omp-onlyne 0.2.0 → 0.3.0

package/src/urls-text.ts

@@ -132,6 +132,9 @@ export const en = {
 	suffixReply: " · reply to {ref}",
 	suffixEntry: " · entry {url}",
 	suffixExpired: " · expired",
+	workLine: "  → work {unit}{parent}{attempt}",
+	workParent: " · parent {unit}",
+	workAttempt: " · attempt {attempt}",
 
 	resourcesTitle: "# Resources · {node}",
 	resourceOwnerError: "- unavailable: {code} · {message}",
@@ -280,6 +283,9 @@ export const zh: Record<keyof typeof en, string> = {
 	suffixReply: " · 回复 {ref}",
 	suffixEntry: " · 条目 {url}",
 	suffixExpired: " · 已过期",
+	workLine: "  → 工作单元 {unit}{parent}{attempt}",
+	workParent: " · 父单元 {unit}",
+	workAttempt: " · 第 {attempt} 次",
 
 	resourcesTitle: "# 资源 · {node}",
 	resourceOwnerError: "- 不可用：{code} · {message}",

package/src/urls.ts

@@ -19,6 +19,7 @@ import {
 	type ThreadDescription,
 	type ThreadRef,
 	type TrustPhase,
+	type WorkRef,
 } from "@onlyne/lib";
 import { createTranslator } from "@onlyne/node-host/i18n";
 import {
@@ -32,7 +33,7 @@ import {
 import { resourceQuery } from "./resources.ts";
 import { getRuntime, type PluginRuntime } from "./runtime.ts";
 import { isTrustThread, trustThread } from "./handshake.ts";
-import type { ContextRecord } from "./types.ts";
+import type { ContextRecord } from "@onlyne/node-host/types";
 import { urlsText } from "./urls-text.ts";
 
 type Caller = { main: boolean; agent_id?: string };
@@ -53,13 +54,15 @@ const TITLE_CHARS = 80;
 
 const handler: ProtocolHandler = {
 	scheme: "onlyne",
-	spec: { backing: "virtual", selectors: "lines", immutable: true },
+	// Every view reads live node state: threads, inbox, neighbors and conversations change
+	// between two reads of the same URL, so OMP must never serve a cached copy.
+	spec: { backing: "virtual", selectors: "lines", immutable: false },
 
 	async resolve(url: InternalUrl, context?: ResolveContext): Promise<InternalResource> {
 		const runtime = getRuntime();
 		if (runtime === undefined) throw new Error(t("notConfigured"));
 		const rendered = await render(runtime, callerOf(runtime, context), viewOf(url));
-		return { url: url.href, content: rendered.content, contentType: rendered.contentType, immutable: true };
+		return { url: url.href, content: rendered.content, contentType: rendered.contentType };
 	},
 
 	/**
@@ -475,11 +478,23 @@ export async function neighborRows(runtime: PluginRuntime): Promise<NeighborRow[
 			base_url: record.base_url,
 			...(record.membership?.domain_id === undefined ? {} : { region: record.membership.domain_id }),
 			...(record.last_seen === undefined ? {} : { last_seen: record.last_seen }),
-			verified,
+			verified: verified || entry?.state === "trusted",
 			phase: entry === undefined ? "no_exchange" : trustPhase(entry),
 			fingerprint: entry?.fingerprint ?? null,
 		});
 	}
+	// A trust row outlives a discovery record: a peer paired earlier is still a neighbor
+	// before mDNS or a seed refresh brings it back, and the listing says so.
+	for (const entry of trust.values()) {
+		if (entry.node_id === runtime.config.node.id || byNode.has(entry.node_id)) continue;
+		byNode.set(entry.node_id, {
+			node_id: entry.node_id,
+			base_url: entry.base_url,
+			verified: entry.state === "trusted",
+			phase: trustPhase(entry),
+			fingerprint: entry.fingerprint,
+		});
+	}
 	return [...byNode.values()].sort((left, right) => left.node_id.localeCompare(right.node_id));
 }
 
@@ -587,6 +602,7 @@ function outboundRow(outbound: Outbound): { position: string; lines: string[] }
 	const at = outbound.created_at ?? null;
 	const status = [outbound.state, outbound.error?.code ?? ""].filter(part => part.length > 0).join(" · ");
 	const reply = related === undefined ? "" : t("suffixReply", { ref: `${related.sender}/${related.id}` });
+	const work = workText(message.meta?.work);
 	const position = `${at ?? ""}\u0000${refKey(ref)}`;
 	const lines = [
 		t("outboundRow", {
@@ -596,6 +612,7 @@ function outboundRow(outbound: Outbound): { position: string; lines: string[] }
 			status,
 			reply,
 		}),
+		...(work === undefined ? [] : [work]),
 		`  ${firstLine(message.msg, SNIPPET_CHARS)}`,
 		t("outboundLinks", { message: messagePath(ref), conversation: conversationPath(ref) }),
 	];
@@ -1448,6 +1465,8 @@ function renderEntryRow(entry: Entry, nodeId: string): string {
 		}),
 	];
 	if (related !== undefined) lines.push(t("replyTo", { ref: refKey(related), url: messagePath(related) }));
+	const work = workText(entry.message.meta?.work);
+	if (work !== undefined) lines.push(work);
 	lines.push(t("historyLinks", {
 		message: messagePath(ref),
 		conversation: conversationPath(ref),
@@ -1479,6 +1498,8 @@ function renderHistoryRow(row: HistoryMessage, nodeId: string): string {
 	if (related !== undefined) {
 		lines.push(t("replyTo", { ref: `${related.sender}/${related.id}`, url: messagePath(related) }));
 	}
+	const work = workText(row.message.meta?.work);
+	if (work !== undefined) lines.push(work);
 	const entry = thread === undefined || row.seq === undefined || thread.owner !== nodeId
 		? ""
 		: t("suffixEntry", { url: entryPath(thread, row.seq) });
@@ -1486,3 +1507,14 @@ function renderHistoryRow(row: HistoryMessage, nodeId: string): string {
 	for (const line of row.message.msg.split(/\r?\n/)) lines.push(`  > ${line}`);
 	return lines.join("\n");
 }
+
+/**
+ * The work unit a message belongs to (RFC 0003 §1), as the reader needs it: the unit a
+ * receiver dedupes on, the enclosing unit, and which attempt this is.
+ */
+function workText(work: WorkRef | undefined): string | undefined {
+	if (work === undefined) return undefined;
+	const parent = work.parent === undefined || work.parent === null ? "" : t("workParent", { unit: work.parent });
+	const attempt = work.attempt === undefined ? "" : t("workAttempt", { attempt: String(work.attempt) });
+	return t("workLine", { unit: work.unit, parent, attempt });
+}

package/src/work.ts

@@ -0,0 +1,10 @@
+import type { WorkRef } from "@onlyne/lib";
+
+/** The work unit as one readable value: the dedupe key, its parent and the attempt number. */
+export function workValue(work: WorkRef): string {
+	return [
+		work.unit,
+		work.parent === undefined || work.parent === null ? "" : `parent ${work.parent}`,
+		work.attempt === undefined ? "" : `attempt ${work.attempt}`,
+	].filter(part => part.length > 0).join(" · ");
+}

package/src/acquire.ts

@@ -1,182 +0,0 @@
-import { lookup } from "node:dns/promises";
-import { BlockList, isIP } from "node:net";
-
-/** RFC 0018 §2: how far a peer may be acquired without a human confirming first. */
-export type AcquirePolicy = "all" | "segment" | "none";
-
-/** RFC 0018 §5: host-side acquisition settings. The library never reads them. */
-export interface AcquisitionPolicy {
-	policy: AcquirePolicy;
-	/** CIDR blocks and host names; only read when `policy` is `segment`. */
-	allow: string[];
-}
-
-/**
- * The default delegation: loopback only. Discovery excludes loopback by default, so the two
- * defaults together mean a remote peer is neither discovered nor approved (RFC 0018 §5.1).
- */
-export const DEFAULT_ACQUISITION: AcquisitionPolicy = {
-	policy: "segment",
-	allow: ["127.0.0.0/8", "::1/128"],
-};
-
-/** Turns a host name into the addresses it names; an empty list means it names none. */
-export type Resolver = (host: string) => Promise<string[]>;
-
-const dnsResolver: Resolver = async host => (await lookup(host, { all: true })).map(row => row.address);
-
-/** The configured policy, or the documented default when the config carries none. */
-export function acquisitionOf(config: { acquisition?: AcquisitionPolicy }): AcquisitionPolicy {
-	return config.acquisition ?? DEFAULT_ACQUISITION;
-}
-
-export type AcquireReason =
-	| "policy_all"
-	| "policy_segment"
-	| "policy_denied_none"
-	| "policy_unobserved"
-	| "policy_denied_observed"
-	| "policy_denied_declared"
-	| "policy_denied_recorded";
-
-/** RFC 0018 §2.1–2.2: what the host observed, what the peer declared, what discovery recorded. */
-export interface AcquireInput {
-	/** The address this statement's connection arrived from; absent when it was not observed. */
-	observed?: string;
-	/** The `base_url` the peer wrote into its own statement. */
-	declared?: string;
-	/** The discovery addresses recorded for this node id when the statement arrived. */
-	recorded?: readonly string[];
-}
-
-export interface AcquireVerdict {
-	allowed: boolean;
-	reason: AcquireReason;
-	/** The allow entry the observed address matched, when one did. */
-	matched?: string;
-}
-
-interface Block {
-	network: string;
-	prefix: number;
-	type: "ipv4" | "ipv6";
-}
-
-const HOST_NAME = /^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$/;
-
-/** One `[acquisition] allow` entry: `network/prefix`, or a host name to accept as written. */
-export function parseAllowBlock(value: string): Block | { name: string } | undefined {
-	const trimmed = value.trim();
-	if (trimmed.length === 0) return undefined;
-	const slash = trimmed.lastIndexOf("/");
-	if (slash <= 0) {
-		// A name is matched by its own spelling, so listing it involves no resolution. A bare
-		// address is not a block: it needs a prefix to say what it covers.
-		if (isIP(trimmed) !== 0 || !HOST_NAME.test(trimmed)) return undefined;
-		return { name: trimmed.toLowerCase() };
-	}
-	const prefix = Number(trimmed.slice(slash + 1));
-	if (!Number.isInteger(prefix) || prefix < 0) return undefined;
-	const network = literalAddress(trimmed.slice(0, slash));
-	if (network === undefined) return undefined;
-	if (prefix > (network.type === "ipv4" ? 32 : 128)) return undefined;
-	return { network: network.address, prefix, type: network.type };
-}
-
-/** The host a value names: a URL's hostname, or the value itself when it is already a host. */
-function hostOf(value: string): string | undefined {
-	const trimmed = value.trim();
-	if (trimmed.length === 0) return undefined;
-	if (!trimmed.includes("://")) return trimmed.replace(/^\[(.*)\]$/, "$1");
-	try {
-		const host = new URL(trimmed).hostname;
-		return host.replace(/^\[(.*)\]$/, "$1");
-	} catch {
-		return undefined;
-	}
-}
-
-/** A host that is already a literal address, with IPv4-mapped IPv6 read as IPv4. */
-function literalAddress(host: string): { address: string; type: "ipv4" | "ipv6" } | undefined {
-	const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-	const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(bare);
-	if (mapped !== null) return { address: mapped[1]!, type: "ipv4" };
-	const family = isIP(bare);
-	if (family === 4) return { address: bare, type: "ipv4" };
-	if (family === 6) return { address: bare, type: "ipv6" };
-	return undefined;
-}
-
-function blockHolds(address: { address: string; type: "ipv4" | "ipv6" }, block: Block): boolean {
-	if (block.type !== address.type) return false;
-	const blocks = new BlockList();
-	blocks.addSubnet(block.network, block.prefix, block.type);
-	return blocks.check(address.address, block.type);
-}
-
-/** The allow entry an address falls in, or undefined. */
-function entryFor(address: { address: string; type: "ipv4" | "ipv6" }, allow: readonly string[]): string | undefined {
-	for (const entry of allow) {
-		const block = parseAllowBlock(entry);
-		if (block === undefined || "name" in block) continue;
-		if (blockHolds(address, block)) return entry.trim();
-	}
-	return undefined;
-}
-
-/**
- * The allow entry a value matches, or undefined. A literal address is judged as itself. A host
- * name matches an allow entry of the same name; otherwise it is resolved and every address it
- * names must fall inside the allow set (RFC 0018 §2.1) — a name that resolves to nothing, or to
- * one address outside the set, matches nothing.
- */
-export async function allowMatch(value: string, allow: readonly string[], resolve: Resolver = dnsResolver): Promise<string | undefined> {
-	const host = hostOf(value);
-	if (host === undefined) return undefined;
-	const literal = literalAddress(host);
-	if (literal !== undefined) return entryFor(literal, allow);
-	const named = allow.find(entry => {
-		const block = parseAllowBlock(entry);
-		return block !== undefined && "name" in block && block.name === host.toLowerCase();
-	});
-	if (named !== undefined) return named.trim();
-	const resolved = await resolve(host).catch(() => [] as string[]);
-	let matched: string | undefined;
-	for (const address of resolved) {
-		const target = literalAddress(address);
-		if (target === undefined) return undefined;
-		const entry = entryFor(target, allow);
-		if (entry === undefined) return undefined;
-		matched ??= entry;
-	}
-	return matched;
-}
-
-/**
- * RFC 0018 §2: decide whether this peer may be approved without a human confirming first.
- *
- * The declared address is checked because the trust row stores it and `peerBase` falls back to
- * it when discovery has no record. The recorded addresses are checked because
- * `discovery.resolve()` re-probes every one of them before it connects, so a record outside the
- * allow set is an outbound request the policy never authorized.
- */
-export async function evaluateAcquisition(
-	policy: AcquisitionPolicy,
-	input: AcquireInput,
-	resolve: Resolver = dnsResolver,
-): Promise<AcquireVerdict> {
-	if (policy.policy === "none") return { allowed: false, reason: "policy_denied_none" };
-	if (policy.policy === "all") return { allowed: true, reason: "policy_all" };
-	if (input.observed === undefined) return { allowed: false, reason: "policy_unobserved" };
-	const observed = await allowMatch(input.observed, policy.allow, resolve);
-	if (observed === undefined) return { allowed: false, reason: "policy_denied_observed" };
-	if (input.declared !== undefined && await allowMatch(input.declared, policy.allow, resolve) === undefined) {
-		return { allowed: false, reason: "policy_denied_declared", matched: observed };
-	}
-	for (const address of input.recorded ?? []) {
-		if (await allowMatch(address, policy.allow, resolve) === undefined) {
-			return { allowed: false, reason: "policy_denied_recorded", matched: observed };
-		}
-	}
-	return { allowed: true, reason: "policy_segment", matched: observed };
-}

package/src/host-text.ts

@@ -1,92 +0,0 @@
-import { createTranslator } from "@onlyne/node-host/i18n";
-const en = {
-  regionEmpty: "region must not be empty.",
-  nodeIdEmpty: "node.id must not be empty.",
-  addressEmpty: "A node address must not be empty.",
-  addressUrl: "A node address must be an absolute URL, got {value}.",
-  addressScheme: "A node address must use http or https, got {value}.",
-  addressShape: "A node address is an origin (http://host:7801) or a service URL (http://host:7801{service}), got {value}.",
-  configMissing: "No Onlyne configuration at {path}. Run /onlyne init to create it.",
-  configParse: "{path}: {error}",
-  languageInvalid: "language must be en or zh-CN.",
-  keyScopeInvalid: "node.key_scope must be project, global or none, got {value}.",
-  publicUrlEmpty: "server.public_url must not be empty.",
-  bindEmpty: "server.bind must not be empty.",
-  bindShape: "server.bind must be a hostname or IP address, got {value}.",
-  pageSizeRange: "threads.page_size must be an integer from 1 to 100, got {value}.",
-  retiredEndpoint: "node.endpoint is not supported; the endpoint comes from server.bind and the listening port.",
-  portRange: "server.port must be an integer from 0 to 65535, got {value}.",
-  retiredPeers: "peers is not supported; peers are discovered over the network and kept in the project SQLite.",
-  retiredOmp: "omp is not supported; delivery and spawning are decided by the OMP judge.",
-  retiredAttention: "threads.default_attention is not supported; reads default to the attention list.",
-  tableExpected: "{path}: {key} must be a table.",
-  stringExpected: "{field} must be a string.",
-  integerExpected: "{field} must be an integer.",
-  stringArrayExpected: "{field} must be an array of non-empty strings.",
-  trustArray: "{path}: trust must be an array of tables.",
-  trustEntry: "{path}: a trust entry needs node_id and a 16-character fingerprint.",
-  acquirePolicy: "acquisition.policy must be all, segment or none, got {value}.",
-  acquireAllow: "acquisition.allow entries must be network/prefix blocks, got {value}.",
-  acquireDenied: "The acquisition policy {policy} refused this approval: {reason}.",
-  addressUnavailable: "No concrete network address is available for this bind host.",
-  keyProvider: "External credential references need a host key provider.",
-  loopbackBind: "The unauthenticated development binding requires a loopback bind host. Create a node key to serve a remote address.",
-  managementIdentity: "HTTP callers cannot claim this node's management identity.",
-  mentionNotFound: "No unique discovered node is named {name}.",
-  guideContacts: "Contacts",
-  guidePending: "Pending",
-  guideAccept: "Accept",
-  guideDiscover: "Discover",
-  guideRequestExchange: "Request key exchange",
-  resourcePageSize: "page_size must be from 1 to 100.",
-  resourceOwner: "Resource owner must be a non-empty node id.",
-  resourceRef: "Resource reads need meta.resource {owner,id}.",
-  resourceSince: "since must be a decimal event id.",
-  resourceOp: "Resource reads use list, describe, log, event with event_id, operations, or status with operation_id.",
-};
-const zh: Record<keyof typeof en, string> = {
-  regionEmpty: "region 不能为空。",
-  nodeIdEmpty: "node.id 不能为空。",
-  addressEmpty: "节点地址不能为空。",
-  addressUrl: "节点地址必须是绝对 URL，收到的是 {value}。",
-  addressScheme: "节点地址必须使用 http 或 https，收到的是 {value}。",
-  addressShape: "节点地址应写成源站（http://host:7801）或服务 URL（http://host:7801{service}），收到的是 {value}。",
-  configMissing: "在 {path} 没有 Onlyne 配置。运行 /onlyne init 创建。",
-  configParse: "{path}: {error}",
-  languageInvalid: "language 必须是 en 或 zh-CN。",
-  keyScopeInvalid: "node.key_scope 必须是 project、global 或 none，收到的是 {value}。",
-  publicUrlEmpty: "server.public_url 不能为空。",
-  bindEmpty: "server.bind 不能为空。",
-  bindShape: "server.bind 必须是主机名或 IP 地址，收到的是 {value}。",
-  pageSizeRange: "threads.page_size 必须是 1 到 100 之间的整数，收到的是 {value}。",
-  retiredEndpoint: "不支持 node.endpoint；端点由 server.bind 和监听端口决定。",
-  portRange: "server.port 必须是 0 到 65535 之间的整数，收到的是 {value}。",
-  retiredPeers: "不支持 peers；对端通过网络发现，并保存在项目 SQLite 中。",
-  retiredOmp: "不支持 omp；投送与派生由 OMP judge 决定。",
-  retiredAttention: "不支持 threads.default_attention；读取默认使用关注列表。",
-  tableExpected: "{path}: {key} 必须是表。",
-  stringExpected: "{field} 必须是字符串。",
-  integerExpected: "{field} 必须是整数。",
-  stringArrayExpected: "{field} 必须是非空字符串数组。",
-  trustArray: "{path}: trust 必须是表数组。",
-  trustEntry: "{path}: 每条 trust 记录需要 node_id 和 16 个字符的指纹。",
-  acquirePolicy: "acquisition.policy 必须是 all、segment 或 none，收到的是 {value}。",
-  acquireAllow: "acquisition.allow 的条目必须是 network/prefix 形式，收到的是 {value}。",
-  acquireDenied: "获取策略 {policy} 拒绝了这次批准：{reason}。",
-  addressUnavailable: "这个绑定主机没有可用的具体网络地址。",
-  keyProvider: "外部凭据引用需要主机密钥提供者。",
-  loopbackBind: "未认证的开发绑定需要回环绑定主机。要对外提供服务，请创建节点密钥。",
-  managementIdentity: "HTTP 调用方不能冒用本节点的管理身份。",
-  mentionNotFound: "没有唯一发现到的节点名为 {name}。",
-  guideContacts: "联系人",
-  guidePending: "待确认",
-  guideAccept: "同意",
-  guideDiscover: "发现",
-  guideRequestExchange: "请求交换密钥",
-  resourcePageSize: "page_size 必须是 1 到 100。",
-  resourceOwner: "资源 owner 必须是非空节点 id。",
-  resourceRef: "读取资源需要 meta.resource {owner,id}。",
-  resourceSince: "since 必须是十进制事件 id。",
-  resourceOp: "读取资源可用 list、describe、log、带 event_id 的 event、operations，或带 operation_id 的 status。",
-};
-export const hostText = createTranslator({ en, "zh-CN": zh });

package/src/node.ts

@@ -1,139 +0,0 @@
-import { networkInterfaces } from "node:os";
-import { FetchTransport, OnlyneError, OnlyneNode, trustPhase, type Action, type AdmissionContext, type Auth, type Json, type KeyHook, type KeyMaterial, type MaintenanceClock, type MsgInput, type Runtime, type SigningTransportOptions, type Storage, type Target } from "@onlyne/lib";
-import { loadOrCreateKey, writeKeyMaterial } from "@onlyne/node-host/keys";
-import { hostText as t } from "./host-text.ts";
-import { canAnswer, type ContextRegistry } from "./store.ts";
-import type { OnlyneConfig } from "./types.ts";
-
-export interface NodeDeps {
-	config: OnlyneConfig;
-	endpoint: string;
-	instanceId: string;
-	storage: Storage;
-	contexts: ContextRegistry;
-	decide(input: MsgInput): Promise<Action>;
-	runtime: Runtime;
-	/** The timer primitives of the library's own maintenance loop (RFC 0017 §6). */
-	clock: MaintenanceClock;
-	/** The directory the host resolved for this node's identity key; absent keeps the loopback development binding. */
-	keyDir?: string;
-	keys?: KeyHook;
-}
-
-export function advertisedHost(bind: string): string {
-	if (bind !== "0.0.0.0" && bind !== "::") return bind;
-	for (const addresses of Object.values(networkInterfaces())) {
-		for (const address of addresses ?? []) {
-			if (!address.internal && address.family === "IPv4") return address.address;
-		}
-	}
-	throw new OnlyneError("unavailable", t("addressUnavailable"));
-}
-
-export function createOnlyneNode(deps: NodeDeps): OnlyneNode {
-	const { config } = deps;
-	if (config.node.key_ref && deps.keys === undefined) throw new OnlyneError("unsupported_delivery", t("keyProvider"));
-	// Without a key directory the node keeps the loopback development binding (RFC 0001 §1).
-	if (deps.keys === undefined && deps.keyDir === undefined && !["127.0.0.1", "::1", "localhost"].includes(config.server.bind)) {
-		throw new OnlyneError("unsupported_delivery", t("loopbackBind"));
-	}
-	let node: OnlyneNode;
-	const authenticate = async (request: Request): Promise<Auth | null> => {
-		const actor = request.headers.get("Onlyne-Actor");
-		if (!actor || !/^[A-Za-z][A-Za-z0-9+.-]*:[^\s]+$/.test(actor)) return null;
-		if (actor === config.node.id) throw new OnlyneError("forbidden", t("managementIdentity"));
-		return { actor };
-	};
-	const resolve = async (id: string): Promise<Target> => {
-		let target: Target;
-		if (id === config.node.id) {
-			target = { node_id: id, base_url: deps.endpoint };
-		} else {
-			try {
-				target = await node.discovery.resolve(id);
-			} catch (error) {
-				const trustEntry = await node.trust.entry(id).catch(() => undefined);
-				if (trustEntry?.base_url) {
-					target = { node_id: id, base_url: trustEntry.base_url };
-				} else {
-					throw error;
-				}
-			}
-		}
-		return { ...target, headers: { "Onlyne-Actor": config.node.id } };
-	};
-	/**
-	 * Admission reads the trust projection, never the discovery catalog (design §1.1): a discovered
-	 * peer is a clue (RFC 0017 §4), and `discovery.known` is process-local, so a restart would refuse
-	 * a peer whose exchange already completed.
-	 */
-	const admitted = async (id: string, context: AdmissionContext): Promise<boolean> => {
-		if (id === config.node.id) return true;
-		return await context.trust(id) === "exchanged";
-	};
-	const keyDir = deps.keyDir;
-	const keys: KeyHook | undefined = deps.keys ?? (keyDir === undefined ? undefined : Object.assign(
-		() => loadOrCreateKey(keyDir, config.node.id),
-		{ replace: (material: KeyMaterial) => writeKeyMaterial(keyDir, material, { replace: true }) },
-	));
-	// The library's own signing transport, built here for one reason: a missing trust row has to
-	// end at this host's menu. Signing still happens only for a keyed node, and the trust reads
-	// resolve lazily because the service exists only once the node is built.
-	const signing: SigningTransportOptions | undefined = keys === undefined ? undefined : {
-		trust: {
-			entry: id => node.trust.entry(id),
-			signRequest: (request, target, raw) => node.trust.signRequest(request, target, raw),
-			verifyResponse: (target, request, response, body) => node.trust.verifyResponse(target, request, response, body),
-		},
-		guidance: details => ({
-			entry: details.required_action === "confirm_exchange"
-				? ["/onlyne", t("guideContacts"), t("guidePending"), t("guideAccept")]
-				: ["/onlyne", t("guideDiscover"), t("guideRequestExchange")],
-		}),
-	};
-	node = new OnlyneNode({
-		node_id: config.node.id, base_url: deps.endpoint, instance_id: deps.instanceId,
-		now: () => Date.now(), id: () => crypto.randomUUID(),
-		authentication: keys === undefined ? ["none"] : ["signature"], plugins: {
-			storage: deps.storage, authenticate, resolve, decide: deps.decide, runtime: deps.runtime, maintenanceClock: deps.clock,
-			...(keys === undefined ? {} : { keys }),
-			...(signing === undefined ? {} : { transport: new FetchTransport(resolve, fetch, signing) }),
-			...(config.trust === undefined ? {} : { trust_seeds: config.trust }),
-			domainCandidates: id => node.discovery.candidates(id),
-			// The keyless development binding checks no identity (RFC 0001 §1): every declared
-			// actor may open a thread. A keyed node admits only peers whose exchange completed.
-			mayAdmit: async (actor, _thread, context) => keys === undefined || await admitted(actor, context),
-			inboundThread: async (actor, context) => keys === undefined || await admitted(actor, context),
-			// A context that cannot answer is not a continuation target: publishing one lets a
-			// sender aim a message at a session that can never reply (caerulea report 4, problem 7).
-			executionContexts: async () => (await deps.contexts.list()).filter(canAnswer)
-				.map(record => ({ alias: record.alias, summary: record.summary, state: record.state })) as Json,
-			mention: async alias => {
-				const name = alias.replace(/^@/, "");
-				if (name === "self" || name === config.node.id) return config.node.id;
-				const matches = (await node.discovery.listRecords()).filter(record => record.node_id === name || record.node_id.split(":").at(-1) === name);
-				const ids = [...new Set(matches.map(record => record.node_id))];
-				if (ids.length !== 1) throw new OnlyneError(ids.length ? "ambiguous_target" : "not_found", t("mentionNotFound", { name }));
-				return ids[0]!;
-			},
-			directory: async () => ({ node: config.node.id, region: config.region, endpoint: deps.endpoint, peers: await node.discovery.listRecords(), contexts: await deps.contexts.list() }) as unknown as Json,
-			// The same rows onlyne://neighbors renders: every observed node with its trust state.
-			neighbors: async () => {
-				const records = await node.discovery.listRecords();
-				const trust = new Map((await node.trust.list(node.auth)).map(entry => [entry.node_id, entry]));
-				return records.map(record => {
-					const entry = trust.get(record.node_id);
-					return {
-						node_id: record.node_id, base_url: record.base_url,
-						...(record.membership?.domain_id === undefined ? {} : { region: record.membership.domain_id }),
-						...(record.last_seen === undefined ? {} : { last_seen: record.last_seen }),
-						verified: record.verified_at !== undefined && Date.parse(record.expires_at) > Date.now(),
-						phase: entry === undefined ? "no_exchange" : trustPhase(entry),
-						fingerprint: entry?.fingerprint ?? null,
-					};
-				});
-			},
-		},
-	});
-	return node;
-}