@rstreamlabs/tunnels 2.0.0 → 3.0.0

package/README.md

@@ -112,7 +112,7 @@ await watch.connect();
 ```
 
 URL-based watch authentication requires a short-lived token with bounded
-lifetime and watch-only tunnel list grants.
+lifetime and watch-only tunnel list resources.
 
 Browser integrations should provide `auth` as a function that calls a backend
 token route and returns a fresh watch token for each connection attempt. Do not
@@ -121,17 +121,19 @@ store the `rstream.token` query token as durable browser state.
 ## Scoped Auth Tokens
 
 `auth.createAuthToken()` mints short-lived engine tokens. Prefer
-`tunnelsGrants` when delegating capabilities to devices, browser sessions, or
-other services.
+`resources.tunnels` when delegating capabilities to devices, browser sessions,
+or other services.
 
 ```ts
 const { token } = await client.auth.createAuthToken({
   expires_in: 60,
-  tunnelsGrants: {
-    scopes: {
-      tunnels: {
-        list: { select: { id: true, name: true, protocol: true } },
-        connect: { params: { path: { regex: "^/api" } } },
+  resources: {
+    tunnels: {
+      scopes: {
+        tunnels: {
+          list: { select: { id: true, name: true, protocol: true } },
+          connect: { params: { path: { regex: "^/api" } } },
+        },
       },
     },
   },
@@ -139,8 +141,8 @@ const { token } = await client.auth.createAuthToken({
 ```
 
 When the client is configured with `projectEndpoint` or `projectId`, scope-only
-requests and scope-only grant leaves are project-scoped by default. Pass
-`projectScoped: false` only when a global scope-only grant is intentional.
+tunnel resources are project-scoped by default. Pass `projectScoped: false`
+only when a global scope-only tunnel resource is intentional.
 
 ## TURN Credentials
 
@@ -160,9 +162,14 @@ const turn = await createTURNCredentials({
   },
   projectEndpoint: "project-endpoint",
   clusterDomain: "cluster.example.rstream.test",
+  ttlSeconds: 600,
 });
 ```
 
+TURN credentials are short-lived. `ttlSeconds` is optional, defaults to 600 for
+local derivation, and must be an integer between 1 and 3600 seconds. PAT-backed
+credentials are additionally capped by the PAT expiration.
+
 ## Webhooks
 
 Validate signed engine webhook payloads with constant-time signature comparison

package/dist/index.d.mts

@@ -229,6 +229,7 @@ interface CreateAPITURNCredentialsOptions {
     credentials: RstreamCredentials;
     projectEndpoint?: string;
     projectId?: string;
+    ttlSeconds?: number;
 }
 interface CreatePATTURNCredentialsOptions {
     clusterDomain: string;

package/dist/index.d.ts

@@ -229,6 +229,7 @@ interface CreateAPITURNCredentialsOptions {
     credentials: RstreamCredentials;
     projectEndpoint?: string;
     projectId?: string;
+    ttlSeconds?: number;
 }
 interface CreatePATTURNCredentialsOptions {
     clusterDomain: string;

package/dist/index.js

@@ -107,7 +107,7 @@ var RstreamAuthResource = class {
     if (options?.projectId !== void 0 || options?.workspaceId !== void 0) {
       return options;
     }
-    if (tokenParams.scopes === void 0 && !tunnelGrantsNeedDefaultTarget(tokenParams.tunnelsGrants)) {
+    if (!tunnelResourcesNeedDefaultTarget(tokenParams.resources?.tunnels)) {
       return options ?? {};
     }
     const target = await this.client.getEngineAuthTokenTarget();
@@ -124,8 +124,8 @@ function createAuthTokenFromClientCredentials(credentials, params, options) {
     metadata: {
       engine: options?.engine
     },
-    tunnelsGrants: normalizeAuthTokenTunnelGrants(tokenParams, options),
-    permissions: null
+    permissions: null,
+    resources: normalizeAuthTokenResources(tokenParams, options)
   };
   const { token } = (0, import_rstream.createClientCredentialsToken)(credentials, {
     claims: payload,
@@ -133,70 +133,73 @@ function createAuthTokenFromClientCredentials(credentials, params, options) {
   });
   return { token };
 }
-function normalizeAuthTokenTunnelGrants(params, options) {
-  const tunnelsGrants = params.tunnelsGrants;
-  if (tunnelsGrants !== void 0) {
-    return applyDefaultTunnelGrantTarget(tunnelsGrants, options);
-  }
-  if (params.scopes) {
-    return { ...normalizeTunnelGrantTarget(options), scopes: params.scopes };
-  }
-  return void 0;
+function normalizeAuthTokenResources(params, options) {
+  return {
+    tunnels: applyDefaultTunnelResourceTarget(
+      requireTunnelResource(params),
+      options
+    )
+  };
+}
+function requireTunnelResource(params) {
+  const tunnels = params.resources?.tunnels;
+  if (tunnels !== void 0) return tunnels;
+  throw new Error("Explicit resources.tunnels is required.");
 }
-function applyDefaultTunnelGrantTarget(grants, options, inheritedTarget = false) {
+function applyDefaultTunnelResourceTarget(resource, options, inheritedTarget = false) {
   if (options?.projectScoped === false) {
-    return grants;
+    return resource;
   }
-  if ("AND" in grants) {
-    const branchHasTarget = inheritedTarget || grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
+  if ("AND" in resource) {
+    const branchHasTarget = inheritedTarget || resource.AND.some((child) => tunnelResourceTreeHasTarget(child));
     return {
-      AND: grants.AND.map(
-        (grant) => applyDefaultTunnelGrantTarget(grant, options, branchHasTarget)
+      AND: resource.AND.map(
+        (child) => applyDefaultTunnelResourceTarget(child, options, branchHasTarget)
       )
     };
   }
-  if ("OR" in grants) {
+  if ("OR" in resource) {
     return {
-      OR: grants.OR.map(
-        (grant) => applyDefaultTunnelGrantTarget(grant, options, inheritedTarget)
+      OR: resource.OR.map(
+        (child) => applyDefaultTunnelResourceTarget(child, options, inheritedTarget)
       )
     };
   }
-  if (grants.scopes === void 0 || tunnelGrantHasTarget(grants) || inheritedTarget) {
-    return grants;
+  if (resource.scopes === void 0 || tunnelResourceHasTarget(resource) || inheritedTarget) {
+    return resource;
   }
-  return { ...normalizeTunnelGrantTarget(options), scopes: grants.scopes };
+  return { ...normalizeTunnelResourceTarget(options), scopes: resource.scopes };
 }
-function tunnelGrantsNeedDefaultTarget(grants, inheritedTarget = false) {
-  if (grants === void 0) {
+function tunnelResourcesNeedDefaultTarget(resource, inheritedTarget = false) {
+  if (resource === void 0) {
     return false;
   }
-  if ("AND" in grants) {
-    const branchHasTarget = inheritedTarget || grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
-    return grants.AND.some(
-      (grant) => tunnelGrantsNeedDefaultTarget(grant, branchHasTarget)
+  if ("AND" in resource) {
+    const branchHasTarget = inheritedTarget || resource.AND.some((child) => tunnelResourceTreeHasTarget(child));
+    return resource.AND.some(
+      (child) => tunnelResourcesNeedDefaultTarget(child, branchHasTarget)
     );
   }
-  if ("OR" in grants) {
-    return grants.OR.some(
-      (grant) => tunnelGrantsNeedDefaultTarget(grant, inheritedTarget)
+  if ("OR" in resource) {
+    return resource.OR.some(
+      (child) => tunnelResourcesNeedDefaultTarget(child, inheritedTarget)
     );
   }
-  return grants.scopes !== void 0 && !tunnelGrantHasTarget(grants) && !inheritedTarget;
+  return resource.scopes !== void 0 && !tunnelResourceHasTarget(resource) && !inheritedTarget;
 }
-function tunnelGrantHasTarget(grant) {
-  return grant.projects !== void 0 || grant.workspaces !== void 0;
+function tunnelResourceHasTarget(resource) {
+  return resource.projects !== void 0 || resource.workspaces !== void 0;
 }
-function tunnelGrantTreeHasTarget(grants) {
-  if ("AND" in grants) {
-    return grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
+function tunnelResourceTreeHasTarget(resource) {
+  if ("AND" in resource) {
+    return resource.AND.some((child) => tunnelResourceTreeHasTarget(child));
   }
-  if ("OR" in grants) {
-    return grants.OR.some((grant) => tunnelGrantTreeHasTarget(grant));
+  if ("OR" in resource) {
+    return resource.OR.some((child) => tunnelResourceTreeHasTarget(child));
   }
-  return tunnelGrantHasTarget(grants);
+  return tunnelResourceHasTarget(resource);
 }
-function normalizeTunnelGrantTarget(options) {
+function normalizeTunnelResourceTarget(options) {
   const projectId = normalizeOptionalString(options?.projectId);
   const workspaceId = normalizeOptionalString(options?.workspaceId);
   if (projectId !== void 0 && workspaceId !== void 0) {
@@ -212,7 +215,7 @@ function normalizeTunnelGrantTarget(options) {
     return {};
   }
   throw new Error(
-    "Project ID or workspace ID is required when using scope-only tunnel grants."
+    "Project ID or workspace ID is required when using scope-only tunnel resources."
   );
 }
 function normalizeOptionalString(value) {
@@ -1129,6 +1132,9 @@ function normalizeTTLSeconds(ttlSeconds) {
   }
   return ttl;
 }
+function createAPITURNCredentialsParams(ttlSeconds) {
+  return ttlSeconds === void 0 ? {} : { ttlSeconds: normalizeTTLSeconds(ttlSeconds) };
+}
 function normalizePort(port, fallback, name) {
   const normalized = port ?? fallback;
   if (!Number.isInteger(normalized) || normalized < 1 || normalized > 65535) {
@@ -1158,19 +1164,21 @@ function parseTURNTokenClaims(token) {
   if (!payloadPart) {
     throw new Error("Invalid token format.");
   }
-  let decoded;
-  try {
-    const payload = Buffer.from(payloadPart, "base64url").toString("utf8");
-    decoded = JSON.parse(payload);
-  } catch {
-    throw new Error("Invalid token format.");
-  }
+  const decoded = parseTURNTokenPayload(payloadPart);
   const parsed = turnTokenClaimsSchema.safeParse(decoded);
   if (!parsed.success) {
     throw new Error("Invalid token format.");
   }
   return parsed.data;
 }
+function parseTURNTokenPayload(payloadPart) {
+  try {
+    const payload = Buffer.from(payloadPart, "base64url").toString("utf8");
+    return JSON.parse(payload);
+  } catch {
+    throw new Error("Invalid token format.");
+  }
+}
 function requirePATExpiration(claims, now) {
   const exp = claims.exp;
   if (typeof exp !== "number") {
@@ -1244,8 +1252,12 @@ async function createAPITURNCredentials(options) {
     apiUrl: options.apiUrl,
     credentials: options.credentials
   });
+  const params = createAPITURNCredentialsParams(options.ttlSeconds);
   if (projectId) {
-    return await client.tunnels.projects.createTurnCredentials(projectId);
+    return await client.tunnels.projects.createTurnCredentials(
+      projectId,
+      params
+    );
   }
   if (!projectEndpoint) {
     throw new Error(
@@ -1253,7 +1265,8 @@ async function createAPITURNCredentials(options) {
     );
   }
   return await client.tunnels.projects.createTurnCredentialsByEndpoint(
-    projectEndpoint
+    projectEndpoint,
+    params
   );
 }
 function createPATTURNCredentials(options) {
@@ -1371,7 +1384,8 @@ async function createTURNCredentials(options) {
       apiUrl: options.apiUrl,
       credentials: controlPlaneCredentials,
       projectEndpoint,
-      projectId: options.projectId
+      projectId: options.projectId,
+      ttlSeconds: options.ttlSeconds
     });
   }
   const clusterDomain = normalizeClusterDomain(options.clusterDomain) ?? (projectEndpoint && options.engine ? deriveClusterDomainFromEngine(projectEndpoint, options.engine) : void 0);
@@ -1607,9 +1621,11 @@ var RstreamTunnelsClient = class {
   async getEngineAuthTokenParams() {
     const target = await this.getEngineAuthTokenTarget();
     return {
-      tunnelsGrants: {
-        ...target,
-        scopes: engineAuthTokenScopes
+      resources: {
+        tunnels: {
+          ...target,
+          scopes: engineAuthTokenScopes
+        }
       }
     };
   }
@@ -1719,37 +1735,38 @@ function validateWatchQueryToken(token) {
       "Watch requires a token with a bounded lifetime of at most 3600 seconds."
     );
   }
-  if (!hasWatchOnlyTunnelGrants(parsed.data)) {
+  if (!hasWatchOnlyTunnelResources(parsed.data)) {
     throw new Error(
-      "Watch requires a fine-grained token limited to tunnel list grants for URL-based authentication."
+      "Watch requires a fine-grained token limited to tunnel list resources for URL-based authentication."
     );
   }
 }
-function hasWatchOnlyTunnelGrants(token) {
+function hasWatchOnlyTunnelResources(token) {
   if (!hasWatchOnlyPermissions(token.permissions)) {
     return false;
   }
-  if (token.tunnelsGrants === void 0) {
+  const resource = token.resources?.tunnels;
+  if (resource === void 0) {
     return false;
   }
-  return hasWatchOnlyTunnelGrant(token.tunnelsGrants);
+  return hasWatchOnlyTunnelResource(resource);
 }
-function hasWatchOnlyTunnelGrant(grant) {
-  return watchGrantBranches(grant).every(
+function hasWatchOnlyTunnelResource(resource) {
+  return watchResourceBranches(resource).every(
     (branch) => branch.hasList && !branch.hasMutationOrConnect
   );
 }
-function watchGrantBranches(grant) {
-  if ("AND" in grant) {
-    return grant.AND.reduce(
-      (branches, child) => combineWatchGrantBranches(branches, child),
+function watchResourceBranches(resource) {
+  if ("AND" in resource) {
+    return resource.AND.reduce(
+      (branches, child) => combineWatchResourceBranches(branches, child),
       [{ hasList: false, hasMutationOrConnect: false }]
     );
   }
-  if ("OR" in grant) {
-    return grant.OR.flatMap(watchGrantBranches);
+  if ("OR" in resource) {
+    return resource.OR.flatMap(watchResourceBranches);
   }
-  const tunnels = grant.scopes?.tunnels;
+  const tunnels = resource.scopes?.tunnels;
   if (tunnels === void 0) {
     return [{ hasList: false, hasMutationOrConnect: false }];
   }
@@ -1760,9 +1777,9 @@ function watchGrantBranches(grant) {
     }
   ];
 }
-function combineWatchGrantBranches(branches, child) {
+function combineWatchResourceBranches(branches, child) {
   return branches.flatMap(
-    (branch) => watchGrantBranches(child).map((childBranch) => ({
+    (branch) => watchResourceBranches(child).map((childBranch) => ({
       hasList: branch.hasList || childBranch.hasList,
       hasMutationOrConnect: branch.hasMutationOrConnect || childBranch.hasMutationOrConnect
     }))
@@ -1773,7 +1790,7 @@ function hasWatchOnlyPermissions(permissions) {
     return true;
   }
   return permissions.every(
-    (permission) => permission === "tunnels.resources.read-only" || permission === "network.resources.read-only"
+    (permission) => permission === "tunnels.resources.read-only"
   );
 }
 var Watch = class {

package/dist/index.mjs

@@ -48,7 +48,7 @@ var RstreamAuthResource = class {
     if (options?.projectId !== void 0 || options?.workspaceId !== void 0) {
       return options;
     }
-    if (tokenParams.scopes === void 0 && !tunnelGrantsNeedDefaultTarget(tokenParams.tunnelsGrants)) {
+    if (!tunnelResourcesNeedDefaultTarget(tokenParams.resources?.tunnels)) {
       return options ?? {};
     }
     const target = await this.client.getEngineAuthTokenTarget();
@@ -65,8 +65,8 @@ function createAuthTokenFromClientCredentials(credentials, params, options) {
     metadata: {
       engine: options?.engine
     },
-    tunnelsGrants: normalizeAuthTokenTunnelGrants(tokenParams, options),
-    permissions: null
+    permissions: null,
+    resources: normalizeAuthTokenResources(tokenParams, options)
   };
   const { token } = createClientCredentialsToken(credentials, {
     claims: payload,
@@ -74,70 +74,73 @@ function createAuthTokenFromClientCredentials(credentials, params, options) {
   });
   return { token };
 }
-function normalizeAuthTokenTunnelGrants(params, options) {
-  const tunnelsGrants = params.tunnelsGrants;
-  if (tunnelsGrants !== void 0) {
-    return applyDefaultTunnelGrantTarget(tunnelsGrants, options);
-  }
-  if (params.scopes) {
-    return { ...normalizeTunnelGrantTarget(options), scopes: params.scopes };
-  }
-  return void 0;
+function normalizeAuthTokenResources(params, options) {
+  return {
+    tunnels: applyDefaultTunnelResourceTarget(
+      requireTunnelResource(params),
+      options
+    )
+  };
+}
+function requireTunnelResource(params) {
+  const tunnels = params.resources?.tunnels;
+  if (tunnels !== void 0) return tunnels;
+  throw new Error("Explicit resources.tunnels is required.");
 }
-function applyDefaultTunnelGrantTarget(grants, options, inheritedTarget = false) {
+function applyDefaultTunnelResourceTarget(resource, options, inheritedTarget = false) {
   if (options?.projectScoped === false) {
-    return grants;
+    return resource;
   }
-  if ("AND" in grants) {
-    const branchHasTarget = inheritedTarget || grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
+  if ("AND" in resource) {
+    const branchHasTarget = inheritedTarget || resource.AND.some((child) => tunnelResourceTreeHasTarget(child));
     return {
-      AND: grants.AND.map(
-        (grant) => applyDefaultTunnelGrantTarget(grant, options, branchHasTarget)
+      AND: resource.AND.map(
+        (child) => applyDefaultTunnelResourceTarget(child, options, branchHasTarget)
       )
     };
   }
-  if ("OR" in grants) {
+  if ("OR" in resource) {
     return {
-      OR: grants.OR.map(
-        (grant) => applyDefaultTunnelGrantTarget(grant, options, inheritedTarget)
+      OR: resource.OR.map(
+        (child) => applyDefaultTunnelResourceTarget(child, options, inheritedTarget)
       )
     };
   }
-  if (grants.scopes === void 0 || tunnelGrantHasTarget(grants) || inheritedTarget) {
-    return grants;
+  if (resource.scopes === void 0 || tunnelResourceHasTarget(resource) || inheritedTarget) {
+    return resource;
   }
-  return { ...normalizeTunnelGrantTarget(options), scopes: grants.scopes };
+  return { ...normalizeTunnelResourceTarget(options), scopes: resource.scopes };
 }
-function tunnelGrantsNeedDefaultTarget(grants, inheritedTarget = false) {
-  if (grants === void 0) {
+function tunnelResourcesNeedDefaultTarget(resource, inheritedTarget = false) {
+  if (resource === void 0) {
     return false;
   }
-  if ("AND" in grants) {
-    const branchHasTarget = inheritedTarget || grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
-    return grants.AND.some(
-      (grant) => tunnelGrantsNeedDefaultTarget(grant, branchHasTarget)
+  if ("AND" in resource) {
+    const branchHasTarget = inheritedTarget || resource.AND.some((child) => tunnelResourceTreeHasTarget(child));
+    return resource.AND.some(
+      (child) => tunnelResourcesNeedDefaultTarget(child, branchHasTarget)
     );
   }
-  if ("OR" in grants) {
-    return grants.OR.some(
-      (grant) => tunnelGrantsNeedDefaultTarget(grant, inheritedTarget)
+  if ("OR" in resource) {
+    return resource.OR.some(
+      (child) => tunnelResourcesNeedDefaultTarget(child, inheritedTarget)
     );
   }
-  return grants.scopes !== void 0 && !tunnelGrantHasTarget(grants) && !inheritedTarget;
+  return resource.scopes !== void 0 && !tunnelResourceHasTarget(resource) && !inheritedTarget;
 }
-function tunnelGrantHasTarget(grant) {
-  return grant.projects !== void 0 || grant.workspaces !== void 0;
+function tunnelResourceHasTarget(resource) {
+  return resource.projects !== void 0 || resource.workspaces !== void 0;
 }
-function tunnelGrantTreeHasTarget(grants) {
-  if ("AND" in grants) {
-    return grants.AND.some((grant) => tunnelGrantTreeHasTarget(grant));
+function tunnelResourceTreeHasTarget(resource) {
+  if ("AND" in resource) {
+    return resource.AND.some((child) => tunnelResourceTreeHasTarget(child));
   }
-  if ("OR" in grants) {
-    return grants.OR.some((grant) => tunnelGrantTreeHasTarget(grant));
+  if ("OR" in resource) {
+    return resource.OR.some((child) => tunnelResourceTreeHasTarget(child));
   }
-  return tunnelGrantHasTarget(grants);
+  return tunnelResourceHasTarget(resource);
 }
-function normalizeTunnelGrantTarget(options) {
+function normalizeTunnelResourceTarget(options) {
   const projectId = normalizeOptionalString(options?.projectId);
   const workspaceId = normalizeOptionalString(options?.workspaceId);
   if (projectId !== void 0 && workspaceId !== void 0) {
@@ -153,7 +156,7 @@ function normalizeTunnelGrantTarget(options) {
     return {};
   }
   throw new Error(
-    "Project ID or workspace ID is required when using scope-only tunnel grants."
+    "Project ID or workspace ID is required when using scope-only tunnel resources."
   );
 }
 function normalizeOptionalString(value) {
@@ -390,6 +393,9 @@ function normalizeTTLSeconds(ttlSeconds) {
   }
   return ttl;
 }
+function createAPITURNCredentialsParams(ttlSeconds) {
+  return ttlSeconds === void 0 ? {} : { ttlSeconds: normalizeTTLSeconds(ttlSeconds) };
+}
 function normalizePort(port, fallback, name) {
   const normalized = port ?? fallback;
   if (!Number.isInteger(normalized) || normalized < 1 || normalized > 65535) {
@@ -419,19 +425,21 @@ function parseTURNTokenClaims(token) {
   if (!payloadPart) {
     throw new Error("Invalid token format.");
   }
-  let decoded;
-  try {
-    const payload = Buffer.from(payloadPart, "base64url").toString("utf8");
-    decoded = JSON.parse(payload);
-  } catch {
-    throw new Error("Invalid token format.");
-  }
+  const decoded = parseTURNTokenPayload(payloadPart);
   const parsed = turnTokenClaimsSchema.safeParse(decoded);
   if (!parsed.success) {
     throw new Error("Invalid token format.");
   }
   return parsed.data;
 }
+function parseTURNTokenPayload(payloadPart) {
+  try {
+    const payload = Buffer.from(payloadPart, "base64url").toString("utf8");
+    return JSON.parse(payload);
+  } catch {
+    throw new Error("Invalid token format.");
+  }
+}
 function requirePATExpiration(claims, now) {
   const exp = claims.exp;
   if (typeof exp !== "number") {
@@ -505,8 +513,12 @@ async function createAPITURNCredentials(options) {
     apiUrl: options.apiUrl,
     credentials: options.credentials
   });
+  const params = createAPITURNCredentialsParams(options.ttlSeconds);
   if (projectId) {
-    return await client.tunnels.projects.createTurnCredentials(projectId);
+    return await client.tunnels.projects.createTurnCredentials(
+      projectId,
+      params
+    );
   }
   if (!projectEndpoint) {
     throw new Error(
@@ -514,7 +526,8 @@ async function createAPITURNCredentials(options) {
     );
   }
   return await client.tunnels.projects.createTurnCredentialsByEndpoint(
-    projectEndpoint
+    projectEndpoint,
+    params
   );
 }
 function createPATTURNCredentials(options) {
@@ -632,7 +645,8 @@ async function createTURNCredentials(options) {
       apiUrl: options.apiUrl,
       credentials: controlPlaneCredentials,
       projectEndpoint,
-      projectId: options.projectId
+      projectId: options.projectId,
+      ttlSeconds: options.ttlSeconds
     });
   }
   const clusterDomain = normalizeClusterDomain(options.clusterDomain) ?? (projectEndpoint && options.engine ? deriveClusterDomainFromEngine(projectEndpoint, options.engine) : void 0);
@@ -868,9 +882,11 @@ var RstreamTunnelsClient = class {
   async getEngineAuthTokenParams() {
     const target = await this.getEngineAuthTokenTarget();
     return {
-      tunnelsGrants: {
-        ...target,
-        scopes: engineAuthTokenScopes
+      resources: {
+        tunnels: {
+          ...target,
+          scopes: engineAuthTokenScopes
+        }
       }
     };
   }
@@ -980,37 +996,38 @@ function validateWatchQueryToken(token) {
       "Watch requires a token with a bounded lifetime of at most 3600 seconds."
     );
   }
-  if (!hasWatchOnlyTunnelGrants(parsed.data)) {
+  if (!hasWatchOnlyTunnelResources(parsed.data)) {
     throw new Error(
-      "Watch requires a fine-grained token limited to tunnel list grants for URL-based authentication."
+      "Watch requires a fine-grained token limited to tunnel list resources for URL-based authentication."
     );
   }
 }
-function hasWatchOnlyTunnelGrants(token) {
+function hasWatchOnlyTunnelResources(token) {
   if (!hasWatchOnlyPermissions(token.permissions)) {
     return false;
   }
-  if (token.tunnelsGrants === void 0) {
+  const resource = token.resources?.tunnels;
+  if (resource === void 0) {
     return false;
   }
-  return hasWatchOnlyTunnelGrant(token.tunnelsGrants);
+  return hasWatchOnlyTunnelResource(resource);
 }
-function hasWatchOnlyTunnelGrant(grant) {
-  return watchGrantBranches(grant).every(
+function hasWatchOnlyTunnelResource(resource) {
+  return watchResourceBranches(resource).every(
     (branch) => branch.hasList && !branch.hasMutationOrConnect
   );
 }
-function watchGrantBranches(grant) {
-  if ("AND" in grant) {
-    return grant.AND.reduce(
-      (branches, child) => combineWatchGrantBranches(branches, child),
+function watchResourceBranches(resource) {
+  if ("AND" in resource) {
+    return resource.AND.reduce(
+      (branches, child) => combineWatchResourceBranches(branches, child),
       [{ hasList: false, hasMutationOrConnect: false }]
     );
   }
-  if ("OR" in grant) {
-    return grant.OR.flatMap(watchGrantBranches);
+  if ("OR" in resource) {
+    return resource.OR.flatMap(watchResourceBranches);
   }
-  const tunnels = grant.scopes?.tunnels;
+  const tunnels = resource.scopes?.tunnels;
   if (tunnels === void 0) {
     return [{ hasList: false, hasMutationOrConnect: false }];
   }
@@ -1021,9 +1038,9 @@ function watchGrantBranches(grant) {
     }
   ];
 }
-function combineWatchGrantBranches(branches, child) {
+function combineWatchResourceBranches(branches, child) {
   return branches.flatMap(
-    (branch) => watchGrantBranches(child).map((childBranch) => ({
+    (branch) => watchResourceBranches(child).map((childBranch) => ({
       hasList: branch.hasList || childBranch.hasList,
       hasMutationOrConnect: branch.hasMutationOrConnect || childBranch.hasMutationOrConnect
     }))
@@ -1034,7 +1051,7 @@ function hasWatchOnlyPermissions(permissions) {
     return true;
   }
   return permissions.every(
-    (permission) => permission === "tunnels.resources.read-only" || permission === "network.resources.read-only"
+    (permission) => permission === "tunnels.resources.read-only"
   );
 }
 var Watch = class {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rstreamlabs/tunnels",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "JS/TS SDK for the rstream Engine API and tunnel runtime APIs.",
   "author": "@uartnet <hello@rstream.io>",
   "repository": {
@@ -47,7 +47,7 @@
     "typescript-config": "*"
   },
   "dependencies": {
-    "@rstreamlabs/rstream": "2.1.5",
+    "@rstreamlabs/rstream": "3.0.0",
     "@types/jsonwebtoken": "^9.0.10",
     "jsonwebtoken": "^9.0.3",
     "zod": "^4.3.6"