@hediet/linkrpc-hub 0.0.1

package/dist/index.js

@@ -0,0 +1,309 @@
+import { ConnectionHandlerSchema, ConnectionTokenBinderSchema, ConsentApproverSchema, EndpointConfigSchema, ForwardCheckingSchema, HubConfigSchema, ListenerConfigSchema, ParticipantConnectorConfigSchema, hubConfigJsonSchema, parseHubConfig } from "./config.js";
+import { a as ApproveClient, c as buildSlotPermissions, d as computeCallBindHash, f as createTerminalConsentPrompt, h as toSignedPermissions, i as runManifestApprover, l as createHubAccessConfig, m as raceConsent, n as configureParticipants, o as HubAccessManifestHost, p as describePermissions, r as validateConfiguredParticipants, s as registerHubAccessManifest, t as runHub, u as describeRequest } from "./chunks/runHub-P3YUwwdv.js";
+import { i as formatFlowSummary, t as TrafficFlowAggregator } from "./chunks/nodeTransit-CWeFnbwt.js";
+import { c as durationToExp, s as CapabilityProposalIssuer, t as createIdentityKeystore } from "./chunks/server-BAxchQhy.js";
+import { spawnCommand } from "./spawn.js";
+import { loadHubConfig, printHubConfigSchema } from "./configFile.js";
+import { serveHub } from "./serve.js";
+import { DEFAULT_RPC_TIMEOUT_MS, withRpcTimeout } from "@hediet/linkrpc";
+import { HubDirectoryExplorer, hubAccessManifestInterface } from "@hediet/linkrpc/hub/common";
+import { safeParse } from "zod/v4/core";
+//#region src/engine/hubAccessGrantSigner.ts
+var HubAccessGrantSigner = class {
+	_grant;
+	_issuer;
+	constructor(signingIdentity, _grant) {
+		this._grant = _grant;
+		this._issuer = new CapabilityProposalIssuer(signingIdentity);
+	}
+	/**
+	* The {@link AccessDecider}: consult the grant policy and, on `permitted`,
+	* mint a capability with the held identity (audience = the consumer,
+	* honoring "Allow once" `callBind` byte-binding for one-shot durations).
+	*/
+	decide = async (ctx) => {
+		const verdict = await this._grant(ctx);
+		if (verdict.result === "rejected") return verdict.reason !== void 0 ? {
+			grant: false,
+			reason: verdict.reason
+		} : { grant: false };
+		return {
+			grant: true,
+			capabilities: [await this._mint(ctx)]
+		};
+	};
+	async _mint(ctx) {
+		return this._issuer.mint({
+			audience: ctx.consumerPrincipalId,
+			permissions: await toSignedPermissions(ctx.permissions, ctx.consumerPrincipalId, ctx.duration),
+			expiresAtMs: durationToExp(ctx.duration)
+		});
+	}
+};
+//#endregion
+//#region src/engine/aggregatingManifest.ts
+/**
+* `AggregatingHubAccessManifest` — a `manifest* → manifest` combinator.
+*
+* It implements the same {@link IHubAccessManifest} surface the approver/UI
+* consumes, but backs it by **many** source manifests: a trusted *local* source
+* (the participant's own {@link HubAccessManifestHost}, reached over an in-memory
+* loopback) plus zero or more *remote* sources it discovers by scanning the hub
+* directory for `hubAccessManifest` interfaces. So the pipeline composes:
+*
+*   hubAccess ─(HubAccessManifestHost)→ manifest_local ─┐
+*   discovered ───────────────────────→ manifest_remote*┤─(aggregator)→ manifest → UI
+*
+* Two invariants make aggregation safe:
+*
+*  1. **Namespaced entry ids.** Each source's entryIds are prefixed with the
+*     source's `tag`, so the merged id space has no collisions and a `setCurrent`
+*     decision can be routed back to exactly the source that parked it.
+*
+*  2. **Origin is preserved only for trusted-local sources.** An entry's
+*     host-authored `origin` bag (e.g. `{ sourceTransportId }`) routes a *local*
+*     consent UI. A remote source's `origin` refers to a transport on *another*
+*     hub — passing it through as-if-local would let a remote address a local
+*     iframe. So `preserveOrigin` is opt-in per source (true for the local
+*     loopback, false for everything discovered); a stripped entry has no
+*     `sourceTransportId`, so the UI falls back to its panel — correct by
+*     construction.
+*
+* Discovery + reads happen over the caller-supplied connection; reaching a
+* remote `hubAccessManifest::{getDesired,setCurrent}` is a forwarded (form-3)
+* call, so that connection must carry an admin-rooted **capability** for
+* `*::hubAccessManifest::*` (and the directory) — without it the gate rejects the
+* scan. This is the aggregator's whole reason to hold the approver's identity.
+*/
+/** The declared result schema for `hubAccessManifest::getDesired` — used to validate each source. */
+const GET_DESIRED_RESULT_SCHEMA = hubAccessManifestInterface.members.getDesired.resultSchema;
+/** Delimiter between a source `tag` and the source-local entryId. Absent from serviceIds/UUIDs. */
+const SEP = "\0";
+var AggregatingHubAccessManifest = class {
+	_options;
+	_listeners = /* @__PURE__ */ new Set();
+	_revision = 0;
+	/** tag → source, refreshed on every {@link _refresh}. Used to route `setCurrent`. */
+	_byTag = /* @__PURE__ */ new Map();
+	/** tag → resilient watch for that exact source incarnation. */
+	_watches = /* @__PURE__ */ new Map();
+	/** Teardown for the source-set watch (e.g. directory watch), started lazily. */
+	_sourcesWatchOff;
+	_refreshPromise;
+	_disposed = false;
+	constructor(_options) {
+		this._options = _options;
+	}
+	/** Fire whenever any source's desired set may have changed (drives `watchDesired`). */
+	onDidChange(cb) {
+		this._listeners.add(cb);
+		if (this._options.watchSources !== void 0 && this._sourcesWatchOff === void 0) this._sourcesWatchOff = this._options.watchSources(() => {
+			if (!this._disposed) this._emit();
+		});
+		this._refresh().catch(() => {});
+		return () => this._listeners.delete(cb);
+	}
+	_emit() {
+		this._revision++;
+		for (const l of this._listeners) try {
+			l();
+		} catch {}
+	}
+	/** Resolve the source set, (un)subscribing watches to match, and cache it by tag. */
+	_refresh() {
+		if (!this._refreshPromise) this._refreshPromise = this._doRefresh().finally(() => {
+			this._refreshPromise = void 0;
+		});
+		return this._refreshPromise;
+	}
+	async _doRefresh() {
+		const sources = await this._options.resolveSources();
+		const next = new Map(sources.map((s) => [s.tag, s]));
+		for (const [tag, watch] of this._watches) {
+			const nextSource = next.get(tag);
+			if (!nextSource || nextSource.manifest !== watch.source.manifest) {
+				this._closeWatch(watch);
+				this._watches.delete(tag);
+			}
+		}
+		this._byTag = next;
+		for (const s of sources) if (!this._watches.has(s.tag)) this._openWatch(s);
+		return sources;
+	}
+	_openWatch(s) {
+		const watch = { source: s };
+		this._watches.set(s.tag, watch);
+		this._startWatch(watch);
+	}
+	_startWatch(watch) {
+		if (this._disposed || this._watches.get(watch.source.tag) !== watch) return;
+		try {
+			const call = watch.source.manifest.watchDesired({}, { onMessage: () => {
+				if (!this._disposed) this._emit();
+			} });
+			watch.call = call;
+			call.then(() => this._watchEnded(watch), () => this._watchEnded(watch));
+		} catch {
+			this._watchEnded(watch);
+		}
+	}
+	_watchEnded(watch) {
+		if (this._disposed || this._watches.get(watch.source.tag) !== watch) return;
+		watch.call = void 0;
+		if (watch.retryTimer !== void 0) return;
+		watch.retryTimer = setTimeout(() => {
+			watch.retryTimer = void 0;
+			if (this._disposed || this._watches.get(watch.source.tag) !== watch) return;
+			this._startWatch(watch);
+			this._emit();
+		}, 250);
+	}
+	_closeWatch(watch) {
+		if (watch.retryTimer !== void 0) clearTimeout(watch.retryTimer);
+		watch.retryTimer = void 0;
+		const call = watch.call;
+		watch.call = void 0;
+		if (call) Promise.resolve(call.cancel("aggregator source removed")).catch(() => {});
+	}
+	/** Merge every source's desired document into one, namespacing ids by source tag. */
+	async getDesired() {
+		const sources = await this._refresh();
+		const requested = {};
+		for (const s of sources) {
+			let doc;
+			try {
+				doc = await withRpcTimeout(s.manifest.getDesired({}), `hubAccessManifest service '${s.tag || "<root>"}'`, this._options.timeoutMs ?? DEFAULT_RPC_TIMEOUT_MS);
+			} catch (e) {
+				this._options.log?.(`aggregator: getDesired(${s.tag}) failed: ${e.message}`);
+				continue;
+			}
+			const parsed = safeParse(GET_DESIRED_RESULT_SCHEMA, doc);
+			if (!parsed.success) {
+				const issue = parsed.error.issues[0];
+				const where = issue?.path?.join(".") ?? "";
+				this._options.log?.(`aggregator: source '${s.tag}' returned an invalid hubAccessManifest::getDesired document; skipping. ${issue?.message ?? "schema mismatch"}${where ? ` (at ${where})` : ""}`);
+				continue;
+			}
+			for (const [id, entry] of Object.entries(parsed.data.requested)) requested[encodeKey(s.tag, id)] = s.preserveOrigin ? entry : stripOrigin(entry);
+		}
+		return {
+			requested,
+			revision: ++this._revision
+		};
+	}
+	/** Route each decision patch back to the source that parked the entry. */
+	async setCurrent(patches) {
+		const bySource = /* @__PURE__ */ new Map();
+		for (const p of patches) {
+			const decoded = decodeCurrentPath(p.path);
+			if (!decoded) continue;
+			const list = bySource.get(decoded.tag) ?? [];
+			list.push({
+				...p,
+				path: `/current/${escapePointer(decoded.innerId)}`
+			});
+			bySource.set(decoded.tag, list);
+		}
+		await Promise.all([...bySource].map(async ([tag, ps]) => {
+			const src = this._byTag.get(tag);
+			if (!src) throw new Error(`aggregator: setCurrent for unknown source '${tag}'`);
+			await withRpcTimeout(src.manifest.setCurrent({ patches: ps }), `hubAccessManifest service '${tag || "<root>"}'`, this._options.timeoutMs ?? DEFAULT_RPC_TIMEOUT_MS);
+		}));
+	}
+	dispose() {
+		this._disposed = true;
+		for (const watch of this._watches.values()) this._closeWatch(watch);
+		this._watches.clear();
+		this._listeners.clear();
+	}
+};
+/**
+* Serve an {@link AggregatingHubAccessManifest} over `connection` as an ordinary
+* `hubAccessManifest` — so an approver consumes it via
+* `connection.service(serviceId).get(hubAccessManifestInterface)` with no idea it
+* is an aggregate. `current` is never read back (decisions flow through
+* `setCurrent` to the sources), so `getCurrent`/`watchCurrent` are served empty.
+*/
+function registerAggregatingManifest(connection, aggregator, options) {
+	connection.register(hubAccessManifestInterface, {
+		getDesired: () => aggregator.getDesired(),
+		watchDesired: (_params, _ctx, stream) => new Promise((resolve) => {
+			if (stream.signal.aborted) {
+				resolve({});
+				return;
+			}
+			const off = aggregator.onDidChange(() => {
+				if (!stream.signal.aborted) stream.send({});
+			});
+			stream.signal.addEventListener("abort", () => {
+				off();
+				resolve({});
+			}, { once: true });
+		}),
+		getCurrent: () => ({
+			current: {},
+			revision: 0
+		}),
+		setCurrent: async (params) => {
+			await aggregator.setCurrent(params.patches);
+			return { revision: 0 };
+		},
+		watchCurrent: (_params, _ctx, stream) => new Promise((resolve) => {
+			stream.signal.addEventListener("abort", () => resolve({}), { once: true });
+		})
+	}, { serviceId: options.serviceId });
+}
+function encodeKey(tag, innerId) {
+	return `${tag}${SEP}${innerId}`;
+}
+function decodeCurrentPath(path) {
+	if (!path.startsWith("/current/")) return void 0;
+	const key = unescapePointer(path.slice(9));
+	const i = key.indexOf(SEP);
+	if (i < 0) return void 0;
+	return {
+		tag: key.slice(0, i),
+		innerId: key.slice(i + 1)
+	};
+}
+/** Drop the host-authored `origin` bag from a remote entry (see class docs). */
+function stripOrigin(entry) {
+	if (entry.origin === void 0) return entry;
+	const clone = { ...entry };
+	delete clone.origin;
+	return clone;
+}
+function escapePointer(segment) {
+	return segment.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+function unescapePointer(segment) {
+	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+//#endregion
+//#region src/engine/watchHubDirectoryTree.ts
+function watchHubDirectoryTree(connection, rootTarget, onChange, options = {}) {
+	const explorer = new HubDirectoryExplorer(connection.channel, {
+		rootTarget,
+		...options.maxDepth !== void 0 ? { maxDepth: options.maxDepth } : {},
+		...options.log !== void 0 ? { log: options.log } : {}
+	});
+	let disposed = false;
+	let stop;
+	explorer.watch(() => {
+		if (!disposed) onChange();
+	}).then((teardown) => {
+		if (disposed) teardown();
+		else stop = teardown;
+	}).catch((error) => {
+		options.log?.(`watchHubDirectoryTree: start failed: ${error.message}`);
+	});
+	return () => {
+		disposed = true;
+		stop?.();
+		explorer.dispose();
+	};
+}
+//#endregion
+export { AggregatingHubAccessManifest, ApproveClient, ConnectionHandlerSchema, ConnectionTokenBinderSchema, ConsentApproverSchema, EndpointConfigSchema, ForwardCheckingSchema, HubAccessGrantSigner, HubAccessManifestHost, HubConfigSchema, ListenerConfigSchema, ParticipantConnectorConfigSchema, TrafficFlowAggregator, buildSlotPermissions, computeCallBindHash, configureParticipants, createHubAccessConfig, createIdentityKeystore, createTerminalConsentPrompt, describePermissions, describeRequest, formatFlowSummary, hubConfigJsonSchema, loadHubConfig, parseHubConfig, printHubConfigSchema, raceConsent, registerAggregatingManifest, registerHubAccessManifest, runHub, runManifestApprover, serveHub, spawnCommand, toSignedPermissions, validateConfiguredParticipants, watchHubDirectoryTree };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/engine/hubAccessGrantSigner.ts","../src/engine/aggregatingManifest.ts","../src/engine/watchHubDirectoryTree.ts"],"sourcesContent":["/**\n * `HubAccessGrantSigner` — a standalone, in-process consent signer for the\n * `hubAccess` flow. It bundles two things and nothing else:\n *\n *  - a {@link SigningIdentity} it mints capabilities with, and\n *  - a {@link GrantPolicy} that says, per request, permit or reject.\n *\n * It implements **no interface** — it is plumbing you adapt onto the hubAccess\n * front door via {@link createHubAccessConfig}:\n *\n * ```ts\n * const signer = new HubAccessGrantSigner(adminIdentity, () => ({ result: 'permitted' }));\n * registerHubAccessService(root, createHubAccessConfig(signer.decide));\n * ```\n *\n * This is the simple \"the hub grants locally with its own key\" path (tests, a\n * trusted local operator). The distributed, keyless path uses\n * {@link HubAccessManifestHost} instead, where a *remote* approver signs.\n */\nimport { type SignedCapability, type SigningIdentity } from '@hediet/linkrpc';\nimport { CapabilityProposalIssuer, durationToExp } from '../hub/server';\nimport { toSignedPermissions } from './consent';\nimport type { AccessDecider, AccessRequestContext } from './hubAccessConfig';\n\n/** A grant policy's verdict on one request. */\nexport type GrantVerdict =\n    | { readonly result: 'permitted' }\n    | { readonly result: 'rejected'; readonly reason?: string };\n\n/** Decides whether to grant a normalized request. May be sync or async. */\nexport type GrantPolicy = (request: AccessRequestContext) => GrantVerdict | Promise<GrantVerdict>;\n\nexport class HubAccessGrantSigner {\n    private readonly _issuer: CapabilityProposalIssuer;\n\n    constructor(\n        signingIdentity: SigningIdentity,\n        private readonly _grant: GrantPolicy,\n    ) {\n        this._issuer = new CapabilityProposalIssuer(signingIdentity);\n    }\n\n    /**\n     * The {@link AccessDecider}: consult the grant policy and, on `permitted`,\n     * mint a capability with the held identity (audience = the consumer,\n     * honoring \"Allow once\" `callBind` byte-binding for one-shot durations).\n     */\n    public readonly decide: AccessDecider = async (ctx) => {\n        const verdict = await this._grant(ctx);\n        if (verdict.result === 'rejected') {\n            return verdict.reason !== undefined ? { grant: false, reason: verdict.reason } : { grant: false };\n        }\n        const capability = await this._mint(ctx);\n        return { grant: true, capabilities: [capability] };\n    };\n\n    private async _mint(ctx: AccessRequestContext): Promise<SignedCapability> {\n        return this._issuer.mint({\n            audience: ctx.consumerPrincipalId,\n            permissions: await toSignedPermissions(ctx.permissions, ctx.consumerPrincipalId, ctx.duration),\n            expiresAtMs: durationToExp(ctx.duration),\n        });\n    }\n}\n","/**\n * `AggregatingHubAccessManifest` — a `manifest* → manifest` combinator.\n *\n * It implements the same {@link IHubAccessManifest} surface the approver/UI\n * consumes, but backs it by **many** source manifests: a trusted *local* source\n * (the participant's own {@link HubAccessManifestHost}, reached over an in-memory\n * loopback) plus zero or more *remote* sources it discovers by scanning the hub\n * directory for `hubAccessManifest` interfaces. So the pipeline composes:\n *\n *   hubAccess ─(HubAccessManifestHost)→ manifest_local ─┐\n *   discovered ───────────────────────→ manifest_remote*┤─(aggregator)→ manifest → UI\n *\n * Two invariants make aggregation safe:\n *\n *  1. **Namespaced entry ids.** Each source's entryIds are prefixed with the\n *     source's `tag`, so the merged id space has no collisions and a `setCurrent`\n *     decision can be routed back to exactly the source that parked it.\n *\n *  2. **Origin is preserved only for trusted-local sources.** An entry's\n *     host-authored `origin` bag (e.g. `{ sourceTransportId }`) routes a *local*\n *     consent UI. A remote source's `origin` refers to a transport on *another*\n *     hub — passing it through as-if-local would let a remote address a local\n *     iframe. So `preserveOrigin` is opt-in per source (true for the local\n *     loopback, false for everything discovered); a stripped entry has no\n *     `sourceTransportId`, so the UI falls back to its panel — correct by\n *     construction.\n *\n * Discovery + reads happen over the caller-supplied connection; reaching a\n * remote `hubAccessManifest::{getDesired,setCurrent}` is a forwarded (form-3)\n * call, so that connection must carry an admin-rooted **capability** for\n * `*::hubAccessManifest::*` (and the directory) — without it the gate rejects the\n * scan. This is the aggregator's whole reason to hold the approver's identity.\n */\nimport {\n    DEFAULT_RPC_TIMEOUT_MS,\n    type LinkRpcConnection,\n    withRpcTimeout,\n} from '@hediet/linkrpc';\nimport { hubAccessManifestInterface, type IHubAccessManifest } from '@hediet/linkrpc/hub/common';\nimport { safeParse } from 'zod/v4/core';\n\n/** The declared result schema for `hubAccessManifest::getDesired` — used to validate each source. */\nconst GET_DESIRED_RESULT_SCHEMA = hubAccessManifestInterface.members.getDesired.resultSchema;\n\n/** The `{ requested, revision }` document `hubAccessManifest::getDesired` returns. */\ntype GetDesiredResult = Awaited<ReturnType<IHubAccessManifest['getDesired']>>;\n/** One desired entry (a `discover | direct` manifest request). Treated opaquely except `origin`. */\ntype ManifestEntry = GetDesiredResult['requested'][string];\n/** A single `hubAccessManifest::setCurrent` patch. */\ntype ManifestPatch = Parameters<IHubAccessManifest['setCurrent']>[0]['patches'][number];\n\n/** A manifest the aggregator merges, tagged and origin-policied. */\nexport interface AggregatorSource {\n    /**\n     * Stable id that namespaces this source's entryIds in the merged document\n     * (and routes `setCurrent` back). For a discovered source, its serviceId.\n     */\n    readonly tag: string;\n    /** The source manifest client. */\n    readonly manifest: IHubAccessManifest;\n    /**\n     * Pass each entry's `origin` bag through verbatim (true) or strip it\n     * (false, default). Set true ONLY for a trusted-local source whose\n     * `sourceTransportId` addresses a local UI; a remote source's origin must be\n     * stripped so it can never address a local iframe.\n     */\n    readonly preserveOrigin?: boolean;\n}\n\nexport interface AggregatingManifestOptions {\n    /**\n     * Resolve the current set of source manifests (the local loopback plus\n     * whatever the caller discovers by scanning the hub). Re-invoked on every\n     * {@link AggregatingHubAccessManifest.getDesired}, so newly-appeared sources\n     * are picked up.\n     */\n    readonly resolveSources: () => Promise<readonly AggregatorSource[]> | readonly AggregatorSource[];\n    /**\n     * Optional: subscribe to \"the *set* of sources may have changed\" — e.g. the\n     * hub's `hubrpc.directory::watch`, which ticks when a service appears or\n     * disappears. Each tick re-emits a change (so a watching approver re-`getDesired`,\n     * which re-runs {@link resolveSources} and discovers the new/removed source).\n     * Without it, a brand-new manifest is only noticed when some *already-known*\n     * source ticks or the approver polls. Returns a teardown.\n     */\n    readonly watchSources?: (onChange: () => void) => () => void;\n    /** Human log sink. */\n    readonly log?: (line: string) => void;\n    /** Hard deadline for each source request. Defaults to 5 seconds. */\n    readonly timeoutMs?: number;\n}\n\n/** Delimiter between a source `tag` and the source-local entryId. Absent from serviceIds/UUIDs. */\nconst SEP = '\\u0000';\n\nexport class AggregatingHubAccessManifest {\n    private readonly _listeners = new Set<() => void>();\n    private _revision = 0;\n    /** tag → source, refreshed on every {@link _refresh}. Used to route `setCurrent`. */\n    private _byTag = new Map<string, AggregatorSource>();\n    /** tag → resilient watch for that exact source incarnation. */\n    private readonly _watches = new Map<string, SourceWatch>();\n    /** Teardown for the source-set watch (e.g. directory watch), started lazily. */\n    private _sourcesWatchOff: (() => void) | undefined;\n    private _refreshPromise: Promise<readonly AggregatorSource[]> | undefined;\n    private _disposed = false;\n\n    constructor(private readonly _options: AggregatingManifestOptions) { }\n\n    /** Fire whenever any source's desired set may have changed (drives `watchDesired`). */\n    public onDidChange(cb: () => void): () => void {\n        this._listeners.add(cb);\n        // Watch the source *set* (directory) so newly-appeared manifests are\n        // discovered, not just changes within already-known sources.\n        if (this._options.watchSources !== undefined && this._sourcesWatchOff === undefined) {\n            this._sourcesWatchOff = this._options.watchSources(() => {\n                if (!this._disposed) this._emit();\n            });\n        }\n        // Ensure per-source watches are live so their ticks propagate to `cb`.\n        void this._refresh().catch(() => { /* refresh logs its own errors */ });\n        return () => this._listeners.delete(cb);\n    }\n\n    private _emit(): void {\n        this._revision++;\n        for (const l of this._listeners) {\n            try { l(); } catch { /* a listener throwing must not break the others */ }\n        }\n    }\n\n    /** Resolve the source set, (un)subscribing watches to match, and cache it by tag. */\n    private _refresh(): Promise<readonly AggregatorSource[]> {\n        if (!this._refreshPromise) {\n            this._refreshPromise = this._doRefresh().finally(() => {\n                this._refreshPromise = undefined;\n            });\n        }\n        return this._refreshPromise;\n    }\n\n    private async _doRefresh(): Promise<readonly AggregatorSource[]> {\n        const sources = await this._options.resolveSources();\n        const next = new Map(sources.map((s) => [s.tag, s] as const));\n        for (const [tag, watch] of this._watches) {\n            const nextSource = next.get(tag);\n            if (!nextSource || nextSource.manifest !== watch.source.manifest) {\n                this._closeWatch(watch);\n                this._watches.delete(tag);\n            }\n        }\n        this._byTag = next;\n        for (const s of sources) {\n            if (!this._watches.has(s.tag)) this._openWatch(s);\n        }\n        return sources;\n    }\n\n    private _openWatch(s: AggregatorSource): void {\n        const watch: SourceWatch = { source: s };\n        this._watches.set(s.tag, watch);\n        this._startWatch(watch);\n    }\n\n    private _startWatch(watch: SourceWatch): void {\n        if (this._disposed || this._watches.get(watch.source.tag) !== watch) return;\n        try {\n            const call = watch.source.manifest.watchDesired({}, {\n                onMessage: () => { if (!this._disposed) this._emit(); },\n            });\n            watch.call = call;\n            call.then(\n                () => this._watchEnded(watch),\n                () => this._watchEnded(watch),\n            );\n        } catch {\n            // A source that can't be watched still contributes via getDesired.\n            this._watchEnded(watch);\n        }\n    }\n\n    private _watchEnded(watch: SourceWatch): void {\n        if (this._disposed || this._watches.get(watch.source.tag) !== watch) return;\n        watch.call = undefined;\n        if (watch.retryTimer !== undefined) return;\n        watch.retryTimer = setTimeout(() => {\n            watch.retryTimer = undefined;\n            if (this._disposed || this._watches.get(watch.source.tag) !== watch) return;\n            this._startWatch(watch);\n            this._emit();\n        }, 250);\n    }\n\n    private _closeWatch(watch: SourceWatch): void {\n        if (watch.retryTimer !== undefined) clearTimeout(watch.retryTimer);\n        watch.retryTimer = undefined;\n        const call = watch.call;\n        watch.call = undefined;\n        if (call) {\n            void Promise.resolve(call.cancel('aggregator source removed')).catch(() => { /* closing */ });\n        }\n    }\n\n    /** Merge every source's desired document into one, namespacing ids by source tag. */\n    public async getDesired(): Promise<GetDesiredResult> {\n        const sources = await this._refresh();\n        const requested: Record<string, ManifestEntry> = {};\n        for (const s of sources) {\n            let doc: GetDesiredResult;\n            try {\n                doc = await withRpcTimeout(\n                    s.manifest.getDesired({}),\n                    `hubAccessManifest service '${s.tag || '<root>'}'`,\n                    this._options.timeoutMs ?? DEFAULT_RPC_TIMEOUT_MS,\n                );\n            } catch (e) {\n                this._options.log?.(`aggregator: getDesired(${s.tag}) failed: ${(e as Error).message}`);\n                continue;\n            }\n            // Result validation at the consumption boundary: `hubAccessManifest`\n            // result schemas are compile-time only (the RPC layer validates\n            // inbound params + streams, but returns results verbatim), so a\n            // source that serves a malformed desired document (e.g. entries\n            // missing their required `consumer`) would otherwise blow up deep in\n            // the approver with an opaque `undefined` read. Fail loudly here:\n            // name the bad source + the first issue, and skip it.\n            const parsed = safeParse(GET_DESIRED_RESULT_SCHEMA, doc);\n            if (!parsed.success) {\n                const issue = parsed.error.issues[0];\n                const where = issue?.path?.join('.') ?? '';\n                this._options.log?.(\n                    `aggregator: source '${s.tag}' returned an invalid hubAccessManifest::getDesired document; skipping. `\n                    + `${issue?.message ?? 'schema mismatch'}${where ? ` (at ${where})` : ''}`,\n                );\n                continue;\n            }\n            for (const [id, entry] of Object.entries(parsed.data.requested)) {\n                requested[encodeKey(s.tag, id)] = s.preserveOrigin ? entry : stripOrigin(entry);\n            }\n        }\n        return { requested, revision: ++this._revision };\n    }\n\n    /** Route each decision patch back to the source that parked the entry. */\n    public async setCurrent(patches: readonly ManifestPatch[]): Promise<void> {\n        const bySource = new Map<string, ManifestPatch[]>();\n        for (const p of patches) {\n            const decoded = decodeCurrentPath(p.path);\n            if (!decoded) continue; // whole-doc / malformed patch — nothing to route\n            const list = bySource.get(decoded.tag) ?? [];\n            list.push({ ...p, path: `/current/${escapePointer(decoded.innerId)}` });\n            bySource.set(decoded.tag, list);\n        }\n        await Promise.all([...bySource].map(async ([tag, ps]) => {\n            const src = this._byTag.get(tag);\n            if (!src) {\n                throw new Error(`aggregator: setCurrent for unknown source '${tag}'`);\n            }\n            await withRpcTimeout(\n                src.manifest.setCurrent({ patches: ps }),\n                `hubAccessManifest service '${tag || '<root>'}'`,\n                this._options.timeoutMs ?? DEFAULT_RPC_TIMEOUT_MS,\n            );\n        }));\n    }\n\n    public dispose(): void {\n        this._disposed = true;\n        for (const watch of this._watches.values()) this._closeWatch(watch);\n        this._watches.clear();\n        this._listeners.clear();\n    }\n\n}\n\ninterface SourceWatch {\n    readonly source: AggregatorSource;\n    call?: ReturnType<IHubAccessManifest['watchDesired']>;\n    retryTimer?: ReturnType<typeof setTimeout>;\n}\n\n/**\n * Serve an {@link AggregatingHubAccessManifest} over `connection` as an ordinary\n * `hubAccessManifest` — so an approver consumes it via\n * `connection.service(serviceId).get(hubAccessManifestInterface)` with no idea it\n * is an aggregate. `current` is never read back (decisions flow through\n * `setCurrent` to the sources), so `getCurrent`/`watchCurrent` are served empty.\n */\nexport function registerAggregatingManifest(\n    connection: LinkRpcConnection<unknown>,\n    aggregator: AggregatingHubAccessManifest,\n    options: { readonly serviceId: string; },\n): void {\n    connection.register(hubAccessManifestInterface, {\n        getDesired: () => aggregator.getDesired(),\n        watchDesired: (_params, _ctx, stream) =>\n            new Promise<Record<string, never>>((resolve) => {\n                if (stream.signal.aborted) { resolve({}); return; }\n                const off = aggregator.onDidChange(() => {\n                    if (!stream.signal.aborted) stream.send({});\n                });\n                stream.signal.addEventListener('abort', () => { off(); resolve({}); }, { once: true });\n            }),\n        getCurrent: () => ({ current: {}, revision: 0 }),\n        setCurrent: async (params) => { await aggregator.setCurrent(params.patches); return { revision: 0 }; },\n        watchCurrent: (_params, _ctx, stream) =>\n            new Promise<Record<string, never>>((resolve) => {\n                stream.signal.addEventListener('abort', () => resolve({}), { once: true });\n            }),\n    }, { serviceId: options.serviceId });\n}\n\nfunction encodeKey(tag: string, innerId: string): string {\n    return `${tag}${SEP}${innerId}`;\n}\n\nfunction decodeCurrentPath(path: string): { tag: string; innerId: string; } | undefined {\n    const prefix = '/current/';\n    if (!path.startsWith(prefix)) return undefined;\n    const key = unescapePointer(path.slice(prefix.length));\n    const i = key.indexOf(SEP);\n    if (i < 0) return undefined;\n    return { tag: key.slice(0, i), innerId: key.slice(i + 1) };\n}\n\n/** Drop the host-authored `origin` bag from a remote entry (see class docs). */\nfunction stripOrigin(entry: ManifestEntry): ManifestEntry {\n    if (entry.origin === undefined) return entry;\n    const clone = { ...entry };\n    delete clone.origin;\n    return clone;\n}\n\nfunction escapePointer(segment: string): string {\n    return segment.replace(/~/g, '~0').replace(/\\//g, '~1');\n}\n\nfunction unescapePointer(segment: string): string {\n    return segment.replace(/~1/g, '/').replace(/~0/g, '~');\n}\n","/**\n * `watchHubDirectoryTree` — a recursive \"the directory tree may have changed\"\n * subscription.\n *\n * The hub directory is a **referral graph**: the root\n * (`<rootTarget>::hubrpc.directory`) lists sub-directories, each of which may\n * list more. A single `hubrpc.directory::watch` only reflects *its own* node —\n * the hub's global directory aggregates local, participant-root, and routing\n * invalidations, while every referred directory remains a separate node with\n * its own watch. To react to a manifest appearing *anywhere* in the tree, a\n * consumer must watch **every** node the walk traverses, and re-subscribe as the\n * set of nodes itself changes.\n *\n * This uses {@link HubDirectoryExplorer} to open\n * `hubrpc.directory::watch` on the root and every discovered sub-directory.\n * A tick re-lists only its source and reconciles affected descendant branches;\n * unchanged siblings are not re-listed or re-watched. Nodes that\n * serve the static {@link directoryWatchNever} handler simply never tick — the\n * watch is a harmless no-op there — while live nodes (the routing-backed root,\n * nested sub-hubs) drive discovery. Reads/watches are forwarded (form-3) calls,\n * so `connection` must carry a capability for `*::hubrpc.directory::*` when it is\n * gated.\n *\n * Returns a teardown that cancels every open watch.\n */\nimport { type LinkRpcConnection } from '@hediet/linkrpc';\nimport { HubDirectoryExplorer } from '@hediet/linkrpc/hub/common';\n\nexport interface WatchHubDirectoryTreeOptions {\n    /** Bound the referral recursion (forwarded to {@link walkHubDetailed}). */\n    readonly maxDepth?: number;\n    /** Human log sink for watch/reconciliation failures. */\n    readonly log?: (line: string) => void;\n}\n\nexport function watchHubDirectoryTree(\n    connection: LinkRpcConnection,\n    rootTarget: string,\n    onChange: () => void,\n    options: WatchHubDirectoryTreeOptions = {},\n): () => void {\n    const explorer = new HubDirectoryExplorer(connection.channel, {\n        rootTarget,\n        ...(options.maxDepth !== undefined ? { maxDepth: options.maxDepth } : {}),\n        ...(options.log !== undefined ? { log: options.log } : {}),\n    });\n    let disposed = false;\n    let stop: (() => void) | undefined;\n    void explorer.watch(() => {\n        if (!disposed) onChange();\n    }).then((teardown) => {\n        if (disposed) teardown();\n        else stop = teardown;\n    }).catch((error) => {\n        options.log?.(`watchHubDirectoryTree: start failed: ${(error as Error).message}`);\n    });\n\n    return () => {\n        disposed = true;\n        stop?.();\n        explorer.dispose();\n    };\n}\n"],"mappings":";;;;;;;;;;;AAgCA,IAAa,uBAAb,MAAkC;CAKT;CAJrB;CAEA,YACI,iBACA,QACF;EADmB,KAAA,SAAA;EAEjB,KAAK,UAAU,IAAI,yBAAyB,eAAe;CAC/D;;;;;;CAOA,SAAwC,OAAO,QAAQ;EACnD,MAAM,UAAU,MAAM,KAAK,OAAO,GAAG;EACrC,IAAI,QAAQ,WAAW,YACnB,OAAO,QAAQ,WAAW,KAAA,IAAY;GAAE,OAAO;GAAO,QAAQ,QAAQ;EAAO,IAAI,EAAE,OAAO,MAAM;EAGpG,OAAO;GAAE,OAAO;GAAM,cAAc,CAAC,MADZ,KAAK,MAAM,GAAG,CACQ;EAAE;CACrD;CAEA,MAAc,MAAM,KAAsD;EACtE,OAAO,KAAK,QAAQ,KAAK;GACrB,UAAU,IAAI;GACd,aAAa,MAAM,oBAAoB,IAAI,aAAa,IAAI,qBAAqB,IAAI,QAAQ;GAC7F,aAAa,cAAc,IAAI,QAAQ;EAC3C,CAAC;CACL;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACrBA,MAAM,4BAA4B,2BAA2B,QAAQ,WAAW;;AAmDhF,MAAM,MAAM;AAEZ,IAAa,+BAAb,MAA0C;CAYT;CAX7B,6BAA8B,IAAI,IAAgB;CAClD,YAAoB;;CAEpB,yBAAiB,IAAI,IAA8B;;CAEnD,2BAA4B,IAAI,IAAyB;;CAEzD;CACA;CACA,YAAoB;CAEpB,YAAY,UAAuD;EAAtC,KAAA,WAAA;CAAwC;;CAGrE,YAAmB,IAA4B;EAC3C,KAAK,WAAW,IAAI,EAAE;EAGtB,IAAI,KAAK,SAAS,iBAAiB,KAAA,KAAa,KAAK,qBAAqB,KAAA,GACtE,KAAK,mBAAmB,KAAK,SAAS,mBAAmB;GACrD,IAAI,CAAC,KAAK,WAAW,KAAK,MAAM;EACpC,CAAC;EAGL,KAAU,SAAS,CAAC,CAAC,YAAY,CAAoC,CAAC;EACtE,aAAa,KAAK,WAAW,OAAO,EAAE;CAC1C;CAEA,QAAsB;EAClB,KAAK;EACL,KAAK,MAAM,KAAK,KAAK,YACjB,IAAI;GAAE,EAAE;EAAG,QAAQ,CAAsD;CAEjF;;CAGA,WAAyD;EACrD,IAAI,CAAC,KAAK,iBACN,KAAK,kBAAkB,KAAK,WAAW,CAAC,CAAC,cAAc;GACnD,KAAK,kBAAkB,KAAA;EAC3B,CAAC;EAEL,OAAO,KAAK;CAChB;CAEA,MAAc,aAAmD;EAC7D,MAAM,UAAU,MAAM,KAAK,SAAS,eAAe;EACnD,MAAM,OAAO,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,CAAU,CAAC;EAC5D,KAAK,MAAM,CAAC,KAAK,UAAU,KAAK,UAAU;GACtC,MAAM,aAAa,KAAK,IAAI,GAAG;GAC/B,IAAI,CAAC,cAAc,WAAW,aAAa,MAAM,OAAO,UAAU;IAC9D,KAAK,YAAY,KAAK;IACtB,KAAK,SAAS,OAAO,GAAG;GAC5B;EACJ;EACA,KAAK,SAAS;EACd,KAAK,MAAM,KAAK,SACZ,IAAI,CAAC,KAAK,SAAS,IAAI,EAAE,GAAG,GAAG,KAAK,WAAW,CAAC;EAEpD,OAAO;CACX;CAEA,WAAmB,GAA2B;EAC1C,MAAM,QAAqB,EAAE,QAAQ,EAAE;EACvC,KAAK,SAAS,IAAI,EAAE,KAAK,KAAK;EAC9B,KAAK,YAAY,KAAK;CAC1B;CAEA,YAAoB,OAA0B;EAC1C,IAAI,KAAK,aAAa,KAAK,SAAS,IAAI,MAAM,OAAO,GAAG,MAAM,OAAO;EACrE,IAAI;GACA,MAAM,OAAO,MAAM,OAAO,SAAS,aAAa,CAAC,GAAG,EAChD,iBAAiB;IAAE,IAAI,CAAC,KAAK,WAAW,KAAK,MAAM;GAAG,EAC1D,CAAC;GACD,MAAM,OAAO;GACb,KAAK,WACK,KAAK,YAAY,KAAK,SACtB,KAAK,YAAY,KAAK,CAChC;EACJ,QAAQ;GAEJ,KAAK,YAAY,KAAK;EAC1B;CACJ;CAEA,YAAoB,OAA0B;EAC1C,IAAI,KAAK,aAAa,KAAK,SAAS,IAAI,MAAM,OAAO,GAAG,MAAM,OAAO;EACrE,MAAM,OAAO,KAAA;EACb,IAAI,MAAM,eAAe,KAAA,GAAW;EACpC,MAAM,aAAa,iBAAiB;GAChC,MAAM,aAAa,KAAA;GACnB,IAAI,KAAK,aAAa,KAAK,SAAS,IAAI,MAAM,OAAO,GAAG,MAAM,OAAO;GACrE,KAAK,YAAY,KAAK;GACtB,KAAK,MAAM;EACf,GAAG,GAAG;CACV;CAEA,YAAoB,OAA0B;EAC1C,IAAI,MAAM,eAAe,KAAA,GAAW,aAAa,MAAM,UAAU;EACjE,MAAM,aAAa,KAAA;EACnB,MAAM,OAAO,MAAM;EACnB,MAAM,OAAO,KAAA;EACb,IAAI,MACA,QAAa,QAAQ,KAAK,OAAO,2BAA2B,CAAC,CAAC,CAAC,YAAY,CAAgB,CAAC;CAEpG;;CAGA,MAAa,aAAwC;EACjD,MAAM,UAAU,MAAM,KAAK,SAAS;EACpC,MAAM,YAA2C,CAAC;EAClD,KAAK,MAAM,KAAK,SAAS;GACrB,IAAI;GACJ,IAAI;IACA,MAAM,MAAM,eACR,EAAE,SAAS,WAAW,CAAC,CAAC,GACxB,8BAA8B,EAAE,OAAO,SAAS,IAChD,KAAK,SAAS,aAAa,sBAC/B;GACJ,SAAS,GAAG;IACR,KAAK,SAAS,MAAM,0BAA0B,EAAE,IAAI,YAAa,EAAY,SAAS;IACtF;GACJ;GAQA,MAAM,SAAS,UAAU,2BAA2B,GAAG;GACvD,IAAI,CAAC,OAAO,SAAS;IACjB,MAAM,QAAQ,OAAO,MAAM,OAAO;IAClC,MAAM,QAAQ,OAAO,MAAM,KAAK,GAAG,KAAK;IACxC,KAAK,SAAS,MACV,uBAAuB,EAAE,IAAI,0EACxB,OAAO,WAAW,oBAAoB,QAAQ,QAAQ,MAAM,KAAK,IAC1E;IACA;GACJ;GACA,KAAK,MAAM,CAAC,IAAI,UAAU,OAAO,QAAQ,OAAO,KAAK,SAAS,GAC1D,UAAU,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,QAAQ,YAAY,KAAK;EAEtF;EACA,OAAO;GAAE;GAAW,UAAU,EAAE,KAAK;EAAU;CACnD;;CAGA,MAAa,WAAW,SAAkD;EACtE,MAAM,2BAAW,IAAI,IAA6B;EAClD,KAAK,MAAM,KAAK,SAAS;GACrB,MAAM,UAAU,kBAAkB,EAAE,IAAI;GACxC,IAAI,CAAC,SAAS;GACd,MAAM,OAAO,SAAS,IAAI,QAAQ,GAAG,KAAK,CAAC;GAC3C,KAAK,KAAK;IAAE,GAAG;IAAG,MAAM,YAAY,cAAc,QAAQ,OAAO;GAAI,CAAC;GACtE,SAAS,IAAI,QAAQ,KAAK,IAAI;EAClC;EACA,MAAM,QAAQ,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;GACrD,MAAM,MAAM,KAAK,OAAO,IAAI,GAAG;GAC/B,IAAI,CAAC,KACD,MAAM,IAAI,MAAM,8CAA8C,IAAI,EAAE;GAExE,MAAM,eACF,IAAI,SAAS,WAAW,EAAE,SAAS,GAAG,CAAC,GACvC,8BAA8B,OAAO,SAAS,IAC9C,KAAK,SAAS,aAAa,sBAC/B;EACJ,CAAC,CAAC;CACN;CAEA,UAAuB;EACnB,KAAK,YAAY;EACjB,KAAK,MAAM,SAAS,KAAK,SAAS,OAAO,GAAG,KAAK,YAAY,KAAK;EAClE,KAAK,SAAS,MAAM;EACpB,KAAK,WAAW,MAAM;CAC1B;AAEJ;;;;;;;;AAeA,SAAgB,4BACZ,YACA,YACA,SACI;CACJ,WAAW,SAAS,4BAA4B;EAC5C,kBAAkB,WAAW,WAAW;EACxC,eAAe,SAAS,MAAM,WAC1B,IAAI,SAAgC,YAAY;GAC5C,IAAI,OAAO,OAAO,SAAS;IAAE,QAAQ,CAAC,CAAC;IAAG;GAAQ;GAClD,MAAM,MAAM,WAAW,kBAAkB;IACrC,IAAI,CAAC,OAAO,OAAO,SAAS,OAAO,KAAK,CAAC,CAAC;GAC9C,CAAC;GACD,OAAO,OAAO,iBAAiB,eAAe;IAAE,IAAI;IAAG,QAAQ,CAAC,CAAC;GAAG,GAAG,EAAE,MAAM,KAAK,CAAC;EACzF,CAAC;EACL,mBAAmB;GAAE,SAAS,CAAC;GAAG,UAAU;EAAE;EAC9C,YAAY,OAAO,WAAW;GAAE,MAAM,WAAW,WAAW,OAAO,OAAO;GAAG,OAAO,EAAE,UAAU,EAAE;EAAG;EACrG,eAAe,SAAS,MAAM,WAC1B,IAAI,SAAgC,YAAY;GAC5C,OAAO,OAAO,iBAAiB,eAAe,QAAQ,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC;EAC7E,CAAC;CACT,GAAG,EAAE,WAAW,QAAQ,UAAU,CAAC;AACvC;AAEA,SAAS,UAAU,KAAa,SAAyB;CACrD,OAAO,GAAG,MAAM,MAAM;AAC1B;AAEA,SAAS,kBAAkB,MAA6D;CAEpF,IAAI,CAAC,KAAK,WAAW,WAAM,GAAG,OAAO,KAAA;CACrC,MAAM,MAAM,gBAAgB,KAAK,MAAM,CAAa,CAAC;CACrD,MAAM,IAAI,IAAI,QAAQ,GAAG;CACzB,IAAI,IAAI,GAAG,OAAO,KAAA;CAClB,OAAO;EAAE,KAAK,IAAI,MAAM,GAAG,CAAC;EAAG,SAAS,IAAI,MAAM,IAAI,CAAC;CAAE;AAC7D;;AAGA,SAAS,YAAY,OAAqC;CACtD,IAAI,MAAM,WAAW,KAAA,GAAW,OAAO;CACvC,MAAM,QAAQ,EAAE,GAAG,MAAM;CACzB,OAAO,MAAM;CACb,OAAO;AACX;AAEA,SAAS,cAAc,SAAyB;CAC5C,OAAO,QAAQ,QAAQ,MAAM,IAAI,CAAC,CAAC,QAAQ,OAAO,IAAI;AAC1D;AAEA,SAAS,gBAAgB,SAAyB;CAC9C,OAAO,QAAQ,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG;AACzD;;;AChTA,SAAgB,sBACZ,YACA,YACA,UACA,UAAwC,CAAC,GAC/B;CACV,MAAM,WAAW,IAAI,qBAAqB,WAAW,SAAS;EAC1D;EACA,GAAI,QAAQ,aAAa,KAAA,IAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;EACvE,GAAI,QAAQ,QAAQ,KAAA,IAAY,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;CAC5D,CAAC;CACD,IAAI,WAAW;CACf,IAAI;CACJ,SAAc,YAAY;EACtB,IAAI,CAAC,UAAU,SAAS;CAC5B,CAAC,CAAC,CAAC,MAAM,aAAa;EAClB,IAAI,UAAU,SAAS;OAClB,OAAO;CAChB,CAAC,CAAC,CAAC,OAAO,UAAU;EAChB,QAAQ,MAAM,wCAAyC,MAAgB,SAAS;CACpF,CAAC;CAED,aAAa;EACT,WAAW;EACX,OAAO;EACP,SAAS,QAAQ;CACrB;AACJ"}

package/dist/serve.d.ts

@@ -0,0 +1,14 @@
+import { n as printHubConfigSchema, t as loadHubConfig } from "./chunks/configFile-y6Phntqu.js";
+//#region src/serve.d.ts
+interface ServeHubOptions {
+  readonly configPath: string;
+  readonly cmdInteractive?: boolean;
+  readonly log?: (line: string) => void;
+  /** Log every JSON-RPC message routed through the hub to {@link log}. */
+  readonly logMessages?: boolean;
+}
+/** Run a hub from `configPath`; resolves only on SIGINT/SIGTERM. */
+declare function serveHub(opts: ServeHubOptions): Promise<void>;
+//#endregion
+export { ServeHubOptions, loadHubConfig, printHubConfigSchema, serveHub };
+//# sourceMappingURL=serve.d.ts.map

package/dist/serve.js

@@ -0,0 +1,31 @@
+import { t as runHub } from "./chunks/runHub-P3YUwwdv.js";
+import { loadHubConfig, printHubConfigSchema } from "./configFile.js";
+//#region src/serve.ts
+/**
+* `serve` — run a hub from a declarative {@link HubConfig} file and block until
+* interrupted. Shared by the `linkrpc-hub` binary and (re-exported) the CLI.
+*/
+/** Run a hub from `configPath`; resolves only on SIGINT/SIGTERM. */
+async function serveHub(opts) {
+	const log = opts.log ?? ((line) => process.stderr.write(line + "\n"));
+	const config = loadHubConfig(opts.configPath);
+	const running = await runHub({
+		config,
+		log,
+		cmdInteractive: opts.cmdInteractive,
+		logMessages: opts.logMessages
+	});
+	log(`hub running (${running.listeners.length} listener(s)). Ctrl-C to stop.`);
+	await new Promise((resolve) => {
+		const stop = () => {
+			running.dispose();
+			resolve();
+		};
+		process.once("SIGINT", stop);
+		process.once("SIGTERM", stop);
+	});
+}
+//#endregion
+export { loadHubConfig, printHubConfigSchema, serveHub };
+
+//# sourceMappingURL=serve.js.map

package/dist/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","names":[],"sources":["../src/serve.ts"],"sourcesContent":["/**\n * `serve` — run a hub from a declarative {@link HubConfig} file and block until\n * interrupted. Shared by the `linkrpc-hub` binary and (re-exported) the CLI.\n */\nimport { runHub } from './engine/runHub';\nimport { loadHubConfig } from './configFile';\n\nexport { loadHubConfig, printHubConfigSchema } from './configFile';\n\nexport interface ServeHubOptions {\n    readonly configPath: string;\n    readonly cmdInteractive?: boolean;\n    readonly log?: (line: string) => void;\n    /** Log every JSON-RPC message routed through the hub to {@link log}. */\n    readonly logMessages?: boolean;\n}\n\n/** Run a hub from `configPath`; resolves only on SIGINT/SIGTERM. */\nexport async function serveHub(opts: ServeHubOptions): Promise<void> {\n    const log = opts.log ?? ((line: string) => process.stderr.write(line + '\\n'));\n    const config = loadHubConfig(opts.configPath);\n    const running = await runHub({\n        config,\n        log,\n        cmdInteractive: opts.cmdInteractive,\n        logMessages: opts.logMessages,\n    });\n    log(`hub running (${running.listeners.length} listener(s)). Ctrl-C to stop.`);\n\n    await new Promise<void>((resolve) => {\n        const stop = (): void => {\n            running.dispose();\n            resolve();\n        };\n        process.once('SIGINT', stop);\n        process.once('SIGTERM', stop);\n    });\n}\n"],"mappings":";;;;;;;;AAkBA,eAAsB,SAAS,MAAsC;CACjE,MAAM,MAAM,KAAK,SAAS,SAAiB,QAAQ,OAAO,MAAM,OAAO,IAAI;CAC3E,MAAM,SAAS,cAAc,KAAK,UAAU;CAC5C,MAAM,UAAU,MAAM,OAAO;EACzB;EACA;EACA,gBAAgB,KAAK;EACrB,aAAa,KAAK;CACtB,CAAC;CACD,IAAI,gBAAgB,QAAQ,UAAU,OAAO,+BAA+B;CAE5E,MAAM,IAAI,SAAe,YAAY;EACjC,MAAM,aAAmB;GACrB,QAAQ,QAAQ;GAChB,QAAQ;EACZ;EACA,QAAQ,KAAK,UAAU,IAAI;EAC3B,QAAQ,KAAK,WAAW,IAAI;CAChC,CAAC;AACL"}

package/dist/spawn.d.ts

@@ -0,0 +1,12 @@
+import { EndpointCommand } from "@hediet/linkrpc/node";
+import { ChildProcess, SpawnOptions } from "node:child_process";
+//#region src/spawn.d.ts
+/**
+ * Spawn a child from a command spec. `{ command }` is run through the OS shell
+ * (so quoting / splitting follows the shell's rules); `{ argv }` is run
+ * directly (no shell), except on Windows where `.cmd` shims need one.
+ */
+declare function spawnCommand(command: EndpointCommand, options: SpawnOptions): ChildProcess;
+//#endregion
+export { spawnCommand };
+//# sourceMappingURL=spawn.d.ts.map

package/dist/spawn.js

@@ -0,0 +1,25 @@
+import { spawn } from "node:child_process";
+//#region src/spawn.ts
+/**
+* Spawn a child from a command spec. `{ command }` is run through the OS shell
+* (so quoting / splitting follows the shell's rules); `{ argv }` is run
+* directly (no shell), except on Windows where `.cmd` shims need one.
+*/
+function spawnCommand(command, options) {
+	if ("argv" in command) {
+		const [bin, ...args] = command.argv;
+		if (!bin) throw new Error("spawnCommand: empty argv command");
+		return spawn(bin, args, {
+			...options,
+			shell: process.platform === "win32"
+		});
+	}
+	return spawn(command.command, {
+		...options,
+		shell: true
+	});
+}
+//#endregion
+export { spawnCommand };
+
+//# sourceMappingURL=spawn.js.map

package/dist/spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.js","names":[],"sources":["../src/spawn.ts"],"sourcesContent":["/**\n * Minimal child-spawn helper used by the hub engine. Kept free of the CLI's\n * connection machinery so the engine has no heavy dependencies. (Socket-path\n * allocation lives on {@link SocketServer.allocSocketPath}.)\n */\nimport { type EndpointCommand } from '@hediet/linkrpc/node';\nimport { type ChildProcess, spawn, type SpawnOptions } from 'node:child_process';\n\n/**\n * Spawn a child from a command spec. `{ command }` is run through the OS shell\n * (so quoting / splitting follows the shell's rules); `{ argv }` is run\n * directly (no shell), except on Windows where `.cmd` shims need one.\n */\nexport function spawnCommand(command: EndpointCommand, options: SpawnOptions): ChildProcess {\n    if ('argv' in command) {\n        const [bin, ...args] = command.argv;\n        if (!bin) throw new Error('spawnCommand: empty argv command');\n        return spawn(bin, args, { ...options, shell: process.platform === 'win32' });\n    }\n    return spawn(command.command, { ...options, shell: true });\n}\n"],"mappings":";;;;;;;AAaA,SAAgB,aAAa,SAA0B,SAAqC;CACxF,IAAI,UAAU,SAAS;EACnB,MAAM,CAAC,KAAK,GAAG,QAAQ,QAAQ;EAC/B,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,kCAAkC;EAC5D,OAAO,MAAM,KAAK,MAAM;GAAE,GAAG;GAAS,OAAO,QAAQ,aAAa;EAAQ,CAAC;CAC/E;CACA,OAAO,MAAM,QAAQ,SAAS;EAAE,GAAG;EAAS,OAAO;CAAK,CAAC;AAC7D"}

package/package.json

@@ -0,0 +1,83 @@
+{
+  "name": "@hediet/linkrpc-hub",
+  "version": "0.0.1",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./hub/server": {
+      "import": "./dist/hub/server/index.js",
+      "types": "./dist/hub/server/index.d.ts"
+    },
+    "./hub/server/client": {
+      "import": "./dist/hub/server/client.js",
+      "types": "./dist/hub/server/client.d.ts"
+    },
+    "./hub/server/transit": {
+      "import": "./dist/hub/server/transit.js",
+      "types": "./dist/hub/server/transit.d.ts"
+    },
+    "./hub/server/connection-token-binder": {
+      "import": "./dist/hub/server/connectionTokenBinder.js",
+      "types": "./dist/hub/server/connectionTokenBinder.d.ts"
+    },
+    "./hub/server/node": {
+      "import": "./dist/hub/server/node/index.js",
+      "types": "./dist/hub/server/node/index.d.ts"
+    },
+    "./config": {
+      "import": "./dist/config.js",
+      "types": "./dist/config.d.ts"
+    },
+    "./config-file": {
+      "import": "./dist/configFile.js",
+      "types": "./dist/configFile.d.ts"
+    },
+    "./spawn": {
+      "import": "./dist/spawn.js",
+      "types": "./dist/spawn.d.ts"
+    },
+    "./serve": {
+      "import": "./dist/serve.js",
+      "types": "./dist/serve.d.ts"
+    },
+    "./engine/runHub": {
+      "import": "./dist/engine/runHub.js",
+      "types": "./dist/engine/runHub.d.ts"
+    }
+  },
+  "bin": {
+    "linkrpc-hub": "./dist/cli.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@vscode/observables": "0.1.1-0",
+    "commander": "^12.1.0",
+    "ws": "^8.18.0",
+    "zod": "^4.4.3",
+    "@hediet/linkrpc": "0.0.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/ws": "^8.5.13",
+    "tsdown": "^0.22.3",
+    "tsx": "4.22.4",
+    "typescript": "^6.0.3",
+    "vitest": "^3.0.0",
+    "@hediet/linkrpc-infra": "0.0.1"
+  },
+  "scripts": {
+    "start": "tsx src/cli.ts",
+    "build": "tsdown",
+    "pack": "pnpm build && pnpm pack",
+    "dev": "tsdown --watch",
+    "test": "vitest --run",
+    "test:watch": "vitest"
+  }
+}