@hediet/linkrpc 0.0.2 → 0.0.3-next.20260922.1

package/dist/chunks/{linkRpcConnection-BadD37ok.d.ts → linkRpcConnection-Bbq20hQG.d.ts}

@@ -42,6 +42,8 @@ interface JsonRpcError {
 type JsonRpcResponse = JsonRpcSuccess | JsonRpcError;
 type JsonRpcMessage = JsonRpcRequest | JsonRpcNotification | JsonRpcResponse;
 declare const ErrorCode: {
+  /** Default code for named LinkRPC application errors. */
+  readonly applicationError: 1;
   readonly parseError: -32700;
   readonly invalidRequest: -32600;
   readonly methodNotFound: -32601;
@@ -204,7 +206,7 @@ interface MethodSchema {
    * may not stream on this method.
    */
   serverStream?: LinkRpcJsonSchema;
-  /** Application-level errors. Codes MUST be unique. */
+  /** Raw codes are exclusive; named and legacy declarations may form a union per code. */
   errors?: ErrorSchema[];
   summary?: string;
   /**
@@ -262,14 +264,41 @@ interface MemberAnnotations {
    */
   dangerous?: boolean;
 }
-interface ErrorSchema {
+type ErrorSchema = LegacyErrorSchema | RawErrorSchema;
+interface RawErrorSchema {
+  code: number;
+  /** Schema of the wire body { message, data? }, excluding the outer code. */
+  schema: LinkRpcJsonSchema;
+  type?: never;
+  message?: never;
+  data?: never;
+}
+interface LegacyErrorSchema {
+  schema?: never;
+  /** Named error discriminator in `error.data.type`. Absent for legacy numeric errors. */
+  type?: string;
   /** JSON-RPC error code. -32768..-32000 and LinkRPC cancellation code -32800 are reserved. */
   code: number;
   message: string;
-  /** Optional schema describing the shape of `error.data`. */
+  /** Payload schema: `error.data.data` for named errors, `error.data` for legacy errors. */
   data?: LinkRpcJsonSchema;
 }
 //#endregion
+//#region src/connection/rpcFailure.d.ts
+declare const rpcFailureBrand: unique symbol;
+/** A nominal failure wrapper: successful application objects can never collide with it. */
+declare class RpcFailure<E> {
+  readonly error: E;
+  readonly [rpcFailureBrand] = true;
+  constructor(error: E);
+}
+type Result$1<T, E = never> = T | RpcFailure<E>;
+declare function isRpcFailure<T, E>(value: Result$1<T, E>): value is RpcFailure<E>;
+declare function isRpcFailure(value: unknown): value is RpcFailure<unknown>;
+//#endregion
+//#region src/schema/applicationErrorBrand.d.ts
+declare const applicationErrorBrand: unique symbol;
+//#endregion
 //#region src/schema/memberTypes.d.ts
 /**
  * The schema type linkrpc accepts everywhere: the zod *core* base shared by
@@ -286,8 +315,7 @@ type Schema<O = unknown> = $ZodType<O>;
  *  - propagate TS types up to the interface definition.
  */
 type MemberType = RequestType<any, any, any, any, any, any, any> | NotificationType<any>;
-declare const applicationErrorBrand: unique symbol;
-type ApplicationErrorValue<TCode extends number = number, TMessage extends string = string, TData = never> = {
+type ApplicationErrorValue<TCode extends number = number, TMessage extends string = string, TData = never, TType extends string | undefined = undefined> = {
   readonly kind: 'application';
   readonly code: TCode;
   readonly message: TMessage;
@@ -295,33 +323,104 @@ type ApplicationErrorValue<TCode extends number = number, TMessage extends strin
   readonly data?: never;
 } : {
   readonly data: TData;
+}) & (TType extends string ? {
+  readonly type: TType;
+} : {
+  readonly type?: never;
 });
-type CreatedApplicationErrorValue<TCode extends number = number, TMessage extends string = string, TData = never> = ApplicationErrorValue<TCode, TMessage, TData> & {
+type CreatedApplicationErrorValue<TCode extends number = number, TMessage extends string = string, TData = never, TType extends string | undefined = undefined> = ApplicationErrorValue<TCode, TMessage, TData, TType> & {
   readonly [applicationErrorBrand]: true;
 };
-interface ApplicationErrorDescriptor<TCode extends number = number, TMessage extends string = string, TData = never> {
+interface ApplicationErrorDescriptor<TCode extends number = number, TMessage extends string = string, TData = never, TType extends string | undefined = undefined> {
   readonly code: TCode;
   readonly message: TMessage;
   readonly dataSchema?: Schema<TData>;
-  readonly create: [TData] extends [never] ? () => CreatedApplicationErrorValue<TCode, TMessage, TData> : (data: TData) => CreatedApplicationErrorValue<TCode, TMessage, TData>;
+  readonly type: TType;
+  /** Match a validated application payload or its failure wrapper. */
+  is(value: RpcFailure<unknown>): value is RpcFailure<ApplicationErrorValue<TCode, string, TData, TType>>;
+  is(value: {
+    readonly kind: 'application';
+  }): value is ApplicationErrorValue<TCode, string, TData, TType>;
+  is(value: unknown): value is ApplicationErrorValue<TCode, string, TData, TType> | RpcFailure<ApplicationErrorValue<TCode, string, TData, TType>>;
+  readonly create: [TData] extends [never] ? () => CreatedApplicationErrorValue<TCode, TMessage, TData, TType> : (data: TData) => CreatedApplicationErrorValue<TCode, TMessage, TData, TType>;
 }
 interface ApplicationErrorDescriptorBase {
+  readonly type?: string;
   readonly code: number;
-  readonly message: string;
+  readonly message?: string;
+  readonly bodySchema?: Schema;
   readonly dataSchema?: Schema<any>;
   readonly create: (...args: any[]) => {
     readonly kind: 'application';
     readonly code: number;
     readonly message: string;
     readonly data?: unknown;
+    readonly type?: string;
     readonly [applicationErrorBrand]: true;
   };
 }
-type ApplicationErrorOf<T> = T extends ApplicationErrorDescriptor<infer C, infer M, infer D> ? CreatedApplicationErrorValue<C, M, D> : never;
-type PublicApplicationErrorOf<T> = 0 extends (1 & T) ? never : T extends CreatedApplicationErrorValue<infer C, infer M, infer D> ? ApplicationErrorValue<C, M, D> : never;
+type ApplicationErrorOf<T> = T extends RpcErrorDescriptor<infer C, infer B> ? CreatedRpcErrorValue<C, B> : T extends ApplicationErrorDescriptor<infer C, infer M, infer D, infer N> ? CreatedApplicationErrorValue<C, M, D, N> : never;
+type PublicApplicationErrorOf<T> = 0 extends (1 & T) ? never : T extends {
+  readonly [rawErrorBrand]: true;
+} ? Omit<T, typeof applicationErrorBrand | typeof rawErrorBrand> : T extends CreatedApplicationErrorValue<infer C, infer M, infer D, infer N> ? ApplicationErrorValue<C, N extends string ? string : M, D, N> : never;
 type DeclaredApplicationErrorOf<T> = 0 extends (1 & T) ? never : Extract<T, ReturnType<ApplicationErrorDescriptorBase['create']>>;
 type ApplicationErrorsOf<T extends readonly ApplicationErrorDescriptorBase[]> = ApplicationErrorOf<T[number]>;
+declare const rawErrorBrand: unique symbol;
+type RpcErrorBody = {
+  readonly message: string;
+  readonly data?: unknown;
+};
+type RpcErrorValue<C extends number, B extends RpcErrorBody> = B & {
+  readonly kind: 'application';
+  readonly code: C;
+  readonly type?: never;
+};
+type CreatedRpcErrorValue<C extends number, B extends RpcErrorBody> = RpcErrorValue<C, B> & {
+  readonly [applicationErrorBrand]: true;
+  readonly [rawErrorBrand]: true;
+};
+interface RpcErrorDescriptor<C extends number = number, B extends RpcErrorBody = RpcErrorBody> {
+  readonly code: C;
+  readonly bodySchema: Schema<B>;
+  readonly type?: never;
+  readonly message?: never;
+  readonly dataSchema?: never;
+  create(body: B): CreatedRpcErrorValue<C, B>;
+  is(value: RpcFailure<unknown>): value is RpcFailure<RpcErrorValue<C, B>>;
+  is(value: {
+    readonly kind: 'application';
+  }): value is RpcErrorValue<C, B>;
+  is(value: unknown): value is RpcErrorValue<C, B> | RpcFailure<RpcErrorValue<C, B>>;
+}
+type RawBody<M extends string, D extends Schema> = {
+  message: M;
+} & (D['_zod']['optout'] extends 'optional' ? {
+  data?: output<D>;
+} : {
+  data: output<D>;
+});
+/** Declare an error selected by numeric code; its schema validates the body afterwards. */
+declare function rpcError<const C extends number, B>(code: C, schema: Schema<B>): RpcErrorDescriptor<C, unknown extends B ? RpcErrorBody : B & RpcErrorBody>;
+declare function rpcError<const C extends number, M extends string = string, D extends Schema = Schema>(code: C, shape: {
+  message?: Schema<M>;
+  data: D;
+}): RpcErrorDescriptor<C, RawBody<M, D>>;
+declare function rpcError<const C extends number, M extends string = string>(code: C, shape: {
+  message?: Schema<M>;
+}): RpcErrorDescriptor<C, {
+  message: M;
+  data?: never;
+}>;
 /** Declare one checked application error for use with {@link RequestType.withErrors}. */
+declare function applicationError<const TType extends string, TData, const TCode extends number = typeof ErrorCode.applicationError>(type: TType, options: {
+  message?: string;
+  data: Schema<TData>;
+  code?: TCode;
+}): ApplicationErrorDescriptor<TCode, string, TData, TType>;
+declare function applicationError<const TType extends string, const TCode extends number = typeof ErrorCode.applicationError>(type: TType, options?: {
+  message?: string;
+  code?: TCode;
+}): ApplicationErrorDescriptor<TCode, string, never, TType>;
 declare function applicationError<const TCode extends number, const TMessage extends string>(code: TCode, message: TMessage): ApplicationErrorDescriptor<TCode, TMessage, never>;
 declare function applicationError<const TCode extends number, const TMessage extends string, TData>(code: TCode, message: TMessage, data: Schema<TData>): ApplicationErrorDescriptor<TCode, TMessage, TData>;
 /** Runtime nominal check for values produced by an application-error descriptor. */
@@ -432,6 +531,22 @@ interface ZodToSvcJsonSchemaOptions {
 /** Convert a zod schema to our restricted SvcJsonSchema subset. */
 declare function zodToSvcJsonSchema(schema: Schema, options?: ZodToSvcJsonSchemaOptions): LinkRpcJsonSchema;
 //#endregion
+//#region src/schema/validationIssue.d.ts
+interface JsonSchemaValidationIssue {
+  readonly path: string;
+  readonly message: string;
+}
+//#endregion
+//#region src/connection/nonCompliantServerError.d.ts
+/** JSON Pointer diagnostics relative to the original wire error. */
+type RpcValidationIssue = JsonSchemaValidationIssue;
+declare class NonCompliantServerError extends Error {
+  readonly original: JsonRpcError['error'];
+  readonly issues: readonly RpcValidationIssue[];
+  readonly kind: "nonCompliantServer";
+  constructor(original: JsonRpcError['error'], issues: readonly RpcValidationIssue[]);
+}
+//#endregion
 //#region src/connection/interfaceDefinition.d.ts
 /**
  * Per-call stream API handed to a request handler as its third argument.
@@ -550,17 +665,28 @@ interface LocalRpcError {
   readonly kind: 'local';
   readonly cause: unknown;
 }
+interface TransportRpcError {
+  readonly kind: 'transport';
+  readonly cause: unknown;
+}
+type GenericRpcError = RemoteRpcError | LocalRpcError | TransportRpcError | NonCompliantServerError;
+type RpcCallError<E = never> = {
+  readonly kind: 'application';
+  readonly error: E;
+} | {
+  readonly kind: 'generic';
+  readonly error: GenericRpcError;
+};
 type CheckedCallResult<TResult, TApplicationError = never> = {
   readonly ok: true;
   readonly value: TResult;
 } | {
   readonly ok: false;
-  readonly error: TApplicationError | RemoteRpcError | LocalRpcError;
+  readonly error: TApplicationError | GenericRpcError;
 };
-interface CheckedCall<TResult, TApplicationError = never> extends Promise<TResult> {
+interface CheckedCall<TResult, TApplicationError = never> extends Promise<Result$1<TResult, TApplicationError>> {
   /**
-   * Settle without throwing. Only an exact code/message/data-schema match is
-   * promoted to a typed application error.
+   * @deprecated Use getResultClient() for values that include generic errors.
    */
   result(): Promise<CheckedCallResult<TResult, TApplicationError>>;
 }
@@ -572,6 +698,7 @@ interface CheckedCall<TResult, TApplicationError = never> extends Promise<TResul
  */
 type _HasStream<TClient, TServer> = [TClient] extends [never] ? ([TServer] extends [never] ? false : true) : true;
 type ClientCall<TResult, TApplicationError> = [TApplicationError] extends [never] ? Promise<TResult> : CheckedCall<TResult, TApplicationError>;
+type ClientResult<R, E> = [E] extends [never] ? R : Result$1<R, E>;
 /**
  * Compile-time TypeScript shape of an interface — useful for typed
  * client/server implementations on top of the runtime definition.
@@ -584,8 +711,10 @@ type ClientCall<TResult, TApplicationError> = [TApplicationError] extends [never
  *   type Client = InterfaceClient<typeof myInterface>;
  *   // => { bar(p: {...}): Promise<string>; foo(p: {...}): void; }
  */
-type InterfaceClientMember<TMember> = TMember extends RequestType<infer P, infer R, infer E, infer TC, infer TS, any, any> ? (_HasStream<TC, TS> extends true ? (params: P, opts?: StreamCallOptions<TS>) => StreamingCall<R, TC> & ClientCall<R, PublicApplicationErrorOf<E>> : (params: P) => ClientCall<R, PublicApplicationErrorOf<E>>) : TMember extends NotificationType<infer P> ? (params: P) => void : never;
+type InterfaceClientMember<TMember> = TMember extends RequestType<infer P, infer R, infer E, infer TC, infer TS, any, any> ? (_HasStream<TC, TS> extends true ? (params: P, opts?: StreamCallOptions<TS>) => StreamingCall<ClientResult<R, PublicApplicationErrorOf<E>>, TC> & ClientCall<R, PublicApplicationErrorOf<E>> : (params: P) => ClientCall<R, PublicApplicationErrorOf<E>>) : TMember extends NotificationType<infer P> ? (params: P) => void : never;
 type InterfaceClient<TDef extends InterfaceDefinition<any>> = { [K in keyof TDef['members']]: InterfaceClientMember<TDef['members'][K]>; };
+/** Every request returns failures as values, including methods with no declared errors. */
+type InterfaceResultClient<TDef extends InterfaceDefinition<any>> = { [K in keyof TDef['members']]: TDef['members'][K] extends RequestType<infer P, infer R, infer E, infer TC, infer TS, any, any> ? _HasStream<TC, TS> extends true ? (params: P, opts?: StreamCallOptions<TS>) => StreamingCall<Result$1<R, RpcCallError<PublicApplicationErrorOf<E>>>, TC> : (params: P) => Promise<Result$1<R, RpcCallError<PublicApplicationErrorOf<E>>>> : TDef['members'][K] extends NotificationType<infer P> ? (params: P) => void : never; };
 /**
  * Compile-time shape of a server implementation for an interface — used by
  * `LinkRpcConnection.register`. Request handlers may return synchronously or
@@ -653,8 +782,8 @@ declare function defineInterface<TMembers extends MemberMap>(info: InterfaceInfo
  * streams use `z.any()` because no zod source is available — call-site
  * validation is therefore a no-op and the caller is responsible for
  * shape-checking inputs and outputs. Declared application-error payloads
- * are materialized and validated because recognizing a typed error must
- * never rely on its code alone.
+ * are materialized and validated after code selection. A known code whose
+ * body fails all declared branches is a noncompliant-server failure.
  *
  * Methods with no `result` descriptor become notifications; methods with
  * `clientStream` / `serverStream` get pass-through stream payload
@@ -737,6 +866,7 @@ interface Components {
 }
 /** Match one JSON value against the structural LinkRPC subset without transforming it. */
 declare function matchesJsonSchema(value: JsonValue, schema: LinkRpcJsonSchema, components?: Components): boolean;
+declare function validateJsonSchema(value: JsonValue, schema: LinkRpcJsonSchema, components?: Components): readonly JsonSchemaValidationIssue[];
 //#endregion
 //#region src/schema/assertSchemaReferences.d.ts
 declare function componentSchemaRef(name: string): string;
@@ -777,6 +907,8 @@ declare function schemaToZod(schema: LinkRpcJsonSchema, components?: Record<stri
 //#endregion
 //#region src/schema/codegen/generateTsInterface.d.ts
 interface GenerateInterfaceOptions {
+  /** Omit imports when composing definitions inside a generated module. */
+  omitImports?: boolean;
   /**
    * Module specifier from which `defineInterface`, `requestType`,
    * `notificationType` are imported. Defaults to `@hediet/linkrpc`.
@@ -814,614 +946,283 @@ interface GenerateInterfaceOptions {
  */
 declare function generateTsInterface(schema: LinkRpcInterfaceSchema, options?: GenerateInterfaceOptions): string;
 //#endregion
-//#region src/inspection/inspection.interfaces.d.ts
-declare const zTopologyPort: import("zod/mini").ZodMiniObject<{
-  portId: import("zod/mini").ZodMiniString<string>;
-  label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-}, import("zod/v4/core").$strip>;
-declare const zParticipantDescriptor: import("zod/mini").ZodMiniObject<{
-  type: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-  label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-  processId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
-  processType: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-  nodeStatusServiceId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-  metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
-}, import("zod/v4/core").$strip>;
-declare const zParticipantDescriptorSource: import("zod/mini").ZodMiniObject<{
-  source: import("zod/mini").ZodMiniEnum<{
-    self: "self";
-    attacher: "attacher";
-  }>;
-  descriptor: import("zod/mini").ZodMiniObject<{
-    type: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-    label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-    processId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
-    processType: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-    nodeStatusServiceId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-    metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
-  }, import("zod/v4/core").$strip>;
-}, import("zod/v4/core").$strip>;
-declare const zTopologyNode: import("zod/mini").ZodMiniObject<{
-  nodeId: import("zod/mini").ZodMiniString<string>;
-  kind: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniEnum<{
-    endpoint: "endpoint";
-    hub: "hub";
-  }>>;
-  label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-  descriptors: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
-    source: import("zod/mini").ZodMiniEnum<{
-      self: "self";
-      attacher: "attacher";
-    }>;
-    descriptor: import("zod/mini").ZodMiniObject<{
-      type: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-      label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-      processId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
-      processType: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-      nodeStatusServiceId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-      metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
-    }, import("zod/v4/core").$strip>;
-  }, import("zod/v4/core").$strip>>>;
-  ports: import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
-    portId: import("zod/mini").ZodMiniString<string>;
-    label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-  }, import("zod/v4/core").$strip>>;
-}, import("zod/v4/core").$strip>;
-declare const zTopologyLinkEndpoint: import("zod/mini").ZodMiniObject<{
-  nodeId: import("zod/mini").ZodMiniString<string>;
-  portId: import("zod/mini").ZodMiniString<string>;
-}, import("zod/v4/core").$strip>;
-declare const zTopologyTransportEndpoint: import("zod/mini").ZodMiniObject<{
-  address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-  port: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
-}, import("zod/v4/core").$strip>;
+//#region src/schema/staticHubSchema.d.ts
+interface InterfaceRef {
+  interfaceId: string;
+  interfaceHash: string;
+}
+type StaticInterfaceReference = InterfaceRef;
+interface StaticService {
+  serviceId: string;
+  interfaces: StaticInterfaceReference[];
+}
+interface StaticHubSchemaDocument {
+  services?: StaticService[];
+  defaultInterface?: StaticInterfaceReference;
+  bareInterfaces?: {
+    interface: InterfaceRef;
+    prefix: string;
+  }[];
+  interfaceSchemas: LinkRpcInterfaceSchema[];
+}
+type StaticHubSchema = StaticHubSchemaDocument;
+declare function parseStaticHubSchema(value: unknown): StaticHubSchema;
+//#endregion
+//#region src/schema/codegen/generateTsContract.d.ts
+interface GenerateContractOptions {
+  linkRpcImport?: string;
+  /** Exact `interfaceId@interfaceHash` keys; required when derived names collide. */
+  interfaceNames?: Readonly<Record<string, string>>;
+  /** Keys: `root:id@hash`, `service:serviceId:id@hash`, `default`, or `bare:prefix`. */
+  bindingNames?: Readonly<Record<string, string>>;
+}
+/** Generate one reusable definition per schema and immutable, typed route descriptors. */
+declare function generateTsContract(document: StaticHubSchemaDocument, options?: GenerateContractOptions): string;
+//#endregion
+//#region src/disposable.d.ts
+/** Minimal disposable handle; calling `dispose` releases the resource. */
+interface IDisposable {
+  dispose(): void;
+}
+//#endregion
+//#region src/transport/messageTransport.d.ts
+interface IMessageTransport<TIncoming = JsonRpcMessage, TOutgoing = JsonRpcMessage> {
+  send(message: TOutgoing): void | Promise<void>;
+  /**
+   * Sets the listener for incoming messages. Setting `undefined` detaches.
+   * The transport buffers messages received before a listener is attached
+   * and delivers them the next tick when one is set.
+   * Forgetting to set a listener will cause the queue to leak.
+   */
+  setListener(listener: ((message: TIncoming) => void) | undefined): void;
+  dispose(): void;
+}
+type MessageWithContext<TCtx> = JsonRpcMessage & {
+  context: TCtx;
+};
+type MessageTransportWithContext<TCtx> = IMessageTransport<JsonRpcMessage, MessageWithContext<TCtx>>;
+type MessageTransportDirection = 'send' | 'receive';
+type MessageTransportTrace = (direction: MessageTransportDirection, message: JsonRpcMessage) => void;
 /**
- * Transport details as observed at a topology link. `local` corresponds to the
- * link's `from` endpoint and `remote` to its `to` endpoint.
+ * Observe every message crossing a transport without changing its buffering or
+ * lifecycle behavior.
  */
-declare const zTopologyTransportInfo: import("zod/mini").ZodMiniObject<{
-  type: import("zod/mini").ZodMiniString<string>;
-  local: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
-    address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-    port: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
-  }, import("zod/v4/core").$strip>>;
-  remote: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
-    address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-    port: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
-  }, import("zod/v4/core").$strip>>;
-  path: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-  metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
-}, import("zod/v4/core").$strip>;
-declare const zTopologyLink: import("zod/mini").ZodMiniObject<{
-  from: import("zod/mini").ZodMiniObject<{
-    nodeId: import("zod/mini").ZodMiniString<string>;
-    portId: import("zod/mini").ZodMiniString<string>;
-  }, import("zod/v4/core").$strip>;
-  to: import("zod/mini").ZodMiniObject<{
-    nodeId: import("zod/mini").ZodMiniString<string>;
-    portId: import("zod/mini").ZodMiniString<string>;
-  }, import("zod/v4/core").$strip>;
-  label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-  peerState: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniEnum<{
-    identified: "identified";
-    pending: "pending";
-    unsupported: "unsupported";
-    error: "error";
-  }>>;
-  transport: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
-    type: import("zod/mini").ZodMiniString<string>;
-    local: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
-      address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-      port: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
-    }, import("zod/v4/core").$strip>>;
-    remote: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
-      address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-      port: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
-    }, import("zod/v4/core").$strip>>;
-    path: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-    metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
-  }, import("zod/v4/core").$strip>>;
-}, import("zod/v4/core").$strip>;
-declare const zRouteClaim: import("zod/mini").ZodMiniObject<{
-  serviceId: import("zod/mini").ZodMiniString<string>;
-  nodeId: import("zod/mini").ZodMiniString<string>;
-  portId: import("zod/mini").ZodMiniString<string>;
-  match: import("zod/mini").ZodMiniEnum<{
-    exact: "exact";
-    prefix: "prefix";
-  }>;
-}, import("zod/v4/core").$strip>;
-declare const zTopologyGraph: import("zod/mini").ZodMiniObject<{
-  observerServiceId: import("zod/mini").ZodMiniString<string>;
-  entryNodeId: import("zod/mini").ZodMiniString<string>;
-  nodes: import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
-    nodeId: import("zod/mini").ZodMiniString<string>;
-    kind: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniEnum<{
-      endpoint: "endpoint";
-      hub: "hub";
-    }>>;
-    label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-    descriptors: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
-      source: import("zod/mini").ZodMiniEnum<{
-        self: "self";
-        attacher: "attacher";
-      }>;
-      descriptor: import("zod/mini").ZodMiniObject<{
-        type: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-        label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-        processId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
-        processType: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-        nodeStatusServiceId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-        metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
-      }, import("zod/v4/core").$strip>;
-    }, import("zod/v4/core").$strip>>>;
-    ports: import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
-      portId: import("zod/mini").ZodMiniString<string>;
-      label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-    }, import("zod/v4/core").$strip>>;
-  }, import("zod/v4/core").$strip>>;
-  links: import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
-    from: import("zod/mini").ZodMiniObject<{
-      nodeId: import("zod/mini").ZodMiniString<string>;
-      portId: import("zod/mini").ZodMiniString<string>;
-    }, import("zod/v4/core").$strip>;
-    to: import("zod/mini").ZodMiniObject<{
-      nodeId: import("zod/mini").ZodMiniString<string>;
-      portId: import("zod/mini").ZodMiniString<string>;
-    }, import("zod/v4/core").$strip>;
-    label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-    peerState: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniEnum<{
-      identified: "identified";
-      pending: "pending";
-      unsupported: "unsupported";
-      error: "error";
-    }>>;
-    transport: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
-      type: import("zod/mini").ZodMiniString<string>;
-      local: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
-        address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-        port: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
-      }, import("zod/v4/core").$strip>>;
-      remote: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
-        address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-        port: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
-      }, import("zod/v4/core").$strip>>;
-      path: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-      metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
-    }, import("zod/v4/core").$strip>>;
-  }, import("zod/v4/core").$strip>>;
-  routes: import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
-    serviceId: import("zod/mini").ZodMiniString<string>;
-    nodeId: import("zod/mini").ZodMiniString<string>;
-    portId: import("zod/mini").ZodMiniString<string>;
-    match: import("zod/mini").ZodMiniEnum<{
-      exact: "exact";
-      prefix: "prefix";
-    }>;
-  }, import("zod/v4/core").$strip>>;
-}, import("zod/v4/core").$strip>;
-type TopologyPort = output<typeof zTopologyPort>;
-type ParticipantDescriptor = output<typeof zParticipantDescriptor>;
-type ParticipantDescriptorSource = output<typeof zParticipantDescriptorSource>;
-type TopologyNode = output<typeof zTopologyNode>;
-type TopologyLinkEndpoint = output<typeof zTopologyLinkEndpoint>;
-type TopologyTransportEndpoint = output<typeof zTopologyTransportEndpoint>;
-type TopologyTransportInfo = output<typeof zTopologyTransportInfo>;
-type TopologyLink = output<typeof zTopologyLink>;
-type RouteClaim = output<typeof zRouteClaim>;
-type TopologyGraph = output<typeof zTopologyGraph>;
-declare const topologyInterface: InterfaceDefinition<{
-  getGraph: RequestType<Record<string, never>, {
-    observerServiceId: string;
-    entryNodeId: string;
-    nodes: {
-      nodeId: string;
-      ports: {
-        portId: string;
-        label?: string | undefined;
-      }[];
-      kind?: "endpoint" | "hub" | undefined;
-      label?: string | undefined;
-      descriptors?: {
-        source: "self" | "attacher";
-        descriptor: {
-          type?: string | undefined;
-          label?: string | undefined;
-          processId?: number | undefined;
-          processType?: string | undefined;
-          nodeStatusServiceId?: string | undefined;
-          metadata?: Record<string, string | number | boolean> | undefined;
-        };
-      }[] | undefined;
-    }[];
-    links: {
-      from: {
-        nodeId: string;
-        portId: string;
-      };
-      to: {
-        nodeId: string;
-        portId: string;
-      };
-      label?: string | undefined;
-      peerState?: "identified" | "pending" | "unsupported" | "error" | undefined;
-      transport?: {
-        type: string;
-        local?: {
-          address?: string | undefined;
-          port?: number | undefined;
-        } | undefined;
-        remote?: {
-          address?: string | undefined;
-          port?: number | undefined;
-        } | undefined;
-        path?: string | undefined;
-        metadata?: Record<string, string | number | boolean> | undefined;
-      } | undefined;
-    }[];
-    routes: {
-      serviceId: string;
-      nodeId: string;
-      portId: string;
-      match: "exact" | "prefix";
-    }[];
-  }, void, NoInfer<Record<string, never>>, never, readonly ApplicationErrorDescriptorBase[], void>;
-  watchGraph: RequestType<Record<string, never>, Record<string, never>, void, never, NoInfer<Record<string, never>>, readonly ApplicationErrorDescriptorBase[], void>;
-}>;
-declare const zTrafficTransitEndpoint: import("zod/mini").ZodMiniObject<{
-  edgeId: import("zod/mini").ZodMiniString<string>;
-  portId: import("zod/mini").ZodMiniString<string>;
-  requestId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniString<string>]>>;
-}, import("zod/v4/core").$strip>;
-declare const zTrafficTransitEvent: import("zod/mini").ZodMiniObject<{
-  type: import("zod/mini").ZodMiniLiteral<"transit">;
-  timeMs: import("zod/mini").ZodMiniNumber<number>;
-  nodeId: import("zod/mini").ZodMiniString<string>;
-  in: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
-    edgeId: import("zod/mini").ZodMiniString<string>;
-    portId: import("zod/mini").ZodMiniString<string>;
-    requestId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniString<string>]>>;
-  }, import("zod/v4/core").$strip>>;
-  out: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
-    edgeId: import("zod/mini").ZodMiniString<string>;
-    portId: import("zod/mini").ZodMiniString<string>;
-    requestId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniString<string>]>>;
-  }, import("zod/v4/core").$strip>>;
-  disposition: import("zod/mini").ZodMiniEnum<{
-    forwarded: "forwarded";
-    consumed: "consumed";
-    dropped: "dropped";
-    unroutable: "unroutable";
-  }>;
-  kind: import("zod/mini").ZodMiniEnum<{
-    request: "request";
-    notification: "notification";
-    response: "response";
-    stream: "stream";
-  }>;
-  method: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-  params: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnknown>;
-  result: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnknown>;
-  error: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
-    code: import("zod/mini").ZodMiniNumber<number>;
-    message: import("zod/mini").ZodMiniString<string>;
-    data: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnknown>;
-  }, import("zod/v4/core").$strip>>;
-}, import("zod/v4/core").$strip>;
-declare const zTrafficOverflowEvent: import("zod/mini").ZodMiniObject<{
-  type: import("zod/mini").ZodMiniLiteral<"overflow">;
-  dropped: import("zod/mini").ZodMiniNumber<number>;
-}, import("zod/v4/core").$strip>;
-declare const zTrafficEvent: import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniObject<{
-  type: import("zod/mini").ZodMiniLiteral<"transit">;
-  timeMs: import("zod/mini").ZodMiniNumber<number>;
-  nodeId: import("zod/mini").ZodMiniString<string>;
-  in: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
-    edgeId: import("zod/mini").ZodMiniString<string>;
-    portId: import("zod/mini").ZodMiniString<string>;
-    requestId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniString<string>]>>;
-  }, import("zod/v4/core").$strip>>;
-  out: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
-    edgeId: import("zod/mini").ZodMiniString<string>;
-    portId: import("zod/mini").ZodMiniString<string>;
-    requestId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniString<string>]>>;
-  }, import("zod/v4/core").$strip>>;
-  disposition: import("zod/mini").ZodMiniEnum<{
-    forwarded: "forwarded";
-    consumed: "consumed";
-    dropped: "dropped";
-    unroutable: "unroutable";
-  }>;
-  kind: import("zod/mini").ZodMiniEnum<{
-    request: "request";
-    notification: "notification";
-    response: "response";
-    stream: "stream";
-  }>;
-  method: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-  params: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnknown>;
-  result: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnknown>;
-  error: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
-    code: import("zod/mini").ZodMiniNumber<number>;
-    message: import("zod/mini").ZodMiniString<string>;
-    data: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnknown>;
-  }, import("zod/v4/core").$strip>>;
-}, import("zod/v4/core").$strip>, import("zod/mini").ZodMiniObject<{
-  type: import("zod/mini").ZodMiniLiteral<"overflow">;
-  dropped: import("zod/mini").ZodMiniNumber<number>;
-}, import("zod/v4/core").$strip>]>;
-type TrafficTransitEndpoint = output<typeof zTrafficTransitEndpoint>;
-type TrafficTransitEvent = output<typeof zTrafficTransitEvent>;
-type TrafficOverflowEvent = output<typeof zTrafficOverflowEvent>;
-type TrafficEvent = output<typeof zTrafficEvent>;
-declare const zTrafficWatchResult: import("zod/mini").ZodMiniObject<{
-  delivered: import("zod/mini").ZodMiniNumber<number>;
-  dropped: import("zod/mini").ZodMiniNumber<number>;
-}, import("zod/v4/core").$strip>;
-type TrafficWatchResult = output<typeof zTrafficWatchResult>;
+declare function traceMessageTransport(transport: IMessageTransport, trace: MessageTransportTrace): IMessageTransport;
 /**
- * Observe raw message transits at the node hosting the addressed service.
- * Consumers may correlate adjacent transits by shared `(portId, requestId)`.
+ * Pipe two transports together: every message one receives is forwarded to
+ * the other's `send`. Returns a disposable that detaches both listeners.
+ *
+ * Neither transport is disposed — the caller owns their lifecycle. This is
+ * the building block for relays (e.g. bridging a `WindowMessageTransport`
+ * for an iframe to a multiplexer channel).
  */
-declare const trafficInterface: InterfaceDefinition<{
-  watch: RequestType<{
-    methodPrefix?: string | undefined;
-    trafficIgnoreKey?: string | undefined;
-    focusRequest?: {
-      portId: string;
-      requestId: string | number;
-    } | undefined;
-  }, {
-    delivered: number;
-    dropped: number;
-  }, void, never, NoInfer<{
-    type: "transit";
-    timeMs: number;
-    nodeId: string;
-    disposition: "forwarded" | "consumed" | "dropped" | "unroutable";
-    kind: "request" | "notification" | "response" | "stream";
-    in?: {
-      edgeId: string;
-      portId: string;
-      requestId?: string | number | undefined;
-    } | undefined;
-    out?: {
-      edgeId: string;
-      portId: string;
-      requestId?: string | number | undefined;
-    } | undefined;
-    method?: string | undefined;
-    params?: unknown;
-    result?: unknown;
-    error?: {
-      code: number;
-      message: string;
-      data?: unknown;
-    } | undefined;
-  } | {
-    type: "overflow";
-    dropped: number;
-  }>, readonly ApplicationErrorDescriptorBase[], void>;
-  watchWithPayloads: RequestType<{
-    maxPayloadBytes: number;
-    methodPrefix?: string | undefined;
-    trafficIgnoreKey?: string | undefined;
-    focusRequest?: {
-      portId: string;
-      requestId: string | number;
-    } | undefined;
-  }, {
-    delivered: number;
-    dropped: number;
-  }, void, never, NoInfer<{
-    type: "transit";
-    timeMs: number;
-    nodeId: string;
-    disposition: "forwarded" | "consumed" | "dropped" | "unroutable";
-    kind: "request" | "notification" | "response" | "stream";
-    in?: {
-      edgeId: string;
-      portId: string;
-      requestId?: string | number | undefined;
-    } | undefined;
-    out?: {
-      edgeId: string;
-      portId: string;
-      requestId?: string | number | undefined;
-    } | undefined;
-    method?: string | undefined;
-    params?: unknown;
-    result?: unknown;
-    error?: {
-      code: number;
-      message: string;
-      data?: unknown;
-    } | undefined;
-  } | {
-    type: "overflow";
-    dropped: number;
-  }>, readonly ApplicationErrorDescriptorBase[], void>;
-}>;
-//#endregion
-//#region src/inspection/node.interfaces.d.ts
-declare const zNodeInfo: import("zod/mini").ZodMiniObject<{
-  nodeId: import("zod/mini").ZodMiniString<string>;
-  portId: import("zod/mini").ZodMiniString<string>;
-  descriptors: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
-    source: import("zod/mini").ZodMiniEnum<{
-      self: "self";
-      attacher: "attacher";
-    }>;
-    descriptor: import("zod/mini").ZodMiniObject<{
-      type: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-      label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-      processId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
-      processType: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-      nodeStatusServiceId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
-      metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
-    }, import("zod/v4/core").$strip>;
-  }, import("zod/v4/core").$strip>>>;
-}, import("zod/v4/core").$strip>;
-type NodeInfo = output<typeof zNodeInfo>;
-/**
- * Generates unique topology-correlation labels, not security identities.
- * Custom generators must avoid collisions across nodes and ports. Tests can
- * supply an independent deterministic sequence for each participant.
- */
-type TopologyIdGenerator = (kind: 'node' | 'port') => string;
+declare function connectTransports<T extends JsonRpcMessage>(a: IMessageTransport<T>, b: IMessageTransport<T>): IDisposable;
 /**
- * Minimal root service for aligning the independently observed topologies at
- * both ends of a connection.
+ * Two in-memory transports wired back-to-back. Useful for tests and for
+ * same-process bridges.
+ *
+ * Generic in the per-direction payload type so asymmetric pairs (e.g. one
+ * side sends plain `JsonRpcMessage`, the other side sends
+ * `JsonRpcMessage & { context: Participant }`) are expressible at the type
+ * level. At runtime both halves just hand objects through by reference.
  */
-declare const nodeInterface: InterfaceDefinition<{
-  getNodeId: RequestType<Record<string, never>, {
-    nodeId: string;
-    portId: string;
-    descriptors?: {
-      source: "self" | "attacher";
-      descriptor: {
-        type?: string | undefined;
-        label?: string | undefined;
-        processId?: number | undefined;
-        processType?: string | undefined;
-        nodeStatusServiceId?: string | undefined;
-        metadata?: Record<string, string | number | boolean> | undefined;
-      };
-    }[] | undefined;
-  }, any, never, never, readonly ApplicationErrorDescriptorBase[], any>;
-}>;
+declare class TransportPair<TFromA = JsonRpcMessage, TFromB = JsonRpcMessage> {
+  readonly a: IMessageTransport<TFromB, TFromA>;
+  readonly b: IMessageTransport<TFromA, TFromB>;
+  constructor();
+}
 //#endregion
-//#region src/connection/streaming.d.ts
+//#region src/connection/channel.d.ts
+declare class Channel<TInCtx = undefined, TOutCtx = undefined> {
+  readonly sender: IRequestSender<TOutCtx>;
+  private readonly _setHandler;
+  private readonly _setWireObserver?;
+  constructor(sender: IRequestSender<TOutCtx>, _setHandler: (h: IRequestHandler<TInCtx> | undefined) => void, _setWireObserver?: ((observer: WireMessageObserver | undefined) => void) | undefined);
+  /** Bind the inbound request/notification handler. May be called before or after construction of {@link LinkRpcConnection}. */
+  setRequestHandler(handler: IRequestHandler<TInCtx> | undefined): void;
+  /**
+   * Install the endpoint inspection observer at the JSON-RPC wire boundary.
+   * Intended for {@link LinkRpcConnection}; ordinary consumers should use the
+   * public `hubrpc.traffic` service instead.
+   */
+  setWireMessageObserver(observer: WireMessageObserver | undefined): void;
+  /**
+   * Compose this channel with a sender-side decorator (typically the
+   * signing layer). The decorator wraps {@link sender} only; the
+   * {@link setRequestHandler} binding is shared with the original channel
+   * so the receive side is bound exactly once regardless of decoration depth.
+   */
+  withSender<TNewOutCtx>(decorate: (raw: IRequestSender<TOutCtx>) => IRequestSender<TNewOutCtx>): Channel<TInCtx, TNewOutCtx>;
+}
+type WireMessageDirection = 'inbound' | 'outbound';
+type WireMessageObserver = (direction: WireMessageDirection, message: JsonRpcMessage) => void;
+interface IRequestHandler<TInCtx = undefined> {
+  handleRequest(call: IncomingCall<TInCtx>): Promise<Result>;
+  handleNotification(call: IncomingCall<TInCtx>): void;
+}
 /**
- * Direction a {@link STREAM_METHOD} message travels, relative to the
- * request it is correlated with. Made explicit on the wire so that a
- * middlebox (the hub) can *author* a stream message — e.g. inject a
- * cancel when a caller disconnects — without an inbound message whose
- * arrival link it could infer the direction from.
+ * Inbound call observed by an {@link IRequestHandler}. `TInCtx` is the
+ * per-call out-of-band context the transport attached on the receiving
+ * side (e.g. the hub stamps `Participant` on overlay-bound messages).
+ * For wire transports it's `undefined`.
  */
-declare const StreamDir: {
-  /** callee → caller: progress, partial results. Routes like a response. */
-  readonly toCaller: "toCaller";
-  /** caller → callee: input, cancellation, keepalive ping. */
-  readonly toCallee: "toCallee";
-};
-type StreamDir = (typeof StreamDir)[keyof typeof StreamDir];
+interface IncomingCall<TInCtx = undefined> {
+  method: string;
+  params: JsonValue | undefined;
+  /** Out-of-band context attached by the transport, if any. */
+  context: TInCtx;
+  /**
+   * Per-call streaming handle. Both directions live on this object,
+   * scoped to the request's lifetime. The inbound listener is auto-
+   * detached when the handler's response settles. For notifications
+   * (no request id) the handle is a no-op stub.
+   */
+  stream: IncomingStream;
+  /**
+   * Aborts when the caller cancels this in-flight request (a
+   * `toCallee` `cancel` control), or when the hub cancels it on the
+   * caller's behalf (caller disconnect / idle timeout). The handler
+   * should observe this and settle promptly — typically by throwing,
+   * which surfaces as a `cancelled` error response. For notifications
+   * this never aborts.
+   */
+  signal: AbortSignal;
+}
 /**
- * Reserved control verbs. A control message carries no app `payload`; it
- * is interpreted by the runtime / hub itself, independently of the
- * originating method's stream schemas, so *any* request is cancellable
- * and keep-alive-able even when it declares no app stream.
+ * Per-call streaming handle attached to {@link IncomingCall.stream}.
+ * Scoped to a single in-flight request; the channel automatically
+ * detaches the inbound listener when the handler's response settles.
+ *
+ * For notifications (which have no request id), `requestId` is
+ * `undefined`, `send` is a no-op, and `onMessage` is a no-op.
  */
-declare const StreamControlType: {
+interface IncomingStream {
+  /** Emit a server→client stream notification correlated with this call. */
+  send(payload: JsonValue): Promise<void>;
   /**
-   * Ask the callee to abort the in-flight request. Always {@link
-   * StreamDir.toCallee}. The callee surfaces this as an `AbortSignal`
-   * and is expected to settle the request (typically with a
-   * `cancelled` error response).
+   * Register a listener for client→server stream messages correlated
+   * with this call. Pass `undefined` to detach. Replaces any prior
+   * listener. The channel detaches the listener automatically when
+   * the handler's response settles.
    */
-  readonly cancel: "cancel";
+  onMessage(listener: ((payload: JsonValue) => void) | undefined): void;
   /**
-   * Keepalive / liveness probe. Resets the hub's per-request idle timer
-   * so a long-running call is not reaped, and lets either side actively
-   * probe the peer. Carries a `nonce` the peer echoes in its {@link
-   * StreamControlType.pong}. May travel in either direction. Emitted
-   * automatically (without awaiting a pong) by the channel for streaming
-   * calls; see {@link STREAM_METHOD}.
+   * Liveness probe toward the caller: emit a `toCaller` ping and
+   * resolve once the caller's `pong` (matching nonce) returns. Rejects
+   * if the request settles first. Independent of the channel's
+   * automatic keepalive ping.
    */
-  readonly ping: "ping";
+  ping(): Promise<void>;
+}
+type Result = {
+  result: JsonValue;
+} | {
+  error: {
+    code: number;
+    message: string;
+    data?: JsonValue;
+  };
+};
+/**
+ * What callers use to send. The {@link Channel} factory binds an
+ * {@link IRequestHandler} at construction (immutable for the channel's
+ * lifetime) and hands the caller back an `IRequestSender`.
+ *
+ * `TOutCtx` is the per-call context bag this sender understands. For
+ * the base {@link JsonRpcChannel} it's `undefined` (the channel
+ * doesn't read any overrides). Decorators like `SigningSender`
+ * parametrise it on their own ctx shape.
+ */
+interface IRequestSender<TOutCtx = undefined> {
+  sendRequest(method: string, params: JsonValue | undefined, opts?: SendOpts<TOutCtx>): Promise<JsonValue>;
+  sendNotification(method: string, params: JsonValue | undefined, opts?: SendOpts<TOutCtx>): Promise<void>;
   /**
-   * Reply to a {@link StreamControlType.ping}, echoing the ping's
-   * `nonce` so the prober can correlate it. Travels opposite the ping.
-   * Carries no app effect — purely a liveness acknowledgement.
+   * Issue a request that participates in the streaming sub-protocol.
+   * Returns synchronously with the wire request id, the result
+   * promise, and a `send` for emitting client→server stream messages.
    */
-  readonly pong: "pong";
-};
-type StreamControlType = (typeof StreamControlType)[keyof typeof StreamControlType];
+  sendRequestWithStream(method: string, params: JsonValue | undefined, opts?: StreamSendOpts<TOutCtx>): RawStreamingCall;
+  close(): void;
+}
 /**
- * Well-known `control.reason` strings. The set is **open** — any string
- * is valid on the wire; these are the reasons linkrpc itself emits.
+ * Handle for a request issued via
+ * {@link IRequestSender.sendRequestWithStream}. `send` emits
+ * client→server stream messages correlated with this call. `result`
+ * resolves with the call's response.
  */
-declare const StreamControlReason: {
+interface RawStreamingCall {
+  readonly result: Promise<JsonValue>;
+  /** Emit a client→server (`toCallee`) stream message correlated with this call. */
+  send(payload: JsonValue): void;
   /**
-   * The caller's transport dropped while the request was in flight; the
-   * hub cancels the callee's now-orphaned work.
+   * Ask the callee to abort this in-flight request (a `toCallee`
+   * `cancel` control). Advisory: the request settles via its normal
+   * response (typically a `cancelled` error). `reason` is an open-set
+   * diagnostic string (see `StreamControlReason`).
    */
-  readonly clientDisconnected: "clientDisconnected";
+  cancel(reason?: string): void;
   /**
-   * The request exceeded the hub's idle timeout with no stream activity
-   * (no ping, no stream message). See {@link STREAM_METHOD} docs.
+   * Stop tracking this request locally and reject {@link result}. This does
+   * not notify the callee; call {@link cancel} first when remote work should
+   * also be cancelled. Safe to call after the request has already settled.
    */
-  readonly idleTimeout: "idleTimeout";
-};
-type StreamControlReason = (typeof StreamControlReason)[keyof typeof StreamControlReason];
+  dispose?(reason?: string): void;
+  /**
+   * Liveness probe toward the callee: emit a `toCallee` ping and
+   * resolve once the callee's `pong` (matching nonce) returns. Rejects
+   * if the request settles first. Independent of the channel's
+   * automatic keepalive ping.
+   */
+  ping(): Promise<void>;
+}
 /**
- * Streaming sub-protocol. Long-running requests can emit additional
- * notifications correlated with the original call in either direction
- * (callee → caller progress, caller → callee input / cancellation /
- * keepalive).
- *
- * Wire form: a JSON-RPC notification whose method is
- * `${streamInterface.info.id}::send` and whose params match
- * `streamInterface.members.send.paramsSchema`. The hub routes purely on
- * `requestId` (following the originating request's established path, like
- * a response); the originating request's capability authorization covers
- * its full stream lifetime, so stream notifications carry no method /
- * interface namespace of their own. App `payload` contents are typed per
- * request via the originating method's
- * `RequestType.clientStreamSchema` / `serverStreamSchema`; reserved
- * `control` messages are schema-independent.
+ * Per-send options.
  *
- * Idle timeout: a request that never streams (no `control` ping, no
- * stream message) is subject to the hub's per-request idle timeout
- * (default 30 minutes) — at which point it is cancelled and its caller
- * gets a `requestTimeout` error. This bounds the hub's pending-request
- * table, which is also what protects it from a slow-loris / DDoS that
- * opens requests and never completes them. Streaming-enabled calls keep
- * themselves alive by emitting a periodic {@link StreamControlType.ping}.
+ * `interfaceHash` is interface-level call metadata: the schema hash of
+ * the interface a typed proxy is calling. It is independent of
+ * `TOutCtx` — the connection stamps it from the interface definition,
+ * the base {@link JsonRpcChannel} ignores it, and signing decorators
+ * bake it into the `$hubrpc` envelope.
  *
- * The interface is declarative: nobody calls
- * `LinkRpcConnection.register(streamInterface, ...)`. The channel and the
- * hub intercept `$stream::send` directly. The definition exists so
- * reflection / consent UIs can describe the wire shape and so all wire
- * constants derive from one source.
- */
-declare const streamInterface: InterfaceDefinition<{
-  send: NotificationType<{
-    requestId: string | number;
-    dir: "toCaller" | "toCallee";
-    control?: {
-      type: "cancel" | "ping" | "pong";
-      reason?: string | undefined;
-      nonce?: string | undefined;
-    } | undefined;
-    payload?: unknown;
-  }>;
-}>;
+ * `ctx` is the sender's `TOutCtx`-typed override / extension bag for
+ * per-call decorator overrides (e.g. `signerOverride`, `capsOverride`).
+ * The base {@link JsonRpcChannel} ignores `ctx` entirely; decorators
+ * like `SigningSender` interpret it.
+ */
+interface SendOpts<TOutCtx = undefined> {
+  readonly ctx?: TOutCtx;
+  /** Interface schema hash for this call (interface-level metadata). */
+  readonly interfaceHash?: string;
+}
+interface StreamSendOpts<TOutCtx = undefined> extends SendOpts<TOutCtx> {
+  readonly onStreamMessage?: (payload: JsonValue) => void;
+}
 /**
- * Full wire method name for stream notifications. Pulled from the
- * interface object so we have a single source of truth.
+ * Convenience: the transport type a {@link JsonRpcChannel} expects.
+ * Outbound is plain `JsonRpcMessage` — the base channel does not
+ * attach context to outgoing wire messages.
  */
-declare const STREAM_METHOD: `${string}::send`;
-/** Wire-level shape carried on `params` of {@link STREAM_METHOD}. */
-type StreamSendParams = output<typeof streamInterface.members.send.paramsSchema>;
-//#endregion
-//#region src/protocol/jcs.d.ts
+type ChannelTransport<TInCtx = undefined> = IMessageTransport<MessageWithCtx<TInCtx>>;
 /**
- * RFC 8785 JSON Canonicalization Scheme (JCS).
- *
- * Used as the byte-deterministic encoding under every linkrpc signature
- * (RPC calls, capabilities, hub-signed previews). Both signer and verifier
- * canonicalize the same value object and obtain byte-identical UTF-8 bytes.
- *
- * Implementation inlined from the `canonicalize` npm package (Apache-2.0,
- * https://github.com/erdtman/canonicalize) so this module stays
- * zero-dependency for browser bundlers that don't resolve transitive
- * npm specifiers (e.g. the in-house app-bundler).
+ * Type of incoming messages on the channel's transport. With
+ * `TInCtx = undefined` (default) this is just `JsonRpcMessage`. With a
+ * concrete `TInCtx`, the transport carries a `context` field alongside
+ * the message — out-of-band, never sent over a wire, set by the
+ * in-process producer.
  */
-/** RFC 8785 canonical JSON string for `value`. */
-declare function jcsCanonicalize(value: unknown): string;
-/** UTF-8 bytes of the RFC 8785 canonical JSON for `value`. The thing actually signed / hashed. */
-declare function jcsCanonicalizeBytes(value: unknown): Uint8Array;
+type MessageWithCtx<TInCtx> = [TInCtx] extends [undefined] ? JsonRpcMessage : JsonRpcMessage & {
+  context: TInCtx;
+};
+declare class RpcError extends Error {
+  readonly code: number;
+  /** Whether this error was decoded from a peer response. */
+  readonly origin: 'local' | 'remote' | 'transport';
+  readonly data?: JsonValue;
+  readonly hasData: boolean;
+  constructor(message: string, code: number, data?: JsonValue,
+  /** Whether this error was decoded from a peer response. */
+  origin?: 'local' | 'remote' | 'transport', hasData?: boolean);
+}
 //#endregion
 //#region src/crypto/cryptoProvider.d.ts
 /**
@@ -1808,1257 +1609,1974 @@ declare function permissionPermits(call: Call, permission: Permission, ability:
  */
 declare function capabilityPermits(call: Call, cap: Capability, ability: Ability): Verdict;
 //#endregion
-//#region src/protocol/methodName.d.ts
+//#region src/identity/identity.d.ts
+/** JSON-serializable form of a {@link KeypairSigningIdentity} (base64url keys). */
+interface SerializedKeypairSigningIdentity {
+  readonly privateKey: string;
+  readonly publicKey: string;
+}
 /**
- * Parsed JSON-RPC method string. The linkrpc dialect uses `::` to
- * separate up to three segments:
- *
- *   - `"member"`                         — bare (preset-bound dispatch)
- *   - `"interfaceId::member"`            — interface form (root service)
- *   - `"::interfaceId::member"`          — explicit root form
- *   - `"serviceId::interfaceId::member"` — fully-qualified form
- *
- * The hub does not accept the `bare` form (it has no interface context
- * to route on). Connection-level dispatch accepts all three.
+ * The public face of a signing identity: its stable {@link PrincipalId} name
+ * and the {@link KeyId} its signatures are stamped with. In Phase 1 (perpetual
+ * identities) the keyId is the genesis key embedded in the principal, so it is
+ * derived by stripping the `id:` prefix.
  */
-type ParsedMethodName = {
-  kind: "bare";
-  member: string;
-} | {
-  kind: "interface";
-  interfaceId: string;
-  member: string;
-} | {
-  kind: "full";
-  serviceId: string;
-  interfaceId: string;
-  member: string;
-};
+declare class PublicSigningIdentity {
+  readonly principal: PrincipalId;
+  constructor(principal: PrincipalId);
+  /** The {@link KeyId} this identity signs with (its genesis key, in Phase 1). */
+  get keyId(): KeyId;
+}
+interface SigningIdentity {
+  readonly publicSigningIdentity: PublicSigningIdentity;
+  sign(bytes: Uint8Array): Promise<Uint8Array>;
+}
 /**
- * Parse a JSON-RPC method string. Returns `undefined` if any segment is
- * empty or the segment count is out of range.
+ * {@link SigningIdentity} backed by an in-process keypair. For the common
+ * case where the signing material lives in memory. For external HSM-style
+ * backends, implement {@link SigningIdentity} directly.
  */
-declare function parseMethodName(method: string): ParsedMethodName | undefined;
+declare class KeypairSigningIdentity implements SigningIdentity {
+  private readonly _privateKey;
+  readonly publicSigningIdentity: PublicSigningIdentity;
+  constructor(principal: PrincipalId, _privateKey: PrivateKey);
+  sign(message: Uint8Array): Promise<Signature>;
+  static fromKeypair(keypair: Keypair): KeypairSigningIdentity;
+  /** Generate a fresh signing identity (Ed25519 keypair). */
+  static generateNew(): Promise<KeypairSigningIdentity>;
+  /** Restore an identity from its {@link toJson} form. */
+  static fromJson(json: SerializedKeypairSigningIdentity): KeypairSigningIdentity;
+  /** Serialize the keypair to a JSON-friendly form (base64url keys). */
+  toJson(): SerializedKeypairSigningIdentity;
+}
+declare class PublicWrappingIdentity {
+  readonly wrapPublicKey: Uint8Array;
+  constructor(wrapPublicKey: Uint8Array);
+}
+interface WrappingIdentity {
+  readonly publicWrappingIdentity: PublicWrappingIdentity;
+  wrap(domain: string, bytes: Uint8Array): Promise<Uint8Array>;
+  unwrap(domain: string, blob: Uint8Array): Promise<Uint8Array>;
+}
+interface Identity extends SigningIdentity, WrappingIdentity {
+  /** The identity's stable {@link PrincipalId} name. */
+  readonly principal: PrincipalId;
+  /** @deprecated */
+  readonly wrapPublicKey: Uint8Array;
+}
 /**
- * Convert a parsed method string to a {@link CallTarget} for capability
- * matching. Interface-form calls are addressed to the root service —
- * represented as an empty `serviceId`. Throws on `bare` form (no
- * interface context) and on malformed input.
+ * Full {@link Identity} backed by in-process Ed25519 (signing) and X25519
+ * (wrapping) keypairs. The local counterpart to a keystore/executor-backed
+ * identity — used by self-managed principals that hold their own key
+ * material (e.g. loaded from disk). For external HSM-style backends,
+ * implement {@link Identity} directly.
  */
-declare function methodNameToTarget(method: string): CallTarget;
+declare class KeypairIdentity implements Identity {
+  private readonly _privateKey;
+  private readonly _wrap;
+  readonly principal: PrincipalId;
+  readonly wrapPublicKey: Uint8Array;
+  readonly publicSigningIdentity: PublicSigningIdentity;
+  readonly publicWrappingIdentity: PublicWrappingIdentity;
+  constructor(principal: PrincipalId, _privateKey: PrivateKey, _wrap: X25519Keypair);
+  sign(message: Uint8Array): Promise<Signature>;
+  wrap(domain: string, bytes: Uint8Array): Promise<Uint8Array>;
+  unwrap(domain: string, blob: Uint8Array): Promise<Uint8Array>;
+  /** Generate a fresh identity (Ed25519 + X25519 keypairs). */
+  static generate(): Promise<KeypairIdentity>;
+}
 //#endregion
-//#region src/protocol/linkRpcEnvelope.d.ts
+//#region src/identity/capability.d.ts
 /**
- * Signed call meta. Lives under `params.$hubrpc` so it can't collide with
- * the user's top-level param keys. Present on signed AND unsigned calls
- * (the latter omit {@link CallMeta.principal} and carry no `$hubrpcSignature`).
+ * Pure freshness check for a single capability link: `true` when the cap never
+ * expires, or its `expiresAtMs` is still in the future at `now + marginMs`.
  *
- * Included verbatim in the bytes a call signature commits to — the
- * signature covers `signingInput("call", { ...userParams, $hubrpc })`.
+ * Mirrors the gate's expiry rule in {@link verifyChain}'s link check
+ * (`expiresAtMs < nowMs` ⇒ expired) so a producer can decide, *before signing*,
+ * whether to re-acquire a cap rather than attach one the gate will reject as
+ * `expired`. The `marginMs` safety window absorbs in-flight transit time and
+ * client/hub clock skew — pass the call's `signedAtMs` as `now` so the check
+ * evaluates expiry against the same instant baked into the envelope.
+ *
+ * This checks ONE link. Effective authority requires every link in a
+ * delegation chain to be unexpired, so a producer attaching a bag should apply
+ * this to every cap it would attach (see {@link capBagFreshAt}).
  */
-interface CallMeta {
-  /** Fully-qualified wire method. The verifier asserts it equals the JSON-RPC `method`. */
-  readonly method: string;
-  /** Replay-protection nonce (base64url). The gate dedups on this. */
-  readonly nonce: string;
-  /** Unix milliseconds. Skew window enforced by the verifier. */
-  readonly signedAtMs: number;
-  /** Identity wielding the call. Present iff signed; equals the audience of every presented cap. */
-  readonly principal?: PrincipalId;
-  /** Optional schema hash assertion. Matched against `TargetPattern.interfaceHash`. */
-  readonly interfaceHash?: string;
-}
+declare function capabilityFreshAt(cap: Capability, now: number, marginMs?: number): boolean;
 /**
- * Extrinsic, unsigned attachments carried under `params.$hubrpcUnsigned`.
- * Not covered by the call signature (they aren't authored by the signer).
+ * Freshness over a whole presented bag: `true` only when every cap is fresh at
+ * `now + marginMs` (see {@link capabilityFreshAt}). An empty bag is trivially
+ * fresh. Use this at the cap-production point to decide whether to re-acquire.
  */
-interface LinkRpcUnsigned {
-  /** Caller's presented capability bag. Parents are resolved out of this by hash. */
-  readonly capabilities?: readonly SignedCapability[];
-}
-/** Reserved wire-key meta carried on a linkrpc call's params object. */
-interface LinkRpcWireMeta {
-  readonly [HUBRPC_META_KEY]?: CallMeta;
-  readonly [HUBRPC_SIGNATURE_KEY]?: Signatures;
-  readonly [HUBRPC_UNSIGNED_KEY]?: LinkRpcUnsigned;
+declare function capBagFreshAt(caps: readonly Capability[], now: number, marginMs?: number): boolean;
+type PermitResult = {
+  ok: true;
+  capabilityNonce: string;
+  rootIssuer: PrincipalId;
+} | {
+  ok: false;
+  reason: string;
+};
+/**
+ * A trust anchor accepted as a capability-chain root, plus whether it may be
+ * named in authorization error messages.
+ */
+interface AcceptedRootIssuer {
+  /** The principal accepted as a chain root for the queried service. */
+  principal: PrincipalId;
+  /**
+   * Whether this issuer may be disclosed in `permits` rejection reasons.
+   * Public anchors (e.g. a hub's well-known admin identity) are surfaced to
+   * help diagnose "wrong root" failures; private ones are withheld so the
+   * error never leaks the set of trusted issuers.
+   */
+  isPublic: boolean;
 }
 /**
- * Wire shape of `params` on a linkrpc JSON-RPC call.
+ * **The** authorization predicate. A call is permitted iff some presented
+ * capability (1) addresses the call, (2) has a genuine, well-delegated
+ * chain whose leaf audience is the caller (`call.signer`), and (3) roots
+ * at an issuer the verifier accepts **for the call's service**.
  *
- * The user's params object (if any) is spread as-is, with the
- * {@link LinkRpcWireMeta} keys attached on top. `TUserParams` carries the
- * user-visible param shape; defaults to an open object. User params MUST be
- * a plain object — enforced at signing/verification via
- * {@link requireObjectParams}.
+ * Pure: it reports the verdict (and the `capabilityNonce` / `rootIssuer`
+ * for audit) but performs no consumption. Replay is the caller's job — the
+ * gate dedups `call.nonce`, so `callBind` grants are single-use for free.
+ *
+ * `acceptedRootIssuers` is consulted with the call's `serviceId` and returns
+ * the accepted {@link AcceptedRootIssuer} anchors; an empty result rejects
+ * every capability (fail closed) — trust is the verifier's, never the
+ * token's. Anchors flagged `isPublic` are named in the rejection reason when
+ * a chain roots at an unaccepted issuer.
  */
-type LinkRpcWireParams<TUserParams extends {
-  [key: string]: JsonValue | undefined;
-} = {
-  [key: string]: JsonValue | undefined;
-}> = TUserParams & LinkRpcWireMeta;
-/** JSON-RPC request whose `params` carry the linkrpc wire meta. */
-type LinkRpcJsonRpcRequest<TUserParams extends {
-  [key: string]: JsonValue | undefined;
-} = {
-  [key: string]: JsonValue | undefined;
-}> = JsonRpcRequest<LinkRpcWireParams<TUserParams>>;
-/** JSON-RPC notification whose `params` carry the linkrpc wire meta. */
-type LinkRpcJsonRpcNotification<TUserParams extends {
-  [key: string]: JsonValue | undefined;
-} = {
-  [key: string]: JsonValue | undefined;
-}> = JsonRpcNotification<LinkRpcWireParams<TUserParams>>;
-/** Either of the two linkrpc-bearing JSON-RPC message shapes. */
-type LinkRpcJsonRpcMessage<TUserParams extends {
-  [key: string]: JsonValue | undefined;
-} = {
-  [key: string]: JsonValue | undefined;
-}> = LinkRpcJsonRpcRequest<TUserParams> | LinkRpcJsonRpcNotification<TUserParams>;
+declare function permits(call: Call, capabilities: readonly SignedCapability[], acceptedRootIssuers: (serviceId: string) => readonly AcceptedRootIssuer[], nowMs: number, opts?: {
+  maxDepth?: number;
+}): Promise<PermitResult>;
 /**
- * The linkrpc signing/cap system accepts only plain-object user params (or
- * none). Reject arrays/primitives at the boundary so "strip `$hubrpc*`, the
- * rest is the signed user params" stays unambiguous.
+ * Sign a `Capability` with a {@link SigningIdentity}. The private key never
+ * leaves the identity. The result verifies via {@link verifyChain}.
  */
-declare function requireObjectParams(userParams: JsonValue | undefined): Record<string, JsonValue | undefined>;
+declare function signCapability(capability: Capability, issuer: SigningIdentity): Promise<SignedCapability>;
+interface IssueCapabilityOptions {
+  /** Identity allowed to present the capability. */
+  readonly audience: PublicSigningIdentity;
+  /** Authority granted to the audience. */
+  readonly permissions: readonly Permission[];
+  /** Optional expiration time as Unix milliseconds. */
+  readonly expiresAtMs?: number;
+  /** Optional parent whose authority this capability narrows. */
+  readonly parent?: SignedCapability;
+}
 /**
- * Return the application-authored portion of a LinkRPC params value.
- *
- * Routing and gate layers must continue forwarding the original wire params so
- * every chained hub can independently verify the envelope. Terminal dispatch
- * may use this derived value for application-schema validation without mutating
- * or replacing the wire message.
+ * Issue and sign a capability, deriving its issuer, nonce, and optional parent
+ * hash. The result is plain JSON data and survives a JSON stringify/parse
+ * round-trip without reconstruction.
  */
-declare function stripLinkRpcWireMeta(wireParams: unknown): JsonValue | undefined;
-//#endregion
-//#region src/disposable.d.ts
-/** Minimal disposable handle; calling `dispose` releases the resource. */
-interface IDisposable {
-  dispose(): void;
-}
-//#endregion
-//#region src/transport/messageTransport.d.ts
-interface IMessageTransport<TIncoming = JsonRpcMessage, TOutgoing = JsonRpcMessage> {
-  send(message: TOutgoing): void | Promise<void>;
-  /**
-   * Sets the listener for incoming messages. Setting `undefined` detaches.
-   * The transport buffers messages received before a listener is attached
-   * and delivers them the next tick when one is set.
-   * Forgetting to set a listener will cause the queue to leak.
-   */
-  setListener(listener: ((message: TIncoming) => void) | undefined): void;
-  dispose(): void;
-}
-type MessageWithContext<TCtx> = JsonRpcMessage & {
-  context: TCtx;
+declare function issueCapability(issuer: SigningIdentity, options: IssueCapabilityOptions): Promise<SignedCapability>;
+type ParamMatcherFor<T> = {
+  exact: T;
+} | {
+  enum: T[];
+} | {
+  any: true;
+} | (T extends string ? {
+  prefix: string;
+} : never) | (T extends readonly string[] ? {
+  subsetOf: string[];
+} : never);
+/** Type-safe top-level parameter matchers for one interface member. */
+type ParamMatchers<T> = T extends Record<string, unknown> ? { [K in keyof T]: ParamMatcherFor<Exclude<T[K], undefined>>; } : never;
+type RequestMemberName<TMembers extends MemberMap> = { [K in keyof TMembers]: TMembers[K] extends RequestType<any, any, any, any, any, any, any> ? K : never; }[keyof TMembers] & string;
+type RequestParams<TMember> = TMember extends RequestType<infer TParams, any, any, any, any, any, any> ? TParams : never;
+/** Match a string parameter by prefix. */
+declare function prefix(value: string): {
+  prefix: string;
 };
-type MessageTransportWithContext<TCtx> = IMessageTransport<JsonRpcMessage, MessageWithContext<TCtx>>;
-type MessageTransportDirection = 'send' | 'receive';
-type MessageTransportTrace = (direction: MessageTransportDirection, message: JsonRpcMessage) => void;
 /**
- * Observe every message crossing a transport without changing its buffering or
- * lifecycle behavior.
+ * Build an invoke permission from a typed interface member. The helper derives
+ * the interface id and schema hash and type-checks parameter matcher names and
+ * values against the member's params.
  */
-declare function traceMessageTransport(transport: IMessageTransport, trace: MessageTransportTrace): IMessageTransport;
+declare function invoke<TMembers extends MemberMap, TMember extends RequestMemberName<TMembers>>(serviceId: string, iface: InterfaceDefinition<TMembers>, member: TMember, params?: ParamMatchers<RequestParams<TMembers[TMember]>>): Permission;
+//#endregion
+//#region src/connection/jsonRpcChannel.d.ts
 /**
- * Pipe two transports together: every message one receives is forwarded to
- * the other's `send`. Returns a disposable that detaches both listeners.
+ * Minimal JSON-RPC 2.0 channel: correlates requests with responses,
+ * dispatches incoming requests/notifications to a handler.
  *
- * Neither transport is disposed — the caller owns their lifecycle. This is
- * the building block for relays (e.g. bridging a `WindowMessageTransport`
- * for an iframe to a multiplexer channel).
- */
-declare function connectTransports<T extends JsonRpcMessage>(a: IMessageTransport<T>, b: IMessageTransport<T>): IDisposable;
-/**
- * Two in-memory transports wired back-to-back. Useful for tests and for
- * same-process bridges.
+ * Construct via {@link JsonRpcChannel.create}: it returns a
+ * {@link Channel} factory which materialises the live channel once a
+ * handler is supplied via `.connect(handler)`. The handler is fixed for
+ * the channel's lifetime — no setter, no mid-flight swap.
  *
- * Generic in the per-direction payload type so asymmetric pairs (e.g. one
- * side sends plain `JsonRpcMessage`, the other side sends
- * `JsonRpcMessage & { context: Participant }`) are expressible at the type
- * level. At runtime both halves just hand objects through by reference.
+ * The outbound `TOutCtx` of the produced sender is `unknown` — this
+ * channel ignores per-call ctx entirely. Decorators (e.g.
+ * `SigningSender`) lift it to a concrete shape.
  */
-declare class TransportPair<TFromA = JsonRpcMessage, TFromB = JsonRpcMessage> {
-  readonly a: IMessageTransport<TFromB, TFromA>;
-  readonly b: IMessageTransport<TFromA, TFromB>;
-  constructor();
-}
-//#endregion
-//#region src/transport/multiplexedTransport.d.ts
-interface MuxEnvelope {
-  readonly $mux: "v1";
-  readonly ch: string;
-  readonly m: JsonRpcMessage;
-}
-declare class MultiplexedTransport<TChannels extends Record<string, string>> implements IDisposable {
-  static create<TChannels extends Record<string, string>>(base: IMessageTransport<MuxEnvelope, MuxEnvelope>, channels: TChannels): MultiplexedTransport<TChannels>;
-  /** Logical transports keyed by the friendly channel names. */
-  readonly transports: { readonly [K in keyof TChannels]: IMessageTransport; };
-  private readonly _base;
-  private readonly _byId;
-  private readonly _usedIds;
-  private _disposed;
-  constructor(base: IMessageTransport<MuxEnvelope, MuxEnvelope>, channels: TChannels);
+declare class JsonRpcChannel<TInCtx = undefined> implements IRequestSender<unknown> {
+  private readonly _transport;
   /**
-   * Add a logical channel after the multiplexer has started.
-   *
-   * Channel ids are permanently retired when disposed. This prevents a late
-   * envelope for an old iframe from being delivered to a replacement iframe.
+   * Wrap a transport in a {@link Channel}. The channel's sender is live
+   * immediately; call {@link Channel.setRequestHandler} (or pass the channel
+   * to {@link LinkRpcConnection}) to bind the inbound handler.
    */
-  addChannel(id: string): IMessageTransport;
-  dispose(): void;
-  private _createChannel;
-}
-//#endregion
-//#region src/connection/channel.d.ts
-declare class Channel<TInCtx = undefined, TOutCtx = undefined> {
-  readonly sender: IRequestSender<TOutCtx>;
-  private readonly _setHandler;
-  private readonly _setWireObserver?;
-  constructor(sender: IRequestSender<TOutCtx>, _setHandler: (h: IRequestHandler<TInCtx> | undefined) => void, _setWireObserver?: ((observer: WireMessageObserver | undefined) => void) | undefined);
-  /** Bind the inbound request/notification handler. May be called before or after construction of {@link LinkRpcConnection}. */
-  setRequestHandler(handler: IRequestHandler<TInCtx> | undefined): void;
+  static create<TInCtx = undefined>(transport: ChannelTransport<TInCtx>): Channel<TInCtx, unknown>;
+  /** Wrap a transport and retain an explicit lifecycle hook for its owner. */
+  static createWithClose<TInCtx = undefined>(transport: ChannelTransport<TInCtx>): {
+    channel: Channel<TInCtx, unknown>;
+    close: () => void;
+  };
+  private _nextId;
+  private readonly _pending;
   /**
-   * Install the endpoint inspection observer at the JSON-RPC wire boundary.
-   * Intended for {@link LinkRpcConnection}; ordinary consumers should use the
-   * public `hubrpc.traffic` service instead.
+   * Per-request callbacks invoked when a {@link STREAM_METHOD}
+   * notification arrives with a matching `requestId`. Used in both
+   * directions: outgoing-request callers register here keyed by the
+   * id they sent; per-call incoming-request stream handles register
+   * keyed by the id they observed. Entries are removed when the
+   * corresponding request completes (response received for outgoing,
+   * response sent for incoming).
    */
-  setWireMessageObserver(observer: WireMessageObserver | undefined): void;
+  private readonly _streamListeners;
   /**
-   * Compose this channel with a sender-side decorator (typically the
-   * signing layer). The decorator wraps {@link sender} only; the
-   * {@link setRequestHandler} binding is shared with the original channel
-   * so the receive side is bound exactly once regardless of decoration depth.
+   * Per-incoming-request handlers for reserved `control` messages
+   * (cancel / ping / pong) arriving as stream notifications. Keyed
+   * by the id observed; removed when the request settles.
    */
-  withSender<TNewOutCtx>(decorate: (raw: IRequestSender<TOutCtx>) => IRequestSender<TNewOutCtx>): Channel<TInCtx, TNewOutCtx>;
-}
-type WireMessageDirection = 'inbound' | 'outbound';
-type WireMessageObserver = (direction: WireMessageDirection, message: JsonRpcMessage) => void;
-interface IRequestHandler<TInCtx = undefined> {
-  handleRequest(call: IncomingCall<TInCtx>): Promise<Result>;
-  handleNotification(call: IncomingCall<TInCtx>): void;
-}
-/**
- * Inbound call observed by an {@link IRequestHandler}. `TInCtx` is the
- * per-call out-of-band context the transport attached on the receiving
- * side (e.g. the hub stamps `Participant` on overlay-bound messages).
- * For wire transports it's `undefined`.
- */
-interface IncomingCall<TInCtx = undefined> {
-  method: string;
-  params: JsonValue | undefined;
-  /** Out-of-band context attached by the transport, if any. */
-  context: TInCtx;
+  private readonly _streamControl;
+  private readonly _incomingAborts;
+  private _handler;
+  private _wireObserver;
+  private _closeError;
+  setRequestHandler(handler: IRequestHandler<TInCtx> | undefined): void;
+  setWireMessageObserver(observer: WireMessageObserver | undefined): void;
+  private constructor();
+  sendRequest(method: string, params: JsonValue | undefined, opts?: SendOpts<unknown>): Promise<JsonValue>;
+  sendNotification(method: string, params: JsonValue | undefined, opts?: SendOpts<unknown>): Promise<void>;
+  sendRequestWithStream(method: string, params: JsonValue | undefined, opts?: StreamSendOpts<unknown>): RawStreamingCall;
   /**
-   * Per-call streaming handle. Both directions live on this object,
-   * scoped to the request's lifetime. The inbound listener is auto-
-   * detached when the handler's response settles. For notifications
-   * (no request id) the handle is a no-op stub.
+   * Build the symmetric ping/pong machinery for one in-flight request.
+   *
+   * `outboundDir` is the direction *this* side emits controls in
+   * (`toCallee` for the caller, `toCaller` for the callee). A received
+   * ping is answered with a pong in that same direction, echoing the
+   * ping's nonce; a received pong resolves the matching outstanding
+   * {@link ping} probe.
    */
-  stream: IncomingStream;
+  private _makePinger;
   /**
-   * Aborts when the caller cancels this in-flight request (a
-   * `toCallee` `cancel` control), or when the hub cancels it on the
-   * caller's behalf (caller disconnect / idle timeout). The handler
-   * should observe this and settle promptly — typically by throwing,
-   * which surfaces as a `cancelled` error response. For notifications
-   * this never aborts.
+   * Emit a stream notification ({@link STREAM_METHOD}) associated with
+   * an in-flight request. Internal: outgoing-side callers reach this
+   * via {@link RawStreamingCall.send} / `cancel`; incoming-side handlers
+   * reach it via {@link IncomingStream.send}.
    */
-  signal: AbortSignal;
-}
-/**
- * Per-call streaming handle attached to {@link IncomingCall.stream}.
- * Scoped to a single in-flight request; the channel automatically
- * detaches the inbound listener when the handler's response settles.
- *
- * For notifications (which have no request id), `requestId` is
- * `undefined`, `send` is a no-op, and `onMessage` is a no-op.
+  private _sendStream;
+  close(): void;
+  private _throwIfClosed;
+  private _onMessage;
+  private _handleStreamNotification;
+  private _handleRequest;
+  private _handleNotification;
+  private _observeInbound;
+  private _observeOutbound;
+  private _observeSendFailure;
+}
+//#endregion
+//#region src/identity/managedIdentity.d.ts
+/**
+ * Executor-side backing for `identity.storage::*`. Lifecycle tied to a
+ * single managed-identity slot; the executor decides where bytes are
+ * stored.
  */
-interface IncomingStream {
-  /** Emit a server→client stream notification correlated with this call. */
-  send(payload: JsonValue): Promise<void>;
-  /**
-   * Register a listener for client→server stream messages correlated
-   * with this call. Pass `undefined` to detach. Replaces any prior
-   * listener. The channel detaches the listener automatically when
-   * the handler's response settles.
-   */
-  onMessage(listener: ((payload: JsonValue) => void) | undefined): void;
-  /**
-   * Liveness probe toward the caller: emit a `toCaller` ping and
-   * resolve once the caller's `pong` (matching nonce) returns. Rejects
-   * if the request settles first. Independent of the channel's
-   * automatic keepalive ping.
-   */
-  ping(): Promise<void>;
+interface ManagedIdentityStorageBackend {
+  get(key: string): Promise<unknown | undefined>;
+  set(key: string, value: unknown): Promise<void>;
+  /** Returns `true` iff the key existed before this call. */
+  delete(key: string): Promise<boolean>;
+  list(prefix?: string): Promise<string[]>;
 }
-type Result = {
-  result: JsonValue;
-} | {
-  error: {
-    code: number;
-    message: string;
-    data?: JsonValue;
-  };
-};
 /**
- * What callers use to send. The {@link Channel} factory binds an
- * {@link IRequestHandler} at construction (immutable for the channel's
- * lifetime) and hands the caller back an `IRequestSender`.
- *
- * `TOutCtx` is the per-call context bag this sender understands. For
- * the base {@link JsonRpcChannel} it's `undefined` (the channel
- * doesn't read any overrides). Decorators like `SigningSender`
- * parametrise it on their own ctx shape.
+ * In-process storage backend. Used by tests and by any executor that
+ * doesn't need at-rest persistence.
  */
-interface IRequestSender<TOutCtx = undefined> {
-  sendRequest(method: string, params: JsonValue | undefined, opts?: SendOpts<TOutCtx>): Promise<JsonValue>;
-  sendNotification(method: string, params: JsonValue | undefined, opts?: SendOpts<TOutCtx>): Promise<void>;
-  /**
-   * Issue a request that participates in the streaming sub-protocol.
-   * Returns synchronously with the wire request id, the result
-   * promise, and a `send` for emitting client→server stream messages.
-   */
-  sendRequestWithStream(method: string, params: JsonValue | undefined, opts?: StreamSendOpts<TOutCtx>): RawStreamingCall;
-  close(): void;
+declare class InMemoryManagedIdentityStorage implements ManagedIdentityStorageBackend {
+  private readonly _data;
+  get(key: string): Promise<unknown | undefined>;
+  set(key: string, value: unknown): Promise<void>;
+  delete(key: string): Promise<boolean>;
+  list(prefix?: string): Promise<string[]>;
 }
 /**
- * Handle for a request issued via
- * {@link IRequestSender.sendRequestWithStream}. `send` emits
- * client→server stream messages correlated with this call. `result`
- * resolves with the call's response.
+ * In-process `ManagedIdentity` that holds the private key in memory and
+ * uses the package crypto API. Useful for tests and for hub-side features
+ * that want a short-lived identity without touching disk.
  */
-interface RawStreamingCall {
-  readonly result: Promise<JsonValue>;
-  /** Emit a client→server (`toCallee`) stream message correlated with this call. */
-  send(payload: JsonValue): void;
-  /**
-   * Ask the callee to abort this in-flight request (a `toCallee`
-   * `cancel` control). Advisory: the request settles via its normal
-   * response (typically a `cancelled` error). `reason` is an open-set
-   * diagnostic string (see `StreamControlReason`).
-   */
-  cancel(reason?: string): void;
-  /**
-   * Stop tracking this request locally and reject {@link result}. This does
-   * not notify the callee; call {@link cancel} first when remote work should
-   * also be cancelled. Safe to call after the request has already settled.
-   */
-  dispose?(reason?: string): void;
-  /**
-   * Liveness probe toward the callee: emit a `toCallee` ping and
-   * resolve once the callee's `pong` (matching nonce) returns. Rejects
-   * if the request settles first. Independent of the channel's
-   * automatic keepalive ping.
-   */
-  ping(): Promise<void>;
+declare class InMemoryManagedIdentity implements Identity {
+  private readonly _ed;
+  private readonly _wrap;
+  readonly principal: PrincipalId;
+  readonly wrapPublicKey: Uint8Array;
+  constructor(_ed: Keypair, _wrap: X25519Keypair);
+  get publicSigningIdentity(): PublicSigningIdentity;
+  get publicWrappingIdentity(): PublicWrappingIdentity;
+  sign(bytes: Uint8Array): Promise<Signature>;
+  wrap(domain: string, bytes: Uint8Array): Promise<Uint8Array>;
+  unwrap(domain: string, blob: Uint8Array): Promise<Uint8Array>;
+  /** Generate a fresh in-memory identity (Ed25519 + X25519 keypairs). */
+  static generate(): Promise<InMemoryManagedIdentity>;
 }
 /**
- * Per-send options.
+ * Register the `identity` interface on `overlay` so the bound participant
+ * can call `identity::sign` etc. on its root overlay. The overlay is
+ * private to one participant — no other peer can reach these methods.
  *
- * `interfaceHash` is interface-level call metadata: the schema hash of
- * the interface a typed proxy is calling. It is independent of
- * `TOutCtx` — the connection stamps it from the interface definition,
- * the base {@link JsonRpcChannel} ignores it, and signing decorators
- * bake it into the `$hubrpc` envelope.
+ * When `storage` is supplied, the `identity.storage` interface is
+ * registered alongside `identity::*`. Lifetime/scope of the backend is
+ * the executor's responsibility — for keystore-backed identities the
+ * backend lives as long as the identity slot does.
  *
- * `ctx` is the sender's `TOutCtx`-typed override / extension bag for
- * per-call decorator overrides (e.g. `signerOverride`, `capsOverride`).
- * The base {@link JsonRpcChannel} ignores `ctx` entirely; decorators
- * like `SigningSender` interpret it.
+ * Typical caller: the executor (e.g. the VS Code extension), right after
+ * `Hub.attachParticipant`, on the `rootOverlay` returned from the attach
+ * handle.
  */
-interface SendOpts<TOutCtx = undefined> {
-  readonly ctx?: TOutCtx;
-  /** Interface schema hash for this call (interface-level metadata). */
-  readonly interfaceHash?: string;
-}
-interface StreamSendOpts<TOutCtx = undefined> extends SendOpts<TOutCtx> {
-  readonly onStreamMessage?: (payload: JsonValue) => void;
-}
+declare function registerIdentityOnOverlay(overlay: LinkRpcConnection, identity: Identity, storage?: ManagedIdentityStorageBackend): void;
 /**
- * Convenience: the transport type a {@link JsonRpcChannel} expects.
- * Outbound is plain `JsonRpcMessage` — the base channel does not
- * attach context to outgoing wire messages.
+ * Like {@link registerIdentityOnOverlay}, but resolves the identity lazily on
+ * first use via `resolveIdentity`. The identity is materialized only when the
+ * bound participant actually calls `identity::*` — registering the overlay
+ * does NOT create or load any identity.
+ *
+ * This is essential for the consent model: a host can serve `identity::*` on a
+ * keystore slot without making the slot privileged (`hasState`) until the app
+ * genuinely opts into an identity. `resolveIdentity` is expected to be cheap on
+ * repeat calls (the keystore caches in memory), and to reflect lifecycle
+ * changes — e.g. after a slot is wiped and re-created ("Reset Identity"), the
+ * next call resolves the fresh identity.
+ *
+ * `storage` is registered eagerly because reading/writing storage is itself
+ * the privileged act the app must perform to gain state — exposing the
+ * interface costs nothing until used.
  */
-type ChannelTransport<TInCtx = undefined> = IMessageTransport<MessageWithCtx<TInCtx>>;
+declare function registerLazyIdentityOnOverlay(overlay: LinkRpcConnection<unknown>, resolveIdentity: () => Promise<Identity>, storage?: ManagedIdentityStorageBackend): void;
 /**
- * Type of incoming messages on the channel's transport. With
- * `TInCtx = undefined` (default) this is just `JsonRpcMessage`. With a
- * concrete `TInCtx`, the transport carries a `context` field alongside
- * the message — out-of-band, never sent over a wire, set by the
- * in-process producer.
+ * Client-side proxy for `identity.storage::*`. Methods round-trip through
+ * the participant's root overlay; the executor enforces key-shape rules
+ * server-side.
+ *
+ * Calls are unsigned (same recursion-guard rationale as
+ * {@link createManagedIdentity} — the overlay is private to one
+ * participant, so transport-level routing already authenticates).
  */
-type MessageWithCtx<TInCtx> = [TInCtx] extends [undefined] ? JsonRpcMessage : JsonRpcMessage & {
-  context: TInCtx;
-};
-declare class RpcError extends Error {
-  readonly code: number;
-  /** Whether this error was decoded from a peer response. */
-  readonly origin: 'local' | 'remote';
-  readonly data?: JsonValue;
-  readonly hasData: boolean;
-  constructor(message: string, code: number, data?: JsonValue,
-  /** Whether this error was decoded from a peer response. */
-  origin?: 'local' | 'remote', hasData?: boolean);
-}
-//#endregion
-//#region src/connection/bareInterfaceTarget.d.ts
-/** A metadata-free foreign-protocol interface and its wire-method prefix. */
-interface BareInterfaceTarget<TDef extends InterfaceDefinition<any>> {
-  readonly mode: 'bare';
-  readonly interface: TDef;
-  readonly prefix: string;
+interface ManagedIdentityStorage {
+  get<T = unknown>(key: string): Promise<T | undefined>;
+  set(key: string, value: unknown): Promise<void>;
+  delete(key: string): Promise<boolean>;
+  list(prefix?: string): Promise<string[]>;
 }
 /**
- * Bundle an interface definition with metadata-free foreign-protocol
- * addressing for use with `connection.get(target)`.
- */
-declare function bareInterfaceTarget<TDef extends InterfaceDefinition<any>>(iface: TDef, options?: {
-  readonly prefix?: string;
-}): BareInterfaceTarget<TDef>;
-//#endregion
-//#region src/connection/channelConnector.d.ts
-/**
- * A raw channel that signals when it closes (and, when possible, can be torn
- * down). Both {@link openHubChannel}'s `HubChannel` and `openStdioChannel`'s
- * `StdioChannel` satisfy this shape.
+ * A managed identity resolved from an executor's `identity::*` overlay: a
+ * full {@link Identity} (signing + HPKE wrap/unwrap, all round-tripping
+ * through the executor — private keys never leave it) plus the
+ * per-identity {@link ManagedIdentityStorage}.
  */
-type ConnectableChannel = Channel<undefined, unknown> & {
-  /**
-   * Fires once when the channel closes. Returns a disposable to unsubscribe.
-   *
-   * Ordering contract: when a close causes a sending method (e.g. a request
-   * or notification) to reject/throw, {@link onClose} must fire *before* that
-   * rejection surfaces to the caller. This lets consumers reliably tell a
-   * close-induced failure (the channel is already observably closed) apart
-   * from a genuine error (the channel is still open). See
-   * {@link ChannelConnector.keepConnected}.
-   */
-  onClose(listener: () => void): IDisposable;
-  /** Tear the channel down. Optional — stdio channels have no explicit close. */
-  close?(): void;
-};
-/** Handle returned by {@link ChannelConnector.keepConnected}. */
-interface KeepConnectedHandle {
+interface ManagedIdentity extends Identity {
   /**
-   * Resolves when the loop exits: the channel closed and the connector does
-   * not redial, or {@link stop} (or the supplied signal) fired.
+   * Per-identity persistent key/value store. Backed by the executor's
+   * `identity.storage::*` overlay; calls throw when the executor did not
+   * register storage for this slot (e.g. an in-process identity for tests).
    */
-  readonly done: Promise<void>;
-  /** Stop redialing and close the current channel (if any). */
-  stop(): void;
-}
-/** Callback run on every (re)connect. The channel is the raw, unsigned channel. */
-type OnChannelConnect<T extends ConnectableChannel> = (ctx: {
-  channel: T;
-}) => void | Promise<void>;
-interface ExpBackoffOptions {
-  readonly initialBackoffMs?: number;
-  readonly maxBackoffMs?: number;
+  readonly storage: ManagedIdentityStorage;
 }
 /**
- * Drives a connect / (re)connect loop over a raw {@link ConnectableChannel}.
- *
- * Unlike connection-level helpers, this works at the channel layer: the
- * caller composes identity / signing on top of the channel handed to
- * {@link keepConnected} (e.g. `SigningSender.wrapChannel(channel, { principal })`).
+ * Bootstrap a {@link ManagedIdentity} from a sender (typically the raw
+ * unsigned sender obtained via `channel.sender` before wrapping with
+ * {@link SigningSender}). Makes `identity::*` calls unsigned — the
+ * executor's overlay is private to one participant so routing already
+ * identifies the caller, preventing signing recursion.
  *
- * Construct via {@link ChannelConnector.once} (a single, already-open channel
- * that never redials) or {@link ChannelConnector.expBackoff} (re-open via a
- * factory with exponential backoff after each close).
+ * The returned identity signs / wraps / unwraps by round-tripping through
+ * the executor's `identity::*` overlay; the caller wires it into their
+ * {@link SigningSender} configuration (e.g. as a {@link Principal}). No
+ * side effects on any existing connection or holder.
  */
-declare class ChannelConnector<T extends ConnectableChannel> {
-  private readonly _open;
-  private readonly _redial;
-  private readonly _initialBackoffMs;
-  private readonly _maxBackoffMs;
-  private constructor();
-  /**
-   * A connector over a single channel (or a promise of one). Never redials;
-   * the loop ends when the channel closes or {@link KeepConnectedHandle.stop}
-   * fires.
-   */
-  static once<T extends ConnectableChannel>(channel: T | Promise<T>): ChannelConnector<T>;
-  /**
-   * A redialing connector: `open` is called once per attempt, and the loop
-   * reconnects with exponential backoff after each close (or failed open).
-   */
-  static expBackoff<T extends ConnectableChannel>(open: () => Promise<T>, opts?: ExpBackoffOptions): ChannelConnector<T>;
+declare function createManagedIdentity(sender: IRequestSender<unknown>): Promise<ManagedIdentity>;
+//#endregion
+//#region src/identity/capBag.d.ts
+interface CapBagOptions {
   /**
-   * Run `onConnect` on every (re)connect with the freshly opened channel.
-   * The callback typically wraps the channel with signing and registers
-   * handlers. Returns once the loop exits (see {@link KeepConnectedHandle}).
+   * Per-identity persistent storage (e.g.
+   * {@link ManagedIdentityHandle.storage}). Omit for a memory-only bag
+   * that forgets its caps when the process exits.
    */
-  keepConnected(onConnect: OnChannelConnect<T>, opts?: {
-    signal?: AbortSignal;
-  }): KeepConnectedHandle;
+  readonly storage?: ManagedIdentityStorage;
+  /** Storage key. Defaults to `hubrpc.caps.v1`. */
+  readonly storageKey?: string;
+  /** Optional sink for non-fatal storage warnings. */
+  readonly onWarn?: (message: string) => void;
 }
-//#endregion
-//#region src/connection/jsonRpcChannel.d.ts
 /**
- * Minimal JSON-RPC 2.0 channel: correlates requests with responses,
- * dispatches incoming requests/notifications to a handler.
- *
- * Construct via {@link JsonRpcChannel.create}: it returns a
- * {@link Channel} factory which materialises the live channel once a
- * handler is supplied via `.connect(handler)`. The handler is fixed for
- * the channel's lifetime — no setter, no mid-flight swap.
+ * A process-lifetime bag of hub-issued capabilities. Plug
+ * {@link CapBag.provider} straight into a connection's cap provider so every
+ * outbound signed call carries whatever caps have been granted so far. The
+ * hub picks whichever cap matches the call per dispatch.
  *
- * The outbound `TOutCtx` of the produced sender is `unknown` — this
- * channel ignores per-call ctx entirely. Decorators (e.g.
- * `SigningSender`) lift it to a concrete shape.
+ * When constructed with {@link CapBagOptions.storage} the bag hydrates from
+ * (and persists to) storage, so the next process spawn for the same identity
+ * reuses its grants without re-prompting.
  */
-declare class JsonRpcChannel<TInCtx = undefined> implements IRequestSender<unknown> {
-  private readonly _transport;
-  /**
-   * Wrap a transport in a {@link Channel}. The channel's sender is live
-   * immediately; call {@link Channel.setRequestHandler} (or pass the channel
-   * to {@link LinkRpcConnection}) to bind the inbound handler.
-   */
-  static create<TInCtx = undefined>(transport: ChannelTransport<TInCtx>): Channel<TInCtx, unknown>;
-  /** Wrap a transport and retain an explicit lifecycle hook for its owner. */
-  static createWithClose<TInCtx = undefined>(transport: ChannelTransport<TInCtx>): {
-    channel: Channel<TInCtx, unknown>;
-    close: () => void;
-  };
-  private _nextId;
-  private readonly _pending;
-  /**
-   * Per-request callbacks invoked when a {@link STREAM_METHOD}
-   * notification arrives with a matching `requestId`. Used in both
-   * directions: outgoing-request callers register here keyed by the
-   * id they sent; per-call incoming-request stream handles register
-   * keyed by the id they observed. Entries are removed when the
-   * corresponding request completes (response received for outgoing,
-   * response sent for incoming).
-   */
-  private readonly _streamListeners;
-  /**
-   * Per-incoming-request handlers for reserved `control` messages
-   * (cancel / ping / pong) arriving as stream notifications. Keyed
-   * by the id observed; removed when the request settles.
-   */
-  private readonly _streamControl;
-  private readonly _incomingAborts;
-  private _handler;
-  private _wireObserver;
-  private _closeError;
-  setRequestHandler(handler: IRequestHandler<TInCtx> | undefined): void;
-  setWireMessageObserver(observer: WireMessageObserver | undefined): void;
+declare class CapBag {
+  /** Create a bag, hydrating from storage when one was supplied. */
+  static load(options?: CapBagOptions): Promise<CapBag>;
+  private readonly _caps;
+  private readonly _storage?;
+  private readonly _storageKey;
+  private readonly _onWarn;
   private constructor();
-  sendRequest(method: string, params: JsonValue | undefined, opts?: SendOpts<unknown>): Promise<JsonValue>;
-  sendNotification(method: string, params: JsonValue | undefined, opts?: SendOpts<unknown>): Promise<void>;
-  sendRequestWithStream(method: string, params: JsonValue | undefined, opts?: StreamSendOpts<unknown>): RawStreamingCall;
-  /**
-   * Build the symmetric ping/pong machinery for one in-flight request.
-   *
-   * `outboundDir` is the direction *this* side emits controls in
-   * (`toCallee` for the caller, `toCaller` for the callee). A received
-   * ping is answered with a pong in that same direction, echoing the
-   * ping's nonce; a received pong resolves the matching outstanding
-   * {@link ping} probe.
-   */
-  private _makePinger;
+  get capabilities(): readonly SignedCapability[];
   /**
-   * Emit a stream notification ({@link STREAM_METHOD}) associated with
-   * an in-flight request. Internal: outgoing-side callers reach this
-   * via {@link RawStreamingCall.send} / `cancel`; incoming-side handlers
-   * reach it via {@link IncomingStream.send}.
+   * A {@link CapProvider} reflecting the bag at call-time. Assign it to
+   * `HubClientHandle.signing.capProvider` or pass it through
+   * `SigningSenderConfig.capProvider`.
    */
-  private _sendStream;
-  close(): void;
-  private _throwIfClosed;
-  private _onMessage;
-  private _handleStreamNotification;
-  private _handleRequest;
-  private _handleNotification;
-  private _observeInbound;
-  private _observeOutbound;
-  private _observeSendFailure;
-}
-//#endregion
-//#region src/connection/requestTimeout.d.ts
-declare const DEFAULT_RPC_TIMEOUT_MS = 5000;
-interface CancellableRequest<T> extends Promise<T> {
-  cancel(reason?: string): void | Promise<void>;
-  dispose?(reason?: string): void;
+  readonly provider: CapProvider;
+  /** Append capabilities and persist (when backed by storage). */
+  add(...caps: readonly SignedCapability[]): Promise<void>;
+  /** Drop all capabilities and persist the empty bag. */
+  clear(): Promise<void>;
+  private _hydrate;
+  private _persist;
 }
-declare function withRpcTimeout<T>(request: CancellableRequest<T>, target: string, timeoutMs?: number): Promise<T>;
 //#endregion
-//#region src/connection/endpointUri.d.ts
+//#region src/identity/principal.d.ts
 /**
- * A strict, RFC-3986 URI vocabulary for "where the linkrpc server lives, and
- * how to reach (or start) it". Every endpoint round-trips through
- * {@link parseEndpointUri} / {@link formatEndpointUri} and is a valid `new URL()`
- * — safe to put in env vars, logs, and config.
- *
- * Supported schemes:
- *   - `unix:/path/to.sock?token=…`           → {@link SocketEndpoint}
- *   - `npipe://./pipe/name?token=…`          → {@link SocketEndpoint} (Windows)
- *   - `ws://host:port?token=…` / `wss:…`     → {@link WsEndpoint} (LinkRPC handshake)
- *   - `ws-no-init://host:port?…`             → {@link WsNoInitEndpoint}
- *   - `cmd-stdio:?command=…` / `…?argv=…`    → {@link CmdStdioEndpoint}
- *   - `cmd:?command=…` / `…?argv=…`          → {@link CmdEnvEndpoint}
+ * A signing identity bundled with its durable capability set. The
+ * {@link SigningIdentity} is fixed for the life of the principal; the
+ * {@link CapBag} is mutable and extensible — caps accumulate as the peer grants
+ * them.
  *
- * The command payload is `{ command: string } | { argv: string[] }`:
- *   - `?command=node%20server.js` — one verbatim string, split by the OS shell.
- *   - `?argv=node&argv=server.js` — repeated `argv` params, structure-preserving.
+ * Transient, per-call (one-shot) grants are deliberately NOT part of a
+ * principal: that is a separate policy, see `OneShotCapStaging`.
  *
- * A bare string with no scheme (legacy `LINKRPC_ENDPOINT`) is auto-detected: a
- * `ws://`/`wss://` URL stays WebSocket, anything else is a socket path.
+ * Lives in its own module (rather than alongside `SigningSender`) so the
+ * `SigningSender` ⇄ `createManagedPrincipal` factory cycle does not run through
+ * a top-level `class … extends Principal`: such a cycle would hit a TDZ
+ * ("Class extends value undefined") depending on module evaluation order.
  */
-/** Verbatim command line (`{ command }`) or pre-split argv (`{ argv }`). */
-type EndpointCommand = {
-  readonly command: string;
-} | {
-  readonly argv: readonly string[];
-};
-/** Named pipe / unix-domain-socket the server already listens on. */
-interface SocketEndpoint {
-  readonly kind: 'socket';
-  readonly path: string;
-  readonly token?: string;
-  /**
-   * Present on sockets created by `hub connect`. Local framing still uses the
-   * LinkRPC transport handshake; this describes whether forwarded application
-   * calls target a LinkRPC or plain JSON-RPC peer.
-   */
-  readonly brokerMode?: 'linkrpc' | 'raw';
-}
-/** A running WebSocket hub; `token` rides in the `hubrpc::initialize` handshake. */
-interface WsEndpoint {
-  readonly kind: 'ws';
-  readonly url: string;
-  readonly token?: string;
+declare class Principal {
+  readonly identity: SigningIdentity;
+  readonly capBag: CapBag;
+  static create(identity: SigningIdentity, capabilities?: readonly SignedCapability[]): Promise<Principal>;
+  constructor(identity: SigningIdentity, capBag: CapBag);
+  get id(): PrincipalId;
 }
+//#endregion
+//#region src/identity/managedPrincipal.d.ts
 /**
- * A running plain-JSON-RPC WebSocket endpoint. Unlike {@link WsEndpoint}, CLI
- * consumers use it without the `hubrpc::initialize` handshake or LinkRPC signing.
- * Query parameters are preserved verbatim for protocols that authenticate
- * during the WebSocket upgrade (for example AHP's `tkn` parameter).
+ * A {@link Principal} that also exposes the executor-backed per-identity
+ * {@link ManagedIdentityStorage}. Returned by {@link createManagedPrincipal}
+ * so callers can persist their own app state (e.g. a resolved serviceId)
+ * alongside the granted capabilities, using the very same durable store the
+ * {@link CapBag} hydrates from — no second storage wiring required.
  */
-interface WsNoInitEndpoint {
-  readonly kind: 'ws-no-init';
-  /** Actual `ws://` URL passed to the WebSocket constructor. */
-  readonly url: string;
-}
-/** Spawn a child and talk linkrpc over its stdin/stdout. */
-interface CmdStdioEndpoint {
-  readonly kind: 'cmd-stdio';
-  readonly command: EndpointCommand;
-  /** Extra environment variables injected into the spawned child. */
-  readonly env?: Readonly<Record<string, string>>;
-  /** Working directory for the spawned child. */
-  readonly cwd?: string;
+declare class PrincipalWithStore extends Principal {
+  readonly store: ManagedIdentityStorage;
+  readonly identity: Identity;
+  constructor(identity: Identity, capBag: CapBag, store: ManagedIdentityStorage);
 }
 /**
- * Spawn a child against a freshly-started *local hub*: the parent listens on a
- * private socket, hands the child its address + token via `LINKRPC_ENDPOINT` /
- * `LINKRPC_TOKEN`, and the child dials in as a hub participant (registering its
- * services), exactly as it would against a remote hub.
- */
-interface CmdEnvEndpoint {
-  readonly kind: 'cmd-env';
-  readonly command: EndpointCommand;
-  /**
-   * When set, the local hub provisions (or reuses) a *persistent* managed
-   * identity under this slot id, so the child's HPKE wrap/unwrap keys survive
-   * across runs (sealed archives re-open).
+ * Executor-managed principal: the peer signs for us through its
+ * `identity::sign` overlay (we never hold a private key). Bootstrapped purely
+ * from the outbound `sender` — no side effects on any connection — and caps
+ * persist in the executor-backed per-identity storage. Works over any
+ * transport whose peer serves the identity overlay (hub *or* stdio).
+ *
+ * Call this exactly once per channel: it performs the `identity::*` handshake
+ * and hydrates the {@link CapBag} from storage. The returned
+ * {@link PrincipalWithStore} additionally surfaces that same durable
+ * {@link ManagedIdentityStorage} as `store`.
+ */
+declare function createManagedPrincipal(sender: IRequestSender<unknown>): Promise<PrincipalWithStore>;
+//#endregion
+//#region src/identity/signingSender.d.ts
+/**
+ * Per-outbound-call hook. Sees every signed call this sender makes,
+ * and gets a chance to:
+ *   - attach capabilities (the common case),
+ *   - override `method` / `params` / `interfaceHash` (rewriting,
+ *     auditing, schema-pinning),
+ *   - advance `signedAtMs` (e.g. after a slow consent prompt that needs
+ *     to issue a cap bound to a fresher timestamp than the sender's
+ *     initial wall-clock).
+ *
+ * `signer` and `nonce` are NOT overridable. `signer` is the call's
+ * identity; `nonce` ties any cap to this specific call attempt and must
+ * not drift between the cap-issuance request and the call itself.
+ */
+type CapProvider = (req: {
+  readonly method: string;
+  readonly params: JsonValue | undefined;
+  readonly signer: PrincipalId;
+  readonly nonce: string;
+  readonly signedAtMs: number;
+  readonly interfaceHash?: string;
+}) => Promise<CapProviderResult>;
+interface CapProviderResult {
+  readonly capabilities?: readonly SignedCapability[];
+  /** Override the wire method this sender signs. Default: the original. */
+  readonly method?: string;
+  /** Override the params this sender signs. Default: the original. */
+  readonly params?: JsonValue;
+  /** Override the interfaceHash baked into the signed envelope. */
+  readonly interfaceHash?: string;
+  /** Advance the Unix-ms timestamp baked into the signed envelope. */
+  readonly signedAtMs?: number;
+}
+/**
+ * Per-call ctx the {@link SigningSender} consumes. All fields are
+ * optional; the sender's persistent {@link SigningSenderConfig.principal} is
+ * the default.
+ *
+ * To install a signer after the sender is already constructed (e.g. a
+ * managed-identity bootstrap), mutate the caller-owned config object — it is
+ * read fresh on every call. No setter on the sender itself.
+ */
+interface SigningCallCtx {
+  /**
+   * Override the signer for this call only. Pass `null` to skip
+   * signing entirely (plain unsigned JSON-RPC). Bootstrap flows that
+   * must talk to `identity::*` before a managed signer is available
+   * use `signerOverride: null` for those calls.
    */
-  readonly provisionSlot?: string;
-  /** Extra environment variables injected into the spawned child. */
-  readonly env?: Readonly<Record<string, string>>;
-  /** Working directory for the spawned child. */
-  readonly cwd?: string;
+  readonly signerOverride?: SigningIdentity | null;
+  /**
+   * Replace whatever caps the persistent cap provider would attach.
+   * Skips the persistent provider for this call.
+   */
+  readonly capsOverride?: readonly SignedCapability[];
+  /**
+   * Reserved for the perm-denied / consent retry path. Currently a
+   * passthrough — sender does not act on it yet.
+   */
+  readonly requestPermissionWhenDenied?: boolean;
 }
-type ResolvedEndpoint = SocketEndpoint | WsEndpoint | WsNoInitEndpoint | CmdStdioEndpoint | CmdEnvEndpoint;
 /**
- * Parse a strict endpoint URI into an {@link ResolvedEndpoint}. Throws on an
- * unknown scheme or a malformed command endpoint. A bare (scheme-less) string
- * is auto-detected as `ws`/`wss` URL or a socket path.
+ * Persistent config for a {@link SigningSender}.
+ *
+ * `principal` is the call identity plus its durable, extensible capability
+ * set. `oneShotCaps` is an optional side-policy that may stage a single-use
+ * capability onto the very next call without touching the principal. Both
+ * fields are read fresh on every call, so callers may install or swap them
+ * after the sender has been constructed.
+ *
+ * A missing `principal` means "no signing / no caps" for that call, unless
+ * overridden via {@link SigningCallCtx}.
  */
-declare function parseEndpointUri(uri: string): ResolvedEndpoint;
-interface FormatEndpointOptions {
-  /** Emit the real token instead of redacting it. Default: redact. */
-  readonly revealToken?: boolean;
+interface SigningSenderConfig {
+  /** Identity + persistent (extensible) capabilities. */
+  readonly principal?: Principal;
+  /**
+   * Optional per-call capability provider. Runs at sign-time with the
+   * concrete method/params/nonce/timestamp and may return caps and/or
+   * signing overrides.
+   */
+  readonly capProvider?: CapProvider;
+  /**
+   * Optional one-shot capability staging policy. Independent of the
+   * principal; drained per outbound signed call.
+   */
+  readonly oneShotCaps?: OneShotCapStaging;
 }
 /**
- * Render an {@link ResolvedEndpoint} back to a canonical strict URI. The token is
- * redacted (`***`) unless `revealToken` is set, so the result is paste-safe for
- * logs. Round-trips with {@link parseEndpointUri} when `revealToken` is true.
+ * Side-policy for staging *one-shot* capabilities onto the next outbound
+ * signed call, independent of any {@link Principal}. The {@link SigningSender}
+ * drains the staged caps after attaching them once, so a spent cap never
+ * leaks into a later call.
+ *
+ * Requesting the one-shot grant (prompting the user / hub) lives next to —
+ * not inside — the principal: the principal owns identity and durable
+ * capabilities; this owns the transient per-call grant.
  */
-declare function formatEndpointUri(spec: ResolvedEndpoint, options?: FormatEndpointOptions): string;
-/** True for endpoints that connect to existing, possibly-remote infrastructure. */
-declare function isHubEndpoint(spec: ResolvedEndpoint): spec is SocketEndpoint | WsEndpoint;
-//#endregion
-//#region src/identity/identity.d.ts
-/** JSON-serializable form of a {@link KeypairSigningIdentity} (base64url keys). */
-interface SerializedKeypairSigningIdentity {
-  readonly privateKey: string;
-  readonly publicKey: string;
+declare class OneShotCapStaging {
+  private _staged;
+  /** Stage caps for the next signed call. Replaces any still-pending caps. */
+  stage(caps: readonly SignedCapability[]): void;
+  /**
+   * Take (and clear) the staged caps. Called by {@link SigningSender} once
+   * per outbound signed call.
+   */
+  take(): readonly SignedCapability[];
 }
 /**
- * The public face of a signing identity: its stable {@link PrincipalId} name
- * and the {@link KeyId} its signatures are stamped with. In Phase 1 (perpetual
- * identities) the keyId is the genesis key embedded in the principal, so it is
- * derived by stripping the `id:` prefix.
+ * Outbound sender decorator that wraps every call in a `$hubrpc` signed
+ * envelope and (optionally) attaches capabilities. Stateless w.r.t. signing
+ * config — the {@link Principal} and {@link OneShotCapStaging} are resolved
+ * per-call from {@link SigningSenderConfig}, so the caller can install or
+ * swap them after construction by mutating that object.
  */
-declare class PublicSigningIdentity {
-  readonly principal: PrincipalId;
-  constructor(principal: PrincipalId);
-  /** The {@link KeyId} this identity signs with (its genesis key, in Phase 1). */
-  get keyId(): KeyId;
+/**
+ * The result of {@link SigningSender.fromChannelWithManagedPrincipal} /
+ * {@link SigningSender.fromTransportWithManagedPrincipal}: a signing
+ * {@link Channel} ready for `LinkRpcConnection`, plus the executor-managed
+ * {@link PrincipalWithStore} that drives it (caps, per-identity storage, nodeId).
+ */
+interface ManagedSigningChannel<TInCtx = undefined> {
+  readonly channel: Channel<TInCtx, SigningCallCtx>;
+  readonly principal: PrincipalWithStore;
 }
-interface SigningIdentity {
-  readonly publicSigningIdentity: PublicSigningIdentity;
-  sign(bytes: Uint8Array): Promise<Uint8Array>;
+declare class SigningSender<TInCtx = unknown> implements IRequestSender<SigningCallCtx> {
+  private readonly _inner;
+  private readonly _config;
+  /**
+   * Wrap an inner channel with signing. Composes via {@link Channel.withSender}
+   * so the resulting `Channel<TInCtx, SigningCallCtx>` plugs into
+   * `LinkRpcConnection`.
+   */
+  static wrapChannel<TInCtx>(inner: Channel<TInCtx, unknown>, config: SigningSenderConfig): Channel<TInCtx, SigningCallCtx>;
+  /**
+   * Bootstrap an executor-managed {@link Principal} over the **unsigned**
+   * `channel`, then wrap that same channel with signing driven by it.
+   *
+   * Crucially, the `identity::*` handshake that mints the managed principal
+   * rides the *raw* channel (`channel.sender`), so those bootstrap calls are
+   * themselves never signed — there is no "sign the sign call" recursion and
+   * no reliance on threading `signerOverride: null` through every transport
+   * layer. The returned signing {@link Channel} is what callers hand to
+   * `LinkRpcConnection`; the {@link PrincipalWithStore} is returned alongside
+   * for caps / per-identity storage / nodeId.
+   */
+  static fromChannelWithManagedPrincipal<TInCtx>(channel: Channel<TInCtx, unknown>, config?: Omit<SigningSenderConfig, 'principal'>): Promise<ManagedSigningChannel<TInCtx>>;
+  /**
+   * Convenience over {@link fromChannelWithManagedPrincipal}: build the
+   * unsigned {@link JsonRpcChannel} from `transport` first. The common entry
+   * point for app hosts / services that own a raw {@link IMessageTransport}.
+   */
+  static fromTransportWithManagedPrincipal(transport: IMessageTransport, config?: Omit<SigningSenderConfig, 'principal'>): Promise<ManagedSigningChannel<undefined>>;
+  constructor(_inner: IRequestSender<unknown>, _config: SigningSenderConfig);
+  sendRequest(method: string, params: JsonValue | undefined, opts?: SendOpts<SigningCallCtx>): Promise<JsonValue>;
+  sendNotification(method: string, params: JsonValue | undefined, opts?: SendOpts<SigningCallCtx>): Promise<void>;
+  sendRequestWithStream(method: string, params: JsonValue | undefined, opts?: StreamSendOpts<SigningCallCtx>): RawStreamingCall;
+  close(): void;
+  private _prepareOutbound;
+  private _resolveSigner;
+  private _createSigningCoordinates;
+  private _resolveIntentAndCapabilities;
+  private _signPreparedCall;
 }
+//#endregion
+//#region src/hub/common/directoryWalk.d.ts
 /**
- * {@link SigningIdentity} backed by an in-process keypair. For the common
- * case where the signing material lives in memory. For external HSM-style
- * backends, implement {@link SigningIdentity} directly.
+ * Portable reflection walk over the `hubrpc.directory` referral tree.
+ *
+ * A directory may explicitly list other `hubrpc.directory` services as
+ * referrals. Flattening that graph into an interface inventory is the
+ * consumer's job. Routing state is deliberately not part of this contract.
  */
-declare class KeypairSigningIdentity implements SigningIdentity {
-  private readonly _privateKey;
-  readonly publicSigningIdentity: PublicSigningIdentity;
-  constructor(principal: PrincipalId, _privateKey: PrivateKey);
-  sign(message: Uint8Array): Promise<Signature>;
-  static fromKeypair(keypair: Keypair): KeypairSigningIdentity;
-  /** Generate a fresh signing identity (Ed25519 keypair). */
-  static generateNew(): Promise<KeypairSigningIdentity>;
-  /** Restore an identity from its {@link toJson} form. */
-  static fromJson(json: SerializedKeypairSigningIdentity): KeypairSigningIdentity;
-  /** Serialize the keypair to a JSON-friendly form (base64url keys). */
-  toJson(): SerializedKeypairSigningIdentity;
+/**
+ * The sender reflection helpers speak over: the signing decorator that wraps
+ * the live channel. Decoupled from the concrete `JsonRpcChannel` so reconnect
+ * can swap the underlying channel transparently.
+ */
+type ReflectionChannel = IRequestSender<SigningCallCtx>;
+interface ServiceListing {
+  readonly serviceId: string;
+  readonly interfaceId: string;
+  readonly hash: string;
+  readonly path?: string;
+  /** Optional non-normative description of the owning service. */
+  readonly serviceDescription?: string;
+  /**
+   * Root node ids required to access the owning service, in CNF. Surfaced by
+   * the directory; {@link walkHubDetailed} additionally folds transitive
+   * requirements from ancestor directories onto descendants.
+   */
+  readonly rootPrincipalSets?: readonly RootPrincipalSet[];
+  /** Scope carried by a directory referral; omitted means its service-id subtree. */
+  readonly reachableServiceIds?: readonly ServiceIdPattern[];
 }
-declare class PublicWrappingIdentity {
-  readonly wrapPublicKey: Uint8Array;
-  constructor(wrapPublicKey: Uint8Array);
+/**
+ * A {@link ServiceListing} enriched with the service id of the directory that
+ * reported it. This is provenance only: every listing is asserted reachable by
+ * sending to the endpoint that answered the directory.
+ */
+interface DiscoveredListing extends ServiceListing {
+  readonly discoveredFrom: string;
 }
-interface WrappingIdentity {
-  readonly publicWrappingIdentity: PublicWrappingIdentity;
-  wrap(domain: string, bytes: Uint8Array): Promise<Uint8Array>;
-  unwrap(domain: string, blob: Uint8Array): Promise<Uint8Array>;
+interface ListOptions {
+  readonly interfaceId?: string;
+  readonly interfaceIdPrefix?: string;
+  readonly serviceId?: string;
+  readonly serviceIdScopes?: readonly ServiceIdPattern[];
+  readonly limit?: number;
+  readonly timeoutMs?: number;
+  /**
+   * When set, send the reflection call to that service via form-3
+   * (`<target>::hubrpc.directory::list`) instead of the implicit root
+   * directory. Used when talking to a hub: the root directory is the hub
+   * itself, but per-service reflection lives on each participant.
+   */
+  readonly target?: string;
 }
-interface Identity extends SigningIdentity, WrappingIdentity {
-  /** The identity's stable {@link PrincipalId} name. */
-  readonly principal: PrincipalId;
-  /** @deprecated */
-  readonly wrapPublicKey: Uint8Array;
+declare function fetchDirectory(channel: ReflectionChannel, opts?: ListOptions): Promise<ServiceListing[]>;
+declare function fetchSchema(channel: ReflectionChannel, interfaceId: string, hash: string | undefined,
+/**
+ * Optional routing target. When set, the schema request is addressed to
+ * `<target>::hubrpc.schemas::get` (form-3) so it reaches the service that
+ * actually hosts this interface — needed when talking to a hub and the
+ * interface lives behind a participant.
+ */
+target?: string): Promise<LinkRpcInterfaceSchema>;
+declare function findMethodInSchema(schema: LinkRpcInterfaceSchema, methodName: string): MethodSchema | undefined;
+/** Default recursion depth when walking the bus. */
+declare const DEFAULT_WALK_DEPTH = 5;
+/** Segment-aware service-id pattern matching (`foo` includes `foo/bar`, not `foobar`). */
+declare function serviceIdMatchesPattern(serviceId: string, pattern: ServiceIdPattern): boolean;
+/** Whether a service id is included by a union of patterns. `undefined` means unfiltered. */
+declare function serviceIdMatchesScopes(serviceId: string, scopes: readonly ServiceIdPattern[] | undefined): boolean;
+/** Canonicalize a pattern union by removing duplicates and contained patterns. */
+declare function normalizeServiceIdScopes(scopes: readonly ServiceIdPattern[]): ServiceIdPattern[];
+/** Pairwise intersection of two pattern unions. */
+declare function intersectServiceIdScopes(left: readonly ServiceIdPattern[], right: readonly ServiceIdPattern[]): ServiceIdPattern[];
+/**
+ * A sub-directory the walk surfaced but could not enumerate — typically because
+ * it is capability-gated (e.g. the `hub` directory, reachable only once the
+ * connection holds a capability for it). The services it would have listed are
+ * therefore absent from the walk; callers can surface `reason` to explain the
+ * gap rather than silently dropping the branch.
+ */
+interface InaccessibleDirectory {
+  /** The directory target (serviceId) that could not be enumerated. */
+  readonly serviceId: string;
+  /** The error message from the denied directory lookup. */
+  readonly reason: string;
+}
+interface WalkHubResult {
+  /** Every interface reachable from the directories the walk could read. */
+  readonly listings: DiscoveredListing[];
+  /**
+   * Sub-directories that were referenced but could not be enumerated (e.g.
+   * capability-gated). Their services are not present in `listings`.
+   */
+  readonly inaccessible: InaccessibleDirectory[];
 }
 /**
- * Full {@link Identity} backed by in-process Ed25519 (signing) and X25519
- * (wrapping) keypairs. The local counterpart to a keystore/executor-backed
- * identity — used by self-managed principals that hold their own key
- * material (e.g. loaded from disk). For external HSM-style backends,
- * implement {@link Identity} directly.
+ * Recursive graph walk: list a directory, intersect the accumulated service-id
+ * scope with every explicit `hubrpc.directory` referral, and recurse. Bounded
+ * by `maxDepth`.
+ *
+ * Every listing is tagged with `discoveredFrom` — the serviceId of the
+ * directory that produced it. When the same `(serviceId, interfaceId, hash)`
+ * shows up via several directories (e.g. once forwarded by the hub, once
+ * directly from the participant), we keep the one whose `discoveredFrom`
+ * matches the item's `serviceId`, since that's the directory that
+ * authoritatively knows about it.
+ *
+ * Transitive root-node-id requirements flow down the tree: when the walk
+ * recurses into a directory whose own `rootPrincipalSets` include `transitive`
+ * reqs, every interface discovered at or below that directory inherits them (as
+ * singleton AND-sets, kept transitive so they keep flowing further down). This
+ * replaces the hub-side `applyTransitiveReqs` fold that the v1 aggregating
+ * directory performed.
+ *
+ * A sub-directory the walk cannot read is recorded in
+ * {@link WalkHubResult.inaccessible} rather than silently dropped. A failure to
+ * read the *root* directory is left silent — there is no sub-tree to explain —
+ * and simply yields empty results.
+ *
+ * When {@link WalkHubOptions.unlockGatedDirectory} is supplied, each gated
+ * sub-directory is offered to the hook; if it returns `true` (a capability was
+ * granted), that directory is re-queued and the walk continues into it — a
+ * fixpoint that keeps unlocking newly-revealed gated branches until nothing
+ * more can be opened (still bounded by `maxDepth`).
+ */
+interface WalkHubOptions {
+  readonly maxDepth?: number;
+  /** Hard deadline for each directory page request. Defaults to 5 seconds. */
+  readonly timeoutMs?: number;
+  /** Return only listings for this exact interface id after traversing directories. */
+  readonly interfaceId?: string;
+  /** Return only listings whose interface id starts with this prefix after traversal. */
+  readonly interfaceIdPrefix?: string;
+  /** Return only listings for this exact service id after traversal. */
+  readonly serviceId?: string;
+  /** Initial service-id scope. Defaults to the universal `{ prefix: "" }`. */
+  readonly serviceIdScopes?: readonly ServiceIdPattern[];
+  /**
+   * The directory the walk starts from. Defaults to the implicit root
+   * directory (form-2 `hubrpc.directory::list`). Pass a serviceId to start at
+   * `<rootTarget>::hubrpc.directory::list` — e.g. the hub's own global
+   * directory (`'hub'`) when walking from the hub's in-process connection.
+   */
+  readonly rootTarget?: string;
+  /**
+   * Invoked once per gated sub-directory the walk encounters. Return `true`
+   * if a capability for its `hubrpc.directory::list` was granted and the
+   * directory should be re-listed; `false` (or omitted hook) leaves it in
+   * {@link WalkHubResult.inaccessible}. Called at most once per `serviceId`.
+   */
+  unlockGatedDirectory?: (serviceId: string) => Promise<boolean>;
+  /** Optional diagnostic sink for inaccessible lists and ended watches. */
+  readonly log?: (message: string) => void;
+}
+declare function walkHubDetailed(channel: ReflectionChannel, opts?: WalkHubOptions): Promise<WalkHubResult>;
+/**
+ * Backward-compatible wrapper over {@link walkHubDetailed} that returns only the
+ * reachable listings, dropping the inaccessible-directory report.
+ */
+declare function walkHub(channel: ReflectionChannel, opts?: WalkHubOptions): Promise<DiscoveredListing[]>;
+interface HubDirectoryChange {
+  /** Directory that emitted the tick. `undefined` denotes the connection root. */
+  readonly target: string | undefined;
+  readonly result: WalkHubResult;
+}
+type HubDirectoryGraphTarget = {
+  readonly kind: 'root';
+  readonly serviceId?: string;
+} | {
+  readonly kind: 'addressed';
+  readonly serviceId: string;
+};
+type HubDirectoryNodeState = 'unexplored' | 'loading' | 'loaded' | 'inaccessible';
+interface HubDirectoryParentReport {
+  readonly target: HubDirectoryGraphTarget;
+  readonly scopes: readonly ServiceIdPattern[];
+  /** Resulting depth for this incoming parent path. */
+  readonly depth: number;
+}
+/** Stable public report for one native directory response. */
+interface HubDirectoryNodeReport {
+  readonly target: HubDirectoryGraphTarget;
+  readonly state: HubDirectoryNodeState;
+  readonly effectiveScopes: readonly ServiceIdPattern[];
+  readonly depth: number;
+  readonly parents: readonly HubDirectoryParentReport[];
+  /** Per-directory listings, normalized to `ServiceListing`, before inherited metadata is folded. */
+  readonly nativeListings: readonly ServiceListing[];
+  readonly inaccessibleReason?: string;
+  readonly watching: boolean;
+}
+/**
+ * Complete point-in-time graph document. `root` exists from construction in
+ * the `unexplored` state, so consumers can render before exploration starts.
+ */
+interface HubDirectoryGraphSnapshot {
+  readonly revision: number;
+  readonly complete: boolean;
+  readonly root: HubDirectoryNodeReport;
+  readonly directories: readonly HubDirectoryNodeReport[];
+  readonly result: WalkHubResult;
+}
+type HubDirectoryGraphEvent = {
+  readonly type: 'snapshot';
+  readonly reason: 'subscribed' | 'reconciliation-started' | 'reset';
+  readonly snapshot: HubDirectoryGraphSnapshot;
+} | {
+  readonly type: 'node-added';
+  readonly reason: 'referral';
+  readonly node: HubDirectoryNodeReport;
+  readonly snapshot: HubDirectoryGraphSnapshot;
+} | {
+  readonly type: 'node-updated';
+  readonly reason: 'loading' | 'loaded' | 'inaccessible' | 'referral' | 'watch-started' | 'watch-stopped' | 'watch-ended' | 'reset';
+  readonly previous: HubDirectoryNodeReport;
+  readonly node: HubDirectoryNodeReport;
+  readonly snapshot: HubDirectoryGraphSnapshot;
+} | {
+  readonly type: 'node-removed';
+  readonly reason: 'unreachable' | 'reset';
+  readonly previous: HubDirectoryNodeReport;
+  readonly snapshot: HubDirectoryGraphSnapshot;
+} | {
+  readonly type: 'settled';
+  readonly snapshot: HubDirectoryGraphSnapshot;
+};
+/**
+ * Reusable directory graph explorer and watcher.
+ *
+ * The class keeps one native snapshot per directory target. A watch tick
+ * re-lists only its source target; outgoing referral changes then propagate
+ * through affected descendants. Unchanged siblings retain both their snapshot
+ * and watch. Multi-parent targets are queried with the normalized union of all
+ * incoming path scopes.
+ */
+declare class HubDirectoryExplorer {
+  private readonly _channel;
+  private readonly _options;
+  private readonly _maxDepth;
+  private readonly _initialScopes;
+  private readonly _nodes;
+  private readonly _unlockAttempted;
+  private readonly _listeners;
+  private readonly _graphListeners;
+  private readonly _pendingTicks;
+  private readonly _watchRetryTimers;
+  private readonly _watchRetryDelays;
+  private _initialized;
+  private _disposed;
+  private _watching;
+  private _complete;
+  private _revision;
+  private _work;
+  private _explorePromise;
+  constructor(_channel: ReflectionChannel, _options?: WalkHubOptions);
+  /** Perform a fresh bounded exploration without starting watches. */
+  explore(): Promise<WalkHubResult>;
+  private _explore;
+  /** Current deduplicated graph snapshot. */
+  get result(): WalkHubResult;
+  /** Current complete-or-progressive directory graph report. */
+  get graphSnapshot(): HubDirectoryGraphSnapshot;
+  /**
+   * Subscribe to progressive graph reports. The listener is registered before
+   * receiving a synchronous current snapshot, avoiding the subscribe/explore
+   * race for both idle and already-running explorers.
+   */
+  subscribe(listener: (event: HubDirectoryGraphEvent) => void): () => void;
+  /**
+   * Explore once, then watch every reachable directory. Resolves after the
+   * initial graph and watches are established.
+   */
+  watch(listener: (change: HubDirectoryChange) => void): Promise<() => void>;
+  /** Wait until all currently queued watch reconciliation has settled. */
+  whenIdle(): Promise<void>;
+  dispose(): void;
+  private _loadNode;
+  private _tryUnlock;
+  private _reconcileOutgoing;
+  private _outgoingFor;
+  private _createRootNode;
+  private _createNode;
+  private _updateNodeFromParents;
+  private _deriveNodeFromParents;
+  private _derivedNodeState;
+  /**
+   * Rebuild incoming contributions from the root seed. Starting with no
+   * non-root contributions computes the least fixed point, so a disconnected
+   * or narrowed cycle cannot keep scopes contributed by its previous state.
+   */
+  private _reconcileScopesFromRoot;
+  private _computeScopeFixedPoint;
+  private _pruneUnreachable;
+  /**
+   * Every changed watch scope uses list/watch/list: callers reach this method
+   * only after a list under the current scope, then the replacement watch is
+   * installed before a verification list. Either the verification sees a
+   * handoff mutation or the new watch ticks for it.
+   */
+  private _synchronizeWatches;
+  private _replaceWatch;
+  private _queueTick;
+  private _stopWatch;
+  private _stopAllWatches;
+  private _scheduleWatchRetry;
+  private _clearWatchRetry;
+  private _clearNodes;
+  private _resetForExplore;
+  private _updateNode;
+  private _nodeReport;
+  private _targetForKey;
+  private _emitNodeAdded;
+  private _emitNodeUpdated;
+  private _emitNodeRemoved;
+  private _startReconciliation;
+  private _settle;
+  private _emitSnapshot;
+  private _emitGraphEvent;
+  private _deliverGraphEvent;
+  private _nodeKeyForTarget;
+  private _throwIfDisposed;
+}
+//#endregion
+//#region src/schema/exportStaticHubSchema.d.ts
+interface ExportStaticHubSchemaOptions {
+  /** Directory and default-binding reflection scope; omitted means the connection root. */
+  serviceId?: string;
+  maxDepth?: number;
+  timeoutMs?: number;
+}
+/** Export a complete static contract, failing on missing reflection, schemas, or truncated discovery. */
+declare function exportStaticHubSchema(channel: ReflectionChannel, options?: ExportStaticHubSchemaOptions): Promise<StaticHubSchemaDocument>;
+//#endregion
+//#region src/inspection/inspection.interfaces.d.ts
+declare const zTopologyPort: import("zod/mini").ZodMiniObject<{
+  portId: import("zod/mini").ZodMiniString<string>;
+  label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+}, import("zod/v4/core").$strip>;
+declare const zParticipantDescriptor: import("zod/mini").ZodMiniObject<{
+  type: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+  label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+  processId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
+  processType: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+  nodeStatusServiceId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+  metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
+}, import("zod/v4/core").$strip>;
+declare const zParticipantDescriptorSource: import("zod/mini").ZodMiniObject<{
+  source: import("zod/mini").ZodMiniEnum<{
+    self: "self";
+    attacher: "attacher";
+  }>;
+  descriptor: import("zod/mini").ZodMiniObject<{
+    type: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+    label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+    processId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
+    processType: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+    nodeStatusServiceId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+    metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
+  }, import("zod/v4/core").$strip>;
+}, import("zod/v4/core").$strip>;
+declare const zTopologyNode: import("zod/mini").ZodMiniObject<{
+  nodeId: import("zod/mini").ZodMiniString<string>;
+  kind: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniEnum<{
+    endpoint: "endpoint";
+    hub: "hub";
+  }>>;
+  label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+  descriptors: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
+    source: import("zod/mini").ZodMiniEnum<{
+      self: "self";
+      attacher: "attacher";
+    }>;
+    descriptor: import("zod/mini").ZodMiniObject<{
+      type: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+      label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+      processId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
+      processType: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+      nodeStatusServiceId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+      metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
+    }, import("zod/v4/core").$strip>;
+  }, import("zod/v4/core").$strip>>>;
+  ports: import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
+    portId: import("zod/mini").ZodMiniString<string>;
+    label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+  }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>;
+declare const zTopologyLinkEndpoint: import("zod/mini").ZodMiniObject<{
+  nodeId: import("zod/mini").ZodMiniString<string>;
+  portId: import("zod/mini").ZodMiniString<string>;
+}, import("zod/v4/core").$strip>;
+declare const zTopologyTransportEndpoint: import("zod/mini").ZodMiniObject<{
+  address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+  port: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
+}, import("zod/v4/core").$strip>;
+/**
+ * Transport details as observed at a topology link. `local` corresponds to the
+ * link's `from` endpoint and `remote` to its `to` endpoint.
+ */
+declare const zTopologyTransportInfo: import("zod/mini").ZodMiniObject<{
+  type: import("zod/mini").ZodMiniString<string>;
+  local: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
+    address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+    port: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
+  }, import("zod/v4/core").$strip>>;
+  remote: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
+    address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+    port: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
+  }, import("zod/v4/core").$strip>>;
+  path: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+  metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
+}, import("zod/v4/core").$strip>;
+declare const zTopologyLink: import("zod/mini").ZodMiniObject<{
+  from: import("zod/mini").ZodMiniObject<{
+    nodeId: import("zod/mini").ZodMiniString<string>;
+    portId: import("zod/mini").ZodMiniString<string>;
+  }, import("zod/v4/core").$strip>;
+  to: import("zod/mini").ZodMiniObject<{
+    nodeId: import("zod/mini").ZodMiniString<string>;
+    portId: import("zod/mini").ZodMiniString<string>;
+  }, import("zod/v4/core").$strip>;
+  label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+  peerState: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniEnum<{
+    identified: "identified";
+    pending: "pending";
+    unsupported: "unsupported";
+    error: "error";
+  }>>;
+  transport: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
+    type: import("zod/mini").ZodMiniString<string>;
+    local: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
+      address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+      port: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
+    }, import("zod/v4/core").$strip>>;
+    remote: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
+      address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+      port: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
+    }, import("zod/v4/core").$strip>>;
+    path: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+    metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
+  }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>;
+declare const zRouteClaim: import("zod/mini").ZodMiniObject<{
+  serviceId: import("zod/mini").ZodMiniString<string>;
+  nodeId: import("zod/mini").ZodMiniString<string>;
+  portId: import("zod/mini").ZodMiniString<string>;
+  match: import("zod/mini").ZodMiniEnum<{
+    exact: "exact";
+    prefix: "prefix";
+  }>;
+}, import("zod/v4/core").$strip>;
+declare const zTopologyGraph: import("zod/mini").ZodMiniObject<{
+  observerServiceId: import("zod/mini").ZodMiniString<string>;
+  entryNodeId: import("zod/mini").ZodMiniString<string>;
+  nodes: import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
+    nodeId: import("zod/mini").ZodMiniString<string>;
+    kind: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniEnum<{
+      endpoint: "endpoint";
+      hub: "hub";
+    }>>;
+    label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+    descriptors: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
+      source: import("zod/mini").ZodMiniEnum<{
+        self: "self";
+        attacher: "attacher";
+      }>;
+      descriptor: import("zod/mini").ZodMiniObject<{
+        type: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+        label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+        processId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
+        processType: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+        nodeStatusServiceId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+        metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
+      }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>>>;
+    ports: import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
+      portId: import("zod/mini").ZodMiniString<string>;
+      label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+    }, import("zod/v4/core").$strip>>;
+  }, import("zod/v4/core").$strip>>;
+  links: import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
+    from: import("zod/mini").ZodMiniObject<{
+      nodeId: import("zod/mini").ZodMiniString<string>;
+      portId: import("zod/mini").ZodMiniString<string>;
+    }, import("zod/v4/core").$strip>;
+    to: import("zod/mini").ZodMiniObject<{
+      nodeId: import("zod/mini").ZodMiniString<string>;
+      portId: import("zod/mini").ZodMiniString<string>;
+    }, import("zod/v4/core").$strip>;
+    label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+    peerState: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniEnum<{
+      identified: "identified";
+      pending: "pending";
+      unsupported: "unsupported";
+      error: "error";
+    }>>;
+    transport: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
+      type: import("zod/mini").ZodMiniString<string>;
+      local: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
+        address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+        port: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
+      }, import("zod/v4/core").$strip>>;
+      remote: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
+        address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+        port: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
+      }, import("zod/v4/core").$strip>>;
+      path: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+      metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
+    }, import("zod/v4/core").$strip>>;
+  }, import("zod/v4/core").$strip>>;
+  routes: import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
+    serviceId: import("zod/mini").ZodMiniString<string>;
+    nodeId: import("zod/mini").ZodMiniString<string>;
+    portId: import("zod/mini").ZodMiniString<string>;
+    match: import("zod/mini").ZodMiniEnum<{
+      exact: "exact";
+      prefix: "prefix";
+    }>;
+  }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>;
+type TopologyPort = output<typeof zTopologyPort>;
+type ParticipantDescriptor = output<typeof zParticipantDescriptor>;
+type ParticipantDescriptorSource = output<typeof zParticipantDescriptorSource>;
+type TopologyNode = output<typeof zTopologyNode>;
+type TopologyLinkEndpoint = output<typeof zTopologyLinkEndpoint>;
+type TopologyTransportEndpoint = output<typeof zTopologyTransportEndpoint>;
+type TopologyTransportInfo = output<typeof zTopologyTransportInfo>;
+type TopologyLink = output<typeof zTopologyLink>;
+type RouteClaim = output<typeof zRouteClaim>;
+type TopologyGraph = output<typeof zTopologyGraph>;
+declare const topologyInterface: InterfaceDefinition<{
+  getGraph: RequestType<Record<string, never>, {
+    observerServiceId: string;
+    entryNodeId: string;
+    nodes: {
+      nodeId: string;
+      ports: {
+        portId: string;
+        label?: string | undefined;
+      }[];
+      kind?: "endpoint" | "hub" | undefined;
+      label?: string | undefined;
+      descriptors?: {
+        source: "self" | "attacher";
+        descriptor: {
+          type?: string | undefined;
+          label?: string | undefined;
+          processId?: number | undefined;
+          processType?: string | undefined;
+          nodeStatusServiceId?: string | undefined;
+          metadata?: Record<string, string | number | boolean> | undefined;
+        };
+      }[] | undefined;
+    }[];
+    links: {
+      from: {
+        nodeId: string;
+        portId: string;
+      };
+      to: {
+        nodeId: string;
+        portId: string;
+      };
+      label?: string | undefined;
+      peerState?: "identified" | "pending" | "unsupported" | "error" | undefined;
+      transport?: {
+        type: string;
+        local?: {
+          address?: string | undefined;
+          port?: number | undefined;
+        } | undefined;
+        remote?: {
+          address?: string | undefined;
+          port?: number | undefined;
+        } | undefined;
+        path?: string | undefined;
+        metadata?: Record<string, string | number | boolean> | undefined;
+      } | undefined;
+    }[];
+    routes: {
+      serviceId: string;
+      nodeId: string;
+      portId: string;
+      match: "exact" | "prefix";
+    }[];
+  }, void, NoInfer<Record<string, never>>, never, readonly ApplicationErrorDescriptorBase[], void>;
+  watchGraph: RequestType<Record<string, never>, Record<string, never>, void, never, NoInfer<Record<string, never>>, readonly ApplicationErrorDescriptorBase[], void>;
+}>;
+declare const zTrafficTransitEndpoint: import("zod/mini").ZodMiniObject<{
+  edgeId: import("zod/mini").ZodMiniString<string>;
+  portId: import("zod/mini").ZodMiniString<string>;
+  requestId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniString<string>]>>;
+}, import("zod/v4/core").$strip>;
+declare const zTrafficTransitEvent: import("zod/mini").ZodMiniObject<{
+  type: import("zod/mini").ZodMiniLiteral<"transit">;
+  timeMs: import("zod/mini").ZodMiniNumber<number>;
+  nodeId: import("zod/mini").ZodMiniString<string>;
+  in: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
+    edgeId: import("zod/mini").ZodMiniString<string>;
+    portId: import("zod/mini").ZodMiniString<string>;
+    requestId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniString<string>]>>;
+  }, import("zod/v4/core").$strip>>;
+  out: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
+    edgeId: import("zod/mini").ZodMiniString<string>;
+    portId: import("zod/mini").ZodMiniString<string>;
+    requestId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniString<string>]>>;
+  }, import("zod/v4/core").$strip>>;
+  disposition: import("zod/mini").ZodMiniEnum<{
+    forwarded: "forwarded";
+    consumed: "consumed";
+    dropped: "dropped";
+    unroutable: "unroutable";
+  }>;
+  kind: import("zod/mini").ZodMiniEnum<{
+    request: "request";
+    notification: "notification";
+    response: "response";
+    stream: "stream";
+  }>;
+  method: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+  params: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnknown>;
+  result: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnknown>;
+  error: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
+    code: import("zod/mini").ZodMiniNumber<number>;
+    message: import("zod/mini").ZodMiniString<string>;
+    data: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnknown>;
+  }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>;
+declare const zTrafficOverflowEvent: import("zod/mini").ZodMiniObject<{
+  type: import("zod/mini").ZodMiniLiteral<"overflow">;
+  dropped: import("zod/mini").ZodMiniNumber<number>;
+}, import("zod/v4/core").$strip>;
+declare const zTrafficEvent: import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniObject<{
+  type: import("zod/mini").ZodMiniLiteral<"transit">;
+  timeMs: import("zod/mini").ZodMiniNumber<number>;
+  nodeId: import("zod/mini").ZodMiniString<string>;
+  in: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
+    edgeId: import("zod/mini").ZodMiniString<string>;
+    portId: import("zod/mini").ZodMiniString<string>;
+    requestId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniString<string>]>>;
+  }, import("zod/v4/core").$strip>>;
+  out: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
+    edgeId: import("zod/mini").ZodMiniString<string>;
+    portId: import("zod/mini").ZodMiniString<string>;
+    requestId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniString<string>]>>;
+  }, import("zod/v4/core").$strip>>;
+  disposition: import("zod/mini").ZodMiniEnum<{
+    forwarded: "forwarded";
+    consumed: "consumed";
+    dropped: "dropped";
+    unroutable: "unroutable";
+  }>;
+  kind: import("zod/mini").ZodMiniEnum<{
+    request: "request";
+    notification: "notification";
+    response: "response";
+    stream: "stream";
+  }>;
+  method: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+  params: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnknown>;
+  result: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnknown>;
+  error: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniObject<{
+    code: import("zod/mini").ZodMiniNumber<number>;
+    message: import("zod/mini").ZodMiniString<string>;
+    data: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniUnknown>;
+  }, import("zod/v4/core").$strip>>;
+}, import("zod/v4/core").$strip>, import("zod/mini").ZodMiniObject<{
+  type: import("zod/mini").ZodMiniLiteral<"overflow">;
+  dropped: import("zod/mini").ZodMiniNumber<number>;
+}, import("zod/v4/core").$strip>]>;
+type TrafficTransitEndpoint = output<typeof zTrafficTransitEndpoint>;
+type TrafficTransitEvent = output<typeof zTrafficTransitEvent>;
+type TrafficOverflowEvent = output<typeof zTrafficOverflowEvent>;
+type TrafficEvent = output<typeof zTrafficEvent>;
+declare const zTrafficWatchResult: import("zod/mini").ZodMiniObject<{
+  delivered: import("zod/mini").ZodMiniNumber<number>;
+  dropped: import("zod/mini").ZodMiniNumber<number>;
+}, import("zod/v4/core").$strip>;
+type TrafficWatchResult = output<typeof zTrafficWatchResult>;
+/**
+ * Observe raw message transits at the node hosting the addressed service.
+ * Consumers may correlate adjacent transits by shared `(portId, requestId)`.
  */
-declare class KeypairIdentity implements Identity {
-  private readonly _privateKey;
-  private readonly _wrap;
-  readonly principal: PrincipalId;
-  readonly wrapPublicKey: Uint8Array;
-  readonly publicSigningIdentity: PublicSigningIdentity;
-  readonly publicWrappingIdentity: PublicWrappingIdentity;
-  constructor(principal: PrincipalId, _privateKey: PrivateKey, _wrap: X25519Keypair);
-  sign(message: Uint8Array): Promise<Signature>;
-  wrap(domain: string, bytes: Uint8Array): Promise<Uint8Array>;
-  unwrap(domain: string, blob: Uint8Array): Promise<Uint8Array>;
-  /** Generate a fresh identity (Ed25519 + X25519 keypairs). */
-  static generate(): Promise<KeypairIdentity>;
-}
+declare const trafficInterface: InterfaceDefinition<{
+  watch: RequestType<{
+    methodPrefix?: string | undefined;
+    trafficIgnoreKey?: string | undefined;
+    focusRequest?: {
+      portId: string;
+      requestId: string | number;
+    } | undefined;
+  }, {
+    delivered: number;
+    dropped: number;
+  }, void, never, NoInfer<{
+    type: "transit";
+    timeMs: number;
+    nodeId: string;
+    disposition: "forwarded" | "consumed" | "dropped" | "unroutable";
+    kind: "request" | "notification" | "response" | "stream";
+    in?: {
+      edgeId: string;
+      portId: string;
+      requestId?: string | number | undefined;
+    } | undefined;
+    out?: {
+      edgeId: string;
+      portId: string;
+      requestId?: string | number | undefined;
+    } | undefined;
+    method?: string | undefined;
+    params?: unknown;
+    result?: unknown;
+    error?: {
+      code: number;
+      message: string;
+      data?: unknown;
+    } | undefined;
+  } | {
+    type: "overflow";
+    dropped: number;
+  }>, readonly ApplicationErrorDescriptorBase[], void>;
+  watchWithPayloads: RequestType<{
+    maxPayloadBytes: number;
+    methodPrefix?: string | undefined;
+    trafficIgnoreKey?: string | undefined;
+    focusRequest?: {
+      portId: string;
+      requestId: string | number;
+    } | undefined;
+  }, {
+    delivered: number;
+    dropped: number;
+  }, void, never, NoInfer<{
+    type: "transit";
+    timeMs: number;
+    nodeId: string;
+    disposition: "forwarded" | "consumed" | "dropped" | "unroutable";
+    kind: "request" | "notification" | "response" | "stream";
+    in?: {
+      edgeId: string;
+      portId: string;
+      requestId?: string | number | undefined;
+    } | undefined;
+    out?: {
+      edgeId: string;
+      portId: string;
+      requestId?: string | number | undefined;
+    } | undefined;
+    method?: string | undefined;
+    params?: unknown;
+    result?: unknown;
+    error?: {
+      code: number;
+      message: string;
+      data?: unknown;
+    } | undefined;
+  } | {
+    type: "overflow";
+    dropped: number;
+  }>, readonly ApplicationErrorDescriptorBase[], void>;
+}>;
 //#endregion
-//#region src/identity/capability.d.ts
-/**
- * Pure freshness check for a single capability link: `true` when the cap never
- * expires, or its `expiresAtMs` is still in the future at `now + marginMs`.
- *
- * Mirrors the gate's expiry rule in {@link verifyChain}'s link check
- * (`expiresAtMs < nowMs` ⇒ expired) so a producer can decide, *before signing*,
- * whether to re-acquire a cap rather than attach one the gate will reject as
- * `expired`. The `marginMs` safety window absorbs in-flight transit time and
- * client/hub clock skew — pass the call's `signedAtMs` as `now` so the check
- * evaluates expiry against the same instant baked into the envelope.
- *
- * This checks ONE link. Effective authority requires every link in a
- * delegation chain to be unexpired, so a producer attaching a bag should apply
- * this to every cap it would attach (see {@link capBagFreshAt}).
- */
-declare function capabilityFreshAt(cap: Capability, now: number, marginMs?: number): boolean;
-/**
- * Freshness over a whole presented bag: `true` only when every cap is fresh at
- * `now + marginMs` (see {@link capabilityFreshAt}). An empty bag is trivially
- * fresh. Use this at the cap-production point to decide whether to re-acquire.
- */
-declare function capBagFreshAt(caps: readonly Capability[], now: number, marginMs?: number): boolean;
-type PermitResult = {
-  ok: true;
-  capabilityNonce: string;
-  rootIssuer: PrincipalId;
-} | {
-  ok: false;
-  reason: string;
-};
-/**
- * A trust anchor accepted as a capability-chain root, plus whether it may be
- * named in authorization error messages.
- */
-interface AcceptedRootIssuer {
-  /** The principal accepted as a chain root for the queried service. */
-  principal: PrincipalId;
-  /**
-   * Whether this issuer may be disclosed in `permits` rejection reasons.
-   * Public anchors (e.g. a hub's well-known admin identity) are surfaced to
-   * help diagnose "wrong root" failures; private ones are withheld so the
-   * error never leaks the set of trusted issuers.
-   */
-  isPublic: boolean;
-}
-/**
- * **The** authorization predicate. A call is permitted iff some presented
- * capability (1) addresses the call, (2) has a genuine, well-delegated
- * chain whose leaf audience is the caller (`call.signer`), and (3) roots
- * at an issuer the verifier accepts **for the call's service**.
- *
- * Pure: it reports the verdict (and the `capabilityNonce` / `rootIssuer`
- * for audit) but performs no consumption. Replay is the caller's job — the
- * gate dedups `call.nonce`, so `callBind` grants are single-use for free.
- *
- * `acceptedRootIssuers` is consulted with the call's `serviceId` and returns
- * the accepted {@link AcceptedRootIssuer} anchors; an empty result rejects
- * every capability (fail closed) — trust is the verifier's, never the
- * token's. Anchors flagged `isPublic` are named in the rejection reason when
- * a chain roots at an unaccepted issuer.
- */
-declare function permits(call: Call, capabilities: readonly SignedCapability[], acceptedRootIssuers: (serviceId: string) => readonly AcceptedRootIssuer[], nowMs: number, opts?: {
-  maxDepth?: number;
-}): Promise<PermitResult>;
-/**
- * Sign a `Capability` with a {@link SigningIdentity}. The private key never
- * leaves the identity. The result verifies via {@link verifyChain}.
- */
-declare function signCapability(capability: Capability, issuer: SigningIdentity): Promise<SignedCapability>;
-interface IssueCapabilityOptions {
-  /** Identity allowed to present the capability. */
-  readonly audience: PublicSigningIdentity;
-  /** Authority granted to the audience. */
-  readonly permissions: readonly Permission[];
-  /** Optional expiration time as Unix milliseconds. */
-  readonly expiresAtMs?: number;
-  /** Optional parent whose authority this capability narrows. */
-  readonly parent?: SignedCapability;
-}
-/**
- * Issue and sign a capability, deriving its issuer, nonce, and optional parent
- * hash. The result is plain JSON data and survives a JSON stringify/parse
- * round-trip without reconstruction.
- */
-declare function issueCapability(issuer: SigningIdentity, options: IssueCapabilityOptions): Promise<SignedCapability>;
-type ParamMatcherFor<T> = {
-  exact: T;
-} | {
-  enum: T[];
-} | {
-  any: true;
-} | (T extends string ? {
-  prefix: string;
-} : never) | (T extends readonly string[] ? {
-  subsetOf: string[];
-} : never);
-/** Type-safe top-level parameter matchers for one interface member. */
-type ParamMatchers<T> = T extends Record<string, unknown> ? { [K in keyof T]: ParamMatcherFor<Exclude<T[K], undefined>>; } : never;
-type RequestMemberName<TMembers extends MemberMap> = { [K in keyof TMembers]: TMembers[K] extends RequestType<any, any, any, any, any, any, any> ? K : never; }[keyof TMembers] & string;
-type RequestParams<TMember> = TMember extends RequestType<infer TParams, any, any, any, any, any, any> ? TParams : never;
-/** Match a string parameter by prefix. */
-declare function prefix(value: string): {
-  prefix: string;
-};
+//#region src/inspection/node.interfaces.d.ts
+declare const zNodeInfo: import("zod/mini").ZodMiniObject<{
+  nodeId: import("zod/mini").ZodMiniString<string>;
+  portId: import("zod/mini").ZodMiniString<string>;
+  descriptors: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
+    source: import("zod/mini").ZodMiniEnum<{
+      self: "self";
+      attacher: "attacher";
+    }>;
+    descriptor: import("zod/mini").ZodMiniObject<{
+      type: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+      label: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+      processId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
+      processType: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+      nodeStatusServiceId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+      metadata: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniNumber<number>, import("zod/mini").ZodMiniBoolean<boolean>]>>>;
+    }, import("zod/v4/core").$strip>;
+  }, import("zod/v4/core").$strip>>>;
+}, import("zod/v4/core").$strip>;
+type NodeInfo = output<typeof zNodeInfo>;
 /**
- * Build an invoke permission from a typed interface member. The helper derives
- * the interface id and schema hash and type-checks parameter matcher names and
- * values against the member's params.
+ * Generates unique topology-correlation labels, not security identities.
+ * Custom generators must avoid collisions across nodes and ports. Tests can
+ * supply an independent deterministic sequence for each participant.
  */
-declare function invoke<TMembers extends MemberMap, TMember extends RequestMemberName<TMembers>>(serviceId: string, iface: InterfaceDefinition<TMembers>, member: TMember, params?: ParamMatchers<RequestParams<TMembers[TMember]>>): Permission;
-//#endregion
-//#region src/identity/managedIdentity.d.ts
+type TopologyIdGenerator = (kind: 'node' | 'port') => string;
 /**
- * Executor-side backing for `identity.storage::*`. Lifecycle tied to a
- * single managed-identity slot; the executor decides where bytes are
- * stored.
+ * Minimal root service for aligning the independently observed topologies at
+ * both ends of a connection.
  */
-interface ManagedIdentityStorageBackend {
-  get(key: string): Promise<unknown | undefined>;
-  set(key: string, value: unknown): Promise<void>;
-  /** Returns `true` iff the key existed before this call. */
-  delete(key: string): Promise<boolean>;
-  list(prefix?: string): Promise<string[]>;
-}
+declare const nodeInterface: InterfaceDefinition<{
+  getNodeId: RequestType<Record<string, never>, {
+    nodeId: string;
+    portId: string;
+    descriptors?: {
+      source: "self" | "attacher";
+      descriptor: {
+        type?: string | undefined;
+        label?: string | undefined;
+        processId?: number | undefined;
+        processType?: string | undefined;
+        nodeStatusServiceId?: string | undefined;
+        metadata?: Record<string, string | number | boolean> | undefined;
+      };
+    }[] | undefined;
+  }, any, never, never, readonly ApplicationErrorDescriptorBase[], any>;
+}>;
+//#endregion
+//#region src/connection/streaming.d.ts
 /**
- * In-process storage backend. Used by tests and by any executor that
- * doesn't need at-rest persistence.
+ * Direction a {@link STREAM_METHOD} message travels, relative to the
+ * request it is correlated with. Made explicit on the wire so that a
+ * middlebox (the hub) can *author* a stream message — e.g. inject a
+ * cancel when a caller disconnects — without an inbound message whose
+ * arrival link it could infer the direction from.
  */
-declare class InMemoryManagedIdentityStorage implements ManagedIdentityStorageBackend {
-  private readonly _data;
-  get(key: string): Promise<unknown | undefined>;
-  set(key: string, value: unknown): Promise<void>;
-  delete(key: string): Promise<boolean>;
-  list(prefix?: string): Promise<string[]>;
-}
+declare const StreamDir: {
+  /** callee → caller: progress, partial results. Routes like a response. */
+  readonly toCaller: "toCaller";
+  /** caller → callee: input, cancellation, keepalive ping. */
+  readonly toCallee: "toCallee";
+};
+type StreamDir = (typeof StreamDir)[keyof typeof StreamDir];
 /**
- * In-process `ManagedIdentity` that holds the private key in memory and
- * uses the package crypto API. Useful for tests and for hub-side features
- * that want a short-lived identity without touching disk.
+ * Reserved control verbs. A control message carries no app `payload`; it
+ * is interpreted by the runtime / hub itself, independently of the
+ * originating method's stream schemas, so *any* request is cancellable
+ * and keep-alive-able even when it declares no app stream.
  */
-declare class InMemoryManagedIdentity implements Identity {
-  private readonly _ed;
-  private readonly _wrap;
-  readonly principal: PrincipalId;
-  readonly wrapPublicKey: Uint8Array;
-  constructor(_ed: Keypair, _wrap: X25519Keypair);
-  get publicSigningIdentity(): PublicSigningIdentity;
-  get publicWrappingIdentity(): PublicWrappingIdentity;
-  sign(bytes: Uint8Array): Promise<Signature>;
-  wrap(domain: string, bytes: Uint8Array): Promise<Uint8Array>;
-  unwrap(domain: string, blob: Uint8Array): Promise<Uint8Array>;
-  /** Generate a fresh in-memory identity (Ed25519 + X25519 keypairs). */
-  static generate(): Promise<InMemoryManagedIdentity>;
-}
+declare const StreamControlType: {
+  /**
+   * Ask the callee to abort the in-flight request. Always {@link
+   * StreamDir.toCallee}. The callee surfaces this as an `AbortSignal`
+   * and is expected to settle the request (typically with a
+   * `cancelled` error response).
+   */
+  readonly cancel: "cancel";
+  /**
+   * Keepalive / liveness probe. Resets the hub's per-request idle timer
+   * so a long-running call is not reaped, and lets either side actively
+   * probe the peer. Carries a `nonce` the peer echoes in its {@link
+   * StreamControlType.pong}. May travel in either direction. Emitted
+   * automatically (without awaiting a pong) by the channel for streaming
+   * calls; see {@link STREAM_METHOD}.
+   */
+  readonly ping: "ping";
+  /**
+   * Reply to a {@link StreamControlType.ping}, echoing the ping's
+   * `nonce` so the prober can correlate it. Travels opposite the ping.
+   * Carries no app effect — purely a liveness acknowledgement.
+   */
+  readonly pong: "pong";
+};
+type StreamControlType = (typeof StreamControlType)[keyof typeof StreamControlType];
 /**
- * Register the `identity` interface on `overlay` so the bound participant
- * can call `identity::sign` etc. on its root overlay. The overlay is
- * private to one participant — no other peer can reach these methods.
- *
- * When `storage` is supplied, the `identity.storage` interface is
- * registered alongside `identity::*`. Lifetime/scope of the backend is
- * the executor's responsibility — for keystore-backed identities the
- * backend lives as long as the identity slot does.
- *
- * Typical caller: the executor (e.g. the VS Code extension), right after
- * `Hub.attachParticipant`, on the `rootOverlay` returned from the attach
- * handle.
+ * Well-known `control.reason` strings. The set is **open** — any string
+ * is valid on the wire; these are the reasons linkrpc itself emits.
  */
-declare function registerIdentityOnOverlay(overlay: LinkRpcConnection, identity: Identity, storage?: ManagedIdentityStorageBackend): void;
+declare const StreamControlReason: {
+  /**
+   * The caller's transport dropped while the request was in flight; the
+   * hub cancels the callee's now-orphaned work.
+   */
+  readonly clientDisconnected: "clientDisconnected";
+  /**
+   * The request exceeded the hub's idle timeout with no stream activity
+   * (no ping, no stream message). See {@link STREAM_METHOD} docs.
+   */
+  readonly idleTimeout: "idleTimeout";
+};
+type StreamControlReason = (typeof StreamControlReason)[keyof typeof StreamControlReason];
 /**
- * Like {@link registerIdentityOnOverlay}, but resolves the identity lazily on
- * first use via `resolveIdentity`. The identity is materialized only when the
- * bound participant actually calls `identity::*` — registering the overlay
- * does NOT create or load any identity.
+ * Streaming sub-protocol. Long-running requests can emit additional
+ * notifications correlated with the original call in either direction
+ * (callee → caller progress, caller → callee input / cancellation /
+ * keepalive).
  *
- * This is essential for the consent model: a host can serve `identity::*` on a
- * keystore slot without making the slot privileged (`hasState`) until the app
- * genuinely opts into an identity. `resolveIdentity` is expected to be cheap on
- * repeat calls (the keystore caches in memory), and to reflect lifecycle
- * changes — e.g. after a slot is wiped and re-created ("Reset Identity"), the
- * next call resolves the fresh identity.
+ * Wire form: a JSON-RPC notification whose method is
+ * `${streamInterface.info.id}::send` and whose params match
+ * `streamInterface.members.send.paramsSchema`. The hub routes purely on
+ * `requestId` (following the originating request's established path, like
+ * a response); the originating request's capability authorization covers
+ * its full stream lifetime, so stream notifications carry no method /
+ * interface namespace of their own. App `payload` contents are typed per
+ * request via the originating method's
+ * `RequestType.clientStreamSchema` / `serverStreamSchema`; reserved
+ * `control` messages are schema-independent.
  *
- * `storage` is registered eagerly because reading/writing storage is itself
- * the privileged act the app must perform to gain state — exposing the
- * interface costs nothing until used.
- */
-declare function registerLazyIdentityOnOverlay(overlay: LinkRpcConnection<unknown>, resolveIdentity: () => Promise<Identity>, storage?: ManagedIdentityStorageBackend): void;
-/**
- * Client-side proxy for `identity.storage::*`. Methods round-trip through
- * the participant's root overlay; the executor enforces key-shape rules
- * server-side.
+ * Idle timeout: a request that never streams (no `control` ping, no
+ * stream message) is subject to the hub's per-request idle timeout
+ * (default 30 minutes) — at which point it is cancelled and its caller
+ * gets a `requestTimeout` error. This bounds the hub's pending-request
+ * table, which is also what protects it from a slow-loris / DDoS that
+ * opens requests and never completes them. Streaming-enabled calls keep
+ * themselves alive by emitting a periodic {@link StreamControlType.ping}.
  *
- * Calls are unsigned (same recursion-guard rationale as
- * {@link createManagedIdentity} — the overlay is private to one
- * participant, so transport-level routing already authenticates).
- */
-interface ManagedIdentityStorage {
-  get<T = unknown>(key: string): Promise<T | undefined>;
-  set(key: string, value: unknown): Promise<void>;
-  delete(key: string): Promise<boolean>;
-  list(prefix?: string): Promise<string[]>;
-}
-/**
- * A managed identity resolved from an executor's `identity::*` overlay: a
- * full {@link Identity} (signing + HPKE wrap/unwrap, all round-tripping
- * through the executor — private keys never leave it) plus the
- * per-identity {@link ManagedIdentityStorage}.
+ * The interface is declarative: nobody calls
+ * `LinkRpcConnection.register(streamInterface, ...)`. The channel and the
+ * hub intercept `$stream::send` directly. The definition exists so
+ * reflection / consent UIs can describe the wire shape and so all wire
+ * constants derive from one source.
  */
-interface ManagedIdentity extends Identity {
-  /**
-   * Per-identity persistent key/value store. Backed by the executor's
-   * `identity.storage::*` overlay; calls throw when the executor did not
-   * register storage for this slot (e.g. an in-process identity for tests).
-   */
-  readonly storage: ManagedIdentityStorage;
-}
+declare const streamInterface: InterfaceDefinition<{
+  send: NotificationType<{
+    requestId: string | number;
+    dir: "toCaller" | "toCallee";
+    control?: {
+      type: "cancel" | "ping" | "pong";
+      reason?: string | undefined;
+      nonce?: string | undefined;
+    } | undefined;
+    payload?: unknown;
+  }>;
+}>;
 /**
- * Bootstrap a {@link ManagedIdentity} from a sender (typically the raw
- * unsigned sender obtained via `channel.sender` before wrapping with
- * {@link SigningSender}). Makes `identity::*` calls unsigned — the
- * executor's overlay is private to one participant so routing already
- * identifies the caller, preventing signing recursion.
- *
- * The returned identity signs / wraps / unwraps by round-tripping through
- * the executor's `identity::*` overlay; the caller wires it into their
- * {@link SigningSender} configuration (e.g. as a {@link Principal}). No
- * side effects on any existing connection or holder.
+ * Full wire method name for stream notifications. Pulled from the
+ * interface object so we have a single source of truth.
  */
-declare function createManagedIdentity(sender: IRequestSender<unknown>): Promise<ManagedIdentity>;
+declare const STREAM_METHOD: `${string}::send`;
+/** Wire-level shape carried on `params` of {@link STREAM_METHOD}. */
+type StreamSendParams = output<typeof streamInterface.members.send.paramsSchema>;
 //#endregion
-//#region src/identity/capBag.d.ts
-interface CapBagOptions {
-  /**
-   * Per-identity persistent storage (e.g.
-   * {@link ManagedIdentityHandle.storage}). Omit for a memory-only bag
-   * that forgets its caps when the process exits.
-   */
-  readonly storage?: ManagedIdentityStorage;
-  /** Storage key. Defaults to `hubrpc.caps.v1`. */
-  readonly storageKey?: string;
-  /** Optional sink for non-fatal storage warnings. */
-  readonly onWarn?: (message: string) => void;
-}
+//#region src/protocol/jcs.d.ts
 /**
- * A process-lifetime bag of hub-issued capabilities. Plug
- * {@link CapBag.provider} straight into a connection's cap provider so every
- * outbound signed call carries whatever caps have been granted so far. The
- * hub picks whichever cap matches the call per dispatch.
+ * RFC 8785 JSON Canonicalization Scheme (JCS).
+ *
+ * Used as the byte-deterministic encoding under every linkrpc signature
+ * (RPC calls, capabilities, hub-signed previews). Both signer and verifier
+ * canonicalize the same value object and obtain byte-identical UTF-8 bytes.
  *
- * When constructed with {@link CapBagOptions.storage} the bag hydrates from
- * (and persists to) storage, so the next process spawn for the same identity
- * reuses its grants without re-prompting.
+ * Implementation inlined from the `canonicalize` npm package (Apache-2.0,
+ * https://github.com/erdtman/canonicalize) so this module stays
+ * zero-dependency for browser bundlers that don't resolve transitive
+ * npm specifiers (e.g. the in-house app-bundler).
  */
-declare class CapBag {
-  /** Create a bag, hydrating from storage when one was supplied. */
-  static load(options?: CapBagOptions): Promise<CapBag>;
-  private readonly _caps;
-  private readonly _storage?;
-  private readonly _storageKey;
-  private readonly _onWarn;
-  private constructor();
-  get capabilities(): readonly SignedCapability[];
-  /**
-   * A {@link CapProvider} reflecting the bag at call-time. Assign it to
-   * `HubClientHandle.signing.capProvider` or pass it through
-   * `SigningSenderConfig.capProvider`.
-   */
-  readonly provider: CapProvider;
-  /** Append capabilities and persist (when backed by storage). */
-  add(...caps: readonly SignedCapability[]): Promise<void>;
-  /** Drop all capabilities and persist the empty bag. */
-  clear(): Promise<void>;
-  private _hydrate;
-  private _persist;
-}
+/** RFC 8785 canonical JSON string for `value`. */
+declare function jcsCanonicalize(value: unknown): string;
+/** UTF-8 bytes of the RFC 8785 canonical JSON for `value`. The thing actually signed / hashed. */
+declare function jcsCanonicalizeBytes(value: unknown): Uint8Array;
 //#endregion
-//#region src/identity/principal.d.ts
+//#region src/protocol/methodName.d.ts
 /**
- * A signing identity bundled with its durable capability set. The
- * {@link SigningIdentity} is fixed for the life of the principal; the
- * {@link CapBag} is mutable and extensible — caps accumulate as the peer grants
- * them.
+ * Parsed JSON-RPC method string. The linkrpc dialect uses `::` to
+ * separate up to three segments:
  *
- * Transient, per-call (one-shot) grants are deliberately NOT part of a
- * principal: that is a separate policy, see `OneShotCapStaging`.
+ *   - `"member"`                         — bare (preset-bound dispatch)
+ *   - `"interfaceId::member"`            — interface form (root service)
+ *   - `"::interfaceId::member"`          — explicit root form
+ *   - `"serviceId::interfaceId::member"` — fully-qualified form
  *
- * Lives in its own module (rather than alongside `SigningSender`) so the
- * `SigningSender` ⇄ `createManagedPrincipal` factory cycle does not run through
- * a top-level `class … extends Principal`: such a cycle would hit a TDZ
- * ("Class extends value undefined") depending on module evaluation order.
+ * The hub does not accept the `bare` form (it has no interface context
+ * to route on). Connection-level dispatch accepts all three.
  */
-declare class Principal {
-  readonly identity: SigningIdentity;
-  readonly capBag: CapBag;
-  static create(identity: SigningIdentity, capabilities?: readonly SignedCapability[]): Promise<Principal>;
-  constructor(identity: SigningIdentity, capBag: CapBag);
-  get id(): PrincipalId;
-}
-//#endregion
-//#region src/identity/managedPrincipal.d.ts
+type ParsedMethodName = {
+  kind: "bare";
+  member: string;
+} | {
+  kind: "interface";
+  interfaceId: string;
+  member: string;
+} | {
+  kind: "full";
+  serviceId: string;
+  interfaceId: string;
+  member: string;
+};
 /**
- * A {@link Principal} that also exposes the executor-backed per-identity
- * {@link ManagedIdentityStorage}. Returned by {@link createManagedPrincipal}
- * so callers can persist their own app state (e.g. a resolved serviceId)
- * alongside the granted capabilities, using the very same durable store the
- * {@link CapBag} hydrates from — no second storage wiring required.
+ * Parse a JSON-RPC method string. Returns `undefined` if any segment is
+ * empty or the segment count is out of range.
  */
-declare class PrincipalWithStore extends Principal {
-  readonly store: ManagedIdentityStorage;
-  readonly identity: Identity;
-  constructor(identity: Identity, capBag: CapBag, store: ManagedIdentityStorage);
-}
+declare function parseMethodName(method: string): ParsedMethodName | undefined;
 /**
- * Executor-managed principal: the peer signs for us through its
- * `identity::sign` overlay (we never hold a private key). Bootstrapped purely
- * from the outbound `sender` — no side effects on any connection — and caps
- * persist in the executor-backed per-identity storage. Works over any
- * transport whose peer serves the identity overlay (hub *or* stdio).
- *
- * Call this exactly once per channel: it performs the `identity::*` handshake
- * and hydrates the {@link CapBag} from storage. The returned
- * {@link PrincipalWithStore} additionally surfaces that same durable
- * {@link ManagedIdentityStorage} as `store`.
+ * Convert a parsed method string to a {@link CallTarget} for capability
+ * matching. Interface-form calls are addressed to the root service —
+ * represented as an empty `serviceId`. Throws on `bare` form (no
+ * interface context) and on malformed input.
  */
-declare function createManagedPrincipal(sender: IRequestSender<unknown>): Promise<PrincipalWithStore>;
+declare function methodNameToTarget(method: string): CallTarget;
 //#endregion
-//#region src/identity/signingSender.d.ts
+//#region src/protocol/linkRpcEnvelope.d.ts
 /**
- * Per-outbound-call hook. Sees every signed call this sender makes,
- * and gets a chance to:
- *   - attach capabilities (the common case),
- *   - override `method` / `params` / `interfaceHash` (rewriting,
- *     auditing, schema-pinning),
- *   - advance `signedAtMs` (e.g. after a slow consent prompt that needs
- *     to issue a cap bound to a fresher timestamp than the sender's
- *     initial wall-clock).
+ * Signed call meta. Lives under `params.$hubrpc` so it can't collide with
+ * the user's top-level param keys. Present on signed AND unsigned calls
+ * (the latter omit {@link CallMeta.principal} and carry no `$hubrpcSignature`).
  *
- * `signer` and `nonce` are NOT overridable. `signer` is the call's
- * identity; `nonce` ties any cap to this specific call attempt and must
- * not drift between the cap-issuance request and the call itself.
+ * Included verbatim in the bytes a call signature commits to — the
+ * signature covers `signingInput("call", { ...userParams, $hubrpc })`.
  */
-type CapProvider = (req: {
+interface CallMeta {
+  /** Fully-qualified wire method. The verifier asserts it equals the JSON-RPC `method`. */
   readonly method: string;
-  readonly params: JsonValue | undefined;
-  readonly signer: PrincipalId;
+  /** Replay-protection nonce (base64url). The gate dedups on this. */
   readonly nonce: string;
+  /** Unix milliseconds. Skew window enforced by the verifier. */
   readonly signedAtMs: number;
+  /** Identity wielding the call. Present iff signed; equals the audience of every presented cap. */
+  readonly principal?: PrincipalId;
+  /** Optional schema hash assertion. Matched against `TargetPattern.interfaceHash`. */
   readonly interfaceHash?: string;
-}) => Promise<CapProviderResult>;
-interface CapProviderResult {
+}
+/**
+ * Extrinsic, unsigned attachments carried under `params.$hubrpcUnsigned`.
+ * Not covered by the call signature (they aren't authored by the signer).
+ */
+interface LinkRpcUnsigned {
+  /** Caller's presented capability bag. Parents are resolved out of this by hash. */
   readonly capabilities?: readonly SignedCapability[];
-  /** Override the wire method this sender signs. Default: the original. */
-  readonly method?: string;
-  /** Override the params this sender signs. Default: the original. */
-  readonly params?: JsonValue;
-  /** Override the interfaceHash baked into the signed envelope. */
-  readonly interfaceHash?: string;
-  /** Advance the Unix-ms timestamp baked into the signed envelope. */
-  readonly signedAtMs?: number;
+}
+/** Reserved wire-key meta carried on a linkrpc call's params object. */
+interface LinkRpcWireMeta {
+  readonly [HUBRPC_META_KEY]?: CallMeta;
+  readonly [HUBRPC_SIGNATURE_KEY]?: Signatures;
+  readonly [HUBRPC_UNSIGNED_KEY]?: LinkRpcUnsigned;
 }
 /**
- * Per-call ctx the {@link SigningSender} consumes. All fields are
- * optional; the sender's persistent {@link SigningSenderConfig.principal} is
- * the default.
+ * Wire shape of `params` on a linkrpc JSON-RPC call.
  *
- * To install a signer after the sender is already constructed (e.g. a
- * managed-identity bootstrap), mutate the caller-owned config object — it is
- * read fresh on every call. No setter on the sender itself.
+ * The user's params object (if any) is spread as-is, with the
+ * {@link LinkRpcWireMeta} keys attached on top. `TUserParams` carries the
+ * user-visible param shape; defaults to an open object. User params MUST be
+ * a plain object — enforced at signing/verification via
+ * {@link requireObjectParams}.
  */
-interface SigningCallCtx {
+type LinkRpcWireParams<TUserParams extends {
+  [key: string]: JsonValue | undefined;
+} = {
+  [key: string]: JsonValue | undefined;
+}> = TUserParams & LinkRpcWireMeta;
+/** JSON-RPC request whose `params` carry the linkrpc wire meta. */
+type LinkRpcJsonRpcRequest<TUserParams extends {
+  [key: string]: JsonValue | undefined;
+} = {
+  [key: string]: JsonValue | undefined;
+}> = JsonRpcRequest<LinkRpcWireParams<TUserParams>>;
+/** JSON-RPC notification whose `params` carry the linkrpc wire meta. */
+type LinkRpcJsonRpcNotification<TUserParams extends {
+  [key: string]: JsonValue | undefined;
+} = {
+  [key: string]: JsonValue | undefined;
+}> = JsonRpcNotification<LinkRpcWireParams<TUserParams>>;
+/** Either of the two linkrpc-bearing JSON-RPC message shapes. */
+type LinkRpcJsonRpcMessage<TUserParams extends {
+  [key: string]: JsonValue | undefined;
+} = {
+  [key: string]: JsonValue | undefined;
+}> = LinkRpcJsonRpcRequest<TUserParams> | LinkRpcJsonRpcNotification<TUserParams>;
+/**
+ * The linkrpc signing/cap system accepts only plain-object user params (or
+ * none). Reject arrays/primitives at the boundary so "strip `$hubrpc*`, the
+ * rest is the signed user params" stays unambiguous.
+ */
+declare function requireObjectParams(userParams: JsonValue | undefined): Record<string, JsonValue | undefined>;
+/**
+ * Return the application-authored portion of a LinkRPC params value.
+ *
+ * Routing and gate layers must continue forwarding the original wire params so
+ * every chained hub can independently verify the envelope. Terminal dispatch
+ * may use this derived value for application-schema validation without mutating
+ * or replacing the wire message.
+ */
+declare function stripLinkRpcWireMeta(wireParams: unknown): JsonValue | undefined;
+//#endregion
+//#region src/transport/multiplexedTransport.d.ts
+interface MuxEnvelope {
+  readonly $mux: "v1";
+  readonly ch: string;
+  readonly m: JsonRpcMessage;
+}
+declare class MultiplexedTransport<TChannels extends Record<string, string>> implements IDisposable {
+  static create<TChannels extends Record<string, string>>(base: IMessageTransport<MuxEnvelope, MuxEnvelope>, channels: TChannels): MultiplexedTransport<TChannels>;
+  /** Logical transports keyed by the friendly channel names. */
+  readonly transports: { readonly [K in keyof TChannels]: IMessageTransport; };
+  private readonly _base;
+  private readonly _byId;
+  private readonly _usedIds;
+  private _disposed;
+  constructor(base: IMessageTransport<MuxEnvelope, MuxEnvelope>, channels: TChannels);
   /**
-   * Override the signer for this call only. Pass `null` to skip
-   * signing entirely (plain unsigned JSON-RPC). Bootstrap flows that
-   * must talk to `identity::*` before a managed signer is available
-   * use `signerOverride: null` for those calls.
+   * Add a logical channel after the multiplexer has started.
+   *
+   * Channel ids are permanently retired when disposed. This prevents a late
+   * envelope for an old iframe from being delivered to a replacement iframe.
    */
-  readonly signerOverride?: SigningIdentity | null;
+  addChannel(id: string): IMessageTransport;
+  dispose(): void;
+  private _createChannel;
+}
+//#endregion
+//#region src/connection/bareInterfaceTarget.d.ts
+/** A metadata-free foreign-protocol interface and its wire-method prefix. */
+interface BareInterfaceTarget<TDef extends InterfaceDefinition<any>> {
+  readonly mode: 'bare';
+  readonly interface: TDef;
+  readonly prefix: string;
+}
+/**
+ * Bundle an interface definition with metadata-free foreign-protocol
+ * addressing for use with `connection.get(target)` or
+ * `connection.register(target, handlers)`.
+ */
+declare function bareInterfaceTarget<TDef extends InterfaceDefinition<any>>(iface: TDef, options?: {
+  readonly prefix?: string;
+}): BareInterfaceTarget<TDef>;
+//#endregion
+//#region src/connection/interfaceTarget.d.ts
+/** A qualified LinkRPC route. An empty serviceId addresses the root interface. */
+interface QualifiedInterfaceTarget<TDef extends InterfaceDefinition<any>> {
+  readonly mode: 'qualified';
+  readonly interface: TDef;
+  readonly serviceId: string;
+}
+/** The peer's preset form-1 route, retaining LinkRPC metadata and streaming. */
+interface DefaultInterfaceTarget<TDef extends InterfaceDefinition<any>> {
+  readonly mode: 'default';
+  readonly interface: TDef;
+}
+type InterfaceTarget<TDef extends InterfaceDefinition<any>> = QualifiedInterfaceTarget<TDef> | DefaultInterfaceTarget<TDef> | BareInterfaceTarget<TDef>;
+declare function interfaceTarget<TDef extends InterfaceDefinition<any>>(iface: TDef, options?: {
+  readonly serviceId?: string;
+}): QualifiedInterfaceTarget<TDef>;
+declare function defaultInterfaceTarget<TDef extends InterfaceDefinition<any>>(iface: TDef): DefaultInterfaceTarget<TDef>;
+declare function isInterfaceTarget<TDef extends InterfaceDefinition<any>>(value: TDef | InterfaceTarget<TDef>): value is InterfaceTarget<TDef>;
+//#endregion
+//#region src/connection/channelConnector.d.ts
+/**
+ * A raw channel that signals when it closes (and, when possible, can be torn
+ * down). Both {@link openHubChannel}'s `HubChannel` and `openStdioChannel`'s
+ * `StdioChannel` satisfy this shape.
+ */
+type ConnectableChannel = Channel<undefined, unknown> & {
   /**
-   * Replace whatever caps the persistent cap provider would attach.
-   * Skips the persistent provider for this call.
+   * Fires once when the channel closes. Returns a disposable to unsubscribe.
+   *
+   * Ordering contract: when a close causes a sending method (e.g. a request
+   * or notification) to reject/throw, {@link onClose} must fire *before* that
+   * rejection surfaces to the caller. This lets consumers reliably tell a
+   * close-induced failure (the channel is already observably closed) apart
+   * from a genuine error (the channel is still open). See
+   * {@link ChannelConnector.keepConnected}.
    */
-  readonly capsOverride?: readonly SignedCapability[];
+  onClose(listener: () => void): IDisposable;
+  /** Tear the channel down. Optional — stdio channels have no explicit close. */
+  close?(): void;
+};
+/** Handle returned by {@link ChannelConnector.keepConnected}. */
+interface KeepConnectedHandle {
   /**
-   * Reserved for the perm-denied / consent retry path. Currently a
-   * passthrough — sender does not act on it yet.
+   * Resolves when the loop exits: the channel closed and the connector does
+   * not redial, or {@link stop} (or the supplied signal) fired.
    */
-  readonly requestPermissionWhenDenied?: boolean;
+  readonly done: Promise<void>;
+  /** Stop redialing and close the current channel (if any). */
+  stop(): void;
+}
+/** Callback run on every (re)connect. The channel is the raw, unsigned channel. */
+type OnChannelConnect<T extends ConnectableChannel> = (ctx: {
+  channel: T;
+}) => void | Promise<void>;
+interface ExpBackoffOptions {
+  readonly initialBackoffMs?: number;
+  readonly maxBackoffMs?: number;
 }
 /**
- * Persistent config for a {@link SigningSender}.
+ * Drives a connect / (re)connect loop over a raw {@link ConnectableChannel}.
  *
- * `principal` is the call identity plus its durable, extensible capability
- * set. `oneShotCaps` is an optional side-policy that may stage a single-use
- * capability onto the very next call without touching the principal. Both
- * fields are read fresh on every call, so callers may install or swap them
- * after the sender has been constructed.
+ * Unlike connection-level helpers, this works at the channel layer: the
+ * caller composes identity / signing on top of the channel handed to
+ * {@link keepConnected} (e.g. `SigningSender.wrapChannel(channel, { principal })`).
  *
- * A missing `principal` means "no signing / no caps" for that call, unless
- * overridden via {@link SigningCallCtx}.
+ * Construct via {@link ChannelConnector.once} (a single, already-open channel
+ * that never redials) or {@link ChannelConnector.expBackoff} (re-open via a
+ * factory with exponential backoff after each close).
  */
-interface SigningSenderConfig {
-  /** Identity + persistent (extensible) capabilities. */
-  readonly principal?: Principal;
+declare class ChannelConnector<T extends ConnectableChannel> {
+  private readonly _open;
+  private readonly _redial;
+  private readonly _initialBackoffMs;
+  private readonly _maxBackoffMs;
+  private constructor();
   /**
-   * Optional per-call capability provider. Runs at sign-time with the
-   * concrete method/params/nonce/timestamp and may return caps and/or
-   * signing overrides.
+   * A connector over a single channel (or a promise of one). Never redials;
+   * the loop ends when the channel closes or {@link KeepConnectedHandle.stop}
+   * fires.
    */
-  readonly capProvider?: CapProvider;
+  static once<T extends ConnectableChannel>(channel: T | Promise<T>): ChannelConnector<T>;
   /**
-   * Optional one-shot capability staging policy. Independent of the
-   * principal; drained per outbound signed call.
+   * A redialing connector: `open` is called once per attempt, and the loop
+   * reconnects with exponential backoff after each close (or failed open).
    */
-  readonly oneShotCaps?: OneShotCapStaging;
+  static expBackoff<T extends ConnectableChannel>(open: () => Promise<T>, opts?: ExpBackoffOptions): ChannelConnector<T>;
+  /**
+   * Run `onConnect` on every (re)connect with the freshly opened channel.
+   * The callback typically wraps the channel with signing and registers
+   * handlers. Returns once the loop exits (see {@link KeepConnectedHandle}).
+   */
+  keepConnected(onConnect: OnChannelConnect<T>, opts?: {
+    signal?: AbortSignal;
+  }): KeepConnectedHandle;
+}
+//#endregion
+//#region src/connection/requestTimeout.d.ts
+declare const DEFAULT_RPC_TIMEOUT_MS = 5000;
+interface CancellableRequest<T> extends Promise<T> {
+  cancel(reason?: string): void | Promise<void>;
+  dispose?(reason?: string): void;
 }
+declare function withRpcTimeout<T>(request: CancellableRequest<T>, target: string, timeoutMs?: number): Promise<T>;
+//#endregion
+//#region src/connection/endpointUri.d.ts
 /**
- * Side-policy for staging *one-shot* capabilities onto the next outbound
- * signed call, independent of any {@link Principal}. The {@link SigningSender}
- * drains the staged caps after attaching them once, so a spent cap never
- * leaks into a later call.
+ * A strict, RFC-3986 URI vocabulary for "where the linkrpc server lives, and
+ * how to reach (or start) it". Every endpoint round-trips through
+ * {@link parseEndpointUri} / {@link formatEndpointUri} and is a valid `new URL()`
+ * — safe to put in env vars, logs, and config.
  *
- * Requesting the one-shot grant (prompting the user / hub) lives next to —
- * not inside — the principal: the principal owns identity and durable
- * capabilities; this owns the transient per-call grant.
+ * Supported schemes:
+ *   - `unix:/path/to.sock?token=…`           → {@link SocketEndpoint}
+ *   - `npipe://./pipe/name?token=…`          → {@link SocketEndpoint} (Windows)
+ *   - `ws://host:port?token=…` / `wss:…`     → {@link WsEndpoint} (LinkRPC handshake)
+ *   - `ws-no-init://host:port?…`             → {@link WsNoInitEndpoint}
+ *   - `cmd-stdio:?command=…` / `…?argv=…`    → {@link CmdStdioEndpoint}
+ *   - `cmd:?command=…` / `…?argv=…`          → {@link CmdEnvEndpoint}
+ *
+ * The command payload is `{ command: string } | { argv: string[] }`:
+ *   - `?command=node%20server.js` — one verbatim string, split by the OS shell.
+ *   - `?argv=node&argv=server.js` — repeated `argv` params, structure-preserving.
+ *
+ * A bare string with no scheme (legacy `LINKRPC_ENDPOINT`) is auto-detected: a
+ * `ws://`/`wss://` URL stays WebSocket, anything else is a socket path.
  */
-declare class OneShotCapStaging {
-  private _staged;
-  /** Stage caps for the next signed call. Replaces any still-pending caps. */
-  stage(caps: readonly SignedCapability[]): void;
+/** Verbatim command line (`{ command }`) or pre-split argv (`{ argv }`). */
+type EndpointCommand = {
+  readonly command: string;
+} | {
+  readonly argv: readonly string[];
+};
+/** Named pipe / unix-domain-socket the server already listens on. */
+interface SocketEndpoint {
+  readonly kind: 'socket';
+  readonly path: string;
+  readonly token?: string;
   /**
-   * Take (and clear) the staged caps. Called by {@link SigningSender} once
-   * per outbound signed call.
+   * Present on sockets created by `hub connect`. Local framing still uses the
+   * LinkRPC transport handshake; this describes whether forwarded application
+   * calls target a LinkRPC or plain JSON-RPC peer.
    */
-  take(): readonly SignedCapability[];
+  readonly brokerMode?: 'linkrpc' | 'raw';
+}
+/** A running WebSocket hub; `token` rides in the `hubrpc::initialize` handshake. */
+interface WsEndpoint {
+  readonly kind: 'ws';
+  readonly url: string;
+  readonly token?: string;
 }
 /**
- * Outbound sender decorator that wraps every call in a `$hubrpc` signed
- * envelope and (optionally) attaches capabilities. Stateless w.r.t. signing
- * config — the {@link Principal} and {@link OneShotCapStaging} are resolved
- * per-call from {@link SigningSenderConfig}, so the caller can install or
- * swap them after construction by mutating that object.
+ * A running plain-JSON-RPC WebSocket endpoint. Unlike {@link WsEndpoint}, CLI
+ * consumers use it without the `hubrpc::initialize` handshake or LinkRPC signing.
+ * Query parameters are preserved verbatim for protocols that authenticate
+ * during the WebSocket upgrade (for example AHP's `tkn` parameter).
  */
+interface WsNoInitEndpoint {
+  readonly kind: 'ws-no-init';
+  /** Actual `ws://` URL passed to the WebSocket constructor. */
+  readonly url: string;
+}
+/** Spawn a child and talk linkrpc over its stdin/stdout. */
+interface CmdStdioEndpoint {
+  readonly kind: 'cmd-stdio';
+  readonly command: EndpointCommand;
+  /** Extra environment variables injected into the spawned child. */
+  readonly env?: Readonly<Record<string, string>>;
+  /** Working directory for the spawned child. */
+  readonly cwd?: string;
+}
 /**
- * The result of {@link SigningSender.fromChannelWithManagedPrincipal} /
- * {@link SigningSender.fromTransportWithManagedPrincipal}: a signing
- * {@link Channel} ready for `LinkRpcConnection`, plus the executor-managed
- * {@link PrincipalWithStore} that drives it (caps, per-identity storage, nodeId).
+ * Spawn a child against a freshly-started *local hub*: the parent listens on a
+ * private socket, hands the child its address + token via `LINKRPC_ENDPOINT` /
+ * `LINKRPC_TOKEN`, and the child dials in as a hub participant (registering its
+ * services), exactly as it would against a remote hub.
  */
-interface ManagedSigningChannel<TInCtx = undefined> {
-  readonly channel: Channel<TInCtx, SigningCallCtx>;
-  readonly principal: PrincipalWithStore;
-}
-declare class SigningSender<TInCtx = unknown> implements IRequestSender<SigningCallCtx> {
-  private readonly _inner;
-  private readonly _config;
-  /**
-   * Wrap an inner channel with signing. Composes via {@link Channel.withSender}
-   * so the resulting `Channel<TInCtx, SigningCallCtx>` plugs into
-   * `LinkRpcConnection`.
-   */
-  static wrapChannel<TInCtx>(inner: Channel<TInCtx, unknown>, config: SigningSenderConfig): Channel<TInCtx, SigningCallCtx>;
-  /**
-   * Bootstrap an executor-managed {@link Principal} over the **unsigned**
-   * `channel`, then wrap that same channel with signing driven by it.
-   *
-   * Crucially, the `identity::*` handshake that mints the managed principal
-   * rides the *raw* channel (`channel.sender`), so those bootstrap calls are
-   * themselves never signed — there is no "sign the sign call" recursion and
-   * no reliance on threading `signerOverride: null` through every transport
-   * layer. The returned signing {@link Channel} is what callers hand to
-   * `LinkRpcConnection`; the {@link PrincipalWithStore} is returned alongside
-   * for caps / per-identity storage / nodeId.
-   */
-  static fromChannelWithManagedPrincipal<TInCtx>(channel: Channel<TInCtx, unknown>, config?: Omit<SigningSenderConfig, 'principal'>): Promise<ManagedSigningChannel<TInCtx>>;
+interface CmdEnvEndpoint {
+  readonly kind: 'cmd-env';
+  readonly command: EndpointCommand;
   /**
-   * Convenience over {@link fromChannelWithManagedPrincipal}: build the
-   * unsigned {@link JsonRpcChannel} from `transport` first. The common entry
-   * point for app hosts / services that own a raw {@link IMessageTransport}.
+   * When set, the local hub provisions (or reuses) a *persistent* managed
+   * identity under this slot id, so the child's HPKE wrap/unwrap keys survive
+   * across runs (sealed archives re-open).
    */
-  static fromTransportWithManagedPrincipal(transport: IMessageTransport, config?: Omit<SigningSenderConfig, 'principal'>): Promise<ManagedSigningChannel<undefined>>;
-  constructor(_inner: IRequestSender<unknown>, _config: SigningSenderConfig);
-  sendRequest(method: string, params: JsonValue | undefined, opts?: SendOpts<SigningCallCtx>): Promise<JsonValue>;
-  sendNotification(method: string, params: JsonValue | undefined, opts?: SendOpts<SigningCallCtx>): Promise<void>;
-  sendRequestWithStream(method: string, params: JsonValue | undefined, opts?: StreamSendOpts<SigningCallCtx>): RawStreamingCall;
-  close(): void;
-  private _prepareOutbound;
-  private _resolveSigner;
-  private _createSigningCoordinates;
-  private _resolveIntentAndCapabilities;
-  private _signPreparedCall;
+  readonly provisionSlot?: string;
+  /** Extra environment variables injected into the spawned child. */
+  readonly env?: Readonly<Record<string, string>>;
+  /** Working directory for the spawned child. */
+  readonly cwd?: string;
+}
+type ResolvedEndpoint = SocketEndpoint | WsEndpoint | WsNoInitEndpoint | CmdStdioEndpoint | CmdEnvEndpoint;
+/**
+ * Parse a strict endpoint URI into an {@link ResolvedEndpoint}. Throws on an
+ * unknown scheme or a malformed command endpoint. A bare (scheme-less) string
+ * is auto-detected as `ws`/`wss` URL or a socket path.
+ */
+declare function parseEndpointUri(uri: string): ResolvedEndpoint;
+interface FormatEndpointOptions {
+  /** Emit the real token instead of redacting it. Default: redact. */
+  readonly revealToken?: boolean;
 }
+/**
+ * Render an {@link ResolvedEndpoint} back to a canonical strict URI. The token is
+ * redacted (`***`) unless `revealToken` is set, so the result is paste-safe for
+ * logs. Round-trips with {@link parseEndpointUri} when `revealToken` is true.
+ */
+declare function formatEndpointUri(spec: ResolvedEndpoint, options?: FormatEndpointOptions): string;
+/** True for endpoints that connect to existing, possibly-remote infrastructure. */
+declare function isHubEndpoint(spec: ResolvedEndpoint): spec is SocketEndpoint | WsEndpoint;
 declare namespace crypto_d_exports {
   export { generateKeypair, generateX25519Keypair, hpkeOpen, hpkeSeal, keypairFromSeed, sha256, sign, verify, x25519KeypairFromSeed };
 }
@@ -3545,8 +4063,11 @@ declare class LinkRpcConnection<TInCtx = any, TOutCtx = any> {
   private readonly _directoryWatchers;
   private readonly _directoryListeners;
   private _inspection;
-  private _trafficInspector;
+  private _inspectionHost;
   private readonly _serviceInspectionRegistrations;
+  private readonly _wireObservers;
+  private readonly _closeListeners;
+  private _closed;
   private readonly _wireChannel;
   private readonly _validateOutboundParams;
   /** Bare-method bindings, keyed by their exact wire prefix. */
@@ -3559,35 +4080,31 @@ declare class LinkRpcConnection<TInCtx = any, TOutCtx = any> {
    * useful for bootstrap flows like `createManagedIdentity`).
    */
   constructor(channel: Channel<TInCtx, TOutCtx> | IRequestSender<TOutCtx>, options?: LinkRpcConnectionOptions);
-  /** Get a typed metadata-free client for a bundled bare interface target. */
-  get<TDef extends InterfaceDefinition<any>>(target: BareInterfaceTarget<TDef>): InterfaceClient<TDef>;
+  /** Get a typed client using a bundled qualified, default, or bare route. */
+  get<TDef extends InterfaceDefinition<any>>(target: InterfaceTarget<TDef>): InterfaceClient<TDef>;
   /** Get a typed client for `iface`, routed to the implicit (root) service. */
   get<TDef extends InterfaceDefinition<any>>(iface: TDef, opts?: GetOptions<TOutCtx>): InterfaceClient<TDef>;
+  private _getClient;
   /**
    * Get a typed client that emits foreign-protocol bare method names.
    * Unlike {@link get}, these calls carry no LinkRPC interface metadata.
    */
   getBare<TDef extends InterfaceDefinition<any>>(iface: TDef, opts?: BareGetOptions): InterfaceClient<TDef>;
+  private _buildBareClient;
+  /** Return request failures as values for a bundled qualified, default, or bare route. */
+  getResultClient<TDef extends InterfaceDefinition<any>>(target: InterfaceTarget<TDef>): InterfaceResultClient<TDef>;
+  /** Return application and generic request failures as values instead of throwing. */
+  getResultClient<TDef extends InterfaceDefinition<any>>(iface: TDef, opts?: GetOptions<TOutCtx>): InterfaceResultClient<TDef>;
   /** Get a service-scoped handle; all interfaces obtained from it route via `serviceId` (form 3). */
   service(serviceId: string): ServiceHandle<TInCtx, TOutCtx>;
-  /** Register handlers for an interface on this connection's server side. */
-  register<TDef extends InterfaceDefinition<any>>(iface: TDef, handlers: InterfaceHandlers<TDef, TInCtx>, opts?: RegisterOptions): InterfaceRegistration;
+  /** Register handlers, adding preset routing when passed a default or bare target. */
+  register<TDef extends InterfaceDefinition<any>>(ifaceOrTarget: TDef | InterfaceTarget<TDef>, handlers: InterfaceHandlers<TDef, TInCtx>, opts?: RegisterOptions): InterfaceRegistration;
+  /** Register inspection contracts without recursively enabling service inspection. */
+  registerInspection<TDef extends InterfaceDefinition<any>>(iface: TDef, handlers: InterfaceHandlers<TDef, TInCtx>, opts?: RegisterOptions): InterfaceRegistration;
+  /** Observe this connection without replacing another inspection scope's observer. */
+  observeWireMessages(observer: WireMessageObserver): InterfaceRegistration;
+  onDidClose(listener: () => void): InterfaceRegistration;
   private _register;
-  /**
-   * Declare the preset interface for form-1 (bare-method) dispatch. The
-   * interface must already be registered under the root (no serviceId).
-   * Surfaced via `hubrpc.defaults::get`.
-   */
-  setPreset(iface: InterfaceDefinition<any>): void;
-  /**
-   * Bind foreign-protocol bare methods to an already registered interface.
-   * Matching uses the longest prefix; once selected, a missing member does
-   * not fall through to a shorter binding.
-   */
-  bindBare(iface: InterfaceDefinition<any>, opts: {
-    prefix: string;
-    serviceId?: string;
-  }): InterfaceRegistration;
   /** Snapshot of every interface currently registered on this connection. */
   listRegisteredInterfaces(): readonly {
     readonly serviceId: string;
@@ -3640,8 +4157,6 @@ declare class LinkRpcConnection<TInCtx = any, TOutCtx = any> {
   private _installServiceInspection;
   private _removeServiceInspection;
   private _hasBusinessServiceRegistration;
-  private _endpointGraph;
-  private _watchTraffic;
 }
 /**
  * Options when obtaining a typed client for an interface.
@@ -3693,8 +4208,8 @@ interface InterfaceRegistration {
 /** Generated topology identity and its live root-interface registration. */
 interface InspectionRegistration extends InterfaceRegistration, NodeInfo {
   /**
-   * Observe this endpoint's full-payload traffic in-process. Wire observation
-   * remains disabled until either this or an RPC traffic watch is active.
+   * Observe this endpoint's full-payload traffic in-process. Watch-control
+   * flows are tracked even when no public observations are active.
    */
   observeTraffic(observer: (transit: TrafficTransitEvent) => void): InterfaceRegistration;
 }
@@ -3703,9 +4218,10 @@ declare class ServiceHandle<TInCtx = undefined, TOutCtx = undefined> {
   private readonly _connection;
   private readonly _serviceId;
   constructor(_connection: LinkRpcConnection<TInCtx, TOutCtx>, _serviceId: string);
+  getResultClient<TDef extends InterfaceDefinition<any>>(iface: TDef, opts?: Partial<TOutCtx>): InterfaceResultClient<TDef>;
   get<TDef extends InterfaceDefinition<any>>(iface: TDef, opts?: Partial<TOutCtx>): InterfaceClient<TDef>;
-  register<TDef extends InterfaceDefinition<any>>(iface: TDef, handlers: InterfaceHandlers<TDef, TInCtx>, opts?: Omit<RegisterOptions, 'serviceId'>): InterfaceRegistration;
+  register<TDef extends InterfaceDefinition<any>>(ifaceOrTarget: TDef | BareInterfaceTarget<TDef>, handlers: InterfaceHandlers<TDef, TInCtx>, opts?: Omit<RegisterOptions, 'serviceId'>): InterfaceRegistration;
 }
 //#endregion
-export { ManagedIdentityStorageBackend as $, RequestType as $i, signedHash as $n, zTopologyLinkEndpoint as $r, Result as $t, VerifyRpcCallResult as A, JsonRpcNotification as Aa, InterfaceHandlers as Ai, Capability as An, nodeInterface as Ar, WsNoInitEndpoint as At, OneShotCapStaging as B, defineInterface as Bi, permissionPermits as Bn, TopologyTransportInfo as Br, ExpBackoffOptions as Bt, VerifyCallOptions as C, SchemaBase as Ca, EXTENSION_PREFIX as Ci, ParsedMethodName as Cn, StreamControlReason as Cr, CmdEnvEndpoint as Ct, SignRpcCallOptions as D, ErrorCode as Da, InterfaceClient as Di, Call as Dn, streamInterface as Dr, ResolvedEndpoint as Dt, verifyCall as E, UnionSchema as Ea, CheckedCallResult as Ei, Ability as En, StreamSendParams as Er, FormatEndpointOptions as Et, identityStorageInterface as F, isNotification as Fa, MemberMap as Fi, TargetPattern as Fn, TopologyLink as Fr, DEFAULT_RPC_TIMEOUT_MS as Ft, createManagedPrincipal as G, ApplicationErrorValue as Gi, LINKRPC_META_KEY as Gn, TrafficWatchResult as Gr, Channel as Gt, SigningSender as H, ApplicationErrorDescriptor as Hi, HUBRPC_META_KEY as Hn, TrafficOverflowEvent as Hr, OnChannelConnect as Ht, crypto_d_exports as I, isRequest as Ia, RemoteRpcError as Ii, capabilityPermits as In, TopologyLinkEndpoint as Ir, withRpcTimeout as It, CapBagOptions as J, DeclaredApplicationErrorOf as Ji, SignDomain as Jn, zParticipantDescriptor as Jr, IRequestSender as Jt, Principal as K, ApplicationErrorsOf as Ki, LINKRPC_SIGNATURE_KEY as Kn, topologyInterface as Kr, ChannelTransport as Kt, CapProvider as L, isResponse as La, StreamApi as Li, hasSignedCapabilityShape as Ln, TopologyNode as Lr, JsonRpcChannel as Lt, signRpcCall as M, JsonRpcResponse as Ma, InterfaceMemberRef as Mi, Pattern as Mn, ParticipantDescriptorSource as Mr, isHubEndpoint as Mt, verifyRpcCall as N, JsonRpcSuccess as Na, InterfaceMemberRefMap as Ni, Permission as Nn, RouteClaim as Nr, parseEndpointUri as Nt, SignedRpcCall as O, JsonRpcError as Oa, InterfaceDefinition as Oi, CallBind as On, NodeInfo as Or, SocketEndpoint as Ot, identityInterface as P, RequestId as Pa, LocalRpcError as Pi, SignedCapability as Pn, TopologyGraph as Pr, CancellableRequest as Pt, ManagedIdentityStorage as Q, PublicApplicationErrorOf as Qi, readSignature as Qn, zTopologyLink as Qr, RawStreamingCall as Qt, CapProviderResult as R, JsonValue as Ra, StreamCallOptions as Ri, matchParams as Rn, TopologyPort as Rr, ChannelConnector as Rt, SignParamsOptions as S, RefSchema as Sa, normalizeJsonSchema as Si, stripLinkRpcWireMeta as Sn, STREAM_METHOD as Sr, WrappingIdentity as St, signParams as T, TupleSchema as Ta, CheckedCall as Ti, parseMethodName as Tn, StreamDir as Tr, EndpointCommand as Tt, SigningSenderConfig as U, ApplicationErrorDescriptorBase as Ui, HUBRPC_SIGNATURE_KEY as Un, TrafficTransitEndpoint as Ur, BareInterfaceTarget as Ut, SigningCallCtx as V, interfaceFromSchema as Vi, Base64Sha256 as Vn, TrafficEvent as Vr, KeepConnectedHandle as Vt, PrincipalWithStore as W, ApplicationErrorOf as Wi, HUBRPC_UNSIGNED_KEY as Wn, TrafficTransitEvent as Wr, bareInterfaceTarget as Wt, InMemoryManagedIdentityStorage as X, MemberType as Xi, Signatures as Xn, zRouteClaim as Xr, IncomingStream as Xt, InMemoryManagedIdentity as Y, MemberDocs as Yi, SignatureEnvelope as Yn, zParticipantDescriptorSource as Yr, IncomingCall as Yt, ManagedIdentity as Z, NotificationType as Zi, getKeyId as Zn, zTopologyGraph as Zr, MessageWithCtx as Zt, SeededPrincipalOptions as _, LinkRpcJsonSchema as _a, componentSchemaName as _i, LinkRpcJsonRpcRequest as _n, principalForPublicKey as _r, KeypairSigningIdentity as _t, LinkRpcConnection as a, requestType as aa, zTrafficOverflowEvent as ai, IMessageTransport as an, Keypair as ar, ParamMatcherFor as at, createSeededSigningIdentity as b, ObjectSchema as ba, isAssignable as bi, LinkRpcWireParams as bn, jcsCanonicalize as br, SerializedKeypairSigningIdentity as bt, ServiceHandle as c, LinkRpcInterfaceSchema as ca, zTrafficWatchResult as ci, MessageTransportWithContext as cn, PrivateKey as cr, capBagFreshAt as ct, ServiceIdPattern as d, ArraySchema as da, SchemaToZodContext as di, connectTransports as dn, Signature as dr, issueCapability as dt, Schema as ea, zTopologyNode as ei, RpcError as en, signingDomainValue as er, createManagedIdentity as et, defaultsInterface as f, BooleanSchema as fa, createSchemaToZod as fi, traceMessageTransport as fn, X25519Keypair as fr, permits as ft, zServiceIdPattern as g, IntegerSchema as ga, assertSchemaReferences as gi, LinkRpcJsonRpcNotification as gn, keyIdForPublicKey as gr, KeypairIdentity as gt, schemasInterface as h, EnumSchema as ha, materializeJsonSchema as hi, LinkRpcJsonRpcMessage as hn, keyIdForPrincipal as hr, Identity as ht, InterfaceRegistration as i, notificationType as ia, zTrafficEvent as ii, MuxEnvelope as in, KeyId as ir, IssueCapabilityOptions as it, attachCapabilities as j, JsonRpcRequest as ja, InterfaceInfo as ji, ParamMatcher as jn, ParticipantDescriptor as jr, formatEndpointUri as jt, VerifyRpcCallOptions as k, JsonRpcMessage as ka, InterfaceDefinitionOpts as ki, CallTarget as kn, TopologyIdGenerator as kr, WsEndpoint as kt, RootPrincipalReq as l, MemberAnnotations as la, GenerateInterfaceOptions as li, MessageWithContext as ln, PublicKey as lr, capabilityFreshAt as lt, directoryWatchNever as m, DiscriminatorSchema as ma, MaterializedJsonSchema as mi, CallMeta as mn, bytesToBase64Url as mr, signCapability as mt, GetOptions as n, applicationError as na, zTopologyTransportEndpoint as ni, StreamSendOpts as nn, withSignature as nr, registerLazyIdentityOnOverlay as nt, LinkRpcConnectionOptions as o, zodToSvcJsonSchema as oa, zTrafficTransitEndpoint as oi, MessageTransportDirection as on, PRINCIPAL_PREFIX as or, ParamMatchers as ot, directoryInterface as p, ConstSchema as pa, schemaToZod as pi, IDisposable as pn, base64UrlToBytes as pr, prefix as pt, CapBag as q, CreatedApplicationErrorValue as qi, LINKRPC_UNSIGNED_KEY as qn, trafficInterface as qr, IRequestHandler as qt, InspectionRegistration as r, isApplicationErrorValue as ra, zTopologyTransportInfo as ri, MultiplexedTransport as rn, KEY_ID_PREFIX as rr, AcceptedRootIssuer as rt, RegisterOptions as s, ErrorSchema as sa, zTrafficTransitEvent as si, MessageTransportTrace as sn, PrincipalId as sr, PermitResult as st, BareGetOptions as t, ZodToSvcJsonSchemaOptions as ta, zTopologyPort as ti, SendOpts as tn, signingInput as tr, registerIdentityOnOverlay as tt, RootPrincipalSet as u, MethodSchema as ua, generateTsInterface as ui, TransportPair as un, ResolveSigningKeyArgs as ur, invoke as ut, createMemoryPrincipal as v, NullSchema as va, componentSchemaRef as vi, LinkRpcUnsigned as vn, publicKeyForKeyId as vr, PublicSigningIdentity as vt, VerifyResult as w, StringSchema as wa, computeInterfaceHash as wi, methodNameToTarget as wn, StreamControlType as wr, CmdStdioEndpoint as wt, JsonObject as x, OneOfSchema as xa, matchesJsonSchema as xi, requireObjectParams as xn, jcsCanonicalizeBytes as xr, SigningIdentity as xt, createSeededMemoryPrincipal as y, NumberSchema as ya, Components as yi, LinkRpcWireMeta as yn, resolveSigningKey as yr, PublicWrappingIdentity as yt, ManagedSigningChannel as z, StreamingCall as zi, permissionMatchesTarget as zn, TopologyTransportEndpoint as zr, ConnectableChannel as zt };
-//# sourceMappingURL=linkRpcConnection-BadD37ok.d.ts.map
+export { ExpBackoffOptions as $, ZodToSvcJsonSchemaOptions as $a, createSchemaToZod as $i, InMemoryManagedIdentityStorage as $n, readSignature as $r, zParticipantDescriptorSource as $t, VerifyRpcCallResult as A, StreamingCall as Aa, RpcError as Ai, WalkHubResult as An, UnionSchema as Ao, CallTarget as Ar, StreamSendParams as At, FormatEndpointOptions as B, ApplicationErrorsOf as Ba, traceMessageTransport as Bi, CapProvider as Bn, isRequest as Bo, permissionMatchesTarget as Br, TopologyLinkEndpoint as Bt, VerifyCallOptions as C, InterfaceResultClient as Ca, IRequestHandler as Ci, HubDirectoryNodeState as Cn, NumberSchema as Co, PublicWrappingIdentity as Cr, parseMethodName as Ct, SignRpcCallOptions as D, RpcCallError as Da, MessageWithCtx as Di, ReflectionChannel as Dn, SchemaBase as Do, Ability as Dr, StreamControlReason as Dt, verifyCall as E, RemoteRpcError as Ea, IncomingStream as Ei, ListOptions as En, RefSchema as Eo, WrappingIdentity as Er, STREAM_METHOD as Et, identityStorageInterface as F, RpcValidationIssue as Fa, MessageTransportTrace as Fi, normalizeServiceIdScopes as Fn, JsonRpcRequest as Fo, SignedCapability as Fr, ParticipantDescriptor as Ft, formatEndpointUri as G, MemberType as Ga, StaticHubSchema as Gi, SigningSender as Gn, HUBRPC_UNSIGNED_KEY as Gr, TrafficEvent as Gt, SocketEndpoint as H, CreatedRpcErrorValue as Ha, GenerateContractOptions as Hi, ManagedSigningChannel as Hn, JsonValue as Ho, Base64Sha256 as Hr, TopologyPort as Ht, crypto_d_exports as I, ApplicationErrorDescriptor as Ia, MessageTransportWithContext as Ii, serviceIdMatchesPattern as In, JsonRpcResponse as Io, TargetPattern as Ir, ParticipantDescriptorSource as It, CancellableRequest as J, RequestType as Ja, StaticService as Ji, createManagedPrincipal as Jn, LINKRPC_UNSIGNED_KEY as Jr, TrafficTransitEvent as Jt, isHubEndpoint as K, NotificationType as Ka, StaticHubSchemaDocument as Ki, SigningSenderConfig as Kn, LINKRPC_META_KEY as Kr, TrafficOverflowEvent as Kt, CmdEnvEndpoint as L, ApplicationErrorDescriptorBase as La, MessageWithContext as Li, serviceIdMatchesScopes as Ln, JsonRpcSuccess as Lo, capabilityPermits as Lr, RouteClaim as Lt, signRpcCall as M, defineInterface as Ma, StreamSendOpts as Mi, fetchSchema as Mn, JsonRpcError as Mo, ParamMatcher as Mr, NodeInfo as Mt, verifyRpcCall as N, interfaceFromSchema as Na, IMessageTransport as Ni, findMethodInSchema as Nn, JsonRpcMessage as No, Pattern as Nr, TopologyIdGenerator as Nt, SignedRpcCall as O, StreamApi as Oa, RawStreamingCall as Oi, ServiceListing as On, StringSchema as Oo, Call as Or, StreamControlType as Ot, identityInterface as P, NonCompliantServerError as Pa, MessageTransportDirection as Pi, intersectServiceIdScopes as Pn, JsonRpcNotification as Po, Permission as Pr, nodeInterface as Pt, ConnectableChannel as Q, Schema as Qa, SchemaToZodContext as Qi, InMemoryManagedIdentity as Qn, getKeyId as Qr, zParticipantDescriptor as Qt, CmdStdioEndpoint as R, ApplicationErrorOf as Ra, TransportPair as Ri, walkHub as Rn, RequestId as Ro, hasSignedCapabilityShape as Rr, TopologyGraph as Rt, SignParamsOptions as S, InterfaceMemberRefMap as Sa, ChannelTransport as Si, HubDirectoryNodeReport as Sn, NullSchema as So, PublicSigningIdentity as Sr, methodNameToTarget as St, signParams as T, MemberMap as Ta, IncomingCall as Ti, InaccessibleDirectory as Tn, OneOfSchema as To, SigningIdentity as Tr, jcsCanonicalizeBytes as Tt, WsEndpoint as U, DeclaredApplicationErrorOf as Ua, generateTsContract as Ui, OneShotCapStaging as Un, HUBRPC_META_KEY as Ur, TopologyTransportEndpoint as Ut, ResolvedEndpoint as V, CreatedApplicationErrorValue as Va, IDisposable as Vi, CapProviderResult as Vn, isResponse as Vo, permissionPermits as Vr, TopologyNode as Vt, WsNoInitEndpoint as W, MemberDocs as Wa, InterfaceRef as Wi, SigningCallCtx as Wn, HUBRPC_SIGNATURE_KEY as Wr, TopologyTransportInfo as Wt, withRpcTimeout as X, RpcErrorDescriptor as Xa, GenerateInterfaceOptions as Xi, CapBag as Xn, SignatureEnvelope as Xr, topologyInterface as Xt, DEFAULT_RPC_TIMEOUT_MS as Y, RpcErrorBody as Ya, parseStaticHubSchema as Yi, Principal as Yn, SignDomain as Yr, TrafficWatchResult as Yt, ChannelConnector as Z, RpcErrorValue as Za, generateTsInterface as Zi, CapBagOptions as Zn, Signatures as Zr, trafficInterface as Zt, SeededPrincipalOptions as _, InterfaceDefinition as _a, keyIdForPublicKey as _i, HubDirectoryChange as _n, ConstSchema as _o, prefix as _r, LinkRpcWireMeta as _t, LinkRpcConnection as a, componentSchemaRef as aa, KeyId as ai, zTopologyPort as an, zodToSvcJsonSchema as ao, registerLazyIdentityOnOverlay as ar, defaultInterfaceTarget as at, createSeededSigningIdentity as b, InterfaceInfo as ba, resolveSigningKey as bi, HubDirectoryGraphSnapshot as bn, IntegerSchema as bo, KeypairIdentity as br, stripLinkRpcWireMeta as bt, ServiceHandle as c, matchesJsonSchema as ca, PrincipalId as ci, zTrafficEvent as cn, isRpcFailure as co, IssueCapabilityOptions as cr, BareInterfaceTarget as ct, ServiceIdPattern as d, EXTENSION_PREFIX as da, ResolveSigningKeyArgs as di, zTrafficTransitEvent as dn, LinkRpcInterfaceSchema as do, PermitResult as dr, MuxEnvelope as dt, schemaToZod as ea, signedHash as ei, zRouteClaim as en, applicationError as eo, ManagedIdentity as er, KeepConnectedHandle as et, defaultsInterface as f, computeInterfaceHash as fa, Signature as fi, zTrafficWatchResult as fn, MemberAnnotations as fo, capBagFreshAt as fr, CallMeta as ft, zServiceIdPattern as g, InterfaceClient as ga, keyIdForPrincipal as gi, DiscoveredListing as gn, BooleanSchema as go, permits as gr, LinkRpcUnsigned as gt, schemasInterface as h, GenericRpcError as ha, bytesToBase64Url as hi, DEFAULT_WALK_DEPTH as hn, ArraySchema as ho, issueCapability as hr, LinkRpcJsonRpcRequest as ht, InterfaceRegistration as i, componentSchemaName as ia, KEY_ID_PREFIX as ii, zTopologyNode as in, rpcError as io, registerIdentityOnOverlay as ir, QualifiedInterfaceTarget as it, attachCapabilities as j, TransportRpcError as ja, SendOpts as ji, fetchDirectory as jn, ErrorCode as jo, Capability as jr, streamInterface as jt, VerifyRpcCallOptions as k, StreamCallOptions as ka, Result as ki, WalkHubOptions as kn, TupleSchema as ko, CallBind as kr, StreamDir as kt, RootPrincipalReq as l, validateJsonSchema as la, PrivateKey as li, zTrafficOverflowEvent as ln, ErrorSchema as lo, ParamMatcherFor as lr, bareInterfaceTarget as lt, directoryWatchNever as m, CheckedCallResult as ma, base64UrlToBytes as mi, exportStaticHubSchema as mn, RawErrorSchema as mo, invoke as mr, LinkRpcJsonRpcNotification as mt, GetOptions as n, materializeJsonSchema as na, signingInput as ni, zTopologyLink as nn, notificationType as no, ManagedIdentityStorageBackend as nr, DefaultInterfaceTarget as nt, LinkRpcConnectionOptions as o, Components as oa, Keypair as oi, zTopologyTransportEndpoint as on, Result$1 as oo, JsonRpcChannel as or, interfaceTarget as ot, directoryInterface as p, CheckedCall as pa, X25519Keypair as pi, ExportStaticHubSchemaOptions as pn, MethodSchema as po, capabilityFreshAt as pr, LinkRpcJsonRpcMessage as pt, parseEndpointUri as q, PublicApplicationErrorOf as qa, StaticInterfaceReference as qi, PrincipalWithStore as qn, LINKRPC_SIGNATURE_KEY as qr, TrafficTransitEndpoint as qt, InspectionRegistration as r, assertSchemaReferences as ra, withSignature as ri, zTopologyLinkEndpoint as rn, requestType as ro, createManagedIdentity as rr, InterfaceTarget as rt, RegisterOptions as s, isAssignable as sa, PRINCIPAL_PREFIX as si, zTopologyTransportInfo as sn, RpcFailure as so, AcceptedRootIssuer as sr, isInterfaceTarget as st, BareGetOptions as t, MaterializedJsonSchema as ta, signingDomainValue as ti, zTopologyGraph as tn, isApplicationErrorValue as to, ManagedIdentityStorage as tr, OnChannelConnect as tt, RootPrincipalSet as u, normalizeJsonSchema as ua, PublicKey as ui, zTrafficTransitEndpoint as un, LegacyErrorSchema as uo, ParamMatchers as ur, MultiplexedTransport as ut, createMemoryPrincipal as v, InterfaceDefinitionOpts as va, principalForPublicKey as vi, HubDirectoryExplorer as vn, DiscriminatorSchema as vo, signCapability as vr, LinkRpcWireParams as vt, VerifyResult as w, LocalRpcError as wa, IRequestSender as wi, HubDirectoryParentReport as wn, ObjectSchema as wo, SerializedKeypairSigningIdentity as wr, jcsCanonicalize as wt, JsonObject as x, InterfaceMemberRef as xa, Channel as xi, HubDirectoryGraphTarget as xn, LinkRpcJsonSchema as xo, KeypairSigningIdentity as xr, ParsedMethodName as xt, createSeededMemoryPrincipal as y, InterfaceHandlers as ya, publicKeyForKeyId as yi, HubDirectoryGraphEvent as yn, EnumSchema as yo, Identity as yr, requireObjectParams as yt, EndpointCommand as z, ApplicationErrorValue as za, connectTransports as zi, walkHubDetailed as zn, isNotification as zo, matchParams as zr, TopologyLink as zt };
+//# sourceMappingURL=linkRpcConnection-Bbq20hQG.d.ts.map