@rstreamlabs/tunnels 1.0.7 → 1.0.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -45,6 +45,10 @@ const turn = await client.turn.createCredentials();
45
45
  `clientSecret`. This is the intended backend flow when you want the server to
46
46
  mint short-lived tokens for downstream clients.
47
47
 
48
+ Managed `projectEndpoint` clients mint engine tokens restricted to the resolved
49
+ project. Explicit `engine` clients using application credentials must provide
50
+ `projectId` or `workspaceId` so locally signed engine tokens are not global.
51
+
48
52
  ```ts
49
53
  import { RstreamTunnelsClient } from "@rstreamlabs/tunnels";
50
54
 
@@ -56,13 +60,14 @@ const client = new RstreamTunnelsClient({
56
60
  projectEndpoint: "project-endpoint",
57
61
  });
58
62
 
59
- const { token } = await client.auth.createAuthToken({ expires_in: 60 });
63
+ const tunnels = await client.tunnels.list();
60
64
  ```
61
65
 
62
66
  ## Fine-Grained Tokens
63
67
 
64
- Use `scopes` for a global grant, or `tunnelsGrants` when the token must be restricted
65
- to specific workspaces or projects.
68
+ Prefer `tunnelsGrants` with explicit `projects` or `workspaces`. Scope-only
69
+ requests require a `projectId` or `workspaceId` option and are converted to
70
+ targeted grants.
66
71
 
67
72
  ```ts
68
73
  import { RstreamTunnelsClient } from "@rstreamlabs/tunnels";
@@ -513,12 +513,6 @@ var engineOpenApiDocument = {
513
513
  scheme: "bearer",
514
514
  bearerFormat: "rstream token",
515
515
  description: "Preferred authentication mechanism. Send an OAuth-issued rstream access token or compatible rstream credential in Authorization: Bearer <token>."
516
- },
517
- queryToken: {
518
- type: "apiKey",
519
- in: "query",
520
- name: "rstream.token",
521
- description: "Fallback authentication mechanism for transports where setting Authorization is impractical. Prefer bearerAuth whenever possible."
522
516
  }
523
517
  },
524
518
  parameters: {
@@ -638,7 +632,7 @@ var engineOpenApiDocument = {
638
632
  summary: "List visible engine clients.",
639
633
  operationId: "list_engine_clients",
640
634
  parameters: [{ $ref: "#/components/parameters/ListClientsParams" }],
641
- security: [{ bearerAuth: [] }, { queryToken: [] }],
635
+ security: [{ bearerAuth: [] }],
642
636
  responses: {
643
637
  "200": jsonArrayResponse(
644
638
  "Visible clients.",
@@ -657,7 +651,7 @@ var engineOpenApiDocument = {
657
651
  summary: "List visible engine tunnels.",
658
652
  operationId: "list_engine_tunnels",
659
653
  parameters: [{ $ref: "#/components/parameters/ListTunnelsParams" }],
660
- security: [{ bearerAuth: [] }, { queryToken: [] }],
654
+ security: [{ bearerAuth: [] }],
661
655
  responses: {
662
656
  "200": jsonArrayResponse(
663
657
  "Visible tunnels. Fine-grained list scopes may filter objects and project fields.",
@@ -677,7 +671,7 @@ var engineOpenApiDocument = {
677
671
  summary: "Subscribe to visible engine state through Server-Sent Events.",
678
672
  operationId: "watch_engine_events_sse",
679
673
  parameters: [{ $ref: "#/components/parameters/WatchParams" }],
680
- security: [{ bearerAuth: [] }, { queryToken: [] }],
674
+ security: [{ bearerAuth: [] }],
681
675
  responses: {
682
676
  "200": streamResponse(
683
677
  "SSE stream. Each event is emitted as a data line containing a JSON Event object."
@@ -696,7 +690,7 @@ var engineOpenApiDocument = {
696
690
  summary: "Subscribe to visible engine state through a WebSocket upgrade.",
697
691
  operationId: "watch_engine_events_websocket",
698
692
  parameters: [{ $ref: "#/components/parameters/WatchParams" }],
699
- security: [{ bearerAuth: [] }, { queryToken: [] }],
693
+ security: [{ bearerAuth: [] }],
700
694
  responses: {
701
695
  "101": {
702
696
  description: "WebSocket connection accepted. Frames contain JSON Event objects."
package/dist/index.d.mts CHANGED
@@ -1,15 +1,15 @@
1
- import { RstreamCredentials, TURNCredentials, ClientCredentials } from '@rstreamlabs/rstream';
1
+ import { RstreamCredentials, TURNCredentials, ClientCredentials, TunnelsProject } from '@rstreamlabs/rstream';
2
2
  import * as z from 'zod';
3
3
  import { JwtPayload } from 'jsonwebtoken';
4
4
  export { engineOpenApiDocument, engineOpenApiJson } from './openapi.mjs';
5
5
 
6
6
  declare const StringFilter: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
7
7
  exact: z.ZodString;
8
- }, z.core.$strip>, z.ZodObject<{
8
+ }, z.core.$strict>, z.ZodObject<{
9
9
  oneof: z.ZodArray<z.ZodString>;
10
- }, z.core.$strip>, z.ZodObject<{
10
+ }, z.core.$strict>, z.ZodObject<{
11
11
  regex: z.ZodString;
12
- }, z.core.$strip>]>;
12
+ }, z.core.$strict>]>;
13
13
  type Schema = z.core.SomeType;
14
14
  type Shape = z.ZodRawShape;
15
15
  type RecordKey = z.core.$ZodRecordKey;
@@ -106,7 +106,7 @@ declare const authTokenTunnelsScopesSchema: z.ZodObject<{
106
106
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
107
107
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
108
108
  }>, unknown>>>;
109
- }, z.core.$strip>]>>;
109
+ }, z.core.$strict>]>>;
110
110
  connect: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
111
111
  filters: z.ZodOptional<z.ZodType<FilterNode<{
112
112
  client_id: z.ZodString;
@@ -220,7 +220,7 @@ declare const authTokenTunnelsScopesSchema: z.ZodObject<{
220
220
  }>, unknown, z.core.$ZodTypeInternals<FilterNode<{
221
221
  path: z.ZodOptional<z.ZodString>;
222
222
  }>, unknown>>>;
223
- }, z.core.$strip>]>>;
223
+ }, z.core.$strict>]>>;
224
224
  list: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
225
225
  filters: z.ZodOptional<z.ZodType<FilterNode<{
226
226
  client_id: z.ZodString;
@@ -364,8 +364,8 @@ declare const authTokenTunnelsScopesSchema: z.ZodObject<{
364
364
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
365
365
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
366
366
  }, z.core.$strip>>;
367
- }, z.core.$strip>]>>;
368
- }, z.core.$strip>;
367
+ }, z.core.$strict>]>>;
368
+ }, z.core.$strict>;
369
369
  declare const authTokenScopesSchema: z.ZodObject<{
370
370
  tunnels: z.ZodOptional<z.ZodObject<{
371
371
  create: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
@@ -448,7 +448,7 @@ declare const authTokenScopesSchema: z.ZodObject<{
448
448
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
449
449
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
450
450
  }>, unknown>>>;
451
- }, z.core.$strip>]>>;
451
+ }, z.core.$strict>]>>;
452
452
  connect: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
453
453
  filters: z.ZodOptional<z.ZodType<FilterNode<{
454
454
  client_id: z.ZodString;
@@ -562,7 +562,7 @@ declare const authTokenScopesSchema: z.ZodObject<{
562
562
  }>, unknown, z.core.$ZodTypeInternals<FilterNode<{
563
563
  path: z.ZodOptional<z.ZodString>;
564
564
  }>, unknown>>>;
565
- }, z.core.$strip>]>>;
565
+ }, z.core.$strict>]>>;
566
566
  list: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
567
567
  filters: z.ZodOptional<z.ZodType<FilterNode<{
568
568
  client_id: z.ZodString;
@@ -706,13 +706,13 @@ declare const authTokenScopesSchema: z.ZodObject<{
706
706
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
707
707
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
708
708
  }, z.core.$strip>>;
709
- }, z.core.$strip>]>>;
710
- }, z.core.$strip>>;
711
- }, z.core.$strip>;
709
+ }, z.core.$strict>]>>;
710
+ }, z.core.$strict>>;
711
+ }, z.core.$strict>;
712
712
  declare const authTokenTunnelGrantSchema: z.ZodObject<{
713
713
  workspaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
714
714
  projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
715
- scopes: z.ZodOptional<z.ZodObject<{
715
+ scopes: z.ZodObject<{
716
716
  tunnels: z.ZodOptional<z.ZodObject<{
717
717
  create: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
718
718
  filters: z.ZodOptional<z.ZodType<FilterNode<{
@@ -794,7 +794,7 @@ declare const authTokenTunnelGrantSchema: z.ZodObject<{
794
794
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
795
795
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
796
796
  }>, unknown>>>;
797
- }, z.core.$strip>]>>;
797
+ }, z.core.$strict>]>>;
798
798
  connect: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
799
799
  filters: z.ZodOptional<z.ZodType<FilterNode<{
800
800
  client_id: z.ZodString;
@@ -908,7 +908,7 @@ declare const authTokenTunnelGrantSchema: z.ZodObject<{
908
908
  }>, unknown, z.core.$ZodTypeInternals<FilterNode<{
909
909
  path: z.ZodOptional<z.ZodString>;
910
910
  }>, unknown>>>;
911
- }, z.core.$strip>]>>;
911
+ }, z.core.$strict>]>>;
912
912
  list: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
913
913
  filters: z.ZodOptional<z.ZodType<FilterNode<{
914
914
  client_id: z.ZodString;
@@ -1052,9 +1052,9 @@ declare const authTokenTunnelGrantSchema: z.ZodObject<{
1052
1052
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
1053
1053
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
1054
1054
  }, z.core.$strip>>;
1055
- }, z.core.$strip>]>>;
1056
- }, z.core.$strip>>;
1057
- }, z.core.$strip>>;
1055
+ }, z.core.$strict>]>>;
1056
+ }, z.core.$strict>>;
1057
+ }, z.core.$strict>;
1058
1058
  }, z.core.$strict>;
1059
1059
  declare const authTokenSchema: z.ZodUnion<readonly [z.ZodObject<{
1060
1060
  aud: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
@@ -1062,7 +1062,7 @@ declare const authTokenSchema: z.ZodUnion<readonly [z.ZodObject<{
1062
1062
  tunnelsGrants: z.ZodOptional<z.ZodArray<z.ZodObject<{
1063
1063
  workspaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
1064
1064
  projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
1065
- scopes: z.ZodOptional<z.ZodObject<{
1065
+ scopes: z.ZodObject<{
1066
1066
  tunnels: z.ZodOptional<z.ZodObject<{
1067
1067
  create: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
1068
1068
  filters: z.ZodOptional<z.ZodType<FilterNode<{
@@ -1144,7 +1144,7 @@ declare const authTokenSchema: z.ZodUnion<readonly [z.ZodObject<{
1144
1144
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
1145
1145
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
1146
1146
  }>, unknown>>>;
1147
- }, z.core.$strip>]>>;
1147
+ }, z.core.$strict>]>>;
1148
1148
  connect: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
1149
1149
  filters: z.ZodOptional<z.ZodType<FilterNode<{
1150
1150
  client_id: z.ZodString;
@@ -1258,7 +1258,7 @@ declare const authTokenSchema: z.ZodUnion<readonly [z.ZodObject<{
1258
1258
  }>, unknown, z.core.$ZodTypeInternals<FilterNode<{
1259
1259
  path: z.ZodOptional<z.ZodString>;
1260
1260
  }>, unknown>>>;
1261
- }, z.core.$strip>]>>;
1261
+ }, z.core.$strict>]>>;
1262
1262
  list: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
1263
1263
  filters: z.ZodOptional<z.ZodType<FilterNode<{
1264
1264
  client_id: z.ZodString;
@@ -1402,9 +1402,9 @@ declare const authTokenSchema: z.ZodUnion<readonly [z.ZodObject<{
1402
1402
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
1403
1403
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
1404
1404
  }, z.core.$strip>>;
1405
- }, z.core.$strip>]>>;
1406
- }, z.core.$strip>>;
1407
- }, z.core.$strip>>;
1405
+ }, z.core.$strict>]>>;
1406
+ }, z.core.$strict>>;
1407
+ }, z.core.$strict>;
1408
1408
  }, z.core.$strict>>>;
1409
1409
  iat: z.ZodOptional<z.ZodNumber>;
1410
1410
  iss: z.ZodOptional<z.ZodString>;
@@ -1423,7 +1423,7 @@ declare const authTokenSchema: z.ZodUnion<readonly [z.ZodObject<{
1423
1423
  tunnelsGrants: z.ZodOptional<z.ZodArray<z.ZodObject<{
1424
1424
  workspaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
1425
1425
  projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
1426
- scopes: z.ZodOptional<z.ZodObject<{
1426
+ scopes: z.ZodObject<{
1427
1427
  tunnels: z.ZodOptional<z.ZodObject<{
1428
1428
  create: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
1429
1429
  filters: z.ZodOptional<z.ZodType<FilterNode<{
@@ -1505,7 +1505,7 @@ declare const authTokenSchema: z.ZodUnion<readonly [z.ZodObject<{
1505
1505
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
1506
1506
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
1507
1507
  }>, unknown>>>;
1508
- }, z.core.$strip>]>>;
1508
+ }, z.core.$strict>]>>;
1509
1509
  connect: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
1510
1510
  filters: z.ZodOptional<z.ZodType<FilterNode<{
1511
1511
  client_id: z.ZodString;
@@ -1619,7 +1619,7 @@ declare const authTokenSchema: z.ZodUnion<readonly [z.ZodObject<{
1619
1619
  }>, unknown, z.core.$ZodTypeInternals<FilterNode<{
1620
1620
  path: z.ZodOptional<z.ZodString>;
1621
1621
  }>, unknown>>>;
1622
- }, z.core.$strip>]>>;
1622
+ }, z.core.$strict>]>>;
1623
1623
  list: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
1624
1624
  filters: z.ZodOptional<z.ZodType<FilterNode<{
1625
1625
  client_id: z.ZodString;
@@ -1763,9 +1763,9 @@ declare const authTokenSchema: z.ZodUnion<readonly [z.ZodObject<{
1763
1763
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
1764
1764
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
1765
1765
  }, z.core.$strip>>;
1766
- }, z.core.$strip>]>>;
1767
- }, z.core.$strip>>;
1768
- }, z.core.$strip>>;
1766
+ }, z.core.$strict>]>>;
1767
+ }, z.core.$strict>>;
1768
+ }, z.core.$strict>;
1769
1769
  }, z.core.$strict>>>;
1770
1770
  iat: z.ZodOptional<z.ZodNumber>;
1771
1771
  iss: z.ZodOptional<z.ZodString>;
@@ -1783,7 +1783,7 @@ declare const authTokenSchema: z.ZodUnion<readonly [z.ZodObject<{
1783
1783
  tunnelsGrants: z.ZodOptional<z.ZodArray<z.ZodObject<{
1784
1784
  workspaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
1785
1785
  projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
1786
- scopes: z.ZodOptional<z.ZodObject<{
1786
+ scopes: z.ZodObject<{
1787
1787
  tunnels: z.ZodOptional<z.ZodObject<{
1788
1788
  create: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
1789
1789
  filters: z.ZodOptional<z.ZodType<FilterNode<{
@@ -1865,7 +1865,7 @@ declare const authTokenSchema: z.ZodUnion<readonly [z.ZodObject<{
1865
1865
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
1866
1866
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
1867
1867
  }>, unknown>>>;
1868
- }, z.core.$strip>]>>;
1868
+ }, z.core.$strict>]>>;
1869
1869
  connect: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
1870
1870
  filters: z.ZodOptional<z.ZodType<FilterNode<{
1871
1871
  client_id: z.ZodString;
@@ -1979,7 +1979,7 @@ declare const authTokenSchema: z.ZodUnion<readonly [z.ZodObject<{
1979
1979
  }>, unknown, z.core.$ZodTypeInternals<FilterNode<{
1980
1980
  path: z.ZodOptional<z.ZodString>;
1981
1981
  }>, unknown>>>;
1982
- }, z.core.$strip>]>>;
1982
+ }, z.core.$strict>]>>;
1983
1983
  list: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
1984
1984
  filters: z.ZodOptional<z.ZodType<FilterNode<{
1985
1985
  client_id: z.ZodString;
@@ -2123,9 +2123,9 @@ declare const authTokenSchema: z.ZodUnion<readonly [z.ZodObject<{
2123
2123
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
2124
2124
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
2125
2125
  }, z.core.$strip>>;
2126
- }, z.core.$strip>]>>;
2127
- }, z.core.$strip>>;
2128
- }, z.core.$strip>>;
2126
+ }, z.core.$strict>]>>;
2127
+ }, z.core.$strict>>;
2128
+ }, z.core.$strict>;
2129
2129
  }, z.core.$strict>>>;
2130
2130
  iat: z.ZodOptional<z.ZodNumber>;
2131
2131
  iss: z.ZodOptional<z.ZodString>;
@@ -2145,7 +2145,7 @@ declare const tokenSchema: z.ZodUnion<readonly [z.ZodObject<{
2145
2145
  tunnelsGrants: z.ZodOptional<z.ZodArray<z.ZodObject<{
2146
2146
  workspaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
2147
2147
  projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
2148
- scopes: z.ZodOptional<z.ZodObject<{
2148
+ scopes: z.ZodObject<{
2149
2149
  tunnels: z.ZodOptional<z.ZodObject<{
2150
2150
  create: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
2151
2151
  filters: z.ZodOptional<z.ZodType<FilterNode<{
@@ -2227,7 +2227,7 @@ declare const tokenSchema: z.ZodUnion<readonly [z.ZodObject<{
2227
2227
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
2228
2228
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
2229
2229
  }>, unknown>>>;
2230
- }, z.core.$strip>]>>;
2230
+ }, z.core.$strict>]>>;
2231
2231
  connect: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
2232
2232
  filters: z.ZodOptional<z.ZodType<FilterNode<{
2233
2233
  client_id: z.ZodString;
@@ -2341,7 +2341,7 @@ declare const tokenSchema: z.ZodUnion<readonly [z.ZodObject<{
2341
2341
  }>, unknown, z.core.$ZodTypeInternals<FilterNode<{
2342
2342
  path: z.ZodOptional<z.ZodString>;
2343
2343
  }>, unknown>>>;
2344
- }, z.core.$strip>]>>;
2344
+ }, z.core.$strict>]>>;
2345
2345
  list: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
2346
2346
  filters: z.ZodOptional<z.ZodType<FilterNode<{
2347
2347
  client_id: z.ZodString;
@@ -2485,9 +2485,9 @@ declare const tokenSchema: z.ZodUnion<readonly [z.ZodObject<{
2485
2485
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
2486
2486
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
2487
2487
  }, z.core.$strip>>;
2488
- }, z.core.$strip>]>>;
2489
- }, z.core.$strip>>;
2490
- }, z.core.$strip>>;
2488
+ }, z.core.$strict>]>>;
2489
+ }, z.core.$strict>>;
2490
+ }, z.core.$strict>;
2491
2491
  }, z.core.$strict>>>;
2492
2492
  iat: z.ZodOptional<z.ZodNumber>;
2493
2493
  iss: z.ZodOptional<z.ZodString>;
@@ -2506,7 +2506,7 @@ declare const tokenSchema: z.ZodUnion<readonly [z.ZodObject<{
2506
2506
  tunnelsGrants: z.ZodOptional<z.ZodArray<z.ZodObject<{
2507
2507
  workspaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
2508
2508
  projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
2509
- scopes: z.ZodOptional<z.ZodObject<{
2509
+ scopes: z.ZodObject<{
2510
2510
  tunnels: z.ZodOptional<z.ZodObject<{
2511
2511
  create: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
2512
2512
  filters: z.ZodOptional<z.ZodType<FilterNode<{
@@ -2588,7 +2588,7 @@ declare const tokenSchema: z.ZodUnion<readonly [z.ZodObject<{
2588
2588
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
2589
2589
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
2590
2590
  }>, unknown>>>;
2591
- }, z.core.$strip>]>>;
2591
+ }, z.core.$strict>]>>;
2592
2592
  connect: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
2593
2593
  filters: z.ZodOptional<z.ZodType<FilterNode<{
2594
2594
  client_id: z.ZodString;
@@ -2702,7 +2702,7 @@ declare const tokenSchema: z.ZodUnion<readonly [z.ZodObject<{
2702
2702
  }>, unknown, z.core.$ZodTypeInternals<FilterNode<{
2703
2703
  path: z.ZodOptional<z.ZodString>;
2704
2704
  }>, unknown>>>;
2705
- }, z.core.$strip>]>>;
2705
+ }, z.core.$strict>]>>;
2706
2706
  list: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
2707
2707
  filters: z.ZodOptional<z.ZodType<FilterNode<{
2708
2708
  client_id: z.ZodString;
@@ -2846,9 +2846,9 @@ declare const tokenSchema: z.ZodUnion<readonly [z.ZodObject<{
2846
2846
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
2847
2847
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
2848
2848
  }, z.core.$strip>>;
2849
- }, z.core.$strip>]>>;
2850
- }, z.core.$strip>>;
2851
- }, z.core.$strip>>;
2849
+ }, z.core.$strict>]>>;
2850
+ }, z.core.$strict>>;
2851
+ }, z.core.$strict>;
2852
2852
  }, z.core.$strict>>>;
2853
2853
  iat: z.ZodOptional<z.ZodNumber>;
2854
2854
  iss: z.ZodOptional<z.ZodString>;
@@ -2866,7 +2866,7 @@ declare const tokenSchema: z.ZodUnion<readonly [z.ZodObject<{
2866
2866
  tunnelsGrants: z.ZodOptional<z.ZodArray<z.ZodObject<{
2867
2867
  workspaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
2868
2868
  projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
2869
- scopes: z.ZodOptional<z.ZodObject<{
2869
+ scopes: z.ZodObject<{
2870
2870
  tunnels: z.ZodOptional<z.ZodObject<{
2871
2871
  create: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
2872
2872
  filters: z.ZodOptional<z.ZodType<FilterNode<{
@@ -2948,7 +2948,7 @@ declare const tokenSchema: z.ZodUnion<readonly [z.ZodObject<{
2948
2948
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
2949
2949
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
2950
2950
  }>, unknown>>>;
2951
- }, z.core.$strip>]>>;
2951
+ }, z.core.$strict>]>>;
2952
2952
  connect: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
2953
2953
  filters: z.ZodOptional<z.ZodType<FilterNode<{
2954
2954
  client_id: z.ZodString;
@@ -3062,7 +3062,7 @@ declare const tokenSchema: z.ZodUnion<readonly [z.ZodObject<{
3062
3062
  }>, unknown, z.core.$ZodTypeInternals<FilterNode<{
3063
3063
  path: z.ZodOptional<z.ZodString>;
3064
3064
  }>, unknown>>>;
3065
- }, z.core.$strip>]>>;
3065
+ }, z.core.$strict>]>>;
3066
3066
  list: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
3067
3067
  filters: z.ZodOptional<z.ZodType<FilterNode<{
3068
3068
  client_id: z.ZodString;
@@ -3206,9 +3206,9 @@ declare const tokenSchema: z.ZodUnion<readonly [z.ZodObject<{
3206
3206
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
3207
3207
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
3208
3208
  }, z.core.$strip>>;
3209
- }, z.core.$strip>]>>;
3210
- }, z.core.$strip>>;
3211
- }, z.core.$strip>>;
3209
+ }, z.core.$strict>]>>;
3210
+ }, z.core.$strict>>;
3211
+ }, z.core.$strict>;
3212
3212
  }, z.core.$strict>>>;
3213
3213
  iat: z.ZodOptional<z.ZodNumber>;
3214
3214
  iss: z.ZodOptional<z.ZodString>;
@@ -3306,7 +3306,7 @@ declare const createAuthTokenParamsSchema: z.ZodObject<{
3306
3306
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
3307
3307
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
3308
3308
  }>, unknown>>>;
3309
- }, z.core.$strip>]>>;
3309
+ }, z.core.$strict>]>>;
3310
3310
  connect: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
3311
3311
  filters: z.ZodOptional<z.ZodType<FilterNode<{
3312
3312
  client_id: z.ZodString;
@@ -3420,7 +3420,7 @@ declare const createAuthTokenParamsSchema: z.ZodObject<{
3420
3420
  }>, unknown, z.core.$ZodTypeInternals<FilterNode<{
3421
3421
  path: z.ZodOptional<z.ZodString>;
3422
3422
  }>, unknown>>>;
3423
- }, z.core.$strip>]>>;
3423
+ }, z.core.$strict>]>>;
3424
3424
  list: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
3425
3425
  filters: z.ZodOptional<z.ZodType<FilterNode<{
3426
3426
  client_id: z.ZodString;
@@ -3564,13 +3564,13 @@ declare const createAuthTokenParamsSchema: z.ZodObject<{
3564
3564
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
3565
3565
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
3566
3566
  }, z.core.$strip>>;
3567
- }, z.core.$strip>]>>;
3568
- }, z.core.$strip>>;
3569
- }, z.core.$strip>>;
3567
+ }, z.core.$strict>]>>;
3568
+ }, z.core.$strict>>;
3569
+ }, z.core.$strict>>;
3570
3570
  tunnelsGrants: z.ZodOptional<z.ZodArray<z.ZodObject<{
3571
3571
  workspaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
3572
3572
  projects: z.ZodOptional<z.ZodArray<z.ZodString>>;
3573
- scopes: z.ZodOptional<z.ZodObject<{
3573
+ scopes: z.ZodObject<{
3574
3574
  tunnels: z.ZodOptional<z.ZodObject<{
3575
3575
  create: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
3576
3576
  filters: z.ZodOptional<z.ZodType<FilterNode<{
@@ -3652,7 +3652,7 @@ declare const createAuthTokenParamsSchema: z.ZodObject<{
3652
3652
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
3653
3653
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
3654
3654
  }>, unknown>>>;
3655
- }, z.core.$strip>]>>;
3655
+ }, z.core.$strict>]>>;
3656
3656
  connect: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
3657
3657
  filters: z.ZodOptional<z.ZodType<FilterNode<{
3658
3658
  client_id: z.ZodString;
@@ -3766,7 +3766,7 @@ declare const createAuthTokenParamsSchema: z.ZodObject<{
3766
3766
  }>, unknown, z.core.$ZodTypeInternals<FilterNode<{
3767
3767
  path: z.ZodOptional<z.ZodString>;
3768
3768
  }>, unknown>>>;
3769
- }, z.core.$strip>]>>;
3769
+ }, z.core.$strict>]>>;
3770
3770
  list: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
3771
3771
  filters: z.ZodOptional<z.ZodType<FilterNode<{
3772
3772
  client_id: z.ZodString;
@@ -3910,9 +3910,9 @@ declare const createAuthTokenParamsSchema: z.ZodObject<{
3910
3910
  rstream_auth: z.ZodOptional<z.ZodBoolean>;
3911
3911
  challenge_mode: z.ZodOptional<z.ZodBoolean>;
3912
3912
  }, z.core.$strip>>;
3913
- }, z.core.$strip>]>>;
3914
- }, z.core.$strip>>;
3915
- }, z.core.$strip>>;
3913
+ }, z.core.$strict>]>>;
3914
+ }, z.core.$strict>>;
3915
+ }, z.core.$strict>;
3916
3916
  }, z.core.$strict>>>;
3917
3917
  metadata: z.ZodOptional<z.ZodUnknown>;
3918
3918
  }, z.core.$strict>;
@@ -3924,7 +3924,8 @@ type RstreamAuthTokenTunnelGrant = z.infer<typeof authTokenTunnelGrantSchema>;
3924
3924
  type RstreamAuthTokenScopes = z.infer<typeof authTokenTunnelsScopesSchema>;
3925
3925
  type RstreamAuthToken = z.infer<typeof authTokenSchema>;
3926
3926
  type Token = z.infer<typeof tokenSchema>;
3927
- type CreateAuthTokenParams = z.infer<typeof createAuthTokenParamsSchema>;
3927
+ type CreateAuthTokenParams = z.input<typeof createAuthTokenParamsSchema>;
3928
+ type ParsedCreateAuthTokenParams = z.infer<typeof createAuthTokenParamsSchema>;
3928
3929
  type CreateAuthTokenResponse = z.infer<typeof createAuthTokenResponseSchema>;
3929
3930
  type RstreamAuth = (() => Promise<string>) | string;
3930
3931
  type RstreamAuthJwtPayload = JwtPayload & RstreamAuthToken;
@@ -4215,6 +4216,7 @@ interface CreatePATTURNCredentialsOptions {
4215
4216
  now?: Date | number;
4216
4217
  projectEndpoint: string;
4217
4218
  token: string;
4219
+ tokenEndpoint: string;
4218
4220
  ttlSeconds?: number;
4219
4221
  turnPort?: number;
4220
4222
  turnsPort?: number;
@@ -4244,6 +4246,7 @@ interface CreateTURNCredentialsOptions {
4244
4246
  projectEndpoint?: string;
4245
4247
  projectId?: string;
4246
4248
  serverPublicKeyHex?: string;
4249
+ tokenEndpoint?: string;
4247
4250
  ttlSeconds?: number;
4248
4251
  turnPort?: number;
4249
4252
  turnsPort?: number;
@@ -6650,6 +6653,14 @@ interface RstreamTunnelsConfig {
6650
6653
  * Used when the engine is not set explicitly.
6651
6654
  */
6652
6655
  projectEndpoint?: string;
6656
+ /**
6657
+ * Project ID used to scope locally signed engine auth tokens.
6658
+ */
6659
+ projectId?: string;
6660
+ /**
6661
+ * Workspace ID used to scope locally signed engine auth tokens.
6662
+ */
6663
+ workspaceId?: string;
6653
6664
  /**
6654
6665
  * Control-plane credentials used when resolving a managed project endpoint.
6655
6666
  * Defaults to the same credentials used against the engine when available.
@@ -6658,12 +6669,16 @@ interface RstreamTunnelsConfig {
6658
6669
  }
6659
6670
  declare class RstreamTunnelsClient {
6660
6671
  private readonly config?;
6672
+ private managedProject?;
6661
6673
  constructor(config?: RstreamTunnelsConfig);
6662
6674
  get apiUrl(): string;
6663
6675
  get credentials(): RstreamCredentials | undefined;
6664
6676
  get controlPlaneCredentials(): RstreamCredentials | undefined;
6665
6677
  get projectEndpoint(): string | undefined;
6666
6678
  getEngine(): Promise<string>;
6679
+ private getManagedProject;
6680
+ private getEngineAuthTokenParams;
6681
+ private getEngineAuthTokenTarget;
6667
6682
  get auth(): RstreamAuthResource;
6668
6683
  get clients(): RstreamClientsResource;
6669
6684
  get tunnels(): RstreamTunnelsResource;
@@ -6673,17 +6688,19 @@ declare class RstreamTunnelsClient {
6673
6688
  request<T>(path: string, options?: RequestInit): Promise<T>;
6674
6689
  }
6675
6690
 
6691
+ interface CreateAuthTokenFromClientCredentialsOptions {
6692
+ engine?: string;
6693
+ projectId?: string;
6694
+ workspaceId?: string;
6695
+ }
6676
6696
  declare class RstreamAuthResource {
6677
6697
  private readonly client;
6678
6698
  constructor(client: RstreamTunnelsClient);
6679
- createAuthToken(params?: CreateAuthTokenParams, options?: {
6699
+ createAuthToken(params: CreateAuthTokenParams, options?: CreateAuthTokenFromClientCredentialsOptions & {
6680
6700
  credentials?: ClientCredentials;
6681
- engine?: string;
6682
6701
  }): Promise<CreateAuthTokenResponse>;
6683
6702
  }
6684
- declare function createAuthTokenFromClientCredentials(credentials: ClientCredentials, params?: CreateAuthTokenParams, options?: {
6685
- engine?: string;
6686
- }): CreateAuthTokenResponse;
6703
+ declare function createAuthTokenFromClientCredentials(credentials: ClientCredentials, params: CreateAuthTokenParams, options?: CreateAuthTokenFromClientCredentialsOptions): CreateAuthTokenResponse;
6687
6704
 
6688
6705
  interface TunnelsResolutionConfig {
6689
6706
  apiUrl?: string;
@@ -6693,10 +6710,12 @@ interface TunnelsResolutionConfig {
6693
6710
  projectEndpoint?: string;
6694
6711
  token?: string;
6695
6712
  }
6713
+ declare function normalizeEngineAddress(engine: string): string;
6696
6714
  declare function resolveTunnelsAPIURL(apiUrl?: string): string;
6697
6715
  declare function resolveTunnelsCredentials(credentials?: RstreamCredentials): RstreamCredentials | undefined;
6698
6716
  declare function resolveControlPlaneCredentials(controlPlaneCredentials?: RstreamCredentials, credentials?: RstreamCredentials, authToken?: string): RstreamCredentials | undefined;
6699
6717
  declare function resolveTunnelsEngine(config: TunnelsResolutionConfig): Promise<string>;
6718
+ declare function resolveManagedTunnelsProject(config: TunnelsResolutionConfig): Promise<TunnelsProject>;
6700
6719
 
6701
6720
  declare const streamTLSInfoSchema: z.ZodObject<{
6702
6721
  version: z.ZodOptional<z.ZodString>;
@@ -7281,6 +7300,7 @@ declare class Watch {
7281
7300
  private readonly events;
7282
7301
  constructor(config: WatchConfig, events: WatchWsEvents);
7283
7302
  connect(): Promise<void>;
7303
+ private handleMessage;
7284
7304
  disconnect(): void;
7285
7305
  }
7286
7306
 
@@ -7308,4 +7328,4 @@ declare const webttyServerSchema: z.ZodObject<{
7308
7328
  type WebTTYServer = z.infer<typeof webttyServerSchema>;
7309
7329
  declare function parseWebTTYServers(tunnels: Tunnel[]): WebTTYServer[];
7310
7330
 
7311
- export { type Client, type ClientFilter, type CreateAPITURNCredentialsOptions, type CreateAPPTURNCredentialsOptions, type CreateAuthTokenParams, type CreateAuthTokenResponse, type CreatePATTURNCredentialsOptions, type CreateTURNCredentialsOptions, type Event, type InitialState, type ListClientsParams, type ListClientsResponse, type ListTunnelsParams, type ListTunnelsResponse, type RstreamAuth, type RstreamAuthJwtPayload, RstreamAuthResource, RstreamAuthResource as RstreamAuthRessource, type RstreamAuthToken, type RstreamAuthTokenPermissions, type RstreamAuthTokenScopes, type RstreamAuthTokenTunnelGrant, RstreamTunnelsClient as RstreamClient, RstreamClientsResource, RstreamClientsResource as RstreamClientsRessource, RstreamTURNResource, RstreamTunnelsClient, type RstreamTunnelsConfig, RstreamTunnelsResource, RstreamTunnelsResource as RstreamTunnelsRessource, RstreamWebhookResource, RstreamWebhookResource as RstreamWebhookRessource, type StreamEndpoint, type StreamSummary, type StreamTLSInfo, type TURNCredentialMode, type Token, type Tunnel, type TunnelFilter, RstreamTunnelsClient as Tunnels, type TunnelsResolutionConfig, Watch, type WatchConfig, type WatchWsEvents, type WebTTYServer, type WebhookEvent, type WsEvent, authTokenPermissionsSchema, authTokenSchema, authTokenScopesSchema, authTokenTunnelGrantSchema, authTokenTunnelsScopesSchema, clientFilterSchema, clientSchema, createAPITURNCredentials, createAPPTURNCredentials, createAuthTokenFromClientCredentials, createAuthTokenParamsSchema, createAuthTokenResponseSchema, createPATTURNCredentials, createTURNCredentials, eventSchema, formatTunnelHost, listClientsParamsSchema, listClientsResponseSchema, listTunnelsParamsSchema, listTunnelsResponseSchema, parseWebTTYServers, resolveControlPlaneCredentials, resolveTunnelsAPIURL, resolveTunnelsCredentials, resolveTunnelsEngine, streamEndpointSchema, streamSummarySchema, streamTLSInfoSchema, tokenSchema, tunnelFilterSchema, tunnelSchema, turnCredentialModeSchema, webhookEventsSchema, webttyServerSchema, wsEventsSchema };
7331
+ export { type Client, type ClientFilter, type CreateAPITURNCredentialsOptions, type CreateAPPTURNCredentialsOptions, type CreateAuthTokenFromClientCredentialsOptions, type CreateAuthTokenParams, type CreateAuthTokenResponse, type CreatePATTURNCredentialsOptions, type CreateTURNCredentialsOptions, type Event, type InitialState, type ListClientsParams, type ListClientsResponse, type ListTunnelsParams, type ListTunnelsResponse, type ParsedCreateAuthTokenParams, type RstreamAuth, type RstreamAuthJwtPayload, RstreamAuthResource, RstreamAuthResource as RstreamAuthRessource, type RstreamAuthToken, type RstreamAuthTokenPermissions, type RstreamAuthTokenScopes, type RstreamAuthTokenTunnelGrant, RstreamTunnelsClient as RstreamClient, RstreamClientsResource, RstreamClientsResource as RstreamClientsRessource, RstreamTURNResource, RstreamTunnelsClient, type RstreamTunnelsConfig, RstreamTunnelsResource, RstreamTunnelsResource as RstreamTunnelsRessource, RstreamWebhookResource, RstreamWebhookResource as RstreamWebhookRessource, type StreamEndpoint, type StreamSummary, type StreamTLSInfo, type TURNCredentialMode, type Token, type Tunnel, type TunnelFilter, RstreamTunnelsClient as Tunnels, type TunnelsResolutionConfig, Watch, type WatchConfig, type WatchWsEvents, type WebTTYServer, type WebhookEvent, type WsEvent, authTokenPermissionsSchema, authTokenSchema, authTokenScopesSchema, authTokenTunnelGrantSchema, authTokenTunnelsScopesSchema, clientFilterSchema, clientSchema, createAPITURNCredentials, createAPPTURNCredentials, createAuthTokenFromClientCredentials, createAuthTokenParamsSchema, createAuthTokenResponseSchema, createPATTURNCredentials, createTURNCredentials, eventSchema, formatTunnelHost, listClientsParamsSchema, listClientsResponseSchema, listTunnelsParamsSchema, listTunnelsResponseSchema, normalizeEngineAddress, parseWebTTYServers, resolveControlPlaneCredentials, resolveManagedTunnelsProject, resolveTunnelsAPIURL, resolveTunnelsCredentials, resolveTunnelsEngine, streamEndpointSchema, streamSummarySchema, streamTLSInfoSchema, tokenSchema, tunnelFilterSchema, tunnelSchema, turnCredentialModeSchema, webhookEventsSchema, webttyServerSchema, wsEventsSchema };