@onlyne/lib 3.1.0 → 3.2.0

package/dist/client.js

@@ -0,0 +1,1772 @@
+var _a;
+import { canonical, decimal, fail, key, page, requireValue, utc } from "./core.js";
+import { trustPhase } from "./types.js";
+import { FAILURE_WINDOW_MS, GRANT_RESYNC_MS, MAX_ATTEMPTS, MAX_CURSOR_PAGES, RESOURCE_CHECK_MS, admissionOf, attentionOf, backoffMs, consumptionKey, failureOf, grantResyncKey, inboxKey, isReply, messageDigest, outboundKey, reconcileBackoffKey, replayOrder, todoKey, } from "./delivery.js";
+import { AwaitedReplies } from "./awaited.js";
+import { workRef } from "./routes/shared.js";
+export class OnlyneClient {
+    #ctx;
+    #transport;
+    #messages;
+    #threads;
+    #resources;
+    #domains;
+    #trust;
+    #loop;
+    /** The maintenance cadence the loop uses while durable work is pending or the host just woke it. */
+    static ACTIVE_INTERVAL_MS = 2_000;
+    /** The floor the loop drops to once the durable ledger holds no pending work. */
+    static IDLE_INTERVAL_MS = 30_000;
+    /** Live awaits and the tool-result holds they place. */
+    #awaiting = new AwaitedReplies();
+    /** Last failure line per scope, and what its window suppressed; one map for every repeated line. */
+    #failureWindows = new Map();
+    constructor(ctx, transport, messages, threads, resources, domains, trust) {
+        this.#ctx = ctx;
+        this.#transport = transport;
+        this.#messages = messages;
+        this.#threads = threads;
+        this.#resources = resources;
+        this.#domains = domains;
+        this.#trust = trust;
+        const clock = ctx.options.plugins.maintenanceClock;
+        if (clock !== undefined) {
+            this.#loop = { clock, controller: new AbortController(), active: { intervalMs: _a.ACTIVE_INTERVAL_MS }, handle: undefined, lastPending: true, running: false };
+        }
+    }
+    /**
+     * RFC 0017 §6: the library-owned maintenance loop. One pass runs `maintain`,
+     * `recover`, then re-arms: pending durable work keeps the active cadence, an idle
+     * ledger drops to the idle floor. Every clock read goes through the injected
+     * `MaintenanceClock`. A pass is never re-entered; a wake during a pass schedules
+     * the next tick at the active cadence. `notify` carries every pending-work change.
+     */
+    runMaintenance() {
+        const loop = this.#loop;
+        if (loop === undefined)
+            fail('unsupported_delivery', 'The host supplied no maintenance clock, so the library cannot own the loop. Pass plugins.maintenanceClock or schedule maintain() yourself.');
+        if (loop.handle !== undefined)
+            return;
+        if (loop.controller.signal.aborted)
+            loop.controller = new AbortController();
+        this.#arm(loop, _a.ACTIVE_INTERVAL_MS);
+    }
+    stopMaintenance() {
+        const loop = this.#loop;
+        if (loop === undefined)
+            return;
+        loop.controller.abort();
+        if (loop.handle === undefined)
+            return;
+        loop.clock.clearTimer(loop.handle);
+        loop.handle = undefined;
+    }
+    /** @internal Flips the loop to its active cadence: new evidence arrived while it idled. */
+    wakeLoop() {
+        const loop = this.#loop;
+        if (loop === undefined || loop.controller.signal.aborted)
+            return;
+        if (loop.active.intervalMs !== _a.ACTIVE_INTERVAL_MS)
+            this.#arm(loop, _a.ACTIVE_INTERVAL_MS);
+    }
+    /** @internal Schedules an immediate maintenance pass when new inbound or grant work lands locally. */
+    wakeImmediate() {
+        const loop = this.#loop;
+        if (loop === undefined || loop.controller.signal.aborted || loop.handle === undefined)
+            return;
+        if (loop.running) {
+            loop.rerunImmediate = true;
+            return;
+        }
+        if (loop.active.intervalMs !== 0)
+            this.#arm(loop, 0);
+    }
+    #arm(loop, intervalMs) {
+        if (loop.handle !== undefined)
+            loop.clock.clearTimer(loop.handle);
+        loop.active.intervalMs = intervalMs;
+        loop.handle = loop.clock.setTimer(intervalMs, () => this.#tick(loop));
+    }
+    async #tick(loop) {
+        // The timer that fired is spent. Clear it instead of dropping the handle: a host clock
+        // that keeps a fired timer registered would otherwise leak one handle per pass, and
+        // `stopMaintenance` could only ever clear the newest.
+        if (loop.handle !== undefined) {
+            loop.clock.clearTimer(loop.handle);
+            loop.handle = undefined;
+        }
+        if (loop.running)
+            return this.#arm(loop, _a.ACTIVE_INTERVAL_MS);
+        loop.running = true;
+        loop.rerunImmediate = false;
+        try {
+            await this.maintain(loop.controller.signal);
+            await this.#recover(loop.controller.signal, true);
+        }
+        catch {
+            // A failed pass keeps its owed records; the next pass retries them.
+        }
+        finally {
+            loop.running = false;
+        }
+        let pending = true;
+        try {
+            pending = await this.hasPendingWork();
+        }
+        catch { /* unknown keeps the active cadence */ }
+        if (pending !== loop.lastPending) {
+            loop.lastPending = pending;
+            this.#ctx.options.plugins.runtime?.notify?.({ event: 'work-pending', pending });
+        }
+        if (!loop.controller.signal.aborted) {
+            const nextMs = loop.rerunImmediate ? 0 : (pending ? _a.ACTIVE_INTERVAL_MS : _a.IDLE_INTERVAL_MS);
+            loop.rerunImmediate = false;
+            this.#arm(loop, nextMs);
+        }
+    }
+    // ---- delivery ---------------------------------------------------------------
+    /**
+     * Delivers one message under a caller-supplied plan. The plan is never re-derived
+     * here: RFC 0005 §2 forbids the library from choosing a delivery mode itself.
+     */
+    async send(to, message, plan, options = {}) {
+        const ctx = this.#ctx;
+        this.wakeLoop();
+        if (message.sender !== ctx.options.node_id) {
+            fail('forbidden', 'This node may only deliver messages this node authors.');
+        }
+        if (typeof to !== 'string' || to.length === 0)
+            fail('invalid_request', 'A delivery names its target endpoint.');
+        if (plan.response === 'await')
+            await this.#ensureAwaitable(plan, options.signal);
+        // RFC 0005 §3: an await that only this node could answer is a cycle, not a wait.
+        if (plan.response === 'await' && (to === ctx.options.node_id || options.expected_author === ctx.options.node_id)) {
+            fail('unsupported_delivery', 'This node cannot await a reply only it could author; no message was sent.');
+        }
+        // `to` is the participant this message addresses. The thread decides where the message is
+        // stored: an initiator owns the thread for the whole conversation, so the storing node is
+        // the thread owner and not necessarily the addressee.
+        const thread = message.meta?.thread ?? await this.#threadOf(message.meta?.in_reply_to);
+        // A reply whose original this node cannot see is answered through the reply authority,
+        // which resolves the landing from its own record. A reply never opens a conversation.
+        if (thread === undefined && message.meta?.in_reply_to !== undefined)
+            return this.#sendUntracked(to, message, plan, options);
+        if (thread === undefined && to === ctx.options.node_id) {
+            // A self-addressed message with no conversation yet lands on this node's own default.
+            return this.#admitHere(message, plan);
+        }
+        const ref = thread ?? await this.#startThread(message);
+        const normalized = {
+            ...message,
+            meta: {
+                ...message.meta,
+                thread: ref,
+                // The addressee of a directed send is who must be told; a reply already notifies the
+                // original author through the reply authority, and `@all` covers every member.
+                ...(to === ctx.options.node_id || message.meta?.in_reply_to !== undefined
+                    || message.meta?.mentions?.includes(to) === true || message.meta?.mentions?.includes('@all') === true
+                    ? {}
+                    : { mentions: [...(message.meta?.mentions ?? []), to] }),
+            },
+        };
+        if (ref.owner === ctx.options.node_id && to !== ctx.options.node_id) {
+            // The addressee can only ever learn this entry through a signed grant or a signed
+            // reconcile, so a send that names a peer this node never paired with is refused before
+            // anything is stored: it would otherwise read `accepted` while the peer can never see it.
+            if (this.#trust !== undefined && ctx.options.plugins.keys !== undefined) {
+                const pairing = await this.#trust.entry(to);
+                if (pairing === undefined) {
+                    fail('not_found', `No trust record names ${to}. Pair the nodes (trust_begin) before addressing them; nothing was stored.`);
+                }
+            }
+            const member = await this.#ensureMember(ref, to);
+            // The participant is told about the thread now, not on a later maintenance pass: this
+            // exchange is also where the participant's own policy answers, so a peer that revoked
+            // this node refuses the conversation at the point the sender can still see it.
+            try {
+                await this.#pushGrant(ref, member);
+            }
+            catch (error) {
+                const failure = failureOf(error);
+                return { admission: admissionOf(failure), error: failure };
+            }
+        }
+        const outcome = await this.#deliver(ref.owner, normalized, plan, options, to);
+        // The storing endpoint is this node whenever it started the conversation; the outcome
+        // still names the peer it addresses, or the receipt reads as a message sent to oneself.
+        return to !== ref.owner ? { ...outcome, resolved: to } : outcome;
+    }
+    /** The reply-authority route: the receiver owns the landing, so no thread is named here. */
+    async #sendUntracked(to, message, plan, options) {
+        return this.#deliver(to, message, plan, options);
+    }
+    /** Records one outbound request, then transmits it or waits for its answer. */
+    async #deliver(target, message, plan, options, addressee) {
+        const ctx = this.#ctx;
+        const slot = outboundKey(message.sender, message.id);
+        const request = {
+            idempotency_key: options.idempotency_key ?? ctx.id(),
+            retry_until: this.#window(options.retry_until),
+            message,
+            target_endpoint: target,
+            plan,
+        };
+        const digest = messageDigest(request);
+        // Who the send addresses, beside where the entry is stored: an initiator's own thread
+        // stores locally, so the record must still name the peer, or the receipt reads as a
+        // message the node sent itself.
+        const addressed = {
+            ...(addressee !== undefined && addressee !== target ? { addressee } : {}),
+            ...(typeof options.requested === 'string' && options.requested !== (addressee ?? target)
+                ? { requested: options.requested }
+                : {}),
+        };
+        // The same message identity with different content is a conflict, never a rewrite:
+        // the slot keeps the first request and the caller sends a new message id instead.
+        const record = await ctx.storage.transaction(async (tx) => {
+            const stored = await tx.get(slot);
+            if (stored !== undefined) {
+                if ((stored.digest ?? messageDigest(stored.request)) !== digest) {
+                    fail('id_conflict', 'This message identity is already bound to different content.');
+                }
+                // A re-drive of the same message keeps the first request identity, which the peer
+                // dedupes on; the consumption identity belongs to the caller waiting now, not to
+                // the delivery, so a caller that names another one replaces the stale slot.
+                // Acceptance is final; anything else is a case the caller is asking again, which is
+                // the one signal that starts a fresh attempt series after a dead letter or a backoff.
+                const recontexted = options.context === undefined || stored.local_context === options.context
+                    ? {} : { local_context: options.context };
+                if (stored.state === 'accepted') {
+                    if (Object.keys(recontexted).length === 0)
+                        return stored;
+                    const updated = { ...stored, ...recontexted };
+                    await tx.put(slot, updated);
+                    return updated;
+                }
+                const updated = { ...stored, ...recontexted, state: 'pending', attempt: undefined, next_attempt: undefined };
+                await tx.put(slot, updated);
+                return updated;
+            }
+            const fresh = {
+                request, expected_author: options.expected_author ?? target, state: 'pending', digest,
+                created_at: new Date(ctx.now()).toISOString(),
+                ...addressed,
+                ...(options.context === undefined ? {} : { local_context: options.context }),
+            };
+            await tx.put(slot, fresh);
+            return fresh;
+        });
+        if (plan.response !== 'await')
+            return this.#transmit(record, options.signal);
+        const waiter = this.#awaiting.register(record);
+        try {
+            return await this.#await(record, waiter, options.signal);
+        }
+        finally {
+            this.#awaiting.release(waiter);
+        }
+    }
+    /**
+     * Re-drives outbound records still open inside their window (RFC 0003 §3). `unknown`
+     * is terminal in meaning but the window still owns another attempt, so the window
+     * decides when to stop, not the last recorded state. A record whose window closed is
+     * settled as `unknown`, never left looking pending. Each record's own attempt series
+     * bounds the re-drive: a scheduled next attempt is respected instead of retried every
+     * pass, and a series that reached its limit stays a dead letter until an explicit
+     * re-send starts a new one. A caller invoking this directly is asking for a retry now,
+     * so it ignores the schedule; the maintenance loop's own pass respects it.
+     */
+    async recover(signal) {
+        return this.#recover(signal, false);
+    }
+    async #recover(signal, scheduled) {
+        const now = this.#ctx.now();
+        const rows = await this.#ctx.storage.transaction(async (tx) => (await tx.scan(key('outbound') + '/'))
+            .map(row => row.value)
+            .filter(row => row.digest !== undefined && (row.state === 'pending' || row.state === 'unknown'))
+            // `pending` is a request that never left; only a failed one carries a schedule.
+            .filter(row => !scheduled || row.state === 'pending' || row.next_attempt === undefined || utc(row.next_attempt) <= now));
+        for (const row of rows) {
+            if (signal?.aborted)
+                return;
+            if (utc(row.request.retry_until) <= this.#ctx.now()) {
+                if (row.state !== 'unknown') {
+                    await this.#commit(row, {
+                        state: 'unknown',
+                        error: { code: 'retry_window_expired', message: 'The window closed before this node learned the admission.', retryable: false },
+                    });
+                    this.#trace({ event: 'outbound.expired', sender: row.request.message.sender, message: row.request.message.id, code: 'retry_window_expired' });
+                }
+                continue;
+            }
+            // A recovered record has no caller left to consume a reply, so recovery re-drives the
+            // delivery and lets reconciliation surface any answer through the local inbox.
+            this.#trace({ event: 'outbound.redriven', sender: row.request.message.sender, message: row.request.message.id, target: row.request.target_endpoint });
+            await this.#transmit({ ...row, state: 'pending' }, signal);
+        }
+    }
+    /** One structured line per lifecycle transition; the host decides where the line lands. */
+    #trace(event) {
+        try {
+            this.#ctx.options.plugins.runtime?.trace?.(event);
+        }
+        catch { /* a tracing fault never breaks delivery */ }
+    }
+    #injectTrace(entry, record, outcome, reason, context) {
+        this.#trace({
+            event: 'inbound.inject', thread: entry.thread_ref, seq: entry.seq,
+            context: context ?? record.context ?? this.#ctx.options.node_id, outcome,
+            ...(reason === undefined ? {} : { reason }),
+        });
+    }
+    /** Appends to a thread this node hosts: no outbound record, no peer, no network. */
+    async #admitHere(message, plan) {
+        // A local append cannot await: the answer lands here as another local admit, which no
+        // waiter on an outbound delivery observes. Refusing is the only honest answer.
+        if (plan.response === 'await') {
+            fail('unsupported_delivery', 'A local append cannot await its answer; no message was sent.');
+        }
+        const receipt = await this.#messages.admit(this.#auth(), {
+            idempotency_key: this.#ctx.id(),
+            retry_until: this.#window(undefined),
+            message,
+            target_endpoint: this.#ctx.options.node_id,
+            plan,
+        });
+        return { admission: 'accepted', receipt };
+    }
+    /**
+     * The thread that holds a message this node can see. A reply names its original, and the
+     * original's thread is where the whole conversation lives (RFC 0002 §2): the entry this
+     * node received, or the receipt of the message this node sent.
+     */
+    async #threadOf(original) {
+        if (original === undefined)
+            return undefined;
+        return this.#ctx.storage.transaction(async (tx) => {
+            const entry = await tx.get(key('entry-ref', original.sender, original.id));
+            if (entry !== undefined)
+                return entry.thread_ref;
+            const sent = await tx.get(outboundKey(original.sender, original.id));
+            if (sent?.receipt !== undefined)
+                return sent.receipt.thread_ref;
+            // A member's copy of an owner-held message lives in its inbox, not in `entry-ref`.
+            const inbox = await tx.scan(key('inbox') + '/');
+            const held = inbox.find(row => row.value.attention.message_ref.sender === original.sender && row.value.attention.message_ref.id === original.id);
+            return held?.value.attention.thread_ref;
+        });
+    }
+    /**
+     * The thread a conversation starts in belongs to the node that started it (RFC 0002 §1),
+     * so the initiator records the thread and admits its own message there. The id is the
+     * message id: a retried first send resolves the same thread instead of opening a second.
+     */
+    async #startThread(message) {
+        const owner = this.#ctx.options.node_id;
+        const ref = { owner, id: message.id };
+        const existing = await this.#ctx.storage.transaction(tx => tx.get(key('thread', owner, ref.id)));
+        if (existing === undefined) {
+            const title = message.delivery_kind.replace(/\s+/g, ' ').trim().slice(0, 100) || message.msg.slice(0, 100);
+            await this.#threads.create(this.#auth(), {
+                idempotency_key: this.#ctx.id(), retry_until: this.#window(undefined), title, id: ref.id,
+            });
+        }
+        return ref;
+    }
+    /**
+     * Grants the addressee `post` and `read` in a thread this node owns, once, and returns the
+     * member row: the grant notice is keyed by the member revision, so the caller can push that
+     * exact notice instead of scanning the outbox for one it might not recognize.
+     */
+    async #ensureMember(ref, peer) {
+        const existing = await this.#ctx.storage.transaction(tx => tx.get(key('member', ref.owner, ref.id, peer)));
+        if (existing !== undefined)
+            return existing;
+        await this.#threads.member(this.#auth(), ref, peer, {}, {
+            idempotency_key: this.#ctx.id(), retry_until: this.#window(undefined),
+        });
+        return this.#ctx.storage.transaction(async (tx) => requireValue(await tx.get(key('member', ref.owner, ref.id, peer))));
+    }
+    /** Delivers the outstanding notice for one member's revision; none outstanding, nothing to push. */
+    async #pushGrant(_ref, member) {
+        const notice = await this.#ctx.storage.transaction(tx => tx.get(key('notice', member.revision)));
+        if (notice === undefined || notice.acked)
+            return;
+        await this.#remote(member.peer, 'POST', '/grants', { grant: notice }, undefined, this.#ctx.options.wait_ms ?? 60_000);
+    }
+    // ---- inbound path -----------------------------------------------------------
+    /**
+     * Records one inbound attention item, then acts. The durable entry and the local
+     * reply record commit before the ack (RFC 0003 §2); only then may a waiter be
+     * released, and only by an entry whose author the owner authenticated and whose
+     * author is the one expected. Invalid evidence is still acked but resolves nothing.
+     *
+     * The entry is trusted as-is: this is the runtime binding's own receive path, where
+     * the owner's authenticated response is the evidence, not a caller argument. No
+     * HTTP route accepts an `Entry` from a peer, so no peer can supply one.
+     */
+    async receive(entry, obligation_id, context) {
+        this.wakeLoop();
+        const attention = attentionOf(entry, obligation_id, this.#ctx.options.node_id);
+        const valid = this.#attest(attention, entry.thread_ref.owner);
+        let duplicate = false;
+        const queued = valid
+            ? await this.#ctx.storage.transaction(async (tx) => {
+                const stored = await tx.get(inboxKey(obligation_id));
+                if (stored !== undefined) {
+                    duplicate = true;
+                    return stored;
+                }
+                const record = { attention, ...(context === undefined ? {} : { context }), injected: false };
+                await tx.put(inboxKey(obligation_id), record);
+                return record;
+            })
+            : { attention, ...(context === undefined ? {} : { context }), injected: false };
+        const relation = entry.message.meta?.relation;
+        this.#trace(duplicate
+            ? { event: 'inbound.duplicate', sender: entry.message.sender, message: entry.message.id }
+            : {
+                event: 'inbound.received', obligation: obligation_id, thread: entry.thread_ref, seq: entry.seq,
+                sender: entry.message.sender, valid, injected: queued.injected,
+                ...(relation === 'reply' || relation === 'followup' ? { relation } : {}),
+                ...(queued.context === undefined ? {} : { context: queued.context }),
+            });
+        // `receipt` and `followup` never release a waiter; only a reply to the original does.
+        if (valid)
+            this.#settle(entry);
+        if (!queued.attention.acked && valid)
+            await this.#ack(entry.thread_ref, obligation_id);
+        if (valid)
+            await this.#consume(entry, queued);
+        return queued;
+    }
+    /**
+     * Reconciles unacked attention for every owner this node knows (RFC 0003 §2): the
+     * `owner + thread_ref` pairs recorded when a grant notice was accepted, plus the
+     * threads this node hosts, which need no grant. The owner's authenticated attention
+     * list is the evidence; the ack goes out only after the entry is durable locally.
+     * An owner this node cannot reach is reported as a trace record, never thrown: one dead
+     * owner must not starve the rest, and a silent skip is the failure nobody can diagnose.
+     * Each (owner, thread) carries its own attempt series: a call from the maintenance pass
+     * respects the scheduled next attempt, and an exhausted series stays a dead letter so an
+     * unreachable owner costs one probe per window instead of one storm per pass. A caller
+     * invoking this directly is asking for a retry now, so it ignores the schedule — and still
+     * counts the attempt, so a caller that retries in a loop reaches the same dead letter.
+     */
+    async reconcile(signal) {
+        return this.#reconcile(signal, false);
+    }
+    async #reconcile(signal, scheduled) {
+        const now = this.#ctx.now();
+        for (const ref of await this.#knownRefs()) {
+            if (signal?.aborted)
+                break;
+            const backoff = await this.#ctx.storage.transaction(tx => tx.get(reconcileBackoffKey(ref)));
+            if (backoff?.dead === true)
+                continue;
+            if (scheduled && backoff !== undefined && utc(backoff.next_attempt) > now)
+                continue;
+            try {
+                await this.#reconcileThread(ref, signal);
+                if (backoff !== undefined)
+                    await this.#ctx.storage.transaction(tx => tx.delete(reconcileBackoffKey(ref)));
+            }
+            catch (error) {
+                if (ref.owner === this.#ctx.options.node_id)
+                    throw error;
+                await this.#reportReconcileFailure(ref, error);
+                continue;
+            }
+        }
+        return this.#messages.inbox(this.#auth(), {});
+    }
+    /**
+     * Records one failed attempt in the thread's series and writes at most one line per window.
+     * A failed pull drops nothing, so the series owns the retry; an attempt that reaches the
+     * limit parks the thread as unreachable and writes one terminal line instead of the
+     * per-window one.
+     */
+    async #reportReconcileFailure(ref, error) {
+        const failure = failureOf(error);
+        const attempt = await this.#ctx.storage.transaction(async (tx) => {
+            const slot = reconcileBackoffKey(ref);
+            const previous = await tx.get(slot);
+            const attempt = (previous?.attempt ?? 0) + 1;
+            const next = {
+                owner: ref.owner, thread: ref.id, attempt,
+                next_attempt: new Date(this.#ctx.now() + backoffMs(attempt)).toISOString(),
+                code: failure.code, message: failure.message,
+                ...(attempt >= MAX_ATTEMPTS ? { dead: true } : {}),
+            };
+            await tx.put(slot, next);
+            return attempt;
+        });
+        if (attempt >= MAX_ATTEMPTS) {
+            this.#trace({ event: 'reconcile.unreachable', owner: ref.owner, thread: ref.id, code: failure.code, attempts: attempt });
+            return;
+        }
+        this.#windowedFailure(key(ref.owner, ref.id, failure.code), attempts => ({
+            event: 'reconcile.failed', owner: ref.owner, thread: ref.id,
+            code: failure.code, message: failure.message, attempts,
+        }));
+    }
+    /**
+     * Writes at most one failure line per scope per window: a permanently dead peer stays
+     * observable without writing the same line every pass, and the line reports how many
+     * suppressed attempts it accounts for.
+     */
+    #windowedFailure(slot, line) {
+        const now = this.#ctx.now();
+        const held = this.#failureWindows.get(slot);
+        if (held !== undefined && now - held.at < FAILURE_WINDOW_MS) {
+            held.suppressed += 1;
+            return;
+        }
+        this.#failureWindows.set(slot, { at: now, suppressed: 0 });
+        this.#trace(line((held?.suppressed ?? 0) + 1));
+    }
+    /**
+     * Delivers outstanding owner grant notices, replays owed todos and entries whose durable
+     * record never reached the model, re-asks trusted owners for the memberships they hold for
+     * this node, re-drives owed trust statements, then reconciles. Replay follows each thread's
+     * own order: `owner`, `id`, then `seq` as a number. One record that fails never starves the
+     * rest, and the failures are thrown after the pass with their records still owed for the
+     * next one. Caller-scheduled, and the only entry a host without a maintenance clock needs
+     * besides `recover`.
+     */
+    async maintain(signal) {
+        await this.#deliverGrants(signal);
+        if (signal?.aborted)
+            return;
+        await this.#confirmGrants(signal);
+        if (signal?.aborted)
+            return;
+        // Before reconciliation, so rows this repairs are pulled in the same pass.
+        await this.#resyncGrants(signal);
+        if (signal?.aborted)
+            return;
+        const failures = [];
+        // Owed todos replay before the inbox pass, so a hook that fails now waits for the next
+        // pass instead of being retried inside this one.
+        await this.#replayTodos(signal, failures);
+        if (signal?.aborted)
+            return;
+        await this.#replayInbox(signal, failures);
+        if (signal?.aborted)
+            return;
+        try {
+            await this.#reconcile(signal, true);
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        // Trust re-drive belongs to the pass, not to the loop: a host that schedules `maintain`
+        // itself must still deliver owed statements (RFC 0017 §3.5).
+        try {
+            await this.#trust?.redrive(signal);
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        if (failures.length === 1)
+            throw failures[0];
+        if (failures.length > 1)
+            throw new AggregateError(failures, 'Some owed records could not be settled; the rest were.');
+    }
+    /**
+     * Whether any durable record still needs a local pass: an unacked grant notice, an
+     * owed todo, an uninjected inbox row, or an outbound still owed an attempt. A scheduler
+     * consults this before running `maintain`, so an idle node costs no rounds; anything
+     * that flips this on (an admission, an ack, a failed delivery) also wakes the host.
+     * A dead-lettered send is terminal, and a scheduled retry counts only once it is due, so
+     * neither holds the active cadence for a peer that is simply away.
+     */
+    async hasPendingWork() {
+        return this.#ctx.storage.transaction(async (tx) => {
+            const now = this.#ctx.now();
+            const inbox = await tx.scan(key('inbox') + '/');
+            if (inbox.some(row => !row.value.attention.acked || !row.value.injected && row.value.attention.entry !== undefined && row.value.attention.disposition !== 'expired'))
+                return true;
+            const todos = await tx.scan(key('todo') + '/');
+            if (todos.some(row => !row.value.done))
+                return true;
+            const outbound = await tx.scan(key('outbound') + '/');
+            if (outbound.some(row => row.value.digest !== undefined && (row.value.state === 'pending'
+                || (row.value.state === 'unknown' && (row.value.next_attempt === undefined || utc(row.value.next_attempt) <= now)))))
+                return true;
+            // A grant notice is how a participant learns the thread it must reconcile, so an
+            // unacked notice is work: skipping it leaves the thread undiscoverable.
+            const notices = await tx.scan(key('notice') + '/');
+            if (notices.some(row => row.value.acked !== true))
+                return true;
+            const grants = await tx.scan(key('grant') + '/');
+            if (grants.some(row => row.value.acked !== true))
+                return true;
+            // An approval whose statement the peer has not confirmed is owed work too: the loop
+            // re-drives it once the retry window opens (RFC 0017 §3.5).
+            // A backed-off obligation still counts once its delay has passed; until then the idle
+            // cadence is enough to notice it, so it does not force the active one.
+            const exchanges = await tx.scan(key('trust-outbound') + '/');
+            if (exchanges.some(row => row.value.blocked === undefined || row.value.blocked <= now))
+                return true;
+            return false;
+        });
+    }
+    /** Replays todos that are owed but whose hook has not succeeded, in thread order. */
+    async #replayTodos(signal, failures) {
+        const owed = await this.#ctx.storage.transaction(async (tx) => (await tx.scan(key('todo') + '/')).map(row => row.value).filter(row => !row.done));
+        owed.sort((a, b) => replayOrder(a.entry, b.entry));
+        for (const row of owed) {
+            if (signal?.aborted)
+                return;
+            try {
+                await this.#deliverTodo(row.entry, row.context);
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+    }
+    /**
+     * Replays inbox records the model has not seen. A record already delivered is skipped, but
+     * an entry durable here still answers a live await, and its owed todo replays above even
+     * when the record is already injected.
+     */
+    async #replayInbox(signal, failures) {
+        const queued = await this.#ctx.storage.transaction(async (tx) => (await tx.scan(key('inbox') + '/')).map(row => row.value));
+        queued.sort((a, b) => replayOrder(a.attention.entry, b.attention.entry));
+        for (const record of queued) {
+            if (signal?.aborted)
+                return;
+            const entry = record.attention.entry;
+            if (entry === undefined)
+                continue;
+            // An entry already durable here answers a live await even when the runtime never saw it.
+            this.#settle(entry);
+            if (record.injected || record.attention.disposition === 'expired')
+                continue;
+            try {
+                await this.#consume(entry, record);
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+    }
+    // ---- the single agent entry --------------------------------------------------
+    /**
+     * The one call a model makes. SystemOne turns the intent into a typed action, the
+     * decision is persisted with its input, then exactly that action runs. With no
+     * usable decision the request fails: the library never picks a plan itself.
+     */
+    async msg(input, options = {}) {
+        if (input == null || typeof input.delivery_kind !== 'string' || typeof input.msg !== 'string') {
+            fail('invalid_request', 'msg needs string delivery_kind and msg fields.');
+        }
+        const action = await this.#decide(input);
+        if (action.kind !== 'send')
+            return this.#dispatch(action, options);
+        const prepared = this.#prepare(input, action);
+        const outcome = await this.send(prepared.to, prepared.message, prepared.plan, { ...options, ...(typeof input.meta?.to === 'string' ? { requested: input.meta.to } : {}) });
+        return this.#addressed(outcome, input.meta?.to, prepared.to);
+    }
+    async prepare(input) {
+        const action = await this.#decide(input);
+        if (action.kind !== 'send')
+            fail('invalid_request', 'A draft must describe a message to send.');
+        return this.#prepare(input, action);
+    }
+    async readResources(query, options = {}) {
+        const auth = this.#auth();
+        const search = new URLSearchParams();
+        if ('cursor' in query && query.cursor !== undefined)
+            search.set('cursor', query.cursor);
+        if ('page_size' in query && query.page_size !== undefined)
+            search.set(query.op === 'log' ? 'limit' : 'page_size', String(query.page_size));
+        if (query.op === 'log' && query.since !== undefined)
+            search.set('since', query.since);
+        const suffix = search.size === 0 ? '' : `?${search}`;
+        const remote = (owner, path) => this.#remote(owner, 'GET', path + suffix, undefined, options.signal, this.#ctx.options.wait_ms ?? 60_000);
+        if (query.op === 'list') {
+            const owners = [...new Set(query.owners ?? [this.#ctx.node])];
+            if (query.cursor !== undefined && owners.length !== 1)
+                fail('invalid_request', 'A resource cursor names exactly one owner.');
+            const rows = await Promise.all(owners.map(async (owner) => {
+                try {
+                    const result = owner === this.#ctx.node
+                        ? await this.#resources.list(auth, query)
+                        : await remote(owner, '/resources');
+                    return { owner, page: result };
+                }
+                catch (error) {
+                    if (options.signal?.aborted)
+                        throw error;
+                    return { owner, error: failureOf(error) };
+                }
+            }));
+            return { owners: rows };
+        }
+        const ref = query.resource;
+        const local = ref.owner === this.#ctx.node;
+        const path = `/resources/${encodeURIComponent(ref.owner)}/${encodeURIComponent(ref.id)}`;
+        switch (query.op) {
+            case 'describe': return local ? this.#resources.describe(auth, ref) : remote(ref.owner, path);
+            case 'log': return local ? this.#resources.log(auth, ref, query) : remote(ref.owner, path + '/log');
+            case 'event': return local ? this.#resources.event(auth, ref, query.event_id) : remote(ref.owner, path + `/log/${encodeURIComponent(query.event_id)}`);
+            case 'operations': return local ? this.#resources.operations(auth, ref, query) : remote(ref.owner, path + '/operations');
+            case 'status': return local ? this.#resources.operation(auth, ref, query.operation_id) : remote(ref.owner, path + `/operations/${encodeURIComponent(query.operation_id)}`);
+        }
+    }
+    #prepare(input, action) {
+        if (action.response === undefined || action.execution === undefined) {
+            fail('decision_unavailable', 'A send needs response and execution; no plan was chosen.');
+        }
+        const meta = input.meta;
+        // RFC 0003 §1: the decision may carry the work unit, and a caller may name it in the
+        // input meta; either way it becomes the first-class field a receiver dedupes on.
+        const work = action.work !== undefined
+            ? workRef(action.work, 'action.work')
+            : meta?.work === undefined ? undefined : workRef(meta.work, 'message.meta.work');
+        const relation = action.in_reply_to === undefined ? action.relation : action.relation ?? 'reply';
+        const message = {
+            id: this.#ctx.id(),
+            sender: this.#ctx.options.node_id,
+            delivery_kind: input.delivery_kind,
+            msg: input.msg,
+            ...(action.thread === undefined && action.in_reply_to === undefined && action.mentions === undefined
+                && work === undefined && meta === undefined
+                ? {}
+                : {
+                    meta: {
+                        ...(work === undefined ? {} : { work }),
+                        ...(action.thread === undefined ? {} : { thread: action.thread }),
+                        ...(action.in_reply_to === undefined ? {} : { in_reply_to: action.in_reply_to }),
+                        ...(relation === undefined ? {} : { relation }),
+                        ...(action.mentions === undefined ? {} : { mentions: action.mentions }),
+                        ...(meta === undefined ? {} : { data: meta }),
+                    },
+                }),
+        };
+        const plan = {
+            response: action.response, execution: action.execution,
+            ...(action.context === undefined ? {} : { context: action.context }),
+        };
+        // A thread this node owns stores the entry locally; `action.to` is the participant the
+        // message addresses, and the two differ whenever an initiator writes to a member.
+        return { to: action.to, message, plan };
+    }
+    /**
+     * The caller's own spelling beside the node the decision resolved it to. Equal spellings say
+     * nothing new; a bare alias that resolved to a peer is the case the receipt cannot show. A
+     * `resolved` the send already derived (the addressee of an initiator's own thread) is kept.
+     */
+    #addressed(outcome, requested, resolved) {
+        const merged = outcome.resolved === undefined ? { ...outcome, resolved } : outcome;
+        return typeof requested !== 'string' || requested === resolved ? merged : { ...merged, requested };
+    }
+    // ---- internals ---------------------------------------------------------------
+    #auth() {
+        return { actor: this.#ctx.options.node_id };
+    }
+    /** Persists the decision and its outcome. RFC 0005 §2: a decision the library cannot act on is a recorded failure. */
+    async #decide(input) {
+        const decision_id = this.#ctx.id();
+        const at = new Date(this.#ctx.now()).toISOString();
+        let action;
+        try {
+            action = await this.#ctx.options.plugins.decide(input);
+        }
+        catch (error) {
+            const failure = failureOf(error);
+            await this.#ctx.storage.transaction(tx => tx.put(key('decision', decision_id), { input, at, error: failure }));
+            if (failure.code !== 'decision_unavailable' && failure.code !== 'unavailable')
+                throw error;
+            fail('decision_unavailable', failure.message);
+        }
+        if (action == null || typeof action !== 'object' || !['send', 'read', 'thread', 'resource', 'domain'].includes(action.kind)) {
+            await this.#ctx.storage.transaction(tx => tx.put(key('decision', decision_id), {
+                input, at,
+                error: { code: 'decision_unavailable', message: 'The decision is not an executable action.', retryable: true },
+            }));
+            fail('decision_unavailable', 'The decision is not an executable action.');
+        }
+        await this.#ctx.storage.transaction(tx => tx.put(key('decision', decision_id), { input, action, at }));
+        return action;
+    }
+    /**
+     * Only `await` needs the host capability, and it is checked before sending (RFC 0005 §5).
+     * `async` ends at the peer and never holds the call open, so it needs nothing here.
+     */
+    async #ensureAwaitable(plan, signal) {
+        if (signal?.aborted)
+            throw signal.reason ?? new Error('The send was cancelled.');
+        const runtime = this.#ctx.options.plugins.runtime;
+        if (runtime === undefined || !(await runtime.supports(plan))) {
+            fail('unsupported_delivery', 'The host cannot hold this await, so no message was sent.');
+        }
+    }
+    /** RFC 0003 §8: the declared window never exceeds the node's supported maximum. */
+    #window(requested) {
+        const ceiling = new Date(this.#ctx.now() + (this.#ctx.options.retry_max_ms ?? 86_400_000)).toISOString();
+        if (requested === undefined)
+            return ceiling;
+        return utc(requested) < utc(ceiling) ? requested : ceiling;
+    }
+    /** One attempt's budget: the wait bound, never past the admission window. */
+    #attempt(record) {
+        const wait = this.#ctx.options.wait_ms ?? 60_000;
+        const remaining = utc(record.request.retry_until) - this.#ctx.now();
+        return Math.max(1, Math.min(wait, remaining));
+    }
+    /**
+     * A network call that cannot outlive its attempt: the caller's signal cancels it, and
+     * even with no signal the attempt ends on its own deadline, so an unreachable peer or
+     * a hanging resolver cannot pin a delivery forever (RFC 0005 §3).
+     */
+    async #remote(target, method, path, body, signal, budget) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(new Error('The attempt exceeded its deadline.')), budget);
+        const onAbort = () => controller.abort(signal?.reason);
+        if (signal !== undefined) {
+            if (signal.aborted)
+                controller.abort(signal.reason);
+            else
+                signal.addEventListener('abort', onAbort, { once: true });
+        }
+        try {
+            return await this.#transport.request(target, method, path, body, controller.signal);
+        }
+        finally {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', onAbort);
+        }
+    }
+    async #transmit(record, signal) {
+        const request = record.request;
+        try {
+            const thread = request.message.meta?.thread;
+            // The thread owner stores the entry. When that owner is this node the admission is
+            // local: the same service, the same idempotency and the same receipt, no loopback call.
+            const receipt = request.target_endpoint === this.#ctx.options.node_id
+                ? await this.#messages.admit(this.#auth(), request)
+                : await this.#remote(request.target_endpoint, 'POST', thread === undefined
+                    ? '/messages'
+                    : `/threads/${encodeURIComponent(thread.owner)}/${encodeURIComponent(thread.id)}/messages`, request, signal, this.#attempt(record));
+            await this.#commit(record, { state: 'accepted', receipt });
+            const guarantee = receipt.guarantee;
+            this.#trace({
+                event: 'outbound.admitted', sender: request.message.sender, message: request.message.id,
+                target: request.target_endpoint, ...(record.addressee === undefined ? {} : { resolved: record.addressee }),
+                state: 'accepted', ...(typeof guarantee === 'string' ? { guarantee } : {}),
+            });
+            return { admission: 'accepted', receipt };
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw error;
+            const failure = failureOf(error);
+            const state = admissionOf(failure);
+            // A retryable failure is one attempt of a bounded series: the next attempt is scheduled,
+            // and an exhausted series becomes a dead letter instead of being re-driven on every pass.
+            // A recorded refusal is final and carries no series at all.
+            const previous = await this.#ctx.storage.transaction(tx => tx.get(outboundKey(request.message.sender, request.message.id)));
+            const attempt = state === 'refused' ? undefined : (previous?.attempt ?? 0) + 1;
+            const terminal = attempt !== undefined && attempt >= MAX_ATTEMPTS;
+            await this.#commit(record, {
+                state: terminal ? 'unreachable' : state,
+                error: failure,
+                ...(attempt === undefined ? {} : { attempt }),
+                ...(attempt === undefined || terminal ? {} : { next_attempt: new Date(this.#ctx.now() + backoffMs(attempt)).toISOString() }),
+            });
+            this.#trace({
+                event: 'outbound.admitted', sender: request.message.sender, message: request.message.id,
+                target: request.target_endpoint, ...(record.addressee === undefined ? {} : { resolved: record.addressee }),
+                state: terminal ? 'unreachable' : state, code: failure.code,
+            });
+            if (terminal)
+                this.#trace({
+                    event: 'outbound.unreachable', sender: request.message.sender, message: request.message.id,
+                    target: request.target_endpoint, attempts: attempt, code: failure.code,
+                });
+            const stored = await this.#ctx.storage.transaction(tx => tx.get(outboundKey(request.message.sender, request.message.id)));
+            return {
+                admission: stored?.state ?? (terminal ? 'unreachable' : state),
+                ...(stored?.state === 'accepted' ? {} : { error: failure }),
+                ...(stored?.receipt === undefined ? (record.receipt === undefined ? {} : { receipt: record.receipt }) : { receipt: stored.receipt }),
+            };
+        }
+    }
+    /**
+     * Deliver, then wait on the one thing that can answer: a reply whose author the owner
+     * authenticated. A timeout ends only this wait; it never invents a state for the
+     * delivery, so a still-open record stays open for recovery.
+     */
+    async #await(record, waiter, signal) {
+        const reply = await this.#awaitOutcome(record, waiter, signal);
+        if (reply.reply === undefined)
+            return reply;
+        // A body already confirmed consumed in this context is rendered as arrival facts only
+        // (RFC 0008 §5). The sender's own consumption identity decides; the plan's context
+        // belongs to the receiver and is never this caller's. A generic caller that names none
+        // is the node itself.
+        const context = record.local_context ?? this.#ctx.options.node_id;
+        const consumed = await this.#alreadyConsumed(reply.reply, context);
+        // The body is now in the caller's hands as a tool result: hold it until the host confirms
+        // consumption, so no automatic fragment presents the same body in that context again. A
+        // wait that is cancelled or times out returns no reply, so it never places a hold.
+        if (!consumed) {
+            this.#awaiting.hold(reply.reply, context);
+        }
+        // Returning the body does not by itself write the record: RFC 0008 §5 forbids advancing
+        // consumption on a submitted tool result. The host calls `confirmConsumption` once it has
+        // observed the model consume the result.
+        return { ...reply, ...(consumed ? { reply_body: 'withheld' } : {}) };
+    }
+    /**
+     * `confirmConsumption(entry, context?, via = 'fragment'): Promise<void>`
+     *
+     * The host's confirmation that this entry's body was consumed by the path it names
+     * (RFC 0008 §5). One commit writes the shared consumption slot, marks every matching inbox
+     * record delivered, and records the todo this consumption owes; the host's todo hook runs
+     * outside that commit, and the todo is filed where the model saw the body. `context` names
+     * that place; with none, the context the entry landed in decides, then this node. A failing
+     * hook leaves the todo owed, so `maintain` replays it, and replaying is safe because the
+     * host commits the todo it creates. This also releases the hold an awaited tool result
+     * placed on the entry for that context.
+     */
+    async confirmConsumption(entry, context, via = 'fragment') {
+        const at = new Date(this.#ctx.now()).toISOString();
+        const consumedIn = await this.#ctx.storage.transaction(async (tx) => {
+            // A row keeps the context the entry landed in; the confirmation context only fills in
+            // for a row that names none.
+            let original;
+            let settled = false;
+            let consumable = false;
+            for (const row of await tx.scan(key('inbox') + '/')) {
+                const held = row.value.attention.entry;
+                if (held === undefined)
+                    continue;
+                if (held.thread_ref.owner !== entry.thread_ref.owner || held.thread_ref.id !== entry.thread_ref.id)
+                    continue;
+                if (held.seq !== entry.seq)
+                    continue;
+                if (row.value.settlement !== undefined) {
+                    settled = true;
+                    continue;
+                }
+                consumable = true;
+                original = original ?? row.value.context;
+                if (row.value.injected)
+                    continue;
+                const landed = row.value.context ?? context;
+                await tx.put(row.key, { ...row.value, injected: true, ...(landed === undefined ? {} : { context: landed }) });
+            }
+            if (settled && !consumable)
+                return undefined;
+            const where = context ?? original ?? this.#ctx.options.node_id;
+            const slot = consumptionKey(where, entry.thread_ref, entry.seq);
+            const stored = await tx.get(slot);
+            if (stored?.confirmed !== true) {
+                await tx.put(slot, {
+                    context: where, thread_ref: entry.thread_ref, seq: entry.seq, confirmed: true, via, at,
+                });
+            }
+            await this.#oweTodo(tx, entry, where);
+            return where;
+        });
+        if (consumedIn === undefined) {
+            this.#awaiting.forget(entry);
+            return;
+        }
+        this.#awaiting.releaseContext(entry, consumedIn);
+        this.#trace({ event: 'consumption.confirmed', thread: entry.thread_ref, seq: entry.seq, context: consumedIn, via });
+        this.#ctx.options.plugins.runtime?.notify({ event: 'inbound', thread: entry.thread_ref, seq: entry.seq, sender: entry.message.sender });
+        await this.#deliverTodo(entry, consumedIn);
+    }
+    /** `confirmToolResult(entry, context?): Promise<void>`: the same settlement for an awaited tool result. */
+    async confirmToolResult(entry, context) {
+        await this.confirmConsumption(entry, context, 'tool_result');
+    }
+    /**
+     * `isWaitingReply(entry, context?): boolean`
+     *
+     * Whether this entry answers an `await` that owns its body here, optionally only one whose
+     * sender-local context is `context`: a waiter still running, or a reply already returned as
+     * a tool result and not yet confirmed consumed. A host defers the automatic fragment on
+     * `true`, because the tool result either holds or already presented the same body. A
+     * cancelled wait returns no reply, so it holds nothing.
+     */
+    isWaitingReply(entry, context) {
+        return this.#awaiting.waiting(entry, context);
+    }
+    async #awaitOutcome(record, waiter, signal) {
+        // The request and the wait start together: a reply that is already durable here, or that
+        // lands while the request is still in flight, answers this call without waiting for the
+        // response. The request keeps running and records its admission when it lands.
+        const budget = this.#attempt(record);
+        const deadline = Date.now() + budget;
+        const sending = this.#transmit(record, signal);
+        const first = await this.#watch(record, waiter, signal, budget, sending);
+        if ('failed' in first) {
+            if (signal?.aborted)
+                return { admission: record.state, wait: 'cancelled' };
+            throw first.failed;
+        }
+        if ('replied' in first)
+            return { admission: record.state, ...(record.receipt === undefined ? {} : { receipt: record.receipt }), reply: first.replied, wait: 'answered' };
+        if ('evidence' in first)
+            return { admission: record.state, ...(record.receipt === undefined ? {} : { receipt: record.receipt }), reply: first.evidence, wait: 'answered' };
+        if ('cancelled' in first)
+            return { admission: record.state, wait: 'cancelled' };
+        // The wait bound can pass just before the request's own deadline fires. Its outcome still
+        // belongs to this call, so collect it rather than leave the attempt unobserved.
+        const delivered = 'delivered' in first ? first.delivered : await sending;
+        if (delivered.admission !== 'accepted')
+            return delivered;
+        // Admitted but unanswered: only a reply or the remaining deadline can end this.
+        const receipt = delivered.receipt !== undefined
+            ? { receipt: delivered.receipt }
+            : record.receipt === undefined ? {} : { receipt: record.receipt };
+        const remaining = Math.max(1, deadline - Date.now());
+        const second = await this.#watch(record, waiter, signal, remaining, undefined);
+        if ('failed' in second) {
+            if (signal?.aborted)
+                return { admission: 'accepted', ...receipt, wait: 'cancelled' };
+            throw second.failed;
+        }
+        if ('replied' in second)
+            return { admission: 'accepted', ...receipt, reply: second.replied, wait: 'answered' };
+        if ('evidence' in second)
+            return { admission: 'accepted', ...receipt, reply: second.evidence, wait: 'answered' };
+        if ('cancelled' in second)
+            return { admission: 'accepted', ...receipt, wait: 'cancelled' };
+        // The budget passed: one last look at durable evidence, then stop asking.
+        const late = await this.#evidence(record);
+        if (late !== undefined)
+            return { admission: 'accepted', ...receipt, reply: late, wait: 'answered' };
+        return { admission: 'accepted', ...receipt, wait: 'timed_out' };
+    }
+    /**
+     * One bounded watch over every signal that can end a wait: a live reply, durable reply
+     * evidence, the request settling, cancellation, or the deadline. Exactly one timer and one
+     * abort listener exist, and both are released whichever signal wins.
+     */
+    async #watch(record, waiter, signal, budget, sending) {
+        const evidence = this.#evidence(record);
+        return new Promise(resolve => {
+            let done = false;
+            let timer;
+            const onAbort = () => finish({ cancelled: true });
+            const finish = (outcome) => {
+                if (done)
+                    return;
+                done = true;
+                clearTimeout(timer);
+                signal?.removeEventListener('abort', onAbort);
+                resolve(outcome);
+            };
+            timer = setTimeout(() => finish({ elapsed: true }), budget);
+            if (signal?.aborted)
+                finish({ cancelled: true });
+            else
+                signal?.addEventListener('abort', onAbort, { once: true });
+            void waiter.outcome.then(entry => finish({ replied: entry }));
+            void evidence.then(entry => { if (entry !== undefined)
+                finish({ evidence: entry }); }, error => finish({ failed: error }));
+            if (sending !== undefined) {
+                void sending.then(delivered => finish({ delivered }), error => finish({ failed: error }));
+            }
+        });
+    }
+    /**
+     * Acceptance is final. The digest is written with every state change, so recovery and
+     * replay keep recognising the message identity instead of losing it to a bare record.
+     */
+    async #commit(record, change) {
+        const request = record.request;
+        const digest = record.digest ?? messageDigest(request);
+        await this.#ctx.storage.transaction(async (tx) => {
+            const slot = outboundKey(request.message.sender, request.message.id);
+            const current = await tx.get(slot);
+            if (current?.state === 'accepted')
+                return;
+            const next = { ...record, ...change, digest };
+            if (next.state === 'accepted')
+                delete next.error;
+            // A settled record owes no further attempt, and a dead letter must not carry a schedule
+            // a later pass would read as permission to try again.
+            if (next.state === 'accepted' || next.state === 'refused' || next.state === 'unreachable') {
+                delete next.next_attempt;
+                if (next.state !== 'unreachable')
+                    delete next.attempt;
+            }
+            await tx.put(slot, next);
+        });
+    }
+    /** Legal reply evidence already on this node for the given original (RFC 0005 §3). */
+    async #evidence(record) {
+        const expected = record.expected_author;
+        const found = await this.#ctx.storage.transaction(async (tx) => (await tx.scan(key('inbox') + '/'))
+            .map(row => row.value.attention.entry)
+            .filter((entry) => entry !== undefined && isReply(record.request.message, entry) && entry.authenticated_author === expected));
+        return found.sort((a, b) => (decimal(a.seq) < decimal(b.seq) ? -1 : decimal(a.seq) > decimal(b.seq) ? 1 : 0))[0];
+    }
+    /** Releases every live await whose original this entry answers, in this process. */
+    #settle(entry) {
+        const settled = this.#awaiting.settle(entry);
+        if (settled > 0)
+            this.#trace({ event: 'await.settled', thread: entry.thread_ref, seq: entry.seq, waiters: settled });
+    }
+    /**
+     * Owner-authenticated evidence only: the entry's own claims grant nothing. `owner` is
+     * the node the evidence came from, so a remote owner's attention list attests just as
+     * strongly as this node's own threads do, and nothing else does. `local` is the copy this
+     * node already holds, used when the owner's row carries no body.
+     */
+    #attest(attention, owner, local) {
+        if (attention.recipient !== this.#ctx.options.node_id)
+            return false;
+        if (attention.thread_ref?.owner !== owner)
+            return false;
+        const entry = attention.entry ?? local;
+        if (entry === undefined)
+            return attention.disposition === 'expired';
+        const ref = attention.thread_ref;
+        return entry.thread_ref.owner === ref.owner
+            && entry.thread_ref.id === ref.id
+            && entry.seq === attention.seq
+            && entry.message.sender === attention.message_ref.sender
+            && entry.message.id === attention.message_ref.id
+            && entry.authenticated_author === attention.authenticated_author
+            && entry.message.sender === entry.authenticated_author
+            && typeof entry.authenticated_author === 'string' && entry.authenticated_author.length > 0
+            && /^(0|[1-9][0-9]*)$/.test(entry.seq);
+    }
+    async #ack(ref, obligation_id) {
+        const mutation = { idempotency_key: this.#ctx.id(), retry_until: this.#window(undefined) };
+        const path = `/threads/${encodeURIComponent(ref.owner)}/${encodeURIComponent(ref.id)}/attention/${encodeURIComponent(obligation_id)}/ack`;
+        let acked;
+        try {
+            if (ref.owner === this.#ctx.options.node_id)
+                await this.#messages.ack(this.#auth(), ref, obligation_id, mutation);
+            else
+                await this.#remote(ref.owner, 'POST', path, mutation, undefined, this.#ctx.options.wait_ms ?? 60_000);
+        }
+        catch {
+            // Ack is idempotent and reconciliation re-sends it; the entry stays durable either way.
+            return;
+        }
+        await this.#ctx.storage.transaction(async (tx) => {
+            const stored = await tx.get(inboxKey(obligation_id));
+            if (stored !== undefined && !stored.attention.acked) {
+                await tx.put(inboxKey(obligation_id), { ...stored, attention: { ...stored.attention, acked: true } });
+                acked = { thread: stored.attention.thread_ref, seq: stored.attention.seq };
+            }
+        });
+        if (acked !== undefined)
+            this.#trace({ event: 'inbound.acked', obligation: obligation_id, thread: acked.thread, seq: acked.seq });
+    }
+    /**
+     * Consumed is recorded only after the host observed the entry in the context. The
+     * context is the obligation's own, then the plan's, then this node; the host may
+     * answer with the context it really used, and that is the one the todo follows.
+     */
+    async #consume(entry, record) {
+        if (record.injected) {
+            this.#injectTrace(entry, record, 'skipped', 'injected');
+            return;
+        }
+        if (await this.#settleResourceAttention(entry, record))
+            return;
+        const runtime = this.#ctx.options.plugins.runtime;
+        if (runtime === undefined) {
+            this.#injectTrace(entry, record, 'skipped', 'no-runtime');
+            return;
+        }
+        const related = entry.message.meta?.in_reply_to;
+        const outbound = related?.sender === this.#ctx.options.node_id
+            ? await this.#ctx.storage.transaction(tx => tx.get(outboundKey(related.sender, related.id)))
+            : undefined;
+        const replyContext = outbound !== undefined && outbound.expected_author === entry.authenticated_author
+            && isReply(outbound.request.message, entry) ? outbound.local_context ?? this.#ctx.options.node_id : undefined;
+        const requested = replyContext ?? record.context ?? record.attention.plan?.context ?? this.#ctx.options.node_id;
+        // An await that owns this reply's body in that context either still holds the call or
+        // already returned it as a tool result. Presenting the same body as a fragment here
+        // would duplicate it; the await's confirmation releases the hold.
+        if (this.isWaitingReply(entry, requested)) {
+            this.#injectTrace(entry, record, 'waiting', 'await-hold', requested);
+            return;
+        }
+        // The entry may already be confirmed consumed in that context through an awaited tool
+        // result; presenting it again as a fragment is the duplicate RFC 0008 §5 forbids. The
+        // shared record and the todo it owes are then all that is left to write.
+        if (await this.#alreadyConsumed(entry, requested)) {
+            this.#injectTrace(entry, record, 'consumed', 'already-consumed', requested);
+            await this.confirmConsumption(entry, requested, 'tool_result');
+            return;
+        }
+        const injected = await runtime.inject(entry, requested, record.attention.plan);
+        this.#injectTrace(entry, record, injected.outcome ?? (injected.consumed ? 'consumed' : 'delivered'), undefined, injected.context);
+        if (!injected.consumed)
+            return;
+        await this.confirmConsumption(entry, injected.context, 'fragment');
+    }
+    async #settleResourceAttention(entry, record) {
+        const ref = entry.message.meta?.data?.resource_ref;
+        if (typeof ref !== 'object' || ref === null || Array.isArray(ref)
+            || typeof ref.owner !== 'string' || typeof ref.id !== 'string'
+            || ref.owner !== entry.authenticated_author)
+            return false;
+        const resource_ref = { owner: ref.owner, id: ref.id };
+        let settlement;
+        const at = new Date(this.#ctx.now()).toISOString();
+        try {
+            const resource = await this.readResources({ op: 'describe', resource: resource_ref }, { signal: AbortSignal.timeout(RESOURCE_CHECK_MS) });
+            if (resource.binding.handler === this.#ctx.node)
+                return false;
+            settlement = { via: 'handover', resource_ref, handler: resource.binding.handler, revision: resource.revision, at };
+        }
+        catch (error) {
+            const failure = failureOf(error);
+            if (failure.code !== 'not_found') {
+                const attempts = await this.#ctx.storage.transaction(async (tx) => {
+                    const slot = inboxKey(record.attention.obligation_id);
+                    const current = await tx.get(slot);
+                    if (current === undefined || current.injected)
+                        return undefined;
+                    const attempts = (current.resource_check_failures ?? 0) + 1;
+                    await tx.put(slot, { ...current, resource_check_failures: attempts });
+                    return attempts;
+                });
+                if (attempts !== undefined)
+                    this.#trace({
+                        event: 'inbound.resource-check.failed', thread: entry.thread_ref, seq: entry.seq,
+                        resource_ref, code: failure.code, attempts,
+                    });
+                throw error;
+            }
+            settlement = { via: 'undeliverable', resource_ref, reason: 'resource-unavailable', at };
+        }
+        const changed = await this.#ctx.storage.transaction(async (tx) => {
+            const slot = inboxKey(record.attention.obligation_id);
+            const current = await tx.get(slot);
+            if (current === undefined || current.injected)
+                return false;
+            await tx.put(slot, { ...current, injected: true, settlement });
+            return true;
+        });
+        if (changed) {
+            this.#awaiting.forget(entry);
+            this.#trace({ event: 'inbound.settled', thread: entry.thread_ref, seq: entry.seq, settlement });
+            this.#ctx.options.plugins.runtime?.notify({ event: 'inbound', thread: entry.thread_ref, seq: entry.seq, sender: entry.message.sender });
+        }
+        return true;
+    }
+    /**
+     * Records the todo this consumption owes, inside the commit that confirms the consumption.
+     * A host without a todo hook owes none, so no record accrues for it.
+     */
+    async #oweTodo(tx, entry, context) {
+        if (this.#ctx.options.plugins.runtime?.todo === undefined)
+            return;
+        const slot = todoKey(context, entry.thread_ref, entry.seq);
+        if (await tx.get(slot) === undefined) {
+            await tx.put(slot, { entry, context, done: false });
+        }
+    }
+    /**
+     * Runs the host's todo hook for one owed todo, then marks it done. A failing hook leaves
+     * the record pending for `maintain`; delivering twice is safe because the host commits
+     * the todo it creates.
+     */
+    async #deliverTodo(entry, context) {
+        const runtime = this.#ctx.options.plugins.runtime;
+        if (runtime?.todo === undefined)
+            return;
+        const slot = todoKey(context, entry.thread_ref, entry.seq);
+        const stored = await this.#ctx.storage.transaction(tx => tx.get(slot));
+        if (stored === undefined || stored.done)
+            return;
+        await runtime.todo(entry, context);
+        await this.#ctx.storage.transaction(async (tx) => {
+            const current = await tx.get(slot);
+            if (current !== undefined)
+                await tx.put(slot, { ...current, done: true });
+        });
+    }
+    /** Whether the named context already confirmed this entry through any delivery path. */
+    async #alreadyConsumed(entry, context) {
+        const stored = await this.#ctx.storage.transaction(tx => tx.get(consumptionKey(context, entry.thread_ref, entry.seq)));
+        return stored?.confirmed === true;
+    }
+    /**
+     * The threads this node was invited into. The rows come from the records it already holds;
+     * each row is then asked of its owner through the same describe read the thread view uses,
+     * which is where the title, the state and the member table live. An owner that cannot be
+     * reached leaves the row in place with the failure attached: an unreachable peer is a
+     * reported outage, never a reason to hide a thread this node belongs to.
+     */
+    async joinedThreads(options = {}, signal) {
+        const listed = await this.#threads.joined(this.#auth(), options);
+        const items = [];
+        for (const row of listed.items)
+            items.push(await this.#ownerFacts(row, signal));
+        return { ...listed, items };
+    }
+    async #ownerFacts(row, signal) {
+        try {
+            const described = await this.#remote(row.thread_ref.owner, 'GET', `/threads/${encodeURIComponent(row.thread_ref.owner)}/${encodeURIComponent(row.thread_ref.id)}`, undefined, signal, this.#ctx.options.wait_ms ?? 60_000);
+            return { ...row, title: described.thread.title, state: described.thread.state, members: described.members };
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw error;
+            return { ...row, unavailable: failureOf(error) };
+        }
+    }
+    /** One thread's record and members: local when this node hosts it, from the owner otherwise. */
+    async describeThread(ref, signal) {
+        if (ref.owner === this.#ctx.options.node_id)
+            return this.#threads.describe(this.#auth(), ref);
+        return this.#remote(ref.owner, 'GET', `/threads/${encodeURIComponent(ref.owner)}/${encodeURIComponent(ref.id)}`, undefined, signal, this.#ctx.options.wait_ms ?? 60_000);
+    }
+    /**
+     * One page of a thread's entries, read locally when this node hosts the thread and from the
+     * owner otherwise. A member of a joined thread has no local copy of the entries, so the
+     * owner's message route is the only source that can answer for them.
+     */
+    async threadEntries(ref, query = {}, signal) {
+        if (ref.owner === this.#ctx.options.node_id)
+            return this.#messages.list(this.#auth(), ref, query);
+        const search = new URLSearchParams();
+        for (const [name, value] of Object.entries(query)) {
+            if (value === undefined)
+                continue;
+            search.set(name, typeof value === 'object' ? JSON.stringify(value) : String(value));
+        }
+        const path = `/threads/${encodeURIComponent(ref.owner)}/${encodeURIComponent(ref.id)}/messages`
+            + (search.size === 0 ? '' : `?${search}`);
+        return this.#remote(ref.owner, 'GET', path, undefined, signal, this.#ctx.options.wait_ms ?? 60_000);
+    }
+    /** Every owner + thread this node knows, from accepted grant notices plus its own threads. */
+    async #knownRefs() {
+        const granted = await this.#ctx.storage.transaction(async (tx) => (await tx.scan(key('known') + '/')).map(row => row.value.thread_ref));
+        const refs = new Map();
+        for (const ref of granted)
+            refs.set(key(ref.owner, ref.id), ref);
+        const owned = await this.#allPages(cursor => this.#threads.list(this.#auth(), { page_size: 100, ...(cursor === undefined ? {} : { cursor }) }));
+        for (const thread of owned)
+            refs.set(key(thread.thread_ref.owner, thread.thread_ref.id), thread.thread_ref);
+        return [...refs.values()];
+    }
+    /** Every item of a paged listing, or a reported failure when the list never terminates. */
+    async #allPages(load) {
+        const all = [];
+        let cursor;
+        for (let fetched = 0; fetched < MAX_CURSOR_PAGES; fetched++) {
+            const page = await load(cursor);
+            all.push(...page.items);
+            cursor = page.next_cursor ?? undefined;
+            if (cursor === undefined)
+                return all;
+        }
+        return fail('cursor_expired', 'The list did not terminate.');
+    }
+    /** The owner's authenticated attention list: remote when the owner is another node. */
+    async #attentionOf(ref, cursor, signal) {
+        if (ref.owner === this.#ctx.options.node_id) {
+            const options = { page_size: 100, ...(cursor === undefined ? {} : { cursor }) };
+            return this.#messages.attention(this.#auth(), ref, options);
+        }
+        const path = `/threads/${encodeURIComponent(ref.owner)}/${encodeURIComponent(ref.id)}/attention`
+            + (cursor === undefined ? '' : `?cursor=${encodeURIComponent(cursor)}`);
+        return this.#remote(ref.owner, 'GET', path, undefined, signal, this.#ctx.options.wait_ms ?? 60_000);
+    }
+    async #reconcileThread(ref, signal) {
+        let cursor;
+        for (let fetched = 0; fetched < MAX_CURSOR_PAGES; fetched++) {
+            if (signal?.aborted)
+                return;
+            const page = await this.#attentionOf(ref, cursor, signal);
+            for (const attention of page.items) {
+                if (signal?.aborted)
+                    return;
+                // The list answers for the thread it was asked about; anything else is not evidence
+                // for this thread, however well-formed it looks.
+                if (attention.thread_ref?.id !== ref.id)
+                    continue;
+                await this.#store(ref, attention);
+            }
+            cursor = page.next_cursor ?? undefined;
+            if (cursor === undefined)
+                return;
+        }
+        fail('cursor_expired', 'The attention list did not terminate.');
+    }
+    /**
+     * Merges an owner's attention row into the local record, then acks and consumes it.
+     * An owner that strips the body never takes back a copy this node already holds
+     * (RFC 0003 §2), and an `expired` disposition marks that copy without deleting it.
+     */
+    async #store(ref, attention) {
+        const obligation_id = typeof attention.obligation_id === 'string' && attention.obligation_id.length > 0
+            ? attention.obligation_id
+            : key(ref.owner, ref.id, attention.message_ref.sender, attention.message_ref.id, this.#ctx.options.node_id);
+        const stored = await this.#ctx.storage.transaction(async (tx) => {
+            const previous = await tx.get(inboxKey(obligation_id));
+            // An owner may strip the body from its list; the copy this node already holds is then
+            // the evidence to check the row against, and it is never discarded (RFC 0003 §2).
+            const local = previous?.attention.entry;
+            if (!this.#attest(attention, ref.owner, local))
+                return undefined;
+            const merged = {
+                attention: { ...attention, obligation_id, entry: attention.entry ?? local },
+                // The owner's plan names the context this delivery was addressed to; a row that
+                // arrived through reconciliation must keep it, or the host cannot route it back.
+                ...(previous?.context === undefined
+                    ? (attention.plan?.context === undefined ? {} : { context: attention.plan.context })
+                    : { context: previous.context }),
+                injected: previous?.injected === true,
+                ...(previous?.settlement === undefined ? {} : { settlement: previous.settlement }),
+                ...(previous?.resource_check_failures === undefined ? {} : { resource_check_failures: previous.resource_check_failures }),
+            };
+            if (previous !== undefined && canonical(previous.attention) === canonical(merged.attention)) {
+                return previous;
+            }
+            await tx.put(inboxKey(obligation_id), merged);
+            return merged;
+        });
+        if (stored === undefined)
+            return;
+        if (!stored.attention.acked)
+            await this.#ack(ref, obligation_id);
+        if (stored.attention.entry === undefined)
+            return;
+        this.#settle(stored.attention.entry);
+        if (stored.attention.disposition === 'expired')
+            return;
+        await this.#consume(stored.attention.entry, stored);
+    }
+    /**
+     * Delivers each outstanding owner notice to its recipient, authenticated as the owner
+     * that issued it. The notice stays unacked here until the recipient's own confirmation
+     * round trip reaches this node's `ackGrant`.
+     */
+    async #deliverGrants(signal) {
+        const budget = this.#ctx.options.wait_ms ?? 60_000;
+        const notices = await this.#allPages(cursor => this.#threads.notices(this.#auth(), { page_size: 100, ...(cursor === undefined ? {} : { cursor }) }));
+        for (const grant of notices) {
+            if (signal?.aborted)
+                return;
+            try {
+                if (grant.recipient === this.#ctx.options.node_id) {
+                    // A node already knows the threads it hosts, so its own notice needs no delivery.
+                    // The recipient is this node, which is the identity `ackGrant` checks.
+                    await this.#threads.ackGrant(this.#auth(), grant.id, {
+                        idempotency_key: this.#ctx.id(), retry_until: this.#window(undefined),
+                    });
+                    continue;
+                }
+                await this.#remote(grant.recipient, 'POST', '/grants', { grant }, signal, budget);
+            }
+            catch {
+                // The next pass retries; the notice stays outstanding until the recipient confirms.
+            }
+        }
+    }
+    /**
+     * Confirms each grant this node accepted back to the owner that issued it. The owner's
+     * `ackGrant` is the one that closes its notice, so the round trip ends there.
+     */
+    async #confirmGrants(signal) {
+        const budget = this.#ctx.options.wait_ms ?? 60_000;
+        const received = await this.#allPages(cursor => this.#threads.grants(this.#auth(), { page_size: 100, ...(cursor === undefined ? {} : { cursor }) }));
+        for (const grant of received) {
+            if (signal?.aborted)
+                return;
+            if (grant.acked)
+                continue;
+            const mutation = { idempotency_key: this.#ctx.id(), retry_until: this.#window(undefined) };
+            try {
+                if (grant.thread_ref.owner === this.#ctx.options.node_id) {
+                    await this.#threads.ackGrant(this.#auth(), grant.id, mutation);
+                }
+                else {
+                    await this.#remote(grant.thread_ref.owner, 'POST', `/grants/${encodeURIComponent(grant.id)}/ack`, mutation, signal, budget);
+                }
+                // The owner's notice is closed; the local copy records that so this pass stops
+                // re-confirming a grant the owner already acknowledged.
+                await this.#threads.ackGrantLocally(this.#auth(), grant.thread_ref, grant.id);
+            }
+            catch {
+                // Idempotent; the next pass sends the confirmation again.
+            }
+        }
+    }
+    /**
+     * Asks every trusted owner, at most once per window, for the memberships it still holds for
+     * this node, and re-records the grants this store no longer has. An owner's notice stays
+     * acknowledged forever, so a participant whose own store was rebuilt never learns those
+     * threads again from a push; the owner's signed answer is the evidence that repairs them.
+     * Only a missing `known` or `grant` row is written, so a healthy thread costs no traffic and
+     * a repeated pass is idempotent. An owner older than this route answers not_found once, and
+     * that answer is the watermark: asking it again inside the window teaches nothing.
+     */
+    async #resyncGrants(signal) {
+        const peers = await this.#ctx.storage.transaction(async (tx) => {
+            const exchanges = (await tx.scan(key('trust') + '/'))
+                .map(row => row.value)
+                .filter(entry => entry.node_id !== this.#ctx.node && trustPhase(entry) === 'exchanged');
+            const rows = [];
+            for (const entry of exchanges) {
+                rows.push({ node_id: entry.node_id, at: (await tx.get(grantResyncKey(entry.node_id)))?.at });
+            }
+            return rows;
+        });
+        const now = this.#ctx.now();
+        // One probe per peer costs the same budget as a resource binding check, never the full
+        // delivery wait: a slow owner must not hold the pass behind it.
+        const budget = Math.min(this.#ctx.options.wait_ms ?? 60_000, RESOURCE_CHECK_MS);
+        for (const peer of peers) {
+            if (signal?.aborted)
+                return;
+            if (peer.at !== undefined && now - peer.at < GRANT_RESYNC_MS)
+                continue;
+            try {
+                const issued = await this.#allPages(cursor => {
+                    const search = new URLSearchParams({ page_size: '100' });
+                    if (cursor !== undefined)
+                        search.set('cursor', cursor);
+                    return this.#remote(peer.node_id, 'GET', `/grants/issued?${search}`, undefined, signal, budget);
+                });
+                // Only a membership this node is the named recipient of, on an owner thread, is the
+                // owner's answer about this node; anything else is not evidence for a local repair.
+                const offered = issued.filter(grant => grant.thread_ref.owner === peer.node_id && grant.recipient === this.#ctx.node);
+                const repair = await this.#ctx.storage.transaction(async (tx) => {
+                    const missing = new Set();
+                    for (const grant of offered) {
+                        const known = await tx.get(key('known', grant.thread_ref.owner, grant.thread_ref.id));
+                        const held = await tx.get(key('grant', grant.thread_ref.owner, grant.id));
+                        if (known === undefined || held === undefined)
+                            missing.add(grant.id);
+                    }
+                    return missing;
+                });
+                for (const grant of offered) {
+                    if (!repair.has(grant.id))
+                        continue;
+                    const restored = await this.#threads.acceptGrant({ actor: peer.node_id }, grant);
+                    this.#trace({ event: 'grant.restored', owner: peer.node_id, thread: restored.thread_ref, grant: restored.id });
+                }
+                await this.#peerAnswered(peer.node_id);
+            }
+            catch (error) {
+                if (signal?.aborted)
+                    return;
+                const failure = failureOf(error);
+                if (failure.code === 'not_found') {
+                    await this.#peerAnswered(peer.node_id);
+                    continue;
+                }
+                this.#windowedFailure(key('grant-resync', peer.node_id, failure.code), attempts => ({
+                    event: 'grant.resync.failed', owner: peer.node_id, code: failure.code, message: failure.message, attempts,
+                }));
+            }
+        }
+    }
+    /**
+     * Records that one trusted owner answered. That answer is the new peer signal a parked
+     * thread waits for, so its dead-lettered retry series starts over.
+     */
+    async #peerAnswered(peer) {
+        await this.#ctx.storage.transaction(async (tx) => {
+            await tx.put(grantResyncKey(peer), { peer, at: this.#ctx.now() });
+            for (const row of await tx.scan(key('reconcile-backoff') + '/')) {
+                if (row.value.owner === peer)
+                    await tx.delete(row.key);
+            }
+        });
+    }
+    async #dispatch(action, options) {
+        const auth = this.#auth();
+        const mutation = () => ({ idempotency_key: this.#ctx.id(), retry_until: this.#window(undefined) });
+        if (action.kind === 'read') {
+            if (action.scope === 'resources')
+                return this.readResources(action.query, options);
+            switch (action.scope) {
+                case 'directory': return this.#directory();
+                case 'neighbors': {
+                    // Same rows onlyne://neighbors renders: observed nodes with trust state attached.
+                    const peers = this.#ctx.options.plugins.neighbors;
+                    if (peers === undefined)
+                        fail('unsupported_delivery', 'No neighbor directory is available on this host.');
+                    return peers();
+                }
+                case 'threads': return this.#threadsView(action, options);
+                case 'inbox':
+                    // A thread-scoped inbox is the owner's attention list for that thread, so the
+                    // owner that admitted the messages is asked, exactly like reconciliation does.
+                    if (action.thread !== undefined)
+                        return this.#attentionOf(action.thread, action.cursor, options.signal);
+                    return this.#messages.inbox(auth, {
+                        ...(action.cursor === undefined ? {} : { cursor: action.cursor }),
+                        ...(action.page_size === undefined ? {} : { page_size: action.page_size }),
+                    });
+                case 'messages':
+                    return this.#readThread(action, options);
+                case 'message':
+                case 'evidence':
+                    return this.#readMessage(action, options);
+            }
+            return fail('invalid_request', 'Unknown read scope.');
+        }
+        if (action.kind === 'thread') {
+            switch (action.op) {
+                case 'create':
+                    return this.#threads.create(auth, { ...mutation(), title: requireValue(action.title, 'invalid_request') });
+                case 'close': return this.#threads.close(auth, requireValue(action.thread, 'invalid_request'), mutation());
+                case 'list': return this.#threads.list(auth);
+                case 'describe': return this.describeThread(requireValue(action.thread, 'invalid_request'), options.signal);
+                case 'member_add':
+                    return this.#threads.member(auth, requireValue(action.thread, 'invalid_request'), requireValue(action.to, 'invalid_request'), {}, mutation());
+                case 'member_remove':
+                    return this.#threads.member(auth, requireValue(action.thread, 'invalid_request'), requireValue(action.to, 'invalid_request'), { state: 'revoked' }, mutation());
+            }
+            return fail('invalid_request', 'Unknown thread operation.');
+        }
+        if (action.kind === 'resource')
+            return this.#operateResource(action, options);
+        if (action.kind === 'domain') {
+            const domainMutation = () => ({
+                idempotency_key: this.#ctx.id(),
+                retry_until: this.#window(undefined),
+                ...(action.expected_revision === undefined ? {} : { expected_revision: action.expected_revision }),
+            });
+            switch (action.op) {
+                case 'create': return this.#domains.create(auth, mutation());
+                case 'join': return this.#domains.join(auth, requireValue(action.domain_id, 'invalid_request'), domainMutation());
+                case 'leave': return this.#domains.leave(auth, requireValue(action.domain_id, 'invalid_request'), domainMutation());
+                case 'list': return this.#domains.list(auth);
+                case 'describe': return this.#domains.describe(auth, requireValue(action.domain_id, 'invalid_request'));
+                case 'discover':
+                    return this.#domains.discover(auth, requireValue(action.domain_id, 'invalid_request'), options.signal);
+            }
+            return fail('invalid_request', 'Unknown domain operation.');
+        }
+        return fail('invalid_request', 'Unknown action.');
+    }
+    /**
+     * Reads a thread over the owner's authenticated endpoint; this node's own threads are
+     * read locally. A remote owner that will not serve the read is a reported failure,
+     * never a silent local fallback.
+     */
+    async #readThread(action, options) {
+        const ref = requireValue(action.thread, 'invalid_request');
+        const query = {
+            attention: action.attention ?? 'thread',
+            ...(action.cursor === undefined ? {} : { cursor: action.cursor }),
+            ...(action.page_size === undefined ? {} : { page_size: action.page_size }),
+            ...(action.seq === undefined ? {} : { since_seq: action.seq }),
+            ...(action.message === undefined ? {} : { related_to: action.message }),
+        };
+        return this.threadEntries(ref, query, options.signal);
+    }
+    /**
+     * The threads this node can see in one page: the ones it owns, plus the ones it was invited
+     * into. A joined row carries `read_only: true`; its owner's title, state and member table
+     * come from the describe read, and an unreachable owner leaves the failure on the row
+     * instead of dropping the thread from the list.
+     */
+    async #threadsView(action, options) {
+        const [owned, joined] = await Promise.all([
+            this.#allPages(cursor => this.#threads.list(this.#auth(), { page_size: 100, ...(cursor === undefined ? {} : { cursor }) })),
+            this.#allPages(cursor => this.joinedThreads({ page_size: 100, ...(cursor === undefined ? {} : { cursor }) }, options.signal)),
+        ]);
+        const position = (row) => key(row.thread_ref.owner, row.thread_ref.id);
+        const rows = [...owned, ...joined].sort((left, right) => {
+            const a = position(left);
+            const b = position(right);
+            return a < b ? -1 : a > b ? 1 : 0;
+        });
+        return page(rows, {
+            ...(action.cursor === undefined ? {} : { cursor: action.cursor }),
+            ...(action.page_size === undefined ? {} : { page_size: action.page_size }),
+        }, { kind: 'threads', actor: this.#ctx.options.node_id }, position);
+    }
+    /**
+     * One message by reference. `evidence` is this node's own delivery record; a message this
+     * node appended to a thread it hosts never creates one, so its committed entry is the
+     * evidence. Otherwise the owner that admitted the message is the only source, and its
+     * message list is where a referenced entry is found (RFC 0004 §2).
+     */
+    async #readMessage(action, options) {
+        const ref = requireValue(action.message, 'invalid_request');
+        if (action.scope === 'evidence') {
+            const record = await this.#ctx.storage.transaction(tx => tx.get(outboundKey(ref.sender, ref.id)));
+            if (record !== undefined)
+                return record;
+            // A reply appended to a hosted thread is committed locally and delivered by that
+            // commit; reporting "no evidence" for it reads as a failed send and invites a
+            // duplicate. A message this node received has another sender, so it stays not_found.
+            const hosted = ref.sender === this.#ctx.options.node_id
+                ? await this.#ctx.storage.transaction(tx => tx.get(key('entry-ref', ref.sender, ref.id)))
+                : undefined;
+            if (hosted !== undefined) {
+                return { admission: 'accepted', local: true, entry: hosted, thread_ref: hosted.thread_ref, seq: hosted.seq };
+            }
+            fail('not_found', 'This node holds no outbound evidence for that message.');
+        }
+        const hosted = await this.#ctx.storage.transaction(tx => tx.get(key('entry-ref', ref.sender, ref.id)));
+        const thread = action.thread ?? hosted?.thread_ref;
+        if (thread === undefined)
+            fail('not_found', 'This node holds no evidence for that message.');
+        if (thread.owner === this.#ctx.options.node_id)
+            return this.#messages.getByRef(this.#auth(), ref);
+        let cursor;
+        for (let fetched = 0; fetched < MAX_CURSOR_PAGES; fetched++) {
+            if (options.signal?.aborted)
+                break;
+            const search = new URLSearchParams({ attention: 'thread' });
+            if (cursor !== undefined)
+                search.set('cursor', cursor);
+            const path = `/threads/${encodeURIComponent(thread.owner)}/${encodeURIComponent(thread.id)}/messages?${search}`;
+            const page = await this.#remote(thread.owner, 'GET', path, undefined, options.signal, this.#ctx.options.wait_ms ?? 60_000);
+            const found = page.items.find(entry => entry.message.sender === ref.sender && entry.message.id === ref.id);
+            if (found !== undefined)
+                return found;
+            cursor = page.next_cursor ?? undefined;
+            if (cursor === undefined)
+                break;
+        }
+        return fail('not_found', 'The owning node did not return that message.');
+    }
+    /** Resource operations route to the resource owner; this node's own resources answer locally. */
+    async #operateResource(action, options) {
+        const request = {
+            idempotency_key: this.#ctx.id(),
+            retry_until: this.#window(undefined),
+            operation_id: this.#ctx.id(),
+            operation: action.operation,
+            ...(action.expected_revision === undefined ? {} : { expected_revision: action.expected_revision }),
+            ...(action.data === undefined ? {} : { data: action.data }),
+        };
+        if (action.resource.owner === this.#ctx.options.node_id) {
+            return this.#resources.operate(this.#auth(), action.resource, request, options.signal);
+        }
+        const path = `/resources/${encodeURIComponent(action.resource.owner)}/${encodeURIComponent(action.resource.id)}/operations`;
+        return this.#remote(action.resource.owner, 'POST', path, request, options.signal, this.#ctx.options.wait_ms ?? 60_000);
+    }
+    /** Local facts read without a peer: this node's identity, description, threads and inbox. */
+    async #directory() {
+        const plugins = this.#ctx.options.plugins;
+        return {
+            node: this.#ctx.options.node_id,
+            description: plugins.directory === undefined ? null : await plugins.directory(),
+            threads: await this.#threads.list(this.#auth(), { page_size: 100 }),
+            inbox: await this.#messages.inbox(this.#auth(), { page_size: 100 }),
+            domains: await this.#domains.list(this.#auth(), { page_size: 100 }),
+        };
+    }
+}
+_a = OnlyneClient;
+//# sourceMappingURL=client.js.map