@hediet/linkrpc-cli 0.0.3-next.20261023.2 → 0.0.3-next.20261023.4

package/README.md

@@ -793,6 +793,7 @@ initial document:
 | `connection notifications [--after n] [--wait 25s] [--follow]` | Read incoming remote notifications from the broker's bounded buffer. `--follow` emits one JSON object per line and can run alongside calls. |
 | `connection destroy`                                  | Stop the configured connection broker through its local overlay. |
 | `json-rpc-stdio <serviceId> [--params <json>]`         | In the Hub profile, expose `<serviceId>::jsonRpcConnection::connectRaw` as newline-delimited JSON-RPC on stdin/stdout. Diagnostics remain on stderr. |
+| `json-rpc-export --target-endpoint <uri> --serviceId <id> --path <path> ...` | In the Hub profile, export multiple JSON-RPC factories through one authenticated raw WebSocket listener. |
 
 The inherited `--schema <path-or-url>` option also overlays static
 `hubrpc.defaults`, `hubrpc.directory`, and `hubrpc.schemas` reflection for
@@ -812,6 +813,27 @@ frame, and each remote frame is written as one JSON line:
 hub --endpoint unix:/run/hub.sock json-rpc-stdio language-server
 ```
 
+`json-rpc-export` maps multiple Hub JSON-RPC services to distinct paths on one listener:
+
+```sh
+linkrpc hub json-rpc-export \
+  --target-endpoint "listen:ws://127.0.0.1:8123" \
+  --target-token "$EXPORT_TOKEN" \
+  --target-token-query-param tkn \
+  --serviceId foo --path /foo \
+  --serviceId bar --path /bar
+```
+
+Each `--serviceId` must be followed by its `--path`; a leading slash is optional. Missing pairs, duplicate paths, and unsupported endpoints fail before connecting to the Hub. Each WebSocket client opens an independent `<serviceId>::jsonRpcConnection::connectRaw` session, including clients on the same route. Requests, responses, notifications, and server-initiated requests pass unchanged, without a `hubrpc::initialize` handshake.
+
+The nonempty export token is separate from the source Hub credentials. Clients authenticate during the WebSocket upgrade with `Authorization: Bearer <token>` or a configured query parameter. Without `--target-token-query-param`, the accepted query names are `tkn` (VS Code sends its `connectionToken` under this name) and `token`. Supplying the repeatable option replaces those defaults: for example `--target-token-query-param connectionToken --target-token-query-param api_key` accepts either custom name. Bearer headers remain accepted. Exactly one credential is required: duplicate query parameters, multiple Authorization headers, or a header combined with a recognized query parameter are rejected, even if their values match. Unrecognized parameters are not credentials.
+
+Alternatively, configure the listener token in the target URI as `listen:ws://127.0.0.1:8123?token=...`; this configuration syntax is independent of the accepted client query names. Readiness output never includes the token. Unknown routes return 404 and missing/invalid/ambiguous credentials return 401 without opening an upstream session. Anyone holding this token can access all configured routes using the export process's Hub identity; use a narrowly scoped identity and protect the token. Client credentials are consumed by the listener and never forwarded to the upstream factory.
+
+Only `listen:ws://` TCP listeners are currently supported, not named pipes or TLS listeners. Bind loopback for local use. For remote access, terminate TLS in a trusted reverse proxy rather than sending tokens over unencrypted networks. The gateway limits connections to 100, frames to 16 MiB, and pending input per client to 32 MiB / 1024 frames; slow consumers and failed upstreams close only their own connection. Factories must open within 30 seconds.
+
+The command stays in the foreground until SIGINT/SIGTERM, then closes clients and the listener. Use the existing Hub daemon/service lifecycle to supervise it; this command neither installs a service nor starts remote AHP hosts. Diagnostics and the bound address (including an assigned port when using port 0) go to stderr.
+
 ### Participant proxy
 
 `proxy` stands in for a participant on the hub: the participant is either this

package/dist/chunks/{cli-B93twHKF.js → cli-CYL6JUxF.js}

@@ -26,6 +26,7 @@ import { stdin, stdout } from "node:process";
 import { TrafficFlowAggregator, createTerminalConsentPrompt, formatFlowSummary } from "@hediet/linkrpc-hub";
 import { loadHubConfig, printHubConfigSchema } from "@hediet/linkrpc-hub/config-file";
 import { connectJsonRpcTransports, connectRawJsonRpcTransport, createNdjsonJsonRpcTransport, jsonRpcConnectionInterface } from "@hediet/linkrpc-infra/json-rpc";
+import { startJsonRpcWebSocketExport, validateJsonRpcExport } from "@hediet/linkrpc-infra/json-rpc/node";
 import { GRAPH_INTERFACE_TAG, IMMUTABLE_GRAPH_INTERFACE_ID, ROOT_WATCH_INTERFACE_ID, evaluateGraphPresentation, graphPresentationInterface, graphPresentationSchema, isGraphRef, standardGraphRuntimeOptions, validateGraphInterfaceSchema } from "@hediet/linkrpc-infra/graph";
 import React from "react";
 import { Box, Text, measureElement, render } from "ink";
@@ -3510,6 +3511,36 @@ async function jsonRpcStdioCommand(options) {
 	stdio.close("closed");
 }
 //#endregion
+//#region src/commands/jsonRpcExport.ts
+/** Preserve option order so a missing path cannot shift subsequent service mappings. */
+var JsonRpcExportRoutes = class {
+	_routes = [];
+	_pendingService;
+	serviceId(value) {
+		if (this._pendingService !== void 0) throw new Error("Each --serviceId must be followed by --path.");
+		this._pendingService = value;
+	}
+	path(value) {
+		if (this._pendingService === void 0) throw new Error("--path must follow --serviceId.");
+		this._routes.push({
+			serviceId: this._pendingService,
+			path: value.startsWith("/") ? value : `/${value}`
+		});
+		this._pendingService = void 0;
+	}
+	getRoutes() {
+		if (this._pendingService !== void 0) throw new Error("Each --serviceId must be followed by --path.");
+		return this._routes;
+	}
+};
+async function jsonRpcExportCommand(options) {
+	const connection = new LinkRpcConnection(options.local.rpcChannel);
+	return startJsonRpcWebSocketExport({
+		...options,
+		openTransport: (serviceId, signal) => connectRawJsonRpcTransport(connection.service(serviceId).get(jsonRpcConnectionInterface), void 0, signal)
+	});
+}
+//#endregion
 //#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/logging/logging.js
 let globalObservableLogger;
 function addLogger(logger) {
@@ -8953,6 +8984,40 @@ Batch options:
 		});
 	});
 	if (profile === "hub") {
+		const exportRoutes = new JsonRpcExportRoutes();
+		program.command("json-rpc-export").description("Export Hub JSON-RPC services through one authenticated raw WebSocket listener.").requiredOption("--target-endpoint <uri>", "Listener URI, e.g. listen:ws://127.0.0.1:8123").option("--target-token <token>", "Local client authentication token (or put token in target URI)").option("--target-token-query-param <name>", "Accepted token query parameter (repeatable; replaces defaults tkn and token)", collectOption).option("--serviceId <id>", "Begin a route; follow each occurrence with --path", (value) => {
+			exportRoutes.serviceId(value);
+			return value;
+		}).option("--path <path>", "Path for the preceding service ID; repeat pairs for multiple routes", (value) => {
+			exportRoutes.path(value);
+			return value;
+		}).action(async (opts) => {
+			const options = {
+				targetEndpoint: opts.targetEndpoint,
+				token: opts.targetToken,
+				tokenQueryParameters: opts.targetTokenQueryParam,
+				routes: exportRoutes.getRoutes()
+			};
+			validateJsonRpcExport(options);
+			const localEp = needEndpoint(endpoint);
+			const local = await connect(localEp, wireLog("hub"));
+			try {
+				reportIdentity(await setupSigning(local.channel, local.signing, getPrincipalSpec(), { negotiateHubCaps: isHubEndpoint(localEp) }));
+				const server = await jsonRpcExportCommand({
+					...options,
+					local,
+					onError: (error) => process.stderr.write(`linkrpc: ${error.message}\n`)
+				});
+				try {
+					process.stderr.write(`linkrpc: JSON-RPC export listening at ${server.endpoint}\n`);
+					await _untilSignalled();
+				} finally {
+					await server.close();
+				}
+			} finally {
+				local.close();
+			}
+		});
 		program.command("json-rpc-stdio <serviceId>").description("Expose <serviceId>::jsonRpcConnection::connectRaw as a newline-delimited JSON-RPC endpoint on this process's stdin/stdout.").option("--params <json>", "JSON value passed to the remote transport factory").action(async (serviceId, opts) => {
 			const localEp = needEndpoint(endpoint);
 			let params;
@@ -9186,7 +9251,7 @@ Batch options:
 				process.once("SIGINT", onSignal);
 				process.once("SIGTERM", onSignal);
 				try {
-					const { runApprovalUi } = await import("./runApprovalUi-CNp2DhKG.js");
+					const { runApprovalUi } = await import("./runApprovalUi-CVymyDHh.js");
 					await runApprovalUi({
 						client,
 						signal: stop.signal
@@ -9201,7 +9266,7 @@ Batch options:
 	registerViewCommands(program, (action) => withChannel(endpoint, getPrincipalSpec(), action));
 	program.command("ui").description("Launch the terminal UI (form-based browser of services + methods).").action(async () => {
 		const acquired = await acquireConnection(endpoint);
-		const { runUi } = await import("./runUi-B4rV3ZfF.js");
+		const { runUi } = await import("./runUi-ByL1VdAP.js");
 		try {
 			await runUi({
 				endpoint: acquired.ep,
@@ -9737,4 +9802,4 @@ function safeJson(value) {
 //#endregion
 export { formatCondition as _, formatCommandLegend as a, targetId as b, safeTerminalText as c, ObservablePromise as d, observableValue as f, resolveViewTarget as g, Disposable as h, dispatchHostKey as i, approvalDetailLines as l, derived as m, views as n, hostCommands as o, autorun as p, ViewFrame as r, matchesKey as s, runCli as t, ObservableLazyPromise as u, interfaceTarget as v, matchesTarget as y };
 
-//# sourceMappingURL=cli-B93twHKF.js.map
+//# sourceMappingURL=cli-CYL6JUxF.js.map