@rstreamlabs/tunnels 3.1.0 → 3.2.1

package/dist/index.js

@@ -42,7 +42,13 @@ __export(index_exports, {
   RstreamWebhookResource: () => RstreamWebhookResource,
   RstreamWebhookRessource: () => RstreamWebhookResource,
   Tunnels: () => RstreamTunnelsClient,
+  WEBHOOK_DELIVERY_ID_HEADER: () => WEBHOOK_DELIVERY_ID_HEADER,
+  WEBHOOK_EVENT_ID_HEADER: () => WEBHOOK_EVENT_ID_HEADER,
+  WEBHOOK_EVENT_TYPE_HEADER: () => WEBHOOK_EVENT_TYPE_HEADER,
+  WEBHOOK_ID_HEADER: () => WEBHOOK_ID_HEADER,
+  WEBHOOK_SIGNATURE_HEADER: () => WEBHOOK_SIGNATURE_HEADER,
   Watch: () => Watch,
+  buildWebhookHeaders: () => buildWebhookHeaders,
   clientFilterSchema: () => clientFilterSchema,
   clientSchema: () => clientSchema,
   createAPITURNCredentials: () => createAPITURNCredentials,
@@ -54,18 +60,22 @@ __export(index_exports, {
   engineOpenApiJson: () => engineOpenApiJson,
   eventSchema: () => eventSchema,
   formatTunnelHost: () => formatTunnelHost,
+  generateWebhookSigningSecret: () => generateWebhookSigningSecret,
   listClientsParamsSchema: () => listClientsParamsSchema,
   listClientsResponseSchema: () => listClientsResponseSchema,
   listTunnelsParamsSchema: () => listTunnelsParamsSchema,
   listTunnelsResponseSchema: () => listTunnelsResponseSchema,
   normalizeEngineAddress: () => normalizeEngineAddress,
   parseWebTTYServers: () => parseWebTTYServers,
+  projectLogEventsSchema: () => projectLogEventsSchema,
   resolveControlPlaneCredentials: () => resolveControlPlaneCredentials,
   resolveManagedTunnelsProject: () => resolveManagedTunnelsProject,
   resolveTunnelsAPIURL: () => resolveTunnelsAPIURL,
   resolveTunnelsCredentials: () => resolveTunnelsCredentials,
   resolveTunnelsEngine: () => resolveTunnelsEngine,
+  signWebhookPayload: () => signWebhookPayload,
   streamEndpointSchema: () => streamEndpointSchema,
+  streamSummaryEventSchema: () => streamSummaryEventSchema,
   streamSummarySchema: () => streamSummarySchema,
   streamTLSInfoSchema: () => streamTLSInfoSchema,
   tunnelFilterSchema: () => tunnelFilterSchema,
@@ -547,15 +557,23 @@ var commonEventsSchema = [
     object: import_tunnel.tunnelSchema
   })
 ];
+var webhookDeliverableEventsSchema = [
+  commonEventsSchema[0],
+  commonEventsSchema[2],
+  commonEventsSchema[3],
+  commonEventsSchema[5]
+];
 var wsEventsSchema = z3.union([
   stateInitialEventSchema,
   ...commonEventsSchema
 ]);
-var webhookEventsSchema = z3.union([
-  ...commonEventsSchema,
-  streamSummaryEventSchema
+var webhookEventsSchema = z3.union(webhookDeliverableEventsSchema);
+var projectLogEventsSchema = streamSummaryEventSchema;
+var eventSchema = z3.union([
+  wsEventsSchema,
+  webhookEventsSchema,
+  projectLogEventsSchema
 ]);
-var eventSchema = z3.union([wsEventsSchema, webhookEventsSchema]);
 
 // src/tunnel.ts
 var import_tunnel2 = require("@rstreamlabs/rstream/tunnel");
@@ -1467,9 +1485,18 @@ var RstreamTURNResource = class {
 
 // src/webhooks-resource.ts
 var import_crypto2 = __toESM(require("crypto"));
+var WEBHOOK_SIGNATURE_HEADER = "rstream-signature";
+var WEBHOOK_EVENT_ID_HEADER = "rstream-event-id";
+var WEBHOOK_EVENT_TYPE_HEADER = "rstream-event-type";
+var WEBHOOK_ID_HEADER = "rstream-webhook-id";
+var WEBHOOK_DELIVERY_ID_HEADER = "rstream-delivery-id";
 var SIGNATURE_HEX_BYTES = 32;
+var webhookSecretBytes = 32;
 var signatureHexSchema = /^[0-9a-fA-F]{64}$/;
 var timestampSchema = /^\d+$/;
+function payloadBuffer(payload) {
+  return Buffer.isBuffer(payload) ? payload : Buffer.from(payload);
+}
 function parseSignatureTimestamp(timestamp) {
   if (!timestampSchema.test(timestamp)) {
     throw new Error("Invalid signature timestamp");
@@ -1486,6 +1513,19 @@ function normalizeTolerance(tolerance) {
   }
   return tolerance;
 }
+function normalizeTimestamp(timestamp) {
+  if (timestamp === void 0) {
+    return Math.floor(Date.now() / 1e3);
+  }
+  const seconds = timestamp instanceof Date ? timestamp.getTime() / 1e3 : timestamp;
+  if (!Number.isFinite(seconds) || seconds < 0) {
+    throw new Error("Invalid webhook signature timestamp");
+  }
+  return Math.floor(seconds);
+}
+function signedPayload(timestamp, payload) {
+  return Buffer.concat([Buffer.from(`${timestamp}.`, "utf8"), payload]);
+}
 function readSignature(signature) {
   if (!signatureHexSchema.test(signature)) {
     return void 0;
@@ -1502,9 +1542,42 @@ function assertSecretConfigured(secret) {
     throw new Error("Webhook signing secret is required");
   }
 }
+function assertNonEmpty(value, label) {
+  const normalized = value.trim();
+  if (normalized.length === 0) {
+    throw new Error(`${label} is required`);
+  }
+  return normalized;
+}
+function generateWebhookSigningSecret() {
+  return `whsec_${import_crypto2.default.randomBytes(webhookSecretBytes).toString("base64url")}`;
+}
+function signWebhookPayload(payload, secret, timestamp) {
+  assertSecretConfigured(secret);
+  const timestampSeconds = normalizeTimestamp(timestamp).toString();
+  const signature = import_crypto2.default.createHmac("sha256", secret).update(signedPayload(timestampSeconds, payloadBuffer(payload))).digest("hex");
+  return `t=${timestampSeconds},v1=${signature}`;
+}
+function buildWebhookHeaders(payload, event, secret, options) {
+  const eventId = assertNonEmpty(event.id ?? "", "Webhook event id");
+  const eventType = assertNonEmpty(event.type, "Webhook event type");
+  const webhookId = assertNonEmpty(options.webhookId, "Webhook id");
+  const deliveryId = assertNonEmpty(options.deliveryId, "Webhook delivery id");
+  return {
+    [WEBHOOK_SIGNATURE_HEADER]: signWebhookPayload(
+      payload,
+      secret,
+      options.timestamp
+    ),
+    [WEBHOOK_EVENT_ID_HEADER]: eventId,
+    [WEBHOOK_EVENT_TYPE_HEADER]: eventType,
+    [WEBHOOK_ID_HEADER]: webhookId,
+    [WEBHOOK_DELIVERY_ID_HEADER]: deliveryId
+  };
+}
 var RstreamWebhookResource = class {
   async event(payload, header, secret, tolerance = 300, receivedAt = Date.now()) {
-    const payloadBuffer = Buffer.isBuffer(payload) ? payload : Buffer.from(payload);
+    const rawPayload = payloadBuffer(payload);
     const signatureHeader = Array.isArray(header) ? header[0] : header.toString();
     if (!signatureHeader) {
       throw new Error("No signature header");
@@ -1524,8 +1597,7 @@ var RstreamWebhookResource = class {
         `Webhook signature timestamp outside tolerance: ${now}, ${timestampNum}`
       );
     }
-    const signedPayload = `${timestamp}.${payloadBuffer.toString("utf8")}`;
-    const expectedSignature = import_crypto2.default.createHmac("sha256", secret).update(signedPayload).digest();
+    const expectedSignature = import_crypto2.default.createHmac("sha256", secret).update(signedPayload(timestamp, rawPayload)).digest();
     const signatureMatched = signatures.some(
       (signature) => signatureMatches(signature, expectedSignature)
     );
@@ -1533,9 +1605,7 @@ var RstreamWebhookResource = class {
       throw new Error("Signature verification failed");
     }
     try {
-      return webhookEventsSchema.parse(
-        JSON.parse(payloadBuffer.toString("utf8"))
-      );
+      return webhookEventsSchema.parse(JSON.parse(rawPayload.toString("utf8")));
     } catch (error) {
       throw new Error(
         `Failed to parse webhook payload: ${error instanceof Error ? error.message : String(error)}`,
@@ -1543,6 +1613,15 @@ var RstreamWebhookResource = class {
       );
     }
   }
+  generateSigningSecret() {
+    return generateWebhookSigningSecret();
+  }
+  sign(payload, secret, timestamp) {
+    return signWebhookPayload(payload, secret, timestamp);
+  }
+  headers(payload, event, secret, options) {
+    return buildWebhookHeaders(payload, event, secret, options);
+  }
 };
 
 // src/tunnels.ts
@@ -1975,7 +2054,13 @@ function parseWebTTYServers(tunnels) {
   RstreamWebhookResource,
   RstreamWebhookRessource,
   Tunnels,
+  WEBHOOK_DELIVERY_ID_HEADER,
+  WEBHOOK_EVENT_ID_HEADER,
+  WEBHOOK_EVENT_TYPE_HEADER,
+  WEBHOOK_ID_HEADER,
+  WEBHOOK_SIGNATURE_HEADER,
   Watch,
+  buildWebhookHeaders,
   clientFilterSchema,
   clientSchema,
   createAPITURNCredentials,
@@ -1987,18 +2072,22 @@ function parseWebTTYServers(tunnels) {
   engineOpenApiJson,
   eventSchema,
   formatTunnelHost,
+  generateWebhookSigningSecret,
   listClientsParamsSchema,
   listClientsResponseSchema,
   listTunnelsParamsSchema,
   listTunnelsResponseSchema,
   normalizeEngineAddress,
   parseWebTTYServers,
+  projectLogEventsSchema,
   resolveControlPlaneCredentials,
   resolveManagedTunnelsProject,
   resolveTunnelsAPIURL,
   resolveTunnelsCredentials,
   resolveTunnelsEngine,
+  signWebhookPayload,
   streamEndpointSchema,
+  streamSummaryEventSchema,
   streamSummarySchema,
   streamTLSInfoSchema,
   tunnelFilterSchema,

package/dist/index.mjs

@@ -9,13 +9,15 @@ import {
   listClientsResponseSchema,
   listTunnelsParamsSchema,
   listTunnelsResponseSchema,
+  projectLogEventsSchema,
   streamEndpointSchema,
+  streamSummaryEventSchema,
   streamSummarySchema,
   streamTLSInfoSchema,
   tunnelFilterSchema,
   webhookEventsSchema,
   wsEventsSchema
-} from "./chunk-UUZYVELQ.mjs";
+} from "./chunk-VUAM3LRU.mjs";
 
 // src/auth-resource.ts
 import { createAuthTokenParamsSchema } from "@rstreamlabs/rstream/auth-token";
@@ -728,9 +730,18 @@ var RstreamTURNResource = class {
 
 // src/webhooks-resource.ts
 import crypto2 from "crypto";
+var WEBHOOK_SIGNATURE_HEADER = "rstream-signature";
+var WEBHOOK_EVENT_ID_HEADER = "rstream-event-id";
+var WEBHOOK_EVENT_TYPE_HEADER = "rstream-event-type";
+var WEBHOOK_ID_HEADER = "rstream-webhook-id";
+var WEBHOOK_DELIVERY_ID_HEADER = "rstream-delivery-id";
 var SIGNATURE_HEX_BYTES = 32;
+var webhookSecretBytes = 32;
 var signatureHexSchema = /^[0-9a-fA-F]{64}$/;
 var timestampSchema = /^\d+$/;
+function payloadBuffer(payload) {
+  return Buffer.isBuffer(payload) ? payload : Buffer.from(payload);
+}
 function parseSignatureTimestamp(timestamp) {
   if (!timestampSchema.test(timestamp)) {
     throw new Error("Invalid signature timestamp");
@@ -747,6 +758,19 @@ function normalizeTolerance(tolerance) {
   }
   return tolerance;
 }
+function normalizeTimestamp(timestamp) {
+  if (timestamp === void 0) {
+    return Math.floor(Date.now() / 1e3);
+  }
+  const seconds = timestamp instanceof Date ? timestamp.getTime() / 1e3 : timestamp;
+  if (!Number.isFinite(seconds) || seconds < 0) {
+    throw new Error("Invalid webhook signature timestamp");
+  }
+  return Math.floor(seconds);
+}
+function signedPayload(timestamp, payload) {
+  return Buffer.concat([Buffer.from(`${timestamp}.`, "utf8"), payload]);
+}
 function readSignature(signature) {
   if (!signatureHexSchema.test(signature)) {
     return void 0;
@@ -763,9 +787,42 @@ function assertSecretConfigured(secret) {
     throw new Error("Webhook signing secret is required");
   }
 }
+function assertNonEmpty(value, label) {
+  const normalized = value.trim();
+  if (normalized.length === 0) {
+    throw new Error(`${label} is required`);
+  }
+  return normalized;
+}
+function generateWebhookSigningSecret() {
+  return `whsec_${crypto2.randomBytes(webhookSecretBytes).toString("base64url")}`;
+}
+function signWebhookPayload(payload, secret, timestamp) {
+  assertSecretConfigured(secret);
+  const timestampSeconds = normalizeTimestamp(timestamp).toString();
+  const signature = crypto2.createHmac("sha256", secret).update(signedPayload(timestampSeconds, payloadBuffer(payload))).digest("hex");
+  return `t=${timestampSeconds},v1=${signature}`;
+}
+function buildWebhookHeaders(payload, event, secret, options) {
+  const eventId = assertNonEmpty(event.id ?? "", "Webhook event id");
+  const eventType = assertNonEmpty(event.type, "Webhook event type");
+  const webhookId = assertNonEmpty(options.webhookId, "Webhook id");
+  const deliveryId = assertNonEmpty(options.deliveryId, "Webhook delivery id");
+  return {
+    [WEBHOOK_SIGNATURE_HEADER]: signWebhookPayload(
+      payload,
+      secret,
+      options.timestamp
+    ),
+    [WEBHOOK_EVENT_ID_HEADER]: eventId,
+    [WEBHOOK_EVENT_TYPE_HEADER]: eventType,
+    [WEBHOOK_ID_HEADER]: webhookId,
+    [WEBHOOK_DELIVERY_ID_HEADER]: deliveryId
+  };
+}
 var RstreamWebhookResource = class {
   async event(payload, header, secret, tolerance = 300, receivedAt = Date.now()) {
-    const payloadBuffer = Buffer.isBuffer(payload) ? payload : Buffer.from(payload);
+    const rawPayload = payloadBuffer(payload);
     const signatureHeader = Array.isArray(header) ? header[0] : header.toString();
     if (!signatureHeader) {
       throw new Error("No signature header");
@@ -785,8 +842,7 @@ var RstreamWebhookResource = class {
         `Webhook signature timestamp outside tolerance: ${now}, ${timestampNum}`
       );
     }
-    const signedPayload = `${timestamp}.${payloadBuffer.toString("utf8")}`;
-    const expectedSignature = crypto2.createHmac("sha256", secret).update(signedPayload).digest();
+    const expectedSignature = crypto2.createHmac("sha256", secret).update(signedPayload(timestamp, rawPayload)).digest();
     const signatureMatched = signatures.some(
       (signature) => signatureMatches(signature, expectedSignature)
     );
@@ -794,9 +850,7 @@ var RstreamWebhookResource = class {
       throw new Error("Signature verification failed");
     }
     try {
-      return webhookEventsSchema.parse(
-        JSON.parse(payloadBuffer.toString("utf8"))
-      );
+      return webhookEventsSchema.parse(JSON.parse(rawPayload.toString("utf8")));
     } catch (error) {
       throw new Error(
         `Failed to parse webhook payload: ${error instanceof Error ? error.message : String(error)}`,
@@ -804,6 +858,15 @@ var RstreamWebhookResource = class {
       );
     }
   }
+  generateSigningSecret() {
+    return generateWebhookSigningSecret();
+  }
+  sign(payload, secret, timestamp) {
+    return signWebhookPayload(payload, secret, timestamp);
+  }
+  headers(payload, event, secret, options) {
+    return buildWebhookHeaders(payload, event, secret, options);
+  }
 };
 
 // src/tunnels.ts
@@ -1235,7 +1298,13 @@ export {
   RstreamWebhookResource,
   RstreamWebhookResource as RstreamWebhookRessource,
   RstreamTunnelsClient as Tunnels,
+  WEBHOOK_DELIVERY_ID_HEADER,
+  WEBHOOK_EVENT_ID_HEADER,
+  WEBHOOK_EVENT_TYPE_HEADER,
+  WEBHOOK_ID_HEADER,
+  WEBHOOK_SIGNATURE_HEADER,
   Watch,
+  buildWebhookHeaders,
   clientFilterSchema,
   clientSchema,
   createAPITURNCredentials,
@@ -1247,18 +1316,22 @@ export {
   engineOpenApiJson,
   eventSchema,
   formatTunnelHost,
+  generateWebhookSigningSecret,
   listClientsParamsSchema,
   listClientsResponseSchema,
   listTunnelsParamsSchema,
   listTunnelsResponseSchema,
   normalizeEngineAddress,
   parseWebTTYServers,
+  projectLogEventsSchema,
   resolveControlPlaneCredentials,
   resolveManagedTunnelsProject,
   resolveTunnelsAPIURL,
   resolveTunnelsCredentials,
   resolveTunnelsEngine,
+  signWebhookPayload,
   streamEndpointSchema,
+  streamSummaryEventSchema,
   streamSummarySchema,
   streamTLSInfoSchema,
   tunnelFilterSchema,

package/dist/openapi.js

@@ -353,15 +353,23 @@ var commonEventsSchema = [
     object: import_tunnel2.tunnelSchema
   })
 ];
+var webhookDeliverableEventsSchema = [
+  commonEventsSchema[0],
+  commonEventsSchema[2],
+  commonEventsSchema[3],
+  commonEventsSchema[5]
+];
 var wsEventsSchema = z4.union([
   stateInitialEventSchema,
   ...commonEventsSchema
 ]);
-var webhookEventsSchema = z4.union([
-  ...commonEventsSchema,
-  streamSummaryEventSchema
+var webhookEventsSchema = z4.union(webhookDeliverableEventsSchema);
+var projectLogEventsSchema = streamSummaryEventSchema;
+var eventSchema = z4.union([
+  wsEventsSchema,
+  webhookEventsSchema,
+  projectLogEventsSchema
 ]);
-var eventSchema = z4.union([wsEventsSchema, webhookEventsSchema]);
 
 // src/openapi.ts
 var z5 = __toESM(require("zod"));

package/dist/openapi.mjs

@@ -1,7 +1,7 @@
 import {
   engineOpenApiDocument,
   engineOpenApiJson
-} from "./chunk-UUZYVELQ.mjs";
+} from "./chunk-VUAM3LRU.mjs";
 export {
   engineOpenApiDocument,
   engineOpenApiJson

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rstreamlabs/tunnels",
-  "version": "3.1.0",
+  "version": "3.2.1",
   "description": "JS/TS SDK for the rstream Engine API and tunnel runtime APIs.",
   "author": "@uartnet <hello@rstream.io>",
   "repository": {
@@ -47,7 +47,7 @@
     "typescript-config": "*"
   },
   "dependencies": {
-    "@rstreamlabs/rstream": "3.0.0",
+    "@rstreamlabs/rstream": "3.1.0",
     "@types/jsonwebtoken": "^9.0.10",
     "jsonwebtoken": "^9.0.3",
     "zod": "^4.3.6"