@rstreamlabs/tunnels 1.0.8 → 1.0.9

package/README.md

@@ -1,6 +1,6 @@
 # `@rstreamlabs/tunnels`
 
-Data-plane JS/TS SDK for rstream tunnels.
+Engine API JS/TS SDK for rstream tunnels.
 
 Use this package to talk directly to the tunnels engine: list tunnels, inspect
 clients, watch engine events, validate webhooks, and create fine-grained app
@@ -9,7 +9,7 @@ tokens.
 The package supports both:
 
 - direct engine usage, including self-hosted deployments
-- managed rstream projects resolved via the control plane
+- managed rstream projects resolved via the Control plane API
 - bearer-token authentication and application credentials
 
 ## Self-hosted usage
@@ -65,9 +65,11 @@ const tunnels = await client.tunnels.list();
 
 ## Fine-Grained Tokens
 
-Prefer `tunnelsGrants` with explicit `projects` or `workspaces`. Scope-only
-requests require a `projectId` or `workspaceId` option and are converted to
-targeted grants.
+Prefer `tunnelsGrants` with explicit operation scopes. When the client is
+configured with `projectEndpoint` or `projectId`, scope-only requests and
+scope-only grant leaves are project-scoped by default. Pass
+`projectScoped: false` only when you intentionally need a global scope-only
+grant.
 
 ```ts
 import { RstreamTunnelsClient } from "@rstreamlabs/tunnels";
@@ -82,18 +84,15 @@ const admin = new RstreamTunnelsClient({
 
 const { token } = await admin.auth.createAuthToken({
   expires_in: 60,
-  tunnelsGrants: [
-    {
-      projects: ["project-id"],
-      scopes: {
-        tunnels: {
-          create: { filters: { protocol: { oneof: ["http"] } } },
-          connect: { params: { path: { regex: "^/api" } } },
-          list: { select: { id: true, name: true, protocol: true } },
-        },
+  tunnelsGrants: {
+    scopes: {
+      tunnels: {
+        create: { filters: { protocol: { oneof: ["http"] } } },
+        connect: { params: { path: { regex: "^/api" } } },
+        list: { select: { id: true, name: true, protocol: true } },
       },
     },
-  ],
+  },
 });
 ```
 
@@ -118,4 +117,4 @@ const turn = await createTURNCredentials({
 `@rstreamlabs/tunnels` reads `RSTREAM_API_URL`, `RSTREAM_ENGINE`, and
 `RSTREAM_AUTHENTICATION_TOKEN` when they are not provided explicitly.
 
-For managed control-plane APIs, use [`@rstreamlabs/rstream`](../rstream/README.md).
+For the Control plane API, use [`@rstreamlabs/rstream`](../rstream/README.md).

package/dist/{chunk-7RZ743EF.mjs → chunk-TVDZNVSF.mjs}

@@ -67,8 +67,7 @@ var tunnelSchema = z2.object({
   tls_alpns: z2.array(z2.string()).optional(),
   tls_min_version: z2.string().optional(),
   tls_ciphers: z2.array(z2.string()).optional(),
-  mtls: z2.boolean().optional(),
-  mtls_ca_cert_pem: z2.string().optional(),
+  mtls_auth: z2.boolean().optional(),
   http_version: z2.enum(["http/1.1", "h2", "h2c", "h3"]).optional(),
   http_use_tls: z2.boolean().optional(),
   upstream_tls: z2.boolean().optional(),
@@ -245,7 +244,7 @@ var routedTunnelSchema = z3.object({
   httpUseTls: z3.boolean().optional(),
   upstreamTls: z3.boolean().optional(),
   tokenAuth: z3.boolean().optional(),
-  mtls: z3.boolean().optional()
+  mtls_auth: z3.boolean().optional()
 });
 var routingSchema = z3.discriminatedUnion("decision", [
   z3.object({ decision: z3.literal("routed"), tunnel: routedTunnelSchema }),
@@ -487,7 +486,7 @@ var engineOpenApiDocument = {
   info: {
     title: "rstream Engine API",
     version: "1.0.0",
-    description: "Operational data-plane API exposed by rstream-engine. This surface is scoped to the authenticated engine or project endpoint and covers live clients, live tunnels, and state-change streams."
+    description: "Operational Engine API exposed by rstream-engine. This surface is scoped to the authenticated engine or project endpoint and covers live clients, live tunnels, and state-change streams."
   },
   servers: [
     {