@rstreamlabs/tunnels 3.2.1 → 3.5.0

package/dist/chunk-VUAM3LRU.mjs

@@ -1,710 +0,0 @@
-// src/client.ts
-import * as z from "zod";
-var clientSchema = z.object({
-  id: z.string(),
-  status: z.enum(["online", "offline"]),
-  user_id: z.string().optional(),
-  workspace_id: z.string().optional(),
-  project_id: z.string().optional(),
-  cluster_id: z.string().optional(),
-  plan: z.string().optional(),
-  provider: z.string().optional(),
-  region: z.string().optional(),
-  agent: z.string().optional(),
-  channel: z.string().optional(),
-  version: z.string().optional(),
-  os: z.string().optional(),
-  arch: z.string().optional(),
-  protocol_version: z.string().optional(),
-  labels: z.record(z.string(), z.string()).optional()
-});
-var clientFilterSchema = clientSchema.pick({
-  id: true,
-  status: true,
-  user_id: true,
-  agent: true,
-  channel: true,
-  version: true,
-  os: true,
-  arch: true,
-  protocol_version: true,
-  labels: true
-}).partial();
-var listClientsParamsSchema = z.object({
-  limit: z.number().int().min(1).optional(),
-  filters: clientFilterSchema.optional()
-});
-var listClientsResponseSchema = z.array(clientSchema);
-
-// src/tunnel.ts
-import { tunnelSchema } from "@rstreamlabs/rstream/tunnel";
-import * as z2 from "zod";
-var DEFAULT_PUBLISHED_PORT = 443;
-var tunnelFilterSchema = tunnelSchema.pick({
-  id: true,
-  name: true,
-  type: true,
-  status: true,
-  client_id: true,
-  user_id: true,
-  publish: true,
-  protocol: true,
-  hostname: true,
-  http_version: true,
-  labels: true
-}).partial();
-var listTunnelsParamsSchema = z2.object({
-  limit: z2.number().int().min(1).optional(),
-  filters: tunnelFilterSchema.optional()
-});
-var listTunnelsResponseSchema = z2.array(tunnelSchema);
-function formatTunnelHost(tunnel) {
-  if (!tunnel.hostname) return tunnel.host;
-  if (!tunnel.port || tunnel.port === DEFAULT_PUBLISHED_PORT) {
-    return tunnel.hostname;
-  }
-  return `${tunnel.hostname}:${tunnel.port}`;
-}
-
-// src/openapi.ts
-import { tunnelSchema as tunnelSchema3 } from "@rstreamlabs/rstream/tunnel";
-
-// src/stream.ts
-import * as z3 from "zod";
-var nonEmptyStringSchema = z3.string().min(1);
-var isoDateTimeSchema = z3.string().datetime({ offset: true });
-var ipAddressSchema = z3.string();
-var intNonNegSchema = z3.number().int().nonnegative();
-var numNonNegSchema = z3.number().nonnegative();
-var geolocationSchema = z3.object({
-  country: z3.string().optional(),
-  region: z3.string().optional()
-});
-var streamTLSInfoSchema = z3.object({
-  version: z3.string().min(1).optional(),
-  cipher: z3.string().min(1).optional(),
-  protocol: z3.string().min(1).optional(),
-  curve: z3.string().min(1).optional(),
-  ech: z3.boolean().optional()
-});
-var streamEndpointSchema = z3.object({
-  ip: ipAddressSchema.optional(),
-  geolocation: geolocationSchema.optional(),
-  tls: streamTLSInfoSchema.optional()
-});
-var httpHeadersSchema = z3.record(
-  z3.string(),
-  z3.union([z3.string(), z3.array(z3.string())])
-);
-var httpProtocolSchema = z3.enum(["http/1.1", "h2", "h2c", "h3"]);
-var httpRequestSchema = z3.object({
-  method: nonEmptyStringSchema,
-  scheme: z3.string().min(1).optional(),
-  host: nonEmptyStringSchema.optional(),
-  path: nonEmptyStringSchema.optional(),
-  query: z3.string().optional(),
-  url: nonEmptyStringSchema.optional(),
-  headers: httpHeadersSchema.optional(),
-  userAgent: z3.string().optional()
-});
-var httpResponseSchema = z3.object({
-  status: z3.number().int().min(100).max(999),
-  headers: httpHeadersSchema.optional()
-});
-var httpRequestStageSchema = z3.object({
-  protocol: httpProtocolSchema.optional(),
-  request: httpRequestSchema
-});
-var httpResponseStageSchema = z3.object({
-  protocol: httpProtocolSchema.optional(),
-  response: httpResponseSchema
-});
-var tokenSourceSchema = z3.enum([
-  "authorization",
-  "query",
-  "client",
-  "unknown"
-]);
-var tokenTypeSchema = z3.enum(["auth", "pat", "app", "unknown"]);
-var firewallRuleSchema = z3.discriminatedUnion("kind", [
-  z3.object({ kind: z3.literal("none") }),
-  z3.object({ kind: z3.literal("mtls") }),
-  z3.object({
-    kind: z3.literal("rstream_auth"),
-    source: z3.literal("rstream_auth")
-  }),
-  z3.object({
-    kind: z3.literal("token"),
-    source: tokenSourceSchema.optional(),
-    tokenType: tokenTypeSchema.optional()
-  })
-]);
-var unauthorizedSourceSchema = z3.object({
-  source: tokenSourceSchema
-});
-var unauthorizedReasonSchema = (shape) => z3.object(shape).merge(unauthorizedSourceSchema);
-var unauthorizedSchema = z3.discriminatedUnion("reason", [
-  unauthorizedReasonSchema({
-    reason: z3.literal("missing_token")
-  }),
-  unauthorizedReasonSchema({
-    reason: z3.literal("invalid_token")
-  }),
-  unauthorizedReasonSchema({
-    reason: z3.literal("expired_token")
-  }),
-  unauthorizedReasonSchema({
-    reason: z3.literal("invalid_secret")
-  }),
-  unauthorizedReasonSchema({
-    reason: z3.literal("user_mismatch")
-  }),
-  unauthorizedReasonSchema({
-    reason: z3.literal("insufficient_scope")
-  }),
-  unauthorizedReasonSchema({
-    reason: z3.literal("policy_denied"),
-    policy: z3.enum(["ip", "geo", "mtls", "challenge", "other"]),
-    value: z3.string().optional()
-  })
-]);
-var failureSchema = z3.discriminatedUnion("kind", [
-  z3.object({
-    kind: z3.literal("timeout"),
-    timeoutMs: intNonNegSchema.optional(),
-    message: z3.string().optional()
-  }),
-  z3.object({
-    kind: z3.literal("unauthorized"),
-    why: unauthorizedSchema,
-    message: z3.string().optional()
-  }),
-  z3.object({
-    kind: z3.literal("not_found"),
-    resource: z3.enum(["tunnel", "client", "route"]),
-    message: z3.string().optional()
-  }),
-  z3.object({
-    kind: z3.literal("refused"),
-    reason: z3.enum(["capacity", "policy", "unsupported", "other"]),
-    message: z3.string().optional()
-  }),
-  z3.object({ kind: z3.literal("io"), message: z3.string().optional() }),
-  z3.object({ kind: z3.literal("internal"), message: z3.string().optional() })
-]);
-var firewallSchema = z3.discriminatedUnion("decision", [
-  z3.object({ decision: z3.literal("allowed"), rule: firewallRuleSchema }),
-  z3.object({
-    decision: z3.literal("denied"),
-    rule: firewallRuleSchema,
-    failure: failureSchema
-  })
-]);
-var routedTunnelSchema = z3.object({
-  tunnelId: nonEmptyStringSchema.optional(),
-  tunnelName: z3.string().optional(),
-  hostname: z3.string().optional(),
-  protocol: z3.string().optional(),
-  published: z3.boolean().optional(),
-  type: z3.string().optional(),
-  tlsMode: z3.string().optional(),
-  httpVersion: z3.string().optional(),
-  httpUseTls: z3.boolean().optional(),
-  upstreamTls: z3.boolean().optional(),
-  tokenAuth: z3.boolean().optional(),
-  mtls_auth: z3.boolean().optional()
-});
-var routingSchema = z3.discriminatedUnion("decision", [
-  z3.object({ decision: z3.literal("routed"), tunnel: routedTunnelSchema }),
-  z3.object({ decision: z3.literal("not_routed"), failure: failureSchema })
-]);
-var streamConnectedMetricsSchema = z3.object({
-  establish_ms: numNonNegSchema,
-  duration_ms: numNonNegSchema,
-  upstream_bytes: intNonNegSchema,
-  downstream_bytes: intNonNegSchema
-});
-var streamFailedMetricsSchema = z3.object({
-  time_to_fail_ms: numNonNegSchema.optional(),
-  establish_ms: numNonNegSchema.optional()
-});
-var terminationSchema = z3.object({
-  by: z3.enum(["downstream", "upstream", "server", "unknown"]),
-  reason: z3.enum(["closed", "reset", "timeout", "error", "unknown"]),
-  message: z3.string().optional()
-});
-var responseConnectedSchema = z3.object({
-  outcome: z3.literal("connected"),
-  established_at: isoDateTimeSchema,
-  upstream: streamEndpointSchema.optional(),
-  metrics: streamConnectedMetricsSchema,
-  termination: terminationSchema.optional(),
-  http: httpResponseStageSchema.optional()
-});
-var responseFailedSchema = z3.object({
-  outcome: z3.literal("failed"),
-  failure: failureSchema,
-  upstream: streamEndpointSchema.optional(),
-  metrics: streamFailedMetricsSchema.optional(),
-  termination: terminationSchema.optional(),
-  http: httpResponseStageSchema.optional()
-});
-var responseSchema = z3.discriminatedUnion("outcome", [
-  responseConnectedSchema,
-  responseFailedSchema
-]);
-var streamSummarySchema = z3.object({
-  workspace_id: nonEmptyStringSchema.optional(),
-  project_id: nonEmptyStringSchema.optional(),
-  cluster_id: nonEmptyStringSchema.optional(),
-  user_id: nonEmptyStringSchema.optional(),
-  client_id: nonEmptyStringSchema.optional(),
-  tunnel_id: nonEmptyStringSchema.optional(),
-  stream_id: nonEmptyStringSchema,
-  created_at: isoDateTimeSchema,
-  terminated_at: isoDateTimeSchema,
-  request: z3.object({
-    downstream: streamEndpointSchema,
-    http: httpRequestStageSchema.optional()
-  }),
-  firewall: firewallSchema,
-  routing: routingSchema,
-  response: responseSchema
-});
-
-// src/event.ts
-import { tunnelSchema as tunnelSchema2 } from "@rstreamlabs/rstream/tunnel";
-import * as z4 from "zod";
-var isoDateTimeSchema2 = z4.string().datetime({ offset: true });
-var initialStateSchema = z4.object({
-  snapshot_at: isoDateTimeSchema2,
-  clients: z4.array(clientSchema),
-  tunnels: z4.array(tunnelSchema2)
-});
-var eventBaseSchema = z4.object({
-  id: z4.string().optional(),
-  created_at: isoDateTimeSchema2.optional(),
-  user_id: z4.string().optional(),
-  workspace_id: z4.string().optional(),
-  project_id: z4.string().optional(),
-  cluster_id: z4.string().optional()
-});
-var withEventBase = (shape) => z4.object(shape).merge(eventBaseSchema).passthrough();
-var stateInitialEventSchema = withEventBase({
-  type: z4.literal("state.initial"),
-  object: initialStateSchema
-});
-var streamSummaryEventSchema = withEventBase({
-  type: z4.literal("stream.summary"),
-  object: streamSummarySchema
-});
-var commonEventsSchema = [
-  withEventBase({
-    type: z4.literal("client.created"),
-    object: clientSchema
-  }),
-  withEventBase({
-    type: z4.literal("client.updated"),
-    object: clientSchema
-  }),
-  withEventBase({
-    type: z4.literal("client.deleted"),
-    object: clientSchema
-  }),
-  withEventBase({
-    type: z4.literal("tunnel.created"),
-    object: tunnelSchema2
-  }),
-  withEventBase({
-    type: z4.literal("tunnel.updated"),
-    object: tunnelSchema2
-  }),
-  withEventBase({
-    type: z4.literal("tunnel.deleted"),
-    object: tunnelSchema2
-  })
-];
-var webhookDeliverableEventsSchema = [
-  commonEventsSchema[0],
-  commonEventsSchema[2],
-  commonEventsSchema[3],
-  commonEventsSchema[5]
-];
-var wsEventsSchema = z4.union([
-  stateInitialEventSchema,
-  ...commonEventsSchema
-]);
-var webhookEventsSchema = z4.union(webhookDeliverableEventsSchema);
-var projectLogEventsSchema = streamSummaryEventSchema;
-var eventSchema = z4.union([
-  wsEventsSchema,
-  webhookEventsSchema,
-  projectLogEventsSchema
-]);
-
-// src/openapi.ts
-import * as z5 from "zod";
-var jsonContentType = "application/json";
-var openApiContentType = "application/vnd.oai.openapi+json;version=3.1";
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function dropSchemaKeyword(value) {
-  if (!isRecord(value)) return value;
-  return Object.fromEntries(
-    Object.entries(value).filter(([key]) => key !== "$schema")
-  );
-}
-function jsonSchemaFor(schema) {
-  return dropSchemaKeyword(
-    z5.toJSONSchema(schema, {
-      unrepresentable: "any",
-      override: (ctx) => {
-        if (ctx.zodSchema instanceof z5.ZodDate) {
-          ctx.jsonSchema.type = "string";
-          ctx.jsonSchema.format = "date-time";
-        }
-      }
-    })
-  );
-}
-function jsonArrayResponse(description, itemSchemaRef) {
-  return {
-    description,
-    content: {
-      [jsonContentType]: {
-        schema: {
-          type: "array",
-          items: {
-            $ref: itemSchemaRef
-          }
-        }
-      }
-    }
-  };
-}
-function streamResponse(description) {
-  return {
-    description,
-    content: {
-      "text/event-stream": {
-        schema: {
-          type: "string"
-        }
-      }
-    }
-  };
-}
-function errorResponse(description) {
-  return {
-    description
-  };
-}
-function queryJsonParameter(name, description, schemaRef, examples) {
-  return {
-    name,
-    in: "query",
-    required: false,
-    description,
-    content: {
-      [jsonContentType]: {
-        schema: {
-          $ref: schemaRef
-        },
-        ...examples ? { examples } : {}
-      }
-    }
-  };
-}
-var readEngineStateRule = {
-  resource: ["engine.tunnels", "engine.streams"],
-  action: "read"
-};
-var readEngineStateRules = [readEngineStateRule];
-var readEngineStreamsRules = [
-  {
-    resource: "engine.streams",
-    action: "read"
-  }
-];
-var watchParamsSchema = z5.object({
-  clients: clientFilterSchema.optional(),
-  tunnels: tunnelFilterSchema.optional()
-});
-var enginePermissions = {
-  "tunnels.resources.read-only": {
-    name: "Discovery: Read-Only",
-    description: "Read active clients, active tunnels, and live state events.",
-    rules: [readEngineStateRule]
-  },
-  "tunnels.tunnels.create-delete": {
-    name: "Tunnels: Create and Delete",
-    description: "Create and close tunnels through the CLI, SDK, or engine control channel.",
-    rules: [
-      {
-        resource: "engine.tunnels",
-        action: ["create", "delete"]
-      }
-    ]
-  },
-  "tunnels.streams.create-delete": {
-    name: "Connections: Create and Delete",
-    description: "Open and close private tunnel streams and WebTTY connections.",
-    rules: [
-      {
-        resource: "engine.streams",
-        action: ["create", "delete"]
-      }
-    ]
-  }
-};
-var engineOpenApiDocument = {
-  openapi: "3.1.0",
-  info: {
-    title: "rstream Engine API",
-    version: "1.0.0",
-    description: "Operational Engine API exposed by rstream engine. This surface is scoped to the authenticated engine or project endpoint and covers live clients, live tunnels, and state-change streams."
-  },
-  servers: [
-    {
-      url: "https://{engine}",
-      description: "Project-scoped rstream engine endpoint.",
-      variables: {
-        engine: {
-          default: "project-endpoint.cluster-host:443",
-          description: "Use the engine value returned by project discovery or configured in RSTREAM_ENGINE."
-        }
-      }
-    }
-  ],
-  security: [
-    {
-      bearerAuth: []
-    }
-  ],
-  components: {
-    securitySchemes: {
-      bearerAuth: {
-        type: "http",
-        scheme: "bearer",
-        bearerFormat: "rstream token",
-        description: "Preferred authentication mechanism. Send an OAuth-issued rstream access token or compatible rstream credential in Authorization: Bearer <token>."
-      }
-    },
-    parameters: {
-      ListClientsParams: queryJsonParameter(
-        "params",
-        "JSON-encoded ListClientsParams object.",
-        "#/components/schemas/ListClientsParams",
-        {
-          filterByAgent: {
-            value: {
-              limit: 10,
-              filters: {
-                agent: "rstream",
-                channel: "stable"
-              }
-            }
-          }
-        }
-      ),
-      ListTunnelsParams: queryJsonParameter(
-        "params",
-        "JSON-encoded ListTunnelsParams object.",
-        "#/components/schemas/ListTunnelsParams",
-        {
-          filterByLabels: {
-            value: {
-              filters: {
-                labels: {
-                  service: "ssh",
-                  env: "prod"
-                }
-              }
-            }
-          }
-        }
-      ),
-      WatchParams: queryJsonParameter(
-        "params",
-        "JSON-encoded WatchParams object. The same shape is accepted by SSE and WebSocket transports.",
-        "#/components/schemas/WatchParams",
-        {
-          watchTaggedTunnels: {
-            value: {
-              clients: {
-                agent: "rstream"
-              },
-              tunnels: {
-                labels: {
-                  service: "ssh"
-                }
-              }
-            }
-          }
-        }
-      )
-    },
-    responses: {
-      BadRequest: errorResponse("Request validation failed."),
-      Unauthorized: errorResponse("Authentication is required."),
-      Forbidden: errorResponse("The token is not authorized.")
-    },
-    schemas: {
-      Client: jsonSchemaFor(clientSchema),
-      Event: jsonSchemaFor(wsEventsSchema),
-      ListClientsParams: jsonSchemaFor(listClientsParamsSchema),
-      ListTunnelsParams: jsonSchemaFor(listTunnelsParamsSchema),
-      TunnelListItem: jsonSchemaFor(tunnelSchema3),
-      WatchParams: jsonSchemaFor(watchParamsSchema)
-    }
-  },
-  "x-rstream-agent-authentication": {
-    oauth_authorization_server_metadata: "https://rstream.io/.well-known/oauth-authorization-server",
-    oauth_protected_resource_metadata: "https://rstream.io/.well-known/oauth-protected-resource",
-    scope_selection: "Use x-rstream-required-rules to understand backend authorization checks. Choose OAuth scopes from x-rstream-permissions or use the task bundles in x-rstream-use-case-permissions."
-  },
-  "x-rstream-permissions": enginePermissions,
-  "x-rstream-use-case-permissions": {
-    "inspect-engine-state": ["tunnels.resources.read-only"],
-    "expose-service-from-cli": [
-      "tunnels.resources.read-only",
-      "tunnels.tunnels.create-delete"
-    ],
-    "connect-private-tunnel": [
-      "tunnels.resources.read-only",
-      "tunnels.streams.create-delete"
-    ],
-    "operate-webtty": [
-      "tunnels.resources.read-only",
-      "tunnels.tunnels.create-delete",
-      "tunnels.streams.create-delete"
-    ]
-  },
-  paths: {
-    "/api/openapi.json": {
-      get: {
-        tags: ["Discovery"],
-        summary: "Return this OpenAPI description.",
-        operationId: "get_engine_openapi",
-        security: [],
-        responses: {
-          "200": {
-            description: "OpenAPI document.",
-            content: {
-              [openApiContentType]: {
-                schema: {
-                  type: "object"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "/api/clients": {
-      get: {
-        tags: ["Runtime inventory"],
-        summary: "List visible engine clients.",
-        operationId: "list_engine_clients",
-        parameters: [{ $ref: "#/components/parameters/ListClientsParams" }],
-        security: [{ bearerAuth: [] }],
-        responses: {
-          "200": jsonArrayResponse(
-            "Visible clients.",
-            "#/components/schemas/Client"
-          ),
-          "400": { $ref: "#/components/responses/BadRequest" },
-          "401": { $ref: "#/components/responses/Unauthorized" },
-          "403": { $ref: "#/components/responses/Forbidden" }
-        },
-        "x-rstream-required-rules": readEngineStreamsRules
-      }
-    },
-    "/api/tunnels": {
-      get: {
-        tags: ["Runtime inventory"],
-        summary: "List visible engine tunnels.",
-        operationId: "list_engine_tunnels",
-        parameters: [{ $ref: "#/components/parameters/ListTunnelsParams" }],
-        security: [{ bearerAuth: [] }],
-        responses: {
-          "200": jsonArrayResponse(
-            "Visible tunnels. Fine-grained list scopes may filter objects and project fields.",
-            "#/components/schemas/TunnelListItem"
-          ),
-          "400": { $ref: "#/components/responses/BadRequest" },
-          "401": { $ref: "#/components/responses/Unauthorized" },
-          "403": { $ref: "#/components/responses/Forbidden" }
-        },
-        "x-rstream-required-rules": readEngineStateRules,
-        "x-rstream-token-metadata-scope": "metadata.scopes.tunnels.list"
-      }
-    },
-    "/api/sse": {
-      get: {
-        tags: ["Runtime watch"],
-        summary: "Subscribe to visible engine state through Server-Sent Events.",
-        operationId: "watch_engine_events_sse",
-        parameters: [{ $ref: "#/components/parameters/WatchParams" }],
-        security: [{ bearerAuth: [] }],
-        responses: {
-          "200": streamResponse(
-            "SSE stream. Each event is emitted as a data line containing a JSON Event object."
-          ),
-          "400": { $ref: "#/components/responses/BadRequest" },
-          "401": { $ref: "#/components/responses/Unauthorized" },
-          "403": { $ref: "#/components/responses/Forbidden" }
-        },
-        "x-rstream-event-schema": "#/components/schemas/Event",
-        "x-rstream-required-rules": readEngineStateRules
-      }
-    },
-    "/api/websocket": {
-      get: {
-        tags: ["Runtime watch"],
-        summary: "Subscribe to visible engine state through a WebSocket upgrade.",
-        operationId: "watch_engine_events_websocket",
-        parameters: [{ $ref: "#/components/parameters/WatchParams" }],
-        security: [{ bearerAuth: [] }],
-        responses: {
-          "101": {
-            description: "WebSocket connection accepted. Frames contain JSON Event objects."
-          },
-          "400": { $ref: "#/components/responses/BadRequest" },
-          "401": { $ref: "#/components/responses/Unauthorized" },
-          "403": { $ref: "#/components/responses/Forbidden" }
-        },
-        "x-rstream-event-schema": "#/components/schemas/Event",
-        "x-rstream-required-rules": readEngineStateRules
-      }
-    }
-  }
-};
-var engineOpenApiJson = `${JSON.stringify(
-  engineOpenApiDocument,
-  null,
-  2
-)}
-`;
-
-export {
-  clientSchema,
-  clientFilterSchema,
-  listClientsParamsSchema,
-  listClientsResponseSchema,
-  streamTLSInfoSchema,
-  streamEndpointSchema,
-  streamSummarySchema,
-  streamSummaryEventSchema,
-  wsEventsSchema,
-  webhookEventsSchema,
-  projectLogEventsSchema,
-  eventSchema,
-  tunnelFilterSchema,
-  listTunnelsParamsSchema,
-  listTunnelsResponseSchema,
-  formatTunnelHost,
-  engineOpenApiDocument,
-  engineOpenApiJson
-};