@rstreamlabs/tunnels 3.2.0 → 3.4.0

package/dist/index.mjs

@@ -1,23 +1,54 @@
 import {
+  RstreamWebTTYResource,
+  attachWebTTYParticipantParamsSchema,
   clientFilterSchema,
   clientSchema,
+  createWebTTYControlRequestParamsSchema,
+  detachWebTTYParticipantParamsSchema,
   engineOpenApiDocument,
   engineOpenApiJson,
   eventSchema,
+  formatStreamAccessPath,
   formatTunnelHost,
   listClientsParamsSchema,
   listClientsResponseSchema,
   listTunnelsParamsSchema,
   listTunnelsResponseSchema,
+  listWebTTYControlRequestsParamsSchema,
+  listWebTTYKeyGrantDecryptMaterialParamsSchema,
+  listWebTTYSessionGroupsParamsSchema,
+  listWebTTYSessionsParamsSchema,
   projectLogEventsSchema,
+  readWebTTYSessionEventsParamsSchema,
+  resolveWebTTYControlRequestParamsSchema,
   streamEndpointSchema,
+  streamEntrySchema,
   streamSummaryEventSchema,
   streamSummarySchema,
   streamTLSInfoSchema,
+  streamWebTTYMetadataSchema,
   tunnelFilterSchema,
+  webTTYCapabilitiesSchema,
+  webTTYContextMetadataSchema,
+  webTTYControlRequestSchema,
+  webTTYCryptoMetadataSchema,
+  webTTYEncryptionModeSchema,
+  webTTYKeyGrantDecryptMaterialSchema,
+  webTTYKeyGrantSchema,
+  webTTYOriginSchema,
+  webTTYParticipantLiveSchema,
+  webTTYParticipantRoleSchema,
+  webTTYParticipantSchema,
+  webTTYRecordingModeSchema,
+  webTTYSessionEventSchema,
+  webTTYSessionGroupSchema,
+  webTTYSessionLiveSchema,
+  webTTYSessionModeSchema,
+  webTTYSessionSchema,
+  webTTYTransportSchema,
   webhookEventsSchema,
   wsEventsSchema
-} from "./chunk-VUAM3LRU.mjs";
+} from "./chunk-6OUCIT5G.mjs";
 
 // src/auth-resource.ts
 import { createAuthTokenParamsSchema } from "@rstreamlabs/rstream/auth-token";
@@ -730,9 +761,18 @@ var RstreamTURNResource = class {
 
 // src/webhooks-resource.ts
 import crypto2 from "crypto";
+var WEBHOOK_SIGNATURE_HEADER = "rstream-signature";
+var WEBHOOK_EVENT_ID_HEADER = "rstream-event-id";
+var WEBHOOK_EVENT_TYPE_HEADER = "rstream-event-type";
+var WEBHOOK_ID_HEADER = "rstream-webhook-id";
+var WEBHOOK_DELIVERY_ID_HEADER = "rstream-delivery-id";
 var SIGNATURE_HEX_BYTES = 32;
+var webhookSecretBytes = 32;
 var signatureHexSchema = /^[0-9a-fA-F]{64}$/;
 var timestampSchema = /^\d+$/;
+function payloadBuffer(payload) {
+  return Buffer.isBuffer(payload) ? payload : Buffer.from(payload);
+}
 function parseSignatureTimestamp(timestamp) {
   if (!timestampSchema.test(timestamp)) {
     throw new Error("Invalid signature timestamp");
@@ -749,6 +789,19 @@ function normalizeTolerance(tolerance) {
   }
   return tolerance;
 }
+function normalizeTimestamp(timestamp) {
+  if (timestamp === void 0) {
+    return Math.floor(Date.now() / 1e3);
+  }
+  const seconds = timestamp instanceof Date ? timestamp.getTime() / 1e3 : timestamp;
+  if (!Number.isFinite(seconds) || seconds < 0) {
+    throw new Error("Invalid webhook signature timestamp");
+  }
+  return Math.floor(seconds);
+}
+function signedPayload(timestamp, payload) {
+  return Buffer.concat([Buffer.from(`${timestamp}.`, "utf8"), payload]);
+}
 function readSignature(signature) {
   if (!signatureHexSchema.test(signature)) {
     return void 0;
@@ -765,9 +818,42 @@ function assertSecretConfigured(secret) {
     throw new Error("Webhook signing secret is required");
   }
 }
+function assertNonEmpty(value, label) {
+  const normalized = value.trim();
+  if (normalized.length === 0) {
+    throw new Error(`${label} is required`);
+  }
+  return normalized;
+}
+function generateWebhookSigningSecret() {
+  return `whsec_${crypto2.randomBytes(webhookSecretBytes).toString("base64url")}`;
+}
+function signWebhookPayload(payload, secret, timestamp) {
+  assertSecretConfigured(secret);
+  const timestampSeconds = normalizeTimestamp(timestamp).toString();
+  const signature = crypto2.createHmac("sha256", secret).update(signedPayload(timestampSeconds, payloadBuffer(payload))).digest("hex");
+  return `t=${timestampSeconds},v1=${signature}`;
+}
+function buildWebhookHeaders(payload, event, secret, options) {
+  const eventId = assertNonEmpty(event.id ?? "", "Webhook event id");
+  const eventType = assertNonEmpty(event.type, "Webhook event type");
+  const webhookId = assertNonEmpty(options.webhookId, "Webhook id");
+  const deliveryId = assertNonEmpty(options.deliveryId, "Webhook delivery id");
+  return {
+    [WEBHOOK_SIGNATURE_HEADER]: signWebhookPayload(
+      payload,
+      secret,
+      options.timestamp
+    ),
+    [WEBHOOK_EVENT_ID_HEADER]: eventId,
+    [WEBHOOK_EVENT_TYPE_HEADER]: eventType,
+    [WEBHOOK_ID_HEADER]: webhookId,
+    [WEBHOOK_DELIVERY_ID_HEADER]: deliveryId
+  };
+}
 var RstreamWebhookResource = class {
   async event(payload, header, secret, tolerance = 300, receivedAt = Date.now()) {
-    const payloadBuffer = Buffer.isBuffer(payload) ? payload : Buffer.from(payload);
+    const rawPayload = payloadBuffer(payload);
     const signatureHeader = Array.isArray(header) ? header[0] : header.toString();
     if (!signatureHeader) {
       throw new Error("No signature header");
@@ -787,8 +873,7 @@ var RstreamWebhookResource = class {
         `Webhook signature timestamp outside tolerance: ${now}, ${timestampNum}`
       );
     }
-    const signedPayload = `${timestamp}.${payloadBuffer.toString("utf8")}`;
-    const expectedSignature = crypto2.createHmac("sha256", secret).update(signedPayload).digest();
+    const expectedSignature = crypto2.createHmac("sha256", secret).update(signedPayload(timestamp, rawPayload)).digest();
     const signatureMatched = signatures.some(
       (signature) => signatureMatches(signature, expectedSignature)
     );
@@ -796,9 +881,7 @@ var RstreamWebhookResource = class {
       throw new Error("Signature verification failed");
     }
     try {
-      return webhookEventsSchema.parse(
-        JSON.parse(payloadBuffer.toString("utf8"))
-      );
+      return webhookEventsSchema.parse(JSON.parse(rawPayload.toString("utf8")));
     } catch (error) {
       throw new Error(
         `Failed to parse webhook payload: ${error instanceof Error ? error.message : String(error)}`,
@@ -806,6 +889,15 @@ var RstreamWebhookResource = class {
       );
     }
   }
+  generateSigningSecret() {
+    return generateWebhookSigningSecret();
+  }
+  sign(payload, secret, timestamp) {
+    return signWebhookPayload(payload, secret, timestamp);
+  }
+  headers(payload, event, secret, options) {
+    return buildWebhookHeaders(payload, event, secret, options);
+  }
 };
 
 // src/tunnels.ts
@@ -924,6 +1016,9 @@ var RstreamTunnelsClient = class {
   get webhooks() {
     return new RstreamWebhookResource();
   }
+  get webtty() {
+    return new RstreamWebTTYResource(this);
+  }
   get turn() {
     return new RstreamTURNResource(this);
   }
@@ -1149,10 +1244,23 @@ var osFamilySchema = z2.enum([
 ]);
 var webttyCapabilitySchema = z2.enum(["exec", "fs"]);
 var webttyFSModeSchema = z2.enum(["read-write", "read-only"]);
+var webttyEncryptionPolicySchema = z2.enum([
+  "disabled",
+  "explicit_key",
+  "workspace_managed"
+]);
 var webttyServerSchema = z2.object({
   tunnel_id: z2.string(),
+  tunnel_protocol: z2.enum(["http", "webtty"]),
+  managed: z2.boolean(),
   host: z2.string(),
   token_auth: z2.boolean(),
+  server_id: z2.string().optional(),
+  server_name: z2.string().optional(),
+  host_key_id: z2.string().optional(),
+  e2e: z2.enum(["disabled", "required"]).optional(),
+  client_proof: z2.enum(["none", "required"]).optional(),
+  encryption_policy: webttyEncryptionPolicySchema.optional(),
   capabilities: z2.array(webttyCapabilitySchema).optional(),
   exec_path: z2.string().optional(),
   fs_path: z2.string().optional(),
@@ -1186,9 +1294,10 @@ function webTTYHasCapability(capabilities, capability) {
 function parser(tunnel) {
   if (tunnel.status !== "online") return null;
   if (tunnel.publish !== true) return null;
-  if (tunnel.protocol !== "http") return null;
+  const managedProtocol = tunnel.protocol === "webtty";
+  if (tunnel.protocol !== "http" && !managedProtocol) return null;
   const tunnelLabels = tunnel.labels ?? {};
-  if (tunnelLabels["application-protocol"] !== "rstream.webtty") {
+  if (!managedProtocol && tunnelLabels["application-protocol"] !== "rstream.webtty") {
     return null;
   }
   const capabilities = webTTYCapabilitiesForLabels(tunnelLabels);
@@ -1201,8 +1310,16 @@ function parser(tunnel) {
   }
   const candidate = {
     tunnel_id: tunnel.id,
+    tunnel_protocol: tunnel.protocol,
+    managed: managedProtocol,
     host: formatTunnelHost(tunnel),
     token_auth: tunnel.token_auth === true,
+    server_id: tunnelLabels["rstream.webtty.server_id"],
+    server_name: tunnelLabels["rstream.webtty.server_name"],
+    host_key_id: tunnelLabels["rstream.webtty.host_key_id"],
+    e2e: tunnelLabels["rstream.webtty.e2e"],
+    client_proof: tunnelLabels["rstream.webtty.client_proof"],
+    encryption_policy: tunnelLabels["rstream.webtty.encryption_policy"],
     capabilities,
     exec_path: webTTYHasCapability(capabilities, "exec") ? tunnelLabels["rstream.webtty.exec.path"] ?? "/" : void 0,
     fs_path: webTTYHasCapability(capabilities, "fs") ? tunnelLabels["rstream.webtty.fs.path"] ?? "/fs" : void 0,
@@ -1234,10 +1351,18 @@ export {
   RstreamTunnelsClient,
   RstreamTunnelsResource,
   RstreamTunnelsResource as RstreamTunnelsRessource,
+  RstreamWebTTYResource,
   RstreamWebhookResource,
   RstreamWebhookResource as RstreamWebhookRessource,
   RstreamTunnelsClient as Tunnels,
+  WEBHOOK_DELIVERY_ID_HEADER,
+  WEBHOOK_EVENT_ID_HEADER,
+  WEBHOOK_EVENT_TYPE_HEADER,
+  WEBHOOK_ID_HEADER,
+  WEBHOOK_SIGNATURE_HEADER,
   Watch,
+  attachWebTTYParticipantParamsSchema,
+  buildWebhookHeaders,
   clientFilterSchema,
   clientSchema,
   createAPITURNCredentials,
@@ -1245,28 +1370,59 @@ export {
   createAuthTokenFromClientCredentials,
   createPATTURNCredentials,
   createTURNCredentials,
+  createWebTTYControlRequestParamsSchema,
+  detachWebTTYParticipantParamsSchema,
   engineOpenApiDocument,
   engineOpenApiJson,
   eventSchema,
+  formatStreamAccessPath,
   formatTunnelHost,
+  generateWebhookSigningSecret,
   listClientsParamsSchema,
   listClientsResponseSchema,
   listTunnelsParamsSchema,
   listTunnelsResponseSchema,
+  listWebTTYControlRequestsParamsSchema,
+  listWebTTYKeyGrantDecryptMaterialParamsSchema,
+  listWebTTYSessionGroupsParamsSchema,
+  listWebTTYSessionsParamsSchema,
   normalizeEngineAddress,
   parseWebTTYServers,
   projectLogEventsSchema,
+  readWebTTYSessionEventsParamsSchema,
   resolveControlPlaneCredentials,
   resolveManagedTunnelsProject,
   resolveTunnelsAPIURL,
   resolveTunnelsCredentials,
   resolveTunnelsEngine,
+  resolveWebTTYControlRequestParamsSchema,
+  signWebhookPayload,
   streamEndpointSchema,
+  streamEntrySchema,
   streamSummaryEventSchema,
   streamSummarySchema,
   streamTLSInfoSchema,
+  streamWebTTYMetadataSchema,
   tunnelFilterSchema,
   turnCredentialModeSchema,
+  webTTYCapabilitiesSchema,
+  webTTYContextMetadataSchema,
+  webTTYControlRequestSchema,
+  webTTYCryptoMetadataSchema,
+  webTTYEncryptionModeSchema,
+  webTTYKeyGrantDecryptMaterialSchema,
+  webTTYKeyGrantSchema,
+  webTTYOriginSchema,
+  webTTYParticipantLiveSchema,
+  webTTYParticipantRoleSchema,
+  webTTYParticipantSchema,
+  webTTYRecordingModeSchema,
+  webTTYSessionEventSchema,
+  webTTYSessionGroupSchema,
+  webTTYSessionLiveSchema,
+  webTTYSessionModeSchema,
+  webTTYSessionSchema,
+  webTTYTransportSchema,
   webhookEventsSchema,
   webttyServerSchema,
   wsEventsSchema

package/dist/openapi.d.mts

@@ -116,7 +116,10 @@ declare const engineOpenApiDocument: {
         "inspect-engine-state": string[];
         "expose-service-from-cli": string[];
         "connect-private-tunnel": string[];
-        "operate-webtty": string[];
+        "run-tunnel-webtty": string[];
+        "join-managed-webtty": string[];
+        "control-managed-webtty": string[];
+        "read-managed-webtty-recordings": string[];
     };
     paths: {
         "/api/openapi.json": {

package/dist/openapi.d.ts

@@ -116,7 +116,10 @@ declare const engineOpenApiDocument: {
         "inspect-engine-state": string[];
         "expose-service-from-cli": string[];
         "connect-private-tunnel": string[];
-        "operate-webtty": string[];
+        "run-tunnel-webtty": string[];
+        "join-managed-webtty": string[];
+        "control-managed-webtty": string[];
+        "read-managed-webtty-recordings": string[];
     };
     paths: {
         "/api/openapi.json": {