@slicervm/sdk 0.1.5 → 0.1.7

package/dist/index.js

@@ -5,7 +5,7 @@ import os from 'os';
 import path2 from 'path';
 import net, { createServer } from 'net';
 import fs from 'fs';
-import { createWebSocketStream, WebSocket } from 'ws';
+import { createWebSocketStream, WebSocket as WebSocket$1 } from 'ws';
 
 // src/types.ts
 var ExecStdioText = "text";
@@ -255,6 +255,7 @@ function createVMReqToWire(r) {
   if (r.ip !== void 0) o.ip = r.ip;
   if (r.tags !== void 0) o.tags = r.tags;
   if (r.secrets !== void 0) o.secrets = r.secrets;
+  if (r.network !== void 0) o.network = r.network;
   return o;
 }
 function createVMResFromWire(w) {
@@ -526,7 +527,7 @@ function openWebSocket(init, mapping) {
   if (init.transport.kind === "socket") {
     opts.agent = unixAgent(init.transport.socketPath);
   }
-  return new WebSocket(url, opts);
+  return new WebSocket$1(url, opts);
 }
 function wsURLForVM(transport, hostname) {
   if (transport.kind === "socket") {
@@ -965,8 +966,8 @@ var VMBg = class {
     q.set("cmd", req.command);
     for (const a of req.args ?? []) q.append("args", a);
     for (const e of req.env ?? []) q.append("env", e);
-    if (req.uid !== void 0 && req.uid !== 0) q.set("uid", String(req.uid));
-    if (req.gid !== void 0 && req.gid !== 0) q.set("gid", String(req.gid));
+    if (req.uid !== void 0) q.set("uid", String(req.uid));
+    if (req.gid !== void 0) q.set("gid", String(req.gid));
     if (req.shell) q.set("shell", req.shell);
     if (req.cwd) q.set("cwd", req.cwd);
     if (req.ringBytes !== void 0 && req.ringBytes > 0) {
@@ -1251,17 +1252,173 @@ function buildListQuery(opts) {
   return s ? `?${s}` : "";
 }
 
+// src/proxy.ts
+var ProxySecretBearer = "bearer";
+var ProxySecretBasic = "basic";
+function clientFromWire(w) {
+  return { name: w.name, createdAt: w.created_at };
+}
+function clientCreatedFromWire(w) {
+  return { name: w.name, token: w.token, createdAt: w.created_at };
+}
+function secretFromWire2(w) {
+  const out = { name: w.name, host: w.host, createdAt: w.created_at };
+  if (w.type) out.type = w.type;
+  return out;
+}
+function ruleFromWire(w) {
+  const out = { host: w.host };
+  if (w.secret) out.secret = w.secret;
+  if (w.methods && w.methods.length > 0) out.methods = w.methods;
+  if (w.paths && w.paths.length > 0) out.paths = w.paths;
+  if (w.expires && w.expires !== "0001-01-01T00:00:00Z") out.expires = w.expires;
+  if (w.passthrough) out.passthrough = w.passthrough;
+  return out;
+}
+var ProxyAPI = class {
+  constructor(transport) {
+    this.transport = transport;
+    this.clients = new ProxyClientsAPI(transport);
+    this.secrets = new ProxySecretsAPI(transport);
+    this.allows = new ProxyAllowsAPI(transport);
+  }
+  transport;
+  clients;
+  secrets;
+  allows;
+};
+var ProxyClientsAPI = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /** Mint a new proxy client. The returned token is shown once. */
+  async create(name, opts = {}) {
+    const body = { name };
+    if (opts.token) body.token = opts.token;
+    const wire = await this.transport.request(
+      "POST",
+      "/proxy/v1/clients",
+      body
+    );
+    return clientCreatedFromWire(wire);
+  }
+  async list() {
+    const wire = await this.transport.request("GET", "/proxy/v1/clients");
+    return (wire ?? []).map(clientFromWire);
+  }
+  /**
+   * Revoke the token, drop every allow rule the client owned, and
+   * remove the client.
+   */
+  async delete(name) {
+    await this.transport.request("DELETE", `/proxy/v1/clients/${encodeURIComponent(name)}`);
+  }
+  /** List a client's allow rules in declaration order (first-match-wins). */
+  async rules(name) {
+    const wire = await this.transport.request(
+      "GET",
+      `/proxy/v1/clients/${encodeURIComponent(name)}`
+    );
+    return (wire ?? []).map(ruleFromWire);
+  }
+};
+var ProxySecretsAPI = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  async create(req) {
+    const body = {
+      name: req.name,
+      host: req.host,
+      value: req.value
+    };
+    if (req.type) body.type = req.type;
+    await this.transport.request("POST", "/proxy/v1/secrets", body);
+  }
+  async list() {
+    const wire = await this.transport.request("GET", "/proxy/v1/secrets");
+    return (wire ?? []).map(secretFromWire2);
+  }
+  /**
+   * Remove a secret. Allow rules that reference it stop matching until
+   * the secret is recreated or the rule is rewritten.
+   */
+  async delete(name) {
+    await this.transport.request("DELETE", `/proxy/v1/secrets/${encodeURIComponent(name)}`);
+  }
+};
+var ProxyAllowsAPI = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /** Add an allow rule. Returns the resolved rule with absolute `expires`. */
+  async add(req) {
+    const body = {
+      client: req.client,
+      host: req.host
+    };
+    if (req.secret) body.secret = req.secret;
+    if (req.methods && req.methods.length > 0) body.methods = req.methods;
+    if (req.paths && req.paths.length > 0) body.paths = req.paths;
+    if (req.ttlSeconds && req.ttlSeconds > 0) body.ttl_seconds = req.ttlSeconds;
+    if (req.passthrough) body.passthrough = true;
+    const wire = await this.transport.request(
+      "POST",
+      "/proxy/v1/allows",
+      body
+    );
+    return ruleFromWire(wire);
+  }
+  /**
+   * Host-bulk revoke: removes **every** rule on the client whose host
+   * matches. For surgical removal of one rule among siblings on the
+   * same host (e.g. several path-scoped rules on `github.com`), use
+   * `removeByTuple` instead.
+   */
+  async remove(client, host) {
+    await this.transport.request(
+      "DELETE",
+      `/proxy/v1/allows/${encodeURIComponent(client)}/${encodeURIComponent(host)}`
+    );
+  }
+  /**
+   * Surgical revoke: removes the single rule whose
+   * (host, methods, paths, passthrough) tuple matches the request.
+   * Pass exactly the same fields you used at create time. Method and
+   * host casing are normalised server-side, so `"GET"` / `"get"` and
+   * `"github.com"` / `"GITHUB.COM"` all match the same stored rule.
+   *
+   * Returns 404 (surfaced as a SlicerAPIError) when no rule matches.
+   */
+  async removeByTuple(req) {
+    const body = {
+      client: req.client,
+      host: req.host
+    };
+    if (req.secret) body.secret = req.secret;
+    if (req.methods && req.methods.length > 0) body.methods = req.methods;
+    if (req.paths && req.paths.length > 0) body.paths = req.paths;
+    if (req.passthrough) body.passthrough = true;
+    await this.transport.request("POST", "/proxy/v1/allows/revoke", body);
+  }
+};
+
 // src/client.ts
 var SlicerClient = class _SlicerClient {
   transport;
   hostGroups;
   vms;
   secrets;
+  proxy;
   constructor(opts) {
     this.transport = new TransportClient(opts);
     this.hostGroups = new HostGroupsAPI(this.transport);
     this.vms = new VMsAPI(this.transport);
     this.secrets = new SecretsAPI(this.transport);
+    this.proxy = new ProxyAPI(this.transport);
   }
   static fromEnv(overrides = {}) {
     const baseURL = overrides.baseURL ?? process.env.SLICER_URL;
@@ -1278,6 +1435,146 @@ var SlicerClient = class _SlicerClient {
   }
 };
 
-export { ExecStdioBase64, ExecStdioText, Forwarder, GiB, HostGroupsAPI, MiB, NonRootUser, SecretExistsError, SecretsAPI, SlicerAPIError, SlicerClient, VM, VMBg, VMFileSystem, VMsAPI, parseAddressMapping, resolveTransport };
+// src/shell.ts
+var FRAME_TYPE_DATA = 1;
+var FRAME_TYPE_WINDOW_SIZE = 2;
+var FRAME_TYPE_SHUTDOWN = 3;
+var FRAME_TYPE_HEARTBEAT = 4;
+var FRAME_TYPE_SESSION_CLOSE = 5;
+var HEADER_SIZE = 5;
+function encodeFrame(frameType, payload) {
+  const payloadLen = payload ? payload.byteLength : 0;
+  const buf = new Uint8Array(HEADER_SIZE + payloadLen);
+  const view = new DataView(buf.buffer);
+  view.setUint8(0, frameType);
+  view.setUint32(1, payloadLen, false);
+  if (payload) buf.set(payload, HEADER_SIZE);
+  return buf;
+}
+function parseFrame(data) {
+  if (data.byteLength < HEADER_SIZE) return null;
+  const view = new DataView(data);
+  const frameType = view.getUint8(0);
+  const payloadLen = view.getUint32(1, false);
+  if (data.byteLength < HEADER_SIZE + payloadLen) return null;
+  const payload = new Uint8Array(data, HEADER_SIZE, payloadLen);
+  return { frameType, payload };
+}
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var SlicerShellSession = class {
+  constructor(terminal, options) {
+    this.terminal = terminal;
+    this.options = options;
+  }
+  terminal;
+  options;
+  ws = null;
+  heartbeatTimer = null;
+  dataDisposable = null;
+  /** True when the WebSocket is open and relaying. */
+  get connected() {
+    return this.ws !== null && this.ws.readyState === WebSocket.OPEN;
+  }
+  /** Open the WebSocket and begin relaying. */
+  connect() {
+    if (this.ws) return;
+    this.options.onStateChange?.("connecting");
+    const ws = new WebSocket(this.options.url);
+    ws.binaryType = "arraybuffer";
+    this.ws = ws;
+    ws.onopen = () => {
+      this.options.onStateChange?.("connected");
+      this.terminal.reset();
+      this.sendResize(this.terminal.cols, this.terminal.rows);
+      this.startHeartbeat();
+    };
+    ws.onmessage = (ev) => {
+      if (!(ev.data instanceof ArrayBuffer)) return;
+      const frame = parseFrame(ev.data);
+      if (!frame) return;
+      switch (frame.frameType) {
+        case FRAME_TYPE_DATA:
+          this.terminal.write(decoder.decode(frame.payload));
+          break;
+        case FRAME_TYPE_SHUTDOWN:
+        case FRAME_TYPE_SESSION_CLOSE:
+          this.teardown();
+          break;
+      }
+    };
+    ws.onclose = () => {
+      this.teardown();
+    };
+    ws.onerror = () => {
+      this.options.onError?.("WebSocket error");
+      this.teardown();
+    };
+    this.dataDisposable = this.terminal.onData((data) => {
+      if (!this.connected) return;
+      const payload = encoder.encode(data);
+      this.ws.send(encodeFrame(FRAME_TYPE_DATA, payload));
+    });
+  }
+  /** Send a graceful shutdown frame and close. */
+  disconnect() {
+    if (this.ws) {
+      try {
+        this.ws.send(encodeFrame(FRAME_TYPE_SHUTDOWN));
+      } catch {
+      }
+    }
+    this.teardown();
+  }
+  /** Send a window resize. Call this from FitAddon's onResize or a ResizeObserver. */
+  resize(cols, rows) {
+    if (!this.connected) return;
+    this.sendResize(cols, rows);
+  }
+  // --- internals -------------------------------------------------------------
+  sendResize(cols, rows) {
+    const payload = new Uint8Array(8);
+    const view = new DataView(payload.buffer);
+    view.setUint32(0, cols, false);
+    view.setUint32(4, rows, false);
+    this.ws.send(encodeFrame(FRAME_TYPE_WINDOW_SIZE, payload));
+  }
+  startHeartbeat() {
+    this.stopHeartbeat();
+    const intervalMs = this.options.heartbeatIntervalMs ?? 3e4;
+    this.heartbeatTimer = setInterval(() => {
+      if (!this.connected) return;
+      this.ws.send(encodeFrame(FRAME_TYPE_HEARTBEAT));
+    }, intervalMs);
+  }
+  stopHeartbeat() {
+    if (this.heartbeatTimer !== null) {
+      clearInterval(this.heartbeatTimer);
+      this.heartbeatTimer = null;
+    }
+  }
+  teardown() {
+    this.stopHeartbeat();
+    if (this.dataDisposable) {
+      this.dataDisposable.dispose();
+      this.dataDisposable = null;
+    }
+    if (this.ws) {
+      const ws = this.ws;
+      this.ws = null;
+      ws.onopen = null;
+      ws.onmessage = null;
+      ws.onclose = null;
+      ws.onerror = null;
+      try {
+        ws.close();
+      } catch {
+      }
+    }
+    this.options.onStateChange?.("disconnected");
+  }
+};
+
+export { ExecStdioBase64, ExecStdioText, FRAME_TYPE_DATA, FRAME_TYPE_HEARTBEAT, FRAME_TYPE_SESSION_CLOSE, FRAME_TYPE_SHUTDOWN, FRAME_TYPE_WINDOW_SIZE, Forwarder, GiB, HostGroupsAPI, MiB, NonRootUser, ProxyAPI, ProxyAllowsAPI, ProxyClientsAPI, ProxySecretBasic, ProxySecretBearer, ProxySecretsAPI, SecretExistsError, SecretsAPI, SlicerAPIError, SlicerClient, SlicerShellSession, VM, VMBg, VMFileSystem, VMsAPI, encodeFrame, parseAddressMapping, parseFrame, resolveTransport };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map