@hediet/linkrpc 0.0.2 → 0.0.3-next.20260922.1

package/dist/chunks/{boundedTrafficSubscription-XZ1KwXZC.js → inspectionHost-BIkLKvr1.js}

@@ -2,8 +2,8 @@
 *  Copyright (c) Microsoft Corporation. All rights reserved.
 *  Licensed under the MIT License. See License.txt in the project root for license information.
 *--------------------------------------------------------------------------------------------*/
-import { any, array, boolean, enum as enum$1, int, literal, nonnegative, number, object, optional, record, string, union, unknown, void as void$1 } from "zod/mini";
-import { toJSONSchema } from "zod/v4/core";
+import { any, array, boolean, enum as enum$1, int, literal, nonnegative, number, object, optional, record, strictObject, string, union, unknown, void as void$1 } from "zod/mini";
+import { safeParse, toJSONSchema } from "zod/v4/core";
 import { z } from "zod";
 //#region src/schema/normalize.ts
 /**
@@ -153,9 +153,171 @@ function _constPropNames(props) {
 	return out;
 }
 //#endregion
-//#region src/schema/memberTypes.ts
+//#region src/connection/rpcFailure.ts
+const rpcFailureBrand = Symbol("linkrpc.rpcFailure");
+/** A nominal failure wrapper: successful application objects can never collide with it. */
+var RpcFailure = class {
+	error;
+	[rpcFailureBrand] = true;
+	constructor(error) {
+		this.error = error;
+		Object.freeze(this);
+	}
+};
+function isRpcFailure(value) {
+	return typeof value === "object" && value !== null && value[rpcFailureBrand] === true;
+}
+//#endregion
+//#region src/protocol/jsonRpc.ts
+const ErrorCode = {
+	/** Default code for named LinkRPC application errors. */
+	applicationError: 1,
+	parseError: -32700,
+	invalidRequest: -32600,
+	methodNotFound: -32601,
+	invalidParams: -32602,
+	internalError: -32603,
+	/** Caller is authenticated but lacks a capability covering the call. */
+	permissionRequired: -32401,
+	/** The peer a request was routed to detached before it could respond. */
+	peerDisconnected: -32402,
+	/** The request exceeded the hub's idle timeout with no stream activity. */
+	requestTimeout: -32403,
+	/** The request was cancelled (by the caller, or by the hub on disconnect). */
+	cancelled: -32800
+};
+function isRequest(m) {
+	return typeof m.method === "string" && m.id !== void 0;
+}
+function isNotification(m) {
+	return typeof m.method === "string" && m.id === void 0;
+}
+function isResponse(m) {
+	return typeof m.method !== "string";
+}
+//#endregion
+//#region src/schema/applicationErrorBrand.ts
 const applicationErrorBrand = Symbol("linkrpc.applicationError");
-function applicationError(code, message, dataSchema) {
+function brandApplicationError(value) {
+	return Object.freeze(Object.defineProperty(value, applicationErrorBrand, { value: true }));
+}
+//#endregion
+//#region src/schema/schemaSource.ts
+const schemaSources = /* @__PURE__ */ new WeakMap();
+//#endregion
+//#region src/schema/validationIssue.ts
+function jsonPointerSegment(key) {
+	return `/${String(key).replace(/~/g, "~0").replace(/\//g, "~1")}`;
+}
+//#endregion
+//#region src/schema/errorValidation.ts
+const bodySchemas = /* @__PURE__ */ new WeakMap();
+function parseDeclaredErrorBody(descriptor, body) {
+	return parseErrorBody(descriptor.bodySchema ?? errorBodySchema(descriptor), body);
+}
+function errorBodySchema(descriptor) {
+	let schema = bodySchemas.get(descriptor);
+	if (schema === void 0) {
+		const payload = descriptor.dataSchema === void 0 ? {} : { data: descriptor.dataSchema };
+		schema = descriptor.type === void 0 ? strictObject({
+			message: literal(descriptor.message),
+			...payload
+		}) : strictObject({
+			message: string(),
+			data: strictObject({
+				type: literal(descriptor.type),
+				...payload
+			})
+		});
+		bodySchemas.set(descriptor, schema);
+	}
+	return schema;
+}
+function parseErrorBody(schema, body) {
+	const parsed = safeParse(schema, body);
+	if (!parsed.success) return {
+		success: false,
+		issues: validationIssues(parsed.error.issues)
+	};
+	if (typeof parsed.data !== "object" || parsed.data === null || !("message" in parsed.data) || typeof parsed.data.message !== "string") return {
+		success: false,
+		issues: [{
+			path: "/message",
+			message: "Expected a string message"
+		}]
+	};
+	return {
+		success: true,
+		data: {
+			...parsed.data,
+			message: parsed.data.message
+		}
+	};
+}
+function validationIssues(issues, prefix = []) {
+	return issues.flatMap((issue) => {
+		const path = [...prefix, ...issue.path];
+		if (issue.code === "invalid_union") return issue.errors.flatMap((branch) => validationIssues(branch, path));
+		if (issue.code === "unrecognized_keys") return issue.keys.map((key) => ({
+			path: pointer([...path, key]),
+			message: "Unexpected property"
+		}));
+		return [{
+			path: pointer(path),
+			message: issue.message
+		}];
+	});
+}
+function pointer(path) {
+	return path.map(jsonPointerSegment).join("");
+}
+function jsonIssues(value, path = [], ancestors = /* @__PURE__ */ new Set()) {
+	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return [];
+	if (typeof value !== "object" || ancestors.has(value) || !Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) return [{
+		path: pointer(path),
+		message: "Expected a JSON value"
+	}];
+	ancestors.add(value);
+	const issues = (Array.isArray(value) ? Array.from(value.entries()) : Object.entries(value)).flatMap(([key, child]) => jsonIssues(child, [...path, key], ancestors));
+	ancestors.delete(value);
+	return issues;
+}
+//#endregion
+//#region src/schema/memberTypes.ts
+function rpcError(code, schemaOrShape) {
+	assertErrorCode(code);
+	const bodySchema = "_zod" in schemaOrShape ? schemaOrShape : object({
+		message: schemaOrShape.message ?? string(),
+		...schemaOrShape.data === void 0 ? {} : { data: schemaOrShape.data }
+	});
+	return Object.freeze({
+		code,
+		bodySchema,
+		create(body) {
+			return brandApplicationError({
+				kind: "application",
+				code,
+				message: body.message,
+				...Object.hasOwn(body, "data") ? { data: body.data } : {}
+			});
+		},
+		is(value) {
+			const payload = isRpcFailure(value) ? value.error : value;
+			if (!isApplicationErrorValue(payload) || payload.code !== code || payload.type !== void 0) return false;
+			return parseErrorBody(bodySchema, {
+				message: payload.message,
+				...Object.hasOwn(payload, "data") ? { data: payload.data } : {}
+			}).success;
+		}
+	});
+}
+function applicationError(codeOrType, messageOrOptions, dataSchema) {
+	const type = typeof codeOrType === "string" ? codeOrType : void 0;
+	if (type === "") throw new Error("Application error type must be a nonempty string.");
+	const options = typeof messageOrOptions === "object" ? messageOrOptions : void 0;
+	const code = typeof codeOrType === "number" ? codeOrType : options?.code ?? ErrorCode.applicationError;
+	const message = type === void 0 ? messageOrOptions : options?.message ?? type;
+	if (type !== void 0) dataSchema = options?.data;
 	assertApplicationErrorCode(code);
 	if (typeof message !== "string") throw new Error("Application error message must be a string.");
 	const create = dataSchema === void 0 ? function() {
@@ -164,6 +326,7 @@ function applicationError(code, message, dataSchema) {
 			kind: "application",
 			code,
 			message,
+			...type === void 0 ? {} : { type },
 			[applicationErrorBrand]: true
 		});
 	} : function(data) {
@@ -172,25 +335,44 @@ function applicationError(code, message, dataSchema) {
 			kind: "application",
 			code,
 			message,
+			...type === void 0 ? {} : { type },
 			[applicationErrorBrand]: true,
 			data
 		});
 	};
-	return Object.freeze({
+	const descriptor = Object.freeze({
+		type,
 		code,
 		message,
 		...dataSchema === void 0 ? {} : { dataSchema },
-		create
+		create,
+		is(value) {
+			const payload = isRpcFailure(value) ? value.error : value;
+			if (!isApplicationErrorValue(payload)) return false;
+			if (payload.kind !== "application" || payload.code !== code || payload.type !== type) return false;
+			const data = Object.hasOwn(payload, "data") ? { data: payload.data } : {};
+			return parseDeclaredErrorBody(descriptor, {
+				message: payload.message,
+				...type === void 0 ? data : { data: {
+					type,
+					...data
+				} }
+			}).success;
+		}
 	});
+	return descriptor;
 }
 /** Runtime nominal check for values produced by an application-error descriptor. */
 function isApplicationErrorValue(value) {
 	return typeof value === "object" && value !== null && value[applicationErrorBrand] === true;
 }
 function assertApplicationErrorCode(code) {
-	if (!Number.isInteger(code) || code < -2147483648 || code > 2147483647) throw new Error(`Application error code ${code} must be a signed 32-bit integer.`);
+	assertErrorCode(code);
 	if (code >= -32768 && code <= -32e3 || code === -32800) throw new Error(`Application error code ${code} is reserved by JSON-RPC or LinkRPC.`);
 }
+function assertErrorCode(code) {
+	if (!Number.isInteger(code) || code < -2147483648 || code > 2147483647) throw new Error(`Application error code ${code} must be a signed 32-bit integer.`);
+}
 var RequestType = class RequestType {
 	paramsSchema;
 	resultSchema;
@@ -210,10 +392,20 @@ var RequestType = class RequestType {
 		this.applicationErrors = applicationErrors;
 		const seen = /* @__PURE__ */ new Set();
 		for (const error of applicationErrors) {
+			if (applicationErrors.some((other) => other !== error && other.code === error.code && (other.bodySchema !== void 0 || error.bodySchema !== void 0))) throw new Error(`Raw error code ${error.code} cannot be shared.`);
+			if (error.bodySchema !== void 0) {
+				assertErrorCode(error.code);
+				const key = `code:${error.code}`;
+				if (seen.has(key)) throw new Error(`Duplicate application error ${key}.`);
+				seen.add(key);
+				continue;
+			}
 			assertApplicationErrorCode(error.code);
 			if (typeof error.message !== "string") throw new Error("Application error message must be a string.");
-			if (seen.has(error.code)) throw new Error(`Duplicate application error code ${error.code}.`);
-			seen.add(error.code);
+			if (error.type !== void 0 && (typeof error.type !== "string" || error.type.length === 0)) throw new Error("Application error type must be a nonempty string.");
+			const key = error.type === void 0 ? `code:${error.code}` : `type:${error.type}`;
+			if (seen.has(key)) throw new Error(`Duplicate application error ${key}.`);
+			seen.add(key);
 		}
 		this.applicationErrors = Object.freeze([...applicationErrors]);
 		this.errors = this.applicationErrors;
@@ -273,6 +465,14 @@ function notificationType(params, docs = {}) {
 }
 /** Convert a zod schema to our restricted SvcJsonSchema subset. */
 function zodToSvcJsonSchema(schema, options) {
+	const source = schemaSources.get(schema);
+	if (source !== void 0) {
+		for (const [name, component] of Object.entries(source.components)) {
+			if (options === void 0) throw new Error("Imported schema references require a component destination");
+			addComponent(options.components, name, normalizeJsonSchema(component));
+		}
+		return normalizeJsonSchema(source.schema);
+	}
 	const type = schema._zod?.def?.type;
 	if (type === "void" || type === "undefined") return true;
 	return normalizeZodJsonSchema(toJSONSchema(schema), options);
@@ -602,6 +802,13 @@ function normalizeSchemaPositions(schema) {
 			const value = normalized[field];
 			if (value !== void 0) normalized[field] = normalizeJsonSchema(value);
 		}
+		if (method.errors !== void 0) normalized.errors = method.errors.map((error) => error.schema !== void 0 ? {
+			...error,
+			schema: normalizeJsonSchema(error.schema)
+		} : {
+			...error,
+			...error.data === void 0 ? {} : { data: normalizeJsonSchema(error.data) }
+		});
 		return [name, normalized];
 	}));
 	const componentSchemas = schema.components?.schemas;
@@ -757,6 +964,13 @@ function createSchemaToZod(components = {}) {
 				if (schema.additionalProperties === false) base = object.strict();
 				else if (schema.additionalProperties === true) base = object.loose();
 				else base = object.catchall(compile(schema.additionalProperties));
+				base = base.superRefine((value, context) => {
+					for (const name of required) if (typeof value === "object" && value !== null && !Object.hasOwn(value, name)) context.addIssue({
+						code: "custom",
+						path: [name],
+						message: "Required property is missing"
+					});
+				});
 				break;
 			}
 		}
@@ -764,7 +978,12 @@ function createSchemaToZod(components = {}) {
 	};
 	return { toZod(schema) {
 		assertSchemaReferences([schema], components);
-		return compile(schema);
+		const result = compile(schema);
+		schemaSources.set(result, {
+			schema,
+			components
+		});
+		return result;
 	} };
 }
 function isAnnotationOnlySchema(schema) {
@@ -814,6 +1033,34 @@ function stringSchema(format) {
 	}
 }
 //#endregion
+//#region src/schema/validateInterfaceErrors.ts
+function validateInterfaceErrors(schema) {
+	if (schema === void 0) return;
+	for (const [methodName, method] of Object.entries(schema.methods)) {
+		if (method.result === void 0 && method.errors !== void 0) throw new Error(`Notification "${methodName}" cannot declare application errors.`);
+		const seen = /* @__PURE__ */ new Set();
+		const errors = method.errors ?? [];
+		for (const error of errors) {
+			if (!Number.isInteger(error.code) || error.code < -2147483648 || error.code > 2147483647) throw new Error(`Application error code ${error.code} on "${methodName}" must be a signed 32-bit integer.`);
+			if (errors.some((other) => other !== error && other.code === error.code && (other.schema !== void 0 || error.schema !== void 0))) throw new Error(`Raw error code ${error.code} on "${methodName}" cannot be shared.`);
+			if (error.schema !== void 0) {
+				if ([
+					"message",
+					"type",
+					"data"
+				].some((key) => Object.hasOwn(error, key))) throw new Error(`Raw error ${error.code} on "${methodName}" must contain only code and schema.`);
+			} else {
+				if (typeof error.message !== "string") throw new Error(`Application error message on "${methodName}" must be a string.`);
+				if (error.code >= -32768 && error.code <= -32e3 || error.code === -32800) throw new Error(`Application error code ${error.code} on "${methodName}" is reserved by JSON-RPC or LinkRPC.`);
+				if (error.type !== void 0 && (typeof error.type !== "string" || error.type.length === 0)) throw new Error(`Application error type on "${methodName}" must be a nonempty string.`);
+			}
+			const key = error.type === void 0 ? `code:${error.code}` : `type:${error.type}`;
+			if (seen.has(key)) throw new Error(`Duplicate application error ${key} on "${methodName}".`);
+			seen.add(key);
+		}
+	}
+}
+//#endregion
 //#region src/connection/interfaceDefinition.ts
 const interfaceDefinitionState = /* @__PURE__ */ new WeakMap();
 var InterfaceDefinition = class {
@@ -877,9 +1124,14 @@ function toMethodSchema(name, member, components) {
 		if (member.clientStreamSchema !== void 0) m.clientStream = convertMemberSchema(name, "clientStream", member.clientStreamSchema, components);
 		if (member.serverStreamSchema !== void 0) m.serverStream = convertMemberSchema(name, "serverStream", member.serverStreamSchema, components);
 		if (member.applicationErrors.length > 0) m.errors = member.applicationErrors.map((error) => {
+			if (error.bodySchema !== void 0) return {
+				code: error.code,
+				schema: convertMemberSchema(name, `error=${error.code}`, error.bodySchema, components)
+			};
 			const result = {
 				code: error.code,
-				message: error.message
+				message: error.message,
+				...error.type === void 0 ? {} : { type: error.type }
 			};
 			if (error.dataSchema !== void 0) result.data = convertMemberSchema(name, `error=${error.code}`, error.dataSchema, components);
 			return result;
@@ -895,20 +1147,6 @@ function toMethodSchema(name, member, components) {
 	if (docs.annotations !== void 0) m.annotations = docs.annotations;
 	return m;
 }
-function validateInterfaceErrors(schema) {
-	if (schema === void 0) return;
-	for (const [methodName, method] of Object.entries(schema.methods)) {
-		if (method.result === void 0 && method.errors !== void 0) throw new Error(`Notification "${methodName}" cannot declare application errors.`);
-		const seen = /* @__PURE__ */ new Set();
-		for (const error of method.errors ?? []) {
-			if (typeof error.message !== "string") throw new Error(`Application error message on "${methodName}" must be a string.`);
-			if (!Number.isInteger(error.code) || error.code < -2147483648 || error.code > 2147483647) throw new Error(`Application error code ${error.code} on "${methodName}" must be a signed 32-bit integer.`);
-			if (error.code >= -32768 && error.code <= -32e3 || error.code === -32800) throw new Error(`Application error code ${error.code} on "${methodName}" is reserved by JSON-RPC or LinkRPC.`);
-			if (seen.has(error.code)) throw new Error(`Duplicate application error code ${error.code} on "${methodName}".`);
-			seen.add(error.code);
-		}
-	}
-}
 function convertMemberSchema(methodName, position, schema, components) {
 	return zodToSvcJsonSchema(schema, {
 		methodName,
@@ -946,21 +1184,29 @@ function defineInterface(info, members) {
 * streams use `z.any()` because no zod source is available — call-site
 * validation is therefore a no-op and the caller is responsible for
 * shape-checking inputs and outputs. Declared application-error payloads
-* are materialized and validated because recognizing a typed error must
-* never rely on its code alone.
+* are materialized and validated after code selection. A known code whose
+* body fails all declared branches is a noncompliant-server failure.
 *
 * Methods with no `result` descriptor become notifications; methods with
 * `clientStream` / `serverStream` get pass-through stream payload
 * schemas attached.
 */
 function interfaceFromSchema(schema) {
+	validateInterfaceErrors(schema);
 	const members = {};
 	for (const [name, method] of Object.entries(schema.methods)) {
 		if (method.result === void 0) {
 			members[name] = new NotificationType(any());
 			continue;
 		}
-		const base = new RequestType(any(), any(), void$1()).withErrors((method.errors ?? []).map((error) => error.data === void 0 ? applicationError(error.code, error.message) : applicationError(error.code, error.message, schemaToZod(error.data, schema.components?.schemas))));
+		const base = new RequestType(any(), any(), void$1()).withErrors((method.errors ?? []).map((error) => error.schema !== void 0 ? rpcError(error.code, schemaToZod(error.schema, schema.components?.schemas)) : error.type !== void 0 ? error.data === void 0 ? applicationError(error.type, {
+			code: error.code,
+			message: error.message
+		}) : applicationError(error.type, {
+			code: error.code,
+			message: error.message,
+			data: schemaToZod(error.data, schema.components?.schemas)
+		}) : error.data === void 0 ? applicationError(error.code, error.message) : applicationError(error.code, error.message, schemaToZod(error.data, schema.components?.schemas))));
 		members[name] = method.clientStream !== void 0 || method.serverStream !== void 0 ? base.withStream({
 			client: method.clientStream !== void 0 ? any() : void 0,
 			server: method.serverStream !== void 0 ? any() : void 0
@@ -972,6 +1218,109 @@ function interfaceFromSchema(schema) {
 	return new InterfaceDefinition(info, members, { frozenSchema: schema });
 }
 //#endregion
+//#region src/crypto/cryptoProvider.ts
+const _b64UrlAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+const _b64UrlReverse = (() => {
+	const m = {};
+	for (let i = 0; i < 64; i++) m[_b64UrlAlphabet[i]] = i;
+	return m;
+})();
+function bytesToBase64Url(bytes) {
+	let out = "";
+	let i = 0;
+	for (; i + 3 <= bytes.length; i += 3) {
+		const n = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+		out += _b64UrlAlphabet[n >> 18 & 63] + _b64UrlAlphabet[n >> 12 & 63] + _b64UrlAlphabet[n >> 6 & 63] + _b64UrlAlphabet[n & 63];
+	}
+	const rem = bytes.length - i;
+	if (rem === 1) {
+		const n = bytes[i] << 16;
+		out += _b64UrlAlphabet[n >> 18 & 63] + _b64UrlAlphabet[n >> 12 & 63];
+	} else if (rem === 2) {
+		const n = bytes[i] << 16 | bytes[i + 1] << 8;
+		out += _b64UrlAlphabet[n >> 18 & 63] + _b64UrlAlphabet[n >> 12 & 63] + _b64UrlAlphabet[n >> 6 & 63];
+	}
+	return out;
+}
+function base64UrlToBytes(s) {
+	const len = s.length;
+	const fullGroups = Math.floor(len / 4);
+	const rem = len % 4;
+	if (rem === 1) throw new Error("base64UrlToBytes: invalid length");
+	const outLen = fullGroups * 3 + (rem === 0 ? 0 : rem - 1);
+	const out = new Uint8Array(outLen);
+	let oi = 0;
+	let i = 0;
+	for (let g = 0; g < fullGroups; g++, i += 4) {
+		const n = _lookup(s, i) << 18 | _lookup(s, i + 1) << 12 | _lookup(s, i + 2) << 6 | _lookup(s, i + 3);
+		out[oi++] = n >> 16 & 255;
+		out[oi++] = n >> 8 & 255;
+		out[oi++] = n & 255;
+	}
+	if (rem === 2) {
+		const n = _lookup(s, i) << 18 | _lookup(s, i + 1) << 12;
+		out[oi++] = n >> 16 & 255;
+	} else if (rem === 3) {
+		const n = _lookup(s, i) << 18 | _lookup(s, i + 1) << 12 | _lookup(s, i + 2) << 6;
+		out[oi++] = n >> 16 & 255;
+		out[oi++] = n >> 8 & 255;
+	}
+	return out;
+}
+function _lookup(s, i) {
+	const v = _b64UrlReverse[s[i]];
+	if (v === void 0) throw new Error(`base64UrlToBytes: invalid char at ${i}`);
+	return v;
+}
+/** Role-tag prefix on a {@link KeyId}'s inline-key form. */
+const KEY_ID_PREFIX = "key:";
+/** Role-tag prefix that wraps a genesis {@link KeyId} into a {@link PrincipalId}. */
+const PRINCIPAL_PREFIX = "id:";
+/** The inline {@link KeyId} for a raw public key: `"key:" + b64url(pk)`. */
+function keyIdForPublicKey(pk) {
+	return KEY_ID_PREFIX + bytesToBase64Url(pk);
+}
+/** The perpetual {@link PrincipalId} for a raw public key: `"id:key:" + b64url(pk)`. */
+function principalForPublicKey(pk) {
+	return "id:" + keyIdForPublicKey(pk);
+}
+/**
+* The genesis {@link KeyId} embedded in a perpetual {@link PrincipalId}
+* (`"id:" + keyId`). Throws if `principal` is not a well-formed `id:` name.
+*/
+function keyIdForPrincipal(principal) {
+	if (!principal.startsWith("id:")) throw new Error(`malformed principal (missing "id:" prefix): ${principal}`);
+	return principal.slice(3);
+}
+/**
+* The raw public key carried inline by a `"key:"` {@link KeyId}. Throws on a
+* missing prefix or malformed base64url.
+*/
+function publicKeyForKeyId(keyId) {
+	if (!keyId.startsWith("key:")) throw new Error(`unsupported keyId (expected "${KEY_ID_PREFIX}" prefix): ${keyId}`);
+	return base64UrlToBytes(keyId.slice(4));
+}
+/**
+* Resolve the verifying public key for `(principal, keyId)`, or `undefined`
+* to **reject** (fail closed). This is the single seam every verifier goes
+* through, replacing the old "the id *is* the key" decode.
+*
+* Phase 1 supports only inline genesis keys: the `keyId` must be a `"key:"`
+* form and the principal must be exactly `"id:" + keyId` (genesis
+* self-certification by string equality). `keydoc:`/rotation forms resolve
+* through `bindings`/`timeMs` later and are intentionally not handled here.
+*/
+function resolveSigningKey(args) {
+	const { principal, keyId } = args;
+	if (!keyId.startsWith("key:")) return;
+	if ("id:" + keyId !== principal) return;
+	try {
+		return { publicKey: base64UrlToBytes(keyId.slice(4)) };
+	} catch {
+		return;
+	}
+}
+//#endregion
 //#region src/inspection/inspection.interfaces.ts
 const zTopologyPort = object({
 	portId: string(),
@@ -1146,6 +1495,142 @@ const nodeInterface = defineInterface({
 	description: "Topology bootstrap: identify the node and port at this end of the direct connection."
 }, { getNodeId: requestType(object({}), zNodeInfo) });
 //#endregion
+//#region src/connection/streaming.ts
+/**
+* Direction a {@link STREAM_METHOD} message travels, relative to the
+* request it is correlated with. Made explicit on the wire so that a
+* middlebox (the hub) can *author* a stream message — e.g. inject a
+* cancel when a caller disconnects — without an inbound message whose
+* arrival link it could infer the direction from.
+*/
+const StreamDir = {
+	/** callee → caller: progress, partial results. Routes like a response. */
+	toCaller: "toCaller",
+	/** caller → callee: input, cancellation, keepalive ping. */
+	toCallee: "toCallee"
+};
+/**
+* Reserved control verbs. A control message carries no app `payload`; it
+* is interpreted by the runtime / hub itself, independently of the
+* originating method's stream schemas, so *any* request is cancellable
+* and keep-alive-able even when it declares no app stream.
+*/
+const StreamControlType = {
+	/**
+	* Ask the callee to abort the in-flight request. Always {@link
+	* StreamDir.toCallee}. The callee surfaces this as an `AbortSignal`
+	* and is expected to settle the request (typically with a
+	* `cancelled` error response).
+	*/
+	cancel: "cancel",
+	/**
+	* Keepalive / liveness probe. Resets the hub's per-request idle timer
+	* so a long-running call is not reaped, and lets either side actively
+	* probe the peer. Carries a `nonce` the peer echoes in its {@link
+	* StreamControlType.pong}. May travel in either direction. Emitted
+	* automatically (without awaiting a pong) by the channel for streaming
+	* calls; see {@link STREAM_METHOD}.
+	*/
+	ping: "ping",
+	/**
+	* Reply to a {@link StreamControlType.ping}, echoing the ping's
+	* `nonce` so the prober can correlate it. Travels opposite the ping.
+	* Carries no app effect — purely a liveness acknowledgement.
+	*/
+	pong: "pong"
+};
+/**
+* Well-known `control.reason` strings. The set is **open** — any string
+* is valid on the wire; these are the reasons linkrpc itself emits.
+*/
+const StreamControlReason = {
+	/**
+	* The caller's transport dropped while the request was in flight; the
+	* hub cancels the callee's now-orphaned work.
+	*/
+	clientDisconnected: "clientDisconnected",
+	/**
+	* The request exceeded the hub's idle timeout with no stream activity
+	* (no ping, no stream message). See {@link STREAM_METHOD} docs.
+	*/
+	idleTimeout: "idleTimeout"
+};
+/**
+* Streaming sub-protocol. Long-running requests can emit additional
+* notifications correlated with the original call in either direction
+* (callee → caller progress, caller → callee input / cancellation /
+* keepalive).
+*
+* Wire form: a JSON-RPC notification whose method is
+* `${streamInterface.info.id}::send` and whose params match
+* `streamInterface.members.send.paramsSchema`. The hub routes purely on
+* `requestId` (following the originating request's established path, like
+* a response); the originating request's capability authorization covers
+* its full stream lifetime, so stream notifications carry no method /
+* interface namespace of their own. App `payload` contents are typed per
+* request via the originating method's
+* `RequestType.clientStreamSchema` / `serverStreamSchema`; reserved
+* `control` messages are schema-independent.
+*
+* Idle timeout: a request that never streams (no `control` ping, no
+* stream message) is subject to the hub's per-request idle timeout
+* (default 30 minutes) — at which point it is cancelled and its caller
+* gets a `requestTimeout` error. This bounds the hub's pending-request
+* table, which is also what protects it from a slow-loris / DDoS that
+* opens requests and never completes them. Streaming-enabled calls keep
+* themselves alive by emitting a periodic {@link StreamControlType.ping}.
+*
+* The interface is declarative: nobody calls
+* `LinkRpcConnection.register(streamInterface, ...)`. The channel and the
+* hub intercept `$stream::send` directly. The definition exists so
+* reflection / consent UIs can describe the wire shape and so all wire
+* constants derive from one source.
+*/
+const streamInterface = defineInterface({
+	id: "$stream",
+	description: "Reserved sub-protocol for in-flight stream messages correlated to a request by `requestId`."
+}, { send: notificationType(object({
+	/**
+	* Id of the in-flight request the message belongs to.
+	* The hub rewrites this across the forwarding boundary
+	* in the same way it rewrites response ids.
+	*/
+	requestId: union([number(), string()]),
+	/**
+	* Which way this message travels relative to the request.
+	* Explicit so the hub can author messages (e.g. cancel on
+	* disconnect) without inferring direction from arrival.
+	*/
+	dir: enum$1(["toCaller", "toCallee"]),
+	/**
+	* Reserved control verb (cancel / ping / pong). Mutually
+	* exclusive with `payload` in practice: a control message
+	* is interpreted by the runtime, not the application.
+	*/
+	control: optional(object({
+		type: enum$1([
+			"cancel",
+			"ping",
+			"pong"
+		]),
+		/** Open-set human/diagnostic reason; see {@link StreamControlReason}. */
+		reason: optional(string()),
+		/**
+		* Correlation token. A `ping` carries a fresh nonce;
+		* the matching `pong` echoes it back so the prober
+		* can resolve the right outstanding probe.
+		*/
+		nonce: optional(string())
+	})),
+	/** Opaque app payload — typed per call by the request's stream schema. */
+	payload: optional(unknown())
+}), { description: "Emit a stream message tied to the request `requestId`." }) });
+/**
+* Full wire method name for stream notifications. Pulled from the
+* interface object so we have a single source of truth.
+*/
+const STREAM_METHOD = `${streamInterface.info.id}::send`;
+//#endregion
 //#region src/inspection/trafficFlowFilter.ts
 var TrafficFlowFilter = class {
 	_focused;
@@ -1196,24 +1681,37 @@ var TrafficWatchFlowTracker = class {
 		this._active.clear();
 		this._unclaimed.clear();
 	}
+	forgetPort(portId) {
+		for (const flow of this._active) if (flow.hasPort(portId)) this._removeFlow(flow);
+	}
 };
 var CorrelatedFlow = class {
 	_endpoints = /* @__PURE__ */ new Set();
+	_ports = /* @__PURE__ */ new Set();
 	_completionEndpoint;
 	constructor(endpoints, completionEndpoint = endpoints[0]) {
-		for (const endpoint of endpoints) this._endpoints.add(endpointKey(endpoint));
+		for (const endpoint of endpoints) {
+			this._endpoints.add(endpointKey(endpoint));
+			this._ports.add(endpoint.portId);
+		}
 		this._completionEndpoint = completionEndpoint === void 0 ? void 0 : endpointKey(completionEndpoint);
 	}
 	matches(transit) {
 		return requestRefsOf(transit).some((endpoint) => this._endpoints.has(endpointKey(endpoint)));
 	}
+	hasPort(portId) {
+		return this._ports.has(portId);
+	}
 	accept(transit) {
 		const endpoints = requestRefsOf(transit);
 		if (!this.matches(transit)) return {
 			matches: false,
 			completed: false
 		};
-		for (const endpoint of endpoints) this._endpoints.add(endpointKey(endpoint));
+		for (const endpoint of endpoints) {
+			this._endpoints.add(endpointKey(endpoint));
+			this._ports.add(endpoint.portId);
+		}
 		const completed = transit.kind === "response" && (isTerminal(transit) || this._completionEndpoint !== void 0 && endpoints.some((endpoint) => endpointKey(endpoint) === this._completionEndpoint));
 		if (completed) this._endpoints.clear();
 		return {
@@ -1382,6 +1880,490 @@ function capPayload(value, maxBytes) {
 	return preview;
 }
 //#endregion
-export { EXTENSION_PREFIX as A, requestType as B, defineInterface as C, assertSchemaReferences as D, schemaToZod as E, NotificationType as F, normalizeJsonSchema as H, RequestType as I, applicationError as L, sha256 as M, jcsCanonicalize as N, componentSchemaName as O, jcsCanonicalizeBytes as P, isApplicationErrorValue as R, InterfaceDefinition as S, createSchemaToZod as T, zodToSvcJsonSchema as V, zTrafficEvent as _, topologyInterface as a, zTrafficTransitEvent as b, zParticipantDescriptorSource as c, zTopologyLink as d, zTopologyLinkEndpoint as f, zTopologyTransportInfo as g, zTopologyTransportEndpoint as h, nodeInterface as i, computeInterfaceHash as j, componentSchemaRef as k, zRouteClaim as l, zTopologyPort as m, TrafficFlowFilter as n, trafficInterface as o, zTopologyNode as p, TrafficWatchFlowTracker as r, zParticipantDescriptor as s, BoundedTrafficSubscription as t, zTopologyGraph as u, zTrafficOverflowEvent as v, interfaceFromSchema as w, zTrafficWatchResult as x, zTrafficTransitEndpoint as y, notificationType as z };
+//#region src/inspection/endpointTrafficInspector.ts
+const REQUEST_CORRELATION_RETENTION_MS = 18e5;
+const MAX_REQUEST_CORRELATIONS = 4096;
+var EndpointTrafficInspector = class {
+	_nodeId;
+	_portId;
+	_emit;
+	_isObserved;
+	_outboundRequests = /* @__PURE__ */ new Map();
+	_inboundRequests = /* @__PURE__ */ new Map();
+	observe = (direction, message) => {
+		this._onMessage(direction, message);
+	};
+	constructor(_nodeId, _portId, _emit, _isObserved) {
+		this._nodeId = _nodeId;
+		this._portId = _portId;
+		this._emit = _emit;
+		this._isObserved = _isObserved;
+	}
+	dispose() {
+		this._outboundRequests.clear();
+		this._inboundRequests.clear();
+	}
+	_onMessage(direction, message) {
+		const now = Date.now();
+		this._pruneRequestCorrelations(now);
+		const publiclyObserved = this._isObserved();
+		if (!publiclyObserved) this.dispose();
+		let transit;
+		const endpoint = this._endpoint("id" in message ? message.id ?? void 0 : void 0);
+		const base = {
+			type: "transit",
+			timeMs: now,
+			nodeId: this._nodeId,
+			...direction === "inbound" ? { in: endpoint } : { out: endpoint },
+			disposition: direction === "inbound" ? "consumed" : "forwarded"
+		};
+		if (isRequest(message)) {
+			const correlation = {
+				method: message.method,
+				timeMs: now
+			};
+			if (publiclyObserved) {
+				const map = this._requestMap(direction);
+				const key = requestKey(message.id);
+				map.delete(key);
+				map.set(key, correlation);
+			}
+			transit = {
+				...base,
+				kind: "request",
+				method: message.method,
+				params: message.params
+			};
+		} else if (isResponse(message)) {
+			const responseMap = direction === "inbound" ? this._outboundRequests : this._inboundRequests;
+			const key = requestKey(message.id);
+			const correlation = responseMap.get(key);
+			responseMap.delete(key);
+			transit = {
+				...base,
+				kind: "response",
+				method: correlation?.method,
+				result: "result" in message ? message.result : void 0,
+				error: "error" in message ? message.error : void 0
+			};
+		} else if (isNotification(message) && message.method === STREAM_METHOD) {
+			const params = message.params;
+			const streamEndpoint = this._endpoint(params?.requestId);
+			transit = {
+				...base,
+				...direction === "inbound" ? { in: streamEndpoint } : { out: streamEndpoint },
+				kind: "stream",
+				method: STREAM_METHOD,
+				params: message.params
+			};
+		} else transit = {
+			...base,
+			kind: "notification",
+			method: message.method,
+			params: message.params
+		};
+		function requestKey(requestId) {
+			return JSON.stringify([typeof requestId, requestId]);
+		}
+		this._emit(transit);
+	}
+	_requestMap(direction) {
+		return direction === "outbound" ? this._outboundRequests : this._inboundRequests;
+	}
+	_endpoint(requestId) {
+		return {
+			edgeId: this._portId,
+			portId: this._portId,
+			...requestId !== void 0 ? { requestId } : {}
+		};
+	}
+	_pruneRequestCorrelations(timeMs) {
+		this._pruneRequestMap(this._outboundRequests, timeMs);
+		this._pruneRequestMap(this._inboundRequests, timeMs);
+	}
+	_pruneRequestMap(map, timeMs) {
+		while (map.size !== 0) {
+			const first = map.entries().next().value;
+			if (first === void 0 || map.size <= MAX_REQUEST_CORRELATIONS && timeMs - first[1].timeMs <= REQUEST_CORRELATION_RETENTION_MS) return;
+			map.delete(first[0]);
+		}
+	}
+};
+//#endregion
+//#region src/inspection/connectionInspectionSource.ts
+var ConnectionInspectionSource = class {
+	_connection;
+	_nodeId;
+	_options;
+	_isObserved;
+	constructor(_connection, _nodeId, _options, _isObserved) {
+		this._connection = _connection;
+		this._nodeId = _nodeId;
+		this._options = _options;
+		this._isObserved = _isObserved;
+	}
+	snapshotTopology() {
+		const { portId, label, peer, transport } = this._options;
+		const nodes = [{
+			nodeId: this._nodeId,
+			ports: [{
+				portId,
+				...label === void 0 ? {} : { label }
+			}]
+		}];
+		const links = [];
+		if (peer !== void 0) {
+			nodes.push({
+				nodeId: peer.nodeId,
+				kind: "endpoint",
+				...peer.label === void 0 ? {} : { label: peer.label },
+				ports: [{ portId: peer.portId }]
+			});
+			links.push({
+				from: {
+					nodeId: this._nodeId,
+					portId
+				},
+				to: {
+					nodeId: peer.nodeId,
+					portId: peer.portId
+				},
+				peerState: "identified",
+				...transport === void 0 ? {} : { transport }
+			});
+		}
+		return {
+			nodes,
+			links,
+			routes: []
+		};
+	}
+	onTopologyChanged(_listener) {
+		return { dispose: () => {} };
+	}
+	observeTraffic(listener) {
+		const inspector = new EndpointTrafficInspector(this._nodeId, this._options.portId, listener, this._isObserved);
+		const observation = this._connection.observeWireMessages(inspector.observe);
+		return { dispose: () => {
+			observation.dispose();
+			inspector.dispose();
+		} };
+	}
+};
+//#endregion
+//#region src/inspection/inspectionHost.ts
+/** A shared inspection scope, independent of both routing and its RPC connections. */
+var InspectionHost = class {
+	_options;
+	_sources = /* @__PURE__ */ new Map();
+	_trackedConnections = /* @__PURE__ */ new Set();
+	_bindings = /* @__PURE__ */ new Set();
+	_subscribers = /* @__PURE__ */ new Set();
+	_observers = /* @__PURE__ */ new Set();
+	_topologyListeners = /* @__PURE__ */ new Set();
+	_trafficSources = /* @__PURE__ */ new Set();
+	_trafficWatches = new TrafficWatchFlowTracker();
+	_disposed = false;
+	nodeId;
+	constructor(_options) {
+		this._options = _options;
+		this.nodeId = _options.nodeId;
+	}
+	get observerCount() {
+		return this._subscribers.size + this._observers.size;
+	}
+	addSource(source) {
+		this._assertActive();
+		if (this._sources.has(source)) throw new Error("Inspection source is already registered");
+		const readPorts = () => new Set(source.snapshotTopology().nodes.flatMap((node) => node.ports.map((port) => port.portId)));
+		let ports = readPorts();
+		const topology = source.onTopologyChanged(() => {
+			const nextPorts = readPorts();
+			const removed = [...ports].filter((port) => !nextPorts.has(port));
+			ports = nextPorts;
+			this._forgetUnusedPorts(removed);
+			this._invalidateTopology();
+		});
+		let traffic;
+		try {
+			traffic = source.observeTraffic((event) => this.publishTransit(event));
+		} catch (error) {
+			topology.dispose();
+			throw error;
+		}
+		const registration = { dispose: () => {
+			if (this._sources.get(source) !== registration) return;
+			this._sources.delete(source);
+			topology.dispose();
+			traffic.dispose();
+			this._forgetUnusedPorts([...ports]);
+			this._invalidateTopology();
+		} };
+		this._sources.set(source, registration);
+		this._invalidateTopology();
+		return registration;
+	}
+	trackConnection(connection, options) {
+		this._assertActive();
+		if (this.getGraph("").nodes.some((node) => node.ports.some((port) => port.portId === options.portId))) throw new Error(`Inspection port "${options.portId}" is already registered`);
+		const source = new ConnectionInspectionSource(connection, this.nodeId, options, () => this.observerCount !== 0);
+		const registration = this.addSource(source);
+		let close;
+		try {
+			close = connection.onDidClose(() => result.dispose());
+		} catch (error) {
+			registration.dispose();
+			throw error;
+		}
+		const result = { dispose: () => {
+			this._trackedConnections.delete(result);
+			close.dispose();
+			registration.dispose();
+		} };
+		this._trackedConnections.add(result);
+		return result;
+	}
+	expose(connection, options) {
+		this._assertActive();
+		const portId = options.portId ?? createPortId();
+		const binding = new InspectionBinding(portId);
+		const registrations = [];
+		this._bindings.add(binding);
+		const registerOptions = { serviceId: options.serviceId };
+		try {
+			const controls = new EndpointTrafficInspector(this.nodeId, portId, (event) => this._trafficWatches.accept(event), () => false);
+			registrations.push(connection.observeWireMessages(controls.observe));
+			registrations.push({ dispose: () => controls.dispose() });
+			registrations.push(connection.registerInspection(nodeInterface, { getNodeId: () => ({
+				nodeId: this.nodeId,
+				portId,
+				...(options.descriptors ?? this._options.descriptors) === void 0 ? {} : { descriptors: [...options.descriptors ?? this._options.descriptors ?? []] }
+			}) }, registerOptions));
+			registrations.push(connection.registerInspection(topologyInterface, {
+				getGraph: () => this.getGraph(options.serviceId, options.includeRoute === false ? void 0 : portId),
+				watchGraph: (_params, _ctx, stream) => this._watchGraph(binding, stream)
+			}, registerOptions));
+			registrations.push(connection.registerInspection(trafficInterface, {
+				watch: (params, _ctx, stream) => this._watchTraffic(binding, params, stream),
+				watchWithPayloads: (params, _ctx, stream) => this._watchTraffic(binding, params, stream)
+			}, registerOptions));
+		} catch (error) {
+			for (const registration of registrations.reverse()) registration.dispose();
+			this._bindings.delete(binding);
+			throw error;
+		}
+		binding.onDispose = () => {
+			this._bindings.delete(binding);
+			for (const registration of registrations.reverse()) registration.dispose();
+			this._forgetUnusedPorts([portId]);
+			this._invalidateTopology();
+		};
+		registrations.push(connection.onDidClose(() => binding.dispose()));
+		this._invalidateTopology();
+		return binding;
+	}
+	getGraph(observerServiceId, routePortId) {
+		this._assertActive();
+		const nodes = /* @__PURE__ */ new Map();
+		const mergeNode = (node) => {
+			const previous = nodes.get(node.nodeId);
+			const ports = new Map(previous?.ports.map((port) => [port.portId, port]));
+			for (const port of node.ports) ports.set(port.portId, {
+				...ports.get(port.portId),
+				...port
+			});
+			nodes.set(node.nodeId, {
+				...previous,
+				...node,
+				ports: [...ports.values()]
+			});
+		};
+		mergeNode({
+			nodeId: this.nodeId,
+			kind: this._options.kind ?? "endpoint",
+			...this._options.label === void 0 ? {} : { label: this._options.label },
+			...this._options.descriptors === void 0 ? {} : { descriptors: [...this._options.descriptors] },
+			ports: []
+		});
+		const links = [];
+		const routes = [];
+		for (const source of this._sources.keys()) {
+			const fragment = source.snapshotTopology();
+			for (const node of fragment.nodes) mergeNode(node);
+			links.push(...fragment.links);
+			routes.push(...fragment.routes);
+		}
+		for (const binding of this._bindings) mergeNode({
+			nodeId: this.nodeId,
+			ports: [{ portId: binding.portId }]
+		});
+		if (routePortId !== void 0) routes.push({
+			serviceId: observerServiceId,
+			nodeId: this.nodeId,
+			portId: routePortId,
+			match: "exact"
+		});
+		return {
+			observerServiceId,
+			entryNodeId: this.nodeId,
+			nodes: [...nodes.values()],
+			links,
+			routes
+		};
+	}
+	publishTransit(event) {
+		if (this._disposed || this._trafficWatches.accept(event)) return;
+		for (const observer of [...this._observers]) try {
+			observer(event);
+		} catch {}
+		for (const subscriber of this._subscribers) subscriber.enqueue(event);
+	}
+	subscribe(options, send) {
+		this._assertActive();
+		if (options.trafficIgnoreKey !== void 0 && !this._trafficWatches.claim(options.trafficIgnoreKey)) throw new Error("Traffic watch request was not observed before subscription");
+		const subscriber = new BoundedTrafficSubscription(options, send, () => {
+			this._subscribers.delete(subscriber);
+			this._stopUnusedTrafficSources();
+		});
+		this._subscribers.add(subscriber);
+		try {
+			this._startTrafficSources();
+		} catch (error) {
+			subscriber.dispose();
+			throw error;
+		}
+		return subscriber;
+	}
+	observeTraffic(observer) {
+		this._assertActive();
+		this._observers.add(observer);
+		const registration = { dispose: () => {
+			this._observers.delete(observer);
+			this._stopUnusedTrafficSources();
+		} };
+		try {
+			this._startTrafficSources();
+		} catch (error) {
+			registration.dispose();
+			throw error;
+		}
+		return registration;
+	}
+	addTrafficSource(source) {
+		this._assertActive();
+		const entry = { source };
+		this._trafficSources.add(entry);
+		try {
+			this._startTrafficSources();
+		} catch (error) {
+			this._trafficSources.delete(entry);
+			throw error;
+		}
+		return { dispose: () => {
+			this._trafficSources.delete(entry);
+			entry.observation?.dispose();
+			entry.observation = void 0;
+		} };
+	}
+	dispose() {
+		if (this._disposed) return;
+		this._disposed = true;
+		for (const binding of [...this._bindings]) binding.dispose();
+		for (const subscriber of [...this._subscribers]) subscriber.dispose();
+		this._observers.clear();
+		this._stopUnusedTrafficSources();
+		this._trafficSources.clear();
+		for (const connection of [...this._trackedConnections]) connection.dispose();
+		for (const source of [...this._sources.values()]) source.dispose();
+		this._topologyListeners.clear();
+		this._trafficWatches.clear();
+	}
+	_startTrafficSources() {
+		if (this.observerCount === 0) return;
+		for (const entry of this._trafficSources) entry.observation ??= entry.source.observe((event) => this.publishTransit(event));
+	}
+	_stopUnusedTrafficSources() {
+		if (this.observerCount !== 0) return;
+		for (const entry of this._trafficSources) {
+			entry.observation?.dispose();
+			entry.observation = void 0;
+		}
+	}
+	_invalidateTopology() {
+		if (this._disposed) return;
+		for (const listener of this._topologyListeners) listener();
+	}
+	_forgetUnusedPorts(portIds) {
+		if (this._disposed) return;
+		const remaining = new Set(this.getGraph("").nodes.flatMap((node) => node.ports.map((port) => port.portId)));
+		for (const portId of portIds) if (!remaining.has(portId)) this._trafficWatches.forgetPort(portId);
+	}
+	_watchGraph(binding, stream) {
+		return new Promise((resolve, reject) => {
+			let pending = false;
+			let active = true;
+			const finish = () => {
+				active = false;
+				this._topologyListeners.delete(invalidate);
+				stream.signal.removeEventListener("abort", finish);
+				binding.abort.signal.removeEventListener("abort", finish);
+				resolve({});
+			};
+			const invalidate = () => {
+				if (pending || !active) return;
+				pending = true;
+				queueMicrotask(() => {
+					pending = false;
+					if (!active) return;
+					stream.send({}).catch((error) => {
+						reject(error);
+						finish();
+					});
+				});
+			};
+			this._topologyListeners.add(invalidate);
+			stream.signal.addEventListener("abort", finish, { once: true });
+			binding.abort.signal.addEventListener("abort", finish, { once: true });
+			if (stream.signal.aborted || binding.abort.signal.aborted) finish();
+		});
+	}
+	async _watchTraffic(binding, options, stream) {
+		const subscription = this.subscribe(options, (event) => stream.send(event));
+		const dispose = () => subscription.dispose();
+		stream.signal.addEventListener("abort", dispose, { once: true });
+		binding.abort.signal.addEventListener("abort", dispose, { once: true });
+		if (stream.signal.aborted || binding.abort.signal.aborted) dispose();
+		try {
+			return await subscription.closed;
+		} finally {
+			stream.signal.removeEventListener("abort", dispose);
+			binding.abort.signal.removeEventListener("abort", dispose);
+			subscription.dispose();
+		}
+	}
+	_assertActive() {
+		if (this._disposed) throw new Error("Inspection host is disposed");
+	}
+};
+var InspectionBinding = class {
+	portId;
+	abort = new AbortController();
+	onDispose = () => {};
+	constructor(portId) {
+		this.portId = portId;
+	}
+	dispose() {
+		if (this.abort.signal.aborted) return;
+		this.abort.abort();
+		this.onDispose();
+	}
+};
+function createPortId() {
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	globalThis.crypto.getRandomValues(bytes);
+	return `port:${bytesToBase64Url(bytes)}`;
+}
+//#endregion
+export { RequestType as $, PRINCIPAL_PREFIX as A, interfaceFromSchema as B, zTopologyTransportInfo as C, zTrafficTransitEvent as D, zTrafficTransitEndpoint as E, principalForPublicKey as F, componentSchemaName as G, createSchemaToZod as H, publicKeyForKeyId as I, computeInterfaceHash as J, componentSchemaRef as K, resolveSigningKey as L, bytesToBase64Url as M, keyIdForPrincipal as N, zTrafficWatchResult as O, keyIdForPublicKey as P, NotificationType as Q, InterfaceDefinition as R, zTopologyTransportEndpoint as S, zTrafficOverflowEvent as T, schemaToZod as U, validateInterfaceErrors as V, assertSchemaReferences as W, jcsCanonicalize as X, sha256 as Y, jcsCanonicalizeBytes as Z, zTopologyGraph as _, TrafficWatchFlowTracker as a, zodToSvcJsonSchema as at, zTopologyNode as b, StreamControlType as c, jsonPointerSegment as ct, nodeInterface as d, isNotification as dt, applicationError as et, topologyInterface as f, isRequest as ft, zRouteClaim as g, normalizeJsonSchema as gt, zParticipantDescriptorSource as h, isRpcFailure as ht, TrafficFlowFilter as i, rpcError as it, base64UrlToBytes as j, KEY_ID_PREFIX as k, StreamDir as l, brandApplicationError as lt, zParticipantDescriptor as m, RpcFailure as mt, ConnectionInspectionSource as n, notificationType as nt, STREAM_METHOD as o, jsonIssues as ot, trafficInterface as p, isResponse as pt, EXTENSION_PREFIX as q, BoundedTrafficSubscription as r, requestType as rt, StreamControlReason as s, parseDeclaredErrorBody as st, InspectionHost as t, isApplicationErrorValue as tt, streamInterface as u, ErrorCode as ut, zTopologyLink as v, zTrafficEvent as w, zTopologyPort as x, zTopologyLinkEndpoint as y, defineInterface as z };
 
-//# sourceMappingURL=boundedTrafficSubscription-XZ1KwXZC.js.map
+//# sourceMappingURL=inspectionHost-BIkLKvr1.js.map