@agentorg/cli 0.0.5 → 0.0.7

package/dist/node_modules/@agentorg/hub/dist/src/build.js

@@ -1,120 +0,0 @@
-import { readdirSync, rmSync } from "node:fs";
-import { mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { Refused } from "@agentorg/sdk";
-import { BuildError, buildPackage } from "@agentorg/sdk/build";
-/** What a package's source may total, paths and text: it fits in one frame. */
-export const MAX_SOURCE = 768 * 1024;
-/** Files one package's source may have. */
-const MAX_FILES = 256;
-/**
- * What a package built by the Hub may import by name: the SDK, the interfaces, zod, and React and
- * the kit for views (`react/jsx-runtime`, which JSX compiles to, is React's).
- */
-const ALLOWED = [
-    "@agentorg/sdk",
-    "@agentorg/interfaces",
-    "zod",
-    "react",
-    "react-dom",
-    "@agentorg/kit",
-];
-/** Where those are found: this package's own folder (dist/src/build.js → the package). */
-const FROM = fileURLToPath(new URL("../..", import.meta.url));
-/** A source path: `package.json`, or a source file under `src/` named plainly. */
-const PATH = /^(package\.json|src(\/[A-Za-z0-9_][A-Za-z0-9_.-]*)*\/[A-Za-z0-9_][A-Za-z0-9_.-]*\.(ts|tsx|mts|js|mjs|jsx|json))$/;
-/** Files under `src/` that tools read as configuration: a tsconfig can name any file to read. */
-const CONFIG = /(^|\/)(tsconfig|jsconfig|package)\.json$/;
-/** At most 16 modules and 16 MiB built; 30 s to bundle each module, 60 s for the whole build. */
-const LIMITS = { modules: 16, bytes: 16 * 1024 * 1024, bundleMs: 30_000, totalMs: 60_000 };
-/** How long reading one module's definition may take, in a Hub build. */
-const DESCRIBE_MS = 5_000;
-/**
- * The source as given, checked before anything is written or queued: its paths (no two the same
- * but for case, none both a file and a folder), its size.
- */
-export function checkSource(files) {
-    if (typeof files !== "object" || files === null || Array.isArray(files))
-        throw new Refused("invalid", "files is an object of path to text.");
-    const entries = Object.entries(files);
-    if (entries.length > MAX_FILES)
-        throw new Refused("invalid", `A package's source is at most ${MAX_FILES} files.`);
-    let size = 0;
-    const seen = new Set();
-    for (const [path, text] of entries) {
-        if (path.length > 256 || !PATH.test(path) || (path !== "package.json" && CONFIG.test(path)))
-            throw new Refused("invalid", `${JSON.stringify(path)}: a package's source is package.json and source files under src/ (.ts, .tsx, .mts, .js, .mjs, .jsx, .json; no tsconfig, jsconfig or package.json there), by plain relative paths.`);
-        const lower = path.toLowerCase();
-        if (seen.has(lower))
-            throw new Refused("invalid", `${path}: another path differs from it only by case.`);
-        seen.add(lower);
-        if (typeof text !== "string")
-            throw new Refused("invalid", `${path} isn't text.`);
-        size += Buffer.byteLength(path) + Buffer.byteLength(text);
-    }
-    if (size > MAX_SOURCE)
-        throw new Refused("invalid", `A package's source is at most ${MAX_SOURCE / 1024} KiB.`);
-    if (!entries.some(([path]) => path === "package.json"))
-        throw new Refused("invalid", "A package's source has a package.json.");
-    for (const lower of seen)
-        for (let at = lower.indexOf("/"); at > 0; at = lower.indexOf("/", at + 1))
-            if (seen.has(lower.slice(0, at)))
-                throw new Refused("invalid", `${lower.slice(0, at)} is both a file and a folder.`);
-    return entries;
-}
-/**
- * A build's message as the caller may see it: the package's own paths relative to it, and the
- * places the Hub knows (its home, its installation) never named. The SDK already tells a place
- * outside the package as <outside>; only known prefixes are replaced here, so what the caller
- * wrote comes back as written.
- */
-function told(message, source, home) {
-    return message
-        .replaceAll(`${source}/`, "")
-        .replaceAll(source, ".")
-        .replaceAll(home, "<home>")
-        .replaceAll(FROM.replace(/\/$/, ""), "<hub>");
-}
-/**
- * Build a package from its source, given as data, and add it with `add`: the files are written to
- * a fresh folder in the home, built as `agentorg build` builds (importing by name only the SDK,
- * the interfaces, zod, React, react-dom and the kit, and nothing outside the folder; reading no tsconfig; at most 16
- * modules and 16 MiB built), and the folder is gone after, whatever happened. A build that fails
- * is `Refused("build")` with the build's message, which names no path outside the package.
- */
-export async function buildSource(home, entries, sandbox, add) {
-    const dir = await realpath(await mkdtemp(join(home, "build-")));
-    const source = join(dir, "source");
-    try {
-        let built;
-        try {
-            for (const [path, text] of entries) {
-                await mkdir(dirname(join(source, path)), { recursive: true, mode: 0o700 });
-                await writeFile(join(source, path), text, { mode: 0o600, flag: "wx" });
-            }
-            built = await buildPackage(source, {
-                out: join(dir, "out"),
-                packages: { allowed: ALLOWED, from: FROM },
-                limits: LIMITS,
-                describeTimeoutMs: DESCRIBE_MS,
-                // The describer runs the source's code: in the OS sandbox host processes run in.
-                describer: { sandbox },
-            });
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            throw new Refused("build", told(error instanceof BuildError ? message : `The build failed: ${message}`, source, await realpath(home)));
-        }
-        return add(built.file);
-    }
-    finally {
-        await rm(dir, { recursive: true, force: true });
-    }
-}
-/** Folders of builds a crash interrupted: removed when the Hub opens. */
-export function sweepBuilds(home) {
-    for (const name of readdirSync(home))
-        if (name.startsWith("build-"))
-            rmSync(join(home, name), { recursive: true, force: true });
-}

package/dist/node_modules/@agentorg/hub/dist/src/logs.d.ts

@@ -1,33 +0,0 @@
-/** One line of an Actor's log, as `hub.actors.logs` returns it. */
-export interface LogLine {
-    level: "info" | "warn" | "error";
-    message: string;
-    data?: Record<string, unknown>;
-    module?: string;
-    at: string;
-}
-/** Where an Actor's log is kept in the home; the previous file, rotated once, is `<file>.1`. */
-export declare const logFile: (home: string, actorId: string) => string;
-/**
- * The newest `limit` entries of an Actor's log, oldest first, across its file and the one rotated
- * before it. Lines that aren't a log entry are skipped and don't count.
- */
-export declare function readLogs(home: string, actorId: string, limit: number): LogLine[];
-/**
- * An entry as it is written, whoever gave it: a known level, the text cut, and the data rebuilt
- * as a fresh object of at most `MAX_FIELDS` keys, each value a primitive or JSON text, cut.
- */
-export declare function boundedEntry(level: unknown, message: unknown, data: unknown, module: string | undefined): LogLine;
-/**
- * Add an entry to an Actor's log (0600). A file that would pass 1 MiB is rotated to `<file>.1`
- * first, replacing the one before, so an Actor's logs never hold more than two files.
- */
-export declare function appendLog(home: string, actorId: string, entry: LogLine): void;
-/** Add entries to an Actor's log in one write, rotating first as `appendLog` does. */
-export declare function appendLogs(home: string, actorId: string, entries: LogLine[]): void;
-/**
- * A line a host process wrote, as a log entry: on stderr, a JSON line with a message and a time is
- * one of the runner's `ctx.log` entries (bounded like any other); anything else is the process's
- * own output, `info` from stdout and `error` from stderr.
- */
-export declare function outputEntry(stream: "stdout" | "stderr", line: string): LogLine;

package/dist/node_modules/@agentorg/hub/dist/src/logs.js

@@ -1,162 +0,0 @@
-import { appendFileSync, closeSync, fstatSync, mkdirSync, openSync, readSync, renameSync, statSync, } from "node:fs";
-import { join } from "node:path";
-/** Where an Actor's log is kept in the home; the previous file, rotated once, is `<file>.1`. */
-export const logFile = (home, actorId) => join(home, "logs", `${actorId}.log`);
-/** A log file is rotated once it would pass this; each read takes at most this of a file's end. */
-const MAX_FILE = 1024 * 1024;
-const TAIL = MAX_FILE;
-/** A line's text is cut to this. */
-const MAX_MESSAGE = 4096;
-/** A line's data: this many keys at most, each value a primitive or JSON text, cut to this. */
-const MAX_FIELDS = 16;
-const MAX_FIELD = 1024;
-function tail(path) {
-    let fd;
-    try {
-        fd = openSync(path, "r");
-    }
-    catch {
-        return []; // Not written yet.
-    }
-    try {
-        const size = fstatSync(fd).size;
-        const length = Math.min(size, TAIL);
-        const buffer = Buffer.alloc(length);
-        readSync(fd, buffer, 0, length, size - length);
-        const lines = buffer.toString("utf8").split("\n");
-        // Cut mid-file, the first line is a fragment.
-        return size > length ? lines.slice(1) : lines;
-    }
-    finally {
-        closeSync(fd);
-    }
-}
-const LEVELS = new Set(["info", "warn", "error"]);
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/** A line as a log entry, built from its known fields only; anything else isn't one. */
-function entryOf(line) {
-    let raw;
-    try {
-        raw = JSON.parse(line);
-    }
-    catch {
-        return undefined; // A partial line from a crash, or not ours.
-    }
-    if (!isRecord(raw) || typeof raw.message !== "string" || typeof raw.at !== "string")
-        return undefined;
-    return {
-        level: LEVELS.has(raw.level) ? raw.level : "info",
-        message: raw.message,
-        ...(isRecord(raw.data) ? { data: raw.data } : {}),
-        ...(typeof raw.module === "string" ? { module: raw.module } : {}),
-        at: raw.at,
-    };
-}
-/**
- * The newest `limit` entries of an Actor's log, oldest first, across its file and the one rotated
- * before it. Lines that aren't a log entry are skipped and don't count.
- */
-export function readLogs(home, actorId, limit) {
-    const file = logFile(home, actorId);
-    const lines = [...tail(`${file}.1`), ...tail(file)];
-    const entries = [];
-    for (let i = lines.length - 1; i >= 0 && entries.length < limit; i--) {
-        const entry = entryOf(lines[i]);
-        if (entry)
-            entries.push(entry);
-    }
-    return entries.reverse();
-}
-/** Anything as text, even what can't say itself (no prototype, a throwing `toString`). */
-function textOf(value) {
-    try {
-        return String(value);
-    }
-    catch {
-        return "[unprintable]";
-    }
-}
-/** One field's value as it is kept: a number, boolean or null as is, anything else as text, cut. */
-function fieldOf(read) {
-    try {
-        const value = read();
-        if (value === null || typeof value === "number" || typeof value === "boolean")
-            return value;
-        const text = typeof value === "string" ? value : textOf(JSON.stringify(value));
-        return text.slice(0, MAX_FIELD);
-    }
-    catch {
-        return "[unreadable]"; // A getter, toJSON or bigint that throws.
-    }
-}
-/**
- * An entry as it is written, whoever gave it: a known level, the text cut, and the data rebuilt
- * as a fresh object of at most `MAX_FIELDS` keys, each value a primitive or JSON text, cut.
- */
-export function boundedEntry(level, message, data, module) {
-    let fields;
-    try {
-        if (isRecord(data)) {
-            // No prototype: a `__proto__` key is a key like any other.
-            fields = Object.create(null);
-            let kept = 0;
-            // Only the first keys are read: the rest are never touched.
-            for (const key in data) {
-                if (!Object.hasOwn(data, key))
-                    continue;
-                if (kept++ >= MAX_FIELDS)
-                    break;
-                fields[key.slice(0, MAX_FIELD)] = fieldOf(() => data[key]);
-            }
-        }
-    }
-    catch {
-        fields = undefined; // Data that can't even list its keys (a hostile proxy) is left out.
-    }
-    return {
-        level: LEVELS.has(level) ? level : "info",
-        message: textOf(message).slice(0, MAX_MESSAGE),
-        ...(fields ? { data: fields } : {}),
-        ...(module === undefined ? {} : { module }),
-        at: new Date().toISOString(),
-    };
-}
-/**
- * Add an entry to an Actor's log (0600). A file that would pass 1 MiB is rotated to `<file>.1`
- * first, replacing the one before, so an Actor's logs never hold more than two files.
- */
-export function appendLog(home, actorId, entry) {
-    appendLogs(home, actorId, [entry]);
-}
-/** Add entries to an Actor's log in one write, rotating first as `appendLog` does. */
-export function appendLogs(home, actorId, entries) {
-    if (!entries.length)
-        return;
-    const file = logFile(home, actorId);
-    const line = entries.map((entry) => `${JSON.stringify(entry)}\n`).join("");
-    // Past what a reader takes of a file, a line could never be read back.
-    if (Buffer.byteLength(line) > MAX_FILE)
-        return;
-    mkdirSync(join(home, "logs"), { recursive: true, mode: 0o700 });
-    let size = 0;
-    try {
-        size = statSync(file).size;
-    }
-    catch {
-        // Not written yet.
-    }
-    if (size > 0 && size + Buffer.byteLength(line) > MAX_FILE)
-        renameSync(file, `${file}.1`);
-    appendFileSync(file, line, { mode: 0o600 });
-}
-/**
- * A line a host process wrote, as a log entry: on stderr, a JSON line with a message and a time is
- * one of the runner's `ctx.log` entries (bounded like any other); anything else is the process's
- * own output, `info` from stdout and `error` from stderr.
- */
-export function outputEntry(stream, line) {
-    const parsed = stream === "stderr" ? entryOf(line) : undefined;
-    return parsed
-        ? boundedEntry(parsed.level, parsed.message, parsed.data, parsed.module?.slice(0, 64))
-        : boundedEntry(stream === "stdout" ? "info" : "error", line, undefined, undefined);
-}

package/dist/node_modules/@agentorg/hub/dist/src/net.d.ts

@@ -1,41 +0,0 @@
-import type { LookupAddress } from "node:dns";
-import { BlockList } from "node:net";
-import { type HubState } from "./state.js";
-export interface NetOptions {
-    /** Resolve a host name to every address it has. Tests give their own. */
-    lookup?: (host: string) => Promise<LookupAddress[]>;
-    /** A CA to trust beside the usual roots. Tests give their own. */
-    ca?: string;
-    /** How long a request may go without a byte either way. */
-    idleMs?: number;
-    /** Addresses refused: by default `blockedAddresses()`. Tests leave loopback out to reach their server. */
-    blocked?: BlockList;
-}
-/**
- * Addresses that aren't the public internet: unspecified, loopback, private (RFC 1918, ULA),
- * shared (CGNAT), link-local (the cloud metadata address among them), multicast, and the reserved
- * and documentation ranges; in IPv6 also the IPv4-compatible range, Teredo and NAT64's local-use
- * prefix. An IPv4-mapped IPv6 address is checked by its IPv4 rules here; `isPublicAddress` checks
- * the other forms that carry an IPv4 address. Only tests leave IPv4 loopback out.
- */
-export declare function blockedAddresses(options?: {
-    loopback?: boolean;
-}): BlockList;
-/** Whether `net` may connect to an address: an IP address, not blocked, and carrying none that is. */
-export declare function isPublicAddress(address: string, blocked?: BlockList): boolean;
-/**
- * The built-in `net` Actor's `http.egress@1`: a consumer's request, made from the Hub's process to
- * the public internet over HTTPS. The host is resolved and every address checked; the connection
- * goes to the checked address (with the name for SNI and the certificate), so a second resolution
- * can't move it. Redirects come back as they are. Each request's method, host and status are
- * audited; bodies never are.
- */
-export declare class Net {
-    #private;
-    constructor(state: HubState, options?: NetOptions);
-    /** One request, for the consumer's slot. Refusals and failures throw the SDK's errors. */
-    handle(request: Request, by: {
-        consumer: string;
-        slot: string;
-    }): Promise<Response>;
-}

package/dist/node_modules/@agentorg/hub/dist/src/net.js

@@ -1,265 +0,0 @@
-import { lookup as dnsLookup } from "node:dns/promises";
-import { request as httpsRequest } from "node:https";
-import { BlockList, isIP } from "node:net";
-import { Readable } from "node:stream";
-import { pipeline } from "node:stream/promises";
-import { rootCertificates } from "node:tls";
-import { OutcomeUnknown, Refused } from "@agentorg/sdk";
-import { ERROR_HEADER } from "@agentorg/sdk/http";
-import { NET } from "./state.js";
-/**
- * Addresses that aren't the public internet: unspecified, loopback, private (RFC 1918, ULA),
- * shared (CGNAT), link-local (the cloud metadata address among them), multicast, and the reserved
- * and documentation ranges; in IPv6 also the IPv4-compatible range, Teredo and NAT64's local-use
- * prefix. An IPv4-mapped IPv6 address is checked by its IPv4 rules here; `isPublicAddress` checks
- * the other forms that carry an IPv4 address. Only tests leave IPv4 loopback out.
- */
-export function blockedAddresses(options = {}) {
-    const blocked = new BlockList();
-    for (const [network, prefix] of [
-        ["0.0.0.0", 8],
-        ["10.0.0.0", 8],
-        ["100.64.0.0", 10],
-        ["127.0.0.0", 8],
-        ["169.254.0.0", 16],
-        ["172.16.0.0", 12],
-        ["192.0.0.0", 24],
-        ["192.0.2.0", 24],
-        ["192.168.0.0", 16],
-        ["198.18.0.0", 15],
-        ["198.51.100.0", 24],
-        ["203.0.113.0", 24],
-        ["224.0.0.0", 4],
-        ["240.0.0.0", 4],
-    ])
-        if (options.loopback !== false || network !== "127.0.0.0")
-            blocked.addSubnet(network, prefix, "ipv4");
-    for (const [network, prefix] of [
-        // IPv4-compatible (deprecated), with :: and ::1 in it.
-        ["::", 96],
-        ["64:ff9b:1::", 48],
-        ["100::", 64],
-        ["2001::", 32],
-        ["2001:db8::", 32],
-        ["fc00::", 7],
-        ["fe80::", 10],
-        ["fec0::", 10],
-        ["ff00::", 8],
-    ])
-        blocked.addSubnet(network, prefix, "ipv6");
-    return blocked;
-}
-/** An IPv6 address's eight 16-bit groups; a zone and a dotted IPv4 tail are understood. */
-function groupsOf(address) {
-    let text = address.toLowerCase().split("%")[0] ?? "";
-    const dotted = /(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(text);
-    if (dotted) {
-        const [a, b, c, d] = dotted.slice(1).map(Number);
-        text = `${text.slice(0, dotted.index)}${((a << 8) | b).toString(16)}:${((c << 8) | d).toString(16)}`;
-    }
-    const [head = "", tail] = text.split("::");
-    const left = head ? head.split(":") : [];
-    const right = tail ? tail.split(":") : [];
-    const fill = tail === undefined ? 0 : 8 - left.length - right.length;
-    const groups = [...left, ...Array(Math.max(fill, 0)).fill("0"), ...right];
-    return groups.length === 8 ? groups.map((group) => Number.parseInt(group, 16)) : undefined;
-}
-/**
- * The IPv4 address an IPv6 address carries, in the forms that reach it: NAT64's well-known
- * prefix (64:ff9b::/96), IPv4-translated (::ffff:0:0:0/96) and 6to4 (2002::/16).
- */
-function carriedIPv4(address) {
-    const g = groupsOf(address);
-    if (!g)
-        return undefined;
-    const v4 = (high, low) => `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
-    const zero = (from, to) => g.slice(from, to).every((x) => x === 0);
-    if (g[0] === 0x64 && g[1] === 0xff9b && zero(2, 6))
-        return v4(g[6] ?? 0, g[7] ?? 0);
-    if (zero(0, 4) && g[4] === 0xffff && g[5] === 0)
-        return v4(g[6] ?? 0, g[7] ?? 0);
-    if (g[0] === 0x2002)
-        return v4(g[1] ?? 0, g[2] ?? 0);
-    return undefined;
-}
-/** Whether `net` may connect to an address: an IP address, not blocked, and carrying none that is. */
-export function isPublicAddress(address, blocked = blockedAddresses()) {
-    const family = isIP(address);
-    if (family === 0)
-        return false;
-    if (blocked.check(address, family === 6 ? "ipv6" : "ipv4"))
-        return false;
-    const carried = family === 6 ? carriedIPv4(address) : undefined;
-    return !carried || !blocked.check(carried, "ipv4");
-}
-/** Headers that describe one hop, not the message. */
-const HOP = new Set([
-    "connection",
-    "keep-alive",
-    "transfer-encoding",
-    "te",
-    "trailer",
-    "upgrade",
-    "proxy-authenticate",
-    "proxy-authorization",
-    "proxy-connection",
-    "host",
-]);
-/**
- * An upstream response's headers for the consumer: hop-by-hop ones dropped, and the SDK's error
- * header too, so no server out there can make the consumer's fetch throw.
- */
-function responseHeaders(raw) {
-    const headers = new Headers();
-    for (const [name, value] of Object.entries(raw)) {
-        const lower = name.toLowerCase();
-        if (HOP.has(lower) || lower === ERROR_HEADER)
-            continue;
-        if (Array.isArray(value))
-            for (const one of value)
-                headers.append(name, one);
-        else if (value !== undefined)
-            headers.set(name, value);
-    }
-    return headers;
-}
-/**
- * The built-in `net` Actor's `http.egress@1`: a consumer's request, made from the Hub's process to
- * the public internet over HTTPS. The host is resolved and every address checked; the connection
- * goes to the checked address (with the name for SNI and the certificate), so a second resolution
- * can't move it. Redirects come back as they are. Each request's method, host and status are
- * audited; bodies never are.
- */
-export class Net {
-    #state;
-    #lookup;
-    #ca;
-    #idleMs;
-    #blocked;
-    constructor(state, options = {}) {
-        this.#state = state;
-        this.#lookup = options.lookup ?? ((host) => dnsLookup(host, { all: true, verbatim: true }));
-        this.#ca = options.ca ? [...rootCertificates, options.ca] : undefined;
-        this.#idleMs = options.idleMs ?? 5 * 60_000;
-        this.#blocked = options.blocked ?? blockedAddresses();
-    }
-    /** One request, for the consumer's slot. Refusals and failures throw the SDK's errors. */
-    async handle(request, by) {
-        const url = new URL(request.url);
-        const audit = (outcome) => {
-            try {
-                this.#state.auditHub("net.request", { ...by, method: request.method, host: url.host, ...outcome }, NET);
-            }
-            catch {
-                // The state is closed: the Hub is shutting down.
-            }
-        };
-        try {
-            const response = await this.#send(request, url);
-            audit({ status: response.status });
-            return response;
-        }
-        catch (error) {
-            audit({ error: error instanceof Refused ? error.code : error.name });
-            throw error;
-        }
-    }
-    async #send(request, url) {
-        if (url.protocol !== "https:")
-            throw new Refused("forbidden", `net reaches only https: URLs, not ${url.protocol}.`);
-        const host = url.hostname.replace(/^\[|\]$/g, "");
-        let addresses;
-        if (isIP(host))
-            addresses = [{ address: host, family: isIP(host) }];
-        else
-            try {
-                addresses = await this.#lookup(host);
-            }
-            catch {
-                throw new Refused("unreachable", `${host} doesn't resolve.`);
-            }
-        if (!addresses.length)
-            throw new Refused("unreachable", `${host} doesn't resolve.`);
-        for (const { address } of addresses)
-            if (!isPublicAddress(address, this.#blocked))
-                throw new Refused("forbidden", `${host} is at ${address}, which isn't on the public internet.`);
-        const target = addresses[0];
-        const sendsBody = Boolean(request.body) && request.method !== "GET" && request.method !== "HEAD";
-        const headers = {};
-        request.headers.forEach((value, name) => {
-            if (HOP.has(name) || name === "set-cookie")
-                return;
-            // The length comes from the body net sends, which is none for GET and HEAD.
-            if (name === "content-length" || name === "expect")
-                return;
-            headers[name] = value;
-        });
-        headers.host = url.host;
-        return new Promise((resolve, reject) => {
-            /** Whether anything may have reached the server: from the TLS handshake on. */
-            let connected = false;
-            const options = {
-                host,
-                port: Number(url.port || 443),
-                path: `${url.pathname}${url.search}`,
-                method: request.method,
-                headers,
-                agent: false,
-                ...(this.#ca ? { ca: this.#ca } : {}),
-                // Every address was checked: the connection goes to one of them (node falls back between
-                // them), never to a new lookup.
-                lookup: (_name, options, callback) => {
-                    if (options.all)
-                        callback(null, addresses);
-                    else
-                        callback(null, target.address, target.family);
-                },
-            };
-            const outgoing = httpsRequest(options, (incoming) => {
-                const status = incoming.statusCode ?? 0;
-                // Whatever a server out there answers, it ends as a response or an error, never a throw
-                // in this process.
-                try {
-                    if (status < 200 || status > 599)
-                        throw new Error(`a status of ${status}`);
-                    const empty = request.method === "HEAD" || status === 204 || status === 205 || status === 304;
-                    const response = new Response(empty ? null : Readable.toWeb(incoming), {
-                        status,
-                        statusText: incoming.statusMessage ?? "",
-                        headers: responseHeaders(incoming.headers),
-                    });
-                    if (empty)
-                        incoming.resume();
-                    resolve(response);
-                }
-                catch (error) {
-                    incoming.destroy();
-                    reject(new OutcomeUnknown(`${url.host} answered what isn't an HTTP response net passes on: ${error.message}`));
-                }
-            });
-            // An upgrade nobody asked for: the request had reached the server.
-            outgoing.on("upgrade", (_response, socket) => {
-                socket.destroy();
-                reject(new OutcomeUnknown(`${url.host} switched protocols, which net doesn't follow.`));
-            });
-            outgoing.on("socket", (socket) => socket.once("secureConnect", () => (connected = true)));
-            // Before the TLS handshake is done nothing has been sent, so a quiet server is unreachable.
-            outgoing.setTimeout(this.#idleMs, () => outgoing.destroy(connected
-                ? new OutcomeUnknown(`${url.host} sent nothing for ${this.#idleMs / 1000} s.`)
-                : new Refused("unreachable", `${url.host} didn't finish connecting within ${this.#idleMs / 1000} s.`)));
-            outgoing.on("error", (error) => reject(error instanceof OutcomeUnknown || error instanceof Refused
-                ? error
-                : connected
-                    ? new OutcomeUnknown(`The request to ${url.host} failed: ${error.message}`)
-                    : new Refused("unreachable", `${url.host} couldn't be reached: ${error.message}`)));
-            const abort = () => outgoing.destroy(request.signal.reason ?? new Error("aborted"));
-            if (request.signal.aborted)
-                return abort();
-            request.signal.addEventListener("abort", abort, { once: true });
-            outgoing.once("close", () => request.signal.removeEventListener("abort", abort));
-            if (!sendsBody || !request.body)
-                return void outgoing.end();
-            pipeline(Readable.fromWeb(request.body), outgoing).catch((error) => outgoing.destroy(error));
-        });
-    }
-}