@hediet/linkrpc-cli 0.0.3-next.20261021.2 → 0.0.3-next.20261022.2

package/README.md

@@ -793,6 +793,38 @@ frame, and each remote frame is written as one JSON line:
 hub --endpoint unix:/run/hub.sock json-rpc-stdio language-server
 ```
 
+### Participant proxy
+
+`proxy` stands in for a participant on the hub: the participant is either this
+process's stdin/stdout (`--stdio`) or a `--target-endpoint*`. It keeps full
+LinkRPC semantics (service ids, streaming, cancellation) and adds what the
+participant cannot do itself:
+
+- Calls the participant emits are forwarded to the hub unsigned by default,
+  keeping any `$hubrpc` envelope the participant attached. `--sign` (explicitly
+  on the `proxy` command line; the Hub profile's signing default does not
+  apply) re-signs them as `--principal`, by default the managed Hub identity,
+  and negotiates capabilities, so a participant without signing support can
+  call services behind `forwardChecking`. This lends the participant that
+  identity. `--no-outbound` drops its calls instead.
+- `--claim <serviceId>` claims the service id and forwards requests the hub
+  routes to it to the participant, verbatim (callers' signatures are kept).
+
+```sh
+# A Rust client that cannot sign yet reaches a gated remote service.
+# Point it at this cmd-stdio endpoint and address calls to the remote service id:
+#   cmd-stdio:?argv=linkrpc&argv=hub&argv=proxy&argv=--stdio&argv=--sign
+hub proxy --stdio --sign
+hub proxy --stdio --sign --principal user:automation
+
+# Serve a stdio program under a service id (equivalent to `tunnel`).
+hub proxy --claim my/service --no-outbound --target-endpoint-cmd-stdio "my-server --stdio"
+```
+
+With `--stdio`, the proxy exits when stdin closes. `tunnel <serviceId>` is
+`proxy --claim <serviceId> --no-outbound`; with `--bidi` it forwards the
+target's calls unsigned.
+
 ### Capabilities
 
 `linkrpc hub caps list [--json]` lists the selected principal's stored capabilities,

package/dist/chunks/{cli-CO0iSiY_.js → cli-C0AV_fi4.js}

@@ -1,4 +1,4 @@
-import { $ as setupSigning, B as tunnelCommand, F as disconnectBroker, H as parseConnectionLimit, I as getBrokerStatus, K as resolveCliInvocation, L as readBrokerNotifications, M as readEndpointDiscovery, N as ContextStore, P as formatContextReference, Q as requestTopologyAccess, R as stopConnectionBroker, U as parseConnectionLimitMilliseconds, V as withStaticHubReflection, W as parseDuration, Z as requestReflectionAccess, a as resolveInvocationEndpoint, at as logoutCliIdentity, bt as MethodRefWithOptHash, c as resolveLocalEndpoint, ct as connect, dt as resolveTargetEndpoint, et as fetchDefaults, ft as resolvedEndpointToConfig, gt as validateValueAgainstSchema, ht as explainValidation, i as resolveInvocationContext, lt as connectViaRootOverlay, m as managedEndpointsInterface, mt as describeSchema, n as loadStaticHubSchema, nt as findMethodInSchema, o as resolveSigning, ot as formatPrincipalSource, pt as describeObjectParams, r as resolveStaticHubSchemaSource, rt as walkHub, s as validationDefault, st as parsePrincipalSpec, t as completeForLine, tt as fetchSchema$1, ut as connectViaTransport, vt as mergeParams, xt as mcpForwardInterface, y as HubHome, yt as parseParamOverride, z as ConnectionBroker } from "./runComplete-B3b-UhnA.js";
+import { $ as requestTopologyAccess, B as proxyCommand, F as disconnectBroker, G as parseDuration, H as withStaticHubReflection, I as getBrokerStatus, L as readBrokerNotifications, M as readEndpointDiscovery, N as ContextStore, P as formatContextReference, Q as requestReflectionAccess, R as stopConnectionBroker, St as mcpForwardInterface, U as parseConnectionLimit, V as tunnelCommand, W as parseConnectionLimitMilliseconds, _t as validateValueAgainstSchema, a as resolveInvocationEndpoint, bt as parseParamOverride, c as resolveLocalEndpoint, ct as parsePrincipalSpec, dt as connectViaTransport, et as setupSigning, ft as resolveTargetEndpoint, gt as explainValidation, ht as describeSchema, i as resolveInvocationContext, it as walkHub, lt as connect, m as managedEndpointsInterface, mt as describeObjectParams, n as loadStaticHubSchema, nt as fetchSchema$1, o as resolveSigning, ot as logoutCliIdentity, pt as resolvedEndpointToConfig, q as resolveCliInvocation, r as resolveStaticHubSchemaSource, rt as findMethodInSchema, s as validationDefault, st as formatPrincipalSource, t as completeForLine, tt as fetchDefaults, ut as connectViaRootOverlay, xt as MethodRefWithOptHash, y as HubHome, yt as mergeParams, z as ConnectionBroker } from "./runComplete-HH0NuvsL.js";
 import { ErrorCode, INTERFACE_TEMPLATES_EXTENSION, LinkRpcConnection, RpcError, computeInterfaceHash, connectTransports, createSchemaToZod, directoryInterface, exportStaticHubSchema, generateTsContract, generateTsInterface, interfaceTemplateArgumentsEquivalent, interfaceTemplateMemberName, interfaceTemplatesEqual, isAssignable, jcsCanonicalize, matchParams, schemaToZod, validateInterfaceTemplates } from "@hediet/linkrpc";
 import { z } from "zod";
 import { WebSocketTransport, connectNdjson, connectToHub, formatEndpointUri, isHubEndpoint, openWebSocket, parseEndpointUri, runInitializeHandshake, traceMessageTransport as traceMessageTransport$1 } from "@hediet/linkrpc/node";
@@ -406,7 +406,7 @@ function contextNamespace(reference) {
 async function useLocalManagement(start, action) {
 	const home = HubHome.resolve();
 	if (start) {
-		const { startDaemon, nodeDaemonLaunch } = await import("./src-ConeU7vr.js");
+		const { startDaemon, nodeDaemonLaunch } = await import("./src-CCHXMIFR.js");
 		if (await startDaemon({
 			home,
 			launch: nodeDaemonLaunch(home)
@@ -426,7 +426,7 @@ async function useLocalManagement(start, action) {
 	}
 }
 async function restartLocalDaemon() {
-	const { startDaemon, stopDaemon, nodeDaemonLaunch } = await import("./src-ConeU7vr.js");
+	const { startDaemon, stopDaemon, nodeDaemonLaunch } = await import("./src-CCHXMIFR.js");
 	const home = HubHome.resolve();
 	process.stderr.write("Restarting the local Hub daemon: clients will disconnect and managed workloads will stop. OS autostart settings are unchanged.\n");
 	await stopDaemon(home);
@@ -8927,13 +8927,7 @@ Batch options:
 				logMessages: g_logMessages
 			});
 		});
-		program.command("tunnel <serviceId>").description("Claim <serviceId> on the source hub (--endpoint*) and forward every request it routes here to a target endpoint over a second connection. The target endpoint is set via --target-endpoint / --target-endpoint-cmd / --target-endpoint-cmd-stdio; when it is --target-endpoint-cmd, the spawned child sees `hubGrantedServiceId::get().grantedServiceIdNamespace` = <serviceId> from its local hub, and global --provision-identity[-slot] applies to it. With `-c, --config`, the source hub is instead appended to the config as an endpoint claiming <serviceId>, and the in-process hub serves it (the config provides the target). Runs until Ctrl-C.").option("--target-endpoint <uri>", "target endpoint URI (unix:/path?token=…, npipe://./pipe/…, ws[s]://host?token=…, cmd:?command=… or cmd-stdio:?command=…)").option("--target-endpoint-cmd <command>", "spawn the target as a server, connect via an injected env socket; the child sees grantedServiceIdNamespace = <serviceId> via hubGrantedServiceId::get").option("--target-endpoint-cmd-stdio <command>", "spawn the target and talk linkrpc over its stdio").option("--target-endpoint-cmd-env <key=value>", "env var for the --target-endpoint-cmd / --target-endpoint-cmd-stdio child (repeatable)", (val, acc) => {
-			const eq = val.indexOf("=");
-			if (eq === -1) throw new InvalidArgumentError(`expected key=value, got '${val}'`);
-			const next = acc ?? {};
-			next[val.slice(0, eq)] = val.slice(eq + 1);
-			return next;
-		}).option("--target-endpoint-token <token>", "token overriding the target URI token (no env fallback for the target)").option("--target-endpoint-cmd-cwd <dir>", "working directory for the --target-endpoint-cmd / --target-endpoint-cmd-stdio child").option("--bidi", "also forward every request/notification the target endpoint emits back to the source hub, exposing the hub to the endpoint (forwards everything, unsigned)").action(async (serviceId, cmdOpts) => {
+		addTargetEndpointOptions(program.command("tunnel <serviceId>").description("Claim <serviceId> on the source hub (--endpoint*) and forward every request it routes here to a target endpoint over a second connection. The target endpoint is set via --target-endpoint / --target-endpoint-cmd / --target-endpoint-cmd-stdio; when it is --target-endpoint-cmd, the spawned child sees `hubGrantedServiceId::get().grantedServiceIdNamespace` = <serviceId> from its local hub, and global --provision-identity[-slot] applies to it. With `-c, --config`, the source hub is instead appended to the config as an endpoint claiming <serviceId>, and the in-process hub serves it (the config provides the target). Runs until Ctrl-C.")).option("--bidi", "also forward every request/notification the target endpoint emits back to the source hub, exposing the hub to the endpoint (forwards everything, unsigned)").action(async (serviceId, cmdOpts) => {
 			const localEp = needEndpoint(endpoint);
 			if (g_hubConfigPath !== void 0) {
 				const baseConfig = loadHubConfig(g_hubConfigPath);
@@ -8957,42 +8951,9 @@ Batch options:
 				});
 				return;
 			}
-			const globalOpts = program.opts();
-			const targetRes = resolveTargetEndpoint({
-				targetEndpoint: cmdOpts.targetEndpoint,
-				targetEndpointCmd: cmdOpts.targetEndpointCmd,
-				targetEndpointCmdStdio: cmdOpts.targetEndpointCmdStdio,
-				targetEndpointCmdEnv: cmdOpts.targetEndpointCmdEnv,
-				targetEndpointToken: cmdOpts.targetEndpointToken,
-				targetEndpointCmdCwd: cmdOpts.targetEndpointCmdCwd,
-				provisionIdentity: globalOpts.provisionIdentity,
-				provisionIdentitySlot: globalOpts.provisionIdentitySlot
-			});
-			if (targetRes.error) {
-				process.stderr.write(`linkrpc: ${targetRes.error}\n`);
-				process.exit(2);
-			}
-			if (!targetRes.endpoint) {
-				process.stderr.write("linkrpc: tunnel requires --target-endpoint / --target-endpoint-cmd / --target-endpoint-cmd-stdio.\n");
-				process.exit(2);
-			}
-			const targetEp = targetRes.endpoint;
-			const remoteTok = process.env.LINKRPC_REMOTE_ENDPOINT_TOKEN;
-			const targetEpWithToken = remoteTok !== void 0 && (targetEp.kind === "socket" || targetEp.kind === "ws") && targetEp.token === void 0 ? {
-				...targetEp,
-				token: remoteTok
-			} : targetEp;
+			const targetEp = resolveTargetEndpointOrExit(cmdOpts, program.opts(), "tunnel");
 			const local = await connect(localEp, wireLog("source"));
-			let remote;
-			if (targetEpWithToken.kind === "cmd-env") remote = await connectViaRootOverlay({
-				command: targetEpWithToken.command,
-				provisionSlot: targetEpWithToken.provisionSlot,
-				env: targetEpWithToken.env,
-				...targetEpWithToken.cwd !== void 0 ? { cwd: targetEpWithToken.cwd } : {},
-				grantedNamespace: serviceId,
-				log: wireLog("target")
-			});
-			else remote = await connect(targetEpWithToken, wireLog("target"));
+			const remote = await connectTargetEndpoint(targetEp, serviceId);
 			try {
 				reportIdentity(await setupSigning(local.channel, local.signing, getPrincipalSpec(), { negotiateHubCaps: isHubEndpoint(localEp) }));
 				await tunnelCommand({
@@ -9006,6 +8967,37 @@ Batch options:
 				local.close();
 			}
 		});
+		addTargetEndpointOptions(program.command("proxy").description("Stand in for a participant on the hub (--endpoint*). The participant is this process's stdin/stdout (--stdio) or a target endpoint (--target-endpoint*). Calls the participant emits are forwarded to the hub unsigned, keeping any signature the participant attached. Pass --sign explicitly to re-sign them as --principal (default: the managed Hub identity) with capability negotiation, so participants that cannot sign can call gated services; --no-outbound drops them instead. With --claim, requests the hub routes to <serviceId> are forwarded to the participant. Runs until the participant disconnects or Ctrl-C.")).option("--stdio", "use this process's stdin/stdout as the participant").option("--claim <serviceId>", "claim <serviceId> on the hub and forward its requests to the participant").option("--no-outbound", "do not forward calls the participant emits to the hub").action(async (cmdOpts) => {
+			const localEp = needEndpoint(endpoint);
+			if (cmdOpts.stdio === hasTargetEndpoint(cmdOpts)) {
+				process.stderr.write("linkrpc: proxy requires exactly one of --stdio or --target-endpoint*.\n");
+				process.exit(2);
+			}
+			const signOutbound = g_invocation?.cliOverrides.sign === true;
+			if (signOutbound && !cmdOpts.outbound) {
+				process.stderr.write("linkrpc: proxy --sign has no effect with --no-outbound.\n");
+				process.exit(2);
+			}
+			const targetEp = cmdOpts.stdio ? void 0 : resolveTargetEndpointOrExit(cmdOpts, program.opts(), "proxy");
+			const hub = await connect(localEp, wireLog("hub"));
+			if (resolveSigning(g_invocation?.profile ?? "hub", g_invocation?.values ?? {})) reportIdentity(await setupSigning(hub.channel, hub.signing, getPrincipalSpec(), { negotiateHubCaps: isHubEndpoint(localEp) }));
+			const participant = targetEp === void 0 ? await connectStdioParticipant() : {
+				connection: await connectTargetEndpoint(targetEp, cmdOpts.claim ?? ""),
+				closed: void 0
+			};
+			try {
+				await proxyCommand({
+					hub,
+					participant: participant.connection,
+					outbound: !cmdOpts.outbound ? "none" : signOutbound ? "signed" : "verbatim",
+					...cmdOpts.claim !== void 0 ? { claimServiceId: cmdOpts.claim } : {},
+					...participant.closed !== void 0 ? { stop: participant.closed } : {}
+				});
+			} finally {
+				participant.connection.close();
+				hub.close();
+			}
+		});
 		program.command("connect-as <binderServiceId> <slot>").description("Mint a single-use identity token for <slot> from the <binderServiceId> (a service implementing connectionTokenBinder, typically the hub service id), then splice a target endpoint onto the hub as a first-class participant with that slot's managed identity and a granted serviceId namespace (--granted-service-id, defaulting to <slot>). No local hub is started: the CLI proxies the connection (target ⟷ CLI ⟷ hub), so it works with every target kind and --log-messages taps the full flow. The hub-facing bound-token listener is --hub-endpoint (defaults to --endpoint when that is a ws/socket). Runs until Ctrl-C.").option("--hub-endpoint <uri>", "ws/socket bound-token listener to splice the target onto (default: --endpoint)").option("--target-endpoint <uri>", "target endpoint URI (unix:/…, ws[s]://…)").option("--target-endpoint-cmd <command>", "spawn the target as a server; it dials the CLI back").option("--target-endpoint-cmd-stdio <command>", "spawn the target and talk linkrpc over its stdio").option("--target-endpoint-cmd-env <key=value>", "env var for the --target-endpoint-cmd / --target-endpoint-cmd-stdio child (repeatable)", (val, acc) => {
 			const eq = val.indexOf("=");
 			if (eq === -1) throw new InvalidArgumentError(`expected key=value, got '${val}'`);
@@ -9127,7 +9119,7 @@ Batch options:
 				process.once("SIGINT", onSignal);
 				process.once("SIGTERM", onSignal);
 				try {
-					const { runApprovalUi } = await import("./runApprovalUi-BVAPyMfz.js");
+					const { runApprovalUi } = await import("./runApprovalUi-CkT1KK-X.js");
 					await runApprovalUi({
 						client,
 						signal: stop.signal
@@ -9142,7 +9134,7 @@ Batch options:
 	registerViewCommands(program, (action) => withChannel(endpoint, getPrincipalSpec(), action));
 	program.command("ui").description("Launch the terminal UI (form-based browser of services + methods).").action(async () => {
 		const acquired = await acquireConnection(endpoint);
-		const { runUi } = await import("./runUi-BrFeYazs.js");
+		const { runUi } = await import("./runUi-mpVqJ6QU.js");
 		try {
 			await runUi({
 				endpoint: acquired.ep,
@@ -9525,6 +9517,75 @@ function needEndpoint(endpoint) {
 	}
 	return endpoint;
 }
+/** The `--target-endpoint*` options shared by `tunnel` and `proxy`. */
+function addTargetEndpointOptions(command) {
+	return command.option("--target-endpoint <uri>", "target endpoint URI (unix:/path?token=…, npipe://./pipe/…, ws[s]://host?token=…, cmd:?command=… or cmd-stdio:?command=…)").option("--target-endpoint-cmd <command>", "spawn the target as a server, connect via an injected env socket; the child sees the claimed service id as grantedServiceIdNamespace via hubGrantedServiceId::get").option("--target-endpoint-cmd-stdio <command>", "spawn the target and talk linkrpc over its stdio").option("--target-endpoint-cmd-env <key=value>", "env var for the --target-endpoint-cmd / --target-endpoint-cmd-stdio child (repeatable)", (val, acc) => {
+		const eq = val.indexOf("=");
+		if (eq === -1) throw new InvalidArgumentError(`expected key=value, got '${val}'`);
+		const next = acc ?? {};
+		next[val.slice(0, eq)] = val.slice(eq + 1);
+		return next;
+	}).option("--target-endpoint-token <token>", "token overriding the target URI token (no env fallback for the target)").option("--target-endpoint-cmd-cwd <dir>", "working directory for the --target-endpoint-cmd / --target-endpoint-cmd-stdio child");
+}
+function hasTargetEndpoint(opts) {
+	return opts.targetEndpoint !== void 0 || opts.targetEndpointCmd !== void 0 || opts.targetEndpointCmdStdio !== void 0;
+}
+function resolveTargetEndpointOrExit(opts, globalOpts, commandName) {
+	const targetRes = resolveTargetEndpoint({
+		...opts,
+		provisionIdentity: globalOpts.provisionIdentity,
+		provisionIdentitySlot: globalOpts.provisionIdentitySlot
+	});
+	if (targetRes.error) {
+		process.stderr.write(`linkrpc: ${targetRes.error}\n`);
+		process.exit(2);
+	}
+	if (!targetRes.endpoint) {
+		process.stderr.write(`linkrpc: ${commandName} requires --target-endpoint / --target-endpoint-cmd / --target-endpoint-cmd-stdio.\n`);
+		process.exit(2);
+	}
+	const targetEp = targetRes.endpoint;
+	const remoteTok = process.env.LINKRPC_REMOTE_ENDPOINT_TOKEN;
+	return remoteTok !== void 0 && (targetEp.kind === "socket" || targetEp.kind === "ws") && targetEp.token === void 0 ? {
+		...targetEp,
+		token: remoteTok
+	} : targetEp;
+}
+/**
+* Connect straight to a target endpoint — no routing hub. A spawned cmd-env
+* child is fronted with a RootOverlay: its root-form calls (identity::*,
+* hubGrantedServiceId::*, reflection, hubAccess) are served locally while every
+* forwarded request is relayed to the child through the overlay splitter. This
+* keeps --provision-identity working (identity::* is served) without the 'hub'
+* service id / claim-wait dance a full local hub imposes.
+*/
+async function connectTargetEndpoint(target, grantedNamespace) {
+	if (target.kind !== "cmd-env") return connect(target, wireLog("target"));
+	return connectViaRootOverlay({
+		command: target.command,
+		provisionSlot: target.provisionSlot,
+		env: target.env,
+		...target.cwd !== void 0 ? { cwd: target.cwd } : {},
+		grantedNamespace,
+		log: wireLog("target")
+	});
+}
+/** This process's stdin/stdout as a participant; `closed` resolves when stdin ends. */
+async function connectStdioParticipant() {
+	let markClosed;
+	const closed = new Promise((resolve) => {
+		markClosed = resolve;
+	});
+	const { transport } = await connectNdjson({
+		input: process.stdin,
+		output: process.stdout,
+		onClose: () => markClosed()
+	});
+	return {
+		connection: connectViaTransport(transport),
+		closed
+	};
+}
 /**
 * Resolve the ws/socket bound-token listener `connect-as` splices the target
 * onto: an explicit `--hub-endpoint <uri>`, else the fallback endpoint when it
@@ -9609,4 +9670,4 @@ function safeJson(value) {
 //#endregion
 export { formatCondition as _, formatCommandLegend as a, targetId as b, safeTerminalText as c, ObservablePromise as d, observableValue as f, resolveViewTarget as g, Disposable as h, dispatchHostKey as i, approvalDetailLines as l, derived as m, views as n, hostCommands as o, autorun as p, ViewFrame as r, matchesKey as s, runCli as t, ObservableLazyPromise as u, interfaceTarget as v, matchesTarget as y };
 
-//# sourceMappingURL=cli-CO0iSiY_.js.map
+//# sourceMappingURL=cli-C0AV_fi4.js.map