@rstreamlabs/tunnels 1.0.6 → 1.0.8

package/dist/index.mjs

@@ -1,3 +1,23 @@
+import {
+  clientFilterSchema,
+  clientSchema,
+  engineOpenApiDocument,
+  engineOpenApiJson,
+  eventSchema,
+  formatTunnelHost,
+  listClientsParamsSchema,
+  listClientsResponseSchema,
+  listTunnelsParamsSchema,
+  listTunnelsResponseSchema,
+  streamEndpointSchema,
+  streamSummarySchema,
+  streamTLSInfoSchema,
+  tunnelFilterSchema,
+  tunnelSchema,
+  webhookEventsSchema,
+  wsEventsSchema
+} from "./chunk-7RZ743EF.mjs";
+
 // src/auth-resource.ts
 import { createClientCredentialsToken } from "@rstreamlabs/rstream";
 
@@ -5,9 +25,9 @@ import { createClientCredentialsToken } from "@rstreamlabs/rstream";
 import * as z from "zod";
 var StringFilter = z.union([
   z.string(),
-  z.object({ exact: z.string() }),
-  z.object({ oneof: z.array(z.string()) }),
-  z.object({ regex: z.string() })
+  z.object({ exact: z.string() }).strict(),
+  z.object({ oneof: z.array(z.string()) }).strict(),
+  z.object({ regex: z.string() }).strict()
 ]);
 function transform(field) {
   if (field instanceof z.ZodOptional) {
@@ -41,78 +61,18 @@ function select(base) {
     return [key, z.boolean().optional()];
   });
   const shape = Object.fromEntries(entries);
-  return z.object(shape);
-}
-
-// src/tunnel.ts
-import * as z2 from "zod";
-var DEFAULT_PUBLISHED_PORT = 443;
-var tunnelSchema = z2.object({
-  // common properties
-  client_id: z2.string(),
-  user_id: z2.string().optional(),
-  workspace_id: z2.string().optional(),
-  project_id: z2.string().optional(),
-  cluster_id: z2.string().optional(),
-  plan: z2.string().optional(),
-  provider: z2.string().optional(),
-  region: z2.string().optional(),
-  status: z2.enum(["online", "offline"]),
-  // tunnel properties
-  id: z2.string(),
-  creation_date: z2.union([z2.string().datetime(), z2.date()]).optional(),
-  name: z2.string().optional(),
-  type: z2.enum(["bytestream", "datagram"]).optional(),
-  publish: z2.boolean().optional(),
-  protocol: z2.enum(["tls", "dtls", "quic", "http"]).optional(),
-  labels: z2.record(z2.string(), z2.string()).optional(),
-  geo_ip: z2.array(z2.string()).optional(),
-  trusted_ips: z2.array(z2.string()).optional(),
-  host: z2.string().optional(),
-  hostname: z2.string().optional(),
-  port: z2.number().int().min(1).max(65535).optional(),
-  tls_mode: z2.enum(["passthrough", "terminated"]).optional(),
-  tls_alpns: z2.array(z2.string()).optional(),
-  tls_min_version: z2.string().optional(),
-  tls_ciphers: z2.array(z2.string()).optional(),
-  mtls: z2.boolean().optional(),
-  mtls_ca_cert_pem: z2.string().optional(),
-  http_version: z2.enum(["http/1.1", "h2", "h2c", "h3"]).optional(),
-  http_use_tls: z2.boolean().optional(),
-  upstream_tls: z2.boolean().optional(),
-  token_auth: z2.boolean().optional(),
-  rstream_auth: z2.boolean().optional(),
-  challenge_mode: z2.boolean().optional()
-});
-var listTunnelsParamsSchema = z2.object({
-  limit: z2.number().optional(),
-  filters: tunnelSchema.pick({
-    status: true,
-    client_id: true,
-    hostname: true,
-    protocol: true,
-    publish: true,
-    labels: true
-  }).partial().optional()
-});
-var listTunnelsResponseSchema = z2.array(tunnelSchema);
-function formatTunnelHost(tunnel) {
-  if (!tunnel.hostname) return tunnel.host;
-  if (!tunnel.port || tunnel.port === DEFAULT_PUBLISHED_PORT) {
-    return tunnel.hostname;
-  }
-  return `${tunnel.hostname}:${tunnel.port}`;
+  return z.object(shape).strict();
 }
 
 // src/auth.ts
-import * as z3 from "zod";
-var nonEmptyStringSchema = z3.string().trim().min(1);
-var authTokenPermissionsSchema = z3.array(z3.string());
-var authTokenTunnelsScopesSchema = z3.object({
+import * as z2 from "zod";
+var nonEmptyStringSchema = z2.string().trim().min(1);
+var authTokenPermissionsSchema = z2.array(z2.string());
+var authTokenTunnelsScopesSchema = z2.object({
   // Scopes for creating tunnels
-  create: z3.union([
-    z3.boolean(),
-    z3.object({
+  create: z2.union([
+    z2.boolean(),
+    z2.object({
       filters: filters(
         tunnelSchema.omit({
           client_id: true,
@@ -128,97 +88,125 @@ var authTokenTunnelsScopesSchema = z3.object({
           creation_date: true
         })
       ).optional()
-    })
+    }).strict()
   ]).optional(),
   // Scopes for connecting to tunnels
-  connect: z3.union([
-    z3.boolean(),
-    z3.object({
+  connect: z2.union([
+    z2.boolean(),
+    z2.object({
       filters: filters(tunnelSchema).optional(),
       params: filters(
-        z3.object({
-          path: z3.string().optional()
+        z2.object({
+          path: z2.string().optional()
         })
       ).optional()
-    })
+    }).strict()
   ]).optional(),
   // Scopes for listing tunnels
-  list: z3.union([
-    z3.boolean(),
-    z3.object({
+  list: z2.union([
+    z2.boolean(),
+    z2.object({
       filters: filters(tunnelSchema).optional(),
       select: select(tunnelSchema).optional()
-    })
+    }).strict()
   ]).optional()
+}).strict().superRefine((scopes, ctx) => {
+  if (scopes.create === void 0 && scopes.connect === void 0 && scopes.list === void 0) {
+    ctx.addIssue({
+      code: z2.ZodIssueCode.custom,
+      message: "At least one tunnel scope action is required."
+    });
+  }
 });
-var authTokenScopesSchema = z3.object({
+var authTokenScopesSchema = z2.object({
   tunnels: authTokenTunnelsScopesSchema.optional()
   // Scopes related to tunnels
+}).strict().superRefine((scopes, ctx) => {
+  if (scopes.tunnels === void 0) {
+    ctx.addIssue({
+      code: z2.ZodIssueCode.custom,
+      message: "Tunnel scopes are required.",
+      path: ["tunnels"]
+    });
+  }
 });
-var authTokenTunnelGrantSchema = z3.object({
-  workspaces: z3.array(nonEmptyStringSchema).min(1).optional(),
-  projects: z3.array(nonEmptyStringSchema).min(1).optional(),
-  scopes: authTokenScopesSchema.optional()
+var authTokenTunnelGrantSchema = z2.object({
+  workspaces: z2.array(nonEmptyStringSchema).min(1).optional(),
+  projects: z2.array(nonEmptyStringSchema).min(1).optional(),
+  scopes: authTokenScopesSchema
 }).strict().superRefine((grant, ctx) => {
   if (grant.workspaces !== void 0 && grant.projects !== void 0) {
     ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: "A grant cannot target workspaces and projects at the same time.",
       path: ["projects"]
     });
   }
+  if (grant.workspaces === void 0 && grant.projects === void 0) {
+    ctx.addIssue({
+      code: z2.ZodIssueCode.custom,
+      message: "A grant must target workspaces or projects.",
+      path: ["workspaces"]
+    });
+  }
 });
 var authTokenCommonSchema = {
-  aud: z3.union([z3.string(), z3.array(z3.string())]).optional(),
-  exp: z3.number().optional(),
-  tunnelsGrants: z3.array(authTokenTunnelGrantSchema).optional(),
-  iat: z3.number().optional(),
-  iss: z3.string().optional(),
-  jti: z3.string().optional(),
-  metadata: z3.object({
-    engine: z3.string().optional()
+  aud: z2.union([z2.string(), z2.array(z2.string())]).optional(),
+  exp: z2.number().optional(),
+  tunnelsGrants: z2.array(authTokenTunnelGrantSchema).optional(),
+  iat: z2.number().optional(),
+  iss: z2.string().optional(),
+  jti: z2.string().optional(),
+  metadata: z2.object({
+    engine: z2.string().optional()
   }).strict().optional(),
-  nbf: z3.number().optional(),
-  sub: z3.string().optional()
+  nbf: z2.number().optional(),
+  sub: z2.string().optional()
 };
-var authTokenSchema = z3.union([
-  z3.object({
-    type: z3.literal("auth"),
-    userId: z3.string(),
+var authTokenSchema = z2.union([
+  z2.object({
+    type: z2.literal("auth"),
+    userId: z2.string(),
     permissions: authTokenPermissionsSchema.nullable(),
     ...authTokenCommonSchema
   }).strict(),
-  z3.object({
-    type: z3.literal("pat"),
-    token_endpoint: z3.string().optional(),
+  z2.object({
+    type: z2.literal("pat"),
+    token_endpoint: z2.string().optional(),
     ...authTokenCommonSchema
   }).strict(),
-  z3.object({
-    type: z3.literal("app"),
-    clientId: z3.string(),
+  z2.object({
+    type: z2.literal("app"),
+    clientId: z2.string(),
     permissions: authTokenPermissionsSchema.nullable(),
     ...authTokenCommonSchema
   }).strict()
 ]);
 var tokenSchema = authTokenSchema;
-var createAuthTokenParamsSchema = z3.object({
-  expires_in: z3.number().default(60),
-  // 1 minute
+var createAuthTokenParamsSchema = z2.object({
+  expires_in: z2.number().int().min(1).max(3600).default(60),
   scopes: authTokenScopesSchema.optional(),
-  tunnelsGrants: z3.array(authTokenTunnelGrantSchema).optional(),
-  metadata: z3.unknown().optional()
+  tunnelsGrants: z2.array(authTokenTunnelGrantSchema).min(1).optional(),
+  metadata: z2.unknown().optional()
   // Additional metadata
 }).strict().superRefine((params, ctx) => {
   if (params.scopes !== void 0 && params.tunnelsGrants !== void 0) {
     ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
+      code: z2.ZodIssueCode.custom,
       message: "Use either scopes or tunnelsGrants, not both.",
       path: ["tunnelsGrants"]
     });
   }
+  if (params.scopes === void 0 && params.tunnelsGrants === void 0) {
+    ctx.addIssue({
+      code: z2.ZodIssueCode.custom,
+      message: "Explicit scopes or tunnelsGrants are required.",
+      path: ["scopes"]
+    });
+  }
 });
-var createAuthTokenResponseSchema = z3.object({
-  token: z3.string()
+var createAuthTokenResponseSchema = z2.object({
+  token: z2.string()
 });
 
 // src/auth-resource.ts
@@ -242,12 +230,12 @@ var RstreamAuthResource = class {
   }
 };
 function createAuthTokenFromClientCredentials(credentials, params, options) {
-  const tokenParams = createAuthTokenParamsSchema.parse(params ?? {});
+  const tokenParams = createAuthTokenParamsSchema.parse(params);
   const payload = {
     metadata: {
       engine: options?.engine
     },
-    tunnelsGrants: normalizeAuthTokenTunnelGrants(tokenParams),
+    tunnelsGrants: normalizeAuthTokenTunnelGrants(tokenParams, options),
     permissions: null
   };
   const { token } = createClientCredentialsToken(credentials, {
@@ -256,49 +244,45 @@ function createAuthTokenFromClientCredentials(credentials, params, options) {
   });
   return { token };
 }
-function normalizeAuthTokenTunnelGrants(params) {
-  if (!params) {
-    return void 0;
-  }
+function normalizeAuthTokenTunnelGrants(params, options) {
   const tunnelsGrants = params.tunnelsGrants;
   if (tunnelsGrants !== void 0) {
     return [...tunnelsGrants];
   }
   if (params.scopes) {
-    return [{ scopes: params.scopes }];
+    return [{ ...normalizeTunnelGrantTarget(options), scopes: params.scopes }];
   }
   return void 0;
 }
-
-// src/client.ts
-import * as z4 from "zod";
-var clientSchema = z4.object({
-  id: z4.string(),
-  status: z4.enum(["online", "offline"]),
-  user_id: z4.string().optional(),
-  workspace_id: z4.string().optional(),
-  project_id: z4.string().optional(),
-  cluster_id: z4.string().optional(),
-  plan: z4.string().optional(),
-  provider: z4.string().optional(),
-  region: z4.string().optional(),
-  agent: z4.string().optional(),
-  channel: z4.string().optional(),
-  version: z4.string().optional(),
-  os: z4.string().optional(),
-  arch: z4.string().optional(),
-  protocol_version: z4.string().optional(),
-  labels: z4.record(z4.string(), z4.string()).optional()
-});
-var listClientsParamsSchema = z4.object({
-  limit: z4.number().optional(),
-  filters: clientSchema.pick({
-    labels: true
-  }).partial().optional()
-});
-var listClientsResponseSchema = z4.array(clientSchema);
+function normalizeTunnelGrantTarget(options) {
+  const projectId = normalizeOptionalString(options?.projectId);
+  const workspaceId = normalizeOptionalString(options?.workspaceId);
+  if (projectId !== void 0 && workspaceId !== void 0) {
+    throw new Error("Use either projectId or workspaceId, not both.");
+  }
+  if (projectId !== void 0) {
+    return { projects: [projectId] };
+  }
+  if (workspaceId !== void 0) {
+    return { workspaces: [workspaceId] };
+  }
+  throw new Error(
+    "Project ID or workspace ID is required when using scope-only tunnel grants."
+  );
+}
+function normalizeOptionalString(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
 
 // src/clients-resource.ts
+function clientPathId(id) {
+  const normalized = id.trim();
+  if (!normalized) {
+    throw new Error("Client ID is required.");
+  }
+  return encodeURIComponent(normalized);
+}
 var RstreamClientsResource = class {
   client;
   constructor(client) {
@@ -312,299 +296,53 @@ var RstreamClientsResource = class {
     return listClientsResponseSchema.parse(response);
   }
   async get(id) {
-    const response = await this.client.request(`/clients/${id}`, {
-      method: "GET"
-    });
+    const response = await this.client.request(
+      `/clients/${clientPathId(id)}`,
+      {
+        method: "GET"
+      }
+    );
     return clientSchema.parse(response);
   }
 };
 
-// src/stream.ts
-import * as z5 from "zod";
-var nonEmptyStringSchema2 = z5.string().min(1);
-var isoDateTimeSchema = z5.string().datetime({ offset: true });
-var ipAddressSchema = z5.string();
-var intNonNegSchema = z5.number().int().nonnegative();
-var numNonNegSchema = z5.number().nonnegative();
-var geolocationSchema = z5.object({
-  country: z5.string().optional(),
-  region: z5.string().optional()
-});
-var streamTLSInfoSchema = z5.object({
-  version: z5.string().min(1).optional(),
-  cipher: z5.string().min(1).optional(),
-  protocol: z5.string().min(1).optional(),
-  curve: z5.string().min(1).optional(),
-  ech: z5.boolean().optional()
-});
-var streamEndpointSchema = z5.object({
-  ip: ipAddressSchema.optional(),
-  geolocation: geolocationSchema.optional(),
-  tls: streamTLSInfoSchema.optional()
-});
-var httpHeadersSchema = z5.record(
-  z5.string(),
-  z5.union([z5.string(), z5.array(z5.string())])
-);
-var httpProtocolSchema = z5.enum(["http/1.1", "h2", "h2c", "h3"]);
-var httpRequestSchema = z5.object({
-  method: nonEmptyStringSchema2,
-  scheme: z5.string().min(1).optional(),
-  host: nonEmptyStringSchema2.optional(),
-  path: nonEmptyStringSchema2.optional(),
-  query: z5.string().optional(),
-  url: nonEmptyStringSchema2.optional(),
-  headers: httpHeadersSchema.optional(),
-  userAgent: z5.string().optional()
-});
-var httpResponseSchema = z5.object({
-  status: z5.number().int().min(100).max(999),
-  headers: httpHeadersSchema.optional()
-});
-var httpRequestStageSchema = z5.object({
-  protocol: httpProtocolSchema.optional(),
-  request: httpRequestSchema
-});
-var httpResponseStageSchema = z5.object({
-  protocol: httpProtocolSchema.optional(),
-  response: httpResponseSchema
-});
-var tokenSourceSchema = z5.enum([
-  "authorization",
-  "query",
-  "client",
-  "unknown"
-]);
-var tokenTypeSchema = z5.enum(["auth", "pat", "app", "unknown"]);
-var firewallRuleSchema = z5.discriminatedUnion("kind", [
-  z5.object({ kind: z5.literal("none") }),
-  z5.object({ kind: z5.literal("mtls") }),
-  z5.object({
-    kind: z5.literal("rstream_auth"),
-    source: z5.literal("rstream_auth")
-  }),
-  z5.object({
-    kind: z5.literal("token"),
-    source: tokenSourceSchema.optional(),
-    tokenType: tokenTypeSchema.optional()
-  })
-]);
-var unauthorizedSourceSchema = z5.object({
-  source: tokenSourceSchema
-});
-var unauthorizedReasonSchema = (shape) => z5.object(shape).merge(unauthorizedSourceSchema);
-var unauthorizedSchema = z5.discriminatedUnion("reason", [
-  unauthorizedReasonSchema({
-    reason: z5.literal("missing_token")
-  }),
-  unauthorizedReasonSchema({
-    reason: z5.literal("invalid_token")
-  }),
-  unauthorizedReasonSchema({
-    reason: z5.literal("expired_token")
-  }),
-  unauthorizedReasonSchema({
-    reason: z5.literal("invalid_secret")
-  }),
-  unauthorizedReasonSchema({
-    reason: z5.literal("user_mismatch")
-  }),
-  unauthorizedReasonSchema({
-    reason: z5.literal("insufficient_scope")
-  }),
-  unauthorizedReasonSchema({
-    reason: z5.literal("policy_denied"),
-    policy: z5.enum(["ip", "geo", "mtls", "challenge", "other"]),
-    value: z5.string().optional()
-  })
-]);
-var failureSchema = z5.discriminatedUnion("kind", [
-  z5.object({
-    kind: z5.literal("timeout"),
-    timeoutMs: intNonNegSchema.optional(),
-    message: z5.string().optional()
-  }),
-  z5.object({
-    kind: z5.literal("unauthorized"),
-    why: unauthorizedSchema,
-    message: z5.string().optional()
-  }),
-  z5.object({
-    kind: z5.literal("not_found"),
-    resource: z5.enum(["tunnel", "client", "route"]),
-    message: z5.string().optional()
-  }),
-  z5.object({
-    kind: z5.literal("refused"),
-    reason: z5.enum(["capacity", "policy", "unsupported", "other"]),
-    message: z5.string().optional()
-  }),
-  z5.object({ kind: z5.literal("io"), message: z5.string().optional() }),
-  z5.object({ kind: z5.literal("internal"), message: z5.string().optional() })
-]);
-var firewallSchema = z5.discriminatedUnion("decision", [
-  z5.object({ decision: z5.literal("allowed"), rule: firewallRuleSchema }),
-  z5.object({
-    decision: z5.literal("denied"),
-    rule: firewallRuleSchema,
-    failure: failureSchema
-  })
-]);
-var routedTunnelSchema = z5.object({
-  tunnelId: nonEmptyStringSchema2.optional(),
-  tunnelName: z5.string().optional(),
-  hostname: z5.string().optional(),
-  protocol: z5.string().optional(),
-  published: z5.boolean().optional(),
-  type: z5.string().optional(),
-  tlsMode: z5.string().optional(),
-  httpVersion: z5.string().optional(),
-  httpUseTls: z5.boolean().optional(),
-  upstreamTls: z5.boolean().optional(),
-  tokenAuth: z5.boolean().optional(),
-  mtls: z5.boolean().optional()
-});
-var routingSchema = z5.discriminatedUnion("decision", [
-  z5.object({ decision: z5.literal("routed"), tunnel: routedTunnelSchema }),
-  z5.object({ decision: z5.literal("not_routed"), failure: failureSchema })
-]);
-var streamConnectedMetricsSchema = z5.object({
-  establish_ms: numNonNegSchema,
-  duration_ms: numNonNegSchema,
-  upstream_bytes: intNonNegSchema,
-  downstream_bytes: intNonNegSchema
-});
-var streamFailedMetricsSchema = z5.object({
-  time_to_fail_ms: numNonNegSchema.optional(),
-  establish_ms: numNonNegSchema.optional()
-});
-var terminationSchema = z5.object({
-  by: z5.enum(["downstream", "upstream", "server", "unknown"]),
-  reason: z5.enum(["closed", "reset", "timeout", "error", "unknown"]),
-  message: z5.string().optional()
-});
-var responseConnectedSchema = z5.object({
-  outcome: z5.literal("connected"),
-  established_at: isoDateTimeSchema,
-  upstream: streamEndpointSchema.optional(),
-  metrics: streamConnectedMetricsSchema,
-  termination: terminationSchema.optional(),
-  http: httpResponseStageSchema.optional()
-});
-var responseFailedSchema = z5.object({
-  outcome: z5.literal("failed"),
-  failure: failureSchema,
-  upstream: streamEndpointSchema.optional(),
-  metrics: streamFailedMetricsSchema.optional(),
-  termination: terminationSchema.optional(),
-  http: httpResponseStageSchema.optional()
-});
-var responseSchema = z5.discriminatedUnion("outcome", [
-  responseConnectedSchema,
-  responseFailedSchema
-]);
-var streamSummarySchema = z5.object({
-  workspace_id: nonEmptyStringSchema2.optional(),
-  project_id: nonEmptyStringSchema2.optional(),
-  cluster_id: nonEmptyStringSchema2.optional(),
-  user_id: nonEmptyStringSchema2.optional(),
-  client_id: nonEmptyStringSchema2.optional(),
-  tunnel_id: nonEmptyStringSchema2.optional(),
-  stream_id: nonEmptyStringSchema2,
-  created_at: isoDateTimeSchema,
-  terminated_at: isoDateTimeSchema,
-  request: z5.object({
-    downstream: streamEndpointSchema,
-    http: httpRequestStageSchema.optional()
-  }),
-  firewall: firewallSchema,
-  routing: routingSchema,
-  response: responseSchema
-});
-
-// src/event.ts
-import * as z6 from "zod";
-var isoDateTimeSchema2 = z6.string().datetime({ offset: true });
-var initialStateSchema = z6.object({
-  snapshot_at: isoDateTimeSchema2,
-  clients: z6.array(clientSchema),
-  tunnels: z6.array(tunnelSchema)
-});
-var eventBaseSchema = z6.object({
-  id: z6.string().optional(),
-  created_at: isoDateTimeSchema2.optional(),
-  user_id: z6.string().optional(),
-  workspace_id: z6.string().optional(),
-  project_id: z6.string().optional(),
-  cluster_id: z6.string().optional()
-});
-var withEventBase = (shape) => z6.object(shape).merge(eventBaseSchema).passthrough();
-var stateInitialEventSchema = withEventBase({
-  type: z6.literal("state.initial"),
-  object: initialStateSchema
-});
-var streamSummaryEventSchema = withEventBase({
-  type: z6.literal("stream.summary"),
-  object: streamSummarySchema
-});
-var commonEventsSchema = [
-  withEventBase({
-    type: z6.literal("client.created"),
-    object: clientSchema
-  }),
-  withEventBase({
-    type: z6.literal("client.updated"),
-    object: clientSchema
-  }),
-  withEventBase({
-    type: z6.literal("client.deleted"),
-    object: clientSchema
-  }),
-  withEventBase({
-    type: z6.literal("tunnel.created"),
-    object: tunnelSchema
-  }),
-  withEventBase({
-    type: z6.literal("tunnel.updated"),
-    object: tunnelSchema
-  }),
-  withEventBase({
-    type: z6.literal("tunnel.deleted"),
-    object: tunnelSchema
-  })
-];
-var wsEventsSchema = z6.union([
-  stateInitialEventSchema,
-  ...commonEventsSchema
-]);
-var webhookEventsSchema = z6.union([
-  ...commonEventsSchema,
-  streamSummaryEventSchema
-]);
-var eventSchema = z6.union([wsEventsSchema, webhookEventsSchema]);
-
 // src/resolution.ts
 import { DEFAULT_API_URL } from "@rstreamlabs/rstream";
 import { getTunnelsProjectEngine } from "@rstreamlabs/rstream";
 import { isTokenCredentials } from "@rstreamlabs/rstream";
 import { readEnvironment } from "@rstreamlabs/rstream";
 import { RstreamClient } from "@rstreamlabs/rstream";
-import jwt from "jsonwebtoken";
 function trimOptionalString(value) {
   const normalized = value?.trim();
   return normalized ? normalized : void 0;
 }
-function getEngineFromToken(token) {
-  if (!token) {
-    return void 0;
+var dnsLabelPattern = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
+function validateHostname(hostname) {
+  if (!hostname || hostname.length > 253 || hostname.includes("..")) {
+    return false;
   }
-  const parsed = authTokenSchema.safeParse(
-    jwt.decode(token, { complete: false })
-  );
-  if (!parsed.success) {
-    return void 0;
+  return hostname.split(".").every((label) => label === "localhost" || dnsLabelPattern.test(label));
+}
+function normalizeEngineAddress(engine) {
+  const normalized = engine.trim();
+  if (!normalized || /^[a-z][a-z0-9+.-]*:\/\//i.test(normalized) || /[/?#@\\\s]/.test(normalized)) {
+    throw new Error("Engine must be a host[:port] value.");
+  }
+  const explicitPort = normalized.match(/:(\d+)$/)?.[1];
+  const url = new URL(`https://${normalized}`);
+  if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw new Error("Engine must be a host[:port] value.");
+  }
+  if (!validateHostname(url.hostname)) {
+    throw new Error("Engine must use a valid hostname.");
+  }
+  if (explicitPort) {
+    const port = Number(explicitPort);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+      throw new Error("Engine port must be an integer between 1 and 65535.");
+    }
   }
-  return trimOptionalString(parsed.data.metadata?.engine);
+  return `${url.hostname.toLowerCase()}${explicitPort ? `:${explicitPort}` : ""}`;
 }
 function resolveTunnelsAPIURL(apiUrl) {
   return trimOptionalString(apiUrl) ?? readEnvironment().apiUrl ?? DEFAULT_API_URL;
@@ -638,37 +376,22 @@ function resolveControlPlaneCredentials(controlPlaneCredentials, credentials, au
 async function resolveTunnelsEngine(config) {
   const explicitEngine = trimOptionalString(config.engine);
   if (explicitEngine) {
-    return explicitEngine;
+    return normalizeEngineAddress(explicitEngine);
   }
   const environmentEngine = readEnvironment().engine;
   if (environmentEngine) {
-    return environmentEngine;
+    return normalizeEngineAddress(environmentEngine);
   }
   const token = trimOptionalString(config.token) ?? (isTokenCredentials(config.credentials) ? config.credentials.token : void 0);
-  const tokenEngine = getEngineFromToken(token);
-  if (tokenEngine) {
-    return tokenEngine;
-  }
   const projectEndpoint = trimOptionalString(config.projectEndpoint);
   if (projectEndpoint) {
-    const credentials = resolveControlPlaneCredentials(
-      config.controlPlaneCredentials,
-      config.credentials,
+    const project = await resolveManagedTunnelsProject({
+      ...config,
       token
-    );
-    if (credentials === void 0) {
-      throw new Error(
-        "Control-plane credentials are required to resolve a managed project endpoint."
-      );
-    }
-    const controlPlane = new RstreamClient({
-      apiUrl: resolveTunnelsAPIURL(config.apiUrl),
-      credentials
     });
-    const project = await controlPlane.tunnels.projects.resolveByEndpoint(projectEndpoint);
     const engine = getTunnelsProjectEngine(project);
     if (engine) {
-      return engine;
+      return normalizeEngineAddress(engine);
     }
     throw new Error(
       "Failed to resolve the engine address from the managed tunnels project."
@@ -678,8 +401,36 @@ async function resolveTunnelsEngine(config) {
     "Engine URL is not defined. Provide an engine, use RSTREAM_ENGINE, or configure a managed project endpoint with control-plane access."
   );
 }
+async function resolveManagedTunnelsProject(config) {
+  const projectEndpoint = trimOptionalString(config.projectEndpoint);
+  if (!projectEndpoint) {
+    throw new Error("Managed project endpoint is required.");
+  }
+  const credentials = resolveControlPlaneCredentials(
+    config.controlPlaneCredentials,
+    config.credentials,
+    config.token
+  );
+  if (credentials === void 0) {
+    throw new Error(
+      "Control-plane credentials are required to resolve a managed project endpoint."
+    );
+  }
+  const controlPlane = new RstreamClient({
+    apiUrl: resolveTunnelsAPIURL(config.apiUrl),
+    credentials
+  });
+  return await controlPlane.tunnels.projects.resolveByEndpoint(projectEndpoint);
+}
 
 // src/tunnels-resource.ts
+function tunnelPathId(id) {
+  const normalized = id.trim();
+  if (!normalized) {
+    throw new Error("Tunnel ID is required.");
+  }
+  return encodeURIComponent(normalized);
+}
 var RstreamTunnelsResource = class {
   client;
   constructor(client) {
@@ -693,65 +444,76 @@ var RstreamTunnelsResource = class {
     return listTunnelsResponseSchema.parse(response);
   }
   async get(id) {
-    const response = await this.client.request(`/tunnels/${id}`, {
-      method: "GET"
-    });
+    const response = await this.client.request(
+      `/tunnels/${tunnelPathId(id)}`,
+      {
+        method: "GET"
+      }
+    );
     return tunnelSchema.parse(response);
   }
 };
 
 // src/tunnels.ts
+import { getTunnelsProjectEngine as getTunnelsProjectEngine2 } from "@rstreamlabs/rstream";
 import { isClientCredentials as isClientCredentials3 } from "@rstreamlabs/rstream";
+import { readEnvironment as readEnvironment2 } from "@rstreamlabs/rstream";
 
 // src/turn.ts
 import { isClientCredentials as isClientCredentials2 } from "@rstreamlabs/rstream";
 import { isTokenCredentials as isTokenCredentials2 } from "@rstreamlabs/rstream";
 import { RstreamClient as RstreamClient2 } from "@rstreamlabs/rstream";
 import { turnCredentialsSchema } from "@rstreamlabs/rstream";
-import * as z7 from "zod";
+import * as z3 from "zod";
 import crypto from "crypto";
 var defaultTURNPort = 3478;
 var defaultTURNSPort = 5349;
-var defaultTURNCredentialTTLSeconds = 24 * 60 * 60;
-var turnTokenClaimsSchema = z7.object({
-  token_endpoint: z7.string().optional(),
-  type: z7.string()
+var defaultTURNCredentialTTLSeconds = 10 * 60;
+var maxTURNCredentialTTLSeconds = 60 * 60;
+var turnTokenClaimsSchema = z3.object({
+  exp: z3.number().int().optional(),
+  iat: z3.number().int().optional(),
+  token_endpoint: z3.string().regex(/^[0-9a-f]{8}$/i).optional(),
+  type: z3.enum(["app", "auth", "pat"])
 });
-var turnCredentialModeSchema = z7.enum(["api", "app", "pat"]);
-function normalizeOptionalString(value) {
+var turnCredentialModeSchema = z3.enum(["api", "app", "pat"]);
+function normalizeOptionalString2(value) {
   const normalized = value?.trim();
   return normalized ? normalized : void 0;
 }
 function normalizeClusterDomain(clusterDomain) {
-  const normalized = normalizeOptionalString(clusterDomain);
+  const normalized = normalizeOptionalString2(clusterDomain);
   return normalized?.toLowerCase();
 }
 function normalizeNow(now) {
-  if (now instanceof Date) {
-    return Math.floor(now.getTime() / 1e3);
+  if (now === void 0) {
+    return Math.floor(Date.now() / 1e3);
   }
-  if (typeof now === "number" && Number.isFinite(now)) {
-    return Math.floor(now);
+  const timestamp = now instanceof Date ? now.getTime() / 1e3 : now;
+  if (!Number.isFinite(timestamp)) {
+    throw new Error("TURN timestamp must be finite.");
   }
-  return Math.floor(Date.now() / 1e3);
+  return Math.floor(timestamp);
 }
 function normalizeTTLSeconds(ttlSeconds) {
-  if (typeof ttlSeconds === "number" && Number.isFinite(ttlSeconds) && ttlSeconds > 0) {
-    return Math.floor(ttlSeconds);
+  const ttl = ttlSeconds ?? defaultTURNCredentialTTLSeconds;
+  if (!Number.isInteger(ttl) || ttl < 1 || ttl > maxTURNCredentialTTLSeconds) {
+    throw new Error("TURN TTL must be an integer between 1 and 3600 seconds.");
   }
-  return defaultTURNCredentialTTLSeconds;
+  return ttl;
 }
-function normalizeTURNPort(port) {
-  if (typeof port === "number" && Number.isFinite(port) && port > 0) {
-    return Math.floor(port);
+function normalizePort(port, fallback, name) {
+  const normalized = port ?? fallback;
+  if (!Number.isInteger(normalized) || normalized < 1 || normalized > 65535) {
+    throw new Error(`${name} must be an integer between 1 and 65535.`);
   }
-  return defaultTURNPort;
+  return normalized;
+}
+function normalizeTURNPort(port) {
+  return normalizePort(port, defaultTURNPort, "TURN port");
 }
 function normalizeTURNSPort(port) {
-  if (typeof port === "number" && Number.isFinite(port) && port > 0) {
-    return Math.floor(port);
-  }
-  return defaultTURNSPort;
+  return normalizePort(port, defaultTURNSPort, "TURNS port");
 }
 function createTURNURLs(clusterDomain, turnPort, turnsPort) {
   const normalizedTURNPort = normalizeTURNPort(turnPort);
@@ -769,16 +531,32 @@ function parseTURNTokenClaims(token) {
   if (!payloadPart) {
     throw new Error("Invalid token format.");
   }
-  const payload = Buffer.from(payloadPart, "base64url").toString("utf8");
-  const parsed = turnTokenClaimsSchema.safeParse(JSON.parse(payload));
+  let decoded;
+  try {
+    const payload = Buffer.from(payloadPart, "base64url").toString("utf8");
+    decoded = JSON.parse(payload);
+  } catch {
+    throw new Error("Invalid token format.");
+  }
+  const parsed = turnTokenClaimsSchema.safeParse(decoded);
   if (!parsed.success) {
     throw new Error("Invalid token format.");
   }
   return parsed.data;
 }
+function requirePATExpiration(claims, now) {
+  const exp = claims.exp;
+  if (typeof exp !== "number") {
+    throw new Error("TURN PAT mode requires a PAT token with expiration.");
+  }
+  if (exp <= now) {
+    throw new Error("TURN PAT mode requires a non-expired PAT token.");
+  }
+  return exp;
+}
 function deriveClusterDomainFromEngine(projectEndpoint, engine) {
-  const normalizedProjectEndpoint = normalizeOptionalString(projectEndpoint);
-  const normalizedEngine = normalizeOptionalString(engine);
+  const normalizedProjectEndpoint = normalizeOptionalString2(projectEndpoint);
+  const normalizedEngine = normalizeOptionalString2(engine);
   if (!normalizedProjectEndpoint || !normalizedEngine) {
     throw new Error(
       "Failed to derive the cluster domain from the engine address."
@@ -812,17 +590,11 @@ function resolveMode(credentials, mode) {
   if (isClientCredentials2(credentials)) {
     return "app";
   }
-  if (isTokenCredentials2(credentials)) {
-    const claims = parseTURNTokenClaims(credentials.token);
-    if (claims.type === "pat" && normalizeOptionalString(claims.token_endpoint)) {
-      return "pat";
-    }
-  }
   return "api";
 }
 async function loadTURNServerPublicKeyHex(clusterDomain, options) {
-  const configuredKey = normalizeOptionalString(options.keyringBaseUrl);
-  const keyringBaseURL = configuredKey ?? normalizeOptionalString(options.apiUrl) ?? "https://rstream.io";
+  const configuredKey = normalizeOptionalString2(options.keyringBaseUrl);
+  const keyringBaseURL = configuredKey ?? normalizeOptionalString2(options.apiUrl) ?? "https://rstream.io";
   const url = new URL(
     `/keyrings/turn/${clusterDomain}.spki.der.hex`,
     keyringBaseURL
@@ -834,8 +606,8 @@ async function loadTURNServerPublicKeyHex(clusterDomain, options) {
   return (await response.text()).trim();
 }
 async function createAPITURNCredentials(options) {
-  const projectId = normalizeOptionalString(options.projectId);
-  const projectEndpoint = normalizeOptionalString(options.projectEndpoint);
+  const projectId = normalizeOptionalString2(options.projectId);
+  const projectEndpoint = normalizeOptionalString2(options.projectEndpoint);
   if (!projectId && !projectEndpoint) {
     throw new Error(
       "Project ID or project endpoint is required for TURN API mode."
@@ -862,11 +634,11 @@ function createPATTURNCredentials(options) {
   if (!clusterDomain) {
     throw new Error("Cluster domain is required for TURN PAT mode.");
   }
-  const projectEndpoint = normalizeOptionalString(options.projectEndpoint);
+  const projectEndpoint = normalizeOptionalString2(options.projectEndpoint);
   if (!projectEndpoint) {
     throw new Error("Project endpoint is required for TURN PAT mode.");
   }
-  const token = normalizeOptionalString(options.token);
+  const token = normalizeOptionalString2(options.token);
   if (!token) {
     throw new Error("Token is required for TURN PAT mode.");
   }
@@ -874,14 +646,17 @@ function createPATTURNCredentials(options) {
   if (claims.type !== "pat") {
     throw new Error("TURN PAT mode requires a PAT token.");
   }
-  const tokenEndpoint = normalizeOptionalString(claims.token_endpoint);
+  const tokenEndpoint = normalizeOptionalString2(options.tokenEndpoint);
   if (!tokenEndpoint) {
-    throw new Error(
-      "TURN PAT mode requires a PAT token carrying a token endpoint."
-    );
+    throw new Error("Token endpoint is required for TURN PAT mode.");
+  }
+  if (claims.token_endpoint !== void 0 && claims.token_endpoint !== tokenEndpoint) {
+    throw new Error("Token endpoint does not match the PAT token.");
   }
+  const now = normalizeNow(options.now);
   const ttlSeconds = normalizeTTLSeconds(options.ttlSeconds);
-  const exp = normalizeNow(options.now) + ttlSeconds;
+  const exp = Math.min(now + ttlSeconds, requirePATExpiration(claims, now));
+  const ttl = exp - now;
   const username = `v1:${exp}:pat:${projectEndpoint}:${tokenEndpoint}`;
   const tokenHash = crypto.createHash("sha256").update(token, "utf8").digest();
   const key = Buffer.from(
@@ -896,7 +671,7 @@ function createPATTURNCredentials(options) {
   const credential = crypto.createHmac("sha256", key).update(username, "utf8").digest("base64");
   return turnCredentialsSchema.parse({
     credential,
-    ttl: ttlSeconds,
+    ttl,
     urls: createTURNURLs(clusterDomain, options.turnPort, options.turnsPort),
     username
   });
@@ -906,15 +681,15 @@ async function createAPPTURNCredentials(options) {
   if (!clusterDomain) {
     throw new Error("Cluster domain is required for TURN APP mode.");
   }
-  const projectEndpoint = normalizeOptionalString(options.projectEndpoint);
+  const projectEndpoint = normalizeOptionalString2(options.projectEndpoint);
   if (!projectEndpoint) {
     throw new Error("Project endpoint is required for TURN APP mode.");
   }
-  const clientId = normalizeOptionalString(options.clientId);
+  const clientId = normalizeOptionalString2(options.clientId);
   if (!clientId) {
     throw new Error("Client ID is required for TURN APP mode.");
   }
-  const clientSecret = normalizeOptionalString(options.clientSecret);
+  const clientSecret = normalizeOptionalString2(options.clientSecret);
   if (!clientSecret) {
     throw new Error("Client secret is required for TURN APP mode.");
   }
@@ -926,7 +701,7 @@ async function createAPPTURNCredentials(options) {
     format: "der",
     type: "pkcs8"
   });
-  const serverPublicKeyHex = normalizeOptionalString(options.serverPublicKeyHex) ?? await loadTURNServerPublicKeyHex(clusterDomain, options);
+  const serverPublicKeyHex = normalizeOptionalString2(options.serverPublicKeyHex) ?? await loadTURNServerPublicKeyHex(clusterDomain, options);
   const serverPublicKey = crypto.createPublicKey({
     key: Buffer.from(serverPublicKeyHex, "hex"),
     format: "der",
@@ -956,7 +731,7 @@ async function createAPPTURNCredentials(options) {
 async function createTURNCredentials(options) {
   const credentials = options.credentials;
   const mode = resolveMode(credentials, options.mode);
-  const projectEndpoint = normalizeOptionalString(options.projectEndpoint);
+  const projectEndpoint = normalizeOptionalString2(options.projectEndpoint);
   if (mode === "api") {
     const controlPlaneCredentials = options.controlPlaneCredentials ?? credentials;
     if (!controlPlaneCredentials) {
@@ -987,6 +762,10 @@ async function createTURNCredentials(options) {
         "Project endpoint is required for TURN PAT mode."
       ),
       token: credentials.token,
+      tokenEndpoint: requireOption(
+        normalizeOptionalString2(options.tokenEndpoint),
+        "Token endpoint is required for TURN PAT mode."
+      ),
       ttlSeconds: options.ttlSeconds,
       turnPort: options.turnPort,
       turnsPort: options.turnsPort
@@ -1036,6 +815,7 @@ var RstreamTURNResource = class {
       projectEndpoint: options.projectEndpoint ?? this.client.projectEndpoint,
       projectId: options.projectId,
       serverPublicKeyHex: options.serverPublicKeyHex,
+      tokenEndpoint: options.tokenEndpoint,
       ttlSeconds: options.ttlSeconds,
       turnPort: options.turnPort,
       turnsPort: options.turnsPort
@@ -1045,6 +825,41 @@ var RstreamTURNResource = class {
 
 // src/webhooks-resource.ts
 import crypto2 from "crypto";
+var SIGNATURE_HEX_BYTES = 32;
+var signatureHexSchema = /^[0-9a-fA-F]{64}$/;
+var timestampSchema = /^\d+$/;
+function parseSignatureTimestamp(timestamp) {
+  if (!timestampSchema.test(timestamp)) {
+    throw new Error("Invalid signature timestamp");
+  }
+  const parsed = Number(timestamp);
+  if (!Number.isSafeInteger(parsed)) {
+    throw new Error("Invalid signature timestamp");
+  }
+  return parsed;
+}
+function normalizeTolerance(tolerance) {
+  if (!Number.isFinite(tolerance) || !Number.isInteger(tolerance) || tolerance < 0) {
+    throw new Error("Invalid signature tolerance");
+  }
+  return tolerance;
+}
+function readSignature(signature) {
+  if (!signatureHexSchema.test(signature)) {
+    return void 0;
+  }
+  const parsed = Buffer.from(signature, "hex");
+  return parsed.length === SIGNATURE_HEX_BYTES ? parsed : void 0;
+}
+function signatureMatches(signature, expected) {
+  const parsed = readSignature(signature);
+  return parsed === void 0 ? false : crypto2.timingSafeEqual(parsed, expected);
+}
+function assertSecretConfigured(secret) {
+  if (secret.trim().length === 0) {
+    throw new Error("Webhook signing secret is required");
+  }
+}
 var RstreamWebhookResource = class {
   async event(payload, header, secret, tolerance = 300, receivedAt = Date.now()) {
     const payloadBuffer = Buffer.isBuffer(payload) ? payload : Buffer.from(payload);
@@ -1052,31 +867,26 @@ var RstreamWebhookResource = class {
     if (!signatureHeader) {
       throw new Error("No signature header");
     }
+    assertSecretConfigured(secret);
     const elements = signatureHeader.split(",").map((element) => element.trim());
     const timestamp = elements.find((element) => element.startsWith("t="))?.substring(2);
     const signatures = elements.filter((element) => element.startsWith("v1=")).map((element) => element.substring(3));
     if (!timestamp || signatures.length === 0) {
       throw new Error("Invalid signature header format");
     }
-    const timestampNum = parseInt(timestamp, 10);
+    const timestampNum = parseSignatureTimestamp(timestamp);
+    const signatureTolerance = normalizeTolerance(tolerance);
     const now = Math.floor(receivedAt / 1e3);
-    if (Math.abs(now - timestampNum) > tolerance) {
+    if (Math.abs(now - timestampNum) > signatureTolerance) {
       throw new Error(
         `Webhook signature timestamp outside tolerance: ${now}, ${timestampNum}`
       );
     }
     const signedPayload = `${timestamp}.${payloadBuffer.toString("utf8")}`;
-    const expectedSignature = crypto2.createHmac("sha256", secret).update(signedPayload).digest("hex");
-    const signatureMatched = signatures.some((signature) => {
-      try {
-        return crypto2.timingSafeEqual(
-          Buffer.from(signature),
-          Buffer.from(expectedSignature)
-        );
-      } catch {
-        return false;
-      }
-    });
+    const expectedSignature = crypto2.createHmac("sha256", secret).update(signedPayload).digest();
+    const signatureMatched = signatures.some(
+      (signature) => signatureMatches(signature, expectedSignature)
+    );
     if (!signatureMatched) {
       throw new Error("Signature verification failed");
     }
@@ -1094,8 +904,16 @@ var RstreamWebhookResource = class {
 };
 
 // src/tunnels.ts
+var engineAuthTokenScopes = {
+  tunnels: {
+    connect: true,
+    create: true,
+    list: true
+  }
+};
 var RstreamTunnelsClient = class {
   config;
+  managedProject;
   constructor(config) {
     this.config = config;
   }
@@ -1115,6 +933,21 @@ var RstreamTunnelsClient = class {
     return this.config?.projectEndpoint;
   }
   async getEngine() {
+    const projectEndpoint = normalizeOptionalString3(
+      this.config?.projectEndpoint
+    );
+    if (projectEndpoint !== void 0 && normalizeOptionalString3(this.config?.engine) === void 0 && readEnvironment2().engine === void 0) {
+      const project = await this.getManagedProject();
+      if (project !== void 0) {
+        const engine = getTunnelsProjectEngine2(project);
+        if (engine) {
+          return normalizeEngineAddress(engine);
+        }
+      }
+      throw new Error(
+        "Failed to resolve the engine address from the managed tunnels project."
+      );
+    }
     return await resolveTunnelsEngine({
       apiUrl: this.config?.apiUrl,
       controlPlaneCredentials: this.controlPlaneCredentials,
@@ -1123,6 +956,57 @@ var RstreamTunnelsClient = class {
       projectEndpoint: this.config?.projectEndpoint
     });
   }
+  async getManagedProject() {
+    const projectEndpoint = normalizeOptionalString3(
+      this.config?.projectEndpoint
+    );
+    if (projectEndpoint === void 0) {
+      return void 0;
+    }
+    if (this.managedProject === void 0) {
+      this.managedProject = resolveManagedTunnelsProject({
+        apiUrl: this.config?.apiUrl,
+        controlPlaneCredentials: this.controlPlaneCredentials,
+        credentials: this.credentials,
+        projectEndpoint
+      }).catch((error) => {
+        this.managedProject = void 0;
+        throw error;
+      });
+    }
+    return await this.managedProject;
+  }
+  async getEngineAuthTokenParams() {
+    const target = await this.getEngineAuthTokenTarget();
+    return {
+      tunnelsGrants: [
+        {
+          ...target,
+          scopes: engineAuthTokenScopes
+        }
+      ]
+    };
+  }
+  async getEngineAuthTokenTarget() {
+    const projectId = normalizeOptionalString3(this.config?.projectId);
+    const workspaceId = normalizeOptionalString3(this.config?.workspaceId);
+    if (projectId !== void 0 && workspaceId !== void 0) {
+      throw new Error("Use either projectId or workspaceId, not both.");
+    }
+    if (projectId !== void 0) {
+      return { projects: [projectId] };
+    }
+    if (workspaceId !== void 0) {
+      return { workspaces: [workspaceId] };
+    }
+    const project = await this.getManagedProject();
+    if (project !== void 0) {
+      return { projects: [project.id] };
+    }
+    throw new Error(
+      "Application credentials require projectId, workspaceId, or projectEndpoint to create scoped engine tokens."
+    );
+  }
   get auth() {
     return new RstreamAuthResource(this);
   }
@@ -1146,13 +1030,17 @@ var RstreamTunnelsClient = class {
     if (!isClientCredentials3(credentials)) {
       return credentials.token;
     }
-    return (await this.auth.createAuthToken(void 0, {
+    const tokenParams = await this.getEngineAuthTokenParams();
+    return (await this.auth.createAuthToken(tokenParams, {
       credentials,
       engine
     })).token;
   }
   async request(path, options) {
-    const engine = await this.getEngine();
+    const engine = normalizeEngineAddress(await this.getEngine());
+    if (!path.startsWith("/") || path.startsWith("//")) {
+      throw new Error("Engine request path must be a relative absolute path.");
+    }
     const url = `https://${engine}/api${path}`;
     const headers = new Headers(options?.headers || {});
     const token = await this.getToken(engine);
@@ -1161,7 +1049,8 @@ var RstreamTunnelsClient = class {
     }
     const response = await fetch(url, {
       ...options,
-      headers
+      headers,
+      redirect: options?.redirect ?? "manual"
     });
     if (!response.ok) {
       const errorText = await response.text();
@@ -1170,8 +1059,68 @@ var RstreamTunnelsClient = class {
     return await response.json();
   }
 };
+function normalizeOptionalString3(value) {
+  const normalized = value?.trim();
+  return normalized ? normalized : void 0;
+}
 
 // src/watch.ts
+import jwt from "jsonwebtoken";
+var maxWatchTokenLifetimeSeconds = 3600;
+var watchTokenIssuedAtSkewSeconds = 300;
+function normalizeTransport(transport) {
+  if (transport === void 0) {
+    return "sse";
+  }
+  if (transport === "sse" || transport === "websocket") {
+    return transport;
+  }
+  throw new Error("Watch: Unsupported transport.");
+}
+function validateWatchQueryToken(token) {
+  const parsed = authTokenSchema.safeParse(jwt.decode(token));
+  if (!parsed.success || parsed.data.type === "pat") {
+    throw new Error(
+      "Watch requires a short-lived auth or app token for URL-based authentication."
+    );
+  }
+  const iat = parsed.data.iat;
+  const exp = parsed.data.exp;
+  const now = Math.floor(Date.now() / 1e3);
+  if (typeof iat !== "number" || typeof exp !== "number" || !Number.isInteger(iat) || !Number.isInteger(exp) || exp <= iat || exp <= now || exp > now + maxWatchTokenLifetimeSeconds || iat > now + watchTokenIssuedAtSkewSeconds || exp - iat > maxWatchTokenLifetimeSeconds) {
+    throw new Error(
+      "Watch requires a token with a bounded lifetime of at most 3600 seconds."
+    );
+  }
+  if (!hasWatchOnlyTunnelGrants(parsed.data)) {
+    throw new Error(
+      "Watch requires a fine-grained token limited to tunnel list grants for URL-based authentication."
+    );
+  }
+}
+function hasWatchOnlyTunnelGrants(token) {
+  if (!hasWatchOnlyPermissions(token.permissions)) {
+    return false;
+  }
+  if (!Array.isArray(token.tunnelsGrants) || token.tunnelsGrants.length === 0) {
+    return false;
+  }
+  return token.tunnelsGrants.every((grant) => {
+    const tunnels = grant.scopes?.tunnels;
+    if (tunnels === void 0) {
+      return false;
+    }
+    return tunnels.list !== void 0 && tunnels.create === void 0 && tunnels.connect === void 0;
+  });
+}
+function hasWatchOnlyPermissions(permissions) {
+  if (!Array.isArray(permissions)) {
+    return true;
+  }
+  return permissions.every(
+    (permission) => permission === "tunnels.resources.read-only" || permission === "network.resources.read-only"
+  );
+}
 var Watch = class {
   connection = null;
   connectionState = "preparing";
@@ -1186,45 +1135,56 @@ var Watch = class {
       throw new Error("Watch: Connection already started or closed.");
     }
     this.connectionState = "connecting";
-    const token = typeof this.config.auth === "function" ? await this.config.auth() : this.config.auth;
-    const engine = await resolveTunnelsEngine({
-      apiUrl: this.config.apiUrl,
-      controlPlaneCredentials: this.config.controlPlaneCredentials,
-      engine: this.config.engine,
-      projectEndpoint: this.config.projectEndpoint,
-      token
-    });
-    const transport = this.config.transport ?? "sse";
-    const base = `https://${engine}`;
-    if (transport === "sse") {
-      const url = new URL(`/api/sse`, base);
-      url.searchParams.set("rstream.token", token);
-      this.connection = new EventSource(url.toString());
-    } else {
-      const url = new URL(`/api/websocket`, base);
-      url.searchParams.set("rstream.token", token);
-      url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-      this.connection = new WebSocket(url.toString());
-    }
-    this.connection.onopen = () => {
-      this.connectionState = "connected";
-      this.events.onConnect?.();
-    };
-    this.connection.onmessage = (msg) => {
-      const parsed = wsEventsSchema.parse(JSON.parse(msg.data));
-      this.events.onEvent?.(parsed);
-    };
-    this.connection.onerror = () => {
-      if (this.connectionState !== "closed") {
-        this.disconnect();
+    try {
+      const token = typeof this.config.auth === "function" ? await this.config.auth() : this.config.auth;
+      validateWatchQueryToken(token);
+      const engine = await resolveTunnelsEngine({
+        apiUrl: this.config.apiUrl,
+        controlPlaneCredentials: this.config.controlPlaneCredentials,
+        engine: this.config.engine,
+        projectEndpoint: this.config.projectEndpoint,
+        token
+      });
+      const transport = normalizeTransport(this.config.transport);
+      const base = `https://${engine}`;
+      if (transport === "sse") {
+        const url = new URL(`/api/sse`, base);
+        url.searchParams.set("rstream.token", token);
+        this.connection = new EventSource(url.toString());
+      } else {
+        const url = new URL(`/api/websocket`, base);
+        url.searchParams.set("rstream.token", token);
+        url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+        this.connection = new WebSocket(url.toString());
       }
-    };
-    if (this.connection instanceof WebSocket) {
-      this.connection.onclose = () => {
+      this.connection.onopen = () => {
+        this.connectionState = "connected";
+        this.events.onConnect?.();
+      };
+      this.connection.onmessage = (msg) => this.handleMessage(msg.data);
+      this.connection.onerror = () => {
         if (this.connectionState !== "closed") {
           this.disconnect();
         }
       };
+      if (this.connection instanceof WebSocket) {
+        this.connection.onclose = () => {
+          if (this.connectionState !== "closed") {
+            this.disconnect();
+          }
+        };
+      }
+    } catch (error) {
+      this.connectionState = "preparing";
+      throw error;
+    }
+  }
+  handleMessage(data) {
+    try {
+      const parsed = wsEventsSchema.parse(JSON.parse(data));
+      this.events.onEvent?.(parsed);
+    } catch {
+      this.disconnect();
     }
   }
   disconnect() {
@@ -1243,7 +1203,7 @@ var Watch = class {
 };
 
 // src/webtty.ts
-import * as z8 from "zod";
+import * as z4 from "zod";
 var osFamilies = [
   "linux",
   "macos",
@@ -1252,25 +1212,25 @@ var osFamilies = [
   "openbsd",
   "freebsd"
 ];
-var webttyServerSchema = z8.object({
-  tunnel_id: z8.string(),
-  host: z8.string(),
-  token_auth: z8.boolean(),
-  os_family: z8.enum(osFamilies).optional(),
-  arch: z8.string().optional(),
-  os_id: z8.string().optional(),
+var webttyServerSchema = z4.object({
+  tunnel_id: z4.string(),
+  host: z4.string(),
+  token_auth: z4.boolean(),
+  os_family: z4.enum(osFamilies).optional(),
+  arch: z4.string().optional(),
+  os_id: z4.string().optional(),
   // /etc/os-release::ID (ubuntu, debian, rocky, etc.)
-  os_version_id: z8.string().optional(),
+  os_version_id: z4.string().optional(),
   // /etc/os-release::VERSION_ID (24.04, 22.04, 11, 10.0.19045, ...)
-  os_version_codename: z8.string().optional(),
+  os_version_codename: z4.string().optional(),
   // /etc/os-release::VERSION_CODENAME (jammy, noble...)
-  os_pretty_name: z8.string().optional(),
+  os_pretty_name: z4.string().optional(),
   // /etc/os-release::PRETTY_NAME
-  kernel_release: z8.string().optional(),
+  kernel_release: z4.string().optional(),
   // uname -r
-  hostname: z8.string().optional(),
+  hostname: z4.string().optional(),
   // uname -n
-  labels: z8.record(z8.string(), z8.string().optional()).optional()
+  labels: z4.record(z4.string(), z4.string().optional()).optional()
 });
 function parser(tunnel) {
   if (tunnel.status !== "online") return null;
@@ -1327,6 +1287,7 @@ export {
   authTokenScopesSchema,
   authTokenTunnelGrantSchema,
   authTokenTunnelsScopesSchema,
+  clientFilterSchema,
   clientSchema,
   createAPITURNCredentials,
   createAPPTURNCredentials,
@@ -1335,14 +1296,18 @@ export {
   createAuthTokenResponseSchema,
   createPATTURNCredentials,
   createTURNCredentials,
+  engineOpenApiDocument,
+  engineOpenApiJson,
   eventSchema,
   formatTunnelHost,
   listClientsParamsSchema,
   listClientsResponseSchema,
   listTunnelsParamsSchema,
   listTunnelsResponseSchema,
+  normalizeEngineAddress,
   parseWebTTYServers,
   resolveControlPlaneCredentials,
+  resolveManagedTunnelsProject,
   resolveTunnelsAPIURL,
   resolveTunnelsCredentials,
   resolveTunnelsEngine,
@@ -1350,6 +1315,7 @@ export {
   streamSummarySchema,
   streamTLSInfoSchema,
   tokenSchema,
+  tunnelFilterSchema,
   tunnelSchema,
   turnCredentialModeSchema,
   webhookEventsSchema,