@hediet/linkrpc 0.0.2 → 0.0.3-next.20260922.1

package/dist/chunks/{src-CAhXne71.js → src-DKjTceek.js}

@@ -3,9 +3,22 @@
 *  Licensed under the MIT License. See License.txt in the project root for license information.
 *--------------------------------------------------------------------------------------------*/
 import { t as __exportAll } from "./rolldown-runtime-4LSo1kEK.js";
-import { B as requestType, C as defineInterface, F as NotificationType, I as RequestType, M as sha256$1, N as jcsCanonicalize, P as jcsCanonicalizeBytes, R as isApplicationErrorValue, V as zodToSvcJsonSchema, a as topologyInterface, i as nodeInterface, o as trafficInterface, r as TrafficWatchFlowTracker, t as BoundedTrafficSubscription, z as notificationType } from "./boundedTrafficSubscription-XZ1KwXZC.js";
-import { array, boolean, enum as enum$1, int, nonnegative, number, object, optional, positive, string, union, unknown } from "zod/mini";
+import { $ as RequestType, F as principalForPublicKey, G as componentSchemaName, I as publicKeyForKeyId, J as computeInterfaceHash, L as resolveSigningKey, M as bytesToBase64Url, N as keyIdForPrincipal, Q as NotificationType, V as validateInterfaceErrors, X as jcsCanonicalize, Y as sha256$1, Z as jcsCanonicalizeBytes, c as StreamControlType, ct as jsonPointerSegment, d as nodeInterface, dt as isNotification, ft as isRequest, j as base64UrlToBytes$1, l as StreamDir, lt as brandApplicationError, mt as RpcFailure, o as STREAM_METHOD, ot as jsonIssues, pt as isResponse, rt as requestType, st as parseDeclaredErrorBody, t as InspectionHost, tt as isApplicationErrorValue, ut as ErrorCode, z as defineInterface } from "./inspectionHost-BIkLKvr1.js";
+import { array, boolean, int, nonnegative, number, object, optional, positive, string, union, unknown } from "zod/mini";
 import { safeParse } from "zod/v4/core";
+//#region src/connection/nonCompliantServerError.ts
+var NonCompliantServerError = class extends Error {
+	original;
+	issues;
+	kind = "nonCompliantServer";
+	constructor(original, issues) {
+		super(`Server error ${original.code} does not match its declared schema: ${issues.map((issue) => `${issue.path || "/"}: ${issue.message}`).join("; ")}`);
+		this.original = original;
+		this.issues = issues;
+		this.name = "NonCompliantServerError";
+	}
+};
+//#endregion
 //#region src/schema/assignability.ts
 /**
 * Structural subtype check: returns `true` iff every JSON value matching
@@ -22,6 +35,11 @@ function isAssignable(sub, sup, components = {}) {
 function matchesJsonSchema(value, schema, components = {}) {
 	return _matches(value, schema, components, /* @__PURE__ */ new Set());
 }
+function validateJsonSchema(value, schema, components = {}) {
+	const issues = [];
+	_matches(value, schema, components, /* @__PURE__ */ new Set(), issues);
+	return issues;
+}
 function _check(sub, sup, c, seen) {
 	if (sup === true) return true;
 	if (sub === false) return true;
@@ -118,49 +136,74 @@ function _restOf(s) {
 	}
 	return true;
 }
-function _matches(v, sup, c, seen) {
+function _matches(v, sup, c, seen, issues, path = "") {
+	const mismatch = (message) => {
+		issues?.push({
+			path,
+			message
+		});
+		return false;
+	};
 	if (sup === true) return true;
-	if (sup === false) return false;
+	if (sup === false) return mismatch("No value is allowed");
 	if (_isRef(sup)) {
-		if (seen.has(sup.$ref)) return false;
+		if (seen.has(sup.$ref)) return mismatch(`Unguarded recursive reference ${sup.$ref}`);
 		const r = _resolveRef(sup, c);
-		return r ? _matches(v, r, c, new Set(seen).add(sup.$ref)) : false;
+		return r === void 0 ? mismatch(`Unresolved reference ${sup.$ref}`) : _matches(v, r, c, new Set(seen).add(sup.$ref), issues, path);
+	}
+	const rawType = sup.type;
+	if (Array.isArray(rawType)) return _matches(v, { anyOf: rawType.map((type) => ({
+		...sup,
+		type
+	})) }, c, seen, issues, path);
+	if (_isUnion(sup)) {
+		const failures = issues === void 0 ? void 0 : [];
+		if (_branches(sup).some((branch) => _matches(v, branch, c, seen, failures, path))) return true;
+		if (failures?.length) issues?.push(...failures);
+		else mismatch("No union branch accepts this value");
+		return false;
 	}
-	if (_isUnion(sup)) return _branches(sup).some((b) => _matches(v, b, c, seen));
-	if (_isConst(sup)) return _jsonEq(v, sup.const);
-	if (_isEnum(sup)) return sup.enum.some((e) => _jsonEq(v, e));
+	if (_isConst(sup)) return _jsonEq(v, sup.const) || mismatch(`Expected ${JSON.stringify(sup.const)}`);
+	if (_isEnum(sup)) return sup.enum.some((e) => _jsonEq(v, e)) || mismatch(`Expected one of ${JSON.stringify(sup.enum)}`);
 	switch (sup.type) {
-		case "null": return v === null;
-		case "boolean": return typeof v === "boolean";
-		case "number": return typeof v === "number";
-		case "integer": return typeof v === "number" && Number.isInteger(v);
-		case "string": return typeof v === "string";
-		case "array": return Array.isArray(v) && _matchesArray(v, sup, c);
-		case "object": return v !== null && typeof v === "object" && !Array.isArray(v) && _matchesObject(v, sup, c);
-		default: return false;
+		case "null": return v === null || mismatch("Expected null");
+		case "boolean": return typeof v === "boolean" || mismatch("Expected boolean");
+		case "number": return typeof v === "number" || mismatch("Expected number");
+		case "integer": return typeof v === "number" && Number.isInteger(v) || mismatch("Expected integer");
+		case "string": return typeof v === "string" || mismatch("Expected string");
+		case "array": return Array.isArray(v) ? _matchesArray(v, sup, c, issues, path) : mismatch("Expected array");
+		case "object": return v !== null && typeof v === "object" && !Array.isArray(v) ? _matchesObject(v, sup, c, issues, path) : mismatch("Expected object");
+		default: return Object.keys(sup).every((key) => key === "title" || key === "description" || key.startsWith("x-")) || mismatch("Unsupported schema shape");
 	}
 }
-function _matchesArray(v, sup, c) {
+function _matchesArray(v, sup, c, issues, path = "") {
 	const prefix = sup.prefixItems ?? [];
 	const rest = _restOf(sup);
-	if (rest === false && v.length !== prefix.length) {
-		if (v.length > prefix.length) return false;
+	if (v.length < prefix.length || rest === false && v.length > prefix.length) {
+		issues?.push({
+			path,
+			message: rest === false ? `Expected ${prefix.length} items` : `Expected at least ${prefix.length} items`
+		});
+		return false;
 	}
+	let valid = true;
 	for (let i = 0; i < v.length; i++) {
 		const s = prefix[i] ?? (rest === false ? false : rest);
-		if (s === false) return false;
-		if (!_matches(v[i], s, c, /* @__PURE__ */ new Set())) return false;
+		if (!_matches(v[i], s, c, /* @__PURE__ */ new Set(), issues, `${path}/${i}`)) valid = false;
 	}
-	return true;
+	return valid;
 }
-function _matchesObject(v, sup, c) {
-	for (const k of sup.required ?? []) if (!Object.hasOwn(v, k)) return false;
-	for (const [k, val] of Object.entries(v)) {
-		const s = Object.hasOwn(sup.properties, k) ? sup.properties[k] : sup.additionalProperties;
-		if (s === false) return false;
-		if (!_matches(val, s, c, /* @__PURE__ */ new Set())) return false;
+function _matchesObject(v, sup, c, issues, path = "") {
+	let valid = true;
+	for (const k of sup.required ?? []) if (!Object.hasOwn(v, k)) {
+		issues?.push({
+			path: path + jsonPointerSegment(k),
+			message: "Required property is missing"
+		});
+		valid = false;
 	}
-	return true;
+	for (const [k, val] of Object.entries(v)) if (!_matches(val, Object.hasOwn(sup.properties, k) ? sup.properties[k] : sup.additionalProperties, c, /* @__PURE__ */ new Set(), issues, path + jsonPointerSegment(k))) valid = false;
+	return valid;
 }
 function _isBottom(s, c, seen) {
 	if (s === false) return true;
@@ -195,7 +238,7 @@ function _isEnum(s) {
 }
 function _resolveRef(r, c) {
 	if (!r.$ref.startsWith("#/components/schemas/")) return void 0;
-	const name = r.$ref.slice(21);
+	const name = componentSchemaName(r.$ref);
 	return c.schemas?.[name];
 }
 function _keyOf(s) {
@@ -311,22 +354,20 @@ function isRecord(value) {
 //#region src/connection/bareInterfaceTarget.ts
 /**
 * Bundle an interface definition with metadata-free foreign-protocol
-* addressing for use with `connection.get(target)`.
+* addressing for use with `connection.get(target)` or
+* `connection.register(target, handlers)`.
 */
 function bareInterfaceTarget(iface, options = {}) {
 	const prefix = options.prefix ?? "";
-	validateBarePrefix(prefix, "bareInterfaceTarget");
+	validateBarePrefix(prefix);
 	return Object.freeze({
 		mode: "bare",
 		interface: iface,
 		prefix
 	});
 }
-function isBareInterfaceTarget(value) {
-	return typeof value === "object" && value !== null && "mode" in value && value.mode === "bare" && "interface" in value && "prefix" in value;
-}
-function validateBarePrefix(prefix, api) {
-	if (prefix.includes("::") || !/^[\x20-\x7e]*$/.test(prefix)) throw new Error(`${api}: prefix must contain only printable ASCII and must not contain "::".`);
+function validateBarePrefix(prefix) {
+	if (prefix.includes("::") || !/^[\x20-\x7e]*$/.test(prefix)) throw new Error("Bare interface prefix must contain only printable ASCII and must not contain \"::\".");
 }
 //#endregion
 //#region src/schema/codegen/utils/codeWriter.ts
@@ -395,18 +436,21 @@ var CodeWriter = class {
 * components receive explicit payload types; other types remain Zod-inferred.
 */
 function generateTsInterface(schema, options = {}) {
-	_validateErrors(schema.methods);
+	validateInterfaceErrors(schema);
 	const linkRpcImport = options.linkRpcImport ?? "@hediet/linkrpc";
 	const exportName = options.exportName ?? _deriveExportName(schema.id);
 	const preserveWireSchema = options.preserveWireSchema ?? false;
-	if (options.bareTarget !== void 0) validateBarePrefix(options.bareTarget.prefix, "bareInterfaceTarget");
+	if (options.bareTarget !== void 0) validateBarePrefix(options.bareTarget.prefix);
 	const w = new CodeWriter();
 	const bareTargetImport = options.bareTarget === void 0 ? "" : "bareInterfaceTarget, ";
 	const errorImport = Object.values(schema.methods).some((method) => (method.errors?.length ?? 0) > 0) ? "applicationError, " : "";
+	const rawErrorImport = Object.values(schema.methods).some((method) => method.errors?.some((error) => error.schema !== void 0)) ? "rpcError, " : "";
 	const definitionImport = preserveWireSchema ? `${errorImport}${bareTargetImport}InterfaceDefinition, notificationType, requestType, type LinkRpcInterfaceSchema` : `${errorImport}${bareTargetImport}defineInterface, notificationType, requestType`;
-	w.writeLine(`import { ${definitionImport} } from "${linkRpcImport}";`);
-	w.writeLine(`import { z } from "zod";`);
-	w.writeLine();
+	if (!options.omitImports) {
+		w.writeLine(`import { ${rawErrorImport}${definitionImport} } from "${linkRpcImport}";`);
+		w.writeLine(`import { z } from "zod";`);
+		w.writeLine();
+	}
 	const componentSchemas = schema.components?.schemas ?? {};
 	const cyclicComponents = _findCyclicComponents(componentSchemas);
 	const componentNames = _allocateComponentNames(componentSchemas);
@@ -550,11 +594,18 @@ function _writeMethod(w, method, components, preserveWireSchema) {
 		w.append(".withErrors([").newline();
 		w.indent();
 		for (const error of method.errors) {
-			w.append(`applicationError(${error.code}, ${JSON.stringify(error.message)}`);
+			if (error.schema !== void 0) {
+				w.append(`rpcError(${error.code}, `);
+				_writeSchema(w, error.schema, components, preserveWireSchema);
+				w.append("),").newline();
+				continue;
+			}
+			w.append(error.type === void 0 ? `applicationError(${error.code}, ${JSON.stringify(error.message)}` : `applicationError(${JSON.stringify(error.type)}, { code: ${error.code}, message: ${JSON.stringify(error.message)}`);
 			if (error.data !== void 0) {
-				w.append(", ");
+				w.append(error.type === void 0 ? ", " : ", data: ");
 				_writeSchema(w, error.data, components, preserveWireSchema);
 			}
+			if (error.type !== void 0) w.append(" }");
 			w.append("),").newline();
 		}
 		w.dedent();
@@ -577,19 +628,6 @@ function _writeMethod(w, method, components, preserveWireSchema) {
 		w.append("})");
 	}
 }
-function _validateErrors(methods) {
-	for (const [name, method] of Object.entries(methods)) {
-		if (method.result === void 0 && method.errors !== void 0) throw new Error(`generateInterface: notification "${name}" cannot declare errors`);
-		const seen = /* @__PURE__ */ new Set();
-		for (const error of method.errors ?? []) {
-			if (typeof error.message !== "string") throw new Error(`generateInterface: error message on "${name}" is not a string`);
-			if (!Number.isInteger(error.code) || error.code < -2147483648 || error.code > 2147483647) throw new Error(`generateInterface: error code ${error.code} on "${name}" is not a signed i32`);
-			if (error.code >= -32768 && error.code <= -32e3 || error.code === -32800) throw new Error(`generateInterface: error code ${error.code} on "${name}" is reserved`);
-			if (seen.has(error.code)) throw new Error(`generateInterface: duplicate error code ${error.code} on "${name}"`);
-			seen.add(error.code);
-		}
-	}
-}
 function _collectMemberDocs(method) {
 	const docs = {};
 	if (method.description !== void 0) docs.description = method.description;
@@ -934,8 +972,7 @@ function _jsonLiteral(value) {
 	return JSON.stringify(value);
 }
 function _parseRef(ref) {
-	if (!ref.startsWith("#/components/schemas/")) throw new Error(`generateInterface: unsupported $ref "${ref}"`);
-	return ref.slice(21);
+	return componentSchemaName(ref);
 }
 function _toComponentVar(name) {
 	return _toIdentifier(name) + "Schema";
@@ -1061,6 +1098,372 @@ function _deriveExportName(id) {
 	return parts[0].toLowerCase() + parts.slice(1).map((p) => p[0].toUpperCase() + p.slice(1).toLowerCase()).join("") + "Interface";
 }
 //#endregion
+//#region src/schema/staticHubSchema.ts
+function parseStaticHubSchema(value) {
+	const root = expectRecord(value, "hub schema");
+	const rawServices = root.services === void 0 ? [] : expectArray(root.services, "services");
+	const interfaceSchemas = expectArray(root.interfaceSchemas, "interfaceSchemas").map((schema, index) => parseInterfaceSchema(schema, `interfaceSchemas[${index}]`));
+	const schemasByKey = /* @__PURE__ */ new Map();
+	for (const schema of interfaceSchemas) {
+		const key = interfaceKey(schema.id, schema.hash);
+		if (schemasByKey.has(key)) throw new Error(`interfaceSchemas contains duplicate ${schema.id}@${schema.hash}`);
+		schemasByKey.set(key, schema);
+	}
+	const services = rawServices.map((service, index) => parseService(service, `services[${index}]`));
+	const serviceIds = /* @__PURE__ */ new Set();
+	for (const [serviceIndex, service] of services.entries()) {
+		if (serviceIds.has(service.serviceId)) throw new Error(`Duplicate serviceId '${service.serviceId}'`);
+		serviceIds.add(service.serviceId);
+		const interfaceIds = /* @__PURE__ */ new Set();
+		for (const [interfaceIndex, ref] of service.interfaces.entries()) {
+			if (interfaceIds.has(ref.interfaceId)) throw new Error(`Duplicate interface '${ref.interfaceId}' in service '${service.serviceId}'`);
+			interfaceIds.add(ref.interfaceId);
+			requireResolvedReference(ref, schemasByKey, `services[${serviceIndex}].interfaces[${interfaceIndex}]`);
+		}
+	}
+	const defaultInterface = root.defaultInterface === void 0 ? void 0 : parseInterfaceReference(root.defaultInterface, "defaultInterface");
+	if (defaultInterface !== void 0) {
+		requireResolvedReference(defaultInterface, schemasByKey, "defaultInterface");
+		const rootInterface = services.find((service) => service.serviceId === "")?.interfaces.find((ref) => ref.interfaceId === defaultInterface.interfaceId);
+		if (rootInterface !== void 0 && rootInterface.interfaceHash !== defaultInterface.interfaceHash) throw new Error(`defaultInterface conflicts with root '${defaultInterface.interfaceId}'`);
+	}
+	const prefixes = /* @__PURE__ */ new Set();
+	const bareInterfaces = root.bareInterfaces === void 0 ? void 0 : expectArray(root.bareInterfaces, "bareInterfaces").map((value, index) => {
+		const path = `bareInterfaces[${index}]`;
+		const binding = expectRecord(value, path);
+		if (typeof binding.prefix !== "string") throw new Error(`${path}.prefix must be a string`);
+		validateBarePrefix(binding.prefix);
+		if (prefixes.has(binding.prefix)) throw new Error(`Duplicate bare prefix '${binding.prefix}'`);
+		prefixes.add(binding.prefix);
+		const ref = parseInterfaceReference(binding.interface, `${path}.interface`);
+		requireResolvedReference(ref, schemasByKey, `${path}.interface`);
+		if (binding.prefix === "" && defaultInterface !== void 0 && interfaceKey(ref.interfaceId, ref.interfaceHash) !== interfaceKey(defaultInterface.interfaceId, defaultInterface.interfaceHash)) throw new Error("Empty bare prefix conflicts with defaultInterface");
+		return {
+			interface: ref,
+			prefix: binding.prefix
+		};
+	});
+	return {
+		...root.services === void 0 ? {} : { services },
+		...defaultInterface === void 0 ? {} : { defaultInterface },
+		...bareInterfaces === void 0 ? {} : { bareInterfaces },
+		interfaceSchemas
+	};
+}
+function parseService(value, path) {
+	const service = expectRecord(value, path);
+	if (typeof service.serviceId !== "string") throw new Error(`${path}.serviceId must be a string`);
+	if (service.serviceId.includes("::") || !/^[\x20-\x7e]*$/.test(service.serviceId)) throw new Error(`${path}.serviceId must be printable ASCII without "::"`);
+	return {
+		serviceId: service.serviceId,
+		interfaces: expectArray(service.interfaces, `${path}.interfaces`).map((ref, index) => parseInterfaceReference(ref, `${path}.interfaces[${index}]`))
+	};
+}
+function parseInterfaceReference(value, path) {
+	const ref = expectRecord(value, path);
+	if (typeof ref.interfaceId !== "string" || ref.interfaceId.length === 0) throw new Error(`${path}.interfaceId must be a non-empty string`);
+	if (typeof ref.interfaceHash !== "string" || ref.interfaceHash.length === 0) throw new Error(`${path}.interfaceHash must be a non-empty string`);
+	return {
+		interfaceId: ref.interfaceId,
+		interfaceHash: ref.interfaceHash
+	};
+}
+function parseInterfaceSchema(value, path) {
+	const schema = expectRecord(value, path);
+	if (typeof schema.id !== "string" || schema.id.length === 0) throw new Error(`${path}.id must be a non-empty string`);
+	if (typeof schema.hash !== "string" || schema.hash.length === 0) throw new Error(`${path}.hash must be a non-empty string`);
+	if (typeof schema.methods !== "object" || schema.methods === null || Array.isArray(schema.methods)) throw new Error(`${path}.methods must be an object`);
+	for (const [name, method] of Object.entries(schema.methods)) {
+		if (name.length === 0) throw new Error(`${path}.methods keys must be non-empty strings`);
+		const parsed = expectRecord(method, `${path}.methods.${name}`);
+		if (!Object.hasOwn(parsed, "params")) throw new Error(`${path}.methods.${name}.params is required`);
+	}
+	const typed = schema;
+	validateInterfaceErrors(typed);
+	const computedHash = computeInterfaceHash(typed);
+	if (computedHash !== typed.hash) throw new Error(`${path} hash mismatch for ${typed.id}: declared ${typed.hash}, computed ${computedHash}`);
+	return typed;
+}
+function requireResolvedReference(ref, schemasByKey, path) {
+	if (!schemasByKey.has(interfaceKey(ref.interfaceId, ref.interfaceHash))) throw new Error(`${path} ${formatReference(ref)} does not resolve to an interface schema`);
+}
+function formatReference(ref) {
+	return `${ref.interfaceId}@${ref.interfaceHash}`;
+}
+function interfaceKey(interfaceId, interfaceHash) {
+	return `${interfaceId}\0${interfaceHash}`;
+}
+function expectRecord(value, path) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`${path} must be an object`);
+	return value;
+}
+function expectArray(value, path) {
+	if (!Array.isArray(value)) throw new Error(`${path} must be an array`);
+	return value;
+}
+//#endregion
+//#region src/schema/codegen/generateTsContract.ts
+/** Generate one reusable definition per schema and immutable, typed route descriptors. */
+function generateTsContract(document, options = {}) {
+	const contract = parseStaticHubSchema(document);
+	const imports = options.linkRpcImport ?? "@hediet/linkrpc";
+	const chunks = [
+		`import { applicationError, rpcError, bareInterfaceTarget, defaultInterfaceTarget, interfaceTarget, InterfaceDefinition, notificationType, requestType, type BareInterfaceTarget, type DefaultInterfaceTarget, type QualifiedInterfaceTarget, type LinkRpcInterfaceSchema } from ${JSON.stringify(imports)};`,
+		"import { z } from \"zod\";",
+		""
+	];
+	const names = /* @__PURE__ */ new Set([
+		"applicationError",
+		"rpcError",
+		"bareInterfaceTarget",
+		"defaultInterfaceTarget",
+		"interfaceTarget",
+		"InterfaceDefinition",
+		"notificationType",
+		"requestType",
+		"LinkRpcInterfaceSchema",
+		"z",
+		"BareInterfaceTarget",
+		"DefaultInterfaceTarget",
+		"QualifiedInterfaceTarget"
+	]);
+	const usedInterfaceKeys = /* @__PURE__ */ new Set();
+	const usedBindingKeys = /* @__PURE__ */ new Set();
+	const definitionNames = /* @__PURE__ */ new Map();
+	function allocate(name, key) {
+		if (!/^[$A-Z_a-z][$\w]*$/.test(name) || reservedWords.has(name) || name.startsWith("$contract")) throw new Error(`Invalid TypeScript export name '${name}' for '${key}'`);
+		if (names.has(name)) throw new Error(`Generated name '${name}' collides for '${key}'; provide explicit naming overrides`);
+		names.add(name);
+		return name;
+	}
+	const schemas = [...contract.interfaceSchemas].sort((a, b) => compare(`${a.id}@${a.hash}`, `${b.id}@${b.hash}`));
+	for (const [index, schema] of schemas.entries()) {
+		const key = `${schema.id}@${schema.hash}`;
+		usedInterfaceKeys.add(key);
+		const name = allocate(options.interfaceNames?.[key] ?? `${identifier(schema.id)}Interface`, key);
+		definitionNames.set(key, name);
+		const source = generateTsInterface(schema, {
+			exportName: "definition",
+			preserveWireSchema: true,
+			omitImports: true
+		});
+		chunks.push(`namespace $contract${index} {`, source.trimEnd().split("\n").map((line) => `    ${line}`).join("\n"), "}");
+		chunks.push(`export const ${name}: typeof $contract${index}.definition = $contract${index}.definition;`, "");
+	}
+	function binding(ref, key, derived, type, expression) {
+		usedBindingKeys.add(key);
+		const name = allocate(options.bindingNames?.[key] ?? derived, key);
+		const definition = definitionNames.get(`${ref.interfaceId}@${ref.interfaceHash}`);
+		chunks.push(`export const ${name}: ${type}<typeof ${definition}> = ${expression(definition)};`);
+	}
+	for (const service of [...contract.services ?? []].sort((a, b) => compare(a.serviceId, b.serviceId))) for (const ref of [...service.interfaces].sort((a, b) => compare(a.interfaceId, b.interfaceId))) {
+		const key = `${ref.interfaceId}@${ref.interfaceHash}`;
+		const base = identifier(ref.interfaceId);
+		binding(ref, service.serviceId === "" ? `root:${key}` : `service:${service.serviceId}:${key}`, service.serviceId === "" ? `${base}Root` : `${identifier(service.serviceId)}${upper(base)}Service`, "QualifiedInterfaceTarget", (name) => `interfaceTarget(${name}, { serviceId: ${JSON.stringify(service.serviceId)} })`);
+	}
+	if (contract.defaultInterface) binding(contract.defaultInterface, "default", `${identifier(contract.defaultInterface.interfaceId)}Default`, "DefaultInterfaceTarget", (name) => `defaultInterfaceTarget(${name})`);
+	for (const bare of [...contract.bareInterfaces ?? []].sort((a, b) => compare(a.prefix, b.prefix))) binding(bare.interface, `bare:${bare.prefix}`, `${identifier(bare.prefix || bare.interface.interfaceId)}Bare`, "BareInterfaceTarget", (name) => `bareInterfaceTarget(${name}, { prefix: ${JSON.stringify(bare.prefix)} })`);
+	for (const [overrides, used] of [[options.interfaceNames, usedInterfaceKeys], [options.bindingNames, usedBindingKeys]]) for (const key of Object.keys(overrides ?? {})) if (!used.has(key)) throw new Error(`Unknown naming override '${key}'`);
+	return `${chunks.join("\n")}\n`;
+}
+function identifier(value) {
+	const name = value.split(/[^A-Za-z0-9_$]+/).filter(Boolean).map((word, index) => index === 0 ? word[0].toLowerCase() + word.slice(1) : upper(word)).join("") || "interface";
+	return /^[0-9]/.test(name) ? `_${name}` : name;
+}
+function upper(value) {
+	return value[0].toUpperCase() + value.slice(1);
+}
+function compare(a, b) {
+	return a < b ? -1 : a > b ? 1 : 0;
+}
+const reservedWords = new Set("break case catch class const continue debugger default delete do else enum export extends false finally for function if import in instanceof new null return super switch this throw true try typeof var void while with implements interface let package private protected public static yield await".split(" "));
+//#endregion
+//#region src/protocol/methodName.ts
+/**
+* Parse a JSON-RPC method string. Returns `undefined` if any segment is
+* empty or the segment count is out of range.
+*/
+function parseMethodName(method) {
+	const parts = method.split("::");
+	if (parts.length === 3 && parts[0].length === 0 && parts[1].length > 0 && parts[2].length > 0) return {
+		kind: "interface",
+		interfaceId: parts[1],
+		member: parts[2]
+	};
+	if (parts.some((p) => p.length === 0)) return void 0;
+	if (parts.length === 1) return {
+		kind: "bare",
+		member: parts[0]
+	};
+	if (parts.length === 2) return {
+		kind: "interface",
+		interfaceId: parts[0],
+		member: parts[1]
+	};
+	if (parts.length === 3) return {
+		kind: "full",
+		serviceId: parts[0],
+		interfaceId: parts[1],
+		member: parts[2]
+	};
+}
+/**
+* Convert a parsed method string to a {@link CallTarget} for capability
+* matching. Interface-form calls are addressed to the root service —
+* represented as an empty `serviceId`. Throws on `bare` form (no
+* interface context) and on malformed input.
+*/
+function methodNameToTarget(method) {
+	const p = parseMethodName(method);
+	if (!p) throw new Error(`linkrpc: malformed method: ${method}`);
+	if (p.kind === "bare") throw new Error(`linkrpc: bare method has no interface context: ${method}`);
+	if (p.kind === "interface") return {
+		serviceId: "",
+		interfaceId: p.interfaceId,
+		member: p.member
+	};
+	return {
+		serviceId: p.serviceId,
+		interfaceId: p.interfaceId,
+		member: p.member
+	};
+}
+//#endregion
+//#region src/protocol/signedObject.ts
+/**
+* The HubRPC **signed-object** standard: one rule for committing a
+* signature (and a content hash) over any JSON object.
+*
+* > The signature `obj.$hubrpcSignature[domain]` covers
+* > `jcs({ [domainValue(domain)]: obj without $hubrpcSignature and $hubrpcUnsigned })`.
+*
+* Both reserved keys are stripped before canonicalization — on **every**
+* object, call or capability alike:
+*
+*  - {@link HUBRPC_SIGNATURE_KEY} (`$hubrpcSignature`) holds the signature
+*    itself (a domain-keyed map of `{ keyId, sig }` entries). It can't sign
+*    itself, so it's excluded.
+*  - {@link HUBRPC_UNSIGNED_KEY} (`$hubrpcUnsigned`) holds extrinsic
+*    *attachments* (e.g. the presented capability bag) authored by someone
+*    other than this signer, so it's excluded too.
+*
+* Domain separation is intrinsic: the per-domain {@link signingDomainValue}
+* is the sole key of the canonicalized wrapper object. A `"call"` signature
+* can therefore never verify as a `"capability"` (or vice-versa). The domain
+* is *supplied by context* by signer and verifier;
+* the on-wire `$hubrpcSignature` key is a convenience index, never a trust
+* claim.
+*
+* This module is pure (no private keys, no `crypto.verify`): it only defines
+* the canonical bytes. Signing/verifying live in `../identity/signedObject`.
+*/
+/** Reserved wire-key: the signature map `{ [domain]: SignatureEnvelope }`. */
+const HUBRPC_SIGNATURE_KEY = "$hubrpcSignature";
+/** Reserved wire-key: extrinsic unsigned attachments (e.g. the capability bag). */
+const HUBRPC_UNSIGNED_KEY = "$hubrpcUnsigned";
+/** Reserved wire-key: signed call meta, present only on calls (dodges the JSON-RPC param namespace). */
+const HUBRPC_META_KEY = "$hubrpc";
+/** @deprecated Use {@link HUBRPC_SIGNATURE_KEY}. */
+const LINKRPC_SIGNATURE_KEY = HUBRPC_SIGNATURE_KEY;
+/** @deprecated Use {@link HUBRPC_UNSIGNED_KEY}. */
+const LINKRPC_UNSIGNED_KEY = HUBRPC_UNSIGNED_KEY;
+/** @deprecated Use {@link HUBRPC_META_KEY}. */
+const LINKRPC_META_KEY = HUBRPC_META_KEY;
+/**
+* The domain-separation key. It includes the frozen signature-suite version
+* and becomes the sole key of the object passed to JCS.
+*/
+function signingDomainValue(domain) {
+	return `hubrpc-sig/v1/${domain}`;
+}
+/**
+* THE bytes a signature commits to (and a content hash hashes) for `obj` in
+* `domain`: `jcs({ [domainValue(domain)]: obj minus the two reserved keys })`.
+*/
+function signingInput(domain, obj) {
+	const signed = { ...obj };
+	delete signed[HUBRPC_SIGNATURE_KEY];
+	delete signed[HUBRPC_UNSIGNED_KEY];
+	return jcsCanonicalizeBytes({ [signingDomainValue(domain)]: signed });
+}
+/**
+* Content identity of a signed object: `base64url(sha256(signingInput(...)))`.
+* The single operation behind both a capability's `callBind.payloadHash`
+* (domain `"call"`) and a child capability's `parentHash` (domain
+* `"capability"`).
+*/
+function signedHash(domain, obj) {
+	return bytesToBase64Url(sha256$1(signingInput(domain, obj)));
+}
+/** Read the signature envelope for `domain` off an object's `$hubrpcSignature` map. */
+function readSignature(obj, domain) {
+	const sigs = obj[HUBRPC_SIGNATURE_KEY];
+	if (sigs === null || typeof sigs !== "object") return void 0;
+	const entry = sigs[domain];
+	if (entry === null || typeof entry !== "object") return void 0;
+	const { keyId, sig } = entry;
+	if (typeof keyId !== "string" || typeof sig !== "string") return void 0;
+	return {
+		keyId,
+		sig
+	};
+}
+/** The {@link KeyId} the signer used for `domain` (the unsigned routing hint), if any. */
+function getKeyId(obj, domain) {
+	return readSignature(obj, domain)?.keyId;
+}
+/**
+* Return a copy of `obj` with `$hubrpcSignature[domain]` set to `envelope`,
+* preserving any sibling-domain signatures already present.
+*/
+function withSignature(obj, domain, envelope) {
+	const prev = obj[HUBRPC_SIGNATURE_KEY];
+	return {
+		...obj,
+		[HUBRPC_SIGNATURE_KEY]: {
+			...prev,
+			[domain]: envelope
+		}
+	};
+}
+//#endregion
+//#region src/protocol/linkRpcEnvelope.ts
+/**
+* The linkrpc signing/cap system accepts only plain-object user params (or
+* none). Reject arrays/primitives at the boundary so "strip `$hubrpc*`, the
+* rest is the signed user params" stays unambiguous.
+*/
+function requireObjectParams(userParams) {
+	if (userParams === void 0) return {};
+	if (userParams === null || typeof userParams !== "object" || Array.isArray(userParams)) throw new Error("linkrpc: user params must be a plain JSON object or undefined");
+	return userParams;
+}
+/**
+* Return the application-authored portion of a LinkRPC params value.
+*
+* Routing and gate layers must continue forwarding the original wire params so
+* every chained hub can independently verify the envelope. Terminal dispatch
+* may use this derived value for application-schema validation without mutating
+* or replacing the wire message.
+*/
+function stripLinkRpcWireMeta(wireParams) {
+	if (wireParams === void 0) return void 0;
+	if (wireParams === null || typeof wireParams !== "object" || Array.isArray(wireParams)) return wireParams;
+	const object = wireParams;
+	const reserved = [
+		HUBRPC_META_KEY,
+		HUBRPC_SIGNATURE_KEY,
+		HUBRPC_UNSIGNED_KEY
+	];
+	if (!reserved.some((key) => key in object)) return object;
+	const userParams = {};
+	for (const key of Object.keys(object)) {
+		if (reserved.includes(key)) continue;
+		userParams[key] = object[key];
+	}
+	return userParams;
+}
+//#endregion
 //#region src/hub/common/reflection.interfaces.ts
 const defaultsInterface = defineInterface({
 	id: "hubrpc.defaults",
@@ -1194,1106 +1597,251 @@ const schemasInterface = defineInterface({
 /** A full `SvcInterfaceSchema`. */
 schema: unknown() })) });
 //#endregion
-//#region src/connection/streaming.ts
-/**
-* Direction a {@link STREAM_METHOD} message travels, relative to the
-* request it is correlated with. Made explicit on the wire so that a
-* middlebox (the hub) can *author* a stream message — e.g. inject a
-* cancel when a caller disconnects — without an inbound message whose
-* arrival link it could infer the direction from.
-*/
-const StreamDir = {
-	/** callee → caller: progress, partial results. Routes like a response. */
-	toCaller: "toCaller",
-	/** caller → callee: input, cancellation, keepalive ping. */
-	toCallee: "toCallee"
-};
-/**
-* Reserved control verbs. A control message carries no app `payload`; it
-* is interpreted by the runtime / hub itself, independently of the
-* originating method's stream schemas, so *any* request is cancellable
-* and keep-alive-able even when it declares no app stream.
-*/
-const StreamControlType = {
-	/**
-	* Ask the callee to abort the in-flight request. Always {@link
-	* StreamDir.toCallee}. The callee surfaces this as an `AbortSignal`
-	* and is expected to settle the request (typically with a
-	* `cancelled` error response).
-	*/
-	cancel: "cancel",
-	/**
-	* Keepalive / liveness probe. Resets the hub's per-request idle timer
-	* so a long-running call is not reaped, and lets either side actively
-	* probe the peer. Carries a `nonce` the peer echoes in its {@link
-	* StreamControlType.pong}. May travel in either direction. Emitted
-	* automatically (without awaiting a pong) by the channel for streaming
-	* calls; see {@link STREAM_METHOD}.
-	*/
-	ping: "ping",
-	/**
-	* Reply to a {@link StreamControlType.ping}, echoing the ping's
-	* `nonce` so the prober can correlate it. Travels opposite the ping.
-	* Carries no app effect — purely a liveness acknowledgement.
-	*/
-	pong: "pong"
-};
-/**
-* Well-known `control.reason` strings. The set is **open** — any string
-* is valid on the wire; these are the reasons linkrpc itself emits.
-*/
-const StreamControlReason = {
-	/**
-	* The caller's transport dropped while the request was in flight; the
-	* hub cancels the callee's now-orphaned work.
-	*/
-	clientDisconnected: "clientDisconnected",
-	/**
-	* The request exceeded the hub's idle timeout with no stream activity
-	* (no ping, no stream message). See {@link STREAM_METHOD} docs.
-	*/
-	idleTimeout: "idleTimeout"
-};
-/**
-* Streaming sub-protocol. Long-running requests can emit additional
-* notifications correlated with the original call in either direction
-* (callee → caller progress, caller → callee input / cancellation /
-* keepalive).
-*
-* Wire form: a JSON-RPC notification whose method is
-* `${streamInterface.info.id}::send` and whose params match
-* `streamInterface.members.send.paramsSchema`. The hub routes purely on
-* `requestId` (following the originating request's established path, like
-* a response); the originating request's capability authorization covers
-* its full stream lifetime, so stream notifications carry no method /
-* interface namespace of their own. App `payload` contents are typed per
-* request via the originating method's
-* `RequestType.clientStreamSchema` / `serverStreamSchema`; reserved
-* `control` messages are schema-independent.
-*
-* Idle timeout: a request that never streams (no `control` ping, no
-* stream message) is subject to the hub's per-request idle timeout
-* (default 30 minutes) — at which point it is cancelled and its caller
-* gets a `requestTimeout` error. This bounds the hub's pending-request
-* table, which is also what protects it from a slow-loris / DDoS that
-* opens requests and never completes them. Streaming-enabled calls keep
-* themselves alive by emitting a periodic {@link StreamControlType.ping}.
-*
-* The interface is declarative: nobody calls
-* `LinkRpcConnection.register(streamInterface, ...)`. The channel and the
-* hub intercept `$stream::send` directly. The definition exists so
-* reflection / consent UIs can describe the wire shape and so all wire
-* constants derive from one source.
-*/
-const streamInterface = defineInterface({
-	id: "$stream",
-	description: "Reserved sub-protocol for in-flight stream messages correlated to a request by `requestId`."
-}, { send: notificationType(object({
-	/**
-	* Id of the in-flight request the message belongs to.
-	* The hub rewrites this across the forwarding boundary
-	* in the same way it rewrites response ids.
-	*/
-	requestId: union([number(), string()]),
-	/**
-	* Which way this message travels relative to the request.
-	* Explicit so the hub can author messages (e.g. cancel on
-	* disconnect) without inferring direction from arrival.
-	*/
-	dir: enum$1(["toCaller", "toCallee"]),
-	/**
-	* Reserved control verb (cancel / ping / pong). Mutually
-	* exclusive with `payload` in practice: a control message
-	* is interpreted by the runtime, not the application.
-	*/
-	control: optional(object({
-		type: enum$1([
-			"cancel",
-			"ping",
-			"pong"
-		]),
-		/** Open-set human/diagnostic reason; see {@link StreamControlReason}. */
-		reason: optional(string()),
-		/**
-		* Correlation token. A `ping` carries a fresh nonce;
-		* the matching `pong` echoes it back so the prober
-		* can resolve the right outstanding probe.
-		*/
-		nonce: optional(string())
-	})),
-	/** Opaque app payload — typed per call by the request's stream schema. */
-	payload: optional(unknown())
-}), { description: "Emit a stream message tied to the request `requestId`." }) });
-/**
-* Full wire method name for stream notifications. Pulled from the
-* interface object so we have a single source of truth.
-*/
-const STREAM_METHOD = `${streamInterface.info.id}::send`;
-//#endregion
-//#region src/protocol/jsonRpc.ts
-const ErrorCode = {
-	parseError: -32700,
-	invalidRequest: -32600,
-	methodNotFound: -32601,
-	invalidParams: -32602,
-	internalError: -32603,
-	/** Caller is authenticated but lacks a capability covering the call. */
-	permissionRequired: -32401,
-	/** The peer a request was routed to detached before it could respond. */
-	peerDisconnected: -32402,
-	/** The request exceeded the hub's idle timeout with no stream activity. */
-	requestTimeout: -32403,
-	/** The request was cancelled (by the caller, or by the hub on disconnect). */
-	cancelled: -32800
-};
-function isRequest(m) {
-	return typeof m.method === "string" && m.id !== void 0;
-}
-function isNotification(m) {
-	return typeof m.method === "string" && m.id === void 0;
-}
-function isResponse(m) {
-	return typeof m.method !== "string";
-}
-//#endregion
-//#region src/crypto/cryptoProvider.ts
-const _b64UrlAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-const _b64UrlReverse = (() => {
-	const m = {};
-	for (let i = 0; i < 64; i++) m[_b64UrlAlphabet[i]] = i;
-	return m;
-})();
-function bytesToBase64Url(bytes) {
-	let out = "";
-	let i = 0;
-	for (; i + 3 <= bytes.length; i += 3) {
-		const n = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
-		out += _b64UrlAlphabet[n >> 18 & 63] + _b64UrlAlphabet[n >> 12 & 63] + _b64UrlAlphabet[n >> 6 & 63] + _b64UrlAlphabet[n & 63];
-	}
-	const rem = bytes.length - i;
-	if (rem === 1) {
-		const n = bytes[i] << 16;
-		out += _b64UrlAlphabet[n >> 18 & 63] + _b64UrlAlphabet[n >> 12 & 63];
-	} else if (rem === 2) {
-		const n = bytes[i] << 16 | bytes[i + 1] << 8;
-		out += _b64UrlAlphabet[n >> 18 & 63] + _b64UrlAlphabet[n >> 12 & 63] + _b64UrlAlphabet[n >> 6 & 63];
+//#region src/connection/requestTimeout.ts
+const DEFAULT_RPC_TIMEOUT_MS = 5e3;
+async function withRpcTimeout(request, target, timeoutMs = DEFAULT_RPC_TIMEOUT_MS) {
+	if (timeoutMs <= 0) return request;
+	let timer;
+	const timeout = new Promise((_resolve, reject) => {
+		timer = setTimeout(() => {
+			const reason = `${target} timed out after ${timeoutMs}ms`;
+			try {
+				Promise.resolve(request.cancel(reason)).catch(() => {});
+			} finally {
+				try {
+					request.dispose?.(reason);
+				} catch {}
+			}
+			reject(new Error(reason));
+		}, timeoutMs);
+	});
+	try {
+		return await Promise.race([request, timeout]);
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
 	}
-	return out;
 }
-function base64UrlToBytes$1(s) {
-	const len = s.length;
-	const fullGroups = Math.floor(len / 4);
-	const rem = len % 4;
-	if (rem === 1) throw new Error("base64UrlToBytes: invalid length");
-	const outLen = fullGroups * 3 + (rem === 0 ? 0 : rem - 1);
-	const out = new Uint8Array(outLen);
-	let oi = 0;
-	let i = 0;
-	for (let g = 0; g < fullGroups; g++, i += 4) {
-		const n = _lookup(s, i) << 18 | _lookup(s, i + 1) << 12 | _lookup(s, i + 2) << 6 | _lookup(s, i + 3);
-		out[oi++] = n >> 16 & 255;
-		out[oi++] = n >> 8 & 255;
-		out[oi++] = n & 255;
-	}
-	if (rem === 2) {
-		const n = _lookup(s, i) << 18 | _lookup(s, i + 1) << 12;
-		out[oi++] = n >> 16 & 255;
-	} else if (rem === 3) {
-		const n = _lookup(s, i) << 18 | _lookup(s, i + 1) << 12 | _lookup(s, i + 2) << 6;
-		out[oi++] = n >> 16 & 255;
-		out[oi++] = n >> 8 & 255;
+//#endregion
+//#region src/hub/common/directoryWalk.ts
+async function fetchDirectory(channel, opts = {}) {
+	const method = opts.target ? `${opts.target}::hubrpc.directory::list` : "hubrpc.directory::list";
+	const all = [];
+	let cursor;
+	while (true) {
+		const params = {};
+		if (opts.interfaceId !== void 0) params.interfaceId = opts.interfaceId;
+		if (opts.interfaceIdPrefix !== void 0) params.interfaceIdPrefix = opts.interfaceIdPrefix;
+		if (opts.serviceId !== void 0) params.serviceId = opts.serviceId;
+		if (opts.serviceIdScopes !== void 0) params.serviceIdScopes = [...opts.serviceIdScopes];
+		if (opts.limit !== void 0) params.limit = opts.limit;
+		if (opts.timeoutMs !== void 0) params.timeoutMs = opts.timeoutMs;
+		if (cursor !== void 0) params.cursor = cursor;
+		const call = channel.sendRequestWithStream(method, params, { interfaceHash: directoryInterface.schemaHash });
+		const target = opts.target ?? "<root>";
+		const page = await withRpcTimeout(Object.assign(call.result, {
+			cancel: (reason) => call.cancel(reason),
+			dispose: (reason) => call.dispose?.(reason)
+		}), `hub directory service '${target}'`, opts.timeoutMs ?? 5e3);
+		for (const it of page.items) all.push({
+			serviceId: it.serviceId,
+			interfaceId: it.interfaceId,
+			hash: it.interfaceHash,
+			...it.path !== void 0 ? { path: it.path } : {},
+			...it.serviceDescription !== void 0 ? { serviceDescription: it.serviceDescription } : {},
+			...Array.isArray(it.rootPrincipalSets) ? { rootPrincipalSets: it.rootPrincipalSets } : {},
+			...Array.isArray(it.reachableServiceIds) ? { reachableServiceIds: it.reachableServiceIds } : {}
+		});
+		if (!page.nextCursor) break;
+		cursor = page.nextCursor;
 	}
-	return out;
+	return all;
 }
-function _lookup(s, i) {
-	const v = _b64UrlReverse[s[i]];
-	if (v === void 0) throw new Error(`base64UrlToBytes: invalid char at ${i}`);
-	return v;
+async function fetchSchema(channel, interfaceId, hash, target) {
+	const method = target ? `${target}::hubrpc.schemas::get` : "hubrpc.schemas::get";
+	const params = { interfaceId };
+	if (hash !== void 0) params.hash = hash;
+	return (await channel.sendRequest(method, params)).schema;
 }
-/** Role-tag prefix on a {@link KeyId}'s inline-key form. */
-const KEY_ID_PREFIX = "key:";
-/** Role-tag prefix that wraps a genesis {@link KeyId} into a {@link PrincipalId}. */
-const PRINCIPAL_PREFIX = "id:";
-/** The inline {@link KeyId} for a raw public key: `"key:" + b64url(pk)`. */
-function keyIdForPublicKey(pk) {
-	return KEY_ID_PREFIX + bytesToBase64Url(pk);
+function findMethodInSchema(schema, methodName) {
+	return schema.methods[methodName];
 }
-/** The perpetual {@link PrincipalId} for a raw public key: `"id:key:" + b64url(pk)`. */
-function principalForPublicKey(pk) {
-	return "id:" + keyIdForPublicKey(pk);
+/** Default recursion depth when walking the bus. */
+const DEFAULT_WALK_DEPTH = 5;
+const DIRECTORY_INTERFACE_ID = "hubrpc.directory";
+const ROOT_NODE_KEY = "\0root";
+/** Segment-aware service-id pattern matching (`foo` includes `foo/bar`, not `foobar`). */
+function serviceIdMatchesPattern(serviceId, pattern) {
+	if ("exact" in pattern) return serviceId === pattern.exact;
+	return pattern.prefix === "" || serviceId === pattern.prefix || serviceId.startsWith(`${pattern.prefix}/`);
 }
-/**
-* The genesis {@link KeyId} embedded in a perpetual {@link PrincipalId}
-* (`"id:" + keyId`). Throws if `principal` is not a well-formed `id:` name.
-*/
-function keyIdForPrincipal(principal) {
-	if (!principal.startsWith("id:")) throw new Error(`malformed principal (missing "id:" prefix): ${principal}`);
-	return principal.slice(3);
+/** Whether a service id is included by a union of patterns. `undefined` means unfiltered. */
+function serviceIdMatchesScopes(serviceId, scopes) {
+	return scopes === void 0 || scopes.some((pattern) => serviceIdMatchesPattern(serviceId, pattern));
 }
-/**
-* The raw public key carried inline by a `"key:"` {@link KeyId}. Throws on a
-* missing prefix or malformed base64url.
-*/
-function publicKeyForKeyId(keyId) {
-	if (!keyId.startsWith("key:")) throw new Error(`unsupported keyId (expected "${KEY_ID_PREFIX}" prefix): ${keyId}`);
-	return base64UrlToBytes$1(keyId.slice(4));
+/** Canonicalize a pattern union by removing duplicates and contained patterns. */
+function normalizeServiceIdScopes(scopes) {
+	const unique = /* @__PURE__ */ new Map();
+	for (const pattern of scopes) unique.set(patternKey(pattern), pattern);
+	const patterns = [...unique.values()];
+	return patterns.filter((candidate, index) => !patterns.some((other, otherIndex) => index !== otherIndex && patternContains(other, candidate))).sort((a, b) => patternKey(a).localeCompare(patternKey(b)));
 }
-/**
-* Resolve the verifying public key for `(principal, keyId)`, or `undefined`
-* to **reject** (fail closed). This is the single seam every verifier goes
-* through, replacing the old "the id *is* the key" decode.
-*
-* Phase 1 supports only inline genesis keys: the `keyId` must be a `"key:"`
-* form and the principal must be exactly `"id:" + keyId` (genesis
-* self-certification by string equality). `keydoc:`/rotation forms resolve
-* through `bindings`/`timeMs` later and are intentionally not handled here.
-*/
-function resolveSigningKey(args) {
-	const { principal, keyId } = args;
-	if (!keyId.startsWith("key:")) return;
-	if ("id:" + keyId !== principal) return;
-	try {
-		return { publicKey: base64UrlToBytes$1(keyId.slice(4)) };
-	} catch {
-		return;
+/** Pairwise intersection of two pattern unions. */
+function intersectServiceIdScopes(left, right) {
+	const intersections = [];
+	for (const a of left) for (const b of right) {
+		const intersection = intersectPattern(a, b);
+		if (intersection !== void 0) intersections.push(intersection);
 	}
+	return normalizeServiceIdScopes(intersections);
 }
-//#endregion
-//#region src/protocol/signedObject.ts
-/**
-* The HubRPC **signed-object** standard: one rule for committing a
-* signature (and a content hash) over any JSON object.
-*
-* > The signature `obj.$hubrpcSignature[domain]` covers
-* > `jcs({ [domainValue(domain)]: obj without $hubrpcSignature and $hubrpcUnsigned })`.
-*
-* Both reserved keys are stripped before canonicalization — on **every**
-* object, call or capability alike:
-*
-*  - {@link HUBRPC_SIGNATURE_KEY} (`$hubrpcSignature`) holds the signature
-*    itself (a domain-keyed map of `{ keyId, sig }` entries). It can't sign
-*    itself, so it's excluded.
-*  - {@link HUBRPC_UNSIGNED_KEY} (`$hubrpcUnsigned`) holds extrinsic
-*    *attachments* (e.g. the presented capability bag) authored by someone
-*    other than this signer, so it's excluded too.
-*
-* Domain separation is intrinsic: the per-domain {@link signingDomainValue}
-* is the sole key of the canonicalized wrapper object. A `"call"` signature
-* can therefore never verify as a `"capability"` (or vice-versa). The domain
-* is *supplied by context* by signer and verifier;
-* the on-wire `$hubrpcSignature` key is a convenience index, never a trust
-* claim.
-*
-* This module is pure (no private keys, no `crypto.verify`): it only defines
-* the canonical bytes. Signing/verifying live in `../identity/signedObject`.
-*/
-/** Reserved wire-key: the signature map `{ [domain]: SignatureEnvelope }`. */
-const HUBRPC_SIGNATURE_KEY = "$hubrpcSignature";
-/** Reserved wire-key: extrinsic unsigned attachments (e.g. the capability bag). */
-const HUBRPC_UNSIGNED_KEY = "$hubrpcUnsigned";
-/** Reserved wire-key: signed call meta, present only on calls (dodges the JSON-RPC param namespace). */
-const HUBRPC_META_KEY = "$hubrpc";
-/** @deprecated Use {@link HUBRPC_SIGNATURE_KEY}. */
-const LINKRPC_SIGNATURE_KEY = HUBRPC_SIGNATURE_KEY;
-/** @deprecated Use {@link HUBRPC_UNSIGNED_KEY}. */
-const LINKRPC_UNSIGNED_KEY = HUBRPC_UNSIGNED_KEY;
-/** @deprecated Use {@link HUBRPC_META_KEY}. */
-const LINKRPC_META_KEY = HUBRPC_META_KEY;
-/**
-* The domain-separation key. It includes the frozen signature-suite version
-* and becomes the sole key of the object passed to JCS.
-*/
-function signingDomainValue(domain) {
-	return `hubrpc-sig/v1/${domain}`;
+function intersectPattern(left, right) {
+	if ("exact" in left) {
+		if ("exact" in right) return left.exact === right.exact ? left : void 0;
+		return serviceIdMatchesPattern(left.exact, right) ? left : void 0;
+	}
+	if ("exact" in right) return serviceIdMatchesPattern(right.exact, left) ? right : void 0;
+	if (serviceIdMatchesPattern(left.prefix, right)) return left;
+	if (serviceIdMatchesPattern(right.prefix, left)) return right;
 }
-/**
-* THE bytes a signature commits to (and a content hash hashes) for `obj` in
-* `domain`: `jcs({ [domainValue(domain)]: obj minus the two reserved keys })`.
-*/
-function signingInput(domain, obj) {
-	const signed = { ...obj };
-	delete signed[HUBRPC_SIGNATURE_KEY];
-	delete signed[HUBRPC_UNSIGNED_KEY];
-	return jcsCanonicalizeBytes({ [signingDomainValue(domain)]: signed });
+function patternContains(container, candidate) {
+	if ("exact" in container) return "exact" in candidate && container.exact === candidate.exact;
+	if ("exact" in candidate) return serviceIdMatchesPattern(candidate.exact, container);
+	return serviceIdMatchesPattern(candidate.prefix, container);
 }
-/**
-* Content identity of a signed object: `base64url(sha256(signingInput(...)))`.
-* The single operation behind both a capability's `callBind.payloadHash`
-* (domain `"call"`) and a child capability's `parentHash` (domain
-* `"capability"`).
-*/
-function signedHash(domain, obj) {
-	return bytesToBase64Url(sha256$1(signingInput(domain, obj)));
+function patternKey(pattern) {
+	return "exact" in pattern ? `e:${pattern.exact}` : `p:${pattern.prefix}`;
 }
-/** Read the signature envelope for `domain` off an object's `$hubrpcSignature` map. */
-function readSignature(obj, domain) {
-	const sigs = obj[HUBRPC_SIGNATURE_KEY];
-	if (sigs === null || typeof sigs !== "object") return void 0;
-	const entry = sigs[domain];
-	if (entry === null || typeof entry !== "object") return void 0;
-	const { keyId, sig } = entry;
-	if (typeof keyId !== "string" || typeof sig !== "string") return void 0;
-	return {
-		keyId,
-		sig
-	};
+function scopesKey(scopes) {
+	return normalizeServiceIdScopes(scopes).map(patternKey).join("\0");
 }
-/** The {@link KeyId} the signer used for `domain` (the unsigned routing hint), if any. */
-function getKeyId(obj, domain) {
-	return readSignature(obj, domain)?.keyId;
+async function walkHubDetailed(channel, opts = {}) {
+	return new HubDirectoryExplorer(channel, opts).explore();
 }
 /**
-* Return a copy of `obj` with `$hubrpcSignature[domain]` set to `envelope`,
-* preserving any sibling-domain signatures already present.
+* Backward-compatible wrapper over {@link walkHubDetailed} that returns only the
+* reachable listings, dropping the inaccessible-directory report.
 */
-function withSignature(obj, domain, envelope) {
-	const prev = obj[HUBRPC_SIGNATURE_KEY];
-	return {
-		...obj,
-		[HUBRPC_SIGNATURE_KEY]: {
-			...prev,
-			[domain]: envelope
-		}
-	};
+async function walkHub(channel, opts = {}) {
+	return (await walkHubDetailed(channel, opts)).listings;
 }
-//#endregion
-//#region src/protocol/capability.ts
 /**
-* Structural wire-shape check for an untrusted signed capability. This does
-* not establish authenticity; callers must still verify its signature and
-* delegation chain.
+* Reusable directory graph explorer and watcher.
+*
+* The class keeps one native snapshot per directory target. A watch tick
+* re-lists only its source target; outgoing referral changes then propagate
+* through affected descendants. Unchanged siblings retain both their snapshot
+* and watch. Multi-parent targets are queried with the normalized union of all
+* incoming path scopes.
 */
-function hasSignedCapabilityShape(value) {
-	if (!_isRecord(value)) return false;
-	if (typeof value.issuer !== "string" || typeof value.audience !== "string" || typeof value.nonce !== "string" || !Array.isArray(value.permissions) || !value.permissions.every(_hasPermissionShape) || value.expiresAtMs !== void 0 && typeof value.expiresAtMs !== "number" || value.parentHash !== void 0 && typeof value.parentHash !== "string") return false;
-	return readSignature(value, "capability") !== void 0;
-}
-function _hasPermissionShape(value) {
-	if (!_isRecord(value) || !_isRecord(value.target)) return false;
-	const target = value.target;
-	if (!_hasPatternShape(target.serviceId) || !_hasPatternShape(target.interfaceId) || !Array.isArray(target.members) || !target.members.every(_hasPatternShape) || target.interfaceHash !== void 0 && typeof target.interfaceHash !== "string" || value.canInvoke !== void 0 && typeof value.canInvoke !== "boolean" || value.canDelegate !== void 0 && typeof value.canDelegate !== "boolean") return false;
-	if (value.params !== void 0) {
-		if (!_isRecord(value.params) || !Object.values(value.params).every(_hasParamMatcherShape)) return false;
+var HubDirectoryExplorer = class {
+	_channel;
+	_options;
+	_maxDepth;
+	_initialScopes;
+	_nodes = /* @__PURE__ */ new Map();
+	_unlockAttempted = /* @__PURE__ */ new Set();
+	_listeners = /* @__PURE__ */ new Set();
+	_graphListeners = /* @__PURE__ */ new Set();
+	_pendingTicks = /* @__PURE__ */ new Set();
+	_watchRetryTimers = /* @__PURE__ */ new Map();
+	_watchRetryDelays = /* @__PURE__ */ new Map();
+	_initialized = false;
+	_disposed = false;
+	_watching = false;
+	_complete = false;
+	_revision = 0;
+	_work = Promise.resolve();
+	_explorePromise;
+	constructor(_channel, _options = {}) {
+		this._channel = _channel;
+		this._options = _options;
+		this._maxDepth = _options.maxDepth ?? 5;
+		this._initialScopes = normalizeServiceIdScopes(_options.serviceIdScopes ?? [{ prefix: "" }]);
+		this._nodes.set(ROOT_NODE_KEY, this._createRootNode());
 	}
-	if (value.callBind !== void 0) {
-		if (!_isRecord(value.callBind) || value.callBind.alg !== "sha256" || typeof value.callBind.payloadHash !== "string") return false;
+	/** Perform a fresh bounded exploration without starting watches. */
+	explore() {
+		this._throwIfDisposed();
+		if (this._explorePromise !== void 0) return this._explorePromise;
+		const promise = this._explore();
+		this._explorePromise = promise;
+		const clear = () => {
+			if (this._explorePromise === promise) this._explorePromise = void 0;
+		};
+		promise.then(clear, clear);
+		return promise;
 	}
-	return true;
-}
-function _hasPatternShape(value) {
-	if (!_isRecord(value)) return false;
-	return "exact" in value && typeof value.exact === "string" || "prefix" in value && typeof value.prefix === "string";
-}
-function _hasParamMatcherShape(value) {
-	if (!_isRecord(value)) return false;
-	if ("exact" in value) return true;
-	if ("enum" in value) return Array.isArray(value.enum);
-	if ("prefix" in value) return typeof value.prefix === "string";
-	if ("subsetOf" in value) return Array.isArray(value.subsetOf) && value.subsetOf.every((item) => typeof item === "string");
-	return value.any === true;
-}
-function _isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-/**
-* Addressing match for a single permission: do its
-* `serviceId`/`interfaceId`/`interfaceHash`/`members` patterns admit
-* `target`?
-*/
-function permissionMatchesTarget(target, perm) {
-	return _targetMismatchReason(target, perm) === void 0;
-}
-var TargetMismatchReason = class {
-	mismatch;
-	constructor(mismatch) {
-		this.mismatch = mismatch;
+	async _explore() {
+		if (this._initialized || this._nodes.get(ROOT_NODE_KEY)?.state !== "unexplored") this._resetForExplore();
+		const root = this._nodes.get(ROOT_NODE_KEY);
+		await this._loadNode(root);
+		if (this._disposed) return {
+			listings: [],
+			inaccessible: []
+		};
+		await this._reconcileScopesFromRoot();
+		await this._pruneUnreachable();
+		this._initialized = true;
+		if (this._watching) await this._synchronizeWatches();
+		this._settle();
+		return this.result;
 	}
-	toString() {
-		const mismatch = this.mismatch;
-		switch (mismatch.kind) {
-			case "serviceId":
-			case "interfaceId": return `${mismatch.kind} ${JSON.stringify(mismatch.actual)} does not match ${_formatPattern(mismatch.expected)}`;
-			case "interfaceHash": return `interfaceHash ${mismatch.actual === void 0 ? "<none>" : JSON.stringify(mismatch.actual)} does not match required ${JSON.stringify(mismatch.expected)}`;
-			case "invalidMembers": return "permission target has invalid members";
-			case "member": {
-				const allowed = mismatch.expected.map(_formatPattern).join(", ") || "<none>";
-				return `member ${JSON.stringify(mismatch.actual)} does not match allowed patterns [${allowed}]`;
+	/** Current deduplicated graph snapshot. */
+	get result() {
+		const best = /* @__PURE__ */ new Map();
+		for (const node of this._nodes.values()) {
+			if (!node.loaded) continue;
+			for (const item of node.listings) {
+				const effective = mergePrincipalSets(item.rootPrincipalSets, node.inherited);
+				const tagged = {
+					...item,
+					...effective.length > 0 ? { rootPrincipalSets: effective } : {},
+					discoveredFrom: node.target ?? ""
+				};
+				const key = listingKey(item);
+				const existing = best.get(key);
+				if (!existing || _isAuthoritative(tagged, existing)) best.set(key, tagged);
 			}
 		}
-	}
-};
-function _targetMismatchReason(target, perm) {
-	const t = perm.target;
-	if (!_patternMatches(target.serviceId, t.serviceId, "/")) return new TargetMismatchReason({
-		kind: "serviceId",
-		actual: target.serviceId,
-		expected: t.serviceId
-	});
-	if (!_patternMatches(target.interfaceId, t.interfaceId, ".")) return new TargetMismatchReason({
-		kind: "interfaceId",
-		actual: target.interfaceId,
-		expected: t.interfaceId
-	});
-	if (t.interfaceHash !== void 0 && target.interfaceHash !== t.interfaceHash) return new TargetMismatchReason({
-		kind: "interfaceHash",
-		actual: target.interfaceHash,
-		expected: t.interfaceHash
-	});
-	if (!Array.isArray(t.members)) return new TargetMismatchReason({ kind: "invalidMembers" });
-	if (!t.members.some((m) => _patternMatches(target.member, m, ""))) return new TargetMismatchReason({
-		kind: "member",
-		actual: target.member,
-		expected: t.members
-	});
-}
-function _patternMatches(value, pat, delim) {
-	if ("exact" in pat) return value === pat.exact;
-	const p = pat.prefix;
-	if (p === "") return true;
-	if (value === p) return true;
-	if (delim === "") return value.startsWith(p);
-	return value.startsWith(p + delim);
-}
-function _formatPattern(pattern) {
-	return "exact" in pattern ? `exact ${JSON.stringify(pattern.exact)}` : `prefix ${JSON.stringify(pattern.prefix)}`;
-}
-/**
-* Strict allowlist match for {@link Permission.params}. The set of
-* top-level keys in the call MUST equal the declared set; values must
-* satisfy their matchers. Nested objects/arrays are compared as opaque
-* JSON values via canonical-JSON equality. Pure (no crypto).
-*/
-function matchParams(declared, actualParams) {
-	const declaredKeys = Object.keys(declared).sort();
-	const actualObj = actualParams !== null && typeof actualParams === "object" && !Array.isArray(actualParams) ? actualParams : void 0;
-	const actualKeys = actualObj ? Object.keys(actualObj).sort() : [];
-	if (declaredKeys.length !== actualKeys.length || declaredKeys.some((k, i) => k !== actualKeys[i])) return {
-		ok: false,
-		reason: `param keys mismatch (declared=${declaredKeys.join(",")}, actual=${actualKeys.join(",")})`
-	};
-	for (const k of declaredKeys) if (!_matchParamValue(declared[k], actualObj[k])) return {
-		ok: false,
-		reason: `param "${k}" does not match`
-	};
-	return { ok: true };
-}
-function _matchParamValue(matcher, value) {
-	if ("any" in matcher) return true;
-	if ("prefix" in matcher) return typeof value === "string" && value.startsWith(matcher.prefix);
-	if ("subsetOf" in matcher) return Array.isArray(value) && value.every((v) => typeof v === "string" && matcher.subsetOf.includes(v));
-	if ("exact" in matcher) return jcsCanonicalize(matcher.exact) === jcsCanonicalize(value);
-	if ("enum" in matcher) {
-		const v = jcsCanonicalize(value);
-		return matcher.enum.some((opt) => jcsCanonicalize(opt) === v);
-	}
-	return false;
-}
-/**
-* Does `permission` admit `call` for the given `ability`? Checks, in
-* order: the ability flag (`canInvoke`/`canDelegate`, both default
-* `false`), the target address, the optional `params` allowlist, and the
-* optional `callBind` hash-binding. Pure.
-*/
-function permissionPermits(call, permission, ability) {
-	if (!(ability === "invoke" ? permission.canInvoke === true : permission.canDelegate === true)) return {
-		ok: false,
-		reason: `permission does not grant ${ability}`
-	};
-	const targetMismatch = _targetMismatchReason(call.target, permission);
-	if (targetMismatch !== void 0) return {
-		ok: false,
-		reason: `permission does not address this call: ${targetMismatch.toString()}`
-	};
-	if (permission.params !== void 0) {
-		const r = matchParams(permission.params, call.params);
-		if (!r.ok) return {
-			ok: false,
-			reason: `params: ${r.reason}`
+		return {
+			listings: [...best.values()].filter((item) => this._options.interfaceId === void 0 || item.interfaceId === this._options.interfaceId).filter((item) => this._options.interfaceIdPrefix === void 0 || item.interfaceId.startsWith(this._options.interfaceIdPrefix)).filter((item) => this._options.serviceId === void 0 || item.serviceId === this._options.serviceId),
+			inaccessible: [...this._nodes.values()].filter((node) => node.key !== ROOT_NODE_KEY && node.inaccessibleReason !== void 0).map((node) => ({
+				serviceId: node.target,
+				reason: node.inaccessibleReason
+			}))
 		};
 	}
-	if (permission.callBind !== void 0) {
-		if (permission.callBind.alg !== "sha256") return {
-			ok: false,
-			reason: `callBind: unsupported hash alg (${permission.callBind.alg})`
-		};
-		if (call.callHash !== permission.callBind.payloadHash) return {
-			ok: false,
-			reason: "callBind: payload hash mismatch"
+	/** Current complete-or-progressive directory graph report. */
+	get graphSnapshot() {
+		const root = this._nodes.get(ROOT_NODE_KEY) ?? this._createRootNode();
+		const directories = [...this._nodes.values()].filter((node) => node.key !== ROOT_NODE_KEY).sort((a, b) => (a.target ?? "").localeCompare(b.target ?? "")).map((node) => this._nodeReport(node));
+		return {
+			revision: this._revision,
+			complete: this._complete,
+			root: this._nodeReport(root),
+			directories,
+			result: this.result
 		};
 	}
-	return { ok: true };
-}
-/**
-* Does `cap` admit `call` for the given `ability`? True iff **any** of its
-* permissions does (the union over permissions). This is one *link's*
-* judgment; chain intersection is enforced by {@link verifyChain}.
-*/
-function capabilityPermits(call, cap, ability) {
-	let lastReason = `no permission grants ${ability} for this call`;
-	for (const permission of cap.permissions) {
-		const r = permissionPermits(call, permission, ability);
-		if (r.ok) return { ok: true };
-		lastReason = r.reason;
-	}
-	return {
-		ok: false,
-		reason: lastReason
-	};
-}
-//#endregion
-//#region src/protocol/methodName.ts
-/**
-* Parse a JSON-RPC method string. Returns `undefined` if any segment is
-* empty or the segment count is out of range.
-*/
-function parseMethodName(method) {
-	const parts = method.split("::");
-	if (parts.length === 3 && parts[0].length === 0 && parts[1].length > 0 && parts[2].length > 0) return {
-		kind: "interface",
-		interfaceId: parts[1],
-		member: parts[2]
-	};
-	if (parts.some((p) => p.length === 0)) return void 0;
-	if (parts.length === 1) return {
-		kind: "bare",
-		member: parts[0]
-	};
-	if (parts.length === 2) return {
-		kind: "interface",
-		interfaceId: parts[0],
-		member: parts[1]
-	};
-	if (parts.length === 3) return {
-		kind: "full",
-		serviceId: parts[0],
-		interfaceId: parts[1],
-		member: parts[2]
-	};
-}
-/**
-* Convert a parsed method string to a {@link CallTarget} for capability
-* matching. Interface-form calls are addressed to the root service —
-* represented as an empty `serviceId`. Throws on `bare` form (no
-* interface context) and on malformed input.
-*/
-function methodNameToTarget(method) {
-	const p = parseMethodName(method);
-	if (!p) throw new Error(`linkrpc: malformed method: ${method}`);
-	if (p.kind === "bare") throw new Error(`linkrpc: bare method has no interface context: ${method}`);
-	if (p.kind === "interface") return {
-		serviceId: "",
-		interfaceId: p.interfaceId,
-		member: p.member
-	};
-	return {
-		serviceId: p.serviceId,
-		interfaceId: p.interfaceId,
-		member: p.member
-	};
-}
-//#endregion
-//#region src/protocol/linkRpcEnvelope.ts
-/**
-* The linkrpc signing/cap system accepts only plain-object user params (or
-* none). Reject arrays/primitives at the boundary so "strip `$hubrpc*`, the
-* rest is the signed user params" stays unambiguous.
-*/
-function requireObjectParams(userParams) {
-	if (userParams === void 0) return {};
-	if (userParams === null || typeof userParams !== "object" || Array.isArray(userParams)) throw new Error("linkrpc: user params must be a plain JSON object or undefined");
-	return userParams;
-}
-/**
-* Return the application-authored portion of a LinkRPC params value.
-*
-* Routing and gate layers must continue forwarding the original wire params so
-* every chained hub can independently verify the envelope. Terminal dispatch
-* may use this derived value for application-schema validation without mutating
-* or replacing the wire message.
-*/
-function stripLinkRpcWireMeta(wireParams) {
-	if (wireParams === void 0) return void 0;
-	if (wireParams === null || typeof wireParams !== "object" || Array.isArray(wireParams)) return wireParams;
-	const object = wireParams;
-	const reserved = [
-		HUBRPC_META_KEY,
-		HUBRPC_SIGNATURE_KEY,
-		HUBRPC_UNSIGNED_KEY
-	];
-	if (!reserved.some((key) => key in object)) return object;
-	const userParams = {};
-	for (const key of Object.keys(object)) {
-		if (reserved.includes(key)) continue;
-		userParams[key] = object[key];
-	}
-	return userParams;
-}
-//#endregion
-//#region src/transport/messageTransport.ts
-/**
-* Observe every message crossing a transport without changing its buffering or
-* lifecycle behavior.
-*/
-function traceMessageTransport(transport, trace) {
-	return {
-		send(message) {
-			trace("send", message);
-			return transport.send(message);
-		},
-		setListener(listener) {
-			transport.setListener(listener === void 0 ? void 0 : (message) => {
-				trace("receive", message);
-				listener(message);
-			});
-		},
-		dispose() {
-			transport.dispose();
-		}
-	};
-}
-/**
-* Pipe two transports together: every message one receives is forwarded to
-* the other's `send`. Returns a disposable that detaches both listeners.
-*
-* Neither transport is disposed — the caller owns their lifecycle. This is
-* the building block for relays (e.g. bridging a `WindowMessageTransport`
-* for an iframe to a multiplexer channel).
-*/
-function connectTransports(a, b) {
-	a.setListener((m) => void b.send(m));
-	b.setListener((m) => void a.send(m));
-	return { dispose() {
-		a.setListener(void 0);
-		b.setListener(void 0);
-	} };
-}
-/**
-* Two in-memory transports wired back-to-back. Useful for tests and for
-* same-process bridges.
-*
-* Generic in the per-direction payload type so asymmetric pairs (e.g. one
-* side sends plain `JsonRpcMessage`, the other side sends
-* `JsonRpcMessage & { context: Participant }`) are expressible at the type
-* level. At runtime both halves just hand objects through by reference.
-*/
-var TransportPair = class {
-	a;
-	b;
-	constructor() {
-		const aT = new _InMemoryTransport();
-		const bT = new _InMemoryTransport();
-		aT._peer = bT;
-		bT._peer = aT;
-		this.a = aT;
-		this.b = bT;
-	}
-};
-var _InMemoryTransport = class {
-	_peer;
-	_listener;
-	_buffer = [];
-	_closed = false;
-	send(message) {
-		if (this._closed || this._peer._closed) return;
-		this._peer._deliver(message);
-	}
-	setListener(listener) {
-		this._listener = listener;
-		if (listener) while (this._buffer.length > 0 && this._listener) {
-			const m = this._buffer.shift();
-			this._listener(m);
-		}
-	}
-	dispose() {
-		this._closed = true;
-	}
-	_deliver(m) {
-		if (this._listener) this._listener(m);
-		else this._buffer.push(m);
-	}
-};
-//#endregion
-//#region src/transport/multiplexedTransport.ts
-var MultiplexedTransport = class MultiplexedTransport {
-	static create(base, channels) {
-		return new MultiplexedTransport(base, channels);
-	}
-	/** Logical transports keyed by the friendly channel names. */
-	transports;
-	_base;
-	_byId = /* @__PURE__ */ new Map();
-	_usedIds = /* @__PURE__ */ new Set();
-	_disposed = false;
-	constructor(base, channels) {
-		this._base = base;
-		const transports = {};
-		for (const name of Object.keys(channels)) {
-			const id = channels[name];
-			transports[name] = this._createChannel(id);
-		}
-		this.transports = transports;
-		base.setListener((data) => {
-			(data == null ? void 0 : this._byId.get(data.ch))?._deliver(data.m);
-		});
-	}
-	/**
-	* Add a logical channel after the multiplexer has started.
-	*
-	* Channel ids are permanently retired when disposed. This prevents a late
-	* envelope for an old iframe from being delivered to a replacement iframe.
-	*/
-	addChannel(id) {
-		if (this._disposed) throw new Error("Cannot add a channel to a disposed multiplexed transport.");
-		return this._createChannel(id);
-	}
-	dispose() {
-		if (this._disposed) return;
-		this._disposed = true;
-		this._base.setListener(void 0);
-		for (const t of [...this._byId.values()]) t.dispose();
-		this._byId.clear();
-	}
-	_createChannel(id) {
-		if (id.length === 0) throw new Error("Multiplexed transport channel ids must not be empty.");
-		if (this._usedIds.has(id)) throw new Error(`Multiplexed transport channel id "${id}" has already been used.`);
-		this._usedIds.add(id);
-		const t = new _ChannelTransport(this._base, id, () => {
-			if (this._byId.get(id) === t) this._byId.delete(id);
-		});
-		this._byId.set(id, t);
-		return t;
-	}
-};
-var _ChannelTransport = class {
-	_base;
-	_ch;
-	_onDispose;
-	_listener;
-	_buffer = [];
-	_closed = false;
-	constructor(_base, _ch, _onDispose) {
-		this._base = _base;
-		this._ch = _ch;
-		this._onDispose = _onDispose;
-	}
-	send(message) {
-		if (this._closed) return;
-		this._base.send({
-			$mux: "v1",
-			ch: this._ch,
-			m: message
-		});
-	}
-	setListener(listener) {
-		this._listener = listener;
-		if (listener) while (this._buffer.length > 0 && this._listener) listener(this._buffer.shift());
-	}
-	dispose() {
-		if (this._closed) return;
-		this._closed = true;
-		this._listener = void 0;
-		this._buffer.length = 0;
-		this._onDispose();
-	}
-	_deliver(m) {
-		if (this._closed) return;
-		if (this._listener) this._listener(m);
-		else this._buffer.push(m);
-	}
-};
-//#endregion
-//#region src/connection/channel.ts
-var Channel = class Channel {
-	sender;
-	_setHandler;
-	_setWireObserver;
-	constructor(sender, _setHandler, _setWireObserver) {
-		this.sender = sender;
-		this._setHandler = _setHandler;
-		this._setWireObserver = _setWireObserver;
-	}
-	/** Bind the inbound request/notification handler. May be called before or after construction of {@link LinkRpcConnection}. */
-	setRequestHandler(handler) {
-		this._setHandler(handler);
-	}
-	/**
-	* Install the endpoint inspection observer at the JSON-RPC wire boundary.
-	* Intended for {@link LinkRpcConnection}; ordinary consumers should use the
-	* public `hubrpc.traffic` service instead.
-	*/
-	setWireMessageObserver(observer) {
-		this._setWireObserver?.(observer);
-	}
-	/**
-	* Compose this channel with a sender-side decorator (typically the
-	* signing layer). The decorator wraps {@link sender} only; the
-	* {@link setRequestHandler} binding is shared with the original channel
-	* so the receive side is bound exactly once regardless of decoration depth.
-	*/
-	withSender(decorate) {
-		return new Channel(decorate(this.sender), this._setHandler, this._setWireObserver);
-	}
-};
-var RpcError = class extends Error {
-	code;
-	origin;
-	data;
-	hasData;
-	constructor(message, code, data, origin = "local", hasData = data !== void 0) {
-		super(message);
-		this.code = code;
-		this.origin = origin;
-		this.name = "RpcError";
-		this.hasData = hasData;
-		if (hasData) this.data = data;
-	}
-};
-//#endregion
-//#region src/connection/requestTimeout.ts
-const DEFAULT_RPC_TIMEOUT_MS = 5e3;
-async function withRpcTimeout(request, target, timeoutMs = DEFAULT_RPC_TIMEOUT_MS) {
-	if (timeoutMs <= 0) return request;
-	let timer;
-	const timeout = new Promise((_resolve, reject) => {
-		timer = setTimeout(() => {
-			const reason = `${target} timed out after ${timeoutMs}ms`;
-			try {
-				Promise.resolve(request.cancel(reason)).catch(() => {});
-			} finally {
-				try {
-					request.dispose?.(reason);
-				} catch {}
-			}
-			reject(new Error(reason));
-		}, timeoutMs);
-	});
-	try {
-		return await Promise.race([request, timeout]);
-	} finally {
-		if (timer !== void 0) clearTimeout(timer);
-	}
-}
-//#endregion
-//#region src/hub/common/directoryWalk.ts
-async function fetchDirectory(channel, opts = {}) {
-	const method = opts.target ? `${opts.target}::hubrpc.directory::list` : "hubrpc.directory::list";
-	const all = [];
-	let cursor;
-	while (true) {
-		const params = {};
-		if (opts.interfaceId !== void 0) params.interfaceId = opts.interfaceId;
-		if (opts.interfaceIdPrefix !== void 0) params.interfaceIdPrefix = opts.interfaceIdPrefix;
-		if (opts.serviceId !== void 0) params.serviceId = opts.serviceId;
-		if (opts.serviceIdScopes !== void 0) params.serviceIdScopes = [...opts.serviceIdScopes];
-		if (opts.limit !== void 0) params.limit = opts.limit;
-		if (opts.timeoutMs !== void 0) params.timeoutMs = opts.timeoutMs;
-		if (cursor !== void 0) params.cursor = cursor;
-		const call = channel.sendRequestWithStream(method, params, { interfaceHash: directoryInterface.schemaHash });
-		const target = opts.target ?? "<root>";
-		const page = await withRpcTimeout(Object.assign(call.result, {
-			cancel: (reason) => call.cancel(reason),
-			dispose: (reason) => call.dispose?.(reason)
-		}), `hub directory service '${target}'`, opts.timeoutMs ?? 5e3);
-		for (const it of page.items) all.push({
-			serviceId: it.serviceId,
-			interfaceId: it.interfaceId,
-			hash: it.interfaceHash,
-			...it.path !== void 0 ? { path: it.path } : {},
-			...it.serviceDescription !== void 0 ? { serviceDescription: it.serviceDescription } : {},
-			...Array.isArray(it.rootPrincipalSets) ? { rootPrincipalSets: it.rootPrincipalSets } : {},
-			...Array.isArray(it.reachableServiceIds) ? { reachableServiceIds: it.reachableServiceIds } : {}
-		});
-		if (!page.nextCursor) break;
-		cursor = page.nextCursor;
-	}
-	return all;
-}
-async function fetchSchema(channel, interfaceId, hash, target) {
-	const method = target ? `${target}::hubrpc.schemas::get` : "hubrpc.schemas::get";
-	const params = { interfaceId };
-	if (hash !== void 0) params.hash = hash;
-	return (await channel.sendRequest(method, params)).schema;
-}
-function findMethodInSchema(schema, methodName) {
-	return schema.methods[methodName];
-}
-/** Default recursion depth when walking the bus. */
-const DEFAULT_WALK_DEPTH = 5;
-const DIRECTORY_INTERFACE_ID = "hubrpc.directory";
-const ROOT_NODE_KEY = "\0root";
-/** Segment-aware service-id pattern matching (`foo` includes `foo/bar`, not `foobar`). */
-function serviceIdMatchesPattern(serviceId, pattern) {
-	if ("exact" in pattern) return serviceId === pattern.exact;
-	return pattern.prefix === "" || serviceId === pattern.prefix || serviceId.startsWith(`${pattern.prefix}/`);
-}
-/** Whether a service id is included by a union of patterns. `undefined` means unfiltered. */
-function serviceIdMatchesScopes(serviceId, scopes) {
-	return scopes === void 0 || scopes.some((pattern) => serviceIdMatchesPattern(serviceId, pattern));
-}
-/** Canonicalize a pattern union by removing duplicates and contained patterns. */
-function normalizeServiceIdScopes(scopes) {
-	const unique = /* @__PURE__ */ new Map();
-	for (const pattern of scopes) unique.set(patternKey(pattern), pattern);
-	const patterns = [...unique.values()];
-	return patterns.filter((candidate, index) => !patterns.some((other, otherIndex) => index !== otherIndex && patternContains(other, candidate))).sort((a, b) => patternKey(a).localeCompare(patternKey(b)));
-}
-/** Pairwise intersection of two pattern unions. */
-function intersectServiceIdScopes(left, right) {
-	const intersections = [];
-	for (const a of left) for (const b of right) {
-		const intersection = intersectPattern(a, b);
-		if (intersection !== void 0) intersections.push(intersection);
-	}
-	return normalizeServiceIdScopes(intersections);
-}
-function intersectPattern(left, right) {
-	if ("exact" in left) {
-		if ("exact" in right) return left.exact === right.exact ? left : void 0;
-		return serviceIdMatchesPattern(left.exact, right) ? left : void 0;
-	}
-	if ("exact" in right) return serviceIdMatchesPattern(right.exact, left) ? right : void 0;
-	if (serviceIdMatchesPattern(left.prefix, right)) return left;
-	if (serviceIdMatchesPattern(right.prefix, left)) return right;
-}
-function patternContains(container, candidate) {
-	if ("exact" in container) return "exact" in candidate && container.exact === candidate.exact;
-	if ("exact" in candidate) return serviceIdMatchesPattern(candidate.exact, container);
-	return serviceIdMatchesPattern(candidate.prefix, container);
-}
-function patternKey(pattern) {
-	return "exact" in pattern ? `e:${pattern.exact}` : `p:${pattern.prefix}`;
-}
-function scopesKey(scopes) {
-	return normalizeServiceIdScopes(scopes).map(patternKey).join("\0");
-}
-async function walkHubDetailed(channel, opts = {}) {
-	return new HubDirectoryExplorer(channel, opts).explore();
-}
-/**
-* Backward-compatible wrapper over {@link walkHubDetailed} that returns only the
-* reachable listings, dropping the inaccessible-directory report.
-*/
-async function walkHub(channel, opts = {}) {
-	return (await walkHubDetailed(channel, opts)).listings;
-}
-/**
-* Reusable directory graph explorer and watcher.
-*
-* The class keeps one native snapshot per directory target. A watch tick
-* re-lists only its source target; outgoing referral changes then propagate
-* through affected descendants. Unchanged siblings retain both their snapshot
-* and watch. Multi-parent targets are queried with the normalized union of all
-* incoming path scopes.
-*/
-var HubDirectoryExplorer = class {
-	_channel;
-	_options;
-	_maxDepth;
-	_initialScopes;
-	_nodes = /* @__PURE__ */ new Map();
-	_unlockAttempted = /* @__PURE__ */ new Set();
-	_listeners = /* @__PURE__ */ new Set();
-	_graphListeners = /* @__PURE__ */ new Set();
-	_pendingTicks = /* @__PURE__ */ new Set();
-	_watchRetryTimers = /* @__PURE__ */ new Map();
-	_watchRetryDelays = /* @__PURE__ */ new Map();
-	_initialized = false;
-	_disposed = false;
-	_watching = false;
-	_complete = false;
-	_revision = 0;
-	_work = Promise.resolve();
-	_explorePromise;
-	constructor(_channel, _options = {}) {
-		this._channel = _channel;
-		this._options = _options;
-		this._maxDepth = _options.maxDepth ?? 5;
-		this._initialScopes = normalizeServiceIdScopes(_options.serviceIdScopes ?? [{ prefix: "" }]);
-		this._nodes.set(ROOT_NODE_KEY, this._createRootNode());
-	}
-	/** Perform a fresh bounded exploration without starting watches. */
-	explore() {
-		this._throwIfDisposed();
-		if (this._explorePromise !== void 0) return this._explorePromise;
-		const promise = this._explore();
-		this._explorePromise = promise;
-		const clear = () => {
-			if (this._explorePromise === promise) this._explorePromise = void 0;
-		};
-		promise.then(clear, clear);
-		return promise;
-	}
-	async _explore() {
-		if (this._initialized || this._nodes.get(ROOT_NODE_KEY)?.state !== "unexplored") this._resetForExplore();
-		const root = this._nodes.get(ROOT_NODE_KEY);
-		await this._loadNode(root);
-		if (this._disposed) return {
-			listings: [],
-			inaccessible: []
-		};
-		await this._reconcileScopesFromRoot();
-		await this._pruneUnreachable();
-		this._initialized = true;
-		if (this._watching) await this._synchronizeWatches();
-		this._settle();
-		return this.result;
-	}
-	/** Current deduplicated graph snapshot. */
-	get result() {
-		const best = /* @__PURE__ */ new Map();
-		for (const node of this._nodes.values()) {
-			if (!node.loaded) continue;
-			for (const item of node.listings) {
-				const effective = mergePrincipalSets(item.rootPrincipalSets, node.inherited);
-				const tagged = {
-					...item,
-					...effective.length > 0 ? { rootPrincipalSets: effective } : {},
-					discoveredFrom: node.target ?? ""
-				};
-				const key = listingKey(item);
-				const existing = best.get(key);
-				if (!existing || _isAuthoritative(tagged, existing)) best.set(key, tagged);
-			}
-		}
-		return {
-			listings: [...best.values()].filter((item) => this._options.interfaceId === void 0 || item.interfaceId === this._options.interfaceId).filter((item) => this._options.interfaceIdPrefix === void 0 || item.interfaceId.startsWith(this._options.interfaceIdPrefix)).filter((item) => this._options.serviceId === void 0 || item.serviceId === this._options.serviceId),
-			inaccessible: [...this._nodes.values()].filter((node) => node.key !== ROOT_NODE_KEY && node.inaccessibleReason !== void 0).map((node) => ({
-				serviceId: node.target,
-				reason: node.inaccessibleReason
-			}))
-		};
-	}
-	/** Current complete-or-progressive directory graph report. */
-	get graphSnapshot() {
-		const root = this._nodes.get(ROOT_NODE_KEY) ?? this._createRootNode();
-		const directories = [...this._nodes.values()].filter((node) => node.key !== ROOT_NODE_KEY).sort((a, b) => (a.target ?? "").localeCompare(b.target ?? "")).map((node) => this._nodeReport(node));
-		return {
-			revision: this._revision,
-			complete: this._complete,
-			root: this._nodeReport(root),
-			directories,
-			result: this.result
-		};
-	}
-	/**
-	* Subscribe to progressive graph reports. The listener is registered before
-	* receiving a synchronous current snapshot, avoiding the subscribe/explore
-	* race for both idle and already-running explorers.
-	*/
-	subscribe(listener) {
-		this._throwIfDisposed();
-		this._graphListeners.add(listener);
-		this._deliverGraphEvent(listener, {
-			type: "snapshot",
-			reason: "subscribed",
-			snapshot: this.graphSnapshot
-		});
-		let active = true;
-		return () => {
-			if (!active) return;
-			active = false;
-			this._graphListeners.delete(listener);
-		};
+	/**
+	* Subscribe to progressive graph reports. The listener is registered before
+	* receiving a synchronous current snapshot, avoiding the subscribe/explore
+	* race for both idle and already-running explorers.
+	*/
+	subscribe(listener) {
+		this._throwIfDisposed();
+		this._graphListeners.add(listener);
+		this._deliverGraphEvent(listener, {
+			type: "snapshot",
+			reason: "subscribed",
+			snapshot: this.graphSnapshot
+		});
+		let active = true;
+		return () => {
+			if (!active) return;
+			active = false;
+			this._graphListeners.delete(listener);
+		};
 	}
 	/**
 	* Explore once, then watch every reachable directory. Resolves after the
@@ -2951,6 +2499,54 @@ function _isAuthoritative(candidate, current) {
 	return candidateDirect && !currentDirect;
 }
 //#endregion
+//#region src/connection/channel.ts
+var Channel = class Channel {
+	sender;
+	_setHandler;
+	_setWireObserver;
+	constructor(sender, _setHandler, _setWireObserver) {
+		this.sender = sender;
+		this._setHandler = _setHandler;
+		this._setWireObserver = _setWireObserver;
+	}
+	/** Bind the inbound request/notification handler. May be called before or after construction of {@link LinkRpcConnection}. */
+	setRequestHandler(handler) {
+		this._setHandler(handler);
+	}
+	/**
+	* Install the endpoint inspection observer at the JSON-RPC wire boundary.
+	* Intended for {@link LinkRpcConnection}; ordinary consumers should use the
+	* public `hubrpc.traffic` service instead.
+	*/
+	setWireMessageObserver(observer) {
+		this._setWireObserver?.(observer);
+	}
+	/**
+	* Compose this channel with a sender-side decorator (typically the
+	* signing layer). The decorator wraps {@link sender} only; the
+	* {@link setRequestHandler} binding is shared with the original channel
+	* so the receive side is bound exactly once regardless of decoration depth.
+	*/
+	withSender(decorate) {
+		return new Channel(decorate(this.sender), this._setHandler, this._setWireObserver);
+	}
+};
+var RpcError = class extends Error {
+	code;
+	origin;
+	data;
+	hasData;
+	constructor(message, code, data, origin = "local", hasData = data !== void 0) {
+		super(message);
+		this.code = code;
+		this.origin = origin;
+		this.message = message;
+		this.name = "RpcError";
+		this.hasData = hasData;
+		if (hasData) this.data = data;
+	}
+};
+//#endregion
 //#region src/connection/jsonRpcChannel.ts
 /**
 * How often a streaming-enabled call emits a `toCallee` keepalive ping so a
@@ -3296,999 +2892,1327 @@ var JsonRpcChannel = class JsonRpcChannel {
 			this._observeOutbound(response);
 			await this._transport.send(response);
 		} else {
-			const resp = {
-				jsonrpc: "2.0",
-				id: m.id,
-				error: result.error
-			};
-			this._observeOutbound(resp);
-			await this._transport.send(resp);
+			const resp = {
+				jsonrpc: "2.0",
+				id: m.id,
+				error: result.error
+			};
+			this._observeOutbound(resp);
+			await this._transport.send(resp);
+		}
+	}
+	_handleNotification(m, context) {
+		if (!this._handler) return;
+		try {
+			this._handler.handleNotification({
+				method: m.method,
+				params: m.params,
+				context,
+				stream: _NOOP_STREAM,
+				signal: _NEVER_ABORT
+			});
+		} catch {}
+	}
+	_observeInbound(message) {
+		const observer = this._wireObserver;
+		if (observer === void 0) return;
+		observer("inbound", message);
+	}
+	_observeOutbound(message, opts) {
+		const observer = this._wireObserver;
+		if (observer === void 0) return;
+		observer("outbound", message);
+	}
+	_observeSendFailure(requestId, error) {
+		if (this._wireObserver === void 0) return;
+		this._observeInbound({
+			jsonrpc: "2.0",
+			id: requestId,
+			error: {
+				code: ErrorCode.peerDisconnected,
+				message: error instanceof Error ? error.message : String(error)
+			}
+		});
+	}
+};
+/** Stub stream handle for notifications, which carry no request id. */
+const _NOOP_STREAM = {
+	send: () => Promise.resolve(),
+	onMessage: () => {},
+	ping: () => Promise.resolve()
+};
+/** A signal that never aborts — handed to notification handlers. */
+const _NEVER_ABORT = new AbortController().signal;
+//#endregion
+//#region src/connection/interfaceTarget.ts
+function interfaceTarget(iface, options = {}) {
+	const serviceId = options.serviceId ?? "";
+	if (serviceId.includes("::") || !/^[\x20-\x7e]*$/.test(serviceId)) throw new Error("Service id must contain only printable ASCII and must not contain \"::\".");
+	return Object.freeze({
+		mode: "qualified",
+		interface: iface,
+		serviceId
+	});
+}
+function defaultInterfaceTarget(iface) {
+	return Object.freeze({
+		mode: "default",
+		interface: iface
+	});
+}
+function isInterfaceTarget(value) {
+	return typeof value === "object" && value !== null && "interface" in value && "mode" in value && (value.mode === "qualified" || value.mode === "default" || value.mode === "bare");
+}
+//#endregion
+//#region src/connection/linkRpcConnection.ts
+/**
+* High-level linkrpc connection. Layers method-name routing and zod-driven
+* validation on top of a plain JSON-RPC channel.
+*
+* Typed proxies built by this class merely forward each call's
+* `interfaceHash` hint to the channel so the signer stamps it into the
+* `$hubrpc` envelope.
+*
+* `TInCtx` is the per-call out-of-band context the connection's transport
+* carries. Default `undefined` covers cross-process and ordinary in-process
+* transports. The hub's self/overlay connections instantiate with a
+* concrete `TInCtx` (e.g. `Participant`) so handlers can see who originated
+* the call.
+*
+* `TOutCtx` is the per-call override / extension bag the outbound sender
+* understands (see {@link SendOpts.ctx}). It only ever flows into the
+* sender as input, so it is a contravariant type parameter. Default `any`
+* keeps the bare `LinkRpcConnection` a valid supertype for holders that do
+* not care about the outbound ctx; pass a concrete shape (e.g.
+* `SigningCallCtx`) to get precise {@link get} typing. The connection
+* itself is agnostic to its contents — it merely forwards the `ctx`
+* defaults supplied to {@link get}.
+*/
+var LinkRpcConnection = class LinkRpcConnection {
+	/**
+	* Convenience: build a {@link JsonRpcChannel} `Channel` from the
+	* given transport and wrap it in an `LinkRpcConnection`. Use this
+	* when you have a transport at hand and don't need a decorator
+	* stack (e.g. signing).
+	*/
+	static fromTransport(transport, options = {}) {
+		return new LinkRpcConnection(JsonRpcChannel.create(transport), options);
+	}
+	/** Underlying JSON-RPC sender — useful for callers that need raw access (e.g. to call hub-served methods that bypass the interface registry). */
+	channel;
+	/** key = `${serviceId ?? ""}::${interfaceId}` */
+	_registry = /* @__PURE__ */ new Map();
+	/** Descriptions for services that have been registered with a `serviceDescription`. */
+	_serviceDescriptions = /* @__PURE__ */ new Map();
+	/** Root-node-id requirement sets recorded per serviceId. */
+	_serviceRootPrincipalSets = /* @__PURE__ */ new Map();
+	_directoryWatchers = /* @__PURE__ */ new Set();
+	_directoryListeners = /* @__PURE__ */ new Set();
+	_inspection;
+	_inspectionHost;
+	_serviceInspectionRegistrations = /* @__PURE__ */ new Map();
+	_wireObservers = /* @__PURE__ */ new Set();
+	_closeListeners = /* @__PURE__ */ new Set();
+	_closed = false;
+	_wireChannel;
+	_validateOutboundParams;
+	/** Bare-method bindings, keyed by their exact wire prefix. */
+	_bareBindings = /* @__PURE__ */ new Map();
+	_generateTopologyId;
+	/**
+	* Construct from a {@link Channel} (binds the inbound handler and uses
+	* `channel.sender` for outbound calls) or from a bare
+	* {@link IRequestSender} (send-only — no inbound handler is registered,
+	* useful for bootstrap flows like `createManagedIdentity`).
+	*/
+	constructor(channel, options = {}) {
+		this._validateOutboundParams = options.validateOutboundParams !== false;
+		this._generateTopologyId = options.generateTopologyId ?? createInspectionId;
+		if ("sender" in channel) {
+			this._wireChannel = channel;
+			this.channel = channel.sender;
+			channel.setRequestHandler({
+				handleRequest: (c) => this._handleRequest(c),
+				handleNotification: (c) => this._handleNotification(c)
+			});
+		} else {
+			this._wireChannel = void 0;
+			this.channel = channel;
 		}
 	}
-	_handleNotification(m, context) {
-		if (!this._handler) return;
-		try {
-			this._handler.handleNotification({
-				method: m.method,
-				params: m.params,
-				context,
-				stream: _NOOP_STREAM,
-				signal: _NEVER_ABORT
-			});
-		} catch {}
+	get(ifaceOrTarget, opts) {
+		return this._getClient(ifaceOrTarget, opts, false);
 	}
-	_observeInbound(message) {
-		const observer = this._wireObserver;
-		if (observer === void 0) return;
-		observer("inbound", message);
+	_getClient(ifaceOrTarget, opts, allFailuresAsValues) {
+		if (isInterfaceTarget(ifaceOrTarget)) {
+			if (opts !== void 0) throw new Error(`${allFailuresAsValues ? "getResultClient" : "get"}: ${ifaceOrTarget.mode === "bare" ? "bare " : ""}interface targets do not accept service or call options.`);
+			if (ifaceOrTarget.mode === "bare") return this._buildBareClient(ifaceOrTarget.interface, ifaceOrTarget.prefix, allFailuresAsValues);
+			return this._buildClient(ifaceOrTarget.interface, ifaceOrTarget.mode === "qualified" ? { serviceId: ifaceOrTarget.serviceId } : {}, void 0, ifaceOrTarget.mode === "default", allFailuresAsValues);
+		}
+		return this._buildClient(ifaceOrTarget, opts ?? {}, void 0, false, allFailuresAsValues);
 	}
-	_observeOutbound(message, opts) {
-		const observer = this._wireObserver;
-		if (observer === void 0) return;
-		observer("outbound", message);
+	/**
+	* Get a typed client that emits foreign-protocol bare method names.
+	* Unlike {@link get}, these calls carry no LinkRPC interface metadata.
+	*/
+	getBare(iface, opts = {}) {
+		return this._buildBareClient(iface, opts.prefix ?? "", false);
 	}
-	_observeSendFailure(requestId, error) {
-		if (this._wireObserver === void 0) return;
-		this._observeInbound({
-			jsonrpc: "2.0",
-			id: requestId,
-			error: {
-				code: ErrorCode.peerDisconnected,
-				message: error instanceof Error ? error.message : String(error)
+	_buildBareClient(iface, prefix, allFailuresAsValues) {
+		validateBarePrefix(prefix);
+		for (const [name, member] of Object.entries(iface.members)) if (member instanceof RequestType && (member.clientStreamSchema !== void 0 || member.serverStreamSchema !== void 0)) throw new Error(`getBare: streaming method "${name}" is not supported on foreign wires.`);
+		return this._buildClient(iface, {}, prefix, false, allFailuresAsValues);
+	}
+	getResultClient(ifaceOrTarget, opts) {
+		return this._getClient(ifaceOrTarget, opts, true);
+	}
+	/** Get a service-scoped handle; all interfaces obtained from it route via `serviceId` (form 3). */
+	service(serviceId) {
+		return new ServiceHandle(this, serviceId);
+	}
+	/** Register handlers, adding preset routing when passed a default or bare target. */
+	register(ifaceOrTarget, handlers, opts = {}) {
+		if (isInterfaceTarget(ifaceOrTarget)) {
+			if (ifaceOrTarget.mode === "qualified") {
+				if (opts.serviceId !== void 0 && opts.serviceId !== ifaceOrTarget.serviceId) throw new Error("register: serviceId conflicts with interface target.");
+				return this._register(ifaceOrTarget.interface, handlers, {
+					...opts,
+					serviceId: ifaceOrTarget.serviceId || void 0
+				}, false);
 			}
+			const prefix = ifaceOrTarget.mode === "bare" ? ifaceOrTarget.prefix : "";
+			validateBarePrefix(prefix);
+			return this._register(ifaceOrTarget.interface, handlers, opts, false, prefix);
+		}
+		return this._register(ifaceOrTarget, handlers, opts, false);
+	}
+	/** Register inspection contracts without recursively enabling service inspection. */
+	registerInspection(iface, handlers, opts = {}) {
+		return this._register(iface, handlers, opts, true);
+	}
+	/** Observe this connection without replacing another inspection scope's observer. */
+	observeWireMessages(observer) {
+		if (this._closed) throw new Error("Connection is closed");
+		if (this._wireChannel === void 0) throw new Error("Connection has no observable wire channel");
+		this._wireObservers.add(observer);
+		this._wireChannel.setWireMessageObserver((direction, message) => {
+			for (const listener of [...this._wireObservers]) try {
+				listener(direction, message);
+			} catch {}
 		});
+		return { dispose: () => {
+			this._wireObservers.delete(observer);
+			if (this._wireObservers.size === 0) this._wireChannel?.setWireMessageObserver(void 0);
+		} };
 	}
-};
-/** Stub stream handle for notifications, which carry no request id. */
-const _NOOP_STREAM = {
-	send: () => Promise.resolve(),
-	onMessage: () => {},
-	ping: () => Promise.resolve()
-};
-/** A signal that never aborts — handed to notification handlers. */
-const _NEVER_ABORT = new AbortController().signal;
-//#endregion
-//#region src/inspection/endpointTrafficInspector.ts
-const REQUEST_CORRELATION_RETENTION_MS = 18e5;
-const MAX_REQUEST_CORRELATIONS = 4096;
-var EndpointTrafficInspector = class {
-	_nodeId;
-	_portId;
-	_setActive;
-	_subscribers = /* @__PURE__ */ new Set();
-	_observers = /* @__PURE__ */ new Set();
-	_outboundRequests = /* @__PURE__ */ new Map();
-	_inboundRequests = /* @__PURE__ */ new Map();
-	_trafficWatches = new TrafficWatchFlowTracker();
-	observe = (direction, message) => {
-		this._onMessage(direction, message);
-	};
-	constructor(_nodeId, _portId, _setActive) {
-		this._nodeId = _nodeId;
-		this._portId = _portId;
-		this._setActive = _setActive;
-	}
-	start() {
-		this._setActive(true);
-	}
-	get observerCount() {
-		return this._subscribers.size + this._observers.size;
-	}
-	subscribe(options, send) {
-		if (options.trafficIgnoreKey !== void 0 && !this._trafficWatches.claim(options.trafficIgnoreKey)) throw new Error("Traffic watch request was not observed before subscription");
-		const subscriber = new BoundedTrafficSubscription(options, send, () => {
-			this._subscribers.delete(subscriber);
-			this._clearCorrelationsIfUnused();
+	onDidClose(listener) {
+		if (this._closed) throw new Error("Connection is closed");
+		this._closeListeners.add(listener);
+		return { dispose: () => {
+			this._closeListeners.delete(listener);
+		} };
+	}
+	_register(iface, handlers, opts, internalInspection, barePrefix) {
+		const serviceId = opts.serviceId;
+		const key = `${serviceId ?? ""}::${iface.info.id}`;
+		if (this._registry.has(key)) throw new Error(`Interface "${iface.info.id}" already registered${serviceId ? ` under service "${serviceId}"` : ""}.`);
+		if (barePrefix !== void 0 && this._bareBindings.has(barePrefix)) throw new Error(`Bare interface prefix "${barePrefix}" is already registered.`);
+		let descriptionWasAdded = false;
+		if (opts.serviceDescription !== void 0) {
+			if (serviceId === void 0) throw new Error("register: `serviceDescription` requires `serviceId`.");
+			const existing = this._serviceDescriptions.get(serviceId);
+			if (existing !== void 0 && existing !== opts.serviceDescription) throw new Error(`register: conflicting descriptions for service "${serviceId}".`);
+			descriptionWasAdded = existing === void 0;
+		}
+		let rootPrincipalSetsWereAdded = false;
+		if (opts.rootPrincipalSets !== void 0) {
+			if (serviceId === void 0) throw new Error("register: `rootPrincipalSets` requires `serviceId`.");
+			const existing = this._serviceRootPrincipalSets.get(serviceId);
+			if (existing !== void 0 && !rootPrincipalSetsEqual(existing, opts.rootPrincipalSets)) throw new Error(`register: conflicting rootPrincipalSets for service "${serviceId}".`);
+			rootPrincipalSetsWereAdded = existing === void 0;
+		}
+		const entry = {
+			iface,
+			handlers,
+			serviceId,
+			internalInspection
+		};
+		if (descriptionWasAdded) this._serviceDescriptions.set(serviceId, opts.serviceDescription);
+		if (rootPrincipalSetsWereAdded) this._serviceRootPrincipalSets.set(serviceId, opts.rootPrincipalSets);
+		this._registry.set(key, entry);
+		if (barePrefix !== void 0) this._bareBindings.set(barePrefix, {
+			prefix: barePrefix,
+			entry
+		});
+		this._notifyDirectoryWatchers(entry, descriptionWasAdded || rootPrincipalSetsWereAdded);
+		if (!internalInspection && serviceId !== void 0 && this._inspection !== void 0 && !this._serviceInspectionRegistrations.has(serviceId)) try {
+			this._installServiceInspection(serviceId);
+		} catch (error) {
+			this._registry.delete(key);
+			if (barePrefix !== void 0) this._bareBindings.delete(barePrefix);
+			if (descriptionWasAdded) this._serviceDescriptions.delete(serviceId);
+			if (rootPrincipalSetsWereAdded) this._serviceRootPrincipalSets.delete(serviceId);
+			this._notifyDirectoryWatchers(entry);
+			throw error;
+		}
+		let disposed = false;
+		return { dispose: () => {
+			if (disposed) return;
+			disposed = true;
+			if (this._registry.get(key) !== entry) return;
+			this._registry.delete(key);
+			for (const [prefix, binding] of this._bareBindings) if (binding.entry === entry) this._bareBindings.delete(prefix);
+			this._notifyDirectoryWatchers(entry);
+			if (serviceId !== void 0 && !this._hasBusinessServiceRegistration(serviceId)) {
+				this._removeServiceInspection(serviceId);
+				this._serviceDescriptions.delete(serviceId);
+				this._serviceRootPrincipalSets.delete(serviceId);
+			}
+		} };
+	}
+	/** Snapshot of every interface currently registered on this connection. */
+	listRegisteredInterfaces() {
+		return Array.from(this._registry.values()).map((r) => {
+			const sid = r.serviceId ?? "";
+			const item = {
+				serviceId: sid,
+				interfaceId: r.iface.info.id,
+				interfaceHash: r.iface.schemaHash
+			};
+			const desc = sid === "" ? void 0 : this._serviceDescriptions.get(sid);
+			if (desc !== void 0) item.serviceDescription = desc;
+			const sets = sid === "" ? void 0 : this._serviceRootPrincipalSets.get(sid);
+			if (sets !== void 0) item.rootPrincipalSets = sets;
+			return item;
 		});
-		this._subscribers.add(subscriber);
-		return subscriber;
 	}
-	observeTransits(observer) {
-		this._observers.add(observer);
+	/** Subscribe to coarse local directory changes; listeners must re-list. */
+	onDidChangeDirectory(listener) {
+		this._directoryListeners.add(listener);
+		return () => this._directoryListeners.delete(listener);
+	}
+	/**
+	* Look up a registered interface definition by id (and optional content
+	* hash). Returns `undefined` if no registered interface matches.
+	*/
+	findRegisteredInterface(interfaceId, hash) {
+		for (const r of this._registry.values()) {
+			if (r.iface.info.id !== interfaceId) continue;
+			if (hash !== void 0 && r.iface.schemaHash !== hash) continue;
+			return r.iface;
+		}
+	}
+	/**
+	* Register the three linkrpc reflection interfaces (`defaults`,
+	* `directory`, `schemas`), backed by this connection's live registry.
+	*
+	* By default they live under the root service (form-2 reachable as
+	* `hubrpc.directory::list`). Pass `serviceId` to additionally mount
+	* them under a specific service — useful for participants that live
+	* behind a hub, so callers can reach reflection via form-3
+	* `<serviceId>::hubrpc.directory::list`.
+	*
+	* Idempotent: re-registering the same `(serviceId, interfaceId)` pair
+	* is a no-op.
+	*/
+	enableReflection(opts = {}) {
+		const key = `${opts.serviceId ?? ""}::${defaultsInterface.info.id}`;
+		if (this._registry.has(key)) return { dispose() {} };
+		const prefix = `${opts.serviceId ?? ""}::`;
+		for (const iface of [directoryInterface, schemasInterface]) if (this._registry.has(`${prefix}${iface.info.id}`)) throw new Error(`enableReflection: partial reflection registration for service "${opts.serviceId ?? ""}".`);
+		const regOpts = opts.serviceId !== void 0 ? { serviceId: opts.serviceId } : {};
+		const registrations = [];
+		registrations.push(this.register(defaultsInterface, {
+			get: () => {
+				const binding = this._bareBindings.get("");
+				if (!binding) return {};
+				return {
+					serviceId: binding.entry.serviceId,
+					interfaceId: binding.entry.iface.info.id,
+					interfaceHash: binding.entry.iface.schemaHash
+				};
+			},
+			listBindings: () => ({ bindings: Array.from(this._bareBindings.values()).sort((a, b) => a.prefix < b.prefix ? -1 : a.prefix > b.prefix ? 1 : 0).map((binding) => ({
+				prefix: binding.prefix,
+				serviceId: binding.entry.serviceId,
+				interfaceId: binding.entry.iface.info.id,
+				interfaceHash: binding.entry.iface.schemaHash
+			})) })
+		}, regOpts));
+		registrations.push(this.register(directoryInterface, {
+			list: ({ interfaceId, interfaceIdPrefix, serviceId, serviceIdScopes, cursor, limit }) => {
+				const all = this.listRegisteredInterfaces().filter((r) => opts.serviceId === void 0 || r.serviceId === opts.serviceId).filter((r) => interfaceId === void 0 || r.interfaceId === interfaceId).filter((r) => interfaceIdPrefix === void 0 || r.interfaceId.startsWith(interfaceIdPrefix)).filter((r) => serviceId === void 0 || r.serviceId === serviceId).filter((r) => serviceIdMatchesScopes(r.serviceId, serviceIdScopes));
+				const start = cursor === void 0 ? 0 : Number.parseInt(cursor, 10) || 0;
+				const end = limit === void 0 ? all.length : Math.min(all.length, start + limit);
+				const page = all.slice(start, end).map((r) => ({
+					serviceId: r.serviceId,
+					interfaceId: r.interfaceId,
+					interfaceHash: r.interfaceHash,
+					serviceDescription: r.serviceDescription,
+					rootPrincipalSets: r.rootPrincipalSets?.map((set) => set.map((p) => ({ ...p })))
+				}));
+				return end < all.length ? {
+					items: page,
+					nextCursor: String(end)
+				} : { items: page };
+			},
+			watch: (params, _ctx, stream) => new Promise((resolve) => {
+				const watcher = {
+					interfaceId: params.interfaceId,
+					interfaceIdPrefix: params.interfaceIdPrefix,
+					serviceId: params.serviceId,
+					serviceIdScopes: params.serviceIdScopes,
+					send: () => stream.send({})
+				};
+				this._directoryWatchers.add(watcher);
+				const finish = () => {
+					this._directoryWatchers.delete(watcher);
+					resolve({});
+				};
+				if (stream.signal.aborted) {
+					finish();
+					return;
+				}
+				stream.signal.addEventListener("abort", finish, { once: true });
+			})
+		}, regOpts));
+		registrations.push(this.register(schemasInterface, { get: ({ interfaceId, hash }) => {
+			const iface = this.findRegisteredInterface(interfaceId, hash);
+			if (!iface) throw new RpcError("Interface not found", ErrorCode.methodNotFound, {
+				reason: "unknown-interface",
+				interfaceId,
+				hash
+			});
+			return { schema: iface.toSchema() };
+		} }, regOpts));
+		if (opts.serviceId !== void 0) try {
+			this.enableReflection();
+		} catch (error) {
+			for (const registration of registrations.reverse()) registration.dispose();
+			throw error;
+		}
 		let disposed = false;
 		return { dispose: () => {
 			if (disposed) return;
 			disposed = true;
-			this._observers.delete(observer);
-			this._clearCorrelationsIfUnused();
+			for (const registration of registrations.reverse()) registration.dispose();
 		} };
 	}
-	dispose() {
-		for (const subscriber of [...this._subscribers]) subscriber.dispose();
-		this._subscribers.clear();
-		this._observers.clear();
-		this._outboundRequests.clear();
-		this._inboundRequests.clear();
-		this._trafficWatches.clear();
-		this._setActive(false);
-	}
-	_onMessage(direction, message) {
-		const now = Date.now();
-		this._pruneRequestCorrelations(now);
-		const publiclyObserved = this._subscribers.size !== 0 || this._observers.size !== 0;
-		let transit;
-		const endpoint = this._endpoint("id" in message ? message.id ?? void 0 : void 0);
-		const base = {
-			type: "transit",
-			timeMs: now,
-			nodeId: this._nodeId,
-			...direction === "inbound" ? { in: endpoint } : { out: endpoint },
-			disposition: direction === "inbound" ? "consumed" : "forwarded"
-		};
-		if (isRequest(message)) {
-			const correlation = {
-				method: message.method,
-				timeMs: now
-			};
-			if (publiclyObserved) {
-				const map = this._requestMap(direction);
-				const key = requestKey(message.id);
-				map.delete(key);
-				map.set(key, correlation);
-			}
-			transit = {
-				...base,
-				kind: "request",
-				method: message.method,
-				params: message.params
-			};
-		} else if (isResponse(message)) {
-			const responseMap = direction === "inbound" ? this._outboundRequests : this._inboundRequests;
-			const key = requestKey(message.id);
-			const correlation = responseMap.get(key);
-			responseMap.delete(key);
-			transit = {
-				...base,
-				kind: "response",
-				method: correlation?.method,
-				result: "result" in message ? message.result : void 0,
-				error: "error" in message ? message.error : void 0
-			};
-		} else if (isNotification(message) && message.method === STREAM_METHOD) {
-			const params = message.params;
-			const streamEndpoint = this._endpoint(params?.requestId);
-			transit = {
-				...base,
-				...direction === "inbound" ? { in: streamEndpoint } : { out: streamEndpoint },
-				kind: "stream",
-				method: STREAM_METHOD,
-				params: message.params
-			};
-		} else transit = {
-			...base,
-			kind: "notification",
-			method: message.method,
-			params: message.params
-		};
-		function requestKey(requestId) {
-			return JSON.stringify([typeof requestId, requestId]);
-		}
-		if (this._trafficWatches.accept(transit)) return;
-		if (!publiclyObserved) return;
-		for (const observer of [...this._observers]) try {
-			observer(transit);
+	_notifyDirectoryWatchers(entry, serviceMetadataChanged = false) {
+		for (const listener of this._directoryListeners) try {
+			listener();
 		} catch {}
-		for (const subscriber of this._subscribers) subscriber.enqueue(transit);
-	}
-	_requestMap(direction) {
-		return direction === "outbound" ? this._outboundRequests : this._inboundRequests;
-	}
-	_endpoint(requestId) {
-		return {
-			edgeId: this._portId,
-			portId: this._portId,
-			...requestId !== void 0 ? { requestId } : {}
-		};
-	}
-	_clearCorrelationsIfUnused() {
-		if (this._subscribers.size !== 0 || this._observers.size !== 0) return;
-		this._outboundRequests.clear();
-		this._inboundRequests.clear();
-	}
-	_pruneRequestCorrelations(timeMs) {
-		this._pruneRequestMap(this._outboundRequests, timeMs);
-		this._pruneRequestMap(this._inboundRequests, timeMs);
-	}
-	_pruneRequestMap(map, timeMs) {
-		while (map.size !== 0) {
-			const first = map.entries().next().value;
-			if (first === void 0 || map.size <= MAX_REQUEST_CORRELATIONS && timeMs - first[1].timeMs <= REQUEST_CORRELATION_RETENTION_MS) return;
-			map.delete(first[0]);
+		for (const watcher of this._directoryWatchers) {
+			if (watcher.pending) continue;
+			const directlyMatches = directoryWatcherMatchesEntry(watcher, entry);
+			const metadataMatches = serviceMetadataChanged && entry.serviceId !== void 0 && [...this._registry.values()].some((candidate) => candidate.serviceId === entry.serviceId && directoryWatcherMatchesEntry(watcher, candidate));
+			if (!directlyMatches && !metadataMatches) continue;
+			watcher.pending = true;
+			queueMicrotask(() => {
+				watcher.pending = false;
+				if (this._directoryWatchers.has(watcher)) watcher.send();
+			});
 		}
 	}
-};
-//#endregion
-//#region src/connection/linkRpcConnection.ts
-/**
-* High-level linkrpc connection. Layers method-name routing and zod-driven
-* validation on top of a plain JSON-RPC channel.
-*
-* Typed proxies built by this class merely forward each call's
-* `interfaceHash` hint to the channel so the signer stamps it into the
-* `$hubrpc` envelope.
-*
-* `TInCtx` is the per-call out-of-band context the connection's transport
-* carries. Default `undefined` covers cross-process and ordinary in-process
-* transports. The hub's self/overlay connections instantiate with a
-* concrete `TInCtx` (e.g. `Participant`) so handlers can see who originated
-* the call.
-*
-* `TOutCtx` is the per-call override / extension bag the outbound sender
-* understands (see {@link SendOpts.ctx}). It only ever flows into the
-* sender as input, so it is a contravariant type parameter. Default `any`
-* keeps the bare `LinkRpcConnection` a valid supertype for holders that do
-* not care about the outbound ctx; pass a concrete shape (e.g.
-* `SigningCallCtx`) to get precise {@link get} typing. The connection
-* itself is agnostic to its contents — it merely forwards the `ctx`
-* defaults supplied to {@link get}.
-*/
-var LinkRpcConnection = class LinkRpcConnection {
-	/**
-	* Convenience: build a {@link JsonRpcChannel} `Channel` from the
-	* given transport and wrap it in an `LinkRpcConnection`. Use this
-	* when you have a transport at hand and don't need a decorator
-	* stack (e.g. signing).
-	*/
-	static fromTransport(transport, options = {}) {
-		return new LinkRpcConnection(JsonRpcChannel.create(transport), options);
-	}
-	/** Underlying JSON-RPC sender — useful for callers that need raw access (e.g. to call hub-served methods that bypass the interface registry). */
-	channel;
-	/** key = `${serviceId ?? ""}::${interfaceId}` */
-	_registry = /* @__PURE__ */ new Map();
-	/** Descriptions for services that have been registered with a `serviceDescription`. */
-	_serviceDescriptions = /* @__PURE__ */ new Map();
-	/** Root-node-id requirement sets recorded per serviceId. */
-	_serviceRootPrincipalSets = /* @__PURE__ */ new Map();
-	_directoryWatchers = /* @__PURE__ */ new Set();
-	_directoryListeners = /* @__PURE__ */ new Set();
-	_inspection;
-	_trafficInspector;
-	_serviceInspectionRegistrations = /* @__PURE__ */ new Map();
-	_wireChannel;
-	_validateOutboundParams;
-	/** Bare-method bindings, keyed by their exact wire prefix. */
-	_bareBindings = /* @__PURE__ */ new Map();
-	_generateTopologyId;
 	/**
-	* Construct from a {@link Channel} (binds the inbound handler and uses
-	* `channel.sender` for outbound calls) or from a bare
-	* {@link IRequestSender} (send-only — no inbound handler is registered,
-	* useful for bootstrap flows like `createManagedIdentity`).
+	* Enable the root `hubrpc.node::getNodeId` topology-bootstrap service.
+	*
+	* The generated ids are stable while this registration is active. They are
+	* unauthenticated correlation labels only; callers must not use them for
+	* identity, capability, or authorization decisions.
 	*/
-	constructor(channel, options = {}) {
-		this._validateOutboundParams = options.validateOutboundParams !== false;
-		this._generateTopologyId = options.generateTopologyId ?? createInspectionId;
-		if ("sender" in channel) {
-			this._wireChannel = channel;
-			this.channel = channel.sender;
-			channel.setRequestHandler({
-				handleRequest: (c) => this._handleRequest(c),
-				handleNotification: (c) => this._handleNotification(c)
-			});
-		} else {
-			this._wireChannel = void 0;
-			this.channel = channel;
+	enableInspection(descriptors) {
+		if (this._inspection !== void 0) return this._inspection;
+		const info = {
+			nodeId: this._generateTopologyId("node"),
+			portId: this._generateTopologyId("port"),
+			...descriptors !== void 0 ? { descriptors: [...descriptors] } : {}
+		};
+		const registration = this._register(nodeInterface, { getNodeId: () => info }, {}, true);
+		const host = new InspectionHost({
+			nodeId: info.nodeId,
+			descriptors
+		});
+		try {
+			if (this._wireChannel !== void 0) host.trackConnection(this, { portId: info.portId });
+		} catch (error) {
+			host.dispose();
+			registration.dispose();
+			throw error;
 		}
-	}
-	get(ifaceOrTarget, opts) {
-		if (isBareInterfaceTarget(ifaceOrTarget)) {
-			if (opts !== void 0) throw new Error("get: bare interface targets do not accept service or call options.");
-			return this.getBare(ifaceOrTarget.interface, { prefix: ifaceOrTarget.prefix });
+		this._inspectionHost = host;
+		let disposed = false;
+		const result = {
+			...info,
+			observeTraffic: (observer) => host.observeTraffic(observer),
+			dispose: () => {
+				if (disposed) return;
+				disposed = true;
+				for (const serviceId of [...this._serviceInspectionRegistrations.keys()]) this._removeServiceInspection(serviceId);
+				host.dispose();
+				if (this._inspectionHost === host) this._inspectionHost = void 0;
+				registration.dispose();
+				if (this._inspection === result) this._inspection = void 0;
+			}
+		};
+		this._inspection = result;
+		try {
+			const services = new Set(Array.from(this._registry.values()).filter((entry) => entry.serviceId !== void 0 && !entry.internalInspection).map((entry) => entry.serviceId));
+			for (const serviceId of services) this._installServiceInspection(serviceId);
+		} catch (error) {
+			result.dispose();
+			throw error;
 		}
-		return this._buildClient(ifaceOrTarget, opts ?? {});
-	}
-	/**
-	* Get a typed client that emits foreign-protocol bare method names.
-	* Unlike {@link get}, these calls carry no LinkRPC interface metadata.
-	*/
-	getBare(iface, opts = {}) {
-		const prefix = opts.prefix ?? "";
-		validateBarePrefix(prefix, "getBare");
-		for (const [name, member] of Object.entries(iface.members)) if (member instanceof RequestType && (member.clientStreamSchema !== void 0 || member.serverStreamSchema !== void 0)) throw new Error(`getBare: streaming method "${name}" is not supported on foreign wires.`);
-		return this._buildClient(iface, {}, prefix);
+		return result;
 	}
-	/** Get a service-scoped handle; all interfaces obtained from it route via `serviceId` (form 3). */
-	service(serviceId) {
-		return new ServiceHandle(this, serviceId);
+	/** Number of active endpoint traffic stream subscribers. */
+	get trafficObserverCount() {
+		return this._inspectionHost?.observerCount ?? 0;
 	}
-	/** Register handlers for an interface on this connection's server side. */
-	register(iface, handlers, opts = {}) {
-		return this._register(iface, handlers, opts, false);
+	close() {
+		if (this._closed) return;
+		this._closed = true;
+		for (const listener of [...this._closeListeners]) listener();
+		this._closeListeners.clear();
+		this._inspection?.dispose();
+		this._wireObservers.clear();
+		this._wireChannel?.setWireMessageObserver(void 0);
+		this.channel.close();
 	}
-	_register(iface, handlers, opts, internalInspection) {
-		const serviceId = opts.serviceId;
-		const key = `${serviceId ?? ""}::${iface.info.id}`;
-		if (this._registry.has(key)) throw new Error(`Interface "${iface.info.id}" already registered${serviceId ? ` under service "${serviceId}"` : ""}.`);
-		let serviceMetadataChanged = false;
-		if (opts.serviceDescription !== void 0) {
-			if (serviceId === void 0) throw new Error("register: `serviceDescription` requires `serviceId`.");
-			const existing = this._serviceDescriptions.get(serviceId);
-			if (existing !== void 0 && existing !== opts.serviceDescription) throw new Error(`register: conflicting descriptions for service "${serviceId}".`);
-			this._serviceDescriptions.set(serviceId, opts.serviceDescription);
-			serviceMetadataChanged = existing === void 0;
+	_buildClient(iface, opts, barePrefix, defaultRoute = false, allFailuresAsValues = false) {
+		const { serviceId, ...ctxRest } = opts;
+		const sendOpts = barePrefix === void 0 ? {
+			ctx: ctxRest,
+			interfaceHash: iface.schemaHash
+		} : void 0;
+		const prefix = barePrefix ?? (defaultRoute ? "" : serviceId ? `${serviceId}::${iface.info.id}::` : `${iface.info.id}::`);
+		const proxy = {};
+		for (const [name, member] of Object.entries(iface.members)) {
+			const wireMethod = `${prefix}${name}`;
+			if (member.kind === "request") {
+				if (member.clientStreamSchema !== void 0 || member.serverStreamSchema !== void 0) {
+					const serverStreamSchema = member.serverStreamSchema;
+					proxy[name] = (params, callOpts) => {
+						const userListener = callOpts?.onMessage;
+						const onStreamMessage = userListener !== void 0 ? (raw) => {
+							if (serverStreamSchema !== void 0) {
+								const r = safeParse(serverStreamSchema, raw);
+								if (!r.success) return;
+								userListener(r.data);
+								return;
+							}
+							userListener(raw);
+						} : void 0;
+						const channelOpts = onStreamMessage !== void 0 ? {
+							...sendOpts,
+							onStreamMessage
+						} : sendOpts;
+						let call;
+						try {
+							this._validateOutboundParamsFor(member, wireMethod, params);
+							call = this.channel.sendRequestWithStream(wireMethod, params, channelOpts);
+						} catch (cause) {
+							if (!allFailuresAsValues) throw cause;
+							call = {
+								result: Promise.reject(cause),
+								send: () => {
+									throw cause;
+								},
+								cancel: () => {
+									throw cause;
+								},
+								ping: async () => {
+									throw cause;
+								}
+							};
+						}
+						const checked = addCheckedResult(call.result.then((raw) => validateWireResult(member.resultSchema, raw, wireMethod)), member, allFailuresAsValues);
+						return Object.assign(checked, {
+							send: async (payload) => call.send(payload),
+							cancel: async (reason) => call.cancel(reason),
+							dispose: (reason) => call.dispose?.(reason),
+							ping: () => call.ping()
+						});
+					};
+				} else proxy[name] = (params) => {
+					return addCheckedResult((async () => {
+						this._validateOutboundParamsFor(member, wireMethod, params);
+						const raw = await this.channel.sendRequest(wireMethod, params, sendOpts);
+						return validateWireResult(member.resultSchema, raw, wireMethod);
+					})(), member, allFailuresAsValues);
+				};
+			} else {
+				const notify = (params) => {
+					this._validateOutboundParamsFor(member, wireMethod, params);
+					this.channel.sendNotification(wireMethod, params, sendOpts);
+				};
+				proxy[name] = barePrefix === void 0 ? async (params) => notify(params) : notify;
+			}
 		}
-		if (opts.rootPrincipalSets !== void 0) {
-			if (serviceId === void 0) throw new Error("register: `rootPrincipalSets` requires `serviceId`.");
-			const existing = this._serviceRootPrincipalSets.get(serviceId);
-			if (existing !== void 0 && !rootPrincipalSetsEqual(existing, opts.rootPrincipalSets)) throw new Error(`register: conflicting rootPrincipalSets for service "${serviceId}".`);
-			this._serviceRootPrincipalSets.set(serviceId, opts.rootPrincipalSets);
-			serviceMetadataChanged ||= existing === void 0;
+		return proxy;
+	}
+	_validateOutboundParamsFor(member, wireMethod, params) {
+		if (!this._validateOutboundParams) return;
+		validateValue(member.paramsSchema, params, `Invalid params for ${wireMethod}`, ErrorCode.invalidParams);
+	}
+	async _handleRequest(call) {
+		const parsed = this._parseRouted(call.method);
+		if (!parsed.ok) return notFound(parsed.reason, call.method);
+		const { entry, memberName } = parsed;
+		const member = entry.iface.members[memberName];
+		if (!member) return notFound("unknown-method", call.method);
+		const handler = entry.handlers[memberName];
+		if (!handler) return notFound("unknown-method", call.method);
+		const userParams = stripLinkRpcWireMeta(call.params);
+		const parsedParams = safeParse(member.paramsSchema, userParams);
+		if (!parsedParams.success) return { error: {
+			code: ErrorCode.invalidParams,
+			message: "Invalid params",
+			data: { issues: parsedParams.error.issues }
+		} };
+		if (!(member instanceof RequestType)) return notFound("unknown-method", call.method);
+		const stream = this._buildStreamApi(call.stream, call.signal, member);
+		try {
+			const result = await handler(parsedParams.data, call.context, stream);
+			const encodedError = encodeApplicationError(member, result);
+			if (encodedError !== void 0) return { error: encodedError };
+			validateValue(member.resultSchema, result, `Invalid result for ${call.method}`, ErrorCode.internalError);
+			return { result: result === void 0 ? null : result };
+		} catch (e) {
+			if (e instanceof RpcError) return { error: {
+				code: e.code,
+				message: e.message,
+				data: e.data
+			} };
+			return { error: {
+				code: ErrorCode.internalError,
+				message: e instanceof Error ? e.message : String(e)
+			} };
 		}
-		const entry = {
-			iface,
-			handlers,
-			serviceId,
-			internalInspection
+	}
+	_buildStreamApi(callStream, signal, member) {
+		return {
+			send: (payload) => {
+				if (member.serverStreamSchema) {
+					const r = safeParse(member.serverStreamSchema, payload);
+					if (!r.success) throw new Error(`Server stream payload failed schema validation: ${r.error.message}`);
+				}
+				return callStream.send(payload);
+			},
+			onMessage: (listener) => {
+				callStream.onMessage((raw) => {
+					if (member.clientStreamSchema) {
+						const r = safeParse(member.clientStreamSchema, raw);
+						if (!r.success) return;
+						listener(r.data);
+						return;
+					}
+				});
+			},
+			ping: () => callStream.ping(),
+			signal
 		};
-		this._registry.set(key, entry);
-		this._notifyDirectoryWatchers(entry, serviceMetadataChanged);
-		if (!internalInspection && serviceId !== void 0 && this._inspection !== void 0 && !this._serviceInspectionRegistrations.has(serviceId)) try {
-			this._installServiceInspection(serviceId);
-		} catch (error) {
-			this._registry.delete(key);
-			this._notifyDirectoryWatchers(entry);
-			throw error;
-		}
-		let disposed = false;
-		return { dispose: () => {
-			if (disposed) return;
-			disposed = true;
-			if (this._registry.get(key) !== entry) return;
-			this._registry.delete(key);
-			for (const [prefix, binding] of this._bareBindings) if (binding.entry === entry) this._bareBindings.delete(prefix);
-			this._notifyDirectoryWatchers(entry);
-			if (serviceId !== void 0 && !this._hasBusinessServiceRegistration(serviceId)) {
-				this._removeServiceInspection(serviceId);
-				this._serviceDescriptions.delete(serviceId);
-				this._serviceRootPrincipalSets.delete(serviceId);
-			}
-		} };
 	}
-	/**
-	* Declare the preset interface for form-1 (bare-method) dispatch. The
-	* interface must already be registered under the root (no serviceId).
-	* Surfaced via `hubrpc.defaults::get`.
-	*/
-	setPreset(iface) {
-		const key = `::${iface.info.id}`;
-		const entry = this._registry.get(key);
-		if (!entry) throw new Error(`setPreset: interface "${iface.info.id}" is not registered under the root service.`);
-		this._bareBindings.set("", {
-			prefix: "",
-			entry
-		});
+	_handleNotification(call) {
+		const parsed = this._parseRouted(call.method);
+		if (!parsed.ok) return;
+		const { entry, memberName } = parsed;
+		const member = entry.iface.members[memberName];
+		if (!(member instanceof NotificationType)) return;
+		const handler = entry.handlers[memberName];
+		if (!handler) return;
+		const userParams = stripLinkRpcWireMeta(call.params);
+		const parsedParams = safeParse(member.paramsSchema, userParams);
+		if (!parsedParams.success) return;
+		handler(parsedParams.data, call.context);
 	}
-	/**
-	* Bind foreign-protocol bare methods to an already registered interface.
-	* Matching uses the longest prefix; once selected, a missing member does
-	* not fall through to a shorter binding.
-	*/
-	bindBare(iface, opts) {
-		validateBarePrefix(opts.prefix, "bindBare");
-		const key = `${opts.serviceId ?? ""}::${iface.info.id}`;
+	_parseRouted(method) {
+		const parsed = parseMethodName(method);
+		if (!parsed) return {
+			ok: false,
+			reason: "bad-method-grammar"
+		};
+		if (parsed.kind === "bare") {
+			let selected;
+			for (const binding of this._bareBindings.values()) if (parsed.member.startsWith(binding.prefix) && (selected === void 0 || binding.prefix.length > selected.prefix.length)) selected = binding;
+			if (!selected) return {
+				ok: false,
+				reason: "no-preset"
+			};
+			return {
+				ok: true,
+				entry: selected.entry,
+				memberName: parsed.member.slice(selected.prefix.length)
+			};
+		}
+		const serviceId = parsed.kind === "full" ? parsed.serviceId : void 0;
+		const key = `${serviceId ?? ""}::${parsed.interfaceId}`;
 		const entry = this._registry.get(key);
-		if (!entry) throw new Error(`bindBare: interface "${iface.info.id}" is not registered` + (opts.serviceId === void 0 ? " under the root service." : ` under service "${opts.serviceId}".`));
-		if (this._bareBindings.has(opts.prefix)) throw new Error(`bindBare: prefix "${opts.prefix}" is already bound.`);
-		const binding = {
-			prefix: opts.prefix,
-			entry
+		if (!entry) return {
+			ok: false,
+			reason: serviceId ? "unknown-service" : "unknown-interface"
+		};
+		return {
+			ok: true,
+			entry,
+			memberName: parsed.member
 		};
-		this._bareBindings.set(opts.prefix, binding);
-		let disposed = false;
-		return { dispose: () => {
-			if (disposed) return;
-			disposed = true;
-			if (this._bareBindings.get(opts.prefix) === binding) this._bareBindings.delete(opts.prefix);
-		} };
 	}
-	/** Snapshot of every interface currently registered on this connection. */
-	listRegisteredInterfaces() {
-		return Array.from(this._registry.values()).map((r) => {
-			const sid = r.serviceId ?? "";
-			const item = {
-				serviceId: sid,
-				interfaceId: r.iface.info.id,
-				interfaceHash: r.iface.schemaHash
-			};
-			const desc = sid === "" ? void 0 : this._serviceDescriptions.get(sid);
-			if (desc !== void 0) item.serviceDescription = desc;
-			const sets = sid === "" ? void 0 : this._serviceRootPrincipalSets.get(sid);
-			if (sets !== void 0) item.rootPrincipalSets = sets;
-			return item;
-		});
+	_installServiceInspection(serviceId) {
+		if (this._serviceInspectionRegistrations.has(serviceId)) return;
+		const info = this._inspection;
+		const host = this._inspectionHost;
+		if (info === void 0 || host === void 0) return;
+		this._serviceInspectionRegistrations.set(serviceId, [host.expose(this, {
+			serviceId,
+			portId: info.portId
+		})]);
 	}
-	/** Subscribe to coarse local directory changes; listeners must re-list. */
-	onDidChangeDirectory(listener) {
-		this._directoryListeners.add(listener);
-		return () => this._directoryListeners.delete(listener);
+	_removeServiceInspection(serviceId) {
+		const registrations = this._serviceInspectionRegistrations.get(serviceId);
+		if (registrations === void 0) return;
+		this._serviceInspectionRegistrations.delete(serviceId);
+		for (const registration of registrations.reverse()) registration.dispose();
 	}
-	/**
-	* Look up a registered interface definition by id (and optional content
-	* hash). Returns `undefined` if no registered interface matches.
-	*/
-	findRegisteredInterface(interfaceId, hash) {
-		for (const r of this._registry.values()) {
-			if (r.iface.info.id !== interfaceId) continue;
-			if (hash !== void 0 && r.iface.schemaHash !== hash) continue;
-			return r.iface;
+	_hasBusinessServiceRegistration(serviceId) {
+		return Array.from(this._registry.values()).some((entry) => entry.serviceId === serviceId && !entry.internalInspection);
+	}
+};
+function createInspectionId(kind) {
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	globalThis.crypto.getRandomValues(bytes);
+	return `${kind}:${bytesToBase64Url(bytes)}`;
+}
+/** Structural equality for two CNF root-node-id requirement collections. */
+function rootPrincipalSetsEqual(a, b) {
+	if (a.length !== b.length) return false;
+	for (let i = 0; i < a.length; i++) {
+		const sa = a[i];
+		const sb = b[i];
+		if (sa.length !== sb.length) return false;
+		for (let j = 0; j < sa.length; j++) {
+			if (sa[j].principal !== sb[j].principal) return false;
+			if (sa[j].transitive === true !== (sb[j].transitive === true)) return false;
 		}
 	}
-	/**
-	* Register the three linkrpc reflection interfaces (`defaults`,
-	* `directory`, `schemas`), backed by this connection's live registry.
-	*
-	* By default they live under the root service (form-2 reachable as
-	* `hubrpc.directory::list`). Pass `serviceId` to additionally mount
-	* them under a specific service — useful for participants that live
-	* behind a hub, so callers can reach reflection via form-3
-	* `<serviceId>::hubrpc.directory::list`.
-	*
-	* Idempotent: re-registering the same `(serviceId, interfaceId)` pair
-	* is a no-op.
-	*/
-	enableReflection(opts = {}) {
-		const key = `${opts.serviceId ?? ""}::${defaultsInterface.info.id}`;
-		if (this._registry.has(key)) return { dispose() {} };
-		const prefix = `${opts.serviceId ?? ""}::`;
-		for (const iface of [directoryInterface, schemasInterface]) if (this._registry.has(`${prefix}${iface.info.id}`)) throw new Error(`enableReflection: partial reflection registration for service "${opts.serviceId ?? ""}".`);
-		const regOpts = opts.serviceId !== void 0 ? { serviceId: opts.serviceId } : {};
-		const registrations = [];
-		registrations.push(this.register(defaultsInterface, {
-			get: () => {
-				const binding = this._bareBindings.get("");
-				if (!binding) return {};
-				return {
-					serviceId: binding.entry.serviceId,
-					interfaceId: binding.entry.iface.info.id,
-					interfaceHash: binding.entry.iface.schemaHash
-				};
-			},
-			listBindings: () => ({ bindings: Array.from(this._bareBindings.values()).sort((a, b) => a.prefix < b.prefix ? -1 : a.prefix > b.prefix ? 1 : 0).map((binding) => ({
-				prefix: binding.prefix,
-				serviceId: binding.entry.serviceId,
-				interfaceId: binding.entry.iface.info.id,
-				interfaceHash: binding.entry.iface.schemaHash
-			})) })
-		}, regOpts));
-		registrations.push(this.register(directoryInterface, {
-			list: ({ interfaceId, interfaceIdPrefix, serviceId, serviceIdScopes, cursor, limit }) => {
-				const all = this.listRegisteredInterfaces().filter((r) => opts.serviceId === void 0 || r.serviceId === opts.serviceId).filter((r) => interfaceId === void 0 || r.interfaceId === interfaceId).filter((r) => interfaceIdPrefix === void 0 || r.interfaceId.startsWith(interfaceIdPrefix)).filter((r) => serviceId === void 0 || r.serviceId === serviceId).filter((r) => serviceIdMatchesScopes(r.serviceId, serviceIdScopes));
-				const start = cursor === void 0 ? 0 : Number.parseInt(cursor, 10) || 0;
-				const end = limit === void 0 ? all.length : Math.min(all.length, start + limit);
-				const page = all.slice(start, end).map((r) => ({
-					serviceId: r.serviceId,
-					interfaceId: r.interfaceId,
-					interfaceHash: r.interfaceHash,
-					serviceDescription: r.serviceDescription,
-					rootPrincipalSets: r.rootPrincipalSets?.map((set) => set.map((p) => ({ ...p })))
-				}));
-				return end < all.length ? {
-					items: page,
-					nextCursor: String(end)
-				} : { items: page };
-			},
-			watch: (params, _ctx, stream) => new Promise((resolve) => {
-				const watcher = {
-					interfaceId: params.interfaceId,
-					interfaceIdPrefix: params.interfaceIdPrefix,
-					serviceId: params.serviceId,
-					serviceIdScopes: params.serviceIdScopes,
-					send: () => stream.send({})
-				};
-				this._directoryWatchers.add(watcher);
-				const finish = () => {
-					this._directoryWatchers.delete(watcher);
-					resolve({});
-				};
-				if (stream.signal.aborted) {
-					finish();
-					return;
-				}
-				stream.signal.addEventListener("abort", finish, { once: true });
-			})
-		}, regOpts));
-		registrations.push(this.register(schemasInterface, { get: ({ interfaceId, hash }) => {
-			const iface = this.findRegisteredInterface(interfaceId, hash);
-			if (!iface) throw new RpcError("Interface not found", ErrorCode.methodNotFound, {
-				reason: "unknown-interface",
-				interfaceId,
-				hash
-			});
-			return { schema: iface.toSchema() };
-		} }, regOpts));
-		if (opts.serviceId !== void 0) try {
-			this.enableReflection();
-		} catch (error) {
-			for (const registration of registrations.reverse()) registration.dispose();
-			throw error;
+	return true;
+}
+function directoryWatcherMatchesEntry(watcher, entry) {
+	const serviceId = entry.serviceId ?? "";
+	return (watcher.interfaceId === void 0 || watcher.interfaceId === entry.iface.info.id) && (watcher.interfaceIdPrefix === void 0 || entry.iface.info.id.startsWith(watcher.interfaceIdPrefix)) && (watcher.serviceId === void 0 || watcher.serviceId === serviceId) && serviceIdMatchesScopes(serviceId, watcher.serviceIdScopes);
+}
+function addCheckedResult(promise, member, allFailuresAsValues = false) {
+	const settled = promise.then((value) => ({
+		ok: true,
+		value
+	}), (cause) => ({
+		ok: false,
+		error: decodeCheckedError(cause, member.applicationErrors),
+		cause
+	}));
+	const result = settled.then((outcome) => {
+		if (outcome.ok) return outcome.value;
+		if (allFailuresAsValues) return new RpcFailure(outcome.error.kind === "application" ? {
+			kind: "application",
+			error: outcome.error
+		} : {
+			kind: "generic",
+			error: outcome.error
+		});
+		if (outcome.error.kind === "application") return new RpcFailure(outcome.error);
+		throw outcome.error.kind === "nonCompliantServer" ? outcome.error : outcome.cause;
+	});
+	return Object.assign(result, { result: async () => {
+		result.catch(() => {});
+		const outcome = await settled;
+		return outcome.ok ? outcome : {
+			ok: false,
+			error: outcome.error
+		};
+	} });
+}
+function decodeCheckedError(cause, descriptors) {
+	if (cause instanceof NonCompliantServerError) return cause;
+	if (!(cause instanceof RpcError) || cause.origin !== "remote") return {
+		kind: cause instanceof RpcError && cause.origin === "transport" ? "transport" : "local",
+		cause
+	};
+	const original = {
+		code: cause.code,
+		message: cause.message,
+		...cause.hasData ? { data: cause.data } : {}
+	};
+	const candidates = descriptors.filter((candidate) => candidate.code === cause.code).sort((a, b) => Number(b.type !== void 0) - Number(a.type !== void 0));
+	const body = {
+		message: cause.message,
+		...cause.hasData ? { data: cause.data } : {}
+	};
+	const issues = [];
+	for (const descriptor of candidates) {
+		const parsed = parseDeclaredErrorBody(descriptor, body);
+		if (!parsed.success) {
+			issues.push(...parsed.issues);
+			continue;
 		}
-		let disposed = false;
-		return { dispose: () => {
-			if (disposed) return;
-			disposed = true;
-			for (const registration of registrations.reverse()) registration.dispose();
-		} };
+		if (descriptor.type === void 0) return brandApplicationError({
+			...parsed.data,
+			kind: "application",
+			code: descriptor.code
+		});
+		const envelope = parsed.data.data;
+		return brandApplicationError({
+			kind: "application",
+			code: descriptor.code,
+			message: parsed.data.message,
+			type: descriptor.type,
+			...typeof envelope === "object" && envelope !== null && "data" in envelope ? { data: envelope.data } : {}
+		});
 	}
-	_notifyDirectoryWatchers(entry, serviceMetadataChanged = false) {
-		for (const listener of this._directoryListeners) try {
-			listener();
-		} catch {}
-		for (const watcher of this._directoryWatchers) {
-			if (watcher.pending) continue;
-			const directlyMatches = directoryWatcherMatchesEntry(watcher, entry);
-			const metadataMatches = serviceMetadataChanged && entry.serviceId !== void 0 && [...this._registry.values()].some((candidate) => candidate.serviceId === entry.serviceId && directoryWatcherMatchesEntry(watcher, candidate));
-			if (!directlyMatches && !metadataMatches) continue;
-			watcher.pending = true;
-			queueMicrotask(() => {
-				watcher.pending = false;
-				if (this._directoryWatchers.has(watcher)) watcher.send();
+	if (candidates.length > 0) return new NonCompliantServerError(original, issues);
+	return {
+		kind: "remote",
+		...original
+	};
+}
+function encodeApplicationError(member, value) {
+	if (!isApplicationErrorValue(value)) return void 0;
+	const candidate = value;
+	const descriptor = member.applicationErrors.find((error) => error.code === candidate.code && error.type === candidate.type && (error.bodySchema !== void 0 || error.type !== void 0 || error.message === candidate.message));
+	if (descriptor === void 0) throw new RpcError(`Undeclared application error ${String(candidate.code)}`, ErrorCode.internalError);
+	const data = Object.hasOwn(value, "data") ? { data: value.data } : {};
+	const body = {
+		message: value.message,
+		...descriptor.type === void 0 ? data : { data: {
+			type: descriptor.type,
+			...data
+		} }
+	};
+	const parsed = parseDeclaredErrorBody(descriptor, body);
+	const issues = parsed.success ? jsonIssues(body) : parsed.issues;
+	if (issues.length > 0) throw new RpcError(`Invalid data for application error ${descriptor.code}`, ErrorCode.internalError, { issues: issues.map((issue) => ({ ...issue })) });
+	return {
+		code: descriptor.code,
+		...body
+	};
+}
+function validateWireResult(schema, raw, wireMethod) {
+	const value = normalizeWireResult(schema, raw);
+	validateValue(schema, value, `Invalid result for ${wireMethod}`, ErrorCode.internalError);
+	return value;
+}
+/** Validate at both ends without stripping extra keys or applying schema transforms. */
+function validateValue(schema, value, message, code) {
+	const checked = safeParse(schema, value);
+	if (!checked.success) throw new RpcError(message, code, { issues: checked.error.issues });
+}
+/** Undo the server's undefined → null convention only when the schema rejects null. */
+function normalizeWireResult(schema, raw) {
+	if (raw !== null) return raw;
+	if (safeParse(schema, null).success) return null;
+	if (safeParse(schema, void 0).success) return void 0;
+	return null;
+}
+/** Service-scoped handle returned by `connection.service(id)`. */
+var ServiceHandle = class {
+	_connection;
+	_serviceId;
+	constructor(_connection, _serviceId) {
+		this._connection = _connection;
+		this._serviceId = _serviceId;
+	}
+	getResultClient(iface, opts = {}) {
+		return this._connection.getResultClient(iface, {
+			...opts,
+			serviceId: this._serviceId
+		});
+	}
+	get(iface, opts = {}) {
+		return this._connection.get(iface, {
+			...opts,
+			serviceId: this._serviceId
+		});
+	}
+	register(ifaceOrTarget, handlers, opts = {}) {
+		return this._connection.register(ifaceOrTarget, handlers, {
+			...opts,
+			serviceId: this._serviceId
+		});
+	}
+};
+function notFound(reason, method) {
+	return { error: {
+		code: ErrorCode.methodNotFound,
+		message: `Method not found: ${method}`,
+		data: {
+			reason,
+			method
+		}
+	} };
+}
+//#endregion
+//#region src/schema/exportStaticHubSchema.ts
+/** Export a complete static contract, failing on missing reflection, schemas, or truncated discovery. */
+async function exportStaticHubSchema(channel, options = {}) {
+	if (options.maxDepth !== void 0 && (!Number.isSafeInteger(options.maxDepth) || options.maxDepth < 0)) throw new Error("maxDepth must be a non-negative integer");
+	const cursors = /* @__PURE__ */ new Map();
+	const timed = {
+		close: () => {},
+		sendRequest: (method, params, opts) => {
+			const call = channel.sendRequestWithStream(method, params, opts);
+			return withRpcTimeout(Object.assign(call.result, {
+				cancel: (reason) => call.cancel(reason),
+				dispose: (reason) => call.dispose?.(reason)
+			}), `contract export ${method}`, options.timeoutMs);
+		},
+		sendNotification: (method, params, opts) => channel.sendNotification(method, params, opts),
+		sendRequestWithStream: (method, params, opts) => {
+			const call = channel.sendRequestWithStream(method, params, opts);
+			if (!method.endsWith("hubrpc.directory::list")) return call;
+			return {
+				send: (payload) => call.send(payload),
+				cancel: (reason) => call.cancel(reason),
+				dispose: (reason) => call.dispose?.(reason),
+				ping: () => call.ping(),
+				result: call.result.then((raw) => {
+					const parsed = safeParse(directoryInterface.members.list.resultSchema, raw);
+					if (!parsed.success) throw new Error(`Invalid directory response from ${method}`);
+					const page = parsed.data;
+					if (page.truncated) throw new Error(`Truncated directory response from ${method}`);
+					if (!params || typeof params !== "object" || !("cursor" in params)) cursors.set(method, /* @__PURE__ */ new Set());
+					if (page.nextCursor !== void 0) {
+						const seen = cursors.get(method);
+						if (seen.has(page.nextCursor)) throw new Error(`Repeated directory cursor from ${method}`);
+						seen.add(page.nextCursor);
+					}
+					return raw;
+				})
+			};
+		}
+	};
+	const connection = new LinkRpcConnection(timed);
+	const explorer = new HubDirectoryExplorer(timed, {
+		rootTarget: options.serviceId,
+		maxDepth: options.maxDepth,
+		timeoutMs: options.timeoutMs
+	});
+	try {
+		await explorer.explore();
+		const snapshot = explorer.graphSnapshot;
+		const incomplete = [snapshot.root, ...snapshot.directories].filter((node) => node.state !== "loaded");
+		if (!snapshot.complete || incomplete.length !== 0 || snapshot.result.inaccessible.length !== 0) throw new Error(`Incomplete contract directory discovery: ${incomplete.map((node) => `${node.target.serviceId ?? "<root>"}: ${node.inaccessibleReason ?? node.state}`).join(", ")}`);
+		const explored = new Set([snapshot.root, ...snapshot.directories].map((node) => node.target.serviceId ?? ""));
+		for (const listing of snapshot.result.listings) if (listing.interfaceId === directoryInterface.info.id && !explored.has(listing.serviceId)) throw new Error(`Incomplete contract directory discovery: '${listing.serviceId}' exceeds maxDepth`);
+		const defaults = connection.get(defaultsInterface, { serviceId: options.serviceId });
+		const preset = await defaults.get({});
+		const { bindings } = await defaults.listBindings({});
+		if (preset.interfaceId === void 0 !== (preset.interfaceHash === void 0)) throw new Error("Incomplete default interface reference: both interfaceId and interfaceHash are required");
+		if (preset.serviceId !== void 0 && preset.interfaceId === void 0) throw new Error("A service-only preset cannot be represented by defaultInterface");
+		const services = /* @__PURE__ */ new Map();
+		const schemas = /* @__PURE__ */ new Map();
+		async function resolve(ref, serviceId) {
+			const key = `${ref.interfaceId}@${ref.interfaceHash}`;
+			if (schemas.has(key)) return;
+			const { schema } = await connection.get(schemasInterface, { serviceId }).get({
+				interfaceId: ref.interfaceId,
+				hash: ref.interfaceHash
 			});
+			const validated = parseStaticHubSchema({ interfaceSchemas: [schema] }).interfaceSchemas[0];
+			if (validated.id !== ref.interfaceId || validated.hash !== ref.interfaceHash) throw new Error(`Schema response does not match ${key}`);
+			schemas.set(key, validated);
 		}
-	}
-	/**
-	* Enable the root `hubrpc.node::getNodeId` topology-bootstrap service.
-	*
-	* The generated ids are stable while this registration is active. They are
-	* unauthenticated correlation labels only; callers must not use them for
-	* identity, capability, or authorization decisions.
-	*/
-	enableInspection(descriptors) {
-		if (this._inspection !== void 0) return this._inspection;
-		const info = {
-			nodeId: this._generateTopologyId("node"),
-			portId: this._generateTopologyId("port"),
-			...descriptors !== void 0 ? { descriptors: [...descriptors] } : {}
-		};
-		const registration = this._register(nodeInterface, { getNodeId: () => info }, {}, true);
-		const trafficInspector = new EndpointTrafficInspector(info.nodeId, info.portId, (active) => this._wireChannel?.setWireMessageObserver(active ? trafficInspector.observe : void 0));
-		this._trafficInspector = trafficInspector;
-		trafficInspector.start();
-		let disposed = false;
-		const result = {
-			...info,
-			observeTraffic: (observer) => trafficInspector.observeTransits(observer),
-			dispose: () => {
-				if (disposed) return;
-				disposed = true;
-				for (const serviceId of [...this._serviceInspectionRegistrations.keys()]) this._removeServiceInspection(serviceId);
-				trafficInspector.dispose();
-				if (this._trafficInspector === trafficInspector) this._trafficInspector = void 0;
-				registration.dispose();
-				if (this._inspection === result) this._inspection = void 0;
-			}
-		};
-		this._inspection = result;
-		try {
-			const services = new Set(Array.from(this._registry.values()).filter((entry) => entry.serviceId !== void 0 && !entry.internalInspection).map((entry) => entry.serviceId));
-			for (const serviceId of services) this._installServiceInspection(serviceId);
-		} catch (error) {
-			result.dispose();
-			throw error;
+		for (const listing of snapshot.result.listings) {
+			const ref = {
+				interfaceId: listing.interfaceId,
+				interfaceHash: listing.hash
+			};
+			const interfaces = services.get(listing.serviceId) ?? [];
+			interfaces.push(ref);
+			services.set(listing.serviceId, interfaces);
+			await resolve(ref, listing.discoveredFrom || void 0);
 		}
-		return result;
+		const defaultInterface = preset.interfaceId === void 0 ? void 0 : {
+			interfaceId: preset.interfaceId,
+			interfaceHash: preset.interfaceHash
+		};
+		if (defaultInterface) await resolve(defaultInterface, options.serviceId ?? preset.serviceId);
+		for (const binding of bindings) await resolve(binding, options.serviceId ?? binding.serviceId);
+		const compare = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+		return parseStaticHubSchema({
+			interfaceSchemas: [...schemas.values()].sort((a, b) => compare(`${a.id}@${a.hash}`, `${b.id}@${b.hash}`)),
+			services: [...services].sort(([a], [b]) => compare(a, b)).map(([serviceId, interfaces]) => ({
+				serviceId,
+				interfaces: interfaces.sort((a, b) => compare(a.interfaceId, b.interfaceId))
+			})),
+			...defaultInterface === void 0 ? {} : { defaultInterface },
+			bareInterfaces: bindings.map(({ prefix, interfaceId, interfaceHash }) => ({
+				prefix,
+				interface: {
+					interfaceId,
+					interfaceHash
+				}
+			})).sort((a, b) => compare(a.prefix, b.prefix))
+		});
+	} finally {
+		explorer.dispose();
 	}
-	/** Number of active endpoint traffic stream subscribers. */
-	get trafficObserverCount() {
-		return this._trafficInspector?.observerCount ?? 0;
+}
+//#endregion
+//#region src/protocol/capability.ts
+/**
+* Structural wire-shape check for an untrusted signed capability. This does
+* not establish authenticity; callers must still verify its signature and
+* delegation chain.
+*/
+function hasSignedCapabilityShape(value) {
+	if (!_isRecord(value)) return false;
+	if (typeof value.issuer !== "string" || typeof value.audience !== "string" || typeof value.nonce !== "string" || !Array.isArray(value.permissions) || !value.permissions.every(_hasPermissionShape) || value.expiresAtMs !== void 0 && typeof value.expiresAtMs !== "number" || value.parentHash !== void 0 && typeof value.parentHash !== "string") return false;
+	return readSignature(value, "capability") !== void 0;
+}
+function _hasPermissionShape(value) {
+	if (!_isRecord(value) || !_isRecord(value.target)) return false;
+	const target = value.target;
+	if (!_hasPatternShape(target.serviceId) || !_hasPatternShape(target.interfaceId) || !Array.isArray(target.members) || !target.members.every(_hasPatternShape) || target.interfaceHash !== void 0 && typeof target.interfaceHash !== "string" || value.canInvoke !== void 0 && typeof value.canInvoke !== "boolean" || value.canDelegate !== void 0 && typeof value.canDelegate !== "boolean") return false;
+	if (value.params !== void 0) {
+		if (!_isRecord(value.params) || !Object.values(value.params).every(_hasParamMatcherShape)) return false;
 	}
-	close() {
-		this.channel.close();
+	if (value.callBind !== void 0) {
+		if (!_isRecord(value.callBind) || value.callBind.alg !== "sha256" || typeof value.callBind.payloadHash !== "string") return false;
 	}
-	_buildClient(iface, opts, barePrefix) {
-		const { serviceId, ...ctxRest } = opts;
-		const sendOpts = barePrefix === void 0 ? {
-			ctx: ctxRest,
-			interfaceHash: iface.schemaHash
-		} : void 0;
-		const prefix = barePrefix ?? (serviceId ? `${serviceId}::${iface.info.id}::` : `${iface.info.id}::`);
-		const proxy = {};
-		for (const [name, member] of Object.entries(iface.members)) {
-			const wireMethod = `${prefix}${name}`;
-			if (member.kind === "request") {
-				if (member.clientStreamSchema !== void 0 || member.serverStreamSchema !== void 0) {
-					const serverStreamSchema = member.serverStreamSchema;
-					proxy[name] = (params, callOpts) => {
-						const userListener = callOpts?.onMessage;
-						const onStreamMessage = userListener !== void 0 ? (raw) => {
-							if (serverStreamSchema !== void 0) {
-								const r = safeParse(serverStreamSchema, raw);
-								if (!r.success) return;
-								userListener(r.data);
-								return;
-							}
-							userListener(raw);
-						} : void 0;
-						const channelOpts = onStreamMessage !== void 0 ? {
-							...sendOpts,
-							onStreamMessage
-						} : sendOpts;
-						this._validateOutboundParamsFor(member, wireMethod, params);
-						const call = this.channel.sendRequestWithStream(wireMethod, params, channelOpts);
-						const checked = addCheckedResult(call.result.then((raw) => validateWireResult(member.resultSchema, raw, wireMethod)), member);
-						return Object.assign(checked, {
-							send: async (payload) => call.send(payload),
-							cancel: async (reason) => call.cancel(reason),
-							dispose: (reason) => call.dispose?.(reason),
-							ping: () => call.ping()
-						});
-					};
-				} else proxy[name] = (params) => {
-					return addCheckedResult((async () => {
-						this._validateOutboundParamsFor(member, wireMethod, params);
-						const raw = await this.channel.sendRequest(wireMethod, params, sendOpts);
-						return validateWireResult(member.resultSchema, raw, wireMethod);
-					})(), member);
-				};
-			} else {
-				const notify = (params) => {
-					this._validateOutboundParamsFor(member, wireMethod, params);
-					this.channel.sendNotification(wireMethod, params, sendOpts);
-				};
-				proxy[name] = barePrefix === void 0 ? async (params) => notify(params) : notify;
+	return true;
+}
+function _hasPatternShape(value) {
+	if (!_isRecord(value)) return false;
+	return "exact" in value && typeof value.exact === "string" || "prefix" in value && typeof value.prefix === "string";
+}
+function _hasParamMatcherShape(value) {
+	if (!_isRecord(value)) return false;
+	if ("exact" in value) return true;
+	if ("enum" in value) return Array.isArray(value.enum);
+	if ("prefix" in value) return typeof value.prefix === "string";
+	if ("subsetOf" in value) return Array.isArray(value.subsetOf) && value.subsetOf.every((item) => typeof item === "string");
+	return value.any === true;
+}
+function _isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* Addressing match for a single permission: do its
+* `serviceId`/`interfaceId`/`interfaceHash`/`members` patterns admit
+* `target`?
+*/
+function permissionMatchesTarget(target, perm) {
+	return _targetMismatchReason(target, perm) === void 0;
+}
+var TargetMismatchReason = class {
+	mismatch;
+	constructor(mismatch) {
+		this.mismatch = mismatch;
+	}
+	toString() {
+		const mismatch = this.mismatch;
+		switch (mismatch.kind) {
+			case "serviceId":
+			case "interfaceId": return `${mismatch.kind} ${JSON.stringify(mismatch.actual)} does not match ${_formatPattern(mismatch.expected)}`;
+			case "interfaceHash": return `interfaceHash ${mismatch.actual === void 0 ? "<none>" : JSON.stringify(mismatch.actual)} does not match required ${JSON.stringify(mismatch.expected)}`;
+			case "invalidMembers": return "permission target has invalid members";
+			case "member": {
+				const allowed = mismatch.expected.map(_formatPattern).join(", ") || "<none>";
+				return `member ${JSON.stringify(mismatch.actual)} does not match allowed patterns [${allowed}]`;
 			}
 		}
-		return proxy;
-	}
-	_validateOutboundParamsFor(member, wireMethod, params) {
-		if (!this._validateOutboundParams) return;
-		validateValue(member.paramsSchema, params, `Invalid params for ${wireMethod}`, ErrorCode.invalidParams);
 	}
-	async _handleRequest(call) {
-		const parsed = this._parseRouted(call.method);
-		if (!parsed.ok) return notFound(parsed.reason, call.method);
-		const { entry, memberName } = parsed;
-		const member = entry.iface.members[memberName];
-		if (!member) return notFound("unknown-method", call.method);
-		const handler = entry.handlers[memberName];
-		if (!handler) return notFound("unknown-method", call.method);
-		const userParams = stripLinkRpcWireMeta(call.params);
-		const parsedParams = safeParse(member.paramsSchema, userParams);
-		if (!parsedParams.success) return { error: {
-			code: ErrorCode.invalidParams,
-			message: "Invalid params",
-			data: { issues: parsedParams.error.issues }
-		} };
-		if (!(member instanceof RequestType)) return notFound("unknown-method", call.method);
-		const stream = this._buildStreamApi(call.stream, call.signal, member);
-		try {
-			const result = await handler(parsedParams.data, call.context, stream);
-			const encodedError = encodeApplicationError(member, result);
-			if (encodedError !== void 0) return { error: encodedError };
-			validateValue(member.resultSchema, result, `Invalid result for ${call.method}`, ErrorCode.internalError);
-			return { result: result === void 0 ? null : result };
-		} catch (e) {
-			if (e instanceof RpcError) return { error: {
-				code: e.code,
-				message: e.message,
-				data: e.data
-			} };
-			return { error: {
-				code: ErrorCode.internalError,
-				message: e instanceof Error ? e.message : String(e)
-			} };
-		}
+};
+function _targetMismatchReason(target, perm) {
+	const t = perm.target;
+	if (!_patternMatches(target.serviceId, t.serviceId, "/")) return new TargetMismatchReason({
+		kind: "serviceId",
+		actual: target.serviceId,
+		expected: t.serviceId
+	});
+	if (!_patternMatches(target.interfaceId, t.interfaceId, ".")) return new TargetMismatchReason({
+		kind: "interfaceId",
+		actual: target.interfaceId,
+		expected: t.interfaceId
+	});
+	if (t.interfaceHash !== void 0 && target.interfaceHash !== t.interfaceHash) return new TargetMismatchReason({
+		kind: "interfaceHash",
+		actual: target.interfaceHash,
+		expected: t.interfaceHash
+	});
+	if (!Array.isArray(t.members)) return new TargetMismatchReason({ kind: "invalidMembers" });
+	if (!t.members.some((m) => _patternMatches(target.member, m, ""))) return new TargetMismatchReason({
+		kind: "member",
+		actual: target.member,
+		expected: t.members
+	});
+}
+function _patternMatches(value, pat, delim) {
+	if ("exact" in pat) return value === pat.exact;
+	const p = pat.prefix;
+	if (p === "") return true;
+	if (value === p) return true;
+	if (delim === "") return value.startsWith(p);
+	return value.startsWith(p + delim);
+}
+function _formatPattern(pattern) {
+	return "exact" in pattern ? `exact ${JSON.stringify(pattern.exact)}` : `prefix ${JSON.stringify(pattern.prefix)}`;
+}
+/**
+* Strict allowlist match for {@link Permission.params}. The set of
+* top-level keys in the call MUST equal the declared set; values must
+* satisfy their matchers. Nested objects/arrays are compared as opaque
+* JSON values via canonical-JSON equality. Pure (no crypto).
+*/
+function matchParams(declared, actualParams) {
+	const declaredKeys = Object.keys(declared).sort();
+	const actualObj = actualParams !== null && typeof actualParams === "object" && !Array.isArray(actualParams) ? actualParams : void 0;
+	const actualKeys = actualObj ? Object.keys(actualObj).sort() : [];
+	if (declaredKeys.length !== actualKeys.length || declaredKeys.some((k, i) => k !== actualKeys[i])) return {
+		ok: false,
+		reason: `param keys mismatch (declared=${declaredKeys.join(",")}, actual=${actualKeys.join(",")})`
+	};
+	for (const k of declaredKeys) if (!_matchParamValue(declared[k], actualObj[k])) return {
+		ok: false,
+		reason: `param "${k}" does not match`
+	};
+	return { ok: true };
+}
+function _matchParamValue(matcher, value) {
+	if ("any" in matcher) return true;
+	if ("prefix" in matcher) return typeof value === "string" && value.startsWith(matcher.prefix);
+	if ("subsetOf" in matcher) return Array.isArray(value) && value.every((v) => typeof v === "string" && matcher.subsetOf.includes(v));
+	if ("exact" in matcher) return jcsCanonicalize(matcher.exact) === jcsCanonicalize(value);
+	if ("enum" in matcher) {
+		const v = jcsCanonicalize(value);
+		return matcher.enum.some((opt) => jcsCanonicalize(opt) === v);
 	}
-	_buildStreamApi(callStream, signal, member) {
-		return {
-			send: (payload) => {
-				if (member.serverStreamSchema) {
-					const r = safeParse(member.serverStreamSchema, payload);
-					if (!r.success) throw new Error(`Server stream payload failed schema validation: ${r.error.message}`);
-				}
-				return callStream.send(payload);
-			},
-			onMessage: (listener) => {
-				callStream.onMessage((raw) => {
-					if (member.clientStreamSchema) {
-						const r = safeParse(member.clientStreamSchema, raw);
-						if (!r.success) return;
-						listener(r.data);
-						return;
-					}
-				});
-			},
-			ping: () => callStream.ping(),
-			signal
+	return false;
+}
+/**
+* Does `permission` admit `call` for the given `ability`? Checks, in
+* order: the ability flag (`canInvoke`/`canDelegate`, both default
+* `false`), the target address, the optional `params` allowlist, and the
+* optional `callBind` hash-binding. Pure.
+*/
+function permissionPermits(call, permission, ability) {
+	if (!(ability === "invoke" ? permission.canInvoke === true : permission.canDelegate === true)) return {
+		ok: false,
+		reason: `permission does not grant ${ability}`
+	};
+	const targetMismatch = _targetMismatchReason(call.target, permission);
+	if (targetMismatch !== void 0) return {
+		ok: false,
+		reason: `permission does not address this call: ${targetMismatch.toString()}`
+	};
+	if (permission.params !== void 0) {
+		const r = matchParams(permission.params, call.params);
+		if (!r.ok) return {
+			ok: false,
+			reason: `params: ${r.reason}`
 		};
 	}
-	_handleNotification(call) {
-		const parsed = this._parseRouted(call.method);
-		if (!parsed.ok) return;
-		const { entry, memberName } = parsed;
-		const member = entry.iface.members[memberName];
-		if (!(member instanceof NotificationType)) return;
-		const handler = entry.handlers[memberName];
-		if (!handler) return;
-		const userParams = stripLinkRpcWireMeta(call.params);
-		const parsedParams = safeParse(member.paramsSchema, userParams);
-		if (!parsedParams.success) return;
-		handler(parsedParams.data, call.context);
-	}
-	_parseRouted(method) {
-		const parsed = parseMethodName(method);
-		if (!parsed) return {
+	if (permission.callBind !== void 0) {
+		if (permission.callBind.alg !== "sha256") return {
 			ok: false,
-			reason: "bad-method-grammar"
+			reason: `callBind: unsupported hash alg (${permission.callBind.alg})`
 		};
-		if (parsed.kind === "bare") {
-			let selected;
-			for (const binding of this._bareBindings.values()) if (parsed.member.startsWith(binding.prefix) && (selected === void 0 || binding.prefix.length > selected.prefix.length)) selected = binding;
-			if (!selected) return {
-				ok: false,
-				reason: "no-preset"
-			};
-			return {
-				ok: true,
-				entry: selected.entry,
-				memberName: parsed.member.slice(selected.prefix.length)
-			};
-		}
-		const serviceId = parsed.kind === "full" ? parsed.serviceId : void 0;
-		const key = `${serviceId ?? ""}::${parsed.interfaceId}`;
-		const entry = this._registry.get(key);
-		if (!entry) return {
+		if (call.callHash !== permission.callBind.payloadHash) return {
 			ok: false,
-			reason: serviceId ? "unknown-service" : "unknown-interface"
-		};
-		return {
-			ok: true,
-			entry,
-			memberName: parsed.member
+			reason: "callBind: payload hash mismatch"
 		};
 	}
-	_installServiceInspection(serviceId) {
-		if (this._serviceInspectionRegistrations.has(serviceId)) return;
-		const info = this._inspection;
-		const trafficInspector = this._trafficInspector;
-		if (info === void 0 || trafficInspector === void 0) return;
-		const registrations = [];
-		const opts = { serviceId };
-		try {
-			registrations.push(this._register(nodeInterface, { getNodeId: () => ({
-				nodeId: info.nodeId,
-				portId: info.portId
-			}) }, opts, true));
-			registrations.push(this._register(topologyInterface, {
-				getGraph: () => this._endpointGraph(serviceId, info),
-				watchGraph: async (_params, _ctx, stream) => {
-					await waitForAbort(stream.signal);
-					return {};
-				}
-			}, opts, true));
-			registrations.push(this._register(trafficInterface, {
-				watch: ({ methodPrefix, trafficIgnoreKey, focusRequest }, _ctx, stream) => this._watchTraffic(trafficInspector, {
-					methodPrefix,
-					trafficIgnoreKey,
-					focusRequest
-				}, stream),
-				watchWithPayloads: ({ methodPrefix, maxPayloadBytes, trafficIgnoreKey, focusRequest }, _ctx, stream) => this._watchTraffic(trafficInspector, {
-					methodPrefix,
-					maxPayloadBytes,
-					trafficIgnoreKey,
-					focusRequest
-				}, stream)
-			}, opts, true));
-		} catch (error) {
-			for (const registration of registrations.reverse()) registration.dispose();
-			throw error;
+	return { ok: true };
+}
+/**
+* Does `cap` admit `call` for the given `ability`? True iff **any** of its
+* permissions does (the union over permissions). This is one *link's*
+* judgment; chain intersection is enforced by {@link verifyChain}.
+*/
+function capabilityPermits(call, cap, ability) {
+	let lastReason = `no permission grants ${ability} for this call`;
+	for (const permission of cap.permissions) {
+		const r = permissionPermits(call, permission, ability);
+		if (r.ok) return { ok: true };
+		lastReason = r.reason;
+	}
+	return {
+		ok: false,
+		reason: lastReason
+	};
+}
+//#endregion
+//#region src/transport/messageTransport.ts
+/**
+* Observe every message crossing a transport without changing its buffering or
+* lifecycle behavior.
+*/
+function traceMessageTransport(transport, trace) {
+	return {
+		send(message) {
+			trace("send", message);
+			return transport.send(message);
+		},
+		setListener(listener) {
+			transport.setListener(listener === void 0 ? void 0 : (message) => {
+				trace("receive", message);
+				listener(message);
+			});
+		},
+		dispose() {
+			transport.dispose();
 		}
-		this._serviceInspectionRegistrations.set(serviceId, registrations);
+	};
+}
+/**
+* Pipe two transports together: every message one receives is forwarded to
+* the other's `send`. Returns a disposable that detaches both listeners.
+*
+* Neither transport is disposed — the caller owns their lifecycle. This is
+* the building block for relays (e.g. bridging a `WindowMessageTransport`
+* for an iframe to a multiplexer channel).
+*/
+function connectTransports(a, b) {
+	a.setListener((m) => void b.send(m));
+	b.setListener((m) => void a.send(m));
+	return { dispose() {
+		a.setListener(void 0);
+		b.setListener(void 0);
+	} };
+}
+/**
+* Two in-memory transports wired back-to-back. Useful for tests and for
+* same-process bridges.
+*
+* Generic in the per-direction payload type so asymmetric pairs (e.g. one
+* side sends plain `JsonRpcMessage`, the other side sends
+* `JsonRpcMessage & { context: Participant }`) are expressible at the type
+* level. At runtime both halves just hand objects through by reference.
+*/
+var TransportPair = class {
+	a;
+	b;
+	constructor() {
+		const aT = new _InMemoryTransport();
+		const bT = new _InMemoryTransport();
+		aT._peer = bT;
+		bT._peer = aT;
+		this.a = aT;
+		this.b = bT;
 	}
-	_removeServiceInspection(serviceId) {
-		const registrations = this._serviceInspectionRegistrations.get(serviceId);
-		if (registrations === void 0) return;
-		this._serviceInspectionRegistrations.delete(serviceId);
-		for (const registration of registrations.reverse()) registration.dispose();
+};
+var _InMemoryTransport = class {
+	_peer;
+	_listener;
+	_buffer = [];
+	_closed = false;
+	send(message) {
+		if (this._closed || this._peer._closed) return;
+		this._peer._deliver(message);
 	}
-	_hasBusinessServiceRegistration(serviceId) {
-		return Array.from(this._registry.values()).some((entry) => entry.serviceId === serviceId && !entry.internalInspection);
+	setListener(listener) {
+		this._listener = listener;
+		if (listener) while (this._buffer.length > 0 && this._listener) {
+			const m = this._buffer.shift();
+			this._listener(m);
+		}
 	}
-	_endpointGraph(serviceId, info) {
-		return {
-			observerServiceId: serviceId,
-			entryNodeId: info.nodeId,
-			nodes: [{
-				nodeId: info.nodeId,
-				kind: "endpoint",
-				...info.descriptors !== void 0 ? { descriptors: info.descriptors } : {},
-				ports: [{ portId: info.portId }]
-			}],
-			links: [],
-			routes: [{
-				serviceId,
-				nodeId: info.nodeId,
-				portId: info.portId,
-				match: "exact"
-			}]
-		};
+	dispose() {
+		this._closed = true;
 	}
-	async _watchTraffic(inspector, options, stream) {
-		const subscription = inspector.subscribe(options, (event) => stream.send(event));
-		const dispose = () => subscription.dispose();
-		if (stream.signal.aborted) dispose();
-		else stream.signal.addEventListener("abort", dispose, { once: true });
-		try {
-			return await subscription.closed;
-		} finally {
-			stream.signal.removeEventListener("abort", dispose);
-			subscription.dispose();
-		}
+	_deliver(m) {
+		if (this._listener) this._listener(m);
+		else this._buffer.push(m);
 	}
 };
-function createInspectionId(kind) {
-	const bytes = /* @__PURE__ */ new Uint8Array(16);
-	globalThis.crypto.getRandomValues(bytes);
-	return `${kind}:${bytesToBase64Url(bytes)}`;
-}
-/** Structural equality for two CNF root-node-id requirement collections. */
-function rootPrincipalSetsEqual(a, b) {
-	if (a.length !== b.length) return false;
-	for (let i = 0; i < a.length; i++) {
-		const sa = a[i];
-		const sb = b[i];
-		if (sa.length !== sb.length) return false;
-		for (let j = 0; j < sa.length; j++) {
-			if (sa[j].principal !== sb[j].principal) return false;
-			if (sa[j].transitive === true !== (sb[j].transitive === true)) return false;
-		}
+//#endregion
+//#region src/transport/multiplexedTransport.ts
+var MultiplexedTransport = class MultiplexedTransport {
+	static create(base, channels) {
+		return new MultiplexedTransport(base, channels);
 	}
-	return true;
-}
-function directoryWatcherMatchesEntry(watcher, entry) {
-	const serviceId = entry.serviceId ?? "";
-	return (watcher.interfaceId === void 0 || watcher.interfaceId === entry.iface.info.id) && (watcher.interfaceIdPrefix === void 0 || entry.iface.info.id.startsWith(watcher.interfaceIdPrefix)) && (watcher.serviceId === void 0 || watcher.serviceId === serviceId) && serviceIdMatchesScopes(serviceId, watcher.serviceIdScopes);
-}
-function addCheckedResult(promise, member) {
-	return Object.assign(promise, { result: async () => {
-		try {
-			return {
-				ok: true,
-				value: await promise
-			};
-		} catch (cause) {
-			return {
-				ok: false,
-				error: decodeCheckedError(cause, member.applicationErrors)
-			};
-		}
-	} });
-}
-function decodeCheckedError(cause, descriptors) {
-	if (!(cause instanceof RpcError) || cause.origin !== "remote") return {
-		kind: "local",
-		cause
-	};
-	const descriptor = descriptors.find((candidate) => candidate.code === cause.code && candidate.message === cause.message);
-	if (descriptor !== void 0) {
-		if (descriptor.dataSchema === void 0 && !cause.hasData) return {
-			kind: "application",
-			code: descriptor.code,
-			message: descriptor.message
-		};
-		if (descriptor.dataSchema !== void 0 && cause.hasData && matchesApplicationData(descriptor.dataSchema, cause.data)) {
-			if (safeParse(descriptor.dataSchema, cause.data).success) return {
-				kind: "application",
-				code: descriptor.code,
-				message: descriptor.message,
-				data: cause.data
-			};
+	/** Logical transports keyed by the friendly channel names. */
+	transports;
+	_base;
+	_byId = /* @__PURE__ */ new Map();
+	_usedIds = /* @__PURE__ */ new Set();
+	_disposed = false;
+	constructor(base, channels) {
+		this._base = base;
+		const transports = {};
+		for (const name of Object.keys(channels)) {
+			const id = channels[name];
+			transports[name] = this._createChannel(id);
 		}
+		this.transports = transports;
+		base.setListener((data) => {
+			(data == null ? void 0 : this._byId.get(data.ch))?._deliver(data.m);
+		});
 	}
-	return {
-		kind: "remote",
-		code: cause.code,
-		message: cause.message,
-		...cause.hasData ? { data: cause.data } : {}
-	};
-}
-function encodeApplicationError(member, value) {
-	if (!isApplicationErrorValue(value)) return void 0;
-	const candidate = value;
-	const descriptor = member.applicationErrors.find((error) => error.code === candidate.code && error.message === candidate.message);
-	if (descriptor === void 0) throw new RpcError(`Undeclared application error ${String(candidate.code)}`, ErrorCode.internalError);
-	const hasData = Object.hasOwn(candidate, "data");
-	if (descriptor.dataSchema === void 0) {
-		if (hasData) throw new RpcError(`Application error ${descriptor.code} must not contain data`, ErrorCode.internalError);
-		return {
-			code: descriptor.code,
-			message: descriptor.message
-		};
-	}
-	if (!hasData) throw new RpcError(`Application error ${descriptor.code} requires data`, ErrorCode.internalError);
-	if (!matchesApplicationData(descriptor.dataSchema, candidate.data)) throw new RpcError(`Invalid data for application error ${descriptor.code}`, ErrorCode.internalError, { issues: [{ message: "Data must be JSON matching the declared wire schema" }] });
-	const parsed = safeParse(descriptor.dataSchema, candidate.data);
-	if (!parsed.success) throw new RpcError(`Invalid data for application error ${descriptor.code}`, ErrorCode.internalError, { issues: parsed.error.issues });
-	return {
-		code: descriptor.code,
-		message: descriptor.message,
-		data: candidate.data
-	};
-}
-/** Reject values JSON serialization would silently omit, coerce, or replace via toJSON. */
-function isWireJsonValue(value, ancestors = /* @__PURE__ */ new Set()) {
-	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
-	if (typeof value === "number") return Number.isFinite(value);
-	if (typeof value !== "object" || ancestors.has(value)) return false;
-	if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) return false;
-	ancestors.add(value);
-	const children = Array.isArray(value) ? value.values() : Object.values(value);
-	for (const child of children) if (!isWireJsonValue(child, ancestors)) return false;
-	ancestors.delete(value);
-	return true;
-}
-const applicationDataSchemas = /* @__PURE__ */ new WeakMap();
-function matchesApplicationData(schema, value) {
-	if (!isWireJsonValue(value)) return false;
-	let wire = applicationDataSchemas.get(schema);
-	if (wire === void 0) {
-		const components = {};
-		wire = {
-			schema: zodToSvcJsonSchema(schema, {
-				methodName: "applicationError",
-				schemaPosition: "data",
-				components
-			}),
-			components
-		};
-		applicationDataSchemas.set(schema, wire);
+	/**
+	* Add a logical channel after the multiplexer has started.
+	*
+	* Channel ids are permanently retired when disposed. This prevents a late
+	* envelope for an old iframe from being delivered to a replacement iframe.
+	*/
+	addChannel(id) {
+		if (this._disposed) throw new Error("Cannot add a channel to a disposed multiplexed transport.");
+		return this._createChannel(id);
 	}
-	return matchesJsonSchema(value, wire.schema, { schemas: wire.components });
-}
-function validateWireResult(schema, raw, wireMethod) {
-	const value = normalizeWireResult(schema, raw);
-	validateValue(schema, value, `Invalid result for ${wireMethod}`, ErrorCode.internalError);
-	return value;
-}
-/** Validate at both ends without stripping extra keys or applying schema transforms. */
-function validateValue(schema, value, message, code) {
-	const checked = safeParse(schema, value);
-	if (!checked.success) throw new RpcError(message, code, { issues: checked.error.issues });
-}
-/** Undo the server's undefined → null convention only when the schema rejects null. */
-function normalizeWireResult(schema, raw) {
-	if (raw !== null) return raw;
-	if (safeParse(schema, null).success) return null;
-	if (safeParse(schema, void 0).success) return void 0;
-	return null;
-}
-/** Service-scoped handle returned by `connection.service(id)`. */
-var ServiceHandle = class {
-	_connection;
-	_serviceId;
-	constructor(_connection, _serviceId) {
-		this._connection = _connection;
-		this._serviceId = _serviceId;
+	dispose() {
+		if (this._disposed) return;
+		this._disposed = true;
+		this._base.setListener(void 0);
+		for (const t of [...this._byId.values()]) t.dispose();
+		this._byId.clear();
 	}
-	get(iface, opts = {}) {
-		return this._connection.get(iface, {
-			...opts,
-			serviceId: this._serviceId
+	_createChannel(id) {
+		if (id.length === 0) throw new Error("Multiplexed transport channel ids must not be empty.");
+		if (this._usedIds.has(id)) throw new Error(`Multiplexed transport channel id "${id}" has already been used.`);
+		this._usedIds.add(id);
+		const t = new _ChannelTransport(this._base, id, () => {
+			if (this._byId.get(id) === t) this._byId.delete(id);
 		});
+		this._byId.set(id, t);
+		return t;
 	}
-	register(iface, handlers, opts = {}) {
-		return this._connection.register(iface, handlers, {
-			...opts,
-			serviceId: this._serviceId
+};
+var _ChannelTransport = class {
+	_base;
+	_ch;
+	_onDispose;
+	_listener;
+	_buffer = [];
+	_closed = false;
+	constructor(_base, _ch, _onDispose) {
+		this._base = _base;
+		this._ch = _ch;
+		this._onDispose = _onDispose;
+	}
+	send(message) {
+		if (this._closed) return;
+		this._base.send({
+			$mux: "v1",
+			ch: this._ch,
+			m: message
 		});
 	}
+	setListener(listener) {
+		this._listener = listener;
+		if (listener) while (this._buffer.length > 0 && this._listener) listener(this._buffer.shift());
+	}
+	dispose() {
+		if (this._closed) return;
+		this._closed = true;
+		this._listener = void 0;
+		this._buffer.length = 0;
+		this._onDispose();
+	}
+	_deliver(m) {
+		if (this._closed) return;
+		if (this._listener) this._listener(m);
+		else this._buffer.push(m);
+	}
 };
-function notFound(reason, method) {
-	return { error: {
-		code: ErrorCode.methodNotFound,
-		message: `Method not found: ${method}`,
-		data: {
-			reason,
-			method
-		}
-	} };
-}
-function waitForAbort(signal) {
-	if (signal.aborted) return Promise.resolve();
-	return new Promise((resolve) => {
-		signal.addEventListener("abort", () => resolve(), { once: true });
-	});
-}
 //#endregion
 //#region src/connection/channelConnector.ts
 const DEFAULT_INITIAL_BACKOFF_MS = 250;
@@ -7752,6 +7676,6 @@ async function createSeededSigningIdentity(opts) {
 	return KeypairSigningIdentity.fromKeypair(ed);
 }
 //#endregion
-export { walkHubDetailed as $, bareInterfaceTarget as $t, attachCapabilities as A, PRINCIPAL_PREFIX as At, LinkRpcConnection as B, isRequest as Bt, identityStorageInterface as C, getKeyId as Ct, PublicWrappingIdentity as D, signingInput as Dt, PublicSigningIdentity as E, signingDomainValue as Et, generateX25519Keypair as F, principalForPublicKey as Ft, fetchDirectory as G, StreamDir as Gt, JsonRpcChannel as H, STREAM_METHOD as Ht, formatEndpointUri as I, publicKeyForKeyId as It, intersectServiceIdScopes as J, directoryInterface as Jt, fetchSchema as K, streamInterface as Kt, isHubEndpoint as L, resolveSigningKey as Lt, verifyRpcCall as M, bytesToBase64Url as Mt, crypto_exports as N, keyIdForPrincipal as Nt, Principal as O, withSignature as Ot, generateKeypair as P, keyIdForPublicKey as Pt, walkHub as Q, generateTsInterface as Qt, parseEndpointUri as R, ErrorCode as Rt, identityInterface as S, LINKRPC_UNSIGNED_KEY as St, KeypairSigningIdentity as T, signedHash as Tt, DEFAULT_WALK_DEPTH as U, StreamControlReason as Ut, ServiceHandle as V, isResponse as Vt, HubDirectoryExplorer as W, StreamControlType as Wt, serviceIdMatchesPattern as X, schemasInterface as Xt, normalizeServiceIdScopes as Y, directoryWatchNever as Yt, serviceIdMatchesScopes as Z, zServiceIdPattern as Zt, InMemoryManagedIdentity as _, HUBRPC_META_KEY as _t, verifyCall as a, TransportPair as at, registerIdentityOnOverlay as b, LINKRPC_META_KEY as bt, invoke as c, requireObjectParams as ct, prefix as d, parseMethodName as dt, materializeJsonSchema as en, DEFAULT_RPC_TIMEOUT_MS as et, signCapability as f, capabilityPermits as ft, createManagedPrincipal as g, permissionPermits as gt, PrincipalWithStore as h, permissionMatchesTarget as ht, signParams as i, MultiplexedTransport as it, signRpcCall as j, base64UrlToBytes$1 as jt, CapBag as k, KEY_ID_PREFIX as kt, issueCapability as l, stripLinkRpcWireMeta as lt, SigningSender as m, matchParams as mt, createSeededMemoryPrincipal as n, matchesJsonSchema as nn, Channel as nt, capBagFreshAt as o, connectTransports as ot, OneShotCapStaging as p, hasSignedCapabilityShape as pt, findMethodInSchema as q, defaultsInterface as qt, createSeededSigningIdentity as r, RpcError as rt, capabilityFreshAt as s, traceMessageTransport as st, createMemoryPrincipal as t, isAssignable as tn, withRpcTimeout as tt, permits as u, methodNameToTarget as ut, InMemoryManagedIdentityStorage as v, HUBRPC_SIGNATURE_KEY as vt, KeypairIdentity as w, readSignature as wt, registerLazyIdentityOnOverlay as x, LINKRPC_SIGNATURE_KEY as xt, createManagedIdentity as y, HUBRPC_UNSIGNED_KEY as yt, ChannelConnector as z, isNotification as zt };
+export { interfaceTarget as $, attachCapabilities as A, getKeyId as At, MultiplexedTransport as B, generateTsInterface as Bt, identityStorageInterface as C, stripLinkRpcWireMeta as Ct, PublicWrappingIdentity as D, LINKRPC_META_KEY as Dt, PublicSigningIdentity as E, HUBRPC_UNSIGNED_KEY as Et, generateX25519Keypair as F, withSignature as Ft, hasSignedCapabilityShape as G, validateJsonSchema as Gt, connectTransports as H, materializeJsonSchema as Ht, formatEndpointUri as I, methodNameToTarget as It, permissionPermits as J, matchParams as K, NonCompliantServerError as Kt, isHubEndpoint as L, parseMethodName as Lt, verifyRpcCall as M, signedHash as Mt, crypto_exports as N, signingDomainValue as Nt, Principal as O, LINKRPC_SIGNATURE_KEY as Ot, generateKeypair as P, signingInput as Pt, defaultInterfaceTarget as Q, parseEndpointUri as R, generateTsContract as Rt, identityInterface as S, requireObjectParams as St, KeypairSigningIdentity as T, HUBRPC_SIGNATURE_KEY as Tt, traceMessageTransport as U, isAssignable as Ut, TransportPair as V, bareInterfaceTarget as Vt, capabilityPermits as W, matchesJsonSchema as Wt, LinkRpcConnection as X, exportStaticHubSchema as Y, ServiceHandle as Z, InMemoryManagedIdentity as _, defaultsInterface as _t, verifyCall as a, HubDirectoryExplorer as at, registerIdentityOnOverlay as b, schemasInterface as bt, invoke as c, findMethodInSchema as ct, prefix as d, serviceIdMatchesPattern as dt, isInterfaceTarget as et, signCapability as f, serviceIdMatchesScopes as ft, createManagedPrincipal as g, withRpcTimeout as gt, PrincipalWithStore as h, DEFAULT_RPC_TIMEOUT_MS as ht, signParams as i, DEFAULT_WALK_DEPTH as it, signRpcCall as j, readSignature as jt, CapBag as k, LINKRPC_UNSIGNED_KEY as kt, issueCapability as l, intersectServiceIdScopes as lt, SigningSender as m, walkHubDetailed as mt, createSeededMemoryPrincipal as n, Channel as nt, capBagFreshAt as o, fetchDirectory as ot, OneShotCapStaging as p, walkHub as pt, permissionMatchesTarget as q, createSeededSigningIdentity as r, RpcError as rt, capabilityFreshAt as s, fetchSchema as st, createMemoryPrincipal as t, JsonRpcChannel as tt, permits as u, normalizeServiceIdScopes as ut, InMemoryManagedIdentityStorage as v, directoryInterface as vt, KeypairIdentity as w, HUBRPC_META_KEY as wt, registerLazyIdentityOnOverlay as x, zServiceIdPattern as xt, createManagedIdentity as y, directoryWatchNever as yt, ChannelConnector as z, parseStaticHubSchema as zt };
 
-//# sourceMappingURL=src-CAhXne71.js.map
+//# sourceMappingURL=src-DKjTceek.js.map