@rstreamlabs/tunnels 3.9.0 → 3.10.1

package/dist/openapi.d.ts

@@ -24,11 +24,19 @@ declare const engineOpenApiDocument: {
             };
         };
     }[];
-    security: {
+    security: ({
         bearerAuth: never[];
-    }[];
+        mutualTLS?: undefined;
+    } | {
+        mutualTLS: never[];
+        bearerAuth?: undefined;
+    })[];
     components: {
         securitySchemes: {
+            mutualTLS: {
+                type: string;
+                description: string;
+            };
             bearerAuth: {
                 type: string;
                 scheme: string;
@@ -98,6 +106,74 @@ declare const engineOpenApiDocument: {
             };
         };
         schemas: {
+            EngineDiscovery: {
+                type: string;
+                required: string[];
+                properties: {
+                    version: {
+                        type: string;
+                        const: number;
+                    };
+                    projectEndpoint: {
+                        type: string;
+                    };
+                    mtlsApiUrl: {
+                        type: string;
+                        format: string;
+                        example: string;
+                    };
+                    capabilities: {
+                        type: string;
+                        items: {
+                            type: string;
+                        };
+                        examples: string[][];
+                    };
+                };
+            };
+            CreateTURNCredentials: {
+                type: string;
+                additionalProperties: boolean;
+                properties: {
+                    ttlSeconds: {
+                        type: string;
+                        minimum: number;
+                        maximum: number;
+                        default: number;
+                    };
+                };
+            };
+            TURNCredentials: {
+                type: string;
+                required: string[];
+                properties: {
+                    username: {
+                        type: string;
+                        maxLength: number;
+                        description: string;
+                    };
+                    credential: {
+                        type: string;
+                        maxLength: number;
+                        description: string;
+                    };
+                    urls: {
+                        type: string;
+                        minItems: number;
+                        maxItems: number;
+                        items: {
+                            type: string;
+                            maxLength: number;
+                        };
+                    };
+                    ttl: {
+                        type: string;
+                        minimum: number;
+                        maximum: number;
+                        description: string;
+                    };
+                };
+            };
             Client: unknown;
             Event: unknown;
             ListClientsParams: unknown;
@@ -122,6 +198,164 @@ declare const engineOpenApiDocument: {
         "read-managed-webtty-recordings": string[];
     };
     paths: {
+        "/.well-known/rstream/engine": {
+            get: {
+                tags: string[];
+                summary: string;
+                operationId: string;
+                description: string;
+                security: never[];
+                responses: {
+                    "200": {
+                        description: string;
+                        headers: {
+                            "Cache-Control": {
+                                schema: {
+                                    type: string;
+                                };
+                                example: string;
+                            };
+                        };
+                        content: {
+                            "application/json": {
+                                schema: {
+                                    $ref: string;
+                                };
+                            };
+                        };
+                    };
+                    "404": {
+                        description: string;
+                    };
+                };
+            };
+        };
+        "/api/turn-server/credentials": {
+            post: {
+                tags: string[];
+                summary: string;
+                operationId: string;
+                description: string;
+                security: ({
+                    bearerAuth: never[];
+                    mutualTLS?: undefined;
+                } | {
+                    mutualTLS: never[];
+                    bearerAuth?: undefined;
+                })[];
+                requestBody: {
+                    required: boolean;
+                    content: {
+                        "application/json": {
+                            schema: {
+                                $ref: string;
+                            };
+                        };
+                    };
+                };
+                responses: {
+                    "200": {
+                        description: string;
+                        headers: {
+                            "Cache-Control": {
+                                schema: {
+                                    type: string;
+                                };
+                                example: string;
+                            };
+                        };
+                        content: {
+                            "application/json": {
+                                schema: {
+                                    $ref: string;
+                                };
+                            };
+                        };
+                    };
+                    "400": {
+                        description: string;
+                        headers: {
+                            "Cache-Control": {
+                                schema: {
+                                    type: string;
+                                };
+                                example: string;
+                            };
+                        };
+                    };
+                    "401": {
+                        description: string;
+                        headers: {
+                            "Cache-Control": {
+                                schema: {
+                                    type: string;
+                                };
+                                example: string;
+                            };
+                        };
+                    };
+                    "403": {
+                        description: string;
+                        headers: {
+                            "Cache-Control": {
+                                schema: {
+                                    type: string;
+                                };
+                                example: string;
+                            };
+                        };
+                    };
+                    "404": {
+                        description: string;
+                        headers: {
+                            "Cache-Control": {
+                                schema: {
+                                    type: string;
+                                };
+                                example: string;
+                            };
+                        };
+                    };
+                    "409": {
+                        description: string;
+                        headers: {
+                            "Cache-Control": {
+                                schema: {
+                                    type: string;
+                                };
+                                example: string;
+                            };
+                        };
+                    };
+                    "429": {
+                        description: string;
+                        headers: {
+                            "Cache-Control": {
+                                schema: {
+                                    type: string;
+                                };
+                                example: string;
+                            };
+                        };
+                    };
+                    "503": {
+                        description: string;
+                        headers: {
+                            "Cache-Control": {
+                                schema: {
+                                    type: string;
+                                };
+                                example: string;
+                            };
+                        };
+                    };
+                };
+                "x-rstream-required-rules": {
+                    resource: string;
+                    action: string;
+                }[];
+            };
+        };
         "/api/openapi.json": {
             get: {
                 tags: string[];
@@ -150,9 +384,13 @@ declare const engineOpenApiDocument: {
                 parameters: {
                     $ref: string;
                 }[];
-                security: {
+                security: ({
                     bearerAuth: never[];
-                }[];
+                    mutualTLS?: undefined;
+                } | {
+                    mutualTLS: never[];
+                    bearerAuth?: undefined;
+                })[];
                 responses: {
                     "200": {
                         description: string;
@@ -188,9 +426,13 @@ declare const engineOpenApiDocument: {
                 parameters: {
                     $ref: string;
                 }[];
-                security: {
+                security: ({
                     bearerAuth: never[];
-                }[];
+                    mutualTLS?: undefined;
+                } | {
+                    mutualTLS: never[];
+                    bearerAuth?: undefined;
+                })[];
                 responses: {
                     "200": {
                         description: string;
@@ -227,9 +469,13 @@ declare const engineOpenApiDocument: {
                 parameters: {
                     $ref: string;
                 }[];
-                security: {
+                security: ({
                     bearerAuth: never[];
-                }[];
+                    mutualTLS?: undefined;
+                } | {
+                    mutualTLS: never[];
+                    bearerAuth?: undefined;
+                })[];
                 responses: {
                     "200": {
                         description: string;
@@ -263,9 +509,13 @@ declare const engineOpenApiDocument: {
                 parameters: {
                     $ref: string;
                 }[];
-                security: {
+                security: ({
                     bearerAuth: never[];
-                }[];
+                    mutualTLS?: undefined;
+                } | {
+                    mutualTLS: never[];
+                    bearerAuth?: undefined;
+                })[];
                 responses: {
                     "101": {
                         description: string;

package/dist/openapi.js

@@ -861,6 +861,19 @@ var watchParamsSchema = z7.object({
   tunnels: tunnelFilterSchema.optional()
 });
 var enginePermissions = {
+  "turn.credentials.create": {
+    name: "TURN Credentials: Create",
+    description: "Issue short-lived TURN credentials through either the Control plane or Engine API.",
+    rules: [
+      {
+        resource: [
+          "api.turn-server.credentials",
+          "engine.turn-server.credentials"
+        ],
+        action: "create"
+      }
+    ]
+  },
   "tunnels.resources.read-only": {
     name: "Discovery: Read-Only",
     description: "Read active clients, active tunnels, and live state events.",
@@ -940,13 +953,13 @@ var engineOpenApiDocument = {
       }
     }
   ],
-  security: [
-    {
-      bearerAuth: []
-    }
-  ],
+  security: [{ bearerAuth: [] }, { mutualTLS: [] }],
   components: {
     securitySchemes: {
+      mutualTLS: {
+        type: "mutualTLS",
+        description: "EE project API only, on the dedicated authority returned by anonymous HTTPS discovery. Present one registered client certificate without a bearer or query token. Ordinary browser-facing hosts never request a client certificate."
+      },
       bearerAuth: {
         type: "http",
         scheme: "bearer",
@@ -1014,6 +1027,64 @@ var engineOpenApiDocument = {
       Forbidden: errorResponse("The token is not authorized.")
     },
     schemas: {
+      EngineDiscovery: {
+        type: "object",
+        required: ["version", "projectEndpoint", "mtlsApiUrl", "capabilities"],
+        properties: {
+          version: { type: "integer", const: 1 },
+          projectEndpoint: { type: "string" },
+          mtlsApiUrl: {
+            type: "string",
+            format: "uri",
+            example: "https://project.mtls.engine.example/api"
+          },
+          capabilities: {
+            type: "array",
+            items: { type: "string" },
+            examples: [["engine-api-mtls", "turn-credentials-v2"]]
+          }
+        }
+      },
+      CreateTURNCredentials: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          ttlSeconds: {
+            type: "integer",
+            minimum: 1,
+            maximum: 3600,
+            default: 600
+          }
+        }
+      },
+      TURNCredentials: {
+        type: "object",
+        required: ["username", "credential", "urls", "ttl"],
+        properties: {
+          username: {
+            type: "string",
+            maxLength: 512,
+            description: "Opaque short-lived v2 issued identity. Do not parse in clients."
+          },
+          credential: {
+            type: "string",
+            maxLength: 1024,
+            description: "Short-lived TURN password."
+          },
+          urls: {
+            type: "array",
+            minItems: 1,
+            maxItems: 16,
+            items: { type: "string", maxLength: 2048 }
+          },
+          ttl: {
+            type: "integer",
+            minimum: 1,
+            maximum: 3600,
+            description: "Effective remaining lifetime in seconds, clipped to identity, source credential and certificate expiry."
+          }
+        }
+      },
       Client: jsonSchemaFor(clientSchema),
       Event: jsonSchemaFor(wsEventsSchema),
       ListClientsParams: jsonSchemaFor(listClientsParamsSchema),
@@ -1048,6 +1119,133 @@ var engineOpenApiDocument = {
     "read-managed-webtty-recordings": ["webtty.logs.read-only"]
   },
   paths: {
+    "/.well-known/rstream/engine": {
+      get: {
+        tags: ["Discovery"],
+        summary: "Discover the dedicated project mTLS API.",
+        operationId: "get_engine_discovery",
+        description: "Anonymous GET on the ordinary project Engine authority. Follow the returned HTTPS URL; do not infer an mTLS hostname. Cache per client using Cache-Control (normally one hour). No certificate, bearer token, cookie or redirect is required. Available only where an explicit EE mapping is configured.",
+        security: [],
+        responses: {
+          "200": {
+            description: "Project-bound discovery. Capabilities describe enabled server features; callers still need the corresponding rights.",
+            headers: {
+              "Cache-Control": {
+                schema: { type: "string" },
+                example: "public, max-age=3600"
+              }
+            },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/EngineDiscovery" }
+              }
+            }
+          },
+          "404": {
+            description: "Dedicated mTLS API is not configured on this authority."
+          }
+        }
+      }
+    },
+    "/api/turn-server/credentials": {
+      post: {
+        tags: ["TURN"],
+        summary: "Issue short-lived project TURN credentials.",
+        operationId: "create_engine_turn_credentials",
+        description: "EE managed projects. Same request and response contract as Control plane project TURN issuance. Empty body is valid. Issued credentials require turn.credentials.create only; turn.relay.allocate applies to local PAT/APP derivation. Issuance does not allocate a relay and does not bypass relay quotas or revocation checks.",
+        security: [{ bearerAuth: [] }, { mutualTLS: [] }],
+        requestBody: {
+          required: false,
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/CreateTURNCredentials" }
+            }
+          }
+        },
+        responses: {
+          "200": {
+            description: "Short-lived project TURN credentials.",
+            headers: {
+              "Cache-Control": {
+                schema: { type: "string" },
+                example: "no-store"
+              }
+            },
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/TURNCredentials" }
+              }
+            }
+          },
+          "400": {
+            description: "Malformed, unknown or out-of-range request fields; body exceeds 4 KiB.",
+            headers: {
+              "Cache-Control": {
+                schema: { type: "string" },
+                example: "no-store"
+              }
+            }
+          },
+          "401": {
+            description: "Missing, invalid, expired or mixed authentication proofs.",
+            headers: {
+              "Cache-Control": {
+                schema: { type: "string" },
+                example: "no-store"
+              }
+            }
+          },
+          "403": {
+            description: "Missing turn.credentials.create permission, workspace membership or project resource scope.",
+            headers: {
+              "Cache-Control": {
+                schema: { type: "string" },
+                example: "no-store"
+              }
+            }
+          },
+          "404": {
+            description: "Project not found.",
+            headers: {
+              "Cache-Control": {
+                schema: { type: "string" },
+                example: "no-store"
+              }
+            }
+          },
+          "409": {
+            description: "Project or serving infrastructure is inactive.",
+            headers: {
+              "Cache-Control": {
+                schema: { type: "string" },
+                example: "no-store"
+              }
+            }
+          },
+          "429": {
+            description: "Rate limit exceeded; do not retry through another issuer.",
+            headers: {
+              "Cache-Control": {
+                schema: { type: "string" },
+                example: "no-store"
+              }
+            }
+          },
+          "503": {
+            description: "Authentication backend, serving metadata or issued keyring unavailable.",
+            headers: {
+              "Cache-Control": {
+                schema: { type: "string" },
+                example: "no-store"
+              }
+            }
+          }
+        },
+        "x-rstream-required-rules": [
+          { resource: "engine.turn-server.credentials", action: "create" }
+        ]
+      }
+    },
     "/api/openapi.json": {
       get: {
         tags: ["Discovery"],
@@ -1074,7 +1272,7 @@ var engineOpenApiDocument = {
         summary: "List visible engine clients.",
         operationId: "list_engine_clients",
         parameters: [{ $ref: "#/components/parameters/ListClientsParams" }],
-        security: [{ bearerAuth: [] }],
+        security: [{ bearerAuth: [] }, { mutualTLS: [] }],
         responses: {
           "200": jsonArrayResponse(
             "Visible clients.",
@@ -1093,7 +1291,7 @@ var engineOpenApiDocument = {
         summary: "List visible engine tunnels.",
         operationId: "list_engine_tunnels",
         parameters: [{ $ref: "#/components/parameters/ListTunnelsParams" }],
-        security: [{ bearerAuth: [] }],
+        security: [{ bearerAuth: [] }, { mutualTLS: [] }],
         responses: {
           "200": jsonArrayResponse(
             "Visible tunnels. Fine-grained list scopes may filter objects and project fields.",
@@ -1113,7 +1311,7 @@ var engineOpenApiDocument = {
         summary: "Subscribe to visible engine state through Server-Sent Events.",
         operationId: "watch_engine_events_sse",
         parameters: [{ $ref: "#/components/parameters/WatchParams" }],
-        security: [{ bearerAuth: [] }],
+        security: [{ bearerAuth: [] }, { mutualTLS: [] }],
         responses: {
           "200": streamResponse(
             "SSE stream. Each event is emitted as a data line containing a JSON Event object."
@@ -1132,7 +1330,7 @@ var engineOpenApiDocument = {
         summary: "Subscribe to visible engine state through a WebSocket upgrade.",
         operationId: "watch_engine_events_websocket",
         parameters: [{ $ref: "#/components/parameters/WatchParams" }],
-        security: [{ bearerAuth: [] }],
+        security: [{ bearerAuth: [] }, { mutualTLS: [] }],
         responses: {
           "101": {
             description: "WebSocket connection accepted. Frames contain JSON Event objects."

package/dist/openapi.mjs

@@ -1,7 +1,7 @@
 import {
   engineOpenApiDocument,
   engineOpenApiJson
-} from "./chunk-3VBF43NB.mjs";
+} from "./chunk-DQN5T7CI.mjs";
 export {
   engineOpenApiDocument,
   engineOpenApiJson

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rstreamlabs/tunnels",
-  "version": "3.9.0",
+  "version": "3.10.1",
   "description": "JS/TS SDK for the rstream Engine API and tunnel runtime APIs.",
   "author": "@uartnet <hello@rstream.io>",
   "repository": {
@@ -47,7 +47,7 @@
     "typescript-config": "*"
   },
   "dependencies": {
-    "@rstreamlabs/rstream": "3.8.2",
+    "@rstreamlabs/rstream": "3.9.1",
     "@types/jsonwebtoken": "^9.0.10",
     "jsonwebtoken": "^9.0.3",
     "zod": "^4.4.3"