@slicervm/sdk 0.1.9 → 0.1.11

package/dist/index.d.cts

@@ -27,6 +27,15 @@ interface VMInfo {
     status?: string;
     persistent?: boolean;
 }
+interface VMTagResponse {
+    hostname: string;
+    tags: string[];
+}
+interface VMTagUpdate {
+    add?: string[];
+    remove?: string[];
+    replace?: string[];
+}
 /**
  * Per-launch network policy override for isolated host groups.
  * Omitted lists inherit the host group's policy. Empty lists intentionally
@@ -650,6 +659,7 @@ interface VMInit {
     ip?: string;
     createdAt?: string;
     arch?: string;
+    tags?: string[];
 }
 declare class CommittedVM {
     private readonly transport;
@@ -672,10 +682,16 @@ declare class VM {
     readonly ip?: string;
     readonly createdAt?: string;
     readonly arch?: string;
+    tags?: string[];
     readonly fs: VMFileSystem;
     readonly bg: VMBg;
     private readonly transport;
     constructor(transport: TransportClient, init: VMInit);
+    getTags(): Promise<string[]>;
+    updateTags(update: VMTagUpdate): Promise<string[]>;
+    addTags(...tags: string[]): Promise<string[]>;
+    removeTags(...tags: string[]): Promise<string[]>;
+    replaceTags(tags: string[]): Promise<string[]>;
     delete(): Promise<void>;
     health(): Promise<AgentHealth>;
     logs(): Promise<VMLogs>;
@@ -854,12 +870,24 @@ declare class SecretsAPI {
  */
 
 /** Credential type for upstream injection. */
-type ProxySecretType = 'bearer' | 'basic' | 'oauth-client-creds';
+type ProxySecretType = 'bearer' | 'basic' | 'oauth-client-creds' | 'oauth-codex' | 'oauth-claude' | 'oauth-github-copilot' | 'oauth-xai' | 'github-app-user' | 'github-app';
 declare const ProxySecretBearer: ProxySecretType;
 /** For basic auth, the secret value must be in `user:pass` form. */
 declare const ProxySecretBasic: ProxySecretType;
 /** OAuth 2.0 client credentials exchanged and renewed by the proxy host. */
 declare const ProxySecretOAuthClientCredentials: ProxySecretType;
+/** Adopt and refresh a host-side Codex ChatGPT OAuth credential. */
+declare const ProxySecretOAuthCodex: ProxySecretType;
+/** Adopt and refresh a host-side Claude Code OAuth credential. */
+declare const ProxySecretOAuthClaude: ProxySecretType;
+/** Adopt and refresh a host-side GitHub Copilot OAuth credential. */
+declare const ProxySecretOAuthGitHubCopilot: ProxySecretType;
+/** Adopt and refresh a host-side xAI Grok OAuth credential. */
+declare const ProxySecretOAuthXAI: ProxySecretType;
+/** Adopt and refresh a host-side GitHub App user OAuth credential. */
+declare const ProxySecretGitHubAppUser: ProxySecretType;
+/** Adopt a host-side GitHub App tuple and inject installation-token Git auth. */
+declare const ProxySecretGitHubApp: ProxySecretType;
 /** A registered proxy client. Tokens are never returned by list/get. */
 interface ProxyClient {
     name: string;
@@ -890,6 +918,9 @@ interface ProxySecret {
     /** Defaults to `bearer` when empty in older state files. */
     type?: ProxySecretType;
     createdAt: string;
+    updatedAt?: string;
+    adoptedAt?: string;
+    refreshedAt?: string;
 }
 interface CreateProxySecretRequest {
     name: string;
@@ -902,8 +933,30 @@ interface CreateProxySecretRequest {
      * inner request). For `oauth-client-creds`, pass top-level JSON containing
      * `token_endpoint`, `client_id`, and `client_secret`; optional `scope` is
      * supported. The proxy obtains, caches, and renews the bearer host-side.
+     * For `oauth-codex`, pass a Codex auth.json or
+     * minimal OAuth JSON containing access_token, refresh_token, and
+     * account_id. For `oauth-claude`, pass Claude Code's .credentials.json
+     * or minimal OAuth JSON containing accessToken and refreshToken. For
+     * `oauth-github-copilot`, pass opencode auth.json or minimal OAuth JSON
+     * containing a GitHub Copilot gho_* or ghu_* token. For `oauth-xai`, pass JSON
+     * emitted by `slicer proxy oauth xai`, or equivalent top-level JSON
+     * containing access_token and refresh_token. For `github-app-user`, pass
+     * JSON emitted by `slicer proxy oauth github-app-user`, or equivalent
+     * top-level JSON containing access_token. The proxy stores and refreshes
+     * OAuth credentials host-side. For `github-app`, pass top-level JSON
+     * containing app_id and either private_key_file or private_key. With
+     * private_key_file, the proxy keeps the PEM file on the host; with
+     * private_key, the PEM is stored in proxy state. The proxy mints GitHub App
+     * installation tokens in memory and injects Git HTTPS Basic auth for
+     * github.com clone/fetch requests.
      */
     value: string;
+    /**
+     * Overwrite an existing secret with the same name. Useful after the
+     * host-side OAuth login has been refreshed manually and the proxy
+     * should re-adopt the credential without rewriting allow rules.
+     */
+    force?: boolean;
 }
 /**
  * Per-client allow entry. First-match-wins by declaration order.
@@ -912,6 +965,8 @@ interface CreateProxySecretRequest {
  *   on the inner request and substitutes the secret's value.
  * - `methods`/`paths` are optional filters (any-of within each list,
  *   all-of across lists). Empty list = any.
+ * - `ports` is optional. Empty means the default web ports 80 and 443
+ *   for backwards compatibility with older host-only rules.
  * - When `passthrough` is true, the proxy splices TCP both ways at
  *   CONNECT without terminating TLS. Cert-pinned clients work
  *   unchanged. Mutually exclusive with `secret`, `methods`, `paths`;
@@ -922,6 +977,7 @@ interface ProxyAllowRule {
     secret?: string;
     methods?: string[];
     paths?: string[];
+    ports?: number[];
     /** RFC 3339 timestamp; absent / zero-value when no expiry. */
     expires?: string;
     passthrough?: boolean;
@@ -933,6 +989,7 @@ interface AddProxyAllowRequest {
     secret?: string;
     methods?: string[];
     paths?: string[];
+    ports?: number[];
     /**
      * Time-to-live in seconds. 0 / omitted = never expires. Resolved to
      * an absolute `expires` timestamp on the returned rule.
@@ -944,7 +1001,7 @@ interface AddProxyAllowRequest {
 /**
  * Input to `allows.removeByTuple`. Mirrors the create payload minus
  * `ttlSeconds` (TTL is mutable lifetime, not part of identity). The
- * proxy matches the rule by (host, methods, paths, passthrough) and
+ * proxy matches the rule by (host, methods, paths, ports, passthrough) and
  * removes the single matching rule. Use when several rules share a
  * host and you want surgical removal of one — pass exactly the same
  * fields you used at create time.
@@ -955,6 +1012,7 @@ interface RemoveProxyAllowByTupleRequest {
     secret?: string;
     methods?: string[];
     paths?: string[];
+    ports?: number[];
     passthrough?: boolean;
 }
 declare class ProxyAPI {
@@ -1003,7 +1061,7 @@ declare class ProxyAllowsAPI {
     remove(client: string, host: string): Promise<void>;
     /**
      * Surgical revoke: removes the single rule whose
-     * (host, methods, paths, passthrough) tuple matches the request.
+     * (host, methods, paths, ports, passthrough) tuple matches the request.
      * Pass exactly the same fields you used at create time. Method and
      * host casing are normalised server-side, so `"GET"` / `"get"` and
      * `"github.com"` / `"GITHUB.COM"` all match the same stored rule.
@@ -1109,4 +1167,4 @@ declare class SlicerShellSession {
     private teardown;
 }
 
-export { type AddProxyAllowRequest, type AddressMapping, type AgentHealth, type BgDeleteResponse, type BgExecInfo, type BgExecRequest, type BgExecResponse, type BgKillOptions, type BgKillResponse, type BgLogOptions, type BgWaitExitResponse, CommitsAPI, CommittedVM, type CreateProxyClientOptions, type CreateProxySecretRequest, type CreateSecretRequest, type CreateVMNetworkPolicy, type CreateVMOptions, type CreateVMRequest, type CreateVMResponse, type DeleteResponse, type ExecFrame, type ExecRequest, type ExecResult, type ExecResultBinary, type ExecStdio, ExecStdioBase64, ExecStdioText, FRAME_TYPE_DATA, FRAME_TYPE_HEARTBEAT, FRAME_TYPE_SESSION_CLOSE, FRAME_TYPE_SHUTDOWN, FRAME_TYPE_WINDOW_SIZE, type FSEntry, type FSMkdirRequest, type FSWatchEvent, type FSWatchEventType, type FSWatchRequest, Forwarder, type ForwarderListener, type ForwarderOptions, GiB, type HostGroup, HostGroupsAPI, type ListOptions, MiB, NonRootUser, ProxyAPI, type ProxyAllowRule, ProxyAllowsAPI, type ProxyClient, type ProxyClientCreated, ProxyClientsAPI, type ProxySecret, ProxySecretBasic, ProxySecretBearer, ProxySecretOAuthClientCredentials, type ProxySecretType, ProxySecretsAPI, type RemoveProxyAllowByTupleRequest, type Secret, SecretExistsError, SecretsAPI, type ShellSessionOptions, type ShutdownRequest, SlicerAPIError, SlicerClient, type SlicerClientOptions, type SlicerInfo, SlicerShellSession, type UpdateSecretRequest, VM, VMBg, type VMCommitDeleteResponse, type VMCommitInfo, type VMCommitListOptions, type VMCommitOptions, type VMCommitResponse, type VMDescription, VMFileSystem, type VMForkFixup, type VMForkNetworkPolicy, type VMForkOptions, type VMForkResponse, type VMForkTagMode, type VMForkWait, type VMInfo, type VMInit, type VMLogs, type VMNetworkDescription, type VMNetworkPolicy, type VMSnapshot, type VMStat, VMsAPI, type WaitOptions, type XTermLike, encodeFrame, parseAddressMapping, parseFrame, resolveTransport };
+export { type AddProxyAllowRequest, type AddressMapping, type AgentHealth, type BgDeleteResponse, type BgExecInfo, type BgExecRequest, type BgExecResponse, type BgKillOptions, type BgKillResponse, type BgLogOptions, type BgWaitExitResponse, CommitsAPI, CommittedVM, type CreateProxyClientOptions, type CreateProxySecretRequest, type CreateSecretRequest, type CreateVMNetworkPolicy, type CreateVMOptions, type CreateVMRequest, type CreateVMResponse, type DeleteResponse, type ExecFrame, type ExecRequest, type ExecResult, type ExecResultBinary, type ExecStdio, ExecStdioBase64, ExecStdioText, FRAME_TYPE_DATA, FRAME_TYPE_HEARTBEAT, FRAME_TYPE_SESSION_CLOSE, FRAME_TYPE_SHUTDOWN, FRAME_TYPE_WINDOW_SIZE, type FSEntry, type FSMkdirRequest, type FSWatchEvent, type FSWatchEventType, type FSWatchRequest, Forwarder, type ForwarderListener, type ForwarderOptions, GiB, type HostGroup, HostGroupsAPI, type ListOptions, MiB, NonRootUser, ProxyAPI, type ProxyAllowRule, ProxyAllowsAPI, type ProxyClient, type ProxyClientCreated, ProxyClientsAPI, type ProxySecret, ProxySecretBasic, ProxySecretBearer, ProxySecretGitHubApp, ProxySecretGitHubAppUser, ProxySecretOAuthClaude, ProxySecretOAuthClientCredentials, ProxySecretOAuthCodex, ProxySecretOAuthGitHubCopilot, ProxySecretOAuthXAI, type ProxySecretType, ProxySecretsAPI, type RemoveProxyAllowByTupleRequest, type Secret, SecretExistsError, SecretsAPI, type ShellSessionOptions, type ShutdownRequest, SlicerAPIError, SlicerClient, type SlicerClientOptions, type SlicerInfo, SlicerShellSession, type UpdateSecretRequest, VM, VMBg, type VMCommitDeleteResponse, type VMCommitInfo, type VMCommitListOptions, type VMCommitOptions, type VMCommitResponse, type VMDescription, VMFileSystem, type VMForkFixup, type VMForkNetworkPolicy, type VMForkOptions, type VMForkResponse, type VMForkTagMode, type VMForkWait, type VMInfo, type VMInit, type VMLogs, type VMNetworkDescription, type VMNetworkPolicy, type VMSnapshot, type VMStat, type VMTagResponse, type VMTagUpdate, VMsAPI, type WaitOptions, type XTermLike, encodeFrame, parseAddressMapping, parseFrame, resolveTransport };

package/dist/index.d.ts

@@ -27,6 +27,15 @@ interface VMInfo {
     status?: string;
     persistent?: boolean;
 }
+interface VMTagResponse {
+    hostname: string;
+    tags: string[];
+}
+interface VMTagUpdate {
+    add?: string[];
+    remove?: string[];
+    replace?: string[];
+}
 /**
  * Per-launch network policy override for isolated host groups.
  * Omitted lists inherit the host group's policy. Empty lists intentionally
@@ -650,6 +659,7 @@ interface VMInit {
     ip?: string;
     createdAt?: string;
     arch?: string;
+    tags?: string[];
 }
 declare class CommittedVM {
     private readonly transport;
@@ -672,10 +682,16 @@ declare class VM {
     readonly ip?: string;
     readonly createdAt?: string;
     readonly arch?: string;
+    tags?: string[];
     readonly fs: VMFileSystem;
     readonly bg: VMBg;
     private readonly transport;
     constructor(transport: TransportClient, init: VMInit);
+    getTags(): Promise<string[]>;
+    updateTags(update: VMTagUpdate): Promise<string[]>;
+    addTags(...tags: string[]): Promise<string[]>;
+    removeTags(...tags: string[]): Promise<string[]>;
+    replaceTags(tags: string[]): Promise<string[]>;
     delete(): Promise<void>;
     health(): Promise<AgentHealth>;
     logs(): Promise<VMLogs>;
@@ -854,12 +870,24 @@ declare class SecretsAPI {
  */
 
 /** Credential type for upstream injection. */
-type ProxySecretType = 'bearer' | 'basic' | 'oauth-client-creds';
+type ProxySecretType = 'bearer' | 'basic' | 'oauth-client-creds' | 'oauth-codex' | 'oauth-claude' | 'oauth-github-copilot' | 'oauth-xai' | 'github-app-user' | 'github-app';
 declare const ProxySecretBearer: ProxySecretType;
 /** For basic auth, the secret value must be in `user:pass` form. */
 declare const ProxySecretBasic: ProxySecretType;
 /** OAuth 2.0 client credentials exchanged and renewed by the proxy host. */
 declare const ProxySecretOAuthClientCredentials: ProxySecretType;
+/** Adopt and refresh a host-side Codex ChatGPT OAuth credential. */
+declare const ProxySecretOAuthCodex: ProxySecretType;
+/** Adopt and refresh a host-side Claude Code OAuth credential. */
+declare const ProxySecretOAuthClaude: ProxySecretType;
+/** Adopt and refresh a host-side GitHub Copilot OAuth credential. */
+declare const ProxySecretOAuthGitHubCopilot: ProxySecretType;
+/** Adopt and refresh a host-side xAI Grok OAuth credential. */
+declare const ProxySecretOAuthXAI: ProxySecretType;
+/** Adopt and refresh a host-side GitHub App user OAuth credential. */
+declare const ProxySecretGitHubAppUser: ProxySecretType;
+/** Adopt a host-side GitHub App tuple and inject installation-token Git auth. */
+declare const ProxySecretGitHubApp: ProxySecretType;
 /** A registered proxy client. Tokens are never returned by list/get. */
 interface ProxyClient {
     name: string;
@@ -890,6 +918,9 @@ interface ProxySecret {
     /** Defaults to `bearer` when empty in older state files. */
     type?: ProxySecretType;
     createdAt: string;
+    updatedAt?: string;
+    adoptedAt?: string;
+    refreshedAt?: string;
 }
 interface CreateProxySecretRequest {
     name: string;
@@ -902,8 +933,30 @@ interface CreateProxySecretRequest {
      * inner request). For `oauth-client-creds`, pass top-level JSON containing
      * `token_endpoint`, `client_id`, and `client_secret`; optional `scope` is
      * supported. The proxy obtains, caches, and renews the bearer host-side.
+     * For `oauth-codex`, pass a Codex auth.json or
+     * minimal OAuth JSON containing access_token, refresh_token, and
+     * account_id. For `oauth-claude`, pass Claude Code's .credentials.json
+     * or minimal OAuth JSON containing accessToken and refreshToken. For
+     * `oauth-github-copilot`, pass opencode auth.json or minimal OAuth JSON
+     * containing a GitHub Copilot gho_* or ghu_* token. For `oauth-xai`, pass JSON
+     * emitted by `slicer proxy oauth xai`, or equivalent top-level JSON
+     * containing access_token and refresh_token. For `github-app-user`, pass
+     * JSON emitted by `slicer proxy oauth github-app-user`, or equivalent
+     * top-level JSON containing access_token. The proxy stores and refreshes
+     * OAuth credentials host-side. For `github-app`, pass top-level JSON
+     * containing app_id and either private_key_file or private_key. With
+     * private_key_file, the proxy keeps the PEM file on the host; with
+     * private_key, the PEM is stored in proxy state. The proxy mints GitHub App
+     * installation tokens in memory and injects Git HTTPS Basic auth for
+     * github.com clone/fetch requests.
      */
     value: string;
+    /**
+     * Overwrite an existing secret with the same name. Useful after the
+     * host-side OAuth login has been refreshed manually and the proxy
+     * should re-adopt the credential without rewriting allow rules.
+     */
+    force?: boolean;
 }
 /**
  * Per-client allow entry. First-match-wins by declaration order.
@@ -912,6 +965,8 @@ interface CreateProxySecretRequest {
  *   on the inner request and substitutes the secret's value.
  * - `methods`/`paths` are optional filters (any-of within each list,
  *   all-of across lists). Empty list = any.
+ * - `ports` is optional. Empty means the default web ports 80 and 443
+ *   for backwards compatibility with older host-only rules.
  * - When `passthrough` is true, the proxy splices TCP both ways at
  *   CONNECT without terminating TLS. Cert-pinned clients work
  *   unchanged. Mutually exclusive with `secret`, `methods`, `paths`;
@@ -922,6 +977,7 @@ interface ProxyAllowRule {
     secret?: string;
     methods?: string[];
     paths?: string[];
+    ports?: number[];
     /** RFC 3339 timestamp; absent / zero-value when no expiry. */
     expires?: string;
     passthrough?: boolean;
@@ -933,6 +989,7 @@ interface AddProxyAllowRequest {
     secret?: string;
     methods?: string[];
     paths?: string[];
+    ports?: number[];
     /**
      * Time-to-live in seconds. 0 / omitted = never expires. Resolved to
      * an absolute `expires` timestamp on the returned rule.
@@ -944,7 +1001,7 @@ interface AddProxyAllowRequest {
 /**
  * Input to `allows.removeByTuple`. Mirrors the create payload minus
  * `ttlSeconds` (TTL is mutable lifetime, not part of identity). The
- * proxy matches the rule by (host, methods, paths, passthrough) and
+ * proxy matches the rule by (host, methods, paths, ports, passthrough) and
  * removes the single matching rule. Use when several rules share a
  * host and you want surgical removal of one — pass exactly the same
  * fields you used at create time.
@@ -955,6 +1012,7 @@ interface RemoveProxyAllowByTupleRequest {
     secret?: string;
     methods?: string[];
     paths?: string[];
+    ports?: number[];
     passthrough?: boolean;
 }
 declare class ProxyAPI {
@@ -1003,7 +1061,7 @@ declare class ProxyAllowsAPI {
     remove(client: string, host: string): Promise<void>;
     /**
      * Surgical revoke: removes the single rule whose
-     * (host, methods, paths, passthrough) tuple matches the request.
+     * (host, methods, paths, ports, passthrough) tuple matches the request.
      * Pass exactly the same fields you used at create time. Method and
      * host casing are normalised server-side, so `"GET"` / `"get"` and
      * `"github.com"` / `"GITHUB.COM"` all match the same stored rule.
@@ -1109,4 +1167,4 @@ declare class SlicerShellSession {
     private teardown;
 }
 
-export { type AddProxyAllowRequest, type AddressMapping, type AgentHealth, type BgDeleteResponse, type BgExecInfo, type BgExecRequest, type BgExecResponse, type BgKillOptions, type BgKillResponse, type BgLogOptions, type BgWaitExitResponse, CommitsAPI, CommittedVM, type CreateProxyClientOptions, type CreateProxySecretRequest, type CreateSecretRequest, type CreateVMNetworkPolicy, type CreateVMOptions, type CreateVMRequest, type CreateVMResponse, type DeleteResponse, type ExecFrame, type ExecRequest, type ExecResult, type ExecResultBinary, type ExecStdio, ExecStdioBase64, ExecStdioText, FRAME_TYPE_DATA, FRAME_TYPE_HEARTBEAT, FRAME_TYPE_SESSION_CLOSE, FRAME_TYPE_SHUTDOWN, FRAME_TYPE_WINDOW_SIZE, type FSEntry, type FSMkdirRequest, type FSWatchEvent, type FSWatchEventType, type FSWatchRequest, Forwarder, type ForwarderListener, type ForwarderOptions, GiB, type HostGroup, HostGroupsAPI, type ListOptions, MiB, NonRootUser, ProxyAPI, type ProxyAllowRule, ProxyAllowsAPI, type ProxyClient, type ProxyClientCreated, ProxyClientsAPI, type ProxySecret, ProxySecretBasic, ProxySecretBearer, ProxySecretOAuthClientCredentials, type ProxySecretType, ProxySecretsAPI, type RemoveProxyAllowByTupleRequest, type Secret, SecretExistsError, SecretsAPI, type ShellSessionOptions, type ShutdownRequest, SlicerAPIError, SlicerClient, type SlicerClientOptions, type SlicerInfo, SlicerShellSession, type UpdateSecretRequest, VM, VMBg, type VMCommitDeleteResponse, type VMCommitInfo, type VMCommitListOptions, type VMCommitOptions, type VMCommitResponse, type VMDescription, VMFileSystem, type VMForkFixup, type VMForkNetworkPolicy, type VMForkOptions, type VMForkResponse, type VMForkTagMode, type VMForkWait, type VMInfo, type VMInit, type VMLogs, type VMNetworkDescription, type VMNetworkPolicy, type VMSnapshot, type VMStat, VMsAPI, type WaitOptions, type XTermLike, encodeFrame, parseAddressMapping, parseFrame, resolveTransport };
+export { type AddProxyAllowRequest, type AddressMapping, type AgentHealth, type BgDeleteResponse, type BgExecInfo, type BgExecRequest, type BgExecResponse, type BgKillOptions, type BgKillResponse, type BgLogOptions, type BgWaitExitResponse, CommitsAPI, CommittedVM, type CreateProxyClientOptions, type CreateProxySecretRequest, type CreateSecretRequest, type CreateVMNetworkPolicy, type CreateVMOptions, type CreateVMRequest, type CreateVMResponse, type DeleteResponse, type ExecFrame, type ExecRequest, type ExecResult, type ExecResultBinary, type ExecStdio, ExecStdioBase64, ExecStdioText, FRAME_TYPE_DATA, FRAME_TYPE_HEARTBEAT, FRAME_TYPE_SESSION_CLOSE, FRAME_TYPE_SHUTDOWN, FRAME_TYPE_WINDOW_SIZE, type FSEntry, type FSMkdirRequest, type FSWatchEvent, type FSWatchEventType, type FSWatchRequest, Forwarder, type ForwarderListener, type ForwarderOptions, GiB, type HostGroup, HostGroupsAPI, type ListOptions, MiB, NonRootUser, ProxyAPI, type ProxyAllowRule, ProxyAllowsAPI, type ProxyClient, type ProxyClientCreated, ProxyClientsAPI, type ProxySecret, ProxySecretBasic, ProxySecretBearer, ProxySecretGitHubApp, ProxySecretGitHubAppUser, ProxySecretOAuthClaude, ProxySecretOAuthClientCredentials, ProxySecretOAuthCodex, ProxySecretOAuthGitHubCopilot, ProxySecretOAuthXAI, type ProxySecretType, ProxySecretsAPI, type RemoveProxyAllowByTupleRequest, type Secret, SecretExistsError, SecretsAPI, type ShellSessionOptions, type ShutdownRequest, SlicerAPIError, SlicerClient, type SlicerClientOptions, type SlicerInfo, SlicerShellSession, type UpdateSecretRequest, VM, VMBg, type VMCommitDeleteResponse, type VMCommitInfo, type VMCommitListOptions, type VMCommitOptions, type VMCommitResponse, type VMDescription, VMFileSystem, type VMForkFixup, type VMForkNetworkPolicy, type VMForkOptions, type VMForkResponse, type VMForkTagMode, type VMForkWait, type VMInfo, type VMInit, type VMLogs, type VMNetworkDescription, type VMNetworkPolicy, type VMSnapshot, type VMStat, type VMTagResponse, type VMTagUpdate, VMsAPI, type WaitOptions, type XTermLike, encodeFrame, parseAddressMapping, parseFrame, resolveTransport };

package/dist/index.js

@@ -866,6 +866,7 @@ var VM = class {
   ip;
   createdAt;
   arch;
+  tags;
   fs;
   bg;
   transport;
@@ -876,10 +877,37 @@ var VM = class {
     if (init.ip !== void 0) this.ip = init.ip;
     if (init.createdAt !== void 0) this.createdAt = init.createdAt;
     if (init.arch !== void 0) this.arch = init.arch;
+    if (init.tags !== void 0) this.tags = init.tags;
     this.fs = new VMFileSystem(transport, this.hostname);
     this.bg = new VMBg(transport, this.hostname);
   }
   // --- lifecycle --------------------------------------------------------
+  async getTags() {
+    const response = await this.transport.request(
+      "GET",
+      `/vm/${encodeURIComponent(this.hostname)}/tags`
+    );
+    this.tags = response.tags;
+    return response.tags;
+  }
+  async updateTags(update) {
+    const response = await this.transport.request(
+      "PATCH",
+      `/vm/${encodeURIComponent(this.hostname)}/tags`,
+      update
+    );
+    this.tags = response.tags;
+    return response.tags;
+  }
+  async addTags(...tags) {
+    return this.updateTags({ add: tags });
+  }
+  async removeTags(...tags) {
+    return this.updateTags({ remove: tags });
+  }
+  async replaceTags(tags) {
+    return this.updateTags({ replace: tags });
+  }
   async delete() {
     await this.transport.request(
       "DELETE",
@@ -1336,7 +1364,8 @@ var VMsAPI = class {
       hostGroup: res.hostGroup ?? hostGroup,
       ...res.ip !== void 0 && { ip: res.ip },
       ...res.createdAt !== void 0 && { createdAt: res.createdAt },
-      ...res.arch !== void 0 && { arch: res.arch }
+      ...res.arch !== void 0 && { arch: res.arch },
+      ...req.tags !== void 0 && { tags: [...req.tags] }
     });
   }
   /**
@@ -1356,7 +1385,8 @@ var VMsAPI = class {
       hostGroup: found.hostGroup ?? "",
       ...found.ip !== void 0 && { ip: found.ip },
       ...found.createdAt !== void 0 && { createdAt: found.createdAt },
-      ...found.arch !== void 0 && { arch: found.arch }
+      ...found.arch !== void 0 && { arch: found.arch },
+      ...found.tags !== void 0 && { tags: found.tags }
     });
   }
   /** Return raw VM metadata across all host groups. */
@@ -1485,6 +1515,12 @@ function validateCommitId2(commitId) {
 var ProxySecretBearer = "bearer";
 var ProxySecretBasic = "basic";
 var ProxySecretOAuthClientCredentials = "oauth-client-creds";
+var ProxySecretOAuthCodex = "oauth-codex";
+var ProxySecretOAuthClaude = "oauth-claude";
+var ProxySecretOAuthGitHubCopilot = "oauth-github-copilot";
+var ProxySecretOAuthXAI = "oauth-xai";
+var ProxySecretGitHubAppUser = "github-app-user";
+var ProxySecretGitHubApp = "github-app";
 function clientFromWire(w) {
   return { name: w.name, createdAt: w.created_at };
 }
@@ -1494,6 +1530,9 @@ function clientCreatedFromWire(w) {
 function secretFromWire2(w) {
   const out = { name: w.name, host: w.host, createdAt: w.created_at };
   if (w.type) out.type = w.type;
+  if (w.updated_at && w.updated_at !== "0001-01-01T00:00:00Z") out.updatedAt = w.updated_at;
+  if (w.adopted_at && w.adopted_at !== "0001-01-01T00:00:00Z") out.adoptedAt = w.adopted_at;
+  if (w.refreshed_at && w.refreshed_at !== "0001-01-01T00:00:00Z") out.refreshedAt = w.refreshed_at;
   return out;
 }
 function ruleFromWire(w) {
@@ -1501,6 +1540,7 @@ function ruleFromWire(w) {
   if (w.secret) out.secret = w.secret;
   if (w.methods && w.methods.length > 0) out.methods = w.methods;
   if (w.paths && w.paths.length > 0) out.paths = w.paths;
+  if (w.ports && w.ports.length > 0) out.ports = w.ports;
   if (w.expires && w.expires !== "0001-01-01T00:00:00Z") out.expires = w.expires;
   if (w.passthrough) out.passthrough = w.passthrough;
   return out;
@@ -1565,6 +1605,7 @@ var ProxySecretsAPI = class {
       value: req.value
     };
     if (req.type) body.type = req.type;
+    if (req.force) body.force = true;
     await this.transport.request("POST", "/proxy/v1/secrets", body);
   }
   async list() {
@@ -1593,6 +1634,7 @@ var ProxyAllowsAPI = class {
     if (req.secret) body.secret = req.secret;
     if (req.methods && req.methods.length > 0) body.methods = req.methods;
     if (req.paths && req.paths.length > 0) body.paths = req.paths;
+    if (req.ports && req.ports.length > 0) body.ports = req.ports;
     if (req.ttlSeconds && req.ttlSeconds > 0) body.ttl_seconds = req.ttlSeconds;
     if (req.passthrough) body.passthrough = true;
     const wire = await this.transport.request(
@@ -1616,7 +1658,7 @@ var ProxyAllowsAPI = class {
   }
   /**
    * Surgical revoke: removes the single rule whose
-   * (host, methods, paths, passthrough) tuple matches the request.
+   * (host, methods, paths, ports, passthrough) tuple matches the request.
    * Pass exactly the same fields you used at create time. Method and
    * host casing are normalised server-side, so `"GET"` / `"get"` and
    * `"github.com"` / `"GITHUB.COM"` all match the same stored rule.
@@ -1631,6 +1673,7 @@ var ProxyAllowsAPI = class {
     if (req.secret) body.secret = req.secret;
     if (req.methods && req.methods.length > 0) body.methods = req.methods;
     if (req.paths && req.paths.length > 0) body.paths = req.paths;
+    if (req.ports && req.ports.length > 0) body.ports = req.ports;
     if (req.passthrough) body.passthrough = true;
     await this.transport.request("POST", "/proxy/v1/allows/revoke", body);
   }
@@ -1807,6 +1850,6 @@ var SlicerShellSession = class {
   }
 };
 
-export { CommitsAPI, CommittedVM, ExecStdioBase64, ExecStdioText, FRAME_TYPE_DATA, FRAME_TYPE_HEARTBEAT, FRAME_TYPE_SESSION_CLOSE, FRAME_TYPE_SHUTDOWN, FRAME_TYPE_WINDOW_SIZE, Forwarder, GiB, HostGroupsAPI, MiB, NonRootUser, ProxyAPI, ProxyAllowsAPI, ProxyClientsAPI, ProxySecretBasic, ProxySecretBearer, ProxySecretOAuthClientCredentials, ProxySecretsAPI, SecretExistsError, SecretsAPI, SlicerAPIError, SlicerClient, SlicerShellSession, VM, VMBg, VMFileSystem, VMsAPI, encodeFrame, parseAddressMapping, parseFrame, resolveTransport };
+export { CommitsAPI, CommittedVM, ExecStdioBase64, ExecStdioText, FRAME_TYPE_DATA, FRAME_TYPE_HEARTBEAT, FRAME_TYPE_SESSION_CLOSE, FRAME_TYPE_SHUTDOWN, FRAME_TYPE_WINDOW_SIZE, Forwarder, GiB, HostGroupsAPI, MiB, NonRootUser, ProxyAPI, ProxyAllowsAPI, ProxyClientsAPI, ProxySecretBasic, ProxySecretBearer, ProxySecretGitHubApp, ProxySecretGitHubAppUser, ProxySecretOAuthClaude, ProxySecretOAuthClientCredentials, ProxySecretOAuthCodex, ProxySecretOAuthGitHubCopilot, ProxySecretOAuthXAI, ProxySecretsAPI, SecretExistsError, SecretsAPI, SlicerAPIError, SlicerClient, SlicerShellSession, VM, VMBg, VMFileSystem, VMsAPI, encodeFrame, parseAddressMapping, parseFrame, resolveTransport };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map