@unofficialbox/box-open-sdk 0.7.0 → 0.8.0

package/docs/managers/web_links.md

@@ -25,6 +25,7 @@ const result = await client.webLinks.create({ /* … */ });
 |---|---|---|---|
 | `web_link_id` | path | `string` | yes |
 | `boxapi` | header | `string` | no |
+| `if-none-match` | header | `string` | no |
 
 **Returns:** `WebLink`
 
@@ -41,6 +42,7 @@ const result = await client.webLinks.get("WEB_LINK_ID");
 | Parameter | In | Type | Required |
 |---|---|---|---|
 | `web_link_id` | path | `string` | yes |
+| `if-match` | header | `string` | no |
 
 **Request body** (`application/json`): `UpdateWebLinkRequest`
 
@@ -59,6 +61,7 @@ const result = await client.webLinks.update("WEB_LINK_ID", { /* … */ });
 | Parameter | In | Type | Required |
 |---|---|---|---|
 | `web_link_id` | path | `string` | yes |
+| `if-match` | header | `string` | no |
 
 **Returns:** `void`
 

package/docs/pagination.md

@@ -15,3 +15,19 @@ It walks every page until the response has no next cursor (or an empty page, for
 offset pagination), and owns a private copy of the options you pass, so your
 value is never mutated. The wire cursor (`next_marker` / `offset`, verbatim per
 TR-TS.2) is threaded through the options for you.
+
+## Events
+
+`client.events.stream` follows Box's long-poll event stream: it yields the events
+after `stream_position` (`'now'` when unset), each once — Box may deliver an
+event twice — then waits on a real-time server until Box reports a change. It
+lists a fresh server when Box asks it to reconnect, and retries a long poll that
+times out. It rejects when a call fails; `break` or an `AbortSignal` stops it.
+Stream positions keep every digit, even past `Number.MAX_SAFE_INTEGER`:
+
+```ts
+const controller = new AbortController();
+for await (const event of client.events.stream({}, controller.signal)) {
+  // use event
+}
+```

package/docs/webhooks.md

@@ -0,0 +1,34 @@
+<!-- Generated by box-gantry. DO NOT EDIT. -->
+# Webhooks
+
+Once you generate signature keys for your app (Developer Console → **Webhooks**
+→ **Manage signature keys**), Box signs every webhook delivery. Each
+`BOX-SIGNATURE-PRIMARY` / `BOX-SIGNATURE-SECONDARY` header is the base64
+HMAC-SHA256, under that key, of the request body followed by the
+`BOX-DELIVERY-TIMESTAMP` header (Box's
+[Verify webhook signatures](https://developer.box.com/guides/webhooks/v2/signatures-v2/)
+guide). `runtime.verifyWebhook` checks a delivery before you trust it:
+
+```ts
+import { runtime } from '@unofficialbox/box-open-sdk';
+
+// `body`: the raw request body (bytes or string); `headers`: a `Headers`
+// object or a plain record.
+const genuine = await runtime.verifyWebhook(body, headers, {
+  primaryKey,
+  secondaryKey,
+});
+if (!genuine) {
+  // reject: not from Box, altered, or stale
+}
+```
+
+- **Pass the body exactly as received.** Parsed and re-serialized JSON won't
+  verify.
+- **Either key may be missing.** A delivery is genuine when the signature of
+  any configured key matches, so you can rotate one key while the other keeps
+  verifying.
+- **Old or future deliveries are refused.** A delivery stamped more than ten
+  minutes ago (`maxAgeSeconds`) or in the future fails, which blocks replays.
+- **Header names match in any case**, and the comparison takes the same time
+  wherever a signature differs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unofficialbox/box-open-sdk",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Box API client for TypeScript (open source, community, punk rock) — typed models, async managers, and a fetch runtime with retry, backoff, and token refresh.",
   "keywords": ["box", "box-api", "sdk", "api-client", "typescript", "unofficial"],
   "license": "MIT",