@onlyne/node-host 3.0.0 → 3.2.0

package/src/index.ts

@@ -1,80 +0,0 @@
-import type { OnlyneNode, ServiceDescription } from '@onlyne/lib';
-import { NetworkDiscovery } from './network.js';
-import type { LogRing } from './log.js';
-import { GatewayTui } from './tui.js';
-
-export { createNodeKey } from './keys.js';
-export { NetworkDiscovery } from './network.js';
-export { createLogger } from './log.js';
-export type { GatewayLogger, LogRing } from './log.js';
-export { GatewayTui } from './tui.js';
-
-export interface NodeHostOptions {
-  node: OnlyneNode;
-  endpoint: string;
-  bind: string;
-  seeds?: string[];
-  /** The log ring the TUI renders; the host's logger owns it. */
-  ring?: LogRing;
-  /** Defaults to the terminal surface when both ends of the process are a TTY. */
-  interactive?: boolean;
-  log(message: string, fields?: Record<string, unknown>): void;
-}
-
-/**
- * The host half every gateway shares: publish the bound endpoint over DNS-SD, browse for
- * peers, re-observe the catalog, and — on a terminal — hand the operator the trust surface.
- * Discovery only adds candidates; a key exchange still needs both fingerprints confirmed.
- */
-export async function startNodeHost(options: NodeHostOptions): Promise<{ close(): Promise<void> }> {
-  const { node, log } = options;
-  const controller = new AbortController();
-  const response = await node.fetch(new Request(`${options.endpoint}/description`));
-  const description = await response.json() as ServiceDescription;
-  const network = new NetworkDiscovery({
-    node_id: node.auth.actor, instance_id: description.instance_id, endpoint: options.endpoint, bind: options.bind,
-    onCandidate: async (url, source, expectedNode) => {
-      if (expectedNode === node.auth.actor) return;
-      await node.discovery.observe(url, source, expectedNode, controller.signal);
-    },
-    onError: error => log('onlyne.discovery.failed', { error: String(error) }),
-  });
-  try { await network.start(); }
-  catch (error) { log('onlyne.discovery.unavailable', { error: String(error) }); }
-  for (const seed of options.seeds ?? []) {
-    try { await node.discovery.observe(seed, 'bootstrap', undefined, controller.signal); }
-    catch (error) { log('onlyne.discovery.failed', { seed, error: String(error) }); }
-  }
-  let refreshing = false;
-  const timer = setInterval(() => {
-    if (refreshing) return;
-    refreshing = true;
-    void node.discovery.refresh(controller.signal)
-      .catch(error => { if (!controller.signal.aborted) log('onlyne.discovery.failed', { error: String(error) }); })
-      .finally(() => { refreshing = false; });
-  }, 30_000);
-
-  let tui: GatewayTui | undefined;
-  // `ONLYNE_NO_TUI=1` keeps the plain JSON log on stdout, for a pipe or a screen a TUI would spoil.
-  const interactive = (options.interactive ?? true) && process.env.ONLYNE_NO_TUI !== '1';
-  if (interactive && options.ring !== undefined && process.stdin.isTTY && process.stdout.isTTY) {
-    const surface = new GatewayTui(node, options.ring, options.endpoint);
-    try {
-      log('onlyne.tui.starting');
-      await surface.start();
-      tui = surface;
-      log('onlyne.tui.ready');
-    } catch (error) {
-      log('onlyne.tui.unavailable', { error: String(error) });
-    }
-  }
-
-  return {
-    async close(): Promise<void> {
-      clearInterval(timer);
-      await tui?.close();
-      controller.abort();
-      await network.close();
-    },
-  };
-}

package/src/keys.ts

@@ -1,158 +0,0 @@
-import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { chmodSync, existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
-import { homedir } from "node:os";
-import { basename, join } from "node:path";
-import type { KeyHook, KeyMaterial } from "@onlyne/lib";
-import { execFile } from "node:child_process";
-import { generateKeyMaterial } from "@onlyne/lib";
-
-/** RFC 0017 §2: the private key rides in its own file as base64 DER; the public half is derived on load. */
-const PRIVATE_NAME = "priv.pem";
-const PUBLIC_NAME = "pub.key";
-
-function projectKeysRoot(cwd: string): string {
-	return join(cwd, ".onlyne", "keys");
-}
-
-function globalKeysRoot(): string {
-	return join(homedir(), ".config", "onlyne", "keys");
-}
-
-function encodePrivate(material: KeyMaterial): string {
-	return Buffer.from(material.private_key).toString("base64");
-}
-
-function decodePrivate(text: string): Uint8Array {
-	return new Uint8Array(Buffer.from(text, "base64"));
-}
-
-/** Refuses group/world-readable private keys and symlinked or foreign-owned files. */
-function assertPrivatePermissions(path: string): void {
-	const stats = statSync(path, { throwIfNoEntry: false });
-	if (stats === undefined) return;
-	if (stats.isSymbolicLink()) throw new Error(`The node key must not be a symlink: ${path}`);
-	if ((stats.mode & 0o077) !== 0) {
-		throw new Error(`The node key is readable beyond its owner. Fix it with: chmod 600 ${path}`);
-	}
-}
-
-async function assertDirectoryPermissions(path: string): Promise<void> {
-	const stats = await statSync(path, { throwIfNoEntry: false });
-	if (stats === undefined || (stats.mode & 0o077) !== 0) {
-		throw new Error(`The key directory is readable beyond its owner. Fix it with: chmod 700 ${path}`);
-	}
-}
-
-/** The node id names a subdirectory; a traversal-looking id is a configuration error. */
-function keyDirectory(root: string, nodeId: string): string {
-	if (nodeId.includes("/") || nodeId.includes("\\") || nodeId.includes("..")) {
-		throw new Error(`The node id cannot name a key directory: ${nodeId}`);
-	}
-	return join(root, encodeURIComponent(nodeId));
-}
-
-/**
- * The git check is `git check-ignore --quiet`, the real semantics: an ancestor ignore,
- * a negation rule, or a .git/info/exclude all read the same way the user's git does.
- */
-function ignoredByGit(root: string, target: string): Promise<boolean> {
-	return new Promise(resolve => {
-		// `cwd` is the project root: the key directory does not exist yet on a first run.
-		execFile("git", ["check-ignore", "--quiet", "--", target], { cwd: root }, error => {
-			// Exit 0 = ignored, exit 1 = tracked-or-untracked but not ignored, other = outside a work tree.
-			resolve(error === null || (typeof (error as { code?: number }).code === "number" && (error as { code?: number }).code === 0));
-		});
-	});
-}
-
-async function insideGitWorkTree(path: string): Promise<boolean> {
-	return new Promise(resolve => {
-		execFile("git", ["rev-parse", "--is-inside-work-tree"], { cwd: path }, (error, stdout) => {
-			resolve(error === null && stdout.trim() === "true");
-		});
-	});
-}
-
-/**
- * Resolves the key directory for a node (RFC 0017 §2). A project key inside a git work
- * tree whose ignore rules do not cover `.onlyne/keys` is refused, with both escapes named.
- */
-export async function ensureKeyDir(cwd: string, nodeId: string, scope: "project" | "global"): Promise<string> {
-	// The global directory holds the node's identity by default; a project directory is an
-	// override for this working tree, read first when both exist.
-	const root = scope === "project" ? projectKeysRoot(cwd) : globalKeysRoot();
-	const dir = keyDirectory(root, nodeId);
-	if (scope === "global") {
-		await mkdir(dir, { recursive: true });
-		await chmod(dir, 0o700);
-		return dir;
-	}
-	if (await insideGitWorkTree(cwd) && !(await ignoredByGit(cwd, dir)) && !(await ignoredByGit(cwd, projectKeysRoot(cwd)))) {
-		throw new Error(
-			"Refusing to create a node key inside a git work tree: .onlyne/keys is not ignored. "
-			+ "Add '.onlyne/keys' to .gitignore, or set node.key_scope = \"global\" in the config.",
-		);
-	}
-	await mkdir(dir, { recursive: true });
-	await chmod(dir, 0o700);
-	return dir;
-}
-
-/** Loads the node's identity key, generating it on first use. */
-export async function loadOrCreateKey(dir: string, nodeId: string): Promise<KeyMaterial> {
-	await assertDirectoryPermissions(dir);
-	const privatePath = join(dir, PRIVATE_NAME);
-	if (!existsSync(privatePath)) {
-		const material = generateKeyMaterial();
-		await writeKeyMaterial(dir, material);
-		return material;
-	}
-	assertPrivatePermissions(privatePath);
-	const base: { private_key: Uint8Array; public_key: Uint8Array } = {
-		private_key: decodePrivate((await readFile(privatePath, "utf8")).trim()),
-		public_key: new Uint8Array(),
-	};
-	// The public half always comes from the private key: the file is a cache, never a source.
-	const { createPrivateKey, createPublicKey } = await import("node:crypto");
-	const pair = createPrivateKey({ key: Buffer.from(base.private_key), format: "der", type: "pkcs8" });
-	const jwk = createPublicKey(pair).export({ format: "jwk" });
-	return { private_key: base.private_key, public_key: new Uint8Array(Buffer.from(String(jwk.x), "base64url")) };
-}
-
-/**
- * Writes the key pair atomically. `replace` is the `plugins.keys.replace` path — the only
- * caller allowed to overwrite an existing private key, because `trust.rotate` has already
- * committed the rotation window and must complete the swap.
- */
-export async function writeKeyMaterial(dir: string, material: KeyMaterial, options: { replace?: boolean } = {}): Promise<void> {
-	const privatePath = join(dir, PRIVATE_NAME);
-	if (existsSync(privatePath) && options.replace !== true) throw new Error(`A node key already exists at ${privatePath}; use trust rotation instead of overwriting it.`);
-	const publicPath = join(dir, PUBLIC_NAME);
-	const stagingPrivate = join(dir, `.${basename(PRIVATE_NAME)}.${process.pid}.tmp`);
-	const stagingPublic = join(dir, `.${basename(PUBLIC_NAME)}.${process.pid}.tmp`);
-	// Every fallible step runs before the private key is renamed: a replace that throws must
-	// leave the old key usable, or the rotation proof for peers pinning it is gone for good.
-	await writeFile(stagingPrivate, encodePrivate(material), { mode: 0o600 });
-	await chmod(stagingPrivate, 0o600);
-	await writeFile(stagingPublic, Buffer.from(material.public_key).toString("base64"), { mode: 0o644 });
-	await chmod(stagingPublic, 0o644);
-	// The public file is a cache derived from the private key, so it may be replaced first.
-	await rename(stagingPublic, publicPath);
-	await rename(stagingPrivate, privatePath);
-}
-
-/** Synchronous guard for the startup path: the existing key must already be private. */
-export function assertKeyPermissions(dir: string): void {
-	assertPrivatePermissions(join(dir, PRIVATE_NAME));
-	void chmod;
-	void chmodSync;
-	void mkdirSync;
-	void readFileSync;
-}
-
-export async function createNodeKey(nodeId: string): Promise<KeyHook> {
-	const dir = await ensureKeyDir(process.cwd(), nodeId, "global");
-	return Object.assign(() => loadOrCreateKey(dir, nodeId), {
-		replace: (material: KeyMaterial) => writeKeyMaterial(dir, material, { replace: true }),
-	});
-}

package/src/log.ts

@@ -1,52 +0,0 @@
-import { appendFileSync } from 'node:fs';
-
-/** A bounded tail of the gateway's own log lines, so the TUI can show them. */
-export interface LogRing {
-  push(key: string, line: string): void;
-  tail(count: number): string[];
-}
-
-export interface GatewayLogger {
-  log(message: string, fields?: Record<string, unknown>): void;
-  readonly ring: LogRing;
-}
-
-/**
- * The gateway logs JSON lines. Under the TUI those lines would corrupt the alternate
- * screen, so they go to a ring the TUI renders instead; without a TTY they stay on stdout.
- */
-export function createLogger(toStdout: boolean, capacity = 200, file?: string): GatewayLogger {
-  // One entry per distinct message: a gateway that retries every five seconds would otherwise
-  // fill the pane with the same line and hide everything else.
-  const lines: Array<{ key: string; line: string; count: number }> = [];
-  const ring: LogRing = {
-    push(key: string, line: string): void {
-      const last = lines.at(-1);
-      if (last !== undefined && last.key === key) {
-        last.line = line;
-        last.count += 1;
-        return;
-      }
-      lines.push({ key, line, count: 1 });
-      if (lines.length > capacity) lines.splice(0, lines.length - capacity);
-    },
-    tail(count: number): string[] {
-      return lines.slice(Math.max(0, lines.length - count))
-        .map(entry => (entry.count === 1 ? entry.line : `${entry.line} ×${entry.count}`));
-    },
-  };
-  return {
-    ring,
-    log(message: string, fields?: Record<string, unknown>): void {
-      const line = JSON.stringify({ at: new Date().toISOString(), message, ...fields });
-      if (toStdout) console.log(line);
-      else ring.push(`${message}|${JSON.stringify(fields ?? {})}`, line);
-      // The TUI owns the screen, so the durable record is the file; without one the line would
-      // exist only in the ring and vanish with the process.
-      if (file !== undefined) {
-        try { appendFileSync(file, `${line}\n`); } catch { /* a full disk must not stop the gateway */ }
-      }
-    },
-  };
-}
-

package/src/network.ts

@@ -1,382 +0,0 @@
-import { networkInterfaces } from "node:os";
-
-/** DNS-SD types used by the host adapter. */
-interface BonjourService {
-	fqdn: string;
-	name: string;
-	port: number;
-	host?: string;
-	addresses?: string[];
-	txt: unknown;
-	referer?: { address?: string };
-	records(): Array<{ type: string }>;
-}
-interface BonjourBrowser {
-	on(event: "up" | "srv-update" | "txt-update" | "down", listener: (service: BonjourService) => void): void;
-	stop(): void;
-}
-interface BonjourInstance {
-	find(options: { type: string; protocol: string }): BonjourBrowser;
-	publish(options: { name: string; type: string; protocol: string; port: number; host: string; probe: boolean; txt: Record<string, string> }): BonjourService;
-	unpublishAll(callback: () => void): void;
-	destroy(callback: () => void): void;
-}
-type BonjourConstructor = new (options: object, error: (error: unknown) => void) => BonjourInstance;
-
-/** RFC 0011 §5.1: the one service type every HTTP binding publishes. */
-const SERVICE_TYPE = "onlyne";
-const SERVICE_PROTOCOL = "tcp";
-const WIRE_PROTOCOL = "onlyne/3";
-const SERVICE_PATH_SUFFIX = "/onlyne/v3";
-const SOURCE = "mdns";
-
-export interface NetworkDiscoveryOptions {
-	node_id: string;
-	/** Identifies this process instance in the service name and TXT record. */
-	instance_id: string;
-	/** Absolute URL the node is listening on; its port is the allocated one. */
-	endpoint: string;
-	/** Local listener address; a wildcard binding advertises a concrete interface. */
-	bind: string;
-	/** `expectedNode` is the identity the advertisement claims, not a verified fact. */
-	onCandidate(url: string, source: string, expectedNode?: string): Promise<void>;
-	onError(error: unknown): void;
-	/** A candidate that was delivered earlier is no longer advertised. */
-	onUnavailable?(url: string): void;
-}
-
-/**
- * Same-link discovery over DNS-SD/mDNS: publishes `_onlyne._tcp.local` and
- * offers every advertisement to the library, which owns identity resolution
- * and membership. The browser keeps other regions' candidates; only the
- * HTTP declaration decides region.
- */
-export class NetworkDiscovery {
-	readonly #options: NetworkDiscoveryOptions;
-	#bonjour: BonjourInstance | undefined;
-	#browser: BonjourBrowser | undefined;
-	#service: BonjourService | undefined;
-	#started = false;
-	#closed: Promise<void> | undefined;
-	#closing = false;
-	/** Deliveries in flight, keyed by URL, so repeated advertisements run once. */
-	#inflight = new Map<string, Promise<boolean>>();
-	/** Delivered URL per service fqdn; a change or a goodbye withdraws the old one. */
-	#delivered = new Map<string, string>();
-
-	constructor(options: NetworkDiscoveryOptions) {
-		this.#options = options;
-	}
-
-	async start(): Promise<void> {
-		if (this.#started) return;
-		this.#closed = undefined;
-		this.#closing = false;
-		const publication = plan(this.#options);
-		let module: { default?: BonjourConstructor } | BonjourConstructor;
-		try {
-			module = await import("bonjour-service") as unknown as { default?: BonjourConstructor } | BonjourConstructor;
-		} catch {
-			throw new Error("DNS-SD discovery is unavailable. Check the bonjour-service installation.");
-		}
-		const Constructor = typeof module === "function" ? module : module.default;
-		if (Constructor === undefined) throw new Error("bonjour-service does not export a constructor.");
-		const bonjour = new Constructor({}, (error: unknown) => this.#fail(error));
-		try {
-			const browser = bonjour.find({ type: SERVICE_TYPE, protocol: SERVICE_PROTOCOL });
-			browser.on("up", service => this.#consider(service));
-			browser.on("srv-update", service => this.#consider(service));
-			browser.on("txt-update", service => this.#consider(service));
-			browser.on("down", service => this.#withdraw(service));
-			this.#bonjour = bonjour;
-			this.#browser = browser;
-
-			// A probe keeps the first `records()` call asynchronous, which is what lets
-			// the loopback filter below take effect before the announcement is sent.
-			const service = bonjour.publish({
-				name: publication.name,
-				type: SERVICE_TYPE,
-				protocol: SERVICE_PROTOCOL,
-				port: publication.port,
-				host: publication.host,
-				probe: true,
-				txt: publication.txt,
-			});
-			if (isLoopback(publication.host)) {
-				// bonjour-service attaches every interface address to the SRV target. A
-				// loopback binding is reachable only from this host, so publishing those
-				// addresses (none of them loopback) would advertise a dead endpoint.
-				const records = service.records.bind(service);
-				service.records = () => records().filter(record => record.type !== "A" && record.type !== "AAAA");
-			}
-			this.#service = service;
-			this.#started = true;
-		} catch (error) {
-			bonjour.destroy(() => undefined);
-			throw error;
-		}
-	}
-
-	async close(): Promise<void> {
-		if (this.#closed !== undefined) return this.#closed;
-		const bonjour = this.#bonjour;
-		this.#closing = true;
-		this.#started = false;
-		this.#browser?.stop();
-		this.#browser = undefined;
-		this.#service = undefined;
-		this.#bonjour = undefined;
-		this.#inflight.clear();
-		this.#delivered.clear();
-		if (bonjour === undefined) {
-			this.#closed = Promise.resolve();
-			return this.#closed;
-		}
-		this.#closed = new Promise<void>(resolve => {
-			bonjour.unpublishAll(() => bonjour.destroy(() => resolve()));
-		});
-		return this.#closed;
-	}
-
-	#consider(service: BonjourService): void {
-		if (this.#closing) return;
-		if (service.fqdn === this.#service?.fqdn) return;
-		const txt = text(service);
-		const node = txt["node_id"];
-		const instance = txt["instance_id"];
-		if (node === this.#options.node_id && instance === this.#options.instance_id) return;
-
-		const protocol = txt["protocol"];
-		if (protocol !== WIRE_PROTOCOL) {
-			this.#fail(new Error(`Service ${service.name} does not speak ${WIRE_PROTOCOL}.`));
-			return;
-		}
-		if (node === undefined || instance === undefined) {
-			this.#fail(new Error(`Service ${service.name} is missing its node_id or instance_id.`));
-			return;
-		}
-		const scheme = txt["scheme"];
-		if (scheme !== "http" && scheme !== "https") {
-			this.#fail(new Error(`Service ${service.name} advertises scheme ${scheme ?? "(missing)"}.`));
-			return;
-		}
-		const path = txt["path"];
-		if (path === undefined || !normalizePath(path).endsWith(SERVICE_PATH_SUFFIX)) {
-			this.#fail(new Error(`Service ${service.name} does not advertise a ${SERVICE_PATH_SUFFIX} path.`));
-			return;
-		}
-		if (!Number.isInteger(service.port) || service.port < 1 || service.port > 65_535) {
-			this.#fail(new Error(`Service ${service.name} advertises port ${String(service.port)}.`));
-			return;
-		}
-
-		const host = candidateHost(service);
-		if (host === undefined) {
-			this.#fail(new Error(`Service ${service.name} advertises no address reachable from this host.`));
-			return;
-		}
-		if (!isLoopback(host) && scheme !== "https") {
-			this.#fail(new Error(`Service ${service.name} advertises plain HTTP across hosts; Onlyne requires HTTPS there.`));
-			return;
-		}
-
-		const url = `${scheme}://${host.includes(":") ? `[${host}]` : host}:${String(service.port)}${normalizePath(path)}`;
-		const previous = this.#delivered.get(service.fqdn);
-		if (previous === url) return;
-		if (previous !== undefined) {
-			this.#delivered.delete(service.fqdn);
-			this.#options.onUnavailable?.(previous);
-		}
-		void this.#deliver(service.fqdn, url, node);
-	}
-
-	#deliver(fqdn: string, url: string, expectedNode: string): Promise<boolean> {
-		const running = this.#inflight.get(url);
-		if (running !== undefined) return running;
-		const attempt = this.#options
-			.onCandidate(url, SOURCE, expectedNode)
-			.then(() => true)
-			.catch((error: unknown) => {
-				this.#fail(error);
-				return false;
-			});
-		const tracked = attempt.finally(() => {
-			if (this.#inflight.get(url) === tracked) this.#inflight.delete(url);
-		});
-		tracked.then(delivered => {
-			if (delivered && !this.#closing && !this.#delivered.has(fqdn)) this.#delivered.set(fqdn, url);
-		});
-		this.#inflight.set(url, tracked);
-		return tracked;
-	}
-
-	#withdraw(service: BonjourService): void {
-		const url = this.#delivered.get(service.fqdn);
-		if (url === undefined) return;
-		this.#delivered.delete(service.fqdn);
-		this.#options.onUnavailable?.(url);
-	}
-
-	#fail(error: unknown): void {
-		if (this.#closing) return;
-		try {
-			this.#options.onError(error);
-		} catch {
-			// The error sink is the end of the chain; a throwing sink must not kill the mDNS loop.
-		}
-	}
-}
-
-interface Publication {
-	name: string;
-	host: string;
-	port: number;
-	txt: Record<string, string>;
-}
-
-/** Validate everything the advertisement needs before the socket exists. */
-function plan(options: NetworkDiscoveryOptions): Publication {
-	if (options.node_id.length === 0) throw new Error("Onlyne discovery needs a node id.");
-	if (options.instance_id.length === 0) throw new Error("Onlyne discovery needs an instance id.");
-	let endpoint: URL;
-	try {
-		endpoint = new URL(options.endpoint);
-	} catch {
-		throw new Error(`The Onlyne endpoint must be an absolute URL, got ${options.endpoint}.`);
-	}
-	if (endpoint.protocol !== "http:" && endpoint.protocol !== "https:") {
-		throw new Error(`The Onlyne endpoint must use http or https, got ${endpoint.protocol}.`);
-	}
-	const scheme = endpoint.protocol.slice(0, -1);
-	const path = servicePath(endpoint.pathname);
-	const port = endpoint.port === "" ? (scheme === "https" ? 443 : 80) : Number(endpoint.port);
-	if (!Number.isInteger(port) || port < 1 || port > 65_535) {
-		throw new Error(`The Onlyne endpoint must name the listening port, got ${options.endpoint}.`);
-	}
-	const advertised = normalizeHost(endpoint.hostname);
-	if (advertised === undefined) throw new Error(`The Onlyne endpoint has no host, got ${options.endpoint}.`);
-	// A wildcard binding is not a connectable address; publish the interface it
-	// listens on instead, and never the wildcard itself.
-	const host = isWildcard(advertised) ? interfaceAddress(options.bind) : advertised;
-	return {
-		name: options.instance_id,
-		host,
-		port,
-		txt: {
-			protocol: WIRE_PROTOCOL,
-			path,
-			scheme,
-			node_id: options.node_id,
-			instance_id: options.instance_id,
-		},
-	};
-}
-
-/** The advertised address of a wildcard binding: its bind when concrete, else a live interface. */
-function interfaceAddress(bind: string): string {
-	const concrete = normalizeHost(bind);
-	if (concrete !== undefined && !isWildcard(concrete)) return concrete;
-	const ipv4: string[] = [];
-	const ipv6: string[] = [];
-	for (const entries of Object.values(networkInterfaces())) {
-		for (const entry of entries ?? []) {
-			if (entry.internal) continue;
-			const address = normalizeAddress(entry.address);
-			if (address === undefined || address.startsWith("fe80:") || address.startsWith("169.254.")) continue;
-			(address.includes(":") ? ipv6 : ipv4).push(address);
-		}
-	}
-	const chosen = ipv4[0] ?? ipv6[0];
-	if (chosen === undefined) {
-		throw new Error("No interface address can be advertised; set server.bind to a concrete address.");
-	}
-	return chosen;
-}
-
-/**
- * The address this host can use to reach the advertised service. Addresses that
- * this host already owns are only applicable when the packet came from this
- * host: a remote service cannot own them, and a remote loopback is unreachable.
- */
-function candidateHost(service: BonjourService): string | undefined {
-	const local = localAddresses();
-	const referer = normalizeHost(service.referer?.address);
-	const originLocal = referer !== undefined && (isLoopback(referer) || local.has(referer));
-	for (const raw of service.addresses ?? []) {
-		const address = normalizeAddress(raw);
-		if (address === undefined || isWildcard(address)) continue;
-		if (address.startsWith("fe80:") || address.startsWith("169.254.")) continue;
-		if (address.startsWith("ff") || /^(22[4-9]|23\d)\./.test(address)) continue;
-		if (isLoopback(address)) {
-			if (originLocal) return address;
-			continue;
-		}
-		if (local.has(address) && !originLocal) continue;
-		return address;
-	}
-	const target = normalizeHost(service.host);
-	if (target === undefined || isWildcard(target)) return undefined;
-	if (isLoopback(target)) return originLocal ? target : undefined;
-	return target;
-}
-
-function localAddresses(): Set<string> {
-	const hosts = new Set<string>(["127.0.0.1", "::1", "localhost"]);
-	for (const entries of Object.values(networkInterfaces())) {
-		for (const entry of entries ?? []) {
-			const address = normalizeAddress(entry.address);
-			if (address !== undefined) hosts.add(address);
-		}
-	}
-	return hosts;
-}
-
-function text(service: BonjourService): Record<string, string> {
-	const fields: Record<string, string> = {};
-	const raw: unknown = service.txt;
-	if (raw === null || typeof raw !== "object") return fields;
-	for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {
-		if (typeof value === "string") fields[key] = value;
-		else if (Array.isArray(value) && typeof value[0] === "string") fields[key] = value[0];
-	}
-	return fields;
-}
-
-function servicePath(pathname: string): string {
-	const path = normalizePath(pathname);
-	if (!path.endsWith(SERVICE_PATH_SUFFIX)) {
-		throw new Error(`The Onlyne endpoint path must end with ${SERVICE_PATH_SUFFIX}, got ${pathname}.`);
-	}
-	return path;
-}
-
-function normalizePath(pathname: string): string {
-	const absolute = pathname.startsWith("/") ? pathname : `/${pathname}`;
-	const trimmed = absolute.replace(/\/+$/, "");
-	return trimmed === "" ? "/" : trimmed;
-}
-
-function normalizeAddress(value: string): string | undefined {
-	let address = value.trim();
-	if (address.startsWith("[") && address.endsWith("]")) address = address.slice(1, -1);
-	const zone = address.indexOf("%");
-	if (zone >= 0) address = address.slice(0, zone);
-	return address.length === 0 ? undefined : address.toLowerCase();
-}
-
-function normalizeHost(value: string | undefined): string | undefined {
-	if (value === undefined) return undefined;
-	const host = normalizeAddress(value);
-	if (host === undefined) return undefined;
-	return host.endsWith(".") ? host.slice(0, -1) : host;
-}
-
-function isLoopback(host: string): boolean {
-	return host === "localhost" || host.endsWith(".localhost") || host === "::1"
-		|| host === "0:0:0:0:0:0:0:1" || host.startsWith("127.");
-}
-
-function isWildcard(host: string): boolean {
-	return host === "0.0.0.0" || host === "::" || host === "0:0:0:0:0:0:0:0";
-}
-