@twinsearth/w2m-dsh-plugin 2.0.7 → 2.0.9

package/src/agent/crypto.mjs

@@ -53,6 +53,8 @@ import {
   randomBytes,
   timingSafeEqual,
 } from 'node:crypto';
+
+import { jsOpen, jsSeal } from './chacha.mjs';
 import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { blake2s256 as blake2s256Js } from './blake2s.mjs';
@@ -758,6 +760,57 @@ export function derive(ikm, label, length = KEY_BYTES) {
  *
  * @returns {{ ok: boolean, missing: string[], present: string[], node: string, detail: string }}
  */
+/** Wrap a cipher construction so an OpenSSL "Unknown cipher" carries WHO/WHAT, not just the text. */
+function cipherContextError(kind, cipherName, error, context = {}) {
+  const wrapped = new Error('P2P_CIPHER_UNAVAILABLE: ' + kind + ' ' + cipherName + ' failed: ' + (error?.message ?? String(error)));
+  wrapped.code = 'P2P_CIPHER_UNAVAILABLE';
+  wrapped.detail = {
+    cipher: cipherName,
+    suite: typeof context.suite === 'string' ? context.suite : 'w2m-p2p-v1',
+    peerKey: typeof context.peerKey === 'string' ? context.peerKey : null,
+    keyLength: context.keyLength ?? null,
+    ivLength: context.ivLength ?? null,
+    openssl: error?.message ?? String(error),
+    node: process.version,
+  };
+  wrapped.cause = error;
+  return wrapped;
+}
+function createCipherContext(name, key, iv, options, context = {}) {
+  try { return createCipheriv(name, key, iv, options); } catch (error) { throw cipherContextError('encrypt', name, error, { ...context, keyLength: key?.length, ivLength: iv?.length }); }
+}
+function createDecipherContext(name, key, iv, options, context = {}) {
+  try { return createDecipheriv(name, key, iv, options); } catch (error) { throw cipherContextError('decrypt', name, error, { ...context, keyLength: key?.length, ivLength: iv?.length }); }
+}
+
+
+/** Native ChaCha20-Poly1305 availability (DSH/Electron's BoringSSL may not expose it). */
+let NATIVE_CHACHA = true;
+try {
+  const probeKey = Buffer.alloc(32, 1);
+  const probeCipher = createCipheriv('chacha20-poly1305', probeKey, Buffer.alloc(12), { authTagLength: 16 });
+  probeCipher.final();
+} catch {
+  NATIVE_CHACHA = false;
+}
+export function nativeAeadAvailable() { return NATIVE_CHACHA; }
+function aeadSeal(key, nonce, plaintext, aad = Buffer.alloc(0), context = {}) {
+  if (!NATIVE_CHACHA) return jsSeal(key, nonce, plaintext, aad);
+  const cipher = createCipherContext('chacha20-poly1305', key, nonce, { authTagLength: TAG_BYTES }, { suite: 'w2m-p2p-v1', ...context });
+  if (aad.length > 0) cipher.setAAD(aad);
+  return Buffer.concat([cipher.update(plaintext), cipher.final(), cipher.getAuthTag()]);
+}
+function aeadOpen(key, nonce, sealed, aad = Buffer.alloc(0)) {
+  if (!NATIVE_CHACHA) return jsOpen(key, nonce, sealed, aad);
+  if (!Buffer.isBuffer(sealed) || sealed.length < TAG_BYTES) return null;
+  try {
+    const decipher = createDecipherContext('chacha20-poly1305', key, nonce, { authTagLength: TAG_BYTES }, { suite: 'w2m-p2p-v1' });
+    if (aad.length > 0) decipher.setAAD(aad);
+    decipher.setAuthTag(sealed.subarray(sealed.length - TAG_BYTES));
+    return Buffer.concat([decipher.update(sealed.subarray(0, sealed.length - TAG_BYTES)), decipher.final()]);
+  } catch { return null; }
+}
+
 export function cryptoCapabilities() {
   const present = [];
   const missing = [];
@@ -774,11 +827,11 @@ export function cryptoCapabilities() {
   check('blake2s256', () => blake2s256Support().ok);
   check('sha256', () => createHash('sha256').update('').digest().length === 32);
   check('chacha20-poly1305', () => {
+    // Count the JS fallback as available: what the handshake needs is the AEAD, not OpenSSL's copy.
     const key = randomBytes(32);
-    const cipher = createCipheriv('chacha20-poly1305', key, Buffer.alloc(12), { authTagLength: 16 });
-    cipher.update(Buffer.from('probe'));
-    cipher.final();
-    return cipher.getAuthTag().length === 16;
+    const sealed = aeadSeal(key, Buffer.alloc(12), Buffer.from('probe'));
+    const opened = aeadOpen(key, Buffer.alloc(12), sealed);
+    return sealed.length === 21 && opened !== null && opened.toString('utf8') === 'probe';
   });
   check('hkdf-sha256', () => hkdfSync('sha256', randomBytes(32), Buffer.alloc(0), Buffer.from('probe'), 32).byteLength === 32);
   check('x25519+diffieHellman', () => {
@@ -993,10 +1046,8 @@ export function sessionKeys({ ephemeralShared, initiatorStaticShared, responderS
  * @param {Buffer} message
  * @returns {Buffer} Ciphertext followed by the tag: 48 bytes for a 32-byte message.
  */
-export function sealMac(key, message) {
-  const cipher = createCipheriv('chacha20-poly1305', key, Buffer.alloc(12), { authTagLength: TAG_BYTES });
-  const ciphertext = Buffer.concat([cipher.update(message), cipher.final()]);
-  return Buffer.concat([ciphertext, cipher.getAuthTag()]);
+export function sealMac(key, message, context = {}) {
+  return aeadSeal(key, Buffer.alloc(12), message, Buffer.alloc(0), context);
 }
 
 /**
@@ -1008,13 +1059,7 @@ export function sealMac(key, message) {
  */
 export function openMac(key, sealed) {
   if (!Buffer.isBuffer(sealed) || sealed.length <= TAG_BYTES) return null;
-  try {
-    const decipher = createDecipheriv('chacha20-poly1305', key, Buffer.alloc(12), { authTagLength: TAG_BYTES });
-    decipher.setAuthTag(sealed.subarray(sealed.length - TAG_BYTES));
-    return Buffer.concat([decipher.update(sealed.subarray(0, sealed.length - TAG_BYTES)), decipher.final()]);
-  } catch {
-    return null;
-  }
+  return aeadOpen(key, Buffer.alloc(12), sealed);
 }
 
 /** @param {Buffer} a @param {Buffer} b @returns {boolean} Constant-time comparison. */
@@ -1600,13 +1645,11 @@ export class CryptoSession {
     cipherHeader.writeUInt8(this.sendEpoch & 0xff, 1);
     cipherHeader.writeBigUInt64LE(counter, 2);
 
-    const cipher = createCipheriv('chacha20-poly1305', key, nonceFor(counter), { authTagLength: TAG_BYTES });
     // The frame's own header —kind and session —rides as additional authenticated data. That is
     // what stops an attacker retagging a DATA frame as a BYE, or moving a frame into another session:
     // the tag covers the fields the receiving channel routes on.
-    cipher.setAAD(header);
-    const ciphertext = Buffer.concat([cipher.update(frame.subarray(FRAME_HEADER_BYTES)), cipher.final()]);
-    return Buffer.concat([header, cipherHeader, ciphertext, cipher.getAuthTag()]);
+    const sealed = aeadSeal(key, nonceFor(counter), frame.subarray(FRAME_HEADER_BYTES), header);
+    return Buffer.concat([header, cipherHeader, sealed]);
   }
 
   /**
@@ -1653,16 +1696,8 @@ export class CryptoSession {
     const key = this.receiveKey(isInitiator, epoch);
     if (key === null) return fail(CRYPTO_REASON.EPOCH_TOO_FAR);
 
-    let plaintext;
-    try {
-      const decipher = createDecipheriv('chacha20-poly1305', key, nonceFor(counter), { authTagLength: TAG_BYTES });
-      decipher.setAAD(header);
-      decipher.setAuthTag(body.subarray(body.length - TAG_BYTES));
-      plaintext = Buffer.concat([
-        decipher.update(body.subarray(CIPHER_HEADER_BYTES, body.length - TAG_BYTES)),
-        decipher.final(),
-      ]);
-    } catch {
+    const plaintext = aeadOpen(key, nonceFor(counter), body.subarray(CIPHER_HEADER_BYTES), header);
+    if (plaintext === null) {
       // Authentication failed. The frame is dropped and never processed, and the tag is *not* retried
       // against the other epochs: an attacker who could make us try keys until one verified would
       // have turned a 128-bit tag into a search.

package/src/agent/discovery.mjs

@@ -0,0 +1,81 @@
+/**
+ * W3 discovery seam: providers only produce candidate addresses.
+ *
+ * Current order is relay -> mDNS -> DHT. A candidate is never an authorisation:
+ * the dial path still verifies the peer's static key and the task identity.
+ * Adding a DHT sidecar later means implementing the same `discover(machineId)`
+ * shape; it does not change the transport or the relay.
+ */
+
+export const DISCOVERY_SOURCE = Object.freeze({
+  RELAY: 'relay',
+  MDNS: 'mdns',
+  DHT: 'dht',
+});
+
+/** Order used only to break duplicate-address ties, not to trust a source. */
+const SOURCE_RANK = Object.freeze({
+  [DISCOVERY_SOURCE.RELAY]: 0,
+  [DISCOVERY_SOURCE.MDNS]: 1,
+  [DISCOVERY_SOURCE.DHT]: 2,
+});
+
+const usable = (candidate) => candidate !== null
+  && typeof candidate === 'object'
+  && typeof candidate.address === 'string'
+  && candidate.address !== ''
+  && candidate.address !== '0.0.0.0'
+  && candidate.address !== '::'
+  && Number.isInteger(candidate.port)
+  && candidate.port > 0
+  && candidate.port <= 65535;
+
+/**
+ * Merge candidates from every provider, deduplicating by address:port.
+ * The first source in rank order wins the label; the address itself is kept
+ * once. No provider can inject a non-address payload into this list.
+ */
+export function mergeCandidates(lists, { limit = 8 } = {}) {
+  const merged = [];
+  const seen = new Set();
+  const sorted = [...lists].sort((a, b) => (SOURCE_RANK[a.source] ?? 9) - (SOURCE_RANK[b.source] ?? 9));
+  for (const list of sorted) {
+    for (const candidate of Array.isArray(list.candidates) ? list.candidates : []) {
+      if (!usable(candidate)) continue;
+      const key = candidate.address + ':' + candidate.port;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      merged.push({ address: candidate.address, port: candidate.port, source: list.source ?? candidate.source ?? 'unknown' });
+      if (merged.length >= limit) return merged;
+    }
+  }
+  return merged;
+}
+
+/** Relay discovery, built on the existing authenticated /v1/peer route. */
+export function createRelayDiscovery({ getJson } = {}) {
+  if (typeof getJson !== 'function') return { ok: false, code: 'DISCOVERY_NO_GET_JSON' };
+  return {
+    ok: true,
+    source: DISCOVERY_SOURCE.RELAY,
+    async discover(machineId) {
+      if (typeof machineId !== 'string' || machineId === '') return { ok: false, code: 'DISCOVERY_BAD_MACHINE_ID', candidates: [] };
+      const answer = await getJson('/v1/peer/' + encodeURIComponent(machineId));
+      if (answer?.ok !== true || answer?.status === 404) return { ok: false, code: 'DISCOVERY_RELAY_MISS', candidates: [] };
+      const candidates = Array.isArray(answer?.json?.peer?.candidates) ? answer.json.peer.candidates : [];
+      return { ok: true, source: DISCOVERY_SOURCE.RELAY, candidates, staticKey: answer?.json?.peer?.static_key ?? null };
+    },
+  };
+}
+
+/**
+ * A provider for tests and for an injected mDNS implementation. It carries no
+ * network logic, so the caller decides how candidates were observed.
+ */
+export function createStaticDiscovery({ source, candidates = [] } = {}) {
+  return {
+    ok: true,
+    source: source ?? 'static',
+    async discover() { return { ok: true, source: source ?? 'static', candidates: candidates.slice() }; },
+  };
+}

package/src/agent/iroh-sidecar.mjs

@@ -0,0 +1,149 @@
+/**
+ * W1 spike: iroh sidecar transport (JSON over length-prefixed stdio).
+ *
+ * The real binary is intentionally not bundled or auto-downloaded: the sidecar
+ * command/args come from configuration and are verified by the caller. This
+ * module owns only the process lifecycle and the frame contract, so a fake
+ * sidecar can exercise every failure path in CI without Rust or a TLS relay.
+ *
+ * Wire (parent -> child and child -> parent): 4-byte big-endian length + UTF-8 JSON.
+ *   { id, method, params }            request
+ *   { id, result } / { id, error }    response
+ *   { type: 'ready' }                 child is listening
+ *   { type: 'message', peer, data }   inbound payload (base64)
+ *   { type: 'status', paths, ... }    diagnostics
+ */
+import { spawn as nodeSpawn } from 'node:child_process';
+
+export const IROH_TRANSPORT = 'iroh-v1';
+export const IROH_CODE = Object.freeze({
+  START_FAILED: 'IROH_SIDECAR_START_FAILED',
+  TIMEOUT: 'IROH_TIMEOUT',
+  EXITED: 'IROH_SIDECAR_EXITED',
+  CLOSED: 'IROH_CLOSED',
+  BAD_FRAME: 'IROH_BAD_FRAME',
+});
+
+function encode(value) {
+  const body = Buffer.from(JSON.stringify(value), 'utf8');
+  const header = Buffer.alloc(4);
+  header.writeUInt32BE(body.length);
+  return Buffer.concat([header, body]);
+}
+
+export function createIrohSidecarTransport({ command, args = [], env = {}, timeoutMs = 2500, spawnImpl = nodeSpawn } = {}) {
+  if (typeof command !== 'string' || command === '') {
+    return { ok: false, code: IROH_CODE.START_FAILED, detail: 'iroh sidecar command is required' };
+  }
+  const handlers = new Set();
+  const pending = new Map();
+  let child = null;
+  let buffer = Buffer.alloc(0);
+  let nextId = 1;
+  let ready = null;
+  let closed = false;
+  let lastStatus = { paths: [] };
+
+  const failPending = (code, detail) => {
+    for (const [id, entry] of pending) {
+      clearTimeout(entry.timer);
+      entry.reject(Object.assign(new Error(detail ?? code), { code }));
+      pending.delete(id);
+    }
+  };
+
+  const onFrame = (message) => {
+    if (message?.type === 'ready') { ready?.(); ready = null; return; }
+    if (message?.type === 'message') {
+      const payload = Buffer.from(String(message.data ?? ''), 'base64');
+      for (const handler of handlers) handler({ peer: message.peer ?? null, payload });
+      return;
+    }
+    if (message?.type === 'status') { lastStatus = { paths: Array.isArray(message.paths) ? message.paths : [] }; return; }
+    if (typeof message?.id === 'number' && pending.has(message.id)) {
+      const entry = pending.get(message.id);
+      clearTimeout(entry.timer);
+      pending.delete(message.id);
+      if (message.error) entry.reject(Object.assign(new Error(String(message.error.message ?? message.error)), { code: message.error.code ?? IROH_CODE.EXITED }));
+      else entry.resolve(message.result ?? null);
+    }
+  };
+
+  const onData = (chunk) => {
+    buffer = Buffer.concat([buffer, chunk]);
+    while (buffer.length >= 4) {
+      const length = buffer.readUInt32BE(0);
+      if (buffer.length < 4 + length) return;
+      const body = buffer.subarray(4, 4 + length);
+      buffer = buffer.subarray(4 + length);
+      try { onFrame(JSON.parse(body.toString('utf8'))); } catch { /* a bad frame is dropped, not fatal */ }
+    }
+  };
+
+  const rpc = (method, params = {}) => new Promise((resolve, reject) => {
+    if (closed || child === null) { reject(Object.assign(new Error(IROH_CODE.CLOSED), { code: IROH_CODE.CLOSED })); return; }
+    const id = nextId;
+    nextId += 1;
+    const timer = setTimeout(() => {
+      pending.delete(id);
+      reject(Object.assign(new Error(IROH_CODE.TIMEOUT), { code: IROH_CODE.TIMEOUT }));
+    }, timeoutMs);
+    timer.unref?.();
+    pending.set(id, { resolve, reject, timer });
+    child.stdin.write(encode({ id, method, params }));
+  });
+
+  const transport = {
+    name: IROH_TRANSPORT,
+    async start() {
+      return new Promise((resolve) => {
+        try {
+          child = spawnImpl(command, args, { stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true, env: { ...process.env, ...env } });
+        } catch (error) {
+          resolve({ ok: false, code: IROH_CODE.START_FAILED, detail: error instanceof Error ? error.message : String(error) });
+          return;
+        }
+        const timer = setTimeout(() => { resolve({ ok: false, code: IROH_CODE.START_FAILED, detail: IROH_CODE.TIMEOUT }); }, timeoutMs);
+        ready = () => { clearTimeout(timer); resolve({ ok: true, name: IROH_TRANSPORT }); };
+        child.stdout.on('data', onData);
+        child.stderr.on('data', () => {});
+        child.on('exit', () => {
+          closed = true;
+          clearTimeout(timer);
+          failPending(IROH_CODE.EXITED, 'iroh sidecar exited');
+          if (ready !== null) { ready = null; resolve({ ok: false, code: IROH_CODE.START_FAILED, detail: 'sidecar exited before ready' }); }
+        });
+        child.on('error', (error) => {
+          closed = true;
+          clearTimeout(timer);
+          resolve({ ok: false, code: IROH_CODE.START_FAILED, detail: error.message });
+        });
+      });
+    },
+    async send(peer, payload) {
+      if (closed || child === null) return { ok: false, code: IROH_CODE.CLOSED };
+      try {
+        await rpc('send', { peer, data: Buffer.from(payload).toString('base64') });
+        return { ok: true, peer };
+      } catch (error) {
+        return { ok: false, code: error.code ?? IROH_CODE.EXITED, detail: error.message };
+      }
+    },
+    onMessage(handler) {
+      if (typeof handler !== 'function') return () => {};
+      handlers.add(handler);
+      return () => handlers.delete(handler);
+    },
+    paths() { return lastStatus.paths.map((path) => ({ ...path, transport: IROH_TRANSPORT })); },
+    diagnostics() { return { name: IROH_TRANSPORT, closed, pending: pending.size, paths: lastStatus.paths.length }; },
+    async stop() {
+      if (closed) return { ok: true };
+      closed = true;
+      failPending(IROH_CODE.CLOSED, 'transport stopped');
+      try { child?.stdin.end(); child?.kill(); } catch { /* already gone */ }
+      child = null;
+      return { ok: true };
+    },
+  };
+  return { ok: true, transport };
+}

package/src/agent/p2p-node.mjs

@@ -1232,7 +1232,7 @@ export class P2PNode extends EventEmitter {
      * that publishes no key is genuinely an older build and `PLAINTEXT_PEER` is honest; a peer that
      * publishes one we had not learned is *our* gap, and after this it is not a gap at all.
      */
-    let peerKey = this.peerKeys.get(machineId);
+    let peerKey = typeof options.peerKey === 'string' && options.peerKey !== '' ? options.peerKey : this.peerKeys.get(machineId);
     if (peerKey === null && announcedStaticKey !== null) {
       this.peerKeys.set(machineId, announcedStaticKey, 'relay');
       peerKey = announcedStaticKey;
@@ -1497,6 +1497,16 @@ export class P2PNode extends EventEmitter {
    * @param {import('./p2p.mjs').P2PChannel} channel
    * @param {{from:string|null, session:number}} details
    */
+  /** Close and forget a cached channel so a fresh dial can arm a new handshake. */
+  dropChannel(session) {
+    const channel = this.channels.get(session);
+    if (channel === undefined) return false;
+    this.channels.delete(session);
+    this.claimed.delete(session);
+    try { channel.close('replaced-by-rehandshake', { silent: true }); } catch { /* already gone */ }
+    return true;
+  }
+
   adoptChannel(channel, details) {
     const previous = this.channels.get(details.session);
     if (previous !== undefined && previous !== channel) {

package/src/agent/p2p-race.mjs

@@ -0,0 +1,105 @@
+/**
+ * Multi-transport race: capability negotiation + first-usable-path wins.
+ *
+ * The control plane never waits for this. A dispatch goes through the relay
+ * immediately; this race only decides which data-channel carries results.
+ * There is deliberately no relay fallback here: if every transport loses, the
+ * caller gets ALL_TRANSPORTS_FAILED and the task result stays on the control
+ * plane, which is a different (and already-working) path.
+ */
+
+export const TRANSPORT_PRIORITY = Object.freeze(['iroh', 'udp']);
+
+/**
+ * Intersect the local and remote capability lists.
+ * A peer that declares nothing is an older build and gets the UDP path only.
+ *
+ * @param {{local?: string[], remote?: string[]|null, priority?: string[]}} input
+ * @returns {string[]} ordered transport names both ends can attempt
+ */
+export function negotiateTransports({ local = ['udp'], remote = null, priority = TRANSPORT_PRIORITY } = {}) {
+  const localSet = new Set(local.filter((name) => typeof name === 'string'));
+  const remoteSet = remote === null ? new Set(['udp']) : new Set(remote.filter((name) => typeof name === 'string'));
+  return priority.filter((name) => localSet.has(name) && remoteSet.has(name));
+}
+
+/**
+ * Run every candidate's start() concurrently and resolve with the first channel.
+ * The losers are aborted as soon as a winner exists (or the total budget expires).
+ *
+ * @param {{
+ *   candidates: Array<{name: string, timeoutMs?: number, start: (ctx: {signal: AbortSignal}) => Promise<any>}>,
+ *   budgetMs?: number,
+ *   now?: () => number,
+ * }} input
+ * @returns {Promise<{ok: true, name: string, channel: any, attempts: object[], elapsedMs: number}
+ *   | {ok: false, code: 'ALL_TRANSPORTS_FAILED'|'NO_TRANSPORTS', attempts: object[], elapsedMs: number}>}
+ */
+export async function raceTransports({ candidates, budgetMs = 3000, now = Date.now } = {}) {
+  if (!Array.isArray(candidates) || candidates.length === 0) {
+    return { ok: false, code: 'NO_TRANSPORTS', attempts: [], elapsedMs: 0 };
+  }
+  const startedAt = now();
+  const attempts = [];
+  const controllers = new Map();
+  let settled = false;
+  let resolveRace = null;
+  const race = new Promise((resolve) => { resolveRace = resolve; });
+
+  const finish = (result) => {
+    if (settled) return;
+    settled = true;
+    for (const [name, controller] of controllers.entries()) {
+      if (result.ok === true && result.name === name) continue; // the winner keeps its channel
+      controller.abort();
+    }
+    resolveRace({ ...result, elapsedMs: now() - startedAt });
+  };
+
+  const budgetTimer = setTimeout(() => {
+    finish({ ok: false, code: 'ALL_TRANSPORTS_FAILED', attempts });
+  }, budgetMs);
+  budgetTimer.unref?.();
+
+  for (const candidate of candidates) {
+    if (typeof candidate?.start !== 'function') continue;
+    const controller = new AbortController();
+    controllers.set(candidate.name, controller);
+    const record = { name: candidate.name, ok: false, code: null, elapsedMs: null };
+    attempts.push(record);
+    const started = now();
+    const timer = setTimeout(() => {
+      record.code = 'TRANSPORT_TIMEOUT';
+      record.elapsedMs = now() - started;
+      controller.abort();
+      if (attempts.every((attempt) => attempt.elapsedMs !== null) && attempts.every((attempt) => attempt.ok !== true)) {
+        finish({ ok: false, code: 'ALL_TRANSPORTS_FAILED', attempts });
+      }
+    }, Number.isFinite(candidate.timeoutMs) ? candidate.timeoutMs : budgetMs);
+    timer.unref?.();
+    Promise.resolve()
+      .then(() => candidate.start({ signal: controller.signal }))
+      .then((channel) => {
+        clearTimeout(timer);
+        if (settled) return;
+        record.ok = true;
+        record.elapsedMs = now() - started;
+        finish({ ok: true, name: candidate.name, channel, attempts });
+      })
+      .catch((error) => {
+        clearTimeout(timer);
+        if (settled) return;
+        record.code = error?.code ?? 'TRANSPORT_FAILED';
+        record.message = error instanceof Error ? error.message : String(error);
+        record.elapsedMs = now() - started;
+        if (attempts.every((attempt) => attempt.ok !== true && attempt.elapsedMs !== null)) {
+          finish({ ok: false, code: 'ALL_TRANSPORTS_FAILED', attempts });
+        }
+      });
+  }
+
+  const result = await race;
+  clearTimeout(budgetTimer);
+  if (result.ok !== true) return result;
+  return result;
+}