@vscode/component-explorer-cli 0.2.1-18 → 0.2.1-181

package/dist/external/linkrpc/typescript/packages/linkrpc/dist/chunks/inspectionHost-BA6ZmC_P.js

@@ -0,0 +1,2523 @@
+import { void as _void, object, optional, unknown, string, enum as _enum, union, number, array, int, nonnegative, strictObject, literal, record, boolean } from 'zod/mini';
+import { toJSONSchema, safeParse } from 'zod/v4/core';
+import 'zod';
+
+/*---------------------------------------------------------------------------------------------
+*  Copyright (c) Microsoft Corporation. All rights reserved.
+*  Licensed under the MIT License. See License.txt in the project root for license information.
+*--------------------------------------------------------------------------------------------*/
+//#region src/schema/normalize.ts
+/**
+* Keys that describe structural shape and are part of the decidable subset.
+* Everything else gets stripped during normalization.
+*
+* Note: `not` is intentionally NOT in this list. The special case `{"not":{}}`
+* (i.e. matches-nothing) is mapped to the literal `false` bottom; any other
+* `not` is dropped.
+*/
+const KEPT_KEYS = /* @__PURE__ */ new Set([
+	"type",
+	"format",
+	"properties",
+	"required",
+	"additionalProperties",
+	"items",
+	"prefixItems",
+	"const",
+	"enum",
+	"anyOf",
+	"oneOf",
+	"discriminator",
+	"$ref",
+	"title",
+	"description"
+]);
+/**
+* Normalize raw JSON Schema output (e.g. from `z.toJSONSchema`) into the
+* SvcJsonSchema subset:
+*
+*  - drop annotation keys (`examples`, `default`, `$comment`, `readOnly`, ...)
+*  - drop out-of-subset refinements (`pattern`, `minimum`, `multipleOf`,
+*    `allOf`, `oneOf`, `if/then/else`, `patternProperties`, ...)
+*  - empty schema `{}` ⇒ `true` (top)
+*  - `{"not":{}}` ⇒ `false` (bottom); any other `not` is stripped
+*  - `type:"object"` without `additionalProperties` ⇒ closed (`false`),
+*    matching linkrpc's stricter contract
+*  - producer `type` arrays ⇒ `anyOf` branches, preserving their order
+*
+* The output is canonical: structurally equal inputs produce structurally
+* equal outputs, which is what `computeInterfaceHash` relies on.
+*/
+function normalizeJsonSchema(raw) {
+	if (raw === true || raw === false) return raw;
+	if (raw === null || typeof raw !== "object") throw new Error(`normalizeJsonSchema: expected object, got ${typeof raw}`);
+	if (Array.isArray(raw)) throw new Error("normalizeJsonSchema: expected object, got array");
+	const r = raw;
+	if ("not" in r && isEmptyObject(r["not"])) return false;
+	if (Array.isArray(r["type"])) {
+		const types = r["type"];
+		if (types.length === 0 || new Set(types).size !== types.length || types.some((type) => ![
+			"null",
+			"boolean",
+			"number",
+			"integer",
+			"string",
+			"array",
+			"object"
+		].includes(type))) throw new Error("normalizeJsonSchema: type array must contain distinct JSON Schema type names");
+		const { title, description, ...branch } = r;
+		return normalizeJsonSchema({
+			title,
+			description,
+			anyOf: types.map((type) => {
+				const schema = {
+					...branch,
+					type
+				};
+				if (type !== "object") {
+					delete schema.properties;
+					delete schema.required;
+					delete schema.additionalProperties;
+				}
+				if (type !== "array") {
+					delete schema.items;
+					delete schema.prefixItems;
+				}
+				if (type !== "string" && type !== "number" && type !== "integer") delete schema.format;
+				return schema;
+			})
+		});
+	}
+	const out = {};
+	for (const [k, v] of Object.entries(r)) {
+		if (!KEPT_KEYS.has(k)) continue;
+		const normalized = normalizeChild(k, v);
+		if (normalized === void 0) continue;
+		out[k] = normalized;
+	}
+	if (out["type"] === "object" && !("additionalProperties" in out)) out["additionalProperties"] = false;
+	if (Array.isArray(out["oneOf"]) && !("discriminator" in out)) {
+		const detected = _detectDiscriminator(out["oneOf"]);
+		if (detected !== void 0) out["discriminator"] = detected;
+	}
+	if ("discriminator" in out && !Array.isArray(out["oneOf"])) delete out["discriminator"];
+	if (Object.keys(out).length === 0) return true;
+	return out;
+}
+function normalizeChild(key, v) {
+	switch (key) {
+		case "properties": {
+			if (!isPlainObject(v)) return {};
+			const out = {};
+			for (const [pk, pv] of Object.entries(v)) out[pk] = normalizeJsonSchema(pv);
+			return out;
+		}
+		case "items":
+		case "additionalProperties":
+			if (v === false) return false;
+			return normalizeJsonSchema(v);
+		case "prefixItems":
+		case "anyOf":
+		case "oneOf":
+			if (!Array.isArray(v)) return [];
+			return v.map((s) => normalizeJsonSchema(s));
+		case "discriminator": {
+			if (!isPlainObject(v)) return void 0;
+			const name = v["propertyName"];
+			if (typeof name !== "string" || name.length === 0) return void 0;
+			return { propertyName: name };
+		}
+		case "enum":
+			if (!Array.isArray(v)) return [];
+			return v.slice();
+		case "required":
+			if (!Array.isArray(v)) return [];
+			return v.slice().sort();
+		default: return v;
+	}
+}
+function isEmptyObject(v) {
+	return isPlainObject(v) && Object.keys(v).length === 0;
+}
+function isPlainObject(v) {
+	return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+/**
+* Inspect a `oneOf` branch list and return a `discriminator` hint when
+* every branch is an object schema and there is exactly one property name
+* that appears in every branch with a distinct `const`-valued schema.
+*
+* This is the canonical JSON-Schema-only encoding of a tagged union, and
+* the shape `z.toJSONSchema(z.discriminatedUnion(...))` emits.
+*/
+function _detectDiscriminator(branches) {
+	if (branches.length < 2) return void 0;
+	const branchPropsList = [];
+	for (const b of branches) {
+		if (b === true || b === false) return void 0;
+		if (b.type !== "object") return void 0;
+		const props = b.properties;
+		if (!props) return void 0;
+		branchPropsList.push(props);
+	}
+	let candidates = _constPropNames(branchPropsList[0]);
+	for (let i = 1; i < branchPropsList.length; i++) {
+		candidates = candidates.filter((n) => _constPropNames(branchPropsList[i]).includes(n));
+		if (candidates.length === 0) return void 0;
+	}
+	for (const name of candidates) {
+		const seen = /* @__PURE__ */ new Set();
+		let allDistinct = true;
+		for (const props of branchPropsList) {
+			const s = props[name];
+			const key = JSON.stringify(s.const);
+			if (seen.has(key)) {
+				allDistinct = false;
+				break;
+			}
+			seen.add(key);
+		}
+		if (allDistinct) return { propertyName: name };
+	}
+}
+function _constPropNames(props) {
+	const out = [];
+	for (const [k, v] of Object.entries(props)) {
+		if (v === true || v === false) continue;
+		if ("const" in v) out.push(k);
+	}
+	return out;
+}
+//#endregion
+//#region src/connection/rpcFailure.ts
+const rpcFailureBrand = Symbol("linkrpc.rpcFailure");
+/** A nominal failure wrapper: successful application objects can never collide with it. */
+var RpcFailure = class {
+	error;
+	[rpcFailureBrand] = true;
+	constructor(error) {
+		this.error = error;
+		Object.freeze(this);
+	}
+};
+//#endregion
+//#region src/protocol/jsonRpc.ts
+const ErrorCode = {
+	/** Default code for named LinkRPC application errors. */
+	applicationError: 1,
+	parseError: -32700,
+	invalidRequest: -32600,
+	methodNotFound: -32601,
+	invalidParams: -32602,
+	internalError: -32603,
+	/** Caller is authenticated but lacks a capability covering the call. */
+	permissionRequired: -32401,
+	/** The peer a request was routed to detached before it could respond. */
+	peerDisconnected: -32402,
+	/** The request exceeded the hub's idle timeout with no stream activity. */
+	requestTimeout: -32403,
+	/** The request was cancelled (by the caller, or by the hub on disconnect). */
+	cancelled: -32800
+};
+function isRequest(m) {
+	return typeof m.method === "string" && m.id !== void 0;
+}
+function isNotification(m) {
+	return typeof m.method === "string" && m.id === void 0;
+}
+function isResponse(m) {
+	return typeof m.method !== "string";
+}
+//#endregion
+//#region src/schema/applicationErrorBrand.ts
+const applicationErrorBrand = Symbol("linkrpc.applicationError");
+function brandApplicationError(value) {
+	return Object.freeze(Object.defineProperty(value, applicationErrorBrand, { value: true }));
+}
+//#endregion
+//#region src/schema/schemaSource.ts
+const schemaSources = /* @__PURE__ */ new WeakMap();
+//#endregion
+//#region src/schema/validationIssue.ts
+function jsonPointerSegment(key) {
+	return `/${String(key).replace(/~/g, "~0").replace(/\//g, "~1")}`;
+}
+//#endregion
+//#region src/schema/errorValidation.ts
+const bodySchemas = /* @__PURE__ */ new WeakMap();
+function parseDeclaredErrorBody(descriptor, body) {
+	return parseErrorBody(descriptor.bodySchema ?? errorBodySchema(descriptor), body);
+}
+function errorBodySchema(descriptor) {
+	let schema = bodySchemas.get(descriptor);
+	if (schema === void 0) {
+		const payload = descriptor.dataSchema === void 0 ? {} : { data: descriptor.dataSchema };
+		schema = descriptor.type === void 0 ? strictObject({
+			message: literal(descriptor.message),
+			...payload
+		}) : strictObject({
+			message: string(),
+			data: strictObject({
+				type: literal(descriptor.type),
+				...payload
+			})
+		});
+		bodySchemas.set(descriptor, schema);
+	}
+	return schema;
+}
+function parseErrorBody(schema, body) {
+	const parsed = safeParse(schema, body);
+	if (!parsed.success) return {
+		success: false,
+		issues: validationIssues(parsed.error.issues)
+	};
+	if (typeof parsed.data !== "object" || parsed.data === null || !("message" in parsed.data) || typeof parsed.data.message !== "string") return {
+		success: false,
+		issues: [{
+			path: "/message",
+			message: "Expected a string message"
+		}]
+	};
+	return {
+		success: true,
+		data: {
+			...parsed.data,
+			message: parsed.data.message
+		}
+	};
+}
+function validationIssues(issues, prefix = []) {
+	return issues.flatMap((issue) => {
+		const path = [...prefix, ...issue.path];
+		if (issue.code === "invalid_union") return issue.errors.flatMap((branch) => validationIssues(branch, path));
+		if (issue.code === "unrecognized_keys") return issue.keys.map((key) => ({
+			path: pointer([...path, key]),
+			message: "Unexpected property"
+		}));
+		return [{
+			path: pointer(path),
+			message: issue.message
+		}];
+	});
+}
+function pointer(path) {
+	return path.map(jsonPointerSegment).join("");
+}
+function jsonIssues(value, path = [], ancestors = /* @__PURE__ */ new Set()) {
+	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return [];
+	if (typeof value !== "object" || ancestors.has(value) || !Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) return [{
+		path: pointer(path),
+		message: "Expected a JSON value"
+	}];
+	ancestors.add(value);
+	const issues = (Array.isArray(value) ? Array.from(value.entries()) : Object.entries(value)).flatMap(([key, child]) => jsonIssues(child, [...path, key], ancestors));
+	ancestors.delete(value);
+	return issues;
+}
+/** Runtime nominal check for values produced by an application-error descriptor. */
+function isApplicationErrorValue(value) {
+	return typeof value === "object" && value !== null && value[applicationErrorBrand] === true;
+}
+function assertApplicationErrorCode(code) {
+	assertErrorCode(code);
+	if (code >= -32768 && code <= -32e3 || code === -32800) throw new Error(`Application error code ${code} is reserved by JSON-RPC or LinkRPC.`);
+}
+function assertErrorCode(code) {
+	if (!Number.isInteger(code) || code < -2147483648 || code > 2147483647) throw new Error(`Application error code ${code} must be a signed 32-bit integer.`);
+}
+var RequestType = class RequestType {
+	paramsSchema;
+	resultSchema;
+	errorSchema;
+	docs;
+	clientStreamSchema;
+	serverStreamSchema;
+	applicationErrors;
+	kind = "request";
+	constructor(paramsSchema, resultSchema, errorSchema, docs = {}, clientStreamSchema, serverStreamSchema, applicationErrors = []) {
+		this.paramsSchema = paramsSchema;
+		this.resultSchema = resultSchema;
+		this.errorSchema = errorSchema;
+		this.docs = docs;
+		this.clientStreamSchema = clientStreamSchema;
+		this.serverStreamSchema = serverStreamSchema;
+		this.applicationErrors = applicationErrors;
+		const seen = /* @__PURE__ */ new Set();
+		for (const error of applicationErrors) {
+			if (applicationErrors.some((other) => other !== error && other.code === error.code && (other.bodySchema !== void 0 || error.bodySchema !== void 0))) throw new Error(`Raw error code ${error.code} cannot be shared.`);
+			if (error.bodySchema !== void 0) {
+				assertErrorCode(error.code);
+				const key = `code:${error.code}`;
+				if (seen.has(key)) throw new Error(`Duplicate application error ${key}.`);
+				seen.add(key);
+				continue;
+			}
+			assertApplicationErrorCode(error.code);
+			if (typeof error.message !== "string") throw new Error("Application error message must be a string.");
+			if (error.type !== void 0 && (typeof error.type !== "string" || error.type.length === 0)) throw new Error("Application error type must be a nonempty string.");
+			const key = error.type === void 0 ? `code:${error.code}` : `type:${error.type}`;
+			if (seen.has(key)) throw new Error(`Duplicate application error ${key}.`);
+			seen.add(key);
+		}
+		this.applicationErrors = Object.freeze([...applicationErrors]);
+		this.errors = this.applicationErrors;
+	}
+	/** Declared checked errors, retained as a tuple for generated-contract consumers. */
+	errors;
+	/**
+	* Return a copy of this request type with stream payload schemas
+	* attached. Pass `undefined` for either direction to leave it
+	* closed.
+	* `NoInfer` keeps a contextual MemberMap's `any` stream slots from
+	* widening undeclared directions; only the supplied schemas infer payloads.
+	*/
+	withStream(opts) {
+		return new RequestType(this.paramsSchema, this.resultSchema, this.errorSchema, this.docs, opts.client, opts.server, this.applicationErrors);
+	}
+	/**
+	* Return a copy with an explicit, typed set of checked application errors.
+	* The legacy third `requestType` schema remains accepted for compatibility,
+	* but does not opt a method into checked errors.
+	*/
+	withErrors(errors) {
+		return new RequestType(this.paramsSchema, this.resultSchema, this.errorSchema, this.docs, this.clientStreamSchema, this.serverStreamSchema, errors);
+	}
+};
+var NotificationType = class {
+	paramsSchema;
+	docs;
+	kind = "notification";
+	constructor(paramsSchema, docs = {}) {
+		this.paramsSchema = paramsSchema;
+		this.docs = docs;
+	}
+};
+/**
+* Define a request method.
+*
+* @example
+*   bar: requestType(z.object({ to: z.string() }), z.string(), {
+*     description: "MUST resolve before the next call from the same caller.",
+*   })
+*/
+function requestType(params, result, docsOrError, maybeDocs) {
+	const docs = {};
+	return new RequestType(params, result ?? _void(), _void(), docs);
+}
+/**
+* Define a notification method.
+*
+* @example
+*   foo: notificationType(z.object({ message: z.string() }))
+*/
+function notificationType(params, docs = {}) {
+	return new NotificationType(params, docs);
+}
+/** Convert a zod schema to our restricted SvcJsonSchema subset. */
+function zodToSvcJsonSchema(schema, options) {
+	const source = schemaSources.get(schema);
+	if (source !== void 0) {
+		for (const [name, component] of Object.entries(source.components)) {
+			if (options === void 0) throw new Error("Imported schema references require a component destination");
+			addComponent(options.components, name, normalizeJsonSchema(component));
+		}
+		return normalizeJsonSchema(source.schema);
+	}
+	const type = schema._zod?.def?.type;
+	if (type === "void" || type === "undefined") return true;
+	return normalizeZodJsonSchema(toJSONSchema(schema, { override: (context) => {
+		const name = options?.parameterNames?.get(context.zodSchema);
+		if (name !== void 0) {
+			for (const key of Object.keys(context.jsonSchema)) delete context.jsonSchema[key];
+			context.jsonSchema.$ref = `linkrpc-parameter:${encodeURIComponent(name)}`;
+		} else if (options?.parameterNames !== void 0) {
+			for (const key of [
+				"allOf",
+				"patternProperties",
+				"unevaluatedProperties",
+				"if",
+				"then",
+				"else",
+				"contains"
+			]) if (key in context.jsonSchema) throw new Error(`Unsupported template JSON Schema keyword "${key}"`);
+		}
+	} }), options);
+}
+function normalizeZodJsonSchema(raw, options) {
+	if (!isRecord(raw)) return normalizeJsonSchema(raw);
+	const definitions = isRecord(raw.$defs) ? raw.$defs : {};
+	const localRefs = collectLocalRefs(raw);
+	if (Object.keys(definitions).length === 0 && localRefs.size === 0) return normalizeJsonSchema(raw);
+	if (options === void 0) throw new Error("zodToSvcJsonSchema: local references require a component destination");
+	const componentNamePrefix = `method=${encodeComponentNamePart(options.methodName)}&schema=${encodeComponentNamePart(options.schemaPosition)}`;
+	const definitionComponents = /* @__PURE__ */ new Map();
+	for (const definitionName of Object.keys(definitions)) definitionComponents.set(definitionName, `${componentNamePrefix}&def=${encodeComponentNamePart(definitionName)}`);
+	const rootComponent = localRefs.has("#") ? `${componentNamePrefix}&root` : void 0;
+	const rewrite = (value) => rewriteLocalRefs(value, definitionComponents, rootComponent);
+	for (const [definitionName, definition] of Object.entries(definitions)) {
+		const componentName = definitionComponents.get(definitionName);
+		if (componentName === void 0) throw new Error(`zodToSvcJsonSchema: missing component for "${definitionName}"`);
+		addComponent(options.components, componentName, normalizeJsonSchema(rewrite(definition)));
+	}
+	const root = rewrite(raw);
+	if (rootComponent !== void 0) {
+		addComponent(options.components, rootComponent, normalizeJsonSchema(root));
+		return { $ref: componentRef(rootComponent) };
+	}
+	return normalizeJsonSchema(root);
+}
+function collectLocalRefs(value, refs = /* @__PURE__ */ new Set()) {
+	if (Array.isArray(value)) {
+		for (const child of value) collectLocalRefs(child, refs);
+		return refs;
+	}
+	if (!isRecord(value)) return refs;
+	if (typeof value.$ref === "string" && value.$ref.startsWith("#")) refs.add(value.$ref);
+	for (const child of Object.values(value)) collectLocalRefs(child, refs);
+	return refs;
+}
+function rewriteLocalRefs(value, definitionComponents, rootComponent) {
+	if (Array.isArray(value)) return value.map((child) => rewriteLocalRefs(child, definitionComponents, rootComponent));
+	if (!isRecord(value)) return value;
+	const result = {};
+	for (const [key, child] of Object.entries(value)) {
+		if (key === "$defs") continue;
+		if (key === "$ref" && typeof child === "string") result[key] = rewriteLocalRef(child, definitionComponents, rootComponent);
+		else result[key] = rewriteLocalRefs(child, definitionComponents, rootComponent);
+	}
+	return result;
+}
+function rewriteLocalRef(ref, definitionComponents, rootComponent) {
+	if (ref === "#") {
+		if (rootComponent === void 0) throw new Error("zodToSvcJsonSchema: root reference has no component destination");
+		return componentRef(rootComponent);
+	}
+	if (ref.startsWith("#/$defs/")) {
+		const encodedName = ref.slice(8);
+		const definitionName = [...definitionComponents.keys()].find((name) => encodeJsonPointerSegment(name) === encodedName);
+		const componentName = definitionName === void 0 ? void 0 : definitionComponents.get(definitionName);
+		if (componentName === void 0) throw new Error(`zodToSvcJsonSchema: dangling local reference "${ref}"`);
+		return componentRef(componentName);
+	}
+	if (ref.startsWith("#") && !ref.startsWith("#/components/schemas/")) throw new Error(`zodToSvcJsonSchema: unsupported local reference "${ref}"`);
+	return ref;
+}
+function addComponent(components, name, schema) {
+	if (Object.hasOwn(components, name)) throw new Error(`zodToSvcJsonSchema: duplicate component name "${name}"`);
+	components[name] = schema;
+}
+function componentRef(name) {
+	return `#/components/schemas/${encodeJsonPointerSegment(name)}`;
+}
+function encodeJsonPointerSegment(value) {
+	return value.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+function encodeComponentNamePart(value) {
+	return encodeURIComponent(value).replace(/~/g, "%7E");
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+//#endregion
+//#region src/schema/schemaValidationError.ts
+/** Invalid reflected schema data, as distinct from an unexpected implementation failure. */
+var SchemaValidationError = class extends Error {
+	name = "SchemaValidationError";
+};
+//#endregion
+//#region src/schema/assertSchemaReferences.ts
+const componentPrefix = "#/components/schemas/";
+function componentSchemaRef(name) {
+	return componentPrefix + name.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+function componentSchemaName(ref) {
+	if (!ref.startsWith(componentPrefix)) throw new SchemaValidationError(`Invalid component reference: ${ref}`);
+	const token = ref.slice(21);
+	if (token.includes("/") || /~(?:[^01]|$)/.test(token)) throw new SchemaValidationError(`Invalid component reference token: ${ref}`);
+	return token.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+//#endregion
+//#region src/protocol/jcs.ts
+/**
+* RFC 8785 JSON Canonicalization Scheme (JCS).
+*
+* Used as the byte-deterministic encoding under every linkrpc signature
+* (RPC calls, capabilities, hub-signed previews). Both signer and verifier
+* canonicalize the same value object and obtain byte-identical UTF-8 bytes.
+*
+* Implementation inlined from the `canonicalize` npm package (Apache-2.0,
+* https://github.com/erdtman/canonicalize) so this module stays
+* zero-dependency for browser bundlers that don't resolve transitive
+* npm specifiers (e.g. the in-house app-bundler).
+*/
+/** RFC 8785 canonical JSON string for `value`. */
+function jcsCanonicalize(value) {
+	const out = _canonicalize(value);
+	if (out === void 0) throw new Error("jcsCanonicalize: value is not JSON-representable");
+	return out;
+}
+new TextEncoder();
+function _canonicalize(object, seen = /* @__PURE__ */ new Set()) {
+	if (typeof object === "number" && Number.isNaN(object)) throw new Error("NaN is not allowed");
+	if (typeof object === "number" && !Number.isFinite(object)) throw new Error("Infinity is not allowed");
+	if (object === null || typeof object !== "object") return JSON.stringify(object);
+	const obj = object;
+	if (typeof obj.toJSON === "function") {
+		if (seen.has(obj)) throw new Error("Circular reference detected");
+		seen.add(obj);
+		const result = _canonicalize(obj.toJSON(), seen);
+		seen.delete(obj);
+		return result;
+	}
+	if (seen.has(obj)) throw new Error("Circular reference detected");
+	seen.add(obj);
+	let result;
+	if (Array.isArray(obj)) result = `[${obj.map((cv) => {
+		return _canonicalize(cv === void 0 || typeof cv === "symbol" ? null : cv, seen);
+	}).join(",")}]`;
+	else {
+		const parts = [];
+		for (const key of Object.keys(obj).sort()) {
+			const v = obj[key];
+			if (v === void 0 || typeof v === "symbol") continue;
+			parts.push(`${JSON.stringify(key)}:${_canonicalize(v, seen)}`);
+		}
+		result = `{${parts.join(",")}}`;
+	}
+	seen.delete(obj);
+	return result;
+}
+//#endregion
+//#region src/crypto/sha256.ts
+/**
+* Pure-JS SHA-256 (RFC 6234 / FIPS 180-4). Synchronous, dependency-free,
+* isomorphic. Used internally by linkrpc for content-hashing interface
+* schemas and deriving identity slot names; also surfaced through the
+* `crypto` API as `crypto.sha256`. For signature work we go through the
+* `crypto` module (`./identity/crypto`).
+*
+* Replaces the previous `@noble/hashes/sha2` import so the bundle has
+* no runtime npm dependencies. Trades the well-vetted dep for ~80 lines
+* of straight-line code that has no branching on input contents and is
+* exercised by the existing test vectors plus `sha256.test.ts`.
+*/
+const K = new Uint32Array([
+	1116352408,
+	1899447441,
+	3049323471,
+	3921009573,
+	961987163,
+	1508970993,
+	2453635748,
+	2870763221,
+	3624381080,
+	310598401,
+	607225278,
+	1426881987,
+	1925078388,
+	2162078206,
+	2614888103,
+	3248222580,
+	3835390401,
+	4022224774,
+	264347078,
+	604807628,
+	770255983,
+	1249150122,
+	1555081692,
+	1996064986,
+	2554220882,
+	2821834349,
+	2952996808,
+	3210313671,
+	3336571891,
+	3584528711,
+	113926993,
+	338241895,
+	666307205,
+	773529912,
+	1294757372,
+	1396182291,
+	1695183700,
+	1986661051,
+	2177026350,
+	2456956037,
+	2730485921,
+	2820302411,
+	3259730800,
+	3345764771,
+	3516065817,
+	3600352804,
+	4094571909,
+	275423344,
+	430227734,
+	506948616,
+	659060556,
+	883997877,
+	958139571,
+	1322822218,
+	1537002063,
+	1747873779,
+	1955562222,
+	2024104815,
+	2227730452,
+	2361852424,
+	2428436474,
+	2756734187,
+	3204031479,
+	3329325298
+]);
+function _rotr(x, n) {
+	return x >>> n | x << 32 - n;
+}
+function sha256(data) {
+	const inputLen = data.length;
+	const bitLen = inputLen * 8;
+	const paddedLen = inputLen + 9 + 63 & -64;
+	const padded = new Uint8Array(paddedLen);
+	padded.set(data);
+	padded[inputLen] = 128;
+	const view = new DataView(padded.buffer);
+	view.setUint32(paddedLen - 8, Math.floor(bitLen / 4294967296), false);
+	view.setUint32(paddedLen - 4, bitLen >>> 0, false);
+	const H = new Uint32Array([
+		1779033703,
+		3144134277,
+		1013904242,
+		2773480762,
+		1359893119,
+		2600822924,
+		528734635,
+		1541459225
+	]);
+	const W = /* @__PURE__ */ new Uint32Array(64);
+	for (let block = 0; block < paddedLen; block += 64) {
+		for (let t = 0; t < 16; t++) W[t] = view.getUint32(block + t * 4, false);
+		for (let t = 16; t < 64; t++) {
+			const w15 = W[t - 15];
+			const w2 = W[t - 2];
+			const s0 = _rotr(w15, 7) ^ _rotr(w15, 18) ^ w15 >>> 3;
+			const s1 = _rotr(w2, 17) ^ _rotr(w2, 19) ^ w2 >>> 10;
+			W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
+		}
+		let a = H[0], b = H[1], c = H[2], d = H[3];
+		let e = H[4], f = H[5], g = H[6], h = H[7];
+		for (let t = 0; t < 64; t++) {
+			const S1 = _rotr(e, 6) ^ _rotr(e, 11) ^ _rotr(e, 25);
+			const ch = e & f ^ ~e & g;
+			const temp1 = h + S1 + ch + K[t] + W[t] >>> 0;
+			const temp2 = (_rotr(a, 2) ^ _rotr(a, 13) ^ _rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+			h = g;
+			g = f;
+			f = e;
+			e = d + temp1 >>> 0;
+			d = c;
+			c = b;
+			b = a;
+			a = temp1 + temp2 >>> 0;
+		}
+		H[0] = H[0] + a >>> 0;
+		H[1] = H[1] + b >>> 0;
+		H[2] = H[2] + c >>> 0;
+		H[3] = H[3] + d >>> 0;
+		H[4] = H[4] + e >>> 0;
+		H[5] = H[5] + f >>> 0;
+		H[6] = H[6] + g >>> 0;
+		H[7] = H[7] + h >>> 0;
+	}
+	const out = /* @__PURE__ */ new Uint8Array(32);
+	const outView = new DataView(out.buffer);
+	for (let i = 0; i < 8; i++) outView.setUint32(i * 4, H[i], false);
+	return out;
+}
+//#endregion
+//#region src/schema/hash.ts
+const methodSchemaFields = [
+	"params",
+	"result",
+	"clientStream",
+	"serverStream"
+];
+/**
+* Compute the interface hash: SHA-256 of the canonicalized schema, truncated
+* to 16 hex chars (64 bits of collision budget per id).
+*
+* Canonicalization strips the schema down to its **normative wire-contract
+* projection** before hashing, so a single interface document can carry richer
+* non-normative material (codegen hints, safety expressions, notes) without
+* changing identity:
+*
+*   1. Normalize every JSON-Schema position (`params`, `result`, streams, and
+*      `components.schemas`) onto the decidable linkrpc subset.
+*   2. Strip every `comment` field (non-normative — must not affect identity).
+*      `description` is NORMATIVE and kept in the hash.
+*   3. Strip every **specification-extension** field — any object key whose name
+*      begins with `x-` — at every level of the document (see
+*      {@link EXTENSION_PREFIX}). This is the minimal, explicit "one document,
+*      two views" mechanism: the stored document keeps the rich `x-…`
+*      expressions; identity hashes only the simple contract. It mirrors
+*      OpenRPC/OpenAPI specification extensions (this schema format is a subset
+*      of OpenRPC 1.x). Editing an `x-…` value never changes the hash; changing
+*      a wire field (`params`, `result`, member names, `type`, `required`,
+*      `description`, `annotations`, …) does.
+*   4. Omit the top-level `hash` field itself.
+*   5. RFC 8785 JCS encode (recursive key sort, no whitespace) via {@link jcsCanonicalize}.
+*
+* Because no interface schema uses `x-…` keys today, this preserves every
+* existing hash: stripping a set of keys that are always absent is a no-op.
+*
+* > Reservation. `x-…` is reserved for non-normative extensions at every level.
+* > Member names cannot collide (they are alphanumeric per chapter 01 §2), and
+* > object property names in the JSON Schema subset MUST NOT begin with `x-`.
+*/
+function computeInterfaceHash(schema) {
+	const json = jcsCanonicalize(stripNonNormative(normalizeSchemaPositions(schema), true));
+	const digest = sha256(new TextEncoder().encode(json));
+	return Array.from(digest.subarray(0, 8), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function normalizeSchemaPositions(schema) {
+	const methods = Object.fromEntries(Object.entries(schema.methods).map(([name, method]) => {
+		const normalized = { ...method };
+		for (const field of methodSchemaFields) {
+			const value = normalized[field];
+			if (value !== void 0) normalized[field] = normalizeJsonSchema(value);
+		}
+		if (method.errors !== void 0) normalized.errors = method.errors.map((error) => error.schema !== void 0 ? {
+			...error,
+			schema: normalizeJsonSchema(error.schema)
+		} : {
+			...error,
+			...error.data === void 0 ? {} : { data: normalizeJsonSchema(error.data) }
+		});
+		return [name, normalized];
+	}));
+	const componentSchemas = schema.components?.schemas;
+	const components = componentSchemas === void 0 ? schema.components : {
+		...schema.components,
+		schemas: Object.fromEntries(Object.entries(componentSchemas).map(([name, value]) => [name, normalizeJsonSchema(value)]))
+	};
+	return {
+		...schema,
+		methods,
+		...components === void 0 ? {} : { components }
+	};
+}
+/** True for a key that must not contribute to the interface hash. */
+function isNonNormativeKey(key, isRoot) {
+	return key === "comment" || key.startsWith("x-") || isRoot && (key === "hash" || key === "tags");
+}
+function stripNonNormative(value, isRoot = false) {
+	if (value === null || typeof value !== "object") return value;
+	if (Array.isArray(value)) return value.map((v) => stripNonNormative(v));
+	const out = {};
+	for (const k of Object.keys(value)) {
+		if (isNonNormativeKey(k, isRoot)) continue;
+		const v = value[k];
+		if (v === void 0) continue;
+		out[k] = stripNonNormative(v);
+	}
+	return out;
+}
+//#endregion
+//#region src/schema/interfaceTemplates.ts
+const INTERFACE_TEMPLATES_EXTENSION = "x-interface-templates";
+/** Attach structural metadata to an already lowered schema, without rebuilding a definition. */
+function attachInterfaceTemplates(schema, mapped) {
+	const templates = Object.create(null);
+	const instances = [];
+	for (const [name, instance] of Object.entries(mapped)) {
+		const priorTemplate = templates[instance.template.id];
+		if (priorTemplate !== void 0 && !interfaceTemplatesEqual(priorTemplate, instance.template)) throw new Error(`Conflicting definitions for interface template "${instance.template.id}"`);
+		templates[instance.template.id] = priorTemplate === void 0 ? instance.template : {
+			...priorTemplate,
+			tags: normalizeInterfaceTags([...priorTemplate.tags ?? [], ...instance.template.tags ?? []])
+		};
+		instances.push({
+			...instance.schema,
+			name
+		});
+	}
+	const tags = normalizeInterfaceTags([...schema.tags ?? [], ...instances.flatMap((instance) => templates[instance.template].tags ?? [])]);
+	return {
+		...schema,
+		...schema.tags !== void 0 || tags.length > 0 ? { tags } : {},
+		[INTERFACE_TEMPLATES_EXTENSION]: {
+			templates,
+			instances
+		}
+	};
+}
+/** Stable, deduplicated discovery labels for a schema and its instantiated templates. */
+function getInterfaceTags(schema) {
+	validateInterfaceTemplates(schema);
+	const metadata = schema[INTERFACE_TEMPLATES_EXTENSION];
+	return normalizeInterfaceTags([...schema.tags ?? [], ...(metadata?.instances ?? []).flatMap((instance) => metadata?.templates[instance.template]?.tags ?? [])]);
+}
+function normalizeInterfaceTags(tags) {
+	return [...new Set(tags)].sort();
+}
+function validateInterfaceTemplates(schema) {
+	validateTags(schema.tags, `Interface "${schema.id}"`);
+	const raw = schema[INTERFACE_TEMPLATES_EXTENSION];
+	if (raw === void 0) return;
+	if (!_isRecord(raw) || !_isRecord(raw.templates) || !Array.isArray(raw.instances)) throw new SchemaValidationError(`${INTERFACE_TEMPLATES_EXTENSION} must contain templates and instances`);
+	const templates = raw.templates;
+	for (const [id, template] of Object.entries(templates)) {
+		if (!_isRecord(template) || template.id !== id) throw new SchemaValidationError(`Interface template key "${id}" must match its id`);
+		validateInterfaceTemplate(template);
+	}
+	const occupied = /* @__PURE__ */ new Map();
+	const names = /* @__PURE__ */ new Set();
+	for (const value of raw.instances) {
+		if (!_isRecord(value)) throw new SchemaValidationError("Interface template instance must be an object");
+		if (typeof value.name !== "string") throw new SchemaValidationError("Interface template instance name must be a string");
+		if (typeof value.template !== "string") throw new SchemaValidationError("Interface template reference must be a string");
+		if (value.prefix !== void 0) throw new SchemaValidationError("Interface template instances require explicit member mappings, not prefixes");
+		if (!_isRecord(value.members)) throw new SchemaValidationError("Interface template members must be an object");
+		if (!_isRecord(value.arguments)) throw new SchemaValidationError("Interface template arguments must be an object");
+		const instance = {
+			name: value.name,
+			template: value.template,
+			members: value.members,
+			arguments: value.arguments
+		};
+		_assertSegment(instance.name, "interface template instance name");
+		if (names.has(instance.name)) throw new SchemaValidationError(`Interface template instance name collision at "${instance.name}"`);
+		names.add(instance.name);
+		const template = templates[instance.template];
+		if (!Object.hasOwn(templates, instance.template)) throw new SchemaValidationError(`Interface template instance "${instance.name}" references unknown template "${instance.template}"`);
+		_validateArguments(instance, template);
+		if (instance.members !== void 0) {
+			for (const name of Object.keys(instance.members)) if (!Object.hasOwn(template.methods, name)) throw new SchemaValidationError(`Unknown mapped member "${name}"`);
+			for (const name of Object.keys(template.methods)) {
+				const target = instance.members[name];
+				if (!Object.hasOwn(instance.members, name) || typeof target !== "string") throw new SchemaValidationError(`Missing mapped member "${name}"`);
+			}
+		}
+		_validateInstanceMethods(schema, instance, template, occupied);
+	}
+}
+/**
+* Best-effort reflection selection, not template consumption or RPC validation.
+* Keep a whole document; incompatible explanations and ties retain the first.
+* Malformed optional metadata is unranked, while template-aware consumers still
+* use validateInterfaceTemplates and report its errors normally.
+*/
+function preferRicherInterfaceSchema(existing, candidate) {
+	if (existing.id !== candidate.id || existing.hash !== candidate.hash) return existing;
+	if (computeInterfaceHash(existing) !== existing.hash || computeInterfaceHash(candidate) !== candidate.hash) return existing;
+	validateTags(existing.tags, `Interface "${existing.id}"`);
+	validateTags(candidate.tags, `Interface "${candidate.id}"`);
+	const next = _rankingMetadata(candidate);
+	const prior = _rankingMetadata(existing);
+	if (candidate["x-interface-templates"] !== void 0 && next === void 0) return existing;
+	if (existing["x-interface-templates"] !== void 0 && prior === void 0) return candidate;
+	if (prior !== void 0 && next === void 0) return existing;
+	if (next !== void 0 && prior !== void 0) {
+		for (const [id, template] of Object.entries(prior.templates)) if (!Object.hasOwn(next.templates, id) || !interfaceTemplatesEqual(template, next.templates[id])) return existing;
+		for (const instance of prior.instances) if (!next.instances.some((value) => _jsonEqual(instance, value))) return existing;
+		for (const [key, value] of Object.entries(prior)) if (key !== "templates" && key !== "instances" && !_jsonEqual(value, next[key])) return existing;
+	}
+	const existingTags = getInterfaceTags(existing);
+	const candidateTags = getInterfaceTags(candidate);
+	if (existingTags.some((tag) => !candidateTags.includes(tag))) return existing;
+	return prior === void 0 && next !== void 0 || prior !== void 0 && next !== void 0 && (Object.keys(next.templates).length > Object.keys(prior.templates).length || next.instances.length > prior.instances.length) || candidateTags.length > existingTags.length ? candidate : existing;
+}
+function _rankingMetadata(schema) {
+	if (schema["x-interface-templates"] === void 0) return void 0;
+	try {
+		validateInterfaceTemplates(schema);
+	} catch (error) {
+		if (!(error instanceof SchemaValidationError)) throw error;
+		return;
+	}
+	return schema[INTERFACE_TEMPLATES_EXTENSION];
+}
+function validateInterfaceTemplate(template) {
+	if (!_isRecord(template) || typeof template.id !== "string" || template.id.length === 0) throw new SchemaValidationError("Interface template id must be a non-empty string");
+	if (!Array.isArray(template.parameters) || !_isRecord(template.methods)) throw new SchemaValidationError(`Interface template "${template.id}" must contain parameters and methods`);
+	validateTags(template.tags, `Interface template "${template.id}"`);
+	const parameters = /* @__PURE__ */ new Set();
+	for (const parameter of template.parameters) {
+		if (typeof parameter !== "string" || parameter.length === 0) throw new SchemaValidationError(`Interface template "${template.id}" has an invalid parameter name`);
+		if (parameters.has(parameter)) throw new SchemaValidationError(`Interface template "${template.id}" repeats parameter "${parameter}"`);
+		parameters.add(parameter);
+	}
+	const components = _componentSchemas(template.components);
+	for (const [name, method] of Object.entries(template.methods)) {
+		_assertSegment(name, `member of interface template "${template.id}"`);
+		if (!_isRecord(method) || !Object.hasOwn(method, "params")) throw new SchemaValidationError(`Interface template "${template.id}" member "${name}" has no params`);
+		for (const field of _methodSchemaFields) {
+			const value = method[field];
+			if (field === "params" || value !== void 0) _validateTemplateSchema(value, parameters, components, /* @__PURE__ */ new Set());
+		}
+		if (method.errors !== void 0 && !Array.isArray(method.errors)) throw new SchemaValidationError("Interface template method errors must be an array");
+		for (const error of method.errors ?? []) {
+			if (!_isRecord(error)) throw new SchemaValidationError("Interface template method error must be an object");
+			if (error.schema !== void 0) _validateTemplateSchema(error.schema, parameters, components, /* @__PURE__ */ new Set());
+			if (error.data !== void 0) _validateTemplateSchema(error.data, parameters, components, /* @__PURE__ */ new Set());
+		}
+	}
+	for (const component of Object.values(components)) _validateTemplateSchema(component, parameters, components, /* @__PURE__ */ new Set());
+}
+function _validateTemplateSchema(schema, parameters, components, seen) {
+	if (typeof schema === "boolean") return;
+	if (!_isRecord(schema)) throw new SchemaValidationError("Interface template schema must be an object or boolean");
+	if (seen.has(schema)) return;
+	seen.add(schema);
+	if ("$parameter" in schema) {
+		if (Object.keys(schema).length !== 1 || typeof schema.$parameter !== "string") throw new SchemaValidationError("A schema parameter reference must contain only $parameter");
+		if (!parameters.has(schema.$parameter)) throw new SchemaValidationError(`Unknown schema parameter "${schema.$parameter}"`);
+		return;
+	}
+	if ("$ref" in schema) {
+		if (typeof schema.$ref !== "string") throw new SchemaValidationError("Component reference must be a string");
+		const name = componentSchemaName(schema.$ref);
+		if (!Object.hasOwn(components, name)) throw new SchemaValidationError(`Unknown interface template component "${name}"`);
+	}
+	for (const child of _schemaChildren(schema)) _validateTemplateSchema(child, parameters, components, seen);
+}
+function _validateArguments(instance, template) {
+	const expected = new Set(template.parameters);
+	for (const name of Object.keys(instance.arguments)) if (!expected.has(name)) throw new SchemaValidationError(`Interface template instance "${instance.name}" supplies unknown parameter "${name}"`);
+	for (const name of expected) {
+		const argument = instance.arguments[name];
+		if (!_isRecord(argument) || !Object.hasOwn(argument, "schema")) throw new SchemaValidationError(`Interface template instance "${instance.name}" is missing parameter "${name}"`);
+		const components = _componentSchemas(argument.components);
+		_validateConcreteSchema(argument.schema, components, /* @__PURE__ */ new Set());
+		for (const component of Object.values(components)) _validateConcreteSchema(component, components, /* @__PURE__ */ new Set());
+	}
+}
+function _validateConcreteSchema(schema, components, seen) {
+	if (typeof schema === "boolean") return;
+	if (!_isRecord(schema)) throw new SchemaValidationError("Concrete schema argument must be an object or boolean");
+	if (seen.has(schema)) return;
+	seen.add(schema);
+	if ("$parameter" in schema) throw new SchemaValidationError("Concrete schema arguments cannot contain $parameter");
+	if ("$ref" in schema) {
+		if (typeof schema.$ref !== "string") throw new SchemaValidationError("Component reference must be a string");
+		const name = componentSchemaName(schema.$ref);
+		if (!Object.hasOwn(components, name)) throw new SchemaValidationError(`Unknown schema argument component "${name}"`);
+	}
+	for (const child of _schemaChildren(schema)) _validateConcreteSchema(child, components, seen);
+}
+function _validateInstanceMethods(schema, instance, template, occupied) {
+	const expectedComponents = {};
+	const instantiatedMethods = Object.fromEntries(Object.entries(template.methods).map(([name, method]) => [name, _instantiateMethod(method, template, instance, expectedComponents)]));
+	const actualComponents = schema.components?.schemas ?? {};
+	for (const [name, expected] of Object.entries(instantiatedMethods)) {
+		const flattenedName = interfaceTemplateMemberName(instance, name);
+		_assertSegment(flattenedName, `mapped member of interface template instance "${instance.name}"`);
+		const prior = occupied.get(flattenedName);
+		if (prior !== void 0) throw new SchemaValidationError(`Interface template member collision at "${flattenedName}" between "${prior}" and "${instance.name}"`);
+		occupied.set(flattenedName, instance.name);
+		const actual = schema.methods[flattenedName];
+		if (actual === void 0) throw new SchemaValidationError(`Interface template instance "${instance.name}" is missing mapped member "${flattenedName}"`);
+		if (!_methodsEquivalent(expected, actual, expectedComponents, actualComponents)) throw new SchemaValidationError(`Interface template instance "${instance.name}" member "${flattenedName}" does not match its instantiated template`);
+	}
+}
+function interfaceTemplateMemberName(instance, member) {
+	const mapped = instance.members[member];
+	if (mapped !== void 0) return mapped;
+	throw new Error(`Missing mapped member "${member}"`);
+}
+function _instantiateMethod(method, template, instance, components) {
+	const instantiate = (value) => _instantiateSchema(value, template, instance, components, /* @__PURE__ */ new Map());
+	const result = {
+		...method,
+		params: instantiate(method.params)
+	};
+	for (const field of _methodSchemaFields.slice(1)) {
+		const value = method[field];
+		if (value !== void 0) result[field] = instantiate(value);
+	}
+	if (method.errors !== void 0) result.errors = method.errors.map((error) => error.schema !== void 0 ? {
+		code: error.code,
+		schema: instantiate(error.schema)
+	} : {
+		code: error.code,
+		message: error.message,
+		...error.type === void 0 ? {} : { type: error.type },
+		...error.data === void 0 ? {} : { data: instantiate(error.data) }
+	});
+	return result;
+}
+function _instantiateSchema(schema, template, instance, destination, copied) {
+	if (typeof schema === "boolean") return schema;
+	if ("$parameter" in schema) return _copyArgumentSchema(schema.$parameter, instance, destination, copied);
+	return _rewriteSchema(schema, (name) => {
+		const key = `template:${template.id}:${name}`;
+		if (!Object.hasOwn(destination, key)) {
+			const component = template.components?.schemas?.[name];
+			if (component === void 0) throw new Error(`Unknown interface template component "${name}"`);
+			destination[key] = false;
+			destination[key] = _instantiateSchema(component, template, instance, destination, copied);
+		}
+		return key;
+	}, (child) => _instantiateSchema(child, template, instance, destination, copied));
+}
+function _copyArgumentSchema(parameter, instance, destination, copied) {
+	const argument = instance.arguments[parameter];
+	if (argument === void 0) throw new Error(`Missing schema argument "${parameter}"`);
+	const rewrite = (schema) => _rewriteSchema(schema, (name) => {
+		const sourceKey = `${parameter}:${name}`;
+		const existing = copied.get(sourceKey);
+		if (existing !== void 0) return existing;
+		const target = `argument:${instance.name}:${parameter}:${name}`;
+		copied.set(sourceKey, target);
+		const component = argument.components?.schemas?.[name];
+		if (component === void 0) throw new Error(`Unknown schema argument component "${name}"`);
+		destination[target] = false;
+		destination[target] = rewrite(component);
+		return target;
+	}, (child) => rewrite(child));
+	return rewrite(argument.schema);
+}
+function _rewriteSchema(schema, rewriteRef, rewriteChild) {
+	if (typeof schema === "boolean") return schema;
+	const result = {};
+	for (const [key, value] of Object.entries(schema)) if (key === "$ref" && typeof value === "string") result.$ref = componentSchemaRef(rewriteRef(componentSchemaName(value)));
+	else if (key === "properties" && _isRecord(value)) result.properties = Object.fromEntries(Object.entries(value).map(([name, child]) => [name, rewriteChild(child)]));
+	else if (key === "additionalProperties" || key === "items") result[key] = typeof value === "boolean" ? value : rewriteChild(value);
+	else if (key === "prefixItems" || key === "anyOf" || key === "oneOf") result[key] = value.map(rewriteChild);
+	else result[key] = value;
+	return result;
+}
+function _methodsEquivalent(expected, actual, expectedComponents, actualComponents) {
+	const expectedRest = { ...expected };
+	const actualRest = { ...actual };
+	for (const field of _methodSchemaFields) {
+		const expectedSchema = expected[field];
+		const actualSchema = actual[field];
+		delete expectedRest[field];
+		delete actualRest[field];
+		if (expectedSchema === void 0 || actualSchema === void 0) {
+			if (expectedSchema !== actualSchema) return false;
+		} else if (!_schemasEquivalent(expectedSchema, actualSchema, expectedComponents, actualComponents)) return false;
+	}
+	const expectedErrors = expectedRest.errors;
+	const actualErrors = actualRest.errors;
+	delete expectedRest.errors;
+	delete actualRest.errors;
+	if (!_jsonEqual(expectedRest, actualRest)) return false;
+	if (expectedErrors === void 0 || actualErrors === void 0) return expectedErrors === actualErrors;
+	if (expectedErrors.length !== actualErrors.length) return false;
+	return expectedErrors.every((error, index) => {
+		const candidate = actualErrors[index];
+		if (error.schema !== void 0 || candidate.schema !== void 0) return error.schema !== void 0 && candidate.schema !== void 0 && error.code === candidate.code && _schemasEquivalent(error.schema, candidate.schema, expectedComponents, actualComponents);
+		return error.code === candidate.code && error.type === candidate.type && error.message === candidate.message && (error.data === void 0 || candidate.data === void 0 ? error.data === candidate.data : _schemasEquivalent(error.data, candidate.data, expectedComponents, actualComponents));
+	});
+}
+function interfaceTemplatesEqual(left, right) {
+	const { tags: _leftTags, ...leftStructure } = left;
+	const { tags: _rightTags, ...rightStructure } = right;
+	return _jsonEqual(leftStructure, rightStructure);
+}
+function validateTags(tags, context) {
+	if (tags === void 0) return;
+	if (!Array.isArray(tags) || tags.some((tag) => typeof tag !== "string")) throw new SchemaValidationError(`${context} tags must be an array of strings`);
+}
+function _schemasEquivalent(left, right, leftComponents, rightComponents, seen = /* @__PURE__ */ new WeakMap()) {
+	if (typeof left === "boolean" || typeof right === "boolean") return left === right;
+	let rights = seen.get(left);
+	if (rights?.has(right)) return true;
+	if (rights === void 0) {
+		rights = /* @__PURE__ */ new WeakSet();
+		seen.set(left, rights);
+	}
+	rights.add(right);
+	const leftRef = "$ref" in left ? left.$ref : void 0;
+	const rightRef = "$ref" in right ? right.$ref : void 0;
+	const leftOwn = leftRef === void 0 ? _toRecord(left) : _withoutRef(left);
+	const rightOwn = rightRef === void 0 ? _toRecord(right) : _withoutRef(right);
+	if (leftRef !== void 0 && Object.keys(leftOwn).length === 0) {
+		const resolved = leftComponents[componentSchemaName(leftRef)];
+		return resolved !== void 0 && _schemasEquivalent(resolved, right, leftComponents, rightComponents, seen);
+	}
+	if (rightRef !== void 0 && Object.keys(rightOwn).length === 0) {
+		const resolved = rightComponents[componentSchemaName(rightRef)];
+		return resolved !== void 0 && _schemasEquivalent(left, resolved, leftComponents, rightComponents, seen);
+	}
+	if (!_schemaObjectsEquivalent(leftOwn, rightOwn, leftComponents, rightComponents, seen)) return false;
+	if (leftRef === void 0 || rightRef === void 0) {
+		if (leftRef === rightRef) return true;
+		const ref = leftRef ?? rightRef;
+		const components = leftRef === void 0 ? rightComponents : leftComponents;
+		const resolved = components[componentSchemaName(ref)];
+		if (resolved === void 0) return false;
+		return leftRef === void 0 ? _schemasEquivalent(left, resolved, leftComponents, components, seen) : _schemasEquivalent(resolved, right, components, rightComponents, seen);
+	}
+	const leftResolved = leftComponents[componentSchemaName(leftRef)];
+	const rightResolved = rightComponents[componentSchemaName(rightRef)];
+	return leftResolved !== void 0 && rightResolved !== void 0 && _schemasEquivalent(leftResolved, rightResolved, leftComponents, rightComponents, seen);
+}
+function _schemaObjectsEquivalent(left, right, leftComponents, rightComponents, seen) {
+	const leftKeys = Object.keys(left).sort();
+	if (!_jsonEqual(leftKeys, Object.keys(right).sort())) return false;
+	for (const key of leftKeys) {
+		const l = left[key];
+		const r = right[key];
+		if (key === "properties" && _isRecord(l) && _isRecord(r)) {
+			const names = Object.keys(l).sort();
+			if (!_jsonEqual(names, Object.keys(r).sort())) return false;
+			if (!names.every((name) => _schemasEquivalent(l[name], r[name], leftComponents, rightComponents, seen))) return false;
+		} else if ((key === "items" || key === "additionalProperties") && _isSchema(l) && _isSchema(r)) {
+			if (!_schemasEquivalent(l, r, leftComponents, rightComponents, seen)) return false;
+		} else if ((key === "prefixItems" || key === "anyOf" || key === "oneOf") && Array.isArray(l) && Array.isArray(r)) {
+			if (l.length !== r.length || !l.every((value, index) => _schemasEquivalent(value, r[index], leftComponents, rightComponents, seen))) return false;
+		} else if (!_jsonEqual(l, r)) return false;
+	}
+	return true;
+}
+function _componentSchemas(components) {
+	if (components === void 0) return {};
+	if (!_isRecord(components) || components.schemas !== void 0 && !_isRecord(components.schemas)) throw new SchemaValidationError("Schema components and component schemas must be objects");
+	return components.schemas ?? {};
+}
+function _schemaChildren(schema) {
+	const result = [];
+	if (schema.properties !== void 0) {
+		if (!_isRecord(schema.properties)) throw new SchemaValidationError("Schema properties must be an object");
+		result.push(...Object.values(schema.properties));
+	}
+	for (const key of ["items", "additionalProperties"]) {
+		const child = schema[key];
+		if (child !== void 0) {
+			if (!_isSchema(child)) throw new SchemaValidationError(`Schema ${key} must be an object or boolean`);
+			result.push(child);
+		}
+	}
+	for (const key of [
+		"prefixItems",
+		"anyOf",
+		"oneOf"
+	]) {
+		const children = schema[key];
+		if (children !== void 0) {
+			if (!Array.isArray(children)) throw new SchemaValidationError(`Schema ${key} must be an array`);
+			result.push(...children);
+		}
+	}
+	return result;
+}
+const _methodSchemaFields = [
+	"params",
+	"result",
+	"clientStream",
+	"serverStream"
+];
+const _segmentPattern = /^[A-Za-z0-9!#$%&'()*+,\-;=?@\[\]^_`{|}~]+$/;
+function _assertSegment(value, label) {
+	if (!_segmentPattern.test(value)) throw new SchemaValidationError(`Invalid ${label} "${value}"`);
+}
+function _withoutRef(schema) {
+	const result = _toRecord(schema);
+	delete result.$ref;
+	return result;
+}
+function _toRecord(value) {
+	return Object.fromEntries(Object.entries(value));
+}
+function _isSchema(value) {
+	return typeof value === "boolean" || _isRecord(value);
+}
+function _isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function _jsonEqual(left, right) {
+	if (left === right) return true;
+	if (Array.isArray(left) || Array.isArray(right)) return Array.isArray(left) && Array.isArray(right) && left.length === right.length && left.every((value, index) => _jsonEqual(value, right[index]));
+	if (!_isRecord(left) || !_isRecord(right)) return false;
+	const leftKeys = Object.keys(left).sort();
+	const rightKeys = Object.keys(right).sort();
+	return leftKeys.length === rightKeys.length && leftKeys.every((key, index) => key === rightKeys[index] && _jsonEqual(left[key], right[key]));
+}
+//#endregion
+//#region src/schema/validateInterfaceErrors.ts
+function validateInterfaceErrors(schema) {
+	if (schema === void 0) return;
+	for (const [methodName, method] of Object.entries(schema.methods)) {
+		if (method.result === void 0 && method.errors !== void 0) throw new Error(`Notification "${methodName}" cannot declare application errors.`);
+		const seen = /* @__PURE__ */ new Set();
+		const errors = method.errors ?? [];
+		for (const error of errors) {
+			if (!Number.isInteger(error.code) || error.code < -2147483648 || error.code > 2147483647) throw new Error(`Application error code ${error.code} on "${methodName}" must be a signed 32-bit integer.`);
+			if (errors.some((other) => other !== error && other.code === error.code && (other.schema !== void 0 || error.schema !== void 0))) throw new Error(`Raw error code ${error.code} on "${methodName}" cannot be shared.`);
+			if (error.schema !== void 0) {
+				if ([
+					"message",
+					"type",
+					"data"
+				].some((key) => Object.hasOwn(error, key))) throw new Error(`Raw error ${error.code} on "${methodName}" must contain only code and schema.`);
+			} else {
+				if (typeof error.message !== "string") throw new Error(`Application error message on "${methodName}" must be a string.`);
+				if (error.code >= -32768 && error.code <= -32e3 || error.code === -32800) throw new Error(`Application error code ${error.code} on "${methodName}" is reserved by JSON-RPC or LinkRPC.`);
+				if (error.type !== void 0 && (typeof error.type !== "string" || error.type.length === 0)) throw new Error(`Application error type on "${methodName}" must be a nonempty string.`);
+			}
+			const key = error.type === void 0 ? `code:${error.code}` : `type:${error.type}`;
+			if (seen.has(key)) throw new Error(`Duplicate application error ${key} on "${methodName}".`);
+			seen.add(key);
+		}
+	}
+}
+//#endregion
+//#region src/schema/interfaceTemplateGroup.ts
+/** Local authoring marker. Never serialized into the wire contract. */
+const interfaceTemplateGroup = Symbol.for("@hediet/linkrpc.interfaceTemplateGroup");
+//#endregion
+//#region src/connection/interfaceDefinition.ts
+const interfaceDefinitionState = /* @__PURE__ */ new WeakMap();
+var InterfaceDefinition = class {
+	info;
+	members;
+	/** Typed wire references for capability and access-request construction. */
+	ref;
+	constructor(info, members, opts = {}) {
+		this.info = info;
+		this.members = members;
+		if (opts.frozenSchema !== void 0 && opts.templates !== void 0) throw new Error("Cannot combine frozenSchema with authored templates");
+		const frozenSchema = opts.templates === void 0 ? opts.frozenSchema : attachInterfaceTemplates(buildSchema(info, members, ""), opts.templates);
+		validateInterfaceErrors(frozenSchema);
+		if (frozenSchema !== void 0) validateInterfaceTemplates(frozenSchema);
+		const effectiveTags = frozenSchema === void 0 ? normalizeInterfaceTags(info.tags ?? []) : getInterfaceTags(frozenSchema);
+		if (info.tags !== void 0 || effectiveTags.length > 0) this.info = {
+			...info,
+			tags: effectiveTags
+		};
+		interfaceDefinitionState.set(this, {
+			frozenSchema,
+			schemaCache: void 0,
+			hashCache: void 0,
+			declarationGroups: void 0
+		});
+		this.ref = Object.fromEntries(Object.keys(members).map((member) => [member, {
+			interfaceId: this.info.id,
+			interfaceHash: this.schemaHash,
+			member
+		}]));
+		if (info.hash !== void 0 && this.schemaHash !== info.hash) throw new Error(`Interface hash mismatch for "${info.id}": expected "${info.hash}", got "${this.schemaHash}". The interface's wire contract changed — update the pinned hash to "${this.schemaHash}" after reviewing the change.`);
+	}
+	/** @internal Materialize authored groups using the existing wire call functions verbatim. */
+	nestClient(client) {
+		const groups = interfaceDefinitionState.get(this).declarationGroups;
+		if (groups === void 0) return client;
+		const groupedWireNames = new Set(Object.values(groups).flatMap((group) => Object.values(group)));
+		const result = Object.create(null);
+		for (const [name, call] of Object.entries(client)) if (!groupedWireNames.has(name)) result[name] = call;
+		for (const [name, mapping] of Object.entries(groups)) {
+			const group = Object.create(null);
+			for (const [member, wireName] of Object.entries(mapping)) group[member] = client[wireName];
+			result[name] = group;
+		}
+		return result;
+	}
+	/** Validate grouped implementations atomically, then lower them to wire handlers. */
+	flattenHandlers(handlers) {
+		const groups = interfaceDefinitionState.get(this).declarationGroups;
+		if (groups === void 0) return handlers;
+		const requireObject = (value, where) => {
+			if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`Expected handler group object at "${where}"`);
+			return value;
+		};
+		const implementation = requireObject(handlers, this.info.id);
+		const groupedWireNames = new Set(Object.values(groups).flatMap((group) => Object.values(group)));
+		const flatNames = Object.keys(this.members).filter((name) => !groupedWireNames.has(name));
+		const expected = /* @__PURE__ */ new Set([...Object.keys(groups), ...flatNames]);
+		for (const key of Reflect.ownKeys(implementation)) if (typeof key !== "string" || !expected.has(key)) throw new Error(`Unexpected handler "${String(key)}"; grouped members require grouped handlers`);
+		const result = Object.create(null);
+		const requireHandler = (object, key, where) => {
+			if (!Object.hasOwn(object, key) || typeof object[key] !== "function") throw new Error(`Missing or invalid handler "${where}"`);
+			return object[key];
+		};
+		for (const name of flatNames) result[name] = requireHandler(implementation, name, name);
+		for (const [name, mapping] of Object.entries(groups)) {
+			if (!Object.hasOwn(implementation, name)) throw new Error(`Missing handler group "${name}"`);
+			const group = requireObject(implementation[name], name);
+			for (const member of Reflect.ownKeys(group)) if (typeof member !== "string" || !Object.hasOwn(mapping, member)) throw new Error(`Unexpected handler "${name}.${String(member)}"`);
+			for (const [member, wireName] of Object.entries(mapping)) result[wireName] = requireHandler(group, member, `${name}.${member}`);
+		}
+		return result;
+	}
+	/** Content hash of this interface (see `computeInterfaceHash`). */
+	get schemaHash() {
+		const state = interfaceDefinitionState.get(this);
+		if (state.hashCache === void 0) state.hashCache = computeInterfaceHash(state.frozenSchema ?? buildSchema(this.info, this.members, ""));
+		return state.hashCache;
+	}
+	/** Lower the definition to a wire-format `LinkRpcInterfaceSchema`, hash filled in. */
+	toSchema() {
+		const state = interfaceDefinitionState.get(this);
+		if (state.schemaCache === void 0) state.schemaCache = state.frozenSchema !== void 0 ? {
+			...state.frozenSchema,
+			hash: this.schemaHash,
+			...this.info.tags !== void 0 ? { tags: [...this.info.tags] } : {}
+		} : buildSchema(this.info, this.members, this.schemaHash);
+		return state.schemaCache;
+	}
+};
+function buildSchema(info, members, hash) {
+	const methods = Object.create(null);
+	const components = {};
+	for (const [name, member] of Object.entries(members)) methods[name] = toMethodSchema(name, member, components);
+	const schema = {
+		id: info.id,
+		hash,
+		methods
+	};
+	if (Object.keys(components).length > 0) schema.components = { schemas: components };
+	if (info.description !== void 0) schema.description = info.description;
+	if (info.comment !== void 0) schema.comment = info.comment;
+	if (info.tags !== void 0) schema.tags = [...new Set(info.tags)];
+	return schema;
+}
+function toMethodSchema(name, member, components, convert = (schema, position) => convertMemberSchema(name, position, schema, components)) {
+	const docs = member.docs;
+	if (member.kind === "request") {
+		const m = {
+			params: convert(member.paramsSchema, "params"),
+			result: convert(member.resultSchema, "result")
+		};
+		if (member.clientStreamSchema !== void 0) m.clientStream = convert(member.clientStreamSchema, "clientStream");
+		if (member.serverStreamSchema !== void 0) m.serverStream = convert(member.serverStreamSchema, "serverStream");
+		if (member.applicationErrors.length > 0) m.errors = member.applicationErrors.map((error) => {
+			if (error.bodySchema !== void 0) return {
+				code: error.code,
+				schema: convert(error.bodySchema, `error=${error.code}`)
+			};
+			const result = {
+				code: error.code,
+				message: error.message,
+				...error.type === void 0 ? {} : { type: error.type }
+			};
+			if (error.dataSchema !== void 0) result.data = convert(error.dataSchema, `error=${error.code}`);
+			return result;
+		});
+		if (docs.description !== void 0) m.description = docs.description;
+		if (docs.comment !== void 0) m.comment = docs.comment;
+		if (docs.annotations !== void 0) m.annotations = docs.annotations;
+		return m;
+	}
+	const m = { params: convert(member.paramsSchema, "params") };
+	if (docs.description !== void 0) m.description = docs.description;
+	if (docs.comment !== void 0) m.comment = docs.comment;
+	if (docs.annotations !== void 0) m.annotations = docs.annotations;
+	return m;
+}
+function convertMemberSchema(methodName, position, schema, components) {
+	return zodToSvcJsonSchema(schema, {
+		methodName,
+		schemaPosition: position,
+		components
+	});
+}
+/**
+* Convenient builder for an interface definition. Tracks TypeScript types
+* through `requestType` / `notificationType` so client and server code can
+* derive their shapes from the definition.
+*
+* @example
+*   const myInterface = defineInterface(
+*     { id: "de.hediet.notification-target" },
+*     {
+*       send: requestType(z.object({ to: z.string() }), z.string()),
+*       notify: notificationType(z.object({ message: z.string() })),
+*     },
+*   );
+*/
+function defineInterface(info, declarations, options = {}) {
+	const entries = Object.entries(declarations);
+	const isGroup = (value) => value !== null && typeof value === "object" && interfaceTemplateGroup in value && value[interfaceTemplateGroup] === true;
+	if (!entries.some(([, value]) => isGroup(value))) return new InterfaceDefinition(info, declarations, options);
+	const members = Object.create(null);
+	const groups = Object.create(null);
+	const templates = Object.assign(Object.create(null), options.templates);
+	const groupNames = new Set(entries.filter(([, value]) => isGroup(value)).map(([name]) => name));
+	const addMember = (name, member) => {
+		if (Object.hasOwn(members, name) || groupNames.has(name)) throw new Error(`Interface member collision at "${name}"`);
+		members[name] = member;
+	};
+	for (const [name, declaration] of entries) {
+		if (!isGroup(declaration)) {
+			addMember(name, declaration);
+			continue;
+		}
+		if (Object.hasOwn(templates, name)) throw new Error(`Interface template instance collision at "${name}"`);
+		const mapping = Object.create(null);
+		if (declaration.mapping !== void 0) {
+			for (const member of Object.keys(declaration.mapping)) if (!Object.hasOwn(declaration.members, member)) throw new Error(`Unknown mapped member "${member}"`);
+		}
+		for (const [member, type] of Object.entries(declaration.members)) {
+			if (declaration.mapping !== void 0 && !Object.hasOwn(declaration.mapping, member)) throw new Error(`Missing mapped member "${member}"`);
+			const wireName = declaration.mapping === void 0 ? `${name}$${member}` : declaration.mapping[member];
+			if (typeof wireName !== "string" || wireName.length === 0) throw new Error(`Missing mapped member "${member}"`);
+			addMember(wireName, type);
+			mapping[member] = wireName;
+		}
+		groups[name] = Object.freeze(mapping);
+		templates[name] = {
+			template: declaration.template,
+			schema: {
+				template: declaration.template.id,
+				arguments: declaration.arguments,
+				members: mapping
+			}
+		};
+	}
+	const definition = new InterfaceDefinition(info, members, {
+		...options,
+		templates
+	});
+	interfaceDefinitionState.get(definition).declarationGroups = Object.freeze(groups);
+	return definition;
+}
+//#endregion
+//#region src/crypto/cryptoProvider.ts
+const _b64UrlAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function bytesToBase64Url(bytes) {
+	let out = "";
+	let i = 0;
+	for (; i + 3 <= bytes.length; i += 3) {
+		const n = bytes[i] << 16 | bytes[i + 1] << 8 | bytes[i + 2];
+		out += _b64UrlAlphabet[n >> 18 & 63] + _b64UrlAlphabet[n >> 12 & 63] + _b64UrlAlphabet[n >> 6 & 63] + _b64UrlAlphabet[n & 63];
+	}
+	const rem = bytes.length - i;
+	if (rem === 1) {
+		const n = bytes[i] << 16;
+		out += _b64UrlAlphabet[n >> 18 & 63] + _b64UrlAlphabet[n >> 12 & 63];
+	} else if (rem === 2) {
+		const n = bytes[i] << 16 | bytes[i + 1] << 8;
+		out += _b64UrlAlphabet[n >> 18 & 63] + _b64UrlAlphabet[n >> 12 & 63] + _b64UrlAlphabet[n >> 6 & 63];
+	}
+	return out;
+}
+//#endregion
+//#region src/inspection/inspection.interfaces.ts
+const zTopologyPort = object({
+	portId: string(),
+	label: optional(string())
+});
+const zParticipantDescriptor = object({
+	type: optional(string()),
+	label: optional(string()),
+	processId: optional(number()),
+	processType: optional(string()),
+	nodeStatusServiceId: optional(string()),
+	metadata: optional(record(string(), union([
+		string(),
+		number(),
+		boolean()
+	])))
+});
+const zParticipantDescriptorSource = object({
+	source: _enum(["self", "attacher"]),
+	descriptor: zParticipantDescriptor
+});
+const zTopologyNode = object({
+	nodeId: string(),
+	kind: optional(_enum(["endpoint", "hub"])),
+	label: optional(string()),
+	descriptors: optional(array(zParticipantDescriptorSource)),
+	ports: array(zTopologyPort)
+});
+const zTopologyLinkEndpoint = object({
+	nodeId: string(),
+	portId: string()
+});
+const zTopologyTransportEndpoint = object({
+	address: optional(string()),
+	port: optional(number().check(int(), nonnegative()))
+});
+/**
+* Transport details as observed at a topology link. `local` corresponds to the
+* link's `from` endpoint and `remote` to its `to` endpoint.
+*/
+const zTopologyTransportInfo = object({
+	type: string(),
+	local: optional(zTopologyTransportEndpoint),
+	remote: optional(zTopologyTransportEndpoint),
+	path: optional(string()),
+	metadata: optional(record(string(), union([
+		string(),
+		number(),
+		boolean()
+	])))
+});
+const zTopologyLink = object({
+	from: zTopologyLinkEndpoint,
+	to: zTopologyLinkEndpoint,
+	label: optional(string()),
+	peerState: optional(_enum([
+		"identified",
+		"pending",
+		"unsupported",
+		"error"
+	])),
+	transport: optional(zTopologyTransportInfo)
+});
+const zRouteClaim = object({
+	serviceId: string(),
+	nodeId: string(),
+	portId: string(),
+	match: _enum(["exact", "prefix"])
+});
+const zTopologyGraph = object({
+	observerServiceId: string(),
+	entryNodeId: string(),
+	nodes: array(zTopologyNode),
+	links: array(zTopologyLink),
+	routes: array(zRouteClaim)
+});
+const topologyInterface = defineInterface({
+	id: "hubrpc.topology",
+	description: "Inspect the transport graph visible from a service. A watch emits invalidation ticks; consumers re-fetch getGraph after each tick."
+}, {
+	getGraph: requestType(object({}), zTopologyGraph).withStream({ client: object({}) }),
+	watchGraph: requestType(object({}), object({})).withStream({ server: object({}) })
+});
+const zTrafficTransitEndpoint = object({
+	edgeId: string(),
+	portId: string(),
+	requestId: optional(union([number(), string()]))
+});
+const zTrafficTransitEvent = object({
+	type: literal("transit"),
+	timeMs: number(),
+	nodeId: string(),
+	in: optional(zTrafficTransitEndpoint),
+	out: optional(zTrafficTransitEndpoint),
+	disposition: _enum([
+		"forwarded",
+		"consumed",
+		"dropped",
+		"unroutable"
+	]),
+	kind: _enum([
+		"request",
+		"notification",
+		"response",
+		"stream"
+	]),
+	method: optional(string()),
+	params: optional(unknown()),
+	result: optional(unknown()),
+	error: optional(object({
+		code: number(),
+		message: string(),
+		data: optional(unknown())
+	}))
+});
+const zTrafficOverflowEvent = object({
+	type: literal("overflow"),
+	dropped: number().check(int(), nonnegative())
+});
+const zTrafficEvent = union([zTrafficTransitEvent, zTrafficOverflowEvent]);
+const zTrafficWatchResult = object({
+	delivered: number().check(int(), nonnegative()),
+	dropped: number().check(int(), nonnegative())
+});
+const zTrafficWatchParams = object({
+	methodPrefix: optional(string()),
+	trafficIgnoreKey: optional(string()),
+	focusRequest: optional(object({
+		portId: string(),
+		requestId: union([number(), string()])
+	}))
+});
+const zTrafficWatchWithPayloadsParams = object({
+	methodPrefix: optional(string()),
+	trafficIgnoreKey: optional(string()),
+	focusRequest: optional(object({
+		portId: string(),
+		requestId: union([number(), string()])
+	})),
+	maxPayloadBytes: number().check(int(), nonnegative())
+});
+/**
+* Observe raw message transits at the node hosting the addressed service.
+* Consumers may correlate adjacent transits by shared `(portId, requestId)`.
+*/
+const trafficInterface = defineInterface({
+	id: "hubrpc.traffic",
+	description: "Stream raw message transits for the entire node hosting the addressed service. Payload-free and explicitly payload-bearing variants keep disclosure opt-in."
+}, {
+	watch: requestType(zTrafficWatchParams, zTrafficWatchResult).withStream({ server: zTrafficEvent }),
+	watchWithPayloads: requestType(zTrafficWatchWithPayloadsParams, zTrafficWatchResult).withStream({ server: zTrafficEvent })
+});
+//#endregion
+//#region src/inspection/node.interfaces.ts
+const zNodeInfo = object({
+	/**
+	* Random identity of this connection's node. It is a topology-correlation
+	* label only and must not be used for authentication or authorization.
+	*/
+	nodeId: string(),
+	/** Random identity of this connection's port on its node. */
+	portId: string(),
+	/** Optional diagnostic descriptors; never used for authorization. */
+	descriptors: optional(array(zParticipantDescriptorSource))
+});
+/**
+* Minimal root service for aligning the independently observed topologies at
+* both ends of a connection.
+*/
+const nodeInterface = defineInterface({
+	id: "hubrpc.node",
+	description: "Topology bootstrap: identify the node and port at this end of the direct connection."
+}, { getNodeId: requestType(object({}), zNodeInfo) });
+//#endregion
+//#region src/connection/streaming.ts
+/**
+* Direction a {@link STREAM_METHOD} message travels, relative to the
+* request it is correlated with. Made explicit on the wire so that a
+* middlebox (the hub) can *author* a stream message — e.g. inject a
+* cancel when a caller disconnects — without an inbound message whose
+* arrival link it could infer the direction from.
+*/
+const StreamDir = {
+	/** callee → caller: progress, partial results. Routes like a response. */
+	toCaller: "toCaller",
+	/** caller → callee: input, cancellation, keepalive ping. */
+	toCallee: "toCallee"
+};
+/**
+* Reserved control verbs. A control message carries no app `payload`; it
+* is interpreted by the runtime / hub itself, independently of the
+* originating method's stream schemas, so *any* request is cancellable
+* and keep-alive-able even when it declares no app stream.
+*/
+const StreamControlType = {
+	/**
+	* Ask the callee to abort the in-flight request. Always {@link
+	* StreamDir.toCallee}. The callee surfaces this as an `AbortSignal`
+	* and is expected to settle the request (typically with a
+	* `cancelled` error response).
+	*/
+	cancel: "cancel",
+	/**
+	* Keepalive / liveness probe. Resets the hub's per-request idle timer
+	* so a long-running call is not reaped, and lets either side actively
+	* probe the peer. Carries a `nonce` the peer echoes in its {@link
+	* StreamControlType.pong}. May travel in either direction. Emitted
+	* automatically (without awaiting a pong) by the channel for streaming
+	* calls; see {@link STREAM_METHOD}.
+	*/
+	ping: "ping",
+	/**
+	* Reply to a {@link StreamControlType.ping}, echoing the ping's
+	* `nonce` so the prober can correlate it. Travels opposite the ping.
+	* Carries no app effect — purely a liveness acknowledgement.
+	*/
+	pong: "pong"
+};
+/**
+* Streaming sub-protocol. Long-running requests can emit additional
+* notifications correlated with the original call in either direction
+* (callee → caller progress, caller → callee input / cancellation /
+* keepalive).
+*
+* Wire form: a JSON-RPC notification whose method is
+* `${streamInterface.info.id}::send` and whose params match
+* `streamInterface.members.send.paramsSchema`. The hub routes purely on
+* `requestId` (following the originating request's established path, like
+* a response); the originating request's capability authorization covers
+* its full stream lifetime, so stream notifications carry no method /
+* interface namespace of their own. App `payload` contents are typed per
+* request via the originating method's
+* `RequestType.clientStreamSchema` / `serverStreamSchema`; reserved
+* `control` messages are schema-independent.
+*
+* Idle timeout: a request that never streams (no `control` ping, no
+* stream message) is subject to the hub's per-request idle timeout
+* (default 30 minutes) — at which point it is cancelled and its caller
+* gets a `requestTimeout` error. This bounds the hub's pending-request
+* table, which is also what protects it from a slow-loris / DDoS that
+* opens requests and never completes them. Streaming-enabled calls keep
+* themselves alive by emitting a periodic {@link StreamControlType.ping}.
+*
+* The interface is declarative: nobody calls
+* `LinkRpcConnection.register(streamInterface, ...)`. The channel and the
+* hub intercept `$stream::send` directly. The definition exists so
+* reflection / consent UIs can describe the wire shape and so all wire
+* constants derive from one source.
+*/
+const streamInterface = defineInterface({
+	id: "$stream",
+	description: "Reserved sub-protocol for in-flight stream messages correlated to a request by `requestId`."
+}, { send: notificationType(object({
+	/**
+	* Id of the in-flight request the message belongs to.
+	* The hub rewrites this across the forwarding boundary
+	* in the same way it rewrites response ids.
+	*/
+	requestId: union([number(), string()]),
+	/**
+	* Which way this message travels relative to the request.
+	* Explicit so the hub can author messages (e.g. cancel on
+	* disconnect) without inferring direction from arrival.
+	*/
+	dir: _enum(["toCaller", "toCallee"]),
+	/**
+	* Reserved control verb (cancel / ping / pong). Mutually
+	* exclusive with `payload` in practice: a control message
+	* is interpreted by the runtime, not the application.
+	*/
+	control: optional(object({
+		type: _enum([
+			"cancel",
+			"ping",
+			"pong"
+		]),
+		/** Open-set human/diagnostic reason; see {@link StreamControlReason}. */
+		reason: optional(string()),
+		/**
+		* Correlation token. A `ping` carries a fresh nonce;
+		* the matching `pong` echoes it back so the prober
+		* can resolve the right outstanding probe.
+		*/
+		nonce: optional(string())
+	})),
+	/** Opaque app payload — typed per call by the request's stream schema. */
+	payload: optional(unknown())
+}), { description: "Emit a stream message tied to the request `requestId`." }) });
+/**
+* Full wire method name for stream notifications. Pulled from the
+* interface object so we have a single source of truth.
+*/
+const STREAM_METHOD = `${streamInterface.info.id}::send`;
+//#endregion
+//#region src/inspection/trafficFlowFilter.ts
+var TrafficFlowFilter = class {
+	_focused;
+	constructor(options) {
+		this._focused = options.focus !== void 0 ? new CorrelatedFlow([options.focus]) : void 0;
+	}
+	shouldInclude(transit) {
+		return this._focused?.accept(transit).matches ?? true;
+	}
+};
+var TrafficWatchFlowTracker = class {
+	_active = /* @__PURE__ */ new Set();
+	_unclaimed = /* @__PURE__ */ new Map();
+	accept(transit) {
+		if (transit.kind === "request" && isTrafficWatchMethod(transit.method)) {
+			const trafficIgnoreKey = readTrafficIgnoreKey(transit.params);
+			let flow = this._findFlow(transit);
+			if (flow === void 0) {
+				flow = new CorrelatedFlow(requestRefsOf(transit), completionRefOf(transit));
+				if (!isTerminal(transit)) this._active.add(flow);
+			} else flow.accept(transit);
+			if (isTerminal(transit)) {
+				this._removeFlow(flow);
+				return true;
+			}
+			if (trafficIgnoreKey !== void 0) this._unclaimed.set(trafficIgnoreKey, flow);
+			return true;
+		}
+		for (const flow of this._active) {
+			const match = flow.accept(transit);
+			if (!match.matches) continue;
+			if (match.completed) this._removeFlow(flow);
+			return true;
+		}
+		return false;
+	}
+	_findFlow(transit) {
+		for (const flow of this._active) if (flow.matches(transit)) return flow;
+	}
+	_removeFlow(flow) {
+		this._active.delete(flow);
+		for (const [key, pending] of this._unclaimed) if (pending === flow) this._unclaimed.delete(key);
+	}
+	claim(trafficIgnoreKey) {
+		return this._unclaimed.delete(trafficIgnoreKey);
+	}
+	clear() {
+		this._active.clear();
+		this._unclaimed.clear();
+	}
+	forgetPort(portId) {
+		for (const flow of this._active) if (flow.hasPort(portId)) this._removeFlow(flow);
+	}
+};
+var CorrelatedFlow = class {
+	_endpoints = /* @__PURE__ */ new Set();
+	_ports = /* @__PURE__ */ new Set();
+	_completionEndpoint;
+	constructor(endpoints, completionEndpoint = endpoints[0]) {
+		for (const endpoint of endpoints) {
+			this._endpoints.add(endpointKey(endpoint));
+			this._ports.add(endpoint.portId);
+		}
+		this._completionEndpoint = completionEndpoint === void 0 ? void 0 : endpointKey(completionEndpoint);
+	}
+	matches(transit) {
+		return requestRefsOf(transit).some((endpoint) => this._endpoints.has(endpointKey(endpoint)));
+	}
+	hasPort(portId) {
+		return this._ports.has(portId);
+	}
+	accept(transit) {
+		const endpoints = requestRefsOf(transit);
+		if (!this.matches(transit)) return {
+			matches: false,
+			completed: false
+		};
+		for (const endpoint of endpoints) {
+			this._endpoints.add(endpointKey(endpoint));
+			this._ports.add(endpoint.portId);
+		}
+		const completed = transit.kind === "response" && (isTerminal(transit) || this._completionEndpoint !== void 0 && endpoints.some((endpoint) => endpointKey(endpoint) === this._completionEndpoint));
+		if (completed) this._endpoints.clear();
+		return {
+			matches: true,
+			completed
+		};
+	}
+};
+function isTerminal(transit) {
+	return transit.disposition === "dropped" || transit.disposition === "unroutable";
+}
+function requestRefsOf(transit) {
+	const result = [];
+	if (transit.in?.requestId !== void 0) result.push(requestRef(transit.in));
+	if (transit.out?.requestId !== void 0) result.push(requestRef(transit.out));
+	return result;
+}
+function requestRef(endpoint) {
+	return {
+		portId: endpoint.portId,
+		requestId: endpoint.requestId
+	};
+}
+function completionRefOf(transit) {
+	if (transit.in?.requestId !== void 0) return requestRef(transit.in);
+	if (transit.out?.requestId !== void 0) return requestRef(transit.out);
+}
+function endpointKey(endpoint) {
+	return JSON.stringify([
+		endpoint.portId,
+		typeof endpoint.requestId,
+		endpoint.requestId
+	]);
+}
+function isTrafficWatchMethod(method) {
+	return method?.endsWith("::hubrpc.traffic::watch") === true || method?.endsWith("::hubrpc.traffic::watchWithPayloads") === true || method === "hubrpc.traffic::watch" || method === "hubrpc.traffic::watchWithPayloads";
+}
+function readTrafficIgnoreKey(params) {
+	if (params === null || Array.isArray(params) || typeof params !== "object" || !("trafficIgnoreKey" in params)) return;
+	const value = params.trafficIgnoreKey;
+	return typeof value === "string" ? value : void 0;
+}
+//#endregion
+//#region src/inspection/boundedTrafficSubscription.ts
+const DEFAULT_QUEUE_LIMIT = 256;
+/**
+* Applies per-subscriber filtering and payload policy while isolating traffic
+* producers from slow or failed stream consumers.
+*/
+var BoundedTrafficSubscription = class {
+	_options;
+	_send;
+	_onDispose;
+	_queueLimit;
+	_queue = [];
+	_active = true;
+	_pumping = false;
+	_overflowPending = 0;
+	_delivered = 0;
+	_dropped = 0;
+	_resolveClosed;
+	_filter;
+	closed;
+	constructor(_options, _send, _onDispose, _queueLimit = DEFAULT_QUEUE_LIMIT) {
+		this._options = _options;
+		this._send = _send;
+		this._onDispose = _onDispose;
+		this._queueLimit = _queueLimit;
+		let resolve;
+		this.closed = new Promise((r) => resolve = r);
+		this._resolveClosed = resolve;
+		this._filter = new TrafficFlowFilter({ focus: _options.focusRequest });
+	}
+	enqueue(transit) {
+		if (!this._active) return;
+		if (!this._filter.shouldInclude(transit)) return;
+		if (this._options.methodPrefix !== void 0 && !transit.method?.startsWith(this._options.methodPrefix)) return;
+		const event = this._options.maxPayloadBytes === void 0 ? withoutPayloads(transit) : withCappedPayloads(transit, this._options.maxPayloadBytes);
+		if (this._queue.length >= this._queueLimit) {
+			this._queue.shift();
+			this._dropped++;
+			this._overflowPending++;
+		}
+		this._queue.push(event);
+		if (!this._pumping) {
+			this._pumping = true;
+			queueMicrotask(() => void this._pump());
+		}
+	}
+	dispose() {
+		if (!this._active) return;
+		this._active = false;
+		this._dropped += this._queue.length;
+		this._queue.length = 0;
+		this._overflowPending = 0;
+		this._onDispose();
+		if (!this._pumping) this._complete();
+	}
+	async _pump() {
+		try {
+			while (this._active) {
+				if (this._overflowPending > 0) {
+					const dropped = this._overflowPending;
+					this._overflowPending = 0;
+					await this._send({
+						type: "overflow",
+						dropped
+					});
+					continue;
+				}
+				const event = this._queue.shift();
+				if (event === void 0) break;
+				await this._send(event);
+				this._delivered++;
+			}
+		} catch {
+			this.dispose();
+		} finally {
+			this._pumping = false;
+			if (!this._active) this._complete();
+			else if (this._queue.length > 0 || this._overflowPending > 0) {
+				this._pumping = true;
+				queueMicrotask(() => void this._pump());
+			}
+		}
+	}
+	_complete() {
+		this._resolveClosed({
+			delivered: this._delivered,
+			dropped: this._dropped
+		});
+	}
+};
+function withoutPayloads(transit) {
+	const { params: _params, result: _result, error, ...rest } = transit;
+	if (error === void 0) return rest;
+	return {
+		...rest,
+		error: {
+			code: error.code,
+			message: error.message
+		}
+	};
+}
+function withCappedPayloads(transit, maxPayloadBytes) {
+	return {
+		...transit,
+		params: capPayload(transit.params, maxPayloadBytes),
+		result: capPayload(transit.result, maxPayloadBytes),
+		error: transit.error === void 0 ? void 0 : {
+			...transit.error,
+			data: capPayload(transit.error.data, maxPayloadBytes)
+		}
+	};
+}
+function capPayload(value, maxBytes) {
+	if (value === void 0) return void 0;
+	if (maxBytes === Number.POSITIVE_INFINITY) return value;
+	const json = JSON.stringify(value);
+	if (json === void 0) return void 0;
+	const encoded = new TextEncoder().encode(json);
+	if (encoded.byteLength <= maxBytes) return value;
+	const encoder = new TextEncoder();
+	let preview = new TextDecoder().decode(encoded.slice(0, maxBytes));
+	while (encoder.encode(preview).byteLength > maxBytes) preview = preview.slice(0, -1);
+	return preview;
+}
+//#endregion
+//#region src/inspection/endpointTrafficInspector.ts
+const REQUEST_CORRELATION_RETENTION_MS = 18e5;
+const MAX_REQUEST_CORRELATIONS = 4096;
+var EndpointTrafficInspector = class {
+	_nodeId;
+	_portId;
+	_emit;
+	_isObserved;
+	_outboundRequests = /* @__PURE__ */ new Map();
+	_inboundRequests = /* @__PURE__ */ new Map();
+	observe = (direction, message) => {
+		this._onMessage(direction, message);
+	};
+	constructor(_nodeId, _portId, _emit, _isObserved) {
+		this._nodeId = _nodeId;
+		this._portId = _portId;
+		this._emit = _emit;
+		this._isObserved = _isObserved;
+	}
+	dispose() {
+		this._outboundRequests.clear();
+		this._inboundRequests.clear();
+	}
+	_onMessage(direction, message) {
+		const now = Date.now();
+		this._pruneRequestCorrelations(now);
+		const publiclyObserved = this._isObserved();
+		if (!publiclyObserved) this.dispose();
+		let transit;
+		const endpoint = this._endpoint("id" in message ? message.id ?? void 0 : void 0);
+		const base = {
+			type: "transit",
+			timeMs: now,
+			nodeId: this._nodeId,
+			...direction === "inbound" ? { in: endpoint } : { out: endpoint },
+			disposition: direction === "inbound" ? "consumed" : "forwarded"
+		};
+		if (isRequest(message)) {
+			const correlation = {
+				method: message.method,
+				timeMs: now
+			};
+			if (publiclyObserved) {
+				const map = this._requestMap(direction);
+				const key = requestKey(message.id);
+				map.delete(key);
+				map.set(key, correlation);
+			}
+			transit = {
+				...base,
+				kind: "request",
+				method: message.method,
+				params: message.params
+			};
+		} else if (isResponse(message)) {
+			const responseMap = direction === "inbound" ? this._outboundRequests : this._inboundRequests;
+			const key = requestKey(message.id);
+			const correlation = responseMap.get(key);
+			responseMap.delete(key);
+			transit = {
+				...base,
+				kind: "response",
+				method: correlation?.method,
+				result: "result" in message ? message.result : void 0,
+				error: "error" in message ? message.error : void 0
+			};
+		} else if (isNotification(message) && message.method === STREAM_METHOD) {
+			const params = message.params;
+			const streamEndpoint = this._endpoint(params?.requestId);
+			transit = {
+				...base,
+				...direction === "inbound" ? { in: streamEndpoint } : { out: streamEndpoint },
+				kind: "stream",
+				method: STREAM_METHOD,
+				params: message.params
+			};
+		} else transit = {
+			...base,
+			kind: "notification",
+			method: message.method,
+			params: message.params
+		};
+		function requestKey(requestId) {
+			return JSON.stringify([typeof requestId, requestId]);
+		}
+		this._emit(transit);
+	}
+	_requestMap(direction) {
+		return direction === "outbound" ? this._outboundRequests : this._inboundRequests;
+	}
+	_endpoint(requestId) {
+		return {
+			edgeId: this._portId,
+			portId: this._portId,
+			...requestId !== void 0 ? { requestId } : {}
+		};
+	}
+	_pruneRequestCorrelations(timeMs) {
+		this._pruneRequestMap(this._outboundRequests, timeMs);
+		this._pruneRequestMap(this._inboundRequests, timeMs);
+	}
+	_pruneRequestMap(map, timeMs) {
+		while (map.size !== 0) {
+			const first = map.entries().next().value;
+			if (first === void 0 || map.size <= MAX_REQUEST_CORRELATIONS && timeMs - first[1].timeMs <= REQUEST_CORRELATION_RETENTION_MS) return;
+			map.delete(first[0]);
+		}
+	}
+};
+//#endregion
+//#region src/inspection/connectionInspectionSource.ts
+var ConnectionInspectionSource = class {
+	_connection;
+	_nodeId;
+	_options;
+	_isObserved;
+	constructor(_connection, _nodeId, _options, _isObserved) {
+		this._connection = _connection;
+		this._nodeId = _nodeId;
+		this._options = _options;
+		this._isObserved = _isObserved;
+	}
+	snapshotTopology() {
+		const { portId, label, peer, transport } = this._options;
+		const nodes = [{
+			nodeId: this._nodeId,
+			ports: [{
+				portId,
+				...label === void 0 ? {} : { label }
+			}]
+		}];
+		const links = [];
+		if (peer !== void 0) {
+			nodes.push({
+				nodeId: peer.nodeId,
+				kind: "endpoint",
+				...peer.label === void 0 ? {} : { label: peer.label },
+				ports: [{ portId: peer.portId }]
+			});
+			links.push({
+				from: {
+					nodeId: this._nodeId,
+					portId
+				},
+				to: {
+					nodeId: peer.nodeId,
+					portId: peer.portId
+				},
+				peerState: "identified",
+				...transport === void 0 ? {} : { transport }
+			});
+		}
+		return {
+			nodes,
+			links,
+			routes: []
+		};
+	}
+	onTopologyChanged(_listener) {
+		return { dispose: () => {} };
+	}
+	observeTraffic(listener) {
+		const inspector = new EndpointTrafficInspector(this._nodeId, this._options.portId, listener, this._isObserved);
+		const observation = this._connection.observeWireMessages(inspector.observe);
+		return { dispose: () => {
+			observation.dispose();
+			inspector.dispose();
+		} };
+	}
+};
+//#endregion
+//#region src/inspection/inspectionHost.ts
+/** A shared inspection scope, independent of both routing and its RPC connections. */
+var InspectionHost = class {
+	_options;
+	_sources = /* @__PURE__ */ new Map();
+	_trackedConnections = /* @__PURE__ */ new Set();
+	_bindings = /* @__PURE__ */ new Set();
+	_subscribers = /* @__PURE__ */ new Set();
+	_observers = /* @__PURE__ */ new Set();
+	_topologyListeners = /* @__PURE__ */ new Set();
+	_trafficSources = /* @__PURE__ */ new Set();
+	_trafficWatches = new TrafficWatchFlowTracker();
+	_disposed = false;
+	nodeId;
+	constructor(_options) {
+		this._options = _options;
+		this.nodeId = _options.nodeId;
+	}
+	get observerCount() {
+		return this._subscribers.size + this._observers.size;
+	}
+	addSource(source) {
+		this._assertActive();
+		if (this._sources.has(source)) throw new Error("Inspection source is already registered");
+		const readPorts = () => new Set(source.snapshotTopology().nodes.flatMap((node) => node.ports.map((port) => port.portId)));
+		let ports = readPorts();
+		const topology = source.onTopologyChanged(() => {
+			const nextPorts = readPorts();
+			const removed = [...ports].filter((port) => !nextPorts.has(port));
+			ports = nextPorts;
+			this._forgetUnusedPorts(removed);
+			this._invalidateTopology();
+		});
+		let traffic;
+		try {
+			traffic = source.observeTraffic((event) => this.publishTransit(event));
+		} catch (error) {
+			topology.dispose();
+			throw error;
+		}
+		const registration = { dispose: () => {
+			if (this._sources.get(source) !== registration) return;
+			this._sources.delete(source);
+			topology.dispose();
+			traffic.dispose();
+			this._forgetUnusedPorts([...ports]);
+			this._invalidateTopology();
+		} };
+		this._sources.set(source, registration);
+		this._invalidateTopology();
+		return registration;
+	}
+	trackConnection(connection, options) {
+		this._assertActive();
+		if (this.getGraph("").nodes.some((node) => node.ports.some((port) => port.portId === options.portId))) throw new Error(`Inspection port "${options.portId}" is already registered`);
+		const source = new ConnectionInspectionSource(connection, this.nodeId, options, () => this.observerCount !== 0);
+		const registration = this.addSource(source);
+		let close;
+		try {
+			close = connection.onDidClose(() => result.dispose());
+		} catch (error) {
+			registration.dispose();
+			throw error;
+		}
+		const result = { dispose: () => {
+			this._trackedConnections.delete(result);
+			close.dispose();
+			registration.dispose();
+		} };
+		this._trackedConnections.add(result);
+		return result;
+	}
+	expose(connection, options) {
+		this._assertActive();
+		const portId = options.portId ?? createPortId();
+		const binding = new InspectionBinding(portId);
+		const registrations = [];
+		this._bindings.add(binding);
+		const registerOptions = { serviceId: options.serviceId };
+		try {
+			const controls = new EndpointTrafficInspector(this.nodeId, portId, (event) => this._trafficWatches.accept(event), () => false);
+			registrations.push(connection.observeWireMessages(controls.observe));
+			registrations.push({ dispose: () => controls.dispose() });
+			registrations.push(connection.registerInspection(nodeInterface, { getNodeId: () => ({
+				nodeId: this.nodeId,
+				portId,
+				...(options.descriptors ?? this._options.descriptors) === void 0 ? {} : { descriptors: [...options.descriptors ?? this._options.descriptors ?? []] }
+			}) }, registerOptions));
+			registrations.push(connection.registerInspection(topologyInterface, {
+				getGraph: () => this.getGraph(options.serviceId, options.includeRoute === false ? void 0 : portId),
+				watchGraph: (_params, _ctx, stream) => this._watchGraph(binding, stream)
+			}, registerOptions));
+			registrations.push(connection.registerInspection(trafficInterface, {
+				watch: (params, _ctx, stream) => this._watchTraffic(binding, params, stream),
+				watchWithPayloads: (params, _ctx, stream) => this._watchTraffic(binding, params, stream)
+			}, registerOptions));
+		} catch (error) {
+			for (const registration of registrations.reverse()) registration.dispose();
+			this._bindings.delete(binding);
+			throw error;
+		}
+		binding.onDispose = () => {
+			this._bindings.delete(binding);
+			for (const registration of registrations.reverse()) registration.dispose();
+			this._forgetUnusedPorts([portId]);
+			this._invalidateTopology();
+		};
+		registrations.push(connection.onDidClose(() => binding.dispose()));
+		this._invalidateTopology();
+		return binding;
+	}
+	getGraph(observerServiceId, routePortId) {
+		this._assertActive();
+		const nodes = /* @__PURE__ */ new Map();
+		const mergeNode = (node) => {
+			const previous = nodes.get(node.nodeId);
+			const ports = new Map(previous?.ports.map((port) => [port.portId, port]));
+			for (const port of node.ports) ports.set(port.portId, {
+				...ports.get(port.portId),
+				...port
+			});
+			nodes.set(node.nodeId, {
+				...previous,
+				...node,
+				ports: [...ports.values()]
+			});
+		};
+		mergeNode({
+			nodeId: this.nodeId,
+			kind: this._options.kind ?? "endpoint",
+			...this._options.label === void 0 ? {} : { label: this._options.label },
+			...this._options.descriptors === void 0 ? {} : { descriptors: [...this._options.descriptors] },
+			ports: []
+		});
+		const links = [];
+		const routes = [];
+		for (const source of this._sources.keys()) {
+			const fragment = source.snapshotTopology();
+			for (const node of fragment.nodes) mergeNode(node);
+			links.push(...fragment.links);
+			routes.push(...fragment.routes);
+		}
+		for (const binding of this._bindings) mergeNode({
+			nodeId: this.nodeId,
+			ports: [{ portId: binding.portId }]
+		});
+		if (routePortId !== void 0) routes.push({
+			serviceId: observerServiceId,
+			nodeId: this.nodeId,
+			portId: routePortId,
+			match: "exact"
+		});
+		return {
+			observerServiceId,
+			entryNodeId: this.nodeId,
+			nodes: [...nodes.values()],
+			links,
+			routes
+		};
+	}
+	publishTransit(event) {
+		if (this._disposed || this._trafficWatches.accept(event)) return;
+		for (const observer of [...this._observers]) try {
+			observer(event);
+		} catch {}
+		for (const subscriber of this._subscribers) subscriber.enqueue(event);
+	}
+	subscribe(options, send) {
+		this._assertActive();
+		if (options.trafficIgnoreKey !== void 0 && !this._trafficWatches.claim(options.trafficIgnoreKey)) throw new Error("Traffic watch request was not observed before subscription");
+		const subscriber = new BoundedTrafficSubscription(options, send, () => {
+			this._subscribers.delete(subscriber);
+			this._stopUnusedTrafficSources();
+		});
+		this._subscribers.add(subscriber);
+		try {
+			this._startTrafficSources();
+		} catch (error) {
+			subscriber.dispose();
+			throw error;
+		}
+		return subscriber;
+	}
+	observeTraffic(observer) {
+		this._assertActive();
+		this._observers.add(observer);
+		const registration = { dispose: () => {
+			this._observers.delete(observer);
+			this._stopUnusedTrafficSources();
+		} };
+		try {
+			this._startTrafficSources();
+		} catch (error) {
+			registration.dispose();
+			throw error;
+		}
+		return registration;
+	}
+	addTrafficSource(source) {
+		this._assertActive();
+		const entry = { source };
+		this._trafficSources.add(entry);
+		try {
+			this._startTrafficSources();
+		} catch (error) {
+			this._trafficSources.delete(entry);
+			throw error;
+		}
+		return { dispose: () => {
+			this._trafficSources.delete(entry);
+			entry.observation?.dispose();
+			entry.observation = void 0;
+		} };
+	}
+	dispose() {
+		if (this._disposed) return;
+		this._disposed = true;
+		for (const binding of [...this._bindings]) binding.dispose();
+		for (const subscriber of [...this._subscribers]) subscriber.dispose();
+		this._observers.clear();
+		this._stopUnusedTrafficSources();
+		this._trafficSources.clear();
+		for (const connection of [...this._trackedConnections]) connection.dispose();
+		for (const source of [...this._sources.values()]) source.dispose();
+		this._topologyListeners.clear();
+		this._trafficWatches.clear();
+	}
+	_startTrafficSources() {
+		if (this.observerCount === 0) return;
+		for (const entry of this._trafficSources) entry.observation ??= entry.source.observe((event) => this.publishTransit(event));
+	}
+	_stopUnusedTrafficSources() {
+		if (this.observerCount !== 0) return;
+		for (const entry of this._trafficSources) {
+			entry.observation?.dispose();
+			entry.observation = void 0;
+		}
+	}
+	_invalidateTopology() {
+		if (this._disposed) return;
+		for (const listener of this._topologyListeners) listener();
+	}
+	_forgetUnusedPorts(portIds) {
+		if (this._disposed) return;
+		const remaining = new Set(this.getGraph("").nodes.flatMap((node) => node.ports.map((port) => port.portId)));
+		for (const portId of portIds) if (!remaining.has(portId)) this._trafficWatches.forgetPort(portId);
+	}
+	_watchGraph(binding, stream) {
+		return new Promise((resolve, reject) => {
+			let pending = false;
+			let active = true;
+			const finish = () => {
+				active = false;
+				this._topologyListeners.delete(invalidate);
+				stream.signal.removeEventListener("abort", finish);
+				binding.abort.signal.removeEventListener("abort", finish);
+				resolve({});
+			};
+			const invalidate = () => {
+				if (pending || !active) return;
+				pending = true;
+				queueMicrotask(() => {
+					pending = false;
+					if (!active) return;
+					stream.send({}).catch((error) => {
+						reject(error);
+						finish();
+					});
+				});
+			};
+			this._topologyListeners.add(invalidate);
+			stream.signal.addEventListener("abort", finish, { once: true });
+			binding.abort.signal.addEventListener("abort", finish, { once: true });
+			if (stream.signal.aborted || binding.abort.signal.aborted) finish();
+		});
+	}
+	async _watchTraffic(binding, options, stream) {
+		const subscription = this.subscribe(options, (event) => stream.send(event));
+		const dispose = () => subscription.dispose();
+		stream.signal.addEventListener("abort", dispose, { once: true });
+		binding.abort.signal.addEventListener("abort", dispose, { once: true });
+		if (stream.signal.aborted || binding.abort.signal.aborted) dispose();
+		try {
+			return await subscription.closed;
+		} finally {
+			stream.signal.removeEventListener("abort", dispose);
+			binding.abort.signal.removeEventListener("abort", dispose);
+			subscription.dispose();
+		}
+	}
+	_assertActive() {
+		if (this._disposed) throw new Error("Inspection host is disposed");
+	}
+};
+var InspectionBinding = class {
+	portId;
+	abort = new AbortController();
+	onDispose = () => {};
+	constructor(portId) {
+		this.portId = portId;
+	}
+	dispose() {
+		if (this.abort.signal.aborted) return;
+		this.abort.abort();
+		this.onDispose();
+	}
+};
+function createPortId() {
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	globalThis.crypto.getRandomValues(bytes);
+	return `port:${bytesToBase64Url(bytes)}`;
+}
+
+export { validateInterfaceTemplate as $, zTopologyTransportInfo as C, isRequest as Ct, zTrafficTransitEvent as D, normalizeJsonSchema as Dt, zTrafficTransitEndpoint as E, interfaceTemplateGroup as H, getInterfaceTags as J, INTERFACE_TEMPLATES_EXTENSION as K, bytesToBase64Url as M, zTrafficWatchResult as O, preferRicherInterfaceSchema as Q, InterfaceDefinition as R, zTopologyTransportEndpoint as S, isNotification as St, zTrafficOverflowEvent as T, RpcFailure as Tt, validateInterfaceErrors as U, toMethodSchema as V, interfaceTemplateMemberName as X, interfaceTemplatesEqual as Z, zTopologyGraph as _, jsonIssues as _t, TrafficWatchFlowTracker as a, zTopologyNode as b, brandApplicationError as bt, StreamControlType as c, componentSchemaRef as ct, nodeInterface as d, validateInterfaceTemplates as et, topologyInterface as f, isApplicationErrorValue as ft, zRouteClaim as g, zodToSvcJsonSchema as gt, zParticipantDescriptorSource as h, TrafficFlowFilter as i, jcsCanonicalize as it, StreamDir as l, NotificationType as lt, zParticipantDescriptor as m, requestType as mt, ConnectionInspectionSource as n, computeInterfaceHash as nt, STREAM_METHOD as o, trafficInterface as p, notificationType as pt, BoundedTrafficSubscription as r, sha256 as rt, componentSchemaName as st, InspectionHost as t, streamInterface as u, RequestType as ut, zTopologyLink as v, parseDeclaredErrorBody as vt, zTrafficEvent as w, isResponse as wt, zTopologyPort as x, ErrorCode as xt, zTopologyLinkEndpoint as y, jsonPointerSegment as yt, defineInterface as z };
+//# sourceMappingURL=inspectionHost-BA6ZmC_P.js.map