@hediet/linkrpc-cli 0.0.3-next.20261023.4 → 0.0.3-next.20261025.3

package/README.md

@@ -581,7 +581,7 @@ it**. Pick one of:
 | `--endpoint <uri>`               | A strict endpoint URI (see below).                                                                         |
 | `--endpoint-cmd <command>`       | Spawn a _server_, hand it a fresh socket + token via `LINKRPC_ENDPOINT`/`LINKRPC_TOKEN`, then connect to it. |
 | `--endpoint-cmd-stdio <command>` | Spawn a child and talk linkrpc over its stdio.                                                              |
-| `LINKRPC_ENDPOINT` (env)          | A URI, or a legacy bare socket path / `ws://` URL. Token from `LINKRPC_TOKEN`; enabled by default in the Hub profile. |
+| `LINKRPC_ENDPOINT` (env)          | A URI, or a legacy bare socket path / `ws://` URL. Token from `LINKRPC_TOKEN`; enabled by default in the Hub profile and with `--use-env` in the RPC profile. |
 
 Legacy `HUBRPC_ENDPOINT` and `HUBRPC_TOKEN` remain supported when the
 corresponding `LINKRPC_*` variable is absent.
@@ -794,6 +794,7 @@ initial document:
 | `connection destroy`                                  | Stop the configured connection broker through its local overlay. |
 | `json-rpc-stdio <serviceId> [--params <json>]`         | In the Hub profile, expose `<serviceId>::jsonRpcConnection::connectRaw` as newline-delimited JSON-RPC on stdin/stdout. Diagnostics remain on stderr. |
 | `json-rpc-export --target-endpoint <uri> --serviceId <id> --path <path> ...` | In the Hub profile, export multiple JSON-RPC factories through one authenticated raw WebSocket listener. |
+| `http-export [--port <n>] [--host <address>]... [--base-domain <domain>]` | In the Hub profile, serve loopback ports of Hub compute nodes at `<port>.<service>.localhost` over HTTP and WebSocket. |
 
 The inherited `--schema <path-or-url>` option also overlays static
 `hubrpc.defaults`, `hubrpc.directory`, and `hubrpc.schemas` reflection for
@@ -834,6 +835,55 @@ Only `listen:ws://` TCP listeners are currently supported, not named pipes or TL
 
 The command stays in the foreground until SIGINT/SIGTERM, then closes clients and the listener. Use the existing Hub daemon/service lifecycle to supervise it; this command neither installs a service nor starts remote AHP hosts. Diagnostics and the bound address (including an assigned port when using port 0) go to stderr.
 
+### HTTP export
+
+`http-export` serves loopback TCP ports of Hub compute nodes (services offering
+`linkrpc.computeNode.tcpForward`) as `*.localhost` sites. `*.localhost` always
+resolves to this machine, so no DNS setup is needed:
+
+```sh
+linkrpc hub http-export            # listens on 127.0.0.1:80 and [::1]:80
+```
+
+| URL | Shows |
+| --- | --- |
+| `http://localhost/` | Services that can forward TCP (`?format=json` for JSON). |
+| `http://hediet--tablet--compute.localhost/` | Listening ports of `hediet/tablet/compute` (needs `linkrpc.computeNode.ports`). |
+| `http://3000.hediet--tablet--compute.localhost/` | Port 3000 of that compute node, including WebSocket upgrades. |
+
+A service is always exactly one label directly below `localhost`, its
+segments joined with `--`. Browsers treat `localhost` as a public suffix, so
+each service is its own site: pages of one machine get no `SameSite` cookies
+from another machine's apps and cannot set cookies for them, as with direct
+access. The ports of one service share that site, as the ports of `localhost`
+do on its machine. A service ID whose segments are not plain lowercase DNS
+labels, or whose label would exceed 63 characters, is written as a hashed label
+instead, `<slug>--h<hash>`, which the gateway resolves against the services it
+can reach. The index pages link to the right form.
+
+There is no gateway credential and no origin check of its own. Instead, the
+gateway translates between a forwarded app's own origins
+(`http://localhost:<port>` on its machine) and their exported names, so the
+app's own Host, Origin, CORS, redirect, and cookie checks behave as they do for
+a browser on its machine:
+
+| Header | Translation |
+| --- | --- |
+| `Host` | Always `localhost:<port>`. The gateway itself only accepts `*.localhost` names, so DNS rebinding cannot reach it. |
+| `Origin`, `Referer` | Exported names of the same service map to `http://localhost:<port>`. Other services' exported names and foreign sites pass unchanged. This machine's own loopback origins have no counterpart on the target: `Origin` becomes `null` and `Referer` is dropped. |
+| `Location`, `Access-Control-Allow-Origin` | URLs naming the target machine's loopback map to their exported names. |
+| `Set-Cookie` | Host-only and `Domain=localhost` cookies get the service's domain (e.g. `Domain=hediet--tablet--compute.localhost`), which reaches that machine's exported ports, as such cookies reach all of its ports there. Cookies for other domains are dropped, as a browser there would reject them. `__Host-` cookies stay host-only, so they reach only one exported port. |
+
+WebSocket upgrades are translated the same way in both directions. No
+`X-Forwarded-*` headers are added. Absolute loopback URLs inside response
+bodies are not rewritten, so they fail rather than reach this machine. Bind
+loopback only: anyone who can reach the listener can use the export process's
+Hub identity to reach every forwarded port.
+
+Each service and port shares one `tcpForward.multiplex` session (up to 10
+logical connections, 8 of them for pooled HTTP keep-alive), closed after five
+idle minutes.
+
 ### Participant proxy
 
 `proxy` stands in for a participant on the hub: the participant is either this
@@ -940,7 +990,7 @@ Value-taking options support both `--option=value` and `--option value`.
 Parameter assignment itself still uses `key=value`, e.g.
 `--param path=/docs/a` or `--param=path=/docs/a`. Use the equals form for
 dash-prefixed values. Quote JSON and strings containing spaces.
-`--cap:request` and `--cap:allow-any` are switches with no value.
+`--cap:request`, `--cap:allow-any`, and `--cap:delegate` are switches with no value.
 The older `--request-cap`, `--allow-param`, and `--duration` spellings have
 been replaced by the `--cap:` options.
 
@@ -950,6 +1000,9 @@ Schema validation is mandatory for explicit requests: `--no-validate` and
 the permission; signed calls include that hash in their signed metadata.
 The default requested duration is `persistent`; `--cap:duration shortLived` and
 `--cap:duration longLived` are also supported. The Hub still decides what to grant.
+`--cap:delegate` also requests `canDelegate`, so the identity can issue narrower
+capabilities for that scope to other identities, e.g. a service it runs; a
+stored grant without delegation does not satisfy such a request.
 One-shot approval cannot satisfy a reusable scope and is rejected.
 
 Fresh durable grants for the selected principal are reused when they cover

package/dist/chunks/{cli-CYL6JUxF.js → cli-D_nbiyek.js}

@@ -1,4 +1,4 @@
-import { $ as requestTopologyAccess, B as proxyCommand, F as disconnectBroker, G as parseDuration, H as withStaticHubReflection, I as getBrokerStatus, L as readBrokerNotifications, M as readEndpointDiscovery, N as ContextStore, P as formatContextReference, Q as requestReflectionAccess, R as stopConnectionBroker, St as mcpForwardInterface, U as parseConnectionLimit, V as tunnelCommand, W as parseConnectionLimitMilliseconds, _t as validateValueAgainstSchema, a as resolveInvocationEndpoint, bt as parseParamOverride, c as resolveLocalEndpoint, ct as parsePrincipalSpec, dt as connectViaTransport, et as setupSigning, ft as resolveTargetEndpoint, gt as explainValidation, ht as describeSchema, i as resolveInvocationContext, it as walkHub, lt as connect, m as managedEndpointsInterface, mt as describeObjectParams, n as loadStaticHubSchema, nt as fetchSchema$1, o as resolveSigning, ot as logoutCliIdentity, pt as resolvedEndpointToConfig, q as resolveCliInvocation, r as resolveStaticHubSchemaSource, rt as findMethodInSchema, s as validationDefault, st as formatPrincipalSource, t as completeForLine, tt as fetchDefaults, ut as connectViaRootOverlay, xt as MethodRefWithOptHash, y as HubHome, yt as mergeParams, z as ConnectionBroker } from "./runComplete-C9LMCMk7.js";
+import { $ as requestTopologyAccess, B as proxyCommand, Ct as MethodRefWithOptHash, F as disconnectBroker, G as parseDuration, H as withStaticHubReflection, I as getBrokerStatus, L as readBrokerNotifications, M as readEndpointDiscovery, N as ContextStore, P as formatContextReference, Q as requestReflectionAccess, R as stopConnectionBroker, St as parseParamOverride, U as parseConnectionLimit, V as tunnelCommand, W as parseConnectionLimitMilliseconds, _t as describeSchema, a as resolveInvocationEndpoint, c as resolveLocalEndpoint, ct as readCliIdentity, dt as connect, et as setupSigning, ft as connectViaRootOverlay, gt as describeObjectParams, ht as resolvedEndpointToConfig, i as resolveInvocationContext, it as walkHub, lt as formatPrincipalSource, m as managedEndpointsInterface, mt as resolveTargetEndpoint, n as loadStaticHubSchema, nt as fetchSchema$1, o as resolveSigning, ot as cliIdentityTarget, pt as connectViaTransport, q as resolveCliInvocation, r as resolveStaticHubSchemaSource, rt as findMethodInSchema, s as validationDefault, st as deleteCliIdentity, t as completeForLine, tt as fetchDefaults, ut as parsePrincipalSpec, vt as explainValidation, wt as mcpForwardInterface, xt as mergeParams, y as HubHome, yt as validateValueAgainstSchema, z as ConnectionBroker } from "./runComplete-bFjlzR3Y.js";
 import { ErrorCode, INTERFACE_TEMPLATES_EXTENSION, LinkRpcConnection, RpcError, computeInterfaceHash, connectTransports, createSchemaToZod, directoryInterface, exportStaticHubSchema, generateTsContract, generateTsInterface, interfaceTemplateArgumentsEquivalent, interfaceTemplateMemberName, interfaceTemplatesEqual, isAssignable, jcsCanonicalize, matchParams, schemaToZod, validateInterfaceTemplates } from "@hediet/linkrpc";
 import { z } from "zod";
 import { WebSocketTransport, connectNdjson, connectToHub, formatEndpointUri, isHubEndpoint, openWebSocket, parseEndpointUri, runInitializeHandshake, traceMessageTransport as traceMessageTransport$1 } from "@hediet/linkrpc/node";
@@ -13,20 +13,22 @@ import * as net from "node:net";
 import { mkdir, open, readFile, writeFile } from "node:fs/promises";
 import { DEFAULT_WALK_DEPTH, HubDirectoryExplorer, fetchSchema, findCoveringCapabilities, hubGrantedServiceIdInterface } from "@hediet/linkrpc/hub/common";
 import { CONSOLE_INTERFACE_TAG, ConsoleTemplate, consoleAttachResultSchema, consoleServerMessageSchema, decodeConsoleData, encodeConsoleData } from "@hediet/linkrpc-infra/console";
+import { createInterface } from "node:readline/promises";
 import { Command, InvalidArgumentError, Option } from "commander";
 import * as readline from "node:readline";
-import { createInterface, emitKeypressEvents } from "node:readline";
+import { createInterface as createInterface$1, emitKeypressEvents } from "node:readline";
 import { parse, unknown } from "zod/mini";
 import { bootstrapApprovalCapability, createHubApprovalClient } from "@hediet/linkrpc-infra/approval";
 import { connectionTokenBinderInterface } from "@hediet/linkrpc-hub/hub/server/connection-token-binder";
 import { spawn } from "node:child_process";
 import { TopologyClient, TopologyNetworkClient, TrafficClient } from "@hediet/linkrpc-infra/inspection";
-import { createInterface as createInterface$1 } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
 import { TrafficFlowAggregator, createTerminalConsentPrompt, formatFlowSummary } from "@hediet/linkrpc-hub";
 import { loadHubConfig, printHubConfigSchema } from "@hediet/linkrpc-hub/config-file";
 import { connectJsonRpcTransports, connectRawJsonRpcTransport, createNdjsonJsonRpcTransport, jsonRpcConnectionInterface } from "@hediet/linkrpc-infra/json-rpc";
 import { startJsonRpcWebSocketExport, validateJsonRpcExport } from "@hediet/linkrpc-infra/json-rpc/node";
+import { computeNodePortsInterface, computeNodeTcpForwardInterface } from "@hediet/linkrpc-infra/compute-node";
+import { startHttpExport } from "@hediet/linkrpc-infra/http-export/node";
 import { GRAPH_INTERFACE_TAG, IMMUTABLE_GRAPH_INTERFACE_ID, ROOT_WATCH_INTERFACE_ID, evaluateGraphPresentation, graphPresentationInterface, graphPresentationSchema, isGraphRef, standardGraphRuntimeOptions, validateGraphInterfaceSchema } from "@hediet/linkrpc-infra/graph";
 import React from "react";
 import { Box, Text, measureElement, render } from "ink";
@@ -49,7 +51,7 @@ var ServiceConsoleInput = class {
 		this._close = _close;
 		this._wasRaw = _input.isRaw ?? false;
 		if (_input.isTTY) {
-			this._readline = createInterface({
+			this._readline = createInterface$1({
 				input: _input,
 				output,
 				terminal: true,
@@ -407,7 +409,7 @@ function contextNamespace(reference) {
 async function useLocalManagement(start, action) {
 	const home = HubHome.resolve();
 	if (start) {
-		const { startDaemon, nodeDaemonLaunch } = await import("./src-CCyOTeN5.js");
+		const { startDaemon, nodeDaemonLaunch } = await import("./src-B71xYgEO.js");
 		if (await startDaemon({
 			home,
 			launch: nodeDaemonLaunch(home)
@@ -427,7 +429,7 @@ async function useLocalManagement(start, action) {
 	}
 }
 async function restartLocalDaemon() {
-	const { startDaemon, stopDaemon, nodeDaemonLaunch } = await import("./src-CCyOTeN5.js");
+	const { startDaemon, stopDaemon, nodeDaemonLaunch } = await import("./src-B71xYgEO.js");
 	const home = HubHome.resolve();
 	process.stderr.write("Restarting the local Hub daemon: clients will disconnect and managed workloads will stop. OS autostart settings are unchanged.\n");
 	await stopDaemon(home);
@@ -947,6 +949,7 @@ async function requestCallCapability(channel, session, ref, params, schema, opts
 			...ref.hash !== void 0 ? { interfaceHash: ref.hash } : {}
 		},
 		canInvoke: true,
+		...opts.delegate === true ? { canDelegate: true } : {},
 		params: matchers
 	};
 	const coverageOptions = {
@@ -3040,7 +3043,7 @@ function selectParticipant(participants, nodeId) {
 	return participants.length === 1 ? participants[0] : void 0;
 }
 async function promptForParticipant(participants, search) {
-	const readline = createInterface$1({
+	const readline = createInterface({
 		input: stdin,
 		output: stdout
 	});
@@ -3541,6 +3544,72 @@ async function jsonRpcExportCommand(options) {
 	});
 }
 //#endregion
+//#region src/commands/httpExport.ts
+const SERVICE_LIST_TTL_MS = 3e4;
+const SERVICE_LIST_TIMEOUT_MS = 2e4;
+async function httpExportCommand(options) {
+	const connection = new LinkRpcConnection(options.local.rpcChannel);
+	const services = new ForwardableServices(options.local.channel, options.requestDirectoryAccess, options.onError);
+	return startHttpExport({
+		listen: options.hosts.map((host) => ({
+			host,
+			port: options.port
+		})),
+		baseDomain: options.baseDomain,
+		getTcpForward: (serviceId) => connection.service(serviceId).get(computeNodeTcpForwardInterface),
+		listServices: () => services.get(),
+		listPorts: async (serviceId) => (await connection.service(serviceId).get(computeNodePortsInterface).listListening({})).ports,
+		onError: options.onError
+	});
+}
+/** Caches the services that implement `tcpForward`; a slow or partial walk returns what it found. */
+var ForwardableServices = class {
+	_channel;
+	_requestDirectoryAccess;
+	_onError;
+	_cached;
+	_pending;
+	constructor(_channel, _requestDirectoryAccess, _onError) {
+		this._channel = _channel;
+		this._requestDirectoryAccess = _requestDirectoryAccess;
+		this._onError = _onError;
+	}
+	get() {
+		if (this._cached && Date.now() - this._cached.at < SERVICE_LIST_TTL_MS) return Promise.resolve(this._cached.value);
+		this._pending ??= this._load().finally(() => {
+			this._pending = void 0;
+		});
+		return this._pending;
+	}
+	async _load() {
+		const explorer = new HubDirectoryExplorer(this._channel, {
+			interfaceId: computeNodeTcpForwardInterface.info.id,
+			timeoutMs: 5e3,
+			unlockGatedDirectory: this._requestDirectoryAccess,
+			log: (message) => this._onError(new Error(message))
+		});
+		let timer;
+		try {
+			const walked = await Promise.race([explorer.explore(), new Promise((resolve) => {
+				timer = setTimeout(() => resolve(void 0), SERVICE_LIST_TIMEOUT_MS);
+			})]);
+			const listings = (walked?.listings ?? explorer.result.listings).filter((listing) => listing.serviceId !== "");
+			const value = {
+				serviceIds: [...new Set(listings.map((listing) => listing.serviceId))],
+				complete: walked !== void 0 && walked.inaccessible.length === 0
+			};
+			this._cached = {
+				value,
+				at: Date.now()
+			};
+			return value;
+		} finally {
+			clearTimeout(timer);
+			explorer.dispose();
+		}
+	}
+};
+//#endregion
 //#region ../../node_modules/.pnpm/@vscode+observables@0.1.1-0/node_modules/@vscode/observables/dist/observableInternal/logging/logging.js
 let globalObservableLogger;
 function addLogger(logger) {
@@ -8734,7 +8803,8 @@ async function main(rawArgv, executableName = "linkrpc") {
 			return;
 		}
 		if (endpoint === void 0) {
-			process.stdout.write("\n(No endpoint configured: pass --endpoint / --endpoint-cmd or set LINKRPC_ENDPOINT\nto see method-specific --p:<name> flags here.)\n");
+			const ignoredEnvironmentHint = ignoredEndpointEnvironmentHint();
+			process.stdout.write(`\n(No endpoint configured: pass ${endpointOptionsDescription()}.\n` + (ignoredEnvironmentHint === void 0 ? "" : `${ignoredEnvironmentHint}.\n`) + "To see method-specific --p:<name> flags here.)\n");
 			return;
 		}
 		let ref;
@@ -8778,7 +8848,7 @@ async function main(rawArgv, executableName = "linkrpc") {
 		"shortLived",
 		"longLived",
 		"persistent"
-	]).default("persistent"));
+	]).default("persistent")).option("--cap:delegate", "also request the right to delegate this authority (canDelegate) to other identities");
 	const configureCall = (cmd, capabilityOnly) => {
 		cmd.description((capabilityOnly ? "Request a capability without executing a call. " : "Invoke a request. ") + "`<methodRef>` is `[svc::][iface::]method[@hash]`. Use `--p:<name> <value>` (or `--p:<name>=<value>`) as a shortcut for `--param <name>=<value>`. Run `hub call <methodRef> --help` to see the method-specific `--p:` flags derived from the live schema.").option("--params <json>", "inline params JSON, or \"-\" to read stdin").option("--param <kv...>", "param override, key=value (JSON or string)").option("--no-validate", "skip schema-based param validation").helpOption(false).option("-h, --help", "show help (includes method params when reachable)").action(async (methodRef, opts, cmd) => {
 			if (opts.help) {
@@ -8794,6 +8864,7 @@ async function main(rawArgv, executableName = "linkrpc") {
 			const allowParams = opts["cap:allowParam"];
 			if (!capabilityOnly && allowParams !== void 0 && !requestCap) throw new Error("--cap:allow-param requires --cap:request.");
 			if (!capabilityOnly && cmd.getOptionValueSource("cap:duration") === "cli" && !requestCap) throw new Error("--cap:duration requires --cap:request.");
+			if (!capabilityOnly && opts["cap:delegate"] === true && !requestCap) throw new Error("--cap:delegate requires --cap:request.");
 			resolveSigning(profile, g_invocation?.values ?? {}, capabilityOnly || requestCap);
 			const validation = opts.validate === false ? "off" : effectiveValidation(profile);
 			if ((capabilityOnly || requestCap) && validation === "off") throw new Error("Capability requests require schema validation; remove --no-validate/--validation off.");
@@ -8807,7 +8878,8 @@ async function main(rawArgv, executableName = "linkrpc") {
 					requestCap,
 					capabilityOnly,
 					signingSession: session,
-					duration: opts["cap:duration"]
+					duration: opts["cap:duration"],
+					delegate: opts["cap:delegate"] === true
 				});
 				process.stdout.write(out + "\n");
 			}, {
@@ -9018,6 +9090,30 @@ Batch options:
 				local.close();
 			}
 		});
+		program.command("http-export").description("Serve loopback ports of Hub compute nodes at <port>.<service>.localhost over HTTP and WebSocket.").option("--port <n>", "Local port to listen on", (value) => parsePositiveInteger(value, "--port"), 80).option("--host <address>", "Local address to bind (repeatable; default 127.0.0.1 and ::1)", collectOption).option("--base-domain <domain>", "Base domain of exported hostnames", "localhost").action(async (opts) => {
+			const localEp = needEndpoint(endpoint);
+			const local = await connect(localEp, wireLog("hub"));
+			try {
+				const session = await setupSigning(local.channel, local.signing, getPrincipalSpec(), { negotiateHubCaps: isHubEndpoint(localEp) });
+				reportIdentity(session);
+				const server = await httpExportCommand({
+					local,
+					requestDirectoryAccess: (serviceId) => requestDirectoryAccess(session, serviceId, {}),
+					port: opts.port,
+					hosts: opts.host ?? ["127.0.0.1", "::1"],
+					baseDomain: opts.baseDomain,
+					onError: (error) => process.stderr.write(`linkrpc: ${error.message}\n`)
+				});
+				try {
+					process.stderr.write(`linkrpc: HTTP export listening at ${server.urls.join(", ")}\n`);
+					await _untilSignalled();
+				} finally {
+					await server.close();
+				}
+			} finally {
+				local.close();
+			}
+		});
 		program.command("json-rpc-stdio <serviceId>").description("Expose <serviceId>::jsonRpcConnection::connectRaw as a newline-delimited JSON-RPC endpoint on this process's stdin/stdout.").option("--params <json>", "JSON value passed to the remote transport factory").action(async (serviceId, opts) => {
 			const localEp = needEndpoint(endpoint);
 			let params;
@@ -9082,11 +9178,16 @@ Batch options:
 			const remote = await connectTargetEndpoint(targetEp, serviceId);
 			try {
 				reportIdentity(await setupSigning(local.channel, local.signing, getPrincipalSpec(), { negotiateHubCaps: isHubEndpoint(localEp) }));
+				const lost = Promise.race([local.closed.then(() => "source"), remote.closed.then(() => "target")]).then((side) => {
+					process.stderr.write(`linkrpc: tunnel: the ${side} connection closed\n`);
+					process.exitCode = 1;
+				});
 				await tunnelCommand({
 					serviceId,
 					local,
 					remote,
-					bidi: cmdOpts.bidi
+					bidi: cmdOpts.bidi,
+					stop: Promise.race([lost, _untilSignalled()])
 				});
 			} finally {
 				remote.close();
@@ -9113,10 +9214,10 @@ Batch options:
 				const principal = typeof cmdOpts.signAs === "string" ? parsePrincipalSpec(cmdOpts.signAs) : getPrincipalSpec();
 				reportIdentity(await setupSigning(hub.channel, hub.signing, principal, { negotiateHubCaps: isHubEndpoint(localEp) }));
 			}
-			const participant = targetEp === void 0 ? await connectStdioParticipant() : {
-				connection: await connectTargetEndpoint(targetEp, cmdOpts.claim ?? ""),
-				closed: void 0
-			};
+			const participant = targetEp === void 0 ? await connectStdioParticipant() : await connectTargetEndpoint(targetEp, cmdOpts.claim ?? "").then((connection) => ({
+				connection,
+				closed: connection.closed
+			}));
 			try {
 				await proxyCommand({
 					hub,
@@ -9251,7 +9352,7 @@ Batch options:
 				process.once("SIGINT", onSignal);
 				process.once("SIGTERM", onSignal);
 				try {
-					const { runApprovalUi } = await import("./runApprovalUi-CVymyDHh.js");
+					const { runApprovalUi } = await import("./runApprovalUi-Diol5P5a.js");
 					await runApprovalUi({
 						client,
 						signal: stop.signal
@@ -9266,7 +9367,7 @@ Batch options:
 	registerViewCommands(program, (action) => withChannel(endpoint, getPrincipalSpec(), action));
 	program.command("ui").description("Launch the terminal UI (form-based browser of services + methods).").action(async () => {
 		const acquired = await acquireConnection(endpoint);
-		const { runUi } = await import("./runUi-ByL1VdAP.js");
+		const { runUi } = await import("./runUi-DDJrDeBg.js");
 		try {
 			await runUi({
 				endpoint: acquired.ep,
@@ -9278,13 +9379,27 @@ Batch options:
 			acquired.running?.dispose();
 		}
 	});
-	if (profile === "hub") program.command("logout").description("Delete the stored CLI identity and cached capabilities. Next call will mint a fresh keypair and prompt for consent again.").action(async () => {
-		const removed = await logoutCliIdentity();
-		if (removed.length === 0) {
-			process.stdout.write("linkrpc: no stored identity found.\n");
+	if (profile === "hub") program.command("logout").description("Delete the stored keypair and cached capabilities of the identity selected by --principal (default: the user:hubrpc-cli fallback). Asks for confirmation unless --yes is given. The next call mints a fresh keypair, which hubs that trusted the old key do not accept.").option("-y, --yes", "delete without asking for confirmation").action(async (opts) => {
+		const target = cliIdentityTarget(getPrincipalSpec());
+		const principal = await readCliIdentity(target);
+		if (principal === void 0) {
+			process.stdout.write(`linkrpc: no stored identity for ${target.label} (${target.file}).\n`);
 			return;
 		}
-		for (const f of removed) process.stdout.write(`removed ${f}\n`);
+		const description = `identity ${target.label} (${principal}) at ${target.file}`;
+		if (opts.yes !== true) {
+			if (process.stdin.isTTY !== true || process.stderr.isTTY !== true) throw new Error(`Refusing to delete ${description} without confirmation; pass --yes.`);
+			const readline = createInterface({
+				input: process.stdin,
+				output: process.stderr
+			});
+			const answer = await readline.question(`Delete ${description} and its cached capabilities? This cannot be undone. [y/N] `).finally(() => readline.close());
+			if (!/^y(es)?$/i.test(answer.trim())) {
+				process.stderr.write("linkrpc: logout cancelled.\n");
+				return;
+			}
+		}
+		for (const f of await deleteCliIdentity(target)) process.stdout.write(`removed ${f}\n`);
 	});
 	program.command("completions <shell>").description("Print a shell completion script. Supported: powershell. Install with `hub completions powershell | Out-String | Invoke-Expression` (one-shot) or append to $PROFILE.").action((shell) => {
 		try {
@@ -9634,7 +9749,8 @@ async function acquireConnection(endpoint) {
 	if (endpoint === void 0 && g_invocation?.profile === "hub") try {
 		return { ep: resolveLocalEndpoint() };
 	} catch {
-		throw new Error("No endpoint configured through flags, environment, or context, and the local Hub daemon is not running. Pass --endpoint, or start the daemon (any `hub services run` starts it).");
+		const ignoredEnvironmentHint = ignoredEndpointEnvironmentHint();
+		throw new Error(`No endpoint configured through flags, environment, or context, and the local Hub daemon is not running. Pass ${endpointOptionsDescription()}, or start the daemon (any \`hub services run\` starts it).` + (ignoredEnvironmentHint === void 0 ? "" : ` ${ignoredEnvironmentHint}.`));
 	}
 	return { ep: needEndpoint(endpoint) };
 }
@@ -9644,11 +9760,23 @@ function reportIdentity(session) {
 }
 function needEndpoint(endpoint) {
 	if (!endpoint) {
-		process.stderr.write("linkrpc: this command requires --endpoint / --endpoint-cmd / --endpoint-cmd-stdio or the LINKRPC_ENDPOINT env var to be set.\n");
+		const ignoredEnvironmentHint = ignoredEndpointEnvironmentHint();
+		process.stderr.write(`linkrpc: this command requires ${endpointOptionsDescription()}.\n` + (ignoredEnvironmentHint === void 0 ? "" : `linkrpc: ${ignoredEnvironmentHint}.\n`));
 		process.exit(2);
 	}
 	return endpoint;
 }
+function endpointOptionsDescription() {
+	const options = "--endpoint / --endpoint-cmd / --endpoint-cmd-stdio or a configured context";
+	return g_invocation?.profile === "hub" && g_invocation.environmentApplied ? `${options} or LINKRPC_ENDPOINT` : options;
+}
+function ignoredEndpointEnvironmentHint() {
+	const invocation = g_invocation;
+	if (invocation === void 0 || invocation.environmentApplied) return void 0;
+	const variable = process.env.LINKRPC_ENDPOINT !== void 0 ? "LINKRPC_ENDPOINT" : process.env.HUBRPC_ENDPOINT !== void 0 ? "HUBRPC_ENDPOINT" : void 0;
+	if (variable === void 0) return void 0;
+	return invocation.profile === "rpc" ? `${variable} is set but only used by hub commands: run \`linkrpc hub <command>\` (or pass --use-env)` : `${variable} is set but ignored because environment overrides are disabled; pass --use-env to apply it`;
+}
 /** The `--target-endpoint*` options shared by `tunnel` and `proxy`. */
 function addTargetEndpointOptions(command) {
 	return command.option("--target-endpoint <uri>", "target endpoint URI (unix:/path?token=…, npipe://./pipe/…, ws[s]://host?token=…, cmd:?command=… or cmd-stdio:?command=…)").option("--target-endpoint-cmd <command>", "spawn the target as a server, connect via an injected env socket; the child sees the claimed service id as grantedServiceIdNamespace via hubGrantedServiceId::get").option("--target-endpoint-cmd-stdio <command>", "spawn the target and talk linkrpc over its stdio").option("--target-endpoint-cmd-env <key=value>", "env var for the --target-endpoint-cmd / --target-endpoint-cmd-stdio child (repeatable)", (val, acc) => {
@@ -9802,4 +9930,4 @@ function safeJson(value) {
 //#endregion
 export { formatCondition as _, formatCommandLegend as a, targetId as b, safeTerminalText as c, ObservablePromise as d, observableValue as f, resolveViewTarget as g, Disposable as h, dispatchHostKey as i, approvalDetailLines as l, derived as m, views as n, hostCommands as o, autorun as p, ViewFrame as r, matchesKey as s, runCli as t, ObservableLazyPromise as u, interfaceTarget as v, matchesTarget as y };
 
-//# sourceMappingURL=cli-CYL6JUxF.js.map
+//# sourceMappingURL=cli-D_nbiyek.js.map