@hediet/linkrpc-hub 0.0.1

package/dist/chunks/hubConnectionAcceptor-BwydvFa4.d.ts

@@ -0,0 +1,1560 @@
+import { o as NodeTransit, s as NodeTransitObserver } from "./nodeTransit-cmtZgdpW.js";
+import { Capability, ChannelTransport, IMessageTransport, Identity, JsonRpcMessage, JsonValue, LinkRpcConnection, ManagedIdentityStorageBackend, MessageWithCtx, Pattern, Permission, PrincipalId, RequestId, RootPrincipalSet, SignedCapability, SigningIdentity } from "@hediet/linkrpc";
+import { ITransportServer, ServiceId, Transport } from "@hediet/linkrpc/hub/common";
+import { NodeInfo, ParticipantDescriptorSource, TopologyGraph, TopologyIdGenerator, TopologyTransportInfo, TrafficEvent, TrafficSubscription, TrafficSubscriptionOptions, TrafficTransitEvent } from "@hediet/linkrpc/inspection";
+//#region src/hub/server/routing/routingTopology.d.ts
+interface ManagedRoutingTopology {
+  readonly node: TopologyGraph['nodes'][number];
+  readonly hubLinks: readonly {
+    readonly hubPortId: string;
+    readonly nodePortId: string;
+    readonly label?: string;
+  }[];
+  readonly peerPortId: string;
+  readonly peerLinkLabel?: string;
+  readonly peerTransport?: TopologyTransportInfo;
+  readonly adjacentNodes?: TopologyGraph['nodes'];
+  readonly adjacentLinks?: TopologyGraph['links'];
+}
+interface ManagedTopologyFragment {
+  readonly nodes: TopologyGraph['nodes'];
+  readonly links?: TopologyGraph['links'];
+  readonly routes?: TopologyGraph['routes'];
+}
+//#endregion
+//#region src/hub/server/routing/routingHub.d.ts
+/**
+ * Diagnostics sink for a {@link Hub}. Deliberately structurally compatible
+ * with VS Code's `LogOutputChannel`, so an extension can pass its log channel
+ * straight in without an adapter.
+ *
+ * The hub only ever logs *routing decisions* — method names, the resolution
+ * kind, claimed prefixes and error reasons — never message **payloads**
+ * (params/results), so attaching a logger never leaks call arguments.
+ */
+interface IHubLogger {
+  trace(message: string): void;
+  debug(message: string): void;
+  info(message: string): void;
+  warn(message: string): void;
+  error(message: string): void;
+}
+interface HubOptions {
+  /** Name used in error payloads / diagnostics. */
+  readonly debugName?: string;
+  /** Optional diagnostic descriptor for this routing node. */
+  readonly descriptors?: readonly ParticipantDescriptorSource[];
+  /** Stable topology identity for this hub. A random id is generated by default. */
+  readonly nodeId?: string;
+  /** Topology node/port ID generator. Defaults to random UUIDs; never used for security nonces. */
+  readonly generateTopologyId?: TopologyIdGenerator;
+  /**
+   * Optional diagnostics sink. When omitted the hub logs nothing and pays no
+   * string-formatting cost (log calls short-circuit on the missing logger).
+   */
+  readonly logger?: IHubLogger;
+  /**
+   * Per-request idle timeout in milliseconds. A forwarded request whose
+   * stream is idle for this long (no response, no stream message, no
+   * keepalive ping) is cancelled toward its target and failed back to its
+   * origin with a `requestTimeout` error. Defaults to 30 minutes. Set to
+   * `0` (or a negative value) to disable — only sensible in tests, since
+   * it removes the hub's bound on `_pending` growth.
+   */
+  readonly idleTimeoutMs?: number;
+  /** Positive deadline per automatic peer probe, in ms (default 1000). Failures retry in the background. */
+  readonly peerIdentificationTimeoutMs?: number;
+  /**
+   * Optional initial node-transit observer. Additional observers can be
+   * attached dynamically with {@link Hub.observeTransits}. When set, the hub emits a
+   * {@link NodeTransit} for every message it routes (requests, responses,
+   * notifications, stream frames). Off by default — when omitted the emit
+   * sites short-circuit and allocate nothing. Never carries more than the
+   * method/params/result the hub already handles.
+   */
+  readonly onTransit?: NodeTransitObserver;
+}
+/** Minimal disposable handle; calling `dispose` detaches the link. */
+interface IDisposable {
+  dispose(): void;
+}
+/** A snapshot row from {@link Hub.pendingRequests}: one in-flight forward. */
+interface PendingRequestInfo {
+  /** Hub-rewritten id the target sees. */
+  readonly hubId: string;
+  /** Original id the origin used. */
+  readonly originalId: RequestId;
+  /** Fully-qualified method. */
+  readonly method: string;
+  /** Edge the request arrived on. */
+  readonly originEdgeId: string;
+  /** Edge the request was forwarded to. */
+  readonly targetEdgeId: string;
+  /** Milliseconds the request has been in flight. */
+  readonly ageMs: number;
+}
+/**
+ * Handle returned by {@link Hub.attach}. Beyond detaching the link, it lets
+ * the caller claim/release prefixes *bound to this specific link* without
+ * holding a reference to the link itself — the seam a {@link RootOverlay}
+ * uses to let its root services claim upstream on the participant's behalf.
+ */
+interface AttachedLink extends IDisposable {
+  /** Make this link the hub's root handler. Throws if another link already holds the role. */
+  setAsLoopback(): void;
+  /** Bind `prefix` to this link (see {@link Hub.claimPrefix}). */
+  addPrefixRoute(prefix: ServiceId): void;
+  /** Release `prefix` from the table. Returns `true` if it existed. */
+  releasePrefix(prefix: ServiceId): boolean;
+  /**
+   * The stable inspection id the hub uses for this link in its
+   * {@link NodeTransit} events. A neighbouring node (e.g. an
+   * {@link import('./overlaySplitter').OverlaySplitter}) should label the
+   * *same physical edge* with this id so a {@link TransitAggregator} chains
+   * the two nodes' transits across the boundary.
+   */
+  readonly edgeId: string;
+  /** Stable topology port identity, independent of the mutable friendly edge label. */
+  readonly portId: string;
+  /** Await or retry peer discovery. Discovery also runs automatically after attachment. */
+  identifyPeer(): Promise<NodeInfo>;
+  /** Send a bounded root request to the far end while the Hub owns dispatch. */
+  request(method: string, params: JsonValue, timeoutMs?: number): Promise<JsonValue | undefined>;
+}
+interface AttachLinkOptions {
+  readonly edgeId?: string;
+  readonly transport?: TopologyTransportInfo;
+  /** Make this link the sole hub-root handler. Throws if another link already holds the role. */
+  readonly exclusiveHubRootHandler?: boolean;
+  /** Initial prefix routes. All must be valid, distinct, and unclaimed. */
+  readonly routePrefixes?: readonly ServiceId[];
+}
+/**
+ * A **Hub** is the entire routing concept of linkrpc v2 — the only noun.
+ * It is a tiny message router with an unauthenticated topology-correlation
+ * identity and exactly three moving
+ * parts, all expressed as {@link IMessageTransport} links:
+ *
+ * - **forwarding table** — longest-prefix serviceId → link map (the
+ *   downstream neighbours / claimed subnets).
+ * - **loopback** — an optional link to the local root services (`bare`/
+ *   `interface`-form calls land here and *never* leave the hub). This is
+ *   the routing equivalent of `127.0.0.1`.
+ * - **uplink** — an optional default route. A hub *with* an uplink is also
+ *   a participant of its parent hub, which is how hubs **nest** (a VS Code
+ *   window hub uplinks to an OS hub uplinks to a home-server hub).
+ *
+ * Routing is pure longest-prefix forwarding with JSON-RPC id rewriting:
+ * a forwarded request keeps its full method name verbatim; only its `id`
+ * is swapped for a hub-local one so responses can be demultiplexed back to
+ * the originating link. There is no notion of identity, capabilities, or
+ * trust at this layer — those are policies layered on top.
+ *
+ * The single privileged write seam is {@link claimPrefix}; everything else
+ * is mechanical message shuffling.
+ */
+declare class Hub {
+  private readonly _options;
+  /** Unauthenticated topology-correlation identity for this hub. */
+  readonly nodeId: string;
+  private readonly _table;
+  private readonly _links;
+  private readonly _pending;
+  private _uplink;
+  private _loopback;
+  private _nextId;
+  private readonly _log;
+  private readonly _transitObservers;
+  /**
+   * Listeners notified whenever the forwarding table changes (a prefix is
+   * claimed or released, or a link detaches dropping its claims). Coarse, by
+   * design: it carries no payload — consumers re-query the directory. This is
+   * the "poll now" nudge that backs `hubrpc.directory::watch`.
+   */
+  private readonly _routingListeners;
+  private readonly _topologyListeners;
+  /** Stable inspection label per link; assigned lazily / by prefix claim. */
+  private readonly _edgeIds;
+  private readonly _transportInfo;
+  private _nextEdgeId;
+  private readonly _topology;
+  private readonly _participantRoots;
+  /** Per-request idle timeout in ms; `<= 0` disables. See {@link HubOptions.idleTimeoutMs}. */
+  private readonly _idleMs;
+  constructor(_options?: HubOptions);
+  /** Prefix for log lines; identifies this hub when nested. */
+  private _tag;
+  /** Stable inspection label for a link; auto-assigned on first use. */
+  private _edgeId;
+  /** Give `link` a friendly inspection label (prefix / loopback / uplink). */
+  private _labelEdge;
+  /** Emit a pre-built node transit. Callers guard construction by observer count. */
+  private _emit;
+  private _transitEndpoint;
+  /** Number of live transit observers. */
+  get transitObserverCount(): number;
+  /** Observe routed messages until the returned handle is disposed. */
+  observeTransits(observer: NodeTransitObserver): IDisposable;
+  /**
+   * Publish a transit from a routing node managed by this Hub. Callers should
+   * check {@link transitObserverCount} before constructing the transit.
+   */
+  publishManagedTransit(transit: NodeTransit): void;
+  /** Replace an attached link's direct topology edge with a managed routing node. */
+  registerManagedRoutingTopology(attached: AttachedLink, topology: ManagedRoutingTopology): IDisposable;
+  /** Add an in-process endpoint or routing fragment to this Hub's topology. */
+  registerManagedTopologyFragment(fragment: ManagedTopologyFragment): IDisposable;
+  /**
+   * Subscribe to coarse routing-table changes (prefix claim/release/detach).
+   * The listener receives no arguments — it is a "something changed; re-query"
+   * nudge. Returns an unsubscribe function.
+   */
+  onDidChangeRouting(listener: () => void): () => void;
+  /** Subscribe to topology changes, including routing and background peer discovery. */
+  onDidChangeTopology(listener: () => void): () => void;
+  /** Number of active routing invalidation observers. */
+  get routingObserverCount(): number;
+  get topologyObserverCount(): number;
+  /** Fire all routing-change listeners. Best-effort; one throwing listener does not block the rest. */
+  private _fireRoutingChanged;
+  private _fireTopologyChanged;
+  private _notifyListeners;
+  /** Emit a stream transit with the owning request's correlated endpoints. */
+  private _emitStream;
+  /**
+   * Snapshot the requests currently in flight through this hub. Each row is
+   * one {@link _pending} entry — the authoritative in-flight set — annotated
+   * with its method, the edges it bridges, and how long it has waited. Useful
+   * for surfacing stuck/slow requests in an inspector.
+   */
+  pendingRequests(): PendingRequestInfo[];
+  /**
+   * Begin routing the messages of `link`. The hub installs itself as the
+   * link's listener; do not also attach another listener. Returns a
+   * disposable that stops routing the link (detaching the listener and
+   * dropping any forwarding entries, uplink/loopback slots, and pending
+   * responses bound to it) when disposed. Peer discovery starts in the
+   * background; unresolved or unsupported peers never block routing.
+   */
+  attach(link: IMessageTransport, opts?: AttachLinkOptions): AttachedLink;
+  /**
+   * Attach a fresh in-memory link and hand back its far end alongside the
+   * {@link AttachedLink} handle. Creates a {@link TransportPair} internally,
+   * {@link attach}es the near side to the hub, and returns the attach handle
+   * augmented with `transport` — the far side for a peer (a consumer
+   * connection, an in-process participant, …) to drive. Equivalent to
+   * `const p = new TransportPair(); const link = hub.attach(p.a);
+   * return { ...link, transport: p.b };`. Disposing the returned link also
+   * disposes `transport`.
+   */
+  attachOut(opts?: AttachLinkOptions): AttachedLink & {
+    readonly transport: IMessageTransport;
+  };
+  private _detach;
+  /** Set (or clear) the default route. Automatically attaches the link. */
+  setUplink(link: IMessageTransport | undefined): void;
+  /** Set (or clear) the root handler. Clear the existing handler before assigning a different link. */
+  setLoopback(link: IMessageTransport | undefined): void;
+  /**
+   * Bind a serviceId `prefix` to `link`. Like initial attachment routes,
+   * this is a privileged operation; higher layers enforce who may claim.
+   *
+   * Claim-once: throws if the prefix is malformed or already owned.
+   */
+  claimPrefix(link: IMessageTransport, prefix: ServiceId): void;
+  private _validatePrefixClaim;
+  private _claimPrefix;
+  releasePrefix(prefix: ServiceId): boolean;
+  /** Snapshot of currently-claimed prefixes. */
+  claimedPrefixes(): ServiceId[];
+  /**
+   * Trust the inspection interfaces mounted for `serviceId` on this attached
+   * in-process link. Only exact reserved inspection interface calls are hidden.
+   */
+  markInspectionService(attached: AttachedLink, serviceId: ServiceId): void;
+  /** Build a topology snapshot on demand for the addressed observer service. */
+  getTopologyGraph(observerServiceId: string): TopologyGraph;
+  /**
+   * Fan a **root-form** request out to every distinct downstream participant
+   * link (the claimed-prefix owners), skipping the link that owns
+   * `excludePrefix` (typically the hub's own services prefix) and the uplink.
+   * Each participant is queried **once** even if it owns several prefixes.
+   * Failures (unreachable participant, timeout, no root handler) are dropped,
+   * so the result holds one entry per link that answered.
+   *
+   * The request is delivered to each participant's **root** services — on an
+   * overlay uplink the splitter routes a root-form method to the participant
+   * (`H·root → P`), which is never forwarded and never gated. That is what
+   * lets the hub's global directory gather participant self-listings without
+   * signing or capabilities.
+   */
+  queryParticipantRoots(method: string, params: JsonValue, excludePrefix?: ServiceId): Promise<JsonValue[]>;
+  /**
+   * Keep a root-form streaming request open on every current participant.
+   * Routing changes reconcile the participant set; application stream payloads
+   * are collapsed into a coarse callback so callers can re-query.
+   */
+  watchParticipantRoots(method: string, params: JsonValue, onTick: () => void, excludePrefix?: ServiceId): IDisposable;
+  /**
+   * Send a single request down `link` and resolve with its result — the
+   * hub-originated analogue of {@link _routeRequest}. It allocates a hub id,
+   * parks a {@link _pending} entry whose `origin` is a tiny in-memory sink
+   * that settles this promise on the matching response, and writes the
+   * request to `link`. It therefore reuses the full demux / idle-timeout /
+   * detach machinery: a response routes back through {@link _demux} into the
+   * sink, an idle target fails it via {@link _onIdleTimeout}, and a detaching
+   * target fails it via {@link _detach}.
+   */
+  private _requestOnLink;
+  private _watchOnLink;
+  /**
+   * The link a still-in-flight forwarded request originally arrived on,
+   * keyed by the **hub-rewritten** id the request now carries (i.e. the
+   * `id` a target sees on its delivered message). Valid from the moment the
+   * hub forwards the request until its response is demultiplexed; returns
+   * `undefined` for unknown / already-answered ids.
+   *
+   * This is the seam a hub-hosted participant uses to learn *which* link a
+   * call it is handling came from, so it can bind a prefix claim to that
+   * exact link via {@link claimPrefix} without the routing core ever
+   * growing a notion of authenticated identity.
+   */
+  getSourceTransport(requestId: RequestId): IMessageTransport | undefined;
+  private _onMessage;
+  private _resolve;
+  private _routeRequest;
+  private _routeNotification;
+  private _demux;
+  /**
+   * Route a `$stream::send` notification. Unlike an ordinary notification, a
+   * stream message is **correlated to an in-flight request by `requestId`**,
+   * not addressed by method name — so it follows the same path the request
+   * established (recorded in {@link _pending}), exactly like a
+   * {@link _demux | response}, and the hub rewrites `requestId` across the
+   * forwarding boundary the same way it rewrites a response `id`.
+   *
+   * The message's explicit `dir` picks the traversal — no inference from the
+   * arriving link:
+   *
+   * - **`toCaller`** (callee → caller progress): routed like a response. The
+   *   streamer used the hub-rewritten id it *received*, so `requestId` is a
+   *   pending hub id; only the link the request was forwarded to may stream
+   *   on it. Restore the origin's original id and forward to the origin.
+   * - **`toCallee`** (caller → callee input / cancel / ping): the reverse
+   *   traversal of the same entry. The streamer used the original id it
+   *   *sent*; rewrite `requestId` to the hub id the target was handed and
+   *   forward to the target. Only the origin may stream this direction.
+   *
+   * Every routed stream message resets the request's idle timer (a keepalive
+   * ping is exactly a `toCallee` control with no payload). A `$stream::send`
+   * matching no in-flight request is dropped (late / unknown correlation).
+   */
+  private _routeStream;
+  /** Delete a pending entry and clear its idle timer. */
+  private _deletePending;
+  /** Arm (or re-arm) the idle timer for a pending entry. No-op when disabled. */
+  private _armIdle;
+  /** Reset the idle timer on stream activity. */
+  private _resetIdle;
+  /**
+   * A request went idle past {@link _idleMs}. Cancel the (presumably hung)
+   * callee, fail the caller with a `requestTimeout`, and drop the entry —
+   * the bound that keeps `_pending` from growing without limit.
+   */
+  private _onIdleTimeout;
+  /**
+   * Author a `toCallee` cancel toward `target` for the request the target
+   * knows as `hubId`. Used on caller-disconnect and idle-timeout — the hub
+   * itself originates the message, which is why `dir` is explicit on the
+   * wire (there is no inbound link to infer it from).
+   */
+  private _injectCancel;
+  private _noTargetCode;
+  private _noTargetMessage;
+  private _replyError;
+}
+//#endregion
+//#region src/hub/server/hubInspector.d.ts
+interface HubTrafficWatchOptions extends TrafficSubscriptionOptions {}
+interface HubTrafficSubscription extends IDisposable, TrafficSubscription {}
+interface HubTrafficSource {
+  observe(observer: (transit: TrafficTransitEvent) => void): IDisposable;
+}
+/** Publishes dynamically observed raw node transits through bounded traffic streams. */
+declare class HubInspector implements IDisposable {
+  private readonly _hub;
+  private readonly _subscribers;
+  private readonly _trafficSources;
+  private readonly _trafficWatches;
+  private readonly _observation;
+  constructor(_hub: Hub);
+  get observerCount(): number;
+  subscribe(options: HubTrafficWatchOptions, send: (event: TrafficEvent) => Promise<void>): HubTrafficSubscription;
+  dispose(): void;
+  /** Add an endpoint traffic source managed by this Hub inspection service. */
+  addTrafficSource(source: HubTrafficSource): IDisposable;
+  private _startTrafficSources;
+  private _startTrafficSource;
+  private _stopTrafficSources;
+  private _onTransit;
+  private _emitTransit;
+}
+//#endregion
+//#region src/hub/server/routing/overlaySplitter.d.ts
+/**
+ * Inspection wiring for an {@link OverlaySplitter}. When supplied, the splitter
+ * emits a {@link NodeTransit} for every message it routes. The three port edge
+ * ids name the splitter's own edges; **`edges.h` must equal the parent hub
+ * link's `edgeId`** so a {@link TransitAggregator} chains the splitter's and
+ * hub's transits across the shared boundary (the splitter forwards request ids
+ * verbatim there, so the `(edgeId, requestId)` endpoints line up).
+ */
+interface OverlaySplitterInspection {
+  readonly nodeId: string;
+  readonly onTransit: NodeTransitObserver;
+  readonly edges: {
+    readonly p: string;
+    readonly c: string;
+    readonly h: string;
+  };
+}
+/**
+ * A fixed three-port message splitter — the per-participant primitive that
+ * replaces a nested {@link import('./routingHub').Hub} inside a
+ * {@link import('./rootOverlay').RootOverlay}.
+ *
+ * Ports:
+ * - **P** — the participant (downstream connection),
+ * - **C** — the local root-services connection (`hubServiceIdRegistry::registerServiceId`,
+ *   `hubrpc.directory`, `identity::*`, …),
+ * - **H** — the uplink to the parent hub.
+ *
+ * Routing rules (verbatim to the design):
+ * ```
+ *   P·root → C        P·*    → H
+ *   H·*    → P        H·root → P
+ *   C·*    → P
+ * ```
+ * where `root` means a bare/interface-form method and `*` a fully-qualified
+ * (`serviceId::…`) method. Responses follow the reverse path. `H·root → P`
+ * lets the parent hub reach the participant's *own* root services (e.g. the
+ * participant-served root directory) — distinct from `P·root → C`, which is
+ * the participant *consuming* the overlay's root services; the two are
+ * opposite directions served by different connections, so they never collide.
+ *
+ * ### `$stream::send` — correlated by `requestId`, not by method form
+ *
+ * A {@link STREAM_METHOD} (`$stream::send`) notification is *interface-form*
+ * (`$stream::send`), so the method-form rules above would naively treat it as
+ * `root` and send a participant's stream to **C** (and route an inbound one as
+ * a root call to **P**). That is wrong: a stream message belongs to an in-flight
+ * request's lifetime and must follow **that request's** path, exactly like a
+ * response does. So `$stream::send` bypasses the method-form table and is
+ * routed like a response instead:
+ *
+ * - **P → ?**: the participant streams using the `requestId` it *observed*,
+ *   which for a request it serves is the tag the splitter stamped on the
+ *   delivered request id (`H\0…` / `C\0…`). We {@link _decodeId | decode} that
+ *   tag, restore the original id, and forward to the tagged origin (H or C) —
+ *   the same demux responses get. An **untagged** `requestId` means the
+ *   participant *initiated* the request (P→H or P→C); we cannot tell which
+ *   statelessly, so we default to the **uplink** (the common case: streaming
+ *   to a fully-qualified service via the parent).
+ * - **H/C → P**: forwarded verbatim to the participant (never dropped), as a
+ *   response would be — the parent has already restored P's original
+ *   `requestId`, symmetric to response-id rewriting.
+ *
+ * PARTICIPANT-INITIATED STREAMS — the one stateful case: because `requestId`
+ * lives in `params` (not a structural top-level id the splitter rewrites in
+ * lock-step), a stream frame for a request the participant *initiated* (`P→C`
+ * or `P→H`) carries P's *own untagged* id, which alone cannot say whether the
+ * call went to the root (C) or the uplink (H). The splitter therefore keeps a
+ * small `requestId → target` map ({@link _pInitiated}), populated when P sends
+ * such a request and cleared when its response returns, and consults it to
+ * route those frames. This is the splitter's *only* per-request state; every
+ * other path still routes statelessly via id-tagging.
+ *
+ * ### Stateless demux via id-tagging
+ *
+ * P is the only port that receives requests from *two* sources (H and C),
+ * so a response from P is ambiguous and ids can collide (`H` and `C` may
+ * each send `id:5`). Rather than a pending-request map (with its attendant
+ * timeout/leak problem), the splitter rewrites **only requests destined for
+ * P**, prepending the origin and original id type to the id:
+ *
+ * ```
+ *   H→P:  id' = "H\0n\042"     (push origin tag)
+ *   C→P:  id' = "C\0s\0abc"
+ *   P→?:  decode id' → route to H or C, restore the original id
+ * ```
+ *
+ * Every other edge (P→H, P→C and the responses coming back from H/C to P)
+ * passes **verbatim** — those targets each have a single peer, so there is no
+ * response ambiguity. The sole exception is *stream* frames for
+ * participant-initiated requests, whose target is recovered from the small
+ * {@link _pInitiated} map (see above); apart from that the id encodes its own
+ * return path.
+ *
+ * NOTE: unlike the central {@link import('./routingHub').Hub}, the tag is
+ * not authenticated. A misbehaving participant could emit a forged tagged
+ * response toward H or C; each endpoint still drops ids it has no pending
+ * request for, and identity/signing live in a higher layer. For the
+ * single-participant overlay this is an acceptable trade for being fully
+ * stateless. If unforgeable return paths are ever required here, HMAC the
+ * tag with a splitter-private secret.
+ */
+declare class OverlaySplitter<TContext = undefined> {
+  private readonly _participant;
+  private readonly _root;
+  private readonly _uplink;
+  private _disposed;
+  private readonly _inspect;
+  /**
+   * Per-request routing target (`C` or `H`) for requests the participant
+   * *initiated*, keyed by P's own request id. Streams for those requests
+   * carry P's untagged id, which alone can't say whether the call went to the
+   * root (C) or the uplink (H); this map recovers it. Populated when P sends
+   * the request, cleared when its response returns. The splitter's only
+   * per-request state — every other path routes statelessly via id-tagging.
+   */
+  private readonly _pInitiated;
+  constructor(_participant: IMessageTransport<MessageWithCtx<TContext>>, _root: IMessageTransport<JsonRpcMessage, MessageWithCtx<TContext>>, _uplink: IMessageTransport, inspection?: OverlaySplitterInspection);
+  /** Detach all three ports. Does not dispose the transports themselves. */
+  dispose(): void;
+  /** Edge id of an upstream origin port. */
+  private _originEdge;
+  /** Emit a node transit if inspection is enabled. Zero-cost otherwise. */
+  private _emit;
+  private _onFromParticipant;
+  /**
+   * Route a participant-emitted `$stream::send` by its `requestId` tag,
+   * mirroring how a {@link _onFromParticipant | response} is demuxed. The
+   * participant streams with the id it *observed*; for a request it serves
+   * that id carries the origin tag the splitter stamped, so decoding it
+   * yields the return port and the original id. Untagged → a request the
+   * participant *initiated*; recover its target (C or H) from {@link
+   * _pInitiated}, defaulting to the uplink.
+   */
+  private _routeParticipantStream;
+  private _onFromUpstream;
+  /** Build a request/notification transit (`out` absent ⇒ dropped here). */
+  private _mkForward;
+  /** Build a response transit crossing from `inEdge`/`inId` to `outEdge`/`outId`. */
+  private _mkResponse;
+}
+//#endregion
+//#region src/hub/server/routing/rootOverlay.d.ts
+interface RootOverlayOptions {
+  /**
+   * The uplink transport to the parent hub. The overlay forwards all
+   * prefixed (`serviceId::…`) participant traffic here and receives the
+   * parent's routed traffic back. Obtain it from `parentHub.attach(pair.b)`
+   * and pass `pair.a`.
+   */
+  readonly uplink: IMessageTransport;
+  /**
+   * Optional inspection wiring forwarded to the underlying
+   * {@link OverlaySplitter}. Set `edges.h` to the parent hub link's `edgeId`
+   * (from `parentHub.attach(...).edgeId`) so transits chain across the
+   * boundary.
+   */
+  readonly inspection?: OverlaySplitterInspection;
+  /** Parent-facing topology port. Defaults to a generated connection-lifetime id. */
+  readonly uplinkPortId?: string;
+}
+/**
+ * A **RootOverlay** is the per-participant front door. It is a pure
+ * {@link OverlaySplitter} wiring with no routing table, no nested hub, and —
+ * deliberately — **no knowledge of which services it serves**. It exposes:
+ *
+ * - {@link root} — the connection serving this participant's root services.
+ *   Install bootstrap/identity modules onto it with `registerHubServices` /
+ *   `registerIdentityServices` *before or after* connecting the participant.
+ * - {@link connectParticipant} — wires the downstream participant through the
+ *   splitter (`P·root → root`, `P·* → uplink`, `uplink·* → P`).
+ *
+ * Because an overlay represents exactly one participant, prefix claims happen
+ * only on the parent (via the {@link import('./routingHub').AttachedLink} that
+ * `registerHubServices` was given); there is no local table to write.
+ *
+ * The overlay is generic over the per-call `TContext` its {@link root}
+ * connection sees. Pass a context-stamping {@link ChannelTransport} to
+ * {@link connectParticipant} to attach per-call context. Most callers connect a
+ * plain (or signature-verifying) transport and leave `TContext` as `undefined`
+ * (context-free).
+ */
+declare class RootOverlay<TContext = undefined> {
+  /**
+   * The per-participant root connection. Register the overlay's root
+   * services here — e.g. `registerHubServices(overlay.root, upstream)` and
+   * `registerIdentityServices(overlay.root, { resolveIdentity })`. Reachable
+   * only by this overlay's participant (root-addressed calls land here).
+   *
+   * Its inbound transport carries the overlay's `TContext`, so identity-aware
+   * front doors — notably the consent `hubAccess` service — can be served here
+   * for the interface-form calls a participant addresses to its own root.
+   */
+  readonly root: LinkRpcConnection<TContext>;
+  readonly nodeId: string;
+  readonly participantPortId: string;
+  readonly rootPortId: string;
+  readonly rootNodeId: string;
+  readonly uplinkPortId: string;
+  private readonly _uplink;
+  private readonly _rootPair;
+  private readonly _inspection;
+  private _splitter;
+  private _disposed;
+  constructor(options: RootOverlayOptions);
+  managedTopology(edgeLabel?: string, peerTransport?: TopologyTransportInfo): ManagedRoutingTopology;
+  /**
+   * Connect the downstream participant. Root-addressed calls from it hit the
+   * {@link root} services; prefixed calls forward via the uplink. May be
+   * called once.
+   *
+   * Connect a context-stamping {@link ChannelTransport} when `TContext` is
+   * concrete; otherwise connect the raw participant transport directly.
+   */
+  connectParticipant(participant: IMessageTransport<MessageWithCtx<TContext>>): void;
+  /**
+   * Tear the overlay down: detach the splitter and dispose the internal root
+   * transport pair. The caller owns the uplink and the participant transport
+   * and disposes them separately (disposing the uplink's
+   * {@link import('./routingHub').AttachedLink} releases any claimed prefixes
+   * on the parent). Idempotent.
+   */
+  dispose(): void;
+}
+//#endregion
+//#region src/hub/server/rootServices.d.ts
+interface RegisterHubServicesOptions {
+  /**
+   * ServiceId under which the parent serves its global reflection services.
+   * The overlay's directory listing *refers* world-view queries here.
+   * Defaults to `'hub'`.
+   */
+  readonly hubServiceId?: string;
+  /**
+   * Absolute serviceId region this connection may claim freely (anything
+   * at/under it, no capability needed), surfaced verbatim through
+   * `hubGrantedServiceId::get` as `grantedServiceIdNamespace`. Typically the
+   * connection's attested identity key. Defaults to `''` — "claim nothing
+   * freely" — which still lets `authorizeClaim` admit claims.
+   */
+  readonly grantedServiceIdNamespace?: string;
+  /**
+   * Consulted in `hubGrantedServiceId::register` before the prefix is
+   * claimed. Return `{ ok: false, reason }` to deny (surfaced to the
+   * participant as an error). When omitted, claims default to "must be within
+   * `grantedServiceIdNamespace`".
+   */
+  authorizeClaim?(requestedPrefix: ServiceId): {
+    ok: true;
+  } | {
+    ok: false;
+    reason: string;
+  };
+}
+/**
+ * Install a participant's **connection root services** onto its overlay root
+ * connection `root`:
+ *
+ * - `hubGrantedServiceId::get` — the connection round-trip: reports the
+ *   `grantedServiceIdNamespace` this connection may claim freely.
+ * - `hubGrantedServiceId::register` — claims a prefix on
+ *   `upstream` (the parent hub link) within the connection's granted namespace,
+ *   gated by `authorizeClaim` (default: namespace membership). Because an
+ *   overlay represents a single participant, *one* upstream claim suffices: all
+ *   prefixed traffic the parent routes to this overlay is for this participant,
+ *   so the {@link OverlaySplitter} delivers it without any local table.
+ * - `hubrpc.directory::list` — by default a **referral** (own root interfaces
+ *   plus one row pointing at `<hubServiceId>::hubrpc.directory`); an
+ *   implementation is free to aggregate the parent's listing instead.
+ * - `hubrpc.schemas::get` — schemas for this overlay's own root interfaces.
+ *
+ * The hub's consent front door (`hubAccess::*`) is installed separately at the
+ * overlay root by {@link registerHubAccessService}; it needs no capability of
+ * its own because the root is never forwarded.
+ *
+ * The overlay itself stays unaware of which services it serves; this is the
+ * routing module that gives it its front door.
+ */
+declare function registerHubServices(root: LinkRpcConnection<unknown>, upstream: AttachedLink, options?: RegisterHubServicesOptions): void;
+interface RegisterIdentityServicesOptions {
+  /**
+   * Resolve the managed identity for this participant. Called **lazily** —
+   * only when the participant first invokes `identity::*` — so registering
+   * the service does not mint or load any key material (matches the consent
+   * model: serving `identity::*` costs nothing until the participant opts in).
+   */
+  resolveIdentity(): Promise<Identity>;
+  /**
+   * Optional per-identity persistent key/value store, registered as
+   * `identity.storage::*` alongside `identity::*`.
+   */
+  storage?: ManagedIdentityStorageBackend;
+}
+/**
+ * Install `identity::*` (and optionally `identity.storage::*`) onto a
+ * participant's overlay root connection. The identity is resolved lazily on
+ * first use — see {@link registerLazyIdentityOnOverlay}.
+ *
+ * This is the identity counterpart to {@link registerHubServices}: a small,
+ * composable module the overlay does not need to know about.
+ */
+declare function registerIdentityServices(root: LinkRpcConnection<unknown>, options: RegisterIdentityServicesOptions): void;
+//#endregion
+//#region src/hub/server/hubRegister.d.ts
+/**
+ * Out-of-band, per-call context produced by {@link withRequestIdContext}. A
+ * typed handler only ever sees the zod-stripped params (the `$hubrpc` envelope
+ * and the wire id are gone), so the originating request's wire id is smuggled
+ * alongside the message via the channel's `context` slot — never over a wire.
+ *
+ * The register handler uses it to resolve the link a forwarded claim arrived on
+ * via {@link Hub.getSourceTransport}.
+ */
+interface RegisterCallContext {
+  /**
+   * The hub-rewritten wire id of the inbound request, or `undefined` for
+   * responses / notifications. Keyed lookups into
+   * {@link Hub.getSourceTransport} use exactly this id.
+   */
+  readonly requestId: RequestId | undefined;
+}
+/**
+ * Annotate an inbound transport so every request carries its wire id in a
+ * {@link RegisterCallContext}. Synchronous and signature-agnostic: it neither
+ * verifies signatures nor checks capabilities (that has already happened on the
+ * forwarded path — see {@link registerHubServiceIdRegistry}). It exists only so
+ * a hub-hosted handler can recover the request id the typed channel would
+ * otherwise strip.
+ */
+declare function withRequestIdContext(link: IMessageTransport): ChannelTransport<RegisterCallContext>;
+interface HubRegisterOptions {
+  /** The central hub whose forwarding-table claims are written. */
+  readonly hub: Hub;
+  /** ServiceId the register endpoint (and the rest of the hub services) is mounted under. */
+  readonly hubServiceId: string;
+}
+/**
+ * Install the hub's privileged **claim front door** — the typed
+ * `hubServiceIdRegistry::registerServiceId` handler — onto the hub services
+ * `connection` (mounted under `hubServiceId`).
+ *
+ * Unlike the per-overlay `registerHubServices` front door — which only lets a
+ * participant claim *within its provenance-granted namespace* — this endpoint
+ * is the path for claiming a prefix **outside** that namespace.
+ *
+ * The handler is a **pure side effect**. Authentication (signature) and
+ * authorization (an admin-rooted capability that permits
+ * `hub::hubServiceIdRegistry::registerServiceId` for the requested
+ * `requestedPrefix`) are enforced *before* the call ever reaches here, by the
+ * {@link import('./forwardedCallGate').withForwardedCallGate forwarded-call
+ * gate} every untrusted participant sits behind. By the time the request lands,
+ * it is already known to be authentic and authorized, so the handler only:
+ *
+ * 1. validates the prefix is well-formed;
+ * 2. resolves the link the request was forwarded from via
+ *    {@link Hub.getSourceTransport} (keyed by {@link RegisterCallContext.requestId});
+ *    and
+ * 3. binds the prefix to that link via {@link Hub.claimPrefix}.
+ *
+ * The source transport answers only *where* to route the prefix, never
+ * *whether* the claim is allowed.
+ */
+declare function registerHubServiceIdRegistry(connection: LinkRpcConnection<RegisterCallContext>, options: HubRegisterOptions): void;
+//#endregion
+//#region src/hub/server/hubServices.d.ts
+interface HubServicesOptions {
+  /** ServiceId the global services are mounted under. Defaults to `'hub'`. */
+  readonly hubServiceId?: string;
+  /** Optional diagnostic descriptor for the hub participant. */
+  readonly descriptors?: readonly ParticipantDescriptorSource[];
+  /** Runs before serving a global directory list or starting a directory watch. */
+  readonly beforeDirectoryQuery?: () => void | Promise<void>;
+}
+interface HubServices {
+  /** The in-process connection backing the hub's global services. */
+  readonly connection: LinkRpcConnection<RegisterCallContext>;
+  /** ServiceId the services are mounted under. */
+  readonly hubServiceId: string;
+  /** Traffic/topology inspector backing the hub's inspection services. */
+  readonly inspector: HubInspector;
+  /** Close the connection and detach the in-process link from the hub. */
+  dispose(): void;
+}
+declare function createHubServiceInterfaces(hub: Hub, options?: HubServicesOptions): HubServices;
+//#endregion
+//#region src/hub/server/accessCandidates.d.ts
+/** A single entry of the aggregated interface directory. */
+interface DirectoryEntry {
+  readonly serviceId: string;
+  readonly interfaceId: string;
+  readonly hash: string;
+  readonly serviceDescription?: string;
+  readonly rootPrincipalSets?: readonly RootPrincipalSet[];
+}
+interface AccessInterfaceRequirement {
+  readonly id: string;
+  /** Optional schema-version pin; when set the candidate's hash must match. */
+  readonly hash?: string;
+  /** Defaults to true. */
+  readonly required: boolean;
+}
+interface AccessMemberRequirement {
+  readonly interfaceId: string;
+  /** Member name matcher (`{ exact }` or `{ prefix }`). */
+  readonly member: Pattern;
+  /** Defaults to true. */
+  readonly required: boolean;
+}
+interface AccessSlotRequest {
+  readonly interfaces: readonly AccessInterfaceRequirement[];
+  readonly members: readonly AccessMemberRequirement[];
+}
+interface AccessSlotCandidate {
+  readonly serviceId: string;
+  readonly serviceDescription?: string;
+  /** Subset of the slot's requested interfaces actually present on this candidate. */
+  readonly satisfiedInterfaces: readonly AccessInterfaceRequirement[];
+  /**
+   * Requested interfaces the candidate does NOT satisfy. By construction
+   * every entry here is `required: false` — a required-but-missing
+   * interface filters the candidate out before it is emitted.
+   */
+  readonly unsatisfiedInterfaces: readonly AccessInterfaceRequirement[];
+}
+interface ResolvedAccessSlot {
+  readonly request: AccessSlotRequest;
+  /** Empty = no service satisfies every required interface. */
+  readonly candidates: readonly AccessSlotCandidate[];
+}
+interface ResolvedCandidates {
+  readonly dependencies: Readonly<Record<string, ResolvedAccessSlot>>;
+  /** Slot ids for which no candidate satisfied every required interface. */
+  readonly noCandidateSlots: readonly string[];
+}
+/**
+ * Fetch the full interface directory by recursively walking the hub's
+ * **referral** directory graph. {@link walkHubDetailed} follows explicit
+ * `hubrpc.directory` listings to collect leaf interfaces (folding transitive
+ * root-node-id requirements onto descendants along the way). Routing claims do
+ * not create referrals. This is the v2 replacement for the hub-internal
+ * `_fullDirectory()`.
+ */
+declare function fetchFullDirectory(connection: LinkRpcConnection, hubServiceId?: string): Promise<DirectoryEntry[]>;
+/**
+ * Resolve every dependency slot against a directory snapshot. Pure port of
+ * the v1 hub's per-request candidate resolution loop + `_candidatesForSlot`.
+ */
+declare function resolveAccessCandidates(slots: Readonly<Record<string, AccessSlotRequest>>, directory: readonly DirectoryEntry[]): ResolvedCandidates;
+/**
+ * Match one slot against the directory snapshot. A service is a candidate iff
+ * it satisfies every `required` interface (by id, and by hash when pinned).
+ */
+declare function candidatesForSlot(slot: AccessSlotRequest, directory: readonly DirectoryEntry[]): AccessSlotCandidate[];
+//#endregion
+//#region src/hub/server/capabilityProposal.d.ts
+/**
+ * Hub-minted "proposal" of a capability the user is about to approve.
+ * `capability` is the readable JSON the consent UI renders; `$hubData` is an
+ * opaque blob the UI must round-trip verbatim — only the issuer inspects it.
+ */
+interface CapabilityProposal {
+  readonly capability: Capability;
+  /** Opaque issuer-private signed blob; round-trip verbatim. */
+  readonly $hubData: unknown;
+}
+/**
+ * Access-grant duration vocabulary.
+ *
+ * `once` and `shortLived` share the same 5-minute TTL — they differ only on
+ * the *use* axis: `once` is the single-use "Allow once" choice (the consent
+ * host additionally pins a `callBind`, making it intrinsically single-use),
+ * while `shortLived` is an ordinary multi-use grant that simply expires soon.
+ * `persistent` never expires (no `expiresAtMs`); revocation is the only way to
+ * end it.
+ */
+type AccessDurationName = 'once' | 'shortLived' | 'longLived' | 'persistent';
+/**
+ * Convert an access duration into a Unix-milliseconds expiration timestamp, so
+ * handlers compute the same `expiresAtMs` the issuer mints with. Returns
+ * `undefined` for `persistent` (and any future never-expiring duration), which
+ * callers pass straight to {@link CapabilityProposalIssuer.propose}/`mint` —
+ * both omit `expiresAtMs` when it is `undefined`, yielding a non-expiring cap.
+ * Defaults to the safe short TTL (`shortLived`) when no duration is supplied.
+ */
+declare function durationToExp(duration: AccessDurationName | undefined): number | undefined;
+interface ProposeArgs {
+  readonly audience: PrincipalId;
+  readonly permissions: readonly Permission[];
+  /** Unix milliseconds. Absent = never expires. */
+  readonly expiresAtMs?: number;
+}
+/**
+ * Issues capabilities and capability proposals signed by an admin
+ * {@link SigningIdentity}. One instance per hub host; tracks redeemed nonces
+ * for one-shot proposal redemption.
+ */
+declare class CapabilityProposalIssuer {
+  private readonly _issuer;
+  private readonly _redeemedNonces;
+  private _nonceCounter;
+  constructor(_issuer: SigningIdentity);
+  get issuerPrincipalId(): PrincipalId;
+  /**
+   * Build an unsigned `Capability` the issuer is willing to sign, tagged with
+   * an internal marker. {@link signProposal} refuses to sign anything lacking
+   * the marker — a guard against a handler fabricating arbitrary caps. The
+   * marker is non-enumerable, so it never affects serialization or signing.
+   */
+  propose(args: ProposeArgs): Capability;
+  /**
+   * Mint a final `SignedCapability` directly from a proposed cap, bypassing
+   * the preview round-trip. Use when no UI needs to render the unsigned form.
+   */
+  mint(args: ProposeArgs): Promise<SignedCapability>;
+  /**
+   * Pair a proposed `Capability` with a domain-separated signature over
+   * `canonicalJson({ preview: cap, bind? })`. The result is **not** a bearer
+   * token — only this issuer can redeem it.
+   */
+  signProposal(cap: Capability, opts?: {
+    readonly bind?: JsonValue;
+  }): Promise<CapabilityProposal>;
+  /**
+   * Verify and redeem a {@link CapabilityProposal}, returning a real
+   * {@link SignedCapability}. Checks: `$hubData` signature, preview deep-equal
+   * to `proposal.capability`, optional `bind` match, and one-shot nonce.
+   */
+  redeemProposal(proposal: CapabilityProposal, opts?: {
+    readonly expectedBind?: JsonValue;
+  }): Promise<SignedCapability>;
+  private _sign;
+  private _nextNonce;
+}
+//#endregion
+//#region src/hub/server/hubAccessService.d.ts
+interface AccessConsumer {
+  readonly name: string;
+  readonly origin?: string;
+  readonly purpose?: string;
+}
+type AccessDuration = AccessDurationName;
+interface AccessSlotBinding {
+  readonly serviceId: string;
+  /** Interface ids (of the slot's requested interfaces) the grant covers. */
+  readonly interfaces: readonly string[];
+}
+interface AccessRequestArgs {
+  readonly consumer: AccessConsumer;
+  /** Verified signer of the `hubAccess::request` call; the capability audience. */
+  readonly consumerPrincipalId: PrincipalId;
+  readonly dependencies: Readonly<Record<string, ResolvedAccessSlot>>;
+  readonly duration: AccessDuration | undefined;
+}
+type AccessDecision = {
+  readonly granted: true;
+  readonly resolvedSlots: Readonly<Record<string, AccessSlotBinding>>;
+  readonly capabilities: readonly SignedCapability[];
+} | {
+  readonly granted: false;
+  readonly reason?: string;
+};
+interface AccessExtendMember {
+  readonly interfaceId: string;
+  readonly member: Pattern;
+  /** Defaults to true. */
+  readonly required: boolean;
+}
+interface AccessExtendArgs {
+  readonly consumer: AccessConsumer;
+  readonly consumerPrincipalId: PrincipalId;
+  readonly serviceId: string;
+  readonly added: readonly AccessExtendMember[];
+  readonly duration: AccessDuration | undefined;
+}
+type AccessExtendDecision = {
+  readonly granted: true;
+  readonly serviceId: string;
+  readonly grantedMembers: readonly {
+    interfaceId: string;
+    member: Pattern;
+  }[];
+  readonly capabilities?: readonly SignedCapability[];
+} | {
+  readonly granted: false;
+  readonly reason?: string;
+};
+/**
+ * Optional per-permission invocation preview the consumer attaches to a
+ * direct ({@link HubAccessHandlers.onAccessRequestDirect}) request. It is
+ * **not** a signed authority constraint — it is the data the consent host
+ * needs to render an honest "Allow once" prompt and to pre-compute the
+ * `callBind.payloadHash` that binds a one-shot capability to exactly this
+ * call. `nonce`/`signedAtMs`/`interfaceHash` are the values the consumer
+ * will sign with when it actually issues the call.
+ */
+interface AccessCallIntent {
+  /** Fully-qualified method name the consumer intends to call. */
+  readonly method: string;
+  /** Params the consumer intends to send (shown to the user, hashed into callBind). */
+  readonly params?: unknown;
+  /** Schema-version assertion the call will carry. */
+  readonly interfaceHash?: string;
+  /** base64url nonce bytes the consumer will sign with. */
+  readonly nonce: string;
+  /** Unix milliseconds the consumer will sign with. */
+  readonly signedAtMs: number;
+  /** One-line summary for the prompt. */
+  readonly summary?: string;
+  /** Consumer's suggested default consent action. */
+  readonly suggestion?: AccessDuration;
+}
+/**
+ * An {@link AccessDirectArgs} permission, carrying the verbatim signed
+ * {@link Permission} the consumer asked for plus the optional
+ * {@link AccessCallIntent} that enables "Allow once" byte-binding.
+ */
+interface AccessDirectPermission extends Permission {
+  readonly callIntent?: AccessCallIntent;
+}
+interface AccessDirectArgs {
+  readonly consumer: AccessConsumer;
+  readonly consumerPrincipalId: PrincipalId;
+  readonly permissions: readonly AccessDirectPermission[];
+  readonly duration: AccessDuration | undefined;
+}
+type AccessDirectDecision = {
+  readonly granted: true;
+  readonly capabilities: readonly SignedCapability[];
+} | {
+  readonly granted: false;
+  readonly reason?: string;
+};
+interface HubAccessHandlers {
+  /** Service-discovery grant: pick a service per slot and mint scoped caps. */
+  onAccessRequest(args: AccessRequestArgs): Promise<AccessDecision>;
+  /** Service-pinned widening of an existing grant. */
+  onAccessExtend(args: AccessExtendArgs): Promise<AccessExtendDecision>;
+  /** Verbatim attenuation grant (no discovery). */
+  onAccessRequestDirect(args: AccessDirectArgs): Promise<AccessDirectDecision>;
+}
+interface RegisterHubAccessOptions {
+  /** Consent + capability-issuance callbacks. */
+  readonly handlers: HubAccessHandlers;
+  /** Provides the directory snapshot for candidate resolution. */
+  fetchDirectory(): Promise<readonly DirectoryEntry[]>;
+}
+/**
+ * Install `hubAccess::{request,extend,requestAccess}` at the **connection
+ * root** of a participant's overlay (root form, no serviceId prefix). The root
+ * is never forwarded, so the consent front door is reached directly and needs
+ * no capability of its own.
+ *
+ * The capability `audience` is taken **directly from `params.consumer.principal`**
+ * — no longer derived from a verified call signer. A cap minted for a nodeId is
+ * only usable by the holder of that node's key (enforced at call time by
+ * `permits`, which checks `audience === call.signer`), so a self-asserted
+ * audience grants no usable authority to a caller who does not hold the key.
+ */
+declare function registerHubAccessService(connection: LinkRpcConnection<unknown>, options: RegisterHubAccessOptions): void;
+//#endregion
+//#region src/hub/server/tokenIdentityStore.d.ts
+/**
+ * What a connection token resolves to once redeemed. The token is a hub-minted,
+ * single-use bearer credential; its presence on a connection attests that the
+ * minting authority (a `connectionTokenBinder`-granted endpoint) vouched for the
+ * bound slot(s).
+ *
+ * The two bindings are **independent axes**, each optional:
+ *
+ * - {@link identitySlot} drives the redeemer's *managed identity* (`identity::*`).
+ * - {@link grantedServiceIdNamespace} drives the redeemer's *freely-claimable
+ *   serviceId namespace* (`hubGrantedServiceId::get`).
+ *
+ * A binder typically sets both to the same value (the historical convention),
+ * but they no longer have to agree — and either may be omitted. A token with
+ * neither is still admitted, but the connection routes anonymously (no
+ * `identity::*`, no freely-claimable namespace).
+ */
+interface TokenIdentityBinding {
+  /**
+   * Managed-identity slot the redeeming connection inherits. Omit to admit the
+   * connection without a managed identity.
+   */
+  readonly identitySlot?: string;
+  /**
+   * ServiceId namespace the redeeming connection may claim freely (reported
+   * via `hubGrantedServiceId::get`). Omit to grant no freely-claimable
+   * namespace.
+   */
+  readonly grantedServiceIdNamespace?: string;
+}
+/** A freshly minted token plus its absolute expiry (epoch ms). */
+interface MintedToken {
+  readonly token: string;
+  readonly expiresAt: number;
+}
+interface TokenIdentityStoreOptions {
+  /** Default lifetime applied to {@link TokenIdentityStore.mint}. Default 30s. */
+  readonly defaultTtlMs?: number;
+  /** Clock seam (tests). Default `Date.now`. */
+  readonly now?: () => number;
+  /** Token generator seam (tests). Default 32 random bytes, base64url. */
+  readonly generateToken?: () => string;
+}
+/**
+ * The hub's connection-token mint + redemption store, shared between the
+ * `connectionTokenBinder::bindConnectionToken` front door (mint) and a
+ * `managedIdentity: { mode: "fromToken" }` / `grantedServiceId: { mode:
+ * "fromToken" }` listener (redeem).
+ *
+ * Tokens are random, time-boxed and **single-use**: {@link redeem} consumes the
+ * entry, so a token can bind exactly one connection and cannot be replayed once
+ * used or expired. Expired entries are pruned lazily on access.
+ */
+declare class TokenIdentityStore {
+  private readonly _byToken;
+  private readonly _defaultTtlMs;
+  private readonly _now;
+  private readonly _generate;
+  constructor(options?: TokenIdentityStoreOptions);
+  /** Mint a fresh single-use token bound to `binding`, valid for `ttlMs`. */
+  mint(binding?: TokenIdentityBinding, ttlMs?: number): MintedToken;
+  /**
+   * Non-consuming existence check for the `hubrpc::initialize` token gate.
+   * Returns `true` iff the token is live (known and unexpired). Single-use is
+   * enforced separately by {@link redeem}.
+   */
+  peek(token: string | undefined): boolean;
+  /**
+   * Consume `token`, returning its binding exactly once. Returns `undefined`
+   * for an unknown, expired or already-redeemed token (the caller should drop
+   * the connection in that case).
+   */
+  redeem(token: string | undefined): TokenIdentityBinding | undefined;
+  /** Live (unexpired, unredeemed) token count — primarily for tests/metrics. */
+  get size(): number;
+  private _prune;
+}
+//#endregion
+//#region src/hub/server/connectionTokenBinderService.d.ts
+interface RegisterConnectionTokenBinderOptions {
+  /** Shared mint/redeem store (the same instance the redeem-side listener reads). */
+  readonly store: TokenIdentityStore;
+  /**
+   * Literal `identitySlot` prefixes this binder may mint identities for (e.g.
+   * `["docker/"]`). A `bindConnectionToken({ identitySlot })` call is rejected
+   * unless `identitySlot` starts with one of these. Empty → identity binding
+   * is disabled (any `identitySlot` request is rejected).
+   */
+  readonly identitySlotPrefixes: readonly string[];
+  /**
+   * Literal `serviceIdNamespace` prefixes this binder may grant (e.g.
+   * `["docker/"]`). A `bindConnectionToken({ serviceIdNamespace })` call is
+   * rejected unless `serviceIdNamespace` starts with one of these. Empty →
+   * serviceId granting is disabled (any `serviceIdNamespace` request is
+   * rejected).
+   */
+  readonly serviceIdPrefixes: readonly string[];
+  /** Optional per-token TTL (ms); falls back to the store's default. */
+  readonly ttlMs?: number;
+  /**
+   * Mount point when registering as a **forwarded hub service** (reachable via
+   * routing as `<serviceId>::connectionTokenBinder`). Omit for the **root
+   * form**: an interface-form registration on an overlay root, never forwarded
+   * → never gated.
+   */
+  readonly serviceId?: string;
+}
+/**
+ * Install `connectionTokenBinder::bindConnectionToken` on `connection`.
+ *
+ * Two forms, selected by {@link RegisterConnectionTokenBinderOptions.serviceId}:
+ *
+ * - **root form** (no `serviceId`): installed at a participant's overlay root
+ *   (root form, never forwarded → never gated). Safe because only the specific
+ *   trusted connection the acceptor installed it on can reach it.
+ * - **forwarded form** (`serviceId` set): mounted as a routable hub service so
+ *   any participant can discover and call it. Safe only because forwarded calls
+ *   go through the hub's forwarded-call gate; the same prefix checks still bound
+ *   what any caller may mint.
+ *
+ * Each call mints a single-use token binding the requested `identitySlot` and/or
+ * `serviceIdNamespace`, provided each requested field falls under the matching
+ * configured prefix. Omitting a field leaves that axis unbound.
+ */
+declare function registerConnectionTokenBinderService(connection: LinkRpcConnection<unknown>, options: RegisterConnectionTokenBinderOptions): void;
+//#endregion
+//#region src/hub/server/connectionHandler.d.ts
+/**
+ * Everything a {@link ConnectionHandler} needs to install a participant's root
+ * services. Built by {@link import('./hubConnectionAcceptor').HubConnectionAcceptor}
+ * once per accepted connection: the connection-specific bits (`root`,
+ * `upstream`, `transport`, `token`) plus the connection-independent policy the
+ * acceptor was configured with (`hubServiceId`, `authorizeClaim`,
+ * `installHubAccess`).
+ */
+interface ConnectionContext {
+  /** The overlay root to install this participant's front doors on. */
+  readonly root: LinkRpcConnection<unknown>;
+  /** The participant's link to the central hub (for `hubGrantedServiceId::register`). */
+  readonly upstream: AttachedLink;
+  /** The central hub. */
+  readonly hub: Hub;
+  /** The accepted transport (custom handlers may read attestation off it). */
+  readonly transport: IMessageTransport;
+  /** The `hubrpc::initialize` token the connection presented (if any). */
+  readonly token: string | undefined;
+  /** ServiceId the global reflection services are mounted under. */
+  readonly hubServiceId: string;
+  /** Per-connection claim authorizer (from the acceptor's policy), if any. */
+  readonly authorizeClaim?: (requestedPrefix: ServiceId) => {
+    ok: true;
+  } | {
+    ok: false;
+    reason: string;
+  };
+  /** Installs the consent front door at the overlay root, if configured. */
+  readonly installHubAccess?: (root: LinkRpcConnection<unknown>) => void;
+}
+/**
+ * The resolved root services a claiming handler provisions. Every field is
+ * optional; {@link provisionRoot} installs the always-on parts (claim/directory
+ * front door + consent) unconditionally and the rest only when present.
+ */
+interface RootProvision {
+  /** Freely-claimable serviceId namespace (`hubGrantedServiceId::get`). */
+  readonly grantedServiceIdNamespace?: string;
+  /** Lazily-resolved managed identity (`identity::*`). Omit for no identity. */
+  readonly resolveIdentity?: () => Promise<Identity>;
+  /** Optional per-identity persistent storage (`identity.storage::*`). */
+  readonly storage?: ManagedIdentityStorageBackend;
+  /** Token-minting front door (`connectionTokenBinder::*`). Omit for none. */
+  readonly connectionTokenBinder?: RegisterConnectionTokenBinderOptions;
+}
+/**
+ * A claiming connection handler: installs the participant's root services and
+ * returns. Built-ins delegate the actual registration to {@link provisionRoot}.
+ */
+type ConnectionHandler = (ctx: ConnectionContext) => void;
+/**
+ * Selects and (on claim) provisions a connection by its `hubrpc::initialize`
+ * token. `handle` is **non-consuming** — it may be called at the pre-handshake
+ * gate to answer "would you accept this token?" — and returns a
+ * {@link ConnectionHandler} that does the (possibly consuming) installation, or
+ * `undefined` to pass to the next factory.
+ */
+interface ConnectionHandlerFactory {
+  handle(token: string | undefined): ConnectionHandler | undefined;
+}
+/**
+ * Walk `factories` in order; return the first handler that claims `token`, or
+ * `undefined` if none do (the caller drops the connection).
+ */
+declare function resolveConnectionHandler(factories: readonly ConnectionHandlerFactory[], token: string | undefined): ConnectionHandler | undefined;
+/**
+ * Install a participant's root services from a resolved {@link RootProvision}:
+ * the always-on claim/directory front door and consent surface, plus (when
+ * present) the minting front door and lazy managed identity. This is the single
+ * shared installer every built-in handler funnels through.
+ */
+declare function provisionRoot(ctx: ConnectionContext, provision: RootProvision): void;
+/**
+ * A factory that claims **any** connection (optionally gated by `claims`) and
+ * provisions a fixed root. Used for the `anonymous` handler (claims all), the
+ * `static` handler (claims a matching token), and dial-in endpoints (claims all,
+ * no token).
+ */
+declare function fixedProvisionHandler(provision: RootProvision, claims?: (token: string | undefined) => boolean): ConnectionHandlerFactory;
+/** The `anonymous` handler: claims every connection, provisioning `provision`. */
+declare function anonymousHandler(provision: RootProvision): ConnectionHandlerFactory;
+/** The `static` handler: claims connections whose token equals `value`. */
+declare function staticTokenHandler(value: string, provision: RootProvision): ConnectionHandlerFactory;
+/**
+ * The `bound` handler: claims connections whose token is live in `store`, and on
+ * claim **redeems** it (single-use) to derive the provisioned identity slot
+ * and/or granted serviceId namespace. `resolveSlot` turns a redeemed slot into
+ * a lazy identity resolver plus its per-identity storage (injected so this stays
+ * node-agnostic).
+ */
+declare function boundTokenHandler(store: TokenIdentityStore, resolveSlot: (slot: string) => {
+  resolveIdentity: () => Promise<Identity>;
+  storage: ManagedIdentityStorageBackend;
+}): ConnectionHandlerFactory;
+//#endregion
+//#region src/hub/server/provenance.d.ts
+/**
+ * Attested origin of an incoming connection. Produced by a
+ * {@link ConnectionProvenanceProvider} from a freshly accepted transport,
+ * *before* any RPC flows. Everything here is, by contract, already verified:
+ * there is no "unverified" provenance — a provider that cannot fully attest
+ * the peer returns `{ error }` instead of a partial result.
+ */
+interface ConnectionProvenance {
+  /**
+   * Stable identity key for the peer. INVARIANT: must begin with
+   * `` `${provider.identityNamespace}/` `` (e.g. `"docker/echo-provider"`),
+   * which {@link withProvenance} enforces — a value that doesn't is treated
+   * as un-attested. This keeps keys from different provenance sources from
+   * colliding and makes the namespace self-describing.
+   */
+  readonly identityKey: string;
+  /**
+   * Free-form, already-verified attestation detail for logging and policy
+   * (container id, image, pid, uid, …). Never used for routing or trust.
+   */
+  readonly attributes: Readonly<Record<string, string | number>>;
+}
+/**
+ * Resolves the {@link ConnectionProvenance} of an accepted transport.
+ *
+ * Generic over the transport type so the provider can read whatever the
+ * concrete transport exposes (e.g. a `NodeSocketTransport`'s `socket` for
+ * peercred) — the hub core stays free of those types. Implementations live
+ * outside the hub (e.g. `@hediet/linkrpc-extra`).
+ */
+interface ConnectionProvenanceProvider<TTransport extends Transport> {
+  /**
+   * Namespace every {@link ConnectionProvenance.identityKey} this provider
+   * emits is prefixed with (e.g. `"docker"`).
+   */
+  readonly identityNamespace: string;
+  /**
+   * Resolve provenance for `transport` before any RPC is exchanged. Honour
+   * `signal` to abort if the transport closes or a deadline elapses.
+   *
+   * @returns verified provenance, or `{ error }` to refuse attestation.
+   */
+  resolve(transport: TTransport, signal: AbortSignal): Promise<ConnectionProvenance | {
+    error: string;
+  }>;
+}
+/**
+ * A {@link Transport} annotated with its (possibly absent) attestation —
+ * the narrow shape provenance-aware consumers (e.g. {@link PrefixPolicy})
+ * depend on, without naming a concrete backend transport type.
+ */
+interface ITransportWithProvenance extends Transport {
+  readonly provenance: ConnectionProvenance | undefined;
+}
+/** A concrete transport `T` annotated with its (possibly absent) attestation. */
+type WithProvenance<T extends Transport> = T & {
+  readonly provenance: ConnectionProvenance | undefined;
+};
+interface WithProvenanceOptions {
+  /**
+   * Abort the provider's `resolve` after this many ms (counts as
+   * un-attested). Omit for no deadline.
+   */
+  readonly resolveTimeoutMs?: number;
+  /**
+   * Drop connections that could not be attested instead of forwarding them
+   * with `provenance: undefined`. Default `false`.
+   */
+  readonly requireProvenance?: boolean;
+}
+/**
+ * Annotate every transport from `source` with the provenance `provider`
+ * resolves for it. On provider error/timeout — or when the returned
+ * `identityKey` does not start with `` `${provider.identityNamespace}/` `` —
+ * the transport is forwarded with `provenance: undefined`, unless
+ * {@link WithProvenanceOptions.requireProvenance} is set, in which case it is
+ * disposed and dropped.
+ *
+ * This is the one concrete {@link mapTransport} the hub ships: it is where
+ * `net.Socket` (or any backend handle) is read for attestation and nowhere
+ * else.
+ */
+declare function withProvenance<T extends Transport>(source: ITransportServer<T>, provider: ConnectionProvenanceProvider<T>, options?: WithProvenanceOptions): ITransportServer<WithProvenance<T>>;
+//#endregion
+//#region src/hub/server/prefixPolicy.d.ts
+/** What a prefix-claim is judged against. */
+interface ClaimContext<TTransport extends Transport> {
+  /**
+   * Node id of the participant's hub-minted managed identity, or `undefined`
+   * if the connection has no identity (anonymous routing).
+   */
+  readonly principal: PrincipalId | undefined;
+  /** The connecting transport (may carry provenance, depending on `T`). */
+  readonly transport: TTransport;
+  /** ServiceId prefix the participant is trying to claim. */
+  readonly requestedPrefix: ServiceId;
+}
+/**
+ * Decides whether a participant may own a routing prefix. This is the policy
+ * wrapped around the hub's single privileged write seam (`claimPrefix`) — the
+ * only place identity/provenance gates routing.
+ */
+interface PrefixPolicy<TTransport extends Transport> {
+  authorizeClaim(ctx: ClaimContext<TTransport>): {
+    ok: true;
+  } | {
+    ok: false;
+    reason: string;
+  };
+}
+interface PrincipalIdPrefixPolicyOptions<TTransport extends ITransportWithProvenance> {
+  /**
+   * Prefixes a participant is allowed to claim. Default: the transport's
+   * attested {@link ConnectionProvenance.identityKey} used **verbatim** as
+   * the sole claimable prefix (e.g. `"docker/echo-provider"`). The full,
+   * namespace-scoped key is the prefix — it is never split or rewritten. A
+   * connection with no provenance may claim nothing.
+   */
+  derivePrefixes?(ctx: ClaimContext<TTransport>): readonly ServiceId[];
+}
+/**
+ * Default {@link PrefixPolicy}: a participant may claim only the prefix(es)
+ * {@link PrincipalIdPrefixPolicyOptions.derivePrefixes} grants it. The out-of-box
+ * derivation ties the claimable prefix to the peer's attested provenance, so
+ * `docker/echo-provider` can serve `docker/echo-provider/*` and nothing can
+ * impersonate it.
+ */
+declare class PrincipalIdPrefixPolicy<TTransport extends ITransportWithProvenance> implements PrefixPolicy<TTransport> {
+  private readonly _derive;
+  constructor(options?: PrincipalIdPrefixPolicyOptions<TTransport>);
+  authorizeClaim(ctx: ClaimContext<TTransport>): {
+    ok: true;
+  } | {
+    ok: false;
+    reason: string;
+  };
+}
+//#endregion
+//#region src/hub/server/hubConnectionAcceptor.d.ts
+/**
+ * A data shape describing an imperative consent front door — the handlers plus
+ * the directory source `registerHubAccessService` needs. Retained as a
+ * convenience type; the acceptor installs consent via the more general
+ * {@link HubConnectionAcceptorBaseOptions.installHubAccess} callback.
+ */
+interface HubAccessConfig {
+  readonly handlers: HubAccessHandlers;
+  fetchDirectory(): Promise<readonly DirectoryEntry[]>;
+}
+interface HubConnectionAcceptorBaseOptions<TTransport extends Transport> {
+  /**
+   * Source of inbound transports. Often a provenance-annotated server
+   * (`withProvenance(socketServer, provider)`), but any
+   * {@link ITransportServer} works — provenance is read via `resolveIdentity`
+   * and the policy, not required by the acceptor's types.
+   */
+  readonly server: ITransportServer<TTransport>;
+  /** The central hub all accepted participants attach under. */
+  readonly hub: Hub;
+  /**
+   * Ordered connection handlers. For each accepted transport the acceptor
+   * resolves the first handler whose {@link ConnectionHandlerFactory.handle}
+   * claims the presented `hubrpc::initialize` token; that handler installs the
+   * participant's root services (identity, granted namespace, minting, …). If
+   * no handler claims, the connection is dropped. An empty array accepts
+   * nothing.
+   */
+  readonly handlers: readonly ConnectionHandlerFactory[];
+  /**
+   * Authorizes each prefix claim a participant makes. Omit to allow every
+   * well-formed claim.
+   */
+  readonly policy?: PrefixPolicy<TTransport>;
+  /** ServiceId of the global reflection services. Defaults to `'hub'`. */
+  readonly hubServiceId?: string;
+  /**
+   * Install the consent front door at each accepted participant's overlay
+   * root (root form, never forwarded → never gated). The callback receives the
+   * root connection and registers `hubAccess::*` on it however it likes — the
+   * imperative `registerHubAccessService(root, …)` or the keyless
+   * `HubAccessManifestHost.registerHubAccessAtRoot(root)`. Omit on open hubs;
+   * then no consent surface is served.
+   */
+  installHubAccess?(root: LinkRpcConnection<unknown>): void;
+  /** Fired after a participant's overlay is attached. */
+  onAttached?(info: {
+    overlay: RootOverlay;
+  }): void;
+  /** Fired when accepting a connection throws. */
+  onError?(error: Error): void;
+}
+/**
+ * Forwarded-call gating policy — a **discriminated union** so the type system
+ * enforces the safe combinations and rules out the dangerous "ask for
+ * capability enforcement but forget the trust anchors" misconfiguration:
+ *
+ * - **off** (default): forwarded calls reach the hub unverified.
+ * - **authenticity only** (`verifyForwardedCalls: true`): forwarded calls must
+ *   carry a valid `$hubrpc` signature; `adminIds` is optional.
+ * - **capability** (`verifyForwardedCalls: true` + `requireForwardedCapability:
+ *   true`): forwarded calls must additionally present a capability rooted at one
+ *   of `adminIds`. Because an empty/absent anchor set fails closed (rejecting
+ *   *every* capability, including validly granted ones), `adminIds` is
+ *   **required at compile time** in this arm.
+ */
+type ForwardCheckingPolicy = {
+  readonly verifyForwardedCalls?: false;
+  readonly requireForwardedCapability?: false;
+  readonly adminIds?: undefined;
+} | {
+  /**
+   * Every accepted participant's hub-facing link is wrapped in a
+   * {@link withForwardedCallGate signature front door}: forwarded
+   * (fully-qualified) requests must carry a valid `$hubrpc` signature to
+   * reach the hub. Requests to the hub's own `hubServiceId` prefix are
+   * exempt (those services self-gate).
+   */
+  readonly verifyForwardedCalls: true;
+  readonly requireForwardedCapability?: false;
+  /**
+   * Optional root trust anchors. With authenticity-only verification a
+   * capability is not required, but when present a call's chain is still
+   * checked against these anchors.
+   */
+  readonly adminIds?: Iterable<PrincipalId>;
+} | {
+  readonly verifyForwardedCalls: true;
+  /**
+   * The forwarded-call gate also requires a capability, not just a
+   * signature: a forwarded call authorises only if its capability chain
+   * roots at one of {@link adminIds} (accepted for every service). The
+   * gate also dedups each request nonce, so `callBind` grants are
+   * single-use for free.
+   */
+  readonly requireForwardedCapability: true;
+  /** Root trust anchors. Typically the hub admin's PrincipalId. Required (fail-closed otherwise). */
+  readonly adminIds: Iterable<PrincipalId>;
+};
+type HubConnectionAcceptorOptions<TTransport extends Transport> = HubConnectionAcceptorBaseOptions<TTransport> & ForwardCheckingPolicy;
+/**
+ * Bridges accepted transports onto the hubv2 graph via a pluggable chain of
+ * {@link ConnectionHandlerFactory connection handlers}. For each transport it:
+ *
+ * 1. attaches an uplink to the central hub and builds a {@link RootOverlay};
+ * 2. resolves the first handler whose token check claims the connection and
+ *    lets it install the participant's root services (claim/directory front
+ *    door + consent, and optionally identity, granted namespace, minting) —
+ *    dropping the connection if none claim; and
+ * 3. connects the participant, disposing the overlay and detaching the uplink
+ *    (which releases its claimed prefixes) when the transport closes.
+ *
+ * It never names a backend transport type — hand it any {@link ITransportServer}.
+ */
+declare class HubConnectionAcceptor<TTransport extends Transport> {
+  private readonly _options;
+  private readonly _accepted;
+  private _disposed;
+  constructor(_options: HubConnectionAcceptorOptions<TTransport>);
+  private _accept;
+  /**
+   * Wrap the hub-facing link per the {@link ForwardCheckingPolicy}. The
+   * option union guarantees that capability mode always carries its
+   * `adminIds` trust anchors, so this can never silently fail closed by
+   * forgetting them.
+   */
+  private _gateHubFacing;
+  private _wire;
+  dispose(): void;
+}
+//#endregion
+export { AccessSlotRequest as $, AccessCallIntent as A, PendingRequestInfo as At, AccessRequestArgs as B, staticTokenHandler as C, HubTrafficSubscription as Ct, TokenIdentityBinding as D, HubOptions as Dt, MintedToken as E, Hub as Et, AccessDirectPermission as F, AccessDurationName as G, HubAccessHandlers as H, AccessDuration as I, ProposeArgs as J, CapabilityProposal as K, AccessExtendArgs as L, AccessDecision as M, AccessDirectArgs as N, TokenIdentityStore as O, IDisposable as Ot, AccessDirectDecision as P, AccessSlotCandidate as Q, AccessExtendDecision as R, resolveConnectionHandler as S, HubTrafficSource as St, registerConnectionTokenBinderService as T, AttachedLink as Tt, RegisterHubAccessOptions as U, AccessSlotBinding as V, registerHubAccessService as W, AccessInterfaceRequirement as X, durationToExp as Y, AccessMemberRequirement as Z, RootProvision as _, RootOverlay as _t, PrefixPolicy as a, resolveAccessCandidates as at, fixedProvisionHandler as b, OverlaySplitterInspection as bt, ConnectionProvenance as c, createHubServiceInterfaces as ct, WithProvenance as d, registerHubServiceIdRegistry as dt, DirectoryEntry as et, WithProvenanceOptions as f, withRequestIdContext as ft, ConnectionHandlerFactory as g, registerIdentityServices as gt, ConnectionHandler as h, registerHubServices as ht, ClaimContext as i, fetchFullDirectory as it, AccessConsumer as j, TokenIdentityStoreOptions as k, IHubLogger as kt, ConnectionProvenanceProvider as l, HubRegisterOptions as lt, ConnectionContext as m, RegisterIdentityServicesOptions as mt, HubConnectionAcceptor as n, ResolvedCandidates as nt, PrincipalIdPrefixPolicy as o, HubServices as ot, withProvenance as p, RegisterHubServicesOptions as pt, CapabilityProposalIssuer as q, HubConnectionAcceptorOptions as r, candidatesForSlot as rt, PrincipalIdPrefixPolicyOptions as s, HubServicesOptions as st, HubAccessConfig as t, ResolvedAccessSlot as tt, ITransportWithProvenance as u, RegisterCallContext as ut, anonymousHandler as v, RootOverlayOptions as vt, RegisterConnectionTokenBinderOptions as w, HubTrafficWatchOptions as wt, provisionRoot as x, HubInspector as xt, boundTokenHandler as y, OverlaySplitter as yt, AccessExtendMember as z };
+//# sourceMappingURL=hubConnectionAcceptor-BwydvFa4.d.ts.map