@rstreamlabs/tunnels 1.0.11 → 3.0.0

package/dist/index.js

@@ -43,18 +43,11 @@ __export(index_exports, {
   RstreamWebhookRessource: () => RstreamWebhookResource,
   Tunnels: () => RstreamTunnelsClient,
   Watch: () => Watch,
-  authTokenPermissionsSchema: () => authTokenPermissionsSchema,
-  authTokenSchema: () => authTokenSchema,
-  authTokenScopesSchema: () => authTokenScopesSchema,
-  authTokenTunnelGrantSchema: () => authTokenTunnelGrantSchema,
-  authTokenTunnelsScopesSchema: () => authTokenTunnelsScopesSchema,
   clientFilterSchema: () => clientFilterSchema,
   clientSchema: () => clientSchema,
   createAPITURNCredentials: () => createAPITURNCredentials,
   createAPPTURNCredentials: () => createAPPTURNCredentials,
   createAuthTokenFromClientCredentials: () => createAuthTokenFromClientCredentials,
-  createAuthTokenParamsSchema: () => createAuthTokenParamsSchema,
-  createAuthTokenResponseSchema: () => createAuthTokenResponseSchema,
   createPATTURNCredentials: () => createPATTURNCredentials,
   createTURNCredentials: () => createTURNCredentials,
   engineOpenApiDocument: () => engineOpenApiDocument,
@@ -75,9 +68,7 @@ __export(index_exports, {
   streamEndpointSchema: () => streamEndpointSchema,
   streamSummarySchema: () => streamSummarySchema,
   streamTLSInfoSchema: () => streamTLSInfoSchema,
-  tokenSchema: () => tokenSchema,
   tunnelFilterSchema: () => tunnelFilterSchema,
-  tunnelSchema: () => tunnelSchema,
   turnCredentialModeSchema: () => turnCredentialModeSchema,
   webhookEventsSchema: () => webhookEventsSchema,
   webttyServerSchema: () => webttyServerSchema,
@@ -86,270 +77,8 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/auth-resource.ts
+var import_auth_token = require("@rstreamlabs/rstream/auth-token");
 var import_rstream = require("@rstreamlabs/rstream");
-
-// src/zod.ts
-var z = __toESM(require("zod"));
-var StringFilter = z.union([
-  z.string(),
-  z.object({ exact: z.string() }).strict(),
-  z.object({ oneof: z.array(z.string()) }).strict(),
-  z.object({ regex: z.string() }).strict()
-]);
-function transform(field) {
-  if (field instanceof z.ZodOptional) {
-    return z.optional(transform(field.unwrap()));
-  }
-  if (field instanceof z.ZodString) {
-    return z.optional(StringFilter);
-  }
-  if (field instanceof z.ZodRecord) {
-    return z.optional(z.record(field.keyType, transform(field.valueType)));
-  }
-  return z.optional(field);
-}
-function filters(base) {
-  const entries = Object.entries(base.shape).map(([key, field]) => [
-    key,
-    transform(field)
-  ]);
-  const shape = Object.fromEntries(entries);
-  const node = z.lazy(
-    () => z.union([
-      z.object(shape).strict(),
-      z.object({ AND: z.array(node) }).strict(),
-      z.object({ OR: z.array(node) }).strict()
-    ])
-  );
-  return node;
-}
-function select(base) {
-  const entries = Object.entries(base.shape).map(([key]) => {
-    return [key, z.boolean().optional()];
-  });
-  const shape = Object.fromEntries(entries);
-  return z.object(shape).strict();
-}
-
-// src/tunnel.ts
-var z2 = __toESM(require("zod"));
-var DEFAULT_PUBLISHED_PORT = 443;
-var tunnelSchema = z2.object({
-  // common properties
-  client_id: z2.string(),
-  user_id: z2.string().optional(),
-  workspace_id: z2.string().optional(),
-  project_id: z2.string().optional(),
-  cluster_id: z2.string().optional(),
-  plan: z2.string().optional(),
-  provider: z2.string().optional(),
-  region: z2.string().optional(),
-  status: z2.enum(["online", "offline"]),
-  // tunnel properties
-  id: z2.string(),
-  creation_date: z2.union([z2.string().datetime(), z2.date()]).optional(),
-  name: z2.string().optional(),
-  type: z2.enum(["bytestream", "datagram"]).optional(),
-  publish: z2.boolean().optional(),
-  protocol: z2.enum(["tls", "dtls", "quic", "http"]).optional(),
-  labels: z2.record(z2.string(), z2.string()).optional(),
-  geo_ip: z2.array(z2.string()).optional(),
-  trusted_ips: z2.array(z2.string()).optional(),
-  host: z2.string().optional(),
-  hostname: z2.string().optional(),
-  port: z2.number().int().min(1).max(65535).optional(),
-  tls_mode: z2.enum(["passthrough", "terminated"]).optional(),
-  tls_alpns: z2.array(z2.string()).optional(),
-  tls_min_version: z2.string().optional(),
-  tls_ciphers: z2.array(z2.string()).optional(),
-  mtls_auth: z2.boolean().optional(),
-  http_version: z2.enum(["http/1.1", "h2", "h2c", "h3"]).optional(),
-  http_use_tls: z2.boolean().optional(),
-  upstream_tls: z2.boolean().optional(),
-  token_auth: z2.boolean().optional(),
-  rstream_auth: z2.boolean().optional(),
-  challenge_mode: z2.boolean().optional()
-});
-var tunnelFilterSchema = tunnelSchema.pick({
-  id: true,
-  name: true,
-  type: true,
-  status: true,
-  client_id: true,
-  user_id: true,
-  publish: true,
-  protocol: true,
-  hostname: true,
-  http_version: true,
-  labels: true
-}).partial();
-var listTunnelsParamsSchema = z2.object({
-  limit: z2.number().int().min(1).optional(),
-  filters: tunnelFilterSchema.optional()
-});
-var listTunnelsResponseSchema = z2.array(tunnelSchema);
-function formatTunnelHost(tunnel) {
-  if (!tunnel.hostname) return tunnel.host;
-  if (!tunnel.port || tunnel.port === DEFAULT_PUBLISHED_PORT) {
-    return tunnel.hostname;
-  }
-  return `${tunnel.hostname}:${tunnel.port}`;
-}
-
-// src/auth.ts
-var z3 = __toESM(require("zod"));
-var nonEmptyStringSchema = z3.string().trim().min(1);
-var authTokenPermissionsSchema = z3.array(z3.string());
-var authTokenTunnelsScopesSchema = z3.object({
-  // Scopes for creating tunnels
-  create: z3.union([
-    z3.boolean(),
-    z3.object({
-      filters: filters(
-        tunnelSchema.omit({
-          client_id: true,
-          user_id: true,
-          workspace_id: true,
-          project_id: true,
-          cluster_id: true,
-          plan: true,
-          provider: true,
-          region: true,
-          status: true,
-          id: true,
-          creation_date: true
-        })
-      ).optional()
-    }).strict()
-  ]).optional(),
-  // Scopes for connecting to tunnels
-  connect: z3.union([
-    z3.boolean(),
-    z3.object({
-      filters: filters(tunnelSchema).optional(),
-      params: filters(
-        z3.object({
-          path: z3.string().optional()
-        })
-      ).optional()
-    }).strict()
-  ]).optional(),
-  // Scopes for listing tunnels
-  list: z3.union([
-    z3.boolean(),
-    z3.object({
-      filters: filters(tunnelSchema).optional(),
-      select: select(tunnelSchema).optional()
-    }).strict()
-  ]).optional()
-}).strict().superRefine((scopes, ctx) => {
-  if (scopes.create === void 0 && scopes.connect === void 0 && scopes.list === void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      message: "At least one tunnel scope action is required."
-    });
-  }
-});
-var authTokenScopesSchema = z3.object({
-  tunnels: authTokenTunnelsScopesSchema.optional()
-  // Scopes related to tunnels
-}).strict().superRefine((scopes, ctx) => {
-  if (scopes.tunnels === void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      message: "Tunnel scopes are required.",
-      path: ["tunnels"]
-    });
-  }
-});
-var authTokenTunnelGrantLeafSchema = z3.object({
-  workspaces: z3.array(nonEmptyStringSchema).min(1).optional(),
-  projects: z3.array(nonEmptyStringSchema).min(1).optional(),
-  scopes: authTokenScopesSchema.optional()
-}).strict().superRefine((grant, ctx) => {
-  if (grant.workspaces !== void 0 && grant.projects !== void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      message: "A grant cannot target workspaces and projects at the same time.",
-      path: ["projects"]
-    });
-  }
-  if (grant.workspaces === void 0 && grant.projects === void 0 && grant.scopes === void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      message: "A grant must target workspaces, projects, or scopes.",
-      path: ["workspaces"]
-    });
-  }
-});
-var authTokenTunnelGrantSchema = z3.lazy(
-  () => z3.union([
-    authTokenTunnelGrantLeafSchema,
-    z3.object({ AND: z3.array(authTokenTunnelGrantSchema).min(1) }).strict(),
-    z3.object({ OR: z3.array(authTokenTunnelGrantSchema).min(1) }).strict()
-  ])
-);
-var authTokenCommonSchema = {
-  aud: z3.union([z3.string(), z3.array(z3.string())]).optional(),
-  exp: z3.number().optional(),
-  tunnelsGrants: authTokenTunnelGrantSchema.optional(),
-  iat: z3.number().optional(),
-  iss: z3.string().optional(),
-  jti: z3.string().optional(),
-  metadata: z3.object({
-    engine: z3.string().optional()
-  }).strict().optional(),
-  nbf: z3.number().optional(),
-  sub: z3.string().optional()
-};
-var authTokenSchema = z3.union([
-  z3.object({
-    type: z3.literal("auth"),
-    userId: z3.string(),
-    permissions: authTokenPermissionsSchema.nullable(),
-    ...authTokenCommonSchema
-  }).strict(),
-  z3.object({
-    type: z3.literal("pat"),
-    tokendpoint: z3.string().optional(),
-    token_endpoint: z3.string().optional(),
-    ...authTokenCommonSchema
-  }).strict(),
-  z3.object({
-    type: z3.literal("app"),
-    clientId: z3.string(),
-    permissions: authTokenPermissionsSchema.nullable(),
-    ...authTokenCommonSchema
-  }).strict()
-]);
-var tokenSchema = authTokenSchema;
-var createAuthTokenParamsSchema = z3.object({
-  expires_in: z3.number().int().min(1).max(3600).default(60),
-  scopes: authTokenScopesSchema.optional(),
-  tunnelsGrants: authTokenTunnelGrantSchema.optional(),
-  metadata: z3.unknown().optional()
-  // Additional metadata
-}).strict().superRefine((params, ctx) => {
-  if (params.scopes !== void 0 && params.tunnelsGrants !== void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      message: "Use either scopes or tunnelsGrants, not both.",
-      path: ["tunnelsGrants"]
-    });
-  }
-  if (params.scopes === void 0 && params.tunnelsGrants === void 0) {
-    ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
-      message: "Explicit scopes or tunnelsGrants are required.",
-      path: ["scopes"]
-    });
-  }
-});
-var createAuthTokenResponseSchema = z3.object({
-  token: z3.string()
-});
-
-// src/auth-resource.ts
 var import_rstream2 = require("@rstreamlabs/rstream");
 var RstreamAuthResource = class {
   client;
@@ -371,14 +100,14 @@ var RstreamAuthResource = class {
     });
   }
   async resolveScopeOptions(params, options) {
-    const tokenParams = createAuthTokenParamsSchema.parse(params);
+    const tokenParams = import_auth_token.createAuthTokenParamsSchema.parse(params);
     if (options?.projectScoped === false) {
       return options ?? {};
     }
     if (options?.projectId !== void 0 || options?.workspaceId !== void 0) {
       return options;
     }
-    if (tokenParams.scopes === void 0 && !tunnelGrantsNeedDefaultTarget(tokenParams.tunnelsGrants)) {
+    if (!tunnelResourcesNeedDefaultTarget(tokenParams.resources?.tunnels)) {
       return options ?? {};
     }
     const target = await this.client.getEngineAuthTokenTarget();
@@ -390,13 +119,13 @@ var RstreamAuthResource = class {
   }
 };
 function createAuthTokenFromClientCredentials(credentials, params, options) {
-  const tokenParams = createAuthTokenParamsSchema.parse(params);
+  const tokenParams = import_auth_token.createAuthTokenParamsSchema.parse(params);
   const payload = {
     metadata: {
       engine: options?.engine
     },
-    tunnelsGrants: normalizeAuthTokenTunnelGrants(tokenParams, options),
-    permissions: null
+    permissions: null,
+    resources: normalizeAuthTokenResources(tokenParams, options)
   };
   const { token } = (0, import_rstream.createClientCredentialsToken)(credentials, {
     claims: payload,
@@ -404,70 +133,73 @@ function createAuthTokenFromClientCredentials(credentials, params, options) {
   });
   return { token };
 }
-function normalizeAuthTokenTunnelGrants(params, options) {
-  const tunnelsGrants = params.tunnelsGrants;
-  if (tunnelsGrants !== void 0) {
-    return applyDefaultTunnelGrantTarget(tunnelsGrants, options);
-  }
-  if (params.scopes) {
-    return { ...normalizeTunnelGrantTarget(options), scopes: params.scopes };
-  }
-  return void 0;
+function normalizeAuthTokenResources(params, options) {
+  return {
+    tunnels: applyDefaultTunnelResourceTarget(
+      requireTunnelResource(params),
+      options
+    )
+  };
+}
+function requireTunnelResource(params) {
+  const tunnels = params.resources?.tunnels;
+  if (tunnels !== void 0) return tunnels;
+  throw new Error("Explicit resources.tunnels is required.");
 }
-function applyDefaultTunnelGrantTarget(grants, options, inheritedTarget = false) {
+function applyDefaultTunnelResourceTarget(resource, options, inheritedTarget = false) {
   if (options?.projectScoped === false) {
-    return grants;
+    return resource;
   }
-  if ("AND" in grants) {
-    const branchHasTarget = inheritedTarget || grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
+  if ("AND" in resource) {
+    const branchHasTarget = inheritedTarget || resource.AND.some((child) => tunnelResourceTreeHasTarget(child));
     return {
-      AND: grants.AND.map(
-        (grant) => applyDefaultTunnelGrantTarget(grant, options, branchHasTarget)
+      AND: resource.AND.map(
+        (child) => applyDefaultTunnelResourceTarget(child, options, branchHasTarget)
       )
     };
   }
-  if ("OR" in grants) {
+  if ("OR" in resource) {
     return {
-      OR: grants.OR.map(
-        (grant) => applyDefaultTunnelGrantTarget(grant, options, inheritedTarget)
+      OR: resource.OR.map(
+        (child) => applyDefaultTunnelResourceTarget(child, options, inheritedTarget)
       )
     };
   }
-  if (grants.scopes === void 0 || tunnelGrantHasTarget(grants) || inheritedTarget) {
-    return grants;
+  if (resource.scopes === void 0 || tunnelResourceHasTarget(resource) || inheritedTarget) {
+    return resource;
   }
-  return { ...normalizeTunnelGrantTarget(options), scopes: grants.scopes };
+  return { ...normalizeTunnelResourceTarget(options), scopes: resource.scopes };
 }
-function tunnelGrantsNeedDefaultTarget(grants, inheritedTarget = false) {
-  if (grants === void 0) {
+function tunnelResourcesNeedDefaultTarget(resource, inheritedTarget = false) {
+  if (resource === void 0) {
     return false;
   }
-  if ("AND" in grants) {
-    const branchHasTarget = inheritedTarget || grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
-    return grants.AND.some(
-      (grant) => tunnelGrantsNeedDefaultTarget(grant, branchHasTarget)
+  if ("AND" in resource) {
+    const branchHasTarget = inheritedTarget || resource.AND.some((child) => tunnelResourceTreeHasTarget(child));
+    return resource.AND.some(
+      (child) => tunnelResourcesNeedDefaultTarget(child, branchHasTarget)
     );
   }
-  if ("OR" in grants) {
-    return grants.OR.some(
-      (grant) => tunnelGrantsNeedDefaultTarget(grant, inheritedTarget)
+  if ("OR" in resource) {
+    return resource.OR.some(
+      (child) => tunnelResourcesNeedDefaultTarget(child, inheritedTarget)
     );
   }
-  return grants.scopes !== void 0 && !tunnelGrantHasTarget(grants) && !inheritedTarget;
+  return resource.scopes !== void 0 && !tunnelResourceHasTarget(resource) && !inheritedTarget;
 }
-function tunnelGrantHasTarget(grant) {
-  return grant.projects !== void 0 || grant.workspaces !== void 0;
+function tunnelResourceHasTarget(resource) {
+  return resource.projects !== void 0 || resource.workspaces !== void 0;
 }
-function tunnelGrantTreeHasTarget(grants) {
-  if ("AND" in grants) {
-    return grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
+function tunnelResourceTreeHasTarget(resource) {
+  if ("AND" in resource) {
+    return resource.AND.some((child) => tunnelResourceTreeHasTarget(child));
   }
-  if ("OR" in grants) {
-    return grants.OR.some((grant) => tunnelGrantTreeHasTarget(grant));
+  if ("OR" in resource) {
+    return resource.OR.some((child) => tunnelResourceTreeHasTarget(child));
   }
-  return tunnelGrantHasTarget(grants);
+  return tunnelResourceHasTarget(resource);
 }
-function normalizeTunnelGrantTarget(options) {
+function normalizeTunnelResourceTarget(options) {
   const projectId = normalizeOptionalString(options?.projectId);
   const workspaceId = normalizeOptionalString(options?.workspaceId);
   if (projectId !== void 0 && workspaceId !== void 0) {
@@ -483,7 +215,7 @@ function normalizeTunnelGrantTarget(options) {
     return {};
   }
   throw new Error(
-    "Project ID or workspace ID is required when using scope-only tunnel grants."
+    "Project ID or workspace ID is required when using scope-only tunnel resources."
   );
 }
 function normalizeOptionalString(value) {
@@ -492,24 +224,24 @@ function normalizeOptionalString(value) {
 }
 
 // src/client.ts
-var z4 = __toESM(require("zod"));
-var clientSchema = z4.object({
-  id: z4.string(),
-  status: z4.enum(["online", "offline"]),
-  user_id: z4.string().optional(),
-  workspace_id: z4.string().optional(),
-  project_id: z4.string().optional(),
-  cluster_id: z4.string().optional(),
-  plan: z4.string().optional(),
-  provider: z4.string().optional(),
-  region: z4.string().optional(),
-  agent: z4.string().optional(),
-  channel: z4.string().optional(),
-  version: z4.string().optional(),
-  os: z4.string().optional(),
-  arch: z4.string().optional(),
-  protocol_version: z4.string().optional(),
-  labels: z4.record(z4.string(), z4.string()).optional()
+var z = __toESM(require("zod"));
+var clientSchema = z.object({
+  id: z.string(),
+  status: z.enum(["online", "offline"]),
+  user_id: z.string().optional(),
+  workspace_id: z.string().optional(),
+  project_id: z.string().optional(),
+  cluster_id: z.string().optional(),
+  plan: z.string().optional(),
+  provider: z.string().optional(),
+  region: z.string().optional(),
+  agent: z.string().optional(),
+  channel: z.string().optional(),
+  version: z.string().optional(),
+  os: z.string().optional(),
+  arch: z.string().optional(),
+  protocol_version: z.string().optional(),
+  labels: z.record(z.string(), z.string()).optional()
 });
 var clientFilterSchema = clientSchema.pick({
   id: true,
@@ -523,11 +255,11 @@ var clientFilterSchema = clientSchema.pick({
   protocol_version: true,
   labels: true
 }).partial();
-var listClientsParamsSchema = z4.object({
-  limit: z4.number().int().min(1).optional(),
+var listClientsParamsSchema = z.object({
+  limit: z.number().int().min(1).optional(),
   filters: clientFilterSchema.optional()
 });
-var listClientsResponseSchema = z4.array(clientSchema);
+var listClientsResponseSchema = z.array(clientSchema);
 
 // src/clients-resource.ts
 function clientPathId(id) {
@@ -561,200 +293,200 @@ var RstreamClientsResource = class {
 };
 
 // src/stream.ts
-var z5 = __toESM(require("zod"));
-var nonEmptyStringSchema2 = z5.string().min(1);
-var isoDateTimeSchema = z5.string().datetime({ offset: true });
-var ipAddressSchema = z5.string();
-var intNonNegSchema = z5.number().int().nonnegative();
-var numNonNegSchema = z5.number().nonnegative();
-var geolocationSchema = z5.object({
-  country: z5.string().optional(),
-  region: z5.string().optional()
+var z2 = __toESM(require("zod"));
+var nonEmptyStringSchema = z2.string().min(1);
+var isoDateTimeSchema = z2.string().datetime({ offset: true });
+var ipAddressSchema = z2.string();
+var intNonNegSchema = z2.number().int().nonnegative();
+var numNonNegSchema = z2.number().nonnegative();
+var geolocationSchema = z2.object({
+  country: z2.string().optional(),
+  region: z2.string().optional()
 });
-var streamTLSInfoSchema = z5.object({
-  version: z5.string().min(1).optional(),
-  cipher: z5.string().min(1).optional(),
-  protocol: z5.string().min(1).optional(),
-  curve: z5.string().min(1).optional(),
-  ech: z5.boolean().optional()
+var streamTLSInfoSchema = z2.object({
+  version: z2.string().min(1).optional(),
+  cipher: z2.string().min(1).optional(),
+  protocol: z2.string().min(1).optional(),
+  curve: z2.string().min(1).optional(),
+  ech: z2.boolean().optional()
 });
-var streamEndpointSchema = z5.object({
+var streamEndpointSchema = z2.object({
   ip: ipAddressSchema.optional(),
   geolocation: geolocationSchema.optional(),
   tls: streamTLSInfoSchema.optional()
 });
-var httpHeadersSchema = z5.record(
-  z5.string(),
-  z5.union([z5.string(), z5.array(z5.string())])
+var httpHeadersSchema = z2.record(
+  z2.string(),
+  z2.union([z2.string(), z2.array(z2.string())])
 );
-var httpProtocolSchema = z5.enum(["http/1.1", "h2", "h2c", "h3"]);
-var httpRequestSchema = z5.object({
-  method: nonEmptyStringSchema2,
-  scheme: z5.string().min(1).optional(),
-  host: nonEmptyStringSchema2.optional(),
-  path: nonEmptyStringSchema2.optional(),
-  query: z5.string().optional(),
-  url: nonEmptyStringSchema2.optional(),
+var httpProtocolSchema = z2.enum(["http/1.1", "h2", "h2c", "h3"]);
+var httpRequestSchema = z2.object({
+  method: nonEmptyStringSchema,
+  scheme: z2.string().min(1).optional(),
+  host: nonEmptyStringSchema.optional(),
+  path: nonEmptyStringSchema.optional(),
+  query: z2.string().optional(),
+  url: nonEmptyStringSchema.optional(),
   headers: httpHeadersSchema.optional(),
-  userAgent: z5.string().optional()
+  userAgent: z2.string().optional()
 });
-var httpResponseSchema = z5.object({
-  status: z5.number().int().min(100).max(999),
+var httpResponseSchema = z2.object({
+  status: z2.number().int().min(100).max(999),
   headers: httpHeadersSchema.optional()
 });
-var httpRequestStageSchema = z5.object({
+var httpRequestStageSchema = z2.object({
   protocol: httpProtocolSchema.optional(),
   request: httpRequestSchema
 });
-var httpResponseStageSchema = z5.object({
+var httpResponseStageSchema = z2.object({
   protocol: httpProtocolSchema.optional(),
   response: httpResponseSchema
 });
-var tokenSourceSchema = z5.enum([
+var tokenSourceSchema = z2.enum([
   "authorization",
   "query",
   "client",
   "unknown"
 ]);
-var tokenTypeSchema = z5.enum(["auth", "pat", "app", "unknown"]);
-var firewallRuleSchema = z5.discriminatedUnion("kind", [
-  z5.object({ kind: z5.literal("none") }),
-  z5.object({ kind: z5.literal("mtls") }),
-  z5.object({
-    kind: z5.literal("rstream_auth"),
-    source: z5.literal("rstream_auth")
+var tokenTypeSchema = z2.enum(["auth", "pat", "app", "unknown"]);
+var firewallRuleSchema = z2.discriminatedUnion("kind", [
+  z2.object({ kind: z2.literal("none") }),
+  z2.object({ kind: z2.literal("mtls") }),
+  z2.object({
+    kind: z2.literal("rstream_auth"),
+    source: z2.literal("rstream_auth")
   }),
-  z5.object({
-    kind: z5.literal("token"),
+  z2.object({
+    kind: z2.literal("token"),
     source: tokenSourceSchema.optional(),
     tokenType: tokenTypeSchema.optional()
   })
 ]);
-var unauthorizedSourceSchema = z5.object({
+var unauthorizedSourceSchema = z2.object({
   source: tokenSourceSchema
 });
-var unauthorizedReasonSchema = (shape) => z5.object(shape).merge(unauthorizedSourceSchema);
-var unauthorizedSchema = z5.discriminatedUnion("reason", [
+var unauthorizedReasonSchema = (shape) => z2.object(shape).merge(unauthorizedSourceSchema);
+var unauthorizedSchema = z2.discriminatedUnion("reason", [
   unauthorizedReasonSchema({
-    reason: z5.literal("missing_token")
+    reason: z2.literal("missing_token")
   }),
   unauthorizedReasonSchema({
-    reason: z5.literal("invalid_token")
+    reason: z2.literal("invalid_token")
   }),
   unauthorizedReasonSchema({
-    reason: z5.literal("expired_token")
+    reason: z2.literal("expired_token")
   }),
   unauthorizedReasonSchema({
-    reason: z5.literal("invalid_secret")
+    reason: z2.literal("invalid_secret")
   }),
   unauthorizedReasonSchema({
-    reason: z5.literal("user_mismatch")
+    reason: z2.literal("user_mismatch")
   }),
   unauthorizedReasonSchema({
-    reason: z5.literal("insufficient_scope")
+    reason: z2.literal("insufficient_scope")
   }),
   unauthorizedReasonSchema({
-    reason: z5.literal("policy_denied"),
-    policy: z5.enum(["ip", "geo", "mtls", "challenge", "other"]),
-    value: z5.string().optional()
+    reason: z2.literal("policy_denied"),
+    policy: z2.enum(["ip", "geo", "mtls", "challenge", "other"]),
+    value: z2.string().optional()
   })
 ]);
-var failureSchema = z5.discriminatedUnion("kind", [
-  z5.object({
-    kind: z5.literal("timeout"),
+var failureSchema = z2.discriminatedUnion("kind", [
+  z2.object({
+    kind: z2.literal("timeout"),
     timeoutMs: intNonNegSchema.optional(),
-    message: z5.string().optional()
+    message: z2.string().optional()
   }),
-  z5.object({
-    kind: z5.literal("unauthorized"),
+  z2.object({
+    kind: z2.literal("unauthorized"),
     why: unauthorizedSchema,
-    message: z5.string().optional()
+    message: z2.string().optional()
   }),
-  z5.object({
-    kind: z5.literal("not_found"),
-    resource: z5.enum(["tunnel", "client", "route"]),
-    message: z5.string().optional()
+  z2.object({
+    kind: z2.literal("not_found"),
+    resource: z2.enum(["tunnel", "client", "route"]),
+    message: z2.string().optional()
   }),
-  z5.object({
-    kind: z5.literal("refused"),
-    reason: z5.enum(["capacity", "policy", "unsupported", "other"]),
-    message: z5.string().optional()
+  z2.object({
+    kind: z2.literal("refused"),
+    reason: z2.enum(["capacity", "policy", "unsupported", "other"]),
+    message: z2.string().optional()
   }),
-  z5.object({ kind: z5.literal("io"), message: z5.string().optional() }),
-  z5.object({ kind: z5.literal("internal"), message: z5.string().optional() })
+  z2.object({ kind: z2.literal("io"), message: z2.string().optional() }),
+  z2.object({ kind: z2.literal("internal"), message: z2.string().optional() })
 ]);
-var firewallSchema = z5.discriminatedUnion("decision", [
-  z5.object({ decision: z5.literal("allowed"), rule: firewallRuleSchema }),
-  z5.object({
-    decision: z5.literal("denied"),
+var firewallSchema = z2.discriminatedUnion("decision", [
+  z2.object({ decision: z2.literal("allowed"), rule: firewallRuleSchema }),
+  z2.object({
+    decision: z2.literal("denied"),
     rule: firewallRuleSchema,
     failure: failureSchema
   })
 ]);
-var routedTunnelSchema = z5.object({
-  tunnelId: nonEmptyStringSchema2.optional(),
-  tunnelName: z5.string().optional(),
-  hostname: z5.string().optional(),
-  protocol: z5.string().optional(),
-  published: z5.boolean().optional(),
-  type: z5.string().optional(),
-  tlsMode: z5.string().optional(),
-  httpVersion: z5.string().optional(),
-  httpUseTls: z5.boolean().optional(),
-  upstreamTls: z5.boolean().optional(),
-  tokenAuth: z5.boolean().optional(),
-  mtls_auth: z5.boolean().optional()
+var routedTunnelSchema = z2.object({
+  tunnelId: nonEmptyStringSchema.optional(),
+  tunnelName: z2.string().optional(),
+  hostname: z2.string().optional(),
+  protocol: z2.string().optional(),
+  published: z2.boolean().optional(),
+  type: z2.string().optional(),
+  tlsMode: z2.string().optional(),
+  httpVersion: z2.string().optional(),
+  httpUseTls: z2.boolean().optional(),
+  upstreamTls: z2.boolean().optional(),
+  tokenAuth: z2.boolean().optional(),
+  mtls_auth: z2.boolean().optional()
 });
-var routingSchema = z5.discriminatedUnion("decision", [
-  z5.object({ decision: z5.literal("routed"), tunnel: routedTunnelSchema }),
-  z5.object({ decision: z5.literal("not_routed"), failure: failureSchema })
+var routingSchema = z2.discriminatedUnion("decision", [
+  z2.object({ decision: z2.literal("routed"), tunnel: routedTunnelSchema }),
+  z2.object({ decision: z2.literal("not_routed"), failure: failureSchema })
 ]);
-var streamConnectedMetricsSchema = z5.object({
+var streamConnectedMetricsSchema = z2.object({
   establish_ms: numNonNegSchema,
   duration_ms: numNonNegSchema,
   upstream_bytes: intNonNegSchema,
   downstream_bytes: intNonNegSchema
 });
-var streamFailedMetricsSchema = z5.object({
+var streamFailedMetricsSchema = z2.object({
   time_to_fail_ms: numNonNegSchema.optional(),
   establish_ms: numNonNegSchema.optional()
 });
-var terminationSchema = z5.object({
-  by: z5.enum(["downstream", "upstream", "server", "unknown"]),
-  reason: z5.enum(["closed", "reset", "timeout", "error", "unknown"]),
-  message: z5.string().optional()
+var terminationSchema = z2.object({
+  by: z2.enum(["downstream", "upstream", "server", "unknown"]),
+  reason: z2.enum(["closed", "reset", "timeout", "error", "unknown"]),
+  message: z2.string().optional()
 });
-var responseConnectedSchema = z5.object({
-  outcome: z5.literal("connected"),
+var responseConnectedSchema = z2.object({
+  outcome: z2.literal("connected"),
   established_at: isoDateTimeSchema,
   upstream: streamEndpointSchema.optional(),
   metrics: streamConnectedMetricsSchema,
   termination: terminationSchema.optional(),
   http: httpResponseStageSchema.optional()
 });
-var responseFailedSchema = z5.object({
-  outcome: z5.literal("failed"),
+var responseFailedSchema = z2.object({
+  outcome: z2.literal("failed"),
   failure: failureSchema,
   upstream: streamEndpointSchema.optional(),
   metrics: streamFailedMetricsSchema.optional(),
   termination: terminationSchema.optional(),
   http: httpResponseStageSchema.optional()
 });
-var responseSchema = z5.discriminatedUnion("outcome", [
+var responseSchema = z2.discriminatedUnion("outcome", [
   responseConnectedSchema,
   responseFailedSchema
 ]);
-var streamSummarySchema = z5.object({
-  workspace_id: nonEmptyStringSchema2.optional(),
-  project_id: nonEmptyStringSchema2.optional(),
-  cluster_id: nonEmptyStringSchema2.optional(),
-  user_id: nonEmptyStringSchema2.optional(),
-  client_id: nonEmptyStringSchema2.optional(),
-  tunnel_id: nonEmptyStringSchema2.optional(),
-  stream_id: nonEmptyStringSchema2,
+var streamSummarySchema = z2.object({
+  workspace_id: nonEmptyStringSchema.optional(),
+  project_id: nonEmptyStringSchema.optional(),
+  cluster_id: nonEmptyStringSchema.optional(),
+  user_id: nonEmptyStringSchema.optional(),
+  client_id: nonEmptyStringSchema.optional(),
+  tunnel_id: nonEmptyStringSchema.optional(),
+  stream_id: nonEmptyStringSchema,
   created_at: isoDateTimeSchema,
   terminated_at: isoDateTimeSchema,
-  request: z5.object({
+  request: z2.object({
     downstream: streamEndpointSchema,
     http: httpRequestStageSchema.optional()
   }),
@@ -764,68 +496,100 @@ var streamSummarySchema = z5.object({
 });
 
 // src/event.ts
-var z6 = __toESM(require("zod"));
-var isoDateTimeSchema2 = z6.string().datetime({ offset: true });
-var initialStateSchema = z6.object({
+var import_tunnel = require("@rstreamlabs/rstream/tunnel");
+var z3 = __toESM(require("zod"));
+var isoDateTimeSchema2 = z3.string().datetime({ offset: true });
+var initialStateSchema = z3.object({
   snapshot_at: isoDateTimeSchema2,
-  clients: z6.array(clientSchema),
-  tunnels: z6.array(tunnelSchema)
+  clients: z3.array(clientSchema),
+  tunnels: z3.array(import_tunnel.tunnelSchema)
 });
-var eventBaseSchema = z6.object({
-  id: z6.string().optional(),
+var eventBaseSchema = z3.object({
+  id: z3.string().optional(),
   created_at: isoDateTimeSchema2.optional(),
-  user_id: z6.string().optional(),
-  workspace_id: z6.string().optional(),
-  project_id: z6.string().optional(),
-  cluster_id: z6.string().optional()
+  user_id: z3.string().optional(),
+  workspace_id: z3.string().optional(),
+  project_id: z3.string().optional(),
+  cluster_id: z3.string().optional()
 });
-var withEventBase = (shape) => z6.object(shape).merge(eventBaseSchema).passthrough();
+var withEventBase = (shape) => z3.object(shape).merge(eventBaseSchema).passthrough();
 var stateInitialEventSchema = withEventBase({
-  type: z6.literal("state.initial"),
+  type: z3.literal("state.initial"),
   object: initialStateSchema
 });
 var streamSummaryEventSchema = withEventBase({
-  type: z6.literal("stream.summary"),
+  type: z3.literal("stream.summary"),
   object: streamSummarySchema
 });
 var commonEventsSchema = [
   withEventBase({
-    type: z6.literal("client.created"),
+    type: z3.literal("client.created"),
     object: clientSchema
   }),
   withEventBase({
-    type: z6.literal("client.updated"),
+    type: z3.literal("client.updated"),
     object: clientSchema
   }),
   withEventBase({
-    type: z6.literal("client.deleted"),
+    type: z3.literal("client.deleted"),
     object: clientSchema
   }),
   withEventBase({
-    type: z6.literal("tunnel.created"),
-    object: tunnelSchema
+    type: z3.literal("tunnel.created"),
+    object: import_tunnel.tunnelSchema
   }),
   withEventBase({
-    type: z6.literal("tunnel.updated"),
-    object: tunnelSchema
+    type: z3.literal("tunnel.updated"),
+    object: import_tunnel.tunnelSchema
   }),
   withEventBase({
-    type: z6.literal("tunnel.deleted"),
-    object: tunnelSchema
+    type: z3.literal("tunnel.deleted"),
+    object: import_tunnel.tunnelSchema
   })
 ];
-var wsEventsSchema = z6.union([
+var wsEventsSchema = z3.union([
   stateInitialEventSchema,
   ...commonEventsSchema
 ]);
-var webhookEventsSchema = z6.union([
+var webhookEventsSchema = z3.union([
   ...commonEventsSchema,
   streamSummaryEventSchema
 ]);
-var eventSchema = z6.union([wsEventsSchema, webhookEventsSchema]);
+var eventSchema = z3.union([wsEventsSchema, webhookEventsSchema]);
+
+// src/tunnel.ts
+var import_tunnel2 = require("@rstreamlabs/rstream/tunnel");
+var z4 = __toESM(require("zod"));
+var DEFAULT_PUBLISHED_PORT = 443;
+var tunnelFilterSchema = import_tunnel2.tunnelSchema.pick({
+  id: true,
+  name: true,
+  type: true,
+  status: true,
+  client_id: true,
+  user_id: true,
+  publish: true,
+  protocol: true,
+  hostname: true,
+  http_version: true,
+  labels: true
+}).partial();
+var listTunnelsParamsSchema = z4.object({
+  limit: z4.number().int().min(1).optional(),
+  filters: tunnelFilterSchema.optional()
+});
+var listTunnelsResponseSchema = z4.array(import_tunnel2.tunnelSchema);
+function formatTunnelHost(tunnel) {
+  if (!tunnel.hostname) return tunnel.host;
+  if (!tunnel.port || tunnel.port === DEFAULT_PUBLISHED_PORT) {
+    return tunnel.hostname;
+  }
+  return `${tunnel.hostname}:${tunnel.port}`;
+}
 
 // src/openapi.ts
-var z7 = __toESM(require("zod"));
+var import_tunnel5 = require("@rstreamlabs/rstream/tunnel");
+var z5 = __toESM(require("zod"));
 var jsonContentType = "application/json";
 var openApiContentType = "application/vnd.oai.openapi+json;version=3.1";
 function isRecord(value) {
@@ -839,10 +603,10 @@ function dropSchemaKeyword(value) {
 }
 function jsonSchemaFor(schema) {
   return dropSchemaKeyword(
-    z7.toJSONSchema(schema, {
+    z5.toJSONSchema(schema, {
       unrepresentable: "any",
       override: (ctx) => {
-        if (ctx.zodSchema instanceof z7.ZodDate) {
+        if (ctx.zodSchema instanceof z5.ZodDate) {
           ctx.jsonSchema.type = "string";
           ctx.jsonSchema.format = "date-time";
         }
@@ -909,7 +673,7 @@ var readEngineStreamsRules = [
     action: "read"
   }
 ];
-var watchParamsSchema = z7.object({
+var watchParamsSchema = z5.object({
   clients: clientFilterSchema.optional(),
   tunnels: tunnelFilterSchema.optional()
 });
@@ -1037,7 +801,7 @@ var engineOpenApiDocument = {
       Event: jsonSchemaFor(wsEventsSchema),
       ListClientsParams: jsonSchemaFor(listClientsParamsSchema),
       ListTunnelsParams: jsonSchemaFor(listTunnelsParamsSchema),
-      TunnelListItem: jsonSchemaFor(tunnelSchema),
+      TunnelListItem: jsonSchemaFor(import_tunnel5.tunnelSchema),
       WatchParams: jsonSchemaFor(watchParamsSchema)
     }
   },
@@ -1288,6 +1052,7 @@ async function resolveManagedTunnelsProject(config) {
 }
 
 // src/tunnels-resource.ts
+var import_tunnel7 = require("@rstreamlabs/rstream/tunnel");
 function tunnelPathId(id) {
   const normalized = id.trim();
   if (!normalized) {
@@ -1314,34 +1079,34 @@ var RstreamTunnelsResource = class {
         method: "GET"
       }
     );
-    return tunnelSchema.parse(response);
+    return import_tunnel7.tunnelSchema.parse(response);
   }
 };
 
 // src/tunnels.ts
+var import_rstream11 = require("@rstreamlabs/rstream");
 var import_rstream12 = require("@rstreamlabs/rstream");
 var import_rstream13 = require("@rstreamlabs/rstream");
-var import_rstream14 = require("@rstreamlabs/rstream");
 
 // src/turn.ts
 var import_rstream8 = require("@rstreamlabs/rstream");
 var import_rstream9 = require("@rstreamlabs/rstream");
 var import_rstream10 = require("@rstreamlabs/rstream");
-var import_rstream11 = require("@rstreamlabs/rstream");
-var z8 = __toESM(require("zod"));
+var import_turn = require("@rstreamlabs/rstream/turn");
+var z6 = __toESM(require("zod"));
 var import_crypto = __toESM(require("crypto"));
 var defaultTURNPort = 3478;
 var defaultTURNSPort = 5349;
 var defaultTURNCredentialTTLSeconds = 10 * 60;
 var maxTURNCredentialTTLSeconds = 60 * 60;
-var turnTokenClaimsSchema = z8.object({
-  exp: z8.number().int().optional(),
-  iat: z8.number().int().optional(),
-  token_endpoint: z8.string().regex(/^[0-9a-f]{8}$/i).optional(),
-  tokendpoint: z8.string().regex(/^[0-9a-f]{8}$/i).optional(),
-  type: z8.enum(["app", "auth", "pat"])
+var turnTokenClaimsSchema = z6.object({
+  exp: z6.number().int().optional(),
+  iat: z6.number().int().optional(),
+  token_endpoint: z6.string().regex(/^[0-9a-f]{8}$/i).optional(),
+  tokendpoint: z6.string().regex(/^[0-9a-f]{8}$/i).optional(),
+  type: z6.enum(["app", "auth", "pat"])
 });
-var turnCredentialModeSchema = z8.enum(["api", "app", "pat"]);
+var turnCredentialModeSchema = z6.enum(["api", "app", "pat"]);
 function normalizeOptionalString2(value) {
   const normalized = value?.trim();
   return normalized ? normalized : void 0;
@@ -1367,6 +1132,9 @@ function normalizeTTLSeconds(ttlSeconds) {
   }
   return ttl;
 }
+function createAPITURNCredentialsParams(ttlSeconds) {
+  return ttlSeconds === void 0 ? {} : { ttlSeconds: normalizeTTLSeconds(ttlSeconds) };
+}
 function normalizePort(port, fallback, name) {
   const normalized = port ?? fallback;
   if (!Number.isInteger(normalized) || normalized < 1 || normalized > 65535) {
@@ -1396,19 +1164,21 @@ function parseTURNTokenClaims(token) {
   if (!payloadPart) {
     throw new Error("Invalid token format.");
   }
-  let decoded;
-  try {
-    const payload = Buffer.from(payloadPart, "base64url").toString("utf8");
-    decoded = JSON.parse(payload);
-  } catch {
-    throw new Error("Invalid token format.");
-  }
+  const decoded = parseTURNTokenPayload(payloadPart);
   const parsed = turnTokenClaimsSchema.safeParse(decoded);
   if (!parsed.success) {
     throw new Error("Invalid token format.");
   }
   return parsed.data;
 }
+function parseTURNTokenPayload(payloadPart) {
+  try {
+    const payload = Buffer.from(payloadPart, "base64url").toString("utf8");
+    return JSON.parse(payload);
+  } catch {
+    throw new Error("Invalid token format.");
+  }
+}
 function requirePATExpiration(claims, now) {
   const exp = claims.exp;
   if (typeof exp !== "number") {
@@ -1482,8 +1252,12 @@ async function createAPITURNCredentials(options) {
     apiUrl: options.apiUrl,
     credentials: options.credentials
   });
+  const params = createAPITURNCredentialsParams(options.ttlSeconds);
   if (projectId) {
-    return await client.tunnels.projects.createTurnCredentials(projectId);
+    return await client.tunnels.projects.createTurnCredentials(
+      projectId,
+      params
+    );
   }
   if (!projectEndpoint) {
     throw new Error(
@@ -1491,7 +1265,8 @@ async function createAPITURNCredentials(options) {
     );
   }
   return await client.tunnels.projects.createTurnCredentialsByEndpoint(
-    projectEndpoint
+    projectEndpoint,
+    params
   );
 }
 function createPATTURNCredentials(options) {
@@ -1535,7 +1310,7 @@ function createPATTURNCredentials(options) {
     )
   );
   const credential = import_crypto.default.createHmac("sha256", key).update(username, "utf8").digest("base64");
-  return import_rstream11.turnCredentialsSchema.parse({
+  return import_turn.turnCredentialsSchema.parse({
     credential,
     ttl,
     urls: createTURNURLs(clusterDomain, options.turnPort, options.turnsPort),
@@ -1587,7 +1362,7 @@ async function createAPPTURNCredentials(options) {
     )
   );
   const credential = import_crypto.default.createHmac("sha256", key).update(username, "utf8").digest("base64");
-  return import_rstream11.turnCredentialsSchema.parse({
+  return import_turn.turnCredentialsSchema.parse({
     credential,
     ttl: ttlSeconds,
     urls: createTURNURLs(clusterDomain, options.turnPort, options.turnsPort),
@@ -1609,7 +1384,8 @@ async function createTURNCredentials(options) {
       apiUrl: options.apiUrl,
       credentials: controlPlaneCredentials,
       projectEndpoint,
-      projectId: options.projectId
+      projectId: options.projectId,
+      ttlSeconds: options.ttlSeconds
     });
   }
   const clusterDomain = normalizeClusterDomain(options.clusterDomain) ?? (projectEndpoint && options.engine ? deriveClusterDomainFromEngine(projectEndpoint, options.engine) : void 0);
@@ -1802,10 +1578,10 @@ var RstreamTunnelsClient = class {
     const projectEndpoint = normalizeOptionalString3(
       this.config?.projectEndpoint
     );
-    if (projectEndpoint !== void 0 && normalizeOptionalString3(this.config?.engine) === void 0 && (0, import_rstream14.readEnvironment)().engine === void 0) {
+    if (projectEndpoint !== void 0 && normalizeOptionalString3(this.config?.engine) === void 0 && (0, import_rstream13.readEnvironment)().engine === void 0) {
       const project = await this.getManagedProject();
       if (project !== void 0) {
-        const engine = (0, import_rstream12.getTunnelsProjectEngine)(project);
+        const engine = (0, import_rstream11.getTunnelsProjectEngine)(project);
         if (engine) {
           return normalizeEngineAddress(engine);
         }
@@ -1845,9 +1621,11 @@ var RstreamTunnelsClient = class {
   async getEngineAuthTokenParams() {
     const target = await this.getEngineAuthTokenTarget();
     return {
-      tunnelsGrants: {
-        ...target,
-        scopes: engineAuthTokenScopes
+      resources: {
+        tunnels: {
+          ...target,
+          scopes: engineAuthTokenScopes
+        }
       }
     };
   }
@@ -1891,7 +1669,7 @@ var RstreamTunnelsClient = class {
     if (!credentials) {
       return void 0;
     }
-    if (!(0, import_rstream13.isClientCredentials)(credentials)) {
+    if (!(0, import_rstream12.isClientCredentials)(credentials)) {
       return credentials.token;
     }
     const tokenParams = await this.getEngineAuthTokenParams();
@@ -1929,6 +1707,7 @@ function normalizeOptionalString3(value) {
 }
 
 // src/watch.ts
+var import_auth_token2 = require("@rstreamlabs/rstream/auth-token");
 var import_jsonwebtoken = __toESM(require("jsonwebtoken"));
 var maxWatchTokenLifetimeSeconds = 3600;
 var watchTokenIssuedAtSkewSeconds = 300;
@@ -1942,7 +1721,7 @@ function normalizeTransport(transport) {
   throw new Error("Watch: Unsupported transport.");
 }
 function validateWatchQueryToken(token) {
-  const parsed = authTokenSchema.safeParse(import_jsonwebtoken.default.decode(token));
+  const parsed = import_auth_token2.authTokenSchema.safeParse(import_jsonwebtoken.default.decode(token));
   if (!parsed.success || parsed.data.type === "pat") {
     throw new Error(
       "Watch requires a short-lived auth or app token for URL-based authentication."
@@ -1956,37 +1735,38 @@ function validateWatchQueryToken(token) {
       "Watch requires a token with a bounded lifetime of at most 3600 seconds."
     );
   }
-  if (!hasWatchOnlyTunnelGrants(parsed.data)) {
+  if (!hasWatchOnlyTunnelResources(parsed.data)) {
     throw new Error(
-      "Watch requires a fine-grained token limited to tunnel list grants for URL-based authentication."
+      "Watch requires a fine-grained token limited to tunnel list resources for URL-based authentication."
     );
   }
 }
-function hasWatchOnlyTunnelGrants(token) {
+function hasWatchOnlyTunnelResources(token) {
   if (!hasWatchOnlyPermissions(token.permissions)) {
     return false;
   }
-  if (token.tunnelsGrants === void 0) {
+  const resource = token.resources?.tunnels;
+  if (resource === void 0) {
     return false;
   }
-  return hasWatchOnlyTunnelGrant(token.tunnelsGrants);
+  return hasWatchOnlyTunnelResource(resource);
 }
-function hasWatchOnlyTunnelGrant(grant) {
-  return watchGrantBranches(grant).every(
+function hasWatchOnlyTunnelResource(resource) {
+  return watchResourceBranches(resource).every(
     (branch) => branch.hasList && !branch.hasMutationOrConnect
   );
 }
-function watchGrantBranches(grant) {
-  if ("AND" in grant) {
-    return grant.AND.reduce(
-      (branches, child) => combineWatchGrantBranches(branches, child),
+function watchResourceBranches(resource) {
+  if ("AND" in resource) {
+    return resource.AND.reduce(
+      (branches, child) => combineWatchResourceBranches(branches, child),
       [{ hasList: false, hasMutationOrConnect: false }]
     );
   }
-  if ("OR" in grant) {
-    return grant.OR.flatMap(watchGrantBranches);
+  if ("OR" in resource) {
+    return resource.OR.flatMap(watchResourceBranches);
   }
-  const tunnels = grant.scopes?.tunnels;
+  const tunnels = resource.scopes?.tunnels;
   if (tunnels === void 0) {
     return [{ hasList: false, hasMutationOrConnect: false }];
   }
@@ -1997,9 +1777,9 @@ function watchGrantBranches(grant) {
     }
   ];
 }
-function combineWatchGrantBranches(branches, child) {
+function combineWatchResourceBranches(branches, child) {
   return branches.flatMap(
-    (branch) => watchGrantBranches(child).map((childBranch) => ({
+    (branch) => watchResourceBranches(child).map((childBranch) => ({
       hasList: branch.hasList || childBranch.hasList,
       hasMutationOrConnect: branch.hasMutationOrConnect || childBranch.hasMutationOrConnect
     }))
@@ -2010,7 +1790,7 @@ function hasWatchOnlyPermissions(permissions) {
     return true;
   }
   return permissions.every(
-    (permission) => permission === "tunnels.resources.read-only" || permission === "network.resources.read-only"
+    (permission) => permission === "tunnels.resources.read-only"
   );
 }
 var Watch = class {
@@ -2095,7 +1875,7 @@ var Watch = class {
 };
 
 // src/webtty.ts
-var z9 = __toESM(require("zod"));
+var z7 = __toESM(require("zod"));
 var osFamilies = [
   "linux",
   "macos",
@@ -2104,25 +1884,25 @@ var osFamilies = [
   "openbsd",
   "freebsd"
 ];
-var webttyServerSchema = z9.object({
-  tunnel_id: z9.string(),
-  host: z9.string(),
-  token_auth: z9.boolean(),
-  os_family: z9.enum(osFamilies).optional(),
-  arch: z9.string().optional(),
-  os_id: z9.string().optional(),
+var webttyServerSchema = z7.object({
+  tunnel_id: z7.string(),
+  host: z7.string(),
+  token_auth: z7.boolean(),
+  os_family: z7.enum(osFamilies).optional(),
+  arch: z7.string().optional(),
+  os_id: z7.string().optional(),
   // /etc/os-release::ID (ubuntu, debian, rocky, etc.)
-  os_version_id: z9.string().optional(),
+  os_version_id: z7.string().optional(),
   // /etc/os-release::VERSION_ID (24.04, 22.04, 11, 10.0.19045, ...)
-  os_version_codename: z9.string().optional(),
+  os_version_codename: z7.string().optional(),
   // /etc/os-release::VERSION_CODENAME (jammy, noble...)
-  os_pretty_name: z9.string().optional(),
+  os_pretty_name: z7.string().optional(),
   // /etc/os-release::PRETTY_NAME
-  kernel_release: z9.string().optional(),
+  kernel_release: z7.string().optional(),
   // uname -r
-  hostname: z9.string().optional(),
+  hostname: z7.string().optional(),
   // uname -n
-  labels: z9.record(z9.string(), z9.string().optional()).optional()
+  labels: z7.record(z7.string(), z7.string().optional()).optional()
 });
 function parser(tunnel) {
   if (tunnel.status !== "online") return null;
@@ -2175,18 +1955,11 @@ function parseWebTTYServers(tunnels) {
   RstreamWebhookRessource,
   Tunnels,
   Watch,
-  authTokenPermissionsSchema,
-  authTokenSchema,
-  authTokenScopesSchema,
-  authTokenTunnelGrantSchema,
-  authTokenTunnelsScopesSchema,
   clientFilterSchema,
   clientSchema,
   createAPITURNCredentials,
   createAPPTURNCredentials,
   createAuthTokenFromClientCredentials,
-  createAuthTokenParamsSchema,
-  createAuthTokenResponseSchema,
   createPATTURNCredentials,
   createTURNCredentials,
   engineOpenApiDocument,
@@ -2207,9 +1980,7 @@ function parseWebTTYServers(tunnels) {
   streamEndpointSchema,
   streamSummarySchema,
   streamTLSInfoSchema,
-  tokenSchema,
   tunnelFilterSchema,
-  tunnelSchema,
   turnCredentialModeSchema,
   webhookEventsSchema,
   webttyServerSchema,