@rstreamlabs/tunnels 3.2.0 → 3.4.0

package/README.md

@@ -112,7 +112,7 @@ await watch.connect();
 ```
 
 URL-based watch authentication requires a short-lived token with bounded
-lifetime and watch-only tunnel list resources.
+lifetime, explicit read-only watch permissions, and list-only tunnel resources.
 
 Browser integrations should provide `auth` as a function that calls a backend
 token route and returns a fresh watch token for each connection attempt. Do not
@@ -190,7 +190,8 @@ For a receiving backend, verify the signature before touching the JSON payload
 and use the event id as the idempotency key.
 
 ```ts
-import { RstreamWebhookResource, type WebhookEvent } from "@rstreamlabs/tunnels";
+import { RstreamWebhookResource } from "@rstreamlabs/tunnels";
+import { type WebhookEvent } from "@rstreamlabs/tunnels";
 
 const webhooks = new RstreamWebhookResource();
 
@@ -225,18 +226,71 @@ export async function receiveWebhook(request: Request) {
   const rawBody = Buffer.from(await request.arrayBuffer());
   const signature = request.headers.get("rstream-signature");
   if (!signature) throw new Error("Missing webhook signature.");
-
   const event = await webhooks.event(
     rawBody,
     signature,
     process.env.WEBHOOK_SECRET!,
   );
   if (!event.id) throw new Error("Missing webhook event id.");
-
   await handleLifecycleEvent(event);
 }
 ```
 
+## Project Log Events
+
+Use `streamSummarySchema` for connection log entries returned by the Engine API.
+The `request.entry.kind` field distinguishes published access from private
+rstream dials; `formatStreamAccessPath` returns the dashboard-safe label for
+that value.
+
+```ts
+import { formatStreamAccessPath } from "@rstreamlabs/tunnels";
+import { streamSummarySchema } from "@rstreamlabs/tunnels";
+
+const summary = streamSummarySchema.parse(payload);
+
+console.log(formatStreamAccessPath(summary.request.entry));
+```
+
+For local receiver tests, the SDK exposes the same signing primitives used by
+the CLI and Engine dispatcher:
+
+```ts
+import { buildWebhookHeaders } from "@rstreamlabs/tunnels";
+import { generateWebhookSigningSecret } from "@rstreamlabs/tunnels";
+import { type WebhookEvent } from "@rstreamlabs/tunnels";
+
+const secret = generateWebhookSigningSecret();
+const event: WebhookEvent & { id: string } = {
+  id: "evt_test",
+  type: "tunnel.created",
+  created_at: new Date().toISOString(),
+  object: {
+    id: "tunnel_test",
+    labels: {
+      device: "device_123",
+    },
+  },
+};
+const body = JSON.stringify(event);
+const headers = buildWebhookHeaders(body, event, secret, {
+  deliveryId: "del_test",
+  webhookId: "we_test",
+});
+
+await fetch("http://localhost:3000/api/rstream/webhook", {
+  body,
+  headers: {
+    "content-type": "application/json",
+    ...headers,
+  },
+  method: "POST",
+});
+```
+
+`rstream events --webhook` uses the same request body and header contract when
+forwarding live local events to a receiver.
+
 ## WebTTY Helpers
 
 Use `parseWebTTYServers()` to derive WebTTY server metadata from tunnel