@poe-platform/safe-bash 0.1.802 → 0.1.804

package/dist/remote-execution/effects.js

@@ -1,357 +0,0 @@
-import { createFileServer } from './files.js';
-import { inspectOutputTree, retrieveOutputs } from './output-retrieval.js';
-import { UploadError } from './upload-protocol.js';
-// Reversible byte spelling for the shared projector. It is never a host path.
-function spelling(bytes) {
-    for (const byte of bytes)
-        if (!Number.isInteger(byte) || byte < 1 || byte > 255)
-            throw new TypeError('Invalid output byte path');
-    return bytes.map(byte => String.fromCharCode(byte)).join('');
-}
-function bytePath(path) { return Array.from(path, char => char.charCodeAt(0)); }
-/** Invocation-local effect authority, populated by actual settled native IO,
- * never by directory enumeration or guessed output operands. Retains must be
- * independently owned; closing native descriptors must not invalidate retrieval.
- * A retain preserves identity, not an immutable content snapshot. */
-export function createEffectStore(options) {
-    options = { ...options };
-    if (!Number.isSafeInteger(options.maxEffects) || options.maxEffects < 1)
-        throw new TypeError('Invalid effect bound');
-    const effects = [];
-    const produced = new Set();
-    const resources = new Map();
-    const retrievalFailures = new Map();
-    const handles = new Map();
-    const scope = { tenantId: crypto.randomUUID(), sessionId: crypto.randomUUID(), epoch: crypto.randomUUID(), invocationId: crypto.randomUUID() };
-    let native = { state: 'running' };
-    let closed = false;
-    let retiring;
-    let started = false;
-    const lifetime = new AbortController();
-    const replayIdentity = Object.freeze({});
-    let reservations = 0;
-    const files = createFileServer({ maxHandles: options.maxEffects, maxFrameBytes: options.maxFrameBytes, async open(_scope, input) {
-            const resource = resources.get(input.path);
-            if (!resource)
-                throw new Error('Unknown effect object');
-            return resource;
-        } });
-    function check() { if (closed)
-        throw new Error('Effect retention closed'); }
-    function handle(object) {
-        check();
-        // Retention alone also covers write-capable opens of untouched inputs.
-        // Only settled invocation effects grant output retrieval membership.
-        if (!produced.has(object))
-            throw new Error('Not an invocation output');
-        if (!resources.has(object))
-            throw new Error('Output retrieval unavailable');
-        let value = handles.get(object);
-        if (!value) {
-            value = files.open(scope, { namespaceId: 'effects', path: object }, new AbortController().signal);
-            handles.set(object, value);
-        }
-        return value;
-    }
-    function inspect() {
-        check();
-        // A write-capable open can retain a prior file without ever changing it.
-        // Only actual settled effects establish output membership.
-        const outputs = [...produced].filter(object => resources.has(object) || retrievalFailures.has(object));
-        return structuredClone({ effects, native, outputs, ...(retrievalFailures.size ? { retrievalFailures: [...retrievalFailures].map(([object, error]) => ({ object, error })) } : {}) });
-    }
-    function outputManifest(snapshot) {
-        return {
-            jobId: scope.invocationId, outputs: snapshot.outputs.filter(object => resources.has(object)), effectBarrier: String(snapshot.effects.length), outputComplete: snapshot.native.state !== 'running',
-            effects: snapshot.effects.flatMap(effect => {
-                if (effect.operation === 'rename') {
-                    if (effect.moved === false)
-                        return [];
-                }
-                return [{ operationId: String(effect.sequence), sequence: String(effect.sequence), operation: effect.operation, state: effect.operation === 'rename' && effect.moved !== true ? 'unknown' : 'applied', namespaceId: 'effects',
-                        ...(effect.count === undefined ? {} : { acknowledgedBytes: String(effect.count) }),
-                        ...(effect.path ? { path: spelling(effect.path) } : {}), ...(effect.destination ? { destination: spelling(effect.destination) } : {}), ...(effect.object ? { identityId: effect.object } : {}) }];
-            }),
-        };
-    }
-    return {
-        inspect,
-        inspectTree(logicalRoot) {
-            const snapshot = inspect();
-            const tree = inspectOutputTree(outputManifest(snapshot), spelling(logicalRoot));
-            return { manifest: snapshot,
-                files: tree.files.map(file => ({ path: bytePath(file.path), relativePath: bytePath(file.relativePath), object: file.identityId })),
-                directories: tree.directories.map(directory => ({ path: bytePath(directory.path), relativePath: bytePath(directory.relativePath) })),
-                retainedIdentities: tree.retainedIdentities, detachedIdentities: tree.detachedIdentities, unlocatedIdentities: tree.unlocatedIdentities,
-                unavailablePaths: tree.unavailablePaths.map(file => ({ path: bytePath(file.path), relativePath: bytePath(file.relativePath) })),
-                unresolvedEffects: tree.unresolvedEffects,
-            };
-        },
-        assertCapacity() { check(); if (effects.length + reservations >= options.maxEffects)
-            throw new Error('Effect receipt capacity'); },
-        /** Reserve a receipt before awaiting a canonical mutation. Release on every
-         * outcome; a failed operation does not consume a settled-effect slot. */
-        reserve(bytes = 0) {
-            check();
-            if (effects.length + reservations >= options.maxEffects)
-                throw new Error('Effect receipt capacity');
-            if (!Number.isSafeInteger(bytes) || bytes < 0 || bytes > options.maxFrameBytes)
-                throw new TypeError('Effect receipt byte limit');
-            reservations++;
-            let released = false;
-            return () => { if (!released) {
-                released = true;
-                reservations--;
-            } };
-        },
-        record(effect) {
-            check();
-            if (effects.length >= options.maxEffects)
-                throw new Error('Effect receipt capacity');
-            // Observe structural receipts once and own their byte arrays before
-            // validation. Re-reading accessors could retain different bytes from
-            // those admitted, or change output membership after settlement.
-            effect = structuredClone(effect);
-            for (const path of [effect.path, effect.destination, effect.target])
-                if (path && (!path.length || path.includes(0) || path.some(n => !Number.isInteger(n) || n < 0 || n > 255)))
-                    throw new TypeError('Invalid effect path');
-            if (effect.operation === 'write' || effect.operation === 'append' || effect.bytes !== undefined || effect.count !== undefined) {
-                if (!Array.isArray(effect.bytes) || effect.bytes.length > options.maxFrameBytes
-                    || !Number.isSafeInteger(effect.count) || effect.count !== effect.bytes.length)
-                    throw new TypeError('Invalid settled effect bytes');
-                for (const byte of effect.bytes)
-                    if (!Number.isInteger(byte) || byte < 0 || byte > 255)
-                        throw new TypeError('Invalid settled effect bytes');
-            }
-            effects.push({ ...effect, sequence: effects.length });
-            if (effect.object && effect.operation !== 'open'
-                && !(effect.operation === 'rename' && effect.moved === false)
-                && !((effect.operation === 'write' || effect.operation === 'append') && effect.count === 0))
-                produced.add(effect.object);
-        },
-        retain(object, resource) {
-            check();
-            if (!object || resources.has(object) || resources.size >= options.maxEffects)
-                throw new Error('Effect retain conflict or capacity');
-            // Retrieval opens lazily. Pin the admitted capability now so mutation of
-            // its public method table cannot redirect reads or replace owned cleanup.
-            // Bound receivers still observe live canonical contents, not snapshots.
-            resources.set(object, Object.freeze({
-                identity: resource.identity, freshness: resource.freshness?.bind(resource),
-                stat: resource.stat.bind(resource), read: resource.read.bind(resource),
-                close: resource.close.bind(resource),
-            }));
-        },
-        failRetrieval(object, error) { check(); retrievalFailures.set(object, error instanceof Error ? error.message : String(error)); },
-        settle(result) {
-            check();
-            if (result.state === 'running' && started)
-                throw new Error('Effect invocation already started');
-            if (native.state !== 'running')
-                throw new Error('Native settlement already recorded');
-            started = true;
-            native = structuredClone(result);
-        },
-        /** Obtain a host-qualified content version for direct range-download resume.
-         * Preserve this capability across interruption; a retain alone cannot prove
-         * that an acknowledged prefix still belongs to the current content. */
-        async freshness(object, signal) {
-            return files.freshness(scope, await handle(object), signal);
-        },
-        async stat(object, signal, freshness) { return files.stat(scope, await handle(object), signal, freshness); },
-        /** Optional freshness must originate from this store and this retained file.
-         * Guarded reads fail when the content changes, including after interruption. */
-        download(object, start, end, signal = new AbortController().signal, freshness) {
-            check();
-            if (typeof start !== 'bigint' || typeof end !== 'bigint' || start < 0n || end < start || end > 9223372036854775807n)
-                throw new UploadError(416, 'Unrepresentable file range');
-            signal.throwIfAborted();
-            let reader;
-            let position = start;
-            const abort = new AbortController();
-            const combined = AbortSignal.any([signal, abort.signal, lifetime.signal]);
-            let finished = false;
-            let pulling = false;
-            let target;
-            const release = () => { reader?.releaseLock(); reader = undefined; };
-            const finish = () => { finished = true; combined.removeEventListener('abort', cancelled); };
-            const cancelled = () => {
-                if (finished)
-                    return;
-                finish();
-                target.error(combined.reason);
-                if (!pulling)
-                    release();
-            };
-            return new ReadableStream({
-                start(controller) {
-                    target = controller;
-                    combined.addEventListener('abort', cancelled, { once: true });
-                    if (combined.aborted)
-                        cancelled();
-                },
-                async pull(controller) {
-                    if (finished)
-                        return;
-                    pulling = true;
-                    try {
-                        combined.throwIfAborted();
-                        reader ??= files.stream(scope, await handle(object), start, end, combined, freshness).getReader();
-                        const part = await reader.read();
-                        if (part.done) {
-                            reader.releaseLock();
-                            reader = undefined;
-                            if (position !== end)
-                                throw new Error('Output range interrupted');
-                            finish();
-                            controller.close();
-                        }
-                        else {
-                            position += BigInt(part.value.length);
-                            controller.enqueue(part.value);
-                        }
-                    }
-                    catch (error) {
-                        if (!finished) {
-                            finish();
-                            controller.error(error);
-                        }
-                    }
-                    finally {
-                        pulling = false;
-                        if (finished)
-                            release();
-                    }
-                },
-                async cancel(reason) { finish(); const cancellation = reader?.cancel(reason); abort.abort(reason); await cancellation; if (!pulling)
-                    release(); },
-            }, { highWaterMark: 0 });
-        },
-        /** Replay ordered settled receipts. Preserve the returned cursor for bound
-         * resume. Legacy numeric offsets leave prefix ownership to the caller. */
-        async reconstruct(destination, progress = 0, signal) {
-            check();
-            const cursor = typeof progress === 'number' ? { nextSequence: progress } : progress;
-            let nextSequence = cursor.nextSequence;
-            signal = signal ? AbortSignal.any([signal, lifetime.signal]) : lifetime.signal;
-            const snapshot = inspect();
-            try {
-                if (!Number.isSafeInteger(nextSequence) || nextSequence < 0 || nextSequence > snapshot.effects.length)
-                    throw new TypeError('Invalid effect cursor');
-                const identity = destination.identity ?? destination;
-                if ((typeof identity !== 'object' || identity === null) && typeof identity !== 'symbol')
-                    throw new TypeError('Invalid effect destination identity');
-                if (typeof progress !== 'number' && (cursor.invocation !== undefined || nextSequence > 0)
-                    && cursor.invocation !== replayIdentity)
-                    throw new Error('Effect resume cursor belongs to another invocation or has no invocation binding');
-                if (typeof progress !== 'number' && (cursor.destination !== undefined || nextSequence > 0)
-                    && cursor.destination !== identity)
-                    throw new Error('Effect resume cursor belongs to another destination or has no destination binding');
-                const apply = destination.apply.bind(destination);
-                cursor.invocation = replayIdentity;
-                cursor.destination = identity;
-                for (; nextSequence < snapshot.effects.length; cursor.nextSequence = ++nextSequence) {
-                    check();
-                    signal?.throwIfAborted();
-                    const effect = snapshot.effects[nextSequence];
-                    if (effect.operation === 'open')
-                        continue;
-                    if (effect.operation === 'rename') {
-                        if (effect.moved === false)
-                            continue;
-                        if (effect.moved !== true)
-                            throw new Error('Canonical rename outcome unavailable');
-                    }
-                    await apply(structuredClone(effect), signal);
-                }
-                signal.throwIfAborted();
-                return { manifest: snapshot, native: snapshot.native, transfer: { state: 'complete', nextSequence, cursor } };
-            }
-            catch (error) {
-                return { manifest: snapshot, native: snapshot.native, transfer: { state: 'failed', nextSequence, cursor, error } };
-            }
-        },
-        /** Copy the surviving invocation-produced tree, even after native failure.
-         * This does not replay mutations onto the live canonical execution tree.
-         * Retained content remains live; resume requires unchanged source content. */
-        async retrieve(logicalRoot, destination, cursor = { completed: new Set(), offsets: new Map() }, signal) {
-            const snapshot = inspect();
-            signal = signal ? AbortSignal.any([signal, lifetime.signal]) : lifetime.signal;
-            try {
-                // Admit destination authority before retained IO can await host work.
-                // Method replacement must not redirect an acknowledged transfer suffix.
-                const mkdir = destination.mkdir.bind(destination);
-                const open = destination.open.bind(destination);
-                const identity = destination.identity ?? destination;
-                const manifest = outputManifest(snapshot);
-                const guards = new Map();
-                const result = await retrieveOutputs(manifest, spelling(logicalRoot), {
-                    async freshness(object, signal) {
-                        const guard = await files.freshness(scope, await handle(object), signal);
-                        if (guard)
-                            guards.set(object, guard);
-                        return guard;
-                    },
-                    async metadata(object, signal) { return files.stat(scope, await handle(object), signal, guards.get(object)); },
-                    async range(object, start, signal = new AbortController().signal) {
-                        const id = await handle(object);
-                        const guard = guards.get(object);
-                        const metadata = await files.stat(scope, id, signal, guard);
-                        return files.stream(scope, id, start, BigInt(metadata.size), signal, guard);
-                    },
-                }, {
-                    identity,
-                    mkdir(path, signal) { check(); return mkdir(Uint8Array.from(path, char => char.charCodeAt(0)), signal); },
-                    async open(path, metadata, signal) {
-                        check();
-                        const file = await open(Uint8Array.from(path, char => char.charCodeAt(0)), metadata, signal);
-                        // Own the acquired destination before fallible method admission.
-                        // Getters can fail or replace its public cleanup method; retire the
-                        // acquired capability without touching settled canonical effects.
-                        const close = file.close.bind(file);
-                        try {
-                            const write = file.write.bind(file);
-                            const truncate = file.truncate.bind(file);
-                            return {
-                                write(position, bytes, signal) { check(); return write(position, bytes, signal); },
-                                truncate(size, signal) { check(); return truncate(size, signal); },
-                                close,
-                            };
-                        }
-                        catch (error) {
-                            try {
-                                await close();
-                            }
-                            catch (cleanup) {
-                                throw new AggregateError([error, cleanup], 'Output destination admission cleanup failed', { cause: error });
-                            }
-                            throw error;
-                        }
-                    },
-                }, cursor, signal, { maxFrameBytes: options.maxFrameBytes });
-                return { manifest: snapshot, native: snapshot.native, transfer: result.transfer };
-            }
-            catch (error) {
-                return { manifest: snapshot, native: snapshot.native, transfer: { state: 'failed', error, cursor } };
-            }
-        },
-        close() {
-            if (retiring)
-                return retiring;
-            closed = true;
-            // Canonical cancellation listeners may synchronously reenter close.
-            // Publish their shared drain before notifying any retained consumer.
-            retiring = Promise.resolve().then(async () => {
-                await Promise.allSettled([...handles.values()]);
-                const results = await Promise.allSettled([files.disposeAll(), ...[...resources].filter(([object]) => !handles.has(object)).map(([, resource]) => Promise.resolve().then(() => resource.close()))]);
-                resources.clear();
-                handles.clear();
-                const failures = results.filter(result => result.status === 'rejected');
-                if (failures.length)
-                    throw new AggregateError(failures.map(result => result.reason), 'Effect retain cleanup failed');
-            });
-            lifetime.abort(new Error('Effect retention closed'));
-            return retiring;
-        },
-    };
-}

package/dist/remote-execution/endpoint.js

@@ -1,224 +0,0 @@
-export class EndpointCapabilityGap extends Error {
-    constructor() { super('No admitted endpoint transport matches the native request and context'); this.name = 'EndpointCapabilityGap'; }
-}
-function sameContext(a, b) {
-    return ['network', 'dns', 'proxy', 'bind', 'tls', 'certificates'].every(key => typeof a[key] === 'string' && a[key].length > 0 && a[key] === b[key]);
-}
-function ownOptions(options) {
-    if (!Array.isArray(options))
-        throw new EndpointCapabilityGap();
-    // Native options are indexed, ordered entries. An array's custom iterator
-    // must neither replace their bytes nor silently omit unqualified options.
-    return Array.from({ length: options.length }, (_, index) => {
-        if (!Object.hasOwn(options, index))
-            throw new EndpointCapabilityGap();
-        const option = options[index];
-        if (option === null || typeof option !== 'object')
-            throw new EndpointCapabilityGap();
-        const { name, value } = option;
-        if (!(name instanceof Uint8Array) || !(value instanceof Uint8Array))
-            throw new EndpointCapabilityGap();
-        return { name: new Uint8Array(name), value: new Uint8Array(value) };
-    });
-}
-/** Creating access is inert. Call open only from the actual native socket stage,
- * including each redirect/reload/key/seek/retry open; never for discovery hints.
- * Native owns HTTP semantics and retry policy. Provider failures propagate once. */
-export function createEndpointAccess(config) {
-    // Admission belongs to this access instance. Caller mutations must not widen
-    // qualification, change endpoint context, or authorize another relay later.
-    const sandbox = { ...config.sandbox };
-    // Missing context cannot decide whether localhost denotes the sandbox or the
-    // caller. Define every context component before selecting either route.
-    if (!sameContext(sandbox, sandbox))
-        throw new EndpointCapabilityGap();
-    const declaredRelays = config.admittedRelays;
-    if (declaredRelays !== undefined && !Array.isArray(declaredRelays)) {
-        throw new TypeError('Relay admission must be an array of nonempty provider identities');
-    }
-    const relayIdentities = Array.from({ length: declaredRelays?.length ?? 0 }, (_, index) => declaredRelays && Object.hasOwn(declaredRelays, index) ? declaredRelays[index] : undefined);
-    if (relayIdentities.some(id => typeof id !== 'string' || !id.length)) {
-        throw new TypeError('Relay admission must be an array of nonempty provider identities');
-    }
-    const admittedRelays = new Set(relayIdentities);
-    const identities = new Set();
-    const declaredProviders = config.providers;
-    if (!Array.isArray(declaredProviders))
-        throw new EndpointCapabilityGap();
-    const providers = Array.from({ length: declaredProviders.length }, (_, index) => {
-        if (!Object.hasOwn(declaredProviders, index))
-            throw new EndpointCapabilityGap();
-        const provider = declaredProviders[index];
-        const id = provider.id;
-        if (typeof id !== 'string' || !id.length || identities.has(id)) {
-            throw new TypeError('Endpoint provider identities must be nonempty and unique');
-        }
-        identities.add(id);
-        const capabilities = provider.capabilities;
-        if (!Array.isArray(capabilities))
-            throw new EndpointCapabilityGap();
-        return {
-            id,
-            open: provider.open.bind(provider),
-            capabilities: Array.from({ length: capabilities.length }, (_, index) => {
-                if (!Object.hasOwn(capabilities, index))
-                    throw new EndpointCapabilityGap();
-                const capability = capabilities[index];
-                // Capture accessor-backed receipt fields once, then own those exact
-                // fields. A second read must not substitute a different qualification.
-                const owned = { ...capability };
-                const transports = owned.transports;
-                if (!Array.isArray(transports))
-                    throw new EndpointCapabilityGap();
-                return {
-                    ...owned,
-                    context: { ...owned.context },
-                    transports: Array.from({ length: transports.length }, (_, index) => {
-                        if (!Object.hasOwn(transports, index))
-                            throw new EndpointCapabilityGap();
-                        const transport = transports[index];
-                        const owned = { ...transport };
-                        if (owned.stage !== undefined && (typeof owned.stage !== 'string' || !owned.stage.length)) {
-                            throw new EndpointCapabilityGap();
-                        }
-                        if (owned.endpoint !== undefined && !(owned.endpoint instanceof Uint8Array)) {
-                            throw new EndpointCapabilityGap();
-                        }
-                        const endpoint = owned.endpoint === undefined ? undefined : new Uint8Array(owned.endpoint);
-                        if (endpoint !== undefined && !endpoint.length)
-                            throw new EndpointCapabilityGap();
-                        return { ...owned,
-                            endpoint,
-                            options: owned.options === undefined ? undefined : ownOptions(owned.options) };
-                    }),
-                    // Iterability alone is not receipt admission: strings would otherwise
-                    // become nonempty character receipts and falsely qualify a transport.
-                    evidence: Array.isArray(owned.evidence) ? Array.from({ length: owned.evidence.length }, (_, index) => Object.hasOwn(owned.evidence, index) ? owned.evidence[index] : undefined) : [],
-                };
-            }),
-        };
-    });
-    const pending = new Set();
-    const leases = new Set();
-    const shutdown = new AbortController();
-    let closing;
-    async function acquire(request) {
-        if (closing)
-            throw new Error('Endpoint access is retiring');
-        // Qualify and dispatch the same owned request. Accessors or later caller
-        // mutation cannot substitute an unqualified protocol/build/context.
-        request = { ...request };
-        if (!(request.endpoint instanceof Uint8Array)
-            || !Array.isArray(request.options))
-            throw new EndpointCapabilityGap();
-        const endpoint = new Uint8Array(request.endpoint);
-        if (!endpoint.length)
-            throw new EndpointCapabilityGap();
-        const options = ownOptions(request.options);
-        request = {
-            ...request, context: { ...request.context }, endpoint,
-            options,
-        };
-        if (typeof request.stage !== 'string' || !request.stage.length
-            || typeof request.protocol !== 'string' || !request.protocol.length
-            || !['stream', 'datagram'].includes(request.semantics)
-            || !['connect', 'bind', 'listen', 'multicast'].includes(request.operation))
-            throw new EndpointCapabilityGap();
-        const signal = request.signal ? AbortSignal.any([request.signal, shutdown.signal]) : shutdown.signal;
-        request = { ...request, signal };
-        signal.throwIfAborted();
-        const route = sameContext(request.context, sandbox) ? 'direct' : 'relay';
-        for (const provider of providers) {
-            if (route === 'relay' && !admittedRelays.has(provider.id))
-                continue;
-            const capability = provider.capabilities.find(c => c.route === route
-                && typeof request.buildDigest === 'string' && request.buildDigest.length > 0
-                && c.buildDigest === request.buildDigest
-                && c.evidence.length > 0 && c.evidence.every(e => typeof e === 'string' && e.length > 0)
-                && sameContext(c.context, request.context)
-                && c.transports.some(t => t.protocol === request.protocol
-                    && t.semantics === request.semantics && t.operation === request.operation
-                    && (t.stage === undefined || t.stage === request.stage)
-                    && (t.endpoint === undefined || (t.endpoint.length === request.endpoint.length
-                        && t.endpoint.every((byte, offset) => byte === request.endpoint[offset])))
-                    && (t.options?.length ?? 0) === request.options.length
-                    && request.options.every((option, index) => {
-                        const qualified = t.options?.[index];
-                        return qualified !== undefined
-                            && option.name.length === qualified.name.length
-                            && option.value.length === qualified.value.length
-                            && option.name.every((byte, offset) => byte === qualified.name[offset])
-                            && option.value.every((byte, offset) => byte === qualified.value[offset]);
-                    })));
-            if (!capability)
-                continue;
-            const nativeLease = await provider.open({ route, request });
-            const retire = nativeLease?.close;
-            if (typeof retire !== 'function')
-                throw new TypeError('Endpoint provider must return a retireable transport lease');
-            let retirement;
-            const lease = {
-                close() {
-                    signal?.removeEventListener('abort', cancel);
-                    if (!retirement) {
-                        retirement = Promise.resolve().then(() => retire.call(nativeLease));
-                        // Successful retirement releases ownership. Failed retirement is
-                        // retained so invocation cleanup cannot report false completion.
-                        void retirement.then(() => leases.delete(lease), () => { });
-                    }
-                    return retirement;
-                },
-            };
-            // Abort listeners cannot return an awaitable cleanup result. Observe it
-            // here; explicit close still returns the original retirement outcome.
-            const cancel = () => { void lease.close().catch(() => { }); };
-            leases.add(lease);
-            signal?.addEventListener('abort', cancel, { once: true });
-            if (signal?.aborted) {
-                const cleanup = await Promise.allSettled([Promise.resolve().then(() => lease.close())]);
-                if (cleanup[0].status === 'rejected')
-                    throw new AggregateError([signal.reason, cleanup[0].reason], 'Endpoint cancellation cleanup failed');
-                signal.throwIfAborted();
-            }
-            if (closing) {
-                await lease.close();
-                throw new Error('Endpoint access is retiring');
-            }
-            return lease;
-        }
-        throw new EndpointCapabilityGap();
-    }
-    return {
-        open(request) {
-            if (closing)
-                return Promise.reject(new Error('Endpoint access is retiring'));
-            // Register acquisition before provider code can reenter retirement.
-            let resolve;
-            let reject;
-            const work = new Promise((settled, failed) => { resolve = settled; reject = failed; });
-            pending.add(work);
-            void work.then(() => pending.delete(work), () => pending.delete(work));
-            void acquire(request).then(resolve, reject);
-            return work;
-        },
-        close() {
-            closing ??= Promise.resolve().then(async () => {
-                // Established listeners/streams can release pending acquisition work.
-                // Start their retirement while draining acquisitions, not afterwards.
-                await Promise.allSettled([...pending, ...[...leases].map(lease => lease.close())]);
-                // Late acquisitions retire themselves. Retained leases here include
-                // every failed retirement; close returns the original outcome once.
-                const results = await Promise.allSettled([...leases].map(lease => lease.close()));
-                const failures = results.filter((result) => result.status === 'rejected');
-                if (failures.length)
-                    throw new AggregateError(failures.map(result => result.reason), 'Endpoint access retirement failed');
-            });
-            // Publish retirement before notifying providers: cancellation listeners
-            // can synchronously reenter close. Pending DNS/connect/listen work must
-            // settle on this signal even when the caller supplied no cancellation.
-            shutdown.abort(new Error('Endpoint access is retiring'));
-            void closing.catch(() => { });
-            return closing;
-        },
-    };
-}