@hediet/linkrpc 0.0.2 → 0.0.3

package/dist/chunks/{boundedTrafficSubscription-XZ1KwXZC.js → inspectionHost-BA08eF6h.js}

@@ -972,6 +972,135 @@ function interfaceFromSchema(schema) {
 	return new InterfaceDefinition(info, members, { frozenSchema: schema });
 }
 //#endregion
+//#region src/protocol/jsonRpc.ts
+const ErrorCode = {
+	parseError: -32700,
+	invalidRequest: -32600,
+	methodNotFound: -32601,
+	invalidParams: -32602,
+	internalError: -32603,
+	/** Caller is authenticated but lacks a capability covering the call. */
+	permissionRequired: -32401,
+	/** The peer a request was routed to detached before it could respond. */
+	peerDisconnected: -32402,
+	/** The request exceeded the hub's idle timeout with no stream activity. */
+	requestTimeout: -32403,
+	/** The request was cancelled (by the caller, or by the hub on disconnect). */
+	cancelled: -32800
+};
+function isRequest(m) {
+	return typeof m.method === "string" && m.id !== void 0;
+}
+function isNotification(m) {
+	return typeof m.method === "string" && m.id === void 0;
+}
+function isResponse(m) {
+	return typeof m.method !== "string";
+}
+//#endregion
+//#region src/crypto/cryptoProvider.ts
+const _b64UrlAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+const _b64UrlReverse = (() => {
+	const m = {};
+	for (let i = 0; i < 64; i++) m[_b64UrlAlphabet[i]] = i;
+	return m;
+})();
+function bytesToBase64Url(bytes) {
+	let out = "";
+	let i = 0;
+	for (; i + 3 <= bytes.length; i += 3) {
+		const n = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+		out += _b64UrlAlphabet[n >> 18 & 63] + _b64UrlAlphabet[n >> 12 & 63] + _b64UrlAlphabet[n >> 6 & 63] + _b64UrlAlphabet[n & 63];
+	}
+	const rem = bytes.length - i;
+	if (rem === 1) {
+		const n = bytes[i] << 16;
+		out += _b64UrlAlphabet[n >> 18 & 63] + _b64UrlAlphabet[n >> 12 & 63];
+	} else if (rem === 2) {
+		const n = bytes[i] << 16 | bytes[i + 1] << 8;
+		out += _b64UrlAlphabet[n >> 18 & 63] + _b64UrlAlphabet[n >> 12 & 63] + _b64UrlAlphabet[n >> 6 & 63];
+	}
+	return out;
+}
+function base64UrlToBytes(s) {
+	const len = s.length;
+	const fullGroups = Math.floor(len / 4);
+	const rem = len % 4;
+	if (rem === 1) throw new Error("base64UrlToBytes: invalid length");
+	const outLen = fullGroups * 3 + (rem === 0 ? 0 : rem - 1);
+	const out = new Uint8Array(outLen);
+	let oi = 0;
+	let i = 0;
+	for (let g = 0; g < fullGroups; g++, i += 4) {
+		const n = _lookup(s, i) << 18 | _lookup(s, i + 1) << 12 | _lookup(s, i + 2) << 6 | _lookup(s, i + 3);
+		out[oi++] = n >> 16 & 255;
+		out[oi++] = n >> 8 & 255;
+		out[oi++] = n & 255;
+	}
+	if (rem === 2) {
+		const n = _lookup(s, i) << 18 | _lookup(s, i + 1) << 12;
+		out[oi++] = n >> 16 & 255;
+	} else if (rem === 3) {
+		const n = _lookup(s, i) << 18 | _lookup(s, i + 1) << 12 | _lookup(s, i + 2) << 6;
+		out[oi++] = n >> 16 & 255;
+		out[oi++] = n >> 8 & 255;
+	}
+	return out;
+}
+function _lookup(s, i) {
+	const v = _b64UrlReverse[s[i]];
+	if (v === void 0) throw new Error(`base64UrlToBytes: invalid char at ${i}`);
+	return v;
+}
+/** Role-tag prefix on a {@link KeyId}'s inline-key form. */
+const KEY_ID_PREFIX = "key:";
+/** Role-tag prefix that wraps a genesis {@link KeyId} into a {@link PrincipalId}. */
+const PRINCIPAL_PREFIX = "id:";
+/** The inline {@link KeyId} for a raw public key: `"key:" + b64url(pk)`. */
+function keyIdForPublicKey(pk) {
+	return KEY_ID_PREFIX + bytesToBase64Url(pk);
+}
+/** The perpetual {@link PrincipalId} for a raw public key: `"id:key:" + b64url(pk)`. */
+function principalForPublicKey(pk) {
+	return "id:" + keyIdForPublicKey(pk);
+}
+/**
+* The genesis {@link KeyId} embedded in a perpetual {@link PrincipalId}
+* (`"id:" + keyId`). Throws if `principal` is not a well-formed `id:` name.
+*/
+function keyIdForPrincipal(principal) {
+	if (!principal.startsWith("id:")) throw new Error(`malformed principal (missing "id:" prefix): ${principal}`);
+	return principal.slice(3);
+}
+/**
+* The raw public key carried inline by a `"key:"` {@link KeyId}. Throws on a
+* missing prefix or malformed base64url.
+*/
+function publicKeyForKeyId(keyId) {
+	if (!keyId.startsWith("key:")) throw new Error(`unsupported keyId (expected "${KEY_ID_PREFIX}" prefix): ${keyId}`);
+	return base64UrlToBytes(keyId.slice(4));
+}
+/**
+* Resolve the verifying public key for `(principal, keyId)`, or `undefined`
+* to **reject** (fail closed). This is the single seam every verifier goes
+* through, replacing the old "the id *is* the key" decode.
+*
+* Phase 1 supports only inline genesis keys: the `keyId` must be a `"key:"`
+* form and the principal must be exactly `"id:" + keyId` (genesis
+* self-certification by string equality). `keydoc:`/rotation forms resolve
+* through `bindings`/`timeMs` later and are intentionally not handled here.
+*/
+function resolveSigningKey(args) {
+	const { principal, keyId } = args;
+	if (!keyId.startsWith("key:")) return;
+	if ("id:" + keyId !== principal) return;
+	try {
+		return { publicKey: base64UrlToBytes(keyId.slice(4)) };
+	} catch {
+		return;
+	}
+}
+//#endregion
 //#region src/inspection/inspection.interfaces.ts
 const zTopologyPort = object({
 	portId: string(),
@@ -1146,6 +1275,142 @@ const nodeInterface = defineInterface({
 	description: "Topology bootstrap: identify the node and port at this end of the direct connection."
 }, { getNodeId: requestType(object({}), zNodeInfo) });
 //#endregion
+//#region src/connection/streaming.ts
+/**
+* Direction a {@link STREAM_METHOD} message travels, relative to the
+* request it is correlated with. Made explicit on the wire so that a
+* middlebox (the hub) can *author* a stream message — e.g. inject a
+* cancel when a caller disconnects — without an inbound message whose
+* arrival link it could infer the direction from.
+*/
+const StreamDir = {
+	/** callee → caller: progress, partial results. Routes like a response. */
+	toCaller: "toCaller",
+	/** caller → callee: input, cancellation, keepalive ping. */
+	toCallee: "toCallee"
+};
+/**
+* Reserved control verbs. A control message carries no app `payload`; it
+* is interpreted by the runtime / hub itself, independently of the
+* originating method's stream schemas, so *any* request is cancellable
+* and keep-alive-able even when it declares no app stream.
+*/
+const StreamControlType = {
+	/**
+	* Ask the callee to abort the in-flight request. Always {@link
+	* StreamDir.toCallee}. The callee surfaces this as an `AbortSignal`
+	* and is expected to settle the request (typically with a
+	* `cancelled` error response).
+	*/
+	cancel: "cancel",
+	/**
+	* Keepalive / liveness probe. Resets the hub's per-request idle timer
+	* so a long-running call is not reaped, and lets either side actively
+	* probe the peer. Carries a `nonce` the peer echoes in its {@link
+	* StreamControlType.pong}. May travel in either direction. Emitted
+	* automatically (without awaiting a pong) by the channel for streaming
+	* calls; see {@link STREAM_METHOD}.
+	*/
+	ping: "ping",
+	/**
+	* Reply to a {@link StreamControlType.ping}, echoing the ping's
+	* `nonce` so the prober can correlate it. Travels opposite the ping.
+	* Carries no app effect — purely a liveness acknowledgement.
+	*/
+	pong: "pong"
+};
+/**
+* Well-known `control.reason` strings. The set is **open** — any string
+* is valid on the wire; these are the reasons linkrpc itself emits.
+*/
+const StreamControlReason = {
+	/**
+	* The caller's transport dropped while the request was in flight; the
+	* hub cancels the callee's now-orphaned work.
+	*/
+	clientDisconnected: "clientDisconnected",
+	/**
+	* The request exceeded the hub's idle timeout with no stream activity
+	* (no ping, no stream message). See {@link STREAM_METHOD} docs.
+	*/
+	idleTimeout: "idleTimeout"
+};
+/**
+* Streaming sub-protocol. Long-running requests can emit additional
+* notifications correlated with the original call in either direction
+* (callee → caller progress, caller → callee input / cancellation /
+* keepalive).
+*
+* Wire form: a JSON-RPC notification whose method is
+* `${streamInterface.info.id}::send` and whose params match
+* `streamInterface.members.send.paramsSchema`. The hub routes purely on
+* `requestId` (following the originating request's established path, like
+* a response); the originating request's capability authorization covers
+* its full stream lifetime, so stream notifications carry no method /
+* interface namespace of their own. App `payload` contents are typed per
+* request via the originating method's
+* `RequestType.clientStreamSchema` / `serverStreamSchema`; reserved
+* `control` messages are schema-independent.
+*
+* Idle timeout: a request that never streams (no `control` ping, no
+* stream message) is subject to the hub's per-request idle timeout
+* (default 30 minutes) — at which point it is cancelled and its caller
+* gets a `requestTimeout` error. This bounds the hub's pending-request
+* table, which is also what protects it from a slow-loris / DDoS that
+* opens requests and never completes them. Streaming-enabled calls keep
+* themselves alive by emitting a periodic {@link StreamControlType.ping}.
+*
+* The interface is declarative: nobody calls
+* `LinkRpcConnection.register(streamInterface, ...)`. The channel and the
+* hub intercept `$stream::send` directly. The definition exists so
+* reflection / consent UIs can describe the wire shape and so all wire
+* constants derive from one source.
+*/
+const streamInterface = defineInterface({
+	id: "$stream",
+	description: "Reserved sub-protocol for in-flight stream messages correlated to a request by `requestId`."
+}, { send: notificationType(object({
+	/**
+	* Id of the in-flight request the message belongs to.
+	* The hub rewrites this across the forwarding boundary
+	* in the same way it rewrites response ids.
+	*/
+	requestId: union([number(), string()]),
+	/**
+	* Which way this message travels relative to the request.
+	* Explicit so the hub can author messages (e.g. cancel on
+	* disconnect) without inferring direction from arrival.
+	*/
+	dir: enum$1(["toCaller", "toCallee"]),
+	/**
+	* Reserved control verb (cancel / ping / pong). Mutually
+	* exclusive with `payload` in practice: a control message
+	* is interpreted by the runtime, not the application.
+	*/
+	control: optional(object({
+		type: enum$1([
+			"cancel",
+			"ping",
+			"pong"
+		]),
+		/** Open-set human/diagnostic reason; see {@link StreamControlReason}. */
+		reason: optional(string()),
+		/**
+		* Correlation token. A `ping` carries a fresh nonce;
+		* the matching `pong` echoes it back so the prober
+		* can resolve the right outstanding probe.
+		*/
+		nonce: optional(string())
+	})),
+	/** Opaque app payload — typed per call by the request's stream schema. */
+	payload: optional(unknown())
+}), { description: "Emit a stream message tied to the request `requestId`." }) });
+/**
+* Full wire method name for stream notifications. Pulled from the
+* interface object so we have a single source of truth.
+*/
+const STREAM_METHOD = `${streamInterface.info.id}::send`;
+//#endregion
 //#region src/inspection/trafficFlowFilter.ts
 var TrafficFlowFilter = class {
 	_focused;
@@ -1196,24 +1461,37 @@ var TrafficWatchFlowTracker = class {
 		this._active.clear();
 		this._unclaimed.clear();
 	}
+	forgetPort(portId) {
+		for (const flow of this._active) if (flow.hasPort(portId)) this._removeFlow(flow);
+	}
 };
 var CorrelatedFlow = class {
 	_endpoints = /* @__PURE__ */ new Set();
+	_ports = /* @__PURE__ */ new Set();
 	_completionEndpoint;
 	constructor(endpoints, completionEndpoint = endpoints[0]) {
-		for (const endpoint of endpoints) this._endpoints.add(endpointKey(endpoint));
+		for (const endpoint of endpoints) {
+			this._endpoints.add(endpointKey(endpoint));
+			this._ports.add(endpoint.portId);
+		}
 		this._completionEndpoint = completionEndpoint === void 0 ? void 0 : endpointKey(completionEndpoint);
 	}
 	matches(transit) {
 		return requestRefsOf(transit).some((endpoint) => this._endpoints.has(endpointKey(endpoint)));
 	}
+	hasPort(portId) {
+		return this._ports.has(portId);
+	}
 	accept(transit) {
 		const endpoints = requestRefsOf(transit);
 		if (!this.matches(transit)) return {
 			matches: false,
 			completed: false
 		};
-		for (const endpoint of endpoints) this._endpoints.add(endpointKey(endpoint));
+		for (const endpoint of endpoints) {
+			this._endpoints.add(endpointKey(endpoint));
+			this._ports.add(endpoint.portId);
+		}
 		const completed = transit.kind === "response" && (isTerminal(transit) || this._completionEndpoint !== void 0 && endpoints.some((endpoint) => endpointKey(endpoint) === this._completionEndpoint));
 		if (completed) this._endpoints.clear();
 		return {
@@ -1382,6 +1660,490 @@ function capPayload(value, maxBytes) {
 	return preview;
 }
 //#endregion
-export { EXTENSION_PREFIX as A, requestType as B, defineInterface as C, assertSchemaReferences as D, schemaToZod as E, NotificationType as F, normalizeJsonSchema as H, RequestType as I, applicationError as L, sha256 as M, jcsCanonicalize as N, componentSchemaName as O, jcsCanonicalizeBytes as P, isApplicationErrorValue as R, InterfaceDefinition as S, createSchemaToZod as T, zodToSvcJsonSchema as V, zTrafficEvent as _, topologyInterface as a, zTrafficTransitEvent as b, zParticipantDescriptorSource as c, zTopologyLink as d, zTopologyLinkEndpoint as f, zTopologyTransportInfo as g, zTopologyTransportEndpoint as h, nodeInterface as i, computeInterfaceHash as j, componentSchemaRef as k, zRouteClaim as l, zTopologyPort as m, TrafficFlowFilter as n, trafficInterface as o, zTopologyNode as p, TrafficWatchFlowTracker as r, zParticipantDescriptor as s, BoundedTrafficSubscription as t, zTopologyGraph as u, zTrafficOverflowEvent as v, interfaceFromSchema as w, zTrafficWatchResult as x, zTrafficTransitEndpoint as y, notificationType as z };
+//#region src/inspection/endpointTrafficInspector.ts
+const REQUEST_CORRELATION_RETENTION_MS = 18e5;
+const MAX_REQUEST_CORRELATIONS = 4096;
+var EndpointTrafficInspector = class {
+	_nodeId;
+	_portId;
+	_emit;
+	_isObserved;
+	_outboundRequests = /* @__PURE__ */ new Map();
+	_inboundRequests = /* @__PURE__ */ new Map();
+	observe = (direction, message) => {
+		this._onMessage(direction, message);
+	};
+	constructor(_nodeId, _portId, _emit, _isObserved) {
+		this._nodeId = _nodeId;
+		this._portId = _portId;
+		this._emit = _emit;
+		this._isObserved = _isObserved;
+	}
+	dispose() {
+		this._outboundRequests.clear();
+		this._inboundRequests.clear();
+	}
+	_onMessage(direction, message) {
+		const now = Date.now();
+		this._pruneRequestCorrelations(now);
+		const publiclyObserved = this._isObserved();
+		if (!publiclyObserved) this.dispose();
+		let transit;
+		const endpoint = this._endpoint("id" in message ? message.id ?? void 0 : void 0);
+		const base = {
+			type: "transit",
+			timeMs: now,
+			nodeId: this._nodeId,
+			...direction === "inbound" ? { in: endpoint } : { out: endpoint },
+			disposition: direction === "inbound" ? "consumed" : "forwarded"
+		};
+		if (isRequest(message)) {
+			const correlation = {
+				method: message.method,
+				timeMs: now
+			};
+			if (publiclyObserved) {
+				const map = this._requestMap(direction);
+				const key = requestKey(message.id);
+				map.delete(key);
+				map.set(key, correlation);
+			}
+			transit = {
+				...base,
+				kind: "request",
+				method: message.method,
+				params: message.params
+			};
+		} else if (isResponse(message)) {
+			const responseMap = direction === "inbound" ? this._outboundRequests : this._inboundRequests;
+			const key = requestKey(message.id);
+			const correlation = responseMap.get(key);
+			responseMap.delete(key);
+			transit = {
+				...base,
+				kind: "response",
+				method: correlation?.method,
+				result: "result" in message ? message.result : void 0,
+				error: "error" in message ? message.error : void 0
+			};
+		} else if (isNotification(message) && message.method === STREAM_METHOD) {
+			const params = message.params;
+			const streamEndpoint = this._endpoint(params?.requestId);
+			transit = {
+				...base,
+				...direction === "inbound" ? { in: streamEndpoint } : { out: streamEndpoint },
+				kind: "stream",
+				method: STREAM_METHOD,
+				params: message.params
+			};
+		} else transit = {
+			...base,
+			kind: "notification",
+			method: message.method,
+			params: message.params
+		};
+		function requestKey(requestId) {
+			return JSON.stringify([typeof requestId, requestId]);
+		}
+		this._emit(transit);
+	}
+	_requestMap(direction) {
+		return direction === "outbound" ? this._outboundRequests : this._inboundRequests;
+	}
+	_endpoint(requestId) {
+		return {
+			edgeId: this._portId,
+			portId: this._portId,
+			...requestId !== void 0 ? { requestId } : {}
+		};
+	}
+	_pruneRequestCorrelations(timeMs) {
+		this._pruneRequestMap(this._outboundRequests, timeMs);
+		this._pruneRequestMap(this._inboundRequests, timeMs);
+	}
+	_pruneRequestMap(map, timeMs) {
+		while (map.size !== 0) {
+			const first = map.entries().next().value;
+			if (first === void 0 || map.size <= MAX_REQUEST_CORRELATIONS && timeMs - first[1].timeMs <= REQUEST_CORRELATION_RETENTION_MS) return;
+			map.delete(first[0]);
+		}
+	}
+};
+//#endregion
+//#region src/inspection/connectionInspectionSource.ts
+var ConnectionInspectionSource = class {
+	_connection;
+	_nodeId;
+	_options;
+	_isObserved;
+	constructor(_connection, _nodeId, _options, _isObserved) {
+		this._connection = _connection;
+		this._nodeId = _nodeId;
+		this._options = _options;
+		this._isObserved = _isObserved;
+	}
+	snapshotTopology() {
+		const { portId, label, peer, transport } = this._options;
+		const nodes = [{
+			nodeId: this._nodeId,
+			ports: [{
+				portId,
+				...label === void 0 ? {} : { label }
+			}]
+		}];
+		const links = [];
+		if (peer !== void 0) {
+			nodes.push({
+				nodeId: peer.nodeId,
+				kind: "endpoint",
+				...peer.label === void 0 ? {} : { label: peer.label },
+				ports: [{ portId: peer.portId }]
+			});
+			links.push({
+				from: {
+					nodeId: this._nodeId,
+					portId
+				},
+				to: {
+					nodeId: peer.nodeId,
+					portId: peer.portId
+				},
+				peerState: "identified",
+				...transport === void 0 ? {} : { transport }
+			});
+		}
+		return {
+			nodes,
+			links,
+			routes: []
+		};
+	}
+	onTopologyChanged(_listener) {
+		return { dispose: () => {} };
+	}
+	observeTraffic(listener) {
+		const inspector = new EndpointTrafficInspector(this._nodeId, this._options.portId, listener, this._isObserved);
+		const observation = this._connection.observeWireMessages(inspector.observe);
+		return { dispose: () => {
+			observation.dispose();
+			inspector.dispose();
+		} };
+	}
+};
+//#endregion
+//#region src/inspection/inspectionHost.ts
+/** A shared inspection scope, independent of both routing and its RPC connections. */
+var InspectionHost = class {
+	_options;
+	_sources = /* @__PURE__ */ new Map();
+	_trackedConnections = /* @__PURE__ */ new Set();
+	_bindings = /* @__PURE__ */ new Set();
+	_subscribers = /* @__PURE__ */ new Set();
+	_observers = /* @__PURE__ */ new Set();
+	_topologyListeners = /* @__PURE__ */ new Set();
+	_trafficSources = /* @__PURE__ */ new Set();
+	_trafficWatches = new TrafficWatchFlowTracker();
+	_disposed = false;
+	nodeId;
+	constructor(_options) {
+		this._options = _options;
+		this.nodeId = _options.nodeId;
+	}
+	get observerCount() {
+		return this._subscribers.size + this._observers.size;
+	}
+	addSource(source) {
+		this._assertActive();
+		if (this._sources.has(source)) throw new Error("Inspection source is already registered");
+		const readPorts = () => new Set(source.snapshotTopology().nodes.flatMap((node) => node.ports.map((port) => port.portId)));
+		let ports = readPorts();
+		const topology = source.onTopologyChanged(() => {
+			const nextPorts = readPorts();
+			const removed = [...ports].filter((port) => !nextPorts.has(port));
+			ports = nextPorts;
+			this._forgetUnusedPorts(removed);
+			this._invalidateTopology();
+		});
+		let traffic;
+		try {
+			traffic = source.observeTraffic((event) => this.publishTransit(event));
+		} catch (error) {
+			topology.dispose();
+			throw error;
+		}
+		const registration = { dispose: () => {
+			if (this._sources.get(source) !== registration) return;
+			this._sources.delete(source);
+			topology.dispose();
+			traffic.dispose();
+			this._forgetUnusedPorts([...ports]);
+			this._invalidateTopology();
+		} };
+		this._sources.set(source, registration);
+		this._invalidateTopology();
+		return registration;
+	}
+	trackConnection(connection, options) {
+		this._assertActive();
+		if (this.getGraph("").nodes.some((node) => node.ports.some((port) => port.portId === options.portId))) throw new Error(`Inspection port "${options.portId}" is already registered`);
+		const source = new ConnectionInspectionSource(connection, this.nodeId, options, () => this.observerCount !== 0);
+		const registration = this.addSource(source);
+		let close;
+		try {
+			close = connection.onDidClose(() => result.dispose());
+		} catch (error) {
+			registration.dispose();
+			throw error;
+		}
+		const result = { dispose: () => {
+			this._trackedConnections.delete(result);
+			close.dispose();
+			registration.dispose();
+		} };
+		this._trackedConnections.add(result);
+		return result;
+	}
+	expose(connection, options) {
+		this._assertActive();
+		const portId = options.portId ?? createPortId();
+		const binding = new InspectionBinding(portId);
+		const registrations = [];
+		this._bindings.add(binding);
+		const registerOptions = { serviceId: options.serviceId };
+		try {
+			const controls = new EndpointTrafficInspector(this.nodeId, portId, (event) => this._trafficWatches.accept(event), () => false);
+			registrations.push(connection.observeWireMessages(controls.observe));
+			registrations.push({ dispose: () => controls.dispose() });
+			registrations.push(connection.registerInspection(nodeInterface, { getNodeId: () => ({
+				nodeId: this.nodeId,
+				portId,
+				...(options.descriptors ?? this._options.descriptors) === void 0 ? {} : { descriptors: [...options.descriptors ?? this._options.descriptors ?? []] }
+			}) }, registerOptions));
+			registrations.push(connection.registerInspection(topologyInterface, {
+				getGraph: () => this.getGraph(options.serviceId, options.includeRoute === false ? void 0 : portId),
+				watchGraph: (_params, _ctx, stream) => this._watchGraph(binding, stream)
+			}, registerOptions));
+			registrations.push(connection.registerInspection(trafficInterface, {
+				watch: (params, _ctx, stream) => this._watchTraffic(binding, params, stream),
+				watchWithPayloads: (params, _ctx, stream) => this._watchTraffic(binding, params, stream)
+			}, registerOptions));
+		} catch (error) {
+			for (const registration of registrations.reverse()) registration.dispose();
+			this._bindings.delete(binding);
+			throw error;
+		}
+		binding.onDispose = () => {
+			this._bindings.delete(binding);
+			for (const registration of registrations.reverse()) registration.dispose();
+			this._forgetUnusedPorts([portId]);
+			this._invalidateTopology();
+		};
+		registrations.push(connection.onDidClose(() => binding.dispose()));
+		this._invalidateTopology();
+		return binding;
+	}
+	getGraph(observerServiceId, routePortId) {
+		this._assertActive();
+		const nodes = /* @__PURE__ */ new Map();
+		const mergeNode = (node) => {
+			const previous = nodes.get(node.nodeId);
+			const ports = new Map(previous?.ports.map((port) => [port.portId, port]));
+			for (const port of node.ports) ports.set(port.portId, {
+				...ports.get(port.portId),
+				...port
+			});
+			nodes.set(node.nodeId, {
+				...previous,
+				...node,
+				ports: [...ports.values()]
+			});
+		};
+		mergeNode({
+			nodeId: this.nodeId,
+			kind: this._options.kind ?? "endpoint",
+			...this._options.label === void 0 ? {} : { label: this._options.label },
+			...this._options.descriptors === void 0 ? {} : { descriptors: [...this._options.descriptors] },
+			ports: []
+		});
+		const links = [];
+		const routes = [];
+		for (const source of this._sources.keys()) {
+			const fragment = source.snapshotTopology();
+			for (const node of fragment.nodes) mergeNode(node);
+			links.push(...fragment.links);
+			routes.push(...fragment.routes);
+		}
+		for (const binding of this._bindings) mergeNode({
+			nodeId: this.nodeId,
+			ports: [{ portId: binding.portId }]
+		});
+		if (routePortId !== void 0) routes.push({
+			serviceId: observerServiceId,
+			nodeId: this.nodeId,
+			portId: routePortId,
+			match: "exact"
+		});
+		return {
+			observerServiceId,
+			entryNodeId: this.nodeId,
+			nodes: [...nodes.values()],
+			links,
+			routes
+		};
+	}
+	publishTransit(event) {
+		if (this._disposed || this._trafficWatches.accept(event)) return;
+		for (const observer of [...this._observers]) try {
+			observer(event);
+		} catch {}
+		for (const subscriber of this._subscribers) subscriber.enqueue(event);
+	}
+	subscribe(options, send) {
+		this._assertActive();
+		if (options.trafficIgnoreKey !== void 0 && !this._trafficWatches.claim(options.trafficIgnoreKey)) throw new Error("Traffic watch request was not observed before subscription");
+		const subscriber = new BoundedTrafficSubscription(options, send, () => {
+			this._subscribers.delete(subscriber);
+			this._stopUnusedTrafficSources();
+		});
+		this._subscribers.add(subscriber);
+		try {
+			this._startTrafficSources();
+		} catch (error) {
+			subscriber.dispose();
+			throw error;
+		}
+		return subscriber;
+	}
+	observeTraffic(observer) {
+		this._assertActive();
+		this._observers.add(observer);
+		const registration = { dispose: () => {
+			this._observers.delete(observer);
+			this._stopUnusedTrafficSources();
+		} };
+		try {
+			this._startTrafficSources();
+		} catch (error) {
+			registration.dispose();
+			throw error;
+		}
+		return registration;
+	}
+	addTrafficSource(source) {
+		this._assertActive();
+		const entry = { source };
+		this._trafficSources.add(entry);
+		try {
+			this._startTrafficSources();
+		} catch (error) {
+			this._trafficSources.delete(entry);
+			throw error;
+		}
+		return { dispose: () => {
+			this._trafficSources.delete(entry);
+			entry.observation?.dispose();
+			entry.observation = void 0;
+		} };
+	}
+	dispose() {
+		if (this._disposed) return;
+		this._disposed = true;
+		for (const binding of [...this._bindings]) binding.dispose();
+		for (const subscriber of [...this._subscribers]) subscriber.dispose();
+		this._observers.clear();
+		this._stopUnusedTrafficSources();
+		this._trafficSources.clear();
+		for (const connection of [...this._trackedConnections]) connection.dispose();
+		for (const source of [...this._sources.values()]) source.dispose();
+		this._topologyListeners.clear();
+		this._trafficWatches.clear();
+	}
+	_startTrafficSources() {
+		if (this.observerCount === 0) return;
+		for (const entry of this._trafficSources) entry.observation ??= entry.source.observe((event) => this.publishTransit(event));
+	}
+	_stopUnusedTrafficSources() {
+		if (this.observerCount !== 0) return;
+		for (const entry of this._trafficSources) {
+			entry.observation?.dispose();
+			entry.observation = void 0;
+		}
+	}
+	_invalidateTopology() {
+		if (this._disposed) return;
+		for (const listener of this._topologyListeners) listener();
+	}
+	_forgetUnusedPorts(portIds) {
+		if (this._disposed) return;
+		const remaining = new Set(this.getGraph("").nodes.flatMap((node) => node.ports.map((port) => port.portId)));
+		for (const portId of portIds) if (!remaining.has(portId)) this._trafficWatches.forgetPort(portId);
+	}
+	_watchGraph(binding, stream) {
+		return new Promise((resolve, reject) => {
+			let pending = false;
+			let active = true;
+			const finish = () => {
+				active = false;
+				this._topologyListeners.delete(invalidate);
+				stream.signal.removeEventListener("abort", finish);
+				binding.abort.signal.removeEventListener("abort", finish);
+				resolve({});
+			};
+			const invalidate = () => {
+				if (pending || !active) return;
+				pending = true;
+				queueMicrotask(() => {
+					pending = false;
+					if (!active) return;
+					stream.send({}).catch((error) => {
+						reject(error);
+						finish();
+					});
+				});
+			};
+			this._topologyListeners.add(invalidate);
+			stream.signal.addEventListener("abort", finish, { once: true });
+			binding.abort.signal.addEventListener("abort", finish, { once: true });
+			if (stream.signal.aborted || binding.abort.signal.aborted) finish();
+		});
+	}
+	async _watchTraffic(binding, options, stream) {
+		const subscription = this.subscribe(options, (event) => stream.send(event));
+		const dispose = () => subscription.dispose();
+		stream.signal.addEventListener("abort", dispose, { once: true });
+		binding.abort.signal.addEventListener("abort", dispose, { once: true });
+		if (stream.signal.aborted || binding.abort.signal.aborted) dispose();
+		try {
+			return await subscription.closed;
+		} finally {
+			stream.signal.removeEventListener("abort", dispose);
+			binding.abort.signal.removeEventListener("abort", dispose);
+			subscription.dispose();
+		}
+	}
+	_assertActive() {
+		if (this._disposed) throw new Error("Inspection host is disposed");
+	}
+};
+var InspectionBinding = class {
+	portId;
+	abort = new AbortController();
+	onDispose = () => {};
+	constructor(portId) {
+		this.portId = portId;
+	}
+	dispose() {
+		if (this.abort.signal.aborted) return;
+		this.abort.abort();
+		this.onDispose();
+	}
+};
+function createPortId() {
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	globalThis.crypto.getRandomValues(bytes);
+	return `port:${bytesToBase64Url(bytes)}`;
+}
+//#endregion
+export { jcsCanonicalize as $, PRINCIPAL_PREFIX as A, isRequest as B, zTopologyTransportInfo as C, zTrafficTransitEvent as D, zTrafficTransitEndpoint as E, principalForPublicKey as F, createSchemaToZod as G, InterfaceDefinition as H, publicKeyForKeyId as I, componentSchemaName as J, schemaToZod as K, resolveSigningKey as L, bytesToBase64Url as M, keyIdForPrincipal as N, zTrafficWatchResult as O, keyIdForPublicKey as P, sha256 as Q, ErrorCode as R, zTopologyTransportEndpoint as S, zTrafficOverflowEvent as T, defineInterface as U, isResponse as V, interfaceFromSchema as W, EXTENSION_PREFIX as X, componentSchemaRef as Y, computeInterfaceHash as Z, zTopologyGraph as _, TrafficWatchFlowTracker as a, notificationType as at, zTopologyNode as b, StreamControlType as c, normalizeJsonSchema as ct, nodeInterface as d, jcsCanonicalizeBytes as et, topologyInterface as f, zRouteClaim as g, zParticipantDescriptorSource as h, TrafficFlowFilter as i, isApplicationErrorValue as it, base64UrlToBytes as j, KEY_ID_PREFIX as k, StreamDir as l, zParticipantDescriptor as m, ConnectionInspectionSource as n, RequestType as nt, STREAM_METHOD as o, requestType as ot, trafficInterface as p, assertSchemaReferences as q, BoundedTrafficSubscription as r, applicationError as rt, StreamControlReason as s, zodToSvcJsonSchema as st, InspectionHost as t, NotificationType as tt, streamInterface as u, zTopologyLink as v, zTrafficEvent as w, zTopologyPort as x, zTopologyLinkEndpoint as y, isNotification as z };
 
-//# sourceMappingURL=boundedTrafficSubscription-XZ1KwXZC.js.map
+//# sourceMappingURL=inspectionHost-BA08eF6h.js.map