@vscode/component-explorer-cli 0.2.1-163 → 0.2.1-164

package/dist/external/linkrpc/typescript/packages/linkrpc/dist/chunks/src-DYVSK_tz.js

@@ -0,0 +1,1871 @@
+import { Q as preferRicherInterfaceSchema, xt as ErrorCode, d as nodeInterface, t as InspectionHost, l as StreamDir, c as StreamControlType, o as STREAM_METHOD, wt as isResponse, St as isNotification, Ct as isRequest, M as bytesToBase64Url, z as defineInterface, mt as requestType, Tt as RpcFailure, ft as isApplicationErrorValue, vt as parseDeclaredErrorBody, _t as jsonIssues, bt as brandApplicationError } from './inspectionHost-BA6ZmC_P.js';
+import { object, array, string, optional, boolean, number, int, nonnegative, positive, unknown, union } from 'zod/mini';
+import { safeParse } from 'zod/v4/core';
+
+/*---------------------------------------------------------------------------------------------
+*  Copyright (c) Microsoft Corporation. All rights reserved.
+*  Licensed under the MIT License. See License.txt in the project root for license information.
+*--------------------------------------------------------------------------------------------*/
+//#endregion
+//#region src/connection/nonCompliantServerError.ts
+var NonCompliantServerError = class extends Error {
+	original;
+	issues;
+	kind = "nonCompliantServer";
+	constructor(original, issues) {
+		super(`Server error ${original.code} does not match its declared schema: ${issues.map((issue) => `${issue.path || "/"}: ${issue.message}`).join("; ")}`);
+		this.original = original;
+		this.issues = issues;
+		this.name = "NonCompliantServerError";
+	}
+};
+function validateBarePrefix(prefix) {
+	if (prefix.includes("::") || !/^[\x20-\x7e]*$/.test(prefix)) throw new Error("Bare interface prefix must contain only printable ASCII and must not contain \"::\".");
+}
+new Set("break case catch class const continue debugger default delete do else enum export extends false finally for function if import in instanceof new null return super switch this throw true try typeof var void while with implements interface let package private protected public static yield await".split(" "));
+//#endregion
+//#region src/protocol/methodName.ts
+/**
+* Parse a JSON-RPC method string. Returns `undefined` if any segment is
+* empty or the segment count is out of range.
+*/
+function parseMethodName(method) {
+	const parts = method.split("::");
+	if (parts.length === 3 && parts[0].length === 0 && parts[1].length > 0 && parts[2].length > 0) return {
+		kind: "interface",
+		interfaceId: parts[1],
+		member: parts[2]
+	};
+	if (parts.some((p) => p.length === 0)) return void 0;
+	if (parts.length === 1) return {
+		kind: "bare",
+		member: parts[0]
+	};
+	if (parts.length === 2) return {
+		kind: "interface",
+		interfaceId: parts[0],
+		member: parts[1]
+	};
+	if (parts.length === 3) return {
+		kind: "full",
+		serviceId: parts[0],
+		interfaceId: parts[1],
+		member: parts[2]
+	};
+}
+//#endregion
+//#region src/protocol/signedObject.ts
+/**
+* The HubRPC **signed-object** standard: one rule for committing a
+* signature (and a content hash) over any JSON object.
+*
+* > The signature `obj.$hubrpcSignature[domain]` covers
+* > `jcs({ [domainValue(domain)]: obj without $hubrpcSignature and $hubrpcUnsigned })`.
+*
+* Both reserved keys are stripped before canonicalization — on **every**
+* object, call or capability alike:
+*
+*  - {@link HUBRPC_SIGNATURE_KEY} (`$hubrpcSignature`) holds the signature
+*    itself (a domain-keyed map of `{ keyId, sig }` entries). It can't sign
+*    itself, so it's excluded.
+*  - {@link HUBRPC_UNSIGNED_KEY} (`$hubrpcUnsigned`) holds extrinsic
+*    *attachments* (e.g. the presented capability bag) authored by someone
+*    other than this signer, so it's excluded too.
+*
+* Domain separation is intrinsic: the per-domain {@link signingDomainValue}
+* is the sole key of the canonicalized wrapper object. A `"call"` signature
+* can therefore never verify as a `"capability"` (or vice-versa). The domain
+* is *supplied by context* by signer and verifier;
+* the on-wire `$hubrpcSignature` key is a convenience index, never a trust
+* claim.
+*
+* This module is pure (no private keys, no `crypto.verify`): it only defines
+* the canonical bytes. Signing/verifying live in `../identity/signedObject`.
+*/
+/** Reserved wire-key: the signature map `{ [domain]: SignatureEnvelope }`. */
+const HUBRPC_SIGNATURE_KEY = "$hubrpcSignature";
+/** Reserved wire-key: extrinsic unsigned attachments (e.g. the capability bag). */
+const HUBRPC_UNSIGNED_KEY = "$hubrpcUnsigned";
+/** Reserved wire-key: signed call meta, present only on calls (dodges the JSON-RPC param namespace). */
+const HUBRPC_META_KEY = "$hubrpc";
+/**
+* Return the application-authored portion of a LinkRPC params value.
+*
+* Routing and gate layers must continue forwarding the original wire params so
+* every chained hub can independently verify the envelope. Terminal dispatch
+* may use this derived value for application-schema validation without mutating
+* or replacing the wire message.
+*/
+function stripLinkRpcWireMeta(wireParams) {
+	if (wireParams === void 0) return void 0;
+	if (wireParams === null || typeof wireParams !== "object" || Array.isArray(wireParams)) return wireParams;
+	const object = wireParams;
+	const reserved = [
+		HUBRPC_META_KEY,
+		HUBRPC_SIGNATURE_KEY,
+		HUBRPC_UNSIGNED_KEY
+	];
+	if (!reserved.some((key) => key in object)) return object;
+	const userParams = {};
+	for (const key of Object.keys(object)) {
+		if (reserved.includes(key)) continue;
+		userParams[key] = object[key];
+	}
+	return userParams;
+}
+//#endregion
+//#region src/hub/common/reflection.interfaces.ts
+const defaultsInterface = defineInterface({
+	id: "hubrpc.defaults",
+	description: "Reflection: preset default service / interface on this connection."
+}, {
+	get: requestType(object({}), object({
+		serviceId: optional(string()),
+		interfaceId: optional(string()),
+		/** Hash of the preset interface, if known. */
+		interfaceHash: optional(string())
+	})),
+	listBindings: requestType(object({}), object({ bindings: array(object({
+		prefix: string(),
+		serviceId: optional(string()),
+		interfaceId: string(),
+		interfaceHash: string()
+	})) }))
+});
+/**
+* A single root-principal requirement. `transitive: true` means the requirement
+* also applies to every service reachable *through* this one — i.e. when this
+* listing is a `hubrpc.directory` reference, everything it lists inherits the
+* requirement (also as transitive).
+*/
+const zRootPrincipalReq = object({
+	principal: string(),
+	transitive: optional(boolean())
+});
+/** One OR-set. The set is satisfied by holding *any one* of its principals. */
+const zRootPrincipalSet = array(zRootPrincipalReq);
+const zServiceIdPattern = union([object({ exact: string() }), object({ prefix: string() })]);
+const zServiceListing = object({
+	serviceId: string(),
+	interfaceId: string(),
+	/** Hash of the interface as implemented by this service. */
+	interfaceHash: string(),
+	/** Optional, non-authoritative discovery labels of this implemented interface. */
+	tags: optional(array(string())),
+	/** Optional non-normative description of the owning service. */
+	serviceDescription: optional(string()),
+	/**
+	* Root principals required to access this service, in CNF: the caller must
+	* satisfy **every** set (AND), and a set is satisfied by **any one** of its
+	* principals (OR). Omitted/empty => no root-principal requirement.
+	*/
+	rootPrincipalSets: optional(array(zRootPrincipalSet)),
+	/**
+	* Service-id regions reachable through this referral. Meaningful only for
+	* `hubrpc.directory` entries; omission defaults to the referral service-id
+	* subtree.
+	*/
+	reachableServiceIds: optional(array(zServiceIdPattern))
+});
+const directoryInterface = defineInterface({
+	id: "hubrpc.directory",
+	description: "Reflection: list services exposed by this endpoint. Can also list other directory services that can be explored."
+}, {
+	list: requestType(object({
+		/** Filter: only return services implementing this interface id. */
+		interfaceId: optional(string()),
+		/** Filter: only return services whose interface id starts with this prefix. */
+		interfaceIdPrefix: optional(string()),
+		/** Filter: only return entries for this service id. */
+		serviceId: optional(string()),
+		/** Union filter used to constrain a transitive directory walk. */
+		serviceIdScopes: optional(array(zServiceIdPattern)),
+		/** Paging: opaque continuation token from a previous response. */
+		cursor: optional(string()),
+		/** Paging: max items in this page. Server MAY return fewer. */
+		limit: optional(number().check(int(), positive())),
+		/** Soft cap on time the server spends gathering this page, in ms. */
+		timeoutMs: optional(number().check(int(), nonnegative()))
+	}), object({
+		items: array(zServiceListing),
+		/** Omitted => no more pages. */
+		nextCursor: optional(string()),
+		/** True if `timeoutMs` cut the page short before exhausting results. */
+		truncated: optional(boolean())
+	})),
+	/**
+	* Coarse change tap on the directory.
+	*
+	* `watch` is a long-lived streaming request that emits an **empty tick**
+	* whenever the (optionally filtered) directory *might* have changed. The
+	* tick carries no delta and no payload — its only meaning is "re-`list`
+	* now". The consumer reconciles against its own last snapshot.
+	*
+	* This keeps the server stateless: it never computes or replays
+	* per-item deltas, never does an initial-sync replay. Over-emission is
+	* allowed (the consumer re-lists and finds nothing new); under-emission
+	* is not. Ticks are coalesced. The `interfaceId` / `serviceId` filters
+	* mirror `list` and are a relevance hint, not a guarantee.
+	*
+	* The request resolves when the caller cancels (or the connection
+	* drops); the runtime auto-detaches the stream when it settles.
+	*/
+	watch: requestType(object({
+		/** Relevance hint: changes touching this interface id. */
+		interfaceId: optional(string()),
+		/** Relevance hint: changes touching an interface id with this prefix. */
+		interfaceIdPrefix: optional(string()),
+		/** Relevance hint: changes touching this service id. */
+		serviceId: optional(string()),
+		/** Relevance hint: changes within any of these service-id regions. */
+		serviceIdScopes: optional(array(zServiceIdPattern))
+	}), object({})).withStream({ 
+	/** Empty tick: "the directory may have changed; re-list." */
+server: object({}) })
+});
+const schemasInterface = defineInterface({
+	id: "hubrpc.schemas",
+	description: "Reflection: fetch interface schemas by id (+ optional hash). Must serve the interfaces advertised in this endpoint's directory."
+}, { get: requestType(object({
+	interfaceId: string(),
+	/** Omit => server picks the version it exposes. */
+	hash: optional(string())
+}), object({ 
+/** A full `SvcInterfaceSchema`. */
+schema: unknown() })) });
+/** Segment-aware service-id pattern matching (`foo` includes `foo/bar`, not `foobar`). */
+function serviceIdMatchesPattern(serviceId, pattern) {
+	if ("exact" in pattern) return serviceId === pattern.exact;
+	return pattern.prefix === "" || serviceId === pattern.prefix || serviceId.startsWith(`${pattern.prefix}/`);
+}
+/** Whether a service id is included by a union of patterns. `undefined` means unfiltered. */
+function serviceIdMatchesScopes(serviceId, scopes) {
+	return scopes === void 0 || scopes.some((pattern) => serviceIdMatchesPattern(serviceId, pattern));
+}
+//#endregion
+//#region src/connection/channel.ts
+var Channel = class Channel {
+	sender;
+	_setHandler;
+	_setWireObserver;
+	constructor(sender, _setHandler, _setWireObserver) {
+		this.sender = sender;
+		this._setHandler = _setHandler;
+		this._setWireObserver = _setWireObserver;
+	}
+	/** Bind the inbound request/notification handler. May be called before or after construction of {@link LinkRpcConnection}. */
+	setRequestHandler(handler) {
+		this._setHandler(handler);
+	}
+	/**
+	* Install the endpoint inspection observer at the JSON-RPC wire boundary.
+	* Intended for {@link LinkRpcConnection}; ordinary consumers should use the
+	* public `hubrpc.traffic` service instead.
+	*/
+	setWireMessageObserver(observer) {
+		this._setWireObserver?.(observer);
+	}
+	/**
+	* Compose this channel with a sender-side decorator (typically the
+	* signing layer). The decorator wraps {@link sender} only; the
+	* {@link setRequestHandler} binding is shared with the original channel
+	* so the receive side is bound exactly once regardless of decoration depth.
+	*/
+	withSender(decorate) {
+		return new Channel(decorate(this.sender), this._setHandler, this._setWireObserver);
+	}
+};
+var RpcError = class extends Error {
+	code;
+	origin;
+	data;
+	hasData;
+	constructor(message, code, data, origin = "local", hasData = data !== void 0) {
+		super(message);
+		this.code = code;
+		this.origin = origin;
+		this.message = message;
+		this.name = "RpcError";
+		this.hasData = hasData;
+		if (hasData) this.data = data;
+	}
+};
+//#endregion
+//#region src/connection/jsonRpcChannel.ts
+/**
+* How often a streaming-enabled call emits a `toCallee` keepalive ping so a
+* routing hub's per-request idle timer never reaps the in-flight request.
+* Must stay comfortably below the hub's idle timeout (default 30 min).
+*/
+const KEEPALIVE_PING_INTERVAL_MS = 6e5;
+/**
+* Minimal JSON-RPC 2.0 channel: correlates requests with responses,
+* dispatches incoming requests/notifications to a handler.
+*
+* Construct via {@link JsonRpcChannel.create}: it returns a
+* {@link Channel} factory which materialises the live channel once a
+* handler is supplied via `.connect(handler)`. The handler is fixed for
+* the channel's lifetime — no setter, no mid-flight swap.
+*
+* The outbound `TOutCtx` of the produced sender is `unknown` — this
+* channel ignores per-call ctx entirely. Decorators (e.g.
+* `SigningSender`) lift it to a concrete shape.
+*/
+var JsonRpcChannel = class JsonRpcChannel {
+	_transport;
+	_requestsDeferred;
+	/**
+	* Wrap a transport in a {@link Channel}. The channel's sender is live
+	* immediately; call {@link Channel.setRequestHandler} (or pass the channel
+	* to {@link LinkRpcConnection}) to bind the inbound handler.
+	*/
+	static create(transport) {
+		return this.createWithClose(transport).channel;
+	}
+	/**
+	* Wrap a transport with lifecycle hooks. deferRequests queues requests,
+	* notifications, and their input streams until resumeRequests is called.
+	* Responses and output streams remain live for setup-time outbound calls.
+	*/
+	static createWithClose(transport, options = {}) {
+		const jrc = new JsonRpcChannel(transport, options.deferRequests === true);
+		return {
+			channel: new Channel(jrc, (h) => jrc.setRequestHandler(h), (observer) => jrc.setWireMessageObserver(observer)),
+			close: () => jrc.close(),
+			resumeRequests: () => jrc.resumeRequests()
+		};
+	}
+	_nextId = 1;
+	_pending = /* @__PURE__ */ new Map();
+	/**
+	* Per-request callbacks invoked when a {@link STREAM_METHOD}
+	* notification arrives with a matching `requestId`. Used in both
+	* directions: outgoing-request callers register here keyed by the
+	* id they sent; per-call incoming-request stream handles register
+	* keyed by the id they observed. Entries are removed when the
+	* corresponding request completes (response received for outgoing,
+	* response sent for incoming).
+	*/
+	_streamListeners = /* @__PURE__ */ new Map();
+	/**
+	* Per-incoming-request handlers for reserved `control` messages
+	* (cancel / ping / pong) arriving as stream notifications. Keyed
+	* by the id observed; removed when the request settles.
+	*/
+	_streamControl = /* @__PURE__ */ new Map();
+	_incomingAborts = /* @__PURE__ */ new Map();
+	_handler;
+	_wireObserver;
+	_closeError;
+	_deferredMessages = [];
+	setRequestHandler(handler) {
+		this._handler = handler;
+	}
+	setWireMessageObserver(observer) {
+		this._wireObserver = observer;
+	}
+	constructor(_transport, _requestsDeferred) {
+		this._transport = _transport;
+		this._requestsDeferred = _requestsDeferred;
+		this._transport.setListener((m) => this._onMessage(m));
+	}
+	resumeRequests() {
+		while (this._deferredMessages.length > 0) this._dispatchMessage(this._deferredMessages.shift());
+		this._requestsDeferred = false;
+	}
+	async sendRequest(method, params, opts) {
+		this._throwIfClosed();
+		const id = this._nextId++;
+		const req = {
+			jsonrpc: "2.0",
+			id,
+			method
+		};
+		if (params !== void 0) req.params = params;
+		const promise = new Promise((resolve, reject) => {
+			this._pending.set(String(id), {
+				resolve,
+				reject
+			});
+		});
+		this._observeOutbound(req, opts);
+		try {
+			await this._transport.send(req);
+		} catch (error) {
+			this._pending.delete(String(id));
+			this._observeSendFailure(id, error);
+			throw error;
+		}
+		return promise;
+	}
+	async sendNotification(method, params, opts) {
+		this._throwIfClosed();
+		const n = {
+			jsonrpc: "2.0",
+			method
+		};
+		if (params !== void 0) n.params = params;
+		this._observeOutbound(n, opts);
+		await this._transport.send(n);
+	}
+	sendRequestWithStream(method, params, opts) {
+		this._throwIfClosed();
+		const id = this._nextId++;
+		const key = String(id);
+		let resolveResult;
+		let rejectResult;
+		const result = new Promise((resolve, reject) => {
+			resolveResult = resolve;
+			rejectResult = reject;
+		});
+		this._pending.set(key, {
+			resolve: resolveResult,
+			reject: rejectResult
+		});
+		if (opts?.onStreamMessage) this._streamListeners.set(key, opts.onStreamMessage);
+		const pinger = this._makePinger(id, StreamDir.toCallee);
+		this._streamControl.set(key, pinger.onControl);
+		const ping = setInterval(() => {
+			this._sendStream(id, StreamDir.toCallee, { control: { type: StreamControlType.ping } });
+		}, KEEPALIVE_PING_INTERVAL_MS);
+		ping.unref?.();
+		const stopPing = () => {
+			clearInterval(ping);
+			pinger.dispose();
+			this._streamControl.delete(key);
+		};
+		const dispose = (reason = "streaming request disposed") => {
+			if (!this._pending.delete(key)) return;
+			this._streamListeners.delete(key);
+			stopPing();
+			rejectResult(new RpcError(reason, ErrorCode.cancelled));
+		};
+		result.then(stopPing, stopPing);
+		(async () => {
+			const req = {
+				jsonrpc: "2.0",
+				id,
+				method
+			};
+			if (params !== void 0) req.params = params;
+			this._observeOutbound(req, opts);
+			await this._transport.send(req);
+		})().catch((err) => {
+			this._pending.delete(key);
+			this._streamListeners.delete(key);
+			this._observeSendFailure(id, err);
+			stopPing();
+			rejectResult(err instanceof Error ? err : new Error(String(err)));
+		});
+		return {
+			result,
+			send: (payload) => this._sendStream(id, StreamDir.toCallee, { payload }),
+			cancel: (reason) => this._sendStream(id, StreamDir.toCallee, { control: reason !== void 0 ? {
+				type: StreamControlType.cancel,
+				reason
+			} : { type: StreamControlType.cancel } }),
+			dispose,
+			ping: pinger.ping
+		};
+	}
+	/**
+	* Build the symmetric ping/pong machinery for one in-flight request.
+	*
+	* `outboundDir` is the direction *this* side emits controls in
+	* (`toCallee` for the caller, `toCaller` for the callee). A received
+	* ping is answered with a pong in that same direction, echoing the
+	* ping's nonce; a received pong resolves the matching outstanding
+	* {@link ping} probe.
+	*/
+	_makePinger(requestId, outboundDir) {
+		const pending = /* @__PURE__ */ new Map();
+		let nextNonce = 1;
+		const ping = () => {
+			const nonce = `${requestId}:${nextNonce++}`;
+			const p = new Promise((resolve, reject) => pending.set(nonce, {
+				resolve,
+				reject
+			}));
+			this._sendStream(requestId, outboundDir, { control: {
+				type: StreamControlType.ping,
+				nonce
+			} });
+			return p;
+		};
+		const onControl = (control) => {
+			if (control.type === StreamControlType.ping) this._sendStream(requestId, outboundDir, { control: {
+				type: StreamControlType.pong,
+				nonce: control.nonce
+			} });
+			else if (control.type === StreamControlType.pong && control.nonce !== void 0) {
+				const waiter = pending.get(control.nonce);
+				if (waiter) {
+					pending.delete(control.nonce);
+					waiter.resolve();
+				}
+			}
+		};
+		const dispose = () => {
+			const err = new RpcError("Request settled before pong", ErrorCode.cancelled);
+			for (const w of pending.values()) w.reject(err);
+			pending.clear();
+		};
+		return {
+			ping,
+			onControl,
+			dispose
+		};
+	}
+	/**
+	* Emit a stream notification ({@link STREAM_METHOD}) associated with
+	* an in-flight request. Internal: outgoing-side callers reach this
+	* via {@link RawStreamingCall.send} / `cancel`; incoming-side handlers
+	* reach it via {@link IncomingStream.send}.
+	*/
+	async _sendStream(requestId, dir, fields) {
+		this._throwIfClosed();
+		const params = {
+			requestId,
+			dir,
+			...fields
+		};
+		const n = {
+			jsonrpc: "2.0",
+			method: STREAM_METHOD,
+			params
+		};
+		this._observeOutbound(n);
+		await this._transport.send(n);
+	}
+	close() {
+		if (this._closeError) return;
+		const error = new RpcError("Connection closed", ErrorCode.peerDisconnected);
+		this._closeError = error;
+		this._deferredMessages.length = 0;
+		for (const abort of this._incomingAborts.values()) abort.abort(error);
+		this._incomingAborts.clear();
+		this._transport.dispose();
+		for (const p of this._pending.values()) p.reject(error);
+		this._pending.clear();
+		this._streamListeners.clear();
+		this._streamControl.clear();
+	}
+	_throwIfClosed() {
+		if (this._closeError) throw this._closeError;
+	}
+	_onMessage(m) {
+		this._observeInbound(m);
+		if (this._requestsDeferred && !isResponse(m) && !(isNotification(m) && m.method === STREAM_METHOD && m.params?.dir === StreamDir.toCaller)) {
+			this._deferredMessages.push(m);
+			return;
+		}
+		this._dispatchMessage(m);
+	}
+	_dispatchMessage(m) {
+		const ctx = m.context;
+		if (isResponse(m)) {
+			if (m.id === null) return;
+			const key = String(m.id);
+			const pending = this._pending.get(key);
+			if (!pending) return;
+			this._pending.delete(key);
+			this._streamListeners.delete(key);
+			if ("error" in m) {
+				const e = m.error;
+				const err = new RpcError(e.message, e.code, e.data, "remote", Object.hasOwn(e, "data"));
+				pending.reject(err);
+			} else pending.resolve(m.result);
+			return;
+		}
+		if (isRequest(m)) {
+			this._handleRequest(m, ctx).catch(() => {});
+			return;
+		}
+		if (isNotification(m)) {
+			if (m.method === STREAM_METHOD) {
+				this._handleStreamNotification(m);
+				return;
+			}
+			this._handleNotification(m, ctx);
+			return;
+		}
+	}
+	_handleStreamNotification(m) {
+		const params = m.params;
+		if (!params) return;
+		const requestId = params.requestId;
+		if (requestId === void 0) return;
+		const key = String(requestId);
+		if (params.control) {
+			this._streamControl.get(key)?.(params.control);
+			return;
+		}
+		const listener = this._streamListeners.get(key);
+		if (!listener) return;
+		listener(params.payload);
+	}
+	async _handleRequest(m, context) {
+		const key = String(m.id);
+		const pinger = this._makePinger(m.id, StreamDir.toCaller);
+		const stream = {
+			send: (payload) => this._sendStream(m.id, StreamDir.toCaller, { payload }),
+			onMessage: (listener) => {
+				if (listener) this._streamListeners.set(key, listener);
+				else this._streamListeners.delete(key);
+			},
+			ping: pinger.ping
+		};
+		const abort = new AbortController();
+		this._incomingAborts.set(key, abort);
+		this._streamControl.set(key, (control) => {
+			if (control.type === StreamControlType.cancel) abort.abort(new RpcError(control.reason ?? "cancelled", ErrorCode.cancelled));
+			else pinger.onControl(control);
+		});
+		let result;
+		try {
+			if (!this._handler) result = { error: {
+				code: ErrorCode.methodNotFound,
+				message: `No handler registered on this endpoint (method: ${m.method}).`
+			} };
+			else try {
+				result = await this._handler.handleRequest({
+					method: m.method,
+					params: m.params,
+					context,
+					stream,
+					signal: abort.signal
+				});
+			} catch (e) {
+				result = { error: {
+					code: ErrorCode.internalError,
+					message: e instanceof Error ? e.message : String(e)
+				} };
+			}
+		} finally {
+			this._streamListeners.delete(key);
+			this._streamControl.delete(key);
+			this._incomingAborts.delete(key);
+			pinger.dispose();
+		}
+		if ("result" in result) {
+			const response = {
+				jsonrpc: "2.0",
+				id: m.id,
+				result: result.result
+			};
+			this._observeOutbound(response);
+			await this._transport.send(response);
+		} else {
+			const resp = {
+				jsonrpc: "2.0",
+				id: m.id,
+				error: result.error
+			};
+			this._observeOutbound(resp);
+			await this._transport.send(resp);
+		}
+	}
+	_handleNotification(m, context) {
+		if (!this._handler) return;
+		try {
+			this._handler.handleNotification({
+				method: m.method,
+				params: m.params,
+				context,
+				stream: _NOOP_STREAM,
+				signal: _NEVER_ABORT
+			});
+		} catch {}
+	}
+	_observeInbound(message) {
+		const observer = this._wireObserver;
+		if (observer === void 0) return;
+		observer("inbound", message);
+	}
+	_observeOutbound(message, opts) {
+		const observer = this._wireObserver;
+		if (observer === void 0) return;
+		observer("outbound", message);
+	}
+	_observeSendFailure(requestId, error) {
+		if (this._wireObserver === void 0) return;
+		this._observeInbound({
+			jsonrpc: "2.0",
+			id: requestId,
+			error: {
+				code: ErrorCode.peerDisconnected,
+				message: error instanceof Error ? error.message : String(error)
+			}
+		});
+	}
+};
+/** Stub stream handle for notifications, which carry no request id. */
+const _NOOP_STREAM = {
+	send: () => Promise.resolve(),
+	onMessage: () => {},
+	ping: () => Promise.resolve()
+};
+/** A signal that never aborts — handed to notification handlers. */
+const _NEVER_ABORT = new AbortController().signal;
+function defaultInterfaceTarget(iface) {
+	return Object.freeze({
+		mode: "default",
+		interface: iface
+	});
+}
+function isInterfaceTarget(value) {
+	return typeof value === "object" && value !== null && "interface" in value && "mode" in value && (value.mode === "qualified" || value.mode === "default" || value.mode === "bare");
+}
+//#endregion
+//#region src/connection/linkRpcConnection.ts
+/**
+* High-level linkrpc connection. Layers method-name routing and zod-driven
+* validation on top of a plain JSON-RPC channel.
+*
+* Typed proxies built by this class merely forward each call's
+* `interfaceHash` hint to the channel so the signer stamps it into the
+* `$hubrpc` envelope.
+*
+* `TInCtx` is the per-call out-of-band context the connection's transport
+* carries. Default `undefined` covers cross-process and ordinary in-process
+* transports. The hub's self/overlay connections instantiate with a
+* concrete `TInCtx` (e.g. `Participant`) so handlers can see who originated
+* the call.
+*
+* `TOutCtx` is the per-call override / extension bag the outbound sender
+* understands (see {@link SendOpts.ctx}). It only ever flows into the
+* sender as input, so it is a contravariant type parameter. Default `any`
+* keeps the bare `LinkRpcConnection` a valid supertype for holders that do
+* not care about the outbound ctx; pass a concrete shape (e.g.
+* `SigningCallCtx`) to get precise {@link get} typing. The connection
+* itself is agnostic to its contents — it merely forwards the `ctx`
+* defaults supplied to {@link get}.
+*/
+var LinkRpcConnection = class LinkRpcConnection {
+	/**
+	* Convenience: build a {@link JsonRpcChannel} `Channel` from the
+	* given transport and wrap it in an `LinkRpcConnection`. Use this
+	* when you have a transport at hand and don't need a decorator
+	* stack (e.g. signing).
+	*/
+	static fromTransport(transport, options = {}) {
+		return new LinkRpcConnection(JsonRpcChannel.create(transport), options);
+	}
+	/** Underlying JSON-RPC sender — useful for callers that need raw access (e.g. to call hub-served methods that bypass the interface registry). */
+	channel;
+	/** key = `${serviceId ?? ""}::${interfaceId}` */
+	_registry = /* @__PURE__ */ new Map();
+	/** Descriptions for services that have been registered with a `serviceDescription`. */
+	_serviceDescriptions = /* @__PURE__ */ new Map();
+	/** Root-node-id requirement sets recorded per serviceId. */
+	_serviceRootPrincipalSets = /* @__PURE__ */ new Map();
+	_directoryWatchers = /* @__PURE__ */ new Set();
+	_directoryListeners = /* @__PURE__ */ new Set();
+	_inspection;
+	_inspectionHost;
+	_serviceInspectionRegistrations = /* @__PURE__ */ new Map();
+	_wireObservers = /* @__PURE__ */ new Set();
+	_closeListeners = /* @__PURE__ */ new Set();
+	_closed = false;
+	_wireChannel;
+	_validateOutboundParams;
+	/** Bare-method bindings, keyed by their exact wire prefix. */
+	_bareBindings = /* @__PURE__ */ new Map();
+	_generateTopologyId;
+	/**
+	* Construct from a {@link Channel} (binds the inbound handler and uses
+	* `channel.sender` for outbound calls) or from a bare
+	* {@link IRequestSender} (send-only — no inbound handler is registered,
+	* useful for bootstrap flows like `createManagedIdentity`).
+	*/
+	constructor(channel, options = {}) {
+		this._validateOutboundParams = options.validateOutboundParams !== false;
+		this._generateTopologyId = options.generateTopologyId ?? createInspectionId;
+		if ("sender" in channel) {
+			this._wireChannel = channel;
+			this.channel = channel.sender;
+			channel.setRequestHandler({
+				handleRequest: (c) => this._handleRequest(c),
+				handleNotification: (c) => this._handleNotification(c)
+			});
+		} else {
+			this._wireChannel = void 0;
+			this.channel = channel;
+		}
+	}
+	get(ifaceOrTarget, opts) {
+		return this._getClient(ifaceOrTarget, opts, false);
+	}
+	_getClient(ifaceOrTarget, opts, allFailuresAsValues) {
+		if (isInterfaceTarget(ifaceOrTarget)) {
+			if (opts !== void 0) throw new Error(`${allFailuresAsValues ? "getResultClient" : "get"}: ${ifaceOrTarget.mode === "bare" ? "bare " : ""}interface targets do not accept service or call options.`);
+			if (ifaceOrTarget.mode === "bare") return this._buildBareClient(ifaceOrTarget.interface, ifaceOrTarget.prefix, allFailuresAsValues);
+			return this._buildClient(ifaceOrTarget.interface, ifaceOrTarget.mode === "qualified" ? { serviceId: ifaceOrTarget.serviceId } : {}, void 0, ifaceOrTarget.mode === "default", allFailuresAsValues);
+		}
+		return this._buildClient(ifaceOrTarget, opts ?? {}, void 0, false, allFailuresAsValues);
+	}
+	/**
+	* Get a typed client that emits foreign-protocol bare method names.
+	* Unlike {@link get}, these calls carry no LinkRPC interface metadata.
+	*/
+	getBare(iface, opts = {}) {
+		return this._buildBareClient(iface, opts.prefix ?? "", false);
+	}
+	_buildBareClient(iface, prefix, allFailuresAsValues) {
+		validateBarePrefix(prefix);
+		for (const [name, member] of Object.entries(iface.members)) if (member.kind === "request" && (member.clientStreamSchema !== void 0 || member.serverStreamSchema !== void 0)) throw new Error(`getBare: streaming method "${name}" is not supported on foreign wires.`);
+		return this._buildClient(iface, {}, prefix, false, allFailuresAsValues);
+	}
+	getResultClient(ifaceOrTarget, opts) {
+		return this._getClient(ifaceOrTarget, opts, true);
+	}
+	/** Get a service-scoped handle; all interfaces obtained from it route via `serviceId` (form 3). */
+	service(serviceId) {
+		return new ServiceHandle(this, serviceId);
+	}
+	/** Register handlers, adding preset routing when passed a default or bare target. */
+	register(ifaceOrTarget, handlers, opts = {}) {
+		if (isInterfaceTarget(ifaceOrTarget)) {
+			if (ifaceOrTarget.mode === "qualified") {
+				if (opts.serviceId !== void 0 && opts.serviceId !== ifaceOrTarget.serviceId) throw new Error("register: serviceId conflicts with interface target.");
+				return this._register(ifaceOrTarget.interface, handlers, {
+					...opts,
+					serviceId: ifaceOrTarget.serviceId || void 0
+				}, false);
+			}
+			const prefix = ifaceOrTarget.mode === "bare" ? ifaceOrTarget.prefix : "";
+			validateBarePrefix(prefix);
+			return this._register(ifaceOrTarget.interface, handlers, opts, false, prefix);
+		}
+		return this._register(ifaceOrTarget, handlers, opts, false);
+	}
+	/** Register inspection contracts without recursively enabling service inspection. */
+	registerInspection(iface, handlers, opts = {}) {
+		return this._register(iface, handlers, opts, true);
+	}
+	/** Observe this connection without replacing another inspection scope's observer. */
+	observeWireMessages(observer) {
+		if (this._closed) throw new Error("Connection is closed");
+		if (this._wireChannel === void 0) throw new Error("Connection has no observable wire channel");
+		this._wireObservers.add(observer);
+		this._wireChannel.setWireMessageObserver((direction, message) => {
+			for (const listener of [...this._wireObservers]) try {
+				listener(direction, message);
+			} catch {}
+		});
+		return { dispose: () => {
+			this._wireObservers.delete(observer);
+			if (this._wireObservers.size === 0) this._wireChannel?.setWireMessageObserver(void 0);
+		} };
+	}
+	onDidClose(listener) {
+		if (this._closed) throw new Error("Connection is closed");
+		this._closeListeners.add(listener);
+		return { dispose: () => {
+			this._closeListeners.delete(listener);
+		} };
+	}
+	_register(iface, handlers, opts, internalInspection, barePrefix) {
+		const serviceId = opts.serviceId;
+		const key = `${serviceId ?? ""}::${iface.info.id}`;
+		if (this._registry.has(key)) throw new Error(`Interface "${iface.info.id}" already registered${serviceId ? ` under service "${serviceId}"` : ""}.`);
+		if (barePrefix !== void 0 && this._bareBindings.has(barePrefix)) throw new Error(`Bare interface prefix "${barePrefix}" is already registered.`);
+		let descriptionWasAdded = false;
+		if (opts.serviceDescription !== void 0) {
+			if (serviceId === void 0) throw new Error("register: `serviceDescription` requires `serviceId`.");
+			const existing = this._serviceDescriptions.get(serviceId);
+			if (existing !== void 0 && existing !== opts.serviceDescription) throw new Error(`register: conflicting descriptions for service "${serviceId}".`);
+			descriptionWasAdded = existing === void 0;
+		}
+		let rootPrincipalSetsWereAdded = false;
+		if (opts.rootPrincipalSets !== void 0) {
+			if (serviceId === void 0) throw new Error("register: `rootPrincipalSets` requires `serviceId`.");
+			const existing = this._serviceRootPrincipalSets.get(serviceId);
+			if (existing !== void 0 && !rootPrincipalSetsEqual(existing, opts.rootPrincipalSets)) throw new Error(`register: conflicting rootPrincipalSets for service "${serviceId}".`);
+			rootPrincipalSetsWereAdded = existing === void 0;
+		}
+		const entry = {
+			iface,
+			handlers: iface.flattenHandlers(handlers),
+			serviceId,
+			internalInspection
+		};
+		if (descriptionWasAdded) this._serviceDescriptions.set(serviceId, opts.serviceDescription);
+		if (rootPrincipalSetsWereAdded) this._serviceRootPrincipalSets.set(serviceId, opts.rootPrincipalSets);
+		this._registry.set(key, entry);
+		if (barePrefix !== void 0) this._bareBindings.set(barePrefix, {
+			prefix: barePrefix,
+			entry
+		});
+		this._notifyDirectoryWatchers(entry, descriptionWasAdded || rootPrincipalSetsWereAdded);
+		if (!internalInspection && serviceId !== void 0 && this._inspection !== void 0 && !this._serviceInspectionRegistrations.has(serviceId)) try {
+			this._installServiceInspection(serviceId);
+		} catch (error) {
+			this._registry.delete(key);
+			if (barePrefix !== void 0) this._bareBindings.delete(barePrefix);
+			if (descriptionWasAdded) this._serviceDescriptions.delete(serviceId);
+			if (rootPrincipalSetsWereAdded) this._serviceRootPrincipalSets.delete(serviceId);
+			this._notifyDirectoryWatchers(entry);
+			throw error;
+		}
+		let disposed = false;
+		return { dispose: () => {
+			if (disposed) return;
+			disposed = true;
+			if (this._registry.get(key) !== entry) return;
+			this._registry.delete(key);
+			for (const [prefix, binding] of this._bareBindings) if (binding.entry === entry) this._bareBindings.delete(prefix);
+			this._notifyDirectoryWatchers(entry);
+			if (serviceId !== void 0 && !this._hasBusinessServiceRegistration(serviceId)) {
+				this._removeServiceInspection(serviceId);
+				this._serviceDescriptions.delete(serviceId);
+				this._serviceRootPrincipalSets.delete(serviceId);
+			}
+		} };
+	}
+	/** Snapshot of every interface currently registered on this connection. */
+	listRegisteredInterfaces() {
+		return Array.from(this._registry.values()).map((r) => {
+			const sid = r.serviceId ?? "";
+			const item = {
+				serviceId: sid,
+				interfaceId: r.iface.info.id,
+				interfaceHash: r.iface.schemaHash
+			};
+			if (r.iface.info.tags !== void 0) item.tags = r.iface.info.tags;
+			const desc = sid === "" ? void 0 : this._serviceDescriptions.get(sid);
+			if (desc !== void 0) item.serviceDescription = desc;
+			const sets = sid === "" ? void 0 : this._serviceRootPrincipalSets.get(sid);
+			if (sets !== void 0) item.rootPrincipalSets = sets;
+			return item;
+		});
+	}
+	/** Subscribe to coarse local directory changes; listeners must re-list. */
+	onDidChangeDirectory(listener) {
+		this._directoryListeners.add(listener);
+		return () => this._directoryListeners.delete(listener);
+	}
+	/**
+	* Look up a registered interface definition by id (and optional content
+	* hash). Returns `undefined` if no registered interface matches.
+	*/
+	findRegisteredInterface(interfaceId, hash) {
+		let selected;
+		for (const r of this._registry.values()) {
+			if (r.iface.info.id !== interfaceId) continue;
+			if (hash !== void 0 && r.iface.schemaHash !== hash) continue;
+			if (selected === void 0 || preferRicherInterfaceSchema(selected.toSchema(), r.iface.toSchema()) === r.iface.toSchema()) selected = r.iface;
+		}
+		return selected;
+	}
+	/**
+	* Register the three linkrpc reflection interfaces (`defaults`,
+	* `directory`, `schemas`), backed by this connection's live registry.
+	*
+	* By default they live under the root service (form-2 reachable as
+	* `hubrpc.directory::list`). Pass `serviceId` to additionally mount
+	* them under a specific service — useful for participants that live
+	* behind a hub, so callers can reach reflection via form-3
+	* `<serviceId>::hubrpc.directory::list`.
+	*
+	* Idempotent: re-registering the same `(serviceId, interfaceId)` pair
+	* is a no-op.
+	*/
+	enableReflection(opts = {}) {
+		const key = `${opts.serviceId ?? ""}::${defaultsInterface.info.id}`;
+		if (this._registry.has(key)) return { dispose() {} };
+		const prefix = `${opts.serviceId ?? ""}::`;
+		for (const iface of [directoryInterface, schemasInterface]) if (this._registry.has(`${prefix}${iface.info.id}`)) throw new Error(`enableReflection: partial reflection registration for service "${opts.serviceId ?? ""}".`);
+		const regOpts = opts.serviceId !== void 0 ? { serviceId: opts.serviceId } : {};
+		const registrations = [];
+		registrations.push(this.register(defaultsInterface, {
+			get: () => {
+				const binding = this._bareBindings.get("");
+				if (!binding) return {};
+				return {
+					serviceId: binding.entry.serviceId,
+					interfaceId: binding.entry.iface.info.id,
+					interfaceHash: binding.entry.iface.schemaHash
+				};
+			},
+			listBindings: () => ({ bindings: Array.from(this._bareBindings.values()).sort((a, b) => a.prefix < b.prefix ? -1 : a.prefix > b.prefix ? 1 : 0).map((binding) => ({
+				prefix: binding.prefix,
+				serviceId: binding.entry.serviceId,
+				interfaceId: binding.entry.iface.info.id,
+				interfaceHash: binding.entry.iface.schemaHash
+			})) })
+		}, regOpts));
+		registrations.push(this.register(directoryInterface, {
+			list: ({ interfaceId, interfaceIdPrefix, serviceId, serviceIdScopes, cursor, limit }) => {
+				const all = this.listRegisteredInterfaces().filter((r) => opts.serviceId === void 0 || r.serviceId === opts.serviceId).filter((r) => interfaceId === void 0 || r.interfaceId === interfaceId).filter((r) => interfaceIdPrefix === void 0 || r.interfaceId.startsWith(interfaceIdPrefix)).filter((r) => serviceId === void 0 || r.serviceId === serviceId).filter((r) => serviceIdMatchesScopes(r.serviceId, serviceIdScopes));
+				const start = cursor === void 0 ? 0 : Number.parseInt(cursor, 10) || 0;
+				const end = limit === void 0 ? all.length : Math.min(all.length, start + limit);
+				const page = all.slice(start, end).map((r) => ({
+					serviceId: r.serviceId,
+					interfaceId: r.interfaceId,
+					interfaceHash: r.interfaceHash,
+					tags: r.tags === void 0 ? void 0 : [...r.tags],
+					serviceDescription: r.serviceDescription,
+					rootPrincipalSets: r.rootPrincipalSets?.map((set) => set.map((p) => ({ ...p })))
+				}));
+				return end < all.length ? {
+					items: page,
+					nextCursor: String(end)
+				} : { items: page };
+			},
+			watch: (params, _ctx, stream) => new Promise((resolve) => {
+				const watcher = {
+					interfaceId: params.interfaceId,
+					interfaceIdPrefix: params.interfaceIdPrefix,
+					serviceId: params.serviceId,
+					serviceIdScopes: params.serviceIdScopes,
+					send: () => stream.send({})
+				};
+				this._directoryWatchers.add(watcher);
+				const finish = () => {
+					this._directoryWatchers.delete(watcher);
+					resolve({});
+				};
+				if (stream.signal.aborted) {
+					finish();
+					return;
+				}
+				stream.signal.addEventListener("abort", finish, { once: true });
+			})
+		}, regOpts));
+		registrations.push(this.register(schemasInterface, { get: ({ interfaceId, hash }) => {
+			const iface = this.findRegisteredInterface(interfaceId, hash);
+			if (!iface) throw new RpcError("Interface not found", ErrorCode.methodNotFound, {
+				reason: "unknown-interface",
+				interfaceId,
+				hash
+			});
+			return { schema: iface.toSchema() };
+		} }, regOpts));
+		if (opts.serviceId !== void 0) try {
+			this.enableReflection();
+		} catch (error) {
+			for (const registration of registrations.reverse()) registration.dispose();
+			throw error;
+		}
+		let disposed = false;
+		return { dispose: () => {
+			if (disposed) return;
+			disposed = true;
+			for (const registration of registrations.reverse()) registration.dispose();
+		} };
+	}
+	_notifyDirectoryWatchers(entry, serviceMetadataChanged = false) {
+		for (const listener of this._directoryListeners) try {
+			listener();
+		} catch {}
+		for (const watcher of this._directoryWatchers) {
+			if (watcher.pending) continue;
+			const directlyMatches = directoryWatcherMatchesEntry(watcher, entry);
+			const metadataMatches = serviceMetadataChanged && entry.serviceId !== void 0 && [...this._registry.values()].some((candidate) => candidate.serviceId === entry.serviceId && directoryWatcherMatchesEntry(watcher, candidate));
+			if (!directlyMatches && !metadataMatches) continue;
+			watcher.pending = true;
+			queueMicrotask(() => {
+				watcher.pending = false;
+				if (this._directoryWatchers.has(watcher)) watcher.send();
+			});
+		}
+	}
+	/**
+	* Enable the root `hubrpc.node::getNodeId` topology-bootstrap service.
+	*
+	* The generated ids are stable while this registration is active. They are
+	* unauthenticated correlation labels only; callers must not use them for
+	* identity, capability, or authorization decisions.
+	*/
+	enableInspection(descriptors) {
+		if (this._inspection !== void 0) return this._inspection;
+		const info = {
+			nodeId: this._generateTopologyId("node"),
+			portId: this._generateTopologyId("port"),
+			...descriptors !== void 0 ? { descriptors: [...descriptors] } : {}
+		};
+		const registration = this._register(nodeInterface, { getNodeId: () => info }, {}, true);
+		const host = new InspectionHost({
+			nodeId: info.nodeId,
+			descriptors
+		});
+		try {
+			if (this._wireChannel !== void 0) host.trackConnection(this, { portId: info.portId });
+		} catch (error) {
+			host.dispose();
+			registration.dispose();
+			throw error;
+		}
+		this._inspectionHost = host;
+		let disposed = false;
+		const result = {
+			...info,
+			observeTraffic: (observer) => host.observeTraffic(observer),
+			dispose: () => {
+				if (disposed) return;
+				disposed = true;
+				for (const serviceId of [...this._serviceInspectionRegistrations.keys()]) this._removeServiceInspection(serviceId);
+				host.dispose();
+				if (this._inspectionHost === host) this._inspectionHost = void 0;
+				registration.dispose();
+				if (this._inspection === result) this._inspection = void 0;
+			}
+		};
+		this._inspection = result;
+		try {
+			const services = new Set(Array.from(this._registry.values()).filter((entry) => entry.serviceId !== void 0 && !entry.internalInspection).map((entry) => entry.serviceId));
+			for (const serviceId of services) this._installServiceInspection(serviceId);
+		} catch (error) {
+			result.dispose();
+			throw error;
+		}
+		return result;
+	}
+	/** Number of active endpoint traffic stream subscribers. */
+	get trafficObserverCount() {
+		return this._inspectionHost?.observerCount ?? 0;
+	}
+	close() {
+		if (this._closed) return;
+		this._closed = true;
+		for (const listener of [...this._closeListeners]) listener();
+		this._closeListeners.clear();
+		this._inspection?.dispose();
+		this._wireObservers.clear();
+		this._wireChannel?.setWireMessageObserver(void 0);
+		this.channel.close();
+	}
+	_buildClient(iface, opts, barePrefix, defaultRoute = false, allFailuresAsValues = false) {
+		const { serviceId, ...ctxRest } = opts;
+		const sendOpts = barePrefix === void 0 ? {
+			ctx: ctxRest,
+			interfaceHash: iface.schemaHash
+		} : void 0;
+		const prefix = barePrefix ?? (defaultRoute ? "" : serviceId ? `${serviceId}::${iface.info.id}::` : `${iface.info.id}::`);
+		const proxy = Object.create(null);
+		for (const [name, member] of Object.entries(iface.members)) {
+			const wireMethod = `${prefix}${name}`;
+			if (member.kind === "request") {
+				if (member.clientStreamSchema !== void 0 || member.serverStreamSchema !== void 0) {
+					const serverStreamSchema = member.serverStreamSchema;
+					proxy[name] = (params, callOpts) => {
+						const userListener = callOpts?.onMessage;
+						const onStreamMessage = userListener !== void 0 ? (raw) => {
+							if (serverStreamSchema !== void 0) {
+								const r = safeParse(serverStreamSchema, raw);
+								if (!r.success) return;
+								userListener(r.data);
+								return;
+							}
+							userListener(raw);
+						} : void 0;
+						const channelOpts = onStreamMessage !== void 0 ? {
+							...sendOpts,
+							onStreamMessage
+						} : sendOpts;
+						let call;
+						try {
+							this._validateOutboundParamsFor(member, wireMethod, params);
+							call = this.channel.sendRequestWithStream(wireMethod, params, channelOpts);
+						} catch (cause) {
+							if (!allFailuresAsValues) throw cause;
+							call = {
+								result: Promise.reject(cause),
+								send: () => {
+									throw cause;
+								},
+								cancel: () => {
+									throw cause;
+								},
+								ping: async () => {
+									throw cause;
+								}
+							};
+						}
+						const checked = addCheckedResult(call.result.then((raw) => validateWireResult(member.resultSchema, raw, wireMethod)), member, allFailuresAsValues);
+						return Object.assign(checked, {
+							send: async (payload) => call.send(payload),
+							cancel: async (reason) => call.cancel(reason),
+							dispose: (reason) => call.dispose?.(reason),
+							ping: () => call.ping()
+						});
+					};
+				} else proxy[name] = (params) => {
+					return addCheckedResult((async () => {
+						this._validateOutboundParamsFor(member, wireMethod, params);
+						const raw = await this.channel.sendRequest(wireMethod, params, sendOpts);
+						return validateWireResult(member.resultSchema, raw, wireMethod);
+					})(), member, allFailuresAsValues);
+				};
+			} else {
+				const notify = (params) => {
+					this._validateOutboundParamsFor(member, wireMethod, params);
+					this.channel.sendNotification(wireMethod, params, sendOpts);
+				};
+				proxy[name] = barePrefix === void 0 ? async (params) => notify(params) : notify;
+			}
+		}
+		return iface.nestClient(proxy);
+	}
+	_validateOutboundParamsFor(member, wireMethod, params) {
+		if (!this._validateOutboundParams) return;
+		validateValue(member.paramsSchema, params, `Invalid params for ${wireMethod}`, ErrorCode.invalidParams);
+	}
+	async _handleRequest(call) {
+		const parsed = this._parseRouted(call.method);
+		if (!parsed.ok) return notFound(parsed.reason, call.method);
+		const { entry, memberName } = parsed;
+		const member = entry.iface.members[memberName];
+		if (!member) return notFound("unknown-method", call.method);
+		const handler = entry.handlers[memberName];
+		if (!handler) return notFound("unknown-method", call.method);
+		const userParams = stripLinkRpcWireMeta(call.params);
+		const parsedParams = safeParse(member.paramsSchema, userParams);
+		if (!parsedParams.success) return { error: {
+			code: ErrorCode.invalidParams,
+			message: "Invalid params",
+			data: { issues: parsedParams.error.issues }
+		} };
+		if (member.kind !== "request") return notFound("unknown-method", call.method);
+		const stream = this._buildStreamApi(call.stream, call.signal, member);
+		try {
+			const result = await handler(parsedParams.data, call.context, stream);
+			const encodedError = encodeApplicationError(member, result);
+			if (encodedError !== void 0) return { error: encodedError };
+			validateValue(member.resultSchema, result, `Invalid result for ${call.method}`, ErrorCode.internalError);
+			return { result: result === void 0 ? null : result };
+		} catch (e) {
+			if (e instanceof RpcError) return { error: {
+				code: e.code,
+				message: e.message,
+				data: e.data
+			} };
+			return { error: {
+				code: ErrorCode.internalError,
+				message: e instanceof Error ? e.message : String(e)
+			} };
+		}
+	}
+	_buildStreamApi(callStream, signal, member) {
+		return {
+			send: (payload) => {
+				if (member.serverStreamSchema) {
+					const r = safeParse(member.serverStreamSchema, payload);
+					if (!r.success) throw new Error(`Server stream payload failed schema validation: ${r.error.message}`);
+				}
+				return callStream.send(payload);
+			},
+			onMessage: (listener) => {
+				callStream.onMessage((raw) => {
+					if (member.clientStreamSchema) {
+						const r = safeParse(member.clientStreamSchema, raw);
+						if (!r.success) return;
+						listener(r.data);
+						return;
+					}
+				});
+			},
+			ping: () => callStream.ping(),
+			signal
+		};
+	}
+	_handleNotification(call) {
+		const parsed = this._parseRouted(call.method);
+		if (!parsed.ok) return;
+		const { entry, memberName } = parsed;
+		const member = entry.iface.members[memberName];
+		if (member?.kind !== "notification") return;
+		const handler = entry.handlers[memberName];
+		if (!handler) return;
+		const userParams = stripLinkRpcWireMeta(call.params);
+		const parsedParams = safeParse(member.paramsSchema, userParams);
+		if (!parsedParams.success) return;
+		handler(parsedParams.data, call.context);
+	}
+	_parseRouted(method) {
+		const parsed = parseMethodName(method);
+		if (!parsed) return {
+			ok: false,
+			reason: "bad-method-grammar"
+		};
+		if (parsed.kind === "bare") {
+			let selected;
+			for (const binding of this._bareBindings.values()) if (parsed.member.startsWith(binding.prefix) && (selected === void 0 || binding.prefix.length > selected.prefix.length)) selected = binding;
+			if (!selected) return {
+				ok: false,
+				reason: "no-preset"
+			};
+			return {
+				ok: true,
+				entry: selected.entry,
+				memberName: parsed.member.slice(selected.prefix.length)
+			};
+		}
+		const serviceId = parsed.kind === "full" ? parsed.serviceId : void 0;
+		const key = `${serviceId ?? ""}::${parsed.interfaceId}`;
+		const entry = this._registry.get(key);
+		if (!entry) return {
+			ok: false,
+			reason: serviceId ? "unknown-service" : "unknown-interface"
+		};
+		return {
+			ok: true,
+			entry,
+			memberName: parsed.member
+		};
+	}
+	_installServiceInspection(serviceId) {
+		if (this._serviceInspectionRegistrations.has(serviceId)) return;
+		const info = this._inspection;
+		const host = this._inspectionHost;
+		if (info === void 0 || host === void 0) return;
+		this._serviceInspectionRegistrations.set(serviceId, [host.expose(this, {
+			serviceId,
+			portId: info.portId
+		})]);
+	}
+	_removeServiceInspection(serviceId) {
+		const registrations = this._serviceInspectionRegistrations.get(serviceId);
+		if (registrations === void 0) return;
+		this._serviceInspectionRegistrations.delete(serviceId);
+		for (const registration of registrations.reverse()) registration.dispose();
+	}
+	_hasBusinessServiceRegistration(serviceId) {
+		return Array.from(this._registry.values()).some((entry) => entry.serviceId === serviceId && !entry.internalInspection);
+	}
+};
+function createInspectionId(kind) {
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	globalThis.crypto.getRandomValues(bytes);
+	return `${kind}:${bytesToBase64Url(bytes)}`;
+}
+/** Structural equality for two CNF root-node-id requirement collections. */
+function rootPrincipalSetsEqual(a, b) {
+	if (a.length !== b.length) return false;
+	for (let i = 0; i < a.length; i++) {
+		const sa = a[i];
+		const sb = b[i];
+		if (sa.length !== sb.length) return false;
+		for (let j = 0; j < sa.length; j++) {
+			if (sa[j].principal !== sb[j].principal) return false;
+			if (sa[j].transitive === true !== (sb[j].transitive === true)) return false;
+		}
+	}
+	return true;
+}
+function directoryWatcherMatchesEntry(watcher, entry) {
+	const serviceId = entry.serviceId ?? "";
+	return (watcher.interfaceId === void 0 || watcher.interfaceId === entry.iface.info.id) && (watcher.interfaceIdPrefix === void 0 || entry.iface.info.id.startsWith(watcher.interfaceIdPrefix)) && (watcher.serviceId === void 0 || watcher.serviceId === serviceId) && serviceIdMatchesScopes(serviceId, watcher.serviceIdScopes);
+}
+function addCheckedResult(promise, member, allFailuresAsValues = false) {
+	const settled = promise.then((value) => ({
+		ok: true,
+		value
+	}), (cause) => ({
+		ok: false,
+		error: decodeCheckedError(cause, member.applicationErrors),
+		cause
+	}));
+	const result = settled.then((outcome) => {
+		if (outcome.ok) return outcome.value;
+		if (allFailuresAsValues) return new RpcFailure(outcome.error.kind === "application" ? {
+			kind: "application",
+			error: outcome.error
+		} : {
+			kind: "generic",
+			error: outcome.error
+		});
+		if (outcome.error.kind === "application") return new RpcFailure(outcome.error);
+		throw outcome.error.kind === "nonCompliantServer" ? outcome.error : outcome.cause;
+	});
+	return Object.assign(result, { result: async () => {
+		result.catch(() => {});
+		const outcome = await settled;
+		return outcome.ok ? outcome : {
+			ok: false,
+			error: outcome.error
+		};
+	} });
+}
+function decodeCheckedError(cause, descriptors) {
+	if (cause instanceof NonCompliantServerError) return cause;
+	if (!(cause instanceof RpcError) || cause.origin !== "remote") return {
+		kind: cause instanceof RpcError && cause.origin === "transport" ? "transport" : "local",
+		cause
+	};
+	const original = {
+		code: cause.code,
+		message: cause.message,
+		...cause.hasData ? { data: cause.data } : {}
+	};
+	const candidates = descriptors.filter((candidate) => candidate.code === cause.code).sort((a, b) => Number(b.type !== void 0) - Number(a.type !== void 0));
+	const body = {
+		message: cause.message,
+		...cause.hasData ? { data: cause.data } : {}
+	};
+	const issues = [];
+	for (const descriptor of candidates) {
+		const parsed = parseDeclaredErrorBody(descriptor, body);
+		if (!parsed.success) {
+			issues.push(...parsed.issues);
+			continue;
+		}
+		if (descriptor.type === void 0) return brandApplicationError({
+			...parsed.data,
+			kind: "application",
+			code: descriptor.code
+		});
+		const envelope = parsed.data.data;
+		return brandApplicationError({
+			kind: "application",
+			code: descriptor.code,
+			message: parsed.data.message,
+			type: descriptor.type,
+			...typeof envelope === "object" && envelope !== null && "data" in envelope ? { data: envelope.data } : {}
+		});
+	}
+	if (candidates.length > 0) return new NonCompliantServerError(original, issues);
+	return {
+		kind: "remote",
+		...original
+	};
+}
+function encodeApplicationError(member, value) {
+	if (!isApplicationErrorValue(value)) return void 0;
+	const candidate = value;
+	const descriptor = member.applicationErrors.find((error) => error.code === candidate.code && error.type === candidate.type && (error.bodySchema !== void 0 || error.type !== void 0 || error.message === candidate.message));
+	if (descriptor === void 0) throw new RpcError(`Undeclared application error ${String(candidate.code)}`, ErrorCode.internalError);
+	const data = Object.hasOwn(value, "data") ? { data: value.data } : {};
+	const body = {
+		message: value.message,
+		...descriptor.type === void 0 ? data : { data: {
+			type: descriptor.type,
+			...data
+		} }
+	};
+	const parsed = parseDeclaredErrorBody(descriptor, body);
+	const issues = parsed.success ? jsonIssues(body) : parsed.issues;
+	if (issues.length > 0) throw new RpcError(`Invalid data for application error ${descriptor.code}`, ErrorCode.internalError, { issues: issues.map((issue) => ({ ...issue })) });
+	return {
+		code: descriptor.code,
+		...body
+	};
+}
+function validateWireResult(schema, raw, wireMethod) {
+	const value = normalizeWireResult(schema, raw);
+	validateValue(schema, value, `Invalid result for ${wireMethod}`, ErrorCode.internalError);
+	return value;
+}
+/** Validate at both ends without stripping extra keys or applying schema transforms. */
+function validateValue(schema, value, message, code) {
+	const checked = safeParse(schema, value);
+	if (!checked.success) throw new RpcError(message, code, { issues: checked.error.issues });
+}
+/** Undo the server's undefined → null convention only when the schema rejects null. */
+function normalizeWireResult(schema, raw) {
+	if (raw !== null) return raw;
+	if (safeParse(schema, null).success) return null;
+	if (safeParse(schema, void 0).success) return void 0;
+	return null;
+}
+/** Service-scoped handle returned by `connection.service(id)`. */
+var ServiceHandle = class {
+	_connection;
+	_serviceId;
+	constructor(_connection, _serviceId) {
+		this._connection = _connection;
+		this._serviceId = _serviceId;
+	}
+	getResultClient(iface, opts = {}) {
+		return this._connection.getResultClient(iface, {
+			...opts,
+			serviceId: this._serviceId
+		});
+	}
+	get(iface, opts = {}) {
+		return this._connection.get(iface, {
+			...opts,
+			serviceId: this._serviceId
+		});
+	}
+	register(ifaceOrTarget, handlers, opts = {}) {
+		return this._connection.register(ifaceOrTarget, handlers, {
+			...opts,
+			serviceId: this._serviceId
+		});
+	}
+};
+function notFound(reason, method) {
+	return { error: {
+		code: ErrorCode.methodNotFound,
+		message: `Method not found: ${method}`,
+		data: {
+			reason,
+			method
+		}
+	} };
+}
+//#endregion
+//#region src/transport/messageTransport.ts
+/**
+* Observe every message crossing a transport without changing its buffering or
+* lifecycle behavior.
+*/
+function traceMessageTransport(transport, trace) {
+	return {
+		send(message) {
+			trace("send", message);
+			return transport.send(message);
+		},
+		setListener(listener) {
+			transport.setListener(listener === void 0 ? void 0 : (message) => {
+				trace("receive", message);
+				listener(message);
+			});
+		},
+		dispose() {
+			transport.dispose();
+		}
+	};
+}
+/**
+* Two in-memory transports wired back-to-back. Useful for tests and for
+* same-process bridges.
+*
+* Generic in the per-direction payload type so asymmetric pairs (e.g. one
+* side sends plain `JsonRpcMessage`, the other side sends
+* `JsonRpcMessage & { context: Participant }`) are expressible at the type
+* level. At runtime both halves just hand objects through by reference.
+*/
+var TransportPair = class {
+	a;
+	b;
+	constructor() {
+		const aT = new _InMemoryTransport();
+		const bT = new _InMemoryTransport();
+		aT._peer = bT;
+		bT._peer = aT;
+		this.a = aT;
+		this.b = bT;
+	}
+};
+var _InMemoryTransport = class {
+	_peer;
+	_listener;
+	_buffer = [];
+	_closed = false;
+	send(message) {
+		if (this._closed || this._peer._closed) return;
+		this._peer._deliver(message);
+	}
+	setListener(listener) {
+		this._listener = listener;
+		if (listener) while (this._buffer.length > 0 && this._listener) {
+			const m = this._buffer.shift();
+			this._listener(m);
+		}
+	}
+	dispose() {
+		this._closed = true;
+	}
+	_deliver(m) {
+		if (this._listener) this._listener(m);
+		else this._buffer.push(m);
+	}
+};
+//#endregion
+//#region src/connection/endpointUri.ts
+const TOKEN_PARAM = "token";
+const BROKER_PARAM = "broker";
+const COMMAND_PARAM = "command";
+const ARGV_PARAM = "argv";
+const PROVISION_SLOT_PARAM = "provisionSlot";
+const ENV_PARAM = "env";
+const CWD_PARAM = "cwd";
+function _tryParseUrl(uri) {
+	try {
+		return new URL(uri);
+	} catch {
+		return;
+	}
+}
+function _looksLikeWsUrl(uri) {
+	return /^wss?:\/\//i.test(uri);
+}
+/** True for a Windows named-pipe path (`\\.\pipe\…` or `\\?\pipe\…`). */
+function _isWindowsPipePath(path) {
+	return /^\\\\[.?]\\pipe\\/i.test(path);
+}
+function _parseCommand(url) {
+	const argv = url.searchParams.getAll(ARGV_PARAM);
+	if (argv.length > 0) return { argv };
+	const command = url.searchParams.get(COMMAND_PARAM);
+	if (command !== null) return { command };
+	throw new Error(`endpoint '${url.protocol}' requires a '${COMMAND_PARAM}' or '${ARGV_PARAM}' query parameter`);
+}
+/** Parse repeated `env=KEY=VALUE` params into a record (first `=` splits). */
+function _parseEnv(url) {
+	const entries = url.searchParams.getAll(ENV_PARAM);
+	if (entries.length === 0) return;
+	const env = {};
+	for (const entry of entries) {
+		const eq = entry.indexOf("=");
+		if (eq === -1) throw new Error(`endpoint '${ENV_PARAM}' param must be 'KEY=VALUE', got '${entry}'`);
+		env[entry.slice(0, eq)] = entry.slice(eq + 1);
+	}
+	return env;
+}
+/**
+* Parse a strict endpoint URI into an {@link ResolvedEndpoint}. Throws on an
+* unknown scheme or a malformed command endpoint. A bare (scheme-less) string
+* is auto-detected as `ws`/`wss` URL or a socket path.
+*/
+function parseEndpointUri(uri) {
+	const trimmed = uri.trim();
+	if (trimmed === "") throw new Error("endpoint URI is empty");
+	const url = _tryParseUrl(trimmed);
+	if (!url) {
+		if (_looksLikeWsUrl(trimmed)) return {
+			kind: "ws",
+			url: trimmed
+		};
+		return {
+			kind: "socket",
+			path: trimmed
+		};
+	}
+	switch (url.protocol) {
+		case "ws:":
+		case "wss:": {
+			const token = url.searchParams.get(TOKEN_PARAM) ?? void 0;
+			url.searchParams.delete(TOKEN_PARAM);
+			const cleanUrl = url.toString();
+			return token !== void 0 ? {
+				kind: "ws",
+				url: cleanUrl,
+				token
+			} : {
+				kind: "ws",
+				url: cleanUrl
+			};
+		}
+		case "ws-no-init:": return {
+			kind: "ws-no-init",
+			url: new URL(trimmed.replace(/^ws-no-init:/i, "ws:")).toString()
+		};
+		case "unix:": {
+			const token = url.searchParams.get(TOKEN_PARAM) ?? void 0;
+			const brokerMode = _parseBrokerMode(url);
+			return {
+				kind: "socket",
+				path: decodeURIComponent(url.pathname),
+				...token !== void 0 ? { token } : {},
+				...brokerMode !== void 0 ? { brokerMode } : {}
+			};
+		}
+		case "npipe:": {
+			const token = url.searchParams.get(TOKEN_PARAM) ?? void 0;
+			const brokerMode = _parseBrokerMode(url);
+			return {
+				kind: "socket",
+				path: `\\\\${url.host === "" ? "." : url.host}${decodeURIComponent(url.pathname).replace(/\//g, "\\")}`,
+				...token !== void 0 ? { token } : {},
+				...brokerMode !== void 0 ? { brokerMode } : {}
+			};
+		}
+		case "cmd-stdio:": {
+			const env = _parseEnv(url);
+			const cwd = url.searchParams.get(CWD_PARAM) ?? void 0;
+			return {
+				kind: "cmd-stdio",
+				command: _parseCommand(url),
+				...env !== void 0 ? { env } : {},
+				...cwd !== void 0 ? { cwd } : {}
+			};
+		}
+		case "cmd:": {
+			const command = _parseCommand(url);
+			const provisionSlot = url.searchParams.get(PROVISION_SLOT_PARAM) ?? void 0;
+			const env = _parseEnv(url);
+			const cwd = url.searchParams.get(CWD_PARAM) ?? void 0;
+			return {
+				kind: "cmd-env",
+				command,
+				...provisionSlot !== void 0 ? { provisionSlot } : {},
+				...env !== void 0 ? { env } : {},
+				...cwd !== void 0 ? { cwd } : {}
+			};
+		}
+		default: throw new Error(`unsupported endpoint scheme '${url.protocol}' (expected unix:, npipe:, ws:, wss:, ws-no-init:, cmd:, or cmd-stdio:)`);
+	}
+}
+const REDACTED = "***";
+function _appendToken(params, token, reveal) {
+	if (token === void 0) return;
+	params.set(TOKEN_PARAM, REDACTED);
+}
+function _parseBrokerMode(url) {
+	const value = url.searchParams.get(BROKER_PARAM);
+	if (value === null) return void 0;
+	if (value === "linkrpc" || value === "raw") return value;
+	throw new Error(`endpoint '${BROKER_PARAM}' param must be 'linkrpc' or 'raw', got '${value}'`);
+}
+function _appendCommand(params, command) {
+	if ("argv" in command) for (const a of command.argv) params.append(ARGV_PARAM, a);
+	else params.set(COMMAND_PARAM, command.command);
+}
+function _appendEnv(params, env) {
+	if (env === void 0) return;
+	for (const [key, value] of Object.entries(env)) params.append(ENV_PARAM, `${key}=${value}`);
+}
+/**
+* Render an {@link ResolvedEndpoint} back to a canonical strict URI. The token is
+* redacted (`***`) unless `revealToken` is set, so the result is paste-safe for
+* logs. Round-trips with {@link parseEndpointUri} when `revealToken` is true.
+*/
+function formatEndpointUri(spec, options) {
+	switch (spec.kind) {
+		case "socket": {
+			const params = new URLSearchParams();
+			_appendToken(params, spec.token);
+			if (spec.brokerMode !== void 0) params.set(BROKER_PARAM, spec.brokerMode);
+			const query = params.toString();
+			const suffix = query === "" ? "" : `?${query}`;
+			if (_isWindowsPipePath(spec.path)) {
+				const m = spec.path.match(/^\\\\([.?])\\(.*)$/);
+				return `npipe://${m ? m[1] : "."}/${(m ? m[2] : spec.path).replace(/\\/g, "/")}${suffix}`;
+			}
+			return `unix:${spec.path}${suffix}`;
+		}
+		case "ws": {
+			const url = new URL(spec.url);
+			_appendToken(url.searchParams, spec.token);
+			return url.toString();
+		}
+		case "ws-no-init": return spec.url.replace(/^ws:/i, "ws-no-init:");
+		case "cmd-stdio": {
+			const params = new URLSearchParams();
+			_appendCommand(params, spec.command);
+			_appendEnv(params, spec.env);
+			if (spec.cwd !== void 0) params.set(CWD_PARAM, spec.cwd);
+			return `cmd-stdio:?${params.toString()}`;
+		}
+		case "cmd-env": {
+			const params = new URLSearchParams();
+			_appendCommand(params, spec.command);
+			if (spec.provisionSlot !== void 0) params.set(PROVISION_SLOT_PARAM, spec.provisionSlot);
+			_appendEnv(params, spec.env);
+			if (spec.cwd !== void 0) params.set(CWD_PARAM, spec.cwd);
+			return `cmd:?${params.toString()}`;
+		}
+	}
+}
+createMergeProxy(globalThis, {});
+function createMergeProxy(baseObj, extObj) {
+	return new Proxy(baseObj, {
+		get(_target, prop, _receiver) {
+			if (prop in extObj) return extObj[prop];
+			else return baseObj[prop];
+		},
+		set(_target, prop, value) {
+			if (prop in extObj) delete extObj[prop];
+			baseObj[prop] = value;
+			return true;
+		},
+		deleteProperty(_target, prop) {
+			let success = false;
+			if (prop in extObj) {
+				delete extObj[prop];
+				success = true;
+			}
+			if (prop in baseObj) {
+				delete baseObj[prop];
+				success = true;
+			}
+			return success;
+		},
+		ownKeys(_target) {
+			const baseKeys = Reflect.ownKeys(baseObj);
+			const extKeys = Reflect.ownKeys(extObj);
+			const extKeysSet = new Set(extKeys);
+			return [...baseKeys.filter((k) => !extKeysSet.has(k)), ...extKeys];
+		},
+		defineProperty(_target, prop, desc) {
+			if (prop in extObj) delete extObj[prop];
+			Reflect.defineProperty(baseObj, prop, desc);
+			return true;
+		},
+		getOwnPropertyDescriptor(_target, prop) {
+			if (prop in extObj) return Reflect.getOwnPropertyDescriptor(extObj, prop);
+			else return Reflect.getOwnPropertyDescriptor(baseObj, prop);
+		},
+		has(_target, prop) {
+			return prop in extObj || prop in baseObj;
+		}
+	});
+}
+//#endregion
+//#region src/identity/identity.interfaces.ts
+const zB64 = string();
+/**
+* Per-participant key oracle. Reached on the participant's root overlay
+* (form-2 method names like `identity::sign`). Private key material lives
+* in the executor; the participant only sees the operations.
+*
+* Wire shape:
+*   sign / wrap / unwrap all take and return base64url-encoded bytes.
+*   `domain` is a caller-chosen string bound into HPKE info and the AEAD
+*   AAD. `unwrap` succeeds only when invoked with the exact `domain` that
+*   `wrap` was called with. Use a stable, namespaced string (e.g.
+*   `secrets.vault.master-key.v1`).
+*/
+defineInterface({
+	id: "identity",
+	description: "Per-participant key oracle: exposes signing and HPKE-based wrap/unwrap for the identity the executor has attached to this participant's root overlay. Private keys never leave the executor."
+}, {
+	getPrincipal: requestType(object({}), object({ principal: string() })),
+	getWrapPublicKey: requestType(object({}), object({ wrapPublicKey: zB64 })),
+	sign: requestType(object({ bytes: zB64 }), object({ signature: zB64 })),
+	wrap: requestType(object({
+		domain: string(),
+		bytes: zB64
+	}), object({ blob: zB64 })),
+	unwrap: requestType(object({
+		domain: string(),
+		blob: zB64
+	}), object({ bytes: zB64 }))
+});
+/**
+* Per-identity persistent key/value store. Reached on the participant's
+* root overlay as `identity.storage::get` etc. — same overlay that serves
+* `identity::*`, same single-participant addressability.
+*
+* Storage scope is the executor's managed-identity slot (e.g.
+* `service:demo`). Lifecycle is bound to the identity: when the executor
+* deletes the identity for a slot, the storage for that slot is wiped in
+* the same operation. New identity issued for the same slot starts empty.
+*
+* The executor encrypts the backing file at rest with the same secret it
+* uses for identity files — see {@link IdentityKeystore} in
+* `@hediet/linkrpc/node`.
+*
+* Keys must match `^[A-Za-z0-9._/-]{1,256}$`. `/` is conventional for
+* namespacing (`caps.v1`, `prefs/foo`) and `list({ prefix })` honours
+* that. Values are arbitrary JSON.
+*/
+defineInterface({
+	id: "identity.storage",
+	description: "Per-identity persistent key/value store. Scope is the executor's managed-identity slot; lifecycle is tied to the identity itself. Backed by an at-rest-encrypted file in the executor."
+}, {
+	get: requestType(object({ key: string() }), object({ value: optional(unknown()) })),
+	set: requestType(object({
+		key: string(),
+		value: unknown()
+	}), object({})),
+	delete: requestType(object({ key: string() }), object({ existed: boolean() })),
+	list: requestType(object({ prefix: optional(string()) }), object({ keys: array(string()) }))
+});
+
+export { HUBRPC_UNSIGNED_KEY as At, formatEndpointUri as B, stripLinkRpcWireMeta as Dt, TransportPair as G, parseEndpointUri as H, HUBRPC_META_KEY as Ot, directoryInterface as St, zServiceIdPattern as Tt, parseMethodName as Vt, NonCompliantServerError as Xt, JsonRpcChannel as at, LinkRpcConnection as et, serviceIdMatchesScopes as gt, serviceIdMatchesPattern as ht, isInterfaceTarget as it, HUBRPC_SIGNATURE_KEY as kt, defaultInterfaceTarget as nt, Channel as ot, traceMessageTransport as q, RpcError as st, ServiceHandle as tt, schemasInterface as wt, defaultsInterface as xt };
+//# sourceMappingURL=src-DYVSK_tz.js.map