@hediet/linkrpc-hub 0.0.1

package/README.md

@@ -0,0 +1,101 @@
+# @hediet/linkrpc-hub
+
+Standalone linkrpc hub that exposes a JSON-RPC-over-WebSocket endpoint.
+Designed to run on a server behind a TLS-terminating reverse proxy
+(Traefik, nginx, Caddy, …).
+
+## Quick start
+
+```sh
+pnpm --filter @hediet/linkrpc-hub build
+node packages/linkrpc-hub/dist/cli.js --port 7878 --token <shared-secret>
+```
+
+When `--token` and `--tokens-file` are both omitted, a one-shot token is
+minted and printed at startup.
+
+## CLI
+
+```
+linkrpc-hub [options]
+
+  --host <h>             interface to bind (default 127.0.0.1)
+  --port <n>             TCP port (default 7878)
+  --path <p>             URL path of the WebSocket endpoint (default /)
+  --identity <file>      admin keypair file (auto-generated on first run)
+  --tokens-file <file>   one accepted token per line; reloaded on SIGHUP
+  --token <t>            accepted token (repeatable)
+  --open                 openMode — disable signature checks. LOCAL DEV ONLY.
+  --allowed-origin <o>   restrict browser clients to this Origin (repeatable)
+  --max-payload <bytes>  WebSocket max frame size (default 16 MiB)
+  --health-path <p>      HTTP path returning 200 OK (default /healthz)
+```
+
+## Authenticating a connection
+
+A client may present its token via `Authorization: Bearer <token>`
+
+## Node client
+
+```ts
+import { connectToHubWs } from '@hediet/linkrpc-hub';
+
+const hub = await connectToHubWs({
+    url: 'wss://hub.example.com/',
+    token: process.env.HUB_TOKEN!,
+});
+const result = await hub.channel.sendRequest('hubrpc.directory::list', {});
+```
+
+## Traefik recipe
+
+Run the hub bound to loopback (or to a docker-internal interface) and let
+Traefik handle TLS and the public hostname.
+
+```yaml
+# docker-compose.yml
+services:
+  linkrpc-hub:
+    image: node:22-alpine
+    command: node /app/packages/linkrpc-hub/dist/cli.js --host 0.0.0.0 --port 7878 --tokens-file /run/secrets/linkrpc-tokens
+    volumes:
+      - ./:/app
+    secrets:
+      - linkrpc-tokens
+    networks:
+      - infra
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.linkrpc-hub.rule=Host(`hub.example.com`)
+      - traefik.http.routers.linkrpc-hub.entrypoints=websecure
+      - traefik.http.routers.linkrpc-hub.tls.certresolver=le
+      - traefik.http.services.linkrpc-hub.loadbalancer.server.port=7878
+      # liveness
+      - traefik.http.services.linkrpc-hub.loadbalancer.healthcheck.path=/healthz
+
+secrets:
+  linkrpc-tokens:
+    file: ./tokens.txt
+
+networks:
+  infra:
+    external: true
+```
+
+Traefik proxies WebSockets transparently — no `Upgrade` header munging
+needed. The hub respects `X-Forwarded-For`, so connection logs show
+real client IPs.
+
+## Security notes
+
+- The hub starts in signed mode by default. Participants register
+  prefixes with capabilities issued by the admin keypair (see the
+  `linkrpc` README, Hub section). Without `--open`, every
+  `hubAccess::request` / `hubAccess::extend` / `hubAccess::requestAccess`
+  is rejected with `permissionRequired` — there is no interactive UI.
+  Mint capabilities out-of-band using the admin keypair.
+- Use **separate tokens per client** when you can. Token rotation: drop
+  the new token into the tokens file and `kill -HUP $(pidof
+  linkrpc-hub)`; old tokens are accepted until removed from the file.
+- The admin keypair file is written with mode `0o600`. Treat it like an
+  SSH host key.

package/dist/chunks/config-BCvkg7jv.d.ts

@@ -0,0 +1,566 @@
+import { z } from "zod";
+//#region src/config.d.ts
+/**
+ * A **provision**: the root services a connection is granted once admitted.
+ * Shared by listener handlers (static/anonymous forms) and endpoints. Each
+ * field is optional and names the root interface it enables.
+ */
+declare const ConnectionTokenBinderSchema: z.ZodObject<{
+  identitySlotPrefix: z.ZodOptional<z.ZodString>;
+  serviceIdPrefix: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type ConnectionTokenBinderConfig = z.infer<typeof ConnectionTokenBinderSchema>;
+declare const provisionFields: {
+  /**
+   * Managed identity for the connection (`identity::*`), provisioned under
+   * `slot`. Omit for no managed identity.
+   */
+  managedIdentity: z.ZodOptional<z.ZodObject<{
+    slot: z.ZodString;
+  }, z.core.$strip>>;
+  /**
+   * ServiceId namespace the connection may claim freely
+   * (`hubGrantedServiceId::get`). Omit to grant no freely-claimable namespace.
+   */
+  grantedServiceId: z.ZodOptional<z.ZodString>;
+  /**
+   * Authorize the connection to mint single-use connection tokens by serving
+   * `connectionTokenBinder::bindConnectionToken` at its overlay root. The two
+   * prefixes bound **independent axes** of what a minted token may carry; set
+   * either, both, or neither.
+   */
+  connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+    identitySlotPrefix: z.ZodOptional<z.ZodString>;
+    serviceIdPrefix: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+};
+type ProvisionConfig = z.infer<z.ZodObject<typeof provisionFields>>;
+/**
+ * A listener **connection handler**: a token match + (for the static forms) the
+ * provision to install when it claims. Discriminated by `token`:
+ *
+ * - `anonymous` — claims **any** connection (the catch-all "no auth"); provisions
+ *   the inline fields.
+ * - `static` — claims connections whose presented token equals `value`;
+ *   provisions the inline fields.
+ * - `bound` — claims connections whose token is live in the hub's
+ *   connection-token store, **redeeming** it (single-use). The provision is
+ *   **intrinsic** to the token's mint binding (identity slot and/or granted
+ *   namespace), so it carries no inline provision.
+ */
+declare const ConnectionHandlerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  managedIdentity: z.ZodOptional<z.ZodObject<{
+    slot: z.ZodString;
+  }, z.core.$strip>>;
+  grantedServiceId: z.ZodOptional<z.ZodString>;
+  connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+    identitySlotPrefix: z.ZodOptional<z.ZodString>;
+    serviceIdPrefix: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  token: z.ZodLiteral<"anonymous">;
+}, z.core.$strip>, z.ZodObject<{
+  managedIdentity: z.ZodOptional<z.ZodObject<{
+    slot: z.ZodString;
+  }, z.core.$strip>>;
+  grantedServiceId: z.ZodOptional<z.ZodString>;
+  connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+    identitySlotPrefix: z.ZodOptional<z.ZodString>;
+    serviceIdPrefix: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  token: z.ZodLiteral<"static">;
+  value: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+  token: z.ZodLiteral<"bound">;
+}, z.core.$strip>], "token">;
+type ConnectionHandlerConfig = z.infer<typeof ConnectionHandlerSchema>;
+/**
+ * Outbound participant kinds that can be attached to an already-running Hub
+ * without host-specific admission or identity provisioning.
+ */
+declare const ParticipantConnectorConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  managedIdentity: z.ZodOptional<z.ZodObject<{
+    slot: z.ZodString;
+  }, z.core.$strip>>;
+  grantedServiceId: z.ZodOptional<z.ZodString>;
+  connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+    identitySlotPrefix: z.ZodOptional<z.ZodString>;
+    serviceIdPrefix: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  defaultRoute: z.ZodDefault<z.ZodBoolean>;
+  kind: z.ZodLiteral<"uri">;
+  uri: z.ZodString;
+  token: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+  managedIdentity: z.ZodOptional<z.ZodObject<{
+    slot: z.ZodString;
+  }, z.core.$strip>>;
+  grantedServiceId: z.ZodOptional<z.ZodString>;
+  connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+    identitySlotPrefix: z.ZodOptional<z.ZodString>;
+    serviceIdPrefix: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  defaultRoute: z.ZodDefault<z.ZodBoolean>;
+  kind: z.ZodLiteral<"ws">;
+  url: z.ZodString;
+  token: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+  managedIdentity: z.ZodOptional<z.ZodObject<{
+    slot: z.ZodString;
+  }, z.core.$strip>>;
+  grantedServiceId: z.ZodOptional<z.ZodString>;
+  connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+    identitySlotPrefix: z.ZodOptional<z.ZodString>;
+    serviceIdPrefix: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  defaultRoute: z.ZodDefault<z.ZodBoolean>;
+  kind: z.ZodLiteral<"socket">;
+  path: z.ZodString;
+  token: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+  managedIdentity: z.ZodOptional<z.ZodObject<{
+    slot: z.ZodString;
+  }, z.core.$strip>>;
+  grantedServiceId: z.ZodOptional<z.ZodString>;
+  connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+    identitySlotPrefix: z.ZodOptional<z.ZodString>;
+    serviceIdPrefix: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  defaultRoute: z.ZodDefault<z.ZodBoolean>;
+  cmd: z.ZodOptional<z.ZodString>;
+  argv: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  cwd: z.ZodOptional<z.ZodString>;
+  kind: z.ZodLiteral<"cmd-stdio">;
+}, z.core.$strip>], "kind">;
+type ParticipantConnectorConfig = z.infer<typeof ParticipantConnectorConfigSchema>;
+declare const EndpointConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  managedIdentity: z.ZodOptional<z.ZodObject<{
+    slot: z.ZodString;
+  }, z.core.$strip>>;
+  grantedServiceId: z.ZodOptional<z.ZodString>;
+  connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+    identitySlotPrefix: z.ZodOptional<z.ZodString>;
+    serviceIdPrefix: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  defaultRoute: z.ZodDefault<z.ZodBoolean>;
+  kind: z.ZodLiteral<"uri">;
+  uri: z.ZodString;
+  token: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+  managedIdentity: z.ZodOptional<z.ZodObject<{
+    slot: z.ZodString;
+  }, z.core.$strip>>;
+  grantedServiceId: z.ZodOptional<z.ZodString>;
+  connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+    identitySlotPrefix: z.ZodOptional<z.ZodString>;
+    serviceIdPrefix: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  defaultRoute: z.ZodDefault<z.ZodBoolean>;
+  kind: z.ZodLiteral<"ws">;
+  url: z.ZodString;
+  token: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+  managedIdentity: z.ZodOptional<z.ZodObject<{
+    slot: z.ZodString;
+  }, z.core.$strip>>;
+  grantedServiceId: z.ZodOptional<z.ZodString>;
+  connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+    identitySlotPrefix: z.ZodOptional<z.ZodString>;
+    serviceIdPrefix: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  defaultRoute: z.ZodDefault<z.ZodBoolean>;
+  kind: z.ZodLiteral<"socket">;
+  path: z.ZodString;
+  token: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+  managedIdentity: z.ZodOptional<z.ZodObject<{
+    slot: z.ZodString;
+  }, z.core.$strip>>;
+  grantedServiceId: z.ZodOptional<z.ZodString>;
+  connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+    identitySlotPrefix: z.ZodOptional<z.ZodString>;
+    serviceIdPrefix: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  defaultRoute: z.ZodDefault<z.ZodBoolean>;
+  cmd: z.ZodOptional<z.ZodString>;
+  argv: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  cwd: z.ZodOptional<z.ZodString>;
+  kind: z.ZodLiteral<"cmd-env">;
+}, z.core.$strip>, z.ZodObject<{
+  managedIdentity: z.ZodOptional<z.ZodObject<{
+    slot: z.ZodString;
+  }, z.core.$strip>>;
+  grantedServiceId: z.ZodOptional<z.ZodString>;
+  connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+    identitySlotPrefix: z.ZodOptional<z.ZodString>;
+    serviceIdPrefix: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  defaultRoute: z.ZodDefault<z.ZodBoolean>;
+  cmd: z.ZodOptional<z.ZodString>;
+  argv: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  cwd: z.ZodOptional<z.ZodString>;
+  kind: z.ZodLiteral<"cmd-stdio">;
+}, z.core.$strip>], "kind">;
+type EndpointConfig = z.infer<typeof EndpointConfigSchema>;
+declare const ListenerConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  handlers: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    managedIdentity: z.ZodOptional<z.ZodObject<{
+      slot: z.ZodString;
+    }, z.core.$strip>>;
+    grantedServiceId: z.ZodOptional<z.ZodString>;
+    connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+      identitySlotPrefix: z.ZodOptional<z.ZodString>;
+      serviceIdPrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    token: z.ZodLiteral<"anonymous">;
+  }, z.core.$strip>, z.ZodObject<{
+    managedIdentity: z.ZodOptional<z.ZodObject<{
+      slot: z.ZodString;
+    }, z.core.$strip>>;
+    grantedServiceId: z.ZodOptional<z.ZodString>;
+    connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+      identitySlotPrefix: z.ZodOptional<z.ZodString>;
+      serviceIdPrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    token: z.ZodLiteral<"static">;
+    value: z.ZodString;
+  }, z.core.$strip>, z.ZodObject<{
+    token: z.ZodLiteral<"bound">;
+  }, z.core.$strip>], "token">>>;
+  type: z.ZodLiteral<"websocket">;
+  host: z.ZodDefault<z.ZodString>;
+  port: z.ZodDefault<z.ZodNumber>;
+  path: z.ZodDefault<z.ZodString>;
+  healthPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+  maxPayload: z.ZodDefault<z.ZodNumber>;
+  allowedOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+  handlers: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    managedIdentity: z.ZodOptional<z.ZodObject<{
+      slot: z.ZodString;
+    }, z.core.$strip>>;
+    grantedServiceId: z.ZodOptional<z.ZodString>;
+    connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+      identitySlotPrefix: z.ZodOptional<z.ZodString>;
+      serviceIdPrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    token: z.ZodLiteral<"anonymous">;
+  }, z.core.$strip>, z.ZodObject<{
+    managedIdentity: z.ZodOptional<z.ZodObject<{
+      slot: z.ZodString;
+    }, z.core.$strip>>;
+    grantedServiceId: z.ZodOptional<z.ZodString>;
+    connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+      identitySlotPrefix: z.ZodOptional<z.ZodString>;
+      serviceIdPrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    token: z.ZodLiteral<"static">;
+    value: z.ZodString;
+  }, z.core.$strip>, z.ZodObject<{
+    token: z.ZodLiteral<"bound">;
+  }, z.core.$strip>], "token">>>;
+  type: z.ZodLiteral<"socket">;
+  path: z.ZodString;
+}, z.core.$strip>], "type">;
+type ListenerConfig = z.infer<typeof ListenerConfigSchema>;
+/**
+ * Forward-checking policy for the hub's inbound listeners. When enabled, the
+ * hub mints an admin signing identity, serves the signed
+ * `hubServiceIdRegistry::registerServiceId` + `hubAccess` front doors, and gates
+ * every forwarded (fully-qualified) call at each listener boundary:
+ *
+ * - `verifySignatures` — forwarded calls must carry a valid `$hubrpc`
+ *   signature (authenticity).
+ * - `requireCapability` — forwarded calls must additionally present a
+ *   capability chain rooting at the hub admin (authorization). Granting
+ *   capabilities is gated by the {@link HubAccessManifestHost} consent rendezvous.
+ *
+ * `true` is shorthand for both flags on; `false` disables forward checking
+ * entirely (open hub, no consent surface).
+ */
+declare const ForwardCheckingSchema: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+  verifySignatures: z.ZodDefault<z.ZodBoolean>;
+  requireCapability: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>]>>;
+type ForwardCheckingConfig = z.infer<typeof ForwardCheckingSchema>;
+/**
+ * Where the built-in terminal consent approver sources its pending requests
+ * from. The approver consumes `hubAccessManifest::{getDesired,watchDesired,
+ * setCurrent}` **over a connection** — never the in-process host object — so the
+ * same loop works against a remote source unchanged.
+ *
+ * - `true` (default) — consume this hub's own manifest (served under
+ *   {@link HubConfig.hubServiceId}). The common, local-operator case.
+ * - `{ serviceId }` — consume the manifest served at `serviceId` (e.g. an
+ *   upstream hub the operator approves on behalf of).
+ * - `false` — install no built-in approver; rely entirely on external approvers
+ *   (configured {@link HubConfig.rootPrincipalIds}) deciding via the manifest.
+ *
+ * The approver is only started when stdin is a TTY (it drives a terminal
+ * prompt); a non-interactive hub is keyless regardless of this setting.
+ */
+declare const ConsentApproverSchema: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+  serviceId: z.ZodString;
+}, z.core.$strip>]>>;
+type ConsentApproverConfig = z.infer<typeof ConsentApproverSchema>;
+declare const HubConfigSchema: z.ZodObject<{
+  $schema: z.ZodOptional<z.ZodString>;
+  hubServiceId: z.ZodDefault<z.ZodString>;
+  listeners: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    handlers: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      managedIdentity: z.ZodOptional<z.ZodObject<{
+        slot: z.ZodString;
+      }, z.core.$strip>>;
+      grantedServiceId: z.ZodOptional<z.ZodString>;
+      connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+        identitySlotPrefix: z.ZodOptional<z.ZodString>;
+        serviceIdPrefix: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>;
+      token: z.ZodLiteral<"anonymous">;
+    }, z.core.$strip>, z.ZodObject<{
+      managedIdentity: z.ZodOptional<z.ZodObject<{
+        slot: z.ZodString;
+      }, z.core.$strip>>;
+      grantedServiceId: z.ZodOptional<z.ZodString>;
+      connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+        identitySlotPrefix: z.ZodOptional<z.ZodString>;
+        serviceIdPrefix: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>;
+      token: z.ZodLiteral<"static">;
+      value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+      token: z.ZodLiteral<"bound">;
+    }, z.core.$strip>], "token">>>;
+    type: z.ZodLiteral<"websocket">;
+    host: z.ZodDefault<z.ZodString>;
+    port: z.ZodDefault<z.ZodNumber>;
+    path: z.ZodDefault<z.ZodString>;
+    healthPath: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    maxPayload: z.ZodDefault<z.ZodNumber>;
+    allowedOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  }, z.core.$strip>, z.ZodObject<{
+    handlers: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      managedIdentity: z.ZodOptional<z.ZodObject<{
+        slot: z.ZodString;
+      }, z.core.$strip>>;
+      grantedServiceId: z.ZodOptional<z.ZodString>;
+      connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+        identitySlotPrefix: z.ZodOptional<z.ZodString>;
+        serviceIdPrefix: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>;
+      token: z.ZodLiteral<"anonymous">;
+    }, z.core.$strip>, z.ZodObject<{
+      managedIdentity: z.ZodOptional<z.ZodObject<{
+        slot: z.ZodString;
+      }, z.core.$strip>>;
+      grantedServiceId: z.ZodOptional<z.ZodString>;
+      connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+        identitySlotPrefix: z.ZodOptional<z.ZodString>;
+        serviceIdPrefix: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>;
+      token: z.ZodLiteral<"static">;
+      value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+      token: z.ZodLiteral<"bound">;
+    }, z.core.$strip>], "token">>>;
+    type: z.ZodLiteral<"socket">;
+    path: z.ZodString;
+  }, z.core.$strip>], "type">>>;
+  endpoints: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    managedIdentity: z.ZodOptional<z.ZodObject<{
+      slot: z.ZodString;
+    }, z.core.$strip>>;
+    grantedServiceId: z.ZodOptional<z.ZodString>;
+    connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+      identitySlotPrefix: z.ZodOptional<z.ZodString>;
+      serviceIdPrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    defaultRoute: z.ZodDefault<z.ZodBoolean>;
+    kind: z.ZodLiteral<"uri">;
+    uri: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>, z.ZodObject<{
+    managedIdentity: z.ZodOptional<z.ZodObject<{
+      slot: z.ZodString;
+    }, z.core.$strip>>;
+    grantedServiceId: z.ZodOptional<z.ZodString>;
+    connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+      identitySlotPrefix: z.ZodOptional<z.ZodString>;
+      serviceIdPrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    defaultRoute: z.ZodDefault<z.ZodBoolean>;
+    kind: z.ZodLiteral<"ws">;
+    url: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>, z.ZodObject<{
+    managedIdentity: z.ZodOptional<z.ZodObject<{
+      slot: z.ZodString;
+    }, z.core.$strip>>;
+    grantedServiceId: z.ZodOptional<z.ZodString>;
+    connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+      identitySlotPrefix: z.ZodOptional<z.ZodString>;
+      serviceIdPrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    defaultRoute: z.ZodDefault<z.ZodBoolean>;
+    kind: z.ZodLiteral<"socket">;
+    path: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>, z.ZodObject<{
+    managedIdentity: z.ZodOptional<z.ZodObject<{
+      slot: z.ZodString;
+    }, z.core.$strip>>;
+    grantedServiceId: z.ZodOptional<z.ZodString>;
+    connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+      identitySlotPrefix: z.ZodOptional<z.ZodString>;
+      serviceIdPrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    defaultRoute: z.ZodDefault<z.ZodBoolean>;
+    cmd: z.ZodOptional<z.ZodString>;
+    argv: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    cwd: z.ZodOptional<z.ZodString>;
+    kind: z.ZodLiteral<"cmd-env">;
+  }, z.core.$strip>, z.ZodObject<{
+    managedIdentity: z.ZodOptional<z.ZodObject<{
+      slot: z.ZodString;
+    }, z.core.$strip>>;
+    grantedServiceId: z.ZodOptional<z.ZodString>;
+    connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+      identitySlotPrefix: z.ZodOptional<z.ZodString>;
+      serviceIdPrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    defaultRoute: z.ZodDefault<z.ZodBoolean>;
+    cmd: z.ZodOptional<z.ZodString>;
+    argv: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    cwd: z.ZodOptional<z.ZodString>;
+    kind: z.ZodLiteral<"cmd-stdio">;
+  }, z.core.$strip>], "kind">>>;
+  namedEndpoints: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+    managedIdentity: z.ZodOptional<z.ZodObject<{
+      slot: z.ZodString;
+    }, z.core.$strip>>;
+    grantedServiceId: z.ZodOptional<z.ZodString>;
+    connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+      identitySlotPrefix: z.ZodOptional<z.ZodString>;
+      serviceIdPrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    defaultRoute: z.ZodDefault<z.ZodBoolean>;
+    kind: z.ZodLiteral<"uri">;
+    uri: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>, z.ZodObject<{
+    managedIdentity: z.ZodOptional<z.ZodObject<{
+      slot: z.ZodString;
+    }, z.core.$strip>>;
+    grantedServiceId: z.ZodOptional<z.ZodString>;
+    connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+      identitySlotPrefix: z.ZodOptional<z.ZodString>;
+      serviceIdPrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    defaultRoute: z.ZodDefault<z.ZodBoolean>;
+    kind: z.ZodLiteral<"ws">;
+    url: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>, z.ZodObject<{
+    managedIdentity: z.ZodOptional<z.ZodObject<{
+      slot: z.ZodString;
+    }, z.core.$strip>>;
+    grantedServiceId: z.ZodOptional<z.ZodString>;
+    connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+      identitySlotPrefix: z.ZodOptional<z.ZodString>;
+      serviceIdPrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    defaultRoute: z.ZodDefault<z.ZodBoolean>;
+    kind: z.ZodLiteral<"socket">;
+    path: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>, z.ZodObject<{
+    managedIdentity: z.ZodOptional<z.ZodObject<{
+      slot: z.ZodString;
+    }, z.core.$strip>>;
+    grantedServiceId: z.ZodOptional<z.ZodString>;
+    connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+      identitySlotPrefix: z.ZodOptional<z.ZodString>;
+      serviceIdPrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    defaultRoute: z.ZodDefault<z.ZodBoolean>;
+    cmd: z.ZodOptional<z.ZodString>;
+    argv: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    cwd: z.ZodOptional<z.ZodString>;
+    kind: z.ZodLiteral<"cmd-env">;
+  }, z.core.$strip>, z.ZodObject<{
+    managedIdentity: z.ZodOptional<z.ZodObject<{
+      slot: z.ZodString;
+    }, z.core.$strip>>;
+    grantedServiceId: z.ZodOptional<z.ZodString>;
+    connectionTokenBinder: z.ZodOptional<z.ZodObject<{
+      identitySlotPrefix: z.ZodOptional<z.ZodString>;
+      serviceIdPrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    routeServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    claimServiceIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    defaultRoute: z.ZodDefault<z.ZodBoolean>;
+    cmd: z.ZodOptional<z.ZodString>;
+    argv: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    cwd: z.ZodOptional<z.ZodString>;
+    kind: z.ZodLiteral<"cmd-stdio">;
+  }, z.core.$strip>], "kind">>>;
+  forwardChecking: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+    verifySignatures: z.ZodDefault<z.ZodBoolean>;
+    requireCapability: z.ZodDefault<z.ZodBoolean>;
+  }, z.core.$strip>]>>;
+  adminIdentitySlot: z.ZodDefault<z.ZodString>;
+  rootPrincipalIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  consentApprover: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+    serviceId: z.ZodString;
+  }, z.core.$strip>]>>;
+}, z.core.$strip>;
+type HubConfig = z.infer<typeof HubConfigSchema>;
+/** Parse + validate an in-memory config object. Throws `ZodError` on failure. */
+declare function parseHubConfig(raw: unknown): HubConfig;
+/** JSON-Schema for the config file (for `--print-schema` / editor tooling). */
+declare function hubConfigJsonSchema(): unknown;
+//#endregion
+export { ProvisionConfig as _, ConsentApproverConfig as a, EndpointConfigSchema as c, HubConfig as d, HubConfigSchema as f, ParticipantConnectorConfigSchema as g, ParticipantConnectorConfig as h, ConnectionTokenBinderSchema as i, ForwardCheckingConfig as l, ListenerConfigSchema as m, ConnectionHandlerSchema as n, ConsentApproverSchema as o, ListenerConfig as p, ConnectionTokenBinderConfig as r, EndpointConfig as s, ConnectionHandlerConfig as t, ForwardCheckingSchema as u, hubConfigJsonSchema as v, parseHubConfig as y };
+//# sourceMappingURL=config-BCvkg7jv.d.ts.map

package/dist/chunks/configFile-y6Phntqu.d.ts

@@ -0,0 +1,9 @@
+import { d as HubConfig } from "./config-BCvkg7jv.js";
+//#region src/configFile.d.ts
+/** Read and validate a hub config file. */
+declare function loadHubConfig(configPath: string): HubConfig;
+/** The config JSON Schema, pretty-printed. */
+declare function printHubConfigSchema(): string;
+//#endregion
+export { printHubConfigSchema as n, loadHubConfig as t };
+//# sourceMappingURL=configFile-y6Phntqu.d.ts.map