opendht 0.0.0-stage → 4.4.100

package/README.md

@@ -1,3 +1,255 @@
-# Temporary Holding Version
+# OpenDHT Node.js Bindings
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Initial Node-API bindings using `node-addon-api` directly over the C++ library.
+Node.js 22.9 or later is required; the addon targets Node-API version 8.
+
+## Install
+
+```sh
+npm install opendht
+```
+
+## Build
+
+Install the native dependencies described in [BUILD.md](../BUILD.md), plus Node.js,
+a C++17 compiler, and CMake 3.21 or later. Ninja is optional.
+
+```sh
+cd nodejs
+npm ci
+npm run build
+npm test
+npm run typecheck
+```
+
+CMake.js builds OpenDHT from the parent source directory in `nodejs/build/native`.
+It does not change the repository's existing build directory. Tools, Python,
+peer discovery, documentation, and native tests default to disabled in this build.
+Native CMake options can be passed through, for example:
+
+```sh
+npm run build -- --CDOPENDHT_PEER_DISCOVERY=ON
+```
+
+The loader checks local builds, then compatible Node-API binaries under `prebuilds/`.
+Set `OPENDHT_NODE_BINDING` to an absolute addon path to select an explicit build.
+Packaged binaries include OpenDHT and non-system native dependencies, so archive
+installation does not require a compiler or a system OpenDHT installation.
+
+## Example Tool
+
+After building, start the TypeScript example from the repository root:
+
+```sh
+npm --prefix nodejs run dhtnode -- --port 4222 --bootstrap bootstrap.jami.net
+```
+
+The source is [examples/dhtnode.ts](examples/dhtnode.ts). `npm run build` compiles
+it to JavaScript; run `npm run build:examples` after editing just the example.
+Bootstrap is optional;
+`--bootstrap-port` selects its UDP port. Use `--port 0` for a free local port.
+
+```text
+listen greeting
+put greeting hello world
+get greeting
+sign greeting signed hello
+cancel greeting
+quit
+```
+
+Keys are text labels, hashed automatically; values are UTF-8 text. The tool
+generates a fresh EC identity on each run and prints IPv4/IPv6 connectivity
+changes. Operations run concurrently, leaving the prompt responsive; dependent
+commands should be entered after their preceding operation completes. EOF waits
+for pending operations, then cancels listeners and closes the runner. Ctrl-C,
+SIGTERM, and `quit` close immediately, rejecting pending operations without
+printing cancellation errors. `--help` lists all options. Archives include both
+the TypeScript source and compiled `examples/dhtnode.js`, runnable without
+TypeScript or development dependencies, including from inside `node_modules`.
+
+## Usage
+
+```js
+import { DhtRunner, hash } from 'opendht';
+
+async function main() {
+    const writer = new DhtRunner();
+    const reader = new DhtRunner();
+    try {
+        writer.run({ port: 0, ipv4: '127.0.0.1', ipv6: '::1' });
+        reader.run({ port: 0, ipv4: '127.0.0.1', ipv6: '::1' });
+        writer.bootstrap('127.0.0.1', reader.getBoundPort());
+        reader.bootstrap('127.0.0.1', writer.getBoundPort());
+        const key = hash('example');
+        const stored = await writer.put(key, Buffer.from('hello'), { id: 42n });
+        if (!stored) throw new Error('DHT put failed');
+        for (const value of await reader.get(key)) {
+            console.log(value.id, value.data.toString());
+        }
+    } finally {
+        await Promise.all([writer.close(), reader.close()]);
+    }
+}
+
+main().catch(console.error);
+```
+
+## API
+
+- `hash(string | Uint8Array)` returns a SHA-1 hash as a 40-character hex string.
+  All get/put/listen keys must be hex hashes, not unhashed application keys.
+- `version` is the underlying OpenDHT version.
+- `run({port, ipv4, ipv6, network, persistPath, identity})` starts a threaded node. Port 0
+  selects a free port. The defaults bind both IP families on all interfaces.
+  `persistPath` is optional; use an empty string to disable persistence.
+- `getBoundPort(4 | 6)` defaults to IPv4; `getNodeId()` returns the node's hex ID.
+- `getStatus()` returns the latest JS-dispatched `{ipv4, ipv6}` connectivity
+  snapshot. Each family is `'disconnected'`, `'connecting'`, or `'connected'`.
+  `runner.on('statusChanged', status => {})` receives changes on the JS thread.
+  New and closing/closed runners report both families as disconnected. No status
+  events are delivered after close begins; close does not emit a final event.
+- `bootstrap(host, port)` queues bootstrap discovery. Returning does not mean the
+  peer is connected; subsequent DHT operations report their own completion.
+- `put(key, Uint8Array, {id, type, userType, permanent})` copies the input and
+  resolves to the native success boolean. IDs are unsigned 64-bit `bigint` values.
+- `get(key)` resolves to value snapshots, or rejects with `ERR_DHT_GET_FAILED`.
+  Values contain `id`, `type`, `seq`, `userType`, copied `Buffer` data, `isSigned`,
+  `isEncrypted`, and an `owner` long fingerprint (or null for unsigned values).
+- `listen(key, (value, expired) => {})` returns a listener with idempotent
+  `cancel()`. Queued deliveries are suppressed after cancellation. Callback
+  return values are ignored; callbacks may cancel or close the runner.
+- `close()` is idempotent and returns the same promise on repeated calls. It
+  waits off the JS thread for graceful shutdown, then joins the native threads.
+  After two seconds it forces the join if graceful shutdown has not completed.
+  Pending operations reject with `ERR_DHT_CLOSED`. A closed runner cannot restart.
+- `ref()` and `unref()` control whether the runner keeps Node's event loop alive.
+  Running nodes are referenced by default. `Symbol.asyncDispose` calls `close()`.
+
+Callbacks run only on their owning JS thread. There is no polling timer or worker
+thread waiting on each get/put. Explicitly close runners; GC cleanup and Node
+environment cleanup hooks are fallbacks, including forced worker termination.
+Pending operations, active listeners, and registered status handlers keep their
+runner alive until completion, cancellation, handler removal, or explicit close.
+Graceful persistence cannot be guaranteed if the process is killed.
+
+The binding does not cap the callback queue or accumulated get results. Queued
+callbacks retain their native values until delivery or cleanup.
+
+## Crypto
+
+`PrivateKey.generate(options)` and `Identity.generate(name, options)` return
+promises and generate keys off the JS thread. Options accept `algorithm: 'ec'`
+(the default, using OpenDHT's default EC curve) or `'rsa'`. RSA `bits` must be an
+integer between 2048 and 8192; the default is 2048.
+
+- `new PrivateKey(bytes, password?)` imports PEM/DER; `serialize(password?)`
+  exports PKCS#8 PEM. A nonempty password encrypts the exported key.
+- `privateKey.getPublicKey()` returns an owned public key. `sign(bytes)` and
+  `decrypt(bytes)` return copied Buffers.
+- `new PublicKey(bytes)` imports a public key; `serialize()` exports DER.
+  `checkSignature(data, signature)` returns a boolean. `encrypt(bytes)` requires
+  an RSA key; EC keys support signatures, not this encryption scheme.
+- `new Certificate(bytes)` imports PEM/DER or a PEM certificate chain;
+  `serialize()` exports a PEM chain. Import does not establish trust or validate
+  the chain against a trust store. `getPublicKey()` returns its public key.
+- Public keys and certificates expose `getId()` (40 hex characters) and
+  `getLongId()` (64 hex characters).
+- `new Identity(privateKey, certificate)` requires matching fingerprints.
+  Its read-only `privateKey` and `certificate` properties return owned wrappers.
+- Pass `identity` to `run()` to enable `putSigned(key, data, options?)` and
+  `putEncrypted(key, data, recipientPublicKey, options?)`. Both return the same
+  success boolean as `put()`. Encrypted values are signed by the sender and
+  transparently decrypted for the recipient by OpenDHT's get/listen layer.
+
+```js
+import { Identity, DhtRunner } from 'opendht';
+
+async function createAuthenticatedNode() {
+    const identity = await Identity.generate('example', { algorithm: 'rsa', bits: 2048 });
+    const runner = new DhtRunner();
+    runner.run({ port: 0, identity });
+    return { runner, identity };
+}
+```
+
+Crypto methods take Uint8Array/Buffer inputs, not implicit text encodings. Imports
+must be nonempty. Malformed handles/data,
+mismatched identities, and unsupported encryption keys raise JS exceptions.
+Only generation is asynchronous; import/export/sign/encrypt/decrypt are
+synchronous and should be used from worker threads for large workloads.
+
+## Packaging And CI
+
+From a successful Release build:
+
+```sh
+npm run package
+npm run test:package
+```
+
+`bundle` copies the addon into `prebuilds/<platform>-<arch>/`, gathers its runtime
+dependencies, rewrites native loader paths, and copies dependency license
+notices. macOS needs `dylibbundler` and Apple developer tools; Linux needs
+`patchelf` and Debian/Ubuntu dependency copyright files. Windows uses the vcpkg
+installed tree (`VCPKG_INSTALLED_DIR`, `VCPKG_DEFAULT_TRIPLET`) and MSVC tools.
+`OPENDHT_LIBRARY_PATH` adds native library search directories when bundling.
+An explicit addon path may be passed to `npm run bundle -- /absolute/addon.node`.
+Bundling replaces only the current platform's generated prebuild directory.
+
+`test:package` creates an npm archive, installs it in a temporary consumer with
+install scripts disabled and no dev dependencies, forces prebuild-only loading,
+and runs the full runtime suite. Pass an archive file or a directory containing
+one archive to test it directly, for example `npm run test:package -- dist`.
+Only runtime JS, declarations, the example's TypeScript source, documentation,
+and prebuilds are included in the archive. `prepack` compiles the example, so
+archive creation needs the development dependencies; archive installation does not.
+
+The [Node.js package workflow](../.github/workflows/nodejs-package.yml) builds:
+
+| Target | Build Baseline |
+| --- | --- |
+| Linux x64 | Ubuntu 24.04 / glibc 2.39 (Noble dependency image) |
+| macOS ARM64 and x64 | macOS 15 |
+| Windows x64 | Windows Server 2022 / MSVC |
+
+The Linux build uses `ghcr.io/savoirfairelinux/opendht/opendht-deps-noble`,
+built from [the Noble Dockerfile](../docker/DockerfileDepsNoble), restored from
+the Ubuntu 24.04 recipe in git history. The release workflow publishes this
+multi-architecture image alongside the other Docker images. Node builds use its
+published `latest` tag. simdutf is linked statically because Ubuntu 24.04 does not
+provide its development package.
+
+CI combines platform prebuilds into one npm archive and verifies that archive on
+Node 22, 24, and 26 on each platform, including Ubuntu 24.04 and 26.04. Branch
+pushes, pull requests, and manual runs build and test without publishing.
+musl/Alpine and other architectures are not currently built. Node-API stability
+does not remove OS/libc or native dependency compatibility requirements. Review
+the included dependency licenses and source-distribution obligations before
+redistributing binaries.
+
+## Releases
+
+Pushing a `v*` tag starts [the release workflow](../.github/workflows/release-package.yml),
+which calls the Node.js package workflow. The npm archive version is taken from
+the tag without its leading `v`, for example `v4.4.99` becomes `opendht@4.4.99`.
+After all Node install tests and Windows builds pass, the release workflow attaches
+the verified npm archive alongside the Windows assets to the draft GitHub Release,
+then publishes that same archive to npm with provenance. Stable versions use the
+`latest` dist-tag; prerelease versions such as `v4.5.0-rc.1` use `next`.
+Publishing to npm happens on the tag push, not when the GitHub draft is published.
+Published npm versions cannot be overwritten; use a new version tag for changes.
+
+Configure an npm trusted publisher for the `opendht` package with GitHub owner
+`savoirfairelinux`, repository `opendht`, and workflow filename `release-package.yml`
+(not `nodejs-package.yml`). Allow direct `npm publish`. Publication runs on a
+GitHub-hosted runner with OIDC, so no npm token is needed once this is configured.
+
+For the first publication, before the npm package exists, set the repository's
+`NPM_TOKEN` secret to a granular npm token with publishing permission and 2FA
+bypass. After the first successful tag release, configure the trusted publisher
+in the npm package settings, then remove `NPM_TOKEN`. The publishing job supports
+the token for this bootstrap and prefers OIDC when available.
+
+Query filters, async iterators, AbortSignal support, certificate trust-store
+validation, CA issuance controls, and proxy controls remain future work.

package/crypto.js

@@ -0,0 +1,56 @@
+export default function createCrypto(native) {
+    const handles = new WeakMap();
+
+    function handle(value, Type) {
+        if (!(value instanceof Type) || !handles.has(value)) throw new TypeError(`Expected ${Type.name}`);
+        return handles.get(value);
+    }
+
+    function wrap(Type, nativeHandle) {
+        const result = Object.create(Type.prototype);
+        handles.set(result, nativeHandle);
+        return result;
+    }
+
+    function generate(kind, name, options = {}) {
+        if (!options || typeof options !== 'object' || Array.isArray(options)) throw new TypeError('Invalid crypto options');
+        return native.cryptoGenerate(kind, name, options.algorithm ?? 'ec', options.bits ?? 2048);
+    }
+
+    class PublicKey {
+        constructor(data) { handles.set(this, native.cryptoImport('public', data)); }
+        serialize() { return native.cryptoSerialize(handle(this, PublicKey)); }
+        getId() { return native.cryptoId(handle(this, PublicKey), false); }
+        getLongId() { return native.cryptoId(handle(this, PublicKey), true); }
+        checkSignature(data, signature) { return native.cryptoVerify(handle(this, PublicKey), data, signature); }
+        encrypt(data) { return native.cryptoEncrypt(handle(this, PublicKey), data); }
+    }
+
+    class PrivateKey {
+        constructor(data, password = '') { handles.set(this, native.cryptoImport('private', data, password)); }
+        static generate(options) { return generate('private', '', options).then(value => wrap(PrivateKey, value)); }
+        serialize(password = '') { return native.cryptoSerialize(handle(this, PrivateKey), password); }
+        getPublicKey() { return wrap(PublicKey, native.cryptoPublicKey(handle(this, PrivateKey))); }
+        sign(data) { return native.cryptoSign(handle(this, PrivateKey), data); }
+        decrypt(data) { return native.cryptoDecrypt(handle(this, PrivateKey), data); }
+    }
+
+    class Certificate {
+        constructor(data) { handles.set(this, native.cryptoImport('certificate', data)); }
+        serialize() { return native.cryptoSerialize(handle(this, Certificate)); }
+        getPublicKey() { return wrap(PublicKey, native.cryptoPublicKey(handle(this, Certificate))); }
+        getId() { return native.cryptoId(handle(this, Certificate), false); }
+        getLongId() { return native.cryptoId(handle(this, Certificate), true); }
+    }
+
+    class Identity {
+        constructor(privateKey, certificate) {
+            handles.set(this, native.cryptoIdentity(handle(privateKey, PrivateKey), handle(certificate, Certificate)));
+        }
+        static generate(name = 'dhtnode', options) { return generate('identity', name, options).then(value => wrap(Identity, value)); }
+        get privateKey() { return wrap(PrivateKey, native.cryptoIdentityPart(handle(this, Identity), true)); }
+        get certificate() { return wrap(Certificate, native.cryptoIdentityPart(handle(this, Identity), false)); }
+    }
+
+    return { PublicKey, PrivateKey, Certificate, Identity, handle };
+}

package/examples/dhtnode.js

@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+import { clearLine, createInterface, cursorTo } from 'node:readline';
+import { parseArgs } from 'node:util';
+const commands = 'get KEY | put KEY TEXT | sign KEY TEXT | listen KEY | cancel KEY | help | quit';
+function portNumber(value, name, minimum = 0) {
+    const port = Number(value);
+    if (!Number.isInteger(port) || port < minimum || port > 65535) {
+        throw new Error(`${name} must be an integer between ${minimum} and 65535`);
+    }
+    return port;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function report(error) {
+    console.error(errorMessage(error));
+    process.exitCode = 1;
+}
+async function main() {
+    const { values } = parseArgs({
+        options: {
+            help: { type: 'boolean', short: 'h' },
+            port: { type: 'string', short: 'p', default: '4222' },
+            ipv4: { type: 'string', default: '0.0.0.0' },
+            ipv6: { type: 'string', default: '::' },
+            bootstrap: { type: 'string', short: 'b' },
+            'bootstrap-port': { type: 'string', default: '4222' },
+        },
+    });
+    if (values.help) {
+        console.log(`Usage: npm run dhtnode -- [options]
+
+  -p, --port PORT           Local UDP port (default: 4222; 0 selects a free port)
+  -b, --bootstrap HOST      Optional bootstrap hostname or IP address
+      --bootstrap-port PORT  Bootstrap UDP port (default: 4222)
+      --ipv4 ADDRESS       IPv4 bind address (default: 0.0.0.0)
+      --ipv6 ADDRESS       IPv6 bind address (default: ::)
+  -h, --help               Show help
+
+Commands: ${commands}
+Keys are text labels hashed with SHA-1. Values are UTF-8 text.`);
+        return;
+    }
+    const port = portNumber(values.port, 'port');
+    const bootstrapPort = portNumber(values['bootstrap-port'], 'bootstrap-port', 1);
+    const { DhtRunner, Identity, hash } = await import('../index.js');
+    const identity = await Identity.generate('dhtnode.ts');
+    const runner = new DhtRunner();
+    const listeners = new Map();
+    const pending = new Set();
+    let lines;
+    let closing;
+    function close() {
+        if (!closing) {
+            for (const listener of listeners.values())
+                listener.cancel();
+            listeners.clear();
+            lines?.close();
+            closing = runner.close();
+        }
+        return closing;
+    }
+    function print(message) {
+        if (process.stdout.isTTY && lines) {
+            clearLine(process.stdout, 0);
+            cursorTo(process.stdout, 0);
+        }
+        console.log(message);
+        if (!closing && process.stdin.isTTY)
+            lines?.prompt(true);
+    }
+    const stop = () => { close().catch(report); };
+    const printValue = (label, value) => {
+        print(`${label} ${value.id}: ${JSON.stringify(value.data.toString('utf8'))}${value.isSigned ? ' [signed]' : ''}`);
+    };
+    const printStatus = (status) => {
+        print(`Connectivity: IPv4 ${status.ipv4}, IPv6 ${status.ipv6}`);
+    };
+    async function execute(line) {
+        const [, command, key, data] = line.trim().match(/^(\S+)(?:\s+(\S+))?(?:\s+(.+))?$/) || [];
+        if (!command)
+            return;
+        if (command === 'help') {
+            print(commands);
+            return;
+        }
+        if (!key)
+            throw new Error('Expected a key. Type help for commands.');
+        const location = hash(key);
+        switch (command) {
+            case 'get': {
+                const found = await runner.get(location);
+                if (closing)
+                    return;
+                for (const value of found)
+                    printValue(key, value);
+                if (!found.length)
+                    print(`No values for ${key}`);
+                break;
+            }
+            case 'put':
+            case 'sign': {
+                if (data === undefined)
+                    throw new Error(`Usage: ${command} KEY TEXT`);
+                const payload = Buffer.from(data, 'utf8');
+                const ok = command === 'sign' ? await runner.putSigned(location, payload)
+                    : await runner.put(location, payload);
+                if (closing)
+                    return;
+                if (!ok)
+                    throw new Error(`Put failed for ${key}`);
+                print(`Stored ${key}`);
+                break;
+            }
+            case 'listen':
+                if (!listeners.has(key)) {
+                    listeners.set(key, runner.listen(location, (value, expired) => {
+                        printValue(`${expired ? 'Expired' : 'Value'} ${key}`, value);
+                    }));
+                }
+                print(`Listening ${key}`);
+                break;
+            case 'cancel':
+                listeners.get(key)?.cancel();
+                listeners.delete(key);
+                print(`Cancelled ${key}`);
+                break;
+            default:
+                throw new Error('Unknown command. Type help for commands.');
+        }
+    }
+    runner.on('error', error => { report(error); stop(); });
+    runner.on('statusChanged', printStatus);
+    process.on('SIGINT', stop);
+    process.on('SIGTERM', stop);
+    try {
+        runner.run({ port, ipv4: values.ipv4, ipv6: values.ipv6, identity });
+        if (values.bootstrap)
+            runner.bootstrap(values.bootstrap, bootstrapPort);
+        lines = createInterface({ input: process.stdin, output: process.stdout });
+        lines.on('SIGINT', stop);
+        lines.setPrompt('dht> ');
+        print(`Node ${runner.getNodeId()} listening on UDP ${runner.getBoundPort()}`);
+        printStatus(runner.getStatus());
+        if (process.stdin.isTTY)
+            print(commands);
+        for await (const line of lines) {
+            if (closing)
+                break;
+            if (/^(quit|exit)(?:\s|$)/.test(line.trim())) {
+                stop();
+                break;
+            }
+            const operation = execute(line).catch(error => {
+                if (!closing)
+                    console.error(errorMessage(error));
+            }).finally(() => { pending.delete(operation); });
+            pending.add(operation);
+            if (process.stdin.isTTY)
+                lines.prompt();
+        }
+        if (!closing)
+            await Promise.all(pending);
+    }
+    finally {
+        try {
+            await close();
+            await Promise.all(pending);
+        }
+        finally {
+            process.removeListener('SIGINT', stop);
+            process.removeListener('SIGTERM', stop);
+        }
+    }
+}
+main().catch(report);

package/examples/dhtnode.ts

@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+
+import { clearLine, createInterface, cursorTo, type Interface } from 'node:readline';
+import { parseArgs } from 'node:util';
+import type { ConnectivityStatus, Listener, Value } from '../index.js';
+
+const commands = 'get KEY | put KEY TEXT | sign KEY TEXT | listen KEY | cancel KEY | help | quit';
+
+function portNumber(value: string, name: string, minimum = 0): number {
+    const port = Number(value);
+    if (!Number.isInteger(port) || port < minimum || port > 65535) {
+        throw new Error(`${name} must be an integer between ${minimum} and 65535`);
+    }
+    return port;
+}
+
+function errorMessage(error: unknown): string {
+    return error instanceof Error ? error.message : String(error);
+}
+
+function report(error: unknown): void {
+    console.error(errorMessage(error));
+    process.exitCode = 1;
+}
+
+async function main(): Promise<void> {
+    const { values } = parseArgs({
+        options: {
+            help: { type: 'boolean', short: 'h' },
+            port: { type: 'string', short: 'p', default: '4222' },
+            ipv4: { type: 'string', default: '0.0.0.0' },
+            ipv6: { type: 'string', default: '::' },
+            bootstrap: { type: 'string', short: 'b' },
+            'bootstrap-port': { type: 'string', default: '4222' },
+        },
+    });
+    if (values.help) {
+        console.log(`Usage: npm run dhtnode -- [options]
+
+  -p, --port PORT           Local UDP port (default: 4222; 0 selects a free port)
+  -b, --bootstrap HOST      Optional bootstrap hostname or IP address
+      --bootstrap-port PORT  Bootstrap UDP port (default: 4222)
+      --ipv4 ADDRESS       IPv4 bind address (default: 0.0.0.0)
+      --ipv6 ADDRESS       IPv6 bind address (default: ::)
+  -h, --help               Show help
+
+Commands: ${commands}
+Keys are text labels hashed with SHA-1. Values are UTF-8 text.`);
+        return;
+    }
+    const port = portNumber(values.port, 'port');
+    const bootstrapPort = portNumber(values['bootstrap-port'], 'bootstrap-port', 1);
+    const { DhtRunner, Identity, hash } = await import('../index.js');
+    const identity = await Identity.generate('dhtnode.ts');
+    const runner = new DhtRunner();
+    const listeners = new Map<string, Listener>();
+    const pending = new Set<Promise<void>>();
+    let lines: Interface | undefined;
+    let closing: Promise<void> | undefined;
+
+    function close(): Promise<void> {
+        if (!closing) {
+            for (const listener of listeners.values()) listener.cancel();
+            listeners.clear();
+            lines?.close();
+            closing = runner.close();
+        }
+        return closing;
+    }
+
+    function print(message: string): void {
+        if (process.stdout.isTTY && lines) {
+            clearLine(process.stdout, 0);
+            cursorTo(process.stdout, 0);
+        }
+        console.log(message);
+        if (!closing && process.stdin.isTTY) lines?.prompt(true);
+    }
+
+    const stop = (): void => { close().catch(report); };
+    const printValue = (label: string, value: Value): void => {
+        print(`${label} ${value.id}: ${JSON.stringify(value.data.toString('utf8'))}${value.isSigned ? ' [signed]' : ''}`);
+    };
+    const printStatus = (status: ConnectivityStatus): void => {
+        print(`Connectivity: IPv4 ${status.ipv4}, IPv6 ${status.ipv6}`);
+    };
+
+    async function execute(line: string): Promise<void> {
+        const [, command, key, data] = line.trim().match(/^(\S+)(?:\s+(\S+))?(?:\s+(.+))?$/) || [];
+        if (!command) return;
+        if (command === 'help') {
+            print(commands);
+            return;
+        }
+        if (!key) throw new Error('Expected a key. Type help for commands.');
+        const location = hash(key);
+        switch (command) {
+            case 'get': {
+                const found = await runner.get(location);
+                if (closing) return;
+                for (const value of found) printValue(key, value);
+                if (!found.length) print(`No values for ${key}`);
+                break;
+            }
+            case 'put':
+            case 'sign': {
+                if (data === undefined) throw new Error(`Usage: ${command} KEY TEXT`);
+                const payload = Buffer.from(data, 'utf8');
+                const ok = command === 'sign' ? await runner.putSigned(location, payload)
+                    : await runner.put(location, payload);
+                if (closing) return;
+                if (!ok) throw new Error(`Put failed for ${key}`);
+                print(`Stored ${key}`);
+                break;
+            }
+            case 'listen':
+                if (!listeners.has(key)) {
+                    listeners.set(key, runner.listen(location, (value, expired) => {
+                        printValue(`${expired ? 'Expired' : 'Value'} ${key}`, value);
+                    }));
+                }
+                print(`Listening ${key}`);
+                break;
+            case 'cancel':
+                listeners.get(key)?.cancel();
+                listeners.delete(key);
+                print(`Cancelled ${key}`);
+                break;
+            default:
+                throw new Error('Unknown command. Type help for commands.');
+        }
+    }
+
+    runner.on('error', error => { report(error); stop(); });
+    runner.on('statusChanged', printStatus);
+    process.on('SIGINT', stop);
+    process.on('SIGTERM', stop);
+    try {
+        runner.run({ port, ipv4: values.ipv4, ipv6: values.ipv6, identity });
+        if (values.bootstrap) runner.bootstrap(values.bootstrap, bootstrapPort);
+        lines = createInterface({ input: process.stdin, output: process.stdout });
+        lines.on('SIGINT', stop);
+        lines.setPrompt('dht> ');
+        print(`Node ${runner.getNodeId()} listening on UDP ${runner.getBoundPort()}`);
+        printStatus(runner.getStatus());
+        if (process.stdin.isTTY) print(commands);
+        for await (const line of lines) {
+            if (closing) break;
+            if (/^(quit|exit)(?:\s|$)/.test(line.trim())) {
+                stop();
+                break;
+            }
+            const operation = execute(line).catch(error => {
+                if (!closing) console.error(errorMessage(error));
+            }).finally(() => { pending.delete(operation); });
+            pending.add(operation);
+            if (process.stdin.isTTY) lines.prompt();
+        }
+        if (!closing) await Promise.all(pending);
+    } finally {
+        try {
+            await close();
+            await Promise.all(pending);
+        } finally {
+            process.removeListener('SIGINT', stop);
+            process.removeListener('SIGTERM', stop);
+        }
+    }
+}
+
+main().catch(report);