@rstreamlabs/tunnels 1.0.8 → 1.0.10

package/dist/index.js

@@ -162,8 +162,7 @@ var tunnelSchema = z2.object({
   tls_alpns: z2.array(z2.string()).optional(),
   tls_min_version: z2.string().optional(),
   tls_ciphers: z2.array(z2.string()).optional(),
-  mtls: z2.boolean().optional(),
-  mtls_ca_cert_pem: z2.string().optional(),
+  mtls_auth: z2.boolean().optional(),
   http_version: z2.enum(["http/1.1", "h2", "h2c", "h3"]).optional(),
   http_use_tls: z2.boolean().optional(),
   upstream_tls: z2.boolean().optional(),
@@ -263,10 +262,10 @@ var authTokenScopesSchema = z3.object({
     });
   }
 });
-var authTokenTunnelGrantSchema = z3.object({
+var authTokenTunnelGrantLeafSchema = z3.object({
   workspaces: z3.array(nonEmptyStringSchema).min(1).optional(),
   projects: z3.array(nonEmptyStringSchema).min(1).optional(),
-  scopes: authTokenScopesSchema
+  scopes: authTokenScopesSchema.optional()
 }).strict().superRefine((grant, ctx) => {
   if (grant.workspaces !== void 0 && grant.projects !== void 0) {
     ctx.addIssue({
@@ -275,18 +274,25 @@ var authTokenTunnelGrantSchema = z3.object({
       path: ["projects"]
     });
   }
-  if (grant.workspaces === void 0 && grant.projects === void 0) {
+  if (grant.workspaces === void 0 && grant.projects === void 0 && grant.scopes === void 0) {
     ctx.addIssue({
       code: z3.ZodIssueCode.custom,
-      message: "A grant must target workspaces or projects.",
+      message: "A grant must target workspaces, projects, or scopes.",
       path: ["workspaces"]
     });
   }
 });
+var authTokenTunnelGrantSchema = z3.lazy(
+  () => z3.union([
+    authTokenTunnelGrantLeafSchema,
+    z3.object({ AND: z3.array(authTokenTunnelGrantSchema).min(1) }).strict(),
+    z3.object({ OR: z3.array(authTokenTunnelGrantSchema).min(1) }).strict()
+  ])
+);
 var authTokenCommonSchema = {
   aud: z3.union([z3.string(), z3.array(z3.string())]).optional(),
   exp: z3.number().optional(),
-  tunnelsGrants: z3.array(authTokenTunnelGrantSchema).optional(),
+  tunnelsGrants: authTokenTunnelGrantSchema.optional(),
   iat: z3.number().optional(),
   iss: z3.string().optional(),
   jti: z3.string().optional(),
@@ -305,6 +311,7 @@ var authTokenSchema = z3.union([
   }).strict(),
   z3.object({
     type: z3.literal("pat"),
+    tokendpoint: z3.string().optional(),
     token_endpoint: z3.string().optional(),
     ...authTokenCommonSchema
   }).strict(),
@@ -319,7 +326,7 @@ var tokenSchema = authTokenSchema;
 var createAuthTokenParamsSchema = z3.object({
   expires_in: z3.number().int().min(1).max(3600).default(60),
   scopes: authTokenScopesSchema.optional(),
-  tunnelsGrants: z3.array(authTokenTunnelGrantSchema).min(1).optional(),
+  tunnelsGrants: authTokenTunnelGrantSchema.optional(),
   metadata: z3.unknown().optional()
   // Additional metadata
 }).strict().superRefine((params, ctx) => {
@@ -357,10 +364,30 @@ var RstreamAuthResource = class {
       );
     }
     const engine = options?.engine ?? await this.client.getEngine().catch(() => void 0);
+    const scopedOptions = await this.resolveScopeOptions(params, options);
     return createAuthTokenFromClientCredentials(credentials, params, {
-      engine
+      engine,
+      ...scopedOptions
     });
   }
+  async resolveScopeOptions(params, options) {
+    const tokenParams = createAuthTokenParamsSchema.parse(params);
+    if (options?.projectScoped === false) {
+      return options ?? {};
+    }
+    if (options?.projectId !== void 0 || options?.workspaceId !== void 0) {
+      return options;
+    }
+    if (tokenParams.scopes === void 0 && !tunnelGrantsNeedDefaultTarget(tokenParams.tunnelsGrants)) {
+      return options ?? {};
+    }
+    const target = await this.client.getEngineAuthTokenTarget();
+    return {
+      ...options,
+      projectId: target.projects?.[0],
+      workspaceId: target.workspaces?.[0]
+    };
+  }
 };
 function createAuthTokenFromClientCredentials(credentials, params, options) {
   const tokenParams = createAuthTokenParamsSchema.parse(params);
@@ -380,13 +407,66 @@ function createAuthTokenFromClientCredentials(credentials, params, options) {
 function normalizeAuthTokenTunnelGrants(params, options) {
   const tunnelsGrants = params.tunnelsGrants;
   if (tunnelsGrants !== void 0) {
-    return [...tunnelsGrants];
+    return applyDefaultTunnelGrantTarget(tunnelsGrants, options);
   }
   if (params.scopes) {
-    return [{ ...normalizeTunnelGrantTarget(options), scopes: params.scopes }];
+    return { ...normalizeTunnelGrantTarget(options), scopes: params.scopes };
   }
   return void 0;
 }
+function applyDefaultTunnelGrantTarget(grants, options, inheritedTarget = false) {
+  if (options?.projectScoped === false) {
+    return grants;
+  }
+  if ("AND" in grants) {
+    const branchHasTarget = inheritedTarget || grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
+    return {
+      AND: grants.AND.map(
+        (grant) => applyDefaultTunnelGrantTarget(grant, options, branchHasTarget)
+      )
+    };
+  }
+  if ("OR" in grants) {
+    return {
+      OR: grants.OR.map(
+        (grant) => applyDefaultTunnelGrantTarget(grant, options, inheritedTarget)
+      )
+    };
+  }
+  if (grants.scopes === void 0 || tunnelGrantHasTarget(grants) || inheritedTarget) {
+    return grants;
+  }
+  return { ...normalizeTunnelGrantTarget(options), scopes: grants.scopes };
+}
+function tunnelGrantsNeedDefaultTarget(grants, inheritedTarget = false) {
+  if (grants === void 0) {
+    return false;
+  }
+  if ("AND" in grants) {
+    const branchHasTarget = inheritedTarget || grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
+    return grants.AND.some(
+      (grant) => tunnelGrantsNeedDefaultTarget(grant, branchHasTarget)
+    );
+  }
+  if ("OR" in grants) {
+    return grants.OR.some(
+      (grant) => tunnelGrantsNeedDefaultTarget(grant, inheritedTarget)
+    );
+  }
+  return grants.scopes !== void 0 && !tunnelGrantHasTarget(grants) && !inheritedTarget;
+}
+function tunnelGrantHasTarget(grant) {
+  return grant.projects !== void 0 || grant.workspaces !== void 0;
+}
+function tunnelGrantTreeHasTarget(grants) {
+  if ("AND" in grants) {
+    return grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
+  }
+  if ("OR" in grants) {
+    return grants.OR.some((grant) => tunnelGrantTreeHasTarget(grant));
+  }
+  return tunnelGrantHasTarget(grants);
+}
 function normalizeTunnelGrantTarget(options) {
   const projectId = normalizeOptionalString(options?.projectId);
   const workspaceId = normalizeOptionalString(options?.workspaceId);
@@ -399,6 +479,9 @@ function normalizeTunnelGrantTarget(options) {
   if (workspaceId !== void 0) {
     return { workspaces: [workspaceId] };
   }
+  if (options?.projectScoped === false) {
+    return {};
+  }
   throw new Error(
     "Project ID or workspace ID is required when using scope-only tunnel grants."
   );
@@ -620,7 +703,7 @@ var routedTunnelSchema = z5.object({
   httpUseTls: z5.boolean().optional(),
   upstreamTls: z5.boolean().optional(),
   tokenAuth: z5.boolean().optional(),
-  mtls: z5.boolean().optional()
+  mtls_auth: z5.boolean().optional()
 });
 var routingSchema = z5.discriminatedUnion("decision", [
   z5.object({ decision: z5.literal("routed"), tunnel: routedTunnelSchema }),
@@ -862,7 +945,7 @@ var engineOpenApiDocument = {
   info: {
     title: "rstream Engine API",
     version: "1.0.0",
-    description: "Operational data-plane API exposed by rstream-engine. This surface is scoped to the authenticated engine or project endpoint and covers live clients, live tunnels, and state-change streams."
+    description: "Operational Engine API exposed by rstream engine. This surface is scoped to the authenticated engine or project endpoint and covers live clients, live tunnels, and state-change streams."
   },
   servers: [
     {
@@ -1179,7 +1262,7 @@ async function resolveTunnelsEngine(config) {
     );
   }
   throw new Error(
-    "Engine URL is not defined. Provide an engine, use RSTREAM_ENGINE, or configure a managed project endpoint with control-plane access."
+    "Engine URL is not defined. Provide an engine, use RSTREAM_ENGINE, or configure a managed project endpoint with Control plane API access."
   );
 }
 async function resolveManagedTunnelsProject(config) {
@@ -1255,6 +1338,7 @@ var turnTokenClaimsSchema = z8.object({
   exp: z8.number().int().optional(),
   iat: z8.number().int().optional(),
   token_endpoint: z8.string().regex(/^[0-9a-f]{8}$/i).optional(),
+  tokendpoint: z8.string().regex(/^[0-9a-f]{8}$/i).optional(),
   type: z8.enum(["app", "auth", "pat"])
 });
 var turnCredentialModeSchema = z8.enum(["api", "app", "pat"]);
@@ -1431,7 +1515,8 @@ function createPATTURNCredentials(options) {
   if (!tokenEndpoint) {
     throw new Error("Token endpoint is required for TURN PAT mode.");
   }
-  if (claims.token_endpoint !== void 0 && claims.token_endpoint !== tokenEndpoint) {
+  const claimsTokenEndpoint = claims.token_endpoint ?? claims.tokendpoint;
+  if (claimsTokenEndpoint !== void 0 && claimsTokenEndpoint !== tokenEndpoint) {
     throw new Error("Token endpoint does not match the PAT token.");
   }
   const now = normalizeNow(options.now);
@@ -1760,12 +1845,10 @@ var RstreamTunnelsClient = class {
   async getEngineAuthTokenParams() {
     const target = await this.getEngineAuthTokenTarget();
     return {
-      tunnelsGrants: [
-        {
-          ...target,
-          scopes: engineAuthTokenScopes
-        }
-      ]
+      tunnelsGrants: {
+        ...target,
+        scopes: engineAuthTokenScopes
+      }
     };
   }
   async getEngineAuthTokenTarget() {
@@ -1883,16 +1966,44 @@ function hasWatchOnlyTunnelGrants(token) {
   if (!hasWatchOnlyPermissions(token.permissions)) {
     return false;
   }
-  if (!Array.isArray(token.tunnelsGrants) || token.tunnelsGrants.length === 0) {
+  if (token.tunnelsGrants === void 0) {
     return false;
   }
-  return token.tunnelsGrants.every((grant) => {
-    const tunnels = grant.scopes?.tunnels;
-    if (tunnels === void 0) {
-      return false;
+  return hasWatchOnlyTunnelGrant(token.tunnelsGrants);
+}
+function hasWatchOnlyTunnelGrant(grant) {
+  return watchGrantBranches(grant).every(
+    (branch) => branch.hasList && !branch.hasMutationOrConnect
+  );
+}
+function watchGrantBranches(grant) {
+  if ("AND" in grant) {
+    return grant.AND.reduce(
+      (branches, child) => combineWatchGrantBranches(branches, child),
+      [{ hasList: false, hasMutationOrConnect: false }]
+    );
+  }
+  if ("OR" in grant) {
+    return grant.OR.flatMap(watchGrantBranches);
+  }
+  const tunnels = grant.scopes?.tunnels;
+  if (tunnels === void 0) {
+    return [{ hasList: false, hasMutationOrConnect: false }];
+  }
+  return [
+    {
+      hasList: tunnels.list !== void 0,
+      hasMutationOrConnect: tunnels.create !== void 0 || tunnels.connect !== void 0
     }
-    return tunnels.list !== void 0 && tunnels.create === void 0 && tunnels.connect === void 0;
-  });
+  ];
+}
+function combineWatchGrantBranches(branches, child) {
+  return branches.flatMap(
+    (branch) => watchGrantBranches(child).map((childBranch) => ({
+      hasList: branch.hasList || childBranch.hasList,
+      hasMutationOrConnect: branch.hasMutationOrConnect || childBranch.hasMutationOrConnect
+    }))
+  );
 }
 function hasWatchOnlyPermissions(permissions) {
   if (!Array.isArray(permissions)) {

package/dist/index.mjs

@@ -16,7 +16,7 @@ import {
   tunnelSchema,
   webhookEventsSchema,
   wsEventsSchema
-} from "./chunk-7RZ743EF.mjs";
+} from "./chunk-NHUJ3FYM.mjs";
 
 // src/auth-resource.ts
 import { createClientCredentialsToken } from "@rstreamlabs/rstream";
@@ -130,10 +130,10 @@ var authTokenScopesSchema = z2.object({
     });
   }
 });
-var authTokenTunnelGrantSchema = z2.object({
+var authTokenTunnelGrantLeafSchema = z2.object({
   workspaces: z2.array(nonEmptyStringSchema).min(1).optional(),
   projects: z2.array(nonEmptyStringSchema).min(1).optional(),
-  scopes: authTokenScopesSchema
+  scopes: authTokenScopesSchema.optional()
 }).strict().superRefine((grant, ctx) => {
   if (grant.workspaces !== void 0 && grant.projects !== void 0) {
     ctx.addIssue({
@@ -142,18 +142,25 @@ var authTokenTunnelGrantSchema = z2.object({
       path: ["projects"]
     });
   }
-  if (grant.workspaces === void 0 && grant.projects === void 0) {
+  if (grant.workspaces === void 0 && grant.projects === void 0 && grant.scopes === void 0) {
     ctx.addIssue({
       code: z2.ZodIssueCode.custom,
-      message: "A grant must target workspaces or projects.",
+      message: "A grant must target workspaces, projects, or scopes.",
       path: ["workspaces"]
     });
   }
 });
+var authTokenTunnelGrantSchema = z2.lazy(
+  () => z2.union([
+    authTokenTunnelGrantLeafSchema,
+    z2.object({ AND: z2.array(authTokenTunnelGrantSchema).min(1) }).strict(),
+    z2.object({ OR: z2.array(authTokenTunnelGrantSchema).min(1) }).strict()
+  ])
+);
 var authTokenCommonSchema = {
   aud: z2.union([z2.string(), z2.array(z2.string())]).optional(),
   exp: z2.number().optional(),
-  tunnelsGrants: z2.array(authTokenTunnelGrantSchema).optional(),
+  tunnelsGrants: authTokenTunnelGrantSchema.optional(),
   iat: z2.number().optional(),
   iss: z2.string().optional(),
   jti: z2.string().optional(),
@@ -172,6 +179,7 @@ var authTokenSchema = z2.union([
   }).strict(),
   z2.object({
     type: z2.literal("pat"),
+    tokendpoint: z2.string().optional(),
     token_endpoint: z2.string().optional(),
     ...authTokenCommonSchema
   }).strict(),
@@ -186,7 +194,7 @@ var tokenSchema = authTokenSchema;
 var createAuthTokenParamsSchema = z2.object({
   expires_in: z2.number().int().min(1).max(3600).default(60),
   scopes: authTokenScopesSchema.optional(),
-  tunnelsGrants: z2.array(authTokenTunnelGrantSchema).min(1).optional(),
+  tunnelsGrants: authTokenTunnelGrantSchema.optional(),
   metadata: z2.unknown().optional()
   // Additional metadata
 }).strict().superRefine((params, ctx) => {
@@ -224,10 +232,30 @@ var RstreamAuthResource = class {
       );
     }
     const engine = options?.engine ?? await this.client.getEngine().catch(() => void 0);
+    const scopedOptions = await this.resolveScopeOptions(params, options);
     return createAuthTokenFromClientCredentials(credentials, params, {
-      engine
+      engine,
+      ...scopedOptions
     });
   }
+  async resolveScopeOptions(params, options) {
+    const tokenParams = createAuthTokenParamsSchema.parse(params);
+    if (options?.projectScoped === false) {
+      return options ?? {};
+    }
+    if (options?.projectId !== void 0 || options?.workspaceId !== void 0) {
+      return options;
+    }
+    if (tokenParams.scopes === void 0 && !tunnelGrantsNeedDefaultTarget(tokenParams.tunnelsGrants)) {
+      return options ?? {};
+    }
+    const target = await this.client.getEngineAuthTokenTarget();
+    return {
+      ...options,
+      projectId: target.projects?.[0],
+      workspaceId: target.workspaces?.[0]
+    };
+  }
 };
 function createAuthTokenFromClientCredentials(credentials, params, options) {
   const tokenParams = createAuthTokenParamsSchema.parse(params);
@@ -247,13 +275,66 @@ function createAuthTokenFromClientCredentials(credentials, params, options) {
 function normalizeAuthTokenTunnelGrants(params, options) {
   const tunnelsGrants = params.tunnelsGrants;
   if (tunnelsGrants !== void 0) {
-    return [...tunnelsGrants];
+    return applyDefaultTunnelGrantTarget(tunnelsGrants, options);
   }
   if (params.scopes) {
-    return [{ ...normalizeTunnelGrantTarget(options), scopes: params.scopes }];
+    return { ...normalizeTunnelGrantTarget(options), scopes: params.scopes };
   }
   return void 0;
 }
+function applyDefaultTunnelGrantTarget(grants, options, inheritedTarget = false) {
+  if (options?.projectScoped === false) {
+    return grants;
+  }
+  if ("AND" in grants) {
+    const branchHasTarget = inheritedTarget || grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
+    return {
+      AND: grants.AND.map(
+        (grant) => applyDefaultTunnelGrantTarget(grant, options, branchHasTarget)
+      )
+    };
+  }
+  if ("OR" in grants) {
+    return {
+      OR: grants.OR.map(
+        (grant) => applyDefaultTunnelGrantTarget(grant, options, inheritedTarget)
+      )
+    };
+  }
+  if (grants.scopes === void 0 || tunnelGrantHasTarget(grants) || inheritedTarget) {
+    return grants;
+  }
+  return { ...normalizeTunnelGrantTarget(options), scopes: grants.scopes };
+}
+function tunnelGrantsNeedDefaultTarget(grants, inheritedTarget = false) {
+  if (grants === void 0) {
+    return false;
+  }
+  if ("AND" in grants) {
+    const branchHasTarget = inheritedTarget || grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
+    return grants.AND.some(
+      (grant) => tunnelGrantsNeedDefaultTarget(grant, branchHasTarget)
+    );
+  }
+  if ("OR" in grants) {
+    return grants.OR.some(
+      (grant) => tunnelGrantsNeedDefaultTarget(grant, inheritedTarget)
+    );
+  }
+  return grants.scopes !== void 0 && !tunnelGrantHasTarget(grants) && !inheritedTarget;
+}
+function tunnelGrantHasTarget(grant) {
+  return grant.projects !== void 0 || grant.workspaces !== void 0;
+}
+function tunnelGrantTreeHasTarget(grants) {
+  if ("AND" in grants) {
+    return grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
+  }
+  if ("OR" in grants) {
+    return grants.OR.some((grant) => tunnelGrantTreeHasTarget(grant));
+  }
+  return tunnelGrantHasTarget(grants);
+}
 function normalizeTunnelGrantTarget(options) {
   const projectId = normalizeOptionalString(options?.projectId);
   const workspaceId = normalizeOptionalString(options?.workspaceId);
@@ -266,6 +347,9 @@ function normalizeTunnelGrantTarget(options) {
   if (workspaceId !== void 0) {
     return { workspaces: [workspaceId] };
   }
+  if (options?.projectScoped === false) {
+    return {};
+  }
   throw new Error(
     "Project ID or workspace ID is required when using scope-only tunnel grants."
   );
@@ -398,7 +482,7 @@ async function resolveTunnelsEngine(config) {
     );
   }
   throw new Error(
-    "Engine URL is not defined. Provide an engine, use RSTREAM_ENGINE, or configure a managed project endpoint with control-plane access."
+    "Engine URL is not defined. Provide an engine, use RSTREAM_ENGINE, or configure a managed project endpoint with Control plane API access."
   );
 }
 async function resolveManagedTunnelsProject(config) {
@@ -474,6 +558,7 @@ var turnTokenClaimsSchema = z3.object({
   exp: z3.number().int().optional(),
   iat: z3.number().int().optional(),
   token_endpoint: z3.string().regex(/^[0-9a-f]{8}$/i).optional(),
+  tokendpoint: z3.string().regex(/^[0-9a-f]{8}$/i).optional(),
   type: z3.enum(["app", "auth", "pat"])
 });
 var turnCredentialModeSchema = z3.enum(["api", "app", "pat"]);
@@ -650,7 +735,8 @@ function createPATTURNCredentials(options) {
   if (!tokenEndpoint) {
     throw new Error("Token endpoint is required for TURN PAT mode.");
   }
-  if (claims.token_endpoint !== void 0 && claims.token_endpoint !== tokenEndpoint) {
+  const claimsTokenEndpoint = claims.token_endpoint ?? claims.tokendpoint;
+  if (claimsTokenEndpoint !== void 0 && claimsTokenEndpoint !== tokenEndpoint) {
     throw new Error("Token endpoint does not match the PAT token.");
   }
   const now = normalizeNow(options.now);
@@ -979,12 +1065,10 @@ var RstreamTunnelsClient = class {
   async getEngineAuthTokenParams() {
     const target = await this.getEngineAuthTokenTarget();
     return {
-      tunnelsGrants: [
-        {
-          ...target,
-          scopes: engineAuthTokenScopes
-        }
-      ]
+      tunnelsGrants: {
+        ...target,
+        scopes: engineAuthTokenScopes
+      }
     };
   }
   async getEngineAuthTokenTarget() {
@@ -1102,16 +1186,44 @@ function hasWatchOnlyTunnelGrants(token) {
   if (!hasWatchOnlyPermissions(token.permissions)) {
     return false;
   }
-  if (!Array.isArray(token.tunnelsGrants) || token.tunnelsGrants.length === 0) {
+  if (token.tunnelsGrants === void 0) {
     return false;
   }
-  return token.tunnelsGrants.every((grant) => {
-    const tunnels = grant.scopes?.tunnels;
-    if (tunnels === void 0) {
-      return false;
+  return hasWatchOnlyTunnelGrant(token.tunnelsGrants);
+}
+function hasWatchOnlyTunnelGrant(grant) {
+  return watchGrantBranches(grant).every(
+    (branch) => branch.hasList && !branch.hasMutationOrConnect
+  );
+}
+function watchGrantBranches(grant) {
+  if ("AND" in grant) {
+    return grant.AND.reduce(
+      (branches, child) => combineWatchGrantBranches(branches, child),
+      [{ hasList: false, hasMutationOrConnect: false }]
+    );
+  }
+  if ("OR" in grant) {
+    return grant.OR.flatMap(watchGrantBranches);
+  }
+  const tunnels = grant.scopes?.tunnels;
+  if (tunnels === void 0) {
+    return [{ hasList: false, hasMutationOrConnect: false }];
+  }
+  return [
+    {
+      hasList: tunnels.list !== void 0,
+      hasMutationOrConnect: tunnels.create !== void 0 || tunnels.connect !== void 0
     }
-    return tunnels.list !== void 0 && tunnels.create === void 0 && tunnels.connect === void 0;
-  });
+  ];
+}
+function combineWatchGrantBranches(branches, child) {
+  return branches.flatMap(
+    (branch) => watchGrantBranches(child).map((childBranch) => ({
+      hasList: branch.hasList || childBranch.hasList,
+      hasMutationOrConnect: branch.hasMutationOrConnect || childBranch.hasMutationOrConnect
+    }))
+  );
 }
 function hasWatchOnlyPermissions(permissions) {
   if (!Array.isArray(permissions)) {

package/dist/openapi.js

@@ -103,8 +103,7 @@ var tunnelSchema = z2.object({
   tls_alpns: z2.array(z2.string()).optional(),
   tls_min_version: z2.string().optional(),
   tls_ciphers: z2.array(z2.string()).optional(),
-  mtls: z2.boolean().optional(),
-  mtls_ca_cert_pem: z2.string().optional(),
+  mtls_auth: z2.boolean().optional(),
   http_version: z2.enum(["http/1.1", "h2", "h2c", "h3"]).optional(),
   http_use_tls: z2.boolean().optional(),
   upstream_tls: z2.boolean().optional(),
@@ -274,7 +273,7 @@ var routedTunnelSchema = z3.object({
   httpUseTls: z3.boolean().optional(),
   upstreamTls: z3.boolean().optional(),
   tokenAuth: z3.boolean().optional(),
-  mtls: z3.boolean().optional()
+  mtls_auth: z3.boolean().optional()
 });
 var routingSchema = z3.discriminatedUnion("decision", [
   z3.object({ decision: z3.literal("routed"), tunnel: routedTunnelSchema }),
@@ -516,7 +515,7 @@ var engineOpenApiDocument = {
   info: {
     title: "rstream Engine API",
     version: "1.0.0",
-    description: "Operational data-plane API exposed by rstream-engine. This surface is scoped to the authenticated engine or project endpoint and covers live clients, live tunnels, and state-change streams."
+    description: "Operational Engine API exposed by rstream engine. This surface is scoped to the authenticated engine or project endpoint and covers live clients, live tunnels, and state-change streams."
   },
   servers: [
     {

package/dist/openapi.mjs

@@ -1,7 +1,7 @@
 import {
   engineOpenApiDocument,
   engineOpenApiJson
-} from "./chunk-7RZ743EF.mjs";
+} from "./chunk-NHUJ3FYM.mjs";
 export {
   engineOpenApiDocument,
   engineOpenApiJson

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rstreamlabs/tunnels",
-  "version": "1.0.8",
-  "description": "JS/TS SDK for the rstream tunnels data plane and engine APIs.",
+  "version": "1.0.10",
+  "description": "JS/TS SDK for the rstream Engine API and tunnel runtime APIs.",
   "author": "@uartnet <hello@rstream.io>",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -43,7 +43,7 @@
     "typescript-config": "*"
   },
   "dependencies": {
-    "@rstreamlabs/rstream": "2.1.1",
+    "@rstreamlabs/rstream": "2.1.3",
     "jsonwebtoken": "^9.0.3",
     "zod": "^4.3.6"
   },