@hostwebhook/node 1.3.0 → 1.4.1

package/dist/index.mjs

@@ -174,24 +174,26 @@ var SendError = class extends Error {
 // src/client.ts
 var DEFAULT_BASE_URL = "https://api.hostwebhook.com";
 var DEFAULT_TIMEOUT = 1e4;
-var _token, _baseUrl, _signingSecret, _signature, _defaultHeaders, _timeoutMs, _HostWebhook_instances, waitForStream_fn;
+var _apiKey, _token, _baseUrl, _signingSecret, _signature, _defaultHeaders, _timeoutMs, _HostWebhook_instances, doSend_fn, waitForStream_fn;
 var HostWebhook = class {
   constructor(config) {
     __privateAdd(this, _HostWebhook_instances);
+    __privateAdd(this, _apiKey);
     __privateAdd(this, _token);
     __privateAdd(this, _baseUrl);
     __privateAdd(this, _signingSecret);
     __privateAdd(this, _signature);
     __privateAdd(this, _defaultHeaders);
     __privateAdd(this, _timeoutMs);
-    if (!config.token) {
-      throw new Error("HostWebhook: token is required");
+    if (!config.apiKey && !config.token) {
+      throw new Error("HostWebhook: apiKey or token is required");
     }
     if (config.signingSecret && config.signature) {
       throw new Error(
         "HostWebhook: use either signingSecret or signature, not both"
       );
     }
+    __privateSet(this, _apiKey, config.apiKey);
     __privateSet(this, _token, config.token);
     __privateSet(this, _baseUrl, (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, ""));
     __privateSet(this, _signingSecret, config.signingSecret);
@@ -202,91 +204,29 @@ var HostWebhook = class {
   /**
    * Send a webhook payload through HostWebhook.
    *
-   * The payload is JSON-stringified and POST'd to the ingress endpoint.
-   * HostWebhook then handles delivery to the target URL with retries,
-   * monitoring, transforms, and signing.
+   * @overload send(payload, options?) — uses default token from constructor
+   * @overload send(token, payload, options?) — specify token per call
    *
-   * @param payload - The webhook payload (will be JSON.stringify'd)
-   * @param options - Optional per-request configuration
-   * @returns The event ID assigned by HostWebhook
    * @throws {SendError} If the API returns a non-2xx status
+   * @throws {Error} If no token is available
    */
-  async send(payload, options) {
-    const body = options?.rawBody !== void 0 ? typeof options.rawBody === "string" ? options.rawBody : options.rawBody.toString("utf8") : JSON.stringify(payload);
-    let tz = "";
-    try {
-      tz = Intl.DateTimeFormat().resolvedOptions().timeZone;
-    } catch {
-    }
-    const headers = {
-      "Content-Type": options?.contentType ?? "application/json",
-      "User-Agent": `HostWebhook-SDK/${"1.3.0"}`,
-      "X-HostWebhook-Sent-At": (/* @__PURE__ */ new Date()).toISOString(),
-      ...tz ? { "X-HostWebhook-Timezone": tz } : {},
-      ...__privateGet(this, _defaultHeaders),
-      ...options?.headers
-    };
-    if (__privateGet(this, _signature)?.type === "static") {
-      const { secret, header } = __privateGet(this, _signature);
-      if (header) {
-        headers[header] = secret;
-      } else {
-        headers["Authorization"] = `Bearer ${secret}`;
-      }
-    } else if (__privateGet(this, _signingSecret)) {
-      const timestamp = Math.floor(Date.now() / 1e3);
-      const sig = createHmac2("sha256", __privateGet(this, _signingSecret)).update(`${timestamp}.${body}`).digest("hex");
-      headers["X-HostWebhook-Signature"] = `t=${timestamp},v1=${sig}`;
-    }
-    const url = `${__privateGet(this, _baseUrl)}/api/in/${__privateGet(this, _token)}`;
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), __privateGet(this, _timeoutMs));
-    let ingressResult;
-    try {
-      const res = await fetch(url, {
-        method: "POST",
-        headers,
-        body,
-        signal: controller.signal
-      });
-      const text = await res.text();
-      if (!res.ok) {
-        throw new SendError(
-          `HostWebhook ingress error (${res.status}): ${text}`,
-          res.status,
-          text
-        );
-      }
-      try {
-        ingressResult = JSON.parse(text);
-      } catch {
-        ingressResult = { eventId: text };
-      }
-    } catch (err) {
-      if (err instanceof SendError) throw err;
-      if (err instanceof DOMException && err.name === "AbortError") {
-        throw new SendError(
-          `HostWebhook request timed out after ${__privateGet(this, _timeoutMs)}ms`,
-          0,
-          ""
-        );
+  async send(tokenOrPayload, payloadOrOptions, maybeOptions) {
+    let token;
+    let payload;
+    let options;
+    if (typeof tokenOrPayload === "string") {
+      token = tokenOrPayload;
+      payload = payloadOrOptions ?? {};
+      options = maybeOptions;
+    } else {
+      if (!__privateGet(this, _token)) {
+        throw new Error("HostWebhook: no default token set \u2014 pass token as first argument: send(token, payload)");
       }
-      throw err;
-    } finally {
-      clearTimeout(timer);
-    }
-    if (ingressResult.syncStatus !== void 0) {
-      if (options?.onResult) options.onResult(ingressResult);
-      return ingressResult;
+      token = __privateGet(this, _token);
+      payload = tokenOrPayload;
+      options = payloadOrOptions;
     }
-    if (options?.waitForResult && ingressResult.streamToken) {
-      return __privateMethod(this, _HostWebhook_instances, waitForStream_fn).call(this, ingressResult, options?.onStep);
-    }
-    if (options?.onResult && ingressResult.streamToken) {
-      __privateMethod(this, _HostWebhook_instances, waitForStream_fn).call(this, ingressResult, options?.onStep).then((result) => options.onResult(result)).catch(() => {
-      });
-    }
-    return ingressResult;
+    return __privateMethod(this, _HostWebhook_instances, doSend_fn).call(this, token, payload, options);
   }
   /**
    * Convenience: send multiple payloads in parallel.
@@ -301,41 +241,60 @@ var HostWebhook = class {
   /**
    * Send a webhook with file attachments.
    *
-   * Files are uploaded directly to storage via presigned URLs (zero memory on API),
-   * then file references are injected into the payload before sending.
+   * Requires `apiKey` with `canvas:write` scope for file operations.
+   * Files are uploaded via presigned URLs, then references are injected into the payload.
    *
-   * @param payload - The webhook payload
-   * @param files - Map of field name → file (Buffer or Blob with metadata)
-   * @param options - Optional per-request configuration
+   * @overload sendWithFiles(payload, files, options?) — uses default token
+   * @overload sendWithFiles(token, payload, files, options?) — specify token per call
    *
    * @example
    * ```ts
-   * const hw = new HostWebhook({ token: 'your_token' });
+   * const hw = new HostWebhook({ apiKey: 'hwk_...', token: 'ingress_token' });
    * await hw.sendWithFiles(
-   *   { orderId: '123', type: 'invoice' },
+   *   { orderId: '123' },
    *   { invoice: { data: pdfBuffer, fileName: 'inv.pdf', mimeType: 'application/pdf' } },
    * );
    * ```
    */
-  async sendWithFiles(payload, files, options) {
+  async sendWithFiles(tokenOrPayload, payloadOrFiles, filesOrOptions, maybeOptions) {
+    let token;
+    let payload;
+    let files;
+    let options;
+    if (typeof tokenOrPayload === "string") {
+      token = tokenOrPayload;
+      payload = payloadOrFiles;
+      files = filesOrOptions ?? {};
+      options = maybeOptions;
+    } else {
+      if (!__privateGet(this, _token)) {
+        throw new Error("HostWebhook: no default token set \u2014 pass token as first argument");
+      }
+      token = __privateGet(this, _token);
+      payload = tokenOrPayload;
+      files = payloadOrFiles ?? {};
+      options = filesOrOptions;
+    }
+    if (!__privateGet(this, _apiKey)) {
+      throw new Error("HostWebhook: apiKey is required for sendWithFiles (needs canvas:write scope)");
+    }
     const enrichedPayload = { ...payload };
     for (const [fieldName, file] of Object.entries(files)) {
       const uploadRes = await fetch(`${__privateGet(this, _baseUrl)}/api/files/upload-url`, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          "Authorization": `Bearer ${__privateGet(this, _token)}`
+          "Authorization": `Bearer ${__privateGet(this, _apiKey)}`
         },
         body: JSON.stringify({ fileName: file.fileName, mimeType: file.mimeType })
       });
       if (!uploadRes.ok) throw new SendError(`Failed to get upload URL for ${fieldName}`, uploadRes.status, await uploadRes.text());
       const { fileId, uploadUrl, key } = await uploadRes.json();
-      const uploadBody = file.data instanceof Blob ? file.data : new Blob([new Uint8Array(file.data)], { type: file.mimeType });
-      const putRes = await fetch(uploadUrl, { method: "PUT", headers: { "Content-Type": file.mimeType }, body: uploadBody });
+      const putRes = await fetch(uploadUrl, { method: "PUT", headers: { "Content-Type": file.mimeType }, body: file.data });
       if (!putRes.ok) throw new SendError(`Failed to upload ${fieldName} to storage`, putRes.status, await putRes.text());
       const confirmRes = await fetch(`${__privateGet(this, _baseUrl)}/api/files/${fileId}/confirm`, {
         method: "POST",
-        headers: { "Authorization": `Bearer ${__privateGet(this, _token)}` }
+        headers: { "Authorization": `Bearer ${__privateGet(this, _apiKey)}` }
       });
       if (!confirmRes.ok) throw new SendError(`Failed to confirm upload for ${fieldName}`, confirmRes.status, await confirmRes.text());
       const confirmed = await confirmRes.json();
@@ -343,9 +302,51 @@ var HostWebhook = class {
         _file: { id: confirmed.id, key, originalName: confirmed.originalName, mimeType: confirmed.mimeType, size: confirmed.size }
       };
     }
-    return this.send(enrichedPayload, options);
+    return __privateMethod(this, _HostWebhook_instances, doSend_fn).call(this, token, enrichedPayload, options);
+  }
+  /**
+   * Send a webhook and stream pipeline steps as an async iterable.
+   *
+   * Much simpler than `waitForResult` or `onResult` callbacks.
+   * Iteration ends when the pipeline completes. Access `stream.result`
+   * after the loop for the final pipeline result.
+   *
+   * @overload stream(payload) — uses default token
+   * @overload stream(token, payload) — specify token per call
+   *
+   * @example
+   * ```ts
+   * const hw = new HostWebhook({ apiKey: 'hwk_...', token: 'ingress_token' });
+   * const stream = await hw.stream({ event: 'order.created' });
+   *
+   * for await (const step of stream) {
+   *   console.log(`${step.nodeType}: ${step.status}`);
+   * }
+   * console.log('Done:', stream.result);
+   * ```
+   */
+  async stream(tokenOrPayload, maybePayload) {
+    let token;
+    let payload;
+    if (typeof tokenOrPayload === "string") {
+      token = tokenOrPayload;
+      payload = maybePayload ?? {};
+    } else {
+      if (!__privateGet(this, _token)) {
+        throw new Error("HostWebhook: no default token set \u2014 pass token as first argument: stream(token, payload)");
+      }
+      token = __privateGet(this, _token);
+      payload = tokenOrPayload;
+    }
+    const ingressResult = await __privateMethod(this, _HostWebhook_instances, doSend_fn).call(this, token, payload);
+    if (!ingressResult.streamToken) {
+      return new PipelineStream([], ingressResult);
+    }
+    const streamUrl = `${__privateGet(this, _baseUrl)}/api/events/${ingressResult.eventId}/stream?token=${ingressResult.streamToken}`;
+    return PipelineStream.connect(streamUrl, ingressResult);
   }
 };
+_apiKey = new WeakMap();
 _token = new WeakMap();
 _baseUrl = new WeakMap();
 _signingSecret = new WeakMap();
@@ -353,6 +354,88 @@ _signature = new WeakMap();
 _defaultHeaders = new WeakMap();
 _timeoutMs = new WeakMap();
 _HostWebhook_instances = new WeakSet();
+doSend_fn = async function(token, payload, options) {
+  const body = options?.rawBody !== void 0 ? typeof options.rawBody === "string" ? options.rawBody : options.rawBody.toString("utf8") : JSON.stringify(payload);
+  let tz = "";
+  try {
+    tz = Intl.DateTimeFormat().resolvedOptions().timeZone;
+  } catch {
+  }
+  const headers = {
+    "Content-Type": options?.contentType ?? "application/json",
+    "User-Agent": `HostWebhook-SDK/${"1.4.1"}`,
+    "X-HostWebhook-Sent-At": (/* @__PURE__ */ new Date()).toISOString(),
+    ...tz ? { "X-HostWebhook-Timezone": tz } : {},
+    ...__privateGet(this, _defaultHeaders),
+    ...options?.headers
+  };
+  if (__privateGet(this, _apiKey)) {
+    headers["Authorization"] = `Bearer ${__privateGet(this, _apiKey)}`;
+  }
+  if (!__privateGet(this, _apiKey)) {
+    if (__privateGet(this, _signature)?.type === "static") {
+      const { secret, header } = __privateGet(this, _signature);
+      if (header) {
+        headers[header] = secret;
+      } else {
+        headers["Authorization"] = `Bearer ${secret}`;
+      }
+    } else if (__privateGet(this, _signingSecret)) {
+      const timestamp = Math.floor(Date.now() / 1e3);
+      const sig = createHmac2("sha256", __privateGet(this, _signingSecret)).update(`${timestamp}.${body}`).digest("hex");
+      headers["X-HostWebhook-Signature"] = `t=${timestamp},v1=${sig}`;
+    }
+  }
+  const url = `${__privateGet(this, _baseUrl)}/api/in/${token}`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), __privateGet(this, _timeoutMs));
+  let ingressResult;
+  try {
+    const res = await fetch(url, {
+      method: "POST",
+      headers,
+      body,
+      signal: controller.signal
+    });
+    const text = await res.text();
+    if (!res.ok) {
+      throw new SendError(
+        `HostWebhook ingress error (${res.status}): ${text}`,
+        res.status,
+        text
+      );
+    }
+    try {
+      ingressResult = JSON.parse(text);
+    } catch {
+      ingressResult = { eventId: text };
+    }
+  } catch (err) {
+    if (err instanceof SendError) throw err;
+    if (err instanceof DOMException && err.name === "AbortError") {
+      throw new SendError(
+        `HostWebhook request timed out after ${__privateGet(this, _timeoutMs)}ms`,
+        0,
+        ""
+      );
+    }
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+  if (ingressResult.syncStatus !== void 0) {
+    if (options?.onResult) options.onResult(ingressResult);
+    return ingressResult;
+  }
+  if (options?.waitForResult && ingressResult.streamToken) {
+    return __privateMethod(this, _HostWebhook_instances, waitForStream_fn).call(this, ingressResult, options?.onStep);
+  }
+  if (options?.onResult && ingressResult.streamToken) {
+    __privateMethod(this, _HostWebhook_instances, waitForStream_fn).call(this, ingressResult, options?.onStep).then((result) => options.onResult(result)).catch(() => {
+    });
+  }
+  return ingressResult;
+};
 waitForStream_fn = async function(ingressResult, onStep) {
   const { eventId, streamToken } = ingressResult;
   const streamUrl = `${__privateGet(this, _baseUrl)}/api/events/${eventId}/stream?token=${streamToken}`;
@@ -417,12 +500,121 @@ waitForStream_fn = async function(ingressResult, onStep) {
     clearTimeout(timer);
   }
 };
+var _steps, _pendingSteps, _done, _doneResult, _resolve, _reader, _abortController;
+var _PipelineStream = class _PipelineStream {
+  constructor(steps, result) {
+    __privateAdd(this, _steps);
+    __privateAdd(this, _pendingSteps, []);
+    __privateAdd(this, _done, false);
+    __privateAdd(this, _doneResult, null);
+    __privateAdd(this, _resolve, null);
+    __privateAdd(this, _reader, null);
+    __privateAdd(this, _abortController, null);
+    __privateSet(this, _steps, steps);
+    this.result = result;
+    __privateSet(this, _done, true);
+  }
+  static async connect(streamUrl, ingressResult) {
+    const stream = new _PipelineStream([], ingressResult);
+    __privateSet(stream, _done, false);
+    const controller = new AbortController();
+    __privateSet(stream, _abortController, controller);
+    const timer = setTimeout(() => controller.abort(), 125e3);
+    try {
+      const res = await fetch(streamUrl, { signal: controller.signal });
+      if (!res.ok) {
+        clearTimeout(timer);
+        __privateSet(stream, _done, true);
+        return stream;
+      }
+      __privateSet(stream, _reader, res.body.getReader());
+      const decoder = new TextDecoder();
+      let buffer = "";
+      let currentEvent = "";
+      (async () => {
+        var _a, _b, _c, _d;
+        try {
+          while (true) {
+            const { done, value } = await __privateGet(stream, _reader).read();
+            if (done) break;
+            buffer += decoder.decode(value, { stream: true });
+            const lines = buffer.split("\n");
+            buffer = lines.pop();
+            for (const line of lines) {
+              if (line.startsWith("event: ")) {
+                currentEvent = line.slice(7).trim();
+              } else if (line.startsWith("data: ")) {
+                try {
+                  const parsed = JSON.parse(line.slice(6));
+                  if (currentEvent === "step") {
+                    __privateGet(stream, _steps).push(parsed);
+                    __privateGet(stream, _pendingSteps).push(parsed);
+                    (_a = __privateGet(stream, _resolve)) == null ? void 0 : _a.call(stream);
+                  } else if (currentEvent === "done") {
+                    __privateSet(stream, _doneResult, parsed);
+                    stream.result = {
+                      ...ingressResult,
+                      steps: __privateGet(stream, _steps),
+                      syncStatus: parsed.status ?? 200,
+                      ...parsed.body ?? parsed
+                    };
+                    __privateSet(stream, _done, true);
+                    (_b = __privateGet(stream, _resolve)) == null ? void 0 : _b.call(stream);
+                    return;
+                  } else if (currentEvent === "timeout") {
+                    stream.result = { ...ingressResult, steps: __privateGet(stream, _steps), syncStatus: 408, error: "Pipeline timeout" };
+                    __privateSet(stream, _done, true);
+                    (_c = __privateGet(stream, _resolve)) == null ? void 0 : _c.call(stream);
+                    return;
+                  }
+                } catch {
+                }
+                currentEvent = "";
+              }
+            }
+          }
+        } catch {
+        } finally {
+          clearTimeout(timer);
+          __privateSet(stream, _done, true);
+          (_d = __privateGet(stream, _resolve)) == null ? void 0 : _d.call(stream);
+        }
+      })();
+    } catch {
+      clearTimeout(timer);
+      __privateSet(stream, _done, true);
+    }
+    return stream;
+  }
+  async *[Symbol.asyncIterator]() {
+    while (true) {
+      if (__privateGet(this, _pendingSteps).length > 0) {
+        yield __privateGet(this, _pendingSteps).shift();
+        continue;
+      }
+      if (__privateGet(this, _done)) return;
+      await new Promise((resolve) => {
+        __privateSet(this, _resolve, resolve);
+      });
+      __privateSet(this, _resolve, null);
+    }
+  }
+};
+_steps = new WeakMap();
+_pendingSteps = new WeakMap();
+_done = new WeakMap();
+_doneResult = new WeakMap();
+_resolve = new WeakMap();
+_reader = new WeakMap();
+_abortController = new WeakMap();
+var PipelineStream = _PipelineStream;
 async function send(config, payload, options) {
   const client = new HostWebhook(config);
   return client.send(payload, options);
 }
 export {
   HostWebhook,
+  PipelineStream,
   SendError,
   VerificationError,
   createNestGuard,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hostwebhook/node",
-  "version": "1.3.0",
+  "version": "1.4.1",
   "description": "Official HostWebhook SDK — verify signatures, parse headers, and send webhooks",
   "main": "dist/index.js",
   "module": "dist/index.mjs",