@yougrowai/node 0.1.0 → 0.4.0

package/dist/index.js

@@ -1,156 +1,263 @@
 import { randomUUID } from "node:crypto";
-import { HEADERS, sign } from "./signing.js";
+import { isSecureOrigin, originOf } from "./origin.js";
+const USERS_PATH = "/api/v2/users";
+/** The API's limits: users per batch request, and bytes per request body. */
+const MAX_BATCH = 100;
+const MAX_BODY_BYTES = 512 * 1024;
+const BATCH_ENVELOPE_BYTES = '{"users":[]}'.length;
+const MAX_USER_ID = 256;
+/** The longest delay a Node timer accepts. */
+const MAX_TIMER_MS = 2_147_483_647;
 /**
- * @yougrowai/node — send your product's user events to YouGrow lifecycle journeys.
- *
- *   const yg = new YouGrow({ keyId: process.env.YOUGROW_KEY_ID!, secret: process.env.YOUGROW_SECRET! });
- *   yg.identify({ userId: user.id, traits: { email: user.email }, consent: { basis: "soft_opt_in" } });
- *   yg.track({ userId: user.id, event: "user.signed_up" });
- *   await yg.flush();
- *
- * Server-side only (the secret signs every request). Messages are batched (≤100
- * per request) and retried with backoff on network errors, 429 and 5xx. Every
- * message carries a messageId, so a retried or duplicated send is harmless.
+ * The API refused a request, or it still failed after the retries: a 429, a 5xx,
+ * or a timeout or network failure (`status` 0, `code` `timeout` or `network_error`).
  */
-export { HEADERS, sign } from "./signing.js";
-const MAX_BATCH = 100;
 export class YouGrowError extends Error {
     status;
     body;
-    constructor(message, status, body) {
-        super(message);
+    /** The API's error code (`invalid`, `unauthorized`, `rate_limited`…), `timeout` or `network_error`, or `http_<status>`. */
+    code;
+    /** For a 400: which fields were wrong, and why. */
+    fields;
+    /**
+     * True for a 429, a 5xx, a timeout or a network failure: trying again later may
+     * work, so a queue or trigger should rethrow it for redelivery. Anything else
+     * (a 400, 401, 404…) won't succeed as it is.
+     */
+    retryable;
+    constructor(message, status, body, options) {
+        super(message, options);
         this.status = status;
         this.body = body;
         this.name = "YouGrowError";
+        const b = asRecord(body);
+        this.code = typeof b?.error === "string" ? b.error : `http_${status}`;
+        if (Array.isArray(b?.fields))
+            this.fields = b.fields;
+        this.retryable = status === 0 || status === 429 || status >= 500;
+    }
+}
+/** From `users.batch` with `throwOnItemError`: some items failed. The rest were applied; `result` says which. */
+export class YouGrowBatchError extends Error {
+    result;
+    constructor(message, result) {
+        super(message);
+        this.result = result;
+        this.name = "YouGrowBatchError";
     }
 }
 export class YouGrow {
-    keyId;
-    secret;
-    endpoint;
-    flushAt;
-    flushIntervalMs;
-    maxRetries;
-    fetchImpl;
-    onError;
-    queue = [];
-    timer = null;
+    users;
+    events;
+    #origin;
+    /** Private (#), so logging the client never prints the credentials. */
+    #authorization;
+    #timeoutMs;
+    #maxRetries;
+    #maxRetryWaitMs;
+    #fetch;
     constructor(opts) {
         if (!opts.keyId || !opts.secret)
             throw new Error("YouGrow: keyId and secret are required");
-        this.keyId = opts.keyId;
-        this.secret = opts.secret;
-        this.endpoint = opts.endpoint ?? "https://yougrow.ai/api/v1/events";
-        this.flushAt = Math.min(Math.max(opts.flushAt ?? 20, 1), MAX_BATCH);
-        this.flushIntervalMs = opts.flushIntervalMs ?? 5000;
-        this.maxRetries = opts.maxRetries ?? 3;
-        this.fetchImpl = opts.fetch ?? fetch;
-        this.onError = opts.onError;
-    }
-    /** Who the user is: email, name, timezone, plan… plus the consent basis. Returns the messageId. */
-    identify(input) {
-        return this.enqueue({
-            type: "identify",
-            messageId: input.messageId ?? randomUUID(),
-            userId: input.userId,
-            timestamp: iso(input.timestamp),
-            traits: input.traits ?? {},
-            ...(input.consent ? { consent: input.consent } : {}),
-        });
-    }
-    /** Something the user did. Returns the messageId. */
-    track(input) {
-        return this.enqueue({
-            type: "track",
-            messageId: input.messageId ?? randomUUID(),
-            userId: input.userId,
-            timestamp: iso(input.timestamp),
-            event: input.event,
-            properties: input.properties ?? {},
-            ...(input.traits ? { traits: input.traits } : {}),
-        });
-    }
-    /** Shorthand for the reserved `onboarding.step_completed` event. */
-    stepCompleted(userId, step, timestamp) {
-        return this.track({ userId, event: "onboarding.step_completed", properties: { step }, timestamp });
-    }
-    /** Send everything queued. Resolves with one result per request. */
-    async flush() {
-        this.clearTimer();
-        const results = [];
-        while (this.queue.length > 0) {
-            const batch = this.queue.splice(0, MAX_BATCH);
-            results.push(await this.send(batch));
-        }
-        return results;
+        this.#origin = originOf(opts.origin);
+        if (!isSecureOrigin(this.#origin))
+            throw new Error("YouGrow: origin must be https, e.g. https://yougrow.ai");
+        this.#authorization = `Basic ${Buffer.from(`${opts.keyId}:${opts.secret}`, "utf8").toString("base64")}`;
+        this.#timeoutMs = whole(opts.timeoutMs, 10_000, 1, MAX_TIMER_MS);
+        this.#maxRetries = whole(opts.maxRetries, 3, 0, Number.MAX_SAFE_INTEGER);
+        this.#maxRetryWaitMs = whole(opts.maxRetryWaitMs, 5_000, 0, MAX_TIMER_MS);
+        this.#fetch = opts.fetch ?? globalThis.fetch;
+        this.users = {
+            update: async (userId, patch) => (await this.#send("PATCH", userPath(userId), JSON.stringify(patch))),
+            batch: (items, batchOpts) => this.#patchMany(items, batchOpts),
+            get: async (userId) => {
+                try {
+                    return (await this.#send("GET", userPath(userId)));
+                }
+                catch (err) {
+                    // Only the API's own "no such user": a 404 from anything else (e.g. a wrong origin) still throws.
+                    if (err instanceof YouGrowError && err.status === 404 && err.code === "not_found")
+                        return null;
+                    throw err;
+                }
+            },
+            delete: async (userId) => {
+                await this.#send("DELETE", userPath(userId));
+            },
+        };
+        this.events = {
+            track: async (userId, event, options = {}) => {
+                const path = `${userPath(userId)}/events`;
+                const { properties, occurredAt } = options;
+                // One key for every attempt, so a retry is never recorded twice.
+                const body = { event, properties, occurredAt, idempotencyKey: options.idempotencyKey ?? randomUUID() };
+                return (await this.#send("POST", path, JSON.stringify(body)));
+            },
+        };
     }
-    /** Flush and stop the background timer (call on shutdown). */
-    async close() {
-        return this.flush();
+    /**
+     * The connection behind your key: its name, environment and status. A credential
+     * check — and a way to catch a key from the wrong environment — before you send.
+     */
+    async me() {
+        return (await this.#send("GET", "/api/v2/me"));
     }
-    enqueue(msg) {
-        this.queue.push(msg);
-        if (this.queue.length >= this.flushAt) {
-            void this.flush().catch((err) => this.onError?.(err));
+    async #patchMany(items, opts = {}) {
+        if (!Array.isArray(items))
+            throw new TypeError("YouGrow: users.batch takes an array of { userId, ...patch }");
+        const total = { applied: 0, ignored: 0, failed: 0, results: [] };
+        for (const chunk of chunks(items)) {
+            if (chunk.bytes > MAX_BODY_BYTES) {
+                // One item bigger than any request may be: it can't be valid, so it fails here.
+                const userId = asRecord(items[chunk.start])?.userId;
+                total.failed += 1;
+                total.results.push({ index: chunk.start, userId: typeof userId === "string" ? userId : null, status: "failed", reason: "body_too_large" });
+                continue;
+            }
+            const r = (await this.#send("POST", `${USERS_PATH}/batch`, `{"users":[${chunk.json.join(",")}]}`));
+            total.applied += r.applied;
+            total.ignored += r.ignored;
+            total.failed += r.failed;
+            for (const item of r.results)
+                total.results.push({ ...item, index: chunk.start + item.index });
         }
-        else if (this.flushIntervalMs > 0 && !this.timer) {
-            this.timer = setTimeout(() => {
-                this.timer = null;
-                void this.flush().catch((err) => this.onError?.(err));
-            }, this.flushIntervalMs);
-            this.timer.unref?.();
+        if (total.failed > 0) {
+            const summary = failureSummary(total, items.length);
+            if (opts.throwOnItemError)
+                throw new YouGrowBatchError(`YouGrow ${summary}`, total);
+            if (!opts.quiet)
+                console.warn(`[@yougrowai/node] ${summary}`);
         }
-        return msg.messageId;
-    }
-    clearTimer() {
-        if (this.timer)
-            clearTimeout(this.timer);
-        this.timer = null;
+        return total;
     }
-    async send(batch) {
-        const body = JSON.stringify({ batch });
+    /**
+     * One request, retried on network errors, timeouts, 429 and 5xx. Resolves
+     * with the JSON body (none for DELETE); an error status throws a YouGrowError.
+     */
+    async #send(method, path, body) {
+        const headers = { authorization: this.#authorization, accept: "application/json" };
+        if (body !== undefined)
+            headers["content-type"] = "application/json";
+        const doFetch = this.#fetch; // called unbound: some fetch implementations refuse another `this`
         for (let attempt = 0;; attempt += 1) {
-            // Sign every attempt afresh: the timestamp must stay inside the 5-minute window.
-            const ts = Math.floor(Date.now() / 1000);
             let res;
+            let text;
             try {
-                res = await this.fetchImpl(this.endpoint, {
-                    method: "POST",
-                    headers: {
-                        "content-type": "application/json",
-                        [HEADERS.keyId]: this.keyId,
-                        [HEADERS.timestamp]: String(ts),
-                        [HEADERS.signature]: sign(this.secret, "events", ts, body),
-                    },
-                    body,
-                });
+                res = await doFetch(`${this.#origin}${path}`, { method, headers, body, signal: AbortSignal.timeout(this.#timeoutMs) });
+                text = await res.text(); // under the same deadline
             }
             catch (err) {
-                if (attempt >= this.maxRetries)
-                    throw err;
-                await backoff(attempt);
+                // Network error or timeout.
+                if (attempt >= this.#maxRetries)
+                    throw transportError(err);
+                await sleep(this.#retryWait(attempt));
                 continue;
             }
-            if (res.status === 202 || res.ok)
-                return (await res.json());
-            const retryable = res.status === 429 || res.status >= 500;
-            if (!retryable || attempt >= this.maxRetries) {
-                const data = await res.json().catch(() => undefined);
-                const code = data?.error ?? `http_${res.status}`;
-                throw new YouGrowError(`YouGrow ingest failed: ${code}`, res.status, data);
+            const data = parseJson(text);
+            if (res.ok) {
+                if (method !== "DELETE" && !asRecord(data)) {
+                    throw new YouGrowError(`YouGrow API ${res.status}: the response isn't JSON (is origin right?)`, res.status);
+                }
+                return data;
             }
-            await backoff(attempt, res.headers.get("retry-after"));
+            if ((res.status === 429 || res.status >= 500) && attempt < this.#maxRetries) {
+                await sleep(this.#retryWait(attempt, res.headers.get("retry-after")));
+                continue;
+            }
+            throw apiError(res.status, data);
+        }
+    }
+    /** Retry-After (seconds) if given, else exponential backoff with full jitter; never over maxRetryWaitMs. */
+    #retryWait(attempt, retryAfter) {
+        const seconds = retryAfter?.trim();
+        if (seconds && /^\d+$/.test(seconds))
+            return Math.min(Number(seconds) * 1000, this.#maxRetryWaitMs);
+        return Math.random() * Math.min(500 * 2 ** attempt, this.#maxRetryWaitMs);
+    }
+}
+/** `/api/v2/users/{userId}`, refusing an id the API can't take before anything is sent. */
+function userPath(userId) {
+    const problem = userIdProblem(userId);
+    if (problem)
+        throw new TypeError(`YouGrow: userId ${problem}`);
+    return `${USERS_PATH}/${encodeURIComponent(userId)}`;
+}
+function userIdProblem(userId) {
+    if (typeof userId !== "string")
+        return "must be a string";
+    if (userId.length === 0)
+        return "is empty";
+    if (userId.length > MAX_USER_ID)
+        return `is over ${MAX_USER_ID} characters`;
+    // "batch" is a route; "." and ".." vanish from a URL path.
+    if (userId === "batch" || userId === "." || userId === "..")
+        return `can't be "${userId}"`;
+    return null;
+}
+/**
+ * Consecutive runs of batch items, one request each: at most 100 users and
+ * 512 KB of body. A run over the limit is a single item too big to send.
+ */
+function* chunks(items) {
+    let chunk = { start: 0, json: [], bytes: BATCH_ENVELOPE_BYTES };
+    for (let i = 0; i < items.length; i += 1) {
+        const json = JSON.stringify(items[i]) ?? "null";
+        const size = Buffer.byteLength(json, "utf8");
+        // + 1 for the comma before it.
+        if (chunk.json.length === MAX_BATCH || (chunk.json.length > 0 && chunk.bytes + 1 + size > MAX_BODY_BYTES)) {
+            yield chunk;
+            chunk = { start: i, json: [], bytes: BATCH_ENVELOPE_BYTES };
         }
+        chunk.bytes += (chunk.json.length > 0 ? 1 : 0) + size;
+        chunk.json.push(json);
+    }
+    if (chunk.json.length > 0)
+        yield chunk;
+}
+/** e.g. "users.batch: 2 of 250 users failed (u3: invalid, u17: invalid)". Ids and reasons only, never the data. */
+function failureSummary(r, count) {
+    const failed = r.results.filter((x) => x.status === "failed");
+    const shown = failed.slice(0, 3).map((x) => `${x.userId ?? `item ${x.index}`}: ${x.reason}`);
+    if (failed.length > 3)
+        shown.push(`+${failed.length - 3} more`);
+    return `users.batch: ${r.failed} of ${count} users failed${shown.length > 0 ? ` (${shown.join(", ")})` : ""}`;
+}
+/** e.g. "YouGrow API 400 invalid: traits.plan: …". */
+/** A timeout or network failure that outlasted the retries: status 0, retryable, the original error as `cause`. */
+function transportError(err) {
+    const code = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError") ? "timeout" : "network_error";
+    const detail = err instanceof Error ? err.message : String(err);
+    return new YouGrowError(`YouGrow API ${code}: ${detail}`, 0, { error: code }, { cause: err });
+}
+function apiError(status, body) {
+    const b = asRecord(body);
+    const fields = Array.isArray(b?.fields) ? b.fields : [];
+    let detail = fields
+        .slice(0, 3)
+        .map((f) => `${f.path}: ${f.message}`)
+        .join("; ");
+    if (fields.length > 3)
+        detail += `; +${fields.length - 3} more`;
+    if (!detail && typeof b?.message === "string")
+        detail = b.message;
+    const code = typeof b?.error === "string" ? ` ${b.error}` : "";
+    return new YouGrowError(`YouGrow API ${status}${code}${detail ? `: ${detail}` : ""}`, status, body);
+}
+function asRecord(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v) ? v : undefined;
+}
+function parseJson(text) {
+    try {
+        return text ? JSON.parse(text) : undefined;
+    }
+    catch {
+        return undefined;
     }
 }
-function iso(t) {
-    if (t === undefined)
-        return new Date().toISOString();
-    return typeof t === "string" ? t : t.toISOString();
+/** A whole number in [min, max] from an option; unset or not a number means the default. */
+function whole(value, fallback, min, max) {
+    return typeof value === "number" && Number.isFinite(value) ? Math.min(Math.max(Math.floor(value), min), max) : fallback;
 }
-/** Exponential backoff with full jitter; honours Retry-After (seconds). */
-function backoff(attempt, retryAfter) {
-    const hinted = retryAfter && /^\d+$/.test(retryAfter) ? Number(retryAfter) * 1000 : 0;
-    const ms = hinted || Math.random() * Math.min(500 * 2 ** attempt, 10_000);
+function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }

package/dist/jwt.d.ts

@@ -8,7 +8,7 @@
  *   dir  "context" | "webhook"
  *   iat / exp   at most 5 minutes apart
  *   jti  unique per request
- *   body_sha256  base64url SHA-256 of the exact raw body
+ *   body_sha256  base64url SHA-256 of the exact raw body (the bytes as received)
  *
  * Signature first, then every claim. Pinned by test/vectors.json.
  */
@@ -48,6 +48,7 @@ export declare function verifyJwt(input: {
     issuer: string;
     audience: string;
     direction: RequestDirection;
-    rawBody: string;
+    /** The bytes as received; a string is hashed as UTF-8. */
+    rawBody: string | Uint8Array;
     nowMs?: number;
 }): JwtResult;

package/dist/jwt.js

@@ -67,7 +67,8 @@ export function verifyJwt(input) {
         return { ok: false, reason: "expired" };
     if (nowSec < c.iat - LEEWAY_SEC)
         return { ok: false, reason: "not_yet_valid" };
-    const hash = createHash("sha256").update(input.rawBody, "utf8").digest("base64url");
+    const bytes = typeof input.rawBody === "string" ? Buffer.from(input.rawBody, "utf8") : input.rawBody;
+    const hash = createHash("sha256").update(bytes).digest("base64url");
     if (c.body_sha256 !== hash)
         return { ok: false, reason: "body_mismatch" };
     return { ok: true, claims: c };

package/dist/origin.d.ts

@@ -0,0 +1,11 @@
+/**
+ * YouGrow's origin, shared by the client (its requests go to `${origin}/api/v2/…`)
+ * and the verifier (tokens carry `iss: origin`; keys are at
+ * `${origin}/.well-known/jwks.json`). Pass the same value to both, e.g. from
+ * YOUGROW_ORIGIN, when you're connected to another YouGrow instance.
+ */
+export declare const DEFAULT_ORIGIN = "https://yougrow.ai";
+/** Without trailing slashes. Unset or empty means DEFAULT_ORIGIN. */
+export declare function originOf(value: string | undefined): string;
+/** https, or plain http on localhost for local development. */
+export declare function isSecureOrigin(origin: string): boolean;

package/dist/origin.js

@@ -0,0 +1,15 @@
+/**
+ * YouGrow's origin, shared by the client (its requests go to `${origin}/api/v2/…`)
+ * and the verifier (tokens carry `iss: origin`; keys are at
+ * `${origin}/.well-known/jwks.json`). Pass the same value to both, e.g. from
+ * YOUGROW_ORIGIN, when you're connected to another YouGrow instance.
+ */
+export const DEFAULT_ORIGIN = "https://yougrow.ai";
+/** Without trailing slashes. Unset or empty means DEFAULT_ORIGIN. */
+export function originOf(value) {
+    return (value || DEFAULT_ORIGIN).replace(/\/+$/, "");
+}
+/** https, or plain http on localhost for local development. */
+export function isSecureOrigin(origin) {
+    return /^https:\/\//.test(origin) || /^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin);
+}

package/dist/server.d.ts

@@ -10,13 +10,15 @@ import { type Jwk, type JwtFailure, type RequestDirection, type YouGrowClaims }
  * Every such request carries `Authorization: Bearer <JWT>` signed with
  * YouGrow's private key. Your secret is NOT involved — you verify against
  * YouGrow's public keys, so nothing you store can be used to forge YouGrow.
- * Always verify against the RAW body, before parsing it.
+ * Always verify against the RAW body (the exact bytes received, as a Buffer or
+ * string), before parsing it.
  *
- *   const verifier = createVerifier({ keyId: process.env.YOUGROW_KEY_ID! });
+ *   const verifier = createVerifier({ keyId: process.env.YOUGROW_KEY_ID!, origin: process.env.YOUGROW_ORIGIN });
  *   const v = await verifier.verify({ headers: req.headers, rawBody, direction: "context" });
  *   if (!v.ok) return res.status(401).end();
  */
 export type { Jwk, RequestDirection, YouGrowClaims } from "./jwt.js";
+/** YouGrow's default origin: the `iss` of its tokens. */
 export declare const DEFAULT_ISSUER = "https://yougrow.ai";
 type HeaderBag = Headers | Record<string, string | string[] | undefined>;
 export type VerifyResult = {
@@ -26,10 +28,40 @@ export type VerifyResult = {
     ok: false;
     reason: JwtFailure | "keys_unavailable";
 };
+/** What YouGrow POSTs to your webhook endpoint: one of these, by `type`. Reply 2xx to any type you don't handle. */
+export type WebhookEvent = WebhookEnvelope<"email_preferences.updated", 
+/** The person unsubscribed from one of YouGrow's emails: from one category, or all of them. */
+{
+    userId: string;
+    category: string;
+    subscribed: false;
+    scope: "all" | "category";
+    source: string;
+}>
+/** YouGrow stopped emailing the person: their address hard-bounced, or they reported an email as spam. */
+ | WebhookEnvelope<"email.suppressed", {
+    userId: string;
+    reason: "hard_bounce" | "complaint";
+}>
+/** The Test webhook button. */
+ | WebhookEnvelope<"connection.test", Record<string, never>>;
+export interface WebhookEnvelope<T extends string, D> {
+    /** Unique per webhook, and the same on every retry: drop ones you've seen. */
+    id: string;
+    type: T;
+    createdAt: string;
+    data: D;
+}
 export interface VerifierOptions {
     /** Your connection's key id — the token's audience. */
     keyId: string;
-    /** YouGrow's origin. Defaults to https://yougrow.ai; use the dev origin for staging. */
+    /**
+     * YouGrow's origin: the same value as the client's `origin`, e.g. from
+     * YOUGROW_ORIGIN. Defaults to https://yougrow.ai. Tokens must carry it as
+     * `iss`, and the keys are fetched from `${origin}/.well-known/jwks.json`.
+     */
+    origin?: string;
+    /** Alias of `origin` (its 0.1 name). */
     issuer?: string;
     /** Pin the key set instead of fetching it (tests, air-gapped setups). */
     jwks?: {
@@ -38,9 +70,14 @@ export interface VerifierOptions {
     fetch?: typeof fetch;
 }
 export interface Verifier {
+    /**
+     * Check one request. `rawBody` is the exact body received — a string, or the
+     * bytes (e.g. a Buffer) — never re-serialised JSON. Plain header objects
+     * match in any case; Fetch `Headers` already do.
+     */
     verify(input: {
         headers: HeaderBag;
-        rawBody: string;
+        rawBody: string | Uint8Array;
         direction: RequestDirection;
         nowMs?: number;
     }): Promise<VerifyResult>;

package/dist/server.js

@@ -1,5 +1,7 @@
 import { tokenFromAuthorization, tokenKid, verifyJwt } from "./jwt.js";
-export const DEFAULT_ISSUER = "https://yougrow.ai";
+import { DEFAULT_ORIGIN, isSecureOrigin, originOf } from "./origin.js";
+/** YouGrow's default origin: the `iss` of its tokens. */
+export const DEFAULT_ISSUER = DEFAULT_ORIGIN;
 const JWKS_PATH = "/.well-known/jwks.json";
 const MIN_CACHE_MS = 60_000;
 const MAX_CACHE_MS = 24 * 3600_000;
@@ -7,10 +9,17 @@ const DEFAULT_CACHE_MS = 3600_000;
 /** An unknown kid refetches the keys at most this often. */
 const REFETCH_COOLDOWN_MS = 60_000;
 function header(h, name) {
+    if (!h)
+        return null;
     if (typeof h.get === "function")
         return h.get(name);
     const bag = h;
-    const v = bag[name] ?? bag[name.toLowerCase()];
+    let v = bag[name] ?? bag[name.toLowerCase()];
+    if (v === undefined) {
+        // Plain objects can keep the sender's casing (e.g. API Gateway REST events): match any case.
+        const lower = name.toLowerCase();
+        v = Object.entries(bag).find(([k, value]) => value !== undefined && k.toLowerCase() === lower)?.[1];
+    }
     return Array.isArray(v) ? (v[0] ?? null) : (v ?? null);
 }
 function cacheMs(cacheControl) {
@@ -25,10 +34,12 @@ function cacheMs(cacheControl) {
  * change on your side. If a refresh fails it keeps using the keys it has.
  */
 export function createVerifier(opts) {
-    const issuer = (opts.issuer ?? DEFAULT_ISSUER).replace(/\/+$/, "");
-    if (!opts.jwks && !/^https:\/\//.test(issuer) && !/^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(issuer)) {
-        throw new Error("createVerifier: issuer must be https");
+    if (opts.origin && opts.issuer && originOf(opts.origin) !== originOf(opts.issuer)) {
+        throw new Error("createVerifier: origin and issuer differ (issuer is an alias of origin); pass origin only");
     }
+    const issuer = originOf(opts.origin || opts.issuer);
+    if (!opts.jwks && !isSecureOrigin(issuer))
+        throw new Error("createVerifier: origin must be https");
     if (!opts.keyId)
         throw new Error("createVerifier: keyId is required");
     const doFetch = opts.fetch ?? globalThis.fetch;
@@ -62,6 +73,9 @@ export function createVerifier(opts) {
     }
     return {
         async verify(input) {
+            if (typeof input.rawBody !== "string" && !ArrayBuffer.isView(input.rawBody)) {
+                throw new TypeError("verify: rawBody must be the raw request body (a string or Buffer), not parsed JSON");
+            }
             const token = tokenFromAuthorization(header(input.headers, "authorization"));
             const now = Date.now();
             const sinceFetch = now - lastFetchAt;

package/package.json

@@ -1,29 +1,39 @@
 {
   "name": "@yougrowai/node",
-  "version": "0.1.0",
-  "description": "Send your product's user events to YouGrow lifecycle journeys, and answer its signed context and webhook requests.",
+  "version": "0.4.0",
+  "description": "Keep your users' state in YouGrow lifecycle journeys, and verify the requests YouGrow sends you.",
   "license": "MIT",
   "author": "YouGrow.AI Limited",
-  "homepage": "https://github.com/ygai-jezl/vizzyblmrkt/tree/main/sdk/node#readme",
+  "homepage": "https://yougrow.ai/developers",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ygai-jezl/vizzyblmrkt.git",
     "directory": "sdk/node"
   },
-  "keywords": ["yougrow", "lifecycle-email", "onboarding", "events", "webhooks", "jwks"],
+  "keywords": ["yougrow", "lifecycle-email", "onboarding", "user-state", "events", "webhooks", "jwks"],
   "type": "module",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
+  "main": "./dist/cjs/index.js",
+  "types": "./dist/cjs/index.d.ts",
   "exports": {
-    ".": { "types": "./dist/index.d.ts", "default": "./dist/index.js" },
-    "./server": { "types": "./dist/server.d.ts", "default": "./dist/server.js" }
+    ".": {
+      "import": { "types": "./dist/index.d.ts", "default": "./dist/index.js" },
+      "require": { "types": "./dist/cjs/index.d.ts", "default": "./dist/cjs/index.js" }
+    },
+    "./server": {
+      "import": { "types": "./dist/server.d.ts", "default": "./dist/server.js" },
+      "require": { "types": "./dist/cjs/server.d.ts", "default": "./dist/cjs/server.js" }
+    },
+    "./package.json": "./package.json"
+  },
+  "typesVersions": {
+    "*": { "server": ["./dist/cjs/server.d.ts"] }
   },
   "files": ["dist", "test/vectors.json", "README.md", "LICENSE"],
   "engines": { "node": ">=18" },
   "sideEffects": false,
   "publishConfig": { "access": "public" },
   "scripts": {
-    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json",
+    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json && tsc -p tsconfig.cjs.json && node -e \"require('fs').writeFileSync('dist/cjs/package.json',JSON.stringify({type:'commonjs'})+'\\n')\"",
     "prepack": "npm run build"
   }
 }