@hediet/linkrpc-cli 0.0.3-next.20261022.1 → 0.0.3-next.20261022.2

package/README.md

@@ -800,27 +800,30 @@ process's stdin/stdout (`--stdio`) or a `--target-endpoint*`. It keeps full
 LinkRPC semantics (service ids, streaming, cancellation) and adds what the
 participant cannot do itself:
 
-- `--outbound signed` (default) re-signs every call the participant emits as
-  the CLI's `--principal` and negotiates capabilities, so a participant without
-  signing support can call services behind `forwardChecking`.
-  `--outbound verbatim` forwards calls unsigned (keeping any `$hubrpc` envelope
-  the participant attached); `--outbound none` drops them.
+- Calls the participant emits are forwarded to the hub unsigned by default,
+  keeping any `$hubrpc` envelope the participant attached. `--sign` (explicitly
+  on the `proxy` command line; the Hub profile's signing default does not
+  apply) re-signs them as `--principal`, by default the managed Hub identity,
+  and negotiates capabilities, so a participant without signing support can
+  call services behind `forwardChecking`. This lends the participant that
+  identity. `--no-outbound` drops its calls instead.
 - `--claim <serviceId>` claims the service id and forwards requests the hub
   routes to it to the participant, verbatim (callers' signatures are kept).
 
 ```sh
 # A Rust client that cannot sign yet reaches a gated remote service.
 # Point it at this cmd-stdio endpoint and address calls to the remote service id:
-#   cmd-stdio:?argv=linkrpc&argv=hub&argv=proxy&argv=--stdio
-hub proxy --stdio
+#   cmd-stdio:?argv=linkrpc&argv=hub&argv=proxy&argv=--stdio&argv=--sign
+hub proxy --stdio --sign
+hub proxy --stdio --sign --principal user:automation
 
 # Serve a stdio program under a service id (equivalent to `tunnel`).
-hub proxy --claim my/service --outbound none --target-endpoint-cmd-stdio "my-server --stdio"
+hub proxy --claim my/service --no-outbound --target-endpoint-cmd-stdio "my-server --stdio"
 ```
 
 With `--stdio`, the proxy exits when stdin closes. `tunnel <serviceId>` is
-`proxy --claim <serviceId>` with `--bidi` selecting `--outbound verbatim`
-instead of `none`.
+`proxy --claim <serviceId> --no-outbound`; with `--bidi` it forwards the
+target's calls unsigned.
 
 ### Capabilities
 

package/dist/chunks/{cli-Cw9kg0Dt.js → cli-C0AV_fi4.js}

@@ -8967,19 +8967,20 @@ Batch options:
 				local.close();
 			}
 		});
-		addTargetEndpointOptions(program.command("proxy").description("Stand in for a participant on the hub (--endpoint*). The participant is this process's stdin/stdout (--stdio) or a target endpoint (--target-endpoint*). Calls the participant emits are forwarded to the hub per --outbound: `signed` (default) re-signs them as this CLI's --principal with capability negotiation, so participants that cannot sign can call gated services; `verbatim` forwards them unsigned; `none` drops them. With --claim, requests the hub routes to <serviceId> are forwarded to the participant. Runs until the participant disconnects or Ctrl-C.")).option("--stdio", "use this process's stdin/stdout as the participant").option("--claim <serviceId>", "claim <serviceId> on the hub and forward its requests to the participant").addOption(new Option("--outbound <mode>", "how participant calls reach the hub").choices([
-			"signed",
-			"verbatim",
-			"none"
-		]).default("signed")).action(async (cmdOpts) => {
+		addTargetEndpointOptions(program.command("proxy").description("Stand in for a participant on the hub (--endpoint*). The participant is this process's stdin/stdout (--stdio) or a target endpoint (--target-endpoint*). Calls the participant emits are forwarded to the hub unsigned, keeping any signature the participant attached. Pass --sign explicitly to re-sign them as --principal (default: the managed Hub identity) with capability negotiation, so participants that cannot sign can call gated services; --no-outbound drops them instead. With --claim, requests the hub routes to <serviceId> are forwarded to the participant. Runs until the participant disconnects or Ctrl-C.")).option("--stdio", "use this process's stdin/stdout as the participant").option("--claim <serviceId>", "claim <serviceId> on the hub and forward its requests to the participant").option("--no-outbound", "do not forward calls the participant emits to the hub").action(async (cmdOpts) => {
 			const localEp = needEndpoint(endpoint);
 			if (cmdOpts.stdio === hasTargetEndpoint(cmdOpts)) {
 				process.stderr.write("linkrpc: proxy requires exactly one of --stdio or --target-endpoint*.\n");
 				process.exit(2);
 			}
+			const signOutbound = g_invocation?.cliOverrides.sign === true;
+			if (signOutbound && !cmdOpts.outbound) {
+				process.stderr.write("linkrpc: proxy --sign has no effect with --no-outbound.\n");
+				process.exit(2);
+			}
 			const targetEp = cmdOpts.stdio ? void 0 : resolveTargetEndpointOrExit(cmdOpts, program.opts(), "proxy");
 			const hub = await connect(localEp, wireLog("hub"));
-			reportIdentity(await setupSigning(hub.channel, hub.signing, getPrincipalSpec(), { negotiateHubCaps: isHubEndpoint(localEp) }));
+			if (resolveSigning(g_invocation?.profile ?? "hub", g_invocation?.values ?? {})) reportIdentity(await setupSigning(hub.channel, hub.signing, getPrincipalSpec(), { negotiateHubCaps: isHubEndpoint(localEp) }));
 			const participant = targetEp === void 0 ? await connectStdioParticipant() : {
 				connection: await connectTargetEndpoint(targetEp, cmdOpts.claim ?? ""),
 				closed: void 0
@@ -8988,7 +8989,7 @@ Batch options:
 				await proxyCommand({
 					hub,
 					participant: participant.connection,
-					outbound: cmdOpts.outbound,
+					outbound: !cmdOpts.outbound ? "none" : signOutbound ? "signed" : "verbatim",
 					...cmdOpts.claim !== void 0 ? { claimServiceId: cmdOpts.claim } : {},
 					...participant.closed !== void 0 ? { stop: participant.closed } : {}
 				});
@@ -9118,7 +9119,7 @@ Batch options:
 				process.once("SIGINT", onSignal);
 				process.once("SIGTERM", onSignal);
 				try {
-					const { runApprovalUi } = await import("./runApprovalUi-DpoUwBpd.js");
+					const { runApprovalUi } = await import("./runApprovalUi-CkT1KK-X.js");
 					await runApprovalUi({
 						client,
 						signal: stop.signal
@@ -9133,7 +9134,7 @@ Batch options:
 	registerViewCommands(program, (action) => withChannel(endpoint, getPrincipalSpec(), action));
 	program.command("ui").description("Launch the terminal UI (form-based browser of services + methods).").action(async () => {
 		const acquired = await acquireConnection(endpoint);
-		const { runUi } = await import("./runUi-BbiA5lOP.js");
+		const { runUi } = await import("./runUi-mpVqJ6QU.js");
 		try {
 			await runUi({
 				endpoint: acquired.ep,
@@ -9669,4 +9670,4 @@ function safeJson(value) {
 //#endregion
 export { formatCondition as _, formatCommandLegend as a, targetId as b, safeTerminalText as c, ObservablePromise as d, observableValue as f, resolveViewTarget as g, Disposable as h, dispatchHostKey as i, approvalDetailLines as l, derived as m, views as n, hostCommands as o, autorun as p, ViewFrame as r, matchesKey as s, runCli as t, ObservableLazyPromise as u, interfaceTarget as v, matchesTarget as y };
 
-//# sourceMappingURL=cli-Cw9kg0Dt.js.map
+//# sourceMappingURL=cli-C0AV_fi4.js.map