@hediet/linkrpc-cli 0.0.3-next.20261008.2 → 0.0.3-next.20261021.2

package/dist/chunks/{cli-JE4URhh3.js → cli-CO0iSiY_.js}

@@ -1,7 +1,7 @@
-import { A as fetchSchema$1, B as resolveTargetEndpoint, D as requestTopologyAccess, E as requestReflectionAccess, F as formatPrincipalSource, G as validateValueAgainstSchema, H as describeObjectParams, I as parsePrincipalSpec, L as connect, M as walkHub, O as setupSigning, P as logoutCliIdentity, R as connectViaRootOverlay, U as describeSchema, V as resolvedEndpointToConfig, W as explainValidation, X as mcpForwardInterface, Y as MethodRefWithOptHash, _ as parseConnectionLimit, a as resolveInvocationContext, c as ContextStore, d as getBrokerStatus, f as readBrokerNotifications, g as withStaticHubReflection, h as tunnelCommand, i as mutationReference, j as findMethodInSchema, k as fetchDefaults, l as formatContextReference, m as ConnectionBroker, n as loadStaticHubSchema, o as resolveInvocationEndpoint, p as stopConnectionBroker, q as mergeParams, r as resolveStaticHubSchemaSource, s as validationDefault, t as completeForLine, u as disconnectBroker, v as parseConnectionLimitMilliseconds, x as resolveCliInvocation, y as parseDuration, z as connectViaTransport } from "./runComplete-DvUneaDU.js";
-import { a as derived, i as autorun, r as observableValue } from "./dist-BOcSU4-O.js";
-import { ErrorCode, INTERFACE_TEMPLATES_EXTENSION, LinkRpcConnection, RpcError, computeInterfaceHash, connectTransports, createSchemaToZod, exportStaticHubSchema, generateTsContract, generateTsInterface, interfaceTemplateArgumentsEquivalent, interfaceTemplateMemberName, isAssignable, jcsCanonicalize } from "@hediet/linkrpc";
-import { WebSocketTransport, connectNdjson, formatEndpointUri, isHubEndpoint, openWebSocket, parseEndpointUri, runInitializeHandshake, traceMessageTransport as traceMessageTransport$1 } from "@hediet/linkrpc/node";
+import { $ as setupSigning, B as tunnelCommand, F as disconnectBroker, H as parseConnectionLimit, I as getBrokerStatus, K as resolveCliInvocation, L as readBrokerNotifications, M as readEndpointDiscovery, N as ContextStore, P as formatContextReference, Q as requestTopologyAccess, R as stopConnectionBroker, U as parseConnectionLimitMilliseconds, V as withStaticHubReflection, W as parseDuration, Z as requestReflectionAccess, a as resolveInvocationEndpoint, at as logoutCliIdentity, bt as MethodRefWithOptHash, c as resolveLocalEndpoint, ct as connect, dt as resolveTargetEndpoint, et as fetchDefaults, ft as resolvedEndpointToConfig, gt as validateValueAgainstSchema, ht as explainValidation, i as resolveInvocationContext, lt as connectViaRootOverlay, m as managedEndpointsInterface, mt as describeSchema, n as loadStaticHubSchema, nt as findMethodInSchema, o as resolveSigning, ot as formatPrincipalSource, pt as describeObjectParams, r as resolveStaticHubSchemaSource, rt as walkHub, s as validationDefault, st as parsePrincipalSpec, t as completeForLine, tt as fetchSchema$1, ut as connectViaTransport, vt as mergeParams, xt as mcpForwardInterface, y as HubHome, yt as parseParamOverride, z as ConnectionBroker } from "./runComplete-B3b-UhnA.js";
+import { ErrorCode, INTERFACE_TEMPLATES_EXTENSION, LinkRpcConnection, RpcError, computeInterfaceHash, connectTransports, createSchemaToZod, directoryInterface, exportStaticHubSchema, generateTsContract, generateTsInterface, interfaceTemplateArgumentsEquivalent, interfaceTemplateMemberName, interfaceTemplatesEqual, isAssignable, jcsCanonicalize, matchParams, schemaToZod, validateInterfaceTemplates } from "@hediet/linkrpc";
+import { z } from "zod";
+import { WebSocketTransport, connectNdjson, connectToHub, formatEndpointUri, isHubEndpoint, openWebSocket, parseEndpointUri, runInitializeHandshake, traceMessageTransport as traceMessageTransport$1 } from "@hediet/linkrpc/node";
 import { SocketServer } from "@hediet/linkrpc-hub/hub/server/node";
 import { randomBytes, randomUUID } from "node:crypto";
 import * as fs from "node:fs";
@@ -11,241 +11,1222 @@ import { spawnCommand } from "@hediet/linkrpc-hub/spawn";
 import { tapTransport } from "@hediet/linkrpc-hub/hub/server/transit";
 import * as net from "node:net";
 import { mkdir, open, readFile, writeFile } from "node:fs/promises";
-import { DEFAULT_WALK_DEPTH, HubDirectoryExplorer, fetchSchema, hubGrantedServiceIdInterface } from "@hediet/linkrpc/hub/common";
-import { Command, InvalidArgumentError } from "commander";
+import { DEFAULT_WALK_DEPTH, HubDirectoryExplorer, fetchSchema, findCoveringCapabilities, hubGrantedServiceIdInterface } from "@hediet/linkrpc/hub/common";
+import { CONSOLE_INTERFACE_TAG, ConsoleTemplate, consoleAttachResultSchema, consoleServerMessageSchema, decodeConsoleData, encodeConsoleData } from "@hediet/linkrpc-infra/console";
+import { Command, InvalidArgumentError, Option } from "commander";
+import * as readline from "node:readline";
+import { createInterface, emitKeypressEvents } from "node:readline";
+import { parse, unknown } from "zod/mini";
 import { bootstrapApprovalCapability, createHubApprovalClient } from "@hediet/linkrpc-infra/approval";
 import { connectionTokenBinderInterface } from "@hediet/linkrpc-hub/hub/server/connection-token-binder";
 import { spawn } from "node:child_process";
 import { TopologyClient, TopologyNetworkClient, TrafficClient } from "@hediet/linkrpc-infra/inspection";
-import { createInterface } from "node:readline/promises";
+import { createInterface as createInterface$1 } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
 import { TrafficFlowAggregator, createTerminalConsentPrompt, formatFlowSummary } from "@hediet/linkrpc-hub";
 import { loadHubConfig, printHubConfigSchema } from "@hediet/linkrpc-hub/config-file";
-import * as readline from "node:readline";
-import { emitKeypressEvents } from "node:readline";
 import { connectJsonRpcTransports, connectRawJsonRpcTransport, createNdjsonJsonRpcTransport, jsonRpcConnectionInterface } from "@hediet/linkrpc-infra/json-rpc";
 import { GRAPH_INTERFACE_TAG, IMMUTABLE_GRAPH_INTERFACE_ID, ROOT_WATCH_INTERFACE_ID, evaluateGraphPresentation, graphPresentationInterface, graphPresentationSchema, isGraphRef, standardGraphRuntimeOptions, validateGraphInterfaceSchema } from "@hediet/linkrpc-infra/graph";
 import React from "react";
 import { Box, Text, measureElement, render } from "ink";
 import { jsx, jsxs } from "react/jsx-runtime";
-import { parse } from "zod/mini";
 import { applyJsonDocumentEdits, logDocumentSchema, logStreamEventSchema, loggingInterface } from "@hediet/linkrpc-infra";
 import { topologyInterface, zTopologyGraph } from "@hediet/linkrpc/inspection";
 import { renderMermaidASCII } from "beautiful-mermaid";
-//#region src/output.ts
-/**
-* Read params either from a `--params <json>` argument (treated as inline
-* JSON) or `--params -` (read from stdin). `undefined` if neither was given.
-*/
-function readParamsArg(value) {
-	if (value === void 0) return void 0;
-	const trimmed = (value === "-" ? readFileSync(0, "utf8") : value).trim();
-	if (trimmed.length === 0) return void 0;
-	try {
-		return JSON.parse(trimmed);
-	} catch (e) {
-		throw new Error(`--params: invalid JSON (${e.message})`);
+//#region src/commands/serviceConsoleInput.ts
+var ServiceConsoleInput = class {
+	_input;
+	_send;
+	_interrupt;
+	_close;
+	_readline;
+	_wasRaw;
+	constructor(_input, output, _send, _interrupt, _close) {
+		this._input = _input;
+		this._send = _send;
+		this._interrupt = _interrupt;
+		this._close = _close;
+		this._wasRaw = _input.isRaw ?? false;
+		if (_input.isTTY) {
+			this._readline = createInterface({
+				input: _input,
+				output,
+				terminal: true,
+				prompt: "",
+				historySize: 0
+			});
+			this._readline.on("line", this._onLine);
+			this._readline.on("SIGINT", _interrupt);
+			this._readline.on("close", _close);
+			_input.on("keypress", this._onKeypress);
+		} else {
+			_input.on("data", this._onData);
+			_input.resume();
+		}
 	}
-}
-function formatJson(v) {
-	if (v === void 0) return "undefined";
-	return JSON.stringify(v, null, 2);
-}
+	dispose() {
+		if (this._readline) {
+			this._readline.removeListener("line", this._onLine);
+			this._readline.removeListener("SIGINT", this._interrupt);
+			this._readline.removeListener("close", this._close);
+			this._readline.close();
+			this._input.removeListener("keypress", this._onKeypress);
+			this._input.setRawMode?.(this._wasRaw);
+		} else this._input.removeListener("data", this._onData);
+		this._input.pause();
+		this._input.unref?.();
+	}
+	_onLine = (line) => {
+		this._send(line + "\n");
+	};
+	_onKeypress = (_text, key) => {
+		if (key.sequence === "") this._close();
+	};
+	_onData = (data) => {
+		if (data.includes(29)) this._close();
+		else this._send(data.toString("utf8"));
+	};
+};
 //#endregion
-//#region src/suggest.ts
-const _SYSTEM_PREFIX = "hubrpc.";
-function _isSystemInterface(id) {
-	return id.startsWith(_SYSTEM_PREFIX);
+//#region src/commands/consoleSession.ts
+/**
+* Drive a `linkrpc.console` attachment (or a stream embedding its protocol):
+* render output, and configure local input from the console's mode. TTY
+* consoles get raw keystrokes, so detaching uses a key sequence (see
+* {@link DetachKeys}); pipe consoles get local line editing, and Ctrl+D on an
+* empty line detaches.
+*/
+async function runConsoleSession(start, options, onExtra) {
+	return new ConsoleSession(options, onExtra).run(start);
 }
-function _isUserInterface(id) {
-	return !_isSystemInterface(id);
+/** Local terminal size, sent so that TTY consoles match this terminal. */
+function localTerminalSize() {
+	const { columns, rows } = process.stdout;
+	return process.stdout.isTTY && columns > 0 && rows > 0 ? {
+		cols: columns,
+		rows
+	} : void 0;
 }
 /**
-* Indexed view of the bus's directory + per-interface methods. Constructed
-* directly from a list of entries (tests) or by walking a live channel
-* (`HubSnapshot.load`). Read-only after construction.
+* A detach key sequence in Docker's `--detach-keys` syntax: comma-separated
+* keys, each a single character or `ctrl-<key>` with `<key>` in `a`-`z`, `@`,
+* `[`, `\`, `]`, `^`, or `_`. For example `ctrl-b,d` or `ctrl-p,ctrl-q`.
 */
-var HubSnapshot = class HubSnapshot {
-	entries;
-	_byService = /* @__PURE__ */ new Map();
-	_byInterface = /* @__PURE__ */ new Map();
-	_byMethodName = /* @__PURE__ */ new Map();
-	constructor(entries) {
-		this.entries = entries;
-		for (const e of entries) {
-			let byIface = this._byService.get(e.serviceId);
-			if (!byIface) {
-				byIface = /* @__PURE__ */ new Map();
-				this._byService.set(e.serviceId, byIface);
-			}
-			byIface.set(e.interfaceId, e);
-			const hosts = this._byInterface.get(e.interfaceId) ?? [];
-			if (!hosts.includes(e.serviceId)) hosts.push(e.serviceId);
-			this._byInterface.set(e.interfaceId, hosts);
-			for (const m of e.methods) {
-				const locs = this._byMethodName.get(m) ?? [];
-				locs.push({
-					serviceId: e.serviceId,
-					interfaceId: e.interfaceId
-				});
-				this._byMethodName.set(m, locs);
-			}
-		}
-	}
-	/** All serviceIds present on the bus, in encounter order ("" = root). */
-	services() {
-		return [...this._byService.keys()];
-	}
-	/** All distinct interface ids (system + user), in encounter order. */
-	interfaces() {
-		return [...this._byInterface.keys()];
-	}
-	interfacesOnService(serviceId) {
-		const m = this._byService.get(serviceId);
-		return m ? [...m.keys()] : [];
-	}
-	servicesHostingInterface(interfaceId) {
-		return this._byInterface.get(interfaceId) ?? [];
-	}
-	methodsOn(serviceId, interfaceId) {
-		return this._byService.get(serviceId)?.get(interfaceId)?.methods ?? [];
+var DetachKeys = class DetachKeys {
+	spec;
+	bytes;
+	constructor(spec, bytes) {
+		this.spec = spec;
+		this.bytes = bytes;
+	}
+	static parse(spec) {
+		const bytes = spec.split(",").map((part) => {
+			const key = part.trim();
+			const ctrl = /^ctrl-(.)$/i.exec(key);
+			if (ctrl) {
+				const index = "@abcdefghijklmnopqrstuvwxyz[\\]^_".indexOf(ctrl[1].toLowerCase());
+				if (index >= 0) return index;
+			} else if (key.length === 1 && key.charCodeAt(0) >= 32 && key.charCodeAt(0) < 127) return key.charCodeAt(0);
+			throw new Error(`Invalid detach key "${key}" in "${spec}": use a character or ctrl-<a-z, @, [, \\, ], ^, _>, separated by commas`);
+		});
+		if (bytes.length === 0) throw new Error("The detach key sequence is empty");
+		return new DetachKeys(spec, Uint8Array.from(bytes));
 	}
-	locationsOfMethod(name) {
-		return this._byMethodName.get(name) ?? [];
+	/** Human-readable form, e.g. `Ctrl+B, then d`. */
+	get label() {
+		return [...this.bytes].map((byte) => byte < 32 ? `Ctrl+${String.fromCharCode(byte + 64)}` : String.fromCharCode(byte)).join(", then ");
 	}
-	/**
-	* Walk the live bus once and fetch the schema for every (service, interface)
-	* pair in parallel. Failures on individual schema fetches are absorbed —
-	* the affected entry just ends up with `methods: []`, so it still
-	* participates in service/interface-level suggestions.
-	*/
-	static async load(channel) {
-		const listings = await walkHub(channel);
-		const entries = await Promise.all(listings.map(async (l) => {
-			try {
-				const schema = await fetchSchema$1(channel, l.interfaceId, l.hash, l.serviceId || void 0);
-				return {
-					serviceId: l.serviceId,
-					interfaceId: l.interfaceId,
-					hash: l.hash,
-					methods: Object.keys(schema.methods)
-				};
-			} catch {
+};
+/** Ctrl+B, then d (tmux's binding): unlike Docker's Ctrl+P, Ctrl+Q, it reaches programs in VS Code's terminal. */
+const DEFAULT_DETACH_KEYS = DetachKeys.parse("ctrl-b,d");
+/**
+* Recognizes a detach sequence in raw keyboard input. Bytes of a partial match
+* are held back, and forwarded unchanged when the sequence does not complete.
+*/
+var DetachKeyFilter = class {
+	_keys;
+	_matched = 0;
+	constructor(_keys = DEFAULT_DETACH_KEYS) {
+		this._keys = _keys;
+	}
+	push(chunk) {
+		const sequence = this._keys.bytes;
+		const forward = [];
+		for (const byte of chunk) {
+			const pending = [...sequence.subarray(0, this._matched), byte];
+			let start = 0;
+			while (start < pending.length && !pending.slice(start).every((value, index) => value === sequence[index])) start++;
+			forward.push(...pending.slice(0, start));
+			this._matched = pending.length - start;
+			if (this._matched === sequence.length) {
+				this._matched = 0;
 				return {
-					serviceId: l.serviceId,
-					interfaceId: l.interfaceId,
-					hash: l.hash,
-					methods: []
+					forward: Uint8Array.from(forward),
+					detach: true
 				};
 			}
-		}));
-		return new HubSnapshot(entries);
+		}
+		return {
+			forward: Uint8Array.from(forward),
+			detach: false
+		};
 	}
 };
-/**
-* Compose a multi-line "Did you mean…" message tailored to the failed ref.
-* The returned string has no trailing newline and no `linkrpc:` prefix (the
-* outer error path adds those).
-*/
-function formatSuggestion(input) {
-	const ctx = {
-		ref: input.ref,
-		snapshot: input.snapshot,
-		verb: input.verb,
-		tool: input.tool ?? "hub"
-	};
-	if (ctx.ref.serviceId !== void 0 && ctx.ref.interfaceId !== void 0) return _suggestForm3(ctx);
-	if (ctx.ref.interfaceId !== void 0) return _suggestForm2(ctx);
-	return _suggestForm1(ctx);
-}
-function _qualify(ctx, s, i, m) {
-	return `${ctx.tool} ${ctx.verb} ${s}::${i}::${m}`;
-}
-function _suggestForm1(ctx) {
-	const { ref, snapshot } = ctx;
-	const token = ref.methodName;
-	if (token !== "" && snapshot.services().includes(token)) {
-		const samples = _sampleCallsForService(ctx, token, 3);
-		const lines = [`"${token}" is a serviceId, not a method.`];
-		lines.push("  See its interfaces:");
-		lines.push(`    ${ctx.tool} ls --service ${token}`);
-		if (samples.length > 0) {
-			lines.push("  Or call one:");
-			for (const s of samples) lines.push(`    ${s}`);
+const ALTERNATE_SCREEN = /\x1b\[\?(?:1049|1047|47)([hl])/g;
+/** Undo terminal modes a program may have enabled: mouse, bracketed paste, focus, win32-input, hidden cursor. */
+const TERMINAL_RESET = "\x1B[0m\x1B[?25h\x1B[?1000l\x1B[?1002l\x1B[?1003l\x1B[?1006l\x1B[?2004l\x1B[?1004l\x1B[?9001l";
+var ConsoleSession = class {
+	_options;
+	_onExtra;
+	_call;
+	_detachKeys;
+	_mode;
+	_signals = [];
+	_input;
+	_raw = false;
+	_alternateScreen = false;
+	_closedLocally = false;
+	constructor(_options, _onExtra) {
+		this._options = _options;
+		this._onExtra = _onExtra;
+		this._detachKeys = _options.detachKeys ?? DEFAULT_DETACH_KEYS;
+	}
+	async run(start) {
+		const onSignal = () => this._interrupt();
+		const onTerminate = () => this.close();
+		process.on("SIGINT", onSignal);
+		process.on("SIGTERM", onTerminate);
+		this._options.signal?.addEventListener("abort", onTerminate);
+		try {
+			this._call = start((message) => this._onMessage(message));
+			if (this._closedLocally || this._options.signal?.aborted) this.close();
+			let exit = null;
+			try {
+				exit = (await this._call).exit;
+			} catch (error) {
+				if (!this._closedLocally) throw error;
+			}
+			return {
+				exit,
+				closedLocally: this._closedLocally
+			};
+		} finally {
+			process.removeListener("SIGINT", onSignal);
+			process.removeListener("SIGTERM", onTerminate);
+			this._options.signal?.removeEventListener("abort", onTerminate);
+			this._input?.dispose();
+			if (this._raw) process.stdout.write(TERMINAL_RESET + (this._alternateScreen ? "\x1B[?1049l" : "") + "\r\n");
+			if (this._closedLocally && this._options.interactive && !this._options.owner && this._options.reattachCommand) process.stderr.write(`Detached. Reattach: ${this._options.reattachCommand}\n`);
 		}
-		return lines.join("\n");
 	}
-	if (snapshot.interfaces().includes(token) && _isUserInterface(token)) {
-		const hosts = snapshot.servicesHostingInterface(token).filter((s) => s !== "");
-		const samples = _sampleCallsForInterface(ctx, token, 3);
-		const lines = [`"${token}" is an interface, not a method. It's hosted on services: ${hosts.join(", ")}.`];
-		if (samples.length > 0) {
-			lines.push("  Try a call:");
-			for (const s of samples) lines.push(`    ${s}`);
+	close() {
+		this._closedLocally = true;
+		try {
+			Promise.resolve(this._call?.cancel()).catch(() => {});
+		} catch {}
+	}
+	_onMessage(message) {
+		const console = message;
+		switch (console.t) {
+			case "console":
+				this._mode = console.mode;
+				this._signals = console.signals;
+				this._startInput();
+				return;
+			case "screen": {
+				const screen = decodeConsoleData(console.data);
+				if (screen.length > 0 && process.stdout.isTTY) process.stdout.write("\x1B[H\x1B[2J");
+				this._write(process.stdout, screen);
+				return;
+			}
+			case "output":
+				this._write(console.stream === "stderr" ? process.stderr : process.stdout, decodeConsoleData(console.data));
+				return;
+			case "notice":
+				process.stderr.write(this._mode === "tty" ? `\r\n[console] ${console.text}\r\n` : `${console.text}\n`);
+				return;
+			case "live":
+				if (this._options.untilLive) this.close();
+				return;
+			case "started":
+			case "exit":
+			case "resized": return;
 		}
-		return lines.join("\n");
+		this._onExtra?.(message);
+	}
+	_write(stream, data) {
+		if (this._mode === "tty") for (const match of new TextDecoder().decode(data).matchAll(ALTERNATE_SCREEN)) this._alternateScreen = match[1] === "h";
+		stream.write(data);
+	}
+	_startInput() {
+		if (!this._options.interactive || this._input) return;
+		const owner = this._options.owner;
+		const reattach = this._options.reattachCommand;
+		if (this._mode === "tty") process.stderr.write(owner ? `Foreground (TTY). Keys go to the program; ${this._detachKeys.label} stops and removes the service.\n` : `Attached (TTY). Keys go to the program; ${this._detachKeys.label} detaches.\n`);
+		else {
+			const interrupt = owner ? "Ctrl+C or " : this._signals.includes("SIGINT") ? "Ctrl+C interrupts; " : "";
+			process.stderr.write(owner ? `Foreground (pipe console). ${interrupt}Ctrl+D on an empty line stops and removes the service.\n` : `Attached (pipe console). ${interrupt}Ctrl+D on an empty line detaches.\n`);
+		}
+		if (reattach) process.stderr.write(`${owner ? "Attach from another terminal while running" : "Reattach"}: ${reattach}\n`);
+		this._input = this._mode === "tty" ? this._startTerminalInput() : this._startLineInput();
+	}
+	_startTerminalInput() {
+		const stdin = process.stdin;
+		const filter = stdin.isTTY ? new DetachKeyFilter(this._detachKeys) : void 0;
+		const wasRaw = stdin.isRaw;
+		if (stdin.isTTY) {
+			stdin.setRawMode(true);
+			this._raw = true;
+		}
+		const onData = (chunk) => {
+			const { forward, detach } = filter ? filter.push(chunk) : {
+				forward: chunk,
+				detach: false
+			};
+			if (forward.length > 0) this._send({
+				t: "input",
+				data: encodeConsoleData(forward)
+			});
+			if (detach) this.close();
+		};
+		const onResize = () => {
+			const size = localTerminalSize();
+			if (size) this._send({
+				t: "resize",
+				...size
+			});
+		};
+		stdin.on("data", onData);
+		stdin.resume();
+		process.stdout.on("resize", onResize);
+		return { dispose: () => {
+			stdin.removeListener("data", onData);
+			process.stdout.removeListener("resize", onResize);
+			if (stdin.isTTY) stdin.setRawMode(wasRaw);
+			stdin.pause();
+			stdin.unref?.();
+		} };
+	}
+	_startLineInput() {
+		return new ServiceConsoleInput(process.stdin, process.stderr, (data) => this._send({
+			t: "input",
+			data: encodeConsoleData(new TextEncoder().encode(data))
+		}), () => this._interrupt(), () => this.close());
+	}
+	_interrupt() {
+		if (this._options.owner || !this._options.interactive) this.close();
+		else if (this._mode === "tty") this._send({
+			t: "input",
+			data: encodeConsoleData(Uint8Array.of(3))
+		});
+		else if (this._signals.includes("SIGINT")) this._send({
+			t: "signal",
+			signal: "SIGINT"
+		});
+		else process.stderr.write("Interrupting is not supported for pipe processes on this host; run with -t for a terminal. Ctrl+D on an empty line detaches.\n");
 	}
-	const locs = snapshot.locationsOfMethod(token).filter((l) => _isUserInterface(l.interfaceId));
-	if (locs.length > 0) {
-		const lines = [`"${token}" is not callable without an interface (no preset is set).`];
-		lines.push("  Did you mean:");
-		for (const l of locs.slice(0, 5)) lines.push(`    ${_qualify(ctx, l.serviceId, l.interfaceId, token)}`);
-		return lines.join("\n");
+	_send(message) {
+		try {
+			Promise.resolve(this._call?.send(message)).catch(() => {});
+		} catch {}
 	}
-	return _suggestForm1Fuzzy(ctx);
+};
+//#endregion
+//#region src/commands/services.ts
+function withDetachKeys(host) {
+	const detachKeys = host.detachKeys();
+	return detachKeys ? { detachKeys } : {};
 }
-function _suggestForm1Fuzzy(ctx) {
-	const { snapshot } = ctx;
-	const token = ctx.ref.methodName;
-	const methodHits = _rankAllMethods(snapshot, token, 3);
-	const ifaceHits = _rankAllInterfaces(snapshot, token, 3);
-	const svcHits = _rankServices(snapshot, token, 3);
-	const lines = [`"${token}" matches no known service, interface, or method.`];
-	if (methodHits.length > 0) {
-		lines.push("  Closest methods:");
-		for (const h of methodHits) lines.push(`    ${_qualify(ctx, h.serviceId, h.interfaceId, h.name)}`);
-	}
-	if (ifaceHits.length > 0) {
-		lines.push("  Closest interfaces:");
-		for (const id of ifaceHits) {
-			const sampleSvc = snapshot.servicesHostingInterface(id).find((s) => s !== "") ?? snapshot.servicesHostingInterface(id)[0];
-			lines.push(`    ${id}  (try ${ctx.tool} ${ctx.verb} ${sampleSvc ?? ""}::${id}::<method>)`);
+function serviceAttachCommand(options, platform = process.platform) {
+	const args = [
+		"hub",
+		"services",
+		"attach",
+		"--id",
+		options.id,
+		"--context",
+		options.context,
+		"--namespace",
+		options.namespace,
+		options.useEnv ? "--use-env" : "--no-use-env"
+	];
+	for (const key of Object.keys(options.overrides)) {
+		if (key === "namespace") continue;
+		const value = options.overrides[key];
+		if (value === void 0) continue;
+		const flag = "--" + key.replace(/[A-Z]/g, (letter) => "-" + letter.toLowerCase());
+		if (key === "endpointCmdEnv" && typeof value === "object") for (const name of Object.keys(value)) args.push(flag, `${name}=<same value>`);
+		else if (typeof value === "boolean") {
+			if (value) args.push(flag);
+			else if (key === "sign") args.push("--no-sign");
+		} else if (typeof value === "string" || typeof value === "number") args.push(flag, key === "endpointToken" ? "<same endpoint token>" : String(value).replace(/([?&]token=)[^&]+/g, "$1<same token>"));
+	}
+	return args.map((arg) => /^[A-Za-z0-9_./:-]+$/.test(arg) ? arg : "'" + arg.replace(/'/g, platform === "win32" ? "''" : "'\\''") + "'").join(" ");
+}
+const requiredInterfaces = [{
+	id: managedEndpointsInterface.info.id,
+	hash: managedEndpointsInterface.schemaHash
+}];
+async function checkDaemonInterfaces(connection, serviceId) {
+	const recovery = serviceId === void 0 ? "Run `hub services restart` to stop the local daemon via RPC and start this CLI's bundled daemon." : "Update/restart the daemon on its execution host. To replace the default local daemon, run `hub --context :empty --no-use-env services restart`.";
+	for (const required of requiredInterfaces) {
+		let cursor;
+		let supported = false;
+		const hashes = /* @__PURE__ */ new Set();
+		try {
+			do {
+				const page = await connection.get(directoryInterface, { serviceId }).list({
+					interfaceId: required.id,
+					serviceId: serviceId ?? "",
+					cursor
+				});
+				for (const item of page.items) {
+					if (item.interfaceId !== required.id || item.serviceId !== (serviceId ?? "")) continue;
+					hashes.add(item.interfaceHash);
+					supported ||= item.interfaceHash === required.hash;
+				}
+				if (page.truncated) throw new Error("Daemon interface discovery was truncated; compatibility could not be checked.");
+				cursor = page.nextCursor;
+			} while (!supported && cursor !== void 0);
+		} catch (error) {
+			if (!(error instanceof RpcError) || error.code !== ErrorCode.methodNotFound) throw error;
+			throw new Error(`The selected daemon cannot report its interfaces. ${recovery}`, { cause: error });
 		}
+		if (!supported) throw new Error(`The selected daemon does not support required interface ${required.id}@${required.hash} (reported: ${[...hashes].join(", ") || "missing"}). ${recovery}`);
+	}
+}
+function contextNamespace(reference) {
+	switch (reference.kind) {
+		case "path": return process.platform === "win32" ? reference.path.toLowerCase() : reference.path;
+		case "id": return `id:${reference.id}`;
+		case "root": return ":root";
+		case "empty": throw new Error("The :empty context has no namespace. Pass --namespace <name>, or select another context with --context <selector>.");
+	}
+}
+async function useLocalManagement(start, action) {
+	const home = HubHome.resolve();
+	if (start) {
+		const { startDaemon, nodeDaemonLaunch } = await import("./src-ConeU7vr.js");
+		if (await startDaemon({
+			home,
+			launch: nodeDaemonLaunch(home)
+		}) === "started") process.stderr.write("linkrpc: local daemon started.\n");
+	}
+	const discovery = readEndpointDiscovery(home.managementFile);
+	if (!discovery) throw new Error("No endpoint configured through flags, environment, or context, and the local Hub daemon is not running.");
+	const handle = await connectToHub({
+		endpoint: discovery.endpoint,
+		token: discovery.token ?? ""
+	});
+	try {
+		await checkDaemonInterfaces(handle.connection);
+		return await action(handle.connection.get(managedEndpointsInterface), { local: true });
+	} finally {
+		handle.close();
 	}
-	if (svcHits.length > 0) {
-		lines.push("  Closest services:");
-		for (const s of svcHits) lines.push(`    ${s}  (try ${ctx.tool} ls --service ${s})`);
-	}
-	if (methodHits.length === 0 && ifaceHits.length === 0 && svcHits.length === 0) lines.push(`  Tip: run \`${ctx.tool} ls\` to see what's available.`);
-	return lines.join("\n");
 }
-function _suggestForm2(ctx) {
-	const { ref, snapshot } = ctx;
-	const iface = ref.interfaceId;
-	const method = ref.methodName;
-	const hostsOfIface = snapshot.servicesHostingInterface(iface);
-	if (hostsOfIface.length === 0) {
-		if (iface !== "" && snapshot.services().includes(iface)) {
-			const locs = snapshot.locationsOfMethod(method).filter((l) => l.serviceId === iface && _isUserInterface(l.interfaceId));
-			if (locs.length > 0) {
-				const lines = [`Interface "${method}" not found on service "${iface}", but "${method}" is a method name there.`];
-				lines.push("  Did you mean:");
-				for (const l of locs.slice(0, 3)) lines.push(`    ${_qualify(ctx, l.serviceId, l.interfaceId, method)}`);
-				return lines.join("\n");
-			}
-			return _formatInterfaceListOnService(ctx, iface, method);
+async function restartLocalDaemon() {
+	const { startDaemon, stopDaemon, nodeDaemonLaunch } = await import("./src-ConeU7vr.js");
+	const home = HubHome.resolve();
+	process.stderr.write("Restarting the local Hub daemon: clients will disconnect and managed workloads will stop. OS autostart settings are unchanged.\n");
+	await stopDaemon(home);
+	await startDaemon({
+		home,
+		launch: nodeDaemonLaunch(home)
+	});
+	await useLocalManagement(false, async () => {});
+	process.stderr.write("The bundled daemon is running and supports the required interfaces.\n");
+}
+function registerServices(program, host) {
+	const createEndpoint = async (id, action) => {
+		try {
+			await host.use(true, action);
+		} catch (error) {
+			if (error instanceof RpcError && error.message === `Endpoint "${id}" already exists in ${host.namespace()}`) throw new RpcError(`${error.message}\nAttach to it: ${host.attachCommand(id)}\nOr replace it: rerun this command with --force`, error.code, error.data, error.origin, error.hasData);
+			throw error;
 		}
-		const candidates = _rankInterfacesWithMethodBoost(snapshot, iface, method, 3);
-		const lines = [`Interface "${iface}" not found.`];
-		if (candidates.length > 0) {
-			lines.push("  Did you mean:");
-			for (const c of candidates) lines.push(`    ${_qualify(ctx, c.serviceId, c.interfaceId, c.methodToTry)}`);
-		} else lines.push(`  Tip: run \`${ctx.tool} ls\` to see what's available.`);
-		return lines.join("\n");
-	}
-	const fuzzy = _rankMethodsOnInterface(snapshot, iface, method, 3);
-	if (fuzzy.length > 0) {
-		const lines = [`Method "${method}" not found on interface "${iface}"${hostsOfIface.length === 1 ? ` (service: ${hostsOfIface[0]})` : ""}.`];
+	};
+	const services = program.command("services").description("Manage context-scoped endpoints through the selected daemon.").option("--namespace <name>", "managed endpoint namespace (defaults to selected context)");
+	services.command("restart").description("Stop the local daemon via RPC and start the bundled daemon; does not change OS autostart.").action(() => host.restart());
+	const addressed = (command) => command.option("--id <id>", "endpoint name in this context", "main");
+	const policy = (command) => command.option("--persistent", "retain definition across stop and daemon restart").addOption(new Option("--restart <policy>", "restart process or reconnect after failure").choices([
+		"never",
+		"on-failure",
+		"always"
+	]).default("never")).option("--force", "stop and replace an existing endpoint with the same ID, even one owned by another terminal");
+	policy(addressed(services.command("run <command...>").description("Start a process on the daemon; arguments follow --."))).option("--detach", "return after readiness").addOption(new Option("--foreground", "stop and remove the service when this CLI disconnects").conflicts(["detach", "persistent"])).option("-t, --tty", "run in a pseudoterminal; keys go to the program and Ctrl+P, Ctrl+Q detaches").option("-x, --no-rpc", "run a plain stdio process without an RPC connection; ready on spawn").option("--cwd <directory>", "working directory on the execution host").option("--env <key=value...>", "explicit child environment").addOption(new Option("--readiness <mode>", "wait for Hub connection or process spawn (default: connected, or spawned with --no-rpc)").choices(["connected", "spawned"])).action(async (command, options) => {
+		if (!options.rpc && options.readiness === "connected") throw new Error("--no-rpc cannot use --readiness connected; plain processes are ready on spawn.");
+		const namespace = host.namespace();
+		const env = {};
+		for (const value of options.env ?? []) {
+			const index = value.indexOf("=");
+			if (index <= 0) throw new Error("--env requires KEY=value");
+			env[value.slice(0, index)] = value.slice(index + 1);
+		}
+		await createEndpoint(options.id, async (client, context) => {
+			const info = await client.info({});
+			const cwd = options.cwd ?? (context.local ? process.cwd() : void 0);
+			if (!cwd) throw new Error("Remote execution requires --cwd with a path on the execution host.");
+			process.stderr.write(`Execution host: ${info.hostname}\nNamespace: ${namespace}\nEndpoint: ${options.id}\nCommand: ${JSON.stringify(command)}\nWorking directory: ${cwd}\n`);
+			const tty = options.tty === true;
+			const size = tty ? localTerminalSize() : void 0;
+			const detach = new AbortController();
+			let status;
+			let timedOut = false;
+			const timeout = options.detach ? setTimeout(() => {
+				timedOut = true;
+				detach.abort();
+			}, 3e4) : void 0;
+			try {
+				const result = await runConsoleSession((onMessage) => client.run({
+					definition: {
+						namespace,
+						id: options.id,
+						persistent: options.persistent ?? false,
+						restart: options.restart,
+						source: {
+							kind: "process",
+							command,
+							cwd,
+							env,
+							rpc: options.rpc,
+							tty,
+							readiness: options.readiness ?? (options.rpc ? "connected" : "spawned")
+						}
+					},
+					owner: options.foreground === true,
+					replace: options.force === true,
+					console: {
+						interactive: !options.detach,
+						...size ? { size } : {}
+					}
+				}, { onMessage }), {
+					interactive: !options.detach,
+					owner: options.foreground === true,
+					reattachCommand: host.attachCommand(options.id),
+					...withDetachKeys(host),
+					signal: detach.signal
+				}, (event) => {
+					status = event.status;
+					if (options.detach && status.runtime.state === "running") detach.abort();
+				});
+				if (options.detach) {
+					if (timedOut) throw new Error("Endpoint did not become ready within 30 seconds. It remains daemon-owned; use services list or logs to inspect it.");
+					if (status?.runtime.state !== "running") throw new Error(status?.runtime.error ?? "Endpoint exited before readiness");
+					print(status);
+				} else if (!result.closedLocally && result.exit?.code) process.exitCode = result.exit.code;
+				else if (!result.closedLocally && status?.runtime.state === "failed" && !result.exit) throw new Error(status.runtime.error ?? "Endpoint failed");
+			} finally {
+				clearTimeout(timeout);
+			}
+		});
+	});
+	policy(addressed(services.command("connect").description("Connect an existing LinkRPC endpoint; never owns its external process."))).requiredOption("--target-endpoint <uri>", "endpoint resolved on the daemon machine").action(async (options) => {
+		const namespace = host.namespace();
+		await createEndpoint(options.id, async (client) => {
+			const info = await client.info({});
+			process.stderr.write(`Execution host: ${info.hostname}\nNamespace: ${namespace}\nEndpoint: ${options.id}\n`);
+			print(await waitUntilReady(client, await client.create({
+				namespace,
+				id: options.id,
+				persistent: options.persistent ?? false,
+				restart: options.restart,
+				replace: options.force === true,
+				source: {
+					kind: "connection",
+					endpoint: options.targetEndpoint
+				}
+			})));
+		});
+	});
+	services.command("list").option("--all-contexts", "include every namespace visible to this caller").action(async (options) => {
+		const namespace = options.allContexts ? void 0 : host.namespace();
+		await host.use(false, async (client) => print(await client.list({ namespace })));
+	});
+	for (const operation of [
+		"start",
+		"stop",
+		"remove"
+	]) addressed(services.command(operation)).action(async (options) => {
+		const namespace = host.namespace();
+		await host.use(operation === "start", async (client) => {
+			if (operation === "start") print(await waitUntilReady(client, await client.start({
+				namespace,
+				id: options.id
+			})));
+			else print(await client[operation]({
+				namespace,
+				id: options.id
+			}));
+		});
+	});
+	addressed(services.command("configure")).option("--persistent", "retain this endpoint").option("--no-persistent", "remove it when stopped").addOption(new Option("--restart <policy>").choices([
+		"never",
+		"on-failure",
+		"always"
+	])).action(async (options, command) => {
+		const namespace = host.namespace();
+		await host.use(false, async (client) => print(await client.configure({
+			namespace,
+			id: options.id,
+			restart: options.restart,
+			persistent: command.getOptionValueSource("persistent") === "cli" ? options.persistent : void 0
+		})));
+	});
+	for (const operation of ["attach", "logs"]) {
+		const subcommand = addressed(services.command(operation));
+		if (operation === "attach") subcommand.option("--read-only", "observe without sending input");
+		else subcommand.option("--follow", "follow new output");
+		subcommand.action(async (options) => {
+			const namespace = host.namespace();
+			await host.use(false, async (client) => {
+				const status = (await client.list({ namespace })).find((value) => value.id === options.id);
+				if (!status) throw new Error(`Endpoint "${options.id}" not found in ${namespace}`);
+				if (!status.console) throw new Error(`Endpoint "${options.id}" is a connection and has no console`);
+				const interactive = operation === "attach" && options.readOnly !== true;
+				const size = interactive ? localTerminalSize() : void 0;
+				const result = await runConsoleSession((onMessage) => client.consoles.attach({
+					params: {
+						namespace,
+						id: options.id
+					},
+					interactive,
+					...size ? { size } : {}
+				}, { onMessage }), {
+					interactive,
+					owner: false,
+					untilLive: operation === "logs" && !options.follow,
+					reattachCommand: host.attachCommand(options.id),
+					...withDetachKeys(host)
+				});
+				if (operation === "attach" && !result.closedLocally && result.exit?.code) process.exitCode = result.exit.code;
+			});
+		});
+	}
+}
+/** Wait until an endpoint runs; fail if it stops, fails, or is removed first. */
+async function waitUntilReady(client, initial) {
+	if (initial.runtime.state === "running") return initial;
+	let current = initial;
+	let outcome;
+	const call = client.watch({
+		namespace: initial.namespace,
+		id: initial.id
+	}, { onMessage: (event) => {
+		if (event.t === "removed") outcome = "removed";
+		else {
+			current = event.status;
+			if (current.runtime.state === "running") outcome = "ready";
+			else if ([
+				"failed",
+				"stopped",
+				"disabled"
+			].includes(current.runtime.state)) outcome = "finished";
+		}
+		if (outcome) call.cancel().catch(() => {});
+	} });
+	const timeout = setTimeout(() => {
+		outcome ??= "timeout";
+		call.cancel().catch(() => {});
+	}, 3e4);
+	try {
+		await call;
+	} catch (error) {
+		if (!outcome) throw error;
+	} finally {
+		clearTimeout(timeout);
+	}
+	switch (outcome) {
+		case "ready": return current;
+		case "timeout": throw new Error("Endpoint did not become ready within 30 seconds. It remains daemon-owned; use services list or logs to inspect it.");
+		default: throw new Error(current.runtime.error ?? "Endpoint exited before readiness");
+	}
+}
+function print(value) {
+	process.stdout.write(JSON.stringify(value, null, 2) + "\n");
+}
+//#endregion
+//#region src/views/types.ts
+function formatCondition(condition) {
+	const match = condition.kind === "interface" ? condition.interface : condition.implements;
+	const predicate = "tag" in match ? `tag(${match.tag})` : `id(${match.interfaceId})`;
+	return condition.kind === "interface" ? `interface:${predicate}` : `service:implements(${predicate})`;
+}
+function matchesInterface(value, condition) {
+	return "tag" in condition ? value.tags?.includes(condition.tag) === true : value.interfaceId === condition.interfaceId;
+}
+function matchesTarget(target, view) {
+	return view.conditions.some((condition) => condition.kind === target.kind && target.interfaces.some((value) => matchesInterface(value, condition.kind === "interface" ? condition.interface : condition.implements)));
+}
+function targetId(kind, listing) {
+	return `${kind}:${encodeURIComponent(listing.serviceId)}:${encodeURIComponent(listing.discoveredFrom)}` + (kind === "interface" ? `:${encodeURIComponent(listing.interfaceId)}:${listing.isDefault ? "default" : "qualified"}` : "");
+}
+function interfaceTarget(listing) {
+	return {
+		id: targetId("interface", listing),
+		kind: "interface",
+		serviceId: listing.serviceId,
+		interfaceId: listing.interfaceId,
+		discoveredFrom: listing.discoveredFrom,
+		interfaces: [listing]
+	};
+}
+//#endregion
+//#region src/views/discovery.ts
+async function discoverViewTargets(channel, view, options = {}) {
+	const explorer = new HubDirectoryExplorer(channel, options);
+	const warnings = [];
+	try {
+		await explorer.explore();
+		const snapshot = explorer.graphSnapshot.result;
+		warnings.push(...snapshot.inaccessible.map((item) => `${item.serviceId || "<root>"}: ${item.reason}`));
+		const listings = [...snapshot.listings];
+		try {
+			const defaults = await deadline(fetchDefaults(channel), options.timeoutMs ?? 5e3);
+			if (defaults.interfaceId !== void 0) {
+				const existing = listings.find((item) => item.serviceId === "" && item.interfaceId === defaults.interfaceId);
+				listings.unshift({
+					serviceId: "",
+					interfaceId: defaults.interfaceId,
+					hash: defaults.hash ?? existing?.hash,
+					discoveredFrom: "",
+					isDefault: true,
+					tags: existing?.tags
+				});
+			}
+		} catch (error) {
+			warnings.push(`Default service: ${message(error)}`);
+		}
+		const interfacesById = /* @__PURE__ */ new Map();
+		for (const listing of listings) {
+			const target = interfaceTarget(listing);
+			const previous = interfacesById.get(target.id);
+			interfacesById.set(target.id, previous === void 0 ? target : {
+				...previous,
+				interfaces: [...previous.interfaces, listing]
+			});
+		}
+		const targets = [...interfacesById.values()];
+		const services = /* @__PURE__ */ new Map();
+		for (const listing of listings) {
+			const id = targetId("service", listing);
+			const values = services.get(id) ?? [];
+			if (!values.some((value) => value.interfaceId === listing.interfaceId && value.hash === listing.hash)) values.push(listing);
+			services.set(id, values);
+		}
+		for (const [id, interfaces] of services) {
+			const first = interfaces[0];
+			targets.push({
+				id,
+				kind: "service",
+				serviceId: first.serviceId,
+				discoveredFrom: first.discoveredFrom,
+				interfaces
+			});
+		}
+		return {
+			targets: targets.filter((target) => matchesTarget(target, view)).map((target) => ({
+				...target,
+				serviceInterfaces: listings.filter((listing) => listing.serviceId === target.serviceId && listing.discoveredFrom === target.discoveredFrom)
+			})).sort((a, b) => a.id.localeCompare(b.id)),
+			warnings
+		};
+	} finally {
+		explorer.dispose();
+	}
+}
+async function resolveViewTarget(channel, view, id, options = {}) {
+	const { targets } = await discoverViewTargets(channel, view, options);
+	const target = targets.find((value) => value.id === id);
+	if (!target) throw new Error(`Unknown or unavailable ${view.id} target "${id}". Run view targets ${view.id} again.`);
+	return loadViewTarget(channel, target, options.timeoutMs, view);
+}
+/** Selection and opening share a connection, including spawned ephemeral endpoints. */
+async function resolveViewSelection(channel, view, options) {
+	if (options.target !== void 0) {
+		const context = await resolveViewTarget(channel, view, options.target, options);
+		if (options.service !== void 0 && context.target.serviceId !== options.service) throw new Error("--target does not match --service");
+		if (options.interface !== void 0 && !context.target.interfaces.some((value) => value.interfaceId === options.interface)) throw new Error("--target does not match --interface");
+		return context;
+	}
+	if (options.interface === void 0 && options.service === void 0) throw new Error("Specify --target, or an exact --interface / --service selector");
+	const candidates = (await discoverViewTargets(channel, view, options)).targets.filter((target) => target.kind === (options.interface === void 0 ? "service" : "interface") && (options.interface === void 0 || target.interfaceId === options.interface) && (options.service === void 0 || target.serviceId === options.service));
+	const matches = candidates.filter((target) => target.kind !== "interface" || target.interfaces.some((value) => value.isDefault) || !candidates.some((other) => other.serviceId === target.serviceId && other.discoveredFrom === target.discoveredFrom && other.interfaceId === target.interfaceId && other.interfaces.every((value) => target.interfaces.some((candidate) => candidate.hash === value.hash)) && target.interfaces.every((value) => other.interfaces.some((candidate) => candidate.hash === value.hash)) && other.interfaces.some((value) => value.isDefault)));
+	if (matches.length !== 1) {
+		const detail = matches.length === 0 ? "No matching target" : `Target selection is ambiguous (${matches.length} targets)`;
+		throw new Error(`${detail}; use --service to narrow the selection or --target from view targets ${view.id}`);
+	}
+	return loadViewTarget(channel, matches[0], options.timeoutMs, view);
+}
+async function loadViewTarget(channel, target, timeoutMs = 5e3, view) {
+	const candidates = view === void 0 || target.kind === "interface" ? target.interfaces : target.interfaces.filter((listing) => view.conditions.some((condition) => condition.kind === "service" && matchesInterface(listing, condition.implements)));
+	for (const listing of candidates) if (candidates.some((other) => other.interfaceId === listing.interfaceId && other.hash !== listing.hash)) throw new Error(`Target "${target.id}" is ambiguous: interface "${listing.interfaceId}" advertises multiple schema hashes`);
+	return {
+		channel,
+		target,
+		interfaces: await Promise.all(candidates.map(async (listing) => {
+			const schema = await deadline(fetchSchema$1(channel, listing.interfaceId, listing.hash, listing.discoveredFrom || void 0), timeoutMs);
+			if (schema.id !== listing.interfaceId || listing.hash !== void 0 && schema.hash !== listing.hash) throw new Error(`Schema for "${listing.interfaceId}" does not match its current directory advertisement; rediscover the target`);
+			return {
+				...listing,
+				hash: schema.hash,
+				schema
+			};
+		}))
+	};
+}
+async function deadline(promise, timeoutMs) {
+	let timer;
+	try {
+		return await Promise.race([promise, new Promise((_, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`Reflection timed out after ${timeoutMs}ms`)), timeoutMs);
+		})]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+function message(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+//#endregion
+//#region src/commands/consoleAttach.ts
+const consoleTemplate = ConsoleTemplate({ params: unknown() }).template;
+/** Discovery-only view: the generic `attach` command reuses directory and reflection resolution. */
+const consoleDiscovery = {
+	id: "console",
+	title: "Console",
+	modes: ["cli"],
+	conditions: [{
+		kind: "interface",
+		interface: { tag: CONSOLE_INTERFACE_TAG }
+	}, {
+		kind: "service",
+		implements: { tag: CONSOLE_INTERFACE_TAG }
+	}],
+	configureCommand() {},
+	open() {
+		throw new Error("Use the attach command");
+	},
+	createSession() {
+		throw new Error("Consoles have no TUI view");
+	}
+};
+/** Console template instances in reflected schemas; tags are only discovery hints. */
+function consoleTargets(interfaces) {
+	return interfaces.flatMap((listing) => {
+		const metadata = listing.schema[INTERFACE_TEMPLATES_EXTENSION];
+		if (metadata === void 0) return [];
+		validateInterfaceTemplates(listing.schema);
+		return metadata.instances.flatMap((instance) => {
+			const template = metadata.templates[instance.template];
+			if (template?.id !== consoleTemplate.id) return [];
+			if (!interfaceTemplatesEqual(template, consoleTemplate)) throw new Error(`${listing.interfaceId} uses an unsupported revision of the ${consoleTemplate.id} template`);
+			const method = (member) => {
+				const name = interfaceTemplateMemberName(instance, member);
+				if (listing.isDefault) return name;
+				return listing.serviceId === "" ? `${listing.interfaceId}::${name}` : `${listing.serviceId}::${listing.interfaceId}::${name}`;
+			};
+			const params = instance.arguments.params;
+			if (params === void 0) throw new Error(`Console instance "${instance.name}" is missing its params argument`);
+			return [{
+				serviceId: listing.serviceId,
+				interfaceId: listing.interfaceId,
+				instance: instance.name,
+				infoMethod: method("info"),
+				attachMethod: method("attach"),
+				params
+			}];
+		});
+	});
+}
+/** List console targets without attaching: discovery uses directory tags, then reflection resolves instances. */
+async function listConsoleTargets(channel) {
+	const discovery = await discoverViewTargets(channel, consoleDiscovery);
+	const rows = [];
+	for (const target of discovery.targets.filter((value) => value.kind === "service")) {
+		const context = await loadViewTarget(channel, target, void 0, consoleDiscovery);
+		for (const console of consoleTargets(context.interfaces)) rows.push(`${console.serviceId || "<root>"}  ${console.interfaceId}  ${console.instance}  ${JSON.stringify(console.params.schema)}`);
+	}
+	return [
+		rows.length === 0 ? "No services offer linkrpc.console." : "SERVICE  INTERFACE  INSTANCE  PARAMS",
+		...rows,
+		...discovery.warnings.map((warning) => `warning: ${warning}`)
+	].join("\n");
+}
+/** Attach to any service implementing the console template, selected by service, interface, and instance. */
+async function attachConsole(channel, options) {
+	const context = await resolveViewSelection(channel, consoleDiscovery, {
+		service: options.serviceId,
+		...options.interfaceId === void 0 ? {} : { interface: options.interfaceId }
+	});
+	const candidates = consoleTargets(context.interfaces).filter((target) => options.instance === void 0 || target.instance === options.instance);
+	if (candidates.length !== 1) {
+		const names = consoleTargets(context.interfaces).map((target) => `${target.interfaceId}#${target.instance}`).join(", ");
+		throw new Error(candidates.length === 0 ? `No console instance matches on "${options.serviceId}"${names ? ` (available: ${names})` : ""}` : `Several consoles are available (${names}); select one with --instance or --interface`);
+	}
+	const target = candidates[0];
+	let params;
+	try {
+		params = JSON.parse(options.params ?? "{}");
+	} catch {
+		throw new Error("--params must be valid JSON");
+	}
+	const validation = createSchemaToZod(target.params.components?.schemas ?? {}).toZod(target.params.schema).safeParse(params);
+	if (!validation.success) throw new Error(`--params does not match the params of console "${target.instance}" (${JSON.stringify(target.params.schema)}): ${validation.error.message}`);
+	const interactive = options.readOnly !== true;
+	const size = interactive ? localTerminalSize() : void 0;
+	const result = await runConsoleSession((onMessage) => rawConsoleCall(channel, target.attachMethod, {
+		params,
+		interactive,
+		...size ? { size } : {}
+	}, onMessage), {
+		interactive,
+		owner: false,
+		reattachCommand: options.reattachCommand,
+		...options.detachKeys ? { detachKeys: options.detachKeys } : {}
+	});
+	if (!result.closedLocally && result.exit?.code) process.exitCode = result.exit.code;
+}
+/** Call a reflected attach method on the raw channel, validating every stream message against the protocol. */
+function rawConsoleCall(channel, method, params, onMessage) {
+	const call = channel.sendRequestWithStream(method, params, { onStreamMessage: (payload) => {
+		const message = consoleServerMessageSchema.safeParse(payload);
+		onMessage(message.success ? message.data : {
+			t: "notice",
+			text: `Ignored an invalid console message: ${message.error.message}`
+		});
+	} });
+	const result = call.result.then((value) => consoleAttachResultSchema.parse(value));
+	result.finally(() => call.dispose?.()).catch(() => {});
+	return {
+		then: (onFulfilled, onRejected) => result.then(onFulfilled, onRejected),
+		send: (message) => call.send(message),
+		cancel: () => call.cancel("detached")
+	};
+}
+//#endregion
+//#region src/output.ts
+/**
+* Read params either from a `--params <json>` argument (treated as inline
+* JSON) or `--params -` (read from stdin). `undefined` if neither was given.
+*/
+function readParamsArg(value) {
+	if (value === void 0) return void 0;
+	const trimmed = (value === "-" ? readFileSync(0, "utf8") : value).trim();
+	if (trimmed.length === 0) return void 0;
+	try {
+		return JSON.parse(trimmed);
+	} catch (e) {
+		throw new Error(`--params: invalid JSON (${e.message})`);
+	}
+}
+function formatJson(v) {
+	if (v === void 0) return "undefined";
+	return JSON.stringify(v, null, 2);
+}
+//#endregion
+//#region src/commands/caps.ts
+const matcherSchema = z.union([
+	z.strictObject({ exact: z.json() }),
+	z.strictObject({ enum: z.array(z.json()).min(1) }),
+	z.strictObject({ prefix: z.string() }),
+	z.strictObject({ subsetOf: z.array(z.string()) }),
+	z.strictObject({ any: z.literal(true) })
+]);
+async function requestCallCapability(channel, session, ref, params, schema, opts) {
+	const method = findMethodInSchema(schema, ref.methodName);
+	if (method === void 0) throw new Error(`Unknown method ${ref.getMethodOnWire()}.`);
+	const matchers = createParamMatchers(params, opts.allowParams ?? [], method.params, schema.components?.schemas);
+	const defaults = ref.interfaceId === void 0 ? await fetchDefaults(channel) : void 0;
+	const permission = {
+		target: {
+			serviceId: { exact: ref.serviceId ?? defaults?.serviceId ?? "" },
+			interfaceId: { exact: ref.interfaceId ?? schema.id },
+			members: [{ exact: ref.methodName }],
+			...ref.hash !== void 0 ? { interfaceHash: ref.hash } : {}
+		},
+		canInvoke: true,
+		params: matchers
+	};
+	const coverageOptions = {
+		audience: session.principal.id,
+		freshnessMarginMs: 2e3
+	};
+	const cached = findCoveringCapabilities(session.listGrants(), [permission], coverageOptions);
+	if (cached !== void 0) return formatJson({
+		status: "granted",
+		reused: true,
+		capabilities: cached
+	});
+	const result = await session.requestAccess({
+		consumer: {
+			name: "linkrpc-cli",
+			purpose: `Invoke ${ref.getMethodOnWire()}.`
+		},
+		permissions: [permission],
+		duration: opts.duration ?? "persistent"
+	});
+	if (result.status !== "granted") {
+		const reason = "reason" in result ? result.reason : void 0;
+		throw new Error(`Capability request ${result.status}${reason ? `: ${reason}` : "."}`);
+	}
+	if (findCoveringCapabilities(session.listGrants(), [permission], coverageOptions) === void 0) throw new Error("The granted capabilities do not cover the requested durable scope.");
+	return formatJson({
+		...result,
+		reused: false
+	});
+}
+function createParamMatchers(params, allowParams, schema, components = {}) {
+	if (params !== void 0 && (params === null || typeof params !== "object" || Array.isArray(params))) throw new Error("Capability requests require object parameters.");
+	const actual = params === void 0 ? {} : Object.fromEntries(Object.entries(params));
+	const matchers = Object.fromEntries(Object.entries(actual).map(([key, value]) => [key, { exact: value }]));
+	const seen = /* @__PURE__ */ new Set();
+	for (const raw of allowParams) {
+		const { path, value } = parseParamOverride(raw);
+		if (path.length !== 1) throw new Error("--cap:allow-param only supports top-level parameter names.");
+		const key = path[0];
+		if (seen.has(key)) throw new Error(`Duplicate --cap:allow-param for ${key}.`);
+		seen.add(key);
+		const parsed = matcherSchema.safeParse(value);
+		if (!parsed.success) throw new Error(`Invalid --cap:allow-param ${key}: ${parsed.error.message}`);
+		matchers[key] = parsed.data;
+	}
+	const properties = Object.fromEntries(Object.entries(matchers).map(([key, matcher]) => [key, matcherToSchema(matcher)]));
+	if (!isAssignable({
+		type: "object",
+		properties,
+		required: Object.keys(properties),
+		additionalProperties: false
+	}, schema, { schemas: components })) throw new Error("--cap:allow-param scope does not match the method parameter schema.");
+	const validator = schemaToZod(schema, components);
+	const samples = [actual];
+	for (const [key, matcher] of Object.entries(matchers)) {
+		const values = "exact" in matcher ? [matcher.exact] : "enum" in matcher ? matcher.enum : "subsetOf" in matcher ? [[], ...matcher.subsetOf.map((value) => [value])] : [];
+		for (const value of values) samples.push({
+			...actual,
+			[key]: value
+		});
+	}
+	for (const sample of samples) {
+		const validated = validator.safeParse(sample);
+		if (!validated.success) throw new Error(`Capability parameter schema validation failed: ${validated.error.message}`);
+	}
+	const matched = matchParams(matchers, actual);
+	if (!matched.ok) throw new Error(`Parameters do not match --cap:allow-param: ${matched.reason}`);
+	return matchers;
+}
+function matcherToSchema(matcher) {
+	if ("any" in matcher) return true;
+	if ("prefix" in matcher) return { type: "string" };
+	if ("subsetOf" in matcher) return {
+		type: "array",
+		items: { enum: matcher.subsetOf }
+	};
+	if ("enum" in matcher) return { enum: z.array(z.json()).parse(matcher.enum) };
+	return { const: z.json().parse(matcher.exact) };
+}
+function listCaps(session, json) {
+	const capabilities = session.listGrants();
+	return json ? formatJson({
+		principal: session.principal.id,
+		capabilities
+	}) : `principal: ${session.principal.id}\n${capabilities.length === 0 ? "No stored capabilities." : formatJson(capabilities)}`;
+}
+//#endregion
+//#region src/suggest.ts
+const _SYSTEM_PREFIX = "hubrpc.";
+function _isSystemInterface(id) {
+	return id.startsWith(_SYSTEM_PREFIX);
+}
+function _isUserInterface(id) {
+	return !_isSystemInterface(id);
+}
+/**
+* Indexed view of the bus's directory + per-interface methods. Constructed
+* directly from a list of entries (tests) or by walking a live channel
+* (`HubSnapshot.load`). Read-only after construction.
+*/
+var HubSnapshot = class HubSnapshot {
+	entries;
+	_byService = /* @__PURE__ */ new Map();
+	_byInterface = /* @__PURE__ */ new Map();
+	_byMethodName = /* @__PURE__ */ new Map();
+	constructor(entries) {
+		this.entries = entries;
+		for (const e of entries) {
+			let byIface = this._byService.get(e.serviceId);
+			if (!byIface) {
+				byIface = /* @__PURE__ */ new Map();
+				this._byService.set(e.serviceId, byIface);
+			}
+			byIface.set(e.interfaceId, e);
+			const hosts = this._byInterface.get(e.interfaceId) ?? [];
+			if (!hosts.includes(e.serviceId)) hosts.push(e.serviceId);
+			this._byInterface.set(e.interfaceId, hosts);
+			for (const m of e.methods) {
+				const locs = this._byMethodName.get(m) ?? [];
+				locs.push({
+					serviceId: e.serviceId,
+					interfaceId: e.interfaceId
+				});
+				this._byMethodName.set(m, locs);
+			}
+		}
+	}
+	/** All serviceIds present on the bus, in encounter order ("" = root). */
+	services() {
+		return [...this._byService.keys()];
+	}
+	/** All distinct interface ids (system + user), in encounter order. */
+	interfaces() {
+		return [...this._byInterface.keys()];
+	}
+	interfacesOnService(serviceId) {
+		const m = this._byService.get(serviceId);
+		return m ? [...m.keys()] : [];
+	}
+	servicesHostingInterface(interfaceId) {
+		return this._byInterface.get(interfaceId) ?? [];
+	}
+	methodsOn(serviceId, interfaceId) {
+		return this._byService.get(serviceId)?.get(interfaceId)?.methods ?? [];
+	}
+	locationsOfMethod(name) {
+		return this._byMethodName.get(name) ?? [];
+	}
+	/**
+	* Walk the live bus once and fetch the schema for every (service, interface)
+	* pair in parallel. Failures on individual schema fetches are absorbed —
+	* the affected entry just ends up with `methods: []`, so it still
+	* participates in service/interface-level suggestions.
+	*/
+	static async load(channel) {
+		const listings = await walkHub(channel);
+		const entries = await Promise.all(listings.map(async (l) => {
+			try {
+				const schema = await fetchSchema$1(channel, l.interfaceId, l.hash, l.serviceId || void 0);
+				return {
+					serviceId: l.serviceId,
+					interfaceId: l.interfaceId,
+					hash: l.hash,
+					methods: Object.keys(schema.methods)
+				};
+			} catch {
+				return {
+					serviceId: l.serviceId,
+					interfaceId: l.interfaceId,
+					hash: l.hash,
+					methods: []
+				};
+			}
+		}));
+		return new HubSnapshot(entries);
+	}
+};
+/**
+* Compose a multi-line "Did you mean…" message tailored to the failed ref.
+* The returned string has no trailing newline and no `linkrpc:` prefix (the
+* outer error path adds those).
+*/
+function formatSuggestion(input) {
+	const ctx = {
+		ref: input.ref,
+		snapshot: input.snapshot,
+		verb: input.verb,
+		tool: input.tool ?? "hub"
+	};
+	if (ctx.ref.serviceId !== void 0 && ctx.ref.interfaceId !== void 0) return _suggestForm3(ctx);
+	if (ctx.ref.interfaceId !== void 0) return _suggestForm2(ctx);
+	return _suggestForm1(ctx);
+}
+function _qualify(ctx, s, i, m) {
+	return `${ctx.tool} ${ctx.verb} ${s}::${i}::${m}`;
+}
+function _suggestForm1(ctx) {
+	const { ref, snapshot } = ctx;
+	const token = ref.methodName;
+	if (token !== "" && snapshot.services().includes(token)) {
+		const samples = _sampleCallsForService(ctx, token, 3);
+		const lines = [`"${token}" is a serviceId, not a method.`];
+		lines.push("  See its interfaces:");
+		lines.push(`    ${ctx.tool} ls --service ${token}`);
+		if (samples.length > 0) {
+			lines.push("  Or call one:");
+			for (const s of samples) lines.push(`    ${s}`);
+		}
+		return lines.join("\n");
+	}
+	if (snapshot.interfaces().includes(token) && _isUserInterface(token)) {
+		const hosts = snapshot.servicesHostingInterface(token).filter((s) => s !== "");
+		const samples = _sampleCallsForInterface(ctx, token, 3);
+		const lines = [`"${token}" is an interface, not a method. It's hosted on services: ${hosts.join(", ")}.`];
+		if (samples.length > 0) {
+			lines.push("  Try a call:");
+			for (const s of samples) lines.push(`    ${s}`);
+		}
+		return lines.join("\n");
+	}
+	const locs = snapshot.locationsOfMethod(token).filter((l) => _isUserInterface(l.interfaceId));
+	if (locs.length > 0) {
+		const lines = [`"${token}" is not callable without an interface (no preset is set).`];
+		lines.push("  Did you mean:");
+		for (const l of locs.slice(0, 5)) lines.push(`    ${_qualify(ctx, l.serviceId, l.interfaceId, token)}`);
+		return lines.join("\n");
+	}
+	return _suggestForm1Fuzzy(ctx);
+}
+function _suggestForm1Fuzzy(ctx) {
+	const { snapshot } = ctx;
+	const token = ctx.ref.methodName;
+	const methodHits = _rankAllMethods(snapshot, token, 3);
+	const ifaceHits = _rankAllInterfaces(snapshot, token, 3);
+	const svcHits = _rankServices(snapshot, token, 3);
+	const lines = [`"${token}" matches no known service, interface, or method.`];
+	if (methodHits.length > 0) {
+		lines.push("  Closest methods:");
+		for (const h of methodHits) lines.push(`    ${_qualify(ctx, h.serviceId, h.interfaceId, h.name)}`);
+	}
+	if (ifaceHits.length > 0) {
+		lines.push("  Closest interfaces:");
+		for (const id of ifaceHits) {
+			const sampleSvc = snapshot.servicesHostingInterface(id).find((s) => s !== "") ?? snapshot.servicesHostingInterface(id)[0];
+			lines.push(`    ${id}  (try ${ctx.tool} ${ctx.verb} ${sampleSvc ?? ""}::${id}::<method>)`);
+		}
+	}
+	if (svcHits.length > 0) {
+		lines.push("  Closest services:");
+		for (const s of svcHits) lines.push(`    ${s}  (try ${ctx.tool} ls --service ${s})`);
+	}
+	if (methodHits.length === 0 && ifaceHits.length === 0 && svcHits.length === 0) lines.push(`  Tip: run \`${ctx.tool} ls\` to see what's available.`);
+	return lines.join("\n");
+}
+function _suggestForm2(ctx) {
+	const { ref, snapshot } = ctx;
+	const iface = ref.interfaceId;
+	const method = ref.methodName;
+	const hostsOfIface = snapshot.servicesHostingInterface(iface);
+	if (hostsOfIface.length === 0) {
+		if (iface !== "" && snapshot.services().includes(iface)) {
+			const locs = snapshot.locationsOfMethod(method).filter((l) => l.serviceId === iface && _isUserInterface(l.interfaceId));
+			if (locs.length > 0) {
+				const lines = [`Interface "${method}" not found on service "${iface}", but "${method}" is a method name there.`];
+				lines.push("  Did you mean:");
+				for (const l of locs.slice(0, 3)) lines.push(`    ${_qualify(ctx, l.serviceId, l.interfaceId, method)}`);
+				return lines.join("\n");
+			}
+			return _formatInterfaceListOnService(ctx, iface, method);
+		}
+		const candidates = _rankInterfacesWithMethodBoost(snapshot, iface, method, 3);
+		const lines = [`Interface "${iface}" not found.`];
+		if (candidates.length > 0) {
+			lines.push("  Did you mean:");
+			for (const c of candidates) lines.push(`    ${_qualify(ctx, c.serviceId, c.interfaceId, c.methodToTry)}`);
+		} else lines.push(`  Tip: run \`${ctx.tool} ls\` to see what's available.`);
+		return lines.join("\n");
+	}
+	const fuzzy = _rankMethodsOnInterface(snapshot, iface, method, 3);
+	if (fuzzy.length > 0) {
+		const lines = [`Method "${method}" not found on interface "${iface}"${hostsOfIface.length === 1 ? ` (service: ${hostsOfIface[0]})` : ""}.`];
 		lines.push("  Did you mean:");
 		for (const f of fuzzy) lines.push(`    ${_qualify(ctx, f.serviceId, iface, f.methodName)}`);
 		return lines.join("\n");
@@ -493,11 +1474,23 @@ async function callCommand(channel, opts) {
 		base: baseParams,
 		overrides: opts.paramOverrides
 	});
-	const validation = opts.noValidate ? "off" : opts.validation ?? "required";
-	if (validation !== "off") await validateParams(channel, ref, params, "call", validation);
+	const requestCap = opts.requestCap === true || opts.capabilityOnly === true;
+	if (!requestCap && opts.allowParams !== void 0) throw new Error("--cap:allow-param requires --cap:request.");
+	if (requestCap && (opts.noValidate || opts.validation === "off")) throw new Error("Capability requests require schema validation; remove --no-validate/--validation off.");
+	if (requestCap && opts.signingSession === void 0) throw new Error("Capability requests require a signed LinkRPC connection.");
 	const onStreamChunk = opts.onStreamChunk ?? writeChunkToStderr;
 	try {
-		const result = await channel.sendRequestWithStream(ref.getMethodOnWire(), params, { onStreamMessage: onStreamChunk }).result;
+		const validation = requestCap ? "required" : opts.noValidate ? "off" : opts.validation ?? "required";
+		const schema = validation === "off" ? void 0 : await validateParams(channel, ref, params, "call", validation);
+		if (requestCap) {
+			if (schema === void 0 || opts.signingSession === void 0) throw new Error("Capability requests require a method schema and signing session.");
+			const result = await requestCallCapability(channel, opts.signingSession, ref, params, schema, opts);
+			if (opts.capabilityOnly) return result;
+		}
+		const result = await channel.sendRequestWithStream(ref.getMethodOnWire(), params, {
+			onStreamMessage: onStreamChunk,
+			...opts.signingSession !== void 0 && ref.hash !== void 0 ? { interfaceHash: ref.hash } : {}
+		}).result;
 		return opts.json !== false ? formatJson(result) : String(result);
 	} catch (e) {
 		if (e instanceof RpcError && e.code === ErrorCode.methodNotFound) await _failWithSuggestion(channel, ref, "call");
@@ -539,15 +1532,16 @@ async function validateParams(channel, ref, params, verb, validation) {
 	}
 	if (schema === void 0) {
 		if (validation === "auto") return;
-		await _failWithSuggestion(channel, ref, verb);
+		return _failWithSuggestion(channel, ref, verb);
 	}
 	const method = findMethodInSchema(schema, ref.methodName);
-	if (!method) await _failWithSuggestion(channel, ref, verb);
+	if (!method) return _failWithSuggestion(channel, ref, verb);
 	if (verb === "call" && method.result === void 0) throw new Error(`${ref.getMethodOnWire()} is a notification member; use \`notify\` instead of \`call\`.`);
 	if (verb === "notify" && method.result !== void 0) throw new Error(`${ref.getMethodOnWire()} is a request member; use \`call\` instead of \`notify\`.`);
 	const paramsSchema = method.params;
 	const reason = validateValueAgainstSchema(params, paramsSchema, schema.components?.schemas ?? {});
 	if (reason !== void 0) throw new Error(_formatParamValidationError(ref, schema, method, params, reason));
+	return schema;
 }
 function _formatParamValidationError(ref, schema, method, params, fallback) {
 	const components = schema.components?.schemas ?? {};
@@ -593,20 +1587,13 @@ function formatRpcError(e) {
 	const dataStr = e.data === void 0 ? "" : ` ${JSON.stringify(e.data)}`;
 	return /* @__PURE__ */ new Error(`RPC error ${e.code}: ${e.message}${dataStr}`);
 }
-/**
-* Friendly explanation for `permissionRequired` (-32401). Typical when the
-* CLI couldn't acquire a capability via `hubAccess::requestAccess` and the
-* target service gates on caps. The earlier `capability negotiation
-* skipped` warning explains *why* we couldn't get one; this footer tells
-* the user what to do.
-*/
 function _formatPermissionRequired(e) {
 	return [
 		`Permission required: ${e.message}`,
-		"  The hub gates this call on a capability, and none was acquired.",
-		"  If your hub uses an access handler, accept the consent prompt and retry.",
-		"  Otherwise, the hub admin has to issue a capability to this CLI identity",
-		`  (\`hub logout\` then retry to mint a fresh identity).`
+		"  No usable capability authorizes this call.",
+		"  Retry with --cap:request to request access before calling.",
+		"  Use --cap:allow-param with --cap:request to request a broader parameter scope,",
+		"  or use `linkrpc hub caps request <methodRef>` to acquire and store access separately."
 	].join("\n");
 }
 //#endregion
@@ -2003,7 +2990,7 @@ function selectParticipant(participants, nodeId) {
 	return participants.length === 1 ? participants[0] : void 0;
 }
 async function promptForParticipant(participants, search) {
-	const readline = createInterface({
+	const readline = createInterface$1({
 		input: stdin,
 		output: stdout
 	});
@@ -2070,409 +3057,1906 @@ async function schemaCommand(channel, opts) {
 	if (opts.json) return formatJson(schema);
 	return renderSchema(schema);
 }
-function renderSchema(schema) {
-	const lines = [];
-	lines.push(`${schema.id}@${schema.hash}`);
-	if (schema.description) lines.push(`  ${schema.description}`);
-	lines.push("");
-	for (const [name, method] of Object.entries(schema.methods)) {
-		lines.push(renderMethod(name, method));
-		lines.push("");
+function renderSchema(schema) {
+	const lines = [];
+	lines.push(`${schema.id}@${schema.hash}`);
+	if (schema.description) lines.push(`  ${schema.description}`);
+	lines.push("");
+	for (const [name, method] of Object.entries(schema.methods)) {
+		lines.push(renderMethod(name, method));
+		lines.push("");
+	}
+	return lines.join("\n").trimEnd();
+}
+function renderMethod(name, m) {
+	const kind = m.result === void 0 ? "notify" : "request";
+	const lines = [];
+	lines.push(`  ${kind}  ${name}`);
+	if (m.summary) lines.push(`    ${m.summary}`);
+	if (m.description) lines.push(`    ${m.description}`);
+	lines.push(`    params: ${shortSchema(m.params)}`);
+	if (m.result) lines.push(`    result: ${shortSchema(m.result)}`);
+	return lines.join("\n");
+}
+function shortSchema(s) {
+	const str = JSON.stringify(s);
+	if (str.length <= 120) return str;
+	return str.slice(0, 117) + "...";
+}
+//#endregion
+//#region src/commands/serve.ts
+/**
+* `linkrpc serve <config>` — run a hub from a declarative `HubConfig` file and
+* block until interrupted. Thin CLI face over the shared `@hediet/linkrpc-hub`
+* engine, so one config format drives the CLI hub, the server hub, and the
+* VS Code extension.
+*/
+/** Run a hub from `configPath` and resolve only when interrupted (SIGINT/SIGTERM). */
+async function serveCommand(opts) {
+	const { serveHub } = await import("@hediet/linkrpc-hub/serve");
+	await serveHub({
+		configPath: opts.configPath,
+		cmdInteractive: opts.cmdInteractive,
+		logMessages: opts.logMessages,
+		log: (line) => process.stderr.write(`linkrpc: ${line}\n`)
+	});
+}
+//#endregion
+//#region src/commands/connectAs.ts
+/**
+* Run a **connect-as** proxy until either side closes (or {@link
+* ConnectAsDeps.stop} resolves).
+*
+* Mints a bound token for a slot, opens the target-facing transport and the
+* hub-facing transport (which redeems the token → this connection *is* the slot
+* on the hub), and splices them message-for-message. The target thereby joins
+* the hub as a first-class participant with the slot's managed identity +
+* granted namespace, without running a local hub and without the target needing
+* to perform the hub handshake itself.
+*
+* Because all traffic crosses the CLI's splice point, {@link
+* ConnectAsDeps.tapTarget} yields complete `--log-messages` observability.
+*/
+async function connectAs(deps) {
+	const token = await deps.mintToken();
+	const target = await deps.openTargetTransport();
+	let hub;
+	try {
+		hub = await deps.openHubTransport(token);
+	} catch (e) {
+		target.dispose();
+		throw e;
+	}
+	const targetTransport = deps.tapTarget ? deps.tapTarget(target.transport) : target.transport;
+	const pipe = connectTransports(targetTransport, hub.transport);
+	deps.log?.("connect-as: bridged target ⟷ hub");
+	await new Promise((resolve) => {
+		let done = false;
+		const teardown = () => {
+			if (done) return;
+			done = true;
+			pipe.dispose();
+			try {
+				target.dispose();
+			} catch {}
+			try {
+				hub.dispose();
+			} catch {}
+			resolve();
+		};
+		target.onClose(teardown);
+		hub.onClose(teardown);
+		deps.stop?.then(teardown);
+	});
+	deps.log?.("connect-as: closed");
+}
+//#endregion
+//#region src/commands/connectAsTransports.ts
+/**
+* Dial a ws / socket endpoint as a client, presenting `token` in the
+* `hubrpc::initialize` handshake. Used for the hub-facing side (with the minted
+* bound token) and for ws / socket / uri targets (with the target's own token).
+*/
+async function openDialTransport(spec, token) {
+	if (spec.kind === "ws") {
+		const ws = await openWebSocket(spec.url);
+		const closeWs = () => {
+			try {
+				ws.close();
+			} catch {}
+		};
+		const transport = new WebSocketTransport(ws, closeWs);
+		try {
+			await runInitializeHandshake(transport, {
+				kind: "client",
+				token
+			});
+		} catch (err) {
+			transport.dispose();
+			closeWs();
+			throw err;
+		}
+		return {
+			transport,
+			onClose: (cb) => ws.addEventListener("close", () => cb()),
+			dispose: () => {
+				transport.dispose();
+				closeWs();
+			}
+		};
+	}
+	const socket = net.createConnection(spec.path);
+	const { transport } = await connectNdjson({
+		input: socket,
+		output: socket,
+		onClose: () => socket.destroy(),
+		initialize: {
+			kind: "client",
+			token
+		}
+	});
+	return {
+		transport,
+		onClose: (cb) => socket.on("close", cb),
+		dispose: () => socket.destroy()
+	};
+}
+/** Forward a child stream's lines to `log`, prefixed with `label`. */
+function _pipeLines(stream, label, log) {
+	if (!stream) return;
+	stream.setEncoding("utf8");
+	stream.on("data", (chunk) => {
+		for (const line of chunk.split(/\r?\n/)) if (line.length > 0) log(`[${label}] ${line}`);
+	});
+}
+/** Spawn a `cmd-stdio` target and talk linkrpc over its stdin/stdout. */
+async function openStdioTransport(command, env, cwd, log) {
+	const child = spawnCommand(command, {
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		...env !== void 0 ? { env: {
+			...process.env,
+			...env
+		} } : {},
+		...cwd !== void 0 ? { cwd } : {}
+	});
+	if (!child.stdin || !child.stdout) throw new Error("connect-as: cmd-stdio child exposes no stdio");
+	if (log) _pipeLines(child.stderr, "target", log);
+	const { transport } = await connectNdjson({
+		input: child.stdout,
+		output: child.stdin,
+		onClose: () => {
+			if (!child.killed) child.kill();
+		}
+	});
+	return {
+		transport,
+		onClose: (cb) => child.once("exit", cb),
+		dispose: () => {
+			transport.dispose();
+			if (!child.killed) child.kill();
+		}
+	};
+}
+/**
+* Spawn a `cmd-env` target against a private socket the CLI listens on, and
+* take the single connection it dials back. This is the sole role-inverted
+* case: the target dials the CLI, so we accept rather than dial. No hub /
+* acceptor is needed — just the raw post-handshake transport to splice.
+*/
+async function openAcceptOneTransport(command, env, cwd, log) {
+	const socketPath = SocketServer.allocSocketPath();
+	const token = randomBytes(16).toString("hex");
+	const server = await SocketServer.start({ endpoint: socketPath });
+	const accepted = new Promise((resolve) => {
+		server.setConnectionHandler((t) => resolve(t));
+	});
+	const child = spawnCommand(command, {
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		],
+		env: {
+			...process.env,
+			...env,
+			LINKRPC_ENDPOINT: socketPath,
+			LINKRPC_TOKEN: token
+		},
+		...cwd !== void 0 ? { cwd } : {}
+	});
+	if (log) {
+		_pipeLines(child.stdout, "target", log);
+		_pipeLines(child.stderr, "target", log);
+	}
+	let exited = false;
+	child.once("exit", () => {
+		exited = true;
+	});
+	const transport = await Promise.race([accepted, new Promise((_resolve, reject) => {
+		child.once("exit", (code) => reject(/* @__PURE__ */ new Error(`connect-as: cmd-env child exited (code ${code ?? "?"}) before connecting`)));
+	})]).catch((err) => {
+		server.dispose();
+		_unlink(socketPath);
+		if (!child.killed) child.kill();
+		throw err;
+	});
+	const dispose = () => {
+		transport.dispose();
+		server.dispose();
+		_unlink(socketPath);
+		if (!exited && !child.killed) child.kill();
+	};
+	return {
+		transport,
+		onClose: (cb) => {
+			transport.onDidClose(cb);
+			child.once("exit", cb);
+		},
+		dispose
+	};
+}
+/** Open the target-facing transport for any resolved endpoint kind. */
+function openTargetTransport(endpoint, log) {
+	switch (endpoint.kind) {
+		case "cmd-env": return openAcceptOneTransport(endpoint.command, endpoint.env, endpoint.cwd, log);
+		case "cmd-stdio": return openStdioTransport(endpoint.command, endpoint.env, endpoint.cwd, log);
+		case "ws":
+		case "socket": return openDialTransport(endpoint, endpoint.token ?? "");
 	}
-	return lines.join("\n").trimEnd();
-}
-function renderMethod(name, m) {
-	const kind = m.result === void 0 ? "notify" : "request";
-	const lines = [];
-	lines.push(`  ${kind}  ${name}`);
-	if (m.summary) lines.push(`    ${m.summary}`);
-	if (m.description) lines.push(`    ${m.description}`);
-	lines.push(`    params: ${shortSchema(m.params)}`);
-	if (m.result) lines.push(`    result: ${shortSchema(m.result)}`);
-	return lines.join("\n");
 }
-function shortSchema(s) {
-	const str = JSON.stringify(s);
-	if (str.length <= 120) return str;
-	return str.slice(0, 117) + "...";
+function _unlink(socketPath) {
+	if (process.platform === "win32") return;
+	try {
+		fs.unlinkSync(socketPath);
+	} catch {}
 }
 //#endregion
-//#region src/commands/serve.ts
+//#region src/commands/mcpForward.ts
 /**
-* `linkrpc serve <config>` — run a hub from a declarative `HubConfig` file and
-* block until interrupted. Thin CLI face over the shared `@hediet/linkrpc-hub`
-* engine, so one config format drives the CLI hub, the server hub, and the
-* VS Code extension.
+* Front door for claiming a serviceId within the connection's granted
+* namespace — interface-form `hubGrantedServiceId::register`. Same claim the
+* `tunnel` command uses.
 */
-/** Run a hub from `configPath` and resolve only when interrupted (SIGINT/SIGTERM). */
-async function serveCommand(opts) {
-	const { serveHub } = await import("@hediet/linkrpc-hub/serve");
-	await serveHub({
-		configPath: opts.configPath,
-		cmdInteractive: opts.cmdInteractive,
-		logMessages: opts.logMessages,
-		log: (line) => process.stderr.write(`linkrpc: ${line}\n`)
-	});
-}
-//#endregion
-//#region src/commands/connectAs.ts
+const CLAIM_METHOD = `${hubGrantedServiceIdInterface.info.id}::register`;
+/** Read-only connection facts — `hubGrantedServiceId::get`. */
+const INFO_METHOD = `${hubGrantedServiceIdInterface.info.id}::get`;
 /**
-* Run a **connect-as** proxy until either side closes (or {@link
-* ConnectAsDeps.stop} resolves).
+* Run a transparent MCP forwarder until stopped.
 *
-* Mints a bound token for a slot, opens the target-facing transport and the
-* hub-facing transport (which redeems the token → this connection *is* the slot
-* on the hub), and splices them message-for-message. The target thereby joins
-* the hub as a first-class participant with the slot's managed identity +
-* granted namespace, without running a local hub and without the target needing
-* to perform the hub handshake itself.
+* Serves {@link mcpForwardInterface} under `serviceId` on the hub: each inbound
+* `connect` request spawns a fresh MCP server child and shuttles raw JSON-RPC
+* frames between the child's stdio (newline-delimited JSON, the MCP stdio
+* transport framing) and the request's duplex stream. The forwarder never
+* parses MCP semantics — it only splits/joins NDJSON lines so each line becomes
+* one opaque `frame`. {@link LinkRpcConnection.enableReflection} is enabled so
+* the hub's directory can discover the service.
 *
-* Because all traffic crosses the CLI's splice point, {@link
-* ConnectAsDeps.tapTarget} yields complete `--log-messages` observability.
+* Resolves when {@link McpForwardOptions.stop} resolves (or on SIGINT/SIGTERM).
 */
-async function connectAs(deps) {
-	const token = await deps.mintToken();
-	const target = await deps.openTargetTransport();
-	let hub;
-	try {
-		hub = await deps.openHubTransport(token);
-	} catch (e) {
-		target.dispose();
-		throw e;
-	}
-	const targetTransport = deps.tapTarget ? deps.tapTarget(target.transport) : target.transport;
-	const pipe = connectTransports(targetTransport, hub.transport);
-	deps.log?.("connect-as: bridged target ⟷ hub");
-	await new Promise((resolve) => {
-		let done = false;
-		const teardown = () => {
-			if (done) return;
-			done = true;
-			pipe.dispose();
-			try {
-				target.dispose();
-			} catch {}
+async function mcpForwardCommand(opts) {
+	const log = opts.log ?? ((line) => process.stderr.write(line + "\n"));
+	const serviceId = opts.serviceId ?? await _resolveGrantedServiceId(opts.local);
+	const conn = new LinkRpcConnection(opts.local.rpcChannel);
+	conn.register(mcpForwardInterface, { connect: (_params, _ctx, stream) => _runLeg(opts.command, opts.env, stream, log) }, { serviceId });
+	conn.enableReflection({ serviceId });
+	await opts.local.channel.sendRequest(CLAIM_METHOD, { serviceId });
+	log(`mcp-forward: claimed '${serviceId}' — forwarding MCP stdio to ${_describe(opts.command)}`);
+	await (opts.stop ?? _untilSignalled$1());
+	log("mcp-forward: stopping");
+}
+/**
+* Resolve the connection's granted serviceId namespace
+* (`hubGrantedServiceId::get`) to use as the default forward prefix. Throws if
+* the namespace is empty ("claim nothing freely") — the caller must then pass an
+* explicit `--serviceId`.
+*/
+async function _resolveGrantedServiceId(local) {
+	const granted = (await local.channel.sendRequest(INFO_METHOD, {}))?.grantedServiceIdNamespace ?? "";
+	if (granted.length === 0) throw new Error("mcp-forward: this connection has no granted serviceId namespace to claim; pass an explicit --serviceId.");
+	return granted;
+}
+/**
+* One MCP session leg: spawn the child, bridge stdio<->stream, and resolve when
+* the child exits or the caller cancels (killing the child).
+*/
+function _runLeg(command, env, stream, log) {
+	return new Promise((resolve) => {
+		const child = spawnCommand(command, {
+			stdio: [
+				"pipe",
+				"pipe",
+				"inherit"
+			],
+			...env !== void 0 ? { env: {
+				...process.env,
+				...env
+			} } : {}
+		});
+		if (!child.stdin || !child.stdout) {
+			log("mcp-forward: child exposes no stdio");
+			if (!child.killed) child.kill();
+			resolve({});
+			return;
+		}
+		let settled = false;
+		const rl = readline.createInterface({ input: child.stdout });
+		const finish = () => {
+			if (settled) return;
+			settled = true;
+			rl.close();
+			if (!child.killed) child.kill();
+			resolve({});
+		};
+		rl.on("line", (line) => {
+			const trimmed = line.trim();
+			if (trimmed.length === 0) return;
+			let frame;
 			try {
-				hub.dispose();
-			} catch {}
+				frame = JSON.parse(trimmed);
+			} catch {
+				return;
+			}
+			if (stream.signal.aborted) return;
+			stream.send({ frame });
+		});
+		stream.onMessage(({ frame }) => {
+			if (!child.stdin || child.stdin.destroyed) return;
+			child.stdin.write(JSON.stringify(frame) + "\n");
+		});
+		if (stream.signal.aborted) {
+			finish();
+			return;
+		}
+		stream.signal.addEventListener("abort", finish, { once: true });
+		child.on("exit", finish);
+		child.on("error", (err) => {
+			log(`mcp-forward: child error: ${String(err)}`);
+			finish();
+		});
+	});
+}
+/** Resolve on the next `SIGINT` / `SIGTERM`. */
+function _untilSignalled$1() {
+	return new Promise((resolve) => {
+		const done = () => {
+			process.removeListener("SIGINT", done);
+			process.removeListener("SIGTERM", done);
 			resolve();
 		};
-		target.onClose(teardown);
-		hub.onClose(teardown);
-		deps.stop?.then(teardown);
+		process.once("SIGINT", done);
+		process.once("SIGTERM", done);
 	});
-	deps.log?.("connect-as: closed");
+}
+/** One-line description of the spawned command for logs. */
+function _describe(command) {
+	return "argv" in command ? command.argv.join(" ") : command.command;
+}
+//#endregion
+//#region src/commands/jsonRpcStdio.ts
+/** Expose a remote `jsonRpcConnection` service as an NDJSON stdio endpoint. */
+async function jsonRpcStdioCommand(options) {
+	const client = new LinkRpcConnection(options.local.rpcChannel).service(options.serviceId).get(jsonRpcConnectionInterface);
+	const remote = await connectRawJsonRpcTransport(client, options.params);
+	const stdio = createNdjsonJsonRpcTransport({
+		input: options.input ?? process.stdin,
+		output: options.output ?? process.stdout
+	});
+	const bridge = connectJsonRpcTransports(remote, stdio);
+	await new Promise((resolve) => {
+		let settled = false;
+		const finish = () => {
+			if (settled) return;
+			settled = true;
+			resolve();
+		};
+		remote.onClose(finish);
+		stdio.onClose(finish);
+	});
+	bridge.dispose();
+	remote.close("closed");
+	stdio.close("closed");
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/logging/logging.js
+let globalObservableLogger;
+function addLogger(logger) {
+	if (!globalObservableLogger) globalObservableLogger = logger;
+	else if (globalObservableLogger instanceof ComposedLogger) globalObservableLogger.loggers.push(logger);
+	else globalObservableLogger = new ComposedLogger([globalObservableLogger, logger]);
+}
+function getLogger() {
+	return globalObservableLogger;
+}
+let globalObservableLoggerFn = void 0;
+function setLogObservableFn(fn) {
+	globalObservableLoggerFn = fn;
+}
+function logObservable(obs) {
+	if (globalObservableLoggerFn) globalObservableLoggerFn(obs);
+}
+var ComposedLogger = class {
+	constructor(loggers) {
+		this.loggers = loggers;
+	}
+	handleObservableCreated(observable, location) {
+		for (const logger of this.loggers) logger.handleObservableCreated(observable, location);
+	}
+	handleOnListenerCountChanged(observable, newCount) {
+		for (const logger of this.loggers) logger.handleOnListenerCountChanged(observable, newCount);
+	}
+	handleObservableUpdated(observable, info) {
+		for (const logger of this.loggers) logger.handleObservableUpdated(observable, info);
+	}
+	handleAutorunCreated(autorun, location) {
+		for (const logger of this.loggers) logger.handleAutorunCreated(autorun, location);
+	}
+	handleAutorunDisposed(autorun) {
+		for (const logger of this.loggers) logger.handleAutorunDisposed(autorun);
+	}
+	handleAutorunDependencyChanged(autorun, observable, change) {
+		for (const logger of this.loggers) logger.handleAutorunDependencyChanged(autorun, observable, change);
+	}
+	handleAutorunStarted(autorun) {
+		for (const logger of this.loggers) logger.handleAutorunStarted(autorun);
+	}
+	handleAutorunFinished(autorun) {
+		for (const logger of this.loggers) logger.handleAutorunFinished(autorun);
+	}
+	handleDerivedDependencyChanged(derived, observable, change) {
+		for (const logger of this.loggers) logger.handleDerivedDependencyChanged(derived, observable, change);
+	}
+	handleDerivedCleared(observable) {
+		for (const logger of this.loggers) logger.handleDerivedCleared(observable);
+	}
+	handleBeginTransaction(transaction) {
+		for (const logger of this.loggers) logger.handleBeginTransaction(transaction);
+	}
+	handleEndTransaction(transaction) {
+		for (const logger of this.loggers) logger.handleEndTransaction(transaction);
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/debugLocation.js
+var DebugLocation;
+(function(DebugLocation) {
+	let enabled = false;
+	function enable() {
+		enabled = true;
+	}
+	DebugLocation.enable = enable;
+	function ofCaller() {
+		return ofNthCaller(1);
+	}
+	DebugLocation.ofCaller = ofCaller;
+	function ofNthCaller(n) {
+		if (!enabled) return;
+		const Err = Error;
+		const l = Err.stackTraceLimit;
+		Err.stackTraceLimit = 3;
+		const stack = (/* @__PURE__ */ new Error()).stack;
+		Err.stackTraceLimit = l;
+		return DebugLocationImpl.fromStack(stack, n + 1);
+	}
+	DebugLocation.ofNthCaller = ofNthCaller;
+})(DebugLocation || (DebugLocation = {}));
+var DebugLocationImpl = class DebugLocationImpl {
+	static fromStack(stack, parentIdx) {
+		const location = parseLine(stack.split("\n")[parentIdx + 1]);
+		if (location) return new DebugLocationImpl(location.fileName, location.line, location.column, location.id);
+		else return;
+	}
+	constructor(fileName, line, column, id) {
+		this.fileName = fileName;
+		this.line = line;
+		this.column = column;
+		this.id = id;
+	}
+};
+function parseLine(stackLine) {
+	if (!stackLine) return;
+	const match = stackLine.match(/\((.*):(\d+):(\d+)\)/);
+	if (match) return {
+		fileName: match[1],
+		line: parseInt(match[2]),
+		column: parseInt(match[3]),
+		id: stackLine
+	};
+	const match2 = stackLine.match(/at ([^\(\)]*):(\d+):(\d+)/);
+	if (match2) return {
+		fileName: match2[1],
+		line: parseInt(match2[2]),
+		column: parseInt(match2[3]),
+		id: stackLine
+	};
 }
 //#endregion
-//#region src/commands/connectAsTransports.ts
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/debugName.js
+var DebugNameData = class {
+	constructor(owner, debugNameSource, referenceFn) {
+		this.owner = owner;
+		this.debugNameSource = debugNameSource;
+		this.referenceFn = referenceFn;
+	}
+	getDebugName(target) {
+		return getDebugName(target, this);
+	}
+};
+const countPerName = /* @__PURE__ */ new Map();
+const cachedDebugName = /* @__PURE__ */ new WeakMap();
+function getDebugName(target, data) {
+	const cached = cachedDebugName.get(target);
+	if (cached) return cached;
+	const dbgName = computeDebugName(target, data);
+	if (dbgName) {
+		let count = countPerName.get(dbgName) ?? 0;
+		count++;
+		countPerName.set(dbgName, count);
+		const result = count === 1 ? dbgName : `${dbgName}#${count}`;
+		cachedDebugName.set(target, result);
+		return result;
+	}
+}
+function computeDebugName(self, data) {
+	const cached = cachedDebugName.get(self);
+	if (cached) return cached;
+	const ownerStr = data.owner ? formatOwner(data.owner) + `.` : "";
+	let result;
+	const debugNameSource = data.debugNameSource;
+	if (debugNameSource !== void 0) {
+		if (typeof debugNameSource === "function") {
+			result = debugNameSource();
+			if (result !== void 0) return ownerStr + result;
+		} else return ownerStr + debugNameSource;
+	}
+	const referenceFn = data.referenceFn;
+	if (referenceFn !== void 0) {
+		result = getFunctionName(referenceFn);
+		if (result !== void 0) return ownerStr + result;
+	}
+	if (data.owner !== void 0) {
+		const key = findKey(data.owner, self);
+		if (key !== void 0) return ownerStr + key;
+	}
+}
+function findKey(obj, value) {
+	for (const key in obj) if (obj[key] === value) return key;
+}
+const countPerClassName = /* @__PURE__ */ new Map();
+const ownerId = /* @__PURE__ */ new WeakMap();
+function formatOwner(owner) {
+	const id = ownerId.get(owner);
+	if (id) return id;
+	const className = getClassName(owner) ?? "Object";
+	let count = countPerClassName.get(className) ?? 0;
+	count++;
+	countPerClassName.set(className, count);
+	const result = count === 1 ? className : `${className}#${count}`;
+	ownerId.set(owner, result);
+	return result;
+}
+function getClassName(obj) {
+	const ctor = obj.constructor;
+	if (ctor) {
+		if (ctor.name === "Object") return;
+		return ctor.name;
+	}
+}
+function getFunctionName(fn) {
+	const fnSrc = fn.toString();
+	const match = /\/\*\*\s*@description\s*([^*]*)\*\//.exec(fnSrc);
+	return (match ? match[1] : void 0)?.trim();
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/observables/baseObservable.js
+let _derived;
 /**
-* Dial a ws / socket endpoint as a client, presenting `token` in the
-* `hubrpc::initialize` handshake. Used for the hub-facing side (with the minted
-* bound token) and for ws / socket / uri targets (with the target's own token).
+* @internal
+* This is to allow splitting files.
 */
-async function openDialTransport(spec, token) {
-	if (spec.kind === "ws") {
-		const ws = await openWebSocket(spec.url);
-		const closeWs = () => {
+function _setDerivedOpts(derived) {
+	_derived = derived;
+}
+let _recomputeInitiallyAndOnChange;
+function _setRecomputeInitiallyAndOnChange(recomputeInitiallyAndOnChange) {
+	_recomputeInitiallyAndOnChange = recomputeInitiallyAndOnChange;
+}
+let _keepObserved;
+function _setKeepObserved(keepObserved) {
+	_keepObserved = keepObserved;
+}
+let _debugGetDependencyGraph;
+function _setDebugGetDependencyGraph(debugGetDependencyGraph) {
+	_debugGetDependencyGraph = debugGetDependencyGraph;
+}
+var ConvenientObservable = class {
+	get TChange() {
+		return null;
+	}
+	reportChanges() {
+		this.get();
+	}
+	/** @sealed */
+	read(reader) {
+		if (reader) return reader.readObservable(this);
+		else return this.get();
+	}
+	map(fnOrOwner, fnOrUndefined, debugLocation = DebugLocation.ofCaller()) {
+		const owner = fnOrUndefined === void 0 ? void 0 : fnOrOwner;
+		const fn = fnOrUndefined === void 0 ? fnOrOwner : fnOrUndefined;
+		return _derived({
+			owner,
+			debugName: () => {
+				const name = getFunctionName(fn);
+				if (name !== void 0) return name;
+				const match = /^\s*\(?\s*([a-zA-Z_$][a-zA-Z_$0-9]*)\s*\)?\s*=>\s*\1(?:\??)\.([a-zA-Z_$][a-zA-Z_$0-9]*)\s*$/.exec(fn.toString());
+				if (match) return `${this.debugName}.${match[2]}`;
+				if (!owner) return `${this.debugName} (mapped)`;
+			},
+			debugReferenceFn: fn
+		}, (reader) => fn(this.read(reader), reader), debugLocation);
+	}
+	/**
+	* @sealed
+	* Converts an observable of an observable value into a direct observable of the value.
+	*/
+	flatten() {
+		return _derived({
+			owner: void 0,
+			debugName: () => `${this.debugName} (flattened)`
+		}, (reader) => this.read(reader).read(reader));
+	}
+	recomputeInitiallyAndOnChange(store, handleValue) {
+		store.add(_recomputeInitiallyAndOnChange(this, handleValue));
+		return this;
+	}
+	/**
+	* Ensures that this observable is observed. This keeps the cache alive.
+	* However, in case of deriveds, it does not force eager evaluation (only when the value is read/get).
+	* Use `recomputeInitiallyAndOnChange` for eager evaluation.
+	*/
+	keepObserved(store) {
+		store.add(_keepObserved(this));
+		return this;
+	}
+	get debugValue() {
+		return this.get();
+	}
+	debugGetDependencyGraph() {
+		return _debugGetDependencyGraph(this);
+	}
+};
+var BaseObservable = class extends ConvenientObservable {
+	constructor(debugLocation) {
+		super();
+		this._observers = /* @__PURE__ */ new Set();
+		getLogger()?.handleObservableCreated(this, debugLocation);
+	}
+	addObserver(observer) {
+		const len = this._observers.size;
+		this._observers.add(observer);
+		if (len === 0) this.onFirstObserverAdded();
+		if (len !== this._observers.size) getLogger()?.handleOnListenerCountChanged(this, this._observers.size);
+	}
+	removeObserver(observer) {
+		const deleted = this._observers.delete(observer);
+		if (deleted && this._observers.size === 0) this.onLastObserverRemoved();
+		if (deleted) getLogger()?.handleOnListenerCountChanged(this, this._observers.size);
+	}
+	onFirstObserverAdded() {}
+	onLastObserverRemoved() {}
+	log() {
+		const hadLogger = !!getLogger();
+		logObservable(this);
+		if (!hadLogger) getLogger()?.handleObservableCreated(this, DebugLocation.ofCaller());
+		return this;
+	}
+	debugGetObservers() {
+		return this._observers;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/commonFacade/deps.js
+function toDisposable(fn) {
+	return { dispose: fn };
+}
+var BugIndicatingError = class BugIndicatingError extends Error {
+	constructor(message) {
+		super(message || "An unexpected bug occurred.");
+		Object.setPrototypeOf(this, BugIndicatingError.prototype);
+	}
+};
+function onBugIndicatingError(error) {
+	throw error;
+}
+function onUnexpectedError(error) {
+	console.error("Unexpected error:", error);
+}
+/**
+* Compares two items for equality using strict equality.
+*/
+const strictEquals = (a, b) => a === b;
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/disposables.js
+var DisposableStore = class {
+	constructor() {
+		this.disposables = [];
+		this._isDisposed = false;
+	}
+	get isDisposed() {
+		return this._isDisposed;
+	}
+	dispose() {
+		this.clear();
+		this._isDisposed = true;
+	}
+	add(disposable) {
+		if (disposable) this.disposables.push(disposable);
+		return disposable;
+	}
+	remove(disposable) {
+		if (!disposable) return disposable;
+		const index = this.disposables.indexOf(disposable);
+		if (index !== -1) this.disposables.splice(index, 1);
+		return disposable;
+	}
+	clear() {
+		for (const disposable of this.disposables) disposable.dispose();
+		this.disposables = [];
+	}
+	leakItems() {
+		this.disposables = [];
+	}
+};
+var Disposable = class {
+	constructor() {
+		this._store = new DisposableStore();
+	}
+	dispose() {
+		this._store.dispose();
+	}
+	_register(t) {
+		this._store.add(t);
+		return t;
+	}
+	_registerOrDispose(t) {
+		if (t) {
+			if (this._store.isDisposed) t.dispose();
+			else this._store.add(t);
+		}
+		return t;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/observables/derivedImpl.js
+function derivedStateToString(state) {
+	switch (state) {
+		case 0: return "initial";
+		case 1: return "dependenciesMightHaveChanged";
+		case 2: return "stale";
+		case 3: return "upToDate";
+		default: return "<unknown>";
+	}
+}
+var Derived = class extends BaseObservable {
+	get debugName() {
+		return this._debugNameData.getDebugName(this) ?? "(anonymous)";
+	}
+	constructor(_debugNameData, _computeFn, _changeTracker, _handleLastObserverRemoved = void 0, _equalityComparator, debugLocation) {
+		super(debugLocation);
+		this._debugNameData = _debugNameData;
+		this._computeFn = _computeFn;
+		this._changeTracker = _changeTracker;
+		this._handleLastObserverRemoved = _handleLastObserverRemoved;
+		this._equalityComparator = _equalityComparator;
+		this._state = 0;
+		this._value = void 0;
+		this._updateCount = 0;
+		this._dependencies = /* @__PURE__ */ new Set();
+		this._dependenciesToBeRemoved = /* @__PURE__ */ new Set();
+		this._changeSummary = void 0;
+		this._isUpdating = false;
+		this._isComputing = false;
+		this._didReportChange = false;
+		this._isInBeforeUpdate = false;
+		this._isReaderValid = false;
+		this._store = void 0;
+		this._delayedStore = void 0;
+		this._removedObserverToCallEndUpdateOn = null;
+		this._changeSummary = this._changeTracker?.createChangeSummary(void 0);
+	}
+	onLastObserverRemoved() {
+		/**
+		* We are not tracking changes anymore, thus we have to assume
+		* that our cache is invalid.
+		*/
+		this._state = 0;
+		this._value = void 0;
+		getLogger()?.handleDerivedCleared(this);
+		for (const d of this._dependencies) d.removeObserver(this);
+		this._dependencies.clear();
+		if (this._store !== void 0) {
+			this._store.dispose();
+			this._store = void 0;
+		}
+		if (this._delayedStore !== void 0) {
+			this._delayedStore.dispose();
+			this._delayedStore = void 0;
+		}
+		this._handleLastObserverRemoved?.();
+	}
+	get() {
+		if (this._isComputing && false);
+		if (this._observers.size === 0) {
+			let result;
 			try {
-				ws.close();
-			} catch {}
-		};
-		const transport = new WebSocketTransport(ws, closeWs);
+				this._isReaderValid = true;
+				let changeSummary = void 0;
+				if (this._changeTracker) {
+					changeSummary = this._changeTracker.createChangeSummary(void 0);
+					this._changeTracker.beforeUpdate?.(this, changeSummary);
+				}
+				result = this._computeFn(this, changeSummary);
+			} finally {
+				this._isReaderValid = false;
+			}
+			this.onLastObserverRemoved();
+			return result;
+		} else {
+			do {
+				if (this._state === 1) for (const d of this._dependencies) {
+					/** might call {@link handleChange} indirectly, which could make us stale */
+					d.reportChanges();
+					if (this._state === 2) break;
+				}
+				if (this._state === 1) this._state = 3;
+				if (this._state !== 3) this._recompute();
+			} while (this._state !== 3);
+			return this._value;
+		}
+	}
+	_recompute() {
+		let didChange = false;
+		this._isComputing = true;
+		this._didReportChange = false;
+		const emptySet = this._dependenciesToBeRemoved;
+		this._dependenciesToBeRemoved = this._dependencies;
+		this._dependencies = emptySet;
 		try {
-			await runInitializeHandshake(transport, {
-				kind: "client",
-				token
+			const changeSummary = this._changeSummary;
+			this._isReaderValid = true;
+			if (this._changeTracker) {
+				this._isInBeforeUpdate = true;
+				this._changeTracker.beforeUpdate?.(this, changeSummary);
+				this._isInBeforeUpdate = false;
+				this._changeSummary = this._changeTracker?.createChangeSummary(changeSummary);
+			}
+			const hadValue = this._state !== 0;
+			const oldValue = this._value;
+			this._state = 3;
+			const delayedStore = this._delayedStore;
+			if (delayedStore !== void 0) this._delayedStore = void 0;
+			try {
+				if (this._store !== void 0) {
+					this._store.dispose();
+					this._store = void 0;
+				}
+				/** might call {@link handleChange} indirectly, which could invalidate us */
+				this._value = this._computeFn(this, changeSummary);
+			} finally {
+				this._isReaderValid = false;
+				for (const o of this._dependenciesToBeRemoved) o.removeObserver(this);
+				this._dependenciesToBeRemoved.clear();
+				if (delayedStore !== void 0) delayedStore.dispose();
+			}
+			didChange = this._didReportChange || hadValue && !this._equalityComparator(oldValue, this._value);
+			getLogger()?.handleObservableUpdated(this, {
+				oldValue,
+				newValue: this._value,
+				change: void 0,
+				didChange,
+				hadValue
 			});
-		} catch (err) {
-			transport.dispose();
-			closeWs();
-			throw err;
+		} catch (e) {
+			onBugIndicatingError(e);
 		}
-		return {
-			transport,
-			onClose: (cb) => ws.addEventListener("close", () => cb()),
-			dispose: () => {
-				transport.dispose();
-				closeWs();
+		this._isComputing = false;
+		if (!this._didReportChange && didChange) for (const r of this._observers) r.handleChange(this, void 0);
+		else this._didReportChange = false;
+	}
+	toString() {
+		return `LazyDerived<${this.debugName}>`;
+	}
+	beginUpdate(_observable) {
+		if (this._isUpdating) throw new BugIndicatingError("Cyclic deriveds are not supported yet!");
+		this._updateCount++;
+		this._isUpdating = true;
+		try {
+			const propagateBeginUpdate = this._updateCount === 1;
+			if (this._state === 3) {
+				this._state = 1;
+				if (!propagateBeginUpdate) for (const r of this._observers) r.handlePossibleChange(this);
 			}
-		};
+			if (propagateBeginUpdate) for (const r of this._observers) r.beginUpdate(this);
+		} finally {
+			this._isUpdating = false;
+		}
 	}
-	const socket = net.createConnection(spec.path);
-	const { transport } = await connectNdjson({
-		input: socket,
-		output: socket,
-		onClose: () => socket.destroy(),
-		initialize: {
-			kind: "client",
-			token
+	endUpdate(_observable) {
+		this._updateCount--;
+		if (this._updateCount === 0) {
+			const observers = [...this._observers];
+			for (const r of observers) r.endUpdate(this);
+			if (this._removedObserverToCallEndUpdateOn) {
+				const observers = [...this._removedObserverToCallEndUpdateOn];
+				this._removedObserverToCallEndUpdateOn = null;
+				for (const r of observers) r.endUpdate(this);
+			}
 		}
-	});
-	return {
-		transport,
-		onClose: (cb) => socket.on("close", cb),
-		dispose: () => socket.destroy()
-	};
+	}
+	handlePossibleChange(observable) {
+		if (this._state === 3 && this._dependencies.has(observable) && !this._dependenciesToBeRemoved.has(observable)) {
+			this._state = 1;
+			for (const r of this._observers) r.handlePossibleChange(this);
+		}
+	}
+	handleChange(observable, change) {
+		if (this._dependencies.has(observable) && !this._dependenciesToBeRemoved.has(observable) || this._isInBeforeUpdate) {
+			getLogger()?.handleDerivedDependencyChanged(this, observable, change);
+			let shouldReact = false;
+			try {
+				shouldReact = this._changeTracker ? this._changeTracker.handleChange({
+					changedObservable: observable,
+					change,
+					didChange: (o) => o === observable
+				}, this._changeSummary) : true;
+			} catch (e) {
+				onBugIndicatingError(e);
+			}
+			const wasUpToDate = this._state === 3;
+			if (shouldReact && (this._state === 1 || wasUpToDate)) {
+				this._state = 2;
+				if (wasUpToDate) for (const r of this._observers) r.handlePossibleChange(this);
+			}
+		}
+	}
+	_ensureReaderValid() {
+		if (!this._isReaderValid) throw new BugIndicatingError("The reader object cannot be used outside its compute function!");
+	}
+	readObservable(observable) {
+		this._ensureReaderValid();
+		observable.addObserver(this);
+		/** This might call {@link handleChange} indirectly, which could invalidate us */
+		const value = observable.get();
+		this._dependencies.add(observable);
+		this._dependenciesToBeRemoved.delete(observable);
+		return value;
+	}
+	reportChange(change) {
+		this._ensureReaderValid();
+		this._didReportChange = true;
+		for (const r of this._observers) r.handleChange(this, change);
+	}
+	get store() {
+		this._ensureReaderValid();
+		if (this._store === void 0) this._store = new DisposableStore();
+		return this._store;
+	}
+	get delayedStore() {
+		this._ensureReaderValid();
+		if (this._delayedStore === void 0) this._delayedStore = new DisposableStore();
+		return this._delayedStore;
+	}
+	addObserver(observer) {
+		const shouldCallBeginUpdate = !this._observers.has(observer) && this._updateCount > 0;
+		super.addObserver(observer);
+		if (shouldCallBeginUpdate) {
+			if (this._removedObserverToCallEndUpdateOn && this._removedObserverToCallEndUpdateOn.has(observer)) this._removedObserverToCallEndUpdateOn.delete(observer);
+			else observer.beginUpdate(this);
+		}
+	}
+	removeObserver(observer) {
+		if (this._observers.has(observer) && this._updateCount > 0) {
+			if (!this._removedObserverToCallEndUpdateOn) this._removedObserverToCallEndUpdateOn = /* @__PURE__ */ new Set();
+			this._removedObserverToCallEndUpdateOn.add(observer);
+		}
+		super.removeObserver(observer);
+	}
+	debugGetState() {
+		return {
+			state: this._state,
+			stateStr: derivedStateToString(this._state),
+			updateCount: this._updateCount,
+			isComputing: this._isComputing,
+			dependencies: this._dependencies,
+			value: this._value
+		};
+	}
+	debugSetValue(newValue) {
+		this._value = newValue;
+	}
+	debugRecompute() {
+		if (!this._isComputing) this._recompute();
+		else this._state = 2;
+	}
+	setValue(newValue, tx, change) {
+		this._value = newValue;
+		const observers = this._observers;
+		tx.updateObserver(this, this);
+		for (const d of observers) d.handleChange(this, change);
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/observables/derived.js
+function derived(computeFnOrOwner, computeFn, debugLocation = DebugLocation.ofCaller()) {
+	if (computeFn !== void 0) return new Derived(new DebugNameData(computeFnOrOwner, void 0, computeFn), computeFn, void 0, void 0, strictEquals, debugLocation);
+	return new Derived(new DebugNameData(void 0, void 0, computeFnOrOwner), computeFnOrOwner, void 0, void 0, strictEquals, debugLocation);
 }
-/** Forward a child stream's lines to `log`, prefixed with `label`. */
-function _pipeLines(stream, label, log) {
-	if (!stream) return;
-	stream.setEncoding("utf8");
-	stream.on("data", (chunk) => {
-		for (const line of chunk.split(/\r?\n/)) if (line.length > 0) log(`[${label}] ${line}`);
-	});
+function derivedOpts(options, computeFn, debugLocation = DebugLocation.ofCaller()) {
+	return new Derived(new DebugNameData(options.owner, options.debugName, options.debugReferenceFn), computeFn, void 0, options.onLastObserverRemoved, options.equalsFn ?? strictEquals, debugLocation);
 }
-/** Spawn a `cmd-stdio` target and talk linkrpc over its stdin/stdout. */
-async function openStdioTransport(command, env, cwd, log) {
-	const child = spawnCommand(command, {
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		],
-		...env !== void 0 ? { env: {
-			...process.env,
-			...env
-		} } : {},
-		...cwd !== void 0 ? { cwd } : {}
-	});
-	if (!child.stdin || !child.stdout) throw new Error("connect-as: cmd-stdio child exposes no stdio");
-	if (log) _pipeLines(child.stderr, "target", log);
-	const { transport } = await connectNdjson({
-		input: child.stdout,
-		output: child.stdin,
-		onClose: () => {
-			if (!child.killed) child.kill();
+_setDerivedOpts(derivedOpts);
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/reactions/createEffectImpl.js
+function autorunStateToString(state) {
+	switch (state) {
+		case 1: return "dependenciesMightHaveChanged";
+		case 2: return "stale";
+		case 3: return "upToDate";
+		default: return "<unknown>";
+	}
+}
+var AutorunObserver = class {
+	get debugName() {
+		return this._debugNameData.getDebugName(this) ?? "(anonymous)";
+	}
+	constructor(_debugNameData, _runFn, _changeTracker, debugLocation) {
+		this._debugNameData = _debugNameData;
+		this._runFn = _runFn;
+		this._changeTracker = _changeTracker;
+		this._state = 2;
+		this._updateCount = 0;
+		this._disposed = false;
+		this._dependencies = /* @__PURE__ */ new Set();
+		this._dependenciesToBeRemoved = /* @__PURE__ */ new Set();
+		this._isRunning = false;
+		this._store = void 0;
+		this._delayedStore = void 0;
+		this._changeSummary = this._changeTracker?.createChangeSummary(void 0);
+		getLogger()?.handleAutorunCreated(this, debugLocation);
+		this._run();
+	}
+	dispose() {
+		if (this._disposed) return;
+		this._disposed = true;
+		for (const o of this._dependencies) o.removeObserver(this);
+		this._dependencies.clear();
+		if (this._store !== void 0) this._store.dispose();
+		if (this._delayedStore !== void 0) this._delayedStore.dispose();
+		getLogger()?.handleAutorunDisposed(this);
+	}
+	_run() {
+		const emptySet = this._dependenciesToBeRemoved;
+		this._dependenciesToBeRemoved = this._dependencies;
+		this._dependencies = emptySet;
+		this._state = 3;
+		try {
+			if (!this._disposed) {
+				getLogger()?.handleAutorunStarted(this);
+				const changeSummary = this._changeSummary;
+				const delayedStore = this._delayedStore;
+				if (delayedStore !== void 0) this._delayedStore = void 0;
+				try {
+					this._isRunning = true;
+					if (this._changeTracker) {
+						this._changeTracker.beforeUpdate?.(this, changeSummary);
+						this._changeSummary = this._changeTracker.createChangeSummary(changeSummary);
+					}
+					if (this._store !== void 0) {
+						this._store.dispose();
+						this._store = void 0;
+					}
+					this._runFn(this, changeSummary);
+				} catch (e) {
+					onBugIndicatingError(e);
+				} finally {
+					this._isRunning = false;
+					if (delayedStore !== void 0) delayedStore.dispose();
+				}
+			}
+		} finally {
+			if (!this._disposed) getLogger()?.handleAutorunFinished(this);
+			for (const o of this._dependenciesToBeRemoved) o.removeObserver(this);
+			this._dependenciesToBeRemoved.clear();
 		}
-	});
-	return {
-		transport,
-		onClose: (cb) => child.once("exit", cb),
-		dispose: () => {
-			transport.dispose();
-			if (!child.killed) child.kill();
+	}
+	toString() {
+		return `Autorun<${this.debugName}>`;
+	}
+	beginUpdate(_observable) {
+		if (this._state === 3) this._state = 1;
+		this._updateCount++;
+	}
+	endUpdate(_observable) {
+		try {
+			if (this._updateCount === 1) do {
+				if (this._state === 1) {
+					this._state = 3;
+					for (const d of this._dependencies) {
+						d.reportChanges();
+						if (this._state === 2) break;
+					}
+				}
+				if (this._state !== 3) this._run();
+			} while (this._state !== 3);
+		} finally {
+			this._updateCount--;
 		}
-	};
-}
-/**
-* Spawn a `cmd-env` target against a private socket the CLI listens on, and
-* take the single connection it dials back. This is the sole role-inverted
-* case: the target dials the CLI, so we accept rather than dial. No hub /
-* acceptor is needed — just the raw post-handshake transport to splice.
-*/
-async function openAcceptOneTransport(command, env, cwd, log) {
-	const socketPath = SocketServer.allocSocketPath();
-	const token = randomBytes(16).toString("hex");
-	const server = await SocketServer.start({ endpoint: socketPath });
-	const accepted = new Promise((resolve) => {
-		server.setConnectionHandler((t) => resolve(t));
-	});
-	const child = spawnCommand(command, {
-		stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		],
-		env: {
-			...process.env,
-			...env,
-			LINKRPC_ENDPOINT: socketPath,
-			LINKRPC_TOKEN: token
-		},
-		...cwd !== void 0 ? { cwd } : {}
-	});
-	if (log) {
-		_pipeLines(child.stdout, "target", log);
-		_pipeLines(child.stderr, "target", log);
 	}
-	let exited = false;
-	child.once("exit", () => {
-		exited = true;
-	});
-	const transport = await Promise.race([accepted, new Promise((_resolve, reject) => {
-		child.once("exit", (code) => reject(/* @__PURE__ */ new Error(`connect-as: cmd-env child exited (code ${code ?? "?"}) before connecting`)));
-	})]).catch((err) => {
-		server.dispose();
-		_unlink(socketPath);
-		if (!child.killed) child.kill();
-		throw err;
-	});
-	const dispose = () => {
-		transport.dispose();
-		server.dispose();
-		_unlink(socketPath);
-		if (!exited && !child.killed) child.kill();
-	};
-	return {
-		transport,
-		onClose: (cb) => {
-			transport.onDidClose(cb);
-			child.once("exit", cb);
-		},
-		dispose
-	};
-}
-/** Open the target-facing transport for any resolved endpoint kind. */
-function openTargetTransport(endpoint, log) {
-	switch (endpoint.kind) {
-		case "cmd-env": return openAcceptOneTransport(endpoint.command, endpoint.env, endpoint.cwd, log);
-		case "cmd-stdio": return openStdioTransport(endpoint.command, endpoint.env, endpoint.cwd, log);
-		case "ws":
-		case "socket": return openDialTransport(endpoint, endpoint.token ?? "");
+	handlePossibleChange(observable) {
+		if (this._state === 3 && this._isDependency(observable)) this._state = 1;
+	}
+	handleChange(observable, change) {
+		if (this._isDependency(observable)) {
+			getLogger()?.handleAutorunDependencyChanged(this, observable, change);
+			try {
+				if (this._changeTracker ? this._changeTracker.handleChange({
+					changedObservable: observable,
+					change,
+					didChange: (o) => o === observable
+				}, this._changeSummary) : true) this._state = 2;
+			} catch (e) {
+				onBugIndicatingError(e);
+			}
+		}
 	}
-}
-function _unlink(socketPath) {
-	if (process.platform === "win32") return;
-	try {
-		fs.unlinkSync(socketPath);
-	} catch {}
-}
+	_isDependency(observable) {
+		return this._dependencies.has(observable) && !this._dependenciesToBeRemoved.has(observable);
+	}
+	_ensureNoRunning() {
+		if (!this._isRunning) throw new BugIndicatingError("The reader object cannot be used outside its compute function!");
+	}
+	readObservable(observable) {
+		this._ensureNoRunning();
+		if (this._disposed) return observable.get();
+		observable.addObserver(this);
+		const value = observable.get();
+		this._dependencies.add(observable);
+		this._dependenciesToBeRemoved.delete(observable);
+		return value;
+	}
+	get store() {
+		this._ensureNoRunning();
+		if (this._disposed) throw new BugIndicatingError("Cannot access store after dispose");
+		if (this._store === void 0) this._store = new DisposableStore();
+		return this._store;
+	}
+	get delayedStore() {
+		this._ensureNoRunning();
+		if (this._disposed) throw new BugIndicatingError("Cannot access store after dispose");
+		if (this._delayedStore === void 0) this._delayedStore = new DisposableStore();
+		return this._delayedStore;
+	}
+	debugGetState() {
+		return {
+			isRunning: this._isRunning,
+			updateCount: this._updateCount,
+			dependencies: this._dependencies,
+			state: this._state,
+			stateStr: autorunStateToString(this._state)
+		};
+	}
+	debugRerun() {
+		if (!this._isRunning) this._run();
+		else this._state = 2;
+	}
+};
 //#endregion
-//#region src/commands/mcpForward.ts
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/reactions/createEffect.js
 /**
-* Front door for claiming a serviceId within the connection's granted
-* namespace — interface-form `hubGrantedServiceId::register`. Same claim the
-* `tunnel` command uses.
+* Runs immediately and whenever a transaction ends and an observed observable changed.
+* {@link fn} should start with a JS Doc using `@description` to name the effect.
 */
-const CLAIM_METHOD = `${hubGrantedServiceIdInterface.info.id}::register`;
-/** Read-only connection facts — `hubGrantedServiceId::get`. */
-const INFO_METHOD = `${hubGrantedServiceIdInterface.info.id}::get`;
+function createEffect(fn, debugLocation = DebugLocation.ofCaller()) {
+	return new AutorunObserver(new DebugNameData(void 0, void 0, fn), fn, void 0, debugLocation);
+}
 /**
-* Run a transparent MCP forwarder until stopped.
-*
-* Serves {@link mcpForwardInterface} under `serviceId` on the hub: each inbound
-* `connect` request spawns a fresh MCP server child and shuttles raw JSON-RPC
-* frames between the child's stdio (newline-delimited JSON, the MCP stdio
-* transport framing) and the request's duplex stream. The forwarder never
-* parses MCP semantics — it only splits/joins NDJSON lines so each line becomes
-* one opaque `frame`. {@link LinkRpcConnection.enableReflection} is enabled so
-* the hub's directory can discover the service.
-*
-* Resolves when {@link McpForwardOptions.stop} resolves (or on SIGINT/SIGTERM).
+* @deprecated Use {@link createEffect} instead.
 */
-async function mcpForwardCommand(opts) {
-	const log = opts.log ?? ((line) => process.stderr.write(line + "\n"));
-	const serviceId = opts.serviceId ?? await _resolveGrantedServiceId(opts.local);
-	const conn = new LinkRpcConnection(opts.local.rpcChannel);
-	conn.register(mcpForwardInterface, { connect: (_params, _ctx, stream) => _runLeg(opts.command, opts.env, stream, log) }, { serviceId });
-	conn.enableReflection({ serviceId });
-	await opts.local.channel.sendRequest(CLAIM_METHOD, { serviceId });
-	log(`mcp-forward: claimed '${serviceId}' — forwarding MCP stdio to ${_describe(opts.command)}`);
-	await (opts.stop ?? _untilSignalled$1());
-	log("mcp-forward: stopping");
+const autorun = createEffect;
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/base.js
+/**
+* This function is used to indicate that the caller recovered from an error that indicates a bug.
+*/
+function handleBugIndicatingErrorRecovery(message) {
+	const err = /* @__PURE__ */ new Error("BugIndicatingErrorRecovery: " + message);
+	onUnexpectedError(err);
+	console.error("recovered from an error that indicates a bug", err);
 }
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/transaction.js
 /**
-* Resolve the connection's granted serviceId namespace
-* (`hubGrantedServiceId::get`) to use as the default forward prefix. Throws if
-* the namespace is empty ("claim nothing freely") — the caller must then pass an
-* explicit `--serviceId`.
+* Starts a transaction in which many observables can be changed at once.
+* {@link fn} should start with a JS Doc using `@description` to give the transaction a debug name.
+* Reaction run on demand or when the transaction ends.
 */
-async function _resolveGrantedServiceId(local) {
-	const granted = (await local.channel.sendRequest(INFO_METHOD, {}))?.grantedServiceIdNamespace ?? "";
-	if (granted.length === 0) throw new Error("mcp-forward: this connection has no granted serviceId namespace to claim; pass an explicit --serviceId.");
-	return granted;
+function transaction(fn, getDebugName) {
+	const tx = new TransactionImpl(fn, getDebugName);
+	try {
+		fn(tx);
+	} finally {
+		tx.finish();
+	}
 }
 /**
-* One MCP session leg: spawn the child, bridge stdio<->stream, and resolve when
-* the child exits or the caller cancels (killing the child).
+* Allows to chain transactions.
 */
-function _runLeg(command, env, stream, log) {
-	return new Promise((resolve) => {
-		const child = spawnCommand(command, {
-			stdio: [
-				"pipe",
-				"pipe",
-				"inherit"
-			],
-			...env !== void 0 ? { env: {
-				...process.env,
-				...env
-			} } : {}
-		});
-		if (!child.stdin || !child.stdout) {
-			log("mcp-forward: child exposes no stdio");
-			if (!child.killed) child.kill();
-			resolve({});
+function subtransaction(tx, fn, getDebugName) {
+	if (!tx) transaction(fn, getDebugName);
+	else fn(tx);
+}
+var TransactionImpl = class {
+	constructor(_fn, _getDebugName) {
+		this._fn = _fn;
+		this._getDebugName = _getDebugName;
+		this._updatingObservers = [];
+		getLogger()?.handleBeginTransaction(this);
+	}
+	getDebugName() {
+		if (this._getDebugName) return this._getDebugName();
+		return getFunctionName(this._fn);
+	}
+	updateObserver(observer, observable) {
+		if (!this._updatingObservers) {
+			handleBugIndicatingErrorRecovery("Transaction already finished!");
+			transaction((tx) => {
+				tx.updateObserver(observer, observable);
+			});
 			return;
 		}
-		let settled = false;
-		const rl = readline.createInterface({ input: child.stdout });
-		const finish = () => {
-			if (settled) return;
-			settled = true;
-			rl.close();
-			if (!child.killed) child.kill();
-			resolve({});
-		};
-		rl.on("line", (line) => {
-			const trimmed = line.trim();
-			if (trimmed.length === 0) return;
-			let frame;
-			try {
-				frame = JSON.parse(trimmed);
-			} catch {
-				return;
-			}
-			if (stream.signal.aborted) return;
-			stream.send({ frame });
-		});
-		stream.onMessage(({ frame }) => {
-			if (!child.stdin || child.stdin.destroyed) return;
-			child.stdin.write(JSON.stringify(frame) + "\n");
+		this._updatingObservers.push({
+			observer,
+			observable
 		});
-		if (stream.signal.aborted) {
-			finish();
+		observer.beginUpdate(observable);
+	}
+	finish() {
+		const updatingObservers = this._updatingObservers;
+		if (!updatingObservers) {
+			handleBugIndicatingErrorRecovery("transaction.finish() has already been called!");
 			return;
 		}
-		stream.signal.addEventListener("abort", finish, { once: true });
-		child.on("exit", finish);
-		child.on("error", (err) => {
-			log(`mcp-forward: child error: ${String(err)}`);
-			finish();
+		for (let i = 0; i < updatingObservers.length; i++) {
+			const { observer, observable } = updatingObservers[i];
+			observer.endUpdate(observable);
+		}
+		this._updatingObservers = null;
+		getLogger()?.handleEndTransaction(this);
+	}
+	debugGetUpdatingObservers() {
+		return this._updatingObservers;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/observables/observableValue.js
+function observableValue(nameOrOwner, initialValue, debugLocation = DebugLocation.ofCaller()) {
+	let debugNameData;
+	if (typeof nameOrOwner === "string") debugNameData = new DebugNameData(void 0, nameOrOwner, void 0);
+	else debugNameData = new DebugNameData(nameOrOwner, void 0, void 0);
+	return new ObservableValue(debugNameData, initialValue, strictEquals, debugLocation);
+}
+var ObservableValue = class extends BaseObservable {
+	get debugName() {
+		return this._debugNameData.getDebugName(this) ?? "ObservableValue";
+	}
+	constructor(_debugNameData, initialValue, _equalityComparator, debugLocation) {
+		super(debugLocation);
+		this._debugNameData = _debugNameData;
+		this._equalityComparator = _equalityComparator;
+		this._value = initialValue;
+		getLogger()?.handleObservableUpdated(this, {
+			hadValue: false,
+			newValue: initialValue,
+			change: void 0,
+			didChange: true,
+			oldValue: void 0
 		});
-	});
-}
-/** Resolve on the next `SIGINT` / `SIGTERM`. */
-function _untilSignalled$1() {
-	return new Promise((resolve) => {
-		const done = () => {
-			process.removeListener("SIGINT", done);
-			process.removeListener("SIGTERM", done);
-			resolve();
+	}
+	get() {
+		return this._value;
+	}
+	set(value, tx, change) {
+		if (change === void 0 && this._equalityComparator(this._value, value)) return;
+		let _tx;
+		if (!tx) tx = _tx = new TransactionImpl(() => {}, () => `Setting ${this.debugName}`);
+		try {
+			const oldValue = this._value;
+			this._setValue(value);
+			getLogger()?.handleObservableUpdated(this, {
+				oldValue,
+				newValue: value,
+				change,
+				didChange: true,
+				hadValue: true
+			});
+			for (const observer of this._observers) {
+				tx.updateObserver(observer, this);
+				observer.handleChange(this, change);
+			}
+		} finally {
+			if (_tx) _tx.finish();
+		}
+	}
+	toString() {
+		return `${this.debugName}: ${this._value}`;
+	}
+	_setValue(newValue) {
+		this._value = newValue;
+	}
+	debugGetState() {
+		return { value: this._value };
+	}
+	debugSetValue(value) {
+		this._value = value;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/observables/observableFromEvent.js
+function observableFromEvent(...args) {
+	let owner;
+	let event;
+	let getValue;
+	let debugLocation;
+	if (args.length === 2) [event, getValue] = args;
+	else [owner, event, getValue, debugLocation] = args;
+	return new FromEventObservable(new DebugNameData(owner, void 0, getValue), event, getValue, () => FromEventObservable.globalTransaction, strictEquals, debugLocation ?? DebugLocation.ofCaller());
+}
+var FromEventObservable = class extends BaseObservable {
+	constructor(_debugNameData, event, _getValue, _getTransaction, _equalityComparator, debugLocation) {
+		super(debugLocation);
+		this._debugNameData = _debugNameData;
+		this.event = event;
+		this._getValue = _getValue;
+		this._getTransaction = _getTransaction;
+		this._equalityComparator = _equalityComparator;
+		this._hasValue = false;
+		this.handleEvent = (args) => {
+			const newValue = this._getValue(args);
+			const oldValue = this._value;
+			const didChange = !this._hasValue || !this._equalityComparator(oldValue, newValue);
+			let didRunTransaction = false;
+			if (didChange) {
+				this._value = newValue;
+				if (this._hasValue) {
+					didRunTransaction = true;
+					subtransaction(this._getTransaction(), (tx) => {
+						getLogger()?.handleObservableUpdated(this, {
+							oldValue,
+							newValue,
+							change: void 0,
+							didChange,
+							hadValue: this._hasValue
+						});
+						for (const o of this._observers) {
+							tx.updateObserver(o, this);
+							o.handleChange(this, void 0);
+						}
+					}, () => {
+						const name = this.getDebugName();
+						return "Event fired" + (name ? `: ${name}` : "");
+					});
+				}
+				this._hasValue = true;
+			}
+			if (!didRunTransaction) getLogger()?.handleObservableUpdated(this, {
+				oldValue,
+				newValue,
+				change: void 0,
+				didChange,
+				hadValue: this._hasValue
+			});
 		};
-		process.once("SIGINT", done);
-		process.once("SIGTERM", done);
+	}
+	getDebugName() {
+		return this._debugNameData.getDebugName(this);
+	}
+	get debugName() {
+		const name = this.getDebugName();
+		return "From Event" + (name ? `: ${name}` : "");
+	}
+	onFirstObserverAdded() {
+		this._subscription = this.event(this.handleEvent);
+	}
+	onLastObserverRemoved() {
+		this._subscription.dispose();
+		this._subscription = void 0;
+		this._hasValue = false;
+		this._value = void 0;
+	}
+	get() {
+		if (this._subscription) {
+			if (!this._hasValue) this.handleEvent(void 0);
+			return this._value;
+		} else return this._getValue(void 0);
+	}
+	debugSetValue(value) {
+		this._value = value;
+	}
+	debugGetState() {
+		return {
+			value: this._value,
+			hasValue: this._hasValue
+		};
+	}
+};
+(function(observableFromEvent) {
+	observableFromEvent.Observer = FromEventObservable;
+	function batchEventsGlobally(tx, fn) {
+		let didSet = false;
+		if (FromEventObservable.globalTransaction === void 0) {
+			FromEventObservable.globalTransaction = tx;
+			didSet = true;
+		}
+		try {
+			fn();
+		} finally {
+			if (didSet) FromEventObservable.globalTransaction = void 0;
+		}
+	}
+	observableFromEvent.batchEventsGlobally = batchEventsGlobally;
+})(observableFromEvent || (observableFromEvent = {}));
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/utils/utils.js
+/**
+* This makes sure the observable is being observed and keeps its cache alive.
+*/
+function keepObserved(observable) {
+	const o = new KeepAliveObserver(false, void 0);
+	observable.addObserver(o);
+	return toDisposable(() => {
+		observable.removeObserver(o);
 	});
 }
-/** One-line description of the spawned command for logs. */
-function _describe(command) {
-	return "argv" in command ? command.argv.join(" ") : command.command;
+_setKeepObserved(keepObserved);
+/**
+* This converts the given observable into an autorun.
+*/
+function recomputeInitiallyAndOnChange(observable, handleValue) {
+	const o = new KeepAliveObserver(true, handleValue);
+	observable.addObserver(o);
+	try {
+		o.beginUpdate(observable);
+	} finally {
+		o.endUpdate(observable);
+	}
+	return toDisposable(() => {
+		observable.removeObserver(o);
+	});
 }
+_setRecomputeInitiallyAndOnChange(recomputeInitiallyAndOnChange);
+var KeepAliveObserver = class {
+	constructor(_forceRecompute, _handleValue) {
+		this._forceRecompute = _forceRecompute;
+		this._handleValue = _handleValue;
+		this._counter = 0;
+	}
+	beginUpdate(observable) {
+		this._counter++;
+	}
+	endUpdate(observable) {
+		if (this._counter === 1 && this._forceRecompute) {
+			if (this._handleValue) this._handleValue(observable.get());
+			else observable.reportChanges();
+		}
+		this._counter--;
+	}
+	handlePossibleChange(observable) {}
+	handleChange(observable, change) {}
+};
 //#endregion
-//#region src/commands/jsonRpcStdio.ts
-/** Expose a remote `jsonRpcConnection` service as an NDJSON stdio endpoint. */
-async function jsonRpcStdioCommand(options) {
-	const client = new LinkRpcConnection(options.local.rpcChannel).service(options.serviceId).get(jsonRpcConnectionInterface);
-	const remote = await connectRawJsonRpcTransport(client, options.params);
-	const stdio = createNdjsonJsonRpcTransport({
-		input: options.input ?? process.stdin,
-		output: options.output ?? process.stdout
-	});
-	const bridge = connectJsonRpcTransports(remote, stdio);
-	await new Promise((resolve) => {
-		let settled = false;
-		const finish = () => {
-			if (settled) return;
-			settled = true;
-			resolve();
-		};
-		remote.onClose(finish);
-		stdio.onClose(finish);
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/logging/consoleObservableLogger.js
+let consoleObservableLogger;
+function logObservableToConsole(obs) {
+	if (!consoleObservableLogger) {
+		consoleObservableLogger = new ConsoleObservableLogger();
+		addLogger(consoleObservableLogger);
+	}
+	consoleObservableLogger.addFilteredObj(obs);
+}
+var ConsoleObservableLogger = class {
+	constructor() {
+		this.indentation = 0;
+		this.changedObservablesSets = /* @__PURE__ */ new WeakMap();
+	}
+	addFilteredObj(obj) {
+		if (!this._filteredObjects) this._filteredObjects = /* @__PURE__ */ new Set();
+		this._filteredObjects.add(obj);
+	}
+	_isIncluded(obj) {
+		return this._filteredObjects?.has(obj) ?? true;
+	}
+	textToConsoleArgs(text) {
+		return consoleTextToArgs([normalText(repeat("|  ", this.indentation)), text]);
+	}
+	formatInfo(info) {
+		if (!info.hadValue) return [
+			normalText(` `),
+			styled(formatValue(info.newValue, 60), { color: "green" }),
+			normalText(` (initial)`)
+		];
+		return info.didChange ? [
+			normalText(` `),
+			styled(formatValue(info.oldValue, 70), {
+				color: "red",
+				strikeThrough: true
+			}),
+			normalText(` `),
+			styled(formatValue(info.newValue, 60), { color: "green" })
+		] : [normalText(` (unchanged)`)];
+	}
+	handleObservableCreated(observable) {
+		if (observable instanceof Derived) {
+			const derived = observable;
+			this.changedObservablesSets.set(derived, /* @__PURE__ */ new Set());
+		}
+	}
+	handleOnListenerCountChanged(observable, newCount) {}
+	handleObservableUpdated(observable, info) {
+		if (!this._isIncluded(observable)) return;
+		if (observable instanceof Derived) {
+			this._handleDerivedRecomputed(observable, info);
+			return;
+		}
+		console.log(...this.textToConsoleArgs([
+			formatKind("observable value changed"),
+			styled(observable.debugName, { color: "BlueViolet" }),
+			...this.formatInfo(info)
+		]));
+	}
+	formatChanges(changes) {
+		if (changes.size === 0) return;
+		return styled(" (changed deps: " + [...changes].map((o) => o.debugName).join(", ") + ")", { color: "gray" });
+	}
+	handleDerivedDependencyChanged(derived, observable, change) {
+		if (!this._isIncluded(derived)) return;
+		this.changedObservablesSets.get(derived)?.add(observable);
+	}
+	_handleDerivedRecomputed(derived, info) {
+		if (!this._isIncluded(derived)) return;
+		const changedObservables = this.changedObservablesSets.get(derived);
+		if (!changedObservables) return;
+		console.log(...this.textToConsoleArgs([
+			formatKind("derived recomputed"),
+			styled(derived.debugName, { color: "BlueViolet" }),
+			...this.formatInfo(info),
+			this.formatChanges(changedObservables),
+			{ data: [{ fn: derived._debugNameData.referenceFn ?? derived._computeFn }] }
+		]));
+		changedObservables.clear();
+	}
+	handleDerivedCleared(derived) {
+		if (!this._isIncluded(derived)) return;
+		console.log(...this.textToConsoleArgs([formatKind("derived cleared"), styled(derived.debugName, { color: "BlueViolet" })]));
+	}
+	handleFromEventObservableTriggered(observable, info) {
+		if (!this._isIncluded(observable)) return;
+		console.log(...this.textToConsoleArgs([
+			formatKind("observable from event triggered"),
+			styled(observable.debugName, { color: "BlueViolet" }),
+			...this.formatInfo(info),
+			{ data: [{ fn: observable._getValue }] }
+		]));
+	}
+	handleAutorunCreated(autorun) {
+		if (!this._isIncluded(autorun)) return;
+		this.changedObservablesSets.set(autorun, /* @__PURE__ */ new Set());
+	}
+	handleAutorunDisposed(autorun) {}
+	handleAutorunDependencyChanged(autorun, observable, change) {
+		if (!this._isIncluded(autorun)) return;
+		this.changedObservablesSets.get(autorun).add(observable);
+	}
+	handleAutorunStarted(autorun) {
+		const changedObservables = this.changedObservablesSets.get(autorun);
+		if (!changedObservables) return;
+		if (this._isIncluded(autorun)) console.log(...this.textToConsoleArgs([
+			formatKind("autorun"),
+			styled(autorun.debugName, { color: "BlueViolet" }),
+			this.formatChanges(changedObservables),
+			{ data: [{ fn: autorun._debugNameData.referenceFn ?? autorun._runFn }] }
+		]));
+		changedObservables.clear();
+		this.indentation++;
+	}
+	handleAutorunFinished(autorun) {
+		this.indentation--;
+	}
+	handleBeginTransaction(transaction) {
+		let transactionName = transaction.getDebugName();
+		if (transactionName === void 0) transactionName = "";
+		if (this._isIncluded(transaction)) console.log(...this.textToConsoleArgs([
+			formatKind("transaction"),
+			styled(transactionName, { color: "BlueViolet" }),
+			{ data: [{ fn: transaction._fn }] }
+		]));
+		this.indentation++;
+	}
+	handleEndTransaction() {
+		this.indentation--;
+	}
+};
+function consoleTextToArgs(text) {
+	const styles = new Array();
+	const data = [];
+	let firstArg = "";
+	function process(t) {
+		if ("length" in t) {
+			for (const item of t) if (item) process(item);
+		} else if ("text" in t) {
+			firstArg += `%c${t.text}`;
+			styles.push(t.style);
+			if (t.data) data.push(...t.data);
+		} else if ("data" in t) data.push(...t.data);
+	}
+	process(text);
+	const result = [firstArg, ...styles];
+	result.push(...data);
+	return result;
+}
+function normalText(text) {
+	return styled(text, { color: "black" });
+}
+function formatKind(kind) {
+	return styled(padStr(`${kind}: `, 10), {
+		color: "black",
+		bold: true
 	});
-	bridge.dispose();
-	remote.close("closed");
-	stdio.close("closed");
 }
+function styled(text, options = { color: "black" }) {
+	function objToCss(styleObj) {
+		return Object.entries(styleObj).reduce((styleString, [propName, propValue]) => {
+			return `${styleString}${propName}:${propValue};`;
+		}, "");
+	}
+	const style = { color: options.color };
+	if (options.strikeThrough) style["text-decoration"] = "line-through";
+	if (options.bold) style["font-weight"] = "bold";
+	return {
+		text,
+		style: objToCss(style)
+	};
+}
+function formatValue(value, availableLen) {
+	try {
+		return formatValueUnsafe(value, availableLen);
+	} catch {
+		return "[[???]]";
+	}
+}
+function formatValueUnsafe(value, availableLen) {
+	switch (typeof value) {
+		case "number": return "" + value;
+		case "string":
+			if (value.length + 2 <= availableLen) return `"${value}"`;
+			return `"${value.substr(0, availableLen - 7)}"+...`;
+		case "boolean": return value ? "true" : "false";
+		case "undefined": return "undefined";
+		case "object":
+			if (value === null) return "null";
+			if (Array.isArray(value)) return formatArray(value, availableLen);
+			return formatObject(value, availableLen);
+		case "symbol": return value.toString();
+		case "function": return `[[Function${value.name ? " " + value.name : ""}]]`;
+		default: return "" + value;
+	}
+}
+function formatArray(value, availableLen) {
+	let result = "[ ";
+	let first = true;
+	for (const val of value) {
+		if (!first) result += ", ";
+		if (result.length - 5 > availableLen) {
+			result += "...";
+			break;
+		}
+		first = false;
+		result += `${formatValue(val, availableLen - result.length)}`;
+	}
+	result += " ]";
+	return result;
+}
+function formatObject(value, availableLen) {
+	try {
+		if (typeof value.toString === "function" && value.toString !== Object.prototype.toString) {
+			const val = value.toString();
+			if (val.length <= availableLen) return val;
+			return val.substring(0, availableLen - 3) + "...";
+		}
+	} catch {
+		return "[[Object]]";
+	}
+	const className = getClassName(value);
+	let result = className ? className + "(" : "{ ";
+	let first = true;
+	let entries;
+	try {
+		entries = Object.entries(value);
+	} catch {
+		return className ? `${className}(...)` : "[[Object]]";
+	}
+	for (const [key, val] of entries) {
+		if (!first) result += ", ";
+		if (result.length - 5 > availableLen) {
+			result += "...";
+			break;
+		}
+		first = false;
+		result += `${key}: ${formatValue(val, availableLen - result.length)}`;
+	}
+	result += className ? ")" : " }";
+	return result;
+}
+function repeat(str, count) {
+	let result = "";
+	for (let i = 1; i <= count; i++) result += str;
+	return result;
+}
+function padStr(str, length) {
+	while (str.length < length) str += " ";
+	return str;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/logging/debugGetDependencyGraph.js
+function debugGetDependencyGraph(obs, options) {
+	const debugNamePostProcessor = options?.debugNamePostProcessor ?? ((str) => str);
+	const info = Info.from(obs, debugNamePostProcessor);
+	if (!info) return "";
+	return formatObservableInfo(info, 0, /* @__PURE__ */ new Set()).trim();
+}
+function formatObservableInfo(info, indentLevel, alreadyListed) {
+	const indent = "		".repeat(indentLevel);
+	const lines = [];
+	if (alreadyListed.has(info.sourceObj)) {
+		lines.push(`${indent}* ${info.type} ${info.name} (already listed)`);
+		return lines.join("\n");
+	}
+	alreadyListed.add(info.sourceObj);
+	lines.push(`${indent}* ${info.type} ${info.name}:`);
+	lines.push(`${indent}  value: ${formatValue(info.value, 50)}`);
+	lines.push(`${indent}  state: ${info.state}`);
+	if (info.dependencies.length > 0) {
+		lines.push(`${indent}  dependencies:`);
+		for (const dep of info.dependencies) lines.push(formatObservableInfo(dep, indentLevel + 1, alreadyListed));
+	}
+	return lines.join("\n");
+}
+var Info = class Info {
+	static from(obs, debugNamePostProcessor) {
+		if (obs instanceof AutorunObserver) {
+			const state = obs.debugGetState();
+			return new Info(obs, debugNamePostProcessor(obs.debugName), "autorun", void 0, state.stateStr, Array.from(state.dependencies).map((dep) => Info.from(dep, debugNamePostProcessor) || Info.unknown(dep)));
+		} else if (obs instanceof Derived) {
+			const state = obs.debugGetState();
+			return new Info(obs, debugNamePostProcessor(obs.debugName), "derived", state.value, state.stateStr, Array.from(state.dependencies).map((dep) => Info.from(dep, debugNamePostProcessor) || Info.unknown(dep)));
+		} else if (obs instanceof ObservableValue) {
+			const state = obs.debugGetState();
+			return new Info(obs, debugNamePostProcessor(obs.debugName), "observableValue", state.value, "upToDate", []);
+		} else if (obs instanceof FromEventObservable) {
+			const state = obs.debugGetState();
+			return new Info(obs, debugNamePostProcessor(obs.debugName), "fromEvent", state.value, state.hasValue ? "upToDate" : "initial", []);
+		}
+	}
+	static unknown(obs) {
+		return new Info(obs, "(unknown)", "unknown", void 0, "unknown", []);
+	}
+	constructor(sourceObj, name, type, value, state, dependencies) {
+		this.sourceObj = sourceObj;
+		this.name = name;
+		this.type = type;
+		this.value = value;
+		this.state = state;
+		this.dependencies = dependencies;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/index.js
+_setDebugGetDependencyGraph(debugGetDependencyGraph);
+setLogObservableFn(logObservableToConsole);
+//#endregion
+//#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/utils/promise.js
+var ObservableLazy = class {
+	/**
+	* The cached value.
+	* Does not force a computation of the value.
+	*/
+	get cachedValue() {
+		return this._value;
+	}
+	constructor(_computeValue) {
+		this._computeValue = _computeValue;
+		this._value = observableValue(this, void 0);
+	}
+	/**
+	* Returns the cached value.
+	* Computes the value if the value has not been cached yet.
+	*/
+	getValue() {
+		let v = this._value.get();
+		if (!v) {
+			v = this._computeValue();
+			this._value.set(v, void 0);
+		}
+		return v;
+	}
+};
+/**
+* A promise whose state is observable.
+*/
+var ObservablePromise = class ObservablePromise {
+	static fromFn(fn) {
+		return new ObservablePromise(fn());
+	}
+	constructor(promise) {
+		this._value = observableValue(this, void 0);
+		/**
+		* The current state of the promise.
+		* Is `undefined` if the promise didn't resolve yet.
+		*/
+		this.promiseResult = this._value;
+		this.resolvedValue = derived(this, (reader) => {
+			const result = this.promiseResult.read(reader);
+			if (!result) return;
+			return result.getDataOrThrow();
+		});
+		this.promise = promise.then((value) => {
+			transaction((tx) => {
+				/** @description onPromiseResolved */
+				this._value.set(new PromiseResult(value, void 0), tx);
+			});
+			return value;
+		}, (error) => {
+			transaction((tx) => {
+				/** @description onPromiseRejected */
+				this._value.set(new PromiseResult(void 0, error), tx);
+			});
+			throw error;
+		});
+	}
+};
+var PromiseResult = class {
+	constructor(data, error) {
+		this.data = data;
+		this.error = error;
+	}
+	/**
+	* Returns the value if the promise resolved, otherwise throws the error.
+	*/
+	getDataOrThrow() {
+		if (this.error) throw this.error;
+		return this.data;
+	}
+};
+/**
+* A lazy promise whose state is observable.
+*/
+var ObservableLazyPromise = class {
+	constructor(_computePromise) {
+		this._computePromise = _computePromise;
+		this._lazyValue = new ObservableLazy(() => new ObservablePromise(this._computePromise()));
+		/**
+		* Does not enforce evaluation of the promise compute function.
+		* Is undefined if the promise has not been computed yet.
+		*/
+		this.cachedPromiseResult = derived(this, (reader) => this._lazyValue.cachedValue.read(reader)?.promiseResult.read(reader));
+	}
+	getPromise() {
+		return this._lazyValue.getValue().promise;
+	}
+};
 //#endregion
 //#region src/approvalPresentation.ts
 function createApprovalPresentation(item, prepared) {
@@ -2780,6 +5264,9 @@ const FLAG_PREFIX = "--p:";
 * mutates the input.
 */
 function rewriteParamShortcuts(argv) {
+	return rewriteCapabilityShortcuts(expandParamShortcuts(argv));
+}
+function expandParamShortcuts(argv) {
 	const out = [];
 	let stopExpanding = false;
 	for (let i = 0; i < argv.length; i++) {
@@ -2820,148 +5307,81 @@ function rewriteParamShortcuts(argv) {
 	}
 	return out;
 }
-//#endregion
-//#region src/views/types.ts
-function formatCondition(condition) {
-	const match = condition.kind === "interface" ? condition.interface : condition.implements;
-	const predicate = "tag" in match ? `tag(${match.tag})` : `id(${match.interfaceId})`;
-	return condition.kind === "interface" ? `interface:${predicate}` : `service:implements(${predicate})`;
-}
-function matchesInterface(value, condition) {
-	return "tag" in condition ? value.tags?.includes(condition.tag) === true : value.interfaceId === condition.interfaceId;
-}
-function matchesTarget(target, view) {
-	return view.conditions.some((condition) => condition.kind === target.kind && target.interfaces.some((value) => matchesInterface(value, condition.kind === "interface" ? condition.interface : condition.implements)));
-}
-function targetId(kind, listing) {
-	return `${kind}:${encodeURIComponent(listing.serviceId)}:${encodeURIComponent(listing.discoveredFrom)}` + (kind === "interface" ? `:${encodeURIComponent(listing.interfaceId)}:${listing.isDefault ? "default" : "qualified"}` : "");
-}
-function interfaceTarget(listing) {
-	return {
-		id: targetId("interface", listing),
-		kind: "interface",
-		serviceId: listing.serviceId,
-		interfaceId: listing.interfaceId,
-		discoveredFrom: listing.discoveredFrom,
-		interfaces: [listing]
-	};
-}
-//#endregion
-//#region src/views/discovery.ts
-async function discoverViewTargets(channel, view, options = {}) {
-	const explorer = new HubDirectoryExplorer(channel, options);
-	const warnings = [];
-	try {
-		await explorer.explore();
-		const snapshot = explorer.graphSnapshot.result;
-		warnings.push(...snapshot.inaccessible.map((item) => `${item.serviceId || "<root>"}: ${item.reason}`));
-		const listings = [...snapshot.listings];
-		try {
-			const defaults = await deadline(fetchDefaults(channel), options.timeoutMs ?? 5e3);
-			if (defaults.interfaceId !== void 0) {
-				const existing = listings.find((item) => item.serviceId === "" && item.interfaceId === defaults.interfaceId);
-				listings.unshift({
-					serviceId: "",
-					interfaceId: defaults.interfaceId,
-					hash: defaults.hash ?? existing?.hash,
-					discoveredFrom: "",
-					isDefault: true,
-					tags: existing?.tags
-				});
-			}
-		} catch (error) {
-			warnings.push(`Default service: ${message(error)}`);
-		}
-		const interfacesById = /* @__PURE__ */ new Map();
-		for (const listing of listings) {
-			const target = interfaceTarget(listing);
-			const previous = interfacesById.get(target.id);
-			interfacesById.set(target.id, previous === void 0 ? target : {
-				...previous,
-				interfaces: [...previous.interfaces, listing]
-			});
+const CAPABILITY_SHORTCUTS = /* @__PURE__ */ new Map([
+	["--cap:allow-prefix", "prefix"],
+	["--cap:allow-any", "any"],
+	["--cap:allow-enum", "enum"],
+	["--cap:allow-subset", "subsetOf"]
+]);
+function rewriteCapabilityShortcuts(argv) {
+	const out = [];
+	const constrained = /* @__PURE__ */ new Set();
+	const assigned = /* @__PURE__ */ new Set();
+	let precedingParam;
+	for (let i = 0; i < argv.length; i++) {
+		const token = argv[i];
+		if (token === "--") {
+			out.push(...argv.slice(i));
+			break;
 		}
-		const targets = [...interfacesById.values()];
-		const services = /* @__PURE__ */ new Map();
-		for (const listing of listings) {
-			const id = targetId("service", listing);
-			const values = services.get(id) ?? [];
-			if (!values.some((value) => value.interfaceId === listing.interfaceId && value.hash === listing.hash)) values.push(listing);
-			services.set(id, values);
+		const eq = token.indexOf("=");
+		const flag = eq < 0 ? token : token.slice(0, eq);
+		const matcher = CAPABILITY_SHORTCUTS.get(flag);
+		if (matcher !== void 0) {
+			if (precedingParam === void 0) throw new Error(`${flag} must immediately follow a --param or --p:<name> assignment.`);
+			if (precedingParam.includes(".")) throw new Error(`${flag} only supports top-level parameter names.`);
+			if (constrained.has(precedingParam)) throw new Error(`Duplicate --cap:allow-param for ${precedingParam}.`);
+			let value = true;
+			if (matcher === "any") {
+				if (eq >= 0) throw new Error("--cap:allow-any takes no value.");
+			} else {
+				const raw = eq >= 0 ? token.slice(eq + 1) : argv[++i];
+				if (raw === void 0 || eq < 0 && raw.startsWith("--")) throw new Error(`${flag} requires a value.`);
+				if (matcher === "prefix") value = raw;
+				else {
+					try {
+						value = JSON.parse(raw);
+					} catch {
+						throw new Error(`${flag} requires a JSON array.`);
+					}
+					if (!Array.isArray(value) || matcher === "enum" && value.length === 0 || matcher === "subsetOf" && !value.every((item) => typeof item === "string")) throw new Error(`${flag} requires ${matcher === "enum" ? "a non-empty JSON array" : "a JSON string array"}.`);
+				}
+			}
+			constrained.add(precedingParam);
+			out.push("--cap:allow-param", `${precedingParam}=${JSON.stringify({ [matcher]: value })}`);
+			continue;
 		}
-		for (const [id, interfaces] of services) {
-			const first = interfaces[0];
-			targets.push({
-				id,
-				kind: "service",
-				serviceId: first.serviceId,
-				discoveredFrom: first.discoveredFrom,
-				interfaces
-			});
+		if (flag === "--param" || flag === "--cap:allow-param") {
+			const values = [];
+			if (eq >= 0) {
+				values.push(token.slice(eq + 1));
+				out.push(token);
+			} else {
+				out.push(token);
+				while (argv[i + 1] !== void 0 && !argv[i + 1].startsWith("-")) {
+					const value = argv[++i];
+					values.push(value);
+					out.push(value);
+				}
+			}
+			precedingParam = void 0;
+			for (const value of values) {
+				const assignment = value.indexOf("=");
+				if (assignment <= 0) continue;
+				const key = value.slice(0, assignment);
+				if (constrained.has(key) && (flag === "--cap:allow-param" || assigned.has(key))) throw new Error(flag === "--param" ? `Cannot reassign parameter ${key} after an explicit capability constraint.` : `Duplicate --cap:allow-param for ${key}.`);
+				if (flag === "--cap:allow-param") constrained.add(key);
+				else {
+					assigned.add(key);
+					precedingParam = key;
+				}
+			}
+			continue;
 		}
-		return {
-			targets: targets.filter((target) => matchesTarget(target, view)).map((target) => ({
-				...target,
-				serviceInterfaces: listings.filter((listing) => listing.serviceId === target.serviceId && listing.discoveredFrom === target.discoveredFrom)
-			})).sort((a, b) => a.id.localeCompare(b.id)),
-			warnings
-		};
-	} finally {
-		explorer.dispose();
-	}
-}
-async function resolveViewTarget(channel, view, id, options = {}) {
-	const { targets } = await discoverViewTargets(channel, view, options);
-	const target = targets.find((value) => value.id === id);
-	if (!target) throw new Error(`Unknown or unavailable ${view.id} target "${id}". Run view targets ${view.id} again.`);
-	return loadViewTarget(channel, target, options.timeoutMs, view);
-}
-/** Selection and opening share a connection, including spawned ephemeral endpoints. */
-async function resolveViewSelection(channel, view, options) {
-	if (options.target !== void 0) {
-		const context = await resolveViewTarget(channel, view, options.target, options);
-		if (options.service !== void 0 && context.target.serviceId !== options.service) throw new Error("--target does not match --service");
-		if (options.interface !== void 0 && !context.target.interfaces.some((value) => value.interfaceId === options.interface)) throw new Error("--target does not match --interface");
-		return context;
-	}
-	if (options.interface === void 0 && options.service === void 0) throw new Error("Specify --target, or an exact --interface / --service selector");
-	const candidates = (await discoverViewTargets(channel, view, options)).targets.filter((target) => target.kind === (options.interface === void 0 ? "service" : "interface") && (options.interface === void 0 || target.interfaceId === options.interface) && (options.service === void 0 || target.serviceId === options.service));
-	const matches = candidates.filter((target) => target.kind !== "interface" || target.interfaces.some((value) => value.isDefault) || !candidates.some((other) => other.serviceId === target.serviceId && other.discoveredFrom === target.discoveredFrom && other.interfaceId === target.interfaceId && other.interfaces.every((value) => target.interfaces.some((candidate) => candidate.hash === value.hash)) && target.interfaces.every((value) => other.interfaces.some((candidate) => candidate.hash === value.hash)) && other.interfaces.some((value) => value.isDefault)));
-	if (matches.length !== 1) {
-		const detail = matches.length === 0 ? "No matching target" : `Target selection is ambiguous (${matches.length} targets)`;
-		throw new Error(`${detail}; use --service to narrow the selection or --target from view targets ${view.id}`);
-	}
-	return loadViewTarget(channel, matches[0], options.timeoutMs, view);
-}
-async function loadViewTarget(channel, target, timeoutMs = 5e3, view) {
-	const candidates = view === void 0 || target.kind === "interface" ? target.interfaces : target.interfaces.filter((listing) => view.conditions.some((condition) => condition.kind === "service" && matchesInterface(listing, condition.implements)));
-	for (const listing of candidates) if (candidates.some((other) => other.interfaceId === listing.interfaceId && other.hash !== listing.hash)) throw new Error(`Target "${target.id}" is ambiguous: interface "${listing.interfaceId}" advertises multiple schema hashes`);
-	return {
-		channel,
-		target,
-		interfaces: await Promise.all(candidates.map(async (listing) => {
-			const schema = await deadline(fetchSchema$1(channel, listing.interfaceId, listing.hash, listing.discoveredFrom || void 0), timeoutMs);
-			if (schema.id !== listing.interfaceId || listing.hash !== void 0 && schema.hash !== listing.hash) throw new Error(`Schema for "${listing.interfaceId}" does not match its current directory advertisement; rediscover the target`);
-			return {
-				...listing,
-				hash: schema.hash,
-				schema
-			};
-		}))
-	};
-}
-async function deadline(promise, timeoutMs) {
-	let timer;
-	try {
-		return await Promise.race([promise, new Promise((_, reject) => {
-			timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`Reflection timed out after ${timeoutMs}ms`)), timeoutMs);
-		})]);
-	} finally {
-		clearTimeout(timer);
+		precedingParam = void 0;
+		out.push(token);
 	}
-}
-function message(error) {
-	return error instanceof Error ? error.message : String(error);
+	return out;
 }
 //#endregion
 //#region src/ui/terminalText.ts
@@ -5899,13 +8319,13 @@ async function main(rawArgv, executableName = "linkrpc") {
 	const profile = cliInvocation.profile;
 	const program = new Command();
 	program.configureHelp({ showGlobalOptions: true });
-	program.name(cliInvocation.programName).description(profile === "hub" ? "CLI / TUI for LinkRPC hubs. Shared RPC commands use hub initialization, signing, capability negotiation, and required schema validation by default." : "CLI / TUI for JSON-RPC and LinkRPC endpoints. Shared commands use the RPC profile with automatic schema validation and no endpoint environment override by default.").option("--endpoint <uri>", "endpoint URI (unix:/path?token=…, npipe://./pipe/…, ws[s]://host?token=…, ws-no-init://host?…, cmd:?command=… or cmd-stdio:?command=…)").option("--endpoint-cmd <command>", "spawn a server, connect via an injected env socket").option("--endpoint-cmd-stdio <command>", "spawn a child and talk over its stdio").option("--endpoint-cmd-env <key=value>", "env var for the --endpoint-cmd / --endpoint-cmd-stdio child (repeatable)", (val, acc) => {
+	program.name(cliInvocation.programName).description(profile === "hub" ? "CLI / TUI for LinkRPC hubs. Shared RPC commands use hub initialization, signing, capability negotiation, and required schema validation by default." : "CLI / TUI for JSON-RPC and LinkRPC endpoints. Shared commands use the RPC profile with automatic schema validation and no endpoint environment override by default.").option("--endpoint <uri>", "endpoint URI (linkrpc:local, unix:/path?token=…, npipe://./pipe/…, ws[s]://host?token=…, ws-no-init://host?…, cmd:?command=… or cmd-stdio:?command=…)").option("--endpoint-cmd <command>", "spawn a server, connect via an injected env socket").option("--endpoint-cmd-stdio <command>", "spawn a child and talk over its stdio").option("--endpoint-cmd-env <key=value>", "env var for the --endpoint-cmd / --endpoint-cmd-stdio child (repeatable)", (val, acc) => {
 		const eq = val.indexOf("=");
 		if (eq === -1) throw new InvalidArgumentError(`expected key=value, got '${val}'`);
 		const next = acc ?? {};
 		next[val.slice(0, eq)] = val.slice(eq + 1);
 		return next;
-	}).option("--endpoint-token <token>", "fill the exact token=% placeholder in --endpoint (or a context endpoint)").option("--endpoint-cmd-cwd <dir>", "working directory for the --endpoint-cmd / --endpoint-cmd-stdio child").option("--context <selector>", "use an exact folder, id:<name>, :root, or :empty context; otherwise look up from cwd").option("--context-set", "persist context-capable overrides supplied on this command to the active context").option("--new-context <selector>", "create a new context from the effective command values; fails if it already exists").option("--schema <path-or-url>", "static schema catalog used for discovery and validation").option("--validation <mode>", "schema validation mode: auto, required, or off", parseValidationMode).option("--use-env", "allow LINKRPC_* / legacy HUBRPC_* endpoint variables to override context").option("--no-use-env", "ignore LINKRPC_* / legacy HUBRPC_* endpoint variables").option("--provision-identity", "with --endpoint-cmd: provision & reuse a persistent identity (slot derived from cwd + command)").option("--provision-identity-slot <slot>", "with --endpoint-cmd: provision & reuse a persistent identity under this explicit slot id").option("--principal <spec>", "identity to sign calls with: \"managed\" (default, falls back to user:hubrpc-cli), \"user:<id>\" (per-user data dir), or \"file:<path>\"", (v) => {
+	}).option("--endpoint-token <token>", "fill the exact token=% placeholder in --endpoint (or a context endpoint)").option("--endpoint-cmd-cwd <dir>", "working directory for the --endpoint-cmd / --endpoint-cmd-stdio child").option("--context <selector>", "use an exact folder, id:<name>, :root, or :empty context; otherwise look up from cwd").option("--context-set", "persist context-capable overrides supplied on this command to the active context").option("--new-context <selector>", "create a new context from the effective command values; fails if it already exists").option("--schema <path-or-url>", "static schema catalog used for discovery and validation").option("--daemon-service <id>", "daemon management service ID on the selected Hub").option("--detach-keys <keys>", "TTY console detach sequence in Docker syntax, e.g. 'ctrl-b,d' (default) or 'ctrl-p,ctrl-q'").option("--validation <mode>", "schema validation mode: auto, required, or off", parseValidationMode).option("--use-env", "allow LINKRPC_* / legacy HUBRPC_* endpoint variables to override context").option("--no-use-env", "ignore LINKRPC_* / legacy HUBRPC_* endpoint variables").option("--sign", "enable Hub signing and stored capabilities (Hub profile default)").option("--no-sign", "disable Hub signing and stored capabilities (RPC profile default)").option("--provision-identity", "with --endpoint-cmd: provision & reuse a persistent identity (slot derived from cwd + command)").option("--provision-identity-slot <slot>", "with --endpoint-cmd: provision & reuse a persistent identity under this explicit slot id").option("--principal <spec>", "identity to sign calls with: \"managed\" (default, falls back to user:hubrpc-cli), \"user:<id>\" (per-user data dir), or \"file:<path>\"", (v) => {
 		try {
 			parsePrincipalSpec(v);
 		} catch (e) {
@@ -5920,9 +8340,21 @@ async function main(rawArgv, executableName = "linkrpc") {
 	let pendingContextSet;
 	let pendingNewContext;
 	let preparedNewContext;
+	/** Create a context from the effective values, then make it the selected context of this invocation. */
+	const createAndSelectContext = async (reference) => {
+		if (g_contextStore === void 0 || g_invocation === void 0) throw new Error("context resolver is unavailable");
+		await createContextFromInvocation(g_contextStore, reference, g_invocation.values);
+		const useEnvironment = explicitOption(program, "useEnv");
+		g_invocation = await resolveInvocationContext({
+			profile,
+			store: g_contextStore,
+			selector: formatContextReference(reference),
+			cliOverrides: g_invocation.cliOverrides,
+			...useEnvironment !== void 0 ? { useEnvironment } : {}
+		});
+	};
 	program.hook("preAction", async (_thisCommand, actionCommand) => {
 		const commandPath = getCommandPath(actionCommand);
-		const allowMissingContext = commandPath === "context set";
 		const store = new ContextStore();
 		const cliOverrides = collectContextOverrides(program, actionCommand);
 		const selector = explicitOption(program, "context");
@@ -5933,16 +8365,17 @@ async function main(rawArgv, executableName = "linkrpc") {
 			store,
 			...selector !== void 0 ? { selector } : {},
 			cliOverrides,
-			...useEnvironment !== void 0 ? { useEnvironment } : {},
-			allowMissingContext
+			...useEnvironment !== void 0 ? { useEnvironment } : {}
 		});
 		if (profile === "rpc" && g_invocation.values.config !== void 0) throw new Error("--config is only available in the hub profile");
 		if (program.opts().contextSet === true) {
 			if (program.opts().newContext !== void 0) throw new Error("--context-set cannot be combined with --new-context");
 			if (Object.keys(cliOverrides).length === 0) throw new Error("--context-set requires at least one context-capable override");
+			assertExplicitRootMutation(g_invocation.selected);
+			if (g_invocation.selected.context === void 0) throw new Error("No context exists to update. Use --new-context . to create one.");
 			pendingContextSet = {
 				store,
-				reference: await mutationReference(store, g_invocation.selected),
+				reference: mutableReference(g_invocation.selected.reference),
 				values: cliOverrides
 			};
 		}
@@ -5959,6 +8392,14 @@ async function main(rawArgv, executableName = "linkrpc") {
 			reference: preparedNewContext.reference,
 			values: g_invocation.values
 		};
+		if (commandPath.startsWith("services ") && preparedNewContext !== void 0) {
+			await createContextFromInvocation(preparedNewContext.store, preparedNewContext.reference, g_invocation.values);
+			pendingNewContext = void 0;
+		}
+		if ((commandPath === "context" || commandPath === "context show") && preparedNewContext !== void 0) {
+			await createAndSelectContext(preparedNewContext.reference);
+			pendingNewContext = void 0;
+		}
 		endpoint = commandUsesEndpoint(commandPath) || hasEndpointOverrides(cliOverrides) ? resolveInvocationEndpoint(g_invocation, actionCommand.name() === "tunnel") : void 0;
 		g_hubConfigPath = g_invocation.values.config;
 		g_logMessages = program.opts().logMessages === true && actionCommand.name() !== "ui";
@@ -5975,6 +8416,65 @@ async function main(rawArgv, executableName = "linkrpc") {
 			pendingNewContext = void 0;
 		}
 	});
+	if (profile === "hub") registerServices(program, {
+		detachKeys,
+		attachCommand: (id) => {
+			if (!g_invocation) throw new Error("Context resolver is unavailable");
+			const reference = preparedNewContext?.reference ?? g_invocation.selected.reference;
+			return serviceAttachCommand({
+				context: formatContextReference(reference),
+				namespace: g_invocation.values.namespace ?? contextNamespace(reference),
+				id,
+				overrides: g_invocation.cliOverrides,
+				useEnv: g_invocation.environmentApplied
+			});
+		},
+		restart: async () => {
+			if (endpoint !== void 0 || g_hubConfigPath !== void 0 || g_invocation?.values.daemonService !== void 0) throw new Error("services restart only replaces the default local daemon, not a selected Hub endpoint or routed daemon. Run `hub --context :empty --no-use-env services restart` to explicitly choose the local daemon.");
+			await restartLocalDaemon();
+		},
+		namespace: () => {
+			if (!g_invocation) throw new Error("Context resolver is unavailable");
+			return g_invocation.values.namespace ?? contextNamespace(preparedNewContext?.reference ?? g_invocation.selected.reference);
+		},
+		use: async (startLocal, action) => {
+			if (endpoint === void 0 && g_hubConfigPath === void 0) return useLocalManagement(startLocal, action);
+			let result;
+			await withChannel(endpoint, getPrincipalSpec(), async (channel) => {
+				const connection = new LinkRpcConnection(channel);
+				const serviceId = g_invocation?.values.daemonService ?? `${(await connection.get(hubGrantedServiceIdInterface).getHubServiceId({})).hubServiceId}/daemon`;
+				await checkDaemonInterfaces(connection, serviceId);
+				result = await action(connection.get(managedEndpointsInterface, { serviceId }), { local: false });
+			}, {
+				requestReflectionAccess: false,
+				autoNegotiatePerCall: true
+			});
+			return result;
+		}
+	});
+	program.command("attach [serviceId]").description("Attach to a console of any service implementing the `linkrpc.console.v1` interface template (found through the `linkrpc.console` directory tag). Without a service, list available consoles. Pipe consoles: Ctrl+D on an empty line detaches. TTY consoles: keys go to the program; the detach keys (default Ctrl+B, then d) detach.").option("--params <json>", "params of the console template instance, e.g. '{\"namespace\":\"…\",\"id\":\"main\"}'", "{}").option("--interface <id>", "interface containing the console instance").option("--instance <name>", "console template instance name, when an interface has several").option("--read-only", "observe output without sending input").action(async (serviceId, opts) => {
+		await withChannel(endpoint, getPrincipalSpec(), async (channel) => {
+			if (serviceId === void 0) {
+				process.stdout.write(`${await listConsoleTargets(channel)}\n`);
+				return;
+			}
+			await attachConsole(channel, {
+				serviceId,
+				params: opts.params,
+				readOnly: opts.readOnly,
+				...opts.interface === void 0 ? {} : { interfaceId: opts.interface },
+				...opts.instance === void 0 ? {} : { instance: opts.instance },
+				detachKeys: detachKeys(),
+				reattachCommand: [
+					cliInvocation.programName,
+					"attach",
+					serviceId,
+					...opts.params === "{}" ? [] : ["--params", `'${opts.params}'`],
+					...opts.instance === void 0 ? [] : ["--instance", opts.instance]
+				].join(" ")
+			});
+		}, { autoNegotiatePerCall: true });
+	});
 	program.command("ls").description("List services and interfaces. Walks the bus recursively, following `hubrpc.directory` references.").option("--interface <id>", "filter by interfaceId").option("--interface-prefix <prefix>", "filter by interfaceId prefix").option("--service <id>", "list a single service (no recursion)").option("--service-prefix <prefix>", "filter by serviceId prefix").option("--search <regexp>", "case-insensitive regexp over listings").option("--depth <n>", "max recursion depth (default 5)", (v) => Number.parseInt(v, 10)).option("--with-members", "include request and notification members from interface schemas").option("--json", "legacy flat listing JSON; use --format json for graph state").option("--format <format>", "pretty, json, or jsonl").option("--dump <file>", "write topology and all schemas to one JSON fixture file").option("--dump-patches <file>", "write progressive RFC 6902 operations as JSON Lines; use - for stdout").option("--stream", "legacy patch-log JSONL; use --format jsonl for reconstructable graph state").option("--watch", "continue observing directory changes until interrupted").action(async (opts) => {
 		await withChannel(endpoint, getPrincipalSpec(), async (channel) => {
 			const format = resolveGraphFormat(opts.format, {
@@ -6166,32 +8666,69 @@ async function main(rawArgv, executableName = "linkrpc") {
 				}
 				const rendered = renderMethodParamHelp(method, schema);
 				if (rendered.text.length > 0) process.stdout.write("\n" + rendered.text);
+			}, {
+				requestReflectionAccess: false,
+				autoNegotiatePerCall: false
 			});
 		} catch (e) {
 			process.stdout.write(`\n(Could not fetch method schema: ${e.message})\n`);
 		}
 	};
-	program.command("call [methodRef]").description("Invoke a request. `<methodRef>` is `[svc::][iface::]method[@hash]`. Use `--p:<name> <value>` (or `--p:<name>=<value>`) as a shortcut for `--param <name>=<value>`. Run `hub call <methodRef> --help` to see the method-specific `--p:` flags derived from the live schema.").option("--params <json>", "inline params JSON, or \"-\" to read stdin").option("--param <kv...>", "param override, key=value (JSON or string)").option("--no-validate", "skip schema-based param validation").helpOption(false).option("-h, --help", "show help (includes method params when reachable)").action(async (methodRef, opts, cmd) => {
-		if (opts.help) {
-			await _printCallHelp(cmd, methodRef ?? "");
-			return;
-		}
-		if (methodRef === void 0) {
-			process.stderr.write("linkrpc: missing required argument 'methodRef'.\n");
-			process.stderr.write(cmd.helpInformation());
-			process.exit(2);
-		}
-		await withChannel(endpoint, getPrincipalSpec(), async (channel) => {
+	const call = program.command("call [methodRef]");
+	const caps = profile === "hub" ? program.command("caps").description("List stored capabilities or request access for a call.") : void 0;
+	caps?.command("list").description("List capabilities stored for the selected principal (including expired grants).").option("--json", "machine-readable JSON output").action(async (opts) => {
+		await withResolvedSigning(endpoint, getPrincipalSpec(), async (_conn, session) => {
+			process.stdout.write(listCaps(session, opts.json === true) + "\n");
+		});
+	});
+	const capsRequest = caps?.command("request [methodRef]").description("Request and store a capability without invoking the method.");
+	const addCapabilityOptions = (cmd) => cmd.option("--cap:allow-param <kv...>", "top-level key=matcher JSON (exact, enum, prefix, subsetOf, any)").option("--cap:allow-prefix <prefix>", "allow a string prefix for the immediately preceding parameter").option("--cap:allow-any", "allow any JSON value for the immediately preceding parameter").option("--cap:allow-enum <json>", "allow one value from a JSON array for the preceding parameter").option("--cap:allow-subset <json>", "allow an array of items from a JSON string array for the preceding parameter").addOption(new Option("--cap:duration <duration>", "requested grant lifetime").choices([
+		"shortLived",
+		"longLived",
+		"persistent"
+	]).default("persistent"));
+	const configureCall = (cmd, capabilityOnly) => {
+		cmd.description((capabilityOnly ? "Request a capability without executing a call. " : "Invoke a request. ") + "`<methodRef>` is `[svc::][iface::]method[@hash]`. Use `--p:<name> <value>` (or `--p:<name>=<value>`) as a shortcut for `--param <name>=<value>`. Run `hub call <methodRef> --help` to see the method-specific `--p:` flags derived from the live schema.").option("--params <json>", "inline params JSON, or \"-\" to read stdin").option("--param <kv...>", "param override, key=value (JSON or string)").option("--no-validate", "skip schema-based param validation").helpOption(false).option("-h, --help", "show help (includes method params when reachable)").action(async (methodRef, opts, cmd) => {
+			if (opts.help) {
+				await _printCallHelp(cmd, methodRef ?? "");
+				return;
+			}
+			if (methodRef === void 0) {
+				process.stderr.write("linkrpc: missing required argument 'methodRef'.\n");
+				process.stderr.write(cmd.helpInformation());
+				process.exit(2);
+			}
+			const requestCap = opts["cap:request"] === true;
+			const allowParams = opts["cap:allowParam"];
+			if (!capabilityOnly && allowParams !== void 0 && !requestCap) throw new Error("--cap:allow-param requires --cap:request.");
+			if (!capabilityOnly && cmd.getOptionValueSource("cap:duration") === "cli" && !requestCap) throw new Error("--cap:duration requires --cap:request.");
+			resolveSigning(profile, g_invocation?.values ?? {}, capabilityOnly || requestCap);
 			const validation = opts.validate === false ? "off" : effectiveValidation(profile);
-			const out = await callCommand(channel, {
-				methodRef,
-				paramsArg: opts.params,
-				paramOverrides: opts.param,
-				validation
+			if ((capabilityOnly || requestCap) && validation === "off") throw new Error("Capability requests require schema validation; remove --no-validate/--validation off.");
+			await withChannel(endpoint, getPrincipalSpec(), async (channel, session) => {
+				const out = await callCommand(channel, {
+					methodRef,
+					paramsArg: opts.params,
+					paramOverrides: opts.param,
+					validation,
+					allowParams,
+					requestCap,
+					capabilityOnly,
+					signingSession: session,
+					duration: opts["cap:duration"]
+				});
+				process.stdout.write(out + "\n");
+			}, {
+				requestReflectionAccess: (capabilityOnly || requestCap) && validation !== "off",
+				requireSigning: capabilityOnly || requestCap,
+				autoNegotiatePerCall: false
 			});
-			process.stdout.write(out + "\n");
-		}, { requestReflectionAccess: effectiveValidation(profile) !== "off" });
-	});
+		});
+		addCapabilityOptions(cmd);
+	};
+	configureCall(call, false);
+	call.option("--cap:request", "ensure a stored capability covers the requested scope before calling");
+	if (capsRequest !== void 0) configureCall(capsRequest, true);
 	program.command("notify [methodRef]").description("Fire a notification (no response). Same `--p:<name>` shortcuts as `call`.").option("--params <json>", "inline params JSON, or \"-\" to read stdin").option("--param <kv...>", "param override, key=value").option("--no-validate", "skip schema-based param validation").helpOption(false).option("-h, --help", "show help (includes method params when reachable)").action(async (methodRef, opts, cmd) => {
 		if (opts.help) {
 			await _printCallHelp(cmd, methodRef ?? "");
@@ -6299,13 +8836,29 @@ Batch options:
 	context.command("show").description("Show only the selected context and its stored defaults.").action(() => {
 		printSelectedContext(false);
 	});
-	context.command("list").description("List every path, named, and root context in the global store.").action(async () => {
+	context.command("create <selector>").description("Create a context (a folder, id:<name>) from the effective values, including flags on this command; same as hub context --new-context <selector>.").action(async (selector) => {
 		if (g_contextStore === void 0) throw new Error("context store is unavailable");
-		for (const item of await g_contextStore.list()) process.stdout.write(`${formatContextReference(item.reference)}\n`);
+		if (preparedNewContext !== void 0) throw new Error("Use either context create <selector> or --new-context, not both");
+		const reference = mutableReference(await g_contextStore.resolveReference(selector));
+		await g_contextStore.assertCanCreate(reference);
+		await createAndSelectContext(reference);
+		printSelectedContext(false);
+	});
+	context.command("list").description("List every path and named context in the global store, and the root context, which always exists.").action(async () => {
+		if (g_contextStore === void 0) throw new Error("context store is unavailable");
+		const references = (await g_contextStore.list()).map((item) => formatContextReference(item.reference));
+		if (!references.includes(":root")) references.push(":root");
+		for (const reference of references.sort()) process.stdout.write(`${reference}\n`);
 	});
-	context.command("set").description("Set explicit context-capable flags on the active context; creates a cwd context when none exists.").option("--unset <key...>", "remove one or more stored context values").action(async (opts) => {
+	context.command("set").description("Set explicit context-capable flags on an existing context, or create one with --new-context.").option("--unset <key...>", "remove one or more stored context values").action(async (opts) => {
 		if (g_contextStore === void 0 || g_invocation === void 0) throw new Error("context resolver is unavailable");
-		const target = explicitOption(program, "context") !== void 0 ? mutableReference(g_invocation.selected.reference) : await mutationReference(g_contextStore, g_invocation.selected);
+		if (preparedNewContext !== void 0) {
+			if ((opts.unset?.length ?? 0) > 0) throw new Error("--unset cannot be used with --new-context");
+			return;
+		}
+		assertExplicitRootMutation(g_invocation.selected);
+		if (g_invocation.selected.context === void 0) throw new Error("No context exists to update. Use hub context set --new-context . with your desired flags.");
+		const target = mutableReference(g_invocation.selected.reference);
 		const overrides = g_invocation.cliOverrides;
 		const unset = (opts.unset ?? []).map(parseContextValueKey);
 		if (Object.keys(overrides).length === 0 && unset.length === 0) throw new Error("context set requires at least one context-capable flag or --unset");
@@ -6314,12 +8867,12 @@ Batch options:
 		process.stdout.write(`Updated context ${formatContextReference(target)}.\n`);
 		if (result !== void 0) printContextValues(result.values, false);
 	});
-	context.command("remove").description("Stop any owned connection and remove the selected context from the global store.").action(async () => {
+	context.command("remove").description("Stop any owned connection and remove the selected context; removing :root resets it to no defaults.").action(async () => {
 		if (g_contextStore === void 0 || g_invocation === void 0) throw new Error("context resolver is unavailable");
 		const reference = g_invocation.selected.reference;
 		if (reference.kind === "empty" || reference.kind === "root" && explicitOption(program, "context") === void 0) throw new Error("select the context to remove explicitly with --context");
 		if (!await g_contextStore.remove(reference)) throw new Error(`context ${formatContextReference(reference)} does not exist`);
-		process.stdout.write(`Removed context ${formatContextReference(reference)}.\n`);
+		process.stdout.write(reference.kind === "root" ? "Reset context :root to no stored defaults (the root context always exists).\n" : `Removed context ${formatContextReference(reference)}.\n`);
 	});
 	program.command("_connection-broker").description("(internal) Run a persistent connection broker.").requiredOption("--remote-endpoint <uri>").requiredOption("--timeout-ms <milliseconds-or-inf>", "", parseConnectionLimitMilliseconds).requiredOption("--ttl-ms <milliseconds-or-inf>", "", parseConnectionLimitMilliseconds).option("--notification-limit <count>", "", (value) => parsePositiveInteger(value, "--notification-limit"), 1e3).option("--schema <path-or-url>").action(async (opts) => {
 		const running = await runConnectionBroker({
@@ -6574,7 +9127,7 @@ Batch options:
 				process.once("SIGINT", onSignal);
 				process.once("SIGTERM", onSignal);
 				try {
-					const { runApprovalUi } = await import("./runApprovalUi-BFI84eck.js");
+					const { runApprovalUi } = await import("./runApprovalUi-BVAPyMfz.js");
 					await runApprovalUi({
 						client,
 						signal: stop.signal
@@ -6589,7 +9142,7 @@ Batch options:
 	registerViewCommands(program, (action) => withChannel(endpoint, getPrincipalSpec(), action));
 	program.command("ui").description("Launch the terminal UI (form-based browser of services + methods).").action(async () => {
 		const acquired = await acquireConnection(endpoint);
-		const { runUi } = await import("./runUi-BNCT8zwR.js");
+		const { runUi } = await import("./runUi-BrFeYazs.js");
 		try {
 			await runUi({
 				endpoint: acquired.ep,
@@ -6650,8 +9203,12 @@ function collectContextOverrides(program, actionCommand) {
 	copyExplicit(program, opts, result, "provisionIdentity");
 	copyExplicit(program, opts, result, "provisionIdentitySlot");
 	copyExplicit(program, opts, result, "principal");
+	copyExplicit(program, opts, result, "sign");
 	copyExplicit(program, opts, result, "schema");
 	copyExplicit(program, opts, result, "validation");
+	copyExplicit(program, opts, result, "daemonService");
+	copyExplicit(program, opts, result, "detachKeys");
+	for (let command = actionCommand; command; command = command.parent) if (command.name() === "services") copyExplicit(command, command.opts(), result, "namespace");
 	if (getCommandPath(actionCommand) === "connection create") {
 		const actionOpts = actionCommand.opts();
 		copyExplicit(actionCommand, actionOpts, result, "timeout", "connectionTimeout");
@@ -6695,6 +9252,10 @@ function mutableReference(reference) {
 	if (reference.kind === "empty") throw new Error(":empty is immutable and cannot be modified");
 	return reference;
 }
+/** The root context applies to every folder without a context: change it only when selected explicitly. */
+function assertExplicitRootMutation(selected) {
+	if (selected.selectedBy === "root") throw new Error("No folder or named context applies here, so the root context is in effect. To change defaults for every such folder, select it explicitly with --context :root; to create a context for this folder, use --new-context .");
+}
 function printSelectedContext(effective) {
 	if (g_invocation === void 0) throw new Error("context resolver is unavailable");
 	const selected = g_invocation.selected;
@@ -6721,7 +9282,7 @@ function contextSelectionDescription(selectedBy) {
 		case "argument": return "--context";
 		case "environment": return "LINKRPC_CONTEXT (HUBRPC_CONTEXT fallback)";
 		case "cwd": return "current-directory lookup";
-		case "root": return ":root fallback";
+		case "root": return ":root fallback (no folder context applies)";
 		case "empty": return "no matching context (:empty)";
 	}
 }
@@ -6746,6 +9307,9 @@ function printContextValues(values, revealToken, source) {
 }
 function contextValueFlag(key) {
 	return {
+		daemonService: "daemon-service",
+		detachKeys: "detach-keys",
+		namespace: "namespace",
 		endpoint: "endpoint",
 		endpointCmd: "endpoint-cmd",
 		endpointCmdStdio: "endpoint-cmd-stdio",
@@ -6756,6 +9320,7 @@ function contextValueFlag(key) {
 		provisionIdentity: "provision-identity",
 		provisionIdentitySlot: "provision-identity-slot",
 		principal: "principal",
+		sign: "sign",
 		schema: "schema",
 		validation: "validation",
 		connectionTimeout: "connection-timeout",
@@ -6765,6 +9330,9 @@ function contextValueFlag(key) {
 }
 function parseContextValueKey(value) {
 	const entry = Object.keys({
+		daemonService: true,
+		detachKeys: true,
+		namespace: true,
 		endpoint: true,
 		endpointCmd: true,
 		endpointCmdStdio: true,
@@ -6775,6 +9343,7 @@ function parseContextValueKey(value) {
 		provisionIdentity: true,
 		provisionIdentitySlot: true,
 		principal: true,
+		sign: true,
 		schema: true,
 		validation: true,
 		connectionTimeout: true,
@@ -6787,6 +9356,11 @@ function parseContextValueKey(value) {
 function effectiveValidation(profile) {
 	return g_invocation?.values.validation ?? validationDefault(profile);
 }
+/** The configured TTY detach sequence; validated when used, so invalid stored values fail with a clear message. */
+function detachKeys() {
+	const spec = g_invocation?.values.detachKeys;
+	return spec === void 0 ? void 0 : DetachKeys.parse(spec);
+}
 function parseValidationMode(value) {
 	if (value === "auto" || value === "required" || value === "off") return value;
 	throw new InvalidArgumentError("--validation must be 'auto', 'required', or 'off'");
@@ -6803,20 +9377,25 @@ function hasEndpointOverrides(values) {
 	return values.endpoint !== void 0 || values.endpointCmd !== void 0 || values.endpointCmdStdio !== void 0 || values.endpointCmdEnv !== void 0 || values.endpointToken !== void 0 || values.endpointCmdCwd !== void 0 || values.provisionIdentity !== void 0 || values.provisionIdentitySlot !== void 0;
 }
 async function withChannel(endpoint, principalSpec, fn, opts = {}) {
+	const sign = resolveSigning(g_invocation?.profile ?? "rpc", g_invocation?.values ?? {}, opts.requireSigning);
 	const acquired = await acquireConnection(endpoint);
 	const conn = await connect(acquired.ep, acquired.running === void 0 ? wireLog("hub") : void 0);
 	try {
 		const schemaSource = g_invocation?.values.schema;
 		const channel = schemaSource === void 0 ? conn.channel : withStaticHubReflection(conn.channel, await loadStaticHubSchema(schemaSource));
 		if (acquired.ep.kind === "ws-no-init" || acquired.ep.kind === "socket" && acquired.ep.brokerMode === "raw") {
+			if (opts.requireSigning || g_invocation?.values.sign === true) throw new Error("Signing requires an initialized LinkRPC endpoint.");
 			await fn(channel);
 			return;
 		}
-		if (g_invocation?.profile === "rpc") {
+		if (!sign) {
 			await fn(channel);
 			return;
 		}
-		const session = await setupSigning(conn.channel, conn.signing, principalSpec, { negotiateHubCaps: acquired.running !== void 0 || isHubEndpoint(acquired.ep) });
+		const session = await setupSigning(conn.channel, conn.signing, principalSpec, {
+			negotiateHubCaps: acquired.running !== void 0 || isHubEndpoint(acquired.ep),
+			autoNegotiatePerCall: opts.autoNegotiatePerCall
+		});
 		reportIdentity(session);
 		if (opts.requestReflectionAccess !== false && schemaSource === void 0 && (acquired.running !== void 0 || isHubEndpoint(acquired.ep))) {
 			if (await requestReflectionAccess(session) === "denied") process.stderr.write("linkrpc: reflection access denied; falling back to per-call negotiation.\n");
@@ -6824,13 +9403,14 @@ async function withChannel(endpoint, principalSpec, fn, opts = {}) {
 		if (opts.requestTopologyAccess !== void 0 && (acquired.running !== void 0 || isHubEndpoint(acquired.ep))) {
 			if (await requestTopologyAccess(session, opts.requestTopologyAccess) === "denied") process.stderr.write("linkrpc: topology access denied; topology sources may be inaccessible.\n");
 		}
-		await fn(channel);
+		await fn(channel, session);
 	} finally {
 		conn.close();
 		acquired.running?.dispose();
 	}
 }
 async function withResolvedSigning(endpoint, principalSpec, fn) {
+	resolveSigning(g_invocation?.profile ?? "rpc", g_invocation?.values ?? {}, true);
 	const acquired = await acquireConnection(endpoint);
 	if (acquired.ep.kind === "ws-no-init" || acquired.ep.kind === "socket" && acquired.ep.brokerMode === "raw") {
 		acquired.running?.dispose();
@@ -6927,6 +9507,11 @@ async function acquireConnection(endpoint) {
 			running
 		};
 	}
+	if (endpoint === void 0 && g_invocation?.profile === "hub") try {
+		return { ep: resolveLocalEndpoint() };
+	} catch {
+		throw new Error("No endpoint configured through flags, environment, or context, and the local Hub daemon is not running. Pass --endpoint, or start the daemon (any `hub services run` starts it).");
+	}
 	return { ep: needEndpoint(endpoint) };
 }
 /** Print the identity used to sign calls to stderr (keeps stdout clean for JSON output). */
@@ -7022,6 +9607,6 @@ function safeJson(value) {
 	}
 }
 //#endregion
-export { formatCommandLegend as a, safeTerminalText as c, interfaceTarget as d, matchesTarget as f, dispatchHostKey as i, resolveViewTarget as l, approvalDetailLines as m, views as n, hostCommands as o, targetId as p, ViewFrame as r, matchesKey as s, runCli as t, formatCondition as u };
+export { formatCondition as _, formatCommandLegend as a, targetId as b, safeTerminalText as c, ObservablePromise as d, observableValue as f, resolveViewTarget as g, Disposable as h, dispatchHostKey as i, approvalDetailLines as l, derived as m, views as n, hostCommands as o, autorun as p, ViewFrame as r, matchesKey as s, runCli as t, ObservableLazyPromise as u, interfaceTarget as v, matchesTarget as y };
 
-//# sourceMappingURL=cli-JE4URhh3.js.map
+//# sourceMappingURL=cli-CO0iSiY_.js.map