@manajemin-dev-cli/sdk 0.1.0 → 0.1.2

package/README.md

@@ -2,7 +2,11 @@
 
 Connect an app to the Manajemin platform: verify what the platform sends you, redeem sign-in codes, acknowledge installs
 and removals, report usage, and keep every database query inside one organisation's workspace. No runtime dependencies.
-Node 22.18 or later (it ships as TypeScript that Node runs directly).
+Node 20 or later.
+
+```sh
+npm install @manajemin-dev-cli/sdk
+```
 
 The rules it implements are the published contract in `doc/integration/` (`contract.json`, `openapi.yaml`,
 `signature-vectors.json`), not this code. Its tests run every published signature vector.

package/client.d.ts

@@ -23,9 +23,17 @@ export interface ClientOptions {
 }
 export declare class ManajeminApiError extends Error {
     readonly status: number;
+    /** Stable machine code to branch on, e.g. `install_paused` or `rate_limited` (quickstart, "Where to look when something fails"). */
     readonly code: string | null;
     readonly requestId: string | null;
-    constructor(status: number, message: string, code: string | null, requestId: string | null);
+    /** Seconds to wait before retrying, from `Retry-After` on a 429. */
+    readonly retryAfterSeconds: number | null;
+    /** The English explanation for the developer. `message` stays the platform's own copy (Indonesian), as in 0.1.1. */
+    readonly detail: string | null;
+    constructor(status: number, message: string, code: string | null, requestId: string | null, extra?: {
+        retryAfterSeconds?: number | null;
+        detail?: string | null;
+    });
 }
 export interface Claims {
     sub: string;

package/client.js

@@ -6,14 +6,21 @@
 export const DEFAULT_BASE_URL = "https://www.manajemin.com";
 export class ManajeminApiError extends Error {
     status;
+    /** Stable machine code to branch on, e.g. `install_paused` or `rate_limited` (quickstart, "Where to look when something fails"). */
     code;
     requestId;
-    constructor(status, message, code, requestId) {
+    /** Seconds to wait before retrying, from `Retry-After` on a 429. */
+    retryAfterSeconds;
+    /** The English explanation for the developer. `message` stays the platform's own copy (Indonesian), as in 0.1.1. */
+    detail;
+    constructor(status, message, code, requestId, extra = {}) {
         super(message);
         this.name = "ManajeminApiError";
         this.status = status;
         this.code = code;
         this.requestId = requestId;
+        this.retryAfterSeconds = extra.retryAfterSeconds ?? null;
+        this.detail = extra.detail ?? null;
     }
 }
 const toStoredFile = (f) => ({ id: f.id, name: f.name, contentType: f.content_type, sizeBytes: f.size_bytes, createdAt: f.created_at });
@@ -209,7 +216,11 @@ export class ManajeminClient {
         }
         if (!response.ok) {
             const error = (parsed ?? {});
-            throw new ManajeminApiError(response.status, error.error ?? `HTTP ${response.status}`, error.code ?? null, error.requestId ?? null);
+            const retryAfter = Number(response.headers.get("retry-after"));
+            throw new ManajeminApiError(response.status, error.error ?? error.message ?? `HTTP ${response.status}`, error.code ?? null, error.requestId ?? null, {
+                retryAfterSeconds: Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter : null,
+                detail: error.message ?? null,
+            });
         }
         return (parsed ?? {});
     }

package/delivery.js

@@ -16,16 +16,29 @@ export function receive(input) {
         return { ok: false, status: 400, reason: "malformed" };
     }
     const id = header(input.headers, "x-manajemin-delivery");
-    const event = header(input.headers, "x-manajemin-event");
-    if (!id || !event || typeof body !== "object" || body === null)
+    const headerEvent = header(input.headers, "x-manajemin-event");
+    if (!id || !headerEvent || typeof body !== "object" || body === null)
+        return { ok: false, status: 400, reason: "malformed" };
+    // The signature covers the body, not the headers: the event, tenant and entity come from the body, and a header that says
+    // otherwise means the request was altered after signing (backlog -121), so it is refused.
+    const signed = body;
+    const fromBody = (value, headerValue) => {
+        if (typeof value !== "string")
+            return { value: headerValue ?? null, ok: true };
+        return { value, ok: headerValue === undefined || headerValue === value };
+    };
+    const event = fromBody(signed.event, headerEvent);
+    const tenant = fromBody(signed.tenant_id, header(input.headers, "x-manajemin-tenant"));
+    const entity = fromBody(signed.entity_id, header(input.headers, "x-manajemin-entity"));
+    if (!event.ok || !tenant.ok || !entity.ok)
         return { ok: false, status: 400, reason: "malformed" };
     return {
         ok: true,
         delivery: {
             id,
-            event,
-            tenantId: header(input.headers, "x-manajemin-tenant") ?? null,
-            entityId: header(input.headers, "x-manajemin-entity") ?? null,
+            event: event.value ?? headerEvent,
+            tenantId: tenant.value,
+            entityId: entity.value,
             apiVersion: header(input.headers, "x-manajemin-api-version") ?? null,
             traceId: /^00-([0-9a-f]{32})-[0-9a-f]{16}-[0-9a-f]{2}$/.exec(header(input.headers, "traceparent") ?? "")?.[1] ?? null,
             body: body,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manajemin-dev-cli/sdk",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Connect an app to the Manajemin platform: verify deliveries, redeem SSO codes, acknowledge installs, report usage.",
   "license": "Apache-2.0",
   "type": "module",