@rstreamlabs/tunnels 1.0.11 → 3.0.0

package/README.md

@@ -112,22 +112,28 @@ await watch.connect();
 ```
 
 URL-based watch authentication requires a short-lived token with bounded
-lifetime and watch-only tunnel list grants.
+lifetime and watch-only tunnel list resources.
+
+Browser integrations should provide `auth` as a function that calls a backend
+token route and returns a fresh watch token for each connection attempt. Do not
+store the `rstream.token` query token as durable browser state.
 
 ## Scoped Auth Tokens
 
 `auth.createAuthToken()` mints short-lived engine tokens. Prefer
-`tunnelsGrants` when delegating capabilities to devices, browser sessions, or
-other services.
+`resources.tunnels` when delegating capabilities to devices, browser sessions,
+or other services.
 
 ```ts
 const { token } = await client.auth.createAuthToken({
   expires_in: 60,
-  tunnelsGrants: {
-    scopes: {
-      tunnels: {
-        list: { select: { id: true, name: true, protocol: true } },
-        connect: { params: { path: { regex: "^/api" } } },
+  resources: {
+    tunnels: {
+      scopes: {
+        tunnels: {
+          list: { select: { id: true, name: true, protocol: true } },
+          connect: { params: { path: { regex: "^/api" } } },
+        },
       },
     },
   },
@@ -135,8 +141,8 @@ const { token } = await client.auth.createAuthToken({
 ```
 
 When the client is configured with `projectEndpoint` or `projectId`, scope-only
-requests and scope-only grant leaves are project-scoped by default. Pass
-`projectScoped: false` only when a global scope-only grant is intentional.
+tunnel resources are project-scoped by default. Pass `projectScoped: false`
+only when a global scope-only tunnel resource is intentional.
 
 ## TURN Credentials
 
@@ -156,9 +162,14 @@ const turn = await createTURNCredentials({
   },
   projectEndpoint: "project-endpoint",
   clusterDomain: "cluster.example.rstream.test",
+  ttlSeconds: 600,
 });
 ```
 
+TURN credentials are short-lived. `ttlSeconds` is optional, defaults to 600 for
+local derivation, and must be an integer between 1 and 3600 seconds. PAT-backed
+credentials are additionally capped by the PAT expiration.
+
 ## Webhooks
 
 Validate signed engine webhook payloads with constant-time signature comparison
@@ -198,10 +209,10 @@ console.log(engineOpenApiDocument.info.title);
 
 ## Environment Variables
 
-| Variable | Purpose |
-| --- | --- |
-| `RSTREAM_API_URL` | Control plane API URL used for managed project resolution. |
-| `RSTREAM_ENGINE` | Engine endpoint used when no engine is provided explicitly. |
+| Variable                       | Purpose                                                         |
+| ------------------------------ | --------------------------------------------------------------- |
+| `RSTREAM_API_URL`              | Control plane API URL used for managed project resolution.      |
+| `RSTREAM_ENGINE`               | Engine endpoint used when no engine is provided explicitly.     |
 | `RSTREAM_AUTHENTICATION_TOKEN` | Bearer token used when credentials are not provided explicitly. |
 
 ## Development

package/dist/{chunk-NHUJ3FYM.mjs → chunk-UUZYVELQ.mjs}

@@ -37,44 +37,9 @@ var listClientsParamsSchema = z.object({
 var listClientsResponseSchema = z.array(clientSchema);
 
 // src/tunnel.ts
+import { tunnelSchema } from "@rstreamlabs/rstream/tunnel";
 import * as z2 from "zod";
 var DEFAULT_PUBLISHED_PORT = 443;
-var tunnelSchema = z2.object({
-  // common properties
-  client_id: z2.string(),
-  user_id: z2.string().optional(),
-  workspace_id: z2.string().optional(),
-  project_id: z2.string().optional(),
-  cluster_id: z2.string().optional(),
-  plan: z2.string().optional(),
-  provider: z2.string().optional(),
-  region: z2.string().optional(),
-  status: z2.enum(["online", "offline"]),
-  // tunnel properties
-  id: z2.string(),
-  creation_date: z2.union([z2.string().datetime(), z2.date()]).optional(),
-  name: z2.string().optional(),
-  type: z2.enum(["bytestream", "datagram"]).optional(),
-  publish: z2.boolean().optional(),
-  protocol: z2.enum(["tls", "dtls", "quic", "http"]).optional(),
-  labels: z2.record(z2.string(), z2.string()).optional(),
-  geo_ip: z2.array(z2.string()).optional(),
-  trusted_ips: z2.array(z2.string()).optional(),
-  host: z2.string().optional(),
-  hostname: z2.string().optional(),
-  port: z2.number().int().min(1).max(65535).optional(),
-  tls_mode: z2.enum(["passthrough", "terminated"]).optional(),
-  tls_alpns: z2.array(z2.string()).optional(),
-  tls_min_version: z2.string().optional(),
-  tls_ciphers: z2.array(z2.string()).optional(),
-  mtls_auth: z2.boolean().optional(),
-  http_version: z2.enum(["http/1.1", "h2", "h2c", "h3"]).optional(),
-  http_use_tls: z2.boolean().optional(),
-  upstream_tls: z2.boolean().optional(),
-  token_auth: z2.boolean().optional(),
-  rstream_auth: z2.boolean().optional(),
-  challenge_mode: z2.boolean().optional()
-});
 var tunnelFilterSchema = tunnelSchema.pick({
   id: true,
   name: true,
@@ -101,6 +66,9 @@ function formatTunnelHost(tunnel) {
   return `${tunnel.hostname}:${tunnel.port}`;
 }
 
+// src/openapi.ts
+import { tunnelSchema as tunnelSchema3 } from "@rstreamlabs/rstream/tunnel";
+
 // src/stream.ts
 import * as z3 from "zod";
 var nonEmptyStringSchema = z3.string().min(1);
@@ -305,12 +273,13 @@ var streamSummarySchema = z3.object({
 });
 
 // src/event.ts
+import { tunnelSchema as tunnelSchema2 } from "@rstreamlabs/rstream/tunnel";
 import * as z4 from "zod";
 var isoDateTimeSchema2 = z4.string().datetime({ offset: true });
 var initialStateSchema = z4.object({
   snapshot_at: isoDateTimeSchema2,
   clients: z4.array(clientSchema),
-  tunnels: z4.array(tunnelSchema)
+  tunnels: z4.array(tunnelSchema2)
 });
 var eventBaseSchema = z4.object({
   id: z4.string().optional(),
@@ -344,15 +313,15 @@ var commonEventsSchema = [
   }),
   withEventBase({
     type: z4.literal("tunnel.created"),
-    object: tunnelSchema
+    object: tunnelSchema2
   }),
   withEventBase({
     type: z4.literal("tunnel.updated"),
-    object: tunnelSchema
+    object: tunnelSchema2
   }),
   withEventBase({
     type: z4.literal("tunnel.deleted"),
-    object: tunnelSchema
+    object: tunnelSchema2
   })
 ];
 var wsEventsSchema = z4.union([
@@ -578,7 +547,7 @@ var engineOpenApiDocument = {
       Event: jsonSchemaFor(wsEventsSchema),
       ListClientsParams: jsonSchemaFor(listClientsParamsSchema),
       ListTunnelsParams: jsonSchemaFor(listTunnelsParamsSchema),
-      TunnelListItem: jsonSchemaFor(tunnelSchema),
+      TunnelListItem: jsonSchemaFor(tunnelSchema3),
       WatchParams: jsonSchemaFor(watchParamsSchema)
     }
   },
@@ -712,11 +681,6 @@ var engineOpenApiJson = `${JSON.stringify(
 `;
 
 export {
-  tunnelSchema,
-  tunnelFilterSchema,
-  listTunnelsParamsSchema,
-  listTunnelsResponseSchema,
-  formatTunnelHost,
   clientSchema,
   clientFilterSchema,
   listClientsParamsSchema,
@@ -727,6 +691,10 @@ export {
   wsEventsSchema,
   webhookEventsSchema,
   eventSchema,
+  tunnelFilterSchema,
+  listTunnelsParamsSchema,
+  listTunnelsResponseSchema,
+  formatTunnelHost,
   engineOpenApiDocument,
   engineOpenApiJson
 };