@hediet/linkrpc-cli 0.0.3-next.20260926.7 → 0.0.3-next.20261006.1

package/README.md

@@ -439,7 +439,11 @@ hub --endpoint unix:/run/hub.sock json-rpc-stdio language-server
 
 These commands resolve the same persistent identity selected by the global
 `--principal` option and endpoint configuration. Approval commands discover and
-validate Hub access manifests through the shared Hub approver client. The
+validate Hub access manifests through the shared observable approval client in
+`@hediet/linkrpc-infra/approval`. The CLI owns formatting and the terminal UI;
+its interactive adapter supplies `createTerminalConsentPrompt` from
+`@hediet/linkrpc-hub` when no prompt is provided. Generic infrastructure callers
+must pass an explicit `ConsentPrompt` to `runInteractive(signal, prompt)`. The
 resolved identity acts as the capability issuer/root: commands only show or
 decide requests whose `acceptableRootIds` allow that root, while minted
 capabilities retain the request consumer as their audience.

package/dist/chunks/{cli-IfKpF0E1.js → cli-yDtBqjCT.js}

@@ -1,6 +1,6 @@
-import { A as connectViaRootOverlay, C as findMethodInSchema, D as formatPrincipalSource, E as logoutCliIdentity, F as describeSchema, H as mcpForwardInterface, I as explainValidation, L as validateValueAgainstSchema, M as resolveTargetEndpoint, N as resolvedEndpointToConfig, O as parsePrincipalSpec, P as describeObjectParams, S as fetchSchema$1, V as MethodRefWithOptHash, a as resolveStaticHubSchemaSource, b as setupSigning, c as resolveInvocationEndpoint, d as formatContextReference, i as loadStaticHubSchema, j as connectViaTransport, k as connect, l as validationDefault, n as StaticHubReflection, o as mutationReference, p as resolveCliInvocation, r as withStaticHubReflection, s as resolveInvocationContext, t as completeForLine, u as ContextStore, v as requestReflectionAccess, w as walkHub, x as fetchDefaults, y as requestTopologyAccess, z as mergeParams } from "./runComplete-F95L0neY.js";
+import { A as connectViaRootOverlay, C as findMethodInSchema, D as formatPrincipalSource, E as logoutCliIdentity, F as describeSchema, H as mcpForwardInterface, I as explainValidation, L as validateValueAgainstSchema, M as resolveTargetEndpoint, N as resolvedEndpointToConfig, O as parsePrincipalSpec, P as describeObjectParams, S as fetchSchema$1, V as MethodRefWithOptHash, a as resolveStaticHubSchemaSource, b as setupSigning, c as resolveInvocationEndpoint, d as formatContextReference, i as loadStaticHubSchema, j as connectViaTransport, k as connect, l as validationDefault, n as StaticHubReflection, o as mutationReference, p as resolveCliInvocation, r as withStaticHubReflection, s as resolveInvocationContext, t as completeForLine, u as ContextStore, v as requestReflectionAccess, w as walkHub, x as fetchDefaults, y as requestTopologyAccess, z as mergeParams } from "./runComplete-CM1sMWnI.js";
 import { a as derived, i as autorun, r as observableValue } from "./dist-BOcSU4-O.js";
-import { ErrorCode, INTERFACE_TEMPLATES_EXTENSION, LinkRpcConnection, RpcError, TransportPair, computeInterfaceHash, connectTransports, createSchemaToZod, exportStaticHubSchema, generateTsContract, generateTsInterface, interfaceTemplateArgumentsEquivalent, interfaceTemplateMemberName, isAssignable, jcsCanonicalize } from "@hediet/linkrpc";
+import { ErrorCode, INTERFACE_TEMPLATES_EXTENSION, LinkRpcConnection, RpcError, computeInterfaceHash, connectTransports, createSchemaToZod, exportStaticHubSchema, generateTsContract, generateTsInterface, interfaceTemplateArgumentsEquivalent, interfaceTemplateMemberName, isAssignable, jcsCanonicalize } from "@hediet/linkrpc";
 import { WebSocketTransport, connectNdjson, formatEndpointUri, isHubEndpoint, openWebSocket, parseEndpointUri, runInitializeHandshake, traceMessageTransport as traceMessageTransport$1 } from "@hediet/linkrpc/node";
 import { SocketServer } from "@hediet/linkrpc-hub/hub/server/node";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -11,19 +11,19 @@ import { spawnCommand } from "@hediet/linkrpc-hub/spawn";
 import { tapTransport } from "@hediet/linkrpc-hub/hub/server/transit";
 import * as net from "node:net";
 import { mkdir, open, readFile, writeFile } from "node:fs/promises";
-import { DEFAULT_WALK_DEPTH, HubDirectoryExplorer, fetchSchema, hubAccessManifestInterface, hubGrantedServiceIdInterface, hubServiceIdRegistryInterface } from "@hediet/linkrpc/hub/common";
+import { DEFAULT_WALK_DEPTH, HubDirectoryExplorer, fetchSchema, hubGrantedServiceIdInterface, hubServiceIdRegistryInterface } from "@hediet/linkrpc/hub/common";
 import { Command, InvalidArgumentError } from "commander";
+import { bootstrapApprovalCapability, createHubApprovalClient } from "@hediet/linkrpc-infra/approval";
 import { connectionTokenBinderInterface } from "@hediet/linkrpc-hub/hub/server/connection-token-binder";
 import { spawn } from "node:child_process";
 import { TopologyClient, TopologyNetworkClient, TrafficClient } from "@hediet/linkrpc-infra/inspection";
 import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
-import { AggregatingHubAccessManifest, ApproveClient, TrafficFlowAggregator, buildSlotPermissions, formatFlowSummary, registerAggregatingManifest, runManifestApprover, toSignedPermissions } from "@hediet/linkrpc-hub";
+import { TrafficFlowAggregator, createTerminalConsentPrompt, formatFlowSummary } from "@hediet/linkrpc-hub";
 import { loadHubConfig, printHubConfigSchema } from "@hediet/linkrpc-hub/config-file";
 import * as readline from "node:readline";
 import { emitKeypressEvents } from "node:readline";
 import { connectJsonRpcTransports, connectRawJsonRpcTransport, createNdjsonJsonRpcTransport, jsonRpcConnectionInterface } from "@hediet/linkrpc-infra/json-rpc";
-import { CapabilityProposalIssuer, candidatesForSlot, durationToExp } from "@hediet/linkrpc-hub/hub/server";
 import { GRAPH_INTERFACE_TAG, IMMUTABLE_GRAPH_INTERFACE_ID, ROOT_WATCH_INTERFACE_ID, evaluateGraphPresentation, graphPresentationInterface, graphPresentationSchema, isGraphRef, standardGraphRuntimeOptions, validateGraphInterfaceSchema } from "@hediet/linkrpc-infra/graph";
 import React from "react";
 import { Box, Text, measureElement, render } from "ink";
@@ -2958,340 +2958,13 @@ function durationTone(duration) {
 }
 //#endregion
 //#region src/commands/approval.ts
-/**
-* The only authority an approval command needs for inspecting and updating
-* manifests across a federated Hub.
-*/
-const approvalCommandPermissions = [{
-	target: {
-		serviceId: { prefix: "" },
-		interfaceId: { exact: "hubAccessManifest" },
-		members: [{ prefix: "" }]
-	},
-	canInvoke: true
-}, {
-	target: {
-		serviceId: { prefix: "" },
-		interfaceId: { exact: "hubrpc.directory" },
-		members: [{ prefix: "" }]
-	},
-	canInvoke: true
-}];
-const approvalCommandPermissionsJson = jcsCanonicalize(approvalCommandPermissions);
-/**
-* Installs the root identity's narrowly scoped self-capability used by the
-* approval scanner. Reusing the non-expiring exact grant prevents repeated
-* commands from growing the principal's durable capability bag.
-*/
-async function bootstrapApprovalCommandCapability(principal) {
-	const existing = principal.capBag.capabilities.find((capability) => capability.issuer === principal.id && capability.audience === principal.id && capability.expiresAtMs === void 0 && capability.parentHash === void 0 && jcsCanonicalize(capability.permissions) === approvalCommandPermissionsJson);
-	if (existing) return existing;
-	const capability = await new CapabilityProposalIssuer(principal.identity).mint({
-		audience: principal.id,
-		permissions: approvalCommandPermissions
-	});
-	await principal.capBag.add(capability);
-	return capability;
-}
-const MANIFEST_INTERFACE_ID = hubAccessManifestInterface.info.id;
-const AGGREGATE_SERVICE_ID = "linkrpc-cli.approvals";
-const EXTERNAL_ID_PREFIX = "ar1_";
-/**
-* CLI-facing approval operations over the hub's shared manifest frontend.
-* The underlying {@link ApproveClient} remains authoritative for snapshots and
-* acknowledgement. One-shot commands mint before calling its acknowledged
-* decision path; {@link runManifestApprover} drives the interactive UI.
-*/
-var ApprovalCommandClient = class {
-	_principalId;
-	_manifest;
-	_client;
-	_issuer;
-	_fetchDirectory;
-	_log;
-	_disposeExtra;
-	_lastClientError;
-	_disposed = false;
-	constructor(options) {
-		this._principalId = options.identity.publicSigningIdentity.principal;
-		this._manifest = options.manifest;
-		this._issuer = new CapabilityProposalIssuer(options.identity);
-		this._fetchDirectory = options.fetchDirectory;
-		this._log = options.log ?? (() => {});
-		this._disposeExtra = options.dispose;
-		this._client = new ApproveClient({
-			manifest: this._manifest,
-			ownPrincipalId: this._principalId,
-			timeoutMs: options.timeoutMs,
-			log: (line) => {
-				this._lastClientError = line;
-				this._log(line);
-			}
-		});
-	}
-	get principalId() {
-		return this._principalId;
-	}
-	async requests() {
-		return this._toPendingRequests(await this._currentRequests());
-	}
-	/**
-	* Subscribe to the authoritative manifest snapshot. The callback is invoked
-	* immediately and whenever the watch reconnects or the request set changes.
-	*/
-	watch(listener) {
-		return autorun((reader) => {
-			const state = this._client.state.read(reader);
-			listener({
-				state,
-				requests: this._toPendingRequests(this._client.requests.read(reader)),
-				...state === "stale" && this._lastClientError !== void 0 ? { error: this._lastClientError } : {}
-			});
-		});
-	}
-	/** Force an immediate manifest reconciliation. */
-	async refresh() {
-		await this._currentRequests();
-	}
-	async deny(externalId, reason, expected) {
-		const internalId = decodeApprovalRequestId(externalId);
-		const pending = await this._requirePending(internalId, externalId);
-		if (expected !== void 0) this._requireUnchanged(pending, expected);
-		const result = await this._client.decide(internalId, {
-			status: "denied",
-			...reason !== void 0 ? { reason } : {}
-		});
-		if (result === "gone") throw new Error(`approval request '${externalId}' is no longer pending`);
-		return result;
-	}
-	async approve(externalId) {
-		return this.approvePrepared(await this.prepareApproval(externalId));
-	}
-	/**
-	* Resolve the exact authority that an approval will mint. Interactive
-	* surfaces render this result before asking for confirmation.
-	*/
-	async prepareApproval(externalId) {
-		const internalId = decodeApprovalRequestId(externalId);
-		const pending = await this._requirePending(internalId, externalId);
-		const resolved = await this._resolveRequest(pending.request);
-		if ("denied" in resolved) throw new Error(`approval request '${externalId}' cannot be granted: ${resolved.denied}`);
-		const sourceServiceId = approvalRequestSource(internalId);
-		return {
-			pending: {
-				id: externalId,
-				request: pending.request,
-				revision: pending.revision,
-				...sourceServiceId === void 0 ? {} : { sourceServiceId }
-			},
-			permissions: await toSignedPermissions(resolved.permissions, pending.request.consumer.principal, pending.request.duration),
-			...resolved.resolvedSlot === void 0 ? {} : { resolvedSlot: resolved.resolvedSlot }
-		};
-	}
-	/** Approve only if the request is still exactly the one that was reviewed. */
-	async approvePrepared(prepared) {
-		const externalId = prepared.pending.id;
-		const internalId = decodeApprovalRequestId(externalId);
-		const pending = await this._requirePending(internalId, externalId);
-		this._requireUnchanged(pending, prepared.pending);
-		const decision = await this._grantDecision(prepared);
-		const result = await this._client.decide(internalId, decision);
-		if (result === "gone") throw new Error(`approval request '${externalId}' is no longer pending`);
-		if (decision.status !== "granted") throw new Error(`approval request '${externalId}' could not be granted` + (decision.reason !== void 0 ? `: ${decision.reason}` : ""));
-		return result;
-	}
-	async runInteractive(signal, prompt) {
-		await this._currentRequests();
-		const approver = runManifestApprover({
-			manifest: this._manifest,
-			issuer: this._issuer,
-			ownPrincipalId: this._principalId,
-			...this._fetchDirectory !== void 0 ? { fetchDirectory: this._fetchDirectory } : {},
-			...prompt !== void 0 ? { prompt } : {},
-			log: this._log
-		});
-		try {
-			await waitForAbort(signal);
-		} finally {
-			approver.dispose();
-		}
-	}
-	dispose() {
-		if (this._disposed) return;
-		this._disposed = true;
-		this._client.dispose();
-		this._disposeExtra?.();
-	}
-	async _currentRequests() {
-		await this._client.refresh();
-		if (this._client.state.get() === "stale") throw new Error(this._lastClientError ?? "could not read pending approval requests");
-		return this._client.requests.get();
-	}
-	_toPendingRequests(requests) {
-		return requests.map(({ id, request, revision }) => {
-			const sourceServiceId = approvalRequestSource(id);
-			return {
-				id: encodeApprovalRequestId(id),
-				request,
-				revision,
-				...sourceServiceId === void 0 ? {} : { sourceServiceId }
-			};
-		}).sort((a, b) => a.id.localeCompare(b.id));
-	}
-	async _requirePending(internalId, externalId) {
-		const pending = (await this._currentRequests()).find((request) => request.id === internalId);
-		if (!pending) throw new Error(`approval request '${externalId}' is not pending for principal '${this._principalId}'`);
-		return pending;
-	}
-	_requireUnchanged(actual, expected) {
-		if (jcsCanonicalize(actual.request) !== jcsCanonicalize(expected.request)) throw new Error(`approval request '${expected.id}' changed after it was reviewed; review it again`);
-	}
-	async _resolveRequest(request) {
-		let permissions;
-		let resolvedSlot;
-		if (request.kind === "direct") permissions = request.permissions;
-		else {
-			if (this._fetchDirectory === void 0) return { denied: "no directory available to resolve discover candidates" };
-			const slot = {
-				interfaces: request.interfaces.map((item) => ({
-					id: item.id,
-					required: item.required !== false,
-					...item.hash !== void 0 ? { hash: item.hash } : {}
-				})),
-				members: request.members.map((item) => ({
-					interfaceId: item.interfaceId,
-					member: item.member,
-					required: item.required !== false
-				}))
-			};
-			const candidate = candidatesForSlot(slot, await this._fetchDirectory())[0];
-			if (!candidate) return { denied: "no candidate service satisfies the requested interfaces" };
-			const present = new Set(candidate.satisfiedInterfaces.map((item) => item.id));
-			permissions = buildSlotPermissions(candidate.serviceId, slot.interfaces, slot.members, present);
-			resolvedSlot = {
-				serviceId: candidate.serviceId,
-				satisfiedInterfaces: candidate.satisfiedInterfaces.map((item) => item.id)
-			};
-		}
-		return {
-			permissions,
-			...resolvedSlot === void 0 ? {} : { resolvedSlot }
-		};
-	}
-	async _grantDecision(prepared) {
-		const request = prepared.pending.request;
-		const capability = await this._issuer.mint({
-			audience: request.consumer.principal,
-			permissions: prepared.permissions,
-			expiresAtMs: durationToExp(request.duration)
-		});
-		return {
-			status: "granted",
-			granted: prepared.resolvedSlot === void 0 ? {
-				kind: "direct",
-				capabilities: [capability]
-			} : {
-				kind: "discover",
-				serviceId: prepared.resolvedSlot.serviceId,
-				satisfiedInterfaces: [...prepared.resolvedSlot.satisfiedInterfaces],
-				capabilities: [capability]
-			}
-		};
-	}
-};
-/**
-* Discover every manifest in the connected hub and expose it through one
-* validated, namespaced aggregate. This is the same discovery/validation path
-* used by the hub's approval UI.
-*/
-function createHubApprovalCommandClient(connection, identity, log) {
-	const explorer = new HubDirectoryExplorer(connection.channel);
-	const sourceCache = /* @__PURE__ */ new Map();
-	let directoryChanged;
-	const watchStarted = explorer.watch(() => directoryChanged?.());
-	const fetchDirectory = async () => {
-		await watchStarted;
-		return explorer.result.listings.map((entry) => ({
-			serviceId: entry.serviceId,
-			interfaceId: entry.interfaceId,
-			hash: entry.hash,
-			...entry.serviceDescription === void 0 ? {} : { serviceDescription: entry.serviceDescription },
-			...entry.rootPrincipalSets === void 0 ? {} : { rootPrincipalSets: entry.rootPrincipalSets }
-		}));
-	};
-	const resolveSources = async () => {
-		const directory = await fetchDirectory();
-		const serviceIds = [...new Set(directory.filter((entry) => entry.interfaceId === MANIFEST_INTERFACE_ID).map((entry) => entry.serviceId))].sort();
-		log?.(`approval: discovered ${serviceIds.length} manifest source${serviceIds.length === 1 ? "" : "s"}${serviceIds.length > 0 ? `: ${serviceIds.join(", ")}` : ""}`);
-		const active = new Set(serviceIds);
-		for (const serviceId of sourceCache.keys()) if (!active.has(serviceId)) sourceCache.delete(serviceId);
-		return serviceIds.map((serviceId) => {
-			const cached = sourceCache.get(serviceId);
-			if (cached !== void 0) return cached;
-			const source = {
-				tag: serviceId,
-				manifest: withApprovalSourceLogging(serviceId === "" ? connection.get(hubAccessManifestInterface) : connection.service(serviceId).get(hubAccessManifestInterface), serviceId, log),
-				preserveOrigin: false
-			};
-			sourceCache.set(serviceId, source);
-			return source;
-		});
-	};
-	const aggregate = new AggregatingHubAccessManifest({
-		resolveSources,
-		watchSources: (onChange) => {
-			directoryChanged = onChange;
-			return () => {
-				if (directoryChanged === onChange) directoryChanged = void 0;
-			};
-		},
-		log
+function createHubApprovalCommandClient(...args) {
+	const client = createHubApprovalClient(...args);
+	const runInteractive = client.runInteractive.bind(client);
+	return Object.assign(client, {
+		watch: (listener) => autorun((reader) => listener(client.snapshot.read(reader))),
+		runInteractive: (signal, prompt = createTerminalConsentPrompt()) => runInteractive(signal, prompt)
 	});
-	const pair = new TransportPair();
-	const aggregateServer = LinkRpcConnection.fromTransport(pair.a);
-	const aggregateClient = LinkRpcConnection.fromTransport(pair.b);
-	registerAggregatingManifest(aggregateServer, aggregate, { serviceId: AGGREGATE_SERVICE_ID });
-	return new ApprovalCommandClient({
-		manifest: aggregateClient.service(AGGREGATE_SERVICE_ID).get(hubAccessManifestInterface),
-		identity,
-		fetchDirectory,
-		log,
-		dispose: () => {
-			aggregate.dispose();
-			watchStarted.then((stop) => stop(), () => void 0);
-			explorer.dispose();
-			aggregateClient.close();
-			aggregateServer.close();
-		}
-	});
-}
-function withApprovalSourceLogging(manifest, serviceId, log) {
-	if (!log) return manifest;
-	const getDesired = manifest.getDesired.bind(manifest);
-	return new Proxy(manifest, { get: (target, property, receiver) => {
-		if (property !== "getDesired") return Reflect.get(target, property, receiver);
-		return async (...args) => {
-			const result = await getDesired(...args);
-			const count = Object.keys(result.requested).length;
-			log(`approval: source '${serviceId || "<root>"}' has ${count} pending request` + (count === 1 ? "" : "s"));
-			return result;
-		};
-	} });
-}
-function encodeApprovalRequestId(internalId) {
-	if (internalId.length === 0) throw new Error("cannot encode an empty approval request id");
-	return `${EXTERNAL_ID_PREFIX}${Buffer.from(internalId, "utf8").toString("base64url")}`;
-}
-function decodeApprovalRequestId(externalId) {
-	if (!new RegExp(`^${EXTERNAL_ID_PREFIX}[A-Za-z0-9_-]+$`).test(externalId)) throw new Error(`invalid approval request id '${externalId}'`);
-	const encoded = externalId.slice(4);
-	const decoded = Buffer.from(encoded, "base64url").toString("utf8");
-	if (decoded.length === 0 || encodeApprovalRequestId(decoded) !== externalId) throw new Error(`invalid approval request id '${externalId}'`);
-	return decoded;
-}
-function approvalRequestSource(internalId) {
-	const separator = internalId.indexOf("\0");
-	return separator < 0 ? void 0 : internalId.slice(0, separator);
 }
 function formatApprovalRequests(requests, principalId, json = false) {
 	if (json) return formatJson({
@@ -3321,10 +2994,6 @@ function formatApprovalDecision(action, id, principalId, json = false, outcome =
 	});
 	return outcome === "applied" ? `${action === "approved" ? "Approved" : "Denied"} ${id}.` : `${action === "approved" ? "Approval" : "Denial"} decision accepted for ${id}, but a matching request is still pending; the consumer may have retried.`;
 }
-function waitForAbort(signal) {
-	if (signal.aborted) return Promise.resolve();
-	return new Promise((resolve) => signal.addEventListener("abort", () => resolve(), { once: true }));
-}
 //#endregion
 //#region src/commands/identity.ts
 function cliIdentity(session) {
@@ -7250,7 +6919,7 @@ Batch options:
 				process.once("SIGINT", onSignal);
 				process.once("SIGTERM", onSignal);
 				try {
-					const { runApprovalUi } = await import("./runApprovalUi-Kt6FnH9y.js");
+					const { runApprovalUi } = await import("./runApprovalUi-eLDf_5ZN.js");
 					await runApprovalUi({
 						client,
 						signal: stop.signal
@@ -7265,7 +6934,7 @@ Batch options:
 	registerViewCommands(program, (action) => withChannel(endpoint, getPrincipalSpec(), action));
 	program.command("ui").description("Launch the terminal UI (form-based browser of services + methods).").action(async () => {
 		const acquired = await acquireConnection(endpoint);
-		const { runUi } = await import("./runUi-DD7DYroJ.js");
+		const { runUi } = await import("./runUi-DF_HTMk9.js");
 		try {
 			await runUi({
 				endpoint: acquired.ep,
@@ -7531,8 +7200,8 @@ async function withResolvedSigning(endpoint, principalSpec, fn) {
 async function withApprovalClient(endpoint, principalSpec, fn, log = (line) => process.stderr.write(`linkrpc: ${line}\n`)) {
 	await withResolvedSigning(endpoint, principalSpec, async (conn, session) => {
 		reportIdentity(session);
-		await bootstrapApprovalCommandCapability(session.principal);
-		const client = createHubApprovalCommandClient(new LinkRpcConnection(conn.rpcChannel), session.principal.identity, log);
+		await bootstrapApprovalCapability(session.principal);
+		const client = createHubApprovalCommandClient(new LinkRpcConnection(conn.rpcChannel), session.principal.identity, log, () => session.principal.capBag.capabilities, () => bootstrapApprovalCapability(session.principal, log));
 		try {
 			await fn(client);
 		} finally {
@@ -7698,4 +7367,4 @@ function safeJson(value) {
 //#endregion
 export { formatCommandLegend as a, safeTerminalText as c, interfaceTarget as d, matchesTarget as f, dispatchHostKey as i, resolveViewTarget as l, approvalDetailLines as m, views as n, hostCommands as o, targetId as p, ViewFrame as r, matchesKey as s, runCli as t, formatCondition as u };
 
-//# sourceMappingURL=cli-IfKpF0E1.js.map
+//# sourceMappingURL=cli-yDtBqjCT.js.map