@hediet/linkrpc-hub 0.0.1

package/dist/index.d.ts

@@ -0,0 +1,512 @@
+import { _ as ProvisionConfig, a as ConsentApproverConfig, c as EndpointConfigSchema, d as HubConfig, f as HubConfigSchema, g as ParticipantConnectorConfigSchema, h as ParticipantConnectorConfig, i as ConnectionTokenBinderSchema, l as ForwardCheckingConfig, m as ListenerConfigSchema, n as ConnectionHandlerSchema, o as ConsentApproverSchema, p as ListenerConfig, r as ConnectionTokenBinderConfig, s as EndpointConfig, t as ConnectionHandlerConfig, u as ForwardCheckingSchema, v as hubConfigJsonSchema, y as parseHubConfig } from "./chunks/config-BCvkg7jv.js";
+import { n as printHubConfigSchema, t as loadHubConfig } from "./chunks/configFile-y6Phntqu.js";
+import { a as IdentityKeystore, c as IdentitySnooze, d as SlotByIdAndTimeResult, f as SlotId, l as SlotAccessKey, o as IdentityKeystoreOptions, p as createIdentityKeystore, s as IdentitySlot, u as SlotByIdAndKeyResult } from "./chunks/index-CLIUrV88.js";
+import { _ as formatFlowSummary, a as FlowSummary, c as TrafficFlowAggregator } from "./chunks/nodeTransit-cmtZgdpW.js";
+import { A as AccessCallIntent, F as AccessDirectPermission, I as AccessDuration, et as DirectoryEntry, j as AccessConsumer, q as CapabilityProposalIssuer, t as HubAccessConfig } from "./chunks/hubConnectionAcceptor-BwydvFa4.js";
+import { ListenerInfo, RunHubOptions, RunningHub, runHub } from "./engine/runHub.js";
+import { ServeHubOptions, serveHub } from "./serve.js";
+import { spawnCommand } from "./spawn.js";
+import { IMessageTransport, JsonValue, LinkRpcConnection, Pattern, Permission, PrincipalId, SignedCapability, SigningIdentity } from "@hediet/linkrpc";
+import { HubAccessManifestDecision, HubAccessManifestRequest, IHubAccessManifest } from "@hediet/linkrpc/hub/common";
+import { IObservable } from "@vscode/observables";
+//#region src/engine/consent.d.ts
+/**
+ * The outcome of a single consent prompt.
+ *
+ * - `{ grant: false }` — deny (optionally with a reason).
+ * - `{ grant: true, capabilities }` — approve. The approver minted the
+ *   capabilities itself (with its own accepted-root identity); the keyless
+ *   {@link HubAccessManifestHost} relays them verbatim. On a grant the
+ *   capabilities are **required** — the host has no signing identity of its
+ *   own.
+ */
+type ConsentDecision = {
+  readonly grant: false;
+  readonly reason?: string;
+} | {
+  readonly grant: true;
+  readonly capabilities?: readonly SignedCapability[];
+};
+/**
+ * Asks an approver to decide a single access request. Injected so different
+ * approvers (the terminal prompt, the hub-served manifest, tests) can supply the
+ * decision. May be aborted via {@link ConsentPromptRequest.signal} when another
+ * racing prompt settles first — implementations should stop waiting and clean up.
+ */
+type ConsentPrompt = (request: ConsentPromptRequest) => Promise<ConsentDecision>;
+interface ConsentPromptRequest {
+  /** Correlates the prompt with the blocked `hubAccess` call. */
+  readonly requestId: string;
+  /** Which `hubAccess` method is blocked on this request. */
+  readonly kind: 'request' | 'extend' | 'requestAccess';
+  /** Human-friendly description of who is asking. */
+  readonly consumer: {
+    readonly name: string;
+    readonly origin?: string;
+    readonly purpose?: string;
+  };
+  /** Verified PrincipalId of the calling consumer (the capability audience). */
+  readonly consumerPrincipalId: PrincipalId;
+  /**
+   * The exact authority requested. Each permission may carry the consent-only
+   * `callIntent` preview, so an approver can mint a byte-bound one-shot
+   * ("Allow once") capability.
+   */
+  readonly permissions: readonly AccessDirectPermission[];
+  /** One line per authority being requested (`serviceId::interfaceId member`). */
+  readonly grants: readonly string[];
+  /** `once` / `session` / `persistent`, when the consumer expressed one. */
+  readonly duration: string | undefined;
+  /** Aborts when another racing prompt has already settled this request. */
+  readonly signal: AbortSignal;
+}
+/** One human-readable line per permission, for an approver's UI / prompt. */
+declare function describePermissions(permissions: readonly Permission[]): string[];
+/**
+ * Strip the consent-only `callIntent` from each requested permission and, for a
+ * one-shot (`duration: 'once'`) grant whose intent declares a concrete call,
+ * pin the permission to that exact call via `callBind.payloadHash`. The result
+ * is the `Permission[]` to sign into the capability. Shared by the hub-issuer
+ * mint path and any inbox approver that wants to honor "Allow once".
+ *
+ * `callIntent` is never itself signed — only the derived `callBind` is.
+ */
+declare function toSignedPermissions(permissions: readonly AccessDirectPermission[], consumerPrincipalId: PrincipalId, duration: string | undefined): Promise<Permission[]>;
+/**
+ * Compute `callBind.payloadHash` for a grant bound to one consumer-declared
+ * call. Builds the SAME signed params the consumer commits to at sign time
+ * (`signedHash('call', { ...params, $hubrpc: meta })`); the forwarded-call gate
+ * re-derives this on the inbound call and checks the hash matches. The consumer
+ * owns `nonce`/`signedAtMs`, supplied via `callIntent`.
+ */
+declare function computeCallBindHash(intent: AccessCallIntent, consumerPrincipalId: PrincipalId): Promise<string>;
+/**
+ * A terminal yes/no consent prompt on stdin.
+ *
+ * When stdin is not a TTY (no operator to answer) it **abstains** — it never
+ * settles, parking until {@link ConsentPromptRequest.signal} aborts. This keeps
+ * it safe inside {@link raceConsent}: a non-interactive terminal must not win
+ * the race with an instant deny, or a hub-served inbox approval could never
+ * land. A headless hub should simply not install this prompt at all (or pair it
+ * with an inbox); on its own it grants nothing.
+ *
+ * When interactive, it resolves on the operator's answer, and abandons the
+ * readline prompt if the request is aborted (another prompt decided first).
+ */
+declare function createTerminalConsentPrompt(): ConsentPrompt;
+/**
+ * Compose several {@link ConsentPrompt}s into one that presents each request to
+ * **all** of them and takes the **first** to settle (first responder wins,
+ * including a deny). Once one settles, the rest are aborted via a shared signal
+ * so they can tear down (close the readline, drop the inbox entry). The
+ * incoming request's own signal is honored too: if the consumer cancels, every
+ * child prompt is aborted.
+ *
+ * This is what lets a single `hubAccess` request reach the hub operator's
+ * terminal prompt and a hub-served inbox at the same time.
+ */
+declare function raceConsent(prompts: readonly ConsentPrompt[]): ConsentPrompt;
+//#endregion
+//#region src/engine/hubAccessConfig.d.ts
+/** The normalized request every `hubAccess` shape collapses to before deciding. */
+interface AccessRequestContext {
+  readonly kind: 'request' | 'extend' | 'requestAccess';
+  readonly consumer: AccessConsumer;
+  /** Capability audience — the consumer's own PrincipalId. */
+  readonly consumerPrincipalId: string;
+  /** The requested authority; permissions may carry a consent-only `callIntent`. */
+  readonly permissions: readonly AccessDirectPermission[];
+  readonly duration: AccessDuration | undefined;
+}
+/** Decides one normalized request, returning the approver-signed capabilities to relay. */
+type AccessDecider = (ctx: AccessRequestContext) => Promise<ConsentDecision>;
+/**
+ * Build the `hubAccess` front-door config from a single {@link AccessDecider}.
+ * The returned {@link HubAccessConfig} is what `registerHubAccessService`
+ * installs at a participant's overlay root.
+ */
+declare function createHubAccessConfig(decide: AccessDecider, fetchDirectory?: () => Promise<readonly DirectoryEntry[]>): HubAccessConfig;
+/** A one-line human summary of a request, for a decider's log. */
+declare function describeRequest(ctx: AccessRequestContext): string;
+/** Build one permission per requested interface, scoped to `serviceId`. */
+declare function buildSlotPermissions(serviceId: string, interfaces: readonly {
+  id: string;
+  hash?: string;
+}[], members: readonly {
+  interfaceId: string;
+  member: Pattern;
+}[], present: ReadonlySet<string>): Permission[];
+//#endregion
+//#region src/engine/hubAccessGrantSigner.d.ts
+/** A grant policy's verdict on one request. */
+type GrantVerdict = {
+  readonly result: 'permitted';
+} | {
+  readonly result: 'rejected';
+  readonly reason?: string;
+};
+/** Decides whether to grant a normalized request. May be sync or async. */
+type GrantPolicy = (request: AccessRequestContext) => GrantVerdict | Promise<GrantVerdict>;
+declare class HubAccessGrantSigner {
+  private readonly _grant;
+  private readonly _issuer;
+  constructor(signingIdentity: SigningIdentity, _grant: GrantPolicy);
+  /**
+   * The {@link AccessDecider}: consult the grant policy and, on `permitted`,
+   * mint a capability with the held identity (audience = the consumer,
+   * honoring "Allow once" `callBind` byte-binding for one-shot durations).
+   */
+  readonly decide: AccessDecider;
+  private _mint;
+}
+//#endregion
+//#region src/engine/hubAccessManifest.d.ts
+/** One interface a discover slot's chosen service must implement. */
+interface ManifestInterfaceReq {
+  readonly id: string;
+  readonly hash?: string;
+  readonly required?: boolean;
+}
+/** One member a discover slot's consumer intends to call. */
+interface ManifestMemberReq {
+  readonly interfaceId: string;
+  readonly member: Pattern;
+  readonly required?: boolean;
+}
+interface PendingBase {
+  readonly requestId: string;
+  readonly consumer: {
+    readonly name: string;
+    readonly origin?: string;
+    readonly purpose?: string;
+  };
+  readonly consumerPrincipalId: string;
+  readonly duration: string | undefined;
+  /**
+   * Host-authored provenance bag, bound per transport at
+   * {@link HubAccessManifestHost.registerHubAccessAtRoot} — never read from the
+   * request params. Relayed verbatim in `getDesired`; the host does not
+   * interpret it.
+   */
+  readonly origin?: Record<string, unknown>;
+}
+/** A parked, undecided request — the host's view of one desired entry. */
+type PendingManifestEntry = (PendingBase & {
+  readonly kind: 'direct';
+  /** Verbatim requested authority; permissions may carry a `callIntent`. */
+  readonly permissions: readonly AccessDirectPermission[];
+}) | (PendingBase & {
+  readonly kind: 'discover';
+  /** The interfaces the chosen service must implement (unresolved). */
+  readonly interfaces: readonly ManifestInterfaceReq[];
+  /** The members the consumer intends to call. */
+  readonly members: readonly ManifestMemberReq[];
+});
+/**
+ * The approver's decision for one parked entry, delivered via `setCurrent`.
+ * A `discover` grant additionally names the chosen service (`resolvedSlot`).
+ */
+type ManifestEntryDecision = {
+  readonly grant: false;
+  readonly reason?: string;
+} | {
+  readonly grant: true;
+  readonly capabilities: readonly SignedCapability[];
+  /** Present for a `discover` grant: which service the approver picked. */
+  readonly resolvedSlot?: {
+    readonly serviceId: string;
+    readonly satisfiedInterfaces: readonly string[];
+  };
+};
+interface HubAccessManifestHostOptions {
+  /**
+   * Root issuer principals the hub's forwarded-call gate accepts. Published as
+   * each desired entry's `acceptableRootIds`, so an approver only acts on
+   * entries it can satisfy (it is — or chains to — one of these). Omit/empty to
+   * leave the roots unspecified (approver decides).
+   */
+  readonly acceptableRootIds?: readonly string[];
+  /** Human log sink for incoming requests. Defaults to stderr. */
+  readonly log?: (line: string) => void;
+}
+declare class HubAccessManifestHost {
+  private readonly _pending;
+  private readonly _listeners;
+  private readonly _acceptableRootIds;
+  private readonly _log;
+  private _revision;
+  constructor(options?: HubAccessManifestHostOptions);
+  /**
+   * Register `hubAccess::{request,extend,requestAccess}` directly at a
+   * participant's overlay root (root form, never forwarded → never gated).
+   * Unlike `registerHubAccessService` this consults **no** hub-side directory:
+   * `request` forwards raw slots as `discover` entries for the approver to
+   * resolve.
+   *
+   * `options.origin` is a host-authored provenance bag bound to THIS
+   * connection and stamped onto every entry parked here. It is bound
+   * server-side (not read from the consumer's request params) so a consumer
+   * cannot spoof another transport's origin. The host relays it verbatim; it
+   * does not interpret it.
+   */
+  registerHubAccessAtRoot(connection: LinkRpcConnection<unknown>, options?: {
+    readonly origin?: Record<string, unknown>;
+  }): void;
+  /** Park a desired entry and await the approver's decision (via `setCurrent`). */
+  private _park;
+  /** Snapshot of the desired document (entryId → desired entry) + revision. */
+  getDesired(): {
+    entries: PendingManifestEntry[];
+    acceptableRootIds: readonly string[];
+    revision: number;
+  };
+  /**
+   * Resolve a parked entry from a `setCurrent` decision. Returns `false` when
+   * no entry with that id is pending (already decided / cancelled).
+   */
+  resolve(requestId: string, decision: ManifestEntryDecision): boolean;
+  /** Subscribe to coarse "desired set may have changed" notifications. */
+  onDidChange(listener: () => void): () => void;
+  private _bump;
+}
+/**
+ * Serve `hubAccessManifest::*` on `connection`, mounted under `serviceId` (the
+ * hub's own service prefix). Reachable only through the forwarded-call gate, so
+ * authorization (an accepted-root capability) is enforced upstream — no gate is
+ * applied here.
+ *
+ * `getCurrent`/`watchCurrent` are vestigial for the hub broker: granted caps are
+ * delivered as the blocked `hubAccess` call's result, not read back through
+ * `current`. They are served (empty) to satisfy the interface.
+ */
+declare function registerHubAccessManifest(connection: LinkRpcConnection<unknown>, host: HubAccessManifestHost, options: {
+  readonly serviceId: string;
+}): void;
+//#endregion
+//#region src/engine/manifestApprover.d.ts
+interface ManifestApproverOptions {
+  /**
+   * The manifest to consume. Just the typed client of
+   * {@link hubAccessManifestInterface} — obtained over any connection
+   * (`connection.service(id).get(hubAccessManifestInterface)`), in-memory or
+   * remote. The approver never touches a raw connection for the manifest
+   * surface.
+   */
+  readonly manifest: IHubAccessManifest;
+  /**
+   * Resolve `discover` entries against the participant directory. Supplied by
+   * the caller because directory access needs the approver's own signed
+   * connection (the approver holds the key). Omit if this approver never
+   * expects `discover` entries — such entries are then denied.
+   */
+  readonly fetchDirectory?: () => Promise<readonly DirectoryEntry[]>;
+  /** Mints the approver's own capabilities (audience = the entry's consumer). */
+  readonly issuer: CapabilityProposalIssuer;
+  /**
+   * This approver's own root principal. An entry is acted on only if its
+   * `acceptableRootIds` is absent or includes this id —
+   * otherwise the approver's signature would be useless to the consumer.
+   * Defaults to the issuer's principal.
+   */
+  readonly ownPrincipalId?: string;
+  /** Decision source. Defaults to a terminal y/N prompt on stdin. */
+  readonly prompt?: ConsentPrompt;
+  /** Human log sink. Defaults to stderr. */
+  readonly log?: (line: string) => void;
+}
+interface ManifestApprover {
+  /** Stop watching and abort any in-flight prompt. */
+  dispose(): void;
+}
+/**
+ * Start consuming the manifest at `options.serviceId` over `options.connection`.
+ * Runs until {@link ManifestApprover.dispose}.
+ */
+declare function runManifestApprover(options: ManifestApproverOptions): ManifestApprover;
+//#endregion
+//#region src/engine/approveClient.d.ts
+interface CapRequest {
+  readonly id: string;
+  readonly request: HubAccessManifestRequest;
+  readonly revision: number;
+}
+type ApproveClientState = 'connecting' | 'live' | 'stale';
+interface ApproveClientOptions {
+  readonly manifest: IHubAccessManifest;
+  /** Only expose requests this root can satisfy. Omit to expose every request. */
+  readonly ownPrincipalId?: string;
+  readonly log?: (line: string) => void;
+  readonly reconnectDelayMs?: number;
+  readonly timeoutMs?: number;
+}
+/**
+ * Authoritative, typed frontend for a `hubAccessManifest`.
+ *
+ * Consumers render {@link requests}; coarse watch ticks are reconciled through
+ * one serialized full-snapshot loop, so older reads cannot overwrite newer
+ * state. A completed watch is re-opened and a failed read keeps the last known
+ * snapshot while {@link state} reports `stale`.
+ */
+declare class ApproveClient {
+  private readonly _requests;
+  readonly requests: IObservable<readonly CapRequest[]>;
+  private readonly _state;
+  readonly state: IObservable<ApproveClientState>;
+  private readonly _manifest;
+  private readonly _ownPrincipalId;
+  private readonly _log;
+  private readonly _reconnectDelayMs;
+  private readonly _timeoutMs;
+  private _watch;
+  private _watchGeneration;
+  private _retryTimer;
+  private _refreshPending;
+  private _refreshPromise;
+  private _disposed;
+  constructor(options: ApproveClientOptions);
+  /** Reconcile the observable with the latest complete desired snapshot. */
+  refresh(): Promise<void>;
+  /**
+   * Write a decision only for a request in the current snapshot, then reconcile
+   * with the next authoritative snapshot. A successful write can still leave a
+   * matching id pending when a federated snapshot lags or the consumer retries;
+   * callers receive `still-pending` so they can report that state honestly.
+   */
+  decide(id: string, decision: HubAccessManifestDecision): Promise<'applied' | 'gone' | 'still-pending'>;
+  dispose(): void;
+  private _drainRefreshes;
+  private _openWatch;
+  private _watchEnded;
+  private _scheduleReconnect;
+}
+//#endregion
+//#region src/engine/aggregatingManifest.d.ts
+/** The `{ requested, revision }` document `hubAccessManifest::getDesired` returns. */
+type GetDesiredResult = Awaited<ReturnType<IHubAccessManifest['getDesired']>>;
+/** A single `hubAccessManifest::setCurrent` patch. */
+type ManifestPatch = Parameters<IHubAccessManifest['setCurrent']>[0]['patches'][number];
+/** A manifest the aggregator merges, tagged and origin-policied. */
+interface AggregatorSource {
+  /**
+   * Stable id that namespaces this source's entryIds in the merged document
+   * (and routes `setCurrent` back). For a discovered source, its serviceId.
+   */
+  readonly tag: string;
+  /** The source manifest client. */
+  readonly manifest: IHubAccessManifest;
+  /**
+   * Pass each entry's `origin` bag through verbatim (true) or strip it
+   * (false, default). Set true ONLY for a trusted-local source whose
+   * `sourceTransportId` addresses a local UI; a remote source's origin must be
+   * stripped so it can never address a local iframe.
+   */
+  readonly preserveOrigin?: boolean;
+}
+interface AggregatingManifestOptions {
+  /**
+   * Resolve the current set of source manifests (the local loopback plus
+   * whatever the caller discovers by scanning the hub). Re-invoked on every
+   * {@link AggregatingHubAccessManifest.getDesired}, so newly-appeared sources
+   * are picked up.
+   */
+  readonly resolveSources: () => Promise<readonly AggregatorSource[]> | readonly AggregatorSource[];
+  /**
+   * Optional: subscribe to "the *set* of sources may have changed" — e.g. the
+   * hub's `hubrpc.directory::watch`, which ticks when a service appears or
+   * disappears. Each tick re-emits a change (so a watching approver re-`getDesired`,
+   * which re-runs {@link resolveSources} and discovers the new/removed source).
+   * Without it, a brand-new manifest is only noticed when some *already-known*
+   * source ticks or the approver polls. Returns a teardown.
+   */
+  readonly watchSources?: (onChange: () => void) => () => void;
+  /** Human log sink. */
+  readonly log?: (line: string) => void;
+  /** Hard deadline for each source request. Defaults to 5 seconds. */
+  readonly timeoutMs?: number;
+}
+declare class AggregatingHubAccessManifest {
+  private readonly _options;
+  private readonly _listeners;
+  private _revision;
+  /** tag → source, refreshed on every {@link _refresh}. Used to route `setCurrent`. */
+  private _byTag;
+  /** tag → resilient watch for that exact source incarnation. */
+  private readonly _watches;
+  /** Teardown for the source-set watch (e.g. directory watch), started lazily. */
+  private _sourcesWatchOff;
+  private _refreshPromise;
+  private _disposed;
+  constructor(_options: AggregatingManifestOptions);
+  /** Fire whenever any source's desired set may have changed (drives `watchDesired`). */
+  onDidChange(cb: () => void): () => void;
+  private _emit;
+  /** Resolve the source set, (un)subscribing watches to match, and cache it by tag. */
+  private _refresh;
+  private _doRefresh;
+  private _openWatch;
+  private _startWatch;
+  private _watchEnded;
+  private _closeWatch;
+  /** Merge every source's desired document into one, namespacing ids by source tag. */
+  getDesired(): Promise<GetDesiredResult>;
+  /** Route each decision patch back to the source that parked the entry. */
+  setCurrent(patches: readonly ManifestPatch[]): Promise<void>;
+  dispose(): void;
+}
+/**
+ * Serve an {@link AggregatingHubAccessManifest} over `connection` as an ordinary
+ * `hubAccessManifest` — so an approver consumes it via
+ * `connection.service(serviceId).get(hubAccessManifestInterface)` with no idea it
+ * is an aggregate. `current` is never read back (decisions flow through
+ * `setCurrent` to the sources), so `getCurrent`/`watchCurrent` are served empty.
+ */
+declare function registerAggregatingManifest(connection: LinkRpcConnection<unknown>, aggregator: AggregatingHubAccessManifest, options: {
+  readonly serviceId: string;
+}): void;
+//#endregion
+//#region src/engine/watchHubDirectoryTree.d.ts
+interface WatchHubDirectoryTreeOptions {
+  /** Bound the referral recursion (forwarded to {@link walkHubDetailed}). */
+  readonly maxDepth?: number;
+  /** Human log sink for watch/reconciliation failures. */
+  readonly log?: (line: string) => void;
+}
+declare function watchHubDirectoryTree(connection: LinkRpcConnection, rootTarget: string, onChange: () => void, options?: WatchHubDirectoryTreeOptions): () => void;
+//#endregion
+//#region src/engine/configuredParticipants.d.ts
+interface ConfiguredParticipant {
+  readonly name: string;
+  readonly config: ParticipantConnectorConfig;
+}
+interface ConfigureParticipantsOptions {
+  readonly participants: readonly ConfiguredParticipant[];
+  /**
+   * Attach a connected transport at the host's trust boundary. Standalone
+   * hubs attach directly; embedded hosts can insert their capability gate.
+   */
+  readonly attachParticipant: (transport: IMessageTransport) => ConfiguredParticipantAttachment;
+  readonly log?: (line: string) => void;
+  /** Forward stdin to the single cmd-stdio participant. */
+  readonly cmdInteractive?: boolean;
+}
+interface ConfiguredParticipants {
+  dispose(): void;
+}
+interface ConfiguredParticipantAttachment {
+  claimPrefix(prefix: string): void;
+  setDefaultRoute(): void;
+  request(method: string, params: JsonValue, timeoutMs?: number): Promise<JsonValue | undefined>;
+  dispose(): void;
+}
+/**
+ * Attach settings/config-defined outbound participants to an existing Hub.
+ *
+ * Each participant is supervised independently: it connects in the background,
+ * claims its configured service ids on the far end, installs its local routes,
+ * and reconnects with exponential backoff after a disconnect.
+ */
+declare function configureParticipants(options: ConfigureParticipantsOptions): ConfiguredParticipants;
+declare function validateConfiguredParticipants(participants: readonly ConfiguredParticipant[]): void;
+//#endregion
+export { type AccessDecider, type AccessRequestContext, AggregatingHubAccessManifest, type AggregatingManifestOptions, type AggregatorSource, ApproveClient, type ApproveClientOptions, type ApproveClientState, type CapRequest, type ConfigureParticipantsOptions, type ConfiguredParticipant, type ConfiguredParticipantAttachment, type ConfiguredParticipants, type ConnectionHandlerConfig, ConnectionHandlerSchema, type ConnectionTokenBinderConfig, ConnectionTokenBinderSchema, type ConsentApproverConfig, ConsentApproverSchema, type ConsentDecision, type ConsentPrompt, type ConsentPromptRequest, type EndpointConfig, EndpointConfigSchema, type FlowSummary, type ForwardCheckingConfig, ForwardCheckingSchema, type GrantPolicy, type GrantVerdict, HubAccessGrantSigner, HubAccessManifestHost, type HubAccessManifestHostOptions, type HubConfig, HubConfigSchema, type IdentityKeystore, type IdentityKeystoreOptions, type IdentitySlot, type IdentitySnooze, type ListenerConfig, ListenerConfigSchema, type ListenerInfo, type ManifestApprover, type ManifestApproverOptions, type ManifestEntryDecision, type ManifestInterfaceReq, type ManifestMemberReq, type ParticipantConnectorConfig, ParticipantConnectorConfigSchema, type PendingManifestEntry, type ProvisionConfig, type RunHubOptions, type RunningHub, type ServeHubOptions, type SlotAccessKey, type SlotByIdAndKeyResult, type SlotByIdAndTimeResult, type SlotId, TrafficFlowAggregator, type WatchHubDirectoryTreeOptions, buildSlotPermissions, computeCallBindHash, configureParticipants, createHubAccessConfig, createIdentityKeystore, createTerminalConsentPrompt, describePermissions, describeRequest, formatFlowSummary, hubConfigJsonSchema, loadHubConfig, parseHubConfig, printHubConfigSchema, raceConsent, registerAggregatingManifest, registerHubAccessManifest, runHub, runManifestApprover, serveHub, spawnCommand, toSignedPermissions, validateConfiguredParticipants, watchHubDirectoryTree };
+//# sourceMappingURL=index.d.ts.map