@hediet/linkrpc-hub 0.0.1

package/dist/chunks/runHub-P3YUwwdv.js

@@ -0,0 +1,1797 @@
+import { a as anonymousHandler, b as Hub, d as registerConnectionTokenBinderService, f as createHubServiceInterfaces, l as resolveConnectionHandler, o as boundTokenHandler, t as HubConnectionAcceptor, u as staticTokenHandler } from "./hubConnectionAcceptor-B5-8JsFY.js";
+import { r as createFlowLogger } from "./nodeTransit-CWeFnbwt.js";
+import { a as TokenIdentityStore, c as durationToExp, d as fetchFullDirectory, n as createSqliteIdentityKeystore, s as CapabilityProposalIssuer, u as candidatesForSlot } from "./server-BAxchQhy.js";
+import { spawnCommand } from "../spawn.js";
+import { i as SocketServer, n as WebSocketServer } from "./node-CTXsQ6oa.js";
+import { DEFAULT_RPC_TIMEOUT_MS, HUBRPC_META_KEY, KeypairSigningIdentity, requireObjectParams, signedHash, withRpcTimeout } from "@hediet/linkrpc";
+import * as readline from "node:readline";
+import { hubAccessInterface, hubAccessManifestInterface, hubGrantedServiceIdInterface } from "@hediet/linkrpc/hub/common";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import * as path from "node:path";
+import { autorun, observableValue } from "@vscode/observables";
+import { WebSocketTransport, connectNdjson, loadOrCreateIdentity, openWebSocket, parseEndpointUri, runInitializeHandshake } from "@hediet/linkrpc/node";
+import * as net from "node:net";
+import * as fs from "node:fs";
+import * as os from "node:os";
+//#region src/engine/consent.ts
+/**
+* Approver-side consent utilities for the `hubAccessManifest` flow.
+*
+* This module is consumed by *approvers* — {@link runManifestApprover} (the CLI)
+* and any other manifest consumer. It provides:
+*
+*  - the prompt contract ({@link ConsentPrompt} / {@link ConsentPromptRequest} /
+*    {@link ConsentDecision}) an approver uses to ask a human, plus the default
+*    terminal y/N prompt ({@link createTerminalConsentPrompt});
+*  - capability-shaping helpers an approver uses when it mints
+*    ({@link toSignedPermissions} / {@link computeCallBindHash}, which honor
+*    "Allow once" `callBind` byte-binding); and
+*  - {@link describePermissions} for rendering a request.
+*
+* The hub-side translation of `hubAccess` requests into parked manifest entries
+* lives on {@link HubAccessManifestHost} (`hubAccessConfig`), not here.
+*/
+/** One-line, human-readable summary of a permission for the consent prompt. */
+function describePermission(perm) {
+	return `${patternText(perm.target.serviceId)}::${patternText(perm.target.interfaceId)} {${perm.target.members.map(patternText).join(",")}}`;
+}
+/** One human-readable line per permission, for an approver's UI / prompt. */
+function describePermissions(permissions) {
+	return permissions.map(describePermission);
+}
+function patternText(p) {
+	if (p === void 0) return "*";
+	if ("exact" in p) return p.exact;
+	if ("prefix" in p) return p.prefix === "" ? "*" : `${p.prefix}*`;
+	return "*";
+}
+/**
+* Strip the consent-only `callIntent` from each requested permission and, for a
+* one-shot (`duration: 'once'`) grant whose intent declares a concrete call,
+* pin the permission to that exact call via `callBind.payloadHash`. The result
+* is the `Permission[]` to sign into the capability. Shared by the hub-issuer
+* mint path and any inbox approver that wants to honor "Allow once".
+*
+* `callIntent` is never itself signed — only the derived `callBind` is.
+*/
+async function toSignedPermissions(permissions, consumerPrincipalId, duration) {
+	return Promise.all(permissions.map(async ({ callIntent, ...perm }) => {
+		const signed = { ...perm };
+		if (duration === "once" && callIntent !== void 0 && callIntent.params !== void 0 && callIntent.nonce && callIntent.signedAtMs !== void 0) signed.callBind = {
+			alg: "sha256",
+			payloadHash: await computeCallBindHash(callIntent, consumerPrincipalId)
+		};
+		return signed;
+	}));
+}
+/**
+* Compute `callBind.payloadHash` for a grant bound to one consumer-declared
+* call. Builds the SAME signed params the consumer commits to at sign time
+* (`signedHash('call', { ...params, $hubrpc: meta })`); the forwarded-call gate
+* re-derives this on the inbound call and checks the hash matches. The consumer
+* owns `nonce`/`signedAtMs`, supplied via `callIntent`.
+*/
+async function computeCallBindHash(intent, consumerPrincipalId) {
+	const callMeta = {
+		method: intent.method,
+		nonce: intent.nonce,
+		signedAtMs: intent.signedAtMs,
+		principal: consumerPrincipalId,
+		...intent.interfaceHash !== void 0 ? { interfaceHash: intent.interfaceHash } : {}
+	};
+	const signedParams = {
+		...requireObjectParams(intent.params),
+		[HUBRPC_META_KEY]: callMeta
+	};
+	return signedHash("call", signedParams);
+}
+/**
+* A terminal yes/no consent prompt on stdin.
+*
+* When stdin is not a TTY (no operator to answer) it **abstains** — it never
+* settles, parking until {@link ConsentPromptRequest.signal} aborts. This keeps
+* it safe inside {@link raceConsent}: a non-interactive terminal must not win
+* the race with an instant deny, or a hub-served inbox approval could never
+* land. A headless hub should simply not install this prompt at all (or pair it
+* with an inbox); on its own it grants nothing.
+*
+* When interactive, it resolves on the operator's answer, and abandons the
+* readline prompt if the request is aborted (another prompt decided first).
+*/
+function createTerminalConsentPrompt() {
+	return (request) => new Promise((resolve) => {
+		if (request.signal.aborted) {
+			resolve({ grant: false });
+			return;
+		}
+		if (!process.stdin.isTTY) {
+			process.stderr.write("hubAccess: stdin is not a TTY; the terminal prompt is abstaining (waiting for an out-of-band approval or cancellation).\n");
+			request.signal.addEventListener("abort", () => resolve({ grant: false }), { once: true });
+			return;
+		}
+		const rl = readline.createInterface({
+			input: process.stdin,
+			output: process.stderr
+		});
+		const onAbort = () => {
+			rl.close();
+			resolve({ grant: false });
+		};
+		request.signal.addEventListener("abort", onAbort, { once: true });
+		const lines = [
+			"",
+			`Access request from "${request.consumer.name}"`,
+			...request.consumer.purpose ? [`  purpose: ${request.consumer.purpose}`] : [],
+			`  node:    ${request.consumerPrincipalId}`,
+			...request.grants.map((g) => `  grant:   ${g}`),
+			...request.duration ? [`  duration: ${request.duration}`] : [],
+			""
+		];
+		process.stderr.write(lines.join("\n"));
+		rl.question("Allow? [y/N] ", (answer) => {
+			request.signal.removeEventListener("abort", onAbort);
+			rl.close();
+			resolve(/^y(es)?$/i.test(answer.trim()) ? { grant: true } : { grant: false });
+		});
+	});
+}
+/**
+* Compose several {@link ConsentPrompt}s into one that presents each request to
+* **all** of them and takes the **first** to settle (first responder wins,
+* including a deny). Once one settles, the rest are aborted via a shared signal
+* so they can tear down (close the readline, drop the inbox entry). The
+* incoming request's own signal is honored too: if the consumer cancels, every
+* child prompt is aborted.
+*
+* This is what lets a single `hubAccess` request reach the hub operator's
+* terminal prompt and a hub-served inbox at the same time.
+*/
+function raceConsent(prompts) {
+	return (request) => new Promise((resolve, reject) => {
+		if (prompts.length === 0) {
+			resolve({
+				grant: false,
+				reason: "no consent surface configured"
+			});
+			return;
+		}
+		const child = new AbortController();
+		const onOuterAbort = () => child.abort();
+		if (request.signal.aborted) child.abort();
+		else request.signal.addEventListener("abort", onOuterAbort, { once: true });
+		let settled = false;
+		const finish = (run) => {
+			if (settled) return;
+			settled = true;
+			request.signal.removeEventListener("abort", onOuterAbort);
+			child.abort();
+			run();
+		};
+		const childRequest = {
+			...request,
+			signal: child.signal
+		};
+		for (const prompt of prompts) Promise.resolve().then(() => prompt(childRequest)).then((decision) => finish(() => resolve(decision)), (err) => finish(() => reject(err)));
+	});
+}
+//#endregion
+//#region src/engine/hubAccessConfig.ts
+/**
+* Build the `hubAccess` front-door config from a single {@link AccessDecider}.
+* The returned {@link HubAccessConfig} is what `registerHubAccessService`
+* installs at a participant's overlay root.
+*/
+function createHubAccessConfig(decide, fetchDirectory = async () => []) {
+	return {
+		handlers: {
+			onAccessRequest: async (args) => {
+				if (Object.keys(args.dependencies).length === 0) return {
+					granted: false,
+					reason: "no slots requested"
+				};
+				const resolvedSlots = {};
+				const permissions = [];
+				for (const [slotId, slot] of Object.entries(args.dependencies)) {
+					const candidate = slot.candidates[0];
+					if (!candidate) return {
+						granted: false,
+						reason: `no candidate for slot '${slotId}'`
+					};
+					const present = new Set(candidate.satisfiedInterfaces.map((i) => i.id));
+					resolvedSlots[slotId] = {
+						serviceId: candidate.serviceId,
+						interfaces: candidate.satisfiedInterfaces.map((i) => i.id)
+					};
+					permissions.push(...buildSlotPermissions(candidate.serviceId, slot.request.interfaces, slot.request.members, present));
+				}
+				const decision = await decide({
+					kind: "request",
+					consumer: args.consumer,
+					consumerPrincipalId: args.consumerPrincipalId,
+					permissions,
+					duration: args.duration
+				});
+				if (!decision.grant) return {
+					granted: false,
+					reason: decision.reason ?? "user denied"
+				};
+				return {
+					granted: true,
+					resolvedSlots,
+					capabilities: capsFromDecision(decision)
+				};
+			},
+			onAccessExtend: async (args) => {
+				const byIface = /* @__PURE__ */ new Map();
+				for (const a of args.added) {
+					const members = byIface.get(a.interfaceId) ?? [];
+					members.push(a.member);
+					byIface.set(a.interfaceId, members);
+				}
+				const permissions = [...byIface.entries()].map(([interfaceId, members]) => ({
+					target: {
+						serviceId: { exact: args.serviceId },
+						interfaceId: { exact: interfaceId },
+						members
+					},
+					canInvoke: true
+				}));
+				if (permissions.length === 0) return {
+					granted: false,
+					reason: "no members requested"
+				};
+				const decision = await decide({
+					kind: "extend",
+					consumer: args.consumer,
+					consumerPrincipalId: args.consumerPrincipalId,
+					permissions,
+					duration: args.duration
+				});
+				if (!decision.grant) return {
+					granted: false,
+					reason: decision.reason ?? "user denied"
+				};
+				return {
+					granted: true,
+					serviceId: args.serviceId,
+					grantedMembers: args.added.map((a) => ({
+						interfaceId: a.interfaceId,
+						member: a.member
+					})),
+					capabilities: capsFromDecision(decision)
+				};
+			},
+			onAccessRequestDirect: async (args) => {
+				if (args.permissions.length === 0) return {
+					granted: false,
+					reason: "no permissions requested"
+				};
+				const decision = await decide({
+					kind: "requestAccess",
+					consumer: args.consumer,
+					consumerPrincipalId: args.consumerPrincipalId,
+					permissions: args.permissions,
+					duration: args.duration
+				});
+				if (!decision.grant) return {
+					granted: false,
+					reason: decision.reason ?? "user denied"
+				};
+				return {
+					granted: true,
+					capabilities: capsFromDecision(decision)
+				};
+			}
+		},
+		fetchDirectory: async () => [...await fetchDirectory()]
+	};
+}
+/** A one-line human summary of a request, for a decider's log. */
+function describeRequest(ctx) {
+	return `"${ctx.consumer.name}" (node=${ctx.consumerPrincipalId}) requests [${describePermissions(ctx.permissions).join(", ")}]${ctx.duration ? ` for '${ctx.duration}'` : ""}`;
+}
+/**
+* Extract the approver-supplied capabilities from an approved decision. The
+* adapter never mints — an approval that carries no capabilities is a contract
+* violation by the decider.
+*/
+function capsFromDecision(decision) {
+	if (decision.capabilities === void 0 || decision.capabilities.length === 0) throw new Error("hubAccess: a grant decision carried no capabilities to relay — the decider must supply approver-signed capabilities (the adapter never mints).");
+	return [...decision.capabilities];
+}
+/** Build one permission per requested interface, scoped to `serviceId`. */
+function buildSlotPermissions(serviceId, interfaces, members, present) {
+	const hashByIface = new Map(interfaces.map((i) => [i.id, i.hash]));
+	const buckets = /* @__PURE__ */ new Map();
+	for (const m of members) {
+		if (!present.has(m.interfaceId)) continue;
+		const hash = hashByIface.get(m.interfaceId);
+		const key = `${m.interfaceId}\u0000${hash ?? ""}`;
+		let bucket = buckets.get(key);
+		if (!bucket) {
+			bucket = {
+				interfaceId: m.interfaceId,
+				hash,
+				members: []
+			};
+			buckets.set(key, bucket);
+		}
+		bucket.members.push(m.member);
+	}
+	if (buckets.size === 0) return [...present].map((interfaceId) => {
+		const hash = hashByIface.get(interfaceId);
+		const target = {
+			serviceId: { exact: serviceId },
+			interfaceId: { exact: interfaceId },
+			members: [{ prefix: "" }]
+		};
+		if (hash !== void 0) target.interfaceHash = hash;
+		return {
+			target,
+			canInvoke: true
+		};
+	});
+	return [...buckets.values()].map((b) => {
+		const target = {
+			serviceId: { exact: serviceId },
+			interfaceId: { exact: b.interfaceId },
+			members: b.members
+		};
+		if (b.hash !== void 0) target.interfaceHash = b.hash;
+		return {
+			target,
+			canInvoke: true
+		};
+	});
+}
+//#endregion
+//#region src/engine/hubAccessManifest.ts
+var HubAccessManifestHost = class {
+	_pending = /* @__PURE__ */ new Map();
+	_listeners = /* @__PURE__ */ new Set();
+	_acceptableRootIds;
+	_log;
+	_revision = 0;
+	constructor(options = {}) {
+		this._acceptableRootIds = options.acceptableRootIds ?? [];
+		this._log = options.log ?? ((line) => process.stderr.write(line + "\n"));
+	}
+	/**
+	* Register `hubAccess::{request,extend,requestAccess}` directly at a
+	* participant's overlay root (root form, never forwarded → never gated).
+	* Unlike `registerHubAccessService` this consults **no** hub-side directory:
+	* `request` forwards raw slots as `discover` entries for the approver to
+	* resolve.
+	*
+	* `options.origin` is a host-authored provenance bag bound to THIS
+	* connection and stamped onto every entry parked here. It is bound
+	* server-side (not read from the consumer's request params) so a consumer
+	* cannot spoof another transport's origin. The host relays it verbatim; it
+	* does not interpret it.
+	*/
+	registerHubAccessAtRoot(connection, options) {
+		const origin = options?.origin;
+		connection.register(hubAccessInterface, {
+			request: async (params, _ctx, stream) => {
+				const consumerPrincipalId = params.consumer.principal;
+				const consumer = plainConsumer(params.consumer);
+				const slotIds = Object.keys(params.dependencies);
+				if (slotIds.length === 0) return {
+					status: "denied",
+					reason: "no slots requested"
+				};
+				this._log(`hubAccess::request "${consumer.name}" (node=${consumerPrincipalId}) slots=[${slotIds.join(", ")}]${params.duration ? ` for '${params.duration}'` : ""}`);
+				const results = await Promise.all(slotIds.map((slotId) => {
+					const slot = params.dependencies[slotId];
+					return this._park({
+						kind: "discover",
+						consumer,
+						consumerPrincipalId,
+						duration: params.duration,
+						interfaces: slot.interfaces,
+						members: slot.members ?? [],
+						origin
+					}, stream.signal);
+				}));
+				const denied = results.find((r) => !r.grant);
+				if (denied && !denied.grant) return denied.reason !== void 0 ? {
+					status: "denied",
+					reason: denied.reason
+				} : { status: "denied" };
+				const slots = {};
+				const capabilities = [];
+				slotIds.forEach((slotId, i) => {
+					const r = results[i];
+					if (!r.grant) return;
+					if (r.resolvedSlot) slots[slotId] = {
+						serviceId: r.resolvedSlot.serviceId,
+						satisfiedInterfaces: [...r.resolvedSlot.satisfiedInterfaces]
+					};
+					capabilities.push(...r.capabilities);
+				});
+				return {
+					status: "granted",
+					slots,
+					capabilities
+				};
+			},
+			extend: async (params, _ctx, stream) => {
+				const consumerPrincipalId = params.consumer.principal;
+				const permissions = extendPermissions(params.serviceId, params.added);
+				this._log(`hubAccess::extend "${params.consumer.name}" (node=${consumerPrincipalId}) service=${params.serviceId}`);
+				const decision = await this._park({
+					kind: "direct",
+					consumer: plainConsumer(params.consumer),
+					consumerPrincipalId,
+					duration: params.duration,
+					permissions,
+					origin
+				}, stream.signal);
+				if (!decision.grant) return decision.reason !== void 0 ? {
+					status: "denied",
+					reason: decision.reason
+				} : { status: "denied" };
+				return {
+					status: "granted",
+					serviceId: params.serviceId,
+					granted: params.added.map((a) => ({
+						interfaceId: a.interfaceId,
+						member: a.member
+					})),
+					capabilities: [...decision.capabilities]
+				};
+			},
+			requestAccess: async (params, _ctx, stream) => {
+				const consumerPrincipalId = params.consumer.principal;
+				const permissions = params.permissions;
+				if (permissions.length === 0) return {
+					status: "denied",
+					reason: "no permissions requested"
+				};
+				this._log(`hubAccess::requestAccess "${params.consumer.name}" (node=${consumerPrincipalId}) [${describePermissions(permissions).join(", ")}]${params.duration ? ` for '${params.duration}'` : ""}`);
+				const decision = await this._park({
+					kind: "direct",
+					consumer: plainConsumer(params.consumer),
+					consumerPrincipalId,
+					duration: params.duration,
+					permissions,
+					origin
+				}, stream.signal);
+				if (!decision.grant) return decision.reason !== void 0 ? {
+					status: "denied",
+					reason: decision.reason
+				} : { status: "denied" };
+				return {
+					status: "granted",
+					capabilities: [...decision.capabilities]
+				};
+			}
+		});
+	}
+	/** Park a desired entry and await the approver's decision (via `setCurrent`). */
+	_park(entry, signal) {
+		signal?.throwIfAborted();
+		return new Promise((resolve, reject) => {
+			const requestId = randomUUID();
+			const full = {
+				...entry,
+				requestId
+			};
+			let done = false;
+			const settle = (decision) => {
+				if (done) return;
+				done = true;
+				signal?.removeEventListener("abort", abort);
+				this._pending.delete(requestId);
+				this._bump();
+				resolve(decision);
+			};
+			const abort = () => {
+				if (done) return;
+				done = true;
+				this._pending.delete(requestId);
+				this._bump();
+				reject(signal?.reason ?? /* @__PURE__ */ new Error("hubAccess request cancelled"));
+			};
+			this._pending.set(requestId, {
+				entry: full,
+				resolve: settle
+			});
+			this._bump();
+			signal?.addEventListener("abort", abort, { once: true });
+			if (signal?.aborted) abort();
+		});
+	}
+	/** Snapshot of the desired document (entryId → desired entry) + revision. */
+	getDesired() {
+		return {
+			entries: [...this._pending.values()].map((e) => e.entry),
+			acceptableRootIds: this._acceptableRootIds,
+			revision: this._revision
+		};
+	}
+	/**
+	* Resolve a parked entry from a `setCurrent` decision. Returns `false` when
+	* no entry with that id is pending (already decided / cancelled).
+	*/
+	resolve(requestId, decision) {
+		const found = this._pending.get(requestId);
+		if (!found) return false;
+		found.resolve(decision);
+		return true;
+	}
+	/** Subscribe to coarse "desired set may have changed" notifications. */
+	onDidChange(listener) {
+		this._listeners.add(listener);
+		return () => this._listeners.delete(listener);
+	}
+	_bump() {
+		this._revision += 1;
+		for (const l of [...this._listeners]) l();
+	}
+};
+function plainConsumer(c) {
+	return {
+		name: c.name,
+		...c.origin !== void 0 ? { origin: c.origin } : {},
+		...c.purpose !== void 0 ? { purpose: c.purpose } : {}
+	};
+}
+/** Group extend `added` members by interface into permissions scoped to `serviceId`. */
+function extendPermissions(serviceId, added) {
+	const byIface = /* @__PURE__ */ new Map();
+	for (const a of added) {
+		const members = byIface.get(a.interfaceId) ?? [];
+		members.push(a.member);
+		byIface.set(a.interfaceId, members);
+	}
+	return [...byIface.entries()].map(([interfaceId, members]) => ({
+		target: {
+			serviceId: { exact: serviceId },
+			interfaceId: { exact: interfaceId },
+			members
+		},
+		canInvoke: true
+	}));
+}
+/**
+* Serve `hubAccessManifest::*` on `connection`, mounted under `serviceId` (the
+* hub's own service prefix). Reachable only through the forwarded-call gate, so
+* authorization (an accepted-root capability) is enforced upstream — no gate is
+* applied here.
+*
+* `getCurrent`/`watchCurrent` are vestigial for the hub broker: granted caps are
+* delivered as the blocked `hubAccess` call's result, not read back through
+* `current`. They are served (empty) to satisfy the interface.
+*/
+function registerHubAccessManifest(connection, host, options) {
+	connection.register(hubAccessManifestInterface, {
+		getDesired: () => {
+			const { entries, acceptableRootIds, revision } = host.getDesired();
+			const requested = {};
+			const roots = acceptableRootIds.length > 0 ? [...acceptableRootIds] : void 0;
+			for (const e of entries) {
+				const consumer = {
+					...e.consumer,
+					principal: e.consumerPrincipalId
+				};
+				const duration = e.duration;
+				const originFields = e.origin !== void 0 ? { origin: e.origin } : {};
+				if (e.kind === "direct") requested[e.requestId] = {
+					kind: "direct",
+					consumer,
+					permissions: e.permissions,
+					...duration !== void 0 ? { duration } : {},
+					...roots !== void 0 ? { acceptableRootIds: roots } : {},
+					...originFields
+				};
+				else requested[e.requestId] = {
+					kind: "discover",
+					consumer,
+					interfaces: e.interfaces.map((i) => ({
+						id: i.id,
+						...i.hash !== void 0 ? { hash: i.hash } : {},
+						...i.required !== void 0 ? { required: i.required } : {}
+					})),
+					members: e.members.map((m) => ({
+						interfaceId: m.interfaceId,
+						member: m.member,
+						...m.required !== void 0 ? { required: m.required } : {}
+					})),
+					...duration !== void 0 ? { duration } : {},
+					...roots !== void 0 ? { acceptableRootIds: roots } : {},
+					...originFields
+				};
+			}
+			return {
+				requested,
+				revision
+			};
+		},
+		watchDesired: (_params, _ctx, stream) => new Promise((resolve) => {
+			if (stream.signal.aborted) {
+				resolve({});
+				return;
+			}
+			const unsubscribe = host.onDidChange(() => {
+				if (stream.signal.aborted) return;
+				stream.send({});
+			});
+			stream.signal.addEventListener("abort", () => {
+				unsubscribe();
+				resolve({});
+			}, { once: true });
+		}),
+		getCurrent: () => ({
+			current: {},
+			revision: 0
+		}),
+		setCurrent: (params) => {
+			const unknown = [];
+			for (const patch of params.patches) {
+				if (patch.op !== "set") continue;
+				for (const [requestId, value] of currentEntriesOfPatch(patch.path, patch.value)) if (!host.resolve(requestId, currentEntryToDecision(value))) unknown.push(requestId);
+			}
+			if (unknown.length > 0) throw new Error(`manifest entries are no longer pending: ${unknown.join(", ")}`);
+			return { revision: 0 };
+		},
+		watchCurrent: (_params, _ctx, stream) => new Promise((resolve) => {
+			stream.signal.addEventListener("abort", () => resolve({}), { once: true });
+		})
+	}, { serviceId: options.serviceId });
+}
+function currentEntryToDecision(value) {
+	if (value.status !== "granted") return value.reason !== void 0 ? {
+		grant: false,
+		reason: value.reason
+	} : { grant: false };
+	if (value.granted.kind === "discover") return {
+		grant: true,
+		capabilities: value.granted.capabilities,
+		resolvedSlot: {
+			serviceId: value.granted.serviceId,
+			satisfiedInterfaces: value.granted.satisfiedInterfaces
+		}
+	};
+	return {
+		grant: true,
+		capabilities: value.granted.capabilities
+	};
+}
+/**
+* Yield `[entryId, currentEntry]` pairs a `setCurrent` patch targets. Supports
+* whole-document (`''` → `{ current: {...} }`), the `current` map
+* (`/current` → `{...}`), and a single entry (`/current/<id>`).
+*/
+function* currentEntriesOfPatch(path, value) {
+	const segments = path === "" ? [] : path.split("/").slice(1).map(unescapePointer);
+	if (segments.length === 0) {
+		const current = value.current ?? {};
+		yield* Object.entries(current);
+		return;
+	}
+	if (segments[0] !== "current") return;
+	if (segments.length === 1) {
+		yield* Object.entries(value ?? {});
+		return;
+	}
+	if (segments.length === 2) yield [segments[1], value];
+}
+function unescapePointer(segment) {
+	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+//#endregion
+//#region src/engine/approveClient.ts
+/**
+* Authoritative, typed frontend for a `hubAccessManifest`.
+*
+* Consumers render {@link requests}; coarse watch ticks are reconciled through
+* one serialized full-snapshot loop, so older reads cannot overwrite newer
+* state. A completed watch is re-opened and a failed read keeps the last known
+* snapshot while {@link state} reports `stale`.
+*/
+var ApproveClient = class {
+	_requests;
+	requests;
+	_state;
+	state;
+	_manifest;
+	_ownPrincipalId;
+	_log;
+	_reconnectDelayMs;
+	_timeoutMs;
+	_watch;
+	_watchGeneration = 0;
+	_retryTimer;
+	_refreshPending = false;
+	_refreshPromise;
+	_disposed = false;
+	constructor(options) {
+		this._manifest = options.manifest;
+		this._ownPrincipalId = options.ownPrincipalId;
+		this._log = options.log ?? (() => {});
+		this._reconnectDelayMs = options.reconnectDelayMs ?? 250;
+		this._timeoutMs = options.timeoutMs ?? DEFAULT_RPC_TIMEOUT_MS;
+		this._requests = observableValue(this, []);
+		this.requests = this._requests;
+		this._state = observableValue(this, "connecting");
+		this.state = this._state;
+		this._openWatch();
+		this.refresh();
+	}
+	/** Reconcile the observable with the latest complete desired snapshot. */
+	refresh() {
+		if (this._disposed) return Promise.resolve();
+		this._refreshPending = true;
+		if (!this._refreshPromise) this._refreshPromise = this._drainRefreshes().finally(() => {
+			this._refreshPromise = void 0;
+		});
+		return this._refreshPromise.then(() => {
+			if (this._refreshPending && !this._disposed) return this.refresh();
+		});
+	}
+	/**
+	* Write a decision only for a request in the current snapshot, then reconcile
+	* with the next authoritative snapshot. A successful write can still leave a
+	* matching id pending when a federated snapshot lags or the consumer retries;
+	* callers receive `still-pending` so they can report that state honestly.
+	*/
+	async decide(id, decision) {
+		if (!this._requests.get().some((request) => request.id === id)) return "gone";
+		await withRpcTimeout(this._manifest.setCurrent({ patches: [{
+			op: "set",
+			path: `/current/${escapePointer(id)}`,
+			value: decision
+		}] }), "hubAccessManifest::setCurrent", this._timeoutMs);
+		await this.refresh();
+		if (this._requests.get().some((request) => request.id === id)) {
+			this._log(`hubAccess approver: decision accepted for '${safeId(id)}', but a matching request is still pending`);
+			return "still-pending";
+		}
+		return "applied";
+	}
+	dispose() {
+		if (this._disposed) return;
+		this._disposed = true;
+		this._watchGeneration++;
+		if (this._retryTimer !== void 0) {
+			clearTimeout(this._retryTimer);
+			this._retryTimer = void 0;
+		}
+		const watch = this._watch;
+		this._watch = void 0;
+		if (watch) watch.cancel("approve client disposed").catch(() => {});
+	}
+	async _drainRefreshes() {
+		while (this._refreshPending && !this._disposed) {
+			this._refreshPending = false;
+			try {
+				const snapshot = await withRpcTimeout(this._manifest.getDesired({}), "hubAccessManifest::getDesired", this._timeoutMs);
+				if (this._disposed) return;
+				const requests = Object.entries(snapshot.requested).filter(([, request]) => rootAccepted(request.acceptableRootIds, this._ownPrincipalId)).map(([id, request]) => ({
+					id,
+					request,
+					revision: snapshot.revision
+				}));
+				this._requests.set(requests, void 0);
+				this._state.set("live", void 0);
+			} catch (error) {
+				if (this._disposed) return;
+				this._state.set("stale", void 0);
+				this._log(`hubAccess approver: getDesired failed: ${errorMessage(error)}`);
+				this._scheduleReconnect();
+			}
+		}
+	}
+	_openWatch() {
+		if (this._disposed || this._watch !== void 0) return;
+		const generation = ++this._watchGeneration;
+		try {
+			const watch = this._manifest.watchDesired({}, { onMessage: () => {
+				this.refresh();
+			} });
+			this._watch = watch;
+			watch.then(() => this._watchEnded(generation, void 0), (error) => this._watchEnded(generation, error));
+		} catch (error) {
+			this._log(`hubAccess approver: watchDesired failed: ${errorMessage(error)}`);
+			this._scheduleReconnect();
+		}
+	}
+	_watchEnded(generation, error) {
+		if (this._disposed || generation !== this._watchGeneration) return;
+		this._watch = void 0;
+		this._state.set("stale", void 0);
+		if (error !== void 0) this._log(`hubAccess approver: watchDesired ended: ${errorMessage(error)}`);
+		this._scheduleReconnect();
+	}
+	_scheduleReconnect() {
+		if (this._disposed || this._retryTimer !== void 0) return;
+		this._retryTimer = setTimeout(() => {
+			this._retryTimer = void 0;
+			this._openWatch();
+			this.refresh();
+		}, this._reconnectDelayMs);
+	}
+};
+function rootAccepted(acceptableRootIds, ownPrincipalId) {
+	if (acceptableRootIds === void 0) return true;
+	if (acceptableRootIds.length === 0 || ownPrincipalId === void 0) return false;
+	return acceptableRootIds.includes(ownPrincipalId);
+}
+function escapePointer(segment) {
+	return segment.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+function safeId(id) {
+	return id.replace(/\u0000/g, "\\0");
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+//#endregion
+//#region src/engine/manifestApprover.ts
+/**
+* Start consuming the manifest at `options.serviceId` over `options.connection`.
+* Runs until {@link ManifestApprover.dispose}.
+*/
+function runManifestApprover(options) {
+	const prompt = options.prompt ?? createTerminalConsentPrompt();
+	const rawLog = options.log ?? ((line) => process.stderr.write(line + "\n"));
+	const log = (line) => {
+		try {
+			rawLog(line);
+		} catch {}
+	};
+	const ownPrincipalId = options.ownPrincipalId ?? options.issuer.issuerPrincipalId;
+	/** entryIds currently being prompted, with their abort handle. */
+	const inFlight = /* @__PURE__ */ new Map();
+	let disposed = false;
+	let tail = Promise.resolve();
+	const client = new ApproveClient({
+		manifest: options.manifest,
+		ownPrincipalId,
+		log
+	});
+	/** Resolve an entry to permissions (+ chosen service for discover). */
+	const resolveEntry = async (entry) => {
+		if (entry.kind === "direct") return { permissions: entry.permissions };
+		if (options.fetchDirectory === void 0) return { denied: "no directory available to resolve discover candidates" };
+		const directory = await options.fetchDirectory();
+		const slot = {
+			interfaces: entry.interfaces.map((i) => ({
+				id: i.id,
+				required: i.required !== false,
+				...i.hash !== void 0 ? { hash: i.hash } : {}
+			})),
+			members: entry.members.map((m) => ({
+				interfaceId: m.interfaceId,
+				member: m.member,
+				required: m.required !== false
+			}))
+		};
+		const candidate = candidatesForSlot(slot, directory)[0];
+		if (!candidate) return { denied: "no candidate service satisfies the requested interfaces" };
+		const present = new Set(candidate.satisfiedInterfaces.map((i) => i.id));
+		return {
+			permissions: buildSlotPermissions(candidate.serviceId, slot.interfaces, slot.members, present),
+			resolvedSlot: {
+				serviceId: candidate.serviceId,
+				satisfiedInterfaces: candidate.satisfiedInterfaces.map((i) => i.id)
+			}
+		};
+	};
+	const mint = async (consumerPrincipalId, permissions, duration) => {
+		const signed = await toSignedPermissions(permissions, consumerPrincipalId, duration);
+		return options.issuer.mint({
+			audience: consumerPrincipalId,
+			permissions: signed,
+			expiresAtMs: durationToExp(duration)
+		});
+	};
+	const processEntry = (entryId, entry, ac) => async () => {
+		if (ac.signal.aborted) {
+			inFlight.delete(entryId);
+			return;
+		}
+		try {
+			const resolved = await resolveEntry(entry);
+			if ("denied" in resolved) {
+				await client.decide(entryId, {
+					status: "denied",
+					reason: resolved.denied
+				});
+				return;
+			}
+			if (ac.signal.aborted) return;
+			const decision = await prompt({
+				requestId: entryId,
+				kind: entry.kind === "discover" ? "request" : "requestAccess",
+				consumer: entry.consumer,
+				consumerPrincipalId: entry.consumer.principal,
+				permissions: resolved.permissions,
+				grants: describePermissions(resolved.permissions),
+				duration: entry.duration,
+				signal: ac.signal
+			});
+			if (ac.signal.aborted) return;
+			if (!decision.grant) {
+				await client.decide(entryId, decision.reason !== void 0 ? {
+					status: "denied",
+					reason: decision.reason
+				} : { status: "denied" });
+				return;
+			}
+			const capabilities = decision.capabilities !== void 0 && decision.capabilities.length > 0 ? [...decision.capabilities] : [await mint(entry.consumer.principal, resolved.permissions, entry.duration)];
+			const granted = resolved.resolvedSlot !== void 0 ? {
+				kind: "discover",
+				serviceId: resolved.resolvedSlot.serviceId,
+				satisfiedInterfaces: [...resolved.resolvedSlot.satisfiedInterfaces],
+				capabilities
+			} : {
+				kind: "direct",
+				capabilities
+			};
+			await client.decide(entryId, {
+				status: "granted",
+				granted
+			});
+		} catch (e) {
+			log(`hubAccess approver: failed to decide ${entryId}: ${e.message}`);
+		} finally {
+			inFlight.delete(entryId);
+		}
+	};
+	const subscription = autorun((reader) => {
+		const requests = client.requests.read(reader);
+		const present = new Set(requests.map((entry) => entry.id));
+		for (const [entryId, ac] of inFlight) if (!present.has(entryId)) ac.abort();
+		for (const { id: entryId, request: entry } of requests) {
+			if (inFlight.has(entryId)) continue;
+			const ac = new AbortController();
+			inFlight.set(entryId, ac);
+			tail = tail.then(processEntry(entryId, entry, ac));
+		}
+	});
+	return { dispose: () => {
+		if (disposed) return;
+		disposed = true;
+		for (const ac of inFlight.values()) ac.abort();
+		subscription.dispose();
+		client.dispose();
+	} };
+}
+//#endregion
+//#region src/engine/cmdEndpoint.ts
+/**
+* Short label for a transport, used to prefix its console log lines.
+* Preference order: an explicit name (the `namedEndpoints` key) → the command
+* basename (`cmd` / `argv[0]`) → the URI host / socket basename → the kind.
+*/
+function endpointLabel(ep, nameKey) {
+	if (nameKey !== void 0 && nameKey.length > 0) return nameKey;
+	switch (ep.kind) {
+		case "cmd-env":
+		case "cmd-stdio": {
+			const first = ep.cmd ?? ep.argv?.[0];
+			if (first) return path.basename(first.split(/\s+/)[0] ?? first);
+			return ep.kind;
+		}
+		case "uri": return _hostish(ep.uri);
+		case "ws": return _hostish(ep.url);
+		case "socket": return path.basename(ep.path) || "socket";
+	}
+}
+function endpointCommand(ep) {
+	if (ep.argv !== void 0 && ep.argv.length > 0) return { argv: ep.argv };
+	if (ep.cmd !== void 0) return { command: ep.cmd };
+	throw new Error("cmd endpoint requires either `cmd` or `argv`");
+}
+function killChild(child) {
+	if (!child.killed) child.kill();
+}
+function _hostish(uri) {
+	try {
+		return new URL(uri).host || uri;
+	} catch {
+		return uri;
+	}
+}
+/**
+* Pipe a child's stdout/stderr to `log`, one prefixed line at a time. Pass
+* `includeStdout: false` for `cmd-stdio`, whose stdout carries the RPC stream
+* (only stderr is human output there).
+*/
+function pipeChildLogs(child, label, log, opts) {
+	const emit = (chunk) => {
+		for (const line of chunk.split(/\r?\n/)) if (line.length > 0) log(`[${label}] ${line}`);
+	};
+	if (opts.includeStdout && child.stdout) {
+		child.stdout.setEncoding("utf8");
+		child.stdout.on("data", emit);
+	}
+	if (child.stderr) {
+		child.stderr.setEncoding("utf8");
+		child.stderr.on("data", emit);
+	}
+}
+/**
+* Forward this process's stdin to a child's stdin (for `--cmd-interactive`).
+* Returns a teardown that detaches the listener and restores the tty.
+*/
+function forwardStdin(child) {
+	const stdin = process.stdin;
+	if (!child.stdin) return () => {};
+	const onData = (chunk) => {
+		child.stdin?.write(chunk);
+	};
+	stdin.resume();
+	stdin.on("data", onData);
+	return () => {
+		stdin.off("data", onData);
+		stdin.pause();
+	};
+}
+//#endregion
+//#region src/engine/routeTable.ts
+/**
+* Static overlap guard for {@link module:./runHub}. The hub's forwarding table
+* silently overwrites a duplicate prefix; this catches a misconfigured hub at
+* startup instead — two transports claiming the same service id, or two
+* default routes — with a message naming both owners.
+*
+* Only *statically configured* routes are tracked here. Service ids that peers
+* claim dynamically through a listener are authorized by the hub's claim
+* policy, not this table.
+*/
+var RouteTable = class {
+	_claimed = /* @__PURE__ */ new Map();
+	_defaultOwner;
+	/** Record that `owner` routes `serviceId`. Throws on a conflicting claim. */
+	claim(serviceId, owner) {
+		const existing = this._claimed.get(serviceId);
+		if (existing !== void 0 && existing !== owner) throw new Error(`route conflict: service id '${serviceId}' is claimed by both '${existing}' and '${owner}'`);
+		this._claimed.set(serviceId, owner);
+	}
+	/** Record `owner` as the single default route. Throws on a second one. */
+	setDefault(owner) {
+		if (this._defaultOwner !== void 0 && this._defaultOwner !== owner) throw new Error(`default-route conflict: both '${this._defaultOwner}' and '${owner}' set defaultRoute; at most one is allowed`);
+		this._defaultOwner = owner;
+	}
+};
+//#endregion
+//#region src/engine/configuredParticipants.ts
+const REGISTER_METHOD = `${hubGrantedServiceIdInterface.info.id}::register`;
+const INITIAL_BACKOFF_MS = 200;
+const MAX_BACKOFF_MS = 5e3;
+/**
+* Attach settings/config-defined outbound participants to an existing Hub.
+*
+* Each participant is supervised independently: it connects in the background,
+* claims its configured service ids on the far end, installs its local routes,
+* and reconnects with exponential backoff after a disconnect.
+*/
+function configureParticipants(options) {
+	const log = options.log ?? ((line) => process.stderr.write(line + "\n"));
+	const disposers = [];
+	const interactiveCommands = options.participants.filter((participant) => participant.config.kind === "cmd-stdio").length;
+	if (options.cmdInteractive && interactiveCommands !== 1) throw new Error(`cmdInteractive requires exactly one cmd-stdio participant, found ${interactiveCommands}`);
+	validateConfiguredParticipants(options.participants);
+	for (const participant of options.participants) disposers.push(_startParticipant(participant, options.attachParticipant, log, options.cmdInteractive === true));
+	let disposed = false;
+	return { dispose: () => {
+		if (disposed) return;
+		disposed = true;
+		for (const dispose of disposers.reverse()) dispose();
+	} };
+}
+function validateConfiguredParticipants(participants) {
+	const routes = new RouteTable();
+	for (const participant of participants) _validateParticipant(participant, routes);
+}
+function _validateParticipant(participant, routes) {
+	const { config, name } = participant;
+	if (config.connectionTokenBinder !== void 0) throw new Error(`participant '${name}': connectionTokenBinder is only supported on cmd-env endpoints`);
+	for (const serviceId of config.routeServiceIds) routes.claim(serviceId, name);
+	if (config.defaultRoute) routes.setDefault(name);
+}
+function _startParticipant(participant, attachParticipant, log, interactive) {
+	const { config, name } = participant;
+	const abort = new AbortController();
+	let current;
+	let connectingAttachment;
+	let stopped = false;
+	const dispose = () => {
+		if (stopped) return;
+		stopped = true;
+		abort.abort();
+		connectingAttachment?.dispose();
+		connectingAttachment = void 0;
+		current?.attachment.dispose();
+		current?.transport.dispose();
+		current = void 0;
+	};
+	(async () => {
+		let backoff = INITIAL_BACKOFF_MS;
+		let delayBeforeAttempt = 0;
+		let hasConnected = false;
+		while (!stopped) {
+			if (delayBeforeAttempt > 0 && !await _delayUnlessAborted(delayBeforeAttempt, abort.signal)) return;
+			try {
+				const connected = await _connectParticipant(participant, attachParticipant, log, interactive, abort.signal, (attachment) => {
+					connectingAttachment = attachment;
+				});
+				if (stopped) {
+					connected.attachment.dispose();
+					connected.transport.dispose();
+					return;
+				}
+				connectingAttachment = void 0;
+				current = connected;
+				log(`[${name}] ${hasConnected ? "reconnected" : "connected"}`);
+				hasConnected = true;
+				backoff = INITIAL_BACKOFF_MS;
+				await connected.closed;
+				connected.attachment.dispose();
+				connected.transport.dispose();
+				if (current === connected) current = void 0;
+				if (stopped) return;
+				delayBeforeAttempt = backoff;
+				log(`[${name}] disconnected; reconnecting in ${delayBeforeAttempt} ms`);
+			} catch (error) {
+				connectingAttachment = void 0;
+				if (stopped) return;
+				delayBeforeAttempt = backoff;
+				log(`[${name}] connection failed: ${_errorMessage(error)}; retrying in ${delayBeforeAttempt} ms`);
+				backoff = Math.min(MAX_BACKOFF_MS, backoff * 2);
+			}
+		}
+	})().catch((error) => {
+		if (!stopped) log(`[${name}] reconnect loop failed: ${_errorMessage(error)}`);
+	});
+	return dispose;
+}
+async function _connectParticipant(participant, attachParticipant, log, interactive, signal, onAttached) {
+	const { config, name } = participant;
+	const opened = await _openParticipant(config, name, log, interactive);
+	if (signal.aborted) {
+		opened.transport.dispose();
+		throw new Error(`participant '${name}' stopped`);
+	}
+	const onAbort = () => opened.transport.dispose();
+	signal.addEventListener("abort", onAbort, { once: true });
+	let attachment;
+	try {
+		attachment = attachParticipant(opened.transport);
+		onAttached(attachment);
+		for (const serviceId of config.claimServiceIds) await _registerOnRemote(attachment, serviceId);
+		for (const serviceId of config.routeServiceIds) attachment.claimPrefix(serviceId);
+		if (config.defaultRoute) attachment.setDefaultRoute();
+		return {
+			...opened,
+			attachment
+		};
+	} catch (error) {
+		attachment?.dispose();
+		opened.transport.dispose();
+		throw new Error(`participant '${name}' registration failed: ${_errorMessage(error)}`, { cause: error });
+	} finally {
+		onAttached(void 0);
+		signal.removeEventListener("abort", onAbort);
+	}
+}
+async function _openParticipant(config, name, log, interactive) {
+	switch (config.kind) {
+		case "ws": return _openWsTransport(config.url, config.token);
+		case "socket": return _openSocketTransport(config.path, config.token);
+		case "uri": {
+			const resolved = parseEndpointUri(config.uri);
+			if (resolved.kind === "ws") return _openWsTransport(resolved.url, config.token ?? resolved.token);
+			if (resolved.kind === "socket") return _openSocketTransport(resolved.path, config.token ?? resolved.token);
+			throw new Error(`participant '${name}': uri resolves to '${resolved.kind}'; use kind 'cmd-stdio' instead`);
+		}
+		case "cmd-stdio": {
+			const closeSignal = _closeSignal();
+			const child = spawnCommand(endpointCommand(config), {
+				stdio: [
+					"pipe",
+					"pipe",
+					"pipe"
+				],
+				env: {
+					...process.env,
+					...config.env
+				},
+				...config.cwd !== void 0 ? { cwd: config.cwd } : {}
+			});
+			child.once("error", closeSignal.close);
+			child.once("exit", closeSignal.close);
+			if (!child.stdin || !child.stdout) {
+				killChild(child);
+				throw new Error(`participant '${name}': child exposes no stdio`);
+			}
+			pipeChildLogs(child, name, log, { includeStdout: false });
+			const stopForwarding = interactive ? forwardStdin(child) : () => {};
+			const { transport } = await connectNdjson({
+				input: child.stdout,
+				output: child.stdin,
+				onClose: () => {
+					stopForwarding();
+					killChild(child);
+					closeSignal.close();
+				}
+			});
+			return {
+				transport,
+				closed: closeSignal.closed
+			};
+		}
+	}
+}
+async function _openSocketTransport(socketPath, token) {
+	const socket = net.createConnection(socketPath);
+	const closeSignal = _closeSignal();
+	socket.on("error", () => {
+		socket.destroy();
+		closeSignal.close();
+	});
+	try {
+		await new Promise((resolve, reject) => {
+			const onError = (error) => reject(error);
+			socket.once("error", onError);
+			socket.once("connect", () => {
+				socket.off("error", onError);
+				resolve();
+			});
+		});
+	} catch (error) {
+		socket.destroy();
+		throw new Error(`connect '${socketPath}' failed: ${_errorMessage(error)}`, { cause: error });
+	}
+	const { transport } = await connectNdjson({
+		input: socket,
+		output: socket,
+		onClose: () => {
+			socket.destroy();
+			closeSignal.close();
+		},
+		initialize: {
+			kind: "client",
+			token: token ?? ""
+		}
+	});
+	return {
+		transport,
+		closed: closeSignal.closed
+	};
+}
+async function _openWsTransport(url, token) {
+	const ws = await openWebSocket(url);
+	const closeSignal = _closeSignal();
+	const transport = new WebSocketTransport(ws, () => {
+		try {
+			ws.close();
+		} catch {}
+		closeSignal.close();
+	});
+	try {
+		await runInitializeHandshake(transport, {
+			kind: "client",
+			token: token ?? ""
+		});
+	} catch (error) {
+		transport.dispose();
+		throw error;
+	}
+	return {
+		transport,
+		closed: closeSignal.closed
+	};
+}
+function _registerOnRemote(attachment, prefix, timeoutMs = 1e4) {
+	return attachment.request(REGISTER_METHOD, { serviceId: prefix }, timeoutMs);
+}
+function _closeSignal() {
+	let close;
+	return {
+		closed: new Promise((resolve) => {
+			let didClose = false;
+			close = () => {
+				if (didClose) return;
+				didClose = true;
+				resolve();
+			};
+		}),
+		close
+	};
+}
+function _delayUnlessAborted(ms, signal) {
+	if (signal.aborted) return Promise.resolve(false);
+	return new Promise((resolve) => {
+		const timer = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve(true);
+		}, ms);
+		const onAbort = () => {
+			clearTimeout(timer);
+			resolve(false);
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+function _errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+//#endregion
+//#region src/engine/runHub.ts
+/**
+* The hub engine: turn one {@link HubConfig} into a running {@link Hub} with all
+* its listeners and endpoints wired up. `serve`, `connect`, and `tunnel` are
+* thin config synthesizers over this; the client commands run it in-process
+* (via the private control socket) when given `-c, --config`.
+*
+* Wiring rules, per transport:
+* - **listener** → a {@link SocketServer}/{@link WebSocketServer} fronted by a
+*   {@link HubConnectionAcceptor}; peers claim their own service ids.
+* - **endpoint** (`ws`/`socket`/`cmd-stdio`/`uri`) → a far end we dial: open the
+*   raw transport, claim our `claimServiceIds` through its connection-granted
+*   namespace, `hub.attach` it for inbound routing, `claimPrefix` its
+*   `routeServiceIds`, and `setUplink` it when it is the `defaultRoute`. Lost
+*   far-end links reconnect and repeat that registration before routing resumes.
+* - **endpoint** (`cmd-env`) → a child spawned against a private hub socket; it
+*   joins this hub as a participant and claims its own prefix.
+*/
+/** Where persistent managed identities for `managedIdentity` slots are stored. */
+const PROVISION_SUBDIR = "provisioned-identities";
+/** Build + start a hub from a config. Resolves once all transports are wired. */
+async function runHub(opts) {
+	const log = opts.log ?? ((line) => process.stderr.write(line + "\n"));
+	const config = opts.config;
+	const flowLogger = opts.logMessages ? createFlowLogger({ log }) : void 0;
+	const hub = flowLogger ? new Hub({ onTransit: flowLogger.onTransit }) : new Hub();
+	const routes = new RouteTable();
+	const disposers = [];
+	const listeners = [];
+	const tokenStore = new TokenIdentityStore();
+	const identities = new IdentityProvisioner();
+	const forwardChecking = await _setupForwardChecking(hub, config, log, disposers, tokenStore);
+	if (flowLogger) disposers.push(() => flowLogger.dispose());
+	const cmdEndpointCount = config.endpoints.filter((e) => e.kind === "cmd-env" || e.kind === "cmd-stdio").length + Object.values(config.namedEndpoints).filter((e) => e.kind === "cmd-env" || e.kind === "cmd-stdio").length;
+	if (opts.cmdInteractive && cmdEndpointCount > 1) throw new Error(`--cmd-interactive requires exactly one cmd endpoint, found ${cmdEndpointCount}`);
+	const interactive = opts.cmdInteractive === true && cmdEndpointCount === 1;
+	const dispose = () => {
+		for (const d of disposers.reverse()) try {
+			d();
+		} catch {}
+	};
+	try {
+		const controlEndpoint = await _startControlSocket(hub, disposers);
+		for (const listener of config.listeners) {
+			const info = await _wireListener(hub, listener, forwardChecking, config.hubServiceId, disposers, log, tokenStore, identities);
+			listeners.push(info);
+		}
+		const planned = [...config.endpoints.map((ep) => ({
+			label: endpointLabel(ep),
+			ep
+		})), ...Object.entries(config.namedEndpoints).map(([label, ep]) => ({
+			label: endpointLabel(ep, label),
+			ep
+		}))];
+		for (const { label, ep } of planned) {
+			for (const serviceId of ep.routeServiceIds) routes.claim(serviceId, label);
+			if (ep.defaultRoute) routes.setDefault(label);
+		}
+		const connectorParticipants = planned.filter((entry) => entry.ep.kind !== "cmd-env").map(({ label, ep }) => ({
+			name: label,
+			config: ep
+		}));
+		const configuredParticipants = configureParticipants({
+			participants: connectorParticipants,
+			attachParticipant: (transport) => {
+				const link = hub.attach(transport);
+				return {
+					claimPrefix: (prefix) => link.addPrefixRoute(prefix),
+					setDefaultRoute: () => hub.setUplink(transport),
+					request: (method, params, timeoutMs) => link.request(method, params, timeoutMs),
+					dispose: () => link.dispose()
+				};
+			},
+			log,
+			cmdInteractive: interactive && connectorParticipants.some((entry) => entry.config.kind === "cmd-stdio")
+		});
+		disposers.push(() => configuredParticipants.dispose());
+		for (const { label, ep } of planned) {
+			if (ep.kind !== "cmd-env") continue;
+			await _wireCmdEnvEndpoint(hub, label, ep, log, interactive, forwardChecking, config.hubServiceId, tokenStore, identities, disposers);
+		}
+		return {
+			hub,
+			listeners,
+			controlEndpoint,
+			dispose
+		};
+	} catch (e) {
+		dispose();
+		throw e;
+	}
+}
+/**
+* Install the hub's global services and, when {@link HubConfig.forwardChecking}
+* is enabled, the `hubAccess` consent front door + the hub-served
+* `hubAccessManifest`.
+*
+* The hub itself is **keyless park-and-relay**: a `hubAccess` request is parked
+* as a desired manifest entry and blocks; an *approver* decides it by relaying a
+* signed capability via `setCurrent`. Approvers are manifest **clients** (over a
+* connection), never special cases inside the hub:
+*
+*  - The built-in **terminal approver** ({@link runManifestApprover}) is started
+*    when stdin is a TTY and {@link HubConfig.consentApprover} is not `false`.
+*    It mints with the hub's persistent admin identity (loaded only then) and
+*    consents on stdin. It reaches the manifest over the in-process services
+*    connection — the same path a remote approver would use.
+*  - A non-interactive hub is **keyless**: it loads no key, and grants come
+*    solely from external approvers (configured `rootPrincipalIds`) deciding via
+*    the manifest with their own self-signed capabilities.
+*
+* Returns the acceptor flags to apply to every inbound listener, or `undefined`
+* for an open (unchecked) hub.
+*/
+async function _setupForwardChecking(hub, config, log, disposers, tokenStore) {
+	const fc = config.forwardChecking;
+	const verifySignatures = fc === true ? true : fc === false ? false : fc.verifySignatures;
+	const requireCapability = fc === true ? true : fc === false ? false : fc.requireCapability;
+	if (!verifySignatures && !requireCapability) {
+		_registerCentralConnectionTokenBinder(createHubServiceInterfaces(hub, { hubServiceId: config.hubServiceId }), config, tokenStore, log);
+		return;
+	}
+	const interactive = process.stdin.isTTY === true;
+	const approverEnabled = requireCapability && interactive && config.consentApprover !== false;
+	let admin;
+	let adminId;
+	if (approverEnabled) {
+		const persisted = await loadOrCreateIdentity({
+			id: config.adminIdentitySlot,
+			storeDir: _provisionDir()
+		});
+		admin = KeypairSigningIdentity.fromKeypair(persisted.keypair);
+		adminId = admin.publicSigningIdentity.principal;
+	}
+	const services = createHubServiceInterfaces(hub, { hubServiceId: config.hubServiceId });
+	_registerCentralConnectionTokenBinder(services, config, tokenStore, log);
+	const adminIds = [...adminId !== void 0 ? [adminId] : [], ...config.rootPrincipalIds];
+	let installHubAccess;
+	if (requireCapability) {
+		const manifest = new HubAccessManifestHost({
+			acceptableRootIds: adminIds,
+			log
+		});
+		registerHubAccessManifest(services.connection, manifest, { serviceId: services.hubServiceId });
+		installHubAccess = (root) => manifest.registerHubAccessAtRoot(root);
+		if (approverEnabled && admin !== void 0) {
+			const approverServiceId = config.consentApprover === true ? services.hubServiceId : config.consentApprover.serviceId;
+			const approver = runManifestApprover({
+				manifest: services.connection.service(approverServiceId).get(hubAccessManifestInterface),
+				fetchDirectory: () => fetchFullDirectory(services.connection, approverServiceId),
+				issuer: new CapabilityProposalIssuer(admin),
+				ownPrincipalId: adminId,
+				log
+			});
+			disposers.push(() => approver.dispose());
+		}
+	}
+	if (requireCapability && adminIds.length === 0) log("WARNING: requireCapability is on but this hub has no accepted roots (no local approver — non-interactive or consentApprover:false — and no rootPrincipalIds configured). No capability can be issued or accepted — every access request will hang in the manifest with no one able to approve it. Configure rootPrincipalIds or enable the approver.");
+	log(`forward checking on (verifySignatures=${verifySignatures}, requireCapability=${requireCapability}, admin=${adminId ?? "(keyless)"}${config.rootPrincipalIds.length > 0 ? `, extraRoots=[${config.rootPrincipalIds.join(", ")}]` : ""})`);
+	return {
+		verifyForwardedCalls: verifySignatures,
+		requireForwardedCapability: requireCapability,
+		adminIds,
+		hubServiceId: services.hubServiceId,
+		...installHubAccess !== void 0 ? { installHubAccess } : {}
+	};
+}
+/**
+* Offer the connection-token binder as a **routable hub service** under
+* `${hubServiceId}::connectionTokenBinder`, in addition to the per-endpoint
+* root form each `cmd-env` binder installs on its own overlay root.
+*
+* The mint policy is the union of every configured `cmd-env` binder's prefixes:
+* a call may bind an `identitySlot` under any configured `identitySlotPrefix`
+* and a `serviceIdNamespace` under any configured `serviceIdPrefix`. Skipped
+* entirely when no endpoint configures a binder.
+*
+* Forwarded calls to this serviceId go through the hub's forwarded-call gate, so
+* on a checked hub a capability is required. On an **open** hub (no gate) it is
+* reachable unauthenticated — consistent with an open hub's trust-all posture,
+* but note that this is a privileged minter.
+*/
+function _registerCentralConnectionTokenBinder(services, config, tokenStore, log) {
+	const binders = [...config.endpoints, ...Object.values(config.namedEndpoints)].filter((ep) => ep.kind === "cmd-env" && ep.connectionTokenBinder !== void 0).map((ep) => ep.connectionTokenBinder);
+	if (binders.length === 0) return;
+	const identitySlotPrefixes = binders.map((b) => b.identitySlotPrefix).filter((p) => p !== void 0);
+	const serviceIdPrefixes = binders.map((b) => b.serviceIdPrefix).filter((p) => p !== void 0);
+	registerConnectionTokenBinderService(services.connection, {
+		store: tokenStore,
+		identitySlotPrefixes,
+		serviceIdPrefixes,
+		serviceId: services.hubServiceId
+	});
+	log(`connectionTokenBinder served on ${services.hubServiceId}::connectionTokenBinder`);
+}
+async function _startControlSocket(hub, disposers) {
+	const socketPath = SocketServer.allocSocketPath();
+	const token = randomBytes(16).toString("hex");
+	const server = await SocketServer.start({ endpoint: socketPath });
+	const acceptor = new HubConnectionAcceptor({
+		server,
+		hub,
+		handlers: [anonymousHandler({})]
+	});
+	disposers.push(() => {
+		acceptor.dispose();
+		server.dispose();
+		_unlinkSocket(socketPath);
+	});
+	return {
+		path: socketPath,
+		token
+	};
+}
+/**
+* Build the forward-checking gate options spread into a {@link
+* HubConnectionAcceptor}. Shared by inbound listeners and spawned `cmd-env`
+* children, so a child participant's forwarded calls are gated identically to
+* an external peer's (otherwise capability enforcement would silently apply
+* only to listeners, leaving spawned services ungated).
+*/
+function _buildGate(forwardChecking, hubServiceId) {
+	const forwardPolicy = !forwardChecking || !forwardChecking.verifyForwardedCalls ? { verifyForwardedCalls: false } : forwardChecking.requireForwardedCapability ? {
+		verifyForwardedCalls: true,
+		requireForwardedCapability: true,
+		adminIds: forwardChecking.adminIds
+	} : {
+		verifyForwardedCalls: true,
+		adminIds: forwardChecking.adminIds
+	};
+	return forwardChecking ? {
+		...forwardPolicy,
+		hubServiceId: forwardChecking.hubServiceId,
+		...forwardChecking.installHubAccess !== void 0 ? { installHubAccess: forwardChecking.installHubAccess } : {}
+	} : {
+		...forwardPolicy,
+		hubServiceId
+	};
+}
+async function _wireListener(hub, listener, forwardChecking, hubServiceId, disposers, log, tokenStore, identities) {
+	const gate = _buildGate(forwardChecking, hubServiceId);
+	const handlers = _buildHandlers(listener.handlers, tokenStore, identities);
+	const isTokenAccepted = (token) => Promise.resolve(resolveConnectionHandler(handlers, token) !== void 0);
+	if (listener.type === "websocket") {
+		const server = await WebSocketServer.start({
+			host: listener.host,
+			port: listener.port,
+			path: listener.path,
+			isTokenAccepted,
+			allowedOrigins: listener.allowedOrigins,
+			maxPayload: listener.maxPayload,
+			requestListener: listener.healthPath ? _healthHandler(listener.healthPath) : void 0
+		});
+		const acceptor = new HubConnectionAcceptor({
+			server,
+			hub,
+			...gate,
+			handlers
+		});
+		disposers.push(() => {
+			acceptor.dispose();
+			server.dispose();
+		});
+		const address = `ws://${listener.host}:${server.port}${listener.path}`;
+		log(`listening (websocket) on ${address}`);
+		return {
+			type: "websocket",
+			address
+		};
+	}
+	const server = await SocketServer.start({
+		endpoint: listener.path,
+		isTokenAccepted
+	});
+	const acceptor = new HubConnectionAcceptor({
+		server,
+		hub,
+		...gate,
+		handlers
+	});
+	disposers.push(() => {
+		acceptor.dispose();
+		server.dispose();
+		_unlinkSocket(listener.path);
+	});
+	log(`listening (socket) on ${listener.path}`);
+	return {
+		type: "socket",
+		address: listener.path
+	};
+}
+/**
+* Map a config {@link ProvisionConfig} to a resolved {@link RootProvision}:
+* turn `managedIdentity.slot` into a lazy resolver, `grantedServiceId` into a
+* namespace, and `connectionTokenBinder` into registrar options.
+*/
+function _provisionFromConfig(provision, tokenStore, identities) {
+	return {
+		...provision.grantedServiceId !== void 0 ? { grantedServiceIdNamespace: provision.grantedServiceId } : {},
+		...provision.managedIdentity !== void 0 ? identities.slotFor(provision.managedIdentity.slot) : {},
+		...provision.connectionTokenBinder !== void 0 ? { connectionTokenBinder: _binderOptions(provision.connectionTokenBinder, tokenStore) } : {}
+	};
+}
+/** Build the acceptor's ordered handler factories from a listener's config. */
+function _buildHandlers(configs, tokenStore, identities) {
+	return configs.map((h) => {
+		switch (h.token) {
+			case "anonymous": return anonymousHandler(_provisionFromConfig(h, tokenStore, identities));
+			case "static": return staticTokenHandler(h.value, _provisionFromConfig(h, tokenStore, identities));
+			case "bound": return boundTokenHandler(tokenStore, (slot) => identities.slotFor(slot));
+		}
+	});
+}
+/**
+* Loads and caches persistent managed identities by slot, backed by a single
+* SQLite keystore. One per hub; shared between config handlers, bound-token
+* redemption, and cmd-env endpoints so a slot resolves to the same identity and
+* per-identity storage everywhere.
+*
+* Runs in the keystore's **unencrypted mode**. Identities created by a previous
+* (file-per-slot plaintext) build are migrated lazily on first resolve, keeping
+* the same principal — see {@link _migrateLegacy}.
+*/
+var IdentityProvisioner = class {
+	_dir = _provisionDir();
+	_keystore;
+	/**
+	* A lazily-resolved managed identity plus its per-identity storage for
+	* `slot`. Spread directly into a {@link RootProvision}.
+	*/
+	slotFor(slot) {
+		const s = this._keystoreFor().slotById(slot);
+		return {
+			resolveIdentity: () => this._resolve(slot, s),
+			storage: s.storage
+		};
+	}
+	/**
+	* Open the keystore on first use — creating the provision dir first, since
+	* `DatabaseSync` cannot create its file in a missing directory. Keyless hubs
+	* (no managed identity) therefore never touch disk.
+	*/
+	_keystoreFor() {
+		if (this._keystore === void 0) {
+			fs.mkdirSync(this._dir, { recursive: true });
+			this._keystore = createSqliteIdentityKeystore({ dbPath: path.join(this._dir, "keystore.db") });
+		}
+		return this._keystore;
+	}
+	async _resolve(slot, s) {
+		const existing = await s.peekIdentity();
+		if (existing) return existing;
+		const migrated = await this._migrateLegacy(slot, s);
+		if (migrated) return migrated;
+		return s.getOrCreateIdentity();
+	}
+	/**
+	* Import a pre-SQLite plaintext identity file for `slot` (if one exists)
+	* into the keystore, preserving its Ed25519 keypair — and therefore its
+	* principal — then rename the file to `.migrated` as an idempotent backup.
+	* Returns the imported identity, or `undefined` when there is nothing to
+	* migrate.
+	*/
+	async _migrateLegacy(slot, s) {
+		const file = path.join(this._dir, `${_legacySlotName(slot)}.json`);
+		try {
+			await fs.promises.access(file);
+		} catch {
+			return;
+		}
+		const persisted = await loadOrCreateIdentity({
+			id: slot,
+			file
+		});
+		const identity = await s.importIdentity(persisted.keypair, persisted.wrapKeypair);
+		await fs.promises.rename(file, `${file}.migrated`).catch(() => {});
+		return identity;
+	}
+};
+/**
+* The legacy on-disk filename for a slot (`sha256(slot)` hex, first 16 bytes),
+* as written by the pre-SQLite `loadOrCreateIdentity` under {@link _provisionDir}.
+* Used only to locate files to migrate.
+*/
+function _legacySlotName(slot) {
+	return createHash("sha256").update(slot).digest("hex").slice(0, 32);
+}
+function _healthHandler(healthPath) {
+	return (req, res) => {
+		if (req.url === healthPath) {
+			res.writeHead(200, { "content-type": "text/plain" });
+			res.end("ok");
+			return;
+		}
+		res.writeHead(426, { "content-type": "text/plain" });
+		res.end("upgrade required");
+	};
+}
+async function _wireCmdEnvEndpoint(hub, label, ep, log, interactive, forwardChecking, hubServiceId, tokenStore, identities, disposers) {
+	if (ep.defaultRoute) throw new Error(`endpoint '${label}': defaultRoute is not supported on cmd-env endpoints`);
+	if (ep.claimServiceIds.length > 0) throw new Error(`endpoint '${label}': claimServiceIds is not supported on cmd-env endpoints`);
+	const namespace = ep.grantedServiceId ?? ep.routeServiceIds[0];
+	const socketPath = SocketServer.allocSocketPath();
+	const token = randomBytes(16).toString("hex");
+	const server = await SocketServer.start({ endpoint: socketPath });
+	const gate = _buildGate(forwardChecking, hubServiceId);
+	const provision = {
+		...namespace !== void 0 ? { grantedServiceIdNamespace: namespace } : {},
+		...ep.managedIdentity !== void 0 ? identities.slotFor(ep.managedIdentity.slot) : {},
+		...ep.connectionTokenBinder !== void 0 ? { connectionTokenBinder: _binderOptions(ep.connectionTokenBinder, tokenStore) } : {}
+	};
+	const acceptor = new HubConnectionAcceptor({
+		server,
+		hub,
+		...gate,
+		handlers: [anonymousHandler(provision)]
+	});
+	const child = spawnCommand(endpointCommand(ep), {
+		stdio: interactive ? [
+			"pipe",
+			"pipe",
+			"pipe"
+		] : [
+			"ignore",
+			"pipe",
+			"pipe"
+		],
+		env: {
+			...process.env,
+			...ep.env,
+			LINKRPC_ENDPOINT: socketPath,
+			LINKRPC_TOKEN: token
+		},
+		...ep.cwd !== void 0 ? { cwd: ep.cwd } : {}
+	});
+	pipeChildLogs(child, label, log, { includeStdout: true });
+	if (interactive) disposers.push(forwardStdin(child));
+	disposers.push(() => {
+		killChild(child);
+		acceptor.dispose();
+		server.dispose();
+		_unlinkSocket(socketPath);
+	});
+}
+/**
+* Build the root-form {@link RegisterConnectionTokenBinderOptions} for a
+* `cmd-env` endpoint's `connectionTokenBinder` config: each optional prefix
+* becomes a single-element allow-list (absent → empty → that axis disabled).
+*/
+function _binderOptions(binder, tokenStore) {
+	return {
+		store: tokenStore,
+		identitySlotPrefixes: binder.identitySlotPrefix !== void 0 ? [binder.identitySlotPrefix] : [],
+		serviceIdPrefixes: binder.serviceIdPrefix !== void 0 ? [binder.serviceIdPrefix] : []
+	};
+}
+function _unlinkSocket(socketPath) {
+	if (process.platform === "win32") return;
+	try {
+		fs.unlinkSync(socketPath);
+	} catch {}
+}
+function _provisionDir() {
+	const home = os.homedir();
+	let base;
+	if (process.platform === "win32") base = process.env.APPDATA ?? path.join(home, "AppData", "Roaming");
+	else if (process.platform === "darwin") base = path.join(home, "Library", "Application Support");
+	else base = process.env.XDG_CONFIG_HOME ?? path.join(home, ".config");
+	return path.join(base, "linkrpc", PROVISION_SUBDIR);
+}
+//#endregion
+export { ApproveClient as a, buildSlotPermissions as c, computeCallBindHash as d, createTerminalConsentPrompt as f, toSignedPermissions as h, runManifestApprover as i, createHubAccessConfig as l, raceConsent as m, configureParticipants as n, HubAccessManifestHost as o, describePermissions as p, validateConfiguredParticipants as r, registerHubAccessManifest as s, runHub as t, describeRequest as u };
+
+//# sourceMappingURL=runHub-P3YUwwdv.js.map