libp2r2p 0.11.36 → 0.12.1

package/private-messenger/index.js

@@ -56,6 +56,7 @@ import { recoveryRetryDelay, isPermanentRecoveryError } from './helpers/recovery
 import { assertMessagePublished, publicationFailureDiagnostic, sanitizePublicationError } from './helpers/publication.js'
 import { normalizeRelayUrl } from '../url/index.js'
 import { deliveryInfo } from '../private-channel/helpers/rumor.js'
+import { normalizePreparedPublications } from '../private-channel/helpers/prepared.js'
 import { migrateMessageQueue } from './services/migrate-message-queue.js'
 import { createPendingDecryption, pendingContentKeyGroup, pendingMissingContentKeyGroup } from './services/pending-decryption.js'
 import { createDecryptionScheduler } from './services/decryption-scheduler.js'
@@ -2415,18 +2416,22 @@ export class PrivateMessenger {
     } finally { releaseActivity() }
   }
 
-  async yell ({ channelPubkey = this.defaultChannelPubkey(), receiverPubkeys, relays, relayToReceivers, message, code, payload, error, content, deletionPubkey }) {
+  async yell ({ channelPubkey = this.defaultChannelPubkey(), receiverPubkeys, relays, relayToReceivers, message, code, payload, error, content, deletionPubkey, createdAt, onPreparedSeed, preparedPublication, preparedPublications }) {
     const channel = this.requireWritableChannel(channelPubkey)
     const releaseActivity = this.decryptionScheduler.activity(channelPubkey)
     try {
-      const routing = await this.resolveSendRouting({ channel, receiverPubkeys, relays, relayToReceivers })
-      this.debugSend('yell', channelPubkey, { code, receiverPubkeys })
+      const prepared = normalizePreparedPublications({ preparedPublication, preparedPublications })
+      const receivers = uniq(receiverPubkeys?.length
+        ? receiverPubkeys
+        : prepared.flatMap(publication => publication.receiverPubkeys || []))
+      const routing = await this.resolveSendRouting({ channel, receiverPubkeys: receivers, relays, relayToReceivers })
+      this.debugSend('yell', channelPubkey, { code, receiverPubkeys: receivers })
       return await this._privateMessage.yell({
         senderSigner: this.userSigner,
         imkcSigner: this.contentKeySigner,
         privateChannelSigner: channel.signer,
         privateChannelReaderPubkey: channel.readerPubkey,
-        receiverPubkeys,
+        receiverPubkeys: receivers,
         ...routing,
         expirationSeconds: this.eventExpirationSecondsFor(channel),
         temporaryStorageArea: this.temporaryStorageArea,
@@ -2437,24 +2442,30 @@ export class PrivateMessenger {
         payload,
         error,
         content,
-        onPreparedSeed: this.outgoingSeedHandler(channelPubkey),
+        createdAt,
+        onPreparedSeed: onPreparedSeed || this.outgoingSeedHandler(channelPubkey),
+        preparedPublications: prepared.length ? prepared : undefined,
         _getIykcProofs: this.contentKeyLookup()
       })
     } finally { releaseActivity() }
   }
 
-  async broadcastRumor ({ channelPubkey = this.defaultChannelPubkey(), receiverPubkeys, relays, relayToReceivers, rumor, deletionPubkey, signal, attemptStartedAt, onPreparedSeed, preparedPublication, onDebug }) {
+  async broadcastRumor ({ channelPubkey = this.defaultChannelPubkey(), receiverPubkeys, relays, relayToReceivers, rumor, deletionPubkey, signal, attemptStartedAt, onPreparedSeed, preparedPublication, preparedPublications, onDebug }) {
     const channel = this.requireWritableChannel(channelPubkey)
     const releaseActivity = this.decryptionScheduler.activity(channelPubkey)
     try {
-      const routing = await this.resolveSendRouting({ channel, receiverPubkeys, relays, relayToReceivers, signal, attemptStartedAt, onDebug })
-      this.debugSend('broadcastRumor', channelPubkey, { receiverPubkeys })
+      const prepared = normalizePreparedPublications({ preparedPublication, preparedPublications })
+      const receivers = uniq(receiverPubkeys?.length
+        ? receiverPubkeys
+        : prepared.flatMap(publication => publication.receiverPubkeys || []))
+      const routing = await this.resolveSendRouting({ channel, receiverPubkeys: receivers, relays, relayToReceivers, signal, attemptStartedAt, onDebug })
+      this.debugSend('broadcastRumor', channelPubkey, { receiverPubkeys: receivers })
       return await this._privateMessage.broadcastRumor({
         senderSigner: this.userSigner,
         imkcSigner: this.contentKeySigner,
         privateChannelSigner: channel.signer,
         privateChannelReaderPubkey: channel.readerPubkey,
-        receiverPubkeys,
+        receiverPubkeys: receivers,
         ...routing,
         expirationSeconds: this.eventExpirationSecondsFor(channel),
         temporaryStorageArea: this.temporaryStorageArea,
@@ -2462,24 +2473,28 @@ export class PrivateMessenger {
         autoDeletionCapability: this.autoDeletionCapabilityFor(channel),
         rumor,
         onPreparedSeed: onPreparedSeed || this.outgoingSeedHandler(channelPubkey),
-        preparedPublication,
+        preparedPublications: prepared.length ? prepared : undefined,
         _getIykcProofs: this.contentKeyLookup()
       })
     } finally { releaseActivity() }
   }
 
-  async broadcastEvent ({ channelPubkey = this.defaultChannelPubkey(), receiverPubkeys, relays, relayToReceivers, event, deletionPubkey, signal, attemptStartedAt, onPreparedSeed, preparedPublication, onDebug }) {
+  async broadcastEvent ({ channelPubkey = this.defaultChannelPubkey(), receiverPubkeys, relays, relayToReceivers, event, deletionPubkey, signal, attemptStartedAt, onPreparedSeed, preparedPublication, preparedPublications, onDebug }) {
     const channel = this.requireWritableChannel(channelPubkey)
     const releaseActivity = this.decryptionScheduler.activity(channelPubkey)
     try {
-      const routing = await this.resolveSendRouting({ channel, receiverPubkeys, relays, relayToReceivers, signal, attemptStartedAt, onDebug })
-      this.debugSend('broadcastEvent', channelPubkey, { receiverPubkeys })
+      const prepared = normalizePreparedPublications({ preparedPublication, preparedPublications })
+      const receivers = uniq(receiverPubkeys?.length
+        ? receiverPubkeys
+        : prepared.flatMap(publication => publication.receiverPubkeys || []))
+      const routing = await this.resolveSendRouting({ channel, receiverPubkeys: receivers, relays, relayToReceivers, signal, attemptStartedAt, onDebug })
+      this.debugSend('broadcastEvent', channelPubkey, { receiverPubkeys: receivers })
       return await this._privateMessage.broadcastEvent({
         senderSigner: this.userSigner,
         imkcSigner: this.contentKeySigner,
         privateChannelSigner: channel.signer,
         privateChannelReaderPubkey: channel.readerPubkey,
-        receiverPubkeys,
+        receiverPubkeys: receivers,
         ...routing,
         expirationSeconds: this.eventExpirationSecondsFor(channel),
         temporaryStorageArea: this.temporaryStorageArea,
@@ -2487,7 +2502,7 @@ export class PrivateMessenger {
         autoDeletionCapability: this.autoDeletionCapabilityFor(channel),
         event,
         onPreparedSeed: onPreparedSeed || this.outgoingSeedHandler(channelPubkey),
-        preparedPublication,
+        preparedPublications: prepared.length ? prepared : undefined,
         _getIykcProofs: this.contentKeyLookup()
       })
     } finally { releaseActivity() }

package/private-messenger/session/README.md

@@ -289,9 +289,17 @@ recipient/channel and inner-event identities, event/chunk position, retention
 and accepted/archived flags. Old entries without it retain `localSaved`, index
 and file/chunk progress and enter the same preparation path; there is no database
 migration or alternate publisher. Replays validate signatures and identity and
-reuse the exact envelopes without repeating cryptography or extending expiry.
-
-The existing `onPreparedSeed` callback now also supplies `publication`. The
+reuse the exact envelopes without repeating cryptography or extending expiry,
+except for one 3560 age-auth refresh. That refresh reuses router/ciphertext and
+seeds but re-signs the whole publication with a new shared `created_at` and
+recomputed `expiration`, writes the replacement generation before retrying, and
+sets `outerRefreshAttempted` so reload cannot repeat it. A relay may report a
+stale wrapper as `invalid:`; that prefix permits this refresh but does not
+attempt NIP-42 authentication.
+
+The existing `onPreparedSeed` callback now also supplies `publication`, plus an
+optional `{ replace: true }` second argument when a refreshed publication must
+replace the same inner-event/receiver group in place. The
 session commits that minimal journal before transmitting; direct messengers
 retain their local seed-store durability. Only after that commit can relay
 publication proceed. One independent serial worker converts recovery seeds into
@@ -321,6 +329,12 @@ relay confirmation separately from `localSaved`. Old entries normalize from
 saved delivery status, never from local progress; their event/file indices and
 prepared envelopes remain unchanged. No database migration is needed.
 
+Prepared envelopes are stored as the `prepared.publications` array. Older
+snapshots containing `prepared.publication` are converted to a one-item array
+and rewritten through the same encrypted outbox queue before publication or
+archive work resumes. The singular key is never written by current versions and
+is not accepted as a public replay argument.
+
 `onOutbox` adds `localPersistence: { state, retryable }`, where state is pending,
 saved or failed. It is a presentation summary with no native error objects.
 A saved remote entry may still have pending/failed local work. Keep it visible

package/private-messenger/session/helpers/prepared-state.js

@@ -0,0 +1,17 @@
+import { ValidationError } from '../../../error/index.js'
+
+export function normalizePreparedState (prepared) {
+  if (!prepared) return { prepared, migrated: false }
+  const legacy = prepared.publication
+  const publications = prepared.publications !== undefined
+    ? prepared.publications
+    : legacy !== undefined
+      ? [legacy]
+      : null
+  if (!Array.isArray(publications) || publications.length === 0) {
+    throw new ValidationError('INVALID_PREPARED_PUBLICATIONS')
+  }
+  prepared.publications = publications
+  delete prepared.publication
+  return { prepared, migrated: legacy !== undefined }
+}

package/private-messenger/session/helpers/publication-journal.js

@@ -24,7 +24,7 @@ export function createPublicationJournal ({ entries, store, archive, changed, on
   function rows (entry) {
     const packet = entry.prepared
     if (!packet?.recover) return []
-    return packet.publication.seeds.flatMap(seed => compactSeedRouterRows(seed).map(row => {
+    return packet.publications.flatMap(publication => publication.seeds.flatMap(seed => compactSeedRouterRows(seed).map(row => {
       const descriptor = packet.target.file
       const value = {
         ...row, channelPubkey: seed.channelPubkey, receivedAt: packet.receivedAt,
@@ -32,15 +32,15 @@ export function createPublicationJournal ({ entries, store, archive, changed, on
         ...(descriptor
           ? {
               root: descriptor.root, controlChannelPubkey: descriptor.controlChannelPubkey,
-              fileChannelPubkey: packet.publication.channelPubkey, peerPubkey: descriptor.peerPubkey,
+              fileChannelPubkey: publication.channelPubkey, peerPubkey: descriptor.peerPubkey,
               chunkIndex: packet.target.chunkIndex,
-              key: `${descriptor.controlChannelPubkey}:${packet.publication.channelPubkey}:${row.receiverPubkey}:${packet.target.chunkIndex}`
+              key: `${descriptor.controlChannelPubkey}:${publication.channelPubkey}:${row.receiverPubkey}:${packet.target.chunkIndex}`
             }
           : {})
       }
       value.recordId = encodeRecord('seed', value).tags[0][1]
       return value
-    }))
+    })))
   }
   function retryLater () {
     if (stopped || !enabled || timer || !failed.size) return
@@ -60,7 +60,7 @@ export function createPublicationJournal ({ entries, store, archive, changed, on
         try {
           if (!durable.has(packet)) { await write(entry); durable.add(packet) }
           if (!packet.archived) {
-            debug(entry, 'recovery-archive-start', queued.get(packet), { publicationId: packet.publication.events[0].id })
+            debug(entry, 'recovery-archive-start', queued.get(packet), { publicationId: packet.publications[0].events[0].id })
             if (packet.recover) await archive(entry, rows(entry))
             packet.archived = true
             debug(entry, 'recovery-archived', started)
@@ -87,15 +87,43 @@ export function createPublicationJournal ({ entries, store, archive, changed, on
     write,
     async flush (entry) { while (writes.has(entry.id)) await writes.get(entry.id) },
     adopt (entry) { if (entry.prepared) { durable.add(entry.prepared); queued.set(entry.prepared, Date.now()) } },
-    async stage (entry, seed, target, retentionSeconds) {
+    async stage (entry, seed, target, retentionSeconds, { replace = false } = {}) {
       const started = Date.now()
-      if (entry.prepared && entry.prepared.publication.events[0].id !== seed.publication.events[0].id) throw new Error('PUBLICATION_ARCHIVE_PENDING')
-      entry.prepared ||= { publication: structuredClone(seed.publication), target, receivedAt: Math.floor(Date.now() / 1000), retentionSeconds, recover: retentionSeconds > 0, accepted: false, archived: retentionSeconds <= 0 }
-      if (durable.has(entry.prepared)) return
+      const publication = structuredClone(seed.publication)
+      const targetKey = JSON.stringify(target)
+      entry.prepared ||= { publications: [], target, receivedAt: Math.floor(Date.now() / 1000), retentionSeconds, recover: retentionSeconds > 0, accepted: false, archived: retentionSeconds <= 0 }
+      if (replace && targetKey !== JSON.stringify(entry.prepared.target)) throw new Error('PUBLICATION_ARCHIVE_TARGET_MISMATCH')
+      if (entry.prepared.publications.some(existing => existing.innerEventId !== publication.innerEventId)) {
+        throw new Error('PUBLICATION_ARCHIVE_PENDING')
+      }
+      const receiverKey = (publication.receiverPubkeys || []).slice().sort().join(',')
+      const eventKey = publication.events.map(event => event.id).join(',')
+      const matchingIndexes = entry.prepared.publications
+        .map((existing, index) => ({ existing, index }))
+        .filter(({ existing }) => existing.innerEventId === publication.innerEventId &&
+          (existing.receiverPubkeys || []).slice().sort().join(',') === receiverKey)
+      const existingIndex = matchingIndexes[0]?.index ?? -1
+      const existing = matchingIndexes[0]?.existing
+      const duplicate = Boolean(existing) &&
+        existing.events.map(event => event.id).join(',') === eventKey
+      const matches = existingIndex >= 0
+      if (replace) {
+        if (!matches) throw new Error('PUBLICATION_ARCHIVE_REPLACE_MISSING')
+        entry.prepared.publications = entry.prepared.publications
+          .filter((_publication, index) => index !== existingIndex)
+          .filter(candidate =>
+            candidate.innerEventId !== publication.innerEventId ||
+            (candidate.receiverPubkeys || []).slice().sort().join(',') !== receiverKey
+          )
+        entry.prepared.publications.splice(existingIndex, 0, publication)
+      } else {
+        if (!duplicate) entry.prepared.publications.push(publication)
+        if (duplicate && durable.has(entry.prepared)) return
+      }
       queued.set(entry.prepared, Date.now())
       await write(entry)
       durable.add(entry.prepared)
-      debug(entry, 'publication-checkpoint', started, { publicationId: seed.publication.events[0].id })
+      debug(entry, replace ? 'publication-refresh' : 'publication-checkpoint', started, { publicationId: seed.publication.events[0].id })
       for (const row of rows(entry)) debug(entry, 'recovery-pending', undefined, { seedRecordId: row.recordId, publicationId: seed.publication.events[0].id })
       wake()
     },

package/private-messenger/session/index.js

@@ -16,6 +16,7 @@ import { assertMessagePublished } from '../helpers/publication.js'
 import { normalizeFallbackRelays, normalizeFallbackDelay } from '../helpers/send-routing.js'
 import { createPublicationJournal, withPendingSeeds } from './helpers/publication-journal.js'
 import { createPauseRecovery, isRecoverableStorageFailure } from '../helpers/pause-recovery.js'
+import { normalizePreparedState } from './helpers/prepared-state.js'
 
 export function wireEvent (value, owner) {
   const event = { kind: value.kind, created_at: value.created_at, tags: structuredClone(value.tags), content: value.content, pubkey: value.pubkey || owner }
@@ -164,6 +165,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
   const idleWaiters = new Set()
   const settled = () => { if (!sending && !localSaving && !enqueuing && !draining && !cleanups.size) { for (const resolve of idleWaiters) resolve(); idleWaiters.clear() } }
   const localComplete = entry => entry.localSaved.every(Boolean)
+  const preparedPublicationId = entry => entry.prepared?.publications?.[0]?.events?.[0]?.id
   const completed = entry => !unadmitted.has(entry) && localComplete(entry) && (entry.peer === owner || entry.deliveryConfirmed)
   const emit = () => onOutbox([...entries.values()].filter(entry => !unadmitted.has(entry) && !entry.deletion && !entry.cancelled).map(entry => ({
     ...entry,
@@ -188,7 +190,7 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
       const onDiagnostic = details => {
         diagnosticReported = true
         debug(entry, 'recovery-archive-result', archiveStartedAt, {
-          publicationId: entry.prepared.publication.events[0].id,
+          publicationId: preparedPublicationId(entry),
           ...details
         })
       }
@@ -199,15 +201,19 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
           for (const row of rows) archived.push(await recoveryStorage.seeds.put(row))
         }
       } else if (entry.prepared.target.file) {
-        for (const seed of entry.prepared.publication.seeds) await fileTransfers.archiveSeed(entry.prepared.target.file, seed)
+        for (const publication of entry.prepared.publications) {
+          for (const seed of publication.seeds) await fileTransfers.archiveSeed(entry.prepared.target.file, seed)
+        }
       } else {
-        for (const seed of entry.prepared.publication.seeds) await messenger.enqueueSeed(seed.channelPubkey, seed)
+        for (const publication of entry.prepared.publications) {
+          for (const seed of publication.seeds) await messenger.enqueueSeed(seed.channelPubkey, seed)
+        }
       }
       if (!diagnosticReported) {
         const results = Array.isArray(archived) ? archived : []
         const storedCount = results.filter(Boolean).length
         debug(entry, 'recovery-archive-result', archiveStartedAt, {
-          publicationId: entry.prepared.publication.events[0].id,
+          publicationId: preparedPublicationId(entry),
           rowCount: rows.length,
           uniqueCount: new Set(rows.map(row => row.recordId).filter(Boolean)).size,
           storedCount,
@@ -226,6 +232,9 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
   const ready = () => (initialized ??= (async () => {
     storage = await openOutbox({ owner, signer, onDebug })
     for (const entry of await storage.list()) {
+      if (normalizePreparedState(entry.prepared).migrated) {
+        await storage.put(structuredClone(entry), { existing: true })
+      }
       // Old encrypted entries retain progress and enter this same pipeline.
       const legacyLocalFailure = entry.deliveryConfirmed === undefined && entry.failed && !entry.localSaved.every(Boolean)
       if (legacyLocalFailure) {
@@ -471,10 +480,10 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
     const options = {
       channelPubkey, receiverPubkeys: [peer], signal, attemptStartedAt: attemptStarts.get(entry.id),
       onDebug: onDebug ? value => debug(entry, value.stage, undefined, value) : undefined,
-      preparedPublication: entry.prepared?.publication,
-      onPreparedSeed: async seed => {
+      preparedPublications: entry.prepared?.publications,
+      onPreparedSeed: async (seed, { replace = false } = {}) => {
         debug(entry, 'envelope-prepared', preparationStartedAt, { publicationId: seed.publication.events[0].id })
-        await journal.stage(entry, seed, { index: entry.index }, retention)
+        await journal.stage(entry, seed, { index: entry.index }, retention, { replace })
         signal.throwIfAborted()
       }
     }
@@ -592,8 +601,11 @@ export function createPrivateMessageSession ({ owner, signer, eventStore, messag
           const recover = mode === 'watchtower' ? messenger.offlineRecoverySecondsFor?.(descriptor.controlChannelPubkey) ?? 0 : 0
           const target = { file: descriptor, fileIndex: entry.fileIndex, chunkIndex: entry.chunkIndex }
           await fileTransfers.publishChunk(descriptor, wireEvent(chunk, owner), {
-            signal: controller.signal, attemptStartedAt: chunkStartedAt, onDebug: onDebug ? value => debug(entry, value.stage, undefined, value) : undefined, preparedPublication: entry.prepared?.publication,
-            onPreparedSeed: async seed => { await journal.stage(entry, seed, target, recover); controller.signal.throwIfAborted() }
+            signal: controller.signal, attemptStartedAt: chunkStartedAt, onDebug: onDebug ? value => debug(entry, value.stage, undefined, value) : undefined, preparedPublications: entry.prepared?.publications,
+            onPreparedSeed: async (seed, { replace = false } = {}) => {
+              await journal.stage(entry, seed, target, recover, { replace })
+              controller.signal.throwIfAborted()
+            }
           })
           entry.chunkIndex++
           const completed = entry.files.slice(0, entry.fileIndex).reduce((sum, value) => sum + value.size, 0) + Math.min(file.size, entry.chunkIndex * IRFS_CHUNK_BYTES)

package/relay/services/relay-pool.js

@@ -8,6 +8,7 @@ import { maybeUnref } from '../helpers/timer.js'
 import { categorizeRelayError, relayTimeoutError } from '../helpers/error.js'
 import { ReadRetry, isRetryableReadFailure, needsConnectivityCheck, waitUntil } from '../helpers/read-retry.js'
 import { normalizeRelayUrl } from '../../url/index.js'
+import { isValidEvent } from '../../event/index.js'
 import { RelayConnection } from './relay-connection.js'
 
 const CONNECTION_TIMEOUT_MS = 3000
@@ -69,7 +70,19 @@ function notifyRelayResult (onRelayResult, result) {
 }
 
 function requiresNip42Auth (reason) {
-  return reason.message.startsWith('auth-required:') || reason.message.startsWith('restricted:')
+  const message = reason?.message || reason?.code || ''
+  return message.startsWith('auth-required:') || message.startsWith('restricted:')
+}
+
+function requiresOuterRefresh (reason) {
+  return requiresNip42Auth(reason) || (reason?.message || reason?.code || '').startsWith('invalid:')
+}
+
+function isDefinitiveOuterRejection (report) {
+  return report?.success === false &&
+    Array.isArray(report.errors) &&
+    report.errors.length > 0 &&
+    report.errors.every(({ reason }) => requiresOuterRefresh(reason))
 }
 
 function countResponseError () {
@@ -1199,15 +1212,19 @@ export class RelayPool {
   // { relay, success, outcome, reason? } result per relay as it settles; outcome
   // is published, duplicate, muted, failed, or timed-out. getAuthEvent is used
   // only after auth-required or restricted publish failures, then retries once.
+  // getRetryEvent may return one fresh signed event after every relay rejected
+  // the original with auth-required/restricted/invalid; it shares the operation deadline.
   // Await `promise` for the complete report, including every relay outcome.
   async sendEvent (event, relays, {
     timeout = SEND_TIMEOUT_MS,
     timeoutUntilFirstFulfillment = null,
     getAuthEvent,
+    getRetryEvent,
     onRelayResult,
     signal
   } = {}) {
     if (signal != null && (typeof signal.aborted !== 'boolean' || typeof signal.addEventListener !== 'function' || typeof signal.removeEventListener !== 'function')) throw new ValidationError('INVALID_RELAY_SIGNAL')
+    if (getRetryEvent != null && typeof getRetryEvent !== 'function') throw new ValidationError('INVALID_RETRY_EVENT_CALLBACK')
     const urls = normalizedRelayUrls(relays)
     if (!urls.length) {
       const promise = Promise.resolve(publishSummary([], urls, {
@@ -1216,69 +1233,121 @@ export class RelayPool {
       return { total: 0, success: false, promise }
     }
 
-    const eventToSend = event.meta ? { ...event } : event
-    if (eventToSend.meta) delete eventToSend.meta
-
-    const sendControllers = urls.map(() => new AbortController())
-    const sendDeferreds = urls.map(() => Promise.withResolvers())
-    const sendPromises = sendDeferreds.map(({ promise }) => promise)
-
-    // Starts before connection work so every relay shares one real deadline.
-    const settlement = createPublishSettlements(sendPromises, timeout, {
-      onSettled: (settlement, index) => {
-        sendControllers[index].abort(settlement.reason)
-        if (settlement.reason?.category === 'timeout' && !settlement.reason.cause) {
-          const relay = this.#relays.get(normalizeRelayUrl(urls[index]))
-          if (relay?.lastTransportError) settlement.reason.cause = relay.lastTransportError
+    const deadline = timeout === null ? null : Date.now() + timeout
+    const remainingTimeout = () => deadline === null ? null : Math.max(0, deadline - Date.now())
+    const sendAttempt = async (eventToSend, { notify = true } = {}) => {
+      const attemptTimeout = remainingTimeout()
+      const eventForAttempt = eventToSend.meta ? { ...eventToSend } : eventToSend
+      if (eventForAttempt.meta) delete eventForAttempt.meta
+      const sendControllers = urls.map(() => new AbortController())
+      const sendDeferreds = urls.map(() => Promise.withResolvers())
+      const sendPromises = sendDeferreds.map(({ promise }) => promise)
+      const bufferedResults = []
+      const delivery = { notify }
+
+      // Starts before connection work so every relay shares one real deadline.
+      const settlement = createPublishSettlements(sendPromises, attemptTimeout, {
+        onSettled: (settlement, index) => {
+          sendControllers[index].abort(settlement.reason)
+          if (settlement.reason?.category === 'timeout' && !settlement.reason.cause) {
+            const relay = this.#relays.get(normalizeRelayUrl(urls[index]))
+            if (relay?.lastTransportError) settlement.reason.cause = relay.lastTransportError
+          }
+          const result = relayResultForSettlement(urls[index], settlement)
+          if (delivery.notify) notifyRelayResult(onRelayResult, result)
+          else bufferedResults.push(result)
         }
-        notifyRelayResult(onRelayResult, relayResultForSettlement(urls[index], settlement))
-      }
-    })
-
-    // Resolves after every relay settles (or reaches the operation timeout) as
-    // { success, total, fulfilled, succeededRelays, errors },
-    // where errors contains { relay, reason } entries for failed relays.
-    const cancel = () => settlement.cancel(signal.reason)
-    if (signal?.aborted) cancel()
-    else signal?.addEventListener('abort', cancel, { once: true })
-    const promise = settlement.promise
-      .finally(() => signal?.removeEventListener('abort', cancel))
-      .then(settlements => publishSummary(settlements, urls, {
-        includeSucceededRelays: true
-      }))
+      })
 
-    urls.forEach((url, index) => {
-      const deferred = sendDeferreds[index]
-      ;(async () => {
-        try {
-          const operationSignal = sendControllers[index].signal
-          if (operationSignal.aborted) throw operationSignal.reason
-          const relay = await this.#getRelay(url)
-          if (operationSignal.aborted) throw operationSignal.reason
-          return await this.#publishEvent(relay, eventToSend, getAuthEvent, operationSignal)
-        } catch (err) {
-          const reason = err instanceof Error ? err : new Error(String(err))
-          if (reason instanceof Nip42AuthenticationError) throw reason
-          if (reason.message.startsWith('duplicate:')) return 'duplicate'
-          if (reason.message.startsWith('mute:')) {
-            console.info([url, reason.message].filter(Boolean).join(' - '))
-            return 'muted'
+      // Resolves after every relay settles (or reaches the operation timeout) as
+      // { success, total, fulfilled, succeededRelays, errors },
+      // where errors contains { relay, reason } entries for failed relays.
+      const cancel = () => settlement.cancel(signal.reason)
+      if (signal?.aborted) cancel()
+      else signal?.addEventListener('abort', cancel, { once: true })
+      const promise = settlement.promise
+        .finally(() => signal?.removeEventListener('abort', cancel))
+        .then(settlements => publishSummary(settlements, urls, {
+          includeSucceededRelays: true
+        }))
+
+      urls.forEach((url, index) => {
+        const deferred = sendDeferreds[index]
+        ;(async () => {
+          try {
+            const operationSignal = sendControllers[index].signal
+            if (operationSignal.aborted) throw operationSignal.reason
+            const relay = await this.#getRelay(url)
+            if (operationSignal.aborted) throw operationSignal.reason
+            return await this.#publishEvent(relay, eventForAttempt, getAuthEvent, operationSignal)
+          } catch (err) {
+            const reason = err instanceof Error ? err : new Error(String(err))
+            if (reason instanceof Nip42AuthenticationError) throw reason
+            if (reason.message.startsWith('duplicate:')) return 'duplicate'
+            if (reason.message.startsWith('mute:')) {
+              console.info([url, reason.message].filter(Boolean).join(' - '))
+              return 'muted'
+            }
+            throw reason
           }
-          throw reason
-        }
-      })().then(deferred.resolve, deferred.reject)
-    })
+        })().then(deferred.resolve, deferred.reject)
+      })
 
-    const success = await firstFulfillment(sendPromises, timeoutUntilFirstFulfillment, {
-      fallback: promise.then(report => report.success)
-    })
-    if (!success) settlement.timeout()
+      const earlyTimeout = timeoutUntilFirstFulfillment === null || attemptTimeout === null
+        ? timeoutUntilFirstFulfillment
+        : Math.min(timeoutUntilFirstFulfillment, attemptTimeout)
+      const success = await firstFulfillment(sendPromises, earlyTimeout, {
+        fallback: promise.then(report => report.success)
+      })
+      if (!success) settlement.timeout()
 
-    return {
-      total: urls.length,
-      success,
-      promise
+      const result = {
+        total: urls.length,
+        success,
+        promise
+      }
+      Object.defineProperty(result, 'flushRelayResults', {
+        value: () => {
+          delivery.notify = true
+          for (const result of bufferedResults.splice(0)) notifyRelayResult(onRelayResult, result)
+        }
+      })
+      return result
+    }
+
+    const first = await sendAttempt(event, { notify: !getRetryEvent })
+    if (first.success || !getRetryEvent) {
+      first.flushRelayResults()
+      return first
+    }
+    let report
+    try {
+      report = await first.promise
+    } catch {
+      first.flushRelayResults()
+      return first
+    }
+    if (!isDefinitiveOuterRejection(report) || (deadline !== null && Date.now() >= deadline)) {
+      first.flushRelayResults()
+      return first
+    }
+    let retryEvent
+    try {
+      retryEvent = await getRetryEvent({ event, report })
+    } catch (cause) {
+      throw Object.assign(new Error('RETRY_EVENT_PREPARATION_FAILED', { cause }), {
+        code: 'RETRY_EVENT_PREPARATION_FAILED',
+        cause
+      })
+    }
+    if ((deadline !== null && Date.now() >= deadline) ||
+        !isValidEvent(retryEvent) || retryEvent.id === event.id || retryEvent.kind !== event.kind) {
+      first.flushRelayResults()
+      return first
     }
+    const retried = await sendAttempt(retryEvent, { notify: true })
+    Object.defineProperty(retried, 'retriedEvent', { value: retryEvent })
+    return retried
   }
 }