@rstreamlabs/tunnels 3.2.1 → 3.5.0

package/dist/openapi.js

@@ -73,30 +73,44 @@ var listClientsParamsSchema = z.object({
 });
 var listClientsResponseSchema = z.array(clientSchema);
 
-// src/tunnel.ts
-var import_tunnel = require("@rstreamlabs/rstream/tunnel");
+// src/webtty-schemas.ts
 var z2 = __toESM(require("zod"));
-var tunnelFilterSchema = import_tunnel.tunnelSchema.pick({
-  id: true,
-  name: true,
-  type: true,
-  status: true,
-  client_id: true,
-  user_id: true,
-  publish: true,
-  protocol: true,
-  hostname: true,
-  http_version: true,
-  labels: true
-}).partial();
-var listTunnelsParamsSchema = z2.object({
-  limit: z2.number().int().min(1).optional(),
-  filters: tunnelFilterSchema.optional()
-});
-var listTunnelsResponseSchema = z2.array(import_tunnel.tunnelSchema);
-
-// src/openapi.ts
-var import_tunnel5 = require("@rstreamlabs/rstream/tunnel");
+var webTTYTransportSchema = z2.enum([
+  "plain",
+  "websocket",
+  "webtransport"
+]);
+var webTTYRecordingModeSchema = z2.enum(["recorded", "private"]);
+var webTTYEncryptionModeSchema = z2.enum(["managed", "e2e"]);
+var webTTYSessionModeSchema = z2.enum([
+  "interactive",
+  "non-interactive"
+]);
+var webTTYOriginSchema = z2.enum([
+  "human",
+  "codex",
+  "api",
+  "automation",
+  "ci",
+  "scheduled-job"
+]);
+var webTTYParticipantRoleSchema = z2.enum(["controller", "spectator"]);
+var webTTYInitiatorKindSchema = z2.enum([
+  "user",
+  "app",
+  "agent",
+  "service-account"
+]);
+var webTTYContextMetadataSchema = z2.object({
+  origin: webTTYOriginSchema.optional(),
+  origin_id: z2.string().optional(),
+  purpose: z2.string().optional(),
+  initiator_kind: webTTYInitiatorKindSchema.optional(),
+  agent_name: z2.string().optional(),
+  agent_version: z2.string().optional(),
+  request_id: z2.string().optional(),
+  labels: z2.record(z2.string(), z2.string()).optional()
+}).passthrough();
 
 // src/stream.ts
 var z3 = __toESM(require("zod"));
@@ -148,6 +162,15 @@ var httpResponseStageSchema = z3.object({
   protocol: httpProtocolSchema.optional(),
   response: httpResponseSchema
 });
+var streamEntrySchema = z3.object({
+  kind: z3.enum([
+    "published_tunnel",
+    "private_rstream",
+    "proxy_egress",
+    "internal"
+  ]),
+  transport: z3.enum(["rstream", "tls", "quic", "dtls", "http", "tcp"]).optional()
+});
 var tokenSourceSchema = z3.enum([
   "authorization",
   "query",
@@ -162,6 +185,10 @@ var firewallRuleSchema = z3.discriminatedUnion("kind", [
     kind: z3.literal("rstream_auth"),
     source: z3.literal("rstream_auth")
   }),
+  z3.object({
+    kind: z3.literal("rstream"),
+    source: z3.literal("private_rstream").optional()
+  }),
   z3.object({
     kind: z3.literal("token"),
     source: tokenSourceSchema.optional(),
@@ -282,6 +309,27 @@ var responseSchema = z3.discriminatedUnion("outcome", [
   responseConnectedSchema,
   responseFailedSchema
 ]);
+var streamWebTTYMetadataSchema = z3.object({
+  server_id: nonEmptyStringSchema.optional(),
+  session_id: nonEmptyStringSchema.optional(),
+  session_group_id: nonEmptyStringSchema.optional(),
+  participant_id: nonEmptyStringSchema.optional(),
+  participant_role: webTTYParticipantRoleSchema.optional(),
+  controller: z3.boolean().optional(),
+  recording_mode: webTTYRecordingModeSchema.optional(),
+  encryption_mode: webTTYEncryptionModeSchema.optional(),
+  encryption_policy: z3.enum(["disabled", "explicit_key", "workspace_managed"]).optional(),
+  e2e: z3.boolean().optional(),
+  client_proof: z3.enum(["none", "required"]).optional(),
+  session_mode: webTTYSessionModeSchema.optional(),
+  downstream_transport: webTTYTransportSchema.optional(),
+  upstream_transport: webTTYTransportSchema.optional(),
+  origin: webTTYOriginSchema.optional(),
+  origin_id: z3.string().optional(),
+  initiator_kind: webTTYInitiatorKindSchema.optional(),
+  device_id: z3.string().optional(),
+  browser_id: z3.string().optional()
+}).passthrough();
 var streamSummarySchema = z3.object({
   workspace_id: nonEmptyStringSchema.optional(),
   project_id: nonEmptyStringSchema.optional(),
@@ -294,85 +342,421 @@ var streamSummarySchema = z3.object({
   terminated_at: isoDateTimeSchema,
   request: z3.object({
     downstream: streamEndpointSchema,
+    entry: streamEntrySchema.optional(),
     http: httpRequestStageSchema.optional()
   }),
   firewall: firewallSchema,
   routing: routingSchema,
+  webtty: streamWebTTYMetadataSchema.optional(),
   response: responseSchema
 });
 
-// src/event.ts
-var import_tunnel2 = require("@rstreamlabs/rstream/tunnel");
+// src/webtty-resource.ts
 var z4 = __toESM(require("zod"));
 var isoDateTimeSchema2 = z4.string().datetime({ offset: true });
-var initialStateSchema = z4.object({
-  snapshot_at: isoDateTimeSchema2,
-  clients: z4.array(clientSchema),
-  tunnels: z4.array(import_tunnel2.tunnelSchema)
-});
-var eventBaseSchema = z4.object({
-  id: z4.string().optional(),
-  created_at: isoDateTimeSchema2.optional(),
-  user_id: z4.string().optional(),
+var decimalCursorSchema = z4.string().regex(/^\d+$/);
+var webTTYSequenceCursorInputSchema = z4.union([
+  decimalCursorSchema,
+  z4.number().int().nonnegative().safe().transform(String)
+]);
+var webTTYSessionStatusSchema = z4.enum([
+  "opening",
+  "active",
+  "closing",
+  "closed",
+  "errored"
+]);
+var webTTYControlRequestStatusSchema = z4.enum([
+  "pending",
+  "granted",
+  "refused",
+  "revoked",
+  "expired"
+]);
+var webTTYEventDirectionSchema = z4.enum([
+  "client_to_server",
+  "server_to_client",
+  "engine_internal"
+]);
+var webTTYStreamTypeSchema = z4.enum(["stdin", "stdout", "stderr"]);
+var webTTYSessionEventTypeSchema = z4.enum([
+  "open",
+  "ack",
+  "data",
+  "resize",
+  "close",
+  "error",
+  "participant",
+  "control",
+  "recording_state"
+]);
+var jsonRecordSchema = z4.record(z4.string(), z4.unknown());
+function rejectCryptoKeyEnvelopes(crypto, ctx, path) {
+  if (crypto === null || typeof crypto !== "object") {
+    return;
+  }
+  if (Object.prototype.hasOwnProperty.call(crypto, "key_envelopes")) {
+    ctx.addIssue({
+      code: z4.ZodIssueCode.custom,
+      message: "key_envelopes are available only from the WebTTY decrypt-material endpoint.",
+      path: [...path, "key_envelopes"]
+    });
+  }
+}
+var webTTYCapabilitiesSchema = z4.object({
+  managed_protocol: z4.boolean(),
+  store_configured: z4.boolean(),
+  session_listing: z4.boolean(),
+  recording: z4.boolean(),
+  replay: z4.boolean(),
+  live_attach: z4.boolean(),
+  control_transfer: z4.boolean(),
+  e2e: z4.boolean(),
+  implemented_transports: z4.array(webTTYTransportSchema),
+  recording_modes: z4.array(webTTYRecordingModeSchema),
+  encryption_modes: z4.array(webTTYEncryptionModeSchema),
+  required_permissions: z4.record(z4.string(), z4.array(z4.string()))
+});
+var webTTYSessionLiveSchema = z4.object({
+  available: z4.boolean(),
+  attachable: z4.boolean(),
+  participant_count: z4.number().int().nonnegative(),
+  controller_participant_id: z4.string().optional(),
+  has_upstream: z4.boolean()
+});
+var webTTYParticipantLiveSchema = z4.object({
+  connected: z4.boolean(),
+  controller: z4.boolean()
+});
+var webTTYSessionSchema = z4.object({
+  id: z4.string(),
+  workspace_id: z4.string().optional(),
+  project_id: z4.string().optional(),
+  cluster_id: z4.string().optional(),
+  server_id: z4.string().optional(),
+  tunnel_id: z4.string(),
+  client_id: z4.string().optional(),
+  initiator_user_id: z4.string().optional(),
+  group_id: z4.string().optional(),
+  status: webTTYSessionStatusSchema,
+  session_mode: webTTYSessionModeSchema,
+  recording_mode: webTTYRecordingModeSchema,
+  encryption_mode: webTTYEncryptionModeSchema,
+  downstream_transport: webTTYTransportSchema.optional(),
+  upstream_transport: webTTYTransportSchema.optional(),
+  command_meta: z4.unknown().optional(),
+  context: webTTYContextMetadataSchema.optional(),
+  started_at: isoDateTimeSchema2,
+  ended_at: isoDateTimeSchema2.optional(),
+  exit_code: z4.number().int().optional(),
+  error_code: z4.string().optional(),
+  error_message: z4.string().optional(),
+  live: webTTYSessionLiveSchema.optional()
+}).passthrough();
+var webTTYSessionGroupSchema = z4.object({
+  id: z4.string(),
   workspace_id: z4.string().optional(),
   project_id: z4.string().optional(),
-  cluster_id: z4.string().optional()
+  initiator_user_id: z4.string().optional(),
+  context: webTTYContextMetadataSchema.optional(),
+  created_at: isoDateTimeSchema2,
+  updated_at: isoDateTimeSchema2,
+  closed_at: isoDateTimeSchema2.optional()
+}).passthrough();
+var webTTYParticipantSchema = z4.object({
+  id: z4.string(),
+  session_id: z4.string(),
+  user_id: z4.string().optional(),
+  device_id: z4.string().optional(),
+  browser_id: z4.string().optional(),
+  role: webTTYParticipantRoleSchema,
+  attached_at: isoDateTimeSchema2,
+  detached_at: isoDateTimeSchema2.optional(),
+  controller: z4.boolean(),
+  grant_state: z4.string().optional(),
+  attach_grant: z4.string().optional(),
+  attach_grant_expires_at: isoDateTimeSchema2.optional(),
+  live: webTTYParticipantLiveSchema.optional()
+}).passthrough();
+var webTTYCryptoMetadataSchema = z4.object({
+  payload_suite: z4.string().optional(),
+  payload_key_id: z4.string().optional(),
+  nonce: z4.string().optional(),
+  key_envelope_suite: z4.string().optional(),
+  key_envelopes: z4.unknown().optional(),
+  key_context: z4.unknown().optional(),
+  key_context_raw: z4.string().optional()
+}).passthrough();
+var webTTYSessionEventSchema = z4.object({
+  id: z4.string(),
+  session_id: z4.string(),
+  seq: decimalCursorSchema,
+  created_at: isoDateTimeSchema2,
+  type: webTTYSessionEventTypeSchema,
+  direction: webTTYEventDirectionSchema.optional(),
+  stream_type: webTTYStreamTypeSchema.optional(),
+  participant_id: z4.string().optional(),
+  payload_length: z4.number().int().nonnegative().optional(),
+  payload_ciphertext: z4.string().optional(),
+  payload_plaintext: z4.string().optional(),
+  crypto: webTTYCryptoMetadataSchema.optional(),
+  prev_hash: z4.string().optional(),
+  hash: z4.string().optional(),
+  metadata: z4.unknown().optional()
+}).passthrough().superRefine((value, ctx) => {
+  rejectCryptoKeyEnvelopes(value.crypto, ctx, ["crypto"]);
+});
+var webTTYKeyGrantBaseShape = {
+  id: z4.string(),
+  session_id: z4.string(),
+  recipient_id: z4.string(),
+  recipient_kind: z4.string(),
+  granted_by: z4.string().optional(),
+  crypto: webTTYCryptoMetadataSchema,
+  created_at: isoDateTimeSchema2,
+  revoked_at: isoDateTimeSchema2.optional()
+};
+var webTTYKeyGrantSchema = z4.object(webTTYKeyGrantBaseShape).passthrough().superRefine((value, ctx) => {
+  if (Object.prototype.hasOwnProperty.call(value, "wrapped_key")) {
+    ctx.addIssue({
+      code: z4.ZodIssueCode.custom,
+      message: "wrapped_key is available only from the WebTTY decrypt-material endpoint.",
+      path: ["wrapped_key"]
+    });
+  }
+  rejectCryptoKeyEnvelopes(value.crypto, ctx, ["crypto"]);
+});
+var webTTYKeyGrantDecryptMaterialSchema = z4.object({
+  ...webTTYKeyGrantBaseShape,
+  wrapped_key: z4.string().optional()
+}).passthrough();
+var webTTYControlRequestSchema = z4.object({
+  id: z4.string(),
+  session_id: z4.string(),
+  requester_participant_id: z4.string(),
+  requester_user_id: z4.string().optional(),
+  approver_participant_id: z4.string().optional(),
+  approver_user_id: z4.string().optional(),
+  status: webTTYControlRequestStatusSchema,
+  reason: z4.string().optional(),
+  metadata: z4.unknown().optional(),
+  created_at: isoDateTimeSchema2,
+  updated_at: isoDateTimeSchema2,
+  resolved_at: isoDateTimeSchema2.optional(),
+  expires_at: isoDateTimeSchema2.optional()
+}).passthrough();
+var listWebTTYSessionsFiltersSchema = z4.object({
+  server_id: z4.string().optional(),
+  tunnel_id: z4.string().optional(),
+  user_id: z4.string().optional(),
+  group_id: z4.string().optional(),
+  origin: webTTYOriginSchema.optional(),
+  status: webTTYSessionStatusSchema.optional(),
+  started_from: isoDateTimeSchema2.optional(),
+  started_to: isoDateTimeSchema2.optional()
+});
+var listWebTTYSessionsParamsSchema = z4.object({
+  limit: z4.number().int().min(1).optional(),
+  filters: listWebTTYSessionsFiltersSchema.optional()
+});
+var listWebTTYSessionGroupsFiltersSchema = z4.object({
+  initiator_user_id: z4.string().optional(),
+  origin: webTTYOriginSchema.optional(),
+  created_from: isoDateTimeSchema2.optional(),
+  created_to: isoDateTimeSchema2.optional()
+});
+var listWebTTYSessionGroupsParamsSchema = z4.object({
+  limit: z4.number().int().min(1).optional(),
+  filters: listWebTTYSessionGroupsFiltersSchema.optional()
+});
+var readWebTTYSessionEventsParamsSchema = z4.object({
+  from_seq: webTTYSequenceCursorInputSchema.optional(),
+  limit: z4.number().int().min(1).optional()
+});
+var listWebTTYKeyGrantDecryptMaterialParamsSchema = z4.object({
+  recipient_id: z4.string().optional(),
+  recipient_kind: z4.string().optional()
+});
+var listWebTTYControlRequestsFiltersSchema = z4.object({
+  status: webTTYControlRequestStatusSchema.optional(),
+  requester_user_id: z4.string().optional()
+});
+var listWebTTYControlRequestsParamsSchema = z4.object({
+  limit: z4.number().int().min(1).optional(),
+  filters: listWebTTYControlRequestsFiltersSchema.optional()
+});
+var attachWebTTYParticipantParamsSchema = z4.object({
+  role: z4.literal("spectator").optional(),
+  device_id: z4.string().optional(),
+  browser_id: z4.string().optional(),
+  transport: webTTYTransportSchema.optional(),
+  grant_state: z4.string().optional(),
+  metadata: jsonRecordSchema.optional()
+});
+var detachWebTTYParticipantParamsSchema = z4.object({
+  reason: z4.string().optional(),
+  metadata: jsonRecordSchema.optional()
+});
+var createWebTTYControlRequestParamsSchema = z4.object({
+  participant_id: z4.string(),
+  reason: z4.string().optional(),
+  metadata: jsonRecordSchema.optional(),
+  expires_at: isoDateTimeSchema2.optional()
+});
+var resolveWebTTYControlRequestParamsSchema = z4.object({
+  action: z4.enum(["grant", "refuse", "revoke"]),
+  approver_participant_id: z4.string().optional(),
+  reason: z4.string().optional()
+});
+var webTTYSessionListSchema = z4.array(webTTYSessionSchema);
+var webTTYSessionGroupListSchema = z4.array(webTTYSessionGroupSchema);
+var webTTYParticipantListSchema = z4.array(webTTYParticipantSchema);
+var webTTYSessionEventListSchema = z4.array(webTTYSessionEventSchema);
+var webTTYKeyGrantListSchema = z4.array(webTTYKeyGrantSchema);
+var webTTYKeyGrantDecryptMaterialListSchema = z4.array(
+  webTTYKeyGrantDecryptMaterialSchema
+);
+var webTTYControlRequestListSchema = z4.array(webTTYControlRequestSchema);
+
+// src/event.ts
+var import_tunnel = require("@rstreamlabs/rstream/tunnel");
+var z5 = __toESM(require("zod"));
+var isoDateTimeSchema3 = z5.string().datetime({ offset: true });
+var initialStateSchema = z5.object({
+  snapshot_at: isoDateTimeSchema3,
+  clients: z5.array(clientSchema),
+  tunnels: z5.array(import_tunnel.tunnelSchema)
+});
+var eventBaseSchema = z5.object({
+  id: z5.string().optional(),
+  created_at: isoDateTimeSchema3.optional(),
+  user_id: z5.string().optional(),
+  workspace_id: z5.string().optional(),
+  project_id: z5.string().optional(),
+  cluster_id: z5.string().optional()
 });
-var withEventBase = (shape) => z4.object(shape).merge(eventBaseSchema).passthrough();
+var withEventBase = (shape) => z5.object(shape).merge(eventBaseSchema).passthrough();
 var stateInitialEventSchema = withEventBase({
-  type: z4.literal("state.initial"),
+  type: z5.literal("state.initial"),
   object: initialStateSchema
 });
 var streamSummaryEventSchema = withEventBase({
-  type: z4.literal("stream.summary"),
+  type: z5.literal("stream.summary"),
   object: streamSummarySchema
 });
 var commonEventsSchema = [
   withEventBase({
-    type: z4.literal("client.created"),
+    type: z5.literal("client.created"),
     object: clientSchema
   }),
   withEventBase({
-    type: z4.literal("client.updated"),
+    type: z5.literal("client.updated"),
     object: clientSchema
   }),
   withEventBase({
-    type: z4.literal("client.deleted"),
+    type: z5.literal("client.deleted"),
     object: clientSchema
   }),
   withEventBase({
-    type: z4.literal("tunnel.created"),
-    object: import_tunnel2.tunnelSchema
+    type: z5.literal("tunnel.created"),
+    object: import_tunnel.tunnelSchema
   }),
   withEventBase({
-    type: z4.literal("tunnel.updated"),
-    object: import_tunnel2.tunnelSchema
+    type: z5.literal("tunnel.updated"),
+    object: import_tunnel.tunnelSchema
   }),
   withEventBase({
-    type: z4.literal("tunnel.deleted"),
-    object: import_tunnel2.tunnelSchema
+    type: z5.literal("tunnel.deleted"),
+    object: import_tunnel.tunnelSchema
+  })
+];
+var webTTYEventsSchema = [
+  withEventBase({
+    type: z5.literal("webtty.session.created"),
+    object: webTTYSessionSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.session.updated"),
+    object: z5.union([webTTYSessionSchema, webTTYSessionGroupSchema])
+  }),
+  withEventBase({
+    type: z5.literal("webtty.session.ended"),
+    object: webTTYSessionSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.participant.joined"),
+    object: webTTYParticipantSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.participant.updated"),
+    object: webTTYParticipantSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.participant.left"),
+    object: webTTYParticipantSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.control.requested"),
+    object: webTTYControlRequestSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.control.granted"),
+    object: webTTYControlRequestSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.control.refused"),
+    object: webTTYControlRequestSchema
+  }),
+  withEventBase({
+    type: z5.literal("webtty.control.revoked"),
+    object: webTTYControlRequestSchema
   })
 ];
 var webhookDeliverableEventsSchema = [
   commonEventsSchema[0],
   commonEventsSchema[2],
   commonEventsSchema[3],
-  commonEventsSchema[5]
+  commonEventsSchema[5],
+  ...webTTYEventsSchema
 ];
-var wsEventsSchema = z4.union([
+var wsEventsSchema = z5.union([
   stateInitialEventSchema,
-  ...commonEventsSchema
+  ...commonEventsSchema,
+  ...webTTYEventsSchema
 ]);
-var webhookEventsSchema = z4.union(webhookDeliverableEventsSchema);
+var webhookEventsSchema = z5.union(webhookDeliverableEventsSchema);
 var projectLogEventsSchema = streamSummaryEventSchema;
-var eventSchema = z4.union([
+var eventSchema = z5.union([
   wsEventsSchema,
   webhookEventsSchema,
   projectLogEventsSchema
 ]);
 
+// src/tunnel.ts
+var import_tunnel2 = require("@rstreamlabs/rstream/tunnel");
+var z6 = __toESM(require("zod"));
+var tunnelFilterSchema = import_tunnel2.tunnelSchema.pick({
+  id: true,
+  name: true,
+  type: true,
+  status: true,
+  client_id: true,
+  user_id: true,
+  publish: true,
+  protocol: true,
+  hostname: true,
+  http_version: true,
+  labels: true
+}).partial();
+var listTunnelsParamsSchema = z6.object({
+  limit: z6.number().int().min(1).optional(),
+  filters: tunnelFilterSchema.optional()
+});
+var listTunnelsResponseSchema = z6.array(import_tunnel2.tunnelSchema);
+
 // src/openapi.ts
-var z5 = __toESM(require("zod"));
+var import_tunnel5 = require("@rstreamlabs/rstream/tunnel");
+var z7 = __toESM(require("zod"));
 var jsonContentType = "application/json";
 var openApiContentType = "application/vnd.oai.openapi+json;version=3.1";
 function isRecord(value) {
@@ -386,10 +770,10 @@ function dropSchemaKeyword(value) {
 }
 function jsonSchemaFor(schema) {
   return dropSchemaKeyword(
-    z5.toJSONSchema(schema, {
+    z7.toJSONSchema(schema, {
       unrepresentable: "any",
       override: (ctx) => {
-        if (ctx.zodSchema instanceof z5.ZodDate) {
+        if (ctx.zodSchema instanceof z7.ZodDate) {
           ctx.jsonSchema.type = "string";
           ctx.jsonSchema.format = "date-time";
         }
@@ -456,7 +840,7 @@ var readEngineStreamsRules = [
     action: "read"
   }
 ];
-var watchParamsSchema = z5.object({
+var watchParamsSchema = z7.object({
   clients: clientFilterSchema.optional(),
   tunnels: tunnelFilterSchema.optional()
 });
@@ -485,6 +869,40 @@ var enginePermissions = {
         action: ["create", "delete"]
       }
     ]
+  },
+  "webtty.sessions.read-only": {
+    name: "WebTTY Sessions: Read-Only",
+    description: "List managed WebTTY sessions, participants, replay state, and join as a spectator.",
+    rules: [
+      {
+        resource: "engine.webtty.sessions",
+        action: "read"
+      }
+    ]
+  },
+  "webtty.sessions.read-write": {
+    name: "WebTTY Sessions: Read and Write",
+    description: "Create managed WebTTY sessions and coordinate control requests for active sessions.",
+    rules: [
+      {
+        resource: "engine.webtty.sessions",
+        action: ["read", "write"]
+      }
+    ]
+  },
+  "webtty.logs.read-only": {
+    name: "WebTTY Session Logs: Read-Only",
+    description: "Read managed WebTTY session logs. End-to-end encrypted content still requires trusted local key material.",
+    rules: [
+      {
+        resource: "engine.webtty.sessions",
+        action: "read"
+      },
+      {
+        resource: "engine.webtty.logs",
+        action: "read"
+      }
+    ]
   }
 };
 var engineOpenApiDocument = {
@@ -604,11 +1022,14 @@ var engineOpenApiDocument = {
       "tunnels.resources.read-only",
       "tunnels.streams.create-delete"
     ],
-    "operate-webtty": [
+    "run-tunnel-webtty": [
       "tunnels.resources.read-only",
       "tunnels.tunnels.create-delete",
       "tunnels.streams.create-delete"
-    ]
+    ],
+    "join-managed-webtty": ["webtty.sessions.read-only"],
+    "control-managed-webtty": ["webtty.sessions.read-write"],
+    "read-managed-webtty-recordings": ["webtty.logs.read-only"]
   },
   paths: {
     "/api/openapi.json": {

package/dist/openapi.mjs

@@ -1,7 +1,7 @@
 import {
   engineOpenApiDocument,
   engineOpenApiJson
-} from "./chunk-VUAM3LRU.mjs";
+} from "./chunk-6OUCIT5G.mjs";
 export {
   engineOpenApiDocument,
   engineOpenApiJson

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rstreamlabs/tunnels",
-  "version": "3.2.1",
+  "version": "3.5.0",
   "description": "JS/TS SDK for the rstream Engine API and tunnel runtime APIs.",
   "author": "@uartnet <hello@rstream.io>",
   "repository": {
@@ -38,8 +38,8 @@
     "type-check": "tsc --noEmit"
   },
   "devDependencies": {
-    "@turbo/gen": "^2.9.5",
-    "@types/node": "^25",
+    "@turbo/gen": "^2.10.0",
+    "@types/node": "^26",
     "eslint": "9.39.4",
     "eslint-config": "*",
     "tsup": "^8.5.1",
@@ -47,10 +47,10 @@
     "typescript-config": "*"
   },
   "dependencies": {
-    "@rstreamlabs/rstream": "3.1.0",
+    "@rstreamlabs/rstream": "3.3.0",
     "@types/jsonwebtoken": "^9.0.10",
     "jsonwebtoken": "^9.0.3",
-    "zod": "^4.3.6"
+    "zod": "^4.4.3"
   },
   "publishConfig": {
     "access": "public"