@rstreamlabs/tunnels 1.0.5 → 1.0.7

package/dist/index.mjs

@@ -1,3 +1,23 @@
+import {
+  clientFilterSchema,
+  clientSchema,
+  engineOpenApiDocument,
+  engineOpenApiJson,
+  eventSchema,
+  formatTunnelHost,
+  listClientsParamsSchema,
+  listClientsResponseSchema,
+  listTunnelsParamsSchema,
+  listTunnelsResponseSchema,
+  streamEndpointSchema,
+  streamSummarySchema,
+  streamTLSInfoSchema,
+  tunnelFilterSchema,
+  tunnelSchema,
+  webhookEventsSchema,
+  wsEventsSchema
+} from "./chunk-OPJKEDVS.mjs";
+
 // src/auth-resource.ts
 import { createClientCredentialsToken } from "@rstreamlabs/rstream";
 
@@ -44,63 +64,15 @@ function select(base) {
   return z.object(shape);
 }
 
-// src/tunnel.ts
-import * as z2 from "zod";
-var tunnelSchema = z2.object({
-  // common properties
-  client_id: z2.string(),
-  user_id: z2.string().optional(),
-  workspace_id: z2.string().optional(),
-  project_id: z2.string().optional(),
-  cluster_id: z2.string().optional(),
-  plan: z2.string().optional(),
-  provider: z2.string().optional(),
-  region: z2.string().optional(),
-  status: z2.enum(["online", "offline"]),
-  // tunnel properties
-  id: z2.string(),
-  creation_date: z2.union([z2.string().datetime(), z2.date()]).optional(),
-  name: z2.string().optional(),
-  type: z2.enum(["bytestream", "datagram"]).optional(),
-  publish: z2.boolean().optional(),
-  protocol: z2.enum(["tls", "dtls", "quic", "http"]).optional(),
-  labels: z2.record(z2.string(), z2.string()).optional(),
-  geo_ip: z2.array(z2.string()).optional(),
-  trusted_ips: z2.array(z2.string()).optional(),
-  host: z2.string().optional(),
-  tls_mode: z2.enum(["passthrough", "terminated"]).optional(),
-  tls_alpns: z2.array(z2.string()).optional(),
-  tls_min_version: z2.string().optional(),
-  tls_ciphers: z2.array(z2.string()).optional(),
-  mtls: z2.boolean().optional(),
-  mtls_ca_cert_pem: z2.string().optional(),
-  http_version: z2.enum(["http/1.1", "h2", "h2c", "h3"]).optional(),
-  http_use_tls: z2.boolean().optional(),
-  token_auth: z2.boolean().optional(),
-  rstream_auth: z2.boolean().optional(),
-  challenge_mode: z2.boolean().optional()
-});
-var listTunnelsParamsSchema = z2.object({
-  limit: z2.number().optional(),
-  filters: tunnelSchema.pick({
-    status: true,
-    client_id: true,
-    protocol: true,
-    publish: true,
-    labels: true
-  }).partial().optional()
-});
-var listTunnelsResponseSchema = z2.array(tunnelSchema);
-
 // src/auth.ts
-import * as z3 from "zod";
-var nonEmptyStringSchema = z3.string().trim().min(1);
-var authTokenPermissionsSchema = z3.array(z3.string());
-var authTokenTunnelsScopesSchema = z3.object({
+import * as z2 from "zod";
+var nonEmptyStringSchema = z2.string().trim().min(1);
+var authTokenPermissionsSchema = z2.array(z2.string());
+var authTokenTunnelsScopesSchema = z2.object({
   // Scopes for creating tunnels
-  create: z3.union([
-    z3.boolean(),
-    z3.object({
+  create: z2.union([
+    z2.boolean(),
+    z2.object({
       filters: filters(
         tunnelSchema.omit({
           client_id: true,
@@ -119,94 +91,94 @@ var authTokenTunnelsScopesSchema = z3.object({
     })
   ]).optional(),
   // Scopes for connecting to tunnels
-  connect: z3.union([
-    z3.boolean(),
-    z3.object({
+  connect: z2.union([
+    z2.boolean(),
+    z2.object({
       filters: filters(tunnelSchema).optional(),
       params: filters(
-        z3.object({
-          path: z3.string().optional()
+        z2.object({
+          path: z2.string().optional()
         })
       ).optional()
     })
   ]).optional(),
   // Scopes for listing tunnels
-  list: z3.union([
-    z3.boolean(),
-    z3.object({
+  list: z2.union([
+    z2.boolean(),
+    z2.object({
       filters: filters(tunnelSchema).optional(),
       select: select(tunnelSchema).optional()
     })
   ]).optional()
 });
-var authTokenScopesSchema = z3.object({
+var authTokenScopesSchema = z2.object({
   tunnels: authTokenTunnelsScopesSchema.optional()
   // Scopes related to tunnels
 });
-var authTokenTunnelGrantSchema = z3.object({
-  workspaces: z3.array(nonEmptyStringSchema).min(1).optional(),
-  projects: z3.array(nonEmptyStringSchema).min(1).optional(),
+var authTokenTunnelGrantSchema = z2.object({
+  workspaces: z2.array(nonEmptyStringSchema).min(1).optional(),
+  projects: z2.array(nonEmptyStringSchema).min(1).optional(),
   scopes: authTokenScopesSchema.optional()
 }).strict().superRefine((grant, ctx) => {
   if (grant.workspaces !== void 0 && grant.projects !== void 0) {
     ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: "A grant cannot target workspaces and projects at the same time.",
       path: ["projects"]
     });
   }
 });
 var authTokenCommonSchema = {
-  aud: z3.union([z3.string(), z3.array(z3.string())]).optional(),
-  exp: z3.number().optional(),
-  tunnelsGrants: z3.array(authTokenTunnelGrantSchema).optional(),
-  iat: z3.number().optional(),
-  iss: z3.string().optional(),
-  jti: z3.string().optional(),
-  metadata: z3.object({
-    engine: z3.string().optional()
+  aud: z2.union([z2.string(), z2.array(z2.string())]).optional(),
+  exp: z2.number().optional(),
+  tunnelsGrants: z2.array(authTokenTunnelGrantSchema).optional(),
+  iat: z2.number().optional(),
+  iss: z2.string().optional(),
+  jti: z2.string().optional(),
+  metadata: z2.object({
+    engine: z2.string().optional()
   }).strict().optional(),
-  nbf: z3.number().optional(),
-  sub: z3.string().optional()
+  nbf: z2.number().optional(),
+  sub: z2.string().optional()
 };
-var authTokenSchema = z3.union([
-  z3.object({
-    type: z3.literal("auth"),
-    userId: z3.string(),
+var authTokenSchema = z2.union([
+  z2.object({
+    type: z2.literal("auth"),
+    userId: z2.string(),
     permissions: authTokenPermissionsSchema.nullable(),
     ...authTokenCommonSchema
   }).strict(),
-  z3.object({
-    type: z3.literal("pat"),
-    token_endpoint: z3.string().optional(),
+  z2.object({
+    type: z2.literal("pat"),
+    token_endpoint: z2.string().optional(),
     ...authTokenCommonSchema
   }).strict(),
-  z3.object({
-    type: z3.literal("app"),
-    clientId: z3.string(),
+  z2.object({
+    type: z2.literal("app"),
+    clientId: z2.string(),
     permissions: authTokenPermissionsSchema.nullable(),
     ...authTokenCommonSchema
   }).strict()
 ]);
 var tokenSchema = authTokenSchema;
-var createAuthTokenParamsSchema = z3.object({
-  expires_in: z3.number().default(60),
+var createAuthTokenParamsSchema = z2.object({
+  expires_in: z2.number().default(60),
   // 1 minute
   scopes: authTokenScopesSchema.optional(),
-  tunnelsGrants: z3.array(authTokenTunnelGrantSchema).optional(),
-  metadata: z3.unknown().optional()
+  tunnelsGrants: z2.array(authTokenTunnelGrantSchema).optional(),
+  metadata: z2.unknown().optional()
   // Additional metadata
 }).strict().superRefine((params, ctx) => {
   if (params.scopes !== void 0 && params.tunnelsGrants !== void 0) {
     ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: "Use either scopes or tunnelsGrants, not both.",
       path: ["tunnelsGrants"]
     });
   }
 });
-var createAuthTokenResponseSchema = z3.object({
-  token: z3.string()
+var createAuthTokenResponseSchema = z2.object({
+  token: z2.string()
 });
 
 // src/auth-resource.ts
@@ -258,34 +230,6 @@ function normalizeAuthTokenTunnelGrants(params) {
   return void 0;
 }
 
-// src/client.ts
-import * as z4 from "zod";
-var clientSchema = z4.object({
-  id: z4.string(),
-  status: z4.enum(["online", "offline"]),
-  user_id: z4.string().optional(),
-  workspace_id: z4.string().optional(),
-  project_id: z4.string().optional(),
-  cluster_id: z4.string().optional(),
-  plan: z4.string().optional(),
-  provider: z4.string().optional(),
-  region: z4.string().optional(),
-  agent: z4.string().optional(),
-  channel: z4.string().optional(),
-  version: z4.string().optional(),
-  os: z4.string().optional(),
-  arch: z4.string().optional(),
-  protocol_version: z4.string().optional(),
-  labels: z4.record(z4.string(), z4.string()).optional()
-});
-var listClientsParamsSchema = z4.object({
-  limit: z4.number().optional(),
-  filters: clientSchema.pick({
-    labels: true
-  }).partial().optional()
-});
-var listClientsResponseSchema = z4.array(clientSchema);
-
 // src/clients-resource.ts
 var RstreamClientsResource = class {
   client;
@@ -307,268 +251,6 @@ var RstreamClientsResource = class {
   }
 };
 
-// src/stream.ts
-import * as z5 from "zod";
-var nonEmptyStringSchema2 = z5.string().min(1);
-var isoDateTimeSchema = z5.string().datetime({ offset: true });
-var ipAddressSchema = z5.string();
-var intNonNegSchema = z5.number().int().nonnegative();
-var numNonNegSchema = z5.number().nonnegative();
-var geolocationSchema = z5.object({
-  country: z5.string().optional(),
-  region: z5.string().optional()
-});
-var streamTLSInfoSchema = z5.object({
-  version: z5.string().min(1).optional(),
-  cipher: z5.string().min(1).optional(),
-  protocol: z5.string().min(1).optional(),
-  curve: z5.string().min(1).optional(),
-  ech: z5.boolean().optional()
-});
-var streamEndpointSchema = z5.object({
-  ip: ipAddressSchema.optional(),
-  geolocation: geolocationSchema.optional(),
-  tls: streamTLSInfoSchema.optional()
-});
-var httpHeadersSchema = z5.record(
-  z5.string(),
-  z5.union([z5.string(), z5.array(z5.string())])
-);
-var httpProtocolSchema = z5.enum(["http/1.1", "h2", "h2c", "h3"]);
-var httpRequestSchema = z5.object({
-  method: nonEmptyStringSchema2,
-  scheme: z5.string().min(1).optional(),
-  host: nonEmptyStringSchema2.optional(),
-  path: nonEmptyStringSchema2.optional(),
-  query: z5.string().optional(),
-  url: nonEmptyStringSchema2.optional(),
-  headers: httpHeadersSchema.optional(),
-  userAgent: z5.string().optional()
-});
-var httpResponseSchema = z5.object({
-  status: z5.number().int().min(100).max(999),
-  headers: httpHeadersSchema.optional()
-});
-var httpRequestStageSchema = z5.object({
-  protocol: httpProtocolSchema.optional(),
-  request: httpRequestSchema
-});
-var httpResponseStageSchema = z5.object({
-  protocol: httpProtocolSchema.optional(),
-  response: httpResponseSchema
-});
-var tokenSourceSchema = z5.enum([
-  "authorization",
-  "query",
-  "client",
-  "unknown"
-]);
-var tokenTypeSchema = z5.enum(["auth", "pat", "app", "unknown"]);
-var firewallRuleSchema = z5.discriminatedUnion("kind", [
-  z5.object({ kind: z5.literal("none") }),
-  z5.object({ kind: z5.literal("mtls") }),
-  z5.object({
-    kind: z5.literal("rstream_auth"),
-    source: z5.literal("rstream_auth")
-  }),
-  z5.object({
-    kind: z5.literal("token"),
-    source: tokenSourceSchema.optional(),
-    tokenType: tokenTypeSchema.optional()
-  })
-]);
-var unauthorizedSourceSchema = z5.object({
-  source: tokenSourceSchema
-});
-var unauthorizedReasonSchema = (shape) => z5.object(shape).merge(unauthorizedSourceSchema);
-var unauthorizedSchema = z5.discriminatedUnion("reason", [
-  unauthorizedReasonSchema({
-    reason: z5.literal("missing_token")
-  }),
-  unauthorizedReasonSchema({
-    reason: z5.literal("invalid_token")
-  }),
-  unauthorizedReasonSchema({
-    reason: z5.literal("expired_token")
-  }),
-  unauthorizedReasonSchema({
-    reason: z5.literal("invalid_secret")
-  }),
-  unauthorizedReasonSchema({
-    reason: z5.literal("user_mismatch")
-  }),
-  unauthorizedReasonSchema({
-    reason: z5.literal("insufficient_scope")
-  }),
-  unauthorizedReasonSchema({
-    reason: z5.literal("policy_denied"),
-    policy: z5.enum(["ip", "geo", "mtls", "challenge", "other"]),
-    value: z5.string().optional()
-  })
-]);
-var failureSchema = z5.discriminatedUnion("kind", [
-  z5.object({
-    kind: z5.literal("timeout"),
-    timeoutMs: intNonNegSchema.optional(),
-    message: z5.string().optional()
-  }),
-  z5.object({
-    kind: z5.literal("unauthorized"),
-    why: unauthorizedSchema,
-    message: z5.string().optional()
-  }),
-  z5.object({
-    kind: z5.literal("not_found"),
-    resource: z5.enum(["tunnel", "client", "route"]),
-    message: z5.string().optional()
-  }),
-  z5.object({
-    kind: z5.literal("refused"),
-    reason: z5.enum(["capacity", "policy", "unsupported", "other"]),
-    message: z5.string().optional()
-  }),
-  z5.object({ kind: z5.literal("io"), message: z5.string().optional() }),
-  z5.object({ kind: z5.literal("internal"), message: z5.string().optional() })
-]);
-var firewallSchema = z5.discriminatedUnion("decision", [
-  z5.object({ decision: z5.literal("allowed"), rule: firewallRuleSchema }),
-  z5.object({
-    decision: z5.literal("denied"),
-    rule: firewallRuleSchema,
-    failure: failureSchema
-  })
-]);
-var routedTunnelSchema = z5.object({
-  tunnelId: nonEmptyStringSchema2.optional(),
-  tunnelName: z5.string().optional(),
-  protocol: z5.string().optional(),
-  published: z5.boolean().optional(),
-  type: z5.string().optional(),
-  tlsMode: z5.string().optional(),
-  httpVersion: z5.string().optional(),
-  httpUseTls: z5.boolean().optional(),
-  tokenAuth: z5.boolean().optional(),
-  mtls: z5.boolean().optional()
-});
-var routingSchema = z5.discriminatedUnion("decision", [
-  z5.object({ decision: z5.literal("routed"), tunnel: routedTunnelSchema }),
-  z5.object({ decision: z5.literal("not_routed"), failure: failureSchema })
-]);
-var streamConnectedMetricsSchema = z5.object({
-  establish_ms: numNonNegSchema,
-  duration_ms: numNonNegSchema,
-  upstream_bytes: intNonNegSchema,
-  downstream_bytes: intNonNegSchema
-});
-var streamFailedMetricsSchema = z5.object({
-  time_to_fail_ms: numNonNegSchema.optional(),
-  establish_ms: numNonNegSchema.optional()
-});
-var terminationSchema = z5.object({
-  by: z5.enum(["downstream", "upstream", "server", "unknown"]),
-  reason: z5.enum(["closed", "reset", "timeout", "error", "unknown"]),
-  message: z5.string().optional()
-});
-var responseConnectedSchema = z5.object({
-  outcome: z5.literal("connected"),
-  established_at: isoDateTimeSchema,
-  upstream: streamEndpointSchema.optional(),
-  metrics: streamConnectedMetricsSchema,
-  termination: terminationSchema.optional(),
-  http: httpResponseStageSchema.optional()
-});
-var responseFailedSchema = z5.object({
-  outcome: z5.literal("failed"),
-  failure: failureSchema,
-  upstream: streamEndpointSchema.optional(),
-  metrics: streamFailedMetricsSchema.optional(),
-  termination: terminationSchema.optional(),
-  http: httpResponseStageSchema.optional()
-});
-var responseSchema = z5.discriminatedUnion("outcome", [
-  responseConnectedSchema,
-  responseFailedSchema
-]);
-var streamSummarySchema = z5.object({
-  workspace_id: nonEmptyStringSchema2.optional(),
-  project_id: nonEmptyStringSchema2.optional(),
-  cluster_id: nonEmptyStringSchema2.optional(),
-  user_id: nonEmptyStringSchema2.optional(),
-  client_id: nonEmptyStringSchema2.optional(),
-  tunnel_id: nonEmptyStringSchema2.optional(),
-  stream_id: nonEmptyStringSchema2,
-  created_at: isoDateTimeSchema,
-  terminated_at: isoDateTimeSchema,
-  request: z5.object({
-    downstream: streamEndpointSchema,
-    http: httpRequestStageSchema.optional()
-  }),
-  firewall: firewallSchema,
-  routing: routingSchema,
-  response: responseSchema
-});
-
-// src/event.ts
-import * as z6 from "zod";
-var isoDateTimeSchema2 = z6.string().datetime({ offset: true });
-var initialStateSchema = z6.object({
-  snapshot_at: isoDateTimeSchema2,
-  clients: z6.array(clientSchema),
-  tunnels: z6.array(tunnelSchema)
-});
-var eventBaseSchema = z6.object({
-  id: z6.string().optional(),
-  created_at: isoDateTimeSchema2.optional(),
-  user_id: z6.string().optional(),
-  workspace_id: z6.string().optional(),
-  project_id: z6.string().optional(),
-  cluster_id: z6.string().optional()
-});
-var withEventBase = (shape) => z6.object(shape).merge(eventBaseSchema).passthrough();
-var stateInitialEventSchema = withEventBase({
-  type: z6.literal("state.initial"),
-  object: initialStateSchema
-});
-var streamSummaryEventSchema = withEventBase({
-  type: z6.literal("stream.summary"),
-  object: streamSummarySchema
-});
-var commonEventsSchema = [
-  withEventBase({
-    type: z6.literal("client.created"),
-    object: clientSchema
-  }),
-  withEventBase({
-    type: z6.literal("client.updated"),
-    object: clientSchema
-  }),
-  withEventBase({
-    type: z6.literal("client.deleted"),
-    object: clientSchema
-  }),
-  withEventBase({
-    type: z6.literal("tunnel.created"),
-    object: tunnelSchema
-  }),
-  withEventBase({
-    type: z6.literal("tunnel.updated"),
-    object: tunnelSchema
-  }),
-  withEventBase({
-    type: z6.literal("tunnel.deleted"),
-    object: tunnelSchema
-  })
-];
-var wsEventsSchema = z6.union([
-  stateInitialEventSchema,
-  ...commonEventsSchema
-]);
-var webhookEventsSchema = z6.union([
-  ...commonEventsSchema,
-  streamSummaryEventSchema
-]);
-var eventSchema = z6.union([wsEventsSchema, webhookEventsSchema]);
-
 // src/resolution.ts
 import { DEFAULT_API_URL } from "@rstreamlabs/rstream";
 import { getTunnelsProjectEngine } from "@rstreamlabs/rstream";
@@ -694,16 +376,16 @@ import { isClientCredentials as isClientCredentials2 } from "@rstreamlabs/rstrea
 import { isTokenCredentials as isTokenCredentials2 } from "@rstreamlabs/rstream";
 import { RstreamClient as RstreamClient2 } from "@rstreamlabs/rstream";
 import { turnCredentialsSchema } from "@rstreamlabs/rstream";
-import * as z7 from "zod";
+import * as z3 from "zod";
 import crypto from "crypto";
 var defaultTURNPort = 3478;
 var defaultTURNSPort = 5349;
 var defaultTURNCredentialTTLSeconds = 24 * 60 * 60;
-var turnTokenClaimsSchema = z7.object({
-  token_endpoint: z7.string().optional(),
-  type: z7.string()
+var turnTokenClaimsSchema = z3.object({
+  token_endpoint: z3.string().optional(),
+  type: z3.string()
 });
-var turnCredentialModeSchema = z7.enum(["api", "app", "pat"]);
+var turnCredentialModeSchema = z3.enum(["api", "app", "pat"]);
 function normalizeOptionalString(value) {
   const normalized = value?.trim();
   return normalized ? normalized : void 0;
@@ -1229,7 +911,7 @@ var Watch = class {
 };
 
 // src/webtty.ts
-import * as z8 from "zod";
+import * as z4 from "zod";
 var osFamilies = [
   "linux",
   "macos",
@@ -1238,25 +920,25 @@ var osFamilies = [
   "openbsd",
   "freebsd"
 ];
-var webttyServerSchema = z8.object({
-  tunnel_id: z8.string(),
-  host: z8.string(),
-  token_auth: z8.boolean(),
-  os_family: z8.enum(osFamilies).optional(),
-  arch: z8.string().optional(),
-  os_id: z8.string().optional(),
+var webttyServerSchema = z4.object({
+  tunnel_id: z4.string(),
+  host: z4.string(),
+  token_auth: z4.boolean(),
+  os_family: z4.enum(osFamilies).optional(),
+  arch: z4.string().optional(),
+  os_id: z4.string().optional(),
   // /etc/os-release::ID (ubuntu, debian, rocky, etc.)
-  os_version_id: z8.string().optional(),
+  os_version_id: z4.string().optional(),
   // /etc/os-release::VERSION_ID (24.04, 22.04, 11, 10.0.19045, ...)
-  os_version_codename: z8.string().optional(),
+  os_version_codename: z4.string().optional(),
   // /etc/os-release::VERSION_CODENAME (jammy, noble...)
-  os_pretty_name: z8.string().optional(),
+  os_pretty_name: z4.string().optional(),
   // /etc/os-release::PRETTY_NAME
-  kernel_release: z8.string().optional(),
+  kernel_release: z4.string().optional(),
   // uname -r
-  hostname: z8.string().optional(),
+  hostname: z4.string().optional(),
   // uname -n
-  labels: z8.record(z8.string(), z8.string().optional()).optional()
+  labels: z4.record(z4.string(), z4.string().optional()).optional()
 });
 function parser(tunnel) {
   if (tunnel.status !== "online") return null;
@@ -1275,7 +957,7 @@ function parser(tunnel) {
   }
   const candidate = {
     tunnel_id: tunnel.id,
-    host: tunnel.host,
+    host: formatTunnelHost(tunnel),
     token_auth: tunnel.token_auth === true,
     os_family: tunnelLabels["rstream.webtty.os_family"],
     arch: tunnelLabels["rstream.webtty.arch"],
@@ -1313,6 +995,7 @@ export {
   authTokenScopesSchema,
   authTokenTunnelGrantSchema,
   authTokenTunnelsScopesSchema,
+  clientFilterSchema,
   clientSchema,
   createAPITURNCredentials,
   createAPPTURNCredentials,
@@ -1321,7 +1004,10 @@ export {
   createAuthTokenResponseSchema,
   createPATTURNCredentials,
   createTURNCredentials,
+  engineOpenApiDocument,
+  engineOpenApiJson,
   eventSchema,
+  formatTunnelHost,
   listClientsParamsSchema,
   listClientsResponseSchema,
   listTunnelsParamsSchema,
@@ -1335,6 +1021,7 @@ export {
   streamSummarySchema,
   streamTLSInfoSchema,
   tokenSchema,
+  tunnelFilterSchema,
   tunnelSchema,
   turnCredentialModeSchema,
   webhookEventsSchema,