@rstreamlabs/tunnels 3.8.2 → 3.9.0

package/dist/index.js

@@ -84,7 +84,9 @@ __export(index_exports, {
   resolveTunnelsCredentials: () => resolveTunnelsCredentials,
   resolveTunnelsEngine: () => resolveTunnelsEngine,
   resolveTunnelsRegion: () => resolveTunnelsRegion,
+  resolveWebTTYBrowserEndpoint: () => resolveWebTTYBrowserEndpoint,
   resolveWebTTYControlRequestParamsSchema: () => resolveWebTTYControlRequestParamsSchema,
+  resolveWebTTYServerTransport: () => resolveWebTTYServerTransport,
   signWebhookPayload: () => signWebhookPayload,
   streamEndpointSchema: () => streamEndpointSchema,
   streamEntrySchema: () => streamEntrySchema,
@@ -114,6 +116,7 @@ __export(index_exports, {
   webTTYTransportSchema: () => webTTYTransportSchema,
   webhookEventsSchema: () => webhookEventsSchema,
   webttyServerSchema: () => webttyServerSchema,
+  webttyTransportSchema: () => webttyTransportSchema,
   wsEventsSchema: () => wsEventsSchema
 });
 module.exports = __toCommonJS(index_exports);
@@ -1775,6 +1778,52 @@ var import_rstream8 = require("@rstreamlabs/rstream");
 var import_rstream9 = require("@rstreamlabs/rstream");
 var import_rstream10 = require("@rstreamlabs/rstream");
 var import_turn = require("@rstreamlabs/rstream/turn");
+
+// src/control-plane-fetch.ts
+function createRequestLifetime(parent, timeoutMilliseconds) {
+  const controller = new AbortController();
+  const abort = () => controller.abort(parent.reason);
+  if (parent.aborted) {
+    abort();
+  } else {
+    parent.addEventListener("abort", abort, { once: true });
+  }
+  const timeout = setTimeout(
+    () => controller.abort(new Error("Control plane request timed out.")),
+    timeoutMilliseconds
+  );
+  return {
+    close: () => {
+      clearTimeout(timeout);
+      parent.removeEventListener("abort", abort);
+    },
+    signal: controller.signal
+  };
+}
+function createBoundedControlPlaneFetch(timeoutMilliseconds) {
+  return async (input, init) => {
+    const request = new Request(input, init);
+    const headers = new Headers(request.headers);
+    headers.set("Connection", "close");
+    const lifetime = createRequestLifetime(request.signal, timeoutMilliseconds);
+    try {
+      const response = await globalThis.fetch(request, {
+        headers,
+        signal: lifetime.signal
+      });
+      const responseBody = response.body === null ? null : new Uint8Array(await response.arrayBuffer());
+      return new Response(responseBody, {
+        headers: Object.fromEntries(response.headers.entries()),
+        status: response.status,
+        statusText: response.statusText
+      });
+    } finally {
+      lifetime.close();
+    }
+  };
+}
+
+// src/turn.ts
 var z8 = __toESM(require("zod"));
 var import_crypto = __toESM(require("crypto"));
 var defaultTURNPort = 3478;
@@ -1782,6 +1831,8 @@ var defaultTURNSPort = 5349;
 var defaultTURNCredentialTTLSeconds = 10 * 60;
 var maxTURNCredentialTTLSeconds = 60 * 60;
 var maxTURNKeyringBytes = 8 * 1024;
+var defaultAPIRequestTimeoutMilliseconds = 1e4;
+var maxAPIRequestTimeoutMilliseconds = 6e4;
 var turnTokenClaimsSchema = z8.object({
   exp: z8.number().int().optional(),
   iat: z8.number().int().optional(),
@@ -1815,6 +1866,15 @@ function normalizeTTLSeconds(ttlSeconds) {
   }
   return ttl;
 }
+function normalizeAPIRequestTimeoutMilliseconds(timeoutMilliseconds) {
+  const timeout = timeoutMilliseconds ?? defaultAPIRequestTimeoutMilliseconds;
+  if (!Number.isInteger(timeout) || timeout < 1 || timeout > maxAPIRequestTimeoutMilliseconds) {
+    throw new Error(
+      "TURN API request timeout must be an integer between 1 and 60000 milliseconds."
+    );
+  }
+  return timeout;
+}
 function createAPITURNCredentialsParams(ttlSeconds) {
   return ttlSeconds === void 0 ? {} : { ttlSeconds: normalizeTTLSeconds(ttlSeconds) };
 }
@@ -2008,11 +2068,16 @@ async function createAPITURNCredentials(options) {
       "Project ID or project endpoint is required for TURN API mode."
     );
   }
+  const requestTimeoutMilliseconds = normalizeAPIRequestTimeoutMilliseconds(
+    options.requestTimeoutMilliseconds
+  );
+  const params = createAPITURNCredentialsParams(options.ttlSeconds);
+  const request = options.fetch ?? createBoundedControlPlaneFetch(requestTimeoutMilliseconds);
   const client = new import_rstream10.RstreamClient({
     apiUrl: options.apiUrl,
-    credentials: options.credentials
+    credentials: options.credentials,
+    fetch: request
   });
-  const params = createAPITURNCredentialsParams(options.ttlSeconds);
   if (projectId) {
     return await client.tunnels.projects.createTurnCredentials(
       projectId,
@@ -2153,8 +2218,10 @@ async function createTURNCredentials(options) {
     return await createAPITURNCredentials({
       apiUrl: options.apiUrl,
       credentials: controlPlaneCredentials,
+      fetch: options.fetch,
       projectEndpoint,
       projectId: options.projectId,
+      requestTimeoutMilliseconds: options.requestTimeoutMilliseconds,
       ttlSeconds: options.ttlSeconds
     });
   }
@@ -2784,6 +2851,11 @@ var webttyEncryptionPolicySchema = z9.enum([
   "explicit_key",
   "workspace_managed"
 ]);
+var webttyTransportSchema = z9.enum([
+  "plain",
+  "websocket",
+  "webtransport"
+]);
 var webttyServerSchema = z9.object({
   tunnel_id: z9.string(),
   tunnel_name: z9.string().optional(),
@@ -2793,7 +2865,11 @@ var webttyServerSchema = z9.object({
   publish: z9.boolean().optional(),
   workspace_id: z9.string().optional(),
   project_id: z9.string().optional(),
-  tunnel_protocol: z9.enum(["http", "webtty"]),
+  tunnel_protocol: z9.enum(["http", "webtty"]).optional(),
+  tunnel_type: z9.enum(["bytestream", "datagram"]).optional(),
+  http_version: z9.string().optional(),
+  transport: webttyTransportSchema.optional(),
+  transport_error: z9.string().optional(),
   managed: z9.boolean(),
   host: z9.string(),
   token_auth: z9.boolean(),
@@ -2807,6 +2883,7 @@ var webttyServerSchema = z9.object({
   exec_path: z9.string().optional(),
   fs_path: z9.string().optional(),
   fs_mode: webttyFSModeSchema.optional(),
+  fs_backend: z9.enum(["webdav", "webrtc"]).optional(),
   os_family: osFamilySchema.optional(),
   arch: z9.string().optional(),
   os_id: z9.string().optional(),
@@ -2833,11 +2910,12 @@ function webTTYCapabilitiesForLabels(labels) {
 function webTTYHasCapability(capabilities, capability) {
   return capabilities.includes(capability);
 }
-function parser(tunnel) {
+function parser(tunnel, includePrivate) {
   if (tunnel.status !== "online") return null;
-  if (tunnel.publish !== true) return null;
+  if (tunnel.publish !== true && !includePrivate) return null;
   const managedProtocol = tunnel.protocol === "webtty";
-  if (tunnel.protocol !== "http" && !managedProtocol) return null;
+  if (tunnel.protocol !== void 0 && tunnel.protocol !== "http" && !managedProtocol)
+    return null;
   const tunnelLabels = tunnel.labels ?? {};
   if (!managedProtocol && tunnelLabels["application-protocol"] !== "rstream.webtty") {
     return null;
@@ -2865,8 +2943,11 @@ function parser(tunnel) {
     workspace_id: tunnel.workspace_id,
     project_id: tunnel.project_id,
     tunnel_protocol: tunnel.protocol,
+    tunnel_type: tunnel.type,
+    http_version: tunnel.http_version,
+    ...webTTYTransportMetadata(tunnelLabels["rstream.webtty.transport"]),
     managed: managedProtocol,
-    host: formatTunnelHost(tunnel),
+    host: formatTunnelHost(tunnel) ?? "",
     token_auth: tunnel.token_auth === true,
     server_id: serverId || void 0,
     server_name: serverName || void 0,
@@ -2877,6 +2958,7 @@ function parser(tunnel) {
     capabilities,
     exec_path: webTTYHasCapability(capabilities, "exec") ? tunnelLabels["rstream.webtty.exec.path"] ?? "/" : void 0,
     fs_path: webTTYHasCapability(capabilities, "fs") ? tunnelLabels["rstream.webtty.fs.path"] ?? "/fs" : void 0,
+    fs_backend: webTTYHasCapability(capabilities, "fs") ? tunnelLabels["rstream.webtty.fs.backend"] ?? "webdav" : void 0,
     fs_mode: webTTYHasCapability(capabilities, "fs") ? tunnelLabels["rstream.webtty.fs.mode"] ?? "read-write" : void 0,
     os_family: tunnelLabels["rstream.webtty.os_family"],
     arch: tunnelLabels["rstream.webtty.arch"],
@@ -2892,8 +2974,54 @@ function parser(tunnel) {
   if (!parsed.success) return null;
   return parsed.data;
 }
-function parseWebTTYServers(tunnels) {
-  return tunnels.map((tunnel) => parser(tunnel)).filter((server) => server !== null);
+function parseWebTTYServers(tunnels, options = {}) {
+  return tunnels.map((tunnel) => parser(tunnel, options.includePrivate === true)).filter((server) => server !== null);
+}
+function webTTYTransportMetadata(value) {
+  if (value === void 0) return {};
+  const parsed = webttyTransportSchema.safeParse(value);
+  if (!parsed.success)
+    return {
+      transport_error: "Server advertises an invalid WebTTY transport."
+    };
+  return { transport: parsed.data };
+}
+function resolveWebTTYServerTransport(server, requested) {
+  if (server.transport_error !== void 0)
+    throw new Error(server.transport_error);
+  const advertised = server.transport ?? (server.tunnel_type === "datagram" ? "webtransport" : void 0);
+  if (advertised !== void 0 && server.tunnel_type !== void 0 && advertised === "webtransport" !== (server.tunnel_type === "datagram")) {
+    throw new Error(
+      `Server WebTTY transport ${advertised} conflicts with tunnel type ${server.tunnel_type}.`
+    );
+  }
+  if (advertised === "webtransport" && server.http_version !== void 0 && server.http_version !== "h3") {
+    throw new Error("Server WebTransport requires HTTP/3.");
+  }
+  if (requested !== void 0 && advertised !== void 0 && requested !== advertised) {
+    throw new Error(
+      `Requested WebTTY transport ${requested} conflicts with server transport ${advertised}.`
+    );
+  }
+  return advertised ?? requested ?? "websocket";
+}
+function resolveWebTTYBrowserEndpoint(server) {
+  const transport = resolveWebTTYServerTransport(server);
+  if (transport === "plain")
+    throw new Error(
+      "Plain WebTTY requires a native client; this server cannot be opened in a browser."
+    );
+  if (server.publish === false || server.host === "")
+    throw new Error(
+      "Private WebTTY requires a native client and its rstrm:// address."
+    );
+  const url = new URL(
+    `${transport === "webtransport" ? "https" : "wss"}://${server.host}`
+  );
+  const execPath = server.exec_path?.trim();
+  if (execPath)
+    url.pathname = execPath.startsWith("/") ? execPath : `/${execPath}`;
+  return { url: url.toString(), transport };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -2951,7 +3079,9 @@ function parseWebTTYServers(tunnels) {
   resolveTunnelsCredentials,
   resolveTunnelsEngine,
   resolveTunnelsRegion,
+  resolveWebTTYBrowserEndpoint,
   resolveWebTTYControlRequestParamsSchema,
+  resolveWebTTYServerTransport,
   signWebhookPayload,
   streamEndpointSchema,
   streamEntrySchema,
@@ -2981,5 +3111,6 @@ function parseWebTTYServers(tunnels) {
   webTTYTransportSchema,
   webhookEventsSchema,
   webttyServerSchema,
+  webttyTransportSchema,
   wsEventsSchema
 });

package/dist/index.mjs

@@ -412,6 +412,52 @@ import { isClientCredentials as isClientCredentials2 } from "@rstreamlabs/rstrea
 import { isTokenCredentials as isTokenCredentials2 } from "@rstreamlabs/rstream";
 import { RstreamClient as RstreamClient2 } from "@rstreamlabs/rstream";
 import { turnCredentialsSchema } from "@rstreamlabs/rstream/turn";
+
+// src/control-plane-fetch.ts
+function createRequestLifetime(parent, timeoutMilliseconds) {
+  const controller = new AbortController();
+  const abort = () => controller.abort(parent.reason);
+  if (parent.aborted) {
+    abort();
+  } else {
+    parent.addEventListener("abort", abort, { once: true });
+  }
+  const timeout = setTimeout(
+    () => controller.abort(new Error("Control plane request timed out.")),
+    timeoutMilliseconds
+  );
+  return {
+    close: () => {
+      clearTimeout(timeout);
+      parent.removeEventListener("abort", abort);
+    },
+    signal: controller.signal
+  };
+}
+function createBoundedControlPlaneFetch(timeoutMilliseconds) {
+  return async (input, init) => {
+    const request = new Request(input, init);
+    const headers = new Headers(request.headers);
+    headers.set("Connection", "close");
+    const lifetime = createRequestLifetime(request.signal, timeoutMilliseconds);
+    try {
+      const response = await globalThis.fetch(request, {
+        headers,
+        signal: lifetime.signal
+      });
+      const responseBody = response.body === null ? null : new Uint8Array(await response.arrayBuffer());
+      return new Response(responseBody, {
+        headers: Object.fromEntries(response.headers.entries()),
+        status: response.status,
+        statusText: response.statusText
+      });
+    } finally {
+      lifetime.close();
+    }
+  };
+}
+
+// src/turn.ts
 import * as z from "zod";
 import crypto from "crypto";
 var defaultTURNPort = 3478;
@@ -419,6 +465,8 @@ var defaultTURNSPort = 5349;
 var defaultTURNCredentialTTLSeconds = 10 * 60;
 var maxTURNCredentialTTLSeconds = 60 * 60;
 var maxTURNKeyringBytes = 8 * 1024;
+var defaultAPIRequestTimeoutMilliseconds = 1e4;
+var maxAPIRequestTimeoutMilliseconds = 6e4;
 var turnTokenClaimsSchema = z.object({
   exp: z.number().int().optional(),
   iat: z.number().int().optional(),
@@ -452,6 +500,15 @@ function normalizeTTLSeconds(ttlSeconds) {
   }
   return ttl;
 }
+function normalizeAPIRequestTimeoutMilliseconds(timeoutMilliseconds) {
+  const timeout = timeoutMilliseconds ?? defaultAPIRequestTimeoutMilliseconds;
+  if (!Number.isInteger(timeout) || timeout < 1 || timeout > maxAPIRequestTimeoutMilliseconds) {
+    throw new Error(
+      "TURN API request timeout must be an integer between 1 and 60000 milliseconds."
+    );
+  }
+  return timeout;
+}
 function createAPITURNCredentialsParams(ttlSeconds) {
   return ttlSeconds === void 0 ? {} : { ttlSeconds: normalizeTTLSeconds(ttlSeconds) };
 }
@@ -645,11 +702,16 @@ async function createAPITURNCredentials(options) {
       "Project ID or project endpoint is required for TURN API mode."
     );
   }
+  const requestTimeoutMilliseconds = normalizeAPIRequestTimeoutMilliseconds(
+    options.requestTimeoutMilliseconds
+  );
+  const params = createAPITURNCredentialsParams(options.ttlSeconds);
+  const request = options.fetch ?? createBoundedControlPlaneFetch(requestTimeoutMilliseconds);
   const client = new RstreamClient2({
     apiUrl: options.apiUrl,
-    credentials: options.credentials
+    credentials: options.credentials,
+    fetch: request
   });
-  const params = createAPITURNCredentialsParams(options.ttlSeconds);
   if (projectId) {
     return await client.tunnels.projects.createTurnCredentials(
       projectId,
@@ -790,8 +852,10 @@ async function createTURNCredentials(options) {
     return await createAPITURNCredentials({
       apiUrl: options.apiUrl,
       credentials: controlPlaneCredentials,
+      fetch: options.fetch,
       projectEndpoint,
       projectId: options.projectId,
+      requestTimeoutMilliseconds: options.requestTimeoutMilliseconds,
       ttlSeconds: options.ttlSeconds
     });
   }
@@ -1421,6 +1485,11 @@ var webttyEncryptionPolicySchema = z2.enum([
   "explicit_key",
   "workspace_managed"
 ]);
+var webttyTransportSchema = z2.enum([
+  "plain",
+  "websocket",
+  "webtransport"
+]);
 var webttyServerSchema = z2.object({
   tunnel_id: z2.string(),
   tunnel_name: z2.string().optional(),
@@ -1430,7 +1499,11 @@ var webttyServerSchema = z2.object({
   publish: z2.boolean().optional(),
   workspace_id: z2.string().optional(),
   project_id: z2.string().optional(),
-  tunnel_protocol: z2.enum(["http", "webtty"]),
+  tunnel_protocol: z2.enum(["http", "webtty"]).optional(),
+  tunnel_type: z2.enum(["bytestream", "datagram"]).optional(),
+  http_version: z2.string().optional(),
+  transport: webttyTransportSchema.optional(),
+  transport_error: z2.string().optional(),
   managed: z2.boolean(),
   host: z2.string(),
   token_auth: z2.boolean(),
@@ -1444,6 +1517,7 @@ var webttyServerSchema = z2.object({
   exec_path: z2.string().optional(),
   fs_path: z2.string().optional(),
   fs_mode: webttyFSModeSchema.optional(),
+  fs_backend: z2.enum(["webdav", "webrtc"]).optional(),
   os_family: osFamilySchema.optional(),
   arch: z2.string().optional(),
   os_id: z2.string().optional(),
@@ -1470,11 +1544,12 @@ function webTTYCapabilitiesForLabels(labels) {
 function webTTYHasCapability(capabilities, capability) {
   return capabilities.includes(capability);
 }
-function parser(tunnel) {
+function parser(tunnel, includePrivate) {
   if (tunnel.status !== "online") return null;
-  if (tunnel.publish !== true) return null;
+  if (tunnel.publish !== true && !includePrivate) return null;
   const managedProtocol = tunnel.protocol === "webtty";
-  if (tunnel.protocol !== "http" && !managedProtocol) return null;
+  if (tunnel.protocol !== void 0 && tunnel.protocol !== "http" && !managedProtocol)
+    return null;
   const tunnelLabels = tunnel.labels ?? {};
   if (!managedProtocol && tunnelLabels["application-protocol"] !== "rstream.webtty") {
     return null;
@@ -1502,8 +1577,11 @@ function parser(tunnel) {
     workspace_id: tunnel.workspace_id,
     project_id: tunnel.project_id,
     tunnel_protocol: tunnel.protocol,
+    tunnel_type: tunnel.type,
+    http_version: tunnel.http_version,
+    ...webTTYTransportMetadata(tunnelLabels["rstream.webtty.transport"]),
     managed: managedProtocol,
-    host: formatTunnelHost(tunnel),
+    host: formatTunnelHost(tunnel) ?? "",
     token_auth: tunnel.token_auth === true,
     server_id: serverId || void 0,
     server_name: serverName || void 0,
@@ -1514,6 +1592,7 @@ function parser(tunnel) {
     capabilities,
     exec_path: webTTYHasCapability(capabilities, "exec") ? tunnelLabels["rstream.webtty.exec.path"] ?? "/" : void 0,
     fs_path: webTTYHasCapability(capabilities, "fs") ? tunnelLabels["rstream.webtty.fs.path"] ?? "/fs" : void 0,
+    fs_backend: webTTYHasCapability(capabilities, "fs") ? tunnelLabels["rstream.webtty.fs.backend"] ?? "webdav" : void 0,
     fs_mode: webTTYHasCapability(capabilities, "fs") ? tunnelLabels["rstream.webtty.fs.mode"] ?? "read-write" : void 0,
     os_family: tunnelLabels["rstream.webtty.os_family"],
     arch: tunnelLabels["rstream.webtty.arch"],
@@ -1529,8 +1608,54 @@ function parser(tunnel) {
   if (!parsed.success) return null;
   return parsed.data;
 }
-function parseWebTTYServers(tunnels) {
-  return tunnels.map((tunnel) => parser(tunnel)).filter((server) => server !== null);
+function parseWebTTYServers(tunnels, options = {}) {
+  return tunnels.map((tunnel) => parser(tunnel, options.includePrivate === true)).filter((server) => server !== null);
+}
+function webTTYTransportMetadata(value) {
+  if (value === void 0) return {};
+  const parsed = webttyTransportSchema.safeParse(value);
+  if (!parsed.success)
+    return {
+      transport_error: "Server advertises an invalid WebTTY transport."
+    };
+  return { transport: parsed.data };
+}
+function resolveWebTTYServerTransport(server, requested) {
+  if (server.transport_error !== void 0)
+    throw new Error(server.transport_error);
+  const advertised = server.transport ?? (server.tunnel_type === "datagram" ? "webtransport" : void 0);
+  if (advertised !== void 0 && server.tunnel_type !== void 0 && advertised === "webtransport" !== (server.tunnel_type === "datagram")) {
+    throw new Error(
+      `Server WebTTY transport ${advertised} conflicts with tunnel type ${server.tunnel_type}.`
+    );
+  }
+  if (advertised === "webtransport" && server.http_version !== void 0 && server.http_version !== "h3") {
+    throw new Error("Server WebTransport requires HTTP/3.");
+  }
+  if (requested !== void 0 && advertised !== void 0 && requested !== advertised) {
+    throw new Error(
+      `Requested WebTTY transport ${requested} conflicts with server transport ${advertised}.`
+    );
+  }
+  return advertised ?? requested ?? "websocket";
+}
+function resolveWebTTYBrowserEndpoint(server) {
+  const transport = resolveWebTTYServerTransport(server);
+  if (transport === "plain")
+    throw new Error(
+      "Plain WebTTY requires a native client; this server cannot be opened in a browser."
+    );
+  if (server.publish === false || server.host === "")
+    throw new Error(
+      "Private WebTTY requires a native client and its rstrm:// address."
+    );
+  const url = new URL(
+    `${transport === "webtransport" ? "https" : "wss"}://${server.host}`
+  );
+  const execPath = server.exec_path?.trim();
+  if (execPath)
+    url.pathname = execPath.startsWith("/") ? execPath : `/${execPath}`;
+  return { url: url.toString(), transport };
 }
 export {
   RstreamAuthResource,
@@ -1587,7 +1712,9 @@ export {
   resolveTunnelsCredentials,
   resolveTunnelsEngine,
   resolveTunnelsRegion,
+  resolveWebTTYBrowserEndpoint,
   resolveWebTTYControlRequestParamsSchema,
+  resolveWebTTYServerTransport,
   signWebhookPayload,
   streamEndpointSchema,
   streamEntrySchema,
@@ -1617,5 +1744,6 @@ export {
   webTTYTransportSchema,
   webhookEventsSchema,
   webttyServerSchema,
+  webttyTransportSchema,
   wsEventsSchema
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rstreamlabs/tunnels",
-  "version": "3.8.2",
+  "version": "3.9.0",
   "description": "JS/TS SDK for the rstream Engine API and tunnel runtime APIs.",
   "author": "@uartnet <hello@rstream.io>",
   "repository": {
@@ -30,15 +30,15 @@
   ],
   "scripts": {
     "build:watch": "tsup --watch",
-    "build": "tsup",
-    "clean": "rm -rf dist",
+    "build": "tsc --emitDeclarationOnly --declarationMap false --rootDir src --outDir .generated/types && tsup",
+    "clean": "rm -rf dist .generated/types",
     "lint": "eslint \"./**/*.ts*\"",
     "pretest": "npm --prefix ../rstream run build && npm run build",
     "test": "node --test ./test/**/*.test.cjs",
     "type-check": "tsc --noEmit"
   },
   "devDependencies": {
-    "@turbo/gen": "^2.10.6",
+    "@turbo/gen": "^2.10.11",
     "@types/node": "^26",
     "eslint": "9.39.5",
     "eslint-config": "*",
@@ -47,7 +47,7 @@
     "typescript-config": "*"
   },
   "dependencies": {
-    "@rstreamlabs/rstream": "3.8.1",
+    "@rstreamlabs/rstream": "3.8.2",
     "@types/jsonwebtoken": "^9.0.10",
     "jsonwebtoken": "^9.0.3",
     "zod": "^4.4.3"