@yougrowai/node 0.1.0 → 0.3.0

package/dist/origin.d.ts

@@ -0,0 +1,11 @@
+/**
+ * YouGrow's origin, shared by the client (its requests go to `${origin}/api/v2/…`)
+ * and the verifier (tokens carry `iss: origin`; keys are at
+ * `${origin}/.well-known/jwks.json`). Pass the same value to both, e.g. from
+ * YOUGROW_ORIGIN, when you're connected to another YouGrow instance.
+ */
+export declare const DEFAULT_ORIGIN = "https://yougrow.ai";
+/** Without trailing slashes. Unset or empty means DEFAULT_ORIGIN. */
+export declare function originOf(value: string | undefined): string;
+/** https, or plain http on localhost for local development. */
+export declare function isSecureOrigin(origin: string): boolean;

package/dist/origin.js

@@ -0,0 +1,15 @@
+/**
+ * YouGrow's origin, shared by the client (its requests go to `${origin}/api/v2/…`)
+ * and the verifier (tokens carry `iss: origin`; keys are at
+ * `${origin}/.well-known/jwks.json`). Pass the same value to both, e.g. from
+ * YOUGROW_ORIGIN, when you're connected to another YouGrow instance.
+ */
+export const DEFAULT_ORIGIN = "https://yougrow.ai";
+/** Without trailing slashes. Unset or empty means DEFAULT_ORIGIN. */
+export function originOf(value) {
+    return (value || DEFAULT_ORIGIN).replace(/\/+$/, "");
+}
+/** https, or plain http on localhost for local development. */
+export function isSecureOrigin(origin) {
+    return /^https:\/\//.test(origin) || /^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin);
+}

package/dist/server.d.ts

@@ -10,13 +10,15 @@ import { type Jwk, type JwtFailure, type RequestDirection, type YouGrowClaims }
  * Every such request carries `Authorization: Bearer <JWT>` signed with
  * YouGrow's private key. Your secret is NOT involved — you verify against
  * YouGrow's public keys, so nothing you store can be used to forge YouGrow.
- * Always verify against the RAW body, before parsing it.
+ * Always verify against the RAW body (the exact bytes received, as a Buffer or
+ * string), before parsing it.
  *
- *   const verifier = createVerifier({ keyId: process.env.YOUGROW_KEY_ID! });
+ *   const verifier = createVerifier({ keyId: process.env.YOUGROW_KEY_ID!, origin: process.env.YOUGROW_ORIGIN });
  *   const v = await verifier.verify({ headers: req.headers, rawBody, direction: "context" });
  *   if (!v.ok) return res.status(401).end();
  */
 export type { Jwk, RequestDirection, YouGrowClaims } from "./jwt.js";
+/** YouGrow's default origin: the `iss` of its tokens. */
 export declare const DEFAULT_ISSUER = "https://yougrow.ai";
 type HeaderBag = Headers | Record<string, string | string[] | undefined>;
 export type VerifyResult = {
@@ -29,7 +31,13 @@ export type VerifyResult = {
 export interface VerifierOptions {
     /** Your connection's key id — the token's audience. */
     keyId: string;
-    /** YouGrow's origin. Defaults to https://yougrow.ai; use the dev origin for staging. */
+    /**
+     * YouGrow's origin: the same value as the client's `origin`, e.g. from
+     * YOUGROW_ORIGIN. Defaults to https://yougrow.ai. Tokens must carry it as
+     * `iss`, and the keys are fetched from `${origin}/.well-known/jwks.json`.
+     */
+    origin?: string;
+    /** Alias of `origin` (its 0.1 name). */
     issuer?: string;
     /** Pin the key set instead of fetching it (tests, air-gapped setups). */
     jwks?: {
@@ -38,9 +46,14 @@ export interface VerifierOptions {
     fetch?: typeof fetch;
 }
 export interface Verifier {
+    /**
+     * Check one request. `rawBody` is the exact body received — a string, or the
+     * bytes (e.g. a Buffer) — never re-serialised JSON. Plain header objects
+     * match in any case; Fetch `Headers` already do.
+     */
     verify(input: {
         headers: HeaderBag;
-        rawBody: string;
+        rawBody: string | Uint8Array;
         direction: RequestDirection;
         nowMs?: number;
     }): Promise<VerifyResult>;

package/dist/server.js

@@ -1,5 +1,7 @@
 import { tokenFromAuthorization, tokenKid, verifyJwt } from "./jwt.js";
-export const DEFAULT_ISSUER = "https://yougrow.ai";
+import { DEFAULT_ORIGIN, isSecureOrigin, originOf } from "./origin.js";
+/** YouGrow's default origin: the `iss` of its tokens. */
+export const DEFAULT_ISSUER = DEFAULT_ORIGIN;
 const JWKS_PATH = "/.well-known/jwks.json";
 const MIN_CACHE_MS = 60_000;
 const MAX_CACHE_MS = 24 * 3600_000;
@@ -7,10 +9,17 @@ const DEFAULT_CACHE_MS = 3600_000;
 /** An unknown kid refetches the keys at most this often. */
 const REFETCH_COOLDOWN_MS = 60_000;
 function header(h, name) {
+    if (!h)
+        return null;
     if (typeof h.get === "function")
         return h.get(name);
     const bag = h;
-    const v = bag[name] ?? bag[name.toLowerCase()];
+    let v = bag[name] ?? bag[name.toLowerCase()];
+    if (v === undefined) {
+        // Plain objects can keep the sender's casing (e.g. API Gateway REST events): match any case.
+        const lower = name.toLowerCase();
+        v = Object.entries(bag).find(([k, value]) => value !== undefined && k.toLowerCase() === lower)?.[1];
+    }
     return Array.isArray(v) ? (v[0] ?? null) : (v ?? null);
 }
 function cacheMs(cacheControl) {
@@ -25,10 +34,12 @@ function cacheMs(cacheControl) {
  * change on your side. If a refresh fails it keeps using the keys it has.
  */
 export function createVerifier(opts) {
-    const issuer = (opts.issuer ?? DEFAULT_ISSUER).replace(/\/+$/, "");
-    if (!opts.jwks && !/^https:\/\//.test(issuer) && !/^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(issuer)) {
-        throw new Error("createVerifier: issuer must be https");
+    if (opts.origin && opts.issuer && originOf(opts.origin) !== originOf(opts.issuer)) {
+        throw new Error("createVerifier: origin and issuer differ (issuer is an alias of origin); pass origin only");
     }
+    const issuer = originOf(opts.origin || opts.issuer);
+    if (!opts.jwks && !isSecureOrigin(issuer))
+        throw new Error("createVerifier: origin must be https");
     if (!opts.keyId)
         throw new Error("createVerifier: keyId is required");
     const doFetch = opts.fetch ?? globalThis.fetch;
@@ -62,6 +73,9 @@ export function createVerifier(opts) {
     }
     return {
         async verify(input) {
+            if (typeof input.rawBody !== "string" && !ArrayBuffer.isView(input.rawBody)) {
+                throw new TypeError("verify: rawBody must be the raw request body (a string or Buffer), not parsed JSON");
+            }
             const token = tokenFromAuthorization(header(input.headers, "authorization"));
             const now = Date.now();
             const sinceFetch = now - lastFetchAt;

package/package.json

@@ -1,29 +1,38 @@
 {
   "name": "@yougrowai/node",
-  "version": "0.1.0",
-  "description": "Send your product's user events to YouGrow lifecycle journeys, and answer its signed context and webhook requests.",
+  "version": "0.3.0",
+  "description": "Keep your users' state in YouGrow lifecycle journeys, and verify the requests YouGrow sends you.",
   "license": "MIT",
   "author": "YouGrow.AI Limited",
-  "homepage": "https://github.com/ygai-jezl/vizzyblmrkt/tree/main/sdk/node#readme",
+  "homepage": "https://yougrow.ai/developers",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ygai-jezl/vizzyblmrkt.git",
     "directory": "sdk/node"
   },
-  "keywords": ["yougrow", "lifecycle-email", "onboarding", "events", "webhooks", "jwks"],
+  "keywords": ["yougrow", "lifecycle-email", "onboarding", "user-state", "events", "webhooks", "jwks"],
   "type": "module",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
+  "main": "./dist/cjs/index.js",
+  "types": "./dist/cjs/index.d.ts",
   "exports": {
-    ".": { "types": "./dist/index.d.ts", "default": "./dist/index.js" },
-    "./server": { "types": "./dist/server.d.ts", "default": "./dist/server.js" }
+    ".": {
+      "import": { "types": "./dist/index.d.ts", "default": "./dist/index.js" },
+      "require": { "types": "./dist/cjs/index.d.ts", "default": "./dist/cjs/index.js" }
+    },
+    "./server": {
+      "import": { "types": "./dist/server.d.ts", "default": "./dist/server.js" },
+      "require": { "types": "./dist/cjs/server.d.ts", "default": "./dist/cjs/server.js" }
+    }
+  },
+  "typesVersions": {
+    "*": { "server": ["./dist/cjs/server.d.ts"] }
   },
   "files": ["dist", "test/vectors.json", "README.md", "LICENSE"],
   "engines": { "node": ">=18" },
   "sideEffects": false,
   "publishConfig": { "access": "public" },
   "scripts": {
-    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json",
+    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json && tsc -p tsconfig.cjs.json && node -e \"require('fs').writeFileSync('dist/cjs/package.json',JSON.stringify({type:'commonjs'})+'\\n')\"",
     "prepack": "npm run build"
   }
 }

package/test/vectors.json

@@ -1,28 +1,5 @@
 {
-  "description": "Signing vectors for the YouGrow product-connection protocol. 'vectors': product -> platform events, signature = 'v1=' + hex(HMAC-SHA256(secret, 'events:' + timestamp + '.' + body)), generated with openssl. 'outbound': platform -> product ES256 JWTs (context pulls, webhooks), signed once with a throwaway P-256 key whose private half was discarded; only the public JWK is kept. Both the server and the SDK test suites must accept every outbound token at nowMs and reject the listed tamperings.",
-  "vectors": [
-    {
-      "secret": "ygs_test_secret_one",
-      "direction": "events",
-      "timestamp": 1758455000,
-      "body": "{\"batch\":[{\"type\":\"identify\",\"messageId\":\"m1\",\"userId\":\"u1\",\"timestamp\":\"2026-09-21T10:00:00Z\",\"traits\":{\"email\":\"alex@acme.test\"}}]}",
-      "signature": "v1=d4bdf726960d10a135b3493f4074b3d3d3773a23ec49955d6efb720bcd2ef914"
-    },
-    {
-      "secret": "ygs_test_secret_two",
-      "direction": "events",
-      "timestamp": 1758455123,
-      "body": "{\"batch\":[{\"type\":\"track\",\"messageId\":\"m2\",\"userId\":\"ü-用户\",\"timestamp\":\"2026-09-21T10:00:00+01:00\",\"event\":\"user.signed_up\"}]}",
-      "signature": "v1=fadcda4cd874e1ad19b1f7059cca902b54afdfe9032c10dcfdffa75cc450b317"
-    },
-    {
-      "secret": "ygs_test_secret_one",
-      "direction": "events",
-      "timestamp": 1758455000,
-      "body": "",
-      "signature": "v1=aae9033d246c64b2e62a630910f59e35531cfb71d5b1a4da90a1002323979eae"
-    }
-  ],
+  "description": "Signing vectors for the YouGrow product-connection protocol. 'outbound': platform -> product ES256 JWTs (context pulls, webhooks), signed once with a throwaway P-256 key whose private half was discarded; only the public JWK is kept. Both the server and the SDK test suites must accept every outbound token at nowMs and reject the listed tamperings.",
   "outbound": {
     "issuer": "https://yougrow.ai",
     "audience": "ygk_vectorsvectorsvectors0",

package/dist/signing.d.ts

@@ -1,19 +0,0 @@
-/**
- * Request signing for events your product sends to YouGrow:
- *
- *   X-YouGrow-Signature: v1=<hex HMAC-SHA256(secret, `events:${timestamp}.${rawBody}`)>
- *
- * Timestamps are unix seconds; requests more than five minutes off are refused.
- * Pinned by test/vectors.json.
- *
- * Requests YouGrow sends YOU (context pulls, webhooks) are not signed with your
- * secret: they carry a JWT signed with YouGrow's own key. Verify those with
- * `createVerifier` from "@yougrowai/node/server".
- */
-export type Direction = "events";
-export declare const HEADERS: {
-    readonly keyId: "x-yougrow-key-id";
-    readonly timestamp: "x-yougrow-timestamp";
-    readonly signature: "x-yougrow-signature";
-};
-export declare function sign(secret: string, direction: Direction, timestampSec: number, rawBody: string): string;

package/dist/signing.js

@@ -1,10 +0,0 @@
-import { createHmac } from "node:crypto";
-export const HEADERS = {
-    keyId: "x-yougrow-key-id",
-    timestamp: "x-yougrow-timestamp",
-    signature: "x-yougrow-signature",
-};
-export function sign(secret, direction, timestampSec, rawBody) {
-    const mac = createHmac("sha256", secret).update(`${direction}:${timestampSec}.${rawBody}`).digest("hex");
-    return `v1=${mac}`;
-}