libp2r2p 0.11.17 → 0.11.18

package/README.md

@@ -1056,7 +1056,7 @@ in pairs per recipient when
 selected relays reject publication or become unreachable while connectivity is
 confirmed. The exact encrypted outer events are reused. Optional `fallbackRelays` on
 `createPrivateMessenger` and `createPrivateMessageSession` are tried after the
-primary destinations, including explicit per-call `relays`, channel `sendRelays`
+primary destinations by default, including explicit per-call `relays`, channel `sendRelays`
 and channel/global `relays`, as well as explicit `relayToReceivers` maps.
 Retries preserve each encrypted recipient subset; success requires accepted
 publication covering every recipient in that subset. Receive routing adds them from the start for live
@@ -1133,3 +1133,10 @@ and wake pending sends on release rather than repeatedly publishing while paused
 Custom session factories must expose `readStatus()` and deliver the initial and
 subsequent `onStateChanged` snapshots; missing observation is rejected instead of
 using polling compatibility. See [session lifecycle](private-messenger/session/README.md).
+
+Private messenger/session constructors accept optional `fallbackDelayMs` (`null`
+by default). Automatic NIP-65 sends can start configured fallback relays after
+the chosen delay while primary publications retain their deadlines. Explicit
+routes keep sequential fallback; every encrypted recipient must be covered.
+`RelayPool.sendEvent` accepts a consumer `signal` without closing shared sockets.
+See [fallback and cancellation](private-messenger/session/README.md#relay-fallback).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libp2r2p",
-  "version": "0.11.17",
+  "version": "0.11.18",
   "description": "Peer-to-relay-to-peer",
   "keywords": [
     "p2r2p",

package/private-messenger/helpers/fallback-race.js

@@ -0,0 +1,134 @@
+import { isReplaceableRelayFailure } from '../../relay/helpers/failure.js'
+
+// Each invocation owns one already signed outer event and its encrypted subset.
+// Lanes share coverage and the tried set; only started reports outlive the race.
+export function publishWithEarlyFallback ({ event, receivers, first, mirrors, tried, nextPrimary, nextFallback, sendEvent, isOnline, isCurrent, signal, pauseSignal, remember, delay, now, setTimer, clearTimer }) {
+  const pending = new Set(receivers)
+  const summaries = []
+  const transportSignal = signal && pauseSignal ? AbortSignal.any([signal, pauseSignal]) : signal || pauseSignal
+  const outcome = Promise.withResolvers()
+  let primaryRunning = true
+  let fallbackRunning = false
+  let fallbackScheduled = true
+  let done = false
+  let blocked = false
+  let offline = false
+  let timer = null
+  let onlineWork
+  const current = () => !transportSignal?.aborted && isCurrent()
+  const summary = success => Promise.all(summaries).then(reports => ({
+    success, total: tried.size,
+    fulfilled: reports.reduce((total, report) => total + (report.fulfilled || 0), 0),
+    succeededRelays: [...new Set(reports.flatMap(report => report.succeededRelays || []))],
+    errors: reports.flatMap(report => report.errors || [])
+  }))
+  const finish = success => {
+    if (done) return
+    done = true
+    clearTimer(timer); timer = null
+    transportSignal?.removeEventListener('abort', interrupted)
+    const interruptedWork = !success && (offline || !current())
+    outcome.resolve({
+      success, total: tried.size, promise: summary(success),
+      ...(interruptedWork && !signal?.aborted ? { retryWhenAvailable: true, ...(offline ? { retryWhenOnline: true } : {}) } : {})
+    })
+  }
+  const check = () => {
+    if (done) return
+    if (!pending.size) finish(true)
+    else if (!primaryRunning && !fallbackRunning && !fallbackScheduled) finish(false)
+  }
+  const interrupted = () => finish(false)
+  const online = async () => {
+    if (done || !current()) return false
+    try {
+      if (!onlineWork) {
+        const work = Promise.resolve().then(() => isOnline({ signal: transportSignal })).finally(() => { if (onlineWork === work) onlineWork = null })
+        onlineWork = work
+      }
+      const connected = await onlineWork
+      if (done || !current()) return false
+      if (!connected) offline = true
+      return connected
+    } catch { if (!done && current()) offline = true; return false }
+  }
+  const launch = async (batch, extra = []) => {
+    const relays = [...new Set([...batch.relays, ...extra])].filter(relay => !tried.has(relay))
+    if (!relays.length) return
+    for (const relay of relays) tried.add(relay)
+    const slot = Promise.withResolvers()
+    summaries.push(slot.promise)
+    let result
+    try { result = await sendEvent(event, relays, { signal: transportSignal }) } catch (reason) {
+      result = { success: false, promise: Promise.resolve({ fulfilled: 0, errors: [{ reason }] }) }
+    }
+    const settled = Promise.resolve(result.promise).catch(reason => ({ fulfilled: 0, errors: [{ reason }] }))
+    slot.resolve(settled)
+    settled.then(async report => {
+      const failed = (report.errors || []).filter(item => isReplaceableRelayFailure(item.reason))
+      // Late redundant failures can inform later sends after this race wins.
+      if (failed.length && (result.success || (done && !pending.size)) && !transportSignal?.aborted && isCurrent()) {
+        try { if (await isOnline({ signal: transportSignal }) && isCurrent()) remember(failed) } catch {}
+      }
+    }).catch(() => {})
+    if (result.success) {
+      if (!done) for (const receiver of batch.receivers) pending.delete(receiver)
+      check()
+      return
+    }
+    const report = await settled
+    if (done) return
+    const errors = report.errors || []
+    if (!errors.length || errors.some(item => !isReplaceableRelayFailure(item.reason))) blocked = true
+    else if (await online()) remember(errors)
+  }
+  async function fallback () {
+    if (done || fallbackRunning || !fallbackScheduled) return
+    clearTimer(timer)
+    fallbackScheduled = false
+    fallbackRunning = true
+    try {
+      if (blocked || offline || !pending.size || !current()) return
+      let batch = nextFallback(pending)
+      if (!batch || !await online()) return
+      while (batch) {
+        if (done || blocked || offline || !current()) break
+        await launch(batch)
+        batch = nextFallback(pending)
+      }
+    } finally { fallbackRunning = false; check() }
+  }
+  async function primary () {
+    try {
+      let batch = first || nextPrimary(pending)
+      let opening = true
+      while (batch) {
+        if (done || blocked || offline || !current()) break
+        await launch(batch, opening ? mirrors : [])
+        opening = false
+        batch = nextPrimary(pending)
+      }
+    } finally {
+      primaryRunning = false
+      // Exhaustion before the deadline starts the fallback immediately.
+      if (!done && fallbackScheduled) {
+        if (!blocked && !offline && current()) await fallback()
+        else { clearTimer(timer); fallbackScheduled = false }
+      }
+      check()
+    }
+  }
+  if (transportSignal?.aborted || !isCurrent()) { finish(false); return outcome.promise }
+  transportSignal?.addEventListener('abort', interrupted, { once: true })
+  const deadline = now() + delay
+  const failed = reason => {
+    if (done) return
+    done = true; clearTimer(timer); timer = null
+    transportSignal?.removeEventListener('abort', interrupted)
+    outcome.reject(reason)
+  }
+  timer = setTimer(() => { fallback().catch(failed) }, Math.max(0, deadline - now()))
+  timer?.unref?.()
+  primary().catch(failed)
+  return outcome.promise
+}

package/private-messenger/helpers/send-routing.js

@@ -1,5 +1,6 @@
 import { normalizeRelayUrl } from '../../url/index.js'
 import { ValidationError } from '../../error/index.js'
+import { publishWithEarlyFallback } from './fallback-race.js'
 import { isReplaceableRelayFailure } from '../../relay/helpers/failure.js'
 
 const EXCLUSION_MS = 5 * 60 * 1000
@@ -12,6 +13,11 @@ export function normalizeFallbackRelays (value = []) {
   return [...new Set(Array.from(value, normalizeRelayUrl))]
 }
 
+export function normalizeFallbackDelay (value = null) {
+  if (value !== null && (!Number.isSafeInteger(value) || value < 0 || value > 2147483647)) throw new ValidationError('INVALID_FALLBACK_DELAY')
+  return value
+}
+
 function routeEntries (routes) {
   return routes instanceof Map ? [...routes] : Object.entries(routes || {})
 }
@@ -26,9 +32,11 @@ function routeGroups (routes) {
   return [...groups.values()]
 }
 
-export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey, primaryRelays, primaryRelayToReceivers, fallbackRelays = [], exclusions, pickRelays, recoveryRelays, publish, publishNymEvent, sendEvent, isOnline, isCurrent, signal, now = Date.now }) {
+export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey, primaryRelays, primaryRelayToReceivers, fallbackRelays = [], fallbackDelayMs = null, exclusions, pickRelays, recoveryRelays, publish, publishNymEvent, sendEvent, isOnline, isCurrent, signal, pauseSignal, now = Date.now, setTimer = setTimeout, clearTimer = clearTimeout }) {
   // Keep discovery's defaults when NIP-65 is unavailable. Explicit maps/lists
   // retain their fanout; configured fallbacks are a separate last-resort stage.
+  fallbackDelayMs = normalizeFallbackDelay(fallbackDelayMs)
+  const transportSignal = signal && pauseSignal ? AbortSignal.any([signal, pauseSignal]) : signal || pauseSignal
   const explicit = Boolean(primaryRelays || primaryRelayToReceivers)
   const primaryRoutes = primaryRelayToReceivers || (primaryRelays
     ? new Map(primaryRelays.map(relay => [relay, peers]))
@@ -61,12 +69,12 @@ export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey,
     return routes
   }
   const relayToReceivers = primaryRelayToReceivers || select(peers, exclusions.keys())
-  const current = () => !signal?.aborted && isCurrent()
+  const current = () => !transportSignal?.aborted && isCurrent()
   const rejected = report => (report?.errors || []).filter(item => candidateSet.has(normalized(item.relay)) && isReplaceableRelayFailure(item.reason))
-  const remember = errors => { for (const item of errors) exclusions.set(normalized(item.relay), now() + EXCLUSION_MS) }
+  const remember = errors => { for (const item of errors) if (candidateSet.has(normalized(item.relay))) exclusions.set(normalized(item.relay), now() + EXCLUSION_MS) }
   const online = async () => {
     if (!current()) return false
-    try { return await isOnline({ signal }) && current() } catch { return false }
+    try { return await isOnline({ signal: transportSignal }) && current() } catch { return false }
   }
 
   async function send (event, initialRelays, context = {}) {
@@ -77,6 +85,24 @@ export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey,
     const mirrors = initialRelays.filter(relay => !candidateSet.has(normalized(relay)))
     const initialPrimary = context.primaryRelays || (primaryRelays || peers.length === 1 ? routeEntries(relayToReceivers).map(([relay]) => relay) : [])
     const first = [...new Set(initialPrimary.map(normalizeRelayUrl))].filter(relay => !exclusions.has(relay))
+    if (!explicit && fallbackDelayMs !== null && fallbackRelays.length) {
+      const tried = new Set()
+      const pick = (pending, fallback) => {
+        const excluded = [...new Set([...exclusions.keys(), ...tried])]
+        const routes = pickRelays([...pending], fallback
+          ? Object.fromEntries([...pending].map(pubkey => [pubkey, { read: fallbackRelays }]))
+          : primaryByPeer, { relayType: 'read', maxPerPubkey: 2, excludeRelaysByPubkey: new Map([...pending].map(pubkey => [pubkey, excluded])), emptyRelaysFallback: [] })
+        return routeGroups(routes)[0]
+      }
+      const result = await publishWithEarlyFallback({
+        event, receivers, first: first.length ? { receivers, relays: first } : null, mirrors, tried,
+        nextPrimary: pending => pick(pending, false), nextFallback: pending => pick(pending, true),
+        sendEvent, isOnline, isCurrent, signal, pauseSignal, remember,
+        delay: fallbackDelayMs, now, setTimer, clearTimer
+      })
+      if (!result.success && current()) exclusions.clear()
+      return result
+    }
     let batch = first.length ? { receivers, relays: first } : null
     const tried = new Set()
     const errors = []
@@ -106,7 +132,7 @@ export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey,
       for (const relay of relays) tried.add(normalized(relay))
       // Every relay in this batch serves the same pending recipient subset.
       // One ACK covers that subset, never unrelated members of the ciphertext.
-      result = await sendEvent(event, relays)
+      result = await sendEvent(event, relays, { signal: transportSignal })
       const settled = Promise.resolve(result.promise)
       summaries.push(settled)
       if (result.success) {

package/private-messenger/index.js

@@ -48,7 +48,7 @@ import * as privateMessage from '../private-message/index.js'
 import { isOnline, onOnline } from '../network/index.js'
 import { isRetryableRelayFailure, isReplaceableRelayFailure } from '../relay/index.js'
 import { createPauseRecovery, isRecoverableStorageFailure } from './helpers/pause-recovery.js'
-import { createSendRelayRouting, normalizeFallbackRelays } from './helpers/send-routing.js'
+import { createSendRelayRouting, normalizeFallbackRelays, normalizeFallbackDelay } from './helpers/send-routing.js'
 import { incompleteFetchError } from '../private-channel/helpers/fetch-error.js'
 import { recoveryRetryDelay, isPermanentRecoveryError } from './helpers/recovery-retry.js'
 import { normalizeRelayUrl } from '../url/index.js'
@@ -212,6 +212,7 @@ export class PrivateMessenger {
 
   constructor ({
     fallbackRelays = [],
+    fallbackDelayMs = null,
     offlineRecoverySeconds = DEFAULT_OFFLINE_RECOVERY_SECONDS,
     staleChannelSeconds = DEFAULT_STALE_CHANNEL_SECONDS,
     identityStorageRetentionSeconds = DEFAULT_IDENTITY_STORAGE_RETENTION_SECONDS,
@@ -254,6 +255,7 @@ export class PrivateMessenger {
   } = {}) {
     if (onStateChanged != null && typeof onStateChanged !== 'function') throw new ValidationError('INVALID_ON_STATE_CHANGED')
     this.fallbackRelays = normalizeFallbackRelays(fallbackRelays)
+    this.fallbackDelayMs = normalizeFallbackDelay(fallbackDelayMs)
     this.offlineRecoverySeconds = normalizeOfflineRecoverySeconds(offlineRecoverySeconds)
     this.staleChannelSeconds = normalizeStaleChannelSeconds(staleChannelSeconds)
     this.identityStorageRetentionSeconds = normalizeIdentityStorageRetentionSeconds(identityStorageRetentionSeconds)
@@ -304,6 +306,7 @@ export class PrivateMessenger {
     this._isOnline = _isOnline
     this.sendRelayExclusions = new Map()
     this.sendRoutingLifetime = new AbortController()
+    this.sendRoutingPause = new AbortController()
     this._setTimeout = _setTimeout
     this._clearTimeout = _clearTimeout
     this._setInterval = _setInterval
@@ -841,6 +844,8 @@ export class PrivateMessenger {
       peers: fixed && !recipients.length ? [this.userPubkey] : recipients, relaysByPubkey, recoveryRelays, primaryRelays: fixed?.map(normalizeRelayUrl), primaryRelayToReceivers: relayToReceivers, fallbackRelays: this.fallbackRelays,
       signal: signal ? AbortSignal.any([this.sendRoutingLifetime.signal, signal]) : this.sendRoutingLifetime.signal,
       exclusions: this.sendRelayExclusions.get(key).exclusions,
+      fallbackDelayMs: this.fallbackDelayMs, pauseSignal: this.sendRoutingPause.signal,
+      setTimer: this._setTimeout, clearTimer: this._clearTimeout,
       pickRelays: this._pickRelaysForPubkeys,
       publish: this._privateChannel.publish || privateChannel.publish,
       publishNymEvent: this._privateChannel.publishNymEvent || privateChannel.publishNymEvent,
@@ -1780,6 +1785,7 @@ export class PrivateMessenger {
     if (typeof reason !== 'string' || !reason.trim()) throw new ValidationError('PAUSE_REASON_REQUIRED')
     this.assertOpen()
     this.pauseReasons.add(reason)
+    this.sendRoutingPause.abort(this.pausedError())
     this.notifyStatus()
     for (const extension of this.extensions) extension.pause?.()
     this.recordInterruption(this.desiredChannels)
@@ -1797,6 +1803,7 @@ export class PrivateMessenger {
     const wasAutomatic = this.automaticPauses.has(reason)
     const removed = this.pauseReasons.delete(reason)
     this.automaticPauses.delete(reason)
+    if (!this.pauseReasons.size && this.sendRoutingPause.signal.aborted) this.sendRoutingPause = new AbortController()
     this.notifyStatus()
     if (reason === 'capacity' && removed) {
       clearInterval(this.capacityTimer)

package/private-messenger/session/README.md

@@ -110,7 +110,7 @@ const session = createPrivateMessageSession({
 })
 ```
 
-Automatic sends try each recipient's NIP-65 read relays first, at most two per
+By default, automatic sends try each recipient's NIP-65 read relays first, at most two per
 recipient per attempt, then the configured fallbacks in pairs. Explicit
 per-call `relays`, channel `sendRelays`/`relays` and global `relays` remain primary
 and also support configured fallbacks, including fixed multi-recipient sends.
@@ -122,6 +122,19 @@ and encrypted recipient subsets, without consulting recipient NIP-65 lists.
 The session coordinator remains a DM API; multi-recipient channels use
 `createPrivateMessenger` directly.
 
+Optional `fallbackDelayMs` defaults to `null` (sequential primary exhaustion).
+A nonnegative integer up to 2147483647 opts automatic NIP-65 routing into early
+fallback; explicit relay lists/maps retain the sequential policy. With `3000`,
+start at most two eligible fallback relays after three seconds without complete
+acceptance, or immediately after primary exhaustion. The deadline belongs to
+one signed outer event; later batches do not renew it. Primary operations retain
+their deadlines and can still win. Failed fallback operations leave primary
+alternatives available; no relay is tried twice. Multiple recipients require
+accepted coverage of every encrypted recipient subset. No wrapper, ID, recipient
+tag or deletion capability is recreated. Confirmed connectivity, exclusions and
+connection cooldowns remain authoritative; a waiting primary is not penalized
+merely because fallback started. Late native failures may inform later sends.
+
 On `blocked`, `restricted`, `auth-required`, `pow`, `rate-limited`, or `error`
 rejections, or connection/transport/timeout failures, replacement requires
 `isOnline` to confirm connectivity. Invalid messages, local signer/authentication
@@ -141,7 +154,8 @@ publication report. A shared relay's first ACK covers all members assigned to
 that publication batch. If replacements use different relays for different
 members, every pending member must be covered before the outer event succeeds;
 a partial ACK cannot hide another member's failure. Remaining primary routes are
-exhausted before configured fallbacks. Redundant acknowledgements may update
+exhausted before configured fallbacks with the default null delay or explicit
+routes. Redundant acknowledgements may update
 future routing preferences without delaying a successfully covered send. Preferences are channel/recipient-scoped, in-memory,
 expire after five minutes, and never alter receive subscriptions. A fresh attempt
 can recheck an exhausted list. Additional fallback relays come only from the
@@ -159,3 +173,12 @@ relays. Validation/authorization failures are terminal without relay rotation.
 `broadcastRumor`/`broadcastEvent` accept a `signal` to stop further replacement
 publications; the session supplies it and aborts it on cancel/close. An already
 published event cannot be recalled by cancellation.
+
+`RelayPool.sendEvent(event, relays, { signal })` supports optional cancellation.
+It returns the existing result/report envelopes with the original abort reason
+for unfinished relays, preserving partial acceptance and avoiding synthetic
+timeouts. Cancellation releases publication waiters and deferred sends without
+closing shared sockets or cancelling another subscriber for the same event ID.
+Operations already transmitted cannot be recalled from relays. A messenger pause
+cancels its outstanding publication work and leaves the outbox pending; resume
+creates a fresh publication lifetime, without treating the pause as a user abort.

package/private-messenger/session/index.js

@@ -10,7 +10,7 @@ import { decodeFileMetadata } from '../../nip94/index.js'
 import { createChatOutbox } from './helpers/work-storage.js'
 import { messengerSigner } from './helpers/signer.js'
 import { assertMessagePublished } from '../helpers/publication.js'
-import { normalizeFallbackRelays } from '../helpers/send-routing.js'
+import { normalizeFallbackRelays, normalizeFallbackDelay } from '../helpers/send-routing.js'
 import { createPauseRecovery, isRecoverableStorageFailure } from '../helpers/pause-recovery.js'
 
 export function wireEvent (value, owner) {
@@ -41,8 +41,9 @@ function messengerStatusSnapshot (value) {
   return { closed: value.closed, paused: value.paused, pauseReasons: [...value.pauseReasons] }
 }
 
-export function createPrivateMessageSession ({ owner, signer, eventStore, messageStorage, chunkStorage, recoveryStorage, fallbackRelays = [], mode = 'seeder', seedersForPeer = peer => [peer], allowedKinds = [5, 9, 1063, 34601], useContentKeys = true, onMedia = () => {}, onOutbox = () => {}, onError = () => {}, onSendError = () => {}, Messenger = createPrivateMessenger, openOutbox = createChatOutbox, FileTransfer = createPrivateFileTransfer, _onOnline = onOnline, _getIykcProofs = getIykcProofs, _setTimeout = setTimeout, _clearTimeout = clearTimeout, _random = Math.random, openDownloads = options => createChatOutbox({ ...options, namespace: 'downloads' }) }) {
+export function createPrivateMessageSession ({ owner, signer, eventStore, messageStorage, chunkStorage, recoveryStorage, fallbackRelays = [], fallbackDelayMs = null, mode = 'seeder', seedersForPeer = peer => [peer], allowedKinds = [5, 9, 1063, 34601], useContentKeys = true, onMedia = () => {}, onOutbox = () => {}, onError = () => {}, onSendError = () => {}, Messenger = createPrivateMessenger, openOutbox = createChatOutbox, FileTransfer = createPrivateFileTransfer, _onOnline = onOnline, _getIykcProofs = getIykcProofs, _setTimeout = setTimeout, _clearTimeout = clearTimeout, _random = Math.random, openDownloads = options => createChatOutbox({ ...options, namespace: 'downloads' }) }) {
   fallbackRelays = normalizeFallbackRelays(fallbackRelays)
+  fallbackDelayMs = normalizeFallbackDelay(fallbackDelayMs)
   const reportedErrors = new WeakSet()
   const reportError = error => {
     if (error && (typeof error === 'object' || typeof error === 'function')) {
@@ -131,7 +132,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     let candidate
     try {
       candidate = await Messenger({
-        fallbackRelays, seedStorage: recoveryStorage?.seeds, userSigner, channels: [], useContentKeys,
+        fallbackRelays, fallbackDelayMs, seedStorage: recoveryStorage?.seeds, userSigner, channels: [], useContentKeys,
         onMessageQueued: () => { if (messengerBinding === binding) return drain() },
         onStateChanged: state => {
           if (closed || messengerBinding !== binding) return

package/relay/helpers/publish.js

@@ -76,7 +76,11 @@ export function createPublishSettlements (promises, timeout, { onSettled } = {})
     })
   }
 
-  return { promise, timeout: timeoutPending }
+  const cancel = reason => {
+    if (isFinished) return
+    for (let index = 0; index < settlements.length; index++) settle(index, { status: 'rejected', outcome: 'failed', reason })
+  }
+  return { promise, timeout: timeoutPending, cancel }
 }
 
 // Turns ordered relay settlements into a stable, caller-facing report. Failed

package/relay/services/relay-connection.js

@@ -186,23 +186,33 @@ export class RelayConnection {
   }
 
   #sendEventOperation (type, event, map, timeoutCode, signal) {
-    if (signal?.aborted) return Promise.reject(signal.reason || relayTimeoutError(timeoutCode))
-    if (map.has(event.id)) return map.get(event.id).promise
+    if (signal?.aborted) return Promise.reject(signal.reason)
+    let pending = map.get(event.id)
+    const created = !pending
+    if (created) {
+      const timer = maybeUnref(setTimeout(() => this.#settleEvent(map, event.id, relayTimeoutError(timeoutCode, this.#lastTransportError)), this.publishTimeout))
+      pending = { timer, waiters: new Set(), cancelSend: null }
+      map.set(event.id, pending)
+    }
     const deferred = Promise.withResolvers()
-    const timer = maybeUnref(setTimeout(() => this.#settleEvent(map, event.id, relayTimeoutError(timeoutCode, this.#lastTransportError)), this.publishTimeout))
-    const onAbort = () => this.#settleEvent(map, event.id, signal.reason || relayTimeoutError(timeoutCode))
-    const stopAbort = () => signal?.removeEventListener('abort', onAbort)
-    const pending = { ...deferred, timer, promise: deferred.promise, cancelSend: null, stopAbort }
-    map.set(event.id, pending)
+    const onAbort = () => {
+      pending.waiters.delete(waiter)
+      signal.removeEventListener('abort', onAbort)
+      deferred.reject(signal.reason)
+      if (!pending.waiters.size && map.get(event.id) === pending) {
+        map.delete(event.id)
+        pending.cancelSend?.()
+        clearTimeout(pending.timer)
+      }
+    }
+    const waiter = { ...deferred, stopAbort: () => signal?.removeEventListener('abort', onAbort) }
+    pending.waiters.add(waiter)
     signal?.addEventListener('abort', onAbort, { once: true })
-    pending.cancelSend = this.#dispatchWork(() => {
-      // Once transmitted, keep the existing ACK/report semantics. Before that,
-      // an operation-wide deadline must cancel the deferred publication.
-      stopAbort()
-      this.send(JSON.stringify([type, event]))
-    }, error => {
-      this.#settleEvent(map, event.id, error)
-    })
+    if (created) {
+      pending.cancelSend = this.#dispatchWork(() => {
+        this.send(JSON.stringify([type, event]))
+      }, error => this.#settleEvent(map, event.id, error))
+    }
     return deferred.promise
   }
 
@@ -225,10 +235,13 @@ export class RelayConnection {
     if (!pending) return
     map.delete(id)
     pending.cancelSend?.()
-    pending.stopAbort?.()
     clearTimeout(pending.timer)
-    if (reason) pending.reject(errorFrom(reason, 'OPERATION_REJECTED'))
-    else pending.resolve(value)
+    for (const waiter of pending.waiters) {
+      waiter.stopAbort()
+      if (reason) waiter.reject(errorFrom(reason, 'OPERATION_REJECTED'))
+      else waiter.resolve(value)
+    }
+    pending.waiters.clear()
   }
 
   #settleCount (id, payload, reason) {

package/relay/services/relay-pool.js

@@ -1204,8 +1204,10 @@ export class RelayPool {
     timeout = SEND_TIMEOUT_MS,
     timeoutUntilFirstFulfillment = null,
     getAuthEvent,
-    onRelayResult
+    onRelayResult,
+    signal
   } = {}) {
+    if (signal != null && (typeof signal.aborted !== 'boolean' || typeof signal.addEventListener !== 'function' || typeof signal.removeEventListener !== 'function')) throw new ValidationError('INVALID_RELAY_SIGNAL')
     const urls = normalizedRelayUrls(relays)
     if (!urls.length) {
       const promise = Promise.resolve(publishSummary([], urls, {
@@ -1236,7 +1238,11 @@ export class RelayPool {
     // Resolves after every relay settles (or reaches the operation timeout) as
     // { success, total, fulfilled, succeededRelays, errors },
     // where errors contains { relay, reason } entries for failed relays.
+    const cancel = () => settlement.cancel(signal.reason)
+    if (signal?.aborted) cancel()
+    else signal?.addEventListener('abort', cancel, { once: true })
     const promise = settlement.promise
+      .finally(() => signal?.removeEventListener('abort', cancel))
       .then(settlements => publishSummary(settlements, urls, {
         includeSucceededRelays: true
       }))
@@ -1245,10 +1251,11 @@ export class RelayPool {
       const deferred = sendDeferreds[index]
       ;(async () => {
         try {
+          const operationSignal = sendControllers[index].signal
+          if (operationSignal.aborted) throw operationSignal.reason
           const relay = await this.#getRelay(url)
-          const signal = sendControllers[index].signal
-          if (signal.aborted) throw signal.reason
-          return await this.#publishEvent(relay, eventToSend, getAuthEvent, signal)
+          if (operationSignal.aborted) throw operationSignal.reason
+          return await this.#publishEvent(relay, eventToSend, getAuthEvent, operationSignal)
         } catch (err) {
           const reason = err instanceof Error ? err : new Error(String(err))
           if (reason instanceof Nip42AuthenticationError) throw reason