@inkbox/sdk 0.3.2 → 0.4.0

package/dist/tunnels/resources/tunnels.js

@@ -1,12 +1,14 @@
 /**
  * inkbox-tunnels/resources/tunnels.ts
  *
- * Control-plane CRUD for tunnels. Wraps `/api/v1/tunnels/*`.
+ * Control-plane reads + update + sign-csr for tunnels. Tunnels are
+ * created and deleted exclusively via identity-create / identity-delete
+ * cascades; there is no standalone create / delete / restore /
+ * force-delete / rotate-secret surface.
  */
 import { InkboxAPIError } from "../../_http.js";
-import { validateTunnelName } from "../_validation.js";
-import { TunnelCSRStateConflict, TunnelNameUnavailable, TunnelStateConflict, TunnelTLSModeMismatch, } from "../exceptions.js";
-import { TLSMode, parseCreatedTunnel, parseRotatedSecret, parseSignedCert, parseTunnel, } from "../types.js";
+import { TunnelCSRStateConflict, TunnelTLSModeMismatch, } from "../exceptions.js";
+import { parseSignedCert, parseTunnel, } from "../types.js";
 const BASE = "/tunnels";
 const SIGN_CSR_TIMEOUT_MS = 180_000;
 export const POOL_SIZE_MIN = 1;
@@ -21,18 +23,6 @@ function detailText(detail) {
     }
     return String(detail);
 }
-function mapCreateError(err) {
-    if (err.statusCode === 409) {
-        return new TunnelNameUnavailable(err.statusCode, err.detail);
-    }
-    return err;
-}
-function mapStateError(err) {
-    if (err.statusCode === 409) {
-        return new TunnelStateConflict(err.statusCode, err.detail);
-    }
-    return err;
-}
 function mapSignCsrError(err) {
     if (err.statusCode !== 409)
         return err;
@@ -59,40 +49,14 @@ export class TunnelsResource {
     }
     // --- Writes ----------------------------------------------------------
     /**
-     * Create a new tunnel. Persist the returned `connectSecret` immediately —
-     * it is shown ONCE.
-     */
-    async create(options) {
-        validateTunnelName(options.tunnelName);
-        const body = {
-            tunnel_name: options.tunnelName,
-            tls_mode: options.tlsMode ?? TLSMode.EDGE,
-        };
-        if (options.description !== undefined && options.description !== null) {
-            body.description = options.description;
-        }
-        try {
-            const data = await this.http.post(`${BASE}/`, body);
-            return parseCreatedTunnel(data);
-        }
-        catch (err) {
-            if (err instanceof InkboxAPIError)
-                throw mapCreateError(err);
-            throw err;
-        }
-    }
-    /**
-     * Update a tunnel. Pass only the fields you want to change.
+     * Update a tunnel's metadata. `metadata` is the only mutable field;
+     * other tunnel attributes are derived from the owning identity.
      *
-     * - `description: null` clears the description.
-     * - `metadata: {}` clears metadata. `metadata` cannot be `null`
-     *   (rejected client-side); pass `{}` to clear.
+     * - `metadata: {}` (or `null`) clears the metadata bag. The server
+     *   column is non-nullable and collapses both forms to `{}`.
      */
     async update(tunnelId, options) {
         const body = {};
-        if ("description" in options) {
-            body.description = options.description;
-        }
         if ("metadata" in options) {
             const m = options.metadata;
             if (m !== null && m !== undefined) {
@@ -105,52 +69,6 @@ export class TunnelsResource {
         const data = await this.http.patch(`${BASE}/${tunnelId}`, body);
         return parseTunnel(data);
     }
-    /**
-     * Schedule a tunnel for removal. The name is held for 24 hours, during
-     * which `restore` brings it back online.
-     */
-    async delete(tunnelId) {
-        const data = await this.http.deleteWithResponse(`${BASE}/${tunnelId}`);
-        return parseTunnel(data);
-    }
-    /** Bring a scheduled-for-removal tunnel back online. */
-    async restore(tunnelId) {
-        try {
-            const data = await this.http.post(`${BASE}/${tunnelId}/restore`);
-            return parseTunnel(data);
-        }
-        catch (err) {
-            if (err instanceof InkboxAPIError)
-                throw mapStateError(err);
-            throw err;
-        }
-    }
-    /**
-     * Remove a scheduled-for-removal tunnel immediately, skipping the 24-hour
-     * window. Requires an admin-scoped API key.
-     */
-    async forceDelete(tunnelId) {
-        try {
-            const data = await this.http.deleteWithResponse(`${BASE}/${tunnelId}/force`);
-            return parseTunnel(data);
-        }
-        catch (err) {
-            if (err instanceof InkboxAPIError)
-                throw mapStateError(err);
-            throw err;
-        }
-    }
-    /**
-     * Rotate the per-tunnel connect secret.
-     *
-     * The new secret takes effect on the next agent reconnect; existing live
-     * connections continue serving traffic with the old secret until they
-     * reconnect.
-     */
-    async rotateSecret(tunnelId) {
-        const data = await this.http.post(`${BASE}/${tunnelId}/rotate-secret`);
-        return parseRotatedSecret(data);
-    }
     /**
      * Sign a CSR for a passthrough tunnel.
      *

package/dist/tunnels/resources/tunnels.js.map

@@ -1 +1 @@
-{"version":3,"file":"tunnels.js","sourceRoot":"","sources":["../../../src/tunnels/resources/tunnels.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAiB,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAQL,OAAO,EAEP,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,MAAM,IAAI,GAAG,UAAU,CAAC;AAExB,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAEpC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,KAAK,GAAI,MAAkC,CAAC,MAAM,CAAC;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,GAAmB;IACzC,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,GAAmB;IACxC,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB;IAC1C,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,sBAAsB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC;AAkBD,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,IAAmB;QAAnB,SAAI,GAAJ,IAAI,CAAe;IAAG,CAAC;IAEpD,wEAAwE;IAExE,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9B,GAAG,IAAI,GAAG,CACX,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QACxD,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAY,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC;QACnE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,wEAAwE;IAExE;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,OAA4B;QACvC,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,IAAI,GAA4B;YACpC,WAAW,EAAE,OAAO,CAAC,UAAU;YAC/B,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI;SAC1C,CAAC;QACF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YACtE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACzC,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAmB,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC;YACtE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc;gBAAE,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,OAA4B;QACzD,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,aAAa,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACzC,CAAC;QACD,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,IAAI,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAY,GAAG,IAAI,IAAI,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3E,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAC7C,GAAG,IAAI,IAAI,QAAQ,EAAE,CACtB,CAAC;QACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAY,GAAG,IAAI,IAAI,QAAQ,UAAU,CAAC,CAAC;YAC5E,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc;gBAAE,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;YAC5D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAC7C,GAAG,IAAI,IAAI,QAAQ,QAAQ,CAC5B,CAAC;YACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc;gBAAE,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;YAC5D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAC/B,GAAG,IAAI,IAAI,QAAQ,gBAAgB,CACpC,CAAC;QACF,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,OAA2B;QACzD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAC/B,GAAG,IAAI,IAAI,QAAQ,WAAW,EAC9B,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EAC3B,EAAE,SAAS,EAAE,mBAAmB,EAAE,CACnC,CAAC;YACF,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc;gBAAE,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC9D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"tunnels.js","sourceRoot":"","sources":["../../../src/tunnels/resources/tunnels.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAiB,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAKL,eAAe,EACf,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,MAAM,IAAI,GAAG,UAAU,CAAC;AAExB,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAEpC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,KAAK,GAAI,MAAkC,CAAC,MAAM,CAAC;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB;IAC1C,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,sBAAsB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC;AAUD,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,IAAmB;QAAnB,SAAI,GAAJ,IAAI,CAAe;IAAG,CAAC;IAEpD,wEAAwE;IAExE,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9B,GAAG,IAAI,GAAG,CACX,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QACxD,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAY,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC;QACnE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,wEAAwE;IAExE;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,OAA4B;QACzD,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,IAAI,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAY,GAAG,IAAI,IAAI,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3E,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,OAA2B;QACzD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAC/B,GAAG,IAAI,IAAI,QAAQ,WAAW,EAC9B,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EAC3B,EAAE,SAAS,EAAE,mBAAmB,EAAE,CACnC,CAAC;YACF,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc;gBAAE,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC9D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF"}

package/dist/tunnels/types.d.ts

@@ -13,46 +13,41 @@ export declare enum TLSMode {
  * - `awaiting_cert`: passthrough-only intermediate state. Inbound TLS
  *   will fail until you call `tunnels.signCsr(...)`.
  * - `active`: routable end-to-end.
- * - `pending_removal`: `delete` was called; the name is held for 24h
- *   during which `tunnels.restore(id)` brings it back. After 24h the
- *   tunnel is permanently removed and its name is released. Past that
- *   point a `GET` for the tunnel id returns 404; `TunnelRemoved`
- *   surfaces that condition for clients holding stale state.
+ * - `deleted`: terminal. The tunnel is offline. Tunnels are deleted
+ *   exclusively via the identity-delete cascade — there is no direct
+ *   tunnel-delete surface.
  */
 export declare enum TunnelStatus {
     AWAITING_CERT = "awaiting_cert",
     ACTIVE = "active",
-    PENDING_REMOVAL = "pending_removal"
+    DELETED = "deleted"
 }
 export interface Tunnel {
     id: string;
     organizationId: string;
     tunnelName: string;
-    description: string | null;
     tlsMode: TLSMode;
     certPem: string | null;
     certFingerprintSha256: string | null;
     certExpiresAt: Date | null;
-    status: TunnelStatus;
+    /**
+     * One of the known {@link TunnelStatus} values, or — if the server
+     * returns a status the SDK doesn't recognize — the raw string. Future
+     * statuses survive parsing without fail-open coercion; callers should
+     * handle a `string` default branch alongside the enum cases.
+     */
+    status: TunnelStatus | string;
     lastConnectedAt: Date | null;
     lastConnectedIpAddr: string | null;
-    restoreDeadlineAt: Date | null;
     currentlyConnected: boolean;
-    publicHost: string | null;
-    zone: string | null;
+    /** Customer-facing hostname — e.g. `my-agent.inkboxwire.com` in production. Lower environments use a different tunnel zone. Non-null for live tunnels. */
+    publicHost: string;
+    /** Zone endpoint for the data-plane. Agents connect to `https://{zone}/_system/connect`. In production this is `inkboxwire.com`; lower environments use a different zone. Non-null for live tunnels. */
+    zone: string;
     metadata: Record<string, unknown>;
     createdAt: Date;
     updatedAt: Date;
 }
-export interface CreatedTunnel {
-    tunnel: Tunnel;
-    /** Shown ONCE — persist immediately. */
-    connectSecret: string;
-}
-export interface RotatedSecret {
-    /** New secret. Takes effect on the next agent reconnect. */
-    connectSecret: string;
-}
 export interface SignedCert {
     certPem: string;
     chainPem: string;
@@ -63,7 +58,6 @@ export interface RawTunnel {
     id: string;
     organization_id: string;
     tunnel_name: string;
-    description: string | null;
     tls_mode: string;
     cert_pem: string | null;
     cert_fingerprint_sha256: string | null;
@@ -71,21 +65,13 @@ export interface RawTunnel {
     status: string;
     last_connected_at: string | null;
     last_connected_ip_addr: string | null;
-    restore_deadline_at: string | null;
     currently_connected: boolean;
-    public_host?: string | null;
-    zone?: string | null;
+    public_host: string;
+    zone: string;
     metadata?: Record<string, unknown> | null;
     created_at: string;
     updated_at: string;
 }
-export interface RawCreatedTunnel {
-    tunnel: RawTunnel;
-    connect_secret: string;
-}
-export interface RawRotatedSecret {
-    connect_secret: string;
-}
 export interface RawSignedCert {
     cert_pem: string;
     chain_pem: string;
@@ -93,7 +79,5 @@ export interface RawSignedCert {
     cert_expires_at: string;
 }
 export declare function parseTunnel(raw: RawTunnel): Tunnel;
-export declare function parseCreatedTunnel(raw: RawCreatedTunnel): CreatedTunnel;
-export declare function parseRotatedSecret(raw: RawRotatedSecret): RotatedSecret;
 export declare function parseSignedCert(raw: RawSignedCert): SignedCert;
 //# sourceMappingURL=types.d.ts.map

package/dist/tunnels/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/tunnels/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,oBAAY,OAAO;IACjB,IAAI,SAAS;IACb,WAAW,gBAAgB;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,oBAAY,YAAY;IACtB,aAAa,kBAAkB;IAC/B,MAAM,WAAW;IACjB,eAAe,oBAAoB;CACpC;AAQD,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,aAAa,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,SAAS,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB,EAAE,MAAM,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;CACzB;AAOD,wBAAgB,WAAW,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAwBlD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,aAAa,CAEvE;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,aAAa,CAEvE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,GAAG,UAAU,CAO9D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/tunnels/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,oBAAY,OAAO;IACjB,IAAI,SAAS;IACb,WAAW,gBAAgB;CAC5B;AAED;;;;;;;;;GASG;AACH,oBAAY,YAAY;IACtB,aAAa,kBAAkB;IAC/B,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,aAAa,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,MAAM,EAAE,YAAY,GAAG,MAAM,CAAC;IAC9B,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,0JAA0J;IAC1J,UAAU,EAAE,MAAM,CAAC;IACnB,wMAAwM;IACxM,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB,EAAE,MAAM,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;CACzB;AAOD,wBAAgB,WAAW,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CA0BlD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,GAAG,UAAU,CAO9D"}

package/dist/tunnels/types.js

@@ -14,57 +14,47 @@ export var TLSMode;
  * - `awaiting_cert`: passthrough-only intermediate state. Inbound TLS
  *   will fail until you call `tunnels.signCsr(...)`.
  * - `active`: routable end-to-end.
- * - `pending_removal`: `delete` was called; the name is held for 24h
- *   during which `tunnels.restore(id)` brings it back. After 24h the
- *   tunnel is permanently removed and its name is released. Past that
- *   point a `GET` for the tunnel id returns 404; `TunnelRemoved`
- *   surfaces that condition for clients holding stale state.
+ * - `deleted`: terminal. The tunnel is offline. Tunnels are deleted
+ *   exclusively via the identity-delete cascade — there is no direct
+ *   tunnel-delete surface.
  */
 export var TunnelStatus;
 (function (TunnelStatus) {
     TunnelStatus["AWAITING_CERT"] = "awaiting_cert";
     TunnelStatus["ACTIVE"] = "active";
-    TunnelStatus["PENDING_REMOVAL"] = "pending_removal";
+    TunnelStatus["DELETED"] = "deleted";
 })(TunnelStatus || (TunnelStatus = {}));
-const STATUS_REMAP_TO_PUBLIC = {
-    awaiting_cert: TunnelStatus.AWAITING_CERT,
-    active: TunnelStatus.ACTIVE,
-    delete_pending: TunnelStatus.PENDING_REMOVAL,
-};
 function parseDate(v) {
     if (v === null || v === undefined)
         return null;
     return new Date(v);
 }
 export function parseTunnel(raw) {
-    const status = STATUS_REMAP_TO_PUBLIC[raw.status] ?? raw.status;
+    if (typeof raw.public_host !== "string" || raw.public_host === "") {
+        throw new Error("tunnel response missing required field 'public_host'");
+    }
+    if (typeof raw.zone !== "string" || raw.zone === "") {
+        throw new Error("tunnel response missing required field 'zone'");
+    }
     return {
         id: String(raw.id),
         organizationId: String(raw.organization_id),
         tunnelName: String(raw.tunnel_name),
-        description: raw.description ?? null,
         tlsMode: raw.tls_mode,
         certPem: raw.cert_pem ?? null,
         certFingerprintSha256: raw.cert_fingerprint_sha256 ?? null,
         certExpiresAt: parseDate(raw.cert_expires_at),
-        status,
+        status: raw.status,
         lastConnectedAt: parseDate(raw.last_connected_at),
         lastConnectedIpAddr: raw.last_connected_ip_addr ?? null,
-        restoreDeadlineAt: parseDate(raw.restore_deadline_at),
         currentlyConnected: Boolean(raw.currently_connected),
-        publicHost: raw.public_host ?? null,
-        zone: raw.zone ?? null,
+        publicHost: raw.public_host,
+        zone: raw.zone,
         metadata: raw.metadata && typeof raw.metadata === "object" ? { ...raw.metadata } : {},
         createdAt: new Date(raw.created_at),
         updatedAt: new Date(raw.updated_at),
     };
 }
-export function parseCreatedTunnel(raw) {
-    return { tunnel: parseTunnel(raw.tunnel), connectSecret: raw.connect_secret };
-}
-export function parseRotatedSecret(raw) {
-    return { connectSecret: raw.connect_secret };
-}
 export function parseSignedCert(raw) {
     return {
         certPem: raw.cert_pem,

package/dist/tunnels/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tunnels/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAN,IAAY,OAGX;AAHD,WAAY,OAAO;IACjB,wBAAa,CAAA;IACb,sCAA2B,CAAA;AAC7B,CAAC,EAHW,OAAO,KAAP,OAAO,QAGlB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,+CAA+B,CAAA;IAC/B,iCAAiB,CAAA;IACjB,mDAAmC,CAAA;AACrC,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED,MAAM,sBAAsB,GAAiC;IAC3D,aAAa,EAAE,YAAY,CAAC,aAAa;IACzC,MAAM,EAAE,YAAY,CAAC,MAAM;IAC3B,cAAc,EAAE,YAAY,CAAC,eAAe;CAC7C,CAAC;AA8EF,SAAS,SAAS,CAAC,CAA4B;IAC7C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAc;IACxC,MAAM,MAAM,GACV,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAK,GAAG,CAAC,MAAuB,CAAC;IACrE,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3C,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QACnC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,OAAO,EAAE,GAAG,CAAC,QAAmB;QAChC,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;QAC7B,qBAAqB,EAAE,GAAG,CAAC,uBAAuB,IAAI,IAAI;QAC1D,aAAa,EAAE,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC;QAC7C,MAAM;QACN,eAAe,EAAE,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACjD,mBAAmB,EAAE,GAAG,CAAC,sBAAsB,IAAI,IAAI;QACvD,iBAAiB,EAAE,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACrD,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACpD,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACnC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;QACtB,QAAQ,EACN,GAAG,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE;QAC7E,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QACnC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAqB;IACtD,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAqB;IACtD,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAkB;IAChD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,qBAAqB,EAAE,GAAG,CAAC,uBAAuB;QAClD,aAAa,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;KAC7C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tunnels/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAN,IAAY,OAGX;AAHD,WAAY,OAAO;IACjB,wBAAa,CAAA;IACb,sCAA2B,CAAA;AAC7B,CAAC,EAHW,OAAO,KAAP,OAAO,QAGlB;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,+CAA+B,CAAA;IAC/B,iCAAiB,CAAA;IACjB,mCAAmB,CAAA;AACrB,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AA8DD,SAAS,SAAS,CAAC,CAA4B;IAC7C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAc;IACxC,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3C,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QACnC,OAAO,EAAE,GAAG,CAAC,QAAmB;QAChC,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;QAC7B,qBAAqB,EAAE,GAAG,CAAC,uBAAuB,IAAI,IAAI;QAC1D,aAAa,EAAE,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC;QAC7C,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,eAAe,EAAE,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACjD,mBAAmB,EAAE,GAAG,CAAC,sBAAsB,IAAI,IAAI;QACvD,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACpD,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EACN,GAAG,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE;QAC7E,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QACnC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAkB;IAChD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,qBAAqB,EAAE,GAAG,CAAC,uBAAuB;QAClD,aAAa,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;KAC7C,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inkbox/sdk",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "TypeScript SDK for the Inkbox API",
   "license": "MIT",
   "type": "module",

package/protocol/tunnel_protocol_constants.json

@@ -33,7 +33,7 @@
   },
   "ControlHeaders": {
     "TUNNEL_ID": "x-tunnel-id",
-    "TUNNEL_SECRET": "x-tunnel-secret",
+    "API_KEY": "x-api-key",
     "OWNER_TOKEN": "x-owner-token",
     "POOL_SLOT": "x-pool-slot",
     "POOL_SIZE": "x-pool-size"