@rstreamlabs/tunnels 1.0.6 → 1.0.7

package/dist/openapi.js

@@ -0,0 +1,753 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/openapi.ts
+var openapi_exports = {};
+__export(openapi_exports, {
+  engineOpenApiDocument: () => engineOpenApiDocument,
+  engineOpenApiJson: () => engineOpenApiJson
+});
+module.exports = __toCommonJS(openapi_exports);
+
+// src/client.ts
+var z = __toESM(require("zod"));
+var clientSchema = z.object({
+  id: z.string(),
+  status: z.enum(["online", "offline"]),
+  user_id: z.string().optional(),
+  workspace_id: z.string().optional(),
+  project_id: z.string().optional(),
+  cluster_id: z.string().optional(),
+  plan: z.string().optional(),
+  provider: z.string().optional(),
+  region: z.string().optional(),
+  agent: z.string().optional(),
+  channel: z.string().optional(),
+  version: z.string().optional(),
+  os: z.string().optional(),
+  arch: z.string().optional(),
+  protocol_version: z.string().optional(),
+  labels: z.record(z.string(), z.string()).optional()
+});
+var clientFilterSchema = clientSchema.pick({
+  id: true,
+  status: true,
+  user_id: true,
+  agent: true,
+  channel: true,
+  version: true,
+  os: true,
+  arch: true,
+  protocol_version: true,
+  labels: true
+}).partial();
+var listClientsParamsSchema = z.object({
+  limit: z.number().int().min(1).optional(),
+  filters: clientFilterSchema.optional()
+});
+var listClientsResponseSchema = z.array(clientSchema);
+
+// src/tunnel.ts
+var z2 = __toESM(require("zod"));
+var tunnelSchema = z2.object({
+  // common properties
+  client_id: z2.string(),
+  user_id: z2.string().optional(),
+  workspace_id: z2.string().optional(),
+  project_id: z2.string().optional(),
+  cluster_id: z2.string().optional(),
+  plan: z2.string().optional(),
+  provider: z2.string().optional(),
+  region: z2.string().optional(),
+  status: z2.enum(["online", "offline"]),
+  // tunnel properties
+  id: z2.string(),
+  creation_date: z2.union([z2.string().datetime(), z2.date()]).optional(),
+  name: z2.string().optional(),
+  type: z2.enum(["bytestream", "datagram"]).optional(),
+  publish: z2.boolean().optional(),
+  protocol: z2.enum(["tls", "dtls", "quic", "http"]).optional(),
+  labels: z2.record(z2.string(), z2.string()).optional(),
+  geo_ip: z2.array(z2.string()).optional(),
+  trusted_ips: z2.array(z2.string()).optional(),
+  host: z2.string().optional(),
+  hostname: z2.string().optional(),
+  port: z2.number().int().min(1).max(65535).optional(),
+  tls_mode: z2.enum(["passthrough", "terminated"]).optional(),
+  tls_alpns: z2.array(z2.string()).optional(),
+  tls_min_version: z2.string().optional(),
+  tls_ciphers: z2.array(z2.string()).optional(),
+  mtls: z2.boolean().optional(),
+  mtls_ca_cert_pem: z2.string().optional(),
+  http_version: z2.enum(["http/1.1", "h2", "h2c", "h3"]).optional(),
+  http_use_tls: z2.boolean().optional(),
+  upstream_tls: z2.boolean().optional(),
+  token_auth: z2.boolean().optional(),
+  rstream_auth: z2.boolean().optional(),
+  challenge_mode: z2.boolean().optional()
+});
+var tunnelFilterSchema = tunnelSchema.pick({
+  id: true,
+  name: true,
+  type: true,
+  status: true,
+  client_id: true,
+  user_id: true,
+  publish: true,
+  protocol: true,
+  hostname: true,
+  http_version: true,
+  labels: true
+}).partial();
+var listTunnelsParamsSchema = z2.object({
+  limit: z2.number().int().min(1).optional(),
+  filters: tunnelFilterSchema.optional()
+});
+var listTunnelsResponseSchema = z2.array(tunnelSchema);
+
+// src/stream.ts
+var z3 = __toESM(require("zod"));
+var nonEmptyStringSchema = z3.string().min(1);
+var isoDateTimeSchema = z3.string().datetime({ offset: true });
+var ipAddressSchema = z3.string();
+var intNonNegSchema = z3.number().int().nonnegative();
+var numNonNegSchema = z3.number().nonnegative();
+var geolocationSchema = z3.object({
+  country: z3.string().optional(),
+  region: z3.string().optional()
+});
+var streamTLSInfoSchema = z3.object({
+  version: z3.string().min(1).optional(),
+  cipher: z3.string().min(1).optional(),
+  protocol: z3.string().min(1).optional(),
+  curve: z3.string().min(1).optional(),
+  ech: z3.boolean().optional()
+});
+var streamEndpointSchema = z3.object({
+  ip: ipAddressSchema.optional(),
+  geolocation: geolocationSchema.optional(),
+  tls: streamTLSInfoSchema.optional()
+});
+var httpHeadersSchema = z3.record(
+  z3.string(),
+  z3.union([z3.string(), z3.array(z3.string())])
+);
+var httpProtocolSchema = z3.enum(["http/1.1", "h2", "h2c", "h3"]);
+var httpRequestSchema = z3.object({
+  method: nonEmptyStringSchema,
+  scheme: z3.string().min(1).optional(),
+  host: nonEmptyStringSchema.optional(),
+  path: nonEmptyStringSchema.optional(),
+  query: z3.string().optional(),
+  url: nonEmptyStringSchema.optional(),
+  headers: httpHeadersSchema.optional(),
+  userAgent: z3.string().optional()
+});
+var httpResponseSchema = z3.object({
+  status: z3.number().int().min(100).max(999),
+  headers: httpHeadersSchema.optional()
+});
+var httpRequestStageSchema = z3.object({
+  protocol: httpProtocolSchema.optional(),
+  request: httpRequestSchema
+});
+var httpResponseStageSchema = z3.object({
+  protocol: httpProtocolSchema.optional(),
+  response: httpResponseSchema
+});
+var tokenSourceSchema = z3.enum([
+  "authorization",
+  "query",
+  "client",
+  "unknown"
+]);
+var tokenTypeSchema = z3.enum(["auth", "pat", "app", "unknown"]);
+var firewallRuleSchema = z3.discriminatedUnion("kind", [
+  z3.object({ kind: z3.literal("none") }),
+  z3.object({ kind: z3.literal("mtls") }),
+  z3.object({
+    kind: z3.literal("rstream_auth"),
+    source: z3.literal("rstream_auth")
+  }),
+  z3.object({
+    kind: z3.literal("token"),
+    source: tokenSourceSchema.optional(),
+    tokenType: tokenTypeSchema.optional()
+  })
+]);
+var unauthorizedSourceSchema = z3.object({
+  source: tokenSourceSchema
+});
+var unauthorizedReasonSchema = (shape) => z3.object(shape).merge(unauthorizedSourceSchema);
+var unauthorizedSchema = z3.discriminatedUnion("reason", [
+  unauthorizedReasonSchema({
+    reason: z3.literal("missing_token")
+  }),
+  unauthorizedReasonSchema({
+    reason: z3.literal("invalid_token")
+  }),
+  unauthorizedReasonSchema({
+    reason: z3.literal("expired_token")
+  }),
+  unauthorizedReasonSchema({
+    reason: z3.literal("invalid_secret")
+  }),
+  unauthorizedReasonSchema({
+    reason: z3.literal("user_mismatch")
+  }),
+  unauthorizedReasonSchema({
+    reason: z3.literal("insufficient_scope")
+  }),
+  unauthorizedReasonSchema({
+    reason: z3.literal("policy_denied"),
+    policy: z3.enum(["ip", "geo", "mtls", "challenge", "other"]),
+    value: z3.string().optional()
+  })
+]);
+var failureSchema = z3.discriminatedUnion("kind", [
+  z3.object({
+    kind: z3.literal("timeout"),
+    timeoutMs: intNonNegSchema.optional(),
+    message: z3.string().optional()
+  }),
+  z3.object({
+    kind: z3.literal("unauthorized"),
+    why: unauthorizedSchema,
+    message: z3.string().optional()
+  }),
+  z3.object({
+    kind: z3.literal("not_found"),
+    resource: z3.enum(["tunnel", "client", "route"]),
+    message: z3.string().optional()
+  }),
+  z3.object({
+    kind: z3.literal("refused"),
+    reason: z3.enum(["capacity", "policy", "unsupported", "other"]),
+    message: z3.string().optional()
+  }),
+  z3.object({ kind: z3.literal("io"), message: z3.string().optional() }),
+  z3.object({ kind: z3.literal("internal"), message: z3.string().optional() })
+]);
+var firewallSchema = z3.discriminatedUnion("decision", [
+  z3.object({ decision: z3.literal("allowed"), rule: firewallRuleSchema }),
+  z3.object({
+    decision: z3.literal("denied"),
+    rule: firewallRuleSchema,
+    failure: failureSchema
+  })
+]);
+var routedTunnelSchema = z3.object({
+  tunnelId: nonEmptyStringSchema.optional(),
+  tunnelName: z3.string().optional(),
+  hostname: z3.string().optional(),
+  protocol: z3.string().optional(),
+  published: z3.boolean().optional(),
+  type: z3.string().optional(),
+  tlsMode: z3.string().optional(),
+  httpVersion: z3.string().optional(),
+  httpUseTls: z3.boolean().optional(),
+  upstreamTls: z3.boolean().optional(),
+  tokenAuth: z3.boolean().optional(),
+  mtls: z3.boolean().optional()
+});
+var routingSchema = z3.discriminatedUnion("decision", [
+  z3.object({ decision: z3.literal("routed"), tunnel: routedTunnelSchema }),
+  z3.object({ decision: z3.literal("not_routed"), failure: failureSchema })
+]);
+var streamConnectedMetricsSchema = z3.object({
+  establish_ms: numNonNegSchema,
+  duration_ms: numNonNegSchema,
+  upstream_bytes: intNonNegSchema,
+  downstream_bytes: intNonNegSchema
+});
+var streamFailedMetricsSchema = z3.object({
+  time_to_fail_ms: numNonNegSchema.optional(),
+  establish_ms: numNonNegSchema.optional()
+});
+var terminationSchema = z3.object({
+  by: z3.enum(["downstream", "upstream", "server", "unknown"]),
+  reason: z3.enum(["closed", "reset", "timeout", "error", "unknown"]),
+  message: z3.string().optional()
+});
+var responseConnectedSchema = z3.object({
+  outcome: z3.literal("connected"),
+  established_at: isoDateTimeSchema,
+  upstream: streamEndpointSchema.optional(),
+  metrics: streamConnectedMetricsSchema,
+  termination: terminationSchema.optional(),
+  http: httpResponseStageSchema.optional()
+});
+var responseFailedSchema = z3.object({
+  outcome: z3.literal("failed"),
+  failure: failureSchema,
+  upstream: streamEndpointSchema.optional(),
+  metrics: streamFailedMetricsSchema.optional(),
+  termination: terminationSchema.optional(),
+  http: httpResponseStageSchema.optional()
+});
+var responseSchema = z3.discriminatedUnion("outcome", [
+  responseConnectedSchema,
+  responseFailedSchema
+]);
+var streamSummarySchema = z3.object({
+  workspace_id: nonEmptyStringSchema.optional(),
+  project_id: nonEmptyStringSchema.optional(),
+  cluster_id: nonEmptyStringSchema.optional(),
+  user_id: nonEmptyStringSchema.optional(),
+  client_id: nonEmptyStringSchema.optional(),
+  tunnel_id: nonEmptyStringSchema.optional(),
+  stream_id: nonEmptyStringSchema,
+  created_at: isoDateTimeSchema,
+  terminated_at: isoDateTimeSchema,
+  request: z3.object({
+    downstream: streamEndpointSchema,
+    http: httpRequestStageSchema.optional()
+  }),
+  firewall: firewallSchema,
+  routing: routingSchema,
+  response: responseSchema
+});
+
+// src/event.ts
+var z4 = __toESM(require("zod"));
+var isoDateTimeSchema2 = z4.string().datetime({ offset: true });
+var initialStateSchema = z4.object({
+  snapshot_at: isoDateTimeSchema2,
+  clients: z4.array(clientSchema),
+  tunnels: z4.array(tunnelSchema)
+});
+var eventBaseSchema = z4.object({
+  id: z4.string().optional(),
+  created_at: isoDateTimeSchema2.optional(),
+  user_id: z4.string().optional(),
+  workspace_id: z4.string().optional(),
+  project_id: z4.string().optional(),
+  cluster_id: z4.string().optional()
+});
+var withEventBase = (shape) => z4.object(shape).merge(eventBaseSchema).passthrough();
+var stateInitialEventSchema = withEventBase({
+  type: z4.literal("state.initial"),
+  object: initialStateSchema
+});
+var streamSummaryEventSchema = withEventBase({
+  type: z4.literal("stream.summary"),
+  object: streamSummarySchema
+});
+var commonEventsSchema = [
+  withEventBase({
+    type: z4.literal("client.created"),
+    object: clientSchema
+  }),
+  withEventBase({
+    type: z4.literal("client.updated"),
+    object: clientSchema
+  }),
+  withEventBase({
+    type: z4.literal("client.deleted"),
+    object: clientSchema
+  }),
+  withEventBase({
+    type: z4.literal("tunnel.created"),
+    object: tunnelSchema
+  }),
+  withEventBase({
+    type: z4.literal("tunnel.updated"),
+    object: tunnelSchema
+  }),
+  withEventBase({
+    type: z4.literal("tunnel.deleted"),
+    object: tunnelSchema
+  })
+];
+var wsEventsSchema = z4.union([
+  stateInitialEventSchema,
+  ...commonEventsSchema
+]);
+var webhookEventsSchema = z4.union([
+  ...commonEventsSchema,
+  streamSummaryEventSchema
+]);
+var eventSchema = z4.union([wsEventsSchema, webhookEventsSchema]);
+
+// src/openapi.ts
+var z5 = __toESM(require("zod"));
+var jsonContentType = "application/json";
+var openApiContentType = "application/vnd.oai.openapi+json;version=3.1";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function dropSchemaKeyword(value) {
+  if (!isRecord(value)) return value;
+  return Object.fromEntries(
+    Object.entries(value).filter(([key]) => key !== "$schema")
+  );
+}
+function jsonSchemaFor(schema) {
+  return dropSchemaKeyword(
+    z5.toJSONSchema(schema, {
+      unrepresentable: "any",
+      override: (ctx) => {
+        if (ctx.zodSchema instanceof z5.ZodDate) {
+          ctx.jsonSchema.type = "string";
+          ctx.jsonSchema.format = "date-time";
+        }
+      }
+    })
+  );
+}
+function jsonArrayResponse(description, itemSchemaRef) {
+  return {
+    description,
+    content: {
+      [jsonContentType]: {
+        schema: {
+          type: "array",
+          items: {
+            $ref: itemSchemaRef
+          }
+        }
+      }
+    }
+  };
+}
+function streamResponse(description) {
+  return {
+    description,
+    content: {
+      "text/event-stream": {
+        schema: {
+          type: "string"
+        }
+      }
+    }
+  };
+}
+function errorResponse(description) {
+  return {
+    description
+  };
+}
+function queryJsonParameter(name, description, schemaRef, examples) {
+  return {
+    name,
+    in: "query",
+    required: false,
+    description,
+    content: {
+      [jsonContentType]: {
+        schema: {
+          $ref: schemaRef
+        },
+        ...examples ? { examples } : {}
+      }
+    }
+  };
+}
+var readEngineStateRule = {
+  resource: ["engine.tunnels", "engine.streams"],
+  action: "read"
+};
+var readEngineStateRules = [readEngineStateRule];
+var readEngineStreamsRules = [
+  {
+    resource: "engine.streams",
+    action: "read"
+  }
+];
+var watchParamsSchema = z5.object({
+  clients: clientFilterSchema.optional(),
+  tunnels: tunnelFilterSchema.optional()
+});
+var enginePermissions = {
+  "tunnels.resources.read-only": {
+    name: "Discovery: Read-Only",
+    description: "Read active clients, active tunnels, and live state events.",
+    rules: [readEngineStateRule]
+  },
+  "tunnels.tunnels.create-delete": {
+    name: "Tunnels: Create and Delete",
+    description: "Create and close tunnels through the CLI, SDK, or engine control channel.",
+    rules: [
+      {
+        resource: "engine.tunnels",
+        action: ["create", "delete"]
+      }
+    ]
+  },
+  "tunnels.streams.create-delete": {
+    name: "Connections: Create and Delete",
+    description: "Open and close private tunnel streams and WebTTY connections.",
+    rules: [
+      {
+        resource: "engine.streams",
+        action: ["create", "delete"]
+      }
+    ]
+  }
+};
+var engineOpenApiDocument = {
+  openapi: "3.1.0",
+  info: {
+    title: "rstream Engine API",
+    version: "1.0.0",
+    description: "Operational data-plane API exposed by rstream-engine. This surface is scoped to the authenticated engine or project endpoint and covers live clients, live tunnels, and state-change streams."
+  },
+  servers: [
+    {
+      url: "https://{engine}",
+      description: "Project-scoped rstream engine endpoint.",
+      variables: {
+        engine: {
+          default: "project-endpoint.cluster-host:443",
+          description: "Use the engine value returned by project discovery or configured in RSTREAM_ENGINE."
+        }
+      }
+    }
+  ],
+  security: [
+    {
+      bearerAuth: []
+    }
+  ],
+  components: {
+    securitySchemes: {
+      bearerAuth: {
+        type: "http",
+        scheme: "bearer",
+        bearerFormat: "rstream token",
+        description: "Preferred authentication mechanism. Send an OAuth-issued rstream access token or compatible rstream credential in Authorization: Bearer <token>."
+      },
+      queryToken: {
+        type: "apiKey",
+        in: "query",
+        name: "rstream.token",
+        description: "Fallback authentication mechanism for transports where setting Authorization is impractical. Prefer bearerAuth whenever possible."
+      }
+    },
+    parameters: {
+      ListClientsParams: queryJsonParameter(
+        "params",
+        "JSON-encoded ListClientsParams object.",
+        "#/components/schemas/ListClientsParams",
+        {
+          filterByAgent: {
+            value: {
+              limit: 10,
+              filters: {
+                agent: "rstream",
+                channel: "stable"
+              }
+            }
+          }
+        }
+      ),
+      ListTunnelsParams: queryJsonParameter(
+        "params",
+        "JSON-encoded ListTunnelsParams object.",
+        "#/components/schemas/ListTunnelsParams",
+        {
+          filterByLabels: {
+            value: {
+              filters: {
+                labels: {
+                  service: "ssh",
+                  env: "prod"
+                }
+              }
+            }
+          }
+        }
+      ),
+      WatchParams: queryJsonParameter(
+        "params",
+        "JSON-encoded WatchParams object. The same shape is accepted by SSE and WebSocket transports.",
+        "#/components/schemas/WatchParams",
+        {
+          watchTaggedTunnels: {
+            value: {
+              clients: {
+                agent: "rstream"
+              },
+              tunnels: {
+                labels: {
+                  service: "ssh"
+                }
+              }
+            }
+          }
+        }
+      )
+    },
+    responses: {
+      BadRequest: errorResponse("Request validation failed."),
+      Unauthorized: errorResponse("Authentication is required."),
+      Forbidden: errorResponse("The token is not authorized.")
+    },
+    schemas: {
+      Client: jsonSchemaFor(clientSchema),
+      Event: jsonSchemaFor(wsEventsSchema),
+      ListClientsParams: jsonSchemaFor(listClientsParamsSchema),
+      ListTunnelsParams: jsonSchemaFor(listTunnelsParamsSchema),
+      TunnelListItem: jsonSchemaFor(tunnelSchema),
+      WatchParams: jsonSchemaFor(watchParamsSchema)
+    }
+  },
+  "x-rstream-agent-authentication": {
+    oauth_authorization_server_metadata: "https://rstream.io/.well-known/oauth-authorization-server",
+    oauth_protected_resource_metadata: "https://rstream.io/.well-known/oauth-protected-resource",
+    scope_selection: "Use x-rstream-required-rules to understand backend authorization checks. Choose OAuth scopes from x-rstream-permissions or use the task bundles in x-rstream-use-case-permissions."
+  },
+  "x-rstream-permissions": enginePermissions,
+  "x-rstream-use-case-permissions": {
+    "inspect-engine-state": ["tunnels.resources.read-only"],
+    "expose-service-from-cli": [
+      "tunnels.resources.read-only",
+      "tunnels.tunnels.create-delete"
+    ],
+    "connect-private-tunnel": [
+      "tunnels.resources.read-only",
+      "tunnels.streams.create-delete"
+    ],
+    "operate-webtty": [
+      "tunnels.resources.read-only",
+      "tunnels.tunnels.create-delete",
+      "tunnels.streams.create-delete"
+    ]
+  },
+  paths: {
+    "/api/openapi.json": {
+      get: {
+        tags: ["Discovery"],
+        summary: "Return this OpenAPI description.",
+        operationId: "get_engine_openapi",
+        security: [],
+        responses: {
+          "200": {
+            description: "OpenAPI document.",
+            content: {
+              [openApiContentType]: {
+                schema: {
+                  type: "object"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/clients": {
+      get: {
+        tags: ["Runtime inventory"],
+        summary: "List visible engine clients.",
+        operationId: "list_engine_clients",
+        parameters: [{ $ref: "#/components/parameters/ListClientsParams" }],
+        security: [{ bearerAuth: [] }, { queryToken: [] }],
+        responses: {
+          "200": jsonArrayResponse(
+            "Visible clients.",
+            "#/components/schemas/Client"
+          ),
+          "400": { $ref: "#/components/responses/BadRequest" },
+          "401": { $ref: "#/components/responses/Unauthorized" },
+          "403": { $ref: "#/components/responses/Forbidden" }
+        },
+        "x-rstream-required-rules": readEngineStreamsRules
+      }
+    },
+    "/api/tunnels": {
+      get: {
+        tags: ["Runtime inventory"],
+        summary: "List visible engine tunnels.",
+        operationId: "list_engine_tunnels",
+        parameters: [{ $ref: "#/components/parameters/ListTunnelsParams" }],
+        security: [{ bearerAuth: [] }, { queryToken: [] }],
+        responses: {
+          "200": jsonArrayResponse(
+            "Visible tunnels. Fine-grained list scopes may filter objects and project fields.",
+            "#/components/schemas/TunnelListItem"
+          ),
+          "400": { $ref: "#/components/responses/BadRequest" },
+          "401": { $ref: "#/components/responses/Unauthorized" },
+          "403": { $ref: "#/components/responses/Forbidden" }
+        },
+        "x-rstream-required-rules": readEngineStateRules,
+        "x-rstream-token-metadata-scope": "metadata.scopes.tunnels.list"
+      }
+    },
+    "/api/sse": {
+      get: {
+        tags: ["Runtime watch"],
+        summary: "Subscribe to visible engine state through Server-Sent Events.",
+        operationId: "watch_engine_events_sse",
+        parameters: [{ $ref: "#/components/parameters/WatchParams" }],
+        security: [{ bearerAuth: [] }, { queryToken: [] }],
+        responses: {
+          "200": streamResponse(
+            "SSE stream. Each event is emitted as a data line containing a JSON Event object."
+          ),
+          "400": { $ref: "#/components/responses/BadRequest" },
+          "401": { $ref: "#/components/responses/Unauthorized" },
+          "403": { $ref: "#/components/responses/Forbidden" }
+        },
+        "x-rstream-event-schema": "#/components/schemas/Event",
+        "x-rstream-required-rules": readEngineStateRules
+      }
+    },
+    "/api/websocket": {
+      get: {
+        tags: ["Runtime watch"],
+        summary: "Subscribe to visible engine state through a WebSocket upgrade.",
+        operationId: "watch_engine_events_websocket",
+        parameters: [{ $ref: "#/components/parameters/WatchParams" }],
+        security: [{ bearerAuth: [] }, { queryToken: [] }],
+        responses: {
+          "101": {
+            description: "WebSocket connection accepted. Frames contain JSON Event objects."
+          },
+          "400": { $ref: "#/components/responses/BadRequest" },
+          "401": { $ref: "#/components/responses/Unauthorized" },
+          "403": { $ref: "#/components/responses/Forbidden" }
+        },
+        "x-rstream-event-schema": "#/components/schemas/Event",
+        "x-rstream-required-rules": readEngineStateRules
+      }
+    }
+  }
+};
+var engineOpenApiJson = `${JSON.stringify(
+  engineOpenApiDocument,
+  null,
+  2
+)}
+`;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  engineOpenApiDocument,
+  engineOpenApiJson
+});