@rstreamlabs/tunnels 3.2.0 → 3.4.0

package/dist/index.js

@@ -39,10 +39,18 @@ __export(index_exports, {
   RstreamTunnelsClient: () => RstreamTunnelsClient,
   RstreamTunnelsResource: () => RstreamTunnelsResource,
   RstreamTunnelsRessource: () => RstreamTunnelsResource,
+  RstreamWebTTYResource: () => RstreamWebTTYResource,
   RstreamWebhookResource: () => RstreamWebhookResource,
   RstreamWebhookRessource: () => RstreamWebhookResource,
   Tunnels: () => RstreamTunnelsClient,
+  WEBHOOK_DELIVERY_ID_HEADER: () => WEBHOOK_DELIVERY_ID_HEADER,
+  WEBHOOK_EVENT_ID_HEADER: () => WEBHOOK_EVENT_ID_HEADER,
+  WEBHOOK_EVENT_TYPE_HEADER: () => WEBHOOK_EVENT_TYPE_HEADER,
+  WEBHOOK_ID_HEADER: () => WEBHOOK_ID_HEADER,
+  WEBHOOK_SIGNATURE_HEADER: () => WEBHOOK_SIGNATURE_HEADER,
   Watch: () => Watch,
+  attachWebTTYParticipantParamsSchema: () => attachWebTTYParticipantParamsSchema,
+  buildWebhookHeaders: () => buildWebhookHeaders,
   clientFilterSchema: () => clientFilterSchema,
   clientSchema: () => clientSchema,
   createAPITURNCredentials: () => createAPITURNCredentials,
@@ -50,28 +58,59 @@ __export(index_exports, {
   createAuthTokenFromClientCredentials: () => createAuthTokenFromClientCredentials,
   createPATTURNCredentials: () => createPATTURNCredentials,
   createTURNCredentials: () => createTURNCredentials,
+  createWebTTYControlRequestParamsSchema: () => createWebTTYControlRequestParamsSchema,
+  detachWebTTYParticipantParamsSchema: () => detachWebTTYParticipantParamsSchema,
   engineOpenApiDocument: () => engineOpenApiDocument,
   engineOpenApiJson: () => engineOpenApiJson,
   eventSchema: () => eventSchema,
+  formatStreamAccessPath: () => formatStreamAccessPath,
   formatTunnelHost: () => formatTunnelHost,
+  generateWebhookSigningSecret: () => generateWebhookSigningSecret,
   listClientsParamsSchema: () => listClientsParamsSchema,
   listClientsResponseSchema: () => listClientsResponseSchema,
   listTunnelsParamsSchema: () => listTunnelsParamsSchema,
   listTunnelsResponseSchema: () => listTunnelsResponseSchema,
+  listWebTTYControlRequestsParamsSchema: () => listWebTTYControlRequestsParamsSchema,
+  listWebTTYKeyGrantDecryptMaterialParamsSchema: () => listWebTTYKeyGrantDecryptMaterialParamsSchema,
+  listWebTTYSessionGroupsParamsSchema: () => listWebTTYSessionGroupsParamsSchema,
+  listWebTTYSessionsParamsSchema: () => listWebTTYSessionsParamsSchema,
   normalizeEngineAddress: () => normalizeEngineAddress,
   parseWebTTYServers: () => parseWebTTYServers,
   projectLogEventsSchema: () => projectLogEventsSchema,
+  readWebTTYSessionEventsParamsSchema: () => readWebTTYSessionEventsParamsSchema,
   resolveControlPlaneCredentials: () => resolveControlPlaneCredentials,
   resolveManagedTunnelsProject: () => resolveManagedTunnelsProject,
   resolveTunnelsAPIURL: () => resolveTunnelsAPIURL,
   resolveTunnelsCredentials: () => resolveTunnelsCredentials,
   resolveTunnelsEngine: () => resolveTunnelsEngine,
+  resolveWebTTYControlRequestParamsSchema: () => resolveWebTTYControlRequestParamsSchema,
+  signWebhookPayload: () => signWebhookPayload,
   streamEndpointSchema: () => streamEndpointSchema,
+  streamEntrySchema: () => streamEntrySchema,
   streamSummaryEventSchema: () => streamSummaryEventSchema,
   streamSummarySchema: () => streamSummarySchema,
   streamTLSInfoSchema: () => streamTLSInfoSchema,
+  streamWebTTYMetadataSchema: () => streamWebTTYMetadataSchema,
   tunnelFilterSchema: () => tunnelFilterSchema,
   turnCredentialModeSchema: () => turnCredentialModeSchema,
+  webTTYCapabilitiesSchema: () => webTTYCapabilitiesSchema,
+  webTTYContextMetadataSchema: () => webTTYContextMetadataSchema,
+  webTTYControlRequestSchema: () => webTTYControlRequestSchema,
+  webTTYCryptoMetadataSchema: () => webTTYCryptoMetadataSchema,
+  webTTYEncryptionModeSchema: () => webTTYEncryptionModeSchema,
+  webTTYKeyGrantDecryptMaterialSchema: () => webTTYKeyGrantDecryptMaterialSchema,
+  webTTYKeyGrantSchema: () => webTTYKeyGrantSchema,
+  webTTYOriginSchema: () => webTTYOriginSchema,
+  webTTYParticipantLiveSchema: () => webTTYParticipantLiveSchema,
+  webTTYParticipantRoleSchema: () => webTTYParticipantRoleSchema,
+  webTTYParticipantSchema: () => webTTYParticipantSchema,
+  webTTYRecordingModeSchema: () => webTTYRecordingModeSchema,
+  webTTYSessionEventSchema: () => webTTYSessionEventSchema,
+  webTTYSessionGroupSchema: () => webTTYSessionGroupSchema,
+  webTTYSessionLiveSchema: () => webTTYSessionLiveSchema,
+  webTTYSessionModeSchema: () => webTTYSessionModeSchema,
+  webTTYSessionSchema: () => webTTYSessionSchema,
+  webTTYTransportSchema: () => webTTYTransportSchema,
   webhookEventsSchema: () => webhookEventsSchema,
   webttyServerSchema: () => webttyServerSchema,
   wsEventsSchema: () => wsEventsSchema
@@ -294,191 +333,264 @@ var RstreamClientsResource = class {
   }
 };
 
-// src/stream.ts
+// src/webtty-schemas.ts
 var z2 = __toESM(require("zod"));
-var nonEmptyStringSchema = z2.string().min(1);
-var isoDateTimeSchema = z2.string().datetime({ offset: true });
-var ipAddressSchema = z2.string();
-var intNonNegSchema = z2.number().int().nonnegative();
-var numNonNegSchema = z2.number().nonnegative();
-var geolocationSchema = z2.object({
-  country: z2.string().optional(),
-  region: z2.string().optional()
+var webTTYTransportSchema = z2.enum([
+  "plain",
+  "websocket",
+  "webtransport"
+]);
+var webTTYRecordingModeSchema = z2.enum(["recorded", "private"]);
+var webTTYEncryptionModeSchema = z2.enum(["managed", "e2e"]);
+var webTTYSessionModeSchema = z2.enum([
+  "interactive",
+  "non-interactive"
+]);
+var webTTYOriginSchema = z2.enum([
+  "human",
+  "codex",
+  "api",
+  "automation",
+  "ci",
+  "scheduled-job"
+]);
+var webTTYParticipantRoleSchema = z2.enum(["controller", "spectator"]);
+var webTTYInitiatorKindSchema = z2.enum([
+  "user",
+  "app",
+  "agent",
+  "service-account"
+]);
+var webTTYContextMetadataSchema = z2.object({
+  origin: webTTYOriginSchema.optional(),
+  origin_id: z2.string().optional(),
+  purpose: z2.string().optional(),
+  initiator_kind: webTTYInitiatorKindSchema.optional(),
+  agent_name: z2.string().optional(),
+  agent_version: z2.string().optional(),
+  request_id: z2.string().optional(),
+  labels: z2.record(z2.string(), z2.string()).optional()
+}).passthrough();
+
+// src/stream.ts
+var z3 = __toESM(require("zod"));
+var nonEmptyStringSchema = z3.string().min(1);
+var isoDateTimeSchema = z3.string().datetime({ offset: true });
+var ipAddressSchema = z3.string();
+var intNonNegSchema = z3.number().int().nonnegative();
+var numNonNegSchema = z3.number().nonnegative();
+var geolocationSchema = z3.object({
+  country: z3.string().optional(),
+  region: z3.string().optional()
 });
-var streamTLSInfoSchema = z2.object({
-  version: z2.string().min(1).optional(),
-  cipher: z2.string().min(1).optional(),
-  protocol: z2.string().min(1).optional(),
-  curve: z2.string().min(1).optional(),
-  ech: z2.boolean().optional()
+var streamTLSInfoSchema = z3.object({
+  version: z3.string().min(1).optional(),
+  cipher: z3.string().min(1).optional(),
+  protocol: z3.string().min(1).optional(),
+  curve: z3.string().min(1).optional(),
+  ech: z3.boolean().optional()
 });
-var streamEndpointSchema = z2.object({
+var streamEndpointSchema = z3.object({
   ip: ipAddressSchema.optional(),
   geolocation: geolocationSchema.optional(),
   tls: streamTLSInfoSchema.optional()
 });
-var httpHeadersSchema = z2.record(
-  z2.string(),
-  z2.union([z2.string(), z2.array(z2.string())])
+var httpHeadersSchema = z3.record(
+  z3.string(),
+  z3.union([z3.string(), z3.array(z3.string())])
 );
-var httpProtocolSchema = z2.enum(["http/1.1", "h2", "h2c", "h3"]);
-var httpRequestSchema = z2.object({
+var httpProtocolSchema = z3.enum(["http/1.1", "h2", "h2c", "h3"]);
+var httpRequestSchema = z3.object({
   method: nonEmptyStringSchema,
-  scheme: z2.string().min(1).optional(),
+  scheme: z3.string().min(1).optional(),
   host: nonEmptyStringSchema.optional(),
   path: nonEmptyStringSchema.optional(),
-  query: z2.string().optional(),
+  query: z3.string().optional(),
   url: nonEmptyStringSchema.optional(),
   headers: httpHeadersSchema.optional(),
-  userAgent: z2.string().optional()
+  userAgent: z3.string().optional()
 });
-var httpResponseSchema = z2.object({
-  status: z2.number().int().min(100).max(999),
+var httpResponseSchema = z3.object({
+  status: z3.number().int().min(100).max(999),
   headers: httpHeadersSchema.optional()
 });
-var httpRequestStageSchema = z2.object({
+var httpRequestStageSchema = z3.object({
   protocol: httpProtocolSchema.optional(),
   request: httpRequestSchema
 });
-var httpResponseStageSchema = z2.object({
+var httpResponseStageSchema = z3.object({
   protocol: httpProtocolSchema.optional(),
   response: httpResponseSchema
 });
-var tokenSourceSchema = z2.enum([
+var streamEntrySchema = z3.object({
+  kind: z3.enum([
+    "published_tunnel",
+    "private_rstream",
+    "proxy_egress",
+    "internal"
+  ]),
+  transport: z3.enum(["rstream", "tls", "quic", "dtls", "http", "tcp"]).optional()
+});
+var tokenSourceSchema = z3.enum([
   "authorization",
   "query",
   "client",
   "unknown"
 ]);
-var tokenTypeSchema = z2.enum(["auth", "pat", "app", "unknown"]);
-var firewallRuleSchema = z2.discriminatedUnion("kind", [
-  z2.object({ kind: z2.literal("none") }),
-  z2.object({ kind: z2.literal("mtls") }),
-  z2.object({
-    kind: z2.literal("rstream_auth"),
-    source: z2.literal("rstream_auth")
+var tokenTypeSchema = z3.enum(["auth", "pat", "app", "unknown"]);
+var firewallRuleSchema = z3.discriminatedUnion("kind", [
+  z3.object({ kind: z3.literal("none") }),
+  z3.object({ kind: z3.literal("mtls") }),
+  z3.object({
+    kind: z3.literal("rstream_auth"),
+    source: z3.literal("rstream_auth")
   }),
-  z2.object({
-    kind: z2.literal("token"),
+  z3.object({
+    kind: z3.literal("rstream"),
+    source: z3.literal("private_rstream").optional()
+  }),
+  z3.object({
+    kind: z3.literal("token"),
     source: tokenSourceSchema.optional(),
     tokenType: tokenTypeSchema.optional()
   })
 ]);
-var unauthorizedSourceSchema = z2.object({
+var unauthorizedSourceSchema = z3.object({
   source: tokenSourceSchema
 });
-var unauthorizedReasonSchema = (shape) => z2.object(shape).merge(unauthorizedSourceSchema);
-var unauthorizedSchema = z2.discriminatedUnion("reason", [
+var unauthorizedReasonSchema = (shape) => z3.object(shape).merge(unauthorizedSourceSchema);
+var unauthorizedSchema = z3.discriminatedUnion("reason", [
   unauthorizedReasonSchema({
-    reason: z2.literal("missing_token")
+    reason: z3.literal("missing_token")
   }),
   unauthorizedReasonSchema({
-    reason: z2.literal("invalid_token")
+    reason: z3.literal("invalid_token")
   }),
   unauthorizedReasonSchema({
-    reason: z2.literal("expired_token")
+    reason: z3.literal("expired_token")
   }),
   unauthorizedReasonSchema({
-    reason: z2.literal("invalid_secret")
+    reason: z3.literal("invalid_secret")
   }),
   unauthorizedReasonSchema({
-    reason: z2.literal("user_mismatch")
+    reason: z3.literal("user_mismatch")
   }),
   unauthorizedReasonSchema({
-    reason: z2.literal("insufficient_scope")
+    reason: z3.literal("insufficient_scope")
   }),
   unauthorizedReasonSchema({
-    reason: z2.literal("policy_denied"),
-    policy: z2.enum(["ip", "geo", "mtls", "challenge", "other"]),
-    value: z2.string().optional()
+    reason: z3.literal("policy_denied"),
+    policy: z3.enum(["ip", "geo", "mtls", "challenge", "other"]),
+    value: z3.string().optional()
   })
 ]);
-var failureSchema = z2.discriminatedUnion("kind", [
-  z2.object({
-    kind: z2.literal("timeout"),
+var failureSchema = z3.discriminatedUnion("kind", [
+  z3.object({
+    kind: z3.literal("timeout"),
     timeoutMs: intNonNegSchema.optional(),
-    message: z2.string().optional()
+    message: z3.string().optional()
   }),
-  z2.object({
-    kind: z2.literal("unauthorized"),
+  z3.object({
+    kind: z3.literal("unauthorized"),
     why: unauthorizedSchema,
-    message: z2.string().optional()
+    message: z3.string().optional()
   }),
-  z2.object({
-    kind: z2.literal("not_found"),
-    resource: z2.enum(["tunnel", "client", "route"]),
-    message: z2.string().optional()
+  z3.object({
+    kind: z3.literal("not_found"),
+    resource: z3.enum(["tunnel", "client", "route"]),
+    message: z3.string().optional()
   }),
-  z2.object({
-    kind: z2.literal("refused"),
-    reason: z2.enum(["capacity", "policy", "unsupported", "other"]),
-    message: z2.string().optional()
+  z3.object({
+    kind: z3.literal("refused"),
+    reason: z3.enum(["capacity", "policy", "unsupported", "other"]),
+    message: z3.string().optional()
   }),
-  z2.object({ kind: z2.literal("io"), message: z2.string().optional() }),
-  z2.object({ kind: z2.literal("internal"), message: z2.string().optional() })
+  z3.object({ kind: z3.literal("io"), message: z3.string().optional() }),
+  z3.object({ kind: z3.literal("internal"), message: z3.string().optional() })
 ]);
-var firewallSchema = z2.discriminatedUnion("decision", [
-  z2.object({ decision: z2.literal("allowed"), rule: firewallRuleSchema }),
-  z2.object({
-    decision: z2.literal("denied"),
+var firewallSchema = z3.discriminatedUnion("decision", [
+  z3.object({ decision: z3.literal("allowed"), rule: firewallRuleSchema }),
+  z3.object({
+    decision: z3.literal("denied"),
     rule: firewallRuleSchema,
     failure: failureSchema
   })
 ]);
-var routedTunnelSchema = z2.object({
+var routedTunnelSchema = z3.object({
   tunnelId: nonEmptyStringSchema.optional(),
-  tunnelName: z2.string().optional(),
-  hostname: z2.string().optional(),
-  protocol: z2.string().optional(),
-  published: z2.boolean().optional(),
-  type: z2.string().optional(),
-  tlsMode: z2.string().optional(),
-  httpVersion: z2.string().optional(),
-  httpUseTls: z2.boolean().optional(),
-  upstreamTls: z2.boolean().optional(),
-  tokenAuth: z2.boolean().optional(),
-  mtls_auth: z2.boolean().optional()
+  tunnelName: z3.string().optional(),
+  hostname: z3.string().optional(),
+  protocol: z3.string().optional(),
+  published: z3.boolean().optional(),
+  type: z3.string().optional(),
+  tlsMode: z3.string().optional(),
+  httpVersion: z3.string().optional(),
+  httpUseTls: z3.boolean().optional(),
+  upstreamTls: z3.boolean().optional(),
+  tokenAuth: z3.boolean().optional(),
+  mtls_auth: z3.boolean().optional()
 });
-var routingSchema = z2.discriminatedUnion("decision", [
-  z2.object({ decision: z2.literal("routed"), tunnel: routedTunnelSchema }),
-  z2.object({ decision: z2.literal("not_routed"), failure: failureSchema })
+var routingSchema = z3.discriminatedUnion("decision", [
+  z3.object({ decision: z3.literal("routed"), tunnel: routedTunnelSchema }),
+  z3.object({ decision: z3.literal("not_routed"), failure: failureSchema })
 ]);
-var streamConnectedMetricsSchema = z2.object({
+var streamConnectedMetricsSchema = z3.object({
   establish_ms: numNonNegSchema,
   duration_ms: numNonNegSchema,
   upstream_bytes: intNonNegSchema,
   downstream_bytes: intNonNegSchema
 });
-var streamFailedMetricsSchema = z2.object({
+var streamFailedMetricsSchema = z3.object({
   time_to_fail_ms: numNonNegSchema.optional(),
   establish_ms: numNonNegSchema.optional()
 });
-var terminationSchema = z2.object({
-  by: z2.enum(["downstream", "upstream", "server", "unknown"]),
-  reason: z2.enum(["closed", "reset", "timeout", "error", "unknown"]),
-  message: z2.string().optional()
+var terminationSchema = z3.object({
+  by: z3.enum(["downstream", "upstream", "server", "unknown"]),
+  reason: z3.enum(["closed", "reset", "timeout", "error", "unknown"]),
+  message: z3.string().optional()
 });
-var responseConnectedSchema = z2.object({
-  outcome: z2.literal("connected"),
+var responseConnectedSchema = z3.object({
+  outcome: z3.literal("connected"),
   established_at: isoDateTimeSchema,
   upstream: streamEndpointSchema.optional(),
   metrics: streamConnectedMetricsSchema,
   termination: terminationSchema.optional(),
   http: httpResponseStageSchema.optional()
 });
-var responseFailedSchema = z2.object({
-  outcome: z2.literal("failed"),
+var responseFailedSchema = z3.object({
+  outcome: z3.literal("failed"),
   failure: failureSchema,
   upstream: streamEndpointSchema.optional(),
   metrics: streamFailedMetricsSchema.optional(),
   termination: terminationSchema.optional(),
   http: httpResponseStageSchema.optional()
 });
-var responseSchema = z2.discriminatedUnion("outcome", [
+var responseSchema = z3.discriminatedUnion("outcome", [
   responseConnectedSchema,
   responseFailedSchema
 ]);
-var streamSummarySchema = z2.object({
+var streamWebTTYMetadataSchema = z3.object({
+  server_id: nonEmptyStringSchema.optional(),
+  session_id: nonEmptyStringSchema.optional(),
+  session_group_id: nonEmptyStringSchema.optional(),
+  participant_id: nonEmptyStringSchema.optional(),
+  participant_role: webTTYParticipantRoleSchema.optional(),
+  controller: z3.boolean().optional(),
+  recording_mode: webTTYRecordingModeSchema.optional(),
+  encryption_mode: webTTYEncryptionModeSchema.optional(),
+  encryption_policy: z3.enum(["disabled", "explicit_key", "workspace_managed"]).optional(),
+  e2e: z3.boolean().optional(),
+  client_proof: z3.enum(["none", "required"]).optional(),
+  session_mode: webTTYSessionModeSchema.optional(),
+  downstream_transport: webTTYTransportSchema.optional(),
+  upstream_transport: webTTYTransportSchema.optional(),
+  origin: webTTYOriginSchema.optional(),
+  origin_id: z3.string().optional(),
+  initiator_kind: webTTYInitiatorKindSchema.optional(),
+  device_id: z3.string().optional(),
+  browser_id: z3.string().optional()
+}).passthrough();
+var streamSummarySchema = z3.object({
   workspace_id: nonEmptyStringSchema.optional(),
   project_id: nonEmptyStringSchema.optional(),
   cluster_id: nonEmptyStringSchema.optional(),
@@ -488,80 +600,561 @@ var streamSummarySchema = z2.object({
   stream_id: nonEmptyStringSchema,
   created_at: isoDateTimeSchema,
   terminated_at: isoDateTimeSchema,
-  request: z2.object({
+  request: z3.object({
     downstream: streamEndpointSchema,
+    entry: streamEntrySchema.optional(),
     http: httpRequestStageSchema.optional()
   }),
   firewall: firewallSchema,
   routing: routingSchema,
+  webtty: streamWebTTYMetadataSchema.optional(),
   response: responseSchema
 });
+function formatStreamAccessPath(entry) {
+  if (!entry) return void 0;
+  switch (entry.kind) {
+    case "published_tunnel":
+      return "Public URL";
+    case "private_rstream":
+      return "Private rstream dial";
+    case "proxy_egress":
+      return "Proxy egress";
+    case "internal":
+      return "Internal";
+    default:
+      return void 0;
+  }
+}
+
+// src/webtty-resource.ts
+var z4 = __toESM(require("zod"));
+var isoDateTimeSchema2 = z4.string().datetime({ offset: true });
+var decimalCursorSchema = z4.string().regex(/^\d+$/);
+var webTTYSequenceCursorInputSchema = z4.union([
+  decimalCursorSchema,
+  z4.number().int().nonnegative().safe().transform(String)
+]);
+var webTTYSessionStatusSchema = z4.enum([
+  "opening",
+  "active",
+  "closing",
+  "closed",
+  "errored"
+]);
+var webTTYControlRequestStatusSchema = z4.enum([
+  "pending",
+  "granted",
+  "refused",
+  "revoked",
+  "expired"
+]);
+var webTTYEventDirectionSchema = z4.enum([
+  "client_to_server",
+  "server_to_client",
+  "engine_internal"
+]);
+var webTTYStreamTypeSchema = z4.enum(["stdin", "stdout", "stderr"]);
+var webTTYSessionEventTypeSchema = z4.enum([
+  "open",
+  "ack",
+  "data",
+  "resize",
+  "close",
+  "error",
+  "participant",
+  "control",
+  "recording_state"
+]);
+var jsonRecordSchema = z4.record(z4.string(), z4.unknown());
+function rejectCryptoKeyEnvelopes(crypto3, ctx, path) {
+  if (crypto3 === null || typeof crypto3 !== "object") {
+    return;
+  }
+  if (Object.prototype.hasOwnProperty.call(crypto3, "key_envelopes")) {
+    ctx.addIssue({
+      code: z4.ZodIssueCode.custom,
+      message: "key_envelopes are available only from the WebTTY decrypt-material endpoint.",
+      path: [...path, "key_envelopes"]
+    });
+  }
+}
+var webTTYCapabilitiesSchema = z4.object({
+  managed_protocol: z4.boolean(),
+  store_configured: z4.boolean(),
+  session_listing: z4.boolean(),
+  recording: z4.boolean(),
+  replay: z4.boolean(),
+  live_attach: z4.boolean(),
+  control_transfer: z4.boolean(),
+  e2e: z4.boolean(),
+  implemented_transports: z4.array(webTTYTransportSchema),
+  recording_modes: z4.array(webTTYRecordingModeSchema),
+  encryption_modes: z4.array(webTTYEncryptionModeSchema),
+  required_permissions: z4.record(z4.string(), z4.array(z4.string()))
+});
+var webTTYSessionLiveSchema = z4.object({
+  available: z4.boolean(),
+  attachable: z4.boolean(),
+  participant_count: z4.number().int().nonnegative(),
+  controller_participant_id: z4.string().optional(),
+  has_upstream: z4.boolean()
+});
+var webTTYParticipantLiveSchema = z4.object({
+  connected: z4.boolean(),
+  controller: z4.boolean()
+});
+var webTTYSessionSchema = z4.object({
+  id: z4.string(),
+  workspace_id: z4.string().optional(),
+  project_id: z4.string().optional(),
+  cluster_id: z4.string().optional(),
+  server_id: z4.string().optional(),
+  tunnel_id: z4.string(),
+  client_id: z4.string().optional(),
+  initiator_user_id: z4.string().optional(),
+  group_id: z4.string().optional(),
+  status: webTTYSessionStatusSchema,
+  session_mode: webTTYSessionModeSchema,
+  recording_mode: webTTYRecordingModeSchema,
+  encryption_mode: webTTYEncryptionModeSchema,
+  downstream_transport: webTTYTransportSchema.optional(),
+  upstream_transport: webTTYTransportSchema.optional(),
+  command_meta: z4.unknown().optional(),
+  context: webTTYContextMetadataSchema.optional(),
+  started_at: isoDateTimeSchema2,
+  ended_at: isoDateTimeSchema2.optional(),
+  exit_code: z4.number().int().optional(),
+  error_code: z4.string().optional(),
+  error_message: z4.string().optional(),
+  live: webTTYSessionLiveSchema.optional()
+}).passthrough();
+var webTTYSessionGroupSchema = z4.object({
+  id: z4.string(),
+  workspace_id: z4.string().optional(),
+  project_id: z4.string().optional(),
+  initiator_user_id: z4.string().optional(),
+  context: webTTYContextMetadataSchema.optional(),
+  created_at: isoDateTimeSchema2,
+  updated_at: isoDateTimeSchema2,
+  closed_at: isoDateTimeSchema2.optional()
+}).passthrough();
+var webTTYParticipantSchema = z4.object({
+  id: z4.string(),
+  session_id: z4.string(),
+  user_id: z4.string().optional(),
+  device_id: z4.string().optional(),
+  browser_id: z4.string().optional(),
+  role: webTTYParticipantRoleSchema,
+  attached_at: isoDateTimeSchema2,
+  detached_at: isoDateTimeSchema2.optional(),
+  controller: z4.boolean(),
+  grant_state: z4.string().optional(),
+  attach_grant: z4.string().optional(),
+  attach_grant_expires_at: isoDateTimeSchema2.optional(),
+  live: webTTYParticipantLiveSchema.optional()
+}).passthrough();
+var webTTYCryptoMetadataSchema = z4.object({
+  payload_suite: z4.string().optional(),
+  payload_key_id: z4.string().optional(),
+  nonce: z4.string().optional(),
+  key_envelope_suite: z4.string().optional(),
+  key_envelopes: z4.unknown().optional(),
+  key_context: z4.unknown().optional(),
+  key_context_raw: z4.string().optional()
+}).passthrough();
+var webTTYSessionEventSchema = z4.object({
+  id: z4.string(),
+  session_id: z4.string(),
+  seq: decimalCursorSchema,
+  created_at: isoDateTimeSchema2,
+  type: webTTYSessionEventTypeSchema,
+  direction: webTTYEventDirectionSchema.optional(),
+  stream_type: webTTYStreamTypeSchema.optional(),
+  participant_id: z4.string().optional(),
+  payload_length: z4.number().int().nonnegative().optional(),
+  payload_ciphertext: z4.string().optional(),
+  payload_plaintext: z4.string().optional(),
+  crypto: webTTYCryptoMetadataSchema.optional(),
+  prev_hash: z4.string().optional(),
+  hash: z4.string().optional(),
+  metadata: z4.unknown().optional()
+}).passthrough().superRefine((value, ctx) => {
+  rejectCryptoKeyEnvelopes(value.crypto, ctx, ["crypto"]);
+});
+var webTTYKeyGrantBaseShape = {
+  id: z4.string(),
+  session_id: z4.string(),
+  recipient_id: z4.string(),
+  recipient_kind: z4.string(),
+  granted_by: z4.string().optional(),
+  crypto: webTTYCryptoMetadataSchema,
+  created_at: isoDateTimeSchema2,
+  revoked_at: isoDateTimeSchema2.optional()
+};
+var webTTYKeyGrantSchema = z4.object(webTTYKeyGrantBaseShape).passthrough().superRefine((value, ctx) => {
+  if (Object.prototype.hasOwnProperty.call(value, "wrapped_key")) {
+    ctx.addIssue({
+      code: z4.ZodIssueCode.custom,
+      message: "wrapped_key is available only from the WebTTY decrypt-material endpoint.",
+      path: ["wrapped_key"]
+    });
+  }
+  rejectCryptoKeyEnvelopes(value.crypto, ctx, ["crypto"]);
+});
+var webTTYKeyGrantDecryptMaterialSchema = z4.object({
+  ...webTTYKeyGrantBaseShape,
+  wrapped_key: z4.string().optional()
+}).passthrough();
+var webTTYControlRequestSchema = z4.object({
+  id: z4.string(),
+  session_id: z4.string(),
+  requester_participant_id: z4.string(),
+  requester_user_id: z4.string().optional(),
+  approver_participant_id: z4.string().optional(),
+  approver_user_id: z4.string().optional(),
+  status: webTTYControlRequestStatusSchema,
+  reason: z4.string().optional(),
+  metadata: z4.unknown().optional(),
+  created_at: isoDateTimeSchema2,
+  updated_at: isoDateTimeSchema2,
+  resolved_at: isoDateTimeSchema2.optional(),
+  expires_at: isoDateTimeSchema2.optional()
+}).passthrough();
+var listWebTTYSessionsFiltersSchema = z4.object({
+  server_id: z4.string().optional(),
+  tunnel_id: z4.string().optional(),
+  user_id: z4.string().optional(),
+  group_id: z4.string().optional(),
+  origin: webTTYOriginSchema.optional(),
+  status: webTTYSessionStatusSchema.optional(),
+  started_from: isoDateTimeSchema2.optional(),
+  started_to: isoDateTimeSchema2.optional()
+});
+var listWebTTYSessionsParamsSchema = z4.object({
+  limit: z4.number().int().min(1).optional(),
+  filters: listWebTTYSessionsFiltersSchema.optional()
+});
+var listWebTTYSessionGroupsFiltersSchema = z4.object({
+  initiator_user_id: z4.string().optional(),
+  origin: webTTYOriginSchema.optional(),
+  created_from: isoDateTimeSchema2.optional(),
+  created_to: isoDateTimeSchema2.optional()
+});
+var listWebTTYSessionGroupsParamsSchema = z4.object({
+  limit: z4.number().int().min(1).optional(),
+  filters: listWebTTYSessionGroupsFiltersSchema.optional()
+});
+var readWebTTYSessionEventsParamsSchema = z4.object({
+  from_seq: webTTYSequenceCursorInputSchema.optional(),
+  limit: z4.number().int().min(1).optional()
+});
+var listWebTTYKeyGrantDecryptMaterialParamsSchema = z4.object({
+  recipient_id: z4.string().optional(),
+  recipient_kind: z4.string().optional()
+});
+var listWebTTYControlRequestsFiltersSchema = z4.object({
+  status: webTTYControlRequestStatusSchema.optional(),
+  requester_user_id: z4.string().optional()
+});
+var listWebTTYControlRequestsParamsSchema = z4.object({
+  limit: z4.number().int().min(1).optional(),
+  filters: listWebTTYControlRequestsFiltersSchema.optional()
+});
+var attachWebTTYParticipantParamsSchema = z4.object({
+  role: z4.literal("spectator").optional(),
+  device_id: z4.string().optional(),
+  browser_id: z4.string().optional(),
+  transport: webTTYTransportSchema.optional(),
+  grant_state: z4.string().optional(),
+  metadata: jsonRecordSchema.optional()
+});
+var detachWebTTYParticipantParamsSchema = z4.object({
+  reason: z4.string().optional(),
+  metadata: jsonRecordSchema.optional()
+});
+var createWebTTYControlRequestParamsSchema = z4.object({
+  participant_id: z4.string(),
+  reason: z4.string().optional(),
+  metadata: jsonRecordSchema.optional(),
+  expires_at: isoDateTimeSchema2.optional()
+});
+var resolveWebTTYControlRequestParamsSchema = z4.object({
+  action: z4.enum(["grant", "refuse", "revoke"]),
+  approver_participant_id: z4.string().optional(),
+  reason: z4.string().optional()
+});
+var webTTYSessionListSchema = z4.array(webTTYSessionSchema);
+var webTTYSessionGroupListSchema = z4.array(webTTYSessionGroupSchema);
+var webTTYParticipantListSchema = z4.array(webTTYParticipantSchema);
+var webTTYSessionEventListSchema = z4.array(webTTYSessionEventSchema);
+var webTTYKeyGrantListSchema = z4.array(webTTYKeyGrantSchema);
+var webTTYKeyGrantDecryptMaterialListSchema = z4.array(
+  webTTYKeyGrantDecryptMaterialSchema
+);
+var webTTYControlRequestListSchema = z4.array(webTTYControlRequestSchema);
+function pathId(kind, value) {
+  const normalized = value.trim();
+  if (!normalized) {
+    throw new Error(`${kind} is required.`);
+  }
+  return encodeURIComponent(normalized);
+}
+function pathWithParams(path, params) {
+  if (params === void 0) {
+    return path;
+  }
+  return `${path}?params=${encodeURIComponent(JSON.stringify(params))}`;
+}
+var RstreamWebTTYResource = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async capabilities() {
+    const response = await this.client.request(
+      "/webtty/capabilities",
+      {
+        method: "GET"
+      }
+    );
+    return webTTYCapabilitiesSchema.parse(response);
+  }
+  async listGroups(params) {
+    const parsed = params === void 0 ? void 0 : listWebTTYSessionGroupsParamsSchema.parse(params);
+    const response = await this.client.request(
+      pathWithParams("/webtty/groups", parsed),
+      { method: "GET" }
+    );
+    return webTTYSessionGroupListSchema.parse(response);
+  }
+  async getGroup(groupId) {
+    const response = await this.client.request(
+      `/webtty/groups/${pathId("Session group ID", groupId)}`,
+      { method: "GET" }
+    );
+    return webTTYSessionGroupSchema.parse(response);
+  }
+  async listSessions(params) {
+    const parsed = params === void 0 ? void 0 : listWebTTYSessionsParamsSchema.parse(params);
+    const response = await this.client.request(
+      pathWithParams("/webtty/sessions", parsed),
+      { method: "GET" }
+    );
+    return webTTYSessionListSchema.parse(response);
+  }
+  async getSession(sessionId) {
+    const response = await this.client.request(
+      `/webtty/sessions/${pathId("Session ID", sessionId)}`,
+      { method: "GET" }
+    );
+    return webTTYSessionSchema.parse(response);
+  }
+  async listParticipants(sessionId) {
+    const response = await this.client.request(
+      `/webtty/sessions/${pathId("Session ID", sessionId)}/participants`,
+      { method: "GET" }
+    );
+    return webTTYParticipantListSchema.parse(response);
+  }
+  async attachParticipant(sessionId, params = {}) {
+    const response = await this.client.request(
+      `/webtty/sessions/${pathId("Session ID", sessionId)}/participants`,
+      {
+        body: JSON.stringify(attachWebTTYParticipantParamsSchema.parse(params)),
+        headers: { "Content-Type": "application/json" },
+        method: "POST"
+      }
+    );
+    return webTTYParticipantSchema.parse(response);
+  }
+  async detachParticipant(sessionId, participantId, params = {}) {
+    const response = await this.client.request(
+      `/webtty/sessions/${pathId("Session ID", sessionId)}/participants/${pathId("Participant ID", participantId)}`,
+      {
+        body: JSON.stringify(detachWebTTYParticipantParamsSchema.parse(params)),
+        headers: { "Content-Type": "application/json" },
+        method: "POST"
+      }
+    );
+    return webTTYParticipantSchema.parse(response);
+  }
+  async readEvents(sessionId, params) {
+    const parsed = params === void 0 ? void 0 : readWebTTYSessionEventsParamsSchema.parse(params);
+    const response = await this.client.request(
+      pathWithParams(
+        `/webtty/sessions/${pathId("Session ID", sessionId)}/events`,
+        parsed
+      ),
+      { method: "GET" }
+    );
+    return webTTYSessionEventListSchema.parse(response);
+  }
+  async listKeyGrants(sessionId) {
+    const response = await this.client.request(
+      `/webtty/sessions/${pathId("Session ID", sessionId)}/key-grants`,
+      { method: "GET" }
+    );
+    return webTTYKeyGrantListSchema.parse(response);
+  }
+  async listKeyGrantDecryptMaterial(sessionId, params) {
+    const parsed = params === void 0 ? void 0 : listWebTTYKeyGrantDecryptMaterialParamsSchema.parse(params);
+    const response = await this.client.request(
+      pathWithParams(
+        `/webtty/sessions/${pathId("Session ID", sessionId)}/key-grants/decrypt-material`,
+        parsed
+      ),
+      { method: "GET" }
+    );
+    return webTTYKeyGrantDecryptMaterialListSchema.parse(response);
+  }
+  async listControlRequests(sessionId, params) {
+    const parsed = params === void 0 ? void 0 : listWebTTYControlRequestsParamsSchema.parse(params);
+    const response = await this.client.request(
+      pathWithParams(
+        `/webtty/sessions/${pathId("Session ID", sessionId)}/control-requests`,
+        parsed
+      ),
+      { method: "GET" }
+    );
+    return webTTYControlRequestListSchema.parse(response);
+  }
+  async createControlRequest(sessionId, params) {
+    const response = await this.client.request(
+      `/webtty/sessions/${pathId("Session ID", sessionId)}/control-requests`,
+      {
+        body: JSON.stringify(
+          createWebTTYControlRequestParamsSchema.parse(params)
+        ),
+        headers: { "Content-Type": "application/json" },
+        method: "POST"
+      }
+    );
+    return webTTYControlRequestSchema.parse(response);
+  }
+  async resolveControlRequest(sessionId, requestId, params) {
+    const response = await this.client.request(
+      `/webtty/sessions/${pathId("Session ID", sessionId)}/control-requests/${pathId("Control request ID", requestId)}`,
+      {
+        body: JSON.stringify(
+          resolveWebTTYControlRequestParamsSchema.parse(params)
+        ),
+        headers: { "Content-Type": "application/json" },
+        method: "POST"
+      }
+    );
+    return webTTYControlRequestSchema.parse(response);
+  }
+};
 
 // src/event.ts
 var import_tunnel = require("@rstreamlabs/rstream/tunnel");
-var z3 = __toESM(require("zod"));
-var isoDateTimeSchema2 = z3.string().datetime({ offset: true });
-var initialStateSchema = z3.object({
-  snapshot_at: isoDateTimeSchema2,
-  clients: z3.array(clientSchema),
-  tunnels: z3.array(import_tunnel.tunnelSchema)
+var z5 = __toESM(require("zod"));
+var isoDateTimeSchema3 = z5.string().datetime({ offset: true });
+var initialStateSchema = z5.object({
+  snapshot_at: isoDateTimeSchema3,
+  clients: z5.array(clientSchema),
+  tunnels: z5.array(import_tunnel.tunnelSchema)
 });
-var eventBaseSchema = z3.object({
-  id: z3.string().optional(),
-  created_at: isoDateTimeSchema2.optional(),
-  user_id: z3.string().optional(),
-  workspace_id: z3.string().optional(),
-  project_id: z3.string().optional(),
-  cluster_id: z3.string().optional()
+var eventBaseSchema = z5.object({
+  id: z5.string().optional(),
+  created_at: isoDateTimeSchema3.optional(),
+  user_id: z5.string().optional(),
+  workspace_id: z5.string().optional(),
+  project_id: z5.string().optional(),
+  cluster_id: z5.string().optional()
 });
-var withEventBase = (shape) => z3.object(shape).merge(eventBaseSchema).passthrough();
+var withEventBase = (shape) => z5.object(shape).merge(eventBaseSchema).passthrough();
 var stateInitialEventSchema = withEventBase({
-  type: z3.literal("state.initial"),
+  type: z5.literal("state.initial"),
   object: initialStateSchema
 });
 var streamSummaryEventSchema = withEventBase({
-  type: z3.literal("stream.summary"),
+  type: z5.literal("stream.summary"),
   object: streamSummarySchema
 });
 var commonEventsSchema = [
   withEventBase({
-    type: z3.literal("client.created"),
+    type: z5.literal("client.created"),
     object: clientSchema
   }),
   withEventBase({
-    type: z3.literal("client.updated"),
+    type: z5.literal("client.updated"),
     object: clientSchema
   }),
   withEventBase({
-    type: z3.literal("client.deleted"),
+    type: z5.literal("client.deleted"),
     object: clientSchema
   }),
   withEventBase({
-    type: z3.literal("tunnel.created"),
+    type: z5.literal("tunnel.created"),
     object: import_tunnel.tunnelSchema
   }),
   withEventBase({
-    type: z3.literal("tunnel.updated"),
+    type: z5.literal("tunnel.updated"),
     object: import_tunnel.tunnelSchema
   }),
   withEventBase({
-    type: z3.literal("tunnel.deleted"),
+    type: z5.literal("tunnel.deleted"),
     object: import_tunnel.tunnelSchema
   })
 ];
+var webTTYEventsSchema = [
+  withEventBase({
+    type: z5.literal("webtty.session.created"),
+    object: webTTYSessionSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.session.updated"),
+    object: z5.union([webTTYSessionSchema, webTTYSessionGroupSchema])
+  }),
+  withEventBase({
+    type: z5.literal("webtty.session.ended"),
+    object: webTTYSessionSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.participant.joined"),
+    object: webTTYParticipantSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.participant.updated"),
+    object: webTTYParticipantSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.participant.left"),
+    object: webTTYParticipantSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.control.requested"),
+    object: webTTYControlRequestSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.control.granted"),
+    object: webTTYControlRequestSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.control.refused"),
+    object: webTTYControlRequestSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.control.revoked"),
+    object: webTTYControlRequestSchema
+  })
+];
 var webhookDeliverableEventsSchema = [
   commonEventsSchema[0],
   commonEventsSchema[2],
   commonEventsSchema[3],
-  commonEventsSchema[5]
+  commonEventsSchema[5],
+  ...webTTYEventsSchema
 ];
-var wsEventsSchema = z3.union([
+var wsEventsSchema = z5.union([
   stateInitialEventSchema,
-  ...commonEventsSchema
+  ...commonEventsSchema,
+  ...webTTYEventsSchema
 ]);
-var webhookEventsSchema = z3.union(webhookDeliverableEventsSchema);
+var webhookEventsSchema = z5.union(webhookDeliverableEventsSchema);
 var projectLogEventsSchema = streamSummaryEventSchema;
-var eventSchema = z3.union([
+var eventSchema = z5.union([
   wsEventsSchema,
   webhookEventsSchema,
   projectLogEventsSchema
@@ -569,7 +1162,7 @@ var eventSchema = z3.union([
 
 // src/tunnel.ts
 var import_tunnel2 = require("@rstreamlabs/rstream/tunnel");
-var z4 = __toESM(require("zod"));
+var z6 = __toESM(require("zod"));
 var DEFAULT_PUBLISHED_PORT = 443;
 var tunnelFilterSchema = import_tunnel2.tunnelSchema.pick({
   id: true,
@@ -584,11 +1177,11 @@ var tunnelFilterSchema = import_tunnel2.tunnelSchema.pick({
   http_version: true,
   labels: true
 }).partial();
-var listTunnelsParamsSchema = z4.object({
-  limit: z4.number().int().min(1).optional(),
+var listTunnelsParamsSchema = z6.object({
+  limit: z6.number().int().min(1).optional(),
   filters: tunnelFilterSchema.optional()
 });
-var listTunnelsResponseSchema = z4.array(import_tunnel2.tunnelSchema);
+var listTunnelsResponseSchema = z6.array(import_tunnel2.tunnelSchema);
 function formatTunnelHost(tunnel) {
   if (!tunnel.hostname) return tunnel.host;
   if (!tunnel.port || tunnel.port === DEFAULT_PUBLISHED_PORT) {
@@ -599,7 +1192,7 @@ function formatTunnelHost(tunnel) {
 
 // src/openapi.ts
 var import_tunnel5 = require("@rstreamlabs/rstream/tunnel");
-var z5 = __toESM(require("zod"));
+var z7 = __toESM(require("zod"));
 var jsonContentType = "application/json";
 var openApiContentType = "application/vnd.oai.openapi+json;version=3.1";
 function isRecord(value) {
@@ -613,10 +1206,10 @@ function dropSchemaKeyword(value) {
 }
 function jsonSchemaFor(schema) {
   return dropSchemaKeyword(
-    z5.toJSONSchema(schema, {
+    z7.toJSONSchema(schema, {
       unrepresentable: "any",
       override: (ctx) => {
-        if (ctx.zodSchema instanceof z5.ZodDate) {
+        if (ctx.zodSchema instanceof z7.ZodDate) {
           ctx.jsonSchema.type = "string";
           ctx.jsonSchema.format = "date-time";
         }
@@ -683,7 +1276,7 @@ var readEngineStreamsRules = [
     action: "read"
   }
 ];
-var watchParamsSchema = z5.object({
+var watchParamsSchema = z7.object({
   clients: clientFilterSchema.optional(),
   tunnels: tunnelFilterSchema.optional()
 });
@@ -712,6 +1305,40 @@ var enginePermissions = {
         action: ["create", "delete"]
       }
     ]
+  },
+  "webtty.sessions.read-only": {
+    name: "WebTTY Sessions: Read-Only",
+    description: "List managed WebTTY sessions, participants, replay state, and join as a spectator.",
+    rules: [
+      {
+        resource: "engine.webtty.sessions",
+        action: "read"
+      }
+    ]
+  },
+  "webtty.sessions.read-write": {
+    name: "WebTTY Sessions: Read and Write",
+    description: "Create managed WebTTY sessions and coordinate control requests for active sessions.",
+    rules: [
+      {
+        resource: "engine.webtty.sessions",
+        action: ["read", "write"]
+      }
+    ]
+  },
+  "webtty.logs.read-only": {
+    name: "WebTTY Session Logs: Read-Only",
+    description: "Read managed WebTTY session logs. End-to-end encrypted content still requires trusted local key material.",
+    rules: [
+      {
+        resource: "engine.webtty.sessions",
+        action: "read"
+      },
+      {
+        resource: "engine.webtty.logs",
+        action: "read"
+      }
+    ]
   }
 };
 var engineOpenApiDocument = {
@@ -831,11 +1458,14 @@ var engineOpenApiDocument = {
       "tunnels.resources.read-only",
       "tunnels.streams.create-delete"
     ],
-    "operate-webtty": [
+    "run-tunnel-webtty": [
       "tunnels.resources.read-only",
       "tunnels.tunnels.create-delete",
       "tunnels.streams.create-delete"
-    ]
+    ],
+    "join-managed-webtty": ["webtty.sessions.read-only"],
+    "control-managed-webtty": ["webtty.sessions.read-write"],
+    "read-managed-webtty-recordings": ["webtty.logs.read-only"]
   },
   paths: {
     "/api/openapi.json": {
@@ -1103,20 +1733,20 @@ var import_rstream8 = require("@rstreamlabs/rstream");
 var import_rstream9 = require("@rstreamlabs/rstream");
 var import_rstream10 = require("@rstreamlabs/rstream");
 var import_turn = require("@rstreamlabs/rstream/turn");
-var z6 = __toESM(require("zod"));
+var z8 = __toESM(require("zod"));
 var import_crypto = __toESM(require("crypto"));
 var defaultTURNPort = 3478;
 var defaultTURNSPort = 5349;
 var defaultTURNCredentialTTLSeconds = 10 * 60;
 var maxTURNCredentialTTLSeconds = 60 * 60;
-var turnTokenClaimsSchema = z6.object({
-  exp: z6.number().int().optional(),
-  iat: z6.number().int().optional(),
-  token_endpoint: z6.string().regex(/^[0-9a-f]{8}$/i).optional(),
-  tokendpoint: z6.string().regex(/^[0-9a-f]{8}$/i).optional(),
-  type: z6.enum(["app", "auth", "pat"])
+var turnTokenClaimsSchema = z8.object({
+  exp: z8.number().int().optional(),
+  iat: z8.number().int().optional(),
+  token_endpoint: z8.string().regex(/^[0-9a-f]{8}$/i).optional(),
+  tokendpoint: z8.string().regex(/^[0-9a-f]{8}$/i).optional(),
+  type: z8.enum(["app", "auth", "pat"])
 });
-var turnCredentialModeSchema = z6.enum(["api", "app", "pat"]);
+var turnCredentialModeSchema = z8.enum(["api", "app", "pat"]);
 function normalizeOptionalString2(value) {
   const normalized = value?.trim();
   return normalized ? normalized : void 0;
@@ -1477,9 +2107,18 @@ var RstreamTURNResource = class {
 
 // src/webhooks-resource.ts
 var import_crypto2 = __toESM(require("crypto"));
+var WEBHOOK_SIGNATURE_HEADER = "rstream-signature";
+var WEBHOOK_EVENT_ID_HEADER = "rstream-event-id";
+var WEBHOOK_EVENT_TYPE_HEADER = "rstream-event-type";
+var WEBHOOK_ID_HEADER = "rstream-webhook-id";
+var WEBHOOK_DELIVERY_ID_HEADER = "rstream-delivery-id";
 var SIGNATURE_HEX_BYTES = 32;
+var webhookSecretBytes = 32;
 var signatureHexSchema = /^[0-9a-fA-F]{64}$/;
 var timestampSchema = /^\d+$/;
+function payloadBuffer(payload) {
+  return Buffer.isBuffer(payload) ? payload : Buffer.from(payload);
+}
 function parseSignatureTimestamp(timestamp) {
   if (!timestampSchema.test(timestamp)) {
     throw new Error("Invalid signature timestamp");
@@ -1496,6 +2135,19 @@ function normalizeTolerance(tolerance) {
   }
   return tolerance;
 }
+function normalizeTimestamp(timestamp) {
+  if (timestamp === void 0) {
+    return Math.floor(Date.now() / 1e3);
+  }
+  const seconds = timestamp instanceof Date ? timestamp.getTime() / 1e3 : timestamp;
+  if (!Number.isFinite(seconds) || seconds < 0) {
+    throw new Error("Invalid webhook signature timestamp");
+  }
+  return Math.floor(seconds);
+}
+function signedPayload(timestamp, payload) {
+  return Buffer.concat([Buffer.from(`${timestamp}.`, "utf8"), payload]);
+}
 function readSignature(signature) {
   if (!signatureHexSchema.test(signature)) {
     return void 0;
@@ -1512,9 +2164,42 @@ function assertSecretConfigured(secret) {
     throw new Error("Webhook signing secret is required");
   }
 }
+function assertNonEmpty(value, label) {
+  const normalized = value.trim();
+  if (normalized.length === 0) {
+    throw new Error(`${label} is required`);
+  }
+  return normalized;
+}
+function generateWebhookSigningSecret() {
+  return `whsec_${import_crypto2.default.randomBytes(webhookSecretBytes).toString("base64url")}`;
+}
+function signWebhookPayload(payload, secret, timestamp) {
+  assertSecretConfigured(secret);
+  const timestampSeconds = normalizeTimestamp(timestamp).toString();
+  const signature = import_crypto2.default.createHmac("sha256", secret).update(signedPayload(timestampSeconds, payloadBuffer(payload))).digest("hex");
+  return `t=${timestampSeconds},v1=${signature}`;
+}
+function buildWebhookHeaders(payload, event, secret, options) {
+  const eventId = assertNonEmpty(event.id ?? "", "Webhook event id");
+  const eventType = assertNonEmpty(event.type, "Webhook event type");
+  const webhookId = assertNonEmpty(options.webhookId, "Webhook id");
+  const deliveryId = assertNonEmpty(options.deliveryId, "Webhook delivery id");
+  return {
+    [WEBHOOK_SIGNATURE_HEADER]: signWebhookPayload(
+      payload,
+      secret,
+      options.timestamp
+    ),
+    [WEBHOOK_EVENT_ID_HEADER]: eventId,
+    [WEBHOOK_EVENT_TYPE_HEADER]: eventType,
+    [WEBHOOK_ID_HEADER]: webhookId,
+    [WEBHOOK_DELIVERY_ID_HEADER]: deliveryId
+  };
+}
 var RstreamWebhookResource = class {
   async event(payload, header, secret, tolerance = 300, receivedAt = Date.now()) {
-    const payloadBuffer = Buffer.isBuffer(payload) ? payload : Buffer.from(payload);
+    const rawPayload = payloadBuffer(payload);
     const signatureHeader = Array.isArray(header) ? header[0] : header.toString();
     if (!signatureHeader) {
       throw new Error("No signature header");
@@ -1534,8 +2219,7 @@ var RstreamWebhookResource = class {
         `Webhook signature timestamp outside tolerance: ${now}, ${timestampNum}`
       );
     }
-    const signedPayload = `${timestamp}.${payloadBuffer.toString("utf8")}`;
-    const expectedSignature = import_crypto2.default.createHmac("sha256", secret).update(signedPayload).digest();
+    const expectedSignature = import_crypto2.default.createHmac("sha256", secret).update(signedPayload(timestamp, rawPayload)).digest();
     const signatureMatched = signatures.some(
       (signature) => signatureMatches(signature, expectedSignature)
     );
@@ -1543,9 +2227,7 @@ var RstreamWebhookResource = class {
       throw new Error("Signature verification failed");
     }
     try {
-      return webhookEventsSchema.parse(
-        JSON.parse(payloadBuffer.toString("utf8"))
-      );
+      return webhookEventsSchema.parse(JSON.parse(rawPayload.toString("utf8")));
     } catch (error) {
       throw new Error(
         `Failed to parse webhook payload: ${error instanceof Error ? error.message : String(error)}`,
@@ -1553,6 +2235,15 @@ var RstreamWebhookResource = class {
       );
     }
   }
+  generateSigningSecret() {
+    return generateWebhookSigningSecret();
+  }
+  sign(payload, secret, timestamp) {
+    return signWebhookPayload(payload, secret, timestamp);
+  }
+  headers(payload, event, secret, options) {
+    return buildWebhookHeaders(payload, event, secret, options);
+  }
 };
 
 // src/tunnels.ts
@@ -1671,6 +2362,9 @@ var RstreamTunnelsClient = class {
   get webhooks() {
     return new RstreamWebhookResource();
   }
+  get webtty() {
+    return new RstreamWebTTYResource(this);
+  }
   get turn() {
     return new RstreamTURNResource(this);
   }
@@ -1885,8 +2579,8 @@ var Watch = class {
 };
 
 // src/webtty.ts
-var z7 = __toESM(require("zod"));
-var osFamilySchema = z7.enum([
+var z9 = __toESM(require("zod"));
+var osFamilySchema = z9.enum([
   "linux",
   "macos",
   "windows",
@@ -1894,25 +2588,38 @@ var osFamilySchema = z7.enum([
   "openbsd",
   "freebsd"
 ]);
-var webttyCapabilitySchema = z7.enum(["exec", "fs"]);
-var webttyFSModeSchema = z7.enum(["read-write", "read-only"]);
-var webttyServerSchema = z7.object({
-  tunnel_id: z7.string(),
-  host: z7.string(),
-  token_auth: z7.boolean(),
-  capabilities: z7.array(webttyCapabilitySchema).optional(),
-  exec_path: z7.string().optional(),
-  fs_path: z7.string().optional(),
+var webttyCapabilitySchema = z9.enum(["exec", "fs"]);
+var webttyFSModeSchema = z9.enum(["read-write", "read-only"]);
+var webttyEncryptionPolicySchema = z9.enum([
+  "disabled",
+  "explicit_key",
+  "workspace_managed"
+]);
+var webttyServerSchema = z9.object({
+  tunnel_id: z9.string(),
+  tunnel_protocol: z9.enum(["http", "webtty"]),
+  managed: z9.boolean(),
+  host: z9.string(),
+  token_auth: z9.boolean(),
+  server_id: z9.string().optional(),
+  server_name: z9.string().optional(),
+  host_key_id: z9.string().optional(),
+  e2e: z9.enum(["disabled", "required"]).optional(),
+  client_proof: z9.enum(["none", "required"]).optional(),
+  encryption_policy: webttyEncryptionPolicySchema.optional(),
+  capabilities: z9.array(webttyCapabilitySchema).optional(),
+  exec_path: z9.string().optional(),
+  fs_path: z9.string().optional(),
   fs_mode: webttyFSModeSchema.optional(),
   os_family: osFamilySchema.optional(),
-  arch: z7.string().optional(),
-  os_id: z7.string().optional(),
-  os_version_id: z7.string().optional(),
-  os_version_codename: z7.string().optional(),
-  os_pretty_name: z7.string().optional(),
-  kernel_release: z7.string().optional(),
-  hostname: z7.string().optional(),
-  labels: z7.record(z7.string(), z7.string().optional()).optional()
+  arch: z9.string().optional(),
+  os_id: z9.string().optional(),
+  os_version_id: z9.string().optional(),
+  os_version_codename: z9.string().optional(),
+  os_pretty_name: z9.string().optional(),
+  kernel_release: z9.string().optional(),
+  hostname: z9.string().optional(),
+  labels: z9.record(z9.string(), z9.string().optional()).optional()
 });
 function isWebTTYCapability(value) {
   return webttyCapabilitySchema.safeParse(value).success;
@@ -1933,9 +2640,10 @@ function webTTYHasCapability(capabilities, capability) {
 function parser(tunnel) {
   if (tunnel.status !== "online") return null;
   if (tunnel.publish !== true) return null;
-  if (tunnel.protocol !== "http") return null;
+  const managedProtocol = tunnel.protocol === "webtty";
+  if (tunnel.protocol !== "http" && !managedProtocol) return null;
   const tunnelLabels = tunnel.labels ?? {};
-  if (tunnelLabels["application-protocol"] !== "rstream.webtty") {
+  if (!managedProtocol && tunnelLabels["application-protocol"] !== "rstream.webtty") {
     return null;
   }
   const capabilities = webTTYCapabilitiesForLabels(tunnelLabels);
@@ -1948,8 +2656,16 @@ function parser(tunnel) {
   }
   const candidate = {
     tunnel_id: tunnel.id,
+    tunnel_protocol: tunnel.protocol,
+    managed: managedProtocol,
     host: formatTunnelHost(tunnel),
     token_auth: tunnel.token_auth === true,
+    server_id: tunnelLabels["rstream.webtty.server_id"],
+    server_name: tunnelLabels["rstream.webtty.server_name"],
+    host_key_id: tunnelLabels["rstream.webtty.host_key_id"],
+    e2e: tunnelLabels["rstream.webtty.e2e"],
+    client_proof: tunnelLabels["rstream.webtty.client_proof"],
+    encryption_policy: tunnelLabels["rstream.webtty.encryption_policy"],
     capabilities,
     exec_path: webTTYHasCapability(capabilities, "exec") ? tunnelLabels["rstream.webtty.exec.path"] ?? "/" : void 0,
     fs_path: webTTYHasCapability(capabilities, "fs") ? tunnelLabels["rstream.webtty.fs.path"] ?? "/fs" : void 0,
@@ -1982,10 +2698,18 @@ function parseWebTTYServers(tunnels) {
   RstreamTunnelsClient,
   RstreamTunnelsResource,
   RstreamTunnelsRessource,
+  RstreamWebTTYResource,
   RstreamWebhookResource,
   RstreamWebhookRessource,
   Tunnels,
+  WEBHOOK_DELIVERY_ID_HEADER,
+  WEBHOOK_EVENT_ID_HEADER,
+  WEBHOOK_EVENT_TYPE_HEADER,
+  WEBHOOK_ID_HEADER,
+  WEBHOOK_SIGNATURE_HEADER,
   Watch,
+  attachWebTTYParticipantParamsSchema,
+  buildWebhookHeaders,
   clientFilterSchema,
   clientSchema,
   createAPITURNCredentials,
@@ -1993,28 +2717,59 @@ function parseWebTTYServers(tunnels) {
   createAuthTokenFromClientCredentials,
   createPATTURNCredentials,
   createTURNCredentials,
+  createWebTTYControlRequestParamsSchema,
+  detachWebTTYParticipantParamsSchema,
   engineOpenApiDocument,
   engineOpenApiJson,
   eventSchema,
+  formatStreamAccessPath,
   formatTunnelHost,
+  generateWebhookSigningSecret,
   listClientsParamsSchema,
   listClientsResponseSchema,
   listTunnelsParamsSchema,
   listTunnelsResponseSchema,
+  listWebTTYControlRequestsParamsSchema,
+  listWebTTYKeyGrantDecryptMaterialParamsSchema,
+  listWebTTYSessionGroupsParamsSchema,
+  listWebTTYSessionsParamsSchema,
   normalizeEngineAddress,
   parseWebTTYServers,
   projectLogEventsSchema,
+  readWebTTYSessionEventsParamsSchema,
   resolveControlPlaneCredentials,
   resolveManagedTunnelsProject,
   resolveTunnelsAPIURL,
   resolveTunnelsCredentials,
   resolveTunnelsEngine,
+  resolveWebTTYControlRequestParamsSchema,
+  signWebhookPayload,
   streamEndpointSchema,
+  streamEntrySchema,
   streamSummaryEventSchema,
   streamSummarySchema,
   streamTLSInfoSchema,
+  streamWebTTYMetadataSchema,
   tunnelFilterSchema,
   turnCredentialModeSchema,
+  webTTYCapabilitiesSchema,
+  webTTYContextMetadataSchema,
+  webTTYControlRequestSchema,
+  webTTYCryptoMetadataSchema,
+  webTTYEncryptionModeSchema,
+  webTTYKeyGrantDecryptMaterialSchema,
+  webTTYKeyGrantSchema,
+  webTTYOriginSchema,
+  webTTYParticipantLiveSchema,
+  webTTYParticipantRoleSchema,
+  webTTYParticipantSchema,
+  webTTYRecordingModeSchema,
+  webTTYSessionEventSchema,
+  webTTYSessionGroupSchema,
+  webTTYSessionLiveSchema,
+  webTTYSessionModeSchema,
+  webTTYSessionSchema,
+  webTTYTransportSchema,
   webhookEventsSchema,
   webttyServerSchema,
   wsEventsSchema