@dork-labs/cloud-api 0.75.1

package/dist/problem.js

@@ -0,0 +1,94 @@
+import { z } from 'zod';
+import { IdSchema, TimestampSchema } from './primitives.js';
+/**
+ * Every machine-readable failure code this contract can return.
+ *
+ * These are mechanism, not catalog: they name what went wrong with a request,
+ * which is a property of the protocol and is published on purpose. Nothing here
+ * names a plan, a model, a supplier or an amount.
+ */
+export const ProblemCodeSchema = z
+    .enum([
+    // Authentication and authorization.
+    'unauthenticated',
+    'invalid_token',
+    'expired_token',
+    'forbidden',
+    'scope_required',
+    // Request shape.
+    'malformed_request',
+    'unsupported_wire_version',
+    'not_found',
+    'conflict',
+    'precondition_failed',
+    'rate_limited',
+    // Seats, orgs and identity.
+    'person_seat_required',
+    'seat_unavailable',
+    'handle_taken',
+    'handle_reserved',
+    'handle_tombstoned',
+    'claim_not_approved',
+    'inbox_full',
+    // Entitlement and balance refusals.
+    'entitlement_required',
+    'balance_exhausted',
+    'quota_exceeded',
+    // Remote access.
+    'enrolment_required',
+    'remote_disabled',
+    'address_unavailable',
+    // The server's own faults.
+    'internal_error',
+    'temporarily_unavailable',
+])
+    .describe('The machine-readable failure code. Codes describe the mechanism of a refusal and never identify a plan, a model or a supplier.');
+/**
+ * The single error envelope every endpoint in this contract returns.
+ *
+ * A response is either the route's success schema or this. There is no third
+ * shape and no per-route error type, so a client writes one failure path.
+ *
+ * `requiredPlanId` is present only on a refusal a subscription would lift. It
+ * is an opaque identifier paired with a server-supplied display string: the
+ * client renders what it is given and never switches on the value, and no
+ * amount ever appears here.
+ */
+export const ProblemSchema = z
+    .object({
+    code: ProblemCodeSchema,
+    status: z
+        .number()
+        .int()
+        .min(400)
+        .max(599)
+        .describe('The HTTP status that accompanied this problem.'),
+    title: z.string().describe('A short, human-readable summary, safe to show a person.'),
+    detail: z
+        .string()
+        .optional()
+        .describe('A longer explanation of this specific occurrence, safe to show a person.'),
+    instance: IdSchema.optional().describe('An opaque request identifier to quote when reporting the failure.'),
+    retryAfterMs: z
+        .number()
+        .int()
+        .nonnegative()
+        .optional()
+        .describe('How long to wait before retrying, when the failure is transient.'),
+    requiredPlanId: IdSchema.optional().describe('An opaque identifier for the subscription that would lift this refusal. Render the accompanying display string; never branch on this value.'),
+    requiredPlanDisplayName: z
+        .string()
+        .optional()
+        .describe('The server-supplied display string for `requiredPlanId`.'),
+    freesAt: TimestampSchema.optional().describe('When the blocking condition clears, where the server can say so.'),
+})
+    .describe('The error envelope every endpoint in this contract returns in place of its success body.');
+/**
+ * Narrows an unknown value to a {@link Problem}.
+ *
+ * @param value - A parsed response body of unknown shape.
+ */
+export function isProblem(value) {
+    return ProblemSchema.safeParse(value).success;
+}
+//# sourceMappingURL=problem.js.map

package/dist/problem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"problem.js","sourceRoot":"","sources":["../src/problem.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,IAAI,CAAC;IACJ,oCAAoC;IACpC,iBAAiB;IACjB,eAAe;IACf,eAAe;IACf,WAAW;IACX,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,0BAA0B;IAC1B,WAAW;IACX,UAAU;IACV,qBAAqB;IACrB,cAAc;IACd,4BAA4B;IAC5B,sBAAsB;IACtB,kBAAkB;IAClB,cAAc;IACd,iBAAiB;IACjB,mBAAmB;IACnB,oBAAoB;IACpB,YAAY;IACZ,oCAAoC;IACpC,sBAAsB;IACtB,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,iBAAiB;IACjB,qBAAqB;IACrB,2BAA2B;IAC3B,gBAAgB;IAChB,yBAAyB;CAC1B,CAAC;KACD,QAAQ,CACP,gIAAgI,CACjI,CAAC;AAKJ;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,IAAI,EAAE,iBAAiB;IACvB,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,GAAG,CAAC;SACR,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,CAAC,gDAAgD,CAAC;IAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IACrF,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,0EAA0E,CAAC;IACvF,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACpC,mEAAmE,CACpE;IACD,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,WAAW,EAAE;SACb,QAAQ,EAAE;SACV,QAAQ,CAAC,kEAAkE,CAAC;IAC/E,cAAc,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC1C,6IAA6I,CAC9I;IACD,uBAAuB,EAAE,CAAC;SACvB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,OAAO,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC1C,kEAAkE,CACnE;CACF,CAAC;KACD,QAAQ,CACP,0FAA0F,CAC3F,CAAC;AAKJ;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAChD,CAAC"}

package/dist/remote.d.ts

@@ -0,0 +1,268 @@
+import { z } from 'zod';
+/**
+ * How remote access is arranged for an instance.
+ *
+ * Mechanism, and safe under catalog blindness for the same reason the
+ * entitlement capability enums are: it describes how the thing works, not what
+ * anybody bought.
+ */
+export declare const RemoteModeSchema: z.ZodEnum<{
+    byo: "byo";
+    managed: "managed";
+    off: "off";
+}>;
+/** Where the tunnel is in its lifecycle. */
+export declare const RemoteStateSchema: z.ZodEnum<{
+    closed: "closed";
+    opening: "opening";
+    open: "open";
+    draining: "draining";
+    blocked: "blocked";
+}>;
+/**
+ * `GET /v1/remote/status`.
+ *
+ * `alwaysAvailable` is a boolean the server computes. A client renders the
+ * promise and never sees a subscription identifier to derive it from.
+ */
+export declare const RemoteStatusSchema: z.ZodObject<{
+    mode: z.ZodEnum<{
+        byo: "byo";
+        managed: "managed";
+        off: "off";
+    }>;
+    state: z.ZodEnum<{
+        closed: "closed";
+        opening: "opening";
+        open: "open";
+        draining: "draining";
+        blocked: "blocked";
+    }>;
+    address: z.ZodString;
+    url: z.ZodOptional<z.ZodString>;
+    openedAt: z.ZodOptional<z.ZodISODateTime>;
+    idleClosesAt: z.ZodOptional<z.ZodISODateTime>;
+    lastActivityAt: z.ZodOptional<z.ZodISODateTime>;
+    alwaysAvailable: z.ZodBoolean;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** The current remote-access state of one instance. */
+export type RemoteStatus = z.infer<typeof RemoteStatusSchema>;
+/**
+ * `POST /v1/remote/open`.
+ *
+ * Accepted from a person`s session, a person`s bearer token, or a valid wake
+ * token. Idempotent on `(instanceId, wakeId)`: repeating the call with the same
+ * wake identifier repeats the answer rather than opening a second tunnel.
+ */
+export declare const RemoteOpenRequestSchema: z.ZodObject<{
+    instanceId: z.ZodString;
+    wakeId: z.ZodString;
+}, z.core.$strip>;
+/** The accepted open request. */
+export declare const RemoteOpenResponseSchema: z.ZodObject<{
+    wakeId: z.ZodString;
+    state: z.ZodEnum<{
+        closed: "closed";
+        opening: "opening";
+        open: "open";
+        draining: "draining";
+        blocked: "blocked";
+    }>;
+    pollAfterMs: z.ZodNumber;
+}, z.core.$strip>;
+/** `POST /v1/remote/close`. */
+export declare const RemoteCloseResponseSchema: z.ZodObject<{
+    state: z.ZodEnum<{
+        closed: "closed";
+        opening: "opening";
+        open: "open";
+        draining: "draining";
+        blocked: "blocked";
+    }>;
+}, z.core.$strip>;
+/**
+ * `POST /v1/remote/wake-tokens` — mint a token that can open a closed tunnel.
+ *
+ * `token` is returned once. Hold it as a credential reference, never as
+ * configuration.
+ */
+export declare const RemoteWakeTokenSchema: z.ZodObject<{
+    token: z.ZodString;
+    expiresAt: z.ZodISODateTime;
+    singleUse: z.ZodBoolean;
+}, z.core.$strip>;
+/**
+ * `POST /v1/remote/enrolment` — the person`s consent to managed remote access.
+ *
+ * Accepted only from a person`s session. An instance cannot enrol itself.
+ */
+export declare const RemoteEnrolmentSchema: z.ZodObject<{
+    enrolmentId: z.ZodString;
+    consentVersion: z.ZodString;
+    enrolledAt: z.ZodISODateTime;
+}, z.core.$strip>;
+/** A person`s consent to managed remote access. */
+export type RemoteEnrolment = z.infer<typeof RemoteEnrolmentSchema>;
+/** `DELETE /v1/remote/enrolment` — withdrawn by the person or by the instance. */
+export declare const RemoteEnrolmentWithdrawnSchema: z.ZodObject<{
+    withdrawnAt: z.ZodISODateTime;
+}, z.core.$strip>;
+/** `GET` / `POST /v1/remote/address` — the canonical address for an instance. */
+export declare const RemoteAddressSchema: z.ZodObject<{
+    address: z.ZodString;
+    host: z.ZodString;
+    kind: z.ZodLiteral<"canonical">;
+}, z.core.$strip>;
+/** Where a custom hostname is in its setup. */
+export declare const CustomAddressStatusSchema: z.ZodEnum<{
+    active: "active";
+    failed: "failed";
+    pending_verification: "pending_verification";
+    verifying: "verifying";
+}>;
+/** Where a custom hostname`s certificate is. */
+export declare const CertificateStateSchema: z.ZodEnum<{
+    none: "none";
+    pending: "pending";
+    failed: "failed";
+    issued: "issued";
+    renewing: "renewing";
+}>;
+/** `GET` / `POST` / `DELETE /v1/remote/address/custom`. */
+export declare const RemoteCustomAddressSchema: z.ZodObject<{
+    hostname: z.ZodString;
+    status: z.ZodEnum<{
+        active: "active";
+        failed: "failed";
+        pending_verification: "pending_verification";
+        verifying: "verifying";
+    }>;
+    verification: z.ZodObject<{
+        recordName: z.ZodString;
+        recordValue: z.ZodString;
+    }, z.core.$strip>;
+    certificate: z.ZodObject<{
+        state: z.ZodEnum<{
+            none: "none";
+            pending: "pending";
+            failed: "failed";
+            issued: "issued";
+            renewing: "renewing";
+        }>;
+        renewsAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+/** A custom hostname for an instance. */
+export type RemoteCustomAddress = z.infer<typeof RemoteCustomAddressSchema>;
+/** `POST /v1/orgs/{orgId}/remote/designation` — pick the always-available instance. */
+export declare const RemoteDesignationRequestSchema: z.ZodObject<{
+    instanceId: z.ZodString;
+}, z.core.$strip>;
+/** The accepted designation. */
+export declare const RemoteDesignationSchema: z.ZodObject<{
+    instanceId: z.ZodString;
+    effectiveAt: z.ZodISODateTime;
+    cooldownUntil: z.ZodISODateTime;
+}, z.core.$strip>;
+/**
+ * `POST /v1/remote/credentials/issue` — an instance asks for a tunnel
+ * credential.
+ *
+ * Instance API key only. `value` is returned once.
+ */
+export declare const RemoteCredentialIssueRequestSchema: z.ZodObject<{
+    instanceId: z.ZodString;
+    idempotencyKey: z.ZodString;
+}, z.core.$strip>;
+/** A freshly issued tunnel credential. */
+export declare const RemoteCredentialSchema: z.ZodObject<{
+    issuanceId: z.ZodString;
+    credentialId: z.ZodString;
+    value: z.ZodString;
+    fingerprint: z.ZodString;
+    acl: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+/** A freshly issued tunnel credential. */
+export type RemoteCredential = z.infer<typeof RemoteCredentialSchema>;
+/** `POST /v1/remote/credentials/confirm` — the instance reports it stored the credential. */
+export declare const RemoteCredentialConfirmRequestSchema: z.ZodObject<{
+    credentialId: z.ZodString;
+}, z.core.$strip>;
+/** The confirmation. */
+export declare const RemoteCredentialConfirmResponseSchema: z.ZodObject<{
+    credentialId: z.ZodString;
+    confirmedAt: z.ZodISODateTime;
+}, z.core.$strip>;
+/**
+ * One event on the instance command stream.
+ *
+ * A published discriminated union rather than an untyped string, so adding a
+ * command kind later is a package release the two sides can agree on rather
+ * than a field they disagree about.
+ */
+export declare const RemoteCommandSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"open">;
+    id: z.ZodString;
+    leaseToken: z.ZodString;
+    wakeId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"close">;
+    id: z.ZodString;
+    leaseToken: z.ZodString;
+    reason: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"rotate">;
+    id: z.ZodString;
+    leaseToken: z.ZodString;
+    credentialId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"revoke">;
+    id: z.ZodString;
+    leaseToken: z.ZodString;
+    credentialId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"inbox_pending">;
+    id: z.ZodString;
+    leaseToken: z.ZodString;
+    seatId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"keepalive">;
+    id: z.ZodString;
+}, z.core.$strip>], "kind">;
+/** One event on the instance command stream. */
+export type RemoteCommand = z.infer<typeof RemoteCommandSchema>;
+/** `POST /v1/remote/commands/ack`. */
+export declare const RemoteCommandAckRequestSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        leaseToken: z.ZodString;
+        outcome: z.ZodEnum<{
+            failed: "failed";
+            applied: "applied";
+            ignored: "ignored";
+        }>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** How many command leases were settled. */
+export declare const RemoteCommandAckResponseSchema: z.ZodObject<{
+    acknowledged: z.ZodNumber;
+}, z.core.$strip>;
+/** `POST /v1/remote/events` — batched activity from an instance. */
+export declare const RemoteEventBatchSchema: z.ZodObject<{
+    instanceId: z.ZodString;
+    activity: z.ZodArray<z.ZodObject<{
+        at: z.ZodISODateTime;
+        requests: z.ZodNumber;
+    }, z.core.$strip>>;
+    closeReports: z.ZodArray<z.ZodObject<{
+        at: z.ZodISODateTime;
+        reason: z.ZodString;
+        wakeId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** How many events were accepted. */
+export declare const RemoteEventBatchResponseSchema: z.ZodObject<{
+    accepted: z.ZodNumber;
+}, z.core.$strip>;
+//# sourceMappingURL=remote.d.ts.map

package/dist/remote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;;;;EAEgE,CAAC;AAE9F,4CAA4C;AAC5C,eAAO,MAAM,iBAAiB;;;;;;EAEsB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;iBAmBgC,CAAC;AAEhE,uDAAuD;AACvD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;iBASjC,CAAC;AAEJ,iCAAiC;AACjC,eAAO,MAAM,wBAAwB;;;;;;;;;;iBAUqD,CAAC;AAE3F,+BAA+B;AAC/B,eAAO,MAAM,yBAAyB;;;;;;;;iBAE+B,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;iBAMuD,CAAC;AAE1F;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;iBAMiE,CAAC;AAEpG,mDAAmD;AACnD,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,kFAAkF;AAClF,eAAO,MAAM,8BAA8B;;iBAEkD,CAAC;AAE9F,iFAAiF;AACjF,eAAO,MAAM,mBAAmB;;;;iBAMiC,CAAC;AAElE,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB;;;;;EAEiB,CAAC;AAExD,gDAAgD;AAChD,eAAO,MAAM,sBAAsB;;;;;;EAEqB,CAAC;AAEzD,2DAA2D;AAC3D,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;iBAcwD,CAAC;AAE/F,yCAAyC;AACzC,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,uFAAuF;AACvF,eAAO,MAAM,8BAA8B;;iBAEoC,CAAC;AAEhF,gCAAgC;AAChC,eAAO,MAAM,uBAAuB;;;;iBAMqC,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC;;;iBAUkC,CAAC;AAElF,0CAA0C;AAC1C,eAAO,MAAM,sBAAsB;;;;;;iBAUqD,CAAC;AAEzF,0CAA0C;AAC1C,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,6FAA6F;AAC7F,eAAO,MAAM,oCAAoC;;iBAEwB,CAAC;AAE1E,wBAAwB;AACxB,eAAO,MAAM,qCAAqC;;;iBAEkB,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAgD7B,CAAC;AAEJ,gDAAgD;AAChD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,sCAAsC;AACtC,eAAO,MAAM,6BAA6B;;;;;;;;;;iBAe6B,CAAC;AAExE,4CAA4C;AAC5C,eAAO,MAAM,8BAA8B;;iBAEe,CAAC;AAE3D,oEAAoE;AACpE,eAAO,MAAM,sBAAsB;;;;;;;;;;;iBAUkD,CAAC;AAEtF,qCAAqC;AACrC,eAAO,MAAM,8BAA8B;;iBAEwB,CAAC"}

package/dist/remote.js

@@ -0,0 +1,267 @@
+import { z } from 'zod';
+import { IdSchema, SecretValueSchema, TimestampSchema } from './primitives.js';
+/**
+ * How remote access is arranged for an instance.
+ *
+ * Mechanism, and safe under catalog blindness for the same reason the
+ * entitlement capability enums are: it describes how the thing works, not what
+ * anybody bought.
+ */
+export const RemoteModeSchema = z
+    .enum(['off', 'byo', 'managed'])
+    .describe('How remote access is arranged: off, the caller`s own tunnel, or a managed one.');
+/** Where the tunnel is in its lifecycle. */
+export const RemoteStateSchema = z
+    .enum(['closed', 'opening', 'open', 'draining', 'blocked'])
+    .describe('Where the tunnel is in its lifecycle.');
+/**
+ * `GET /v1/remote/status`.
+ *
+ * `alwaysAvailable` is a boolean the server computes. A client renders the
+ * promise and never sees a subscription identifier to derive it from.
+ */
+export const RemoteStatusSchema = z
+    .object({
+    mode: RemoteModeSchema,
+    state: RemoteStateSchema,
+    address: z.string().describe('The address this instance is reachable at.'),
+    url: z.string().url().optional().describe('The full URL, when the tunnel is open.'),
+    openedAt: TimestampSchema.optional(),
+    idleClosesAt: TimestampSchema.optional().describe('When an idle tunnel will close itself.'),
+    lastActivityAt: TimestampSchema.optional(),
+    alwaysAvailable: z
+        .boolean()
+        .describe('Computed by the server. The client renders the promise and never derives it from a subscription.'),
+    reason: z
+        .string()
+        .optional()
+        .describe('Why the tunnel is in this state, when the state needs explaining.'),
+})
+    .describe('The current remote-access state of one instance.');
+/**
+ * `POST /v1/remote/open`.
+ *
+ * Accepted from a person`s session, a person`s bearer token, or a valid wake
+ * token. Idempotent on `(instanceId, wakeId)`: repeating the call with the same
+ * wake identifier repeats the answer rather than opening a second tunnel.
+ */
+export const RemoteOpenRequestSchema = z
+    .object({
+    instanceId: IdSchema,
+    wakeId: IdSchema.describe('A client-chosen idempotency key. The same key repeats the answer, not the effect.'),
+})
+    .describe('Open the tunnel for an instance. Idempotent on the instance and wake identifier together.');
+/** The accepted open request. */
+export const RemoteOpenResponseSchema = z
+    .object({
+    wakeId: IdSchema,
+    state: RemoteStateSchema,
+    pollAfterMs: z
+        .number()
+        .int()
+        .nonnegative()
+        .describe('How long to wait before reading the status again.'),
+})
+    .describe('The accepted open request, and how long to wait before checking the status.');
+/** `POST /v1/remote/close`. */
+export const RemoteCloseResponseSchema = z
+    .object({ state: RemoteStateSchema })
+    .describe('The state the tunnel is in after being asked to close.');
+/**
+ * `POST /v1/remote/wake-tokens` — mint a token that can open a closed tunnel.
+ *
+ * `token` is returned once. Hold it as a credential reference, never as
+ * configuration.
+ */
+export const RemoteWakeTokenSchema = z
+    .object({
+    token: SecretValueSchema,
+    expiresAt: TimestampSchema,
+    singleUse: z.boolean(),
+})
+    .describe('A token that can open a closed tunnel. The value is returned exactly once.');
+/**
+ * `POST /v1/remote/enrolment` — the person`s consent to managed remote access.
+ *
+ * Accepted only from a person`s session. An instance cannot enrol itself.
+ */
+export const RemoteEnrolmentSchema = z
+    .object({
+    enrolmentId: IdSchema,
+    consentVersion: z.string().describe('Which version of the consent text the person agreed to.'),
+    enrolledAt: TimestampSchema,
+})
+    .describe('A person`s consent to managed remote access. Only a person`s session can create one.');
+/** `DELETE /v1/remote/enrolment` — withdrawn by the person or by the instance. */
+export const RemoteEnrolmentWithdrawnSchema = z
+    .object({ withdrawnAt: TimestampSchema })
+    .describe('When consent was withdrawn. Either the person or the instance may withdraw it.');
+/** `GET` / `POST /v1/remote/address` — the canonical address for an instance. */
+export const RemoteAddressSchema = z
+    .object({
+    address: z.string(),
+    host: z.string(),
+    kind: z.literal('canonical'),
+})
+    .describe('The canonical address an instance is reachable at.');
+/** Where a custom hostname is in its setup. */
+export const CustomAddressStatusSchema = z
+    .enum(['pending_verification', 'verifying', 'active', 'failed'])
+    .describe('Where a custom hostname is in its setup.');
+/** Where a custom hostname`s certificate is. */
+export const CertificateStateSchema = z
+    .enum(['none', 'pending', 'issued', 'renewing', 'failed'])
+    .describe('Where a custom hostname`s certificate is.');
+/** `GET` / `POST` / `DELETE /v1/remote/address/custom`. */
+export const RemoteCustomAddressSchema = z
+    .object({
+    hostname: z.string(),
+    status: CustomAddressStatusSchema,
+    verification: z
+        .object({
+        recordName: z.string().describe('The DNS record name to create.'),
+        recordValue: z.string().describe('The DNS record value to set.'),
+    })
+        .describe('The DNS record that proves the caller controls the hostname.'),
+    certificate: z
+        .object({ state: CertificateStateSchema, renewsAt: TimestampSchema.nullable() })
+        .describe('The certificate this hostname is served with.'),
+})
+    .describe('A custom hostname for an instance, its verification record and its certificate.');
+/** `POST /v1/orgs/{orgId}/remote/designation` — pick the always-available instance. */
+export const RemoteDesignationRequestSchema = z
+    .object({ instanceId: IdSchema })
+    .describe('Designate which instance an organization keeps always available.');
+/** The accepted designation. */
+export const RemoteDesignationSchema = z
+    .object({
+    instanceId: IdSchema,
+    effectiveAt: TimestampSchema,
+    cooldownUntil: TimestampSchema.describe('Until when the designation cannot be changed again.'),
+})
+    .describe('The accepted designation, and when it may next be changed.');
+/**
+ * `POST /v1/remote/credentials/issue` — an instance asks for a tunnel
+ * credential.
+ *
+ * Instance API key only. `value` is returned once.
+ */
+export const RemoteCredentialIssueRequestSchema = z
+    .object({
+    instanceId: IdSchema,
+    idempotencyKey: z
+        .string()
+        .min(1)
+        .describe('A client-chosen key. Repeating an issue with the same key repeats the answer, not the effect.'),
+})
+    .describe('An instance asking for a tunnel credential. Instance API key only.');
+/** A freshly issued tunnel credential. */
+export const RemoteCredentialSchema = z
+    .object({
+    issuanceId: IdSchema,
+    credentialId: IdSchema,
+    value: SecretValueSchema,
+    fingerprint: z.string().describe('A stable digest of the credential, safe to log and compare.'),
+    acl: z
+        .array(z.string())
+        .describe('What this credential may do, as opaque server-supplied strings.'),
+})
+    .describe('A freshly issued tunnel credential. The `value` is returned exactly once.');
+/** `POST /v1/remote/credentials/confirm` — the instance reports it stored the credential. */
+export const RemoteCredentialConfirmRequestSchema = z
+    .object({ credentialId: IdSchema })
+    .describe('An instance confirming it has stored an issued credential.');
+/** The confirmation. */
+export const RemoteCredentialConfirmResponseSchema = z
+    .object({ credentialId: IdSchema, confirmedAt: TimestampSchema })
+    .describe('When the server recorded the instance`s confirmation.');
+/**
+ * One event on the instance command stream.
+ *
+ * A published discriminated union rather than an untyped string, so adding a
+ * command kind later is a package release the two sides can agree on rather
+ * than a field they disagree about.
+ */
+export const RemoteCommandSchema = z
+    .discriminatedUnion('kind', [
+    z
+        .object({
+        kind: z.literal('open'),
+        id: IdSchema,
+        leaseToken: z.string().min(1),
+        wakeId: IdSchema,
+    })
+        .describe('Open the tunnel.'),
+    z
+        .object({
+        kind: z.literal('close'),
+        id: IdSchema,
+        leaseToken: z.string().min(1),
+        reason: z.string(),
+    })
+        .describe('Close the tunnel.'),
+    z
+        .object({
+        kind: z.literal('rotate'),
+        id: IdSchema,
+        leaseToken: z.string().min(1),
+        credentialId: IdSchema,
+    })
+        .describe('Replace the tunnel credential.'),
+    z
+        .object({
+        kind: z.literal('revoke'),
+        id: IdSchema,
+        leaseToken: z.string().min(1),
+        credentialId: IdSchema,
+    })
+        .describe('Stop using the tunnel credential and forget it.'),
+    z
+        .object({
+        kind: z.literal('inbox_pending'),
+        id: IdSchema,
+        leaseToken: z.string().min(1),
+        seatId: IdSchema,
+    })
+        .describe('There is mail waiting for a seat.'),
+    z
+        .object({ kind: z.literal('keepalive'), id: IdSchema })
+        .describe('Nothing to do. Sent so a silent stream can be told from a dead one.'),
+])
+    .describe('One event on the `GET /v1/remote/commands` stream. Server-sent events; instance API key only.');
+/** `POST /v1/remote/commands/ack`. */
+export const RemoteCommandAckRequestSchema = z
+    .object({
+    items: z
+        .array(z.object({
+        id: IdSchema,
+        leaseToken: z.string().min(1),
+        outcome: z
+            .enum(['applied', 'ignored', 'failed'])
+            .describe('What the instance did with the command.'),
+    }))
+        .min(1)
+        .max(100),
+})
+    .describe('Report what an instance did with the commands it leased.');
+/** How many command leases were settled. */
+export const RemoteCommandAckResponseSchema = z
+    .object({ acknowledged: z.number().int().nonnegative() })
+    .describe('How many command leases the server settled.');
+/** `POST /v1/remote/events` — batched activity from an instance. */
+export const RemoteEventBatchSchema = z
+    .object({
+    instanceId: IdSchema,
+    activity: z
+        .array(z.object({ at: TimestampSchema, requests: z.number().int().nonnegative() }))
+        .describe('Windowed request counters.'),
+    closeReports: z
+        .array(z.object({ at: TimestampSchema, reason: z.string(), wakeId: IdSchema.nullable() }))
+        .describe('Why and when the tunnel closed itself.'),
+})
+    .describe('Batched activity, close reports and window counters from one instance.');
+/** How many events were accepted. */
+export const RemoteEventBatchResponseSchema = z
+    .object({ accepted: z.number().int().nonnegative() })
+    .describe('How many of the reported events the server accepted.');
+//# sourceMappingURL=remote.js.map

package/dist/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;KAC/B,QAAQ,CAAC,gFAAgF,CAAC,CAAC;AAE9F,4CAA4C;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;KAC1D,QAAQ,CAAC,uCAAuC,CAAC,CAAC;AAErD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,gBAAgB;IACtB,KAAK,EAAE,iBAAiB;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IAC1E,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACnF,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IAC3F,cAAc,EAAE,eAAe,CAAC,QAAQ,EAAE;IAC1C,eAAe,EAAE,CAAC;SACf,OAAO,EAAE;SACT,QAAQ,CACP,kGAAkG,CACnG;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,mEAAmE,CAAC;CACjF,CAAC;KACD,QAAQ,CAAC,kDAAkD,CAAC,CAAC;AAKhE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,UAAU,EAAE,QAAQ;IACpB,MAAM,EAAE,QAAQ,CAAC,QAAQ,CACvB,mFAAmF,CACpF;CACF,CAAC;KACD,QAAQ,CACP,2FAA2F,CAC5F,CAAC;AAEJ,iCAAiC;AACjC,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,iBAAiB;IACxB,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,EAAE;SACL,WAAW,EAAE;SACb,QAAQ,CAAC,mDAAmD,CAAC;CACjE,CAAC;KACD,QAAQ,CAAC,6EAA6E,CAAC,CAAC;AAE3F,+BAA+B;AAC/B,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;KACpC,QAAQ,CAAC,wDAAwD,CAAC,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,KAAK,EAAE,iBAAiB;IACxB,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC;KACD,QAAQ,CAAC,4EAA4E,CAAC,CAAC;AAE1F;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,WAAW,EAAE,QAAQ;IACrB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IAC9F,UAAU,EAAE,eAAe;CAC5B,CAAC;KACD,QAAQ,CAAC,sFAAsF,CAAC,CAAC;AAKpG,kFAAkF;AAClF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;KACxC,QAAQ,CAAC,gFAAgF,CAAC,CAAC;AAE9F,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;CAC7B,CAAC;KACD,QAAQ,CAAC,oDAAoD,CAAC,CAAC;AAElE,+CAA+C;AAC/C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,IAAI,CAAC,CAAC,sBAAsB,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;KAC/D,QAAQ,CAAC,0CAA0C,CAAC,CAAC;AAExD,gDAAgD;AAChD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;KACzD,QAAQ,CAAC,2CAA2C,CAAC,CAAC;AAEzD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,yBAAyB;IACjC,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QACjE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;KACjE,CAAC;SACD,QAAQ,CAAC,8DAA8D,CAAC;IAC3E,WAAW,EAAE,CAAC;SACX,MAAM,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,EAAE,CAAC;SAC/E,QAAQ,CAAC,+CAA+C,CAAC;CAC7D,CAAC;KACD,QAAQ,CAAC,iFAAiF,CAAC,CAAC;AAK/F,uFAAuF;AACvF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;KAChC,QAAQ,CAAC,kEAAkE,CAAC,CAAC;AAEhF,gCAAgC;AAChC,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,eAAe;IAC5B,aAAa,EAAE,eAAe,CAAC,QAAQ,CAAC,qDAAqD,CAAC;CAC/F,CAAC;KACD,QAAQ,CAAC,4DAA4D,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAChD,MAAM,CAAC;IACN,UAAU,EAAE,QAAQ;IACpB,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,+FAA+F,CAChG;CACJ,CAAC;KACD,QAAQ,CAAC,oEAAoE,CAAC,CAAC;AAElF,0CAA0C;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,UAAU,EAAE,QAAQ;IACpB,YAAY,EAAE,QAAQ;IACtB,KAAK,EAAE,iBAAiB;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;IAC/F,GAAG,EAAE,CAAC;SACH,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CAAC,iEAAiE,CAAC;CAC/E,CAAC;KACD,QAAQ,CAAC,2EAA2E,CAAC,CAAC;AAKzF,6FAA6F;AAC7F,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC;KAClD,MAAM,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;KAClC,QAAQ,CAAC,4DAA4D,CAAC,CAAC;AAE1E,wBAAwB;AACxB,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;KAChE,QAAQ,CAAC,uDAAuD,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,kBAAkB,CAAC,MAAM,EAAE;IAC1B,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,EAAE,EAAE,QAAQ;QACZ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,QAAQ;KACjB,CAAC;SACD,QAAQ,CAAC,kBAAkB,CAAC;IAC/B,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,EAAE,EAAE,QAAQ;QACZ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;SACD,QAAQ,CAAC,mBAAmB,CAAC;IAChC,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,EAAE,EAAE,QAAQ;QACZ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,YAAY,EAAE,QAAQ;KACvB,CAAC;SACD,QAAQ,CAAC,gCAAgC,CAAC;IAC7C,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,EAAE,EAAE,QAAQ;QACZ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,YAAY,EAAE,QAAQ;KACvB,CAAC;SACD,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QAChC,EAAE,EAAE,QAAQ;QACZ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,QAAQ;KACjB,CAAC;SACD,QAAQ,CAAC,mCAAmC,CAAC;IAChD,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;SACtD,QAAQ,CAAC,qEAAqE,CAAC;CACnF,CAAC;KACD,QAAQ,CACP,+FAA+F,CAChG,CAAC;AAKJ,sCAAsC;AACtC,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,KAAK,EAAE,CAAC;SACL,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,QAAQ;QACZ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,OAAO,EAAE,CAAC;aACP,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;aACtC,QAAQ,CAAC,yCAAyC,CAAC;KACvD,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;CACZ,CAAC;KACD,QAAQ,CAAC,0DAA0D,CAAC,CAAC;AAExE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;KACxD,QAAQ,CAAC,6CAA6C,CAAC,CAAC;AAE3D,oEAAoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;SAClF,QAAQ,CAAC,4BAA4B,CAAC;IACzC,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SACzF,QAAQ,CAAC,wCAAwC,CAAC;CACtD,CAAC;KACD,QAAQ,CAAC,wEAAwE,CAAC,CAAC;AAEtF,qCAAqC;AACrC,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;KACpD,QAAQ,CAAC,sDAAsD,CAAC,CAAC"}