@onlyne/lib 3.0.0 → 3.1.0

package/src/messages.ts

@@ -1,6 +1,6 @@
-import type { Attention, Auth, DeliveryPlan, Entry, Event, Failure, Grant, Json, LocalAttention, Member, MessageQuery, MessageRef, Mutation, Outbound, PageOptions, Receipt, ReplyPermit, SendRequest, Thread, ThreadRef, Transaction } from './types.js';
-import { admissionView, canonical, decimal, fail, fingerprint, key, OnlyneError, page, requireValue, same, type Context } from './core.js';
-import { canRead, getThread } from './threads.js';
+import type { Attention, Auth, DeliveryPlan, Entry, Event, Failure, Grant, Json, LocalAttention, Member, MessageQuery, MessageRef, Mutation, Outbound, PageOptions, Receipt, ReplyPermit, SendRequest, Thread, ThreadRef, Transaction } from './types.ts';
+import { admissionView, canonical, decimal, fail, fingerprint, key, OnlyneError, page, requireValue, same, type Context } from './core.ts';
+import { canRead, getThread } from './threads.ts';
 
 type Remembered = { digest: string; receipt?: Receipt; error?: Failure; retry_until: string };
 type Binding = { digest: string; identity: string };
@@ -18,14 +18,18 @@ const RECORDED_REFUSALS: Record<string, true> = {
 const compareOrdinal = (a: string, b: string): number => decimal(a) < decimal(b) ? -1 : decimal(a) > decimal(b) ? 1 : 0;
 
 export class MessageService {
-  constructor(private readonly ctx: Context) {}
+  readonly #ctx: Context;
+
+  constructor(ctx: Context) {
+    this.#ctx = ctx;
+  }
 
   async admit(auth: Auth, request: SendRequest): Promise<Receipt> {
     const { message } = request;
     if (!auth.actor) fail('unauthenticated', 'Authentication is required.');
     if (typeof message?.id !== 'string' || !message.id || typeof message.sender !== 'string' || typeof message.msg !== 'string' || typeof message.delivery_kind !== 'string') fail('invalid_request', 'A message needs id, sender, delivery_kind and msg.');
     if (message.sender !== auth.actor && auth.sender !== message.sender) fail('forbidden', 'The caller cannot represent this author.');
-    if (request.target_endpoint !== this.ctx.node) fail('forbidden', 'The target endpoint is not served here.');
+    if (request.target_endpoint !== this.#ctx.node) fail('forbidden', 'The target endpoint is not served here.');
     if (!request.plan || !['none', 'async', 'await'].includes(request.plan.response) || !['existing', 'new'].includes(request.plan.execution)) fail('invalid_request', 'An executable delivery plan is required.');
     if (!request.idempotency_key) fail('invalid_request', 'An idempotency key is required.');
     if (message.meta?.relation && !message.meta.in_reply_to) fail('invalid_request', 'A relation requires an original message.');
@@ -37,14 +41,14 @@ export class MessageService {
     // Asked before the admission transaction opens: a host that answers from its own store
     // would otherwise wait on this transaction and deadlock it. The refusal it produces is
     // still recorded inside the transaction below.
-    const runtime = this.ctx.options.plugins.runtime;
+    const runtime = this.#ctx.options.plugins.runtime;
     const supported = runtime === undefined || await runtime.supports(request.plan, message);
-    const outcome = await this.ctx.storage.transaction(async (tx): Promise<Outcome> => {
+    const outcome = await this.#ctx.storage.transaction(async (tx): Promise<Outcome> => {
       const bound = await tx.get<Binding>(operationKey);
       if (bound && (bound.digest !== requestDigest || bound.identity !== identity)) fail('id_conflict', 'The idempotency key is bound to another request.');
       const old = await tx.get<Remembered>(identity);
       if (old) {
-        this.ctx.options.plugins.runtime?.trace?.({ event: 'inbound.duplicate', sender: message.sender, message: message.id });
+        this.#ctx.options.plugins.runtime?.trace?.({ event: 'inbound.duplicate', sender: message.sender, message: message.id });
         // A different body never replaces the identity already recorded, accepted or refused.
         if (old.digest !== digest) return { error: new OnlyneError('id_conflict', 'This message identity has different content.').error };
         if (old.error) return { error: old.error };
@@ -54,9 +58,16 @@ export class MessageService {
       }
       try {
         if (!supported) {
-          return await this.refuse(tx, identity, digest, request, new OnlyneError('unsupported_delivery', 'The runtime cannot fulfill this delivery plan.'));
+          // The plan is the only thing the sender can change, so the refusal names it: a host
+          // that cannot hold an await or open a new context says so, instead of leaving the
+          // reader to guess which half of the plan it refused.
+          return await this.refuse(tx, identity, digest, request, new OnlyneError(
+            'unsupported_delivery',
+            `This host cannot deliver a ${request.plan.response} response with ${request.plan.execution} execution; nothing was stored.`,
+            { plan: { response: request.plan.response, execution: request.plan.execution } },
+          ));
         }
-        this.ctx.deadline(request.retry_until);
+        this.#ctx.deadline(request.retry_until);
         return await this.append(tx, auth, request, digest, requestDigest, identity, operationKey);
       } catch (error) {
         if (error instanceof OnlyneError && RECORDED_REFUSALS[error.error.code] === true) return this.refuse(tx, identity, digest, request, error);
@@ -64,8 +75,8 @@ export class MessageService {
       }
     });
     if ('error' in outcome) throw new OnlyneError(outcome.error.code, outcome.error.message, outcome.error.details);
-    this.ctx.options.plugins.runtime?.notify?.({ event: 'inbound', thread: outcome.receipt.thread_ref, seq: outcome.receipt.seq, sender: message.sender });
-    this.ctx.options.plugins.runtime?.notify?.({ event: 'work-pending', pending: true });
+    this.#ctx.options.plugins.runtime?.notify?.({ event: 'inbound', thread: outcome.receipt.thread_ref, seq: outcome.receipt.seq, sender: message.sender });
+    this.#ctx.options.plugins.runtime?.notify?.({ event: 'work-pending', pending: true });
     return requireValue(outcome.receipt);
   }
 
@@ -85,40 +96,40 @@ export class MessageService {
     let permit: ReplyPermit | undefined;
     if (original !== undefined) {
       permit = await tx.get<ReplyPermit>(key('permit', original.sender, original.id, message.sender));
-      if (threadRef === undefined && permit && !permit.revoked && permit.remaining > 0 && Date.parse(permit.expires_at) > this.ctx.now()
-        && (message.meta?.relation !== 'followup' || permit.followup) && this.ctx.node === permit.landing.owner) threadRef = permit.landing;
+      if (threadRef === undefined && permit && !permit.revoked && permit.remaining > 0 && Date.parse(permit.expires_at) > this.#ctx.now()
+        && (message.meta?.relation !== 'followup' || permit.followup) && this.#ctx.node === permit.landing.owner) threadRef = permit.landing;
       if (threadRef === undefined) threadRef = await this.chainLanding(tx, original, message.sender);
     }
     let firstContact = false;
     if (threadRef === undefined) {
       // The default landing is the owner's own slot, resolved once inside this transaction.
-      const landing = await tx.get<ThreadRef>(key('default', this.ctx.node));
-      if (landing === undefined || landing.owner !== this.ctx.node || typeof landing.id !== 'string' || landing.id.length === 0) {
+      const landing = await tx.get<ThreadRef>(key('default', this.#ctx.node));
+      if (landing === undefined || landing.owner !== this.#ctx.node || typeof landing.id !== 'string' || landing.id.length === 0) {
         // Finding a landing grants nothing (RFC 0002 §3): only the owner's inbound policy
         // may open a thread and admit this sender into it.
-        const policy = this.ctx.options.plugins.inboundThread;
+        const policy = this.#ctx.options.plugins.inboundThread;
         if (policy === undefined || !await policy(auth.actor, admissionView(tx))) {
           return this.refuse(tx, identity, digest, request, new OnlyneError('not_found', 'No default thread is configured.'));
         }
         firstContact = true;
         let id = crypto.randomUUID();
-        while (await tx.get<Thread>(key('thread', this.ctx.node, id))) id = crypto.randomUUID();
-        threadRef = { owner: this.ctx.node, id };
+        while (await tx.get<Thread>(key('thread', this.#ctx.node, id))) id = crypto.randomUUID();
+        threadRef = { owner: this.#ctx.node, id };
       } else {
         threadRef = { owner: landing.owner, id: landing.id };
       }
     }
-    this.ctx.owner(threadRef.owner);
+    this.#ctx.owner(threadRef.owner);
     const thread: Thread = firstContact
-      ? { thread_ref: threadRef, title: message.msg.replace(/\s+/g, ' ').trim().slice(0, 100) || message.delivery_kind, state: 'open', next_seq: '1', event_seq: '0', created_at: new Date(this.ctx.now()).toISOString(), closed_at: null }
-      : await getThread(tx, this.ctx, threadRef);
+      ? { thread_ref: threadRef, title: message.msg.replace(/\s+/g, ' ').trim().slice(0, 100) || message.delivery_kind, state: 'open', next_seq: '1', event_seq: '0', created_at: new Date(this.#ctx.now()).toISOString(), closed_at: null }
+      : await getThread(tx, this.#ctx, threadRef);
     const member = firstContact ? undefined : await tx.get<Member>(key('member', threadRef.owner, threadRef.id, message.sender));
     const ordinary = firstContact || message.sender === threadRef.owner || (member?.state === 'active' && member.access.includes('post'));
-    const allowedPermit = permit !== undefined && !permit.revoked && permit.remaining > 0 && Date.parse(permit.expires_at) > this.ctx.now()
+    const allowedPermit = permit !== undefined && !permit.revoked && permit.remaining > 0 && Date.parse(permit.expires_at) > this.#ctx.now()
       && same(permit.landing, threadRef) && (message.meta?.relation !== 'followup' || permit.followup);
     if (!ordinary && !allowedPermit) return this.refuse(tx, identity, digest, request, new OnlyneError('not_a_member', 'The sender is not an active post member.'));
     if (thread.state === 'closed') return this.refuse(tx, identity, digest, request, new OnlyneError('thread_closed', 'The thread is closed.'));
-    const admissionPolicy = this.ctx.options.plugins.mayAdmit;
+    const admissionPolicy = this.#ctx.options.plugins.mayAdmit;
     if (admissionPolicy && !await admissionPolicy(auth.actor, threadRef, admissionView(tx))) {
       return this.refuse(tx, identity, digest, request, new OnlyneError('forbidden', 'The admission policy refused the request.'));
     }
@@ -139,7 +150,7 @@ export class MessageService {
       if (alias === threadRef.owner) { recipients.add(threadRef.owner); continue; }
       if (members.some(m => m.peer === alias)) { recipients.add(alias); continue; }
       // A display alias is not a node id; the integration layer owns the mapping.
-      const resolved = await this.ctx.options.plugins.mention?.(alias, threadRef);
+      const resolved = await this.#ctx.options.plugins.mention?.(alias, threadRef);
       if (resolved === undefined || (resolved !== threadRef.owner && !members.some(m => m.peer === resolved))) {
         fail('invalid_request', 'A mention must resolve to an active member identity.');
       }
@@ -153,7 +164,7 @@ export class MessageService {
     if (firstContact) {
       // Written with the entry and the receipt in this one transaction: the thread, its
       // sender membership and the grant notice either all commit or none of them do.
-      const revision = this.ctx.id();
+      const revision = this.#ctx.id();
       const membership: Member = { peer: message.sender, state: 'active', access: ['post', 'read'], read_scope: {}, revision };
       const notice: Grant = { id: revision, recipient: message.sender, thread_ref: threadRef, revision, acked: false };
       const eventId = (decimal(thread.event_seq) + 1n).toString();
@@ -167,11 +178,11 @@ export class MessageService {
     thread.event_seq = (decimal(thread.event_seq) + 1n).toString();
     const entry: Entry = {
       thread_ref: threadRef, seq, message: structuredClone(message), authenticated_author: message.sender,
-      reply_authority: auth.reply_authority ?? auth.actor, at: new Date(this.ctx.now()).toISOString(),
+      reply_authority: auth.reply_authority ?? auth.actor, at: new Date(this.#ctx.now()).toISOString(),
     };
     const receipt: Receipt = {
-      message_ref: { sender: message.sender, id: message.id }, receipt_id: this.ctx.id(),
-      guarantee: this.ctx.storage.guarantee, thread_ref: threadRef, seq, plan: structuredClone(request.plan),
+      message_ref: { sender: message.sender, id: message.id }, receipt_id: this.#ctx.id(),
+      guarantee: this.#ctx.storage.guarantee, thread_ref: threadRef, seq, plan: structuredClone(request.plan),
       thread_created: firstContact, previous_seq: (decimal(seq) - 1n).toString(),
       // The answer a message gives is part of what the owner admitted: the sender can only
       // prove "I replied to that one" from the receipt, and the reference here is the pair
@@ -215,7 +226,7 @@ export class MessageService {
       const entry = await tx.get<Entry>(key('entry-ref', ref.sender, ref.id));
       if (entry !== undefined) {
         const landing = entry.thread_ref;
-        this.ctx.owner(landing.owner);
+        this.#ctx.owner(landing.owner);
         const thread = await tx.get<Thread>(key('thread', landing.owner, landing.id));
         if (thread === undefined) fail('not_found', 'The original reply landing is no longer available.');
         if (thread.state === 'closed') fail('thread_closed', 'The original reply landing is closed; an explicitly authorized alternative is required.');
@@ -223,7 +234,7 @@ export class MessageService {
       }
       const sent: Outbound | undefined = await tx.get<Outbound>(key('outbound', ref.sender, ref.id));
       if (sent === undefined) fail('not_found', 'The original message history is unavailable; no alternative reply landing was authorized.');
-      if (ref.sender !== this.ctx.node || sent.expected_author !== sender) fail('forbidden', 'This sender is not the expected reply author.');
+      if (ref.sender !== this.#ctx.node || sent.expected_author !== sender) fail('forbidden', 'This sender is not the expected reply author.');
       const parent: MessageRef | undefined = sent.request.message.meta?.in_reply_to;
       // The first reply to an outbound root has no local incoming thread yet.
       if (parent === undefined) return undefined;
@@ -242,7 +253,7 @@ export class MessageService {
   private async writeAttention(tx: Transaction, attention: Attention, plan: DeliveryPlan) {
     const attested: Attention = { ...attention, plan };
     await tx.put(key('attention', attested.thread_ref.owner, attested.thread_ref.id, attested.obligation_id), attested);
-    if (attested.recipient !== this.ctx.node) return;
+    if (attested.recipient !== this.#ctx.node) return;
     const slot = key('inbox', attested.obligation_id);
     if (await tx.get(slot) !== undefined) return;
     await tx.put<LocalAttention>(slot, {
@@ -250,7 +261,7 @@ export class MessageService {
       ...(plan.context === undefined ? {} : { context: plan.context }),
       injected: false,
     });
-    this.ctx.options.plugins.runtime?.trace?.({
+    this.#ctx.options.plugins.runtime?.trace?.({
       event: 'inbound.received', obligation: attested.obligation_id, thread: attested.thread_ref,
       seq: attested.seq, sender: attested.message_ref.sender, valid: true, injected: false,
       ...(plan.context === undefined ? {} : { context: plan.context }),
@@ -260,8 +271,8 @@ export class MessageService {
   }
 
   async list(auth: Auth, ref: ThreadRef, query: MessageQuery = {}) {
-    return this.ctx.storage.transaction(async tx => {
-      const thread = await getThread(tx, this.ctx, ref);
+    return this.#ctx.storage.transaction(async tx => {
+      const thread = await getThread(tx, this.#ctx, ref);
       if (!await canRead(tx, auth.actor, ref)) fail('forbidden', 'Read access is required.');
       const entries: Entry[] = [];
       for (const { value: entry } of await tx.scan<Entry>(key('entry', ref.owner, ref.id) + '/')) {
@@ -286,8 +297,8 @@ export class MessageService {
    * is stored back and before it is returned, so a revoked reader never sees content.
    */
   async attention(auth: Auth, ref: ThreadRef, options: PageOptions = {}) {
-    return this.ctx.storage.transaction(async tx => {
-      await getThread(tx, this.ctx, ref);
+    return this.#ctx.storage.transaction(async tx => {
+      await getThread(tx, this.#ctx, ref);
       const allowed = await canRead(tx, auth.actor, ref);
       const rows = (await tx.scan<Attention>(key('attention', ref.owner, ref.id) + '/')).map(r => r.value).filter(a => a.recipient === auth.actor && !a.acked);
       const visible: Attention[] = [];
@@ -307,8 +318,8 @@ export class MessageService {
   }
 
   async ack(auth: Auth, ref: ThreadRef, id: string, mutation: Mutation) {
-    return this.ctx.mutate(auth, `attention-ack/${canonical(ref)}/${id}`, mutation, {}, async tx => {
-      await getThread(tx, this.ctx, ref);
+    return this.#ctx.mutate(auth, `attention-ack/${canonical(ref)}/${id}`, mutation, {}, async tx => {
+      await getThread(tx, this.#ctx, ref);
       const slot = key('attention', ref.owner, ref.id, id);
       const attention = requireValue(await tx.get<Attention>(slot));
       if (attention.recipient !== auth.actor) fail('not_found', 'This attention obligation is not addressed to the caller.');
@@ -321,8 +332,8 @@ export class MessageService {
   }
 
   async inbox(auth: Auth, options: PageOptions = {}) {
-    if (auth.actor !== this.ctx.node) fail('forbidden', 'The local inbox belongs to this node.');
-    return this.ctx.storage.transaction(async tx => {
+    if (auth.actor !== this.#ctx.node) fail('forbidden', 'The local inbox belongs to this node.');
+    return this.#ctx.storage.transaction(async tx => {
       const rows = (await tx.scan<LocalAttention>('inbox/')).map(r => r.value);
       rows.sort((a, b) => a.attention.obligation_id.localeCompare(b.attention.obligation_id));
       const indexed = rows.map((value, index) => ({ value, position: String(index + 1) }));
@@ -332,7 +343,7 @@ export class MessageService {
   }
 
   async getByRef(auth: Auth, ref: MessageRef) {
-    return this.ctx.storage.transaction(async tx => {
+    return this.#ctx.storage.transaction(async tx => {
       const entry = requireValue(await tx.get<Entry>(key('entry-ref', ref.sender, ref.id)));
       if (!await canRead(tx, auth.actor, entry.thread_ref, entry)) fail('not_found', 'This message is not readable.');
       return entry;
@@ -340,15 +351,15 @@ export class MessageService {
   }
 
   async events(auth: Auth, ref: ThreadRef, options: PageOptions = {}) {
-    return this.ctx.storage.transaction(async tx => {
-      await getThread(tx, this.ctx, ref);
+    return this.#ctx.storage.transaction(async tx => {
+      await getThread(tx, this.#ctx, ref);
       if (!await canRead(tx, auth.actor, ref)) fail('forbidden', 'Read access is required.');
       const rows: Event[] = [];
       for (const { value: event } of await tx.scan<Event>(key('event', ref.owner, ref.id) + '/')) {
         if (event.message_ref) {
           const entry = await tx.get<Entry>(key('entry-ref', event.message_ref.sender, event.message_ref.id));
           if (!entry || !await canRead(tx, auth.actor, ref, entry)) continue;
-        } else if (event.type === 'membership' && auth.actor !== this.ctx.node) continue;
+        } else if (event.type === 'membership' && auth.actor !== this.#ctx.node) continue;
         rows.push(event);
       }
       rows.sort((a, b) => compareOrdinal(a.id, b.id));
@@ -357,8 +368,8 @@ export class MessageService {
   }
 
   async snapshot(auth: Auth, ref: ThreadRef) {
-    return this.ctx.storage.transaction(async tx => {
-      const thread = await getThread(tx, this.ctx, ref);
+    return this.#ctx.storage.transaction(async tx => {
+      const thread = await getThread(tx, this.#ctx, ref);
       if (!await canRead(tx, auth.actor, ref)) fail('forbidden', 'Read access is required.');
       const entries: Entry[] = [];
       for (const row of await tx.scan<Entry>(key('entry', ref.owner, ref.id) + '/')) if (await canRead(tx, auth.actor, ref, row.value)) entries.push(row.value);
@@ -368,15 +379,15 @@ export class MessageService {
   }
 
   async expire(auth: Auth, ref: ThreadRef, beforeSeq: string) {
-    this.ctx.owner(ref.owner);
-    if (auth.actor !== this.ctx.node) fail('forbidden', 'Only the owner may expire history.');
-    return this.ctx.storage.transaction(async tx => {
-      await getThread(tx, this.ctx, ref);
+    this.#ctx.owner(ref.owner);
+    if (auth.actor !== this.#ctx.node) fail('forbidden', 'Only the owner may expire history.');
+    return this.#ctx.storage.transaction(async tx => {
+      await getThread(tx, this.#ctx, ref);
       for (const row of await tx.scan<Entry>(key('entry', ref.owner, ref.id) + '/')) {
         if (decimal(row.value.seq) >= decimal(beforeSeq)) continue;
         const recordKey = key('message', row.value.message.sender, row.value.message.id);
         const record = requireValue(await tx.get<Remembered>(recordKey));
-        if (Date.parse(record.retry_until) > this.ctx.now()) fail('conflict', 'The replay window is still open.');
+        if (Date.parse(record.retry_until) > this.#ctx.now()) fail('conflict', 'The replay window is still open.');
         // The tombstone keeps the digest and the window, never the body.
         await tx.put(recordKey, { digest: record.digest, retry_until: record.retry_until });
         await tx.delete(row.key);

package/src/node.ts

@@ -1,16 +1,17 @@
-import type { Auth, NodeOptions } from './types.js';
-import { createContext } from './core.js';
-import { ThreadService } from './threads.js';
-import { MessageService } from './messages.js';
-import { createResourceService } from './resources.js';
-import type { ResourceService } from './resources.js';
-import { DomainService } from './domains.js';
-import { DiscoveryService } from './discovery.js';
-import { OnlyneClient } from './client.js';
-import { KeyService, TrustService } from './keys.js';
-import { FetchTransport } from './transport.js';
-import { createHttpHandler } from './http.js';
-import { HistoryService } from './history.js';
+import type { Auth, NodeOptions } from './types.ts';
+import { createContext } from './core.ts';
+import { ThreadService } from './threads.ts';
+import { MessageService } from './messages.ts';
+import { createResourceService } from './resources.ts';
+import type { ResourceService } from './resources.ts';
+import { DomainService } from './domains.ts';
+import { DiscoveryService } from './discovery.ts';
+import { OnlyneClient } from './client.ts';
+import { KeyService, TrustService } from './keys.ts';
+import { FetchTransport } from './transport.ts';
+import { composeResolver } from './resolve.ts';
+import { createHttpHandler } from './http.ts';
+import { HistoryService } from './history.ts';
 
 export class OnlyneNode {
   readonly threads: ThreadService;
@@ -23,7 +24,7 @@ export class OnlyneNode {
   readonly trust: TrustService;
   readonly client: OnlyneClient;
   /** The transport this node signs with; a host that talks to peers itself must reuse it. */
-  readonly transport: import('./types.js').Transport;
+  readonly transport: import('./types.ts').Transport;
   readonly fetch: (request: Request) => Promise<Response>;
   readonly auth: Auth;
 
@@ -35,8 +36,15 @@ export class OnlyneNode {
     this.history = new HistoryService(ctx);
     this.keys = new KeyService(ctx);
     this.trust = new TrustService(ctx, this.keys);
+    this.discovery = new DiscoveryService(ctx);
     const transport = options.plugins.transport ?? new FetchTransport(
-      options.plugins.resolve,
+      // The composed resolver is the one address authority (resolve.ts): discovery first,
+      // the trust row as the fallback that writes a moved peer's address back.
+      composeResolver({
+        resolve: options.plugins.resolve,
+        trust: this.trust,
+        observe: (base_url, source, expectedNode) => this.discovery.observe(base_url, source, expectedNode),
+      }),
       fetch,
       options.plugins.keys === undefined ? undefined : { trust: this.trust },
     );
@@ -44,7 +52,6 @@ export class OnlyneNode {
     // transport instead of reaching the network on its own.
     this.resources = createResourceService(ctx, transport);
     this.domains = new DomainService(ctx);
-    this.discovery = new DiscoveryService(ctx);
     this.transport = transport;
     this.client = new OnlyneClient(ctx, transport, this.messages, this.threads, this.resources, this.domains, this.trust);
     this.trust.bindLoop(this.client);

package/src/resolve.ts

@@ -0,0 +1,39 @@
+import { OnlyneError } from './core.ts';
+import type { Failure, NodeId, Target, TrustEntry } from './types.ts';
+
+/**
+ * The one place an address is composed for the wire (RFC 0011 §4, RFC 0018 §5.1).
+ * The host resolver — usually the discovery catalog — answers first. When it reports
+ * `not_found` (never observed) or `unavailable` (recorded but no address answers), a
+ * trusted row's `base_url` is the authoritative fallback: probing it succeeds writes the
+ * address back into the discovery catalog, so a peer that moved stays reachable and the
+ * new address becomes visible to the model. A trusted row whose address also fails is
+ * `unavailable` — never degraded to `not_found`, which names an unknown identity.
+ */
+export function composeResolver(deps: {
+  resolve: (node: NodeId) => Promise<Target>;
+  trust?: { entry(node: NodeId): Promise<TrustEntry | undefined> };
+  observe?: (base_url: string, source: string, expectedNode?: NodeId) => Promise<unknown>;
+}): (node: NodeId) => Promise<Target> {
+  return async node => {
+    try {
+      return await deps.resolve(node);
+    } catch (error) {
+      const failure: Failure | undefined = error instanceof OnlyneError
+        ? error.error
+        : (error as { error?: Failure } | null)?.error;
+      if (failure?.code !== 'not_found' && failure?.code !== 'unavailable') throw error;
+      const entry = await deps.trust?.entry(node);
+      if (entry === undefined || entry.state !== 'trusted' || entry.base_url.length === 0) throw error;
+      if (deps.observe !== undefined) {
+        try {
+          await deps.observe(entry.base_url, 'trust-row', node);
+        } catch {
+          throw new OnlyneError('unavailable',
+            `${node} holds a trusted row whose address is ${entry.base_url}, but no recorded address answered and that address did not verify either.`);
+        }
+      }
+      return { node_id: node, base_url: entry.base_url };
+    }
+  };
+}

package/src/resources.ts

@@ -1,9 +1,9 @@
 import type {
   AckReceipt, Auth, Failure, HandoverProbe, Json, LogQuery, Mutation, OperationRecord, OperationRequest,
   OperationResult, Page, PageOptions, ProbeAnswer, Resource, ResourceEvent, ResourceRef, Transaction, Transport,
-} from './types.js';
-import type { Context } from './core.js';
-import { OnlyneError, decimal, fail, key, page, requireValue, same, utc } from './core.js';
+} from './types.ts';
+import type { Context } from './core.ts';
+import { OnlyneError, decimal, fail, key, page, requireValue, same, utc } from './core.ts';
 
 export interface ResourceService {
   register(auth: Auth, resource: Resource): Promise<Resource>;