@rstreamlabs/tunnels 1.0.7 → 1.0.9

package/README.md

@@ -1,6 +1,6 @@
 # `@rstreamlabs/tunnels`
 
-Data-plane JS/TS SDK for rstream tunnels.
+Engine API JS/TS SDK for rstream tunnels.
 
 Use this package to talk directly to the tunnels engine: list tunnels, inspect
 clients, watch engine events, validate webhooks, and create fine-grained app
@@ -9,7 +9,7 @@ tokens.
 The package supports both:
 
 - direct engine usage, including self-hosted deployments
-- managed rstream projects resolved via the control plane
+- managed rstream projects resolved via the Control plane API
 - bearer-token authentication and application credentials
 
 ## Self-hosted usage
@@ -45,6 +45,10 @@ const turn = await client.turn.createCredentials();
 `clientSecret`. This is the intended backend flow when you want the server to
 mint short-lived tokens for downstream clients.
 
+Managed `projectEndpoint` clients mint engine tokens restricted to the resolved
+project. Explicit `engine` clients using application credentials must provide
+`projectId` or `workspaceId` so locally signed engine tokens are not global.
+
 ```ts
 import { RstreamTunnelsClient } from "@rstreamlabs/tunnels";
 
@@ -56,13 +60,16 @@ const client = new RstreamTunnelsClient({
   projectEndpoint: "project-endpoint",
 });
 
-const { token } = await client.auth.createAuthToken({ expires_in: 60 });
+const tunnels = await client.tunnels.list();
 ```
 
 ## Fine-Grained Tokens
 
-Use `scopes` for a global grant, or `tunnelsGrants` when the token must be restricted
-to specific workspaces or projects.
+Prefer `tunnelsGrants` with explicit operation scopes. When the client is
+configured with `projectEndpoint` or `projectId`, scope-only requests and
+scope-only grant leaves are project-scoped by default. Pass
+`projectScoped: false` only when you intentionally need a global scope-only
+grant.
 
 ```ts
 import { RstreamTunnelsClient } from "@rstreamlabs/tunnels";
@@ -77,18 +84,15 @@ const admin = new RstreamTunnelsClient({
 
 const { token } = await admin.auth.createAuthToken({
   expires_in: 60,
-  tunnelsGrants: [
-    {
-      projects: ["project-id"],
-      scopes: {
-        tunnels: {
-          create: { filters: { protocol: { oneof: ["http"] } } },
-          connect: { params: { path: { regex: "^/api" } } },
-          list: { select: { id: true, name: true, protocol: true } },
-        },
+  tunnelsGrants: {
+    scopes: {
+      tunnels: {
+        create: { filters: { protocol: { oneof: ["http"] } } },
+        connect: { params: { path: { regex: "^/api" } } },
+        list: { select: { id: true, name: true, protocol: true } },
       },
     },
-  ],
+  },
 });
 ```
 
@@ -113,4 +117,4 @@ const turn = await createTURNCredentials({
 `@rstreamlabs/tunnels` reads `RSTREAM_API_URL`, `RSTREAM_ENGINE`, and
 `RSTREAM_AUTHENTICATION_TOKEN` when they are not provided explicitly.
 
-For managed control-plane APIs, use [`@rstreamlabs/rstream`](../rstream/README.md).
+For the Control plane API, use [`@rstreamlabs/rstream`](../rstream/README.md).

package/dist/{chunk-OPJKEDVS.mjs → chunk-TVDZNVSF.mjs}

@@ -67,8 +67,7 @@ var tunnelSchema = z2.object({
   tls_alpns: z2.array(z2.string()).optional(),
   tls_min_version: z2.string().optional(),
   tls_ciphers: z2.array(z2.string()).optional(),
-  mtls: z2.boolean().optional(),
-  mtls_ca_cert_pem: z2.string().optional(),
+  mtls_auth: z2.boolean().optional(),
   http_version: z2.enum(["http/1.1", "h2", "h2c", "h3"]).optional(),
   http_use_tls: z2.boolean().optional(),
   upstream_tls: z2.boolean().optional(),
@@ -245,7 +244,7 @@ var routedTunnelSchema = z3.object({
   httpUseTls: z3.boolean().optional(),
   upstreamTls: z3.boolean().optional(),
   tokenAuth: z3.boolean().optional(),
-  mtls: z3.boolean().optional()
+  mtls_auth: z3.boolean().optional()
 });
 var routingSchema = z3.discriminatedUnion("decision", [
   z3.object({ decision: z3.literal("routed"), tunnel: routedTunnelSchema }),
@@ -487,7 +486,7 @@ var engineOpenApiDocument = {
   info: {
     title: "rstream Engine API",
     version: "1.0.0",
-    description: "Operational data-plane API exposed by rstream-engine. This surface is scoped to the authenticated engine or project endpoint and covers live clients, live tunnels, and state-change streams."
+    description: "Operational Engine API exposed by rstream-engine. This surface is scoped to the authenticated engine or project endpoint and covers live clients, live tunnels, and state-change streams."
   },
   servers: [
     {
@@ -513,12 +512,6 @@ var engineOpenApiDocument = {
         scheme: "bearer",
         bearerFormat: "rstream token",
         description: "Preferred authentication mechanism. Send an OAuth-issued rstream access token or compatible rstream credential in Authorization: Bearer <token>."
-      },
-      queryToken: {
-        type: "apiKey",
-        in: "query",
-        name: "rstream.token",
-        description: "Fallback authentication mechanism for transports where setting Authorization is impractical. Prefer bearerAuth whenever possible."
       }
     },
     parameters: {
@@ -638,7 +631,7 @@ var engineOpenApiDocument = {
         summary: "List visible engine clients.",
         operationId: "list_engine_clients",
         parameters: [{ $ref: "#/components/parameters/ListClientsParams" }],
-        security: [{ bearerAuth: [] }, { queryToken: [] }],
+        security: [{ bearerAuth: [] }],
         responses: {
           "200": jsonArrayResponse(
             "Visible clients.",
@@ -657,7 +650,7 @@ var engineOpenApiDocument = {
         summary: "List visible engine tunnels.",
         operationId: "list_engine_tunnels",
         parameters: [{ $ref: "#/components/parameters/ListTunnelsParams" }],
-        security: [{ bearerAuth: [] }, { queryToken: [] }],
+        security: [{ bearerAuth: [] }],
         responses: {
           "200": jsonArrayResponse(
             "Visible tunnels. Fine-grained list scopes may filter objects and project fields.",
@@ -677,7 +670,7 @@ var engineOpenApiDocument = {
         summary: "Subscribe to visible engine state through Server-Sent Events.",
         operationId: "watch_engine_events_sse",
         parameters: [{ $ref: "#/components/parameters/WatchParams" }],
-        security: [{ bearerAuth: [] }, { queryToken: [] }],
+        security: [{ bearerAuth: [] }],
         responses: {
           "200": streamResponse(
             "SSE stream. Each event is emitted as a data line containing a JSON Event object."
@@ -696,7 +689,7 @@ var engineOpenApiDocument = {
         summary: "Subscribe to visible engine state through a WebSocket upgrade.",
         operationId: "watch_engine_events_websocket",
         parameters: [{ $ref: "#/components/parameters/WatchParams" }],
-        security: [{ bearerAuth: [] }, { queryToken: [] }],
+        security: [{ bearerAuth: [] }],
         responses: {
           "101": {
             description: "WebSocket connection accepted. Frames contain JSON Event objects."