@inkbox/sdk 0.3.2 → 0.4.1

package/dist/tunnels/client/index.js

@@ -12,11 +12,11 @@
  * (`@inkbox/sdk`) stays browser-safe; only this subpath gates on Node.
  */
 import { POOL_SIZE_MAX, POOL_SIZE_MIN } from "../resources/tunnels.js";
-import { TunnelRemoved, TunnelSecretUnavailable, TunnelStateConflict, } from "../exceptions.js";
+import { TunnelNotProvisioned, TunnelRemoved, TunnelStateConflict, } from "../exceptions.js";
 import { validateTunnelName } from "../_validation.js";
-import { TLSMode, TunnelStatus } from "../types.js";
+import { TLSMode } from "../types.js";
 import { validateForwardTarget, } from "./_validation.js";
-import { defaultStateDir, ensurePrivateStateDir, loadState, printSecretOnce, saveState, } from "./_state.js";
+import { defaultStateDir, ensurePrivateStateDir, loadState, saveState, } from "./_state.js";
 import { TunnelListenerImpl, } from "./_listener.js";
 import { DEFAULT_INBOUND_BODY_BYTES, DEFAULT_OUTBOUND_BODY_BYTES, TunnelRuntime, } from "./_runtime.js";
 export { ForwardTargetRefused, validateEnvelopePath, validateForwardTarget, } from "./_validation.js";
@@ -30,7 +30,7 @@ export const PROD_ZONE = "inkboxwire.com";
  * `wsHandler` set without an HTTP path.
  *
  * Validation runs synchronously before any control-plane writes: a
- * tunnel is never created or restored for an invalid configuration.
+ * tunnel is never opened for an invalid configuration.
  */
 export class InvalidConnectOptions extends Error {
     constructor(message) {
@@ -38,6 +38,7 @@ export class InvalidConnectOptions extends Error {
         this.name = "InvalidConnectOptions";
     }
 }
+export { TunnelNotProvisioned } from "../exceptions.js";
 function validatePoolSize(poolSize) {
     if (poolSize === undefined)
         return;
@@ -67,15 +68,17 @@ function validateDispatchOptions(opts) {
     }
 }
 function resolveZoneAndHost(opts) {
-    const publicHost = opts.serverPublicHost ?? opts.state?.publicHost ?? `${opts.name}.${PROD_ZONE}`;
-    const zone = opts.dataPlaneZoneOverride ??
-        opts.serverZone ??
-        opts.state?.zone ??
-        PROD_ZONE;
-    return { zone, publicHost };
+    const zone = opts.dataPlaneZoneOverride ?? opts.serverZone;
+    return { zone, publicHost: opts.serverPublicHost };
 }
 /**
  * Bring a tunnel online from this Node process.
+ *
+ * The tunnel must already exist in the calling org (provisioned by
+ * `inkbox.createIdentity(...)`). Data-plane authentication uses the
+ * same API key the `inkbox` client was constructed with — an
+ * identity-scoped key must match the tunnel's identity, or an
+ * admin-scoped key in the same org.
  */
 export async function connect(inkbox, options) {
     // --- Synchronous validation (cheap; runs before any disk or server I/O) ---
@@ -87,17 +90,9 @@ export async function connect(inkbox, options) {
             allowRemoteForwarding: options.allowRemoteForwarding,
         });
     }
-    const tlsMode = (typeof options.tlsMode === "string"
-        ? options.tlsMode
-        : options.tlsMode) ?? TLSMode.EDGE;
-    // Passthrough accepts both http:// and https:// forwardTo URLs.
-    // UpstreamUrlDispatch builds undici's tls.connect options from
-    // forwardToVerifyTls / forwardToCaBundle for https:// upstreams.
-    const onPendingRemoval = options.onPendingRemoval ?? "auto_restore";
     const stateDirPath = options.stateDir ?? defaultStateDir(options.name);
     ensurePrivateStateDir(stateDirPath);
     const state = loadState(stateDirPath);
-    let secret = options.secret ?? state?.secret ?? null;
     let tunnel = null;
     if (state?.tunnelId) {
         try {
@@ -107,7 +102,7 @@ export async function connect(inkbox, options) {
             const apiErr = err;
             if (apiErr?.statusCode === 404) {
                 throw new TunnelRemoved(`tunnel ${options.name} (id=${state.tunnelId}) has been removed; ` +
-                    `clear ${stateDirPath} and call inkbox.tunnels.create() to start fresh`);
+                    `clear ${stateDirPath} and call inkbox.createIdentity(${JSON.stringify(options.name)}) to start fresh`);
             }
             throw err;
         }
@@ -117,47 +112,9 @@ export async function connect(inkbox, options) {
         tunnel = list.find((t) => t.tunnelName === options.name) ?? null;
     }
     if (!tunnel) {
-        const created = await inkbox.tunnels.create({
-            tunnelName: options.name,
-            tlsMode,
-            description: options.description,
-        });
-        tunnel = created.tunnel;
-        secret = created.connectSecret;
-        saveState(stateDirPath, {
-            tunnelId: tunnel.id,
-            name: options.name,
-            secret,
-            mode: tlsMode,
-            zone: tunnel.zone,
-            publicHost: tunnel.publicHost,
-        });
-        printSecretOnce({
-            secret,
-            statePath: `${stateDirPath}/state.json`,
-            printToStderr: options.printSecretToStderr ?? null,
-        });
-    }
-    else {
-        if (tunnel.tlsMode !== tlsMode) {
-            throw new TunnelStateConflict(409, `tls_mode mismatch: requested ${tlsMode} but tunnel reports ${tunnel.tlsMode}. ` +
-                "tls_mode is fixed at creation; delete the tunnel and recreate to change it.");
-        }
-        if (tunnel.status === TunnelStatus.PENDING_REMOVAL) {
-            if (onPendingRemoval === "error") {
-                throw new TunnelStateConflict(409, `tunnel ${options.name} is in pending_removal; pass ` +
-                    "onPendingRemoval: 'auto_restore' to bring it back");
-            }
-            if (!secret) {
-                throw new TunnelSecretUnavailable(`connect_secret not available locally for tunnel ${options.name}; ` +
-                    "pass secret explicitly, or rotate via inkbox.tunnels.rotateSecret(id) first.");
-            }
-            tunnel = await inkbox.tunnels.restore(tunnel.id);
-        }
-        if (!secret) {
-            throw new TunnelSecretUnavailable(`connect_secret not available locally for tunnel ${options.name}; ` +
-                "pass secret explicitly, or rotate via inkbox.tunnels.rotateSecret(id) first.");
-        }
+        throw new TunnelNotProvisioned(`no tunnel named ${JSON.stringify(options.name)} exists in this org. ` +
+            "Tunnels are provisioned atomically by inkbox.createIdentity(<handle>); " +
+            `call inkbox.createIdentity(${JSON.stringify(options.name)}) first.`);
     }
     // For passthrough, lazy-load _cert.ts so the edge-mode bundle stays
     // clean of @peculiar/x509. The dynamic import keeps the dep out of
@@ -171,9 +128,8 @@ export async function connect(inkbox, options) {
         const cert = await import("./_cert.js");
         const tls = await import("./_tls.js");
         const keypair = await cert.loadOrCreateKeypair(stateDirPath);
-        const tunnelPublicHost = tunnel.publicHost ?? `${options.name}.${PROD_ZONE}`;
         if (await cert.certNeedsSign(stateDirPath, keypair)) {
-            const csrPem = await cert.buildCsr(keypair, tunnelPublicHost);
+            const csrPem = await cert.buildCsr(keypair, tunnel.publicHost);
             const signed = await inkbox.tunnels.signCsr(tunnel.id, { csrPem });
             cert.writeCertChain(stateDirPath, signed.certPem, signed.chainPem);
         }
@@ -199,20 +155,18 @@ export async function connect(inkbox, options) {
         name: options.name,
         serverZone: tunnel.zone,
         serverPublicHost: tunnel.publicHost,
-        state,
         dataPlaneZoneOverride: options.dataPlaneZone ?? null,
     });
     saveState(stateDirPath, {
         tunnelId: tunnel.id,
         name: options.name,
-        secret,
         mode: tunnel.tlsMode,
         zone,
         publicHost,
     });
     const runtime = new TunnelRuntime({
         tunnelId: tunnel.id,
-        secret,
+        apiKey: inkbox._apiKey,
         zone,
         publicHost,
         poolSize: options.poolSize ?? null,
@@ -239,4 +193,5 @@ export async function connect(inkbox, options) {
         listenerOpts,
     });
 }
+void TunnelStateConflict; // retained for re-export breadth on the surviving surface
 //# sourceMappingURL=index.js.map

package/dist/tunnels/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tunnels/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAU,YAAY,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAGL,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,SAAS,EACT,eAAe,EACf,SAAS,GACV,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,GAInB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,aAAa,GACd,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAO1B,OAAO,EACL,wBAAwB,EACxB,QAAQ,EACR,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AA8DD,SAAS,gBAAgB,CAAC,QAA4B;IACpD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO;IACnC,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC3B,QAAQ,GAAG,aAAa;QACxB,QAAQ,GAAG,aAAa,EACxB,CAAC;QACD,MAAM,IAAI,UAAU,CAClB,mCAAmC,aAAa,KAAK,aAAa,UAAU,QAAQ,GAAG,CACxF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,IAAoB;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC;IAC3C,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,qBAAqB,CAC7B,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,IAAI,qBAAqB,CAC7B,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,IAAI,KAAK,EAAE,CAAC;QACxC,MAAM,IAAI,qBAAqB,CAC7B,oEAAoE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAM3B;IACC,MAAM,UAAU,GACd,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,KAAK,EAAE,UAAU,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;IACjF,MAAM,IAAI,GACR,IAAI,CAAC,qBAAqB;QAC1B,IAAI,CAAC,UAAU;QACf,IAAI,CAAC,KAAK,EAAE,IAAI;QAChB,SAAS,CAAC;IACZ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAc,EACd,OAAuB;IAEvB,6EAA6E;IAC7E,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE;YACvC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;SACrD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GACX,CAAC,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QAClC,CAAC,CAAE,OAAO,CAAC,OAAmB;QAC9B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;IAEvC,gEAAgE;IAChE,+DAA+D;IAC/D,iEAAiE;IACjE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,cAAc,CAAC;IACpE,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvE,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IAEtC,IAAI,MAAM,GAAkB,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC;IACpE,IAAI,MAAM,GAAkB,IAAI,CAAC;IAEjC,IAAI,KAAK,EAAE,QAAQ,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,GAA8B,CAAC;YAC9C,IAAI,MAAM,EAAE,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC/B,MAAM,IAAI,aAAa,CACrB,UAAU,OAAO,CAAC,IAAI,QAAQ,KAAK,CAAC,QAAQ,sBAAsB;oBAChE,SAAS,YAAY,kDAAkD,CAC1E,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1C,UAAU,EAAE,OAAO,CAAC,IAAI;YACxB,OAAO;YACP,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;QACH,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACxB,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;QAC/B,SAAS,CAAC,YAAY,EAAE;YACtB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC;QACH,eAAe,CAAC;YACd,MAAM;YACN,SAAS,EAAE,GAAG,YAAY,aAAa;YACvC,aAAa,EAAE,OAAO,CAAC,mBAAmB,IAAI,IAAI;SACnD,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,mBAAmB,CAC3B,GAAG,EACH,gCAAgC,OAAO,uBAAuB,MAAM,CAAC,OAAO,IAAI;gBAC9E,6EAA6E,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,eAAe,EAAE,CAAC;YACnD,IAAI,gBAAgB,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,IAAI,mBAAmB,CAC3B,GAAG,EACH,UAAU,OAAO,CAAC,IAAI,+BAA+B;oBACnD,mDAAmD,CACtD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,uBAAuB,CAC/B,mDAAmD,OAAO,CAAC,IAAI,IAAI;oBACjE,8EAA8E,CACjF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,uBAAuB,CAC/B,mDAAmD,OAAO,CAAC,IAAI,IAAI;gBACjE,8EAA8E,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,wBAAwB;IACxB,IAAI,aAAa,GAA6C,IAAI,CAAC;IACnE,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3C,gEAAgE;QAChE,qEAAqE;QACrE,mCAAmC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,gBAAgB,GACpB,MAAM,CAAC,UAAU,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;QACtD,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,YAAY,iBAAiB,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CACvD,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC/B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC/C,mEAAmE;QACnE,iEAAiE;QACjE,8DAA8D;QAC9D,iEAAiE;QACjE,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC;QACrD,MAAM,aAAa,GAAG,QAAQ;YAC5B,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;YACpB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACjB,aAAa,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC;YACpC,YAAY;YACZ,MAAM;YACN,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC;QAC9C,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,gBAAgB,EAAE,MAAM,CAAC,UAAU;QACnC,KAAK;QACL,qBAAqB,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;KACrD,CAAC,CAAC;IAEH,SAAS,CAAC,YAAY,EAAE;QACtB,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,OAAO;QACpB,IAAI;QACJ,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;QAChC,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,MAAM;QACN,IAAI;QACJ,UAAU;QACV,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,QAAQ,EAAE;YACR,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B;QACD,aAAa,EAAE,aAAa,IAAI,SAAS;QACzC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,0BAA0B;QAC9E,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,2BAA2B;QACzE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,MAAM,YAAY,GAAuB;QACvC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;KACrD,CAAC;IACF,OAAO,IAAI,kBAAkB,CAAC;QAC5B,UAAU;QACV,MAAM;QACN,OAAO;QACP,YAAY;KACb,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tunnels/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAU,MAAM,aAAa,CAAC;AAC9C,OAAO,EAGL,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,SAAS,EACT,SAAS,GACV,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,GAInB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,aAAa,GACd,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAO1B,OAAO,EACL,wBAAwB,EACxB,QAAQ,EACR,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAwDxD,SAAS,gBAAgB,CAAC,QAA4B;IACpD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO;IACnC,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC3B,QAAQ,GAAG,aAAa;QACxB,QAAQ,GAAG,aAAa,EACxB,CAAC;QACD,MAAM,IAAI,UAAU,CAClB,mCAAmC,aAAa,KAAK,aAAa,UAAU,QAAQ,GAAG,CACxF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,IAAoB;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC;IAC3C,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,qBAAqB,CAC7B,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,IAAI,qBAAqB,CAC7B,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,IAAI,KAAK,EAAE,CAAC;QACxC,MAAM,IAAI,qBAAqB,CAC7B,oEAAoE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAK3B;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,qBAAqB,IAAI,IAAI,CAAC,UAAU,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAc,EACd,OAAuB;IAEvB,6EAA6E;IAC7E,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE;YACvC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;SACrD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IAEtC,IAAI,MAAM,GAAkB,IAAI,CAAC;IAEjC,IAAI,KAAK,EAAE,QAAQ,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,GAA8B,CAAC;YAC9C,IAAI,MAAM,EAAE,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC/B,MAAM,IAAI,aAAa,CACrB,UAAU,OAAO,CAAC,IAAI,QAAQ,KAAK,CAAC,QAAQ,sBAAsB;oBAChE,SAAS,YAAY,mCAAmC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CACzG,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAC5B,mBAAmB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,uBAAuB;YACpE,yEAAyE;YACzE,8BAA8B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CACvE,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,wBAAwB;IACxB,IAAI,aAAa,GAA6C,IAAI,CAAC;IACnE,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3C,gEAAgE;QAChE,qEAAqE;QACrE,mCAAmC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,YAAY,iBAAiB,CAAC;QAClD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CACvD,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC/B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC/C,mEAAmE;QACnE,iEAAiE;QACjE,8DAA8D;QAC9D,iEAAiE;QACjE,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC;QACrD,MAAM,aAAa,GAAG,QAAQ;YAC5B,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;YACpB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACjB,aAAa,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC;YACpC,YAAY;YACZ,MAAM;YACN,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC;QAC9C,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,gBAAgB,EAAE,MAAM,CAAC,UAAU;QACnC,qBAAqB,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;KACrD,CAAC,CAAC;IAEH,SAAS,CAAC,YAAY,EAAE;QACtB,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,MAAM,CAAC,OAAO;QACpB,IAAI;QACJ,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;QAChC,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,MAAM,EAAE,MAAM,CAAC,OAAO;QACtB,IAAI;QACJ,UAAU;QACV,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,QAAQ,EAAE;YACR,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B;QACD,aAAa,EAAE,aAAa,IAAI,SAAS;QACzC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,0BAA0B;QAC9E,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,2BAA2B;QACzE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,MAAM,YAAY,GAAuB;QACvC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;KACrD,CAAC;IACF,OAAO,IAAI,kBAAkB,CAAC;QAC5B,UAAU;QACV,MAAM;QACN,OAAO;QACP,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED,KAAK,mBAAmB,CAAC,CAAC,0DAA0D"}

package/dist/tunnels/exceptions.d.ts

@@ -10,22 +10,24 @@ export declare class TunnelError extends InkboxError {
 export declare class TunnelNameInvalid extends TunnelError {
     constructor(message: string);
 }
-export declare class TunnelSecretUnavailable extends TunnelError {
-    constructor(message: string);
-}
 export declare class TunnelRemoved extends TunnelError {
     constructor(message: string);
 }
 export declare class TunnelStateConflict extends InkboxAPIError {
     constructor(statusCode: number, detail: InkboxAPIErrorDetail);
 }
-export declare class TunnelNameUnavailable extends InkboxAPIError {
-    constructor(statusCode: number, detail: InkboxAPIErrorDetail);
-}
 export declare class TunnelTLSModeMismatch extends InkboxAPIError {
     constructor(statusCode: number, detail: InkboxAPIErrorDetail);
 }
 export declare class TunnelCSRStateConflict extends TunnelStateConflict {
     constructor(statusCode: number, detail: InkboxAPIErrorDetail);
 }
+/**
+ * Raised by `connect()` when no tunnel exists for the supplied name in
+ * the calling org. Tunnels are provisioned atomically as part of
+ * `inkbox.createIdentity(...)`; they have no standalone create surface.
+ */
+export declare class TunnelNotProvisioned extends TunnelError {
+    constructor(message: string);
+}
 //# sourceMappingURL=exceptions.d.ts.map

package/dist/tunnels/exceptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/tunnels/exceptions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,cAAc,EACd,WAAW,EACX,KAAK,oBAAoB,EAC1B,MAAM,aAAa,CAAC;AAErB,qBAAa,WAAY,SAAQ,WAAW;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAkB,SAAQ,WAAW;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,uBAAwB,SAAQ,WAAW;gBAC1C,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,aAAc,SAAQ,WAAW;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAgBD,qBAAa,mBAAoB,SAAQ,cAAc;gBACzC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB;CAI7D;AAED,qBAAa,qBAAsB,SAAQ,cAAc;gBAC3C,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB;CAI7D;AAED,qBAAa,qBAAsB,SAAQ,cAAc;gBAC3C,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB;CAI7D;AAED,qBAAa,sBAAuB,SAAQ,mBAAmB;gBACjD,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB;CAI7D"}
+{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/tunnels/exceptions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,cAAc,EACd,WAAW,EACX,KAAK,oBAAoB,EAC1B,MAAM,aAAa,CAAC;AAErB,qBAAa,WAAY,SAAQ,WAAW;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAkB,SAAQ,WAAW;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,aAAc,SAAQ,WAAW;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,cAAc;gBACzC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB;CAI7D;AAED,qBAAa,qBAAsB,SAAQ,cAAc;gBAC3C,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB;CAI7D;AAED,qBAAa,sBAAuB,SAAQ,mBAAmB;gBACjD,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB;CAI7D;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,WAAW;gBACvC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/tunnels/exceptions.js

@@ -16,41 +16,16 @@ export class TunnelNameInvalid extends TunnelError {
         this.name = "TunnelNameInvalid";
     }
 }
-export class TunnelSecretUnavailable extends TunnelError {
-    constructor(message) {
-        super(message);
-        this.name = "TunnelSecretUnavailable";
-    }
-}
 export class TunnelRemoved extends TunnelError {
     constructor(message) {
         super(message);
         this.name = "TunnelRemoved";
     }
 }
-function sanitizeDetail(detail) {
-    const sanitizeStr = (s) => s.replace(/delete_pending/g, "pending_removal").replace(/deleted/g, "removed");
-    if (typeof detail === "string")
-        return sanitizeStr(detail);
-    if (detail && typeof detail === "object") {
-        const out = {};
-        for (const [k, v] of Object.entries(detail)) {
-            out[k] = typeof v === "string" ? sanitizeStr(v) : v;
-        }
-        return out;
-    }
-    return detail;
-}
 export class TunnelStateConflict extends InkboxAPIError {
-    constructor(statusCode, detail) {
-        super(statusCode, sanitizeDetail(detail));
-        this.name = "TunnelStateConflict";
-    }
-}
-export class TunnelNameUnavailable extends InkboxAPIError {
     constructor(statusCode, detail) {
         super(statusCode, detail);
-        this.name = "TunnelNameUnavailable";
+        this.name = "TunnelStateConflict";
     }
 }
 export class TunnelTLSModeMismatch extends InkboxAPIError {
@@ -65,4 +40,15 @@ export class TunnelCSRStateConflict extends TunnelStateConflict {
         this.name = "TunnelCSRStateConflict";
     }
 }
+/**
+ * Raised by `connect()` when no tunnel exists for the supplied name in
+ * the calling org. Tunnels are provisioned atomically as part of
+ * `inkbox.createIdentity(...)`; they have no standalone create surface.
+ */
+export class TunnelNotProvisioned extends TunnelError {
+    constructor(message) {
+        super(message);
+        this.name = "TunnelNotProvisioned";
+    }
+}
 //# sourceMappingURL=exceptions.js.map

package/dist/tunnels/exceptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"exceptions.js","sourceRoot":"","sources":["../../src/tunnels/exceptions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,cAAc,EACd,WAAW,GAEZ,MAAM,aAAa,CAAC;AAErB,MAAM,OAAO,WAAY,SAAQ,WAAW;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,WAAW;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,WAAW;IACtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,WAAW;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,SAAS,cAAc,CAAC,MAA4B;IAClD,MAAM,WAAW,GAAG,CAAC,CAAS,EAAU,EAAE,CACxC,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACjF,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,cAAc;IACrD,YAAY,UAAkB,EAAE,MAA4B;QAC1D,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,cAAc;IACvD,YAAY,UAAkB,EAAE,MAA4B;QAC1D,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,cAAc;IACvD,YAAY,UAAkB,EAAE,MAA4B;QAC1D,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,mBAAmB;IAC7D,YAAY,UAAkB,EAAE,MAA4B;QAC1D,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF"}
+{"version":3,"file":"exceptions.js","sourceRoot":"","sources":["../../src/tunnels/exceptions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,cAAc,EACd,WAAW,GAEZ,MAAM,aAAa,CAAC;AAErB,MAAM,OAAO,WAAY,SAAQ,WAAW;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,WAAW;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,WAAW;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,cAAc;IACrD,YAAY,UAAkB,EAAE,MAA4B;QAC1D,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,cAAc;IACvD,YAAY,UAAkB,EAAE,MAA4B;QAC1D,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,mBAAmB;IAC7D,YAAY,UAAkB,EAAE,MAA4B;QAC1D,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,WAAW;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF"}

package/dist/tunnels/resources/tunnels.d.ts

@@ -1,20 +1,16 @@
 /**
  * inkbox-tunnels/resources/tunnels.ts
  *
- * Control-plane CRUD for tunnels. Wraps `/api/v1/tunnels/*`.
+ * Control-plane reads + update + sign-csr for tunnels. Tunnels are
+ * created and deleted exclusively via identity-create / identity-delete
+ * cascades; there is no standalone create / delete / restore /
+ * force-delete / rotate-secret surface.
  */
 import { HttpTransport } from "../../_http.js";
-import { CreatedTunnel, RotatedSecret, SignedCert, TLSMode, Tunnel } from "../types.js";
+import { SignedCert, Tunnel } from "../types.js";
 export declare const POOL_SIZE_MIN = 1;
 export declare const POOL_SIZE_MAX = 32;
-export interface CreateTunnelOptions {
-    tunnelName: string;
-    tlsMode?: TLSMode | "edge" | "passthrough";
-    description?: string | null;
-}
 export interface UpdateTunnelOptions {
-    /** Pass `null` to clear; omit to leave unchanged. */
-    description?: string | null;
     /**
      * Pass `{}` or `null` to clear (the server's column is non-nullable
      * and collapses both forms to `{}`); omit to leave unchanged.
@@ -27,38 +23,13 @@ export declare class TunnelsResource {
     list(): Promise<Tunnel[]>;
     get(tunnelId: string): Promise<Tunnel>;
     /**
-     * Create a new tunnel. Persist the returned `connectSecret` immediately —
-     * it is shown ONCE.
-     */
-    create(options: CreateTunnelOptions): Promise<CreatedTunnel>;
-    /**
-     * Update a tunnel. Pass only the fields you want to change.
+     * Update a tunnel's metadata. `metadata` is the only mutable field;
+     * other tunnel attributes are derived from the owning identity.
      *
-     * - `description: null` clears the description.
-     * - `metadata: {}` clears metadata. `metadata` cannot be `null`
-     *   (rejected client-side); pass `{}` to clear.
+     * - `metadata: {}` (or `null`) clears the metadata bag. The server
+     *   column is non-nullable and collapses both forms to `{}`.
      */
     update(tunnelId: string, options: UpdateTunnelOptions): Promise<Tunnel>;
-    /**
-     * Schedule a tunnel for removal. The name is held for 24 hours, during
-     * which `restore` brings it back online.
-     */
-    delete(tunnelId: string): Promise<Tunnel>;
-    /** Bring a scheduled-for-removal tunnel back online. */
-    restore(tunnelId: string): Promise<Tunnel>;
-    /**
-     * Remove a scheduled-for-removal tunnel immediately, skipping the 24-hour
-     * window. Requires an admin-scoped API key.
-     */
-    forceDelete(tunnelId: string): Promise<Tunnel>;
-    /**
-     * Rotate the per-tunnel connect secret.
-     *
-     * The new secret takes effect on the next agent reconnect; existing live
-     * connections continue serving traffic with the old secret until they
-     * reconnect.
-     */
-    rotateSecret(tunnelId: string): Promise<RotatedSecret>;
     /**
      * Sign a CSR for a passthrough tunnel.
      *

package/dist/tunnels/resources/tunnels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnels.d.ts","sourceRoot":"","sources":["../../../src/tunnels/resources/tunnels.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAkB,MAAM,gBAAgB,CAAC;AAQ/D,OAAO,EACL,aAAa,EAKb,aAAa,EACb,UAAU,EACV,OAAO,EACP,MAAM,EAKP,MAAM,aAAa,CAAC;AAMrB,eAAO,MAAM,aAAa,IAAI,CAAC;AAC/B,eAAO,MAAM,aAAa,KAAK,CAAC;AAkChC,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,aAAa,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C;AAED,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,aAAa;IAI1C,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAQzB,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAO5C;;;OAGG;IACG,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,CAAC;IAkBlE;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;IAkB7E;;;OAGG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAO/C,wDAAwD;IAClD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUhD;;;OAGG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYpD;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAO5D;;;;;;OAMG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;CAalF"}
+{"version":3,"file":"tunnels.d.ts","sourceRoot":"","sources":["../../../src/tunnels/resources/tunnels.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAkB,MAAM,gBAAgB,CAAC;AAK/D,OAAO,EAGL,UAAU,EACV,MAAM,EAGP,MAAM,aAAa,CAAC;AAMrB,eAAO,MAAM,aAAa,IAAI,CAAC;AAC/B,eAAO,MAAM,aAAa,KAAK,CAAC;AAoBhC,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C;AAED,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,aAAa;IAI1C,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAQzB,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAO5C;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;IAe7E;;;;;;OAMG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;CAalF"}

package/dist/tunnels/resources/tunnels.js

@@ -1,12 +1,14 @@
 /**
  * inkbox-tunnels/resources/tunnels.ts
  *
- * Control-plane CRUD for tunnels. Wraps `/api/v1/tunnels/*`.
+ * Control-plane reads + update + sign-csr for tunnels. Tunnels are
+ * created and deleted exclusively via identity-create / identity-delete
+ * cascades; there is no standalone create / delete / restore /
+ * force-delete / rotate-secret surface.
  */
 import { InkboxAPIError } from "../../_http.js";
-import { validateTunnelName } from "../_validation.js";
-import { TunnelCSRStateConflict, TunnelNameUnavailable, TunnelStateConflict, TunnelTLSModeMismatch, } from "../exceptions.js";
-import { TLSMode, parseCreatedTunnel, parseRotatedSecret, parseSignedCert, parseTunnel, } from "../types.js";
+import { TunnelCSRStateConflict, TunnelTLSModeMismatch, } from "../exceptions.js";
+import { parseSignedCert, parseTunnel, } from "../types.js";
 const BASE = "/tunnels";
 const SIGN_CSR_TIMEOUT_MS = 180_000;
 export const POOL_SIZE_MIN = 1;
@@ -21,18 +23,6 @@ function detailText(detail) {
     }
     return String(detail);
 }
-function mapCreateError(err) {
-    if (err.statusCode === 409) {
-        return new TunnelNameUnavailable(err.statusCode, err.detail);
-    }
-    return err;
-}
-function mapStateError(err) {
-    if (err.statusCode === 409) {
-        return new TunnelStateConflict(err.statusCode, err.detail);
-    }
-    return err;
-}
 function mapSignCsrError(err) {
     if (err.statusCode !== 409)
         return err;
@@ -59,40 +49,14 @@ export class TunnelsResource {
     }
     // --- Writes ----------------------------------------------------------
     /**
-     * Create a new tunnel. Persist the returned `connectSecret` immediately —
-     * it is shown ONCE.
-     */
-    async create(options) {
-        validateTunnelName(options.tunnelName);
-        const body = {
-            tunnel_name: options.tunnelName,
-            tls_mode: options.tlsMode ?? TLSMode.EDGE,
-        };
-        if (options.description !== undefined && options.description !== null) {
-            body.description = options.description;
-        }
-        try {
-            const data = await this.http.post(`${BASE}/`, body);
-            return parseCreatedTunnel(data);
-        }
-        catch (err) {
-            if (err instanceof InkboxAPIError)
-                throw mapCreateError(err);
-            throw err;
-        }
-    }
-    /**
-     * Update a tunnel. Pass only the fields you want to change.
+     * Update a tunnel's metadata. `metadata` is the only mutable field;
+     * other tunnel attributes are derived from the owning identity.
      *
-     * - `description: null` clears the description.
-     * - `metadata: {}` clears metadata. `metadata` cannot be `null`
-     *   (rejected client-side); pass `{}` to clear.
+     * - `metadata: {}` (or `null`) clears the metadata bag. The server
+     *   column is non-nullable and collapses both forms to `{}`.
      */
     async update(tunnelId, options) {
         const body = {};
-        if ("description" in options) {
-            body.description = options.description;
-        }
         if ("metadata" in options) {
             const m = options.metadata;
             if (m !== null && m !== undefined) {
@@ -105,52 +69,6 @@ export class TunnelsResource {
         const data = await this.http.patch(`${BASE}/${tunnelId}`, body);
         return parseTunnel(data);
     }
-    /**
-     * Schedule a tunnel for removal. The name is held for 24 hours, during
-     * which `restore` brings it back online.
-     */
-    async delete(tunnelId) {
-        const data = await this.http.deleteWithResponse(`${BASE}/${tunnelId}`);
-        return parseTunnel(data);
-    }
-    /** Bring a scheduled-for-removal tunnel back online. */
-    async restore(tunnelId) {
-        try {
-            const data = await this.http.post(`${BASE}/${tunnelId}/restore`);
-            return parseTunnel(data);
-        }
-        catch (err) {
-            if (err instanceof InkboxAPIError)
-                throw mapStateError(err);
-            throw err;
-        }
-    }
-    /**
-     * Remove a scheduled-for-removal tunnel immediately, skipping the 24-hour
-     * window. Requires an admin-scoped API key.
-     */
-    async forceDelete(tunnelId) {
-        try {
-            const data = await this.http.deleteWithResponse(`${BASE}/${tunnelId}/force`);
-            return parseTunnel(data);
-        }
-        catch (err) {
-            if (err instanceof InkboxAPIError)
-                throw mapStateError(err);
-            throw err;
-        }
-    }
-    /**
-     * Rotate the per-tunnel connect secret.
-     *
-     * The new secret takes effect on the next agent reconnect; existing live
-     * connections continue serving traffic with the old secret until they
-     * reconnect.
-     */
-    async rotateSecret(tunnelId) {
-        const data = await this.http.post(`${BASE}/${tunnelId}/rotate-secret`);
-        return parseRotatedSecret(data);
-    }
     /**
      * Sign a CSR for a passthrough tunnel.
      *

package/dist/tunnels/resources/tunnels.js.map

@@ -1 +1 @@
-{"version":3,"file":"tunnels.js","sourceRoot":"","sources":["../../../src/tunnels/resources/tunnels.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAiB,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAQL,OAAO,EAEP,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,MAAM,IAAI,GAAG,UAAU,CAAC;AAExB,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAEpC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,KAAK,GAAI,MAAkC,CAAC,MAAM,CAAC;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,GAAmB;IACzC,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,GAAmB;IACxC,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB;IAC1C,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,sBAAsB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC;AAkBD,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,IAAmB;QAAnB,SAAI,GAAJ,IAAI,CAAe;IAAG,CAAC;IAEpD,wEAAwE;IAExE,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9B,GAAG,IAAI,GAAG,CACX,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QACxD,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAY,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC;QACnE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,wEAAwE;IAExE;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,OAA4B;QACvC,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,IAAI,GAA4B;YACpC,WAAW,EAAE,OAAO,CAAC,UAAU;YAC/B,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI;SAC1C,CAAC;QACF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YACtE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACzC,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAmB,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC;YACtE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc;gBAAE,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,OAA4B;QACzD,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,aAAa,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACzC,CAAC;QACD,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,IAAI,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAY,GAAG,IAAI,IAAI,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3E,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAC7C,GAAG,IAAI,IAAI,QAAQ,EAAE,CACtB,CAAC;QACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAY,GAAG,IAAI,IAAI,QAAQ,UAAU,CAAC,CAAC;YAC5E,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc;gBAAE,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;YAC5D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAC7C,GAAG,IAAI,IAAI,QAAQ,QAAQ,CAC5B,CAAC;YACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc;gBAAE,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;YAC5D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAC/B,GAAG,IAAI,IAAI,QAAQ,gBAAgB,CACpC,CAAC;QACF,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,OAA2B;QACzD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAC/B,GAAG,IAAI,IAAI,QAAQ,WAAW,EAC9B,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EAC3B,EAAE,SAAS,EAAE,mBAAmB,EAAE,CACnC,CAAC;YACF,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc;gBAAE,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC9D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"tunnels.js","sourceRoot":"","sources":["../../../src/tunnels/resources/tunnels.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAiB,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAKL,eAAe,EACf,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,MAAM,IAAI,GAAG,UAAU,CAAC;AAExB,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAEpC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,KAAK,GAAI,MAAkC,CAAC,MAAM,CAAC;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB;IAC1C,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,sBAAsB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC;AAUD,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,IAAmB;QAAnB,SAAI,GAAJ,IAAI,CAAe;IAAG,CAAC;IAEpD,wEAAwE;IAExE,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9B,GAAG,IAAI,GAAG,CACX,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QACxD,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAY,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC;QACnE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,wEAAwE;IAExE;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,OAA4B;QACzD,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,IAAI,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAY,GAAG,IAAI,IAAI,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3E,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,OAA2B;QACzD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAC/B,GAAG,IAAI,IAAI,QAAQ,WAAW,EAC9B,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EAC3B,EAAE,SAAS,EAAE,mBAAmB,EAAE,CACnC,CAAC;YACF,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc;gBAAE,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC9D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF"}

package/dist/tunnels/types.d.ts

@@ -13,46 +13,41 @@ export declare enum TLSMode {
  * - `awaiting_cert`: passthrough-only intermediate state. Inbound TLS
  *   will fail until you call `tunnels.signCsr(...)`.
  * - `active`: routable end-to-end.
- * - `pending_removal`: `delete` was called; the name is held for 24h
- *   during which `tunnels.restore(id)` brings it back. After 24h the
- *   tunnel is permanently removed and its name is released. Past that
- *   point a `GET` for the tunnel id returns 404; `TunnelRemoved`
- *   surfaces that condition for clients holding stale state.
+ * - `deleted`: terminal. The tunnel is offline. Tunnels are deleted
+ *   exclusively via the identity-delete cascade — there is no direct
+ *   tunnel-delete surface.
  */
 export declare enum TunnelStatus {
     AWAITING_CERT = "awaiting_cert",
     ACTIVE = "active",
-    PENDING_REMOVAL = "pending_removal"
+    DELETED = "deleted"
 }
 export interface Tunnel {
     id: string;
     organizationId: string;
     tunnelName: string;
-    description: string | null;
     tlsMode: TLSMode;
     certPem: string | null;
     certFingerprintSha256: string | null;
     certExpiresAt: Date | null;
-    status: TunnelStatus;
+    /**
+     * One of the known {@link TunnelStatus} values, or — if the server
+     * returns a status the SDK doesn't recognize — the raw string. Future
+     * statuses survive parsing without fail-open coercion; callers should
+     * handle a `string` default branch alongside the enum cases.
+     */
+    status: TunnelStatus | string;
     lastConnectedAt: Date | null;
     lastConnectedIpAddr: string | null;
-    restoreDeadlineAt: Date | null;
     currentlyConnected: boolean;
-    publicHost: string | null;
-    zone: string | null;
+    /** Customer-facing hostname — e.g. `my-agent.inkboxwire.com` in production. Lower environments use a different tunnel zone. Non-null for live tunnels. */
+    publicHost: string;
+    /** Zone endpoint for the data-plane. Agents connect to `https://{zone}/_system/connect`. In production this is `inkboxwire.com`; lower environments use a different zone. Non-null for live tunnels. */
+    zone: string;
     metadata: Record<string, unknown>;
     createdAt: Date;
     updatedAt: Date;
 }
-export interface CreatedTunnel {
-    tunnel: Tunnel;
-    /** Shown ONCE — persist immediately. */
-    connectSecret: string;
-}
-export interface RotatedSecret {
-    /** New secret. Takes effect on the next agent reconnect. */
-    connectSecret: string;
-}
 export interface SignedCert {
     certPem: string;
     chainPem: string;
@@ -63,7 +58,6 @@ export interface RawTunnel {
     id: string;
     organization_id: string;
     tunnel_name: string;
-    description: string | null;
     tls_mode: string;
     cert_pem: string | null;
     cert_fingerprint_sha256: string | null;
@@ -71,21 +65,13 @@ export interface RawTunnel {
     status: string;
     last_connected_at: string | null;
     last_connected_ip_addr: string | null;
-    restore_deadline_at: string | null;
     currently_connected: boolean;
-    public_host?: string | null;
-    zone?: string | null;
+    public_host: string;
+    zone: string;
     metadata?: Record<string, unknown> | null;
     created_at: string;
     updated_at: string;
 }
-export interface RawCreatedTunnel {
-    tunnel: RawTunnel;
-    connect_secret: string;
-}
-export interface RawRotatedSecret {
-    connect_secret: string;
-}
 export interface RawSignedCert {
     cert_pem: string;
     chain_pem: string;
@@ -93,7 +79,5 @@ export interface RawSignedCert {
     cert_expires_at: string;
 }
 export declare function parseTunnel(raw: RawTunnel): Tunnel;
-export declare function parseCreatedTunnel(raw: RawCreatedTunnel): CreatedTunnel;
-export declare function parseRotatedSecret(raw: RawRotatedSecret): RotatedSecret;
 export declare function parseSignedCert(raw: RawSignedCert): SignedCert;
 //# sourceMappingURL=types.d.ts.map