@hediet/linkrpc-hub 0.0.1

package/dist/chunks/hubConnectionAcceptor-B5-8JsFY.js

@@ -0,0 +1,2768 @@
+import { t as connectionTokenBinderInterface } from "./connectionTokenBinder.interfaces-B-beCg06.js";
+import { ErrorCode, LinkRpcConnection, RpcError, STREAM_METHOD, StreamControlReason, StreamControlType, StreamDir, TransportPair, directoryInterface, directoryWatchNever, isNotification, isRequest, isResponse, methodNameToTarget, nodeInterface, parseMethodName, permits, registerLazyIdentityOnOverlay, schemasInterface, verifyCall, verifyRpcCall } from "@hediet/linkrpc";
+import { ROOT_SERVICE_ID, SERVICE_ID_SEPARATOR, hubGrantedServiceIdInterface, hubServiceIdRegistryInterface, isServiceIdUnder, isValidServiceId, normalizeServiceIdScopes, serviceIdMatchesScopes } from "@hediet/linkrpc/hub/common";
+import { randomUUID } from "node:crypto";
+import { BoundedTrafficSubscription, TrafficWatchFlowTracker, nodeInterface as nodeInterface$1, topologyInterface, trafficInterface } from "@hediet/linkrpc/inspection";
+import { safeParse } from "zod/v4/core";
+//#region src/hub/server/routing/forwardingTable.ts
+/**
+* A longest-prefix routing table keyed by {@link ServiceId} prefixes — the
+* hub's equivalent of an IP forwarding table.
+*
+* A prefix `"a/b"` owns every serviceId equal to it or beneath it
+* (`"a/b"`, `"a/b/c"`, …) *unless* a longer claimed prefix matches first.
+* Matching is segment-aware: `"a/bc"` is **not** under `"a/b"`.
+*
+* The table is intentionally a plain stateful container with no opinion on
+* *who* may claim what — that policy lives in {@link Hub.claimPrefix}. This
+* keeps the data structure trivially testable in isolation.
+*/
+var ForwardingTable = class {
+	_entries = /* @__PURE__ */ new Map();
+	/**
+	* Reverse index: value → the set of prefixes claimed for it. Kept in
+	* lock-step with {@link _entries} so {@link deleteByValue} (used when a
+	* link detaches) is O(claims-for-that-value) instead of an O(size) scan.
+	*/
+	_prefixesByValue = /* @__PURE__ */ new Map();
+	/** Number of claimed prefixes. */
+	get size() {
+		return this._entries.size;
+	}
+	has(prefix) {
+		return this._entries.has(prefix);
+	}
+	get(prefix) {
+		return this._entries.get(prefix);
+	}
+	/**
+	* Claim `prefix` for `value`. Overwrites any existing claim — callers
+	* that want claim-once semantics must check {@link has} first (the hub
+	* does).
+	*/
+	set(prefix, value) {
+		const prev = this._entries.get(prefix);
+		if (prev !== void 0 && prev !== value) this._dropFromIndex(prev, prefix);
+		this._entries.set(prefix, value);
+		let prefixes = this._prefixesByValue.get(value);
+		if (!prefixes) {
+			prefixes = /* @__PURE__ */ new Set();
+			this._prefixesByValue.set(value, prefixes);
+		}
+		prefixes.add(prefix);
+	}
+	delete(prefix) {
+		const value = this._entries.get(prefix);
+		if (value === void 0) return false;
+		this._entries.delete(prefix);
+		this._dropFromIndex(value, prefix);
+		return true;
+	}
+	/**
+	* Remove every claim bound to `value` (matched by reference/equality).
+	* O(number of prefixes that value owns). Returns the removed prefixes.
+	*/
+	deleteByValue(value) {
+		const prefixes = this._prefixesByValue.get(value);
+		if (!prefixes) return [];
+		this._prefixesByValue.delete(value);
+		for (const prefix of prefixes) this._entries.delete(prefix);
+		return [...prefixes];
+	}
+	_dropFromIndex(value, prefix) {
+		const prefixes = this._prefixesByValue.get(value);
+		if (!prefixes) return;
+		prefixes.delete(prefix);
+		if (prefixes.size === 0) this._prefixesByValue.delete(value);
+	}
+	entries() {
+		return this._entries.entries();
+	}
+	prefixes() {
+		return [...this._entries.keys()];
+	}
+	/**
+	* Find the value owning the longest claimed prefix of `serviceId`.
+	* Walks up the `'/'` segments — `"a/b/c"` tries `"a/b/c"`, `"a/b"`,
+	* `"a"` in that order — and returns the first hit, or `undefined` if
+	* none of its ancestors are claimed.
+	*/
+	longestPrefixMatch(serviceId) {
+		let candidate = serviceId;
+		while (candidate.length > 0) {
+			const value = this._entries.get(candidate);
+			if (value !== void 0) return {
+				prefix: candidate,
+				value
+			};
+			const slash = candidate.lastIndexOf(SERVICE_ID_SEPARATOR);
+			if (slash === -1) break;
+			candidate = candidate.slice(0, slash);
+		}
+	}
+};
+/**
+* Validate a forwarding-table **prefix**: a non-root {@link ServiceId}. The
+* root (`""`) is a valid service id but cannot be claimed as a prefix (it
+* would capture every address); the uplink is the route of last resort
+* instead. Returns an error string, or `undefined` when well-formed.
+*/
+function validatePrefix(prefix) {
+	if (typeof prefix !== "string" || prefix === ROOT_SERVICE_ID) return "prefix required";
+	if (!isValidServiceId(prefix)) return "prefix must be a valid serviceId (no leading/trailing/empty '/' segments)";
+}
+//#endregion
+//#region src/hub/server/routing/participantRoots.ts
+/** Reconciles participant-root queries and watches over the Hub's routing links. */
+var ParticipantRoots = class {
+	_options;
+	constructor(_options) {
+		this._options = _options;
+	}
+	async query(method, params, excludePrefix) {
+		return (await Promise.all([...this._participantLinks(excludePrefix)].map((link) => this._options.requestOnLink(link, method, params).then((result) => result, () => void 0)))).filter((result) => result !== void 0);
+	}
+	watch(method, params, onTick, excludePrefix) {
+		const watches = /* @__PURE__ */ new Map();
+		let disposed = false;
+		const stopState = (state) => {
+			if (state.retry !== void 0) clearTimeout(state.retry);
+			state.retry = void 0;
+			state.watch?.dispose();
+			state.watch = void 0;
+		};
+		const start = (link, state) => {
+			if (disposed || !this._participantLinks(excludePrefix).has(link)) return;
+			state.watch = this._options.watchOnLink(link, method, params, onTick, () => {
+				queueMicrotask(() => {
+					if (disposed || watches.get(link) !== state) return;
+					state.watch = void 0;
+					state.retry = setTimeout(() => {
+						state.retry = void 0;
+						start(link, state);
+					}, state.retryDelayMs);
+					state.retryDelayMs = Math.min(5e3, state.retryDelayMs * 2);
+				});
+			}, () => {
+				state.retryDelayMs = 200;
+				onTick();
+			});
+		};
+		const reconcile = () => {
+			const current = this._participantLinks(excludePrefix);
+			for (const [link, state] of watches) {
+				if (current.has(link)) continue;
+				stopState(state);
+				watches.delete(link);
+			}
+			for (const link of current) {
+				if (watches.has(link)) continue;
+				const state = { retryDelayMs: 200 };
+				watches.set(link, state);
+				start(link, state);
+			}
+		};
+		reconcile();
+		const unsubscribe = this._options.onDidChangeRouting(reconcile);
+		return { dispose: () => {
+			if (disposed) return;
+			disposed = true;
+			unsubscribe();
+			for (const state of watches.values()) stopState(state);
+			watches.clear();
+		} };
+	}
+	_participantLinks(excludePrefix) {
+		const exclude = excludePrefix !== void 0 ? this._options.prefixOwner(excludePrefix) : void 0;
+		const uplink = this._options.uplink();
+		const links = /* @__PURE__ */ new Set();
+		for (const [, link] of this._options.forwardingEntries()) {
+			if (link === exclude || link === uplink) continue;
+			links.add(link);
+		}
+		return links;
+	}
+};
+//#endregion
+//#region src/hub/server/routing/peerDiscovery.ts
+const GET_NODE_ID_METHOD = `${nodeInterface$1.info.id}::getNodeId`;
+/** Background policy for direct-peer identity; forwarding never waits for it. */
+var PeerDiscovery = class {
+	_options;
+	_peers = /* @__PURE__ */ new WeakMap();
+	_timeoutMs;
+	constructor(_options) {
+		this._options = _options;
+		this._timeoutMs = _options.timeoutMs ?? 1e3;
+		if (!Number.isFinite(this._timeoutMs) || this._timeoutMs <= 0) throw new Error("peerIdentificationTimeoutMs must be a positive finite number");
+	}
+	attach(link) {
+		if (this._peers.has(link)) return;
+		const state = {
+			status: "pending",
+			retryDelayMs: 200
+		};
+		this._peers.set(link, state);
+		this._schedule(link, state, 0);
+	}
+	detach(link) {
+		const state = this._peers.get(link);
+		if (state?.timer !== void 0) clearTimeout(state.timer);
+		this._peers.delete(link);
+	}
+	info(link) {
+		return this._peers.get(link)?.info;
+	}
+	status(link) {
+		return this._peers.get(link)?.status ?? "pending";
+	}
+	identify(link) {
+		const state = this._peers.get(link);
+		if (state === void 0) return Promise.reject(/* @__PURE__ */ new Error("identifyPeer: link is detached"));
+		if (state.info !== void 0) return Promise.resolve(state.info);
+		if (state.attempt !== void 0) return state.attempt;
+		if (state.timer !== void 0) clearTimeout(state.timer);
+		state.timer = void 0;
+		const attempt = Promise.resolve().then(async () => {
+			if (this._peers.get(link) !== state) throw new Error("identifyPeer: link is detached");
+			const raw = await this._options.request(link, this._timeoutMs);
+			const parsed = safeParse(nodeInterface$1.members.getNodeId.resultSchema, raw);
+			if (!parsed.success || parsed.data.nodeId.length === 0 || parsed.data.portId.length === 0) throw new Error(`identifyPeer: invalid result from ${GET_NODE_ID_METHOD}`);
+			const info = parsed.data;
+			if (this._peers.get(link) !== state) throw new Error("identifyPeer: link is detached");
+			state.info = info;
+			state.status = "identified";
+			this._options.onDidChange();
+			return info;
+		}).catch((error) => {
+			if (this._peers.get(link) === state) {
+				const status = error instanceof RpcError && error.code === ErrorCode.methodNotFound ? "unsupported" : "error";
+				if (state.status !== status) {
+					state.status = status;
+					this._options.onDidChange();
+				}
+				const delay = state.status === "unsupported" ? 3e4 : state.retryDelayMs;
+				state.retryDelayMs = Math.min(5e3, state.retryDelayMs * 2);
+				this._schedule(link, state, delay * (.8 + Math.random() * .4));
+			}
+			throw new Error(`identifyPeer: ${GET_NODE_ID_METHOD} failed: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+		}).finally(() => {
+			state.attempt = void 0;
+		});
+		state.attempt = attempt;
+		return attempt;
+	}
+	_schedule(link, state, delayMs) {
+		if (this._peers.get(link) !== state) return;
+		state.timer = setTimeout(() => {
+			state.timer = void 0;
+			if (this._peers.get(link) !== state) return;
+			this.identify(link).catch(() => {});
+		}, delayMs);
+		state.timer.unref();
+	}
+};
+//#endregion
+//#region src/hub/server/routing/routingTopology.ts
+/**
+* Owns the Hub's inspection-facing topology state. Routing remains in Hub;
+* this class only consumes snapshots and low-level request callbacks.
+*/
+var RoutingTopology = class {
+	_options;
+	_portIds = /* @__PURE__ */ new WeakMap();
+	_handleLinks = /* @__PURE__ */ new WeakMap();
+	_peers;
+	_inspectionServices = /* @__PURE__ */ new WeakMap();
+	_managedRoutingTopologies = /* @__PURE__ */ new WeakMap();
+	_managedTopologyFragments = /* @__PURE__ */ new Set();
+	constructor(_options) {
+		this._options = _options;
+		this._peers = new PeerDiscovery({
+			timeoutMs: _options.peerIdentificationTimeoutMs,
+			request: (link, timeoutMs) => _options.requestOnLink(link, GET_NODE_ID_METHOD, {}, timeoutMs),
+			onDidChange: _options.onDidChange
+		});
+	}
+	attachLink(link) {
+		this._peers.attach(link);
+	}
+	portId(link) {
+		let id = this._portIds.get(link);
+		if (id === void 0) {
+			id = this._options.generateTopologyId("port");
+			this._portIds.set(link, id);
+		}
+		return id;
+	}
+	registerHandle(handle, link) {
+		this._handleLinks.set(handle, link);
+	}
+	identifyPeer(link) {
+		return this._peers.identify(link);
+	}
+	registerManagedRoutingTopology(attached, topology) {
+		const link = this._attachedLink(attached, "registerManagedRoutingTopology");
+		this._managedRoutingTopologies.set(link, topology);
+		this._options.onDidChange();
+		let disposed = false;
+		return { dispose: () => {
+			if (disposed) return;
+			disposed = true;
+			if (this._managedRoutingTopologies.get(link) !== topology) return;
+			this._managedRoutingTopologies.delete(link);
+			this._options.onDidChange();
+		} };
+	}
+	registerManagedTopologyFragment(fragment) {
+		this._managedTopologyFragments.add(fragment);
+		this._options.onDidChange();
+		let disposed = false;
+		return { dispose: () => {
+			if (disposed) return;
+			disposed = true;
+			this._managedTopologyFragments.delete(fragment);
+			this._options.onDidChange();
+		} };
+	}
+	markInspectionService(attached, serviceId) {
+		const link = this._attachedLink(attached, "markInspectionService");
+		let services = this._inspectionServices.get(link);
+		if (services === void 0) {
+			services = /* @__PURE__ */ new Set();
+			this._inspectionServices.set(link, services);
+		}
+		services.add(serviceId);
+	}
+	isInspectionService(link, serviceId) {
+		return this._inspectionServices.get(link)?.has(serviceId) === true;
+	}
+	getTopologyGraph(observerServiceId) {
+		const allLinks = [...this._options.links()];
+		const visibleLinks = allLinks.filter((link) => !this._inspectionServices.has(link));
+		const hubPorts = allLinks.map((link) => ({
+			portId: this.portId(link),
+			label: this._options.edgeId(link)
+		}));
+		for (const link of visibleLinks) for (const hubLink of this._managedRoutingTopologies.get(link)?.hubLinks ?? []) if (!hubPorts.some((port) => port.portId === hubLink.hubPortId)) hubPorts.push({
+			portId: hubLink.hubPortId,
+			label: hubLink.label ?? hubLink.hubPortId
+		});
+		const nodes = [{
+			nodeId: this._options.nodeId,
+			kind: "hub",
+			...this._options.debugName !== void 0 ? { label: this._options.debugName } : {},
+			...this._options.descriptors !== void 0 ? { descriptors: [...this._options.descriptors] } : {},
+			ports: hubPorts
+		}];
+		const peerNodes = /* @__PURE__ */ new Map();
+		const links = [];
+		for (const link of visibleLinks) {
+			const peer = this._topologyPeer(link);
+			const managed = this._managedRoutingTopologies.get(link);
+			let peerNode = peerNodes.get(peer.nodeId);
+			if (peerNode === void 0) {
+				peerNode = {
+					nodeId: peer.nodeId,
+					ports: []
+				};
+				peerNodes.set(peer.nodeId, peerNode);
+				nodes.push(peerNode);
+			}
+			if (!peerNode.ports.some((port) => port.portId === peer.portId)) peerNode.ports.push({ portId: peer.portId });
+			if (managed !== void 0) {
+				nodes.push({
+					...managed.node,
+					ports: [...managed.node.ports]
+				});
+				for (const adjacentNode of managed.adjacentNodes ?? []) nodes.push({
+					...adjacentNode,
+					ports: [...adjacentNode.ports]
+				});
+				for (const hubLink of managed.hubLinks) links.push({
+					from: {
+						nodeId: this._options.nodeId,
+						portId: hubLink.hubPortId
+					},
+					to: {
+						nodeId: managed.node.nodeId,
+						portId: hubLink.nodePortId
+					},
+					...hubLink.label !== void 0 ? { label: hubLink.label } : {}
+				});
+				links.push({
+					from: {
+						nodeId: managed.node.nodeId,
+						portId: managed.peerPortId
+					},
+					to: peer,
+					...managed.peerLinkLabel !== void 0 ? { label: managed.peerLinkLabel } : {},
+					...managed.peerTransport !== void 0 ? { transport: managed.peerTransport } : {},
+					peerState: this._peers.status(link)
+				});
+				links.push(...managed.adjacentLinks ?? []);
+				continue;
+			}
+			const transport = this._options.transportInfo(link);
+			links.push({
+				from: {
+					nodeId: this._options.nodeId,
+					portId: this.portId(link)
+				},
+				to: peer,
+				label: this._options.edgeId(link),
+				peerState: this._peers.status(link),
+				...transport !== void 0 ? { transport } : {}
+			});
+		}
+		const routes = [];
+		for (const [serviceId, link] of this._options.forwardingEntries()) {
+			if (this.isInspectionService(link, serviceId)) {
+				routes.push({
+					serviceId,
+					nodeId: this._options.nodeId,
+					portId: this.portId(link),
+					match: "prefix"
+				});
+				continue;
+			}
+			const peer = this._topologyPeer(link);
+			routes.push({
+				serviceId,
+				nodeId: peer.nodeId,
+				portId: peer.portId,
+				match: "prefix"
+			});
+		}
+		for (const fragment of this._managedTopologyFragments) {
+			nodes.push(...fragment.nodes.map((node) => ({
+				...node,
+				ports: [...node.ports]
+			})));
+			links.push(...fragment.links ?? []);
+			routes.push(...fragment.routes ?? []);
+		}
+		return {
+			observerServiceId,
+			entryNodeId: this._options.nodeId,
+			nodes,
+			links,
+			routes
+		};
+	}
+	cleanupLink(link) {
+		this._inspectionServices.delete(link);
+		this._peers.detach(link);
+		this._managedRoutingTopologies.delete(link);
+	}
+	_attachedLink(attached, operation) {
+		const link = this._handleLinks.get(attached);
+		if (link === void 0 || !this._options.isAttached(link)) throw new Error(`${operation}: link is not attached to this hub`);
+		return link;
+	}
+	_topologyPeer(link) {
+		const identified = this._peers.info(link);
+		if (identified !== void 0) return identified;
+		const localPortId = this.portId(link);
+		return {
+			nodeId: `${this._options.nodeId}:unidentified:${localPortId}`,
+			portId: `unidentified:${localPortId}`
+		};
+	}
+};
+//#endregion
+//#region src/hub/server/routing/routingHub.ts
+const DEFAULT_IDLE_TIMEOUT_MS = 18e5;
+/**
+* A **Hub** is the entire routing concept of linkrpc v2 — the only noun.
+* It is a tiny message router with an unauthenticated topology-correlation
+* identity and exactly three moving
+* parts, all expressed as {@link IMessageTransport} links:
+*
+* - **forwarding table** — longest-prefix serviceId → link map (the
+*   downstream neighbours / claimed subnets).
+* - **loopback** — an optional link to the local root services (`bare`/
+*   `interface`-form calls land here and *never* leave the hub). This is
+*   the routing equivalent of `127.0.0.1`.
+* - **uplink** — an optional default route. A hub *with* an uplink is also
+*   a participant of its parent hub, which is how hubs **nest** (a VS Code
+*   window hub uplinks to an OS hub uplinks to a home-server hub).
+*
+* Routing is pure longest-prefix forwarding with JSON-RPC id rewriting:
+* a forwarded request keeps its full method name verbatim; only its `id`
+* is swapped for a hub-local one so responses can be demultiplexed back to
+* the originating link. There is no notion of identity, capabilities, or
+* trust at this layer — those are policies layered on top.
+*
+* The single privileged write seam is {@link claimPrefix}; everything else
+* is mechanical message shuffling.
+*/
+var Hub = class {
+	_options;
+	/** Unauthenticated topology-correlation identity for this hub. */
+	nodeId;
+	_table = new ForwardingTable();
+	_links = /* @__PURE__ */ new Set();
+	_pending = /* @__PURE__ */ new Map();
+	_uplink;
+	_loopback;
+	_nextId = 1;
+	_log;
+	_transitObservers = /* @__PURE__ */ new Set();
+	/**
+	* Listeners notified whenever the forwarding table changes (a prefix is
+	* claimed or released, or a link detaches dropping its claims). Coarse, by
+	* design: it carries no payload — consumers re-query the directory. This is
+	* the "poll now" nudge that backs `hubrpc.directory::watch`.
+	*/
+	_routingListeners = /* @__PURE__ */ new Set();
+	_topologyListeners = /* @__PURE__ */ new Set();
+	/** Stable inspection label per link; assigned lazily / by prefix claim. */
+	_edgeIds = /* @__PURE__ */ new WeakMap();
+	_transportInfo = /* @__PURE__ */ new WeakMap();
+	_nextEdgeId = 1;
+	_topology;
+	_participantRoots;
+	/** Per-request idle timeout in ms; `<= 0` disables. See {@link HubOptions.idleTimeoutMs}. */
+	_idleMs;
+	constructor(_options = {}) {
+		this._options = _options;
+		const generateTopologyId = _options.generateTopologyId ?? (() => randomUUID());
+		this.nodeId = _options.nodeId ?? generateTopologyId("node");
+		this._log = _options.logger;
+		if (_options.onTransit !== void 0) this._transitObservers.add(_options.onTransit);
+		this._idleMs = _options.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
+		this._topology = new RoutingTopology({
+			nodeId: this.nodeId,
+			generateTopologyId,
+			debugName: _options.debugName,
+			descriptors: _options.descriptors,
+			peerIdentificationTimeoutMs: _options.peerIdentificationTimeoutMs,
+			links: () => this._links,
+			forwardingEntries: () => this._table.entries(),
+			edgeId: (link) => this._edgeId(link),
+			transportInfo: (link) => this._transportInfo.get(link),
+			isAttached: (link) => this._links.has(link),
+			requestOnLink: (link, method, params, timeoutMs) => this._requestOnLink(link, method, params, timeoutMs),
+			onDidChange: () => this._fireTopologyChanged()
+		});
+		this._participantRoots = new ParticipantRoots({
+			forwardingEntries: () => this._table.entries(),
+			prefixOwner: (prefix) => this._table.get(prefix),
+			uplink: () => this._uplink,
+			requestOnLink: (link, method, params) => this._requestOnLink(link, method, params),
+			watchOnLink: (link, method, params, onTick, onSettled, onEstablished) => this._watchOnLink(link, method, params, onTick, onSettled, onEstablished),
+			onDidChangeRouting: (listener) => this.onDidChangeRouting(listener)
+		});
+	}
+	/** Prefix for log lines; identifies this hub when nested. */
+	_tag() {
+		return this._options.debugName !== void 0 ? `[${this._options.debugName}] ` : "";
+	}
+	/** Stable inspection label for a link; auto-assigned on first use. */
+	_edgeId(link) {
+		let id = this._edgeIds.get(link);
+		if (id === void 0) {
+			id = `e${this._nextEdgeId++}`;
+			this._edgeIds.set(link, id);
+		}
+		return id;
+	}
+	/** Give `link` a friendly inspection label (prefix / loopback / uplink). */
+	_labelEdge(link, label) {
+		const cur = this._edgeIds.get(link);
+		if (cur === void 0 || /^e\d+$/.test(cur)) this._edgeIds.set(link, label);
+	}
+	/** Emit a pre-built node transit. Callers guard construction by observer count. */
+	_emit(t) {
+		for (const observer of [...this._transitObservers]) try {
+			observer(t);
+		} catch (err) {
+			this._log?.warn(`${this._tag()}transit observer threw: ${String(err)}`);
+		}
+	}
+	_transitEndpoint(link, requestId) {
+		return {
+			edgeId: this._edgeId(link),
+			portId: this._topology.portId(link),
+			...requestId !== void 0 ? { requestId } : {}
+		};
+	}
+	/** Number of live transit observers. */
+	get transitObserverCount() {
+		return this._transitObservers.size;
+	}
+	/** Observe routed messages until the returned handle is disposed. */
+	observeTransits(observer) {
+		this._transitObservers.add(observer);
+		let disposed = false;
+		return { dispose: () => {
+			if (disposed) return;
+			disposed = true;
+			this._transitObservers.delete(observer);
+		} };
+	}
+	/**
+	* Publish a transit from a routing node managed by this Hub. Callers should
+	* check {@link transitObserverCount} before constructing the transit.
+	*/
+	publishManagedTransit(transit) {
+		if (this._transitObservers.size === 0) return;
+		this._emit(transit);
+	}
+	/** Replace an attached link's direct topology edge with a managed routing node. */
+	registerManagedRoutingTopology(attached, topology) {
+		return this._topology.registerManagedRoutingTopology(attached, topology);
+	}
+	/** Add an in-process endpoint or routing fragment to this Hub's topology. */
+	registerManagedTopologyFragment(fragment) {
+		return this._topology.registerManagedTopologyFragment(fragment);
+	}
+	/**
+	* Subscribe to coarse routing-table changes (prefix claim/release/detach).
+	* The listener receives no arguments — it is a "something changed; re-query"
+	* nudge. Returns an unsubscribe function.
+	*/
+	onDidChangeRouting(listener) {
+		this._routingListeners.add(listener);
+		return () => {
+			this._routingListeners.delete(listener);
+		};
+	}
+	/** Subscribe to topology changes, including routing and background peer discovery. */
+	onDidChangeTopology(listener) {
+		this._topologyListeners.add(listener);
+		return () => {
+			this._topologyListeners.delete(listener);
+		};
+	}
+	/** Number of active routing invalidation observers. */
+	get routingObserverCount() {
+		return this._routingListeners.size;
+	}
+	get topologyObserverCount() {
+		return this._topologyListeners.size;
+	}
+	/** Fire all routing-change listeners. Best-effort; one throwing listener does not block the rest. */
+	_fireRoutingChanged() {
+		this._notifyListeners(this._routingListeners);
+		this._fireTopologyChanged();
+	}
+	_fireTopologyChanged() {
+		this._notifyListeners(this._topologyListeners);
+	}
+	_notifyListeners(listeners) {
+		for (const listener of [...listeners]) try {
+			listener();
+		} catch (err) {
+			this._log?.warn(`${this._tag()}change listener threw: ${String(err)}`);
+		}
+	}
+	/** Emit a stream transit with the owning request's correlated endpoints. */
+	_emitStream(note, inEp, outEp) {
+		if (this._transitObservers.size === 0) return;
+		this._emit({
+			timeMs: Date.now(),
+			nodeId: this.nodeId,
+			in: inEp,
+			out: outEp,
+			disposition: "forwarded",
+			kind: "stream",
+			method: STREAM_METHOD,
+			params: note.params
+		});
+	}
+	/**
+	* Snapshot the requests currently in flight through this hub. Each row is
+	* one {@link _pending} entry — the authoritative in-flight set — annotated
+	* with its method, the edges it bridges, and how long it has waited. Useful
+	* for surfacing stuck/slow requests in an inspector.
+	*/
+	pendingRequests() {
+		const now = Date.now();
+		const out = [];
+		for (const [hubId, p] of this._pending) out.push({
+			hubId,
+			originalId: p.originalId,
+			method: p.method,
+			originEdgeId: this._edgeId(p.origin),
+			targetEdgeId: this._edgeId(p.target),
+			ageMs: now - p.startedAtMs
+		});
+		return out;
+	}
+	/**
+	* Begin routing the messages of `link`. The hub installs itself as the
+	* link's listener; do not also attach another listener. Returns a
+	* disposable that stops routing the link (detaching the listener and
+	* dropping any forwarding entries, uplink/loopback slots, and pending
+	* responses bound to it) when disposed. Peer discovery starts in the
+	* background; unresolved or unsupported peers never block routing.
+	*/
+	attach(link, opts) {
+		const prefixes = opts?.routePrefixes ?? [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const prefix of prefixes) {
+			this._validatePrefixClaim(prefix);
+			if (seen.has(prefix)) throw new Error(`claimPrefix: duplicate prefix '${prefix}'`);
+			seen.add(prefix);
+		}
+		if (opts?.exclusiveHubRootHandler === true && this._loopback !== void 0 && this._loopback !== link) throw new Error("exclusiveHubRootHandler: another link is already the hub-root handler");
+		if (opts?.edgeId !== void 0) this._edgeIds.set(link, opts.edgeId);
+		if (opts?.transport !== void 0) this._transportInfo.set(link, opts.transport);
+		let disposed = false;
+		const handle = {
+			dispose: () => {
+				if (disposed) return;
+				disposed = true;
+				this._detach(link);
+			},
+			setAsLoopback: () => {
+				if (disposed || !this._links.has(link)) throw new Error("setAsLoopback: link is detached");
+				this.setLoopback(link);
+			},
+			addPrefixRoute: (prefix) => this.claimPrefix(link, prefix),
+			releasePrefix: (prefix) => this.releasePrefix(prefix),
+			edgeId: this._edgeId(link),
+			portId: this._topology.portId(link),
+			identifyPeer: () => this._topology.identifyPeer(link),
+			request: (method, params, timeoutMs) => this._requestOnLink(link, method, params, timeoutMs)
+		};
+		this._topology.registerHandle(handle, link);
+		const isNew = !this._links.has(link);
+		const loopbackChanged = opts?.exclusiveHubRootHandler === true && this._loopback !== link;
+		if (isNew) {
+			this._links.add(link);
+			this._topology.attachLink(link);
+		}
+		if (opts?.exclusiveHubRootHandler === true) {
+			this._loopback = link;
+			this._labelEdge(link, "loopback");
+		}
+		for (const prefix of prefixes) this._claimPrefix(link, prefix);
+		if (isNew) link.setListener((m) => this._onMessage(link, m));
+		if (isNew || loopbackChanged || prefixes.length !== 0) this._fireRoutingChanged();
+		return handle;
+	}
+	/**
+	* Attach a fresh in-memory link and hand back its far end alongside the
+	* {@link AttachedLink} handle. Creates a {@link TransportPair} internally,
+	* {@link attach}es the near side to the hub, and returns the attach handle
+	* augmented with `transport` — the far side for a peer (a consumer
+	* connection, an in-process participant, …) to drive. Equivalent to
+	* `const p = new TransportPair(); const link = hub.attach(p.a);
+	* return { ...link, transport: p.b };`. Disposing the returned link also
+	* disposes `transport`.
+	*/
+	attachOut(opts) {
+		const pair = new TransportPair();
+		const link = this.attach(pair.a, opts);
+		const result = {
+			...link,
+			transport: pair.b,
+			dispose: () => {
+				link.dispose();
+				pair.b.dispose();
+			}
+		};
+		this._topology.registerHandle(result, pair.a);
+		return result;
+	}
+	_detach(link) {
+		if (!this._links.has(link)) return;
+		link.setListener(void 0);
+		this._links.delete(link);
+		this._topology.cleanupLink(link);
+		this._table.deleteByValue(link);
+		if (this._uplink === link) this._uplink = void 0;
+		if (this._loopback === link) this._loopback = void 0;
+		for (const [id, p] of [...this._pending]) if (p.origin === link) {
+			this._injectCancel(p.target, id, StreamControlReason.clientDisconnected);
+			if (this._transitObservers.size !== 0) this._emit({
+				timeMs: Date.now(),
+				nodeId: this.nodeId,
+				in: this._transitEndpoint(p.target, id),
+				disposition: "dropped",
+				kind: "response",
+				method: p.method,
+				error: {
+					code: ErrorCode.peerDisconnected,
+					message: "origin disconnected"
+				}
+			});
+			this._deletePending(id);
+		} else if (p.target === link) {
+			this._deletePending(id);
+			this._log?.warn(`${this._tag()}target detached mid-request (hubId=${id}); failing origin`);
+			if (this._transitObservers.size !== 0) this._emit({
+				timeMs: Date.now(),
+				nodeId: this.nodeId,
+				in: this._transitEndpoint(p.target, id),
+				out: this._transitEndpoint(p.origin, p.originalId),
+				disposition: "forwarded",
+				kind: "response",
+				method: p.method,
+				error: {
+					code: ErrorCode.peerDisconnected,
+					message: "target detached before responding"
+				}
+			});
+			this._replyError(p.origin, p.originalId, ErrorCode.peerDisconnected, "target detached before responding");
+		}
+		this._fireRoutingChanged();
+	}
+	/** Set (or clear) the default route. Automatically attaches the link. */
+	setUplink(link) {
+		const changed = this._uplink !== link;
+		this._uplink = link;
+		if (link) {
+			this.attach(link);
+			this._labelEdge(link, "uplink");
+		}
+		if (changed) this._fireRoutingChanged();
+	}
+	/** Set (or clear) the root handler. Clear the existing handler before assigning a different link. */
+	setLoopback(link) {
+		if (link !== void 0) this.attach(link, { exclusiveHubRootHandler: true });
+		else if (this._loopback !== void 0) {
+			this._loopback = void 0;
+			this._fireRoutingChanged();
+		}
+	}
+	/**
+	* Bind a serviceId `prefix` to `link`. Like initial attachment routes,
+	* this is a privileged operation; higher layers enforce who may claim.
+	*
+	* Claim-once: throws if the prefix is malformed or already owned.
+	*/
+	claimPrefix(link, prefix) {
+		this.attach(link, { routePrefixes: [prefix] });
+	}
+	_validatePrefixClaim(prefix) {
+		const err = validatePrefix(prefix);
+		if (err) throw new Error(`claimPrefix: ${err}`);
+		if (this._table.has(prefix)) throw new Error(`claimPrefix: prefix '${prefix}' is already claimed`);
+	}
+	_claimPrefix(link, prefix) {
+		this._table.set(prefix, link);
+		this._labelEdge(link, prefix);
+		this._log?.debug(`${this._tag()}claim prefix '${prefix}'`);
+	}
+	releasePrefix(prefix) {
+		const released = this._table.delete(prefix);
+		if (released) {
+			this._log?.debug(`${this._tag()}release prefix '${prefix}'`);
+			this._fireRoutingChanged();
+		}
+		return released;
+	}
+	/** Snapshot of currently-claimed prefixes. */
+	claimedPrefixes() {
+		return this._table.prefixes();
+	}
+	/**
+	* Trust the inspection interfaces mounted for `serviceId` on this attached
+	* in-process link. Only exact reserved inspection interface calls are hidden.
+	*/
+	markInspectionService(attached, serviceId) {
+		this._topology.markInspectionService(attached, serviceId);
+	}
+	/** Build a topology snapshot on demand for the addressed observer service. */
+	getTopologyGraph(observerServiceId) {
+		return this._topology.getTopologyGraph(observerServiceId);
+	}
+	/**
+	* Fan a **root-form** request out to every distinct downstream participant
+	* link (the claimed-prefix owners), skipping the link that owns
+	* `excludePrefix` (typically the hub's own services prefix) and the uplink.
+	* Each participant is queried **once** even if it owns several prefixes.
+	* Failures (unreachable participant, timeout, no root handler) are dropped,
+	* so the result holds one entry per link that answered.
+	*
+	* The request is delivered to each participant's **root** services — on an
+	* overlay uplink the splitter routes a root-form method to the participant
+	* (`H·root → P`), which is never forwarded and never gated. That is what
+	* lets the hub's global directory gather participant self-listings without
+	* signing or capabilities.
+	*/
+	async queryParticipantRoots(method, params, excludePrefix) {
+		return this._participantRoots.query(method, params, excludePrefix);
+	}
+	/**
+	* Keep a root-form streaming request open on every current participant.
+	* Routing changes reconcile the participant set; application stream payloads
+	* are collapsed into a coarse callback so callers can re-query.
+	*/
+	watchParticipantRoots(method, params, onTick, excludePrefix) {
+		return this._participantRoots.watch(method, params, onTick, excludePrefix);
+	}
+	/**
+	* Send a single request down `link` and resolve with its result — the
+	* hub-originated analogue of {@link _routeRequest}. It allocates a hub id,
+	* parks a {@link _pending} entry whose `origin` is a tiny in-memory sink
+	* that settles this promise on the matching response, and writes the
+	* request to `link`. It therefore reuses the full demux / idle-timeout /
+	* detach machinery: a response routes back through {@link _demux} into the
+	* sink, an idle target fails it via {@link _onIdleTimeout}, and a detaching
+	* target fails it via {@link _detach}.
+	*/
+	_requestOnLink(link, method, params, timeoutMs) {
+		return new Promise((resolve, reject) => {
+			const hubId = this._nextId++;
+			const key = String(hubId);
+			let settled = false;
+			let requestTimeout;
+			const finish = (error, result) => {
+				if (settled) return;
+				settled = true;
+				if (requestTimeout !== void 0) clearTimeout(requestTimeout);
+				if (error !== void 0) reject(error);
+				else resolve(result);
+			};
+			const origin = {
+				send: (m) => {
+					const r = m;
+					const err = r.error;
+					if (err) finish(new RpcError(err.message ?? "request failed", err.code ?? ErrorCode.internalError, err.data));
+					else finish(void 0, r.result);
+				},
+				setListener: () => {},
+				dispose: () => {}
+			};
+			this._pending.set(key, {
+				origin,
+				originalId: hubId,
+				target: link,
+				method,
+				startedAtMs: Date.now()
+			});
+			this._armIdle(key);
+			if (timeoutMs !== void 0 && timeoutMs > 0) {
+				requestTimeout = setTimeout(() => {
+					if (this._pending.get(key)?.origin !== origin) return;
+					this._injectCancel(link, key, StreamControlReason.clientDisconnected);
+					this._deletePending(key);
+					finish(/* @__PURE__ */ new Error(`${method} timed out after ${timeoutMs}ms`));
+				}, timeoutMs);
+				requestTimeout.unref();
+			}
+			const onSendError = (error) => {
+				if (this._pending.get(key)?.origin !== origin) return;
+				this._deletePending(key);
+				finish(error instanceof Error ? error : new Error(String(error)));
+			};
+			try {
+				Promise.resolve(link.send({
+					jsonrpc: "2.0",
+					id: hubId,
+					method,
+					params
+				})).catch(onSendError);
+			} catch (error) {
+				onSendError(error);
+			}
+		});
+	}
+	_watchOnLink(link, method, params, onTick, onSettled, onEstablished) {
+		const hubId = this._nextId++;
+		const key = String(hubId);
+		let active = true;
+		let pingTimer;
+		let establishedTimer;
+		const stop = (cancel) => {
+			if (!active) return;
+			active = false;
+			if (pingTimer !== void 0) clearInterval(pingTimer);
+			if (establishedTimer !== void 0) clearTimeout(establishedTimer);
+			if (this._pending.get(key)?.origin === origin) {
+				if (cancel) this._injectCancel(link, key, StreamControlReason.clientDisconnected);
+				this._deletePending(key);
+			}
+			if (!cancel) onSettled();
+		};
+		const sendControl = (control, dir) => {
+			const message = {
+				jsonrpc: "2.0",
+				method: STREAM_METHOD,
+				params: {
+					requestId: hubId,
+					dir,
+					control
+				}
+			};
+			try {
+				Promise.resolve(link.send(message)).catch(() => stop(false));
+			} catch {
+				stop(false);
+			}
+		};
+		const origin = {
+			send: (message) => {
+				if (isNotification(message) && message.method === STREAM_METHOD) {
+					const stream = _streamParams(message);
+					if (stream?.dir !== StreamDir.toCaller) return;
+					if (stream.control?.type === StreamControlType.ping) sendControl({
+						type: StreamControlType.pong,
+						nonce: stream.control.nonce
+					}, StreamDir.toCallee);
+					if (stream.payload !== void 0) onTick();
+				} else if (isResponse(message)) stop(false);
+			},
+			setListener: () => {},
+			dispose: () => stop(true)
+		};
+		this._pending.set(key, {
+			origin,
+			originalId: hubId,
+			target: link,
+			method,
+			startedAtMs: Date.now()
+		});
+		this._armIdle(key);
+		establishedTimer = setTimeout(() => {
+			establishedTimer = void 0;
+			if (active && this._pending.get(key)?.origin === origin) onEstablished();
+		}, 10);
+		if (this._idleMs > 0) pingTimer = setInterval(() => {
+			if (!active || this._pending.get(key)?.origin !== origin) {
+				stop(false);
+				return;
+			}
+			this._resetIdle(key);
+			sendControl({
+				type: StreamControlType.ping,
+				nonce: randomUUID()
+			}, StreamDir.toCallee);
+		}, Math.max(10, Math.floor(this._idleMs / 3)));
+		const onSendError = () => stop(false);
+		try {
+			Promise.resolve(link.send({
+				jsonrpc: "2.0",
+				id: hubId,
+				method,
+				params
+			})).catch(onSendError);
+		} catch {
+			onSendError();
+		}
+		return { dispose: () => stop(true) };
+	}
+	/**
+	* The link a still-in-flight forwarded request originally arrived on,
+	* keyed by the **hub-rewritten** id the request now carries (i.e. the
+	* `id` a target sees on its delivered message). Valid from the moment the
+	* hub forwards the request until its response is demultiplexed; returns
+	* `undefined` for unknown / already-answered ids.
+	*
+	* This is the seam a hub-hosted participant uses to learn *which* link a
+	* call it is handling came from, so it can bind a prefix claim to that
+	* exact link via {@link claimPrefix} without the routing core ever
+	* growing a notion of authenticated identity.
+	*/
+	getSourceTransport(requestId) {
+		return this._pending.get(String(requestId))?.origin;
+	}
+	_onMessage(from, m) {
+		if (isResponse(m)) this._demux(from, m);
+		else if (isRequest(m)) {
+			if (m.method === GET_NODE_ID_METHOD) {
+				from.send({
+					jsonrpc: "2.0",
+					id: m.id,
+					result: {
+						nodeId: this.nodeId,
+						portId: this._topology.portId(from)
+					}
+				});
+				return;
+			}
+			this._routeRequest(from, m);
+		} else if (isNotification(m)) {
+			if (m.method === STREAM_METHOD) this._routeStream(from, m);
+			else this._routeNotification(from, m);
+		}
+	}
+	_resolve(method, from) {
+		const parsed = parseMethodName(method);
+		if (!parsed) return { kind: "malformed" };
+		if (parsed.kind === "bare" || parsed.kind === "interface") return {
+			kind: "loopback",
+			link: this._loopback
+		};
+		const match = this._table.longestPrefixMatch(parsed.serviceId);
+		if (match) return {
+			kind: "prefix",
+			link: match.value,
+			prefix: match.prefix
+		};
+		if (this._uplink !== void 0 && this._uplink === from) return {
+			kind: "uplink",
+			link: void 0
+		};
+		return {
+			kind: "uplink",
+			link: this._uplink
+		};
+	}
+	_routeRequest(from, req) {
+		const res = this._resolve(req.method, from);
+		const target = res.kind === "malformed" ? void 0 : res.link;
+		if (!target) {
+			const message = this._noTargetMessage(res, req.method);
+			this._log?.warn(`${this._tag()}unroutable request '${req.method}' (id=${String(req.id)}): ${message}`);
+			if (this._transitObservers.size !== 0) this._emit({
+				timeMs: Date.now(),
+				nodeId: this.nodeId,
+				in: this._transitEndpoint(from, req.id),
+				disposition: "unroutable",
+				kind: "request",
+				method: req.method,
+				params: req.params
+			});
+			this._replyError(from, req.id, this._noTargetCode(res), message);
+			return;
+		}
+		const hubId = this._nextId++;
+		const key = String(hubId);
+		this._pending.set(key, {
+			origin: from,
+			originalId: req.id,
+			target,
+			method: req.method,
+			startedAtMs: Date.now()
+		});
+		this._armIdle(key);
+		this._log?.trace(`${this._tag()}route '${req.method}' (${res.kind}${res.kind === "prefix" ? ` ${res.prefix}` : ""}) id=${String(req.id)}\u2192${hubId}`);
+		if (this._transitObservers.size !== 0) this._emit({
+			timeMs: Date.now(),
+			nodeId: this.nodeId,
+			in: this._transitEndpoint(from, req.id),
+			out: this._transitEndpoint(target, hubId),
+			disposition: "forwarded",
+			kind: "request",
+			method: req.method,
+			params: req.params
+		});
+		const forwarded = {
+			...req,
+			id: hubId
+		};
+		const onSendError = (error) => {
+			const pending = this._pending.get(key);
+			if (pending === void 0 || pending.target !== target) return;
+			this._deletePending(key);
+			const message = `target send failed: ${error instanceof Error ? error.message : String(error)}`;
+			this._log?.warn(`${this._tag()}${message} (hubId=${key})`);
+			if (this._transitObservers.size !== 0) this._emit({
+				timeMs: Date.now(),
+				nodeId: this.nodeId,
+				in: this._transitEndpoint(pending.target, hubId),
+				out: this._transitEndpoint(pending.origin, pending.originalId),
+				disposition: "dropped",
+				kind: "response",
+				method: pending.method,
+				error: {
+					code: ErrorCode.peerDisconnected,
+					message
+				}
+			});
+			this._replyError(pending.origin, pending.originalId, ErrorCode.peerDisconnected, message);
+		};
+		try {
+			Promise.resolve(target.send(forwarded)).catch(onSendError);
+		} catch (error) {
+			onSendError(error);
+		}
+	}
+	_routeNotification(from, note) {
+		const method = note.method;
+		const params = note.params;
+		const res = this._resolve(method, from);
+		const target = res.kind === "malformed" ? void 0 : res.link;
+		if (target) {
+			if (this._transitObservers.size !== 0) this._emit({
+				timeMs: Date.now(),
+				nodeId: this.nodeId,
+				in: this._transitEndpoint(from),
+				out: this._transitEndpoint(target),
+				disposition: "forwarded",
+				kind: "notification",
+				method,
+				params
+			});
+			target.send(note);
+		} else {
+			if (this._transitObservers.size !== 0) this._emit({
+				timeMs: Date.now(),
+				nodeId: this.nodeId,
+				in: this._transitEndpoint(from),
+				disposition: res.kind === "malformed" ? "unroutable" : "dropped",
+				kind: "notification",
+				method,
+				params
+			});
+			this._log?.trace(`${this._tag()}drop unroutable notification '${method}'`);
+		}
+	}
+	_demux(from, res) {
+		if (res.id === null) return;
+		const key = String(res.id);
+		const pending = this._pending.get(key);
+		if (!pending) return;
+		if (from !== pending.target) return;
+		this._deletePending(key);
+		if (this._transitObservers.size !== 0) this._emit({
+			timeMs: Date.now(),
+			nodeId: this.nodeId,
+			in: this._transitEndpoint(pending.target, res.id),
+			out: this._transitEndpoint(pending.origin, pending.originalId),
+			disposition: "forwarded",
+			kind: "response",
+			method: pending.method,
+			result: res.result,
+			error: res.error
+		});
+		pending.origin.send({
+			...res,
+			id: pending.originalId
+		});
+	}
+	/**
+	* Route a `$stream::send` notification. Unlike an ordinary notification, a
+	* stream message is **correlated to an in-flight request by `requestId`**,
+	* not addressed by method name — so it follows the same path the request
+	* established (recorded in {@link _pending}), exactly like a
+	* {@link _demux | response}, and the hub rewrites `requestId` across the
+	* forwarding boundary the same way it rewrites a response `id`.
+	*
+	* The message's explicit `dir` picks the traversal — no inference from the
+	* arriving link:
+	*
+	* - **`toCaller`** (callee → caller progress): routed like a response. The
+	*   streamer used the hub-rewritten id it *received*, so `requestId` is a
+	*   pending hub id; only the link the request was forwarded to may stream
+	*   on it. Restore the origin's original id and forward to the origin.
+	* - **`toCallee`** (caller → callee input / cancel / ping): the reverse
+	*   traversal of the same entry. The streamer used the original id it
+	*   *sent*; rewrite `requestId` to the hub id the target was handed and
+	*   forward to the target. Only the origin may stream this direction.
+	*
+	* Every routed stream message resets the request's idle timer (a keepalive
+	* ping is exactly a `toCallee` control with no payload). A `$stream::send`
+	* matching no in-flight request is dropped (late / unknown correlation).
+	*/
+	_routeStream(from, note) {
+		const p = _streamParams(note);
+		if (!p || p.requestId === void 0) {
+			this._log?.trace(`${this._tag()}drop malformed '${STREAM_METHOD}' (no requestId)`);
+			return;
+		}
+		if (p.dir === StreamDir.toCaller) {
+			const key = String(p.requestId);
+			const pending = this._pending.get(key);
+			if (!pending || from !== pending.target) {
+				this._log?.trace(`${this._tag()}drop unroutable toCaller '${STREAM_METHOD}' requestId=${String(p.requestId)}`);
+				return;
+			}
+			this._resetIdle(key);
+			pending.origin.send(_withRequestId$1(note, pending.originalId));
+			this._emitStream(note, this._transitEndpoint(pending.target, p.requestId), this._transitEndpoint(pending.origin, pending.originalId));
+			return;
+		}
+		for (const [hubId, pending] of this._pending) if (pending.origin === from && String(pending.originalId) === String(p.requestId)) {
+			this._resetIdle(hubId);
+			pending.target.send(_withRequestId$1(note, Number(hubId)));
+			this._emitStream(note, this._transitEndpoint(pending.origin, p.requestId), this._transitEndpoint(pending.target, Number(hubId)));
+			return;
+		}
+		this._log?.trace(`${this._tag()}drop unroutable toCallee '${STREAM_METHOD}' requestId=${String(p.requestId)}`);
+	}
+	/** Delete a pending entry and clear its idle timer. */
+	_deletePending(key) {
+		const p = this._pending.get(key);
+		if (!p) return;
+		if (p.timer !== void 0) clearTimeout(p.timer);
+		this._pending.delete(key);
+	}
+	/** Arm (or re-arm) the idle timer for a pending entry. No-op when disabled. */
+	_armIdle(key) {
+		if (this._idleMs <= 0) return;
+		const t = setTimeout(() => this._onIdleTimeout(key), this._idleMs);
+		t.unref?.();
+		const p = this._pending.get(key);
+		if (p) p.timer = t;
+		else clearTimeout(t);
+	}
+	/** Reset the idle timer on stream activity. */
+	_resetIdle(key) {
+		const p = this._pending.get(key);
+		if (!p) return;
+		if (p.timer !== void 0) clearTimeout(p.timer);
+		this._armIdle(key);
+	}
+	/**
+	* A request went idle past {@link _idleMs}. Cancel the (presumably hung)
+	* callee, fail the caller with a `requestTimeout`, and drop the entry —
+	* the bound that keeps `_pending` from growing without limit.
+	*/
+	_onIdleTimeout(key) {
+		const p = this._pending.get(key);
+		if (!p) return;
+		this._log?.warn(`${this._tag()}request idle-timed-out (hubId=${key}); cancelling + failing origin`);
+		this._injectCancel(p.target, key, StreamControlReason.idleTimeout);
+		this._deletePending(key);
+		if (this._transitObservers.size !== 0) this._emit({
+			timeMs: Date.now(),
+			nodeId: this.nodeId,
+			in: this._transitEndpoint(p.target, key),
+			out: this._transitEndpoint(p.origin, p.originalId),
+			disposition: "forwarded",
+			kind: "response",
+			method: p.method,
+			error: {
+				code: ErrorCode.requestTimeout,
+				message: "request idle-timed-out"
+			}
+		});
+		this._replyError(p.origin, p.originalId, ErrorCode.requestTimeout, "request idle-timed-out");
+	}
+	/**
+	* Author a `toCallee` cancel toward `target` for the request the target
+	* knows as `hubId`. Used on caller-disconnect and idle-timeout — the hub
+	* itself originates the message, which is why `dir` is explicit on the
+	* wire (there is no inbound link to infer it from).
+	*/
+	_injectCancel(target, hubId, reason) {
+		const params = {
+			requestId: Number(hubId),
+			dir: StreamDir.toCallee,
+			control: {
+				type: StreamControlType.cancel,
+				reason
+			}
+		};
+		try {
+			Promise.resolve(target.send({
+				jsonrpc: "2.0",
+				method: STREAM_METHOD,
+				params
+			})).catch(() => void 0);
+		} catch {}
+	}
+	_noTargetCode(res) {
+		return res.kind === "malformed" ? ErrorCode.invalidRequest : ErrorCode.methodNotFound;
+	}
+	_noTargetMessage(res, method) {
+		switch (res.kind) {
+			case "malformed": return `malformed method name: ${method}`;
+			case "loopback": return `no local root services to handle: ${method}`;
+			case "uplink": return `no route for: ${method}`;
+			default: return `unroutable: ${method}`;
+		}
+	}
+	_replyError(to, id, code, message) {
+		const error = {
+			jsonrpc: "2.0",
+			id,
+			error: this._options.debugName !== void 0 ? {
+				code,
+				message,
+				data: { hub: this._options.debugName }
+			} : {
+				code,
+				message
+			}
+		};
+		to.send(error);
+	}
+};
+/** Read the params off a {@link STREAM_METHOD} notification. */
+function _streamParams(m) {
+	const params = m.params;
+	if (params === null || typeof params !== "object") return void 0;
+	return params;
+}
+/** Clone a {@link STREAM_METHOD} notification with `requestId` replaced. */
+function _withRequestId$1(m, requestId) {
+	const params = {
+		...m.params,
+		requestId
+	};
+	return {
+		...m,
+		params
+	};
+}
+//#endregion
+//#region src/hub/server/hubInspector.ts
+/** Publishes dynamically observed raw node transits through bounded traffic streams. */
+var HubInspector = class {
+	_hub;
+	_subscribers = /* @__PURE__ */ new Set();
+	_trafficSources = /* @__PURE__ */ new Set();
+	_trafficWatches = new TrafficWatchFlowTracker();
+	_observation;
+	constructor(_hub) {
+		this._hub = _hub;
+		this._observation = this._hub.observeTransits((transit) => {
+			this._onTransit(transit);
+		});
+	}
+	get observerCount() {
+		return this._subscribers.size;
+	}
+	subscribe(options, send) {
+		if (options.trafficIgnoreKey !== void 0 && !this._trafficWatches.claim(options.trafficIgnoreKey)) throw new Error("Traffic watch request was not observed before subscription");
+		const subscriber = new BoundedTrafficSubscription(options, send, () => {
+			this._subscribers.delete(subscriber);
+			if (this._subscribers.size === 0) this._stopTrafficSources();
+		});
+		if (this._subscribers.size === 0) this._startTrafficSources();
+		this._subscribers.add(subscriber);
+		return subscriber;
+	}
+	dispose() {
+		for (const subscriber of [...this._subscribers]) subscriber.dispose();
+		this._subscribers.clear();
+		this._observation.dispose();
+		this._trafficWatches.clear();
+		this._stopTrafficSources();
+		this._trafficSources.clear();
+	}
+	/** Add an endpoint traffic source managed by this Hub inspection service. */
+	addTrafficSource(source) {
+		const registered = { source };
+		this._trafficSources.add(registered);
+		if (this._subscribers.size !== 0) this._startTrafficSource(registered);
+		let disposed = false;
+		return { dispose: () => {
+			if (disposed) return;
+			disposed = true;
+			this._trafficSources.delete(registered);
+			registered.observation?.dispose();
+			registered.observation = void 0;
+		} };
+	}
+	_startTrafficSources() {
+		for (const source of this._trafficSources) this._startTrafficSource(source);
+	}
+	_startTrafficSource(source) {
+		source.observation ??= source.source.observe((transit) => this._emitTransit(transit));
+	}
+	_stopTrafficSources() {
+		for (const source of this._trafficSources) {
+			source.observation?.dispose();
+			source.observation = void 0;
+		}
+	}
+	_onTransit(transit) {
+		const event = {
+			type: "transit",
+			timeMs: transit.timeMs,
+			nodeId: transit.nodeId,
+			...transit.in !== void 0 ? { in: normalizeEndpoint(transit.in) } : {},
+			...transit.out !== void 0 ? { out: normalizeEndpoint(transit.out) } : {},
+			disposition: transit.disposition,
+			kind: transit.kind,
+			method: transit.method,
+			params: transit.params,
+			result: transit.result,
+			error: transit.error
+		};
+		if (this._trafficWatches.accept(event)) return;
+		if (this._subscribers.size !== 0) this._emitTransit(event);
+	}
+	_emitTransit(transit) {
+		for (const subscriber of this._subscribers) subscriber.enqueue(transit);
+	}
+};
+function normalizeEndpoint(endpoint) {
+	return {
+		edgeId: endpoint.edgeId,
+		portId: endpoint.portId ?? endpoint.edgeId,
+		...endpoint.requestId !== void 0 ? { requestId: endpoint.requestId } : {}
+	};
+}
+//#endregion
+//#region src/hub/server/routing/overlaySplitter.ts
+/** Separator for return-path tags. NUL never appears in JSON-RPC ids. */
+const SEP = "\0";
+/**
+* A fixed three-port message splitter — the per-participant primitive that
+* replaces a nested {@link import('./routingHub').Hub} inside a
+* {@link import('./rootOverlay').RootOverlay}.
+*
+* Ports:
+* - **P** — the participant (downstream connection),
+* - **C** — the local root-services connection (`hubServiceIdRegistry::registerServiceId`,
+*   `hubrpc.directory`, `identity::*`, …),
+* - **H** — the uplink to the parent hub.
+*
+* Routing rules (verbatim to the design):
+* ```
+*   P·root → C        P·*    → H
+*   H·*    → P        H·root → P
+*   C·*    → P
+* ```
+* where `root` means a bare/interface-form method and `*` a fully-qualified
+* (`serviceId::…`) method. Responses follow the reverse path. `H·root → P`
+* lets the parent hub reach the participant's *own* root services (e.g. the
+* participant-served root directory) — distinct from `P·root → C`, which is
+* the participant *consuming* the overlay's root services; the two are
+* opposite directions served by different connections, so they never collide.
+*
+* ### `$stream::send` — correlated by `requestId`, not by method form
+*
+* A {@link STREAM_METHOD} (`$stream::send`) notification is *interface-form*
+* (`$stream::send`), so the method-form rules above would naively treat it as
+* `root` and send a participant's stream to **C** (and route an inbound one as
+* a root call to **P**). That is wrong: a stream message belongs to an in-flight
+* request's lifetime and must follow **that request's** path, exactly like a
+* response does. So `$stream::send` bypasses the method-form table and is
+* routed like a response instead:
+*
+* - **P → ?**: the participant streams using the `requestId` it *observed*,
+*   which for a request it serves is the tag the splitter stamped on the
+*   delivered request id (`H\0…` / `C\0…`). We {@link _decodeId | decode} that
+*   tag, restore the original id, and forward to the tagged origin (H or C) —
+*   the same demux responses get. An **untagged** `requestId` means the
+*   participant *initiated* the request (P→H or P→C); we cannot tell which
+*   statelessly, so we default to the **uplink** (the common case: streaming
+*   to a fully-qualified service via the parent).
+* - **H/C → P**: forwarded verbatim to the participant (never dropped), as a
+*   response would be — the parent has already restored P's original
+*   `requestId`, symmetric to response-id rewriting.
+*
+* PARTICIPANT-INITIATED STREAMS — the one stateful case: because `requestId`
+* lives in `params` (not a structural top-level id the splitter rewrites in
+* lock-step), a stream frame for a request the participant *initiated* (`P→C`
+* or `P→H`) carries P's *own untagged* id, which alone cannot say whether the
+* call went to the root (C) or the uplink (H). The splitter therefore keeps a
+* small `requestId → target` map ({@link _pInitiated}), populated when P sends
+* such a request and cleared when its response returns, and consults it to
+* route those frames. This is the splitter's *only* per-request state; every
+* other path still routes statelessly via id-tagging.
+*
+* ### Stateless demux via id-tagging
+*
+* P is the only port that receives requests from *two* sources (H and C),
+* so a response from P is ambiguous and ids can collide (`H` and `C` may
+* each send `id:5`). Rather than a pending-request map (with its attendant
+* timeout/leak problem), the splitter rewrites **only requests destined for
+* P**, prepending the origin and original id type to the id:
+*
+* ```
+*   H→P:  id' = "H\0n\042"     (push origin tag)
+*   C→P:  id' = "C\0s\0abc"
+*   P→?:  decode id' → route to H or C, restore the original id
+* ```
+*
+* Every other edge (P→H, P→C and the responses coming back from H/C to P)
+* passes **verbatim** — those targets each have a single peer, so there is no
+* response ambiguity. The sole exception is *stream* frames for
+* participant-initiated requests, whose target is recovered from the small
+* {@link _pInitiated} map (see above); apart from that the id encodes its own
+* return path.
+*
+* NOTE: unlike the central {@link import('./routingHub').Hub}, the tag is
+* not authenticated. A misbehaving participant could emit a forged tagged
+* response toward H or C; each endpoint still drops ids it has no pending
+* request for, and identity/signing live in a higher layer. For the
+* single-participant overlay this is an acceptable trade for being fully
+* stateless. If unforgeable return paths are ever required here, HMAC the
+* tag with a splitter-private secret.
+*/
+var OverlaySplitter = class {
+	_participant;
+	_root;
+	_uplink;
+	_disposed = false;
+	_inspect;
+	/**
+	* Per-request routing target (`C` or `H`) for requests the participant
+	* *initiated*, keyed by P's own request id. Streams for those requests
+	* carry P's untagged id, which alone can't say whether the call went to the
+	* root (C) or the uplink (H); this map recovers it. Populated when P sends
+	* the request, cleared when its response returns. The splitter's only
+	* per-request state — every other path routes statelessly via id-tagging.
+	*/
+	_pInitiated = /* @__PURE__ */ new Map();
+	constructor(_participant, _root, _uplink, inspection) {
+		this._participant = _participant;
+		this._root = _root;
+		this._uplink = _uplink;
+		this._inspect = inspection;
+		this._participant.setListener((m) => this._onFromParticipant(m));
+		this._root.setListener((m) => this._onFromUpstream(m, "C"));
+		this._uplink.setListener((m) => this._onFromUpstream(m, "H"));
+	}
+	/** Detach all three ports. Does not dispose the transports themselves. */
+	dispose() {
+		if (this._disposed) return;
+		this._disposed = true;
+		this._participant.setListener(void 0);
+		this._root.setListener(void 0);
+		this._uplink.setListener(void 0);
+		this._pInitiated.clear();
+	}
+	/** Edge id of an upstream origin port. */
+	_originEdge(origin) {
+		return origin === "H" ? this._inspect.edges.h : this._inspect.edges.c;
+	}
+	/** Emit a node transit if inspection is enabled. Zero-cost otherwise. */
+	_emit(t) {
+		if (this._inspect) this._inspect.onTransit(t);
+	}
+	_onFromParticipant(m) {
+		if (isResponse(m)) {
+			if (m.id === null) return;
+			const dec = _decodeId(m.id);
+			if (!dec) return;
+			if (dec.origin === "H") {
+				if (this._inspect) this._emit(this._mkResponse(this._inspect.edges.p, m.id, this._inspect.edges.h, dec.id, m));
+				this._uplink.send({
+					...m,
+					id: dec.id
+				});
+			} else {
+				if (this._inspect) this._emit(this._mkResponse(this._inspect.edges.p, m.id, this._inspect.edges.c, dec.id, m));
+				this._root.send({
+					...m,
+					id: dec.id
+				});
+			}
+			return;
+		}
+		const method = _methodOf(m);
+		if (method === void 0) return;
+		if (method === STREAM_METHOD) {
+			this._routeParticipantStream(m);
+			return;
+		}
+		const rootForm = _isRootForm(method);
+		if (rootForm === void 0) {
+			if (this._inspect) this._emit(this._mkForward(this._inspect.edges.p, m, void 0, method, "dropped"));
+			return;
+		}
+		if (rootForm) {
+			if (this._inspect) this._emit(this._mkForward(this._inspect.edges.p, m, this._inspect.edges.c, method, "forwarded"));
+			if (isRequest(m)) this._pInitiated.set(m.id, { target: "C" });
+			this._root.send(m);
+		} else {
+			if (this._inspect) this._emit(this._mkForward(this._inspect.edges.p, m, this._inspect.edges.h, method, "forwarded"));
+			if (isRequest(m)) this._pInitiated.set(m.id, { target: "H" });
+			this._uplink.send(m);
+		}
+	}
+	/**
+	* Route a participant-emitted `$stream::send` by its `requestId` tag,
+	* mirroring how a {@link _onFromParticipant | response} is demuxed. The
+	* participant streams with the id it *observed*; for a request it serves
+	* that id carries the origin tag the splitter stamped, so decoding it
+	* yields the return port and the original id. Untagged → a request the
+	* participant *initiated*; recover its target (C or H) from {@link
+	* _pInitiated}, defaulting to the uplink.
+	*/
+	_routeParticipantStream(m) {
+		const requestId = _streamRequestId(m);
+		const dec = requestId !== void 0 ? _decodeId(requestId) : void 0;
+		if (dec) {
+			const restored = _withRequestId(m, dec.id);
+			if (dec.origin === "H") this._uplink.send(restored);
+			else this._root.send(restored);
+			return;
+		}
+		if ((requestId !== void 0 ? this._pInitiated.get(requestId) : void 0)?.target === "C") {
+			this._root.send(m);
+			return;
+		}
+		this._uplink.send(m);
+	}
+	_onFromUpstream(m, origin) {
+		if (isResponse(m)) {
+			m.id === null || this._pInitiated.get(m.id);
+			if (m.id !== null) this._pInitiated.delete(m.id);
+			if (this._inspect) this._emit(this._mkResponse(this._originEdge(origin), m.id, this._inspect.edges.p, m.id, m));
+			this._participant.send(m);
+			return;
+		}
+		const method = _methodOf(m);
+		if (method === void 0) return;
+		if (method === STREAM_METHOD) {
+			if (_streamDir(m) === StreamDir.toCallee) {
+				const requestId = _streamRequestId(m);
+				if (requestId !== void 0) {
+					this._participant.send(_withRequestId(m, _encodeId(origin, requestId)));
+					return;
+				}
+			}
+			this._participant.send(m);
+			return;
+		}
+		if (_isRootForm(method) === void 0) {
+			if (this._inspect) this._emit(this._mkForward(this._originEdge(origin), m, void 0, method, "dropped"));
+			return;
+		}
+		if (isRequest(m)) {
+			const encodedId = _encodeId(origin, m.id);
+			if (this._inspect) this._emit(this._mkForward(this._originEdge(origin), m, this._inspect.edges.p, method, "forwarded", encodedId));
+			this._participant.send({
+				...m,
+				id: encodedId
+			});
+		} else if (isNotification(m)) {
+			if (this._inspect) this._emit(this._mkForward(this._originEdge(origin), m, this._inspect.edges.p, method, "forwarded"));
+			this._participant.send(m);
+		}
+	}
+	/** Build a request/notification transit (`out` absent ⇒ dropped here). */
+	_mkForward(inEdge, m, outEdge, method, disposition, outRequestId) {
+		const id = m.id;
+		const isReq = isRequest(m);
+		const inEp = {
+			edgeId: inEdge,
+			...isReq && id !== void 0 ? { requestId: id } : {}
+		};
+		const outEp = outEdge === void 0 ? void 0 : {
+			edgeId: outEdge,
+			...isReq ? { requestId: outRequestId ?? id } : {}
+		};
+		return {
+			timeMs: Date.now(),
+			nodeId: this._inspect.nodeId,
+			in: inEp,
+			out: outEp,
+			disposition,
+			kind: isReq ? "request" : "notification",
+			method,
+			params: m.params
+		};
+	}
+	/** Build a response transit crossing from `inEdge`/`inId` to `outEdge`/`outId`. */
+	_mkResponse(inEdge, inId, outEdge, outId, m) {
+		return {
+			timeMs: Date.now(),
+			nodeId: this._inspect.nodeId,
+			in: {
+				edgeId: inEdge,
+				...inId !== null ? { requestId: inId } : {}
+			},
+			out: {
+				edgeId: outEdge,
+				...outId !== null ? { requestId: outId } : {}
+			},
+			disposition: "forwarded",
+			kind: "response",
+			result: m.result,
+			error: m.error
+		};
+	}
+};
+function _methodOf(m) {
+	const method = m.method;
+	return typeof method === "string" ? method : void 0;
+}
+/** Read the `requestId` correlator off a `$stream::send` notification. */
+function _streamRequestId(m) {
+	const params = m.params;
+	if (params === null || typeof params !== "object") return void 0;
+	const requestId = params.requestId;
+	return typeof requestId === "number" || typeof requestId === "string" ? requestId : void 0;
+}
+/** Read the `dir` discriminator off a `$stream::send` notification. */
+function _streamDir(m) {
+	const params = m.params;
+	if (params === null || typeof params !== "object") return void 0;
+	const dir = params.dir;
+	return dir === StreamDir.toCaller || dir === StreamDir.toCallee ? dir : void 0;
+}
+/** Clone a `$stream::send` notification with `requestId` replaced (id restore). */
+function _withRequestId(m, requestId) {
+	const params = {
+		...m.params,
+		requestId
+	};
+	return {
+		...m,
+		params
+	};
+}
+/** `true` for bare/interface form, `false` for fully-qualified, `undefined` if malformed. */
+function _isRootForm(method) {
+	const p = parseMethodName(method);
+	if (!p) return void 0;
+	return p.kind === "bare" || p.kind === "interface";
+}
+function _encodeId(origin, id) {
+	return `${origin}${SEP}${typeof id === "number" ? "n" : "s"}${SEP}${String(id)}`;
+}
+function _decodeId(id) {
+	if (typeof id !== "string") return void 0;
+	const i1 = id.indexOf(SEP);
+	if (i1 < 0) return void 0;
+	const origin = id.slice(0, i1);
+	if (origin !== "H" && origin !== "C") return void 0;
+	const i2 = id.indexOf(SEP, i1 + 1);
+	if (i2 < 0) return void 0;
+	const type = id.slice(i1 + 1, i2);
+	const raw = id.slice(i2 + 1);
+	return {
+		origin,
+		id: type === "n" ? Number(raw) : raw
+	};
+}
+//#endregion
+//#region src/hub/server/routing/rootOverlay.ts
+/**
+* A **RootOverlay** is the per-participant front door. It is a pure
+* {@link OverlaySplitter} wiring with no routing table, no nested hub, and —
+* deliberately — **no knowledge of which services it serves**. It exposes:
+*
+* - {@link root} — the connection serving this participant's root services.
+*   Install bootstrap/identity modules onto it with `registerHubServices` /
+*   `registerIdentityServices` *before or after* connecting the participant.
+* - {@link connectParticipant} — wires the downstream participant through the
+*   splitter (`P·root → root`, `P·* → uplink`, `uplink·* → P`).
+*
+* Because an overlay represents exactly one participant, prefix claims happen
+* only on the parent (via the {@link import('./routingHub').AttachedLink} that
+* `registerHubServices` was given); there is no local table to write.
+*
+* The overlay is generic over the per-call `TContext` its {@link root}
+* connection sees. Pass a context-stamping {@link ChannelTransport} to
+* {@link connectParticipant} to attach per-call context. Most callers connect a
+* plain (or signature-verifying) transport and leave `TContext` as `undefined`
+* (context-free).
+*/
+var RootOverlay = class {
+	/**
+	* The per-participant root connection. Register the overlay's root
+	* services here — e.g. `registerHubServices(overlay.root, upstream)` and
+	* `registerIdentityServices(overlay.root, { resolveIdentity })`. Reachable
+	* only by this overlay's participant (root-addressed calls land here).
+	*
+	* Its inbound transport carries the overlay's `TContext`, so identity-aware
+	* front doors — notably the consent `hubAccess` service — can be served here
+	* for the interface-form calls a participant addresses to its own root.
+	*/
+	root;
+	nodeId = `overlay:${randomUUID()}`;
+	participantPortId = `port:${randomUUID()}`;
+	rootPortId = `port:${randomUUID()}`;
+	rootNodeId = `endpoint:${randomUUID()}`;
+	uplinkPortId;
+	_uplink;
+	_rootPair;
+	_inspection;
+	_splitter;
+	_disposed = false;
+	constructor(options) {
+		this._uplink = options.uplink;
+		this._inspection = options.inspection;
+		this.uplinkPortId = options.uplinkPortId ?? `port:${randomUUID()}`;
+		this._rootPair = new TransportPair();
+		this.root = LinkRpcConnection.fromTransport(this._rootPair.b);
+		this.root.register(nodeInterface$1, { getNodeId: () => ({
+			nodeId: this.nodeId,
+			portId: this.participantPortId
+		}) });
+	}
+	managedTopology(edgeLabel, peerTransport) {
+		return {
+			node: {
+				nodeId: this.nodeId,
+				kind: "hub",
+				label: "Root overlay",
+				ports: [
+					{
+						portId: this.participantPortId,
+						label: "participant"
+					},
+					{
+						portId: this.rootPortId,
+						label: "root"
+					},
+					{
+						portId: this.uplinkPortId,
+						label: "uplink"
+					}
+				]
+			},
+			hubLinks: [{
+				hubPortId: this.uplinkPortId,
+				nodePortId: this.uplinkPortId,
+				...edgeLabel !== void 0 ? { label: edgeLabel } : {}
+			}],
+			peerPortId: this.participantPortId,
+			...peerTransport !== void 0 ? { peerTransport } : {},
+			adjacentNodes: [{
+				nodeId: this.rootNodeId,
+				kind: "endpoint",
+				label: "Root services",
+				ports: [{ portId: this.rootPortId }]
+			}],
+			adjacentLinks: [{
+				from: {
+					nodeId: this.nodeId,
+					portId: this.rootPortId
+				},
+				to: {
+					nodeId: this.rootNodeId,
+					portId: this.rootPortId
+				}
+			}]
+		};
+	}
+	/**
+	* Connect the downstream participant. Root-addressed calls from it hit the
+	* {@link root} services; prefixed calls forward via the uplink. May be
+	* called once.
+	*
+	* Connect a context-stamping {@link ChannelTransport} when `TContext` is
+	* concrete; otherwise connect the raw participant transport directly.
+	*/
+	connectParticipant(participant) {
+		if (this._splitter) throw new Error("RootOverlay: participant already connected");
+		this._splitter = new OverlaySplitter(participant, this._rootPair.a, this._uplink, this._inspection);
+	}
+	/**
+	* Tear the overlay down: detach the splitter and dispose the internal root
+	* transport pair. The caller owns the uplink and the participant transport
+	* and disposes them separately (disposing the uplink's
+	* {@link import('./routingHub').AttachedLink} releases any claimed prefixes
+	* on the parent). Idempotent.
+	*/
+	dispose() {
+		if (this._disposed) return;
+		this._disposed = true;
+		this._splitter?.dispose();
+		this._rootPair.a.dispose();
+		this._rootPair.b.dispose();
+	}
+};
+//#endregion
+//#region src/hub/server/rootServices.ts
+/**
+* Install a participant's **connection root services** onto its overlay root
+* connection `root`:
+*
+* - `hubGrantedServiceId::get` — the connection round-trip: reports the
+*   `grantedServiceIdNamespace` this connection may claim freely.
+* - `hubGrantedServiceId::register` — claims a prefix on
+*   `upstream` (the parent hub link) within the connection's granted namespace,
+*   gated by `authorizeClaim` (default: namespace membership). Because an
+*   overlay represents a single participant, *one* upstream claim suffices: all
+*   prefixed traffic the parent routes to this overlay is for this participant,
+*   so the {@link OverlaySplitter} delivers it without any local table.
+* - `hubrpc.directory::list` — by default a **referral** (own root interfaces
+*   plus one row pointing at `<hubServiceId>::hubrpc.directory`); an
+*   implementation is free to aggregate the parent's listing instead.
+* - `hubrpc.schemas::get` — schemas for this overlay's own root interfaces.
+*
+* The hub's consent front door (`hubAccess::*`) is installed separately at the
+* overlay root by {@link registerHubAccessService}; it needs no capability of
+* its own because the root is never forwarded.
+*
+* The overlay itself stays unaware of which services it serves; this is the
+* routing module that gives it its front door.
+*/
+function registerHubServices(root, upstream, options = {}) {
+	const hubServiceId = options.hubServiceId ?? "hub";
+	const grantedServiceIdNamespace = options.grantedServiceIdNamespace ?? "";
+	const authorizeClaim = options.authorizeClaim;
+	root.register(hubGrantedServiceIdInterface, {
+		get: () => {
+			return { grantedServiceIdNamespace };
+		},
+		getHubServiceId: () => {
+			return { hubServiceId };
+		},
+		register: ({ serviceId }) => {
+			const verdict = authorizeClaim ? authorizeClaim(serviceId) : grantedServiceIdNamespace !== "" && isServiceIdUnder(serviceId, grantedServiceIdNamespace) ? { ok: true } : {
+				ok: false,
+				reason: `"${serviceId}" is outside this connection's granted namespace "${grantedServiceIdNamespace}"`
+			};
+			if (!verdict.ok) throw new RpcError(`claim denied: ${verdict.reason}`, ErrorCode.invalidRequest);
+			upstream.addPrefixRoute(serviceId);
+			return {};
+		}
+	});
+	root.register(directoryInterface, {
+		list: ({ interfaceId, interfaceIdPrefix, serviceId, serviceIdScopes }) => {
+			const referral = {
+				serviceId: hubServiceId,
+				interfaceId: directoryInterface.info.id,
+				interfaceHash: directoryInterface.schemaHash,
+				reachableServiceIds: [{ prefix: "" }]
+			};
+			return { items: [...root.listRegisteredInterfaces(), referral].filter((it) => interfaceId === void 0 || it.interfaceId === interfaceId).filter((it) => interfaceIdPrefix === void 0 || it.interfaceId.startsWith(interfaceIdPrefix)).filter((it) => serviceId === void 0 || it.serviceId === serviceId).filter((it) => serviceIdMatchesScopes(it.serviceId, serviceIdScopes)).map((it) => {
+				const entry = {
+					serviceId: it.serviceId,
+					interfaceId: it.interfaceId,
+					interfaceHash: it.interfaceHash
+				};
+				const desc = it.serviceDescription;
+				if (desc !== void 0) entry.serviceDescription = desc;
+				const sets = it.rootPrincipalSets;
+				if (sets !== void 0) entry.rootPrincipalSets = sets.map((s) => [...s]);
+				const reachable = it.reachableServiceIds;
+				if (reachable !== void 0) entry.reachableServiceIds = [...reachable];
+				return entry;
+			}) };
+		},
+		watch: (_params, _ctx, stream) => new Promise((resolve) => {
+			if (stream.signal.aborted) {
+				resolve({});
+				return;
+			}
+			let pending = false;
+			const flush = () => {
+				pending = false;
+				if (!stream.signal.aborted) stream.send({}).catch(() => void 0);
+			};
+			const unsubscribe = root.onDidChangeDirectory(() => {
+				if (pending) return;
+				pending = true;
+				queueMicrotask(flush);
+			});
+			stream.signal.addEventListener("abort", () => {
+				unsubscribe();
+				resolve({});
+			}, { once: true });
+		})
+	});
+	root.register(schemasInterface, { get: ({ interfaceId, hash }) => {
+		const iface = root.findRegisteredInterface(interfaceId, hash);
+		if (!iface) throw new RpcError("Interface not found", ErrorCode.methodNotFound, {
+			reason: "unknown-interface",
+			interfaceId,
+			hash
+		});
+		return { schema: iface.toSchema() };
+	} });
+}
+/**
+* Install `identity::*` (and optionally `identity.storage::*`) onto a
+* participant's overlay root connection. The identity is resolved lazily on
+* first use — see {@link registerLazyIdentityOnOverlay}.
+*
+* This is the identity counterpart to {@link registerHubServices}: a small,
+* composable module the overlay does not need to know about.
+*/
+function registerIdentityServices(root, options) {
+	registerLazyIdentityOnOverlay(root, options.resolveIdentity, options.storage);
+}
+//#endregion
+//#region src/hub/server/hubRegister.ts
+/**
+* Annotate an inbound transport so every request carries its wire id in a
+* {@link RegisterCallContext}. Synchronous and signature-agnostic: it neither
+* verifies signatures nor checks capabilities (that has already happened on the
+* forwarded path — see {@link registerHubServiceIdRegistry}). It exists only so
+* a hub-hosted handler can recover the request id the typed channel would
+* otherwise strip.
+*/
+function withRequestIdContext(link) {
+	return {
+		send: (message) => link.send(message),
+		setListener: (listener) => {
+			if (listener === void 0) {
+				link.setListener(void 0);
+				return;
+			}
+			link.setListener((message) => {
+				const requestId = isRequest(message) ? message.id : void 0;
+				const contextual = {
+					...message,
+					context: { requestId }
+				};
+				Object.defineProperty(contextual, "context", {
+					enumerable: false,
+					writable: false
+				});
+				listener(contextual);
+			});
+		},
+		dispose: () => link.dispose()
+	};
+}
+/**
+* Install the hub's privileged **claim front door** — the typed
+* `hubServiceIdRegistry::registerServiceId` handler — onto the hub services
+* `connection` (mounted under `hubServiceId`).
+*
+* Unlike the per-overlay `registerHubServices` front door — which only lets a
+* participant claim *within its provenance-granted namespace* — this endpoint
+* is the path for claiming a prefix **outside** that namespace.
+*
+* The handler is a **pure side effect**. Authentication (signature) and
+* authorization (an admin-rooted capability that permits
+* `hub::hubServiceIdRegistry::registerServiceId` for the requested
+* `requestedPrefix`) are enforced *before* the call ever reaches here, by the
+* {@link import('./forwardedCallGate').withForwardedCallGate forwarded-call
+* gate} every untrusted participant sits behind. By the time the request lands,
+* it is already known to be authentic and authorized, so the handler only:
+*
+* 1. validates the prefix is well-formed;
+* 2. resolves the link the request was forwarded from via
+*    {@link Hub.getSourceTransport} (keyed by {@link RegisterCallContext.requestId});
+*    and
+* 3. binds the prefix to that link via {@link Hub.claimPrefix}.
+*
+* The source transport answers only *where* to route the prefix, never
+* *whether* the claim is allowed.
+*/
+function registerHubServiceIdRegistry(connection, options) {
+	const { hub, hubServiceId } = options;
+	connection.register(hubServiceIdRegistryInterface, { registerServiceId: async ({ requestedPrefix }, ctx) => {
+		const prefixError = validatePrefix(requestedPrefix);
+		if (prefixError) throw new RpcError(prefixError, ErrorCode.invalidParams);
+		const origin = ctx.requestId !== void 0 ? hub.getSourceTransport(ctx.requestId) : void 0;
+		if (origin === void 0) throw new RpcError("no source link for claim", ErrorCode.invalidRequest);
+		try {
+			hub.claimPrefix(origin, requestedPrefix);
+		} catch (e) {
+			throw new RpcError(e instanceof Error ? e.message : String(e), ErrorCode.invalidRequest, { prefix: requestedPrefix });
+		}
+		return {};
+	} }, { serviceId: hubServiceId });
+}
+//#endregion
+//#region src/hub/server/hubServices.ts
+function createHubServiceInterfaces(hub, options = {}) {
+	const hubServiceId = options.hubServiceId ?? "hub";
+	const link = hub.attachOut({
+		exclusiveHubRootHandler: true,
+		routePrefixes: [hubServiceId]
+	});
+	hub.markInspectionService(link, hubServiceId);
+	const connection = LinkRpcConnection.fromTransport(withRequestIdContext(link.transport));
+	const inspector = new HubInspector(hub);
+	registerInspectionInterfaces(connection, hub, inspector, hubServiceId, link.portId, options.descriptors);
+	registerHubReflection(connection, hub, hubServiceId, options.beforeDirectoryQuery);
+	registerHubServiceIdRegistry(connection, {
+		hub,
+		hubServiceId
+	});
+	return {
+		connection,
+		hubServiceId,
+		inspector,
+		dispose: () => {
+			inspector.dispose();
+			connection.close();
+			link.dispose();
+		}
+	};
+}
+function registerInspectionInterfaces(connection, hub, inspector, hubServiceId, portId, descriptors) {
+	connection.register(nodeInterface, { getNodeId: () => ({
+		nodeId: hub.nodeId,
+		portId,
+		...descriptors !== void 0 ? { descriptors: [...descriptors] } : {}
+	}) }, { serviceId: hubServiceId });
+	connection.register(topologyInterface, {
+		getGraph: () => hub.getTopologyGraph(hubServiceId),
+		watchGraph: (_params, _ctx, stream) => new Promise((resolve) => {
+			if (stream.signal.aborted) {
+				resolve({});
+				return;
+			}
+			let pending = false;
+			const flush = () => {
+				pending = false;
+				if (!stream.signal.aborted) stream.send({}).catch(() => void 0);
+			};
+			const unsubscribe = hub.onDidChangeTopology(() => {
+				if (pending) return;
+				pending = true;
+				queueMicrotask(flush);
+			});
+			stream.signal.addEventListener("abort", () => {
+				unsubscribe();
+				resolve({});
+			}, { once: true });
+		})
+	}, { serviceId: hubServiceId });
+	connection.register(trafficInterface, {
+		watch: ({ methodPrefix, trafficIgnoreKey, focusRequest }, _ctx, stream) => runTrafficWatch(inspector, {
+			methodPrefix,
+			trafficIgnoreKey,
+			focusRequest
+		}, stream),
+		watchWithPayloads: ({ methodPrefix, maxPayloadBytes, trafficIgnoreKey, focusRequest }, _ctx, stream) => runTrafficWatch(inspector, {
+			methodPrefix,
+			maxPayloadBytes,
+			trafficIgnoreKey,
+			focusRequest
+		}, stream)
+	}, { serviceId: hubServiceId });
+}
+async function runTrafficWatch(inspector, options, stream) {
+	const subscription = inspector.subscribe(options, (event) => stream.send(event));
+	const dispose = () => subscription.dispose();
+	if (stream.signal.aborted) dispose();
+	else stream.signal.addEventListener("abort", dispose, { once: true });
+	try {
+		return await subscription.closed;
+	} finally {
+		stream.signal.removeEventListener("abort", dispose);
+		subscription.dispose();
+	}
+}
+/**
+* Register the hub's **reflection** surface — `hubrpc.directory::list` /
+* `hubrpc.schemas::get` — on `connection`, mounted under `hubServiceId`.
+*
+* This is the always-on half of {@link createHubServiceInterfaces}: the
+* destination every {@link RootOverlay} directory *refers* world-view queries
+* to, independent of whether the signed, capability-gated claim front door
+* ({@link registerHubServiceIdRegistry}) is enabled.
+*
+* `directory.list` returns the hub's own services plus the referrals explicitly
+* returned by participant connection-root directories. Routing claims do not
+* create directory entries: a routable service that is not explicitly listed
+* remains callable when already known but is not discoverable.
+*/
+function registerHubReflection(connection, hub, hubServiceId, beforeDirectoryQuery) {
+	connection.register(directoryInterface, {
+		list: ({ interfaceId, interfaceIdPrefix, serviceId, serviceIdScopes }) => {
+			return { items: [{
+				serviceId: hubServiceId,
+				interfaceId: directoryInterface.info.id,
+				interfaceHash: directoryInterface.schemaHash,
+				reachableServiceIds: [{ prefix: hubServiceId }]
+			}].filter((it) => interfaceId === void 0 || it.interfaceId === interfaceId).filter((it) => interfaceIdPrefix === void 0 || it.interfaceId.startsWith(interfaceIdPrefix)).filter((it) => serviceId === void 0 || it.serviceId === serviceId).filter((it) => serviceIdMatchesScopes(it.serviceId, serviceIdScopes)) };
+		},
+		watch: directoryWatchNever
+	});
+	connection.register(schemasInterface, { get: ({ interfaceId, hash }) => {
+		const iface = connection.findRegisteredInterface(interfaceId, hash);
+		if (!iface) throw new RpcError("Interface not found", ErrorCode.methodNotFound, {
+			reason: "unknown-interface",
+			interfaceId,
+			hash
+		});
+		return { schema: iface.toSchema() };
+	} });
+	connection.register(directoryInterface, {
+		list: async ({ interfaceId, interfaceIdPrefix, serviceId, serviceIdScopes }) => {
+			await beforeDirectoryQuery?.();
+			const items = [];
+			for (const r of connection.listRegisteredInterfaces()) items.push(r);
+			const rootListings = await hub.queryParticipantRoots(`${directoryInterface.info.id}::list`, { interfaceId: directoryInterface.info.id }, hubServiceId);
+			for (const raw of rootListings) {
+				const page = raw;
+				if (!page || !Array.isArray(page.items)) continue;
+				for (const it of page.items) {
+					if (it.serviceId === "") continue;
+					items.push(it);
+				}
+			}
+			const deduplicated = /* @__PURE__ */ new Map();
+			for (const item of items) {
+				const key = `${item.serviceId}\0${item.interfaceId}\0${item.interfaceHash}`;
+				const previous = deduplicated.get(key);
+				if (previous === void 0) {
+					deduplicated.set(key, item);
+					continue;
+				}
+				const preferred = item.serviceDescription !== void 0 || item.rootPrincipalSets !== void 0 ? item : previous;
+				if (item.interfaceId !== directoryInterface.info.id) {
+					deduplicated.set(key, preferred);
+					continue;
+				}
+				const previousScopes = previous.reachableServiceIds ?? [{ prefix: previous.serviceId }];
+				const itemScopes = item.reachableServiceIds ?? [{ prefix: item.serviceId }];
+				deduplicated.set(key, {
+					...preferred,
+					reachableServiceIds: normalizeServiceIdScopes([...previousScopes, ...itemScopes])
+				});
+			}
+			return { items: [...deduplicated.values()].filter((it) => interfaceId === void 0 || it.interfaceId === interfaceId).filter((it) => interfaceIdPrefix === void 0 || it.interfaceId.startsWith(interfaceIdPrefix)).filter((it) => serviceId === void 0 || it.serviceId === serviceId).filter((it) => serviceIdMatchesScopes(it.serviceId, serviceIdScopes)).map((it) => ({
+				serviceId: it.serviceId,
+				interfaceId: it.interfaceId,
+				interfaceHash: it.interfaceHash,
+				...it.serviceDescription !== void 0 ? { serviceDescription: it.serviceDescription } : {},
+				...it.rootPrincipalSets !== void 0 ? { rootPrincipalSets: it.rootPrincipalSets.map((s) => [...s]) } : {},
+				...it.reachableServiceIds !== void 0 ? { reachableServiceIds: [...it.reachableServiceIds] } : {}
+			})) };
+		},
+		watch: async (params, _ctx, stream) => {
+			await beforeDirectoryQuery?.();
+			return new Promise((resolve) => {
+				if (stream.signal.aborted) {
+					resolve({});
+					return;
+				}
+				let pending = false;
+				const flush = () => {
+					pending = false;
+					if (stream.signal.aborted) return;
+					stream.send({}).catch(() => void 0);
+				};
+				const notify = () => {
+					if (pending) return;
+					pending = true;
+					queueMicrotask(flush);
+				};
+				const unsubscribeRouting = hub.onDidChangeRouting(notify);
+				const unsubscribeLocal = connection.onDidChangeDirectory(notify);
+				const participantWatches = hub.watchParticipantRoots(`${directoryInterface.info.id}::watch`, params, notify, hubServiceId);
+				stream.signal.addEventListener("abort", () => {
+					unsubscribeRouting();
+					unsubscribeLocal();
+					participantWatches.dispose();
+					resolve({});
+				}, { once: true });
+			});
+		}
+	}, { serviceId: hubServiceId });
+	connection.register(schemasInterface, { get: ({ interfaceId, hash }) => {
+		const iface = connection.findRegisteredInterface(interfaceId, hash);
+		if (!iface) throw new RpcError("Interface not found", ErrorCode.methodNotFound, {
+			reason: "unknown-interface",
+			interfaceId,
+			hash
+		});
+		return { schema: iface.toSchema() };
+	} }, { serviceId: hubServiceId });
+}
+//#endregion
+//#region src/hub/server/connectionTokenBinderService.ts
+function assertUnderPrefix(value, prefixes, field, configuredPrefix) {
+	if (!prefixes.some((p) => value.startsWith(p))) throw new RpcError(`${field} "${value}" is outside this binder's granted ${configuredPrefix} ${JSON.stringify(prefixes)}`, ErrorCode.invalidRequest);
+}
+/**
+* Install `connectionTokenBinder::bindConnectionToken` on `connection`.
+*
+* Two forms, selected by {@link RegisterConnectionTokenBinderOptions.serviceId}:
+*
+* - **root form** (no `serviceId`): installed at a participant's overlay root
+*   (root form, never forwarded → never gated). Safe because only the specific
+*   trusted connection the acceptor installed it on can reach it.
+* - **forwarded form** (`serviceId` set): mounted as a routable hub service so
+*   any participant can discover and call it. Safe only because forwarded calls
+*   go through the hub's forwarded-call gate; the same prefix checks still bound
+*   what any caller may mint.
+*
+* Each call mints a single-use token binding the requested `identitySlot` and/or
+* `serviceIdNamespace`, provided each requested field falls under the matching
+* configured prefix. Omitting a field leaves that axis unbound.
+*/
+function registerConnectionTokenBinderService(connection, options) {
+	const { store, identitySlotPrefixes, serviceIdPrefixes, ttlMs, serviceId } = options;
+	connection.register(connectionTokenBinderInterface, { bindConnectionToken: ({ identitySlot, serviceIdNamespace }) => {
+		const binding = {};
+		if (identitySlot !== void 0) {
+			assertUnderPrefix(identitySlot, identitySlotPrefixes, "identitySlot", "identitySlotPrefix");
+			binding.identitySlot = identitySlot;
+		}
+		if (serviceIdNamespace !== void 0) {
+			assertUnderPrefix(serviceIdNamespace, serviceIdPrefixes, "serviceIdNamespace", "serviceIdPrefix");
+			binding.grantedServiceIdNamespace = serviceIdNamespace;
+		}
+		const minted = ttlMs !== void 0 ? store.mint(binding, ttlMs) : store.mint(binding);
+		return {
+			token: minted.token,
+			expiresAt: minted.expiresAt
+		};
+	} }, serviceId !== void 0 ? { serviceId } : {});
+}
+//#endregion
+//#region src/hub/server/connectionHandler.ts
+/**
+* Walk `factories` in order; return the first handler that claims `token`, or
+* `undefined` if none do (the caller drops the connection).
+*/
+function resolveConnectionHandler(factories, token) {
+	for (const factory of factories) {
+		const handler = factory.handle(token);
+		if (handler !== void 0) return handler;
+	}
+}
+/**
+* Install a participant's root services from a resolved {@link RootProvision}:
+* the always-on claim/directory front door and consent surface, plus (when
+* present) the minting front door and lazy managed identity. This is the single
+* shared installer every built-in handler funnels through.
+*/
+function provisionRoot(ctx, provision) {
+	registerHubServices(ctx.root, ctx.upstream, {
+		hubServiceId: ctx.hubServiceId,
+		...provision.grantedServiceIdNamespace !== void 0 ? { grantedServiceIdNamespace: provision.grantedServiceIdNamespace } : {},
+		...ctx.authorizeClaim !== void 0 ? { authorizeClaim: ctx.authorizeClaim } : {}
+	});
+	ctx.installHubAccess?.(ctx.root);
+	if (provision.connectionTokenBinder !== void 0) registerConnectionTokenBinderService(ctx.root, provision.connectionTokenBinder);
+	if (provision.resolveIdentity !== void 0) registerIdentityServices(ctx.root, {
+		resolveIdentity: provision.resolveIdentity,
+		...provision.storage !== void 0 ? { storage: provision.storage } : {}
+	});
+}
+/**
+* A factory that claims **any** connection (optionally gated by `claims`) and
+* provisions a fixed root. Used for the `anonymous` handler (claims all), the
+* `static` handler (claims a matching token), and dial-in endpoints (claims all,
+* no token).
+*/
+function fixedProvisionHandler(provision, claims = () => true) {
+	return { handle: (token) => claims(token) ? (ctx) => provisionRoot(ctx, provision) : void 0 };
+}
+/** The `anonymous` handler: claims every connection, provisioning `provision`. */
+function anonymousHandler(provision) {
+	return fixedProvisionHandler(provision);
+}
+/** The `static` handler: claims connections whose token equals `value`. */
+function staticTokenHandler(value, provision) {
+	return fixedProvisionHandler(provision, (token) => token === value);
+}
+/**
+* The `bound` handler: claims connections whose token is live in `store`, and on
+* claim **redeems** it (single-use) to derive the provisioned identity slot
+* and/or granted serviceId namespace. `resolveSlot` turns a redeemed slot into
+* a lazy identity resolver plus its per-identity storage (injected so this stays
+* node-agnostic).
+*/
+function boundTokenHandler(store, resolveSlot) {
+	return { handle: (token) => {
+		if (!store.peek(token)) return void 0;
+		return (ctx) => {
+			const binding = store.redeem(token);
+			if (binding === void 0) throw new Error("bound token was consumed between accept and redeem");
+			provisionRoot(ctx, {
+				...binding.grantedServiceIdNamespace !== void 0 ? { grantedServiceIdNamespace: binding.grantedServiceIdNamespace } : {},
+				...binding.identitySlot !== void 0 ? resolveSlot(binding.identitySlot) : {}
+			});
+		};
+	} };
+}
+//#endregion
+//#region src/hub/server/verifiedSignature.ts
+/**
+* Wrap an inbound transport so every request's `$hubrpc` signature is verified
+* **eagerly, at the door** — a pure authenticity gate with no capability check:
+*
+* - a **valid** signature → the request is delivered unchanged;
+* - an **invalid** signature → the request is **rejected** here (an error
+*   response is sent and the message is never delivered);
+* - an **unsigned** call (no envelope) → delivered unchanged, so keyless
+*   connections still work.
+*
+* This is the signature half of the hub's trust model. *Authorization*
+* (capability chains) is **not** this wrapper's job — that is enforced
+* separately by {@link import('./forwardedCallGate').withForwardedCallGate} on
+* the hub-facing (forwarded) path. The root overlay uses this wrapper on its own
+* root-form calls (consent / identity front doors), which never pass through the
+* forwarded-call gate and so need their authenticity established here.
+*
+* When `verifySignatures` is not `true`, the transport is returned unchanged (no
+* verification, every message passes verbatim).
+*
+* Verification is async but in-order delivery is preserved via a per-link
+* promise chain.
+*/
+function withVerifiedSignature(link, options = {}) {
+	if (options.verifySignatures !== true) return link;
+	return {
+		send: (message) => link.send(message),
+		setListener: (listener) => {
+			if (listener === void 0) {
+				link.setListener(void 0);
+				return;
+			}
+			let chain = Promise.resolve();
+			link.setListener((message) => {
+				chain = chain.then(async () => {
+					if (await _rejectedBadSignature(link, message)) return;
+					listener(message);
+				}).catch((e) => {
+					console.error("Error in inbound signature verification:", e);
+				});
+			});
+		},
+		dispose: () => link.dispose()
+	};
+}
+/**
+* Verify a single inbound request's signature. Returns `true` (and sends an
+* error response over `link`) when the signature is present but invalid;
+* returns `false` — the message should be delivered — for a valid signature, an
+* unsigned call, or a non-request.
+*/
+async function _rejectedBadSignature(link, message) {
+	if (!isRequest(message)) return false;
+	const res = await verifyRpcCall({
+		wireMethod: message.method,
+		wireParams: message.params
+	});
+	if (!res.ok) {
+		link.send({
+			jsonrpc: "2.0",
+			id: message.id,
+			error: {
+				code: ErrorCode.invalidRequest,
+				message: res.reason
+			}
+		});
+		return true;
+	}
+	return false;
+}
+//#endregion
+//#region src/hub/server/forwardedCallGate.ts
+/**
+* A **signature front door** for fully-qualified calls. Wrap an incoming
+* transport with this before attaching it to a hub or constructing the serving
+* connection, so every `serviceId::interfaceId::member` call must carry a
+* valid `$hubrpc` signature.
+* Unsigned or tampered calls are rejected with an error response and never
+* reach the downstream hub or connection.
+*
+* What passes **verbatim** (ungated):
+* - responses;
+* - root-addressed requests (`interfaceId::member`) and bare requests
+*   (`member`) — these always terminate at the connection root and are never
+*   forwarded; and
+* - requests targeting an {@link ForwardedCallGateOptions.exemptPrefixes exempt
+*   prefix} (the hub's own services, which gate themselves).
+*
+* The gate **does not strip** the envelope: signed wire params keep the real
+* call params at the top level alongside `$hubrpc`/`$hubrpcUnsigned`, so the
+* target's typed handler recovers them via schema-stripping while a target that
+* cares may re-verify as defense-in-depth. Authorization is *not* this gate's
+* job (unless {@link ForwardedCallGateOptions.requireCapability} is set): it
+* proves *who* is calling, leaving *whether they may* to the capability layer.
+*
+* In-order delivery toward the hub is preserved across the async verification:
+* inbound messages are processed through a single serial queue.
+*/
+function withForwardedCallGate(inner, options) {
+	return withFullyQualifiedCallGate(inner, options);
+}
+/** Explicitly named alias for {@link withForwardedCallGate}. */
+function withFullyQualifiedCallGate(inner, options) {
+	return new ForwardedCallGate(inner, options);
+}
+var ForwardedCallGate = class {
+	_inner;
+	_options;
+	_exempt;
+	/**
+	* Per-call nonces already admitted on this link. A call replaying a
+	* nonce is rejected — this is the single replay ledger, and it makes any
+	* `callBind`-scoped capability single-use for free.
+	*/
+	_seenNonces = /* @__PURE__ */ new Set();
+	_downstream;
+	/** Serializes inbound processing so async verification never reorders the stream. */
+	_tail = Promise.resolve();
+	constructor(_inner, _options) {
+		this._inner = _inner;
+		this._options = _options;
+		this._exempt = new Set(_options.exemptPrefixes ?? []);
+	}
+	/** hub → participant: verbatim, never gated. */
+	send(message) {
+		this._inner.send(message);
+	}
+	setListener(listener) {
+		this._downstream = listener;
+		this._inner.setListener(listener === void 0 ? void 0 : (message) => {
+			this._tail = this._tail.then(() => this._process(message));
+		});
+	}
+	dispose() {
+		this._inner.dispose();
+	}
+	async _process(m) {
+		if (!isRequest(m) && !isNotification(m)) {
+			this._downstream?.(m);
+			return;
+		}
+		const parsed = parseMethodName(m.method);
+		if (!parsed || parsed.kind !== "full" || this._exempt.has(parsed.serviceId)) {
+			this._downstream?.(m);
+			return;
+		}
+		await this._gate(m);
+	}
+	async _gate(call) {
+		const nowMs = this._options.nowMs?.();
+		const res = await verifyCall({
+			method: call.method,
+			params: call.params,
+			parseMethod: methodNameToTarget,
+			requireCapability: this._options.requireCapability === true,
+			...nowMs !== void 0 ? { nowMs } : {}
+		});
+		if (!res.ok) {
+			const code = res.kind === "capability" ? ErrorCode.permissionRequired : ErrorCode.invalidRequest;
+			this._reject(call, code, res.reason);
+			return;
+		}
+		if (this._seenNonces.has(res.nonce)) {
+			this._reject(call, ErrorCode.invalidRequest, "replayed request nonce");
+			return;
+		}
+		if (this._options.requireCapability === true) {
+			const verdict = await permits(res.call, res.capabilities, (serviceId) => this._acceptedRootIssuers(serviceId), nowMs ?? Date.now());
+			if (!verdict.ok) {
+				this._reject(call, ErrorCode.permissionRequired, verdict.reason);
+				return;
+			}
+		}
+		this._seenNonces.add(res.nonce);
+		this._downstream?.(call);
+	}
+	_reject(call, code, message) {
+		if (!isRequest(call)) return;
+		this._inner.send({
+			jsonrpc: "2.0",
+			id: call.id,
+			error: {
+				code,
+				message
+			}
+		});
+	}
+	_acceptedRootIssuers(serviceId) {
+		if (this._options.requireCapability !== true) return [];
+		if (this._options.trustedRoots !== void 0) return this._options.trustedRoots.map(({ principal }) => ({
+			principal,
+			isPublic: true
+		}));
+		return this._options.acceptedRootIssuers(serviceId);
+	}
+};
+//#endregion
+//#region src/hub/server/hubConnectionAcceptor.ts
+/**
+* Bridges accepted transports onto the hubv2 graph via a pluggable chain of
+* {@link ConnectionHandlerFactory connection handlers}. For each transport it:
+*
+* 1. attaches an uplink to the central hub and builds a {@link RootOverlay};
+* 2. resolves the first handler whose token check claims the connection and
+*    lets it install the participant's root services (claim/directory front
+*    door + consent, and optionally identity, granted namespace, minting) —
+*    dropping the connection if none claim; and
+* 3. connects the participant, disposing the overlay and detaching the uplink
+*    (which releases its claimed prefixes) when the transport closes.
+*
+* It never names a backend transport type — hand it any {@link ITransportServer}.
+*/
+var HubConnectionAcceptor = class {
+	_options;
+	_accepted = /* @__PURE__ */ new Set();
+	_disposed = false;
+	constructor(_options) {
+		this._options = _options;
+		this._options.server.setConnectionHandler((t) => {
+			this._accept(t);
+		});
+	}
+	_accept(transport) {
+		if (this._disposed) {
+			transport.dispose();
+			return;
+		}
+		let accepted;
+		try {
+			accepted = this._wire(transport);
+		} catch (e) {
+			this._options.onError?.(e instanceof Error ? e : new Error(String(e)));
+			transport.dispose();
+			return;
+		}
+		this._accepted.add(accepted);
+		transport.onDidClose(() => {
+			accepted.overlay.dispose();
+			accepted.topology.dispose();
+			accepted.upstream.dispose();
+			this._accepted.delete(accepted);
+		});
+		this._options.onAttached?.({ overlay: accepted.overlay });
+	}
+	/**
+	* Wrap the hub-facing link per the {@link ForwardCheckingPolicy}. The
+	* option union guarantees that capability mode always carries its
+	* `adminIds` trust anchors, so this can never silently fail closed by
+	* forgetting them.
+	*/
+	_gateHubFacing(inner) {
+		if (this._options.verifyForwardedCalls !== true) return inner;
+		if (this._options.requireForwardedCapability === true) {
+			const adminIds = [...this._options.adminIds];
+			return withForwardedCallGate(inner, {
+				requireCapability: true,
+				acceptedRootIssuers: () => adminIds.map((nodeId) => ({
+					principal: nodeId,
+					isPublic: true
+				}))
+			});
+		}
+		const adminIds = this._options.adminIds !== void 0 ? [...this._options.adminIds] : void 0;
+		return withForwardedCallGate(inner, { ...adminIds !== void 0 ? { acceptedRootIssuers: () => adminIds.map((nodeId) => ({
+			principal: nodeId,
+			isPublic: true
+		})) } : {} });
+	}
+	_wire(transport) {
+		const token = transport.initializeToken;
+		const handler = resolveConnectionHandler(this._options.handlers, token);
+		if (handler === void 0) throw new Error("no connection handler accepted the presented token");
+		const pair = new TransportPair();
+		const hubFacing = this._gateHubFacing(pair.b);
+		const upstream = this._options.hub.attach(hubFacing);
+		const overlay = new RootOverlay({
+			uplink: pair.a,
+			uplinkPortId: upstream.portId
+		});
+		const topology = this._options.hub.registerManagedRoutingTopology(upstream, overlay.managedTopology(upstream.edgeId, transport.topologyInfo));
+		const policy = this._options.policy;
+		const ctx = {
+			root: overlay.root,
+			upstream,
+			hub: this._options.hub,
+			transport,
+			token,
+			hubServiceId: this._options.hubServiceId ?? "hub",
+			...policy !== void 0 ? { authorizeClaim: (requestedPrefix) => policy.authorizeClaim({
+				principal: void 0,
+				transport,
+				requestedPrefix
+			}) } : {},
+			...this._options.installHubAccess !== void 0 ? { installHubAccess: this._options.installHubAccess } : {}
+		};
+		try {
+			handler(ctx);
+			const verifySignatures = this._options.verifyForwardedCalls === true;
+			overlay.connectParticipant(withVerifiedSignature(transport, { verifySignatures }));
+			return {
+				overlay,
+				upstream,
+				topology
+			};
+		} catch (error) {
+			overlay.dispose();
+			topology.dispose();
+			upstream.dispose();
+			throw error;
+		}
+	}
+	dispose() {
+		if (this._disposed) return;
+		this._disposed = true;
+		for (const accepted of this._accepted) {
+			accepted.overlay.dispose();
+			accepted.topology.dispose();
+			accepted.upstream.dispose();
+		}
+		this._accepted.clear();
+		this._options.server.dispose();
+	}
+};
+//#endregion
+export { validatePrefix as S, RootOverlay as _, anonymousHandler as a, Hub as b, provisionRoot as c, registerConnectionTokenBinderService as d, createHubServiceInterfaces as f, registerIdentityServices as g, registerHubServices as h, withVerifiedSignature as i, resolveConnectionHandler as l, withRequestIdContext as m, withForwardedCallGate as n, boundTokenHandler as o, registerHubServiceIdRegistry as p, withFullyQualifiedCallGate as r, fixedProvisionHandler as s, HubConnectionAcceptor as t, staticTokenHandler as u, OverlaySplitter as v, ForwardingTable as x, HubInspector as y };
+
+//# sourceMappingURL=hubConnectionAcceptor-B5-8JsFY.js.map