inbox);
+		};
 		let outcome;
 		try {
-			outcome = rsaKey == null ? await fetchWithValidatedRedirects(request, openDeliveryHop, (response) => consumeSendActivityResponse(response, inbox)) : await doubleKnockScoped(request, rsaKey, {
+			outcome = rsaKey == null ? await fetchWithValidatedRedirects(request, openDeliveryHop, consume, attempt) : await doubleKnockScoped(request, rsaKey, {
 				tracerProvider,
 				specDeterminer
-			}, openDeliveryHop, (response) => consumeSendActivityResponse(response, inbox));
+			}, openDeliveryHop, consume, attempt == null ? void 0 : {
+				fetch: (request, submit) => attempt.fetch(request, submit),
+				response: (response, disposition) => attempt.response(response, disposition),
+				error: (phase, error) => attempt.failure({
+					kind: "local",
+					phase,
+					error
+				})
+			});
 		} catch (error) {
+			attempt?.unknown(error);
 			const failure = error instanceof FetchError || error instanceof UrlError ? error : createFetchError(inbox.href, error);
 			logger.error("Failed to send activity {activityId} to {inbox}:\n{error}", {
 				activityId,
@@ -398,7 +498,13 @@ async function sendActivityInternal({ activity, activityId, activityType, keys,
 					statusText,
 					error
 				});
-				throw new SendActivityError(inbox, status, `Failed to send activity ${activityId} to ${inbox.href} (${status} ${statusText}):\n${error}`, error, responseHeaders);
+				const failure = new SendActivityError(inbox, status, `Failed to send activity ${activityId} to ${inbox.href} (${status} ${statusText}):\n${error}`, error, responseHeaders);
+				attempt?.failure({
+					kind: "http",
+					phase: "response",
+					error: failure
+				});
+				throw failure;
 			}
 			deliverySuccess = true;
 			const eventAttributes = {
@@ -442,7 +548,7 @@ function cancelResponseBody(response, url) {
 /**
 * Reads what is needed from the final response of a delivery while its
 * session is open: the body of a successful response is cancelled, and at
-* most 1 KiB of an error response body is read.
+* most 1 KiB of an error response body is read within its diagnostic budget.
 */
 async function consumeSendActivityResponse(response, inbox) {
 	if (response.ok) {
@@ -472,9 +578,10 @@ async function consumeSendActivityResponse(response, inbox) {
 * @param request The request to send.
 * @param openHop The function to open a session for each hop.
 * @param consume The function to consume the final response.
+* @param attempt The in-process attempt observation, if registered.
 * @returns The value returned by `consume`.
 */
-async function fetchWithValidatedRedirects(request, openHop, consume) {
+async function fetchWithValidatedRedirects(request, openHop, consume, attempt) {
 	const logger = getLogger([
 		"fedify",
 		"federation",
@@ -485,7 +592,7 @@ async function fetchWithValidatedRedirects(request, openHop, consume) {
 		const session = await openHop(request.url);
 		let response;
 		try {
-			response = await session.fetch(request, { redirect: "manual" });
+			response = await (attempt == null ? session.fetch(request, { redirect: "manual" }) : attempt.fetch(request, () => session.fetch(request, { redirect: "manual" })));
 		} catch (error) {
 			await closeAfterError(session, logger);
 			throw error;
@@ -497,17 +604,21 @@ async function fetchWithValidatedRedirects(request, openHop, consume) {
 			303,
 			307,
 			308
-		].includes(response.status) || location == null) try {
-			return await consume(response);
-		} catch (error) {
-			logger.debug("Failed to consume the response from {url}; closing the session: {error}", {
-				url: request.url,
-				error
-			});
-			throw error;
-		} finally {
-			await session.close();
+		].includes(response.status) || location == null) {
+			attempt?.response(response, "final");
+			try {
+				return await consume(response);
+			} catch (error) {
+				logger.debug("Failed to consume the response from {url}; closing the session: {error}", {
+					url: request.url,
+					error
+				});
+				throw error;
+			} finally {
+				await session.close();
+			}
 		}
+		attempt?.response(response, "intermediate");
 		cancelResponseBody(response, request.url);
 		await session.close();
 		if (redirects >= 20) throw new TypeError("Too many redirects");
@@ -568,7 +679,9 @@ var SendActivityError = class extends Error {
 	* The response body from the inbox, if any.  Note that this may be
 	* truncated to a maximum of 1 KiB to prevent excessive memory consumption
 	* when remote servers return large error pages (e.g., Cloudflare error pages).
-	* If truncated, the string will end with `"… (truncated)"`.
+	* If truncated, the string will end with `"… (truncated)"`. Diagnostic reading
+	* has a separate one-second budget; a deadline retains any partial preview and
+	* appends `"… (timed out)"`. This is independent of application body capture.
 	*/
 	responseBody;
 	/**

package/dist/sig/compound-proof-discovery.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { a as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-BqqP38Sf.mjs";
+import { a as inspectCompoundPortableObjectApplicability, n as discoverCompoundProofDocuments } from "../compound-proof-BavXW-ow.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-discovery.test.ts

package/dist/sig/compound-proof-producer.test.mjs

@@ -3,7 +3,7 @@ import "urlpattern-polyfill";
 globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
-import { a as inspectCompoundPortableObjectApplicability, i as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-BqqP38Sf.mjs";
+import { a as inspectCompoundPortableObjectApplicability, i as findUnsupportedCompoundProofShape, t as containsCompoundPortableObject } from "../compound-proof-BavXW-ow.mjs";
 import { test } from "@fedify/fixture";
 //#region src/sig/compound-proof-producer.test.ts
 const portableId = "ap+ef61://did:key:z6MkAlice/objects/1";

package/dist/sig/compound-proof-verification.test.mjs

@@ -4,9 +4,9 @@ globalThis.addEventListener = () => {};
 import { t as assertEquals } from "../assert_equals-Z6IcEbWU.mjs";
 import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
-import { c as verifyMapLocalProof, f as verifyPortableObjectProofPolicy } from "../proof-CzWCRhnC.mjs";
+import { c as verifyMapLocalProof, f as verifyPortableObjectProofPolicy } from "../proof-tAb5_Dq4.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey, s as rsaPublicKey2 } from "../keys-DIJNHW-Y.mjs";
-import { a as inspectCompoundPortableObjectApplicability, o as verifyCompoundPortableObjectProofs, s as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-BqqP38Sf.mjs";
+import { a as inspectCompoundPortableObjectApplicability, o as verifyCompoundPortableObjectProofs, s as verifyCompoundProofDocuments, t as containsCompoundPortableObject } from "../compound-proof-BavXW-ow.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { CryptographicKey, Multikey, Person } from "@fedify/vocab";

package/dist/sig/compound-proof.test.mjs

@@ -6,9 +6,9 @@ import "../std__assert-DvMDRPes.mjs";
 import { t as assert } from "../assert-D1Eafmd_.mjs";
 import { n as preloadedOnlyDocumentLoader } from "../public-audience--klBIOk1.mjs";
 import { r as normalizeOutgoingActivityJsonLd } from "../outgoing-jsonld-4IJqPYos.mjs";
-import { h as verifyProof, s as signObject } from "../proof-CzWCRhnC.mjs";
+import { h as verifyProof, s as signObject } from "../proof-tAb5_Dq4.mjs";
 import { n as ed25519PrivateKey, r as ed25519PublicKey } from "../keys-DIJNHW-Y.mjs";
-import { s as verifyCompoundProofDocuments } from "../compound-proof-BqqP38Sf.mjs";
+import { s as verifyCompoundProofDocuments } from "../compound-proof-BavXW-ow.mjs";
 import { t as map_local_create_note_default } from "../map-local-create-note-B0SeXJms.mjs";
 import { t as map_local_context_conflict_default } from "../map-local-context-conflict-DOYEEJ3u.mjs";
 import { Create, DataIntegrityProof, Note, Question } from "@fedify/vocab";