@rstreamlabs/tunnels 3.10.2 → 4.0.1

package/dist/index.js

@@ -170,7 +170,7 @@ __export(index_exports, {
   attachWebTTYParticipantParamsSchema: () => attachWebTTYParticipantParamsSchema,
   buildWebhookHeaders: () => buildWebhookHeaders,
   clientFilterSchema: () => clientFilterSchema,
-  clientSchema: () => clientSchema,
+  clientSchema: () => import_client2.clientSchema,
   createAPITURNCredentials: () => createAPITURNCredentials,
   createAPPTURNCredentials: () => createAPPTURNCredentials,
   createAuthTokenFromClientCredentials: () => createAuthTokenFromClientCredentials,
@@ -192,6 +192,8 @@ __export(index_exports, {
   listWebTTYKeyGrantDecryptMaterialParamsSchema: () => listWebTTYKeyGrantDecryptMaterialParamsSchema,
   listWebTTYSessionGroupsParamsSchema: () => listWebTTYSessionGroupsParamsSchema,
   listWebTTYSessionsParamsSchema: () => listWebTTYSessionsParamsSchema,
+  listedClientSchema: () => listedClientSchema,
+  listedTunnelSchema: () => listedTunnelSchema,
   normalizeEngineAddress: () => normalizeEngineAddress,
   parseWebTTYServers: () => parseWebTTYServers,
   projectLogEventsSchema: () => projectLogEventsSchema,
@@ -389,25 +391,10 @@ function normalizeOptionalString(value) {
 
 // src/client.ts
 var z = __toESM(require("zod"));
-var clientSchema = z.object({
-  id: z.string(),
-  status: z.enum(["online", "offline"]),
-  user_id: z.string().optional(),
-  workspace_id: z.string().optional(),
-  project_id: z.string().optional(),
-  cluster_id: z.string().optional(),
-  plan: z.string().optional(),
-  provider: z.string().optional(),
-  region: z.string().optional(),
-  agent: z.string().optional(),
-  channel: z.string().optional(),
-  version: z.string().optional(),
-  os: z.string().optional(),
-  arch: z.string().optional(),
-  protocol_version: z.string().optional(),
-  labels: z.record(z.string(), z.string()).optional()
-});
-var clientFilterSchema = clientSchema.pick({
+var import_client = require("@rstreamlabs/rstream/client");
+var import_client2 = require("@rstreamlabs/rstream/client");
+var listedClientSchema = import_client.clientSchema.partial();
+var clientFilterSchema = import_client.clientSchema.pick({
   id: true,
   status: true,
   user_id: true,
@@ -423,7 +410,7 @@ var listClientsParamsSchema = z.object({
   limit: z.number().int().min(1).optional(),
   filters: clientFilterSchema.optional()
 });
-var listClientsResponseSchema = z.array(clientSchema);
+var listClientsResponseSchema = z.array(listedClientSchema);
 
 // src/clients-resource.ts
 function clientPathId(id) {
@@ -452,24 +439,55 @@ var RstreamClientsResource = class {
         method: "GET"
       }
     );
-    return clientSchema.parse(response);
+    return import_client2.clientSchema.parse(response);
   }
 };
 
-// src/webtty-schemas.ts
+// src/tunnel.ts
+var import_tunnel = require("@rstreamlabs/rstream/tunnel");
 var z2 = __toESM(require("zod"));
-var webTTYTransportSchema = z2.enum([
+var DEFAULT_PUBLISHED_PORT = 443;
+var tunnelFilterSchema = import_tunnel.tunnelSchema.pick({
+  id: true,
+  name: true,
+  type: true,
+  status: true,
+  client_id: true,
+  user_id: true,
+  publish: true,
+  protocol: true,
+  hostname: true,
+  http_version: true,
+  labels: true
+}).partial();
+var listTunnelsParamsSchema = z2.object({
+  limit: z2.number().int().min(1).optional(),
+  filters: tunnelFilterSchema.optional()
+});
+var listedTunnelSchema = import_tunnel.tunnelSchema.partial();
+var listTunnelsResponseSchema = z2.array(listedTunnelSchema);
+function formatTunnelHost(tunnel) {
+  if (!tunnel.hostname) return tunnel.host;
+  if (!tunnel.port || tunnel.port === DEFAULT_PUBLISHED_PORT) {
+    return tunnel.hostname;
+  }
+  return `${tunnel.hostname}:${tunnel.port}`;
+}
+
+// src/webtty-schemas.ts
+var z3 = __toESM(require("zod"));
+var webTTYTransportSchema = z3.enum([
   "plain",
   "websocket",
   "webtransport"
 ]);
-var webTTYRecordingModeSchema = z2.enum(["recorded", "private"]);
-var webTTYEncryptionModeSchema = z2.enum(["managed", "e2e"]);
-var webTTYSessionModeSchema = z2.enum([
+var webTTYRecordingModeSchema = z3.enum(["recorded", "private"]);
+var webTTYEncryptionModeSchema = z3.enum(["managed", "e2e"]);
+var webTTYSessionModeSchema = z3.enum([
   "interactive",
   "non-interactive"
 ]);
-var webTTYOriginSchema = z2.enum([
+var webTTYOriginSchema = z3.enum([
   "human",
   "codex",
   "api",
@@ -477,259 +495,259 @@ var webTTYOriginSchema = z2.enum([
   "ci",
   "scheduled-job"
 ]);
-var webTTYParticipantRoleSchema = z2.enum(["controller", "spectator"]);
-var webTTYInitiatorKindSchema = z2.enum([
+var webTTYParticipantRoleSchema = z3.enum(["controller", "spectator"]);
+var webTTYInitiatorKindSchema = z3.enum([
   "user",
   "app",
   "agent",
   "service-account"
 ]);
-var webTTYContextMetadataSchema = z2.object({
+var webTTYContextMetadataSchema = z3.object({
   origin: webTTYOriginSchema.optional(),
-  origin_id: z2.string().optional(),
-  purpose: z2.string().optional(),
+  origin_id: z3.string().optional(),
+  purpose: z3.string().optional(),
   initiator_kind: webTTYInitiatorKindSchema.optional(),
-  agent_name: z2.string().optional(),
-  agent_version: z2.string().optional(),
-  request_id: z2.string().optional(),
-  labels: z2.record(z2.string(), z2.string()).optional()
+  agent_name: z3.string().optional(),
+  agent_version: z3.string().optional(),
+  request_id: z3.string().optional(),
+  labels: z3.record(z3.string(), z3.string()).optional()
 }).passthrough();
 
 // src/stream.ts
-var z3 = __toESM(require("zod"));
-var nonEmptyStringSchema = z3.string().min(1);
-var isoDateTimeSchema = z3.string().datetime({ offset: true });
-var ipAddressSchema = z3.string();
-var intNonNegSchema = z3.number().int().nonnegative();
-var numNonNegSchema = z3.number().nonnegative();
-var geolocationSchema = z3.object({
-  country: z3.string().optional(),
-  region: z3.string().optional()
+var z4 = __toESM(require("zod"));
+var nonEmptyStringSchema = z4.string().min(1);
+var isoDateTimeSchema = z4.string().datetime({ offset: true });
+var ipAddressSchema = z4.string();
+var intNonNegSchema = z4.number().int().nonnegative();
+var numNonNegSchema = z4.number().nonnegative();
+var geolocationSchema = z4.object({
+  country: z4.string().optional(),
+  region: z4.string().optional()
 });
-var streamTLSInfoSchema = z3.object({
-  version: z3.string().min(1).optional(),
-  cipher: z3.string().min(1).optional(),
-  protocol: z3.string().min(1).optional(),
-  curve: z3.string().min(1).optional(),
-  ech: z3.boolean().optional()
+var streamTLSInfoSchema = z4.object({
+  version: z4.string().min(1).optional(),
+  cipher: z4.string().min(1).optional(),
+  protocol: z4.string().min(1).optional(),
+  curve: z4.string().min(1).optional(),
+  ech: z4.boolean().optional()
 });
-var streamEndpointSchema = z3.object({
+var streamEndpointSchema = z4.object({
   ip: ipAddressSchema.optional(),
   geolocation: geolocationSchema.optional(),
   tls: streamTLSInfoSchema.optional()
 });
-var httpHeadersSchema = z3.record(
-  z3.string(),
-  z3.union([z3.string(), z3.array(z3.string())])
+var httpHeadersSchema = z4.record(
+  z4.string(),
+  z4.union([z4.string(), z4.array(z4.string())])
 );
-var httpProtocolSchema = z3.enum(["http/1.1", "h2", "h2c", "h3"]);
-var httpRequestSchema = z3.object({
+var httpProtocolSchema = z4.enum(["http/1.1", "h2", "h2c", "h3"]);
+var httpRequestSchema = z4.object({
   method: nonEmptyStringSchema,
-  scheme: z3.string().min(1).optional(),
+  scheme: z4.string().min(1).optional(),
   host: nonEmptyStringSchema.optional(),
   path: nonEmptyStringSchema.optional(),
-  query: z3.string().optional(),
+  query: z4.string().optional(),
   url: nonEmptyStringSchema.optional(),
   headers: httpHeadersSchema.optional(),
-  userAgent: z3.string().optional()
+  userAgent: z4.string().optional()
 });
-var httpResponseSchema = z3.object({
-  status: z3.number().int().min(100).max(999),
+var httpResponseSchema = z4.object({
+  status: z4.number().int().min(100).max(999),
   headers: httpHeadersSchema.optional()
 });
-var httpRequestStageSchema = z3.object({
+var httpRequestStageSchema = z4.object({
   protocol: httpProtocolSchema.optional(),
   request: httpRequestSchema
 });
-var httpResponseStageSchema = z3.object({
+var httpResponseStageSchema = z4.object({
   protocol: httpProtocolSchema.optional(),
   response: httpResponseSchema
 });
-var streamEntrySchema = z3.object({
-  kind: z3.enum([
+var streamEntrySchema = z4.object({
+  kind: z4.enum([
     "published_tunnel",
     "private_rstream",
     "proxy_egress",
     "internal"
   ]),
-  transport: z3.enum(["rstream", "tls", "quic", "dtls", "http", "tcp"]).optional()
+  transport: z4.enum(["rstream", "tls", "quic", "dtls", "http", "tcp"]).optional()
 });
-var tokenSourceSchema = z3.enum([
+var tokenSourceSchema = z4.enum([
   "authorization",
   "query",
   "client",
   "unknown"
 ]);
-var tokenTypeSchema = z3.enum(["auth", "pat", "app", "unknown"]);
-var firewallRuleSchema = z3.discriminatedUnion("kind", [
-  z3.object({ kind: z3.literal("none") }),
-  z3.object({ kind: z3.literal("mtls") }),
-  z3.object({
-    kind: z3.literal("rstream_auth"),
-    source: z3.literal("rstream_auth")
+var tokenTypeSchema = z4.enum(["auth", "pat", "app", "unknown"]);
+var firewallRuleSchema = z4.discriminatedUnion("kind", [
+  z4.object({ kind: z4.literal("none") }),
+  z4.object({ kind: z4.literal("mtls") }),
+  z4.object({
+    kind: z4.literal("rstream_auth"),
+    source: z4.literal("rstream_auth")
   }),
-  z3.object({
-    kind: z3.literal("rstream"),
-    source: z3.literal("private_rstream").optional()
+  z4.object({
+    kind: z4.literal("rstream"),
+    source: z4.literal("private_rstream").optional()
   }),
-  z3.object({
-    kind: z3.literal("token"),
+  z4.object({
+    kind: z4.literal("token"),
     source: tokenSourceSchema.optional(),
     tokenType: tokenTypeSchema.optional()
   })
 ]);
-var unauthorizedSourceSchema = z3.object({
+var unauthorizedSourceSchema = z4.object({
   source: tokenSourceSchema
 });
-var unauthorizedReasonSchema = (shape) => z3.object(shape).merge(unauthorizedSourceSchema);
-var unauthorizedSchema = z3.discriminatedUnion("reason", [
+var unauthorizedReasonSchema = (shape) => z4.object(shape).merge(unauthorizedSourceSchema);
+var unauthorizedSchema = z4.discriminatedUnion("reason", [
   unauthorizedReasonSchema({
-    reason: z3.literal("missing_token")
+    reason: z4.literal("missing_token")
   }),
   unauthorizedReasonSchema({
-    reason: z3.literal("invalid_token")
+    reason: z4.literal("invalid_token")
   }),
   unauthorizedReasonSchema({
-    reason: z3.literal("expired_token")
+    reason: z4.literal("expired_token")
   }),
   unauthorizedReasonSchema({
-    reason: z3.literal("invalid_secret")
+    reason: z4.literal("invalid_secret")
   }),
   unauthorizedReasonSchema({
-    reason: z3.literal("user_mismatch")
+    reason: z4.literal("user_mismatch")
   }),
   unauthorizedReasonSchema({
-    reason: z3.literal("insufficient_scope")
+    reason: z4.literal("insufficient_scope")
   }),
   unauthorizedReasonSchema({
-    reason: z3.literal("policy_denied"),
-    policy: z3.enum(["ip", "geo", "mtls", "challenge", "other"]),
-    value: z3.string().optional()
+    reason: z4.literal("policy_denied"),
+    policy: z4.enum(["ip", "geo", "mtls", "challenge", "other"]),
+    value: z4.string().optional()
   })
 ]);
-var failureSchema = z3.discriminatedUnion("kind", [
-  z3.object({
-    kind: z3.literal("timeout"),
+var failureSchema = z4.discriminatedUnion("kind", [
+  z4.object({
+    kind: z4.literal("timeout"),
     timeoutMs: intNonNegSchema.optional(),
-    message: z3.string().optional()
+    message: z4.string().optional()
   }),
-  z3.object({
-    kind: z3.literal("unauthorized"),
+  z4.object({
+    kind: z4.literal("unauthorized"),
     why: unauthorizedSchema,
-    message: z3.string().optional()
+    message: z4.string().optional()
   }),
-  z3.object({
-    kind: z3.literal("not_found"),
-    resource: z3.enum(["tunnel", "client", "route"]),
-    message: z3.string().optional()
+  z4.object({
+    kind: z4.literal("not_found"),
+    resource: z4.enum(["tunnel", "client", "route"]),
+    message: z4.string().optional()
   }),
-  z3.object({
-    kind: z3.literal("refused"),
-    reason: z3.enum(["capacity", "policy", "unsupported", "other"]),
-    message: z3.string().optional()
+  z4.object({
+    kind: z4.literal("refused"),
+    reason: z4.enum(["capacity", "policy", "unsupported", "other"]),
+    message: z4.string().optional()
   }),
-  z3.object({ kind: z3.literal("io"), message: z3.string().optional() }),
-  z3.object({ kind: z3.literal("internal"), message: z3.string().optional() })
+  z4.object({ kind: z4.literal("io"), message: z4.string().optional() }),
+  z4.object({ kind: z4.literal("internal"), message: z4.string().optional() })
 ]);
-var firewallSchema = z3.discriminatedUnion("decision", [
-  z3.object({ decision: z3.literal("allowed"), rule: firewallRuleSchema }),
-  z3.object({
-    decision: z3.literal("denied"),
+var firewallSchema = z4.discriminatedUnion("decision", [
+  z4.object({ decision: z4.literal("allowed"), rule: firewallRuleSchema }),
+  z4.object({
+    decision: z4.literal("denied"),
     rule: firewallRuleSchema,
     failure: failureSchema
   })
 ]);
-var routedTunnelSchema = z3.object({
+var routedTunnelSchema = z4.object({
   tunnelId: nonEmptyStringSchema.optional(),
-  tunnelName: z3.string().optional(),
-  hostname: z3.string().optional(),
-  protocol: z3.string().optional(),
-  published: z3.boolean().optional(),
-  type: z3.string().optional(),
-  tlsMode: z3.string().optional(),
-  httpVersion: z3.string().optional(),
-  httpUseTls: z3.boolean().optional(),
-  upstreamTls: z3.boolean().optional(),
-  tokenAuth: z3.boolean().optional(),
-  mtls_auth: z3.boolean().optional()
+  tunnelName: z4.string().optional(),
+  hostname: z4.string().optional(),
+  protocol: z4.string().optional(),
+  published: z4.boolean().optional(),
+  type: z4.string().optional(),
+  tlsMode: z4.string().optional(),
+  httpVersion: z4.string().optional(),
+  httpUseTls: z4.boolean().optional(),
+  upstreamTls: z4.boolean().optional(),
+  tokenAuth: z4.boolean().optional(),
+  mtls_auth: z4.boolean().optional()
 });
-var routingNodeSchema = z3.object({
+var routingNodeSchema = z4.object({
   engineId: nonEmptyStringSchema,
   region: nonEmptyStringSchema,
   generation: nonEmptyStringSchema.optional()
 });
-var routingPathSchema = z3.object({
-  mode: z3.enum(["direct", "cross_region"]),
-  crossRegionRoutingAllowed: z3.boolean(),
+var routingPathSchema = z4.object({
+  mode: z4.enum(["direct", "cross_region"]),
+  crossRegionRoutingAllowed: z4.boolean(),
   ingress: routingNodeSchema,
   owner: routingNodeSchema,
   anchor: routingNodeSchema
 });
-var routingSchema = z3.discriminatedUnion("decision", [
-  z3.object({
-    decision: z3.literal("routed"),
+var routingSchema = z4.discriminatedUnion("decision", [
+  z4.object({
+    decision: z4.literal("routed"),
     tunnel: routedTunnelSchema,
     path: routingPathSchema.optional()
   }),
-  z3.object({ decision: z3.literal("not_routed"), failure: failureSchema })
+  z4.object({ decision: z4.literal("not_routed"), failure: failureSchema })
 ]);
-var streamConnectedMetricsSchema = z3.object({
+var streamConnectedMetricsSchema = z4.object({
   establish_ms: numNonNegSchema,
   duration_ms: numNonNegSchema,
   upstream_bytes: intNonNegSchema,
   downstream_bytes: intNonNegSchema
 });
-var streamFailedMetricsSchema = z3.object({
+var streamFailedMetricsSchema = z4.object({
   time_to_fail_ms: numNonNegSchema.optional(),
   establish_ms: numNonNegSchema.optional()
 });
-var terminationSchema = z3.object({
-  by: z3.enum(["downstream", "upstream", "server", "unknown"]),
-  reason: z3.enum(["closed", "reset", "timeout", "error", "unknown"]),
-  message: z3.string().optional()
+var terminationSchema = z4.object({
+  by: z4.enum(["downstream", "upstream", "server", "unknown"]),
+  reason: z4.enum(["closed", "reset", "timeout", "error", "unknown"]),
+  message: z4.string().optional()
 });
-var responseConnectedSchema = z3.object({
-  outcome: z3.literal("connected"),
+var responseConnectedSchema = z4.object({
+  outcome: z4.literal("connected"),
   established_at: isoDateTimeSchema,
   upstream: streamEndpointSchema.optional(),
   metrics: streamConnectedMetricsSchema,
   termination: terminationSchema.optional(),
   http: httpResponseStageSchema.optional()
 });
-var responseFailedSchema = z3.object({
-  outcome: z3.literal("failed"),
+var responseFailedSchema = z4.object({
+  outcome: z4.literal("failed"),
   failure: failureSchema,
   upstream: streamEndpointSchema.optional(),
   metrics: streamFailedMetricsSchema.optional(),
   termination: terminationSchema.optional(),
   http: httpResponseStageSchema.optional()
 });
-var responseSchema = z3.discriminatedUnion("outcome", [
+var responseSchema = z4.discriminatedUnion("outcome", [
   responseConnectedSchema,
   responseFailedSchema
 ]);
-var streamWebTTYMetadataSchema = z3.object({
+var streamWebTTYMetadataSchema = z4.object({
   server_id: nonEmptyStringSchema.optional(),
   session_id: nonEmptyStringSchema.optional(),
   session_group_id: nonEmptyStringSchema.optional(),
   participant_id: nonEmptyStringSchema.optional(),
   participant_role: webTTYParticipantRoleSchema.optional(),
-  controller: z3.boolean().optional(),
+  controller: z4.boolean().optional(),
   recording_mode: webTTYRecordingModeSchema.optional(),
   encryption_mode: webTTYEncryptionModeSchema.optional(),
-  encryption_policy: z3.enum(["disabled", "explicit_key", "workspace_managed"]).optional(),
-  e2e: z3.boolean().optional(),
-  client_proof: z3.enum(["none", "required"]).optional(),
+  encryption_policy: z4.enum(["disabled", "explicit_key", "workspace_managed"]).optional(),
+  e2e: z4.boolean().optional(),
+  client_proof: z4.enum(["none", "required"]).optional(),
   session_mode: webTTYSessionModeSchema.optional(),
   downstream_transport: webTTYTransportSchema.optional(),
   upstream_transport: webTTYTransportSchema.optional(),
   origin: webTTYOriginSchema.optional(),
-  origin_id: z3.string().optional(),
+  origin_id: z4.string().optional(),
   initiator_kind: webTTYInitiatorKindSchema.optional(),
-  device_id: z3.string().optional(),
-  browser_id: z3.string().optional()
+  device_id: z4.string().optional(),
+  browser_id: z4.string().optional()
 }).passthrough();
-var streamSummarySchema = z3.object({
+var streamSummarySchema = z4.object({
   workspace_id: nonEmptyStringSchema.optional(),
   project_id: nonEmptyStringSchema.optional(),
   cluster_id: nonEmptyStringSchema.optional(),
@@ -739,7 +757,7 @@ var streamSummarySchema = z3.object({
   stream_id: nonEmptyStringSchema,
   created_at: isoDateTimeSchema,
   terminated_at: isoDateTimeSchema,
-  request: z3.object({
+  request: z4.object({
     downstream: streamEndpointSchema,
     entry: streamEntrySchema.optional(),
     http: httpRequestStageSchema.optional()
@@ -766,34 +784,34 @@ function formatStreamAccessPath(entry) {
 }
 
 // src/webtty-resource.ts
-var z4 = __toESM(require("zod"));
-var isoDateTimeSchema2 = z4.string().datetime({ offset: true });
-var decimalCursorSchema = z4.string().regex(/^\d+$/);
-var webTTYSequenceCursorInputSchema = z4.union([
+var z5 = __toESM(require("zod"));
+var isoDateTimeSchema2 = z5.string().datetime({ offset: true });
+var decimalCursorSchema = z5.string().regex(/^\d+$/);
+var webTTYSequenceCursorInputSchema = z5.union([
   decimalCursorSchema,
-  z4.number().int().nonnegative().safe().transform(String)
+  z5.number().int().nonnegative().safe().transform(String)
 ]);
-var webTTYSessionStatusSchema = z4.enum([
+var webTTYSessionStatusSchema = z5.enum([
   "opening",
   "active",
   "closing",
   "closed",
   "errored"
 ]);
-var webTTYControlRequestStatusSchema = z4.enum([
+var webTTYControlRequestStatusSchema = z5.enum([
   "pending",
   "granted",
   "refused",
   "revoked",
   "expired"
 ]);
-var webTTYEventDirectionSchema = z4.enum([
+var webTTYEventDirectionSchema = z5.enum([
   "client_to_server",
   "server_to_client",
   "engine_internal"
 ]);
-var webTTYStreamTypeSchema = z4.enum(["stdin", "stdout", "stderr"]);
-var webTTYSessionEventTypeSchema = z4.enum([
+var webTTYStreamTypeSchema = z5.enum(["stdin", "stdout", "stderr"]);
+var webTTYSessionEventTypeSchema = z5.enum([
   "open",
   "ack",
   "data",
@@ -804,233 +822,233 @@ var webTTYSessionEventTypeSchema = z4.enum([
   "control",
   "recording_state"
 ]);
-var jsonRecordSchema = z4.record(z4.string(), z4.unknown());
+var jsonRecordSchema = z5.record(z5.string(), z5.unknown());
 function rejectCryptoKeyEnvelopes(crypto3, ctx, path) {
   if (crypto3 === null || typeof crypto3 !== "object") {
     return;
   }
   if (Object.prototype.hasOwnProperty.call(crypto3, "key_envelopes")) {
     ctx.addIssue({
-      code: z4.ZodIssueCode.custom,
+      code: z5.ZodIssueCode.custom,
       message: "key_envelopes are available only from the WebTTY decrypt-material endpoint.",
       path: [...path, "key_envelopes"]
     });
   }
 }
-var webTTYCapabilitiesSchema = z4.object({
-  managed_protocol: z4.boolean(),
-  store_configured: z4.boolean(),
-  session_listing: z4.boolean(),
-  recording: z4.boolean(),
-  replay: z4.boolean(),
-  live_attach: z4.boolean(),
-  control_transfer: z4.boolean(),
-  e2e: z4.boolean(),
-  implemented_transports: z4.array(webTTYTransportSchema),
-  recording_modes: z4.array(webTTYRecordingModeSchema),
-  encryption_modes: z4.array(webTTYEncryptionModeSchema),
-  required_permissions: z4.record(z4.string(), z4.array(z4.string()))
+var webTTYCapabilitiesSchema = z5.object({
+  managed_protocol: z5.boolean(),
+  store_configured: z5.boolean(),
+  session_listing: z5.boolean(),
+  recording: z5.boolean(),
+  replay: z5.boolean(),
+  live_attach: z5.boolean(),
+  control_transfer: z5.boolean(),
+  e2e: z5.boolean(),
+  implemented_transports: z5.array(webTTYTransportSchema),
+  recording_modes: z5.array(webTTYRecordingModeSchema),
+  encryption_modes: z5.array(webTTYEncryptionModeSchema),
+  required_permissions: z5.record(z5.string(), z5.array(z5.string()))
 });
-var webTTYSessionLiveSchema = z4.object({
-  available: z4.boolean(),
-  attachable: z4.boolean(),
-  participant_count: z4.number().int().nonnegative(),
-  controller_participant_id: z4.string().optional(),
-  has_upstream: z4.boolean()
+var webTTYSessionLiveSchema = z5.object({
+  available: z5.boolean(),
+  attachable: z5.boolean(),
+  participant_count: z5.number().int().nonnegative(),
+  controller_participant_id: z5.string().optional(),
+  has_upstream: z5.boolean()
 });
-var webTTYParticipantLiveSchema = z4.object({
-  connected: z4.boolean(),
-  controller: z4.boolean()
+var webTTYParticipantLiveSchema = z5.object({
+  connected: z5.boolean(),
+  controller: z5.boolean()
 });
-var webTTYSessionSchema = z4.object({
-  id: z4.string(),
-  workspace_id: z4.string().optional(),
-  project_id: z4.string().optional(),
-  cluster_id: z4.string().optional(),
-  server_id: z4.string().optional(),
-  tunnel_id: z4.string(),
-  client_id: z4.string().optional(),
-  initiator_user_id: z4.string().optional(),
-  group_id: z4.string().optional(),
+var webTTYSessionSchema = z5.object({
+  id: z5.string(),
+  workspace_id: z5.string().optional(),
+  project_id: z5.string().optional(),
+  cluster_id: z5.string().optional(),
+  server_id: z5.string().optional(),
+  tunnel_id: z5.string(),
+  client_id: z5.string().optional(),
+  initiator_user_id: z5.string().optional(),
+  group_id: z5.string().optional(),
   status: webTTYSessionStatusSchema,
   session_mode: webTTYSessionModeSchema,
   recording_mode: webTTYRecordingModeSchema,
   encryption_mode: webTTYEncryptionModeSchema,
   downstream_transport: webTTYTransportSchema.optional(),
   upstream_transport: webTTYTransportSchema.optional(),
-  command_meta: z4.unknown().optional(),
+  command_meta: z5.unknown().optional(),
   context: webTTYContextMetadataSchema.optional(),
   started_at: isoDateTimeSchema2,
   ended_at: isoDateTimeSchema2.optional(),
-  exit_code: z4.number().int().optional(),
-  error_code: z4.string().optional(),
-  error_message: z4.string().optional(),
+  exit_code: z5.number().int().optional(),
+  error_code: z5.string().optional(),
+  error_message: z5.string().optional(),
   live: webTTYSessionLiveSchema.optional()
 }).passthrough();
-var webTTYSessionGroupSchema = z4.object({
-  id: z4.string(),
-  workspace_id: z4.string().optional(),
-  project_id: z4.string().optional(),
-  initiator_user_id: z4.string().optional(),
+var webTTYSessionGroupSchema = z5.object({
+  id: z5.string(),
+  workspace_id: z5.string().optional(),
+  project_id: z5.string().optional(),
+  initiator_user_id: z5.string().optional(),
   context: webTTYContextMetadataSchema.optional(),
   created_at: isoDateTimeSchema2,
   updated_at: isoDateTimeSchema2,
   closed_at: isoDateTimeSchema2.optional()
 }).passthrough();
-var webTTYParticipantSchema = z4.object({
-  id: z4.string(),
-  session_id: z4.string(),
-  user_id: z4.string().optional(),
-  device_id: z4.string().optional(),
-  browser_id: z4.string().optional(),
+var webTTYParticipantSchema = z5.object({
+  id: z5.string(),
+  session_id: z5.string(),
+  user_id: z5.string().optional(),
+  device_id: z5.string().optional(),
+  browser_id: z5.string().optional(),
   role: webTTYParticipantRoleSchema,
   attached_at: isoDateTimeSchema2,
   detached_at: isoDateTimeSchema2.optional(),
-  controller: z4.boolean(),
-  grant_state: z4.string().optional(),
-  attach_grant: z4.string().optional(),
+  controller: z5.boolean(),
+  grant_state: z5.string().optional(),
+  attach_grant: z5.string().optional(),
   attach_grant_expires_at: isoDateTimeSchema2.optional(),
   live: webTTYParticipantLiveSchema.optional()
 }).passthrough();
-var webTTYCryptoMetadataSchema = z4.object({
-  payload_suite: z4.string().optional(),
-  payload_key_id: z4.string().optional(),
-  nonce: z4.string().optional(),
-  key_envelope_suite: z4.string().optional(),
-  key_envelopes: z4.unknown().optional(),
-  key_context: z4.unknown().optional(),
-  key_context_raw: z4.string().optional()
+var webTTYCryptoMetadataSchema = z5.object({
+  payload_suite: z5.string().optional(),
+  payload_key_id: z5.string().optional(),
+  nonce: z5.string().optional(),
+  key_envelope_suite: z5.string().optional(),
+  key_envelopes: z5.unknown().optional(),
+  key_context: z5.unknown().optional(),
+  key_context_raw: z5.string().optional()
 }).passthrough();
-var webTTYSessionEventSchema = z4.object({
-  id: z4.string(),
-  session_id: z4.string(),
+var webTTYSessionEventSchema = z5.object({
+  id: z5.string(),
+  session_id: z5.string(),
   seq: decimalCursorSchema,
   created_at: isoDateTimeSchema2,
   type: webTTYSessionEventTypeSchema,
   direction: webTTYEventDirectionSchema.optional(),
   stream_type: webTTYStreamTypeSchema.optional(),
-  participant_id: z4.string().optional(),
-  payload_length: z4.number().int().nonnegative().optional(),
-  payload_ciphertext: z4.string().optional(),
-  payload_plaintext: z4.string().optional(),
+  participant_id: z5.string().optional(),
+  payload_length: z5.number().int().nonnegative().optional(),
+  payload_ciphertext: z5.string().optional(),
+  payload_plaintext: z5.string().optional(),
   crypto: webTTYCryptoMetadataSchema.optional(),
-  prev_hash: z4.string().optional(),
-  hash: z4.string().optional(),
-  metadata: z4.unknown().optional()
+  prev_hash: z5.string().optional(),
+  hash: z5.string().optional(),
+  metadata: z5.unknown().optional()
 }).passthrough().superRefine((value, ctx) => {
   rejectCryptoKeyEnvelopes(value.crypto, ctx, ["crypto"]);
 });
 var webTTYKeyGrantBaseShape = {
-  id: z4.string(),
-  session_id: z4.string(),
-  recipient_id: z4.string(),
-  recipient_kind: z4.string(),
-  granted_by: z4.string().optional(),
+  id: z5.string(),
+  session_id: z5.string(),
+  recipient_id: z5.string(),
+  recipient_kind: z5.string(),
+  granted_by: z5.string().optional(),
   crypto: webTTYCryptoMetadataSchema,
   created_at: isoDateTimeSchema2,
   revoked_at: isoDateTimeSchema2.optional()
 };
-var webTTYKeyGrantSchema = z4.object(webTTYKeyGrantBaseShape).passthrough().superRefine((value, ctx) => {
+var webTTYKeyGrantSchema = z5.object(webTTYKeyGrantBaseShape).passthrough().superRefine((value, ctx) => {
   if (Object.prototype.hasOwnProperty.call(value, "wrapped_key")) {
     ctx.addIssue({
-      code: z4.ZodIssueCode.custom,
+      code: z5.ZodIssueCode.custom,
       message: "wrapped_key is available only from the WebTTY decrypt-material endpoint.",
       path: ["wrapped_key"]
     });
   }
   rejectCryptoKeyEnvelopes(value.crypto, ctx, ["crypto"]);
 });
-var webTTYKeyGrantDecryptMaterialSchema = z4.object({
+var webTTYKeyGrantDecryptMaterialSchema = z5.object({
   ...webTTYKeyGrantBaseShape,
-  wrapped_key: z4.string().optional()
+  wrapped_key: z5.string().optional()
 }).passthrough();
-var webTTYControlRequestSchema = z4.object({
-  id: z4.string(),
-  session_id: z4.string(),
-  requester_participant_id: z4.string(),
-  requester_user_id: z4.string().optional(),
-  approver_participant_id: z4.string().optional(),
-  approver_user_id: z4.string().optional(),
+var webTTYControlRequestSchema = z5.object({
+  id: z5.string(),
+  session_id: z5.string(),
+  requester_participant_id: z5.string(),
+  requester_user_id: z5.string().optional(),
+  approver_participant_id: z5.string().optional(),
+  approver_user_id: z5.string().optional(),
   status: webTTYControlRequestStatusSchema,
-  reason: z4.string().optional(),
-  metadata: z4.unknown().optional(),
+  reason: z5.string().optional(),
+  metadata: z5.unknown().optional(),
   created_at: isoDateTimeSchema2,
   updated_at: isoDateTimeSchema2,
   resolved_at: isoDateTimeSchema2.optional(),
   expires_at: isoDateTimeSchema2.optional()
 }).passthrough();
-var listWebTTYSessionsFiltersSchema = z4.object({
-  server_id: z4.string().optional(),
-  tunnel_id: z4.string().optional(),
-  user_id: z4.string().optional(),
-  group_id: z4.string().optional(),
+var listWebTTYSessionsFiltersSchema = z5.object({
+  server_id: z5.string().optional(),
+  tunnel_id: z5.string().optional(),
+  user_id: z5.string().optional(),
+  group_id: z5.string().optional(),
   origin: webTTYOriginSchema.optional(),
   status: webTTYSessionStatusSchema.optional(),
   started_from: isoDateTimeSchema2.optional(),
   started_to: isoDateTimeSchema2.optional()
 });
-var listWebTTYSessionsParamsSchema = z4.object({
-  limit: z4.number().int().min(1).optional(),
+var listWebTTYSessionsParamsSchema = z5.object({
+  limit: z5.number().int().min(1).optional(),
   filters: listWebTTYSessionsFiltersSchema.optional()
 });
-var listWebTTYSessionGroupsFiltersSchema = z4.object({
-  initiator_user_id: z4.string().optional(),
+var listWebTTYSessionGroupsFiltersSchema = z5.object({
+  initiator_user_id: z5.string().optional(),
   origin: webTTYOriginSchema.optional(),
   created_from: isoDateTimeSchema2.optional(),
   created_to: isoDateTimeSchema2.optional()
 });
-var listWebTTYSessionGroupsParamsSchema = z4.object({
-  limit: z4.number().int().min(1).optional(),
+var listWebTTYSessionGroupsParamsSchema = z5.object({
+  limit: z5.number().int().min(1).optional(),
   filters: listWebTTYSessionGroupsFiltersSchema.optional()
 });
-var readWebTTYSessionEventsParamsSchema = z4.object({
+var readWebTTYSessionEventsParamsSchema = z5.object({
   from_seq: webTTYSequenceCursorInputSchema.optional(),
-  limit: z4.number().int().min(1).optional()
+  limit: z5.number().int().min(1).optional()
 });
-var listWebTTYKeyGrantDecryptMaterialParamsSchema = z4.object({
-  recipient_id: z4.string().optional(),
-  recipient_kind: z4.string().optional()
+var listWebTTYKeyGrantDecryptMaterialParamsSchema = z5.object({
+  recipient_id: z5.string().optional(),
+  recipient_kind: z5.string().optional()
 });
-var listWebTTYControlRequestsFiltersSchema = z4.object({
+var listWebTTYControlRequestsFiltersSchema = z5.object({
   status: webTTYControlRequestStatusSchema.optional(),
-  requester_user_id: z4.string().optional()
+  requester_user_id: z5.string().optional()
 });
-var listWebTTYControlRequestsParamsSchema = z4.object({
-  limit: z4.number().int().min(1).optional(),
+var listWebTTYControlRequestsParamsSchema = z5.object({
+  limit: z5.number().int().min(1).optional(),
   filters: listWebTTYControlRequestsFiltersSchema.optional()
 });
-var attachWebTTYParticipantParamsSchema = z4.object({
-  role: z4.literal("spectator").optional(),
-  device_id: z4.string().optional(),
-  browser_id: z4.string().optional(),
+var attachWebTTYParticipantParamsSchema = z5.object({
+  role: z5.literal("spectator").optional(),
+  device_id: z5.string().optional(),
+  browser_id: z5.string().optional(),
   transport: webTTYTransportSchema.optional(),
-  grant_state: z4.string().optional(),
+  grant_state: z5.string().optional(),
   metadata: jsonRecordSchema.optional()
 });
-var detachWebTTYParticipantParamsSchema = z4.object({
-  reason: z4.string().optional(),
+var detachWebTTYParticipantParamsSchema = z5.object({
+  reason: z5.string().optional(),
   metadata: jsonRecordSchema.optional()
 });
-var createWebTTYControlRequestParamsSchema = z4.object({
-  participant_id: z4.string(),
-  reason: z4.string().optional(),
+var createWebTTYControlRequestParamsSchema = z5.object({
+  participant_id: z5.string(),
+  reason: z5.string().optional(),
   metadata: jsonRecordSchema.optional(),
   expires_at: isoDateTimeSchema2.optional()
 });
-var resolveWebTTYControlRequestParamsSchema = z4.object({
-  action: z4.enum(["grant", "refuse", "revoke"]),
-  approver_participant_id: z4.string().optional(),
-  reason: z4.string().optional()
+var resolveWebTTYControlRequestParamsSchema = z5.object({
+  action: z5.enum(["grant", "refuse", "revoke"]),
+  approver_participant_id: z5.string().optional(),
+  reason: z5.string().optional()
 });
-var webTTYSessionListSchema = z4.array(webTTYSessionSchema);
-var webTTYSessionGroupListSchema = z4.array(webTTYSessionGroupSchema);
-var webTTYParticipantListSchema = z4.array(webTTYParticipantSchema);
-var webTTYSessionEventListSchema = z4.array(webTTYSessionEventSchema);
-var webTTYKeyGrantListSchema = z4.array(webTTYKeyGrantSchema);
-var webTTYKeyGrantDecryptMaterialListSchema = z4.array(
+var webTTYSessionListSchema = z5.array(webTTYSessionSchema);
+var webTTYSessionGroupListSchema = z5.array(webTTYSessionGroupSchema);
+var webTTYParticipantListSchema = z5.array(webTTYParticipantSchema);
+var webTTYSessionEventListSchema = z5.array(webTTYSessionEventSchema);
+var webTTYKeyGrantListSchema = z5.array(webTTYKeyGrantSchema);
+var webTTYKeyGrantDecryptMaterialListSchema = z5.array(
   webTTYKeyGrantDecryptMaterialSchema
 );
-var webTTYControlRequestListSchema = z4.array(webTTYControlRequestSchema);
+var webTTYControlRequestListSchema = z5.array(webTTYControlRequestSchema);
 function pathId(kind, value) {
   const normalized = value.trim();
   if (!normalized) {
@@ -1186,151 +1204,146 @@ var RstreamWebTTYResource = class {
 };
 
 // src/event.ts
-var import_tunnel = require("@rstreamlabs/rstream/tunnel");
-var z5 = __toESM(require("zod"));
-var isoDateTimeSchema3 = z5.string().datetime({ offset: true });
-var initialStateSchema = z5.object({
+var import_tunnel3 = require("@rstreamlabs/rstream/tunnel");
+var z6 = __toESM(require("zod"));
+var isoDateTimeSchema3 = z6.string().datetime({ offset: true });
+var initialStateSchema = z6.object({
   snapshot_at: isoDateTimeSchema3,
-  clients: z5.array(clientSchema),
-  tunnels: z5.array(import_tunnel.tunnelSchema)
+  clients: z6.array(listedClientSchema),
+  tunnels: z6.array(listedTunnelSchema)
 });
-var eventBaseSchema = z5.object({
-  id: z5.string().optional(),
+var eventBaseSchema = z6.object({
+  id: z6.string().optional(),
   created_at: isoDateTimeSchema3.optional(),
-  user_id: z5.string().optional(),
-  workspace_id: z5.string().optional(),
-  project_id: z5.string().optional(),
-  cluster_id: z5.string().optional()
+  user_id: z6.string().optional(),
+  workspace_id: z6.string().optional(),
+  project_id: z6.string().optional(),
+  cluster_id: z6.string().optional()
 });
-var withEventBase = (shape) => z5.object(shape).merge(eventBaseSchema).passthrough();
+var withEventBase = (shape) => z6.object(shape).merge(eventBaseSchema).passthrough();
 var stateInitialEventSchema = withEventBase({
-  type: z5.literal("state.initial"),
+  type: z6.literal("state.initial"),
   object: initialStateSchema
 });
 var streamSummaryEventSchema = withEventBase({
-  type: z5.literal("stream.summary"),
+  type: z6.literal("stream.summary"),
   object: streamSummarySchema
 });
+var fullInventoryEventsSchema = [
+  withEventBase({
+    type: z6.literal("client.created"),
+    object: import_client2.clientSchema
+  }),
+  withEventBase({
+    type: z6.literal("client.updated"),
+    object: import_client2.clientSchema
+  }),
+  withEventBase({
+    type: z6.literal("client.deleted"),
+    object: import_client2.clientSchema
+  }),
+  withEventBase({
+    type: z6.literal("tunnel.created"),
+    object: import_tunnel3.tunnelSchema
+  }),
+  withEventBase({
+    type: z6.literal("tunnel.updated"),
+    object: import_tunnel3.tunnelSchema
+  }),
+  withEventBase({
+    type: z6.literal("tunnel.deleted"),
+    object: import_tunnel3.tunnelSchema
+  })
+];
 var commonEventsSchema = [
   withEventBase({
-    type: z5.literal("client.created"),
-    object: clientSchema
+    type: z6.literal("client.created"),
+    object: listedClientSchema
   }),
   withEventBase({
-    type: z5.literal("client.updated"),
-    object: clientSchema
+    type: z6.literal("client.updated"),
+    object: listedClientSchema
   }),
   withEventBase({
-    type: z5.literal("client.deleted"),
-    object: clientSchema
+    type: z6.literal("client.deleted"),
+    object: listedClientSchema
   }),
   withEventBase({
-    type: z5.literal("tunnel.created"),
-    object: import_tunnel.tunnelSchema
+    type: z6.literal("tunnel.created"),
+    object: listedTunnelSchema
   }),
   withEventBase({
-    type: z5.literal("tunnel.updated"),
-    object: import_tunnel.tunnelSchema
+    type: z6.literal("tunnel.updated"),
+    object: listedTunnelSchema
   }),
   withEventBase({
-    type: z5.literal("tunnel.deleted"),
-    object: import_tunnel.tunnelSchema
+    type: z6.literal("tunnel.deleted"),
+    object: listedTunnelSchema
   })
 ];
 var webTTYEventsSchema = [
   withEventBase({
-    type: z5.literal("webtty.session.created"),
+    type: z6.literal("webtty.session.created"),
     object: webTTYSessionSchema
   }),
   withEventBase({
-    type: z5.literal("webtty.session.updated"),
-    object: z5.union([webTTYSessionSchema, webTTYSessionGroupSchema])
+    type: z6.literal("webtty.session.updated"),
+    object: z6.union([webTTYSessionSchema, webTTYSessionGroupSchema])
   }),
   withEventBase({
-    type: z5.literal("webtty.session.ended"),
+    type: z6.literal("webtty.session.ended"),
     object: webTTYSessionSchema
   }),
   withEventBase({
-    type: z5.literal("webtty.participant.joined"),
+    type: z6.literal("webtty.participant.joined"),
     object: webTTYParticipantSchema
   }),
   withEventBase({
-    type: z5.literal("webtty.participant.updated"),
+    type: z6.literal("webtty.participant.updated"),
     object: webTTYParticipantSchema
   }),
   withEventBase({
-    type: z5.literal("webtty.participant.left"),
+    type: z6.literal("webtty.participant.left"),
     object: webTTYParticipantSchema
   }),
   withEventBase({
-    type: z5.literal("webtty.control.requested"),
+    type: z6.literal("webtty.control.requested"),
     object: webTTYControlRequestSchema
   }),
   withEventBase({
-    type: z5.literal("webtty.control.granted"),
+    type: z6.literal("webtty.control.granted"),
     object: webTTYControlRequestSchema
   }),
   withEventBase({
-    type: z5.literal("webtty.control.refused"),
+    type: z6.literal("webtty.control.refused"),
     object: webTTYControlRequestSchema
   }),
   withEventBase({
-    type: z5.literal("webtty.control.revoked"),
+    type: z6.literal("webtty.control.revoked"),
     object: webTTYControlRequestSchema
   })
 ];
 var webhookDeliverableEventsSchema = [
-  commonEventsSchema[0],
-  commonEventsSchema[2],
-  commonEventsSchema[3],
-  commonEventsSchema[5],
+  fullInventoryEventsSchema[0],
+  fullInventoryEventsSchema[2],
+  fullInventoryEventsSchema[3],
+  fullInventoryEventsSchema[5],
   ...webTTYEventsSchema
 ];
-var wsEventsSchema = z5.union([
+var wsEventsSchema = z6.union([
   stateInitialEventSchema,
   ...commonEventsSchema,
   ...webTTYEventsSchema
 ]);
-var webhookEventsSchema = z5.union(webhookDeliverableEventsSchema);
+var webhookEventsSchema = z6.union(webhookDeliverableEventsSchema);
 var projectLogEventsSchema = streamSummaryEventSchema;
-var eventSchema = z5.union([
+var eventSchema = z6.union([
   wsEventsSchema,
   webhookEventsSchema,
   projectLogEventsSchema
 ]);
 
-// src/tunnel.ts
-var import_tunnel2 = require("@rstreamlabs/rstream/tunnel");
-var z6 = __toESM(require("zod"));
-var DEFAULT_PUBLISHED_PORT = 443;
-var tunnelFilterSchema = import_tunnel2.tunnelSchema.pick({
-  id: true,
-  name: true,
-  type: true,
-  status: true,
-  client_id: true,
-  user_id: true,
-  publish: true,
-  protocol: true,
-  hostname: true,
-  http_version: true,
-  labels: true
-}).partial();
-var listTunnelsParamsSchema = z6.object({
-  limit: z6.number().int().min(1).optional(),
-  filters: tunnelFilterSchema.optional()
-});
-var listTunnelsResponseSchema = z6.array(import_tunnel2.tunnelSchema);
-function formatTunnelHost(tunnel) {
-  if (!tunnel.hostname) return tunnel.host;
-  if (!tunnel.port || tunnel.port === DEFAULT_PUBLISHED_PORT) {
-    return tunnel.hostname;
-  }
-  return `${tunnel.hostname}:${tunnel.port}`;
-}
-
 // src/openapi.ts
-var import_tunnel5 = require("@rstreamlabs/rstream/tunnel");
 var z7 = __toESM(require("zod"));
 var jsonContentType = "application/json";
 var openApiContentType = "application/vnd.oai.openapi+json;version=3.1";
@@ -1409,12 +1422,6 @@ var readEngineStateRule = {
   action: "read"
 };
 var readEngineStateRules = [readEngineStateRule];
-var readEngineStreamsRules = [
-  {
-    resource: "engine.streams",
-    action: "read"
-  }
-];
 var watchParamsSchema = z7.object({
   clients: clientFilterSchema.optional(),
   tunnels: tunnelFilterSchema.optional()
@@ -1644,11 +1651,11 @@ var engineOpenApiDocument = {
           }
         }
       },
-      Client: jsonSchemaFor(clientSchema),
+      Client: jsonSchemaFor(listedClientSchema),
       Event: jsonSchemaFor(wsEventsSchema),
       ListClientsParams: jsonSchemaFor(listClientsParamsSchema),
       ListTunnelsParams: jsonSchemaFor(listTunnelsParamsSchema),
-      TunnelListItem: jsonSchemaFor(import_tunnel5.tunnelSchema),
+      TunnelListItem: jsonSchemaFor(listedTunnelSchema),
       WatchParams: jsonSchemaFor(watchParamsSchema)
     }
   },
@@ -1829,19 +1836,20 @@ var engineOpenApiDocument = {
       get: {
         tags: ["Runtime inventory"],
         summary: "List visible engine clients.",
+        "x-rstream-token-scope": "resources.tunnels.scopes.clients.list",
         operationId: "list_engine_clients",
         parameters: [{ $ref: "#/components/parameters/ListClientsParams" }],
         security: [{ bearerAuth: [] }, { mutualTLS: [] }],
         responses: {
           "200": jsonArrayResponse(
-            "Visible clients.",
+            "Visible clients. Fine-grained list scopes may filter objects and project fields.",
             "#/components/schemas/Client"
           ),
           "400": { $ref: "#/components/responses/BadRequest" },
           "401": { $ref: "#/components/responses/Unauthorized" },
           "403": { $ref: "#/components/responses/Forbidden" }
         },
-        "x-rstream-required-rules": readEngineStreamsRules
+        "x-rstream-required-rules": readEngineStateRules
       }
     },
     "/api/tunnels": {
@@ -1861,7 +1869,7 @@ var engineOpenApiDocument = {
           "403": { $ref: "#/components/responses/Forbidden" }
         },
         "x-rstream-required-rules": readEngineStateRules,
-        "x-rstream-token-metadata-scope": "metadata.scopes.tunnels.list"
+        "x-rstream-token-scope": "resources.tunnels.scopes.tunnels.list"
       }
     },
     "/api/sse": {
@@ -2167,7 +2175,7 @@ async function resolveManagedTunnelsProject(config) {
 }
 
 // src/tunnels-resource.ts
-var import_tunnel7 = require("@rstreamlabs/rstream/tunnel");
+var import_tunnel8 = require("@rstreamlabs/rstream/tunnel");
 function tunnelPathId(id) {
   const normalized = id.trim();
   if (!normalized) {
@@ -2194,7 +2202,7 @@ var RstreamTunnelsResource = class {
         method: "GET"
       }
     );
-    return import_tunnel7.tunnelSchema.parse(response);
+    return import_tunnel8.tunnelSchema.parse(response);
   }
 };
 
@@ -3526,7 +3534,7 @@ function validateWatchQueryToken(token) {
   }
   if (!hasWatchOnlyTunnelResources(parsed.data)) {
     throw new Error(
-      "Watch requires a fine-grained token limited to tunnel list resources for URL-based authentication."
+      "Watch requires a fine-grained token limited to client or tunnel list resources for URL-based authentication."
     );
   }
 }
@@ -3542,38 +3550,38 @@ function hasWatchOnlyTunnelResources(token) {
 }
 function hasWatchOnlyTunnelResource(resource) {
   return watchResourceBranches(resource).every(
-    (branch) => branch.hasList && !branch.hasMutationOrConnect
+    (branch) => (branch.clients || branch.tunnels) && !branch.create && !branch.connect
   );
 }
 function watchResourceBranches(resource) {
   if ("AND" in resource) {
     return resource.AND.reduce(
-      (branches, child) => combineWatchResourceBranches(branches, child),
-      [{ hasList: false, hasMutationOrConnect: false }]
+      (branches, child) => branches.flatMap(
+        (branch) => watchResourceBranches(child).map((other) => ({
+          clients: branch.clients && other.clients,
+          tunnels: branch.tunnels && other.tunnels,
+          create: branch.create && other.create,
+          connect: branch.connect && other.connect
+        }))
+      ),
+      [{ clients: true, tunnels: true, create: true, connect: true }]
     );
   }
-  if ("OR" in resource) {
-    return resource.OR.flatMap(watchResourceBranches);
-  }
-  const tunnels = resource.scopes?.tunnels;
-  if (tunnels === void 0) {
-    return [{ hasList: false, hasMutationOrConnect: false }];
+  if ("OR" in resource) return resource.OR.flatMap(watchResourceBranches);
+  if (resource.scopes === void 0) {
+    return [{ clients: true, tunnels: true, create: true, connect: true }];
   }
+  const { clients, tunnels } = resource.scopes;
+  const allows = (scope) => scope !== void 0 && scope !== false;
   return [
     {
-      hasList: tunnels.list !== void 0,
-      hasMutationOrConnect: tunnels.create !== void 0 || tunnels.connect !== void 0
+      clients: clients === void 0 || allows(clients.list),
+      tunnels: allows(tunnels?.list),
+      create: allows(tunnels?.create),
+      connect: allows(tunnels?.connect)
     }
   ];
 }
-function combineWatchResourceBranches(branches, child) {
-  return branches.flatMap(
-    (branch) => watchResourceBranches(child).map((childBranch) => ({
-      hasList: branch.hasList || childBranch.hasList,
-      hasMutationOrConnect: branch.hasMutationOrConnect || childBranch.hasMutationOrConnect
-    }))
-  );
-}
 function hasWatchOnlyPermissions(permissions) {
   if (!Array.isArray(permissions)) {
     return true;
@@ -3799,7 +3807,7 @@ function webTTYHasCapability(capabilities, capability) {
   return capabilities.includes(capability);
 }
 function parser(tunnel, includePrivate) {
-  if (tunnel.status !== "online") return null;
+  if (!tunnel.id || tunnel.status !== "online") return null;
   if (tunnel.publish !== true && !includePrivate) return null;
   const managedProtocol = tunnel.protocol === "webtty";
   if (tunnel.protocol !== void 0 && tunnel.protocol !== "http" && !managedProtocol)
@@ -3957,6 +3965,8 @@ function resolveWebTTYBrowserEndpoint(server) {
   listWebTTYKeyGrantDecryptMaterialParamsSchema,
   listWebTTYSessionGroupsParamsSchema,
   listWebTTYSessionsParamsSchema,
+  listedClientSchema,
+  listedTunnelSchema,
   normalizeEngineAddress,
   parseWebTTYServers,
   projectLogEventsSchema,