@rstreamlabs/tunnels 3.2.0 → 3.4.0

package/dist/chunk-6OUCIT5G.mjs

@@ -0,0 +1,1330 @@
+// src/client.ts
+import * as z from "zod";
+var clientSchema = z.object({
+  id: z.string(),
+  status: z.enum(["online", "offline"]),
+  user_id: z.string().optional(),
+  workspace_id: z.string().optional(),
+  project_id: z.string().optional(),
+  cluster_id: z.string().optional(),
+  plan: z.string().optional(),
+  provider: z.string().optional(),
+  region: z.string().optional(),
+  agent: z.string().optional(),
+  channel: z.string().optional(),
+  version: z.string().optional(),
+  os: z.string().optional(),
+  arch: z.string().optional(),
+  protocol_version: z.string().optional(),
+  labels: z.record(z.string(), z.string()).optional()
+});
+var clientFilterSchema = clientSchema.pick({
+  id: true,
+  status: true,
+  user_id: true,
+  agent: true,
+  channel: true,
+  version: true,
+  os: true,
+  arch: true,
+  protocol_version: true,
+  labels: true
+}).partial();
+var listClientsParamsSchema = z.object({
+  limit: z.number().int().min(1).optional(),
+  filters: clientFilterSchema.optional()
+});
+var listClientsResponseSchema = z.array(clientSchema);
+
+// src/webtty-schemas.ts
+import * as z2 from "zod";
+var webTTYTransportSchema = z2.enum([
+  "plain",
+  "websocket",
+  "webtransport"
+]);
+var webTTYRecordingModeSchema = z2.enum(["recorded", "private"]);
+var webTTYEncryptionModeSchema = z2.enum(["managed", "e2e"]);
+var webTTYSessionModeSchema = z2.enum([
+  "interactive",
+  "non-interactive"
+]);
+var webTTYOriginSchema = z2.enum([
+  "human",
+  "codex",
+  "api",
+  "automation",
+  "ci",
+  "scheduled-job"
+]);
+var webTTYParticipantRoleSchema = z2.enum(["controller", "spectator"]);
+var webTTYInitiatorKindSchema = z2.enum([
+  "user",
+  "app",
+  "agent",
+  "service-account"
+]);
+var webTTYContextMetadataSchema = z2.object({
+  origin: webTTYOriginSchema.optional(),
+  origin_id: z2.string().optional(),
+  purpose: z2.string().optional(),
+  initiator_kind: webTTYInitiatorKindSchema.optional(),
+  agent_name: z2.string().optional(),
+  agent_version: z2.string().optional(),
+  request_id: z2.string().optional(),
+  labels: z2.record(z2.string(), z2.string()).optional()
+}).passthrough();
+
+// src/stream.ts
+import * as z3 from "zod";
+var nonEmptyStringSchema = z3.string().min(1);
+var isoDateTimeSchema = z3.string().datetime({ offset: true });
+var ipAddressSchema = z3.string();
+var intNonNegSchema = z3.number().int().nonnegative();
+var numNonNegSchema = z3.number().nonnegative();
+var geolocationSchema = z3.object({
+  country: z3.string().optional(),
+  region: z3.string().optional()
+});
+var streamTLSInfoSchema = z3.object({
+  version: z3.string().min(1).optional(),
+  cipher: z3.string().min(1).optional(),
+  protocol: z3.string().min(1).optional(),
+  curve: z3.string().min(1).optional(),
+  ech: z3.boolean().optional()
+});
+var streamEndpointSchema = z3.object({
+  ip: ipAddressSchema.optional(),
+  geolocation: geolocationSchema.optional(),
+  tls: streamTLSInfoSchema.optional()
+});
+var httpHeadersSchema = z3.record(
+  z3.string(),
+  z3.union([z3.string(), z3.array(z3.string())])
+);
+var httpProtocolSchema = z3.enum(["http/1.1", "h2", "h2c", "h3"]);
+var httpRequestSchema = z3.object({
+  method: nonEmptyStringSchema,
+  scheme: z3.string().min(1).optional(),
+  host: nonEmptyStringSchema.optional(),
+  path: nonEmptyStringSchema.optional(),
+  query: z3.string().optional(),
+  url: nonEmptyStringSchema.optional(),
+  headers: httpHeadersSchema.optional(),
+  userAgent: z3.string().optional()
+});
+var httpResponseSchema = z3.object({
+  status: z3.number().int().min(100).max(999),
+  headers: httpHeadersSchema.optional()
+});
+var httpRequestStageSchema = z3.object({
+  protocol: httpProtocolSchema.optional(),
+  request: httpRequestSchema
+});
+var httpResponseStageSchema = z3.object({
+  protocol: httpProtocolSchema.optional(),
+  response: httpResponseSchema
+});
+var streamEntrySchema = z3.object({
+  kind: z3.enum([
+    "published_tunnel",
+    "private_rstream",
+    "proxy_egress",
+    "internal"
+  ]),
+  transport: z3.enum(["rstream", "tls", "quic", "dtls", "http", "tcp"]).optional()
+});
+var tokenSourceSchema = z3.enum([
+  "authorization",
+  "query",
+  "client",
+  "unknown"
+]);
+var tokenTypeSchema = z3.enum(["auth", "pat", "app", "unknown"]);
+var firewallRuleSchema = z3.discriminatedUnion("kind", [
+  z3.object({ kind: z3.literal("none") }),
+  z3.object({ kind: z3.literal("mtls") }),
+  z3.object({
+    kind: z3.literal("rstream_auth"),
+    source: z3.literal("rstream_auth")
+  }),
+  z3.object({
+    kind: z3.literal("rstream"),
+    source: z3.literal("private_rstream").optional()
+  }),
+  z3.object({
+    kind: z3.literal("token"),
+    source: tokenSourceSchema.optional(),
+    tokenType: tokenTypeSchema.optional()
+  })
+]);
+var unauthorizedSourceSchema = z3.object({
+  source: tokenSourceSchema
+});
+var unauthorizedReasonSchema = (shape) => z3.object(shape).merge(unauthorizedSourceSchema);
+var unauthorizedSchema = z3.discriminatedUnion("reason", [
+  unauthorizedReasonSchema({
+    reason: z3.literal("missing_token")
+  }),
+  unauthorizedReasonSchema({
+    reason: z3.literal("invalid_token")
+  }),
+  unauthorizedReasonSchema({
+    reason: z3.literal("expired_token")
+  }),
+  unauthorizedReasonSchema({
+    reason: z3.literal("invalid_secret")
+  }),
+  unauthorizedReasonSchema({
+    reason: z3.literal("user_mismatch")
+  }),
+  unauthorizedReasonSchema({
+    reason: z3.literal("insufficient_scope")
+  }),
+  unauthorizedReasonSchema({
+    reason: z3.literal("policy_denied"),
+    policy: z3.enum(["ip", "geo", "mtls", "challenge", "other"]),
+    value: z3.string().optional()
+  })
+]);
+var failureSchema = z3.discriminatedUnion("kind", [
+  z3.object({
+    kind: z3.literal("timeout"),
+    timeoutMs: intNonNegSchema.optional(),
+    message: z3.string().optional()
+  }),
+  z3.object({
+    kind: z3.literal("unauthorized"),
+    why: unauthorizedSchema,
+    message: z3.string().optional()
+  }),
+  z3.object({
+    kind: z3.literal("not_found"),
+    resource: z3.enum(["tunnel", "client", "route"]),
+    message: z3.string().optional()
+  }),
+  z3.object({
+    kind: z3.literal("refused"),
+    reason: z3.enum(["capacity", "policy", "unsupported", "other"]),
+    message: z3.string().optional()
+  }),
+  z3.object({ kind: z3.literal("io"), message: z3.string().optional() }),
+  z3.object({ kind: z3.literal("internal"), message: z3.string().optional() })
+]);
+var firewallSchema = z3.discriminatedUnion("decision", [
+  z3.object({ decision: z3.literal("allowed"), rule: firewallRuleSchema }),
+  z3.object({
+    decision: z3.literal("denied"),
+    rule: firewallRuleSchema,
+    failure: failureSchema
+  })
+]);
+var routedTunnelSchema = z3.object({
+  tunnelId: nonEmptyStringSchema.optional(),
+  tunnelName: z3.string().optional(),
+  hostname: z3.string().optional(),
+  protocol: z3.string().optional(),
+  published: z3.boolean().optional(),
+  type: z3.string().optional(),
+  tlsMode: z3.string().optional(),
+  httpVersion: z3.string().optional(),
+  httpUseTls: z3.boolean().optional(),
+  upstreamTls: z3.boolean().optional(),
+  tokenAuth: z3.boolean().optional(),
+  mtls_auth: z3.boolean().optional()
+});
+var routingSchema = z3.discriminatedUnion("decision", [
+  z3.object({ decision: z3.literal("routed"), tunnel: routedTunnelSchema }),
+  z3.object({ decision: z3.literal("not_routed"), failure: failureSchema })
+]);
+var streamConnectedMetricsSchema = z3.object({
+  establish_ms: numNonNegSchema,
+  duration_ms: numNonNegSchema,
+  upstream_bytes: intNonNegSchema,
+  downstream_bytes: intNonNegSchema
+});
+var streamFailedMetricsSchema = z3.object({
+  time_to_fail_ms: numNonNegSchema.optional(),
+  establish_ms: numNonNegSchema.optional()
+});
+var terminationSchema = z3.object({
+  by: z3.enum(["downstream", "upstream", "server", "unknown"]),
+  reason: z3.enum(["closed", "reset", "timeout", "error", "unknown"]),
+  message: z3.string().optional()
+});
+var responseConnectedSchema = z3.object({
+  outcome: z3.literal("connected"),
+  established_at: isoDateTimeSchema,
+  upstream: streamEndpointSchema.optional(),
+  metrics: streamConnectedMetricsSchema,
+  termination: terminationSchema.optional(),
+  http: httpResponseStageSchema.optional()
+});
+var responseFailedSchema = z3.object({
+  outcome: z3.literal("failed"),
+  failure: failureSchema,
+  upstream: streamEndpointSchema.optional(),
+  metrics: streamFailedMetricsSchema.optional(),
+  termination: terminationSchema.optional(),
+  http: httpResponseStageSchema.optional()
+});
+var responseSchema = z3.discriminatedUnion("outcome", [
+  responseConnectedSchema,
+  responseFailedSchema
+]);
+var streamWebTTYMetadataSchema = z3.object({
+  server_id: nonEmptyStringSchema.optional(),
+  session_id: nonEmptyStringSchema.optional(),
+  session_group_id: nonEmptyStringSchema.optional(),
+  participant_id: nonEmptyStringSchema.optional(),
+  participant_role: webTTYParticipantRoleSchema.optional(),
+  controller: z3.boolean().optional(),
+  recording_mode: webTTYRecordingModeSchema.optional(),
+  encryption_mode: webTTYEncryptionModeSchema.optional(),
+  encryption_policy: z3.enum(["disabled", "explicit_key", "workspace_managed"]).optional(),
+  e2e: z3.boolean().optional(),
+  client_proof: z3.enum(["none", "required"]).optional(),
+  session_mode: webTTYSessionModeSchema.optional(),
+  downstream_transport: webTTYTransportSchema.optional(),
+  upstream_transport: webTTYTransportSchema.optional(),
+  origin: webTTYOriginSchema.optional(),
+  origin_id: z3.string().optional(),
+  initiator_kind: webTTYInitiatorKindSchema.optional(),
+  device_id: z3.string().optional(),
+  browser_id: z3.string().optional()
+}).passthrough();
+var streamSummarySchema = z3.object({
+  workspace_id: nonEmptyStringSchema.optional(),
+  project_id: nonEmptyStringSchema.optional(),
+  cluster_id: nonEmptyStringSchema.optional(),
+  user_id: nonEmptyStringSchema.optional(),
+  client_id: nonEmptyStringSchema.optional(),
+  tunnel_id: nonEmptyStringSchema.optional(),
+  stream_id: nonEmptyStringSchema,
+  created_at: isoDateTimeSchema,
+  terminated_at: isoDateTimeSchema,
+  request: z3.object({
+    downstream: streamEndpointSchema,
+    entry: streamEntrySchema.optional(),
+    http: httpRequestStageSchema.optional()
+  }),
+  firewall: firewallSchema,
+  routing: routingSchema,
+  webtty: streamWebTTYMetadataSchema.optional(),
+  response: responseSchema
+});
+function formatStreamAccessPath(entry) {
+  if (!entry) return void 0;
+  switch (entry.kind) {
+    case "published_tunnel":
+      return "Public URL";
+    case "private_rstream":
+      return "Private rstream dial";
+    case "proxy_egress":
+      return "Proxy egress";
+    case "internal":
+      return "Internal";
+    default:
+      return void 0;
+  }
+}
+
+// src/webtty-resource.ts
+import * as z4 from "zod";
+var isoDateTimeSchema2 = z4.string().datetime({ offset: true });
+var decimalCursorSchema = z4.string().regex(/^\d+$/);
+var webTTYSequenceCursorInputSchema = z4.union([
+  decimalCursorSchema,
+  z4.number().int().nonnegative().safe().transform(String)
+]);
+var webTTYSessionStatusSchema = z4.enum([
+  "opening",
+  "active",
+  "closing",
+  "closed",
+  "errored"
+]);
+var webTTYControlRequestStatusSchema = z4.enum([
+  "pending",
+  "granted",
+  "refused",
+  "revoked",
+  "expired"
+]);
+var webTTYEventDirectionSchema = z4.enum([
+  "client_to_server",
+  "server_to_client",
+  "engine_internal"
+]);
+var webTTYStreamTypeSchema = z4.enum(["stdin", "stdout", "stderr"]);
+var webTTYSessionEventTypeSchema = z4.enum([
+  "open",
+  "ack",
+  "data",
+  "resize",
+  "close",
+  "error",
+  "participant",
+  "control",
+  "recording_state"
+]);
+var jsonRecordSchema = z4.record(z4.string(), z4.unknown());
+function rejectCryptoKeyEnvelopes(crypto, ctx, path) {
+  if (crypto === null || typeof crypto !== "object") {
+    return;
+  }
+  if (Object.prototype.hasOwnProperty.call(crypto, "key_envelopes")) {
+    ctx.addIssue({
+      code: z4.ZodIssueCode.custom,
+      message: "key_envelopes are available only from the WebTTY decrypt-material endpoint.",
+      path: [...path, "key_envelopes"]
+    });
+  }
+}
+var webTTYCapabilitiesSchema = z4.object({
+  managed_protocol: z4.boolean(),
+  store_configured: z4.boolean(),
+  session_listing: z4.boolean(),
+  recording: z4.boolean(),
+  replay: z4.boolean(),
+  live_attach: z4.boolean(),
+  control_transfer: z4.boolean(),
+  e2e: z4.boolean(),
+  implemented_transports: z4.array(webTTYTransportSchema),
+  recording_modes: z4.array(webTTYRecordingModeSchema),
+  encryption_modes: z4.array(webTTYEncryptionModeSchema),
+  required_permissions: z4.record(z4.string(), z4.array(z4.string()))
+});
+var webTTYSessionLiveSchema = z4.object({
+  available: z4.boolean(),
+  attachable: z4.boolean(),
+  participant_count: z4.number().int().nonnegative(),
+  controller_participant_id: z4.string().optional(),
+  has_upstream: z4.boolean()
+});
+var webTTYParticipantLiveSchema = z4.object({
+  connected: z4.boolean(),
+  controller: z4.boolean()
+});
+var webTTYSessionSchema = z4.object({
+  id: z4.string(),
+  workspace_id: z4.string().optional(),
+  project_id: z4.string().optional(),
+  cluster_id: z4.string().optional(),
+  server_id: z4.string().optional(),
+  tunnel_id: z4.string(),
+  client_id: z4.string().optional(),
+  initiator_user_id: z4.string().optional(),
+  group_id: z4.string().optional(),
+  status: webTTYSessionStatusSchema,
+  session_mode: webTTYSessionModeSchema,
+  recording_mode: webTTYRecordingModeSchema,
+  encryption_mode: webTTYEncryptionModeSchema,
+  downstream_transport: webTTYTransportSchema.optional(),
+  upstream_transport: webTTYTransportSchema.optional(),
+  command_meta: z4.unknown().optional(),
+  context: webTTYContextMetadataSchema.optional(),
+  started_at: isoDateTimeSchema2,
+  ended_at: isoDateTimeSchema2.optional(),
+  exit_code: z4.number().int().optional(),
+  error_code: z4.string().optional(),
+  error_message: z4.string().optional(),
+  live: webTTYSessionLiveSchema.optional()
+}).passthrough();
+var webTTYSessionGroupSchema = z4.object({
+  id: z4.string(),
+  workspace_id: z4.string().optional(),
+  project_id: z4.string().optional(),
+  initiator_user_id: z4.string().optional(),
+  context: webTTYContextMetadataSchema.optional(),
+  created_at: isoDateTimeSchema2,
+  updated_at: isoDateTimeSchema2,
+  closed_at: isoDateTimeSchema2.optional()
+}).passthrough();
+var webTTYParticipantSchema = z4.object({
+  id: z4.string(),
+  session_id: z4.string(),
+  user_id: z4.string().optional(),
+  device_id: z4.string().optional(),
+  browser_id: z4.string().optional(),
+  role: webTTYParticipantRoleSchema,
+  attached_at: isoDateTimeSchema2,
+  detached_at: isoDateTimeSchema2.optional(),
+  controller: z4.boolean(),
+  grant_state: z4.string().optional(),
+  attach_grant: z4.string().optional(),
+  attach_grant_expires_at: isoDateTimeSchema2.optional(),
+  live: webTTYParticipantLiveSchema.optional()
+}).passthrough();
+var webTTYCryptoMetadataSchema = z4.object({
+  payload_suite: z4.string().optional(),
+  payload_key_id: z4.string().optional(),
+  nonce: z4.string().optional(),
+  key_envelope_suite: z4.string().optional(),
+  key_envelopes: z4.unknown().optional(),
+  key_context: z4.unknown().optional(),
+  key_context_raw: z4.string().optional()
+}).passthrough();
+var webTTYSessionEventSchema = z4.object({
+  id: z4.string(),
+  session_id: z4.string(),
+  seq: decimalCursorSchema,
+  created_at: isoDateTimeSchema2,
+  type: webTTYSessionEventTypeSchema,
+  direction: webTTYEventDirectionSchema.optional(),
+  stream_type: webTTYStreamTypeSchema.optional(),
+  participant_id: z4.string().optional(),
+  payload_length: z4.number().int().nonnegative().optional(),
+  payload_ciphertext: z4.string().optional(),
+  payload_plaintext: z4.string().optional(),
+  crypto: webTTYCryptoMetadataSchema.optional(),
+  prev_hash: z4.string().optional(),
+  hash: z4.string().optional(),
+  metadata: z4.unknown().optional()
+}).passthrough().superRefine((value, ctx) => {
+  rejectCryptoKeyEnvelopes(value.crypto, ctx, ["crypto"]);
+});
+var webTTYKeyGrantBaseShape = {
+  id: z4.string(),
+  session_id: z4.string(),
+  recipient_id: z4.string(),
+  recipient_kind: z4.string(),
+  granted_by: z4.string().optional(),
+  crypto: webTTYCryptoMetadataSchema,
+  created_at: isoDateTimeSchema2,
+  revoked_at: isoDateTimeSchema2.optional()
+};
+var webTTYKeyGrantSchema = z4.object(webTTYKeyGrantBaseShape).passthrough().superRefine((value, ctx) => {
+  if (Object.prototype.hasOwnProperty.call(value, "wrapped_key")) {
+    ctx.addIssue({
+      code: z4.ZodIssueCode.custom,
+      message: "wrapped_key is available only from the WebTTY decrypt-material endpoint.",
+      path: ["wrapped_key"]
+    });
+  }
+  rejectCryptoKeyEnvelopes(value.crypto, ctx, ["crypto"]);
+});
+var webTTYKeyGrantDecryptMaterialSchema = z4.object({
+  ...webTTYKeyGrantBaseShape,
+  wrapped_key: z4.string().optional()
+}).passthrough();
+var webTTYControlRequestSchema = z4.object({
+  id: z4.string(),
+  session_id: z4.string(),
+  requester_participant_id: z4.string(),
+  requester_user_id: z4.string().optional(),
+  approver_participant_id: z4.string().optional(),
+  approver_user_id: z4.string().optional(),
+  status: webTTYControlRequestStatusSchema,
+  reason: z4.string().optional(),
+  metadata: z4.unknown().optional(),
+  created_at: isoDateTimeSchema2,
+  updated_at: isoDateTimeSchema2,
+  resolved_at: isoDateTimeSchema2.optional(),
+  expires_at: isoDateTimeSchema2.optional()
+}).passthrough();
+var listWebTTYSessionsFiltersSchema = z4.object({
+  server_id: z4.string().optional(),
+  tunnel_id: z4.string().optional(),
+  user_id: z4.string().optional(),
+  group_id: z4.string().optional(),
+  origin: webTTYOriginSchema.optional(),
+  status: webTTYSessionStatusSchema.optional(),
+  started_from: isoDateTimeSchema2.optional(),
+  started_to: isoDateTimeSchema2.optional()
+});
+var listWebTTYSessionsParamsSchema = z4.object({
+  limit: z4.number().int().min(1).optional(),
+  filters: listWebTTYSessionsFiltersSchema.optional()
+});
+var listWebTTYSessionGroupsFiltersSchema = z4.object({
+  initiator_user_id: z4.string().optional(),
+  origin: webTTYOriginSchema.optional(),
+  created_from: isoDateTimeSchema2.optional(),
+  created_to: isoDateTimeSchema2.optional()
+});
+var listWebTTYSessionGroupsParamsSchema = z4.object({
+  limit: z4.number().int().min(1).optional(),
+  filters: listWebTTYSessionGroupsFiltersSchema.optional()
+});
+var readWebTTYSessionEventsParamsSchema = z4.object({
+  from_seq: webTTYSequenceCursorInputSchema.optional(),
+  limit: z4.number().int().min(1).optional()
+});
+var listWebTTYKeyGrantDecryptMaterialParamsSchema = z4.object({
+  recipient_id: z4.string().optional(),
+  recipient_kind: z4.string().optional()
+});
+var listWebTTYControlRequestsFiltersSchema = z4.object({
+  status: webTTYControlRequestStatusSchema.optional(),
+  requester_user_id: z4.string().optional()
+});
+var listWebTTYControlRequestsParamsSchema = z4.object({
+  limit: z4.number().int().min(1).optional(),
+  filters: listWebTTYControlRequestsFiltersSchema.optional()
+});
+var attachWebTTYParticipantParamsSchema = z4.object({
+  role: z4.literal("spectator").optional(),
+  device_id: z4.string().optional(),
+  browser_id: z4.string().optional(),
+  transport: webTTYTransportSchema.optional(),
+  grant_state: z4.string().optional(),
+  metadata: jsonRecordSchema.optional()
+});
+var detachWebTTYParticipantParamsSchema = z4.object({
+  reason: z4.string().optional(),
+  metadata: jsonRecordSchema.optional()
+});
+var createWebTTYControlRequestParamsSchema = z4.object({
+  participant_id: z4.string(),
+  reason: z4.string().optional(),
+  metadata: jsonRecordSchema.optional(),
+  expires_at: isoDateTimeSchema2.optional()
+});
+var resolveWebTTYControlRequestParamsSchema = z4.object({
+  action: z4.enum(["grant", "refuse", "revoke"]),
+  approver_participant_id: z4.string().optional(),
+  reason: z4.string().optional()
+});
+var webTTYSessionListSchema = z4.array(webTTYSessionSchema);
+var webTTYSessionGroupListSchema = z4.array(webTTYSessionGroupSchema);
+var webTTYParticipantListSchema = z4.array(webTTYParticipantSchema);
+var webTTYSessionEventListSchema = z4.array(webTTYSessionEventSchema);
+var webTTYKeyGrantListSchema = z4.array(webTTYKeyGrantSchema);
+var webTTYKeyGrantDecryptMaterialListSchema = z4.array(
+  webTTYKeyGrantDecryptMaterialSchema
+);
+var webTTYControlRequestListSchema = z4.array(webTTYControlRequestSchema);
+function pathId(kind, value) {
+  const normalized = value.trim();
+  if (!normalized) {
+    throw new Error(`${kind} is required.`);
+  }
+  return encodeURIComponent(normalized);
+}
+function pathWithParams(path, params) {
+  if (params === void 0) {
+    return path;
+  }
+  return `${path}?params=${encodeURIComponent(JSON.stringify(params))}`;
+}
+var RstreamWebTTYResource = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async capabilities() {
+    const response = await this.client.request(
+      "/webtty/capabilities",
+      {
+        method: "GET"
+      }
+    );
+    return webTTYCapabilitiesSchema.parse(response);
+  }
+  async listGroups(params) {
+    const parsed = params === void 0 ? void 0 : listWebTTYSessionGroupsParamsSchema.parse(params);
+    const response = await this.client.request(
+      pathWithParams("/webtty/groups", parsed),
+      { method: "GET" }
+    );
+    return webTTYSessionGroupListSchema.parse(response);
+  }
+  async getGroup(groupId) {
+    const response = await this.client.request(
+      `/webtty/groups/${pathId("Session group ID", groupId)}`,
+      { method: "GET" }
+    );
+    return webTTYSessionGroupSchema.parse(response);
+  }
+  async listSessions(params) {
+    const parsed = params === void 0 ? void 0 : listWebTTYSessionsParamsSchema.parse(params);
+    const response = await this.client.request(
+      pathWithParams("/webtty/sessions", parsed),
+      { method: "GET" }
+    );
+    return webTTYSessionListSchema.parse(response);
+  }
+  async getSession(sessionId) {
+    const response = await this.client.request(
+      `/webtty/sessions/${pathId("Session ID", sessionId)}`,
+      { method: "GET" }
+    );
+    return webTTYSessionSchema.parse(response);
+  }
+  async listParticipants(sessionId) {
+    const response = await this.client.request(
+      `/webtty/sessions/${pathId("Session ID", sessionId)}/participants`,
+      { method: "GET" }
+    );
+    return webTTYParticipantListSchema.parse(response);
+  }
+  async attachParticipant(sessionId, params = {}) {
+    const response = await this.client.request(
+      `/webtty/sessions/${pathId("Session ID", sessionId)}/participants`,
+      {
+        body: JSON.stringify(attachWebTTYParticipantParamsSchema.parse(params)),
+        headers: { "Content-Type": "application/json" },
+        method: "POST"
+      }
+    );
+    return webTTYParticipantSchema.parse(response);
+  }
+  async detachParticipant(sessionId, participantId, params = {}) {
+    const response = await this.client.request(
+      `/webtty/sessions/${pathId("Session ID", sessionId)}/participants/${pathId("Participant ID", participantId)}`,
+      {
+        body: JSON.stringify(detachWebTTYParticipantParamsSchema.parse(params)),
+        headers: { "Content-Type": "application/json" },
+        method: "POST"
+      }
+    );
+    return webTTYParticipantSchema.parse(response);
+  }
+  async readEvents(sessionId, params) {
+    const parsed = params === void 0 ? void 0 : readWebTTYSessionEventsParamsSchema.parse(params);
+    const response = await this.client.request(
+      pathWithParams(
+        `/webtty/sessions/${pathId("Session ID", sessionId)}/events`,
+        parsed
+      ),
+      { method: "GET" }
+    );
+    return webTTYSessionEventListSchema.parse(response);
+  }
+  async listKeyGrants(sessionId) {
+    const response = await this.client.request(
+      `/webtty/sessions/${pathId("Session ID", sessionId)}/key-grants`,
+      { method: "GET" }
+    );
+    return webTTYKeyGrantListSchema.parse(response);
+  }
+  async listKeyGrantDecryptMaterial(sessionId, params) {
+    const parsed = params === void 0 ? void 0 : listWebTTYKeyGrantDecryptMaterialParamsSchema.parse(params);
+    const response = await this.client.request(
+      pathWithParams(
+        `/webtty/sessions/${pathId("Session ID", sessionId)}/key-grants/decrypt-material`,
+        parsed
+      ),
+      { method: "GET" }
+    );
+    return webTTYKeyGrantDecryptMaterialListSchema.parse(response);
+  }
+  async listControlRequests(sessionId, params) {
+    const parsed = params === void 0 ? void 0 : listWebTTYControlRequestsParamsSchema.parse(params);
+    const response = await this.client.request(
+      pathWithParams(
+        `/webtty/sessions/${pathId("Session ID", sessionId)}/control-requests`,
+        parsed
+      ),
+      { method: "GET" }
+    );
+    return webTTYControlRequestListSchema.parse(response);
+  }
+  async createControlRequest(sessionId, params) {
+    const response = await this.client.request(
+      `/webtty/sessions/${pathId("Session ID", sessionId)}/control-requests`,
+      {
+        body: JSON.stringify(
+          createWebTTYControlRequestParamsSchema.parse(params)
+        ),
+        headers: { "Content-Type": "application/json" },
+        method: "POST"
+      }
+    );
+    return webTTYControlRequestSchema.parse(response);
+  }
+  async resolveControlRequest(sessionId, requestId, params) {
+    const response = await this.client.request(
+      `/webtty/sessions/${pathId("Session ID", sessionId)}/control-requests/${pathId("Control request ID", requestId)}`,
+      {
+        body: JSON.stringify(
+          resolveWebTTYControlRequestParamsSchema.parse(params)
+        ),
+        headers: { "Content-Type": "application/json" },
+        method: "POST"
+      }
+    );
+    return webTTYControlRequestSchema.parse(response);
+  }
+};
+
+// src/event.ts
+import { tunnelSchema } from "@rstreamlabs/rstream/tunnel";
+import * as z5 from "zod";
+var isoDateTimeSchema3 = z5.string().datetime({ offset: true });
+var initialStateSchema = z5.object({
+  snapshot_at: isoDateTimeSchema3,
+  clients: z5.array(clientSchema),
+  tunnels: z5.array(tunnelSchema)
+});
+var eventBaseSchema = z5.object({
+  id: z5.string().optional(),
+  created_at: isoDateTimeSchema3.optional(),
+  user_id: z5.string().optional(),
+  workspace_id: z5.string().optional(),
+  project_id: z5.string().optional(),
+  cluster_id: z5.string().optional()
+});
+var withEventBase = (shape) => z5.object(shape).merge(eventBaseSchema).passthrough();
+var stateInitialEventSchema = withEventBase({
+  type: z5.literal("state.initial"),
+  object: initialStateSchema
+});
+var streamSummaryEventSchema = withEventBase({
+  type: z5.literal("stream.summary"),
+  object: streamSummarySchema
+});
+var commonEventsSchema = [
+  withEventBase({
+    type: z5.literal("client.created"),
+    object: clientSchema
+  }),
+  withEventBase({
+    type: z5.literal("client.updated"),
+    object: clientSchema
+  }),
+  withEventBase({
+    type: z5.literal("client.deleted"),
+    object: clientSchema
+  }),
+  withEventBase({
+    type: z5.literal("tunnel.created"),
+    object: tunnelSchema
+  }),
+  withEventBase({
+    type: z5.literal("tunnel.updated"),
+    object: tunnelSchema
+  }),
+  withEventBase({
+    type: z5.literal("tunnel.deleted"),
+    object: tunnelSchema
+  })
+];
+var webTTYEventsSchema = [
+  withEventBase({
+    type: z5.literal("webtty.session.created"),
+    object: webTTYSessionSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.session.updated"),
+    object: z5.union([webTTYSessionSchema, webTTYSessionGroupSchema])
+  }),
+  withEventBase({
+    type: z5.literal("webtty.session.ended"),
+    object: webTTYSessionSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.participant.joined"),
+    object: webTTYParticipantSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.participant.updated"),
+    object: webTTYParticipantSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.participant.left"),
+    object: webTTYParticipantSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.control.requested"),
+    object: webTTYControlRequestSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.control.granted"),
+    object: webTTYControlRequestSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.control.refused"),
+    object: webTTYControlRequestSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.control.revoked"),
+    object: webTTYControlRequestSchema
+  })
+];
+var webhookDeliverableEventsSchema = [
+  commonEventsSchema[0],
+  commonEventsSchema[2],
+  commonEventsSchema[3],
+  commonEventsSchema[5],
+  ...webTTYEventsSchema
+];
+var wsEventsSchema = z5.union([
+  stateInitialEventSchema,
+  ...commonEventsSchema,
+  ...webTTYEventsSchema
+]);
+var webhookEventsSchema = z5.union(webhookDeliverableEventsSchema);
+var projectLogEventsSchema = streamSummaryEventSchema;
+var eventSchema = z5.union([
+  wsEventsSchema,
+  webhookEventsSchema,
+  projectLogEventsSchema
+]);
+
+// src/tunnel.ts
+import { tunnelSchema as tunnelSchema2 } from "@rstreamlabs/rstream/tunnel";
+import * as z6 from "zod";
+var DEFAULT_PUBLISHED_PORT = 443;
+var tunnelFilterSchema = tunnelSchema2.pick({
+  id: true,
+  name: true,
+  type: true,
+  status: true,
+  client_id: true,
+  user_id: true,
+  publish: true,
+  protocol: true,
+  hostname: true,
+  http_version: true,
+  labels: true
+}).partial();
+var listTunnelsParamsSchema = z6.object({
+  limit: z6.number().int().min(1).optional(),
+  filters: tunnelFilterSchema.optional()
+});
+var listTunnelsResponseSchema = z6.array(tunnelSchema2);
+function formatTunnelHost(tunnel) {
+  if (!tunnel.hostname) return tunnel.host;
+  if (!tunnel.port || tunnel.port === DEFAULT_PUBLISHED_PORT) {
+    return tunnel.hostname;
+  }
+  return `${tunnel.hostname}:${tunnel.port}`;
+}
+
+// src/openapi.ts
+import { tunnelSchema as tunnelSchema3 } from "@rstreamlabs/rstream/tunnel";
+import * as z7 from "zod";
+var jsonContentType = "application/json";
+var openApiContentType = "application/vnd.oai.openapi+json;version=3.1";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function dropSchemaKeyword(value) {
+  if (!isRecord(value)) return value;
+  return Object.fromEntries(
+    Object.entries(value).filter(([key]) => key !== "$schema")
+  );
+}
+function jsonSchemaFor(schema) {
+  return dropSchemaKeyword(
+    z7.toJSONSchema(schema, {
+      unrepresentable: "any",
+      override: (ctx) => {
+        if (ctx.zodSchema instanceof z7.ZodDate) {
+          ctx.jsonSchema.type = "string";
+          ctx.jsonSchema.format = "date-time";
+        }
+      }
+    })
+  );
+}
+function jsonArrayResponse(description, itemSchemaRef) {
+  return {
+    description,
+    content: {
+      [jsonContentType]: {
+        schema: {
+          type: "array",
+          items: {
+            $ref: itemSchemaRef
+          }
+        }
+      }
+    }
+  };
+}
+function streamResponse(description) {
+  return {
+    description,
+    content: {
+      "text/event-stream": {
+        schema: {
+          type: "string"
+        }
+      }
+    }
+  };
+}
+function errorResponse(description) {
+  return {
+    description
+  };
+}
+function queryJsonParameter(name, description, schemaRef, examples) {
+  return {
+    name,
+    in: "query",
+    required: false,
+    description,
+    content: {
+      [jsonContentType]: {
+        schema: {
+          $ref: schemaRef
+        },
+        ...examples ? { examples } : {}
+      }
+    }
+  };
+}
+var readEngineStateRule = {
+  resource: ["engine.tunnels", "engine.streams"],
+  action: "read"
+};
+var readEngineStateRules = [readEngineStateRule];
+var readEngineStreamsRules = [
+  {
+    resource: "engine.streams",
+    action: "read"
+  }
+];
+var watchParamsSchema = z7.object({
+  clients: clientFilterSchema.optional(),
+  tunnels: tunnelFilterSchema.optional()
+});
+var enginePermissions = {
+  "tunnels.resources.read-only": {
+    name: "Discovery: Read-Only",
+    description: "Read active clients, active tunnels, and live state events.",
+    rules: [readEngineStateRule]
+  },
+  "tunnels.tunnels.create-delete": {
+    name: "Tunnels: Create and Delete",
+    description: "Create and close tunnels through the CLI, SDK, or engine control channel.",
+    rules: [
+      {
+        resource: "engine.tunnels",
+        action: ["create", "delete"]
+      }
+    ]
+  },
+  "tunnels.streams.create-delete": {
+    name: "Connections: Create and Delete",
+    description: "Open and close private tunnel streams and WebTTY connections.",
+    rules: [
+      {
+        resource: "engine.streams",
+        action: ["create", "delete"]
+      }
+    ]
+  },
+  "webtty.sessions.read-only": {
+    name: "WebTTY Sessions: Read-Only",
+    description: "List managed WebTTY sessions, participants, replay state, and join as a spectator.",
+    rules: [
+      {
+        resource: "engine.webtty.sessions",
+        action: "read"
+      }
+    ]
+  },
+  "webtty.sessions.read-write": {
+    name: "WebTTY Sessions: Read and Write",
+    description: "Create managed WebTTY sessions and coordinate control requests for active sessions.",
+    rules: [
+      {
+        resource: "engine.webtty.sessions",
+        action: ["read", "write"]
+      }
+    ]
+  },
+  "webtty.logs.read-only": {
+    name: "WebTTY Session Logs: Read-Only",
+    description: "Read managed WebTTY session logs. End-to-end encrypted content still requires trusted local key material.",
+    rules: [
+      {
+        resource: "engine.webtty.sessions",
+        action: "read"
+      },
+      {
+        resource: "engine.webtty.logs",
+        action: "read"
+      }
+    ]
+  }
+};
+var engineOpenApiDocument = {
+  openapi: "3.1.0",
+  info: {
+    title: "rstream Engine API",
+    version: "1.0.0",
+    description: "Operational Engine API exposed by rstream engine. This surface is scoped to the authenticated engine or project endpoint and covers live clients, live tunnels, and state-change streams."
+  },
+  servers: [
+    {
+      url: "https://{engine}",
+      description: "Project-scoped rstream engine endpoint.",
+      variables: {
+        engine: {
+          default: "project-endpoint.cluster-host:443",
+          description: "Use the engine value returned by project discovery or configured in RSTREAM_ENGINE."
+        }
+      }
+    }
+  ],
+  security: [
+    {
+      bearerAuth: []
+    }
+  ],
+  components: {
+    securitySchemes: {
+      bearerAuth: {
+        type: "http",
+        scheme: "bearer",
+        bearerFormat: "rstream token",
+        description: "Preferred authentication mechanism. Send an OAuth-issued rstream access token or compatible rstream credential in Authorization: Bearer <token>."
+      }
+    },
+    parameters: {
+      ListClientsParams: queryJsonParameter(
+        "params",
+        "JSON-encoded ListClientsParams object.",
+        "#/components/schemas/ListClientsParams",
+        {
+          filterByAgent: {
+            value: {
+              limit: 10,
+              filters: {
+                agent: "rstream",
+                channel: "stable"
+              }
+            }
+          }
+        }
+      ),
+      ListTunnelsParams: queryJsonParameter(
+        "params",
+        "JSON-encoded ListTunnelsParams object.",
+        "#/components/schemas/ListTunnelsParams",
+        {
+          filterByLabels: {
+            value: {
+              filters: {
+                labels: {
+                  service: "ssh",
+                  env: "prod"
+                }
+              }
+            }
+          }
+        }
+      ),
+      WatchParams: queryJsonParameter(
+        "params",
+        "JSON-encoded WatchParams object. The same shape is accepted by SSE and WebSocket transports.",
+        "#/components/schemas/WatchParams",
+        {
+          watchTaggedTunnels: {
+            value: {
+              clients: {
+                agent: "rstream"
+              },
+              tunnels: {
+                labels: {
+                  service: "ssh"
+                }
+              }
+            }
+          }
+        }
+      )
+    },
+    responses: {
+      BadRequest: errorResponse("Request validation failed."),
+      Unauthorized: errorResponse("Authentication is required."),
+      Forbidden: errorResponse("The token is not authorized.")
+    },
+    schemas: {
+      Client: jsonSchemaFor(clientSchema),
+      Event: jsonSchemaFor(wsEventsSchema),
+      ListClientsParams: jsonSchemaFor(listClientsParamsSchema),
+      ListTunnelsParams: jsonSchemaFor(listTunnelsParamsSchema),
+      TunnelListItem: jsonSchemaFor(tunnelSchema3),
+      WatchParams: jsonSchemaFor(watchParamsSchema)
+    }
+  },
+  "x-rstream-agent-authentication": {
+    oauth_authorization_server_metadata: "https://rstream.io/.well-known/oauth-authorization-server",
+    oauth_protected_resource_metadata: "https://rstream.io/.well-known/oauth-protected-resource",
+    scope_selection: "Use x-rstream-required-rules to understand backend authorization checks. Choose OAuth scopes from x-rstream-permissions or use the task bundles in x-rstream-use-case-permissions."
+  },
+  "x-rstream-permissions": enginePermissions,
+  "x-rstream-use-case-permissions": {
+    "inspect-engine-state": ["tunnels.resources.read-only"],
+    "expose-service-from-cli": [
+      "tunnels.resources.read-only",
+      "tunnels.tunnels.create-delete"
+    ],
+    "connect-private-tunnel": [
+      "tunnels.resources.read-only",
+      "tunnels.streams.create-delete"
+    ],
+    "run-tunnel-webtty": [
+      "tunnels.resources.read-only",
+      "tunnels.tunnels.create-delete",
+      "tunnels.streams.create-delete"
+    ],
+    "join-managed-webtty": ["webtty.sessions.read-only"],
+    "control-managed-webtty": ["webtty.sessions.read-write"],
+    "read-managed-webtty-recordings": ["webtty.logs.read-only"]
+  },
+  paths: {
+    "/api/openapi.json": {
+      get: {
+        tags: ["Discovery"],
+        summary: "Return this OpenAPI description.",
+        operationId: "get_engine_openapi",
+        security: [],
+        responses: {
+          "200": {
+            description: "OpenAPI document.",
+            content: {
+              [openApiContentType]: {
+                schema: {
+                  type: "object"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/clients": {
+      get: {
+        tags: ["Runtime inventory"],
+        summary: "List visible engine clients.",
+        operationId: "list_engine_clients",
+        parameters: [{ $ref: "#/components/parameters/ListClientsParams" }],
+        security: [{ bearerAuth: [] }],
+        responses: {
+          "200": jsonArrayResponse(
+            "Visible clients.",
+            "#/components/schemas/Client"
+          ),
+          "400": { $ref: "#/components/responses/BadRequest" },
+          "401": { $ref: "#/components/responses/Unauthorized" },
+          "403": { $ref: "#/components/responses/Forbidden" }
+        },
+        "x-rstream-required-rules": readEngineStreamsRules
+      }
+    },
+    "/api/tunnels": {
+      get: {
+        tags: ["Runtime inventory"],
+        summary: "List visible engine tunnels.",
+        operationId: "list_engine_tunnels",
+        parameters: [{ $ref: "#/components/parameters/ListTunnelsParams" }],
+        security: [{ bearerAuth: [] }],
+        responses: {
+          "200": jsonArrayResponse(
+            "Visible tunnels. Fine-grained list scopes may filter objects and project fields.",
+            "#/components/schemas/TunnelListItem"
+          ),
+          "400": { $ref: "#/components/responses/BadRequest" },
+          "401": { $ref: "#/components/responses/Unauthorized" },
+          "403": { $ref: "#/components/responses/Forbidden" }
+        },
+        "x-rstream-required-rules": readEngineStateRules,
+        "x-rstream-token-metadata-scope": "metadata.scopes.tunnels.list"
+      }
+    },
+    "/api/sse": {
+      get: {
+        tags: ["Runtime watch"],
+        summary: "Subscribe to visible engine state through Server-Sent Events.",
+        operationId: "watch_engine_events_sse",
+        parameters: [{ $ref: "#/components/parameters/WatchParams" }],
+        security: [{ bearerAuth: [] }],
+        responses: {
+          "200": streamResponse(
+            "SSE stream. Each event is emitted as a data line containing a JSON Event object."
+          ),
+          "400": { $ref: "#/components/responses/BadRequest" },
+          "401": { $ref: "#/components/responses/Unauthorized" },
+          "403": { $ref: "#/components/responses/Forbidden" }
+        },
+        "x-rstream-event-schema": "#/components/schemas/Event",
+        "x-rstream-required-rules": readEngineStateRules
+      }
+    },
+    "/api/websocket": {
+      get: {
+        tags: ["Runtime watch"],
+        summary: "Subscribe to visible engine state through a WebSocket upgrade.",
+        operationId: "watch_engine_events_websocket",
+        parameters: [{ $ref: "#/components/parameters/WatchParams" }],
+        security: [{ bearerAuth: [] }],
+        responses: {
+          "101": {
+            description: "WebSocket connection accepted. Frames contain JSON Event objects."
+          },
+          "400": { $ref: "#/components/responses/BadRequest" },
+          "401": { $ref: "#/components/responses/Unauthorized" },
+          "403": { $ref: "#/components/responses/Forbidden" }
+        },
+        "x-rstream-event-schema": "#/components/schemas/Event",
+        "x-rstream-required-rules": readEngineStateRules
+      }
+    }
+  }
+};
+var engineOpenApiJson = `${JSON.stringify(
+  engineOpenApiDocument,
+  null,
+  2
+)}
+`;
+
+export {
+  clientSchema,
+  clientFilterSchema,
+  listClientsParamsSchema,
+  listClientsResponseSchema,
+  webTTYTransportSchema,
+  webTTYRecordingModeSchema,
+  webTTYEncryptionModeSchema,
+  webTTYSessionModeSchema,
+  webTTYOriginSchema,
+  webTTYParticipantRoleSchema,
+  webTTYContextMetadataSchema,
+  streamTLSInfoSchema,
+  streamEndpointSchema,
+  streamEntrySchema,
+  streamWebTTYMetadataSchema,
+  streamSummarySchema,
+  formatStreamAccessPath,
+  webTTYCapabilitiesSchema,
+  webTTYSessionLiveSchema,
+  webTTYParticipantLiveSchema,
+  webTTYSessionSchema,
+  webTTYSessionGroupSchema,
+  webTTYParticipantSchema,
+  webTTYCryptoMetadataSchema,
+  webTTYSessionEventSchema,
+  webTTYKeyGrantSchema,
+  webTTYKeyGrantDecryptMaterialSchema,
+  webTTYControlRequestSchema,
+  listWebTTYSessionsParamsSchema,
+  listWebTTYSessionGroupsParamsSchema,
+  readWebTTYSessionEventsParamsSchema,
+  listWebTTYKeyGrantDecryptMaterialParamsSchema,
+  listWebTTYControlRequestsParamsSchema,
+  attachWebTTYParticipantParamsSchema,
+  detachWebTTYParticipantParamsSchema,
+  createWebTTYControlRequestParamsSchema,
+  resolveWebTTYControlRequestParamsSchema,
+  RstreamWebTTYResource,
+  streamSummaryEventSchema,
+  wsEventsSchema,
+  webhookEventsSchema,
+  projectLogEventsSchema,
+  eventSchema,
+  tunnelFilterSchema,
+  listTunnelsParamsSchema,
+  listTunnelsResponseSchema,
+  formatTunnelHost,
+  engineOpenApiDocument,
+  engineOpenApiJson
+};