@rstreamlabs/tunnels 1.0.1 → 1.0.3

package/dist/index.js

@@ -46,6 +46,7 @@ __export(index_exports, {
   authTokenPermissionsSchema: () => authTokenPermissionsSchema,
   authTokenSchema: () => authTokenSchema,
   authTokenScopesSchema: () => authTokenScopesSchema,
+  authTokenTunnelGrantSchema: () => authTokenTunnelGrantSchema,
   authTokenTunnelsScopesSchema: () => authTokenTunnelsScopesSchema,
   clientSchema: () => clientSchema,
   createAPITURNCredentials: () => createAPITURNCredentials,
@@ -65,7 +66,9 @@ __export(index_exports, {
   resolveTunnelsAPIURL: () => resolveTunnelsAPIURL,
   resolveTunnelsCredentials: () => resolveTunnelsCredentials,
   resolveTunnelsEngine: () => resolveTunnelsEngine,
+  streamEndpointSchema: () => streamEndpointSchema,
   streamSummarySchema: () => streamSummarySchema,
+  streamTLSInfoSchema: () => streamTLSInfoSchema,
   tokenSchema: () => tokenSchema,
   tunnelSchema: () => tunnelSchema,
   turnCredentialModeSchema: () => turnCredentialModeSchema,
@@ -77,41 +80,6 @@ module.exports = __toCommonJS(index_exports);
 
 // src/auth-resource.ts
 var import_rstream = require("@rstreamlabs/rstream");
-var import_rstream2 = require("@rstreamlabs/rstream");
-var RstreamAuthResource = class {
-  client;
-  constructor(client) {
-    this.client = client;
-  }
-  async createAuthToken(params, options) {
-    const credentials = options?.credentials || this.client.credentials;
-    if (!(0, import_rstream2.isClientCredentials)(credentials)) {
-      throw new Error(
-        "Application credentials (client id, client secret) are required to create an auth token."
-      );
-    }
-    const engine = options?.engine ?? await this.client.getEngine().catch(() => void 0);
-    return createAuthTokenFromClientCredentials(credentials, params, {
-      engine
-    });
-  }
-};
-function createAuthTokenFromClientCredentials(credentials, params, options) {
-  const payload = {
-    metadata: {
-      engine: options?.engine,
-      scopes: params?.scopes
-    },
-    permissions: null,
-    project_id: params?.project_id,
-    workspace_id: params?.workspace_id
-  };
-  const { token } = (0, import_rstream.createClientCredentialsToken)(credentials, {
-    claims: payload,
-    expiresInSeconds: params?.expires_in
-  });
-  return { token };
-}
 
 // src/zod.ts
 var z = __toESM(require("zod"));
@@ -141,9 +109,9 @@ function filters(base) {
   const shape = Object.fromEntries(entries);
   const node = z.lazy(
     () => z.union([
-      z.object(shape),
-      z.object({ AND: z.array(node) }),
-      z.object({ OR: z.array(node) })
+      z.object(shape).strict(),
+      z.object({ AND: z.array(node) }).strict(),
+      z.object({ OR: z.array(node) }).strict()
     ])
   );
   return node;
@@ -206,6 +174,7 @@ var listTunnelsResponseSchema = z2.array(tunnelSchema);
 
 // src/auth.ts
 var z3 = __toESM(require("zod"));
+var nonEmptyStringSchema = z3.string().trim().min(1);
 var authTokenPermissionsSchema = z3.array(z3.string());
 var authTokenTunnelsScopesSchema = z3.object({
   // Scopes for creating tunnels
@@ -254,45 +223,121 @@ var authTokenScopesSchema = z3.object({
   tunnels: authTokenTunnelsScopesSchema.optional()
   // Scopes related to tunnels
 });
+var authTokenTunnelGrantSchema = z3.object({
+  workspaces: z3.array(nonEmptyStringSchema).min(1).optional(),
+  projects: z3.array(nonEmptyStringSchema).min(1).optional(),
+  scopes: authTokenScopesSchema.optional()
+}).strict().superRefine((grant, ctx) => {
+  if (grant.workspaces !== void 0 && grant.projects !== void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      message: "A grant cannot target workspaces and projects at the same time.",
+      path: ["projects"]
+    });
+  }
+});
+var authTokenCommonSchema = {
+  aud: z3.union([z3.string(), z3.array(z3.string())]).optional(),
+  exp: z3.number().optional(),
+  tunnelsGrants: z3.array(authTokenTunnelGrantSchema).optional(),
+  iat: z3.number().optional(),
+  iss: z3.string().optional(),
+  jti: z3.string().optional(),
+  metadata: z3.object({
+    engine: z3.string().optional()
+  }).strict().optional(),
+  nbf: z3.number().optional(),
+  sub: z3.string().optional()
+};
 var authTokenSchema = z3.union([
   z3.object({
     type: z3.literal("auth"),
     userId: z3.string(),
-    permissions: authTokenPermissionsSchema.nullable()
-  }),
+    permissions: authTokenPermissionsSchema.nullable(),
+    ...authTokenCommonSchema
+  }).strict(),
   z3.object({
     type: z3.literal("pat"),
-    token_endpoint: z3.string().optional()
-  }),
+    token_endpoint: z3.string().optional(),
+    ...authTokenCommonSchema
+  }).strict(),
   z3.object({
     type: z3.literal("app"),
     clientId: z3.string(),
-    permissions: authTokenPermissionsSchema.nullable()
-  })
-]).and(
-  z3.object({
-    workspace_id: z3.string().optional(),
-    project_id: z3.string().optional(),
-    metadata: z3.object({
-      engine: z3.string().optional(),
-      scopes: authTokenScopesSchema.optional()
-    }).optional()
-  })
-);
+    permissions: authTokenPermissionsSchema.nullable(),
+    ...authTokenCommonSchema
+  }).strict()
+]);
 var tokenSchema = authTokenSchema;
 var createAuthTokenParamsSchema = z3.object({
   expires_in: z3.number().default(60),
   // 1 minute
-  workspace_id: z3.string().optional(),
-  project_id: z3.string().optional(),
   scopes: authTokenScopesSchema.optional(),
+  tunnelsGrants: z3.array(authTokenTunnelGrantSchema).optional(),
   metadata: z3.unknown().optional()
   // Additional metadata
+}).strict().superRefine((params, ctx) => {
+  if (params.scopes !== void 0 && params.tunnelsGrants !== void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      message: "Use either scopes or tunnelsGrants, not both.",
+      path: ["tunnelsGrants"]
+    });
+  }
 });
 var createAuthTokenResponseSchema = z3.object({
   token: z3.string()
 });
 
+// src/auth-resource.ts
+var import_rstream2 = require("@rstreamlabs/rstream");
+var RstreamAuthResource = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async createAuthToken(params, options) {
+    const credentials = options?.credentials || this.client.credentials;
+    if (!(0, import_rstream2.isClientCredentials)(credentials)) {
+      throw new Error(
+        "Application credentials (client id, client secret) are required to create an auth token."
+      );
+    }
+    const engine = options?.engine ?? await this.client.getEngine().catch(() => void 0);
+    return createAuthTokenFromClientCredentials(credentials, params, {
+      engine
+    });
+  }
+};
+function createAuthTokenFromClientCredentials(credentials, params, options) {
+  const tokenParams = createAuthTokenParamsSchema.parse(params ?? {});
+  const payload = {
+    metadata: {
+      engine: options?.engine
+    },
+    tunnelsGrants: normalizeAuthTokenTunnelGrants(tokenParams),
+    permissions: null
+  };
+  const { token } = (0, import_rstream.createClientCredentialsToken)(credentials, {
+    claims: payload,
+    expiresInSeconds: tokenParams.expires_in
+  });
+  return { token };
+}
+function normalizeAuthTokenTunnelGrants(params) {
+  if (!params) {
+    return void 0;
+  }
+  const tunnelsGrants = params.tunnelsGrants;
+  if (tunnelsGrants !== void 0) {
+    return [...tunnelsGrants];
+  }
+  if (params.scopes) {
+    return [{ scopes: params.scopes }];
+  }
+  return void 0;
+}
+
 // src/client.ts
 var z4 = __toESM(require("zod"));
 var clientSchema = z4.object({
@@ -344,8 +389,8 @@ var RstreamClientsResource = class {
 
 // src/stream.ts
 var z5 = __toESM(require("zod"));
-var nonEmptyStringSchema = z5.string().min(1);
-var isoDateTimeSchema = z5.string().datetime();
+var nonEmptyStringSchema2 = z5.string().min(1);
+var isoDateTimeSchema = z5.string().datetime({ offset: true });
 var ipAddressSchema = z5.string();
 var intNonNegSchema = z5.number().int().nonnegative();
 var numNonNegSchema = z5.number().nonnegative();
@@ -353,9 +398,14 @@ var geolocationSchema = z5.object({
   country: z5.string().optional(),
   region: z5.string().optional()
 });
-var endpointSchema = z5.object({
+var streamTLSInfoSchema = z5.object({
+  version: z5.string().min(1).optional(),
+  cipher: z5.string().min(1).optional()
+});
+var streamEndpointSchema = z5.object({
   ip: ipAddressSchema.optional(),
-  geolocation: geolocationSchema.optional()
+  geolocation: geolocationSchema.optional(),
+  tls: streamTLSInfoSchema.optional()
 });
 var httpHeadersSchema = z5.record(
   z5.string(),
@@ -363,12 +413,12 @@ var httpHeadersSchema = z5.record(
 );
 var httpProtocolSchema = z5.enum(["http/1.1", "h2", "h2c", "h3"]);
 var httpRequestSchema = z5.object({
-  method: nonEmptyStringSchema,
+  method: nonEmptyStringSchema2,
   scheme: z5.string().min(1).optional(),
-  host: nonEmptyStringSchema.optional(),
-  path: nonEmptyStringSchema.optional(),
+  host: nonEmptyStringSchema2.optional(),
+  path: nonEmptyStringSchema2.optional(),
   query: z5.string().optional(),
-  url: nonEmptyStringSchema.optional(),
+  url: nonEmptyStringSchema2.optional(),
   headers: httpHeadersSchema.optional(),
   userAgent: z5.string().optional()
 });
@@ -424,6 +474,9 @@ var unauthorizedSchema = z5.discriminatedUnion("reason", [
   unauthorizedReasonSchema({
     reason: z5.literal("user_mismatch")
   }),
+  unauthorizedReasonSchema({
+    reason: z5.literal("insufficient_scope")
+  }),
   unauthorizedReasonSchema({
     reason: z5.literal("policy_denied"),
     policy: z5.enum(["ip", "geo", "mtls", "challenge", "other"]),
@@ -463,7 +516,7 @@ var firewallSchema = z5.discriminatedUnion("decision", [
   })
 ]);
 var routedTunnelSchema = z5.object({
-  tunnelId: nonEmptyStringSchema.optional(),
+  tunnelId: nonEmptyStringSchema2.optional(),
   tunnelName: z5.string().optional(),
   protocol: z5.string().optional(),
   published: z5.boolean().optional(),
@@ -496,7 +549,7 @@ var terminationSchema = z5.object({
 var responseConnectedSchema = z5.object({
   outcome: z5.literal("connected"),
   established_at: isoDateTimeSchema,
-  upstream: endpointSchema.optional(),
+  upstream: streamEndpointSchema.optional(),
   metrics: streamConnectedMetricsSchema,
   termination: terminationSchema.optional(),
   http: httpResponseStageSchema.optional()
@@ -504,7 +557,7 @@ var responseConnectedSchema = z5.object({
 var responseFailedSchema = z5.object({
   outcome: z5.literal("failed"),
   failure: failureSchema,
-  upstream: endpointSchema.optional(),
+  upstream: streamEndpointSchema.optional(),
   metrics: streamFailedMetricsSchema.optional(),
   termination: terminationSchema.optional(),
   http: httpResponseStageSchema.optional()
@@ -514,17 +567,17 @@ var responseSchema = z5.discriminatedUnion("outcome", [
   responseFailedSchema
 ]);
 var streamSummarySchema = z5.object({
-  workspace_id: nonEmptyStringSchema.optional(),
-  project_id: nonEmptyStringSchema.optional(),
-  cluster_id: nonEmptyStringSchema.optional(),
-  user_id: nonEmptyStringSchema.optional(),
-  client_id: nonEmptyStringSchema.optional(),
-  tunnel_id: nonEmptyStringSchema.optional(),
-  stream_id: nonEmptyStringSchema,
+  workspace_id: nonEmptyStringSchema2.optional(),
+  project_id: nonEmptyStringSchema2.optional(),
+  cluster_id: nonEmptyStringSchema2.optional(),
+  user_id: nonEmptyStringSchema2.optional(),
+  client_id: nonEmptyStringSchema2.optional(),
+  tunnel_id: nonEmptyStringSchema2.optional(),
+  stream_id: nonEmptyStringSchema2,
   created_at: isoDateTimeSchema,
   terminated_at: isoDateTimeSchema,
   request: z5.object({
-    downstream: endpointSchema,
+    downstream: streamEndpointSchema,
     http: httpRequestStageSchema.optional()
   }),
   firewall: firewallSchema,
@@ -534,7 +587,7 @@ var streamSummarySchema = z5.object({
 
 // src/event.ts
 var z6 = __toESM(require("zod"));
-var isoDateTimeSchema2 = z6.string().datetime();
+var isoDateTimeSchema2 = z6.string().datetime({ offset: true });
 var initialStateSchema = z6.object({
   snapshot_at: isoDateTimeSchema2,
   clients: z6.array(clientSchema),
@@ -1336,6 +1389,7 @@ function parseWebTTYServers(tunnels) {
   authTokenPermissionsSchema,
   authTokenSchema,
   authTokenScopesSchema,
+  authTokenTunnelGrantSchema,
   authTokenTunnelsScopesSchema,
   clientSchema,
   createAPITURNCredentials,
@@ -1355,7 +1409,9 @@ function parseWebTTYServers(tunnels) {
   resolveTunnelsAPIURL,
   resolveTunnelsCredentials,
   resolveTunnelsEngine,
+  streamEndpointSchema,
   streamSummarySchema,
+  streamTLSInfoSchema,
   tokenSchema,
   tunnelSchema,
   turnCredentialModeSchema,

package/dist/index.mjs

@@ -1,40 +1,5 @@
 // src/auth-resource.ts
 import { createClientCredentialsToken } from "@rstreamlabs/rstream";
-import { isClientCredentials } from "@rstreamlabs/rstream";
-var RstreamAuthResource = class {
-  client;
-  constructor(client) {
-    this.client = client;
-  }
-  async createAuthToken(params, options) {
-    const credentials = options?.credentials || this.client.credentials;
-    if (!isClientCredentials(credentials)) {
-      throw new Error(
-        "Application credentials (client id, client secret) are required to create an auth token."
-      );
-    }
-    const engine = options?.engine ?? await this.client.getEngine().catch(() => void 0);
-    return createAuthTokenFromClientCredentials(credentials, params, {
-      engine
-    });
-  }
-};
-function createAuthTokenFromClientCredentials(credentials, params, options) {
-  const payload = {
-    metadata: {
-      engine: options?.engine,
-      scopes: params?.scopes
-    },
-    permissions: null,
-    project_id: params?.project_id,
-    workspace_id: params?.workspace_id
-  };
-  const { token } = createClientCredentialsToken(credentials, {
-    claims: payload,
-    expiresInSeconds: params?.expires_in
-  });
-  return { token };
-}
 
 // src/zod.ts
 import * as z from "zod";
@@ -64,9 +29,9 @@ function filters(base) {
   const shape = Object.fromEntries(entries);
   const node = z.lazy(
     () => z.union([
-      z.object(shape),
-      z.object({ AND: z.array(node) }),
-      z.object({ OR: z.array(node) })
+      z.object(shape).strict(),
+      z.object({ AND: z.array(node) }).strict(),
+      z.object({ OR: z.array(node) }).strict()
     ])
   );
   return node;
@@ -129,6 +94,7 @@ var listTunnelsResponseSchema = z2.array(tunnelSchema);
 
 // src/auth.ts
 import * as z3 from "zod";
+var nonEmptyStringSchema = z3.string().trim().min(1);
 var authTokenPermissionsSchema = z3.array(z3.string());
 var authTokenTunnelsScopesSchema = z3.object({
   // Scopes for creating tunnels
@@ -177,45 +143,121 @@ var authTokenScopesSchema = z3.object({
   tunnels: authTokenTunnelsScopesSchema.optional()
   // Scopes related to tunnels
 });
+var authTokenTunnelGrantSchema = z3.object({
+  workspaces: z3.array(nonEmptyStringSchema).min(1).optional(),
+  projects: z3.array(nonEmptyStringSchema).min(1).optional(),
+  scopes: authTokenScopesSchema.optional()
+}).strict().superRefine((grant, ctx) => {
+  if (grant.workspaces !== void 0 && grant.projects !== void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      message: "A grant cannot target workspaces and projects at the same time.",
+      path: ["projects"]
+    });
+  }
+});
+var authTokenCommonSchema = {
+  aud: z3.union([z3.string(), z3.array(z3.string())]).optional(),
+  exp: z3.number().optional(),
+  tunnelsGrants: z3.array(authTokenTunnelGrantSchema).optional(),
+  iat: z3.number().optional(),
+  iss: z3.string().optional(),
+  jti: z3.string().optional(),
+  metadata: z3.object({
+    engine: z3.string().optional()
+  }).strict().optional(),
+  nbf: z3.number().optional(),
+  sub: z3.string().optional()
+};
 var authTokenSchema = z3.union([
   z3.object({
     type: z3.literal("auth"),
     userId: z3.string(),
-    permissions: authTokenPermissionsSchema.nullable()
-  }),
+    permissions: authTokenPermissionsSchema.nullable(),
+    ...authTokenCommonSchema
+  }).strict(),
   z3.object({
     type: z3.literal("pat"),
-    token_endpoint: z3.string().optional()
-  }),
+    token_endpoint: z3.string().optional(),
+    ...authTokenCommonSchema
+  }).strict(),
   z3.object({
     type: z3.literal("app"),
     clientId: z3.string(),
-    permissions: authTokenPermissionsSchema.nullable()
-  })
-]).and(
-  z3.object({
-    workspace_id: z3.string().optional(),
-    project_id: z3.string().optional(),
-    metadata: z3.object({
-      engine: z3.string().optional(),
-      scopes: authTokenScopesSchema.optional()
-    }).optional()
-  })
-);
+    permissions: authTokenPermissionsSchema.nullable(),
+    ...authTokenCommonSchema
+  }).strict()
+]);
 var tokenSchema = authTokenSchema;
 var createAuthTokenParamsSchema = z3.object({
   expires_in: z3.number().default(60),
   // 1 minute
-  workspace_id: z3.string().optional(),
-  project_id: z3.string().optional(),
   scopes: authTokenScopesSchema.optional(),
+  tunnelsGrants: z3.array(authTokenTunnelGrantSchema).optional(),
   metadata: z3.unknown().optional()
   // Additional metadata
+}).strict().superRefine((params, ctx) => {
+  if (params.scopes !== void 0 && params.tunnelsGrants !== void 0) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      message: "Use either scopes or tunnelsGrants, not both.",
+      path: ["tunnelsGrants"]
+    });
+  }
 });
 var createAuthTokenResponseSchema = z3.object({
   token: z3.string()
 });
 
+// src/auth-resource.ts
+import { isClientCredentials } from "@rstreamlabs/rstream";
+var RstreamAuthResource = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async createAuthToken(params, options) {
+    const credentials = options?.credentials || this.client.credentials;
+    if (!isClientCredentials(credentials)) {
+      throw new Error(
+        "Application credentials (client id, client secret) are required to create an auth token."
+      );
+    }
+    const engine = options?.engine ?? await this.client.getEngine().catch(() => void 0);
+    return createAuthTokenFromClientCredentials(credentials, params, {
+      engine
+    });
+  }
+};
+function createAuthTokenFromClientCredentials(credentials, params, options) {
+  const tokenParams = createAuthTokenParamsSchema.parse(params ?? {});
+  const payload = {
+    metadata: {
+      engine: options?.engine
+    },
+    tunnelsGrants: normalizeAuthTokenTunnelGrants(tokenParams),
+    permissions: null
+  };
+  const { token } = createClientCredentialsToken(credentials, {
+    claims: payload,
+    expiresInSeconds: tokenParams.expires_in
+  });
+  return { token };
+}
+function normalizeAuthTokenTunnelGrants(params) {
+  if (!params) {
+    return void 0;
+  }
+  const tunnelsGrants = params.tunnelsGrants;
+  if (tunnelsGrants !== void 0) {
+    return [...tunnelsGrants];
+  }
+  if (params.scopes) {
+    return [{ scopes: params.scopes }];
+  }
+  return void 0;
+}
+
 // src/client.ts
 import * as z4 from "zod";
 var clientSchema = z4.object({
@@ -267,8 +309,8 @@ var RstreamClientsResource = class {
 
 // src/stream.ts
 import * as z5 from "zod";
-var nonEmptyStringSchema = z5.string().min(1);
-var isoDateTimeSchema = z5.string().datetime();
+var nonEmptyStringSchema2 = z5.string().min(1);
+var isoDateTimeSchema = z5.string().datetime({ offset: true });
 var ipAddressSchema = z5.string();
 var intNonNegSchema = z5.number().int().nonnegative();
 var numNonNegSchema = z5.number().nonnegative();
@@ -276,9 +318,14 @@ var geolocationSchema = z5.object({
   country: z5.string().optional(),
   region: z5.string().optional()
 });
-var endpointSchema = z5.object({
+var streamTLSInfoSchema = z5.object({
+  version: z5.string().min(1).optional(),
+  cipher: z5.string().min(1).optional()
+});
+var streamEndpointSchema = z5.object({
   ip: ipAddressSchema.optional(),
-  geolocation: geolocationSchema.optional()
+  geolocation: geolocationSchema.optional(),
+  tls: streamTLSInfoSchema.optional()
 });
 var httpHeadersSchema = z5.record(
   z5.string(),
@@ -286,12 +333,12 @@ var httpHeadersSchema = z5.record(
 );
 var httpProtocolSchema = z5.enum(["http/1.1", "h2", "h2c", "h3"]);
 var httpRequestSchema = z5.object({
-  method: nonEmptyStringSchema,
+  method: nonEmptyStringSchema2,
   scheme: z5.string().min(1).optional(),
-  host: nonEmptyStringSchema.optional(),
-  path: nonEmptyStringSchema.optional(),
+  host: nonEmptyStringSchema2.optional(),
+  path: nonEmptyStringSchema2.optional(),
   query: z5.string().optional(),
-  url: nonEmptyStringSchema.optional(),
+  url: nonEmptyStringSchema2.optional(),
   headers: httpHeadersSchema.optional(),
   userAgent: z5.string().optional()
 });
@@ -347,6 +394,9 @@ var unauthorizedSchema = z5.discriminatedUnion("reason", [
   unauthorizedReasonSchema({
     reason: z5.literal("user_mismatch")
   }),
+  unauthorizedReasonSchema({
+    reason: z5.literal("insufficient_scope")
+  }),
   unauthorizedReasonSchema({
     reason: z5.literal("policy_denied"),
     policy: z5.enum(["ip", "geo", "mtls", "challenge", "other"]),
@@ -386,7 +436,7 @@ var firewallSchema = z5.discriminatedUnion("decision", [
   })
 ]);
 var routedTunnelSchema = z5.object({
-  tunnelId: nonEmptyStringSchema.optional(),
+  tunnelId: nonEmptyStringSchema2.optional(),
   tunnelName: z5.string().optional(),
   protocol: z5.string().optional(),
   published: z5.boolean().optional(),
@@ -419,7 +469,7 @@ var terminationSchema = z5.object({
 var responseConnectedSchema = z5.object({
   outcome: z5.literal("connected"),
   established_at: isoDateTimeSchema,
-  upstream: endpointSchema.optional(),
+  upstream: streamEndpointSchema.optional(),
   metrics: streamConnectedMetricsSchema,
   termination: terminationSchema.optional(),
   http: httpResponseStageSchema.optional()
@@ -427,7 +477,7 @@ var responseConnectedSchema = z5.object({
 var responseFailedSchema = z5.object({
   outcome: z5.literal("failed"),
   failure: failureSchema,
-  upstream: endpointSchema.optional(),
+  upstream: streamEndpointSchema.optional(),
   metrics: streamFailedMetricsSchema.optional(),
   termination: terminationSchema.optional(),
   http: httpResponseStageSchema.optional()
@@ -437,17 +487,17 @@ var responseSchema = z5.discriminatedUnion("outcome", [
   responseFailedSchema
 ]);
 var streamSummarySchema = z5.object({
-  workspace_id: nonEmptyStringSchema.optional(),
-  project_id: nonEmptyStringSchema.optional(),
-  cluster_id: nonEmptyStringSchema.optional(),
-  user_id: nonEmptyStringSchema.optional(),
-  client_id: nonEmptyStringSchema.optional(),
-  tunnel_id: nonEmptyStringSchema.optional(),
-  stream_id: nonEmptyStringSchema,
+  workspace_id: nonEmptyStringSchema2.optional(),
+  project_id: nonEmptyStringSchema2.optional(),
+  cluster_id: nonEmptyStringSchema2.optional(),
+  user_id: nonEmptyStringSchema2.optional(),
+  client_id: nonEmptyStringSchema2.optional(),
+  tunnel_id: nonEmptyStringSchema2.optional(),
+  stream_id: nonEmptyStringSchema2,
   created_at: isoDateTimeSchema,
   terminated_at: isoDateTimeSchema,
   request: z5.object({
-    downstream: endpointSchema,
+    downstream: streamEndpointSchema,
     http: httpRequestStageSchema.optional()
   }),
   firewall: firewallSchema,
@@ -457,7 +507,7 @@ var streamSummarySchema = z5.object({
 
 // src/event.ts
 import * as z6 from "zod";
-var isoDateTimeSchema2 = z6.string().datetime();
+var isoDateTimeSchema2 = z6.string().datetime({ offset: true });
 var initialStateSchema = z6.object({
   snapshot_at: isoDateTimeSchema2,
   clients: z6.array(clientSchema),
@@ -1258,6 +1308,7 @@ export {
   authTokenPermissionsSchema,
   authTokenSchema,
   authTokenScopesSchema,
+  authTokenTunnelGrantSchema,
   authTokenTunnelsScopesSchema,
   clientSchema,
   createAPITURNCredentials,
@@ -1277,7 +1328,9 @@ export {
   resolveTunnelsAPIURL,
   resolveTunnelsCredentials,
   resolveTunnelsEngine,
+  streamEndpointSchema,
   streamSummarySchema,
+  streamTLSInfoSchema,
   tokenSchema,
   tunnelSchema,
   turnCredentialModeSchema,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rstreamlabs/tunnels",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "JS/TS SDK for the rstream tunnels data plane and engine APIs.",
   "author": "@uartnet <hello@rstream.io>",
   "license": "Apache-2.0",