useyuva 0.0.13 → 0.0.14

package/README.md

@@ -10,8 +10,10 @@ JavaScript SDK for [Yuva](https://github.com/productdevbook/yuva), open-source c
 | `useyuva/subscribe` | `<yuva-subscribe>`, a mailing list sign-up form. Registers in the browser only. |
 | `useyuva/analytics` | `createAnalytics()`: cookieless pageviews and engagement for an analytics property. Does nothing during SSR. |
 | `useyuva/react` | `YuvaProvider`, `useConversations`, `useMessages`, `YuvaAnalytics`, `useYuvaAnalytics`. React 18+ is an optional peer. |
-| `useyuva/nuxt` | A Nuxt module: `YuvaChat`, `YuvaPageFeedback`, `YuvaDiscussions` and `YuvaSubscribe` components, configured once in `nuxt.config`. |
+| `useyuva/nuxt` | A Nuxt module: `YuvaChat`, `YuvaPageFeedback`, `YuvaDiscussions` and `YuvaSubscribe` components, configured once in `nuxt.config`, and the identity and webhook routes on the server. |
+| `useyuva/nitro` | A Nitro v3 module serving `/_yuva/identity` and `/_yuva/webhook` and sending server-side analytics; `defineYuvaServer` from `useyuva/nitro/runtime`. |
 | `useyuva/api` | A typed `/v1` client for backends (API key), generated from the OpenAPI contract. |
+| `useyuva/server` | `signIdentityToken`, `verifyWebhook` and `createAnalytics` for backends. Web Crypto and `fetch` only: Node 22+, Bun, Deno, workers, srvx. |
 
 ```sh
 npm install useyuva
@@ -273,7 +275,46 @@ export default defineNuxtConfig({
 `NUXT_PUBLIC_YUVA_SERVER`, `NUXT_PUBLIC_YUVA_CHANNEL`, `NUXT_PUBLIC_YUVA_LOCALE` and, when
 `analytics` is set, `NUXT_PUBLIC_YUVA_ANALYTICS_KEY` override the options at runtime. `analytics`
 takes `key`, `server` (defaults to `yuva.server`), `hash`, `consent`, `manual`, `outbound`, `files` and `chat`, adds a client
-plugin and auto-imports `useYuvaAnalytics()`. `<YuvaChat />`, `<YuvaPageFeedback />`, `<YuvaDiscussions />` and `<YuvaSubscribe />` are
+plugin and auto-imports `useYuvaAnalytics()`.
+
+For signed-in users, the only code you write is who they are:
+
+```ts
+// server/yuva.ts
+export default defineYuvaServer({
+  user: async (event) => {
+    const { user } = await getUserSession(event); // your session; null when signed out
+    return user && { subject: user.id, email: user.email, emailVerified: user.emailConfirmed, name: user.name };
+  },
+  webhooks: {
+    "message.created": async (payload) => {
+      if (!payload.data.contact?.online) await sendPush(payload.data);
+    },
+  },
+});
+```
+
+```sh
+NUXT_YUVA_IDENTITY_SECRET=yuva_is_…   # at build and at runtime
+NUXT_YUVA_WEBHOOK_SECRET=whsec_…
+NUXT_YUVA_ANALYTICS_API_KEY=yuva_…
+NUXT_YUVA_ANALYTICS_PROPERTY_ID=…
+```
+
+With an identity secret, the module serves `GET /_yuva/identity` (the [h3](#h3) identity handler for
+`user(event)`) and every component fetches its token there on its own; pass `identityToken` to
+override that, or `null` for anonymous. With a webhook secret it serves `POST /_yuva/webhook`, which
+verifies the request and calls `webhooks[type]` like `defineYuvaWebhookHandler`. With an analytics API
+key (`analytics:write`) and property id, `event.context.yuva.track(event)` sends server-side events
+to `yuva.server` (or `NUXT_YUVA_SERVER`), flushed through `waitUntil` after the request where the
+platform has one and when Nitro closes. The secrets are the options `identitySecret`,
+`webhookSecret`, `analytics.apiKey` and `analytics.propertyId` or the variables above; they go only
+into the server runtime config (`useRuntimeConfig().yuva`), never into the public one. A route is
+added only when its secret is known at build time, from `nuxt.config` or the environment; a secret
+that is only in the build environment is not written into the build, so set it at runtime too. A
+route whose secret is empty at runtime answers `404`. `defineYuvaServer` is auto-imported on the
+server (`useyuva/nitro/runtime`), and `event` has your Nuxt's `H3Event` type. Works on Nitro v2 and
+v3. `<YuvaChat />`, `<YuvaPageFeedback />`, `<YuvaDiscussions />` and `<YuvaSubscribe />` are
 auto-imported, render on the server and load their element in the browser when they mount. Props
 are the attributes in camelCase (`pageTitle`, `identityToken`, which also takes a function);
 events are `@rating`, `@feedback`, `@discussion`, `@post`, `@reader` and `@unread`. `yuva-*` tags are custom elements in
@@ -318,6 +359,207 @@ const { data, error } = await api.GET("/v1/inboxes");
 Built on [openapi-fetch](https://openapi-ts.dev/openapi-fetch/); paths, parameters and bodies are
 typed from the contract. Keep API keys on the server.
 
+## Server
+
+For your backend: sign identity tokens, verify webhooks and send server-side analytics events. It
+uses only Web Crypto, `Request` and `fetch`, so it runs on Node, Bun, Deno and workers, and directly
+under [srvx](https://srvx.h3.dev):
+
+```ts
+import { serve } from "srvx";
+import { createAnalytics, signIdentityToken, verifyWebhook, WebhookVerificationError } from "useyuva/server";
+
+const analytics = createAnalytics({
+  server: "https://support.example.com",
+  apiKey: process.env.YUVA_API_KEY!, // analytics:write
+  propertyId: process.env.YUVA_ANALYTICS_PROPERTY!,
+  onError: (error) => console.warn("yuva analytics", error),
+});
+
+serve({
+  async fetch(request) {
+    const { pathname } = new URL(request.url);
+    if (pathname === "/yuva-token") {
+      const user = await currentUser(request); // your session
+      const token = await signIdentityToken(process.env.YUVA_IDENTITY_SECRET!, {
+        subject: user.id, // required: your user id
+        email: user.email,
+        emailVerified: user.emailConfirmed, // only then does Yuva match the address to a contact
+        name: user.name,
+        attrs: { plan: user.plan },
+      });
+      return Response.json({ token });
+    }
+    if (pathname === "/webhooks/yuva" && request.method === "POST") {
+      try {
+        const event = await verifyWebhook(process.env.YUVA_WEBHOOK_SECRET!, request);
+        // Ignore a webhook-id you have already handled; Yuva retries until it gets a 2xx.
+        if (event.type === "message.created" && !event.data.contact?.online) {
+          // send your push notification
+        }
+        return new Response(null, { status: 204 });
+      } catch (error) {
+        if (error instanceof WebhookVerificationError) return new Response("bad signature", { status: 401 });
+        throw error;
+      }
+    }
+    if (pathname === "/signup" && request.method === "POST") {
+      // ...
+      analytics.track(request, { name: "Signup", props: { plan: "pro" }, revenue: { amount: "29.90", currency: "EUR" } });
+      request.waitUntil?.(analytics.flush());
+      return Response.redirect(new URL("/welcome", request.url), 303);
+    }
+    return new Response("Not found", { status: 404 });
+  },
+});
+```
+
+`signIdentityToken(secret, claims)` returns the HS256 token the widget and the mobile SDKs exchange
+for a contact session, signed with the inbox's identity secret (shown once when the inbox is created
+or its secret is rotated). Claims: `subject` (1 to 200 characters), `email`, `emailVerified`, `name`,
+`locale`, `attrs` (at most 16 KiB as JSON), `id` (the `jti`: Yuva then accepts the token only once),
+`issuedAt` and `ttl` in seconds (300 by default, at most 600). Sign a new one whenever the page or
+app starts a session.
+
+`verifyWebhook(secret, request, { tolerance })` checks the [Standard Webhooks](https://www.standardwebhooks.com)
+signature over the raw body with the endpoint's `whsec_…` secret and returns the parsed event, typed
+by its `type`. It throws a `WebhookVerificationError` (`code`: `invalid_secret`, `missing_headers`,
+`invalid_timestamp`, `timestamp_too_old`, `timestamp_too_new`, `invalid_signature`) when no
+signature matches or `webhook-timestamp` is more than `tolerance` seconds (300 by default) from now.
+During a secret rotation either secret verifies. When the body is already read,
+`verifyWebhookBody(secret, headers, bytes, options)` does the same; `signWebhook(secret, id, time, body)`
+signs a request for testing a handler.
+
+`createAnalytics({ server, apiKey, propertyId })` reports events only your backend sees, such as a
+signup or a payment, to an analytics property with an API key that has the `analytics:write` scope.
+`track(request, event)` forwards the visitor's address, `User-Agent`, `Sec-CH-UA-Platform`,
+`Sec-CH-UA-Mobile` and `Accept-Language` (never stored by Yuva), so the event counts as the same
+visitor as their browser that day, and takes the URL and referrer from the request when the event
+leaves them out; requests with `DNT: 1` or `Sec-GPC: 1` send nothing. `send(event)` queues an event
+as it is, such as one with your own `visitorKey` (a session id, never an e-mail address) instead of
+`ip` and `userAgent`. Both throw for an event without a name or URL and after `close()`.
+
+The visitor's address is read only from `request.ip`, which srvx sets from the connection. Behind a
+proxy, or on a runtime that does not set it, pass `clientIP: (request) => …` returning the address
+your proxy reports, such as `request.headers.get("cf-connecting-ip")` on Cloudflare Workers; a
+forwarded header is trustworthy only when your own proxy sets it.
+
+Events are sent in batches of up to 100 every `flushInterval` (5000 ms) or as soon as a batch is
+full, holding at most `queueSize` (10,000) events. Network errors, `429` and `5xx` are retried
+`maxRetries` times (5) with a backoff from `minBackoff` (1000 ms) doubling up to a minute, never
+sooner than `Retry-After`. Dropped events, refused batches (`AnalyticsBatchError`) and events the
+server left out (`AnalyticsEventError`) go to `onError`. The timers never keep a process alive:
+`flush()` sends what is queued and resolves to the last batch error, if any, without rejecting, so
+it can go to `waitUntil`; `close()` flushes and stops the client before the process exits.
+
+### h3
+
+`useyuva/h3` wraps the same helpers for an [h3](https://h3.dev) v2 app (`h3` is an optional peer
+dependency):
+
+```ts
+import { H3, serve } from "h3";
+import { defineYuvaAnalytics, defineYuvaIdentityHandler, defineYuvaWebhookHandler } from "useyuva/h3";
+import { createAnalytics } from "useyuva/server";
+
+const app = new H3()
+  .use(
+    defineYuvaAnalytics({
+      analytics: createAnalytics({
+        server: "https://support.example.com",
+        apiKey: process.env.YUVA_API_KEY!,
+        propertyId: process.env.YUVA_ANALYTICS_PROPERTY!,
+      }),
+    })
+  )
+  .get(
+    "/yuva-token",
+    defineYuvaIdentityHandler({
+      secret: process.env.YUVA_IDENTITY_SECRET!,
+      user: async (event) => {
+        const user = await currentUser(event); // your session; null when signed out
+        return user && { subject: user.id, email: user.email, emailVerified: user.emailConfirmed, name: user.name };
+      },
+    })
+  )
+  .post(
+    "/webhooks/yuva",
+    defineYuvaWebhookHandler({
+      secret: process.env.YUVA_WEBHOOK_SECRET!,
+      on: {
+        "message.created": async (payload) => {
+          if (!payload.data.contact?.online) await sendPush(payload.data);
+        },
+        "conversation.rated": (payload) => saveRating(payload.data.conversation),
+      },
+    })
+  )
+  .post("/signup", async (event) => {
+    // ...
+    event.context.yuva?.track({ name: "Signup", props: { plan: "pro" } });
+    return Response.redirect(new URL("/welcome", event.req.url), 303);
+  });
+
+serve(app);
+```
+
+```html
+<yuva-chat channel="yuva_pk_…" server="https://support.example.com"></yuva-chat>
+<script type="module">
+  import "useyuva/chat";
+  document.querySelector("yuva-chat").setIdentityToken(async () => {
+    const response = await fetch("/yuva-token", { credentials: "same-origin" });
+    return response.ok ? (await response.json()).token : null;
+  });
+</script>
+```
+
+`defineYuvaIdentityHandler({ secret, user, ttl })` answers `{ "token": "…" }` with a token for the
+claims `user(event)` returns, with `Cache-Control: no-store`, and `401` when it returns nothing;
+`ttl` is the default for claims without their own. `defineYuvaWebhookHandler({ secret, tolerance, on })`
+verifies the raw request with `verifyWebhook` and calls the handler for the event's `type` with the
+event typed for it; it answers `401` when the signature does not verify, `204` for a type without a
+handler, and otherwise the `Response` the handler returns or `204`. A handler that throws answers
+`500`, so Yuva retries. `defineYuvaAnalytics({ analytics })` is a middleware that puts
+`track(event)` (`analytics.track` with the request) on `event.context.yuva` and, after a request
+that tracked something, hands `flush()` to the request's `waitUntil`, which srvx sets on every
+runtime it serves; without one the queue goes out on the client's timer.
+
+### Nitro
+
+`useyuva/nitro` is the same server part for a [Nitro](https://nitro.build) v3 app:
+
+```ts
+// nitro.config.ts
+import { defineConfig } from "nitro";
+
+export default defineConfig({
+  serverDir: "./server",
+  modules: ["useyuva/nitro"],
+});
+```
+
+```ts
+// server/yuva.ts
+import { getCookie } from "nitro/h3";
+import { defineYuvaServer } from "useyuva/nitro/runtime";
+
+export default defineYuvaServer({
+  user: async (event) => {
+    const user = await findSession(getCookie(event, "session")); // null when signed out
+    return user && { subject: user.id, email: user.email, emailVerified: user.emailConfirmed, name: user.name };
+  },
+  webhooks: { "conversation.rated": (payload) => saveRating(payload.data.conversation) },
+});
+```
+
+The variables are `NITRO_YUVA_IDENTITY_SECRET`, `NITRO_YUVA_WEBHOOK_SECRET`,
+`NITRO_YUVA_ANALYTICS_API_KEY`, `NITRO_YUVA_ANALYTICS_PROPERTY_ID` and `NITRO_YUVA_SERVER` (the Yuva
+server analytics goes to), or `yuva({ identitySecret, webhookSecret, analytics: { apiKey, propertyId }, server })`
+from `useyuva/nitro` in `modules`; routes, `track` and the build-time rule are as in [Nuxt](#nuxt).
+`yuva.ts` is read from `serverDir`, or the root without one. The page asks for the token as in the
+h3 example, at `/_yuva/identity`.
+
 ## License
 
 MIT

package/dist/esm/docs.js

@@ -131,4 +131,4 @@ button { font: inherit; color: inherit; }
 .choice[aria-pressed="true"] { background: var(--yuva-soft); }
 .choice:disabled { cursor: default; }
 .choice:focus-visible { outline: 2px solid var(--yuva-accent); outline-offset: 2px; }
-`;function storageKey(channel){return`yuva:${channel}:page-ratings`}function remembered(channel){try{let raw=localStorage.getItem(storageKey(channel));return raw?JSON.parse(raw):{}}catch{return{}}}function remember(channel,page,rating){try{let ratings=remembered(channel);delete ratings[page],ratings[page]=rating;let pages=Object.keys(ratings);for(let old of pages.slice(0,Math.max(0,pages.length-maxRemembered)))delete ratings[old];localStorage.setItem(storageKey(channel),JSON.stringify(ratings))}catch{}}class YuvaPageFeedbackElement extends YuvaDocsElement{#phase="ask";#rating;#error="";#comment=el("textarea");#email=el("input");constructor(){super();this.#comment.rows=3,this.#comment.maxLength=5000,this.#comment.dir="auto",this.#comment.addEventListener("input",()=>this.#syncSend()),this.#email.type="email",this.#email.autocomplete="email"}get rating(){return this.#rating??null}reset(){this.#phase="ask",this.#error="",this.#comment.value="",this.#rating=this.channel?remembered(this.channel)[this.pageUrl]:void 0}pageChanged(){if(this.#phase==="ask"&&!this.#error)this.#rating=this.channel?remembered(this.channel)[this.pageUrl]:void 0;this.render()}async rate(rating){let channel=this.channel;if(!channel||this.refused||this.#phase==="rating"||this.#phase==="sending")return;let page=this.pageUrl,previous=remembered(channel)[page];if(this.#error="",previous===rating){this.#rating=rating,this.#phase=this.canWrite?"form":"thanks",this.render(),this.#comment.focus({preventScroll:!0});return}this.#phase="rating",this.#rating=rating,this.render();try{await this.client().ratePage({page,title:this.pageTitle||void 0,rating,previous})}catch(error){if(this.pageUrl!==page||this.refusal(error))return;this.#rating=previous,this.#phase="ask",this.#error=this.errorText(error),this.render();return}if(remember(channel,page,rating),this.emit("yuva-rating",{page,rating,previous:previous??null}),this.pageUrl!==page)return;this.#phase=this.canWrite?"form":"thanks",this.render(),this.#comment.focus({preventScroll:!0})}async#send(){let body=this.#comment.value.trim(),email=this.#email.value.trim(),rating=this.#rating;if(!body||this.#phase!=="form")return;if(email&&!this.#email.checkValidity()){this.#error=this.t({id:"E_qvzP"}),this.render();return}let page=this.pageUrl;this.#phase="sending",this.#error="",this.render();try{let{conversation}=await this.client().sendFeedback({page_url:page,page_title:this.pageTitle||void 0,rating,body,locale:this.locale,allow_email:this.identified||!!email,email:!this.identified&&email?email:void 0});if(this.emit("yuva-feedback",{page,rating:rating??null,conversation_id:conversation.id}),this.pageUrl!==page)return;this.#comment.value="",this.#phase="thanks"}catch(error){if(this.pageUrl!==page||this.refusal(error,!1))return;this.#phase="form",this.#error=this.errorText(error)}this.render()}#syncSend(){let send=this.root.querySelector(".send");if(send)send.disabled=this.#phase!=="form"||this.#comment.value.trim()===""}render(){if(this.refused||!this.channel){this.root.replaceChildren();return}let question=this.t({id:"SOvBw9"}),ask=el("div","ask");ask.setAttribute("role","group"),ask.setAttribute("aria-label",question);let choices=el("div","choices");for(let value of["up","down"]){let button=el("button","choice");button.type="button",button.innerHTML=thumb(value==="down"),button.append(el("span","",value==="up"?this.t({id:"l75CjT"}):this.t({id:"1UzENP"}))),button.setAttribute("aria-pressed",String(this.#rating===value)),button.disabled=this.#phase==="rating"||this.#phase==="sending",button.addEventListener("click",()=>void this.rate(value)),choices.append(button)}ask.append(el("p","question",question),choices);let children=[ask];if(this.#phase==="form"||this.#phase==="sending"){let form=el("form");form.noValidate=!0,form.addEventListener("submit",(event)=>{event.preventDefault(),this.#send()});let prompt=this.#rating==="down"?this.t({id:"U7H5Fm"}):this.t({id:"EmiQvf"});if(this.#comment.placeholder=prompt,this.#comment.setAttribute("aria-label",prompt),this.#comment.disabled=this.#phase==="sending",form.append(this.#comment),!this.identified)this.#email.placeholder=this.t({id:"a_qtPP"}),this.#email.setAttribute("aria-label",this.t({id:"XJURKP"})),this.#email.disabled=this.#phase==="sending",form.append(this.#email);let skip=el("button","link",this.t({id:"tA4dAO"}));skip.type="button",skip.disabled=this.#phase==="sending",skip.addEventListener("click",()=>{this.#phase="thanks",this.#error="",this.render()});let send=el("button","send",this.#phase==="sending"?this.t({id:"Sad2tK"}):this.t({id:"JlFcis"}));send.type="submit";let actions=el("div","actions");actions.append(skip,send),form.append(actions),children.push(form)}else if(this.#phase==="thanks"){let thanks=el("p","muted",this.t({id:"d6N994"}));thanks.setAttribute("role","status"),children.push(thanks)}if(this.#error){let error=el("p","error",this.#error);error.setAttribute("role","alert"),children.push(error)}this.frame(styles2,...children),this.#syncSend()}}function defineDocs(){if(typeof customElements>"u")return;if(!customElements.get("yuva-discussions"))customElements.define("yuva-discussions",YuvaDiscussionsElement);if(!customElements.get("yuva-page-feedback"))customElements.define("yuva-page-feedback",YuvaPageFeedbackElement)}YuvaDiscussionsElement.loadThread=()=>import("./thread-6dcd0yms.js");defineDocs();export{YuvaDiscussionsElement,YuvaPageFeedbackElement,defineDocs};
+`;function storageKey(channel){return`yuva:${channel}:page-ratings`}function remembered(channel){try{let raw=localStorage.getItem(storageKey(channel));return raw?JSON.parse(raw):{}}catch{return{}}}function remember(channel,page,rating){try{let ratings=remembered(channel);delete ratings[page],ratings[page]=rating;let pages=Object.keys(ratings);for(let old of pages.slice(0,Math.max(0,pages.length-maxRemembered)))delete ratings[old];localStorage.setItem(storageKey(channel),JSON.stringify(ratings))}catch{}}class YuvaPageFeedbackElement extends YuvaDocsElement{#phase="ask";#rating;#error="";#comment=el("textarea");#email=el("input");constructor(){super();this.#comment.rows=3,this.#comment.maxLength=5000,this.#comment.dir="auto",this.#comment.addEventListener("input",()=>this.#syncSend()),this.#email.type="email",this.#email.autocomplete="email"}get rating(){return this.#rating??null}reset(){this.#phase="ask",this.#error="",this.#comment.value="",this.#rating=this.channel?remembered(this.channel)[this.pageUrl]:void 0}pageChanged(){if(this.#phase==="ask"&&!this.#error)this.#rating=this.channel?remembered(this.channel)[this.pageUrl]:void 0;this.render()}async rate(rating){let channel=this.channel;if(!channel||this.refused||this.#phase==="rating"||this.#phase==="sending")return;let page=this.pageUrl,previous=remembered(channel)[page];if(this.#error="",previous===rating){this.#rating=rating,this.#phase=this.canWrite?"form":"thanks",this.render(),this.#comment.focus({preventScroll:!0});return}this.#phase="rating",this.#rating=rating,this.render();try{await this.client().ratePage({page,title:this.pageTitle||void 0,rating,previous})}catch(error){if(this.pageUrl!==page||this.refusal(error))return;this.#rating=previous,this.#phase="ask",this.#error=this.errorText(error),this.render();return}if(remember(channel,page,rating),this.emit("yuva-rating",{page,rating,previous:previous??null}),this.pageUrl!==page)return;this.#phase=this.canWrite?"form":"thanks",this.render(),this.#comment.focus({preventScroll:!0})}async#send(){let body=this.#comment.value.trim(),email=this.#email.value.trim(),rating=this.#rating;if(!body||this.#phase!=="form")return;if(email&&!this.#email.checkValidity()){this.#error=this.t({id:"E_qvzP"}),this.render();return}let page=this.pageUrl;this.#phase="sending",this.#error="",this.render();try{let{conversation}=await this.client().sendFeedback({page_url:page,page_title:this.pageTitle||void 0,rating,body,locale:this.locale,allow_email:this.identified||!!email,email:!this.identified&&email?email:void 0});if(this.emit("yuva-feedback",{page,rating:rating??null,conversation_id:conversation.id}),this.pageUrl!==page)return;this.#comment.value="",this.#phase="thanks"}catch(error){if(this.pageUrl!==page||this.refusal(error,!1))return;this.#phase="form",this.#error=this.errorText(error)}this.render()}#syncSend(){let send=this.root.querySelector(".send");if(send)send.disabled=this.#phase!=="form"||this.#comment.value.trim()===""}render(){if(this.refused||!this.channel){this.root.replaceChildren();return}let question=this.t({id:"SOvBw9"}),ask=el("div","ask");ask.setAttribute("role","group"),ask.setAttribute("aria-label",question);let choices=el("div","choices");for(let value of["up","down"]){let button=el("button","choice");button.type="button",button.innerHTML=thumb(value==="down"),button.append(el("span","",value==="up"?this.t({id:"l75CjT"}):this.t({id:"1UzENP"}))),button.setAttribute("aria-pressed",String(this.#rating===value)),button.disabled=this.#phase==="rating"||this.#phase==="sending",button.addEventListener("click",()=>void this.rate(value)),choices.append(button)}ask.append(el("p","question",question),choices);let children=[ask];if(this.#phase==="form"||this.#phase==="sending"){let form=el("form");form.noValidate=!0,form.addEventListener("submit",(event)=>{event.preventDefault(),this.#send()});let prompt=this.#rating==="down"?this.t({id:"U7H5Fm"}):this.t({id:"EmiQvf"});if(this.#comment.placeholder=prompt,this.#comment.setAttribute("aria-label",prompt),this.#comment.disabled=this.#phase==="sending",form.append(this.#comment),!this.identified)this.#email.placeholder=this.t({id:"a_qtPP"}),this.#email.setAttribute("aria-label",this.t({id:"XJURKP"})),this.#email.disabled=this.#phase==="sending",form.append(this.#email);let skip=el("button","link",this.t({id:"tA4dAO"}));skip.type="button",skip.disabled=this.#phase==="sending",skip.addEventListener("click",()=>{this.#phase="thanks",this.#error="",this.render()});let send=el("button","send",this.#phase==="sending"?this.t({id:"Sad2tK"}):this.t({id:"JlFcis"}));send.type="submit";let actions=el("div","actions");actions.append(skip,send),form.append(actions),children.push(form)}else if(this.#phase==="thanks"){let thanks=el("p","muted",this.t({id:"d6N994"}));thanks.setAttribute("role","status"),children.push(thanks)}if(this.#error){let error=el("p","error",this.#error);error.setAttribute("role","alert"),children.push(error)}this.frame(styles2,...children),this.#syncSend()}}function defineDocs(){if(typeof customElements>"u")return;if(!customElements.get("yuva-discussions"))customElements.define("yuva-discussions",YuvaDiscussionsElement);if(!customElements.get("yuva-page-feedback"))customElements.define("yuva-page-feedback",YuvaPageFeedbackElement)}YuvaDiscussionsElement.loadThread=()=>import("./thread-gx5pssds.js");defineDocs();export{YuvaDiscussionsElement,YuvaPageFeedbackElement,defineDocs};

package/dist/esm/h3.js

@@ -0,0 +1 @@
+import{signIdentityToken2,WebhookVerificationError2,verifyWebhook2}from"./index-qcd538se.js";import{defineHandler,defineMiddleware}from"h3";var noStore={"cache-control":"no-store"};function defineYuvaIdentityHandler({secret,user,ttl}){return defineHandler(async(event)=>{let claims=await user(event);if(!claims)return new Response(null,{status:401,headers:noStore});let token=await signIdentityToken2(secret,{...claims,ttl:claims.ttl??ttl});return Response.json({token},{headers:noStore})})}function defineYuvaWebhookHandler({secret,tolerance,on}){return defineHandler(async(event)=>{let payload;try{payload=await verifyWebhook2(secret,event.req,{tolerance})}catch(error){if(error instanceof WebhookVerificationError2)return new Response(error.message,{status:401});throw error}if(!Object.hasOwn(on,payload.type))return new Response(null,{status:204});let handler=on[payload.type],result=await handler?.(payload,event);return result instanceof Response?result:new Response(null,{status:204})})}function defineYuvaAnalytics({analytics}){return defineMiddleware(async(event,next)=>{let request=event.req,tracked=!1;event.context.yuva={track(e){analytics.track(request,e),tracked=!0}};try{return await next()}finally{if(tracked&&request.waitUntil)event.waitUntil(analytics.flush())}})}export{defineYuvaAnalytics,defineYuvaIdentityHandler,defineYuvaWebhookHandler};

package/dist/esm/index-qcd538se.js

@@ -0,0 +1,2 @@
+var encoder=new TextEncoder,utf8=(text)=>encoder.encode(text);function base64(bytes){let binary="";for(let byte of bytes)binary+=String.fromCharCode(byte);return btoa(binary)}var base64url=(bytes)=>base64(bytes).replace(/=+$/,"").replace(/\+/g,"-").replace(/\//g,"_"),strictBase64=/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;function decodeBase64(text){if(!strictBase64.test(text))return;return Uint8Array.from(atob(text),(char)=>char.charCodeAt(0))}var hmacKey=(key,usages)=>crypto.subtle.importKey("raw",key,{name:"HMAC",hash:"SHA-256"},!1,usages),goEscapes={"<":"\\u003c",">":"\\u003e","&":"\\u0026","\u2028":"\\u2028","\u2029":"\\u2029"};function goJSON(value){if(value===null||typeof value!=="object"||typeof value.toJSON==="function")return JSON.stringify(value)?.replace(/[<>&\u2028\u2029]/g,(char)=>goEscapes[char]);if(Array.isArray(value))return`[${value.map((item)=>goJSON(item)??"null").join(",")}]`;let fields=[];for(let key of Object.keys(value).sort()){let encoded=goJSON(value[key]);if(encoded!==void 0)fields.push(`${goJSON(key)}:${encoded}`)}return`{${fields.join(",")}}`}var DEFAULT_IDENTITY_TTL2=300,MAX_IDENTITY_TTL2=600,header=base64url(utf8('{"alg":"HS256","typ":"JWT"}'));async function signIdentityToken2(secret,claims){if(!secret)throw Error("identity: the inbox identity secret is empty");let sub=(claims.subject??"").trim();if(!sub||[...sub].length>200)throw Error("identity: subject must be 1 to 200 characters");let ttl=claims.ttl||DEFAULT_IDENTITY_TTL2;if(!(ttl>0&&ttl<=MAX_IDENTITY_TTL2))throw Error("identity: ttl must be at most 10 minutes");let at=(claims.issuedAt??new Date).getTime(),payload={sub,email:claims.email||void 0,email_verified:claims.emailVerified||void 0,name:claims.name||void 0,locale:claims.locale||void 0,attrs:claims.attrs&&Object.keys(claims.attrs).length>0?claims.attrs:void 0,jti:claims.id||void 0,iat:Math.floor(at/1000),exp:Math.floor((at+ttl*1000)/1000)},fields=Object.entries(payload).flatMap(([key,value])=>{let encoded=goJSON(value);return encoded===void 0?[]:[`"${key}":${encoded}`]}),signing=`${header}.${base64url(utf8(`{${fields.join(",")}}`))}`,key=await hmacKey(utf8(secret),["sign"]);return`${signing}.${base64url(new Uint8Array(await crypto.subtle.sign("HMAC",key,utf8(signing))))}`}var DEFAULT_WEBHOOK_TOLERANCE2=300,messages={invalid_secret:"webhook: the secret is not a whsec_ base64 secret",missing_headers:"webhook: webhook-id, webhook-timestamp or webhook-signature is missing",invalid_timestamp:"webhook: webhook-timestamp is not a unix time",timestamp_too_old:"webhook: webhook-timestamp is too old",timestamp_too_new:"webhook: webhook-timestamp is too far in the future",invalid_signature:"webhook: no signature matches"};class WebhookVerificationError2 extends Error{code;constructor(code){super(messages[code]);this.name="WebhookVerificationError",this.code=code}}function key(secret){let bytes=decodeBase64(secret.trim().replace(/^whsec_/,""));if(!bytes||bytes.length===0)throw new WebhookVerificationError2("invalid_secret");return bytes}function signed(id,timestamp,body){let prefix=utf8(`${id}.${timestamp}.`),data=new Uint8Array(prefix.length+body.length);return data.set(prefix),data.set(body,prefix.length),data}async function signWebhook2(secret,id,timestamp,body){let k=await hmacKey(key(secret),["sign"]),data=signed(id,String(Math.floor(timestamp.getTime()/1000)),typeof body==="string"?utf8(body):body);return`v1,${base64(new Uint8Array(await crypto.subtle.sign("HMAC",k,data)))}`}async function verifyWebhookBody2(secret,headers,body,{tolerance,now=new Date}={}){let raw=key(secret),id=headers.get("webhook-id"),ts=headers.get("webhook-timestamp"),sigs=headers.get("webhook-signature");if(!id||!ts||!sigs)throw new WebhookVerificationError2("missing_headers");if(!/^[+-]?\d{1,19}$/.test(ts))throw new WebhookVerificationError2("invalid_timestamp");let window=(tolerance&&tolerance>0?tolerance:DEFAULT_WEBHOOK_TOLERANCE2)*1000,at=Number(ts)*1000;if(now.getTime()-at>window)throw new WebhookVerificationError2("timestamp_too_old");if(at-now.getTime()>window)throw new WebhookVerificationError2("timestamp_too_new");let k=await hmacKey(raw,["verify"]),data=signed(id,ts,body);for(let sig of sigs.split(/\s+/)){let comma=sig.indexOf(",");if(comma<0||sig.slice(0,comma)!=="v1")continue;let got=decodeBase64(sig.slice(comma+1));if(got&&got.length>0&&await crypto.subtle.verify("HMAC",k,got,data))return}throw new WebhookVerificationError2("invalid_signature")}async function verifyWebhook2(secret,request,options){let body=new Uint8Array(await request.arrayBuffer());return await verifyWebhookBody2(secret,request.headers,body,options),JSON.parse(new TextDecoder().decode(body))}
+export{DEFAULT_IDENTITY_TTL2,MAX_IDENTITY_TTL2,signIdentityToken2,DEFAULT_WEBHOOK_TOLERANCE2,WebhookVerificationError2,signWebhook2,verifyWebhookBody2,verifyWebhook2};

package/dist/esm/nitro/module.js

@@ -0,0 +1,39 @@
+import { resolve } from "node:path";
+import {
+  findServerFile,
+  IDENTITY_ROUTE,
+  runtimePath,
+  SERVER_MODULE,
+  serverModule,
+  serverParts,
+  serverRuntimeConfig,
+  WEBHOOK_ROUTE
+} from "./setup.js";
+export function yuva(options = {}) {
+  return {
+    name: "useyuva",
+    setup(nitro) {
+      const config = serverRuntimeConfig(nitro.options.runtimeConfig.yuva, options);
+      nitro.options.runtimeConfig.yuva = config;
+      const parts = serverParts(config, process.env, "NITRO_");
+      if (!parts.identity && !parts.webhook && !parts.analytics)
+        return;
+      const dir = nitro.options.serverDir ? resolve(nitro.options.rootDir, nitro.options.serverDir) : nitro.options.rootDir;
+      const server = findServerFile(dir);
+      if (!server && parts.identity)
+        nitro.logger.warn(`useyuva: no yuva.ts in ${dir}, so ${IDENTITY_ROUTE} answers 404`);
+      nitro.options.virtual[SERVER_MODULE] = serverModule({
+        nitro: 3,
+        server,
+        runtimeConfig: "nitro/runtime-config"
+      });
+      if (parts.identity)
+        nitro.options.handlers.push({ route: IDENTITY_ROUTE, method: "GET", handler: runtimePath("identity") });
+      if (parts.webhook)
+        nitro.options.handlers.push({ route: WEBHOOK_ROUTE, method: "POST", handler: runtimePath("webhook") });
+      if (parts.analytics)
+        nitro.options.plugins.push(runtimePath("plugin"));
+    }
+  };
+}
+export default yuva();

package/dist/esm/nitro/runtime/core.js

@@ -0,0 +1,64 @@
+import {
+  createAnalytics,
+  signIdentityToken,
+  verifyWebhook,
+  WebhookVerificationError
+} from "../../server.js";
+const noStore = { "cache-control": "no-store" };
+const notFound = () => new Response(null, { status: 404 });
+export function identityHandler(yuva) {
+  return yuva.defineHandler(async (event) => {
+    const secret = yuva.config().yuva?.identitySecret;
+    if (!secret || !yuva.server.user)
+      return notFound();
+    const claims = await yuva.server.user(event);
+    if (!claims)
+      return new Response(null, { status: 401, headers: noStore });
+    return Response.json({ token: await signIdentityToken(secret, claims) }, { headers: noStore });
+  });
+}
+export function webhookHandler(yuva) {
+  return yuva.defineHandler(async (event) => {
+    const secret = yuva.config().yuva?.webhookSecret;
+    if (!secret)
+      return notFound();
+    let payload;
+    try {
+      payload = await verifyWebhook(secret, yuva.toRequest(event));
+    } catch (error) {
+      if (error instanceof WebhookVerificationError)
+        return new Response(error.message, { status: 401 });
+      throw error;
+    }
+    const on = yuva.server.webhooks ?? {};
+    if (!Object.hasOwn(on, payload.type))
+      return new Response(null, { status: 204 });
+    const handler = on[payload.type];
+    const result = await handler?.(payload, event);
+    return result instanceof Response ? result : new Response(null, { status: 204 });
+  });
+}
+export function analyticsPlugin(yuva) {
+  return (nitroApp) => {
+    const config = yuva.config();
+    const { apiKey, propertyId } = config.yuva?.analytics ?? {};
+    const server = config.yuva?.server || config.public?.yuva?.analytics?.server || config.public?.yuva?.server;
+    if (!apiKey || !propertyId || !server)
+      return;
+    const analytics = createAnalytics({ server, apiKey, propertyId });
+    const tracked = new WeakSet;
+    nitroApp.hooks.hook("request", (event) => {
+      event.context.yuva = {
+        track(e) {
+          analytics.track(yuva.trackRequest(event), e);
+          tracked.add(event);
+        }
+      };
+    });
+    yuva.onResponse(nitroApp.hooks, (event) => {
+      if (tracked.has(event))
+        yuva.waitUntil(event)?.(analytics.flush());
+    });
+    nitroApp.hooks.hook("close", () => analytics.close());
+  };
+}

package/dist/esm/nitro/runtime/define.js

@@ -0,0 +1,3 @@
+export function defineYuvaServer(server) {
+  return server;
+}

package/dist/esm/nitro/runtime/identity.js

@@ -0,0 +1,3 @@
+import * as yuva from "#yuva/server";
+import { identityHandler } from "./core.js";
+export default identityHandler(yuva);

package/dist/esm/nitro/runtime/plugin.js

@@ -0,0 +1,3 @@
+import * as yuva from "#yuva/server";
+import { analyticsPlugin } from "./core.js";
+export default analyticsPlugin(yuva);

package/dist/esm/nitro/runtime/webhook.js

@@ -0,0 +1,3 @@
+import * as yuva from "#yuva/server";
+import { webhookHandler } from "./core.js";
+export default webhookHandler(yuva);

package/dist/esm/nitro/setup.js

@@ -0,0 +1,65 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+export const IDENTITY_ROUTE = "/_yuva/identity";
+export const WEBHOOK_ROUTE = "/_yuva/webhook";
+export const SERVER_MODULE = "#yuva/server";
+export function serverRuntimeConfig(current, options) {
+  return {
+    ...current,
+    server: current?.server || options.server || "",
+    identitySecret: current?.identitySecret || options.identitySecret || "",
+    webhookSecret: current?.webhookSecret || options.webhookSecret || "",
+    analytics: {
+      ...current?.analytics,
+      apiKey: current?.analytics?.apiKey || options.analytics?.apiKey || "",
+      propertyId: current?.analytics?.propertyId || options.analytics?.propertyId || ""
+    }
+  };
+}
+export function serverParts(config, env, prefix) {
+  const set = (value, name) => !!(value || env[`${prefix}YUVA_${name}`]);
+  return {
+    identity: set(config.identitySecret, "IDENTITY_SECRET"),
+    webhook: set(config.webhookSecret, "WEBHOOK_SECRET"),
+    analytics: set(config.analytics?.apiKey, "ANALYTICS_API_KEY") && set(config.analytics?.propertyId, "ANALYTICS_PROPERTY_ID")
+  };
+}
+export function findServerFile(dir) {
+  for (const ext of ["ts", "mts", "js", "mjs"]) {
+    const path = join(dir, `yuva.${ext}`);
+    if (existsSync(path))
+      return path;
+  }
+  return;
+}
+export function runtimePath(name) {
+  return fileURLToPath(new URL(`./runtime/${name}.js`, import.meta.url));
+}
+export function serverModule({ nitro, server, runtimeConfig, h3 = "h3" }) {
+  const v3 = nitro >= 3;
+  const lines = [
+    `import { useRuntimeConfig } from ${JSON.stringify(runtimeConfig)}`,
+    ...v3 ? [] : [`import { defineEventHandler, getRequestIP, getRequestURL, toWebRequest } from ${JSON.stringify(h3)}`],
+    server ? `import server from ${JSON.stringify(server)}` : "const server = {}",
+    "export { server }",
+    "export const config = () => useRuntimeConfig()",
+    ...v3 ? [
+      "export const defineHandler = (handler) => handler",
+      "export const toRequest = (event) => event.req",
+      "export const trackRequest = (event) => event.req",
+      'export const onResponse = (hooks, fn) => hooks.hook("response", (_response, event) => fn(event))',
+      "export const waitUntil = (event) => (event.req.waitUntil ? (promise) => event.waitUntil(promise) : undefined)"
+    ] : [
+      "export const defineHandler = defineEventHandler",
+      "export const toRequest = (event) => toWebRequest(event)",
+      "export const trackRequest = (event) =>",
+      "  Object.assign(new Request(getRequestURL(event), { headers: event.headers }), { ip: getRequestIP(event) })",
+      'export const onResponse = (hooks, fn) => hooks.hook("afterResponse", (event) => fn(event))',
+      "export const waitUntil = (event) => (event.context.waitUntil ? (promise) => event.waitUntil(promise) : undefined)"
+    ]
+  ];
+  return `${lines.join(`
+`)}
+`;
+}

package/dist/esm/nuxt/module.js

@@ -1,15 +1,55 @@
-import { addComponent, addImports, addPlugin, defineNuxtModule } from "@nuxt/kit";
+import * as kit from "@nuxt/kit";
+import {
+  addComponent,
+  addImports,
+  addPlugin,
+  addServerHandler,
+  addServerImports,
+  addServerPlugin,
+  addTypeTemplate,
+  defineNuxtModule,
+  useLogger
+} from "@nuxt/kit";
+import {
+  findServerFile,
+  IDENTITY_ROUTE,
+  runtimePath,
+  SERVER_MODULE,
+  serverModule,
+  serverParts,
+  serverRuntimeConfig,
+  WEBHOOK_ROUTE
+} from "../nitro/setup.js";
 const components = ["YuvaChat", "YuvaDiscussions", "YuvaPageFeedback", "YuvaSubscribe"];
+const serverTypes = `import type { H3Event } from "h3"
+
+declare module "useyuva/nitro/runtime" {
+  interface YuvaServerTypes {
+    event: H3Event
+  }
+}
+
+export {}
+`;
 export default defineNuxtModule({
   meta: { name: "useyuva", configKey: "yuva" },
   defaults: { server: "", channel: "", locale: "" },
   setup(options, nuxt) {
+    const { apiKey, propertyId, ...clientAnalytics } = options.analytics ?? { key: "" };
+    const secrets = serverRuntimeConfig(nuxt.options.runtimeConfig.yuva, {
+      identitySecret: options.identitySecret,
+      webhookSecret: options.webhookSecret,
+      analytics: { apiKey, propertyId }
+    });
+    const parts = serverParts(secrets, process.env, "NUXT_");
     const current = nuxt.options.runtimeConfig.public.yuva ?? {};
+    const base = nuxt.options.app.baseURL.replace(/\/+$/, "");
     nuxt.options.runtimeConfig.public.yuva = {
       server: current.server || options.server || "",
       channel: current.channel || options.channel || "",
       locale: current.locale || options.locale || "",
-      analytics: current.analytics || options.analytics
+      identity: current.identity || (parts.identity ? `${base}${IDENTITY_ROUTE}` : ""),
+      analytics: current.analytics || (options.analytics ? clientAnalytics : undefined)
     };
     const compilerOptions = nuxt.options.vue.compilerOptions ??= {};
     const isCustomElement = compilerOptions.isCustomElement;
@@ -20,5 +60,27 @@ export default defineNuxtModule({
     addImports({ name: "useYuvaAnalytics", from: "useyuva/nuxt/analytics" });
     if (nuxt.options.runtimeConfig.public.yuva.analytics)
       addPlugin({ src: "useyuva/nuxt/plugin", mode: "client" });
+    addServerImports([{ name: "defineYuvaServer", from: "useyuva/nitro/runtime" }]);
+    addTypeTemplate({ filename: "types/useyuva-server.d.ts", getContents: () => serverTypes }, { nitro: true });
+    if (!parts.identity && !parts.webhook && !parts.analytics)
+      return;
+    nuxt.options.runtimeConfig.yuva = secrets;
+    const server = findServerFile(nuxt.options.serverDir);
+    if (!server && parts.identity) {
+      useLogger("useyuva").warn(`No yuva.ts in ${nuxt.options.serverDir}, so ${IDENTITY_ROUTE} answers 404`);
+    }
+    const nitro = kit.getNitroVersion?.(nuxt) ?? 2;
+    nuxt.hook("nitro:config", (config) => {
+      config.virtual = {
+        ...config.virtual,
+        [SERVER_MODULE]: serverModule({ nitro, server, runtimeConfig: "#imports" })
+      };
+    });
+    if (parts.identity)
+      addServerHandler({ route: IDENTITY_ROUTE, method: "GET", handler: runtimePath("identity") });
+    if (parts.webhook)
+      addServerHandler({ route: WEBHOOK_ROUTE, method: "POST", handler: runtimePath("webhook") });
+    if (parts.analytics)
+      addServerPlugin(runtimePath("plugin"));
   }
 });

package/dist/esm/nuxt/runtime/components.js

@@ -18,12 +18,19 @@ const subscribeProps = {
   consent: String,
   privacyUrl: String
 };
+function identityRoute(path) {
+  return async () => {
+    const response = await fetch(path, { credentials: "same-origin" });
+    return response.ok ? (await response.json()).token : null;
+  };
+}
 function setup(tag, load, props, attributes, listeners) {
   const config = useRuntimeConfig().public.yuva;
   const element = ref(null);
+  const route = config?.identity ? identityRoute(config.identity) : undefined;
   onMounted(() => {
     load();
-    watch(() => props.identityToken, (source) => {
+    watch(() => props.identityToken === undefined ? route : props.identityToken, (source) => {
       const target = element.value;
       if (!target || typeof source !== "function")
         return;

package/dist/esm/server.js

@@ -0,0 +1 @@
+import{DEFAULT_IDENTITY_TTL2,MAX_IDENTITY_TTL2,signIdentityToken2,DEFAULT_WEBHOOK_TOLERANCE2,WebhookVerificationError2,signWebhook2,verifyWebhookBody2,verifyWebhook2}from"./index-qcd538se.js";var MAX_BATCH=100;class AnalyticsEventError extends Error{event;detail;constructor(event,detail){super(`analytics: event ${JSON.stringify(event.name)} refused: ${detail}`);this.name="AnalyticsEventError",this.event=event,this.detail=detail}}class AnalyticsBatchError extends Error{status;body;events;constructor(events,status,body,cause){super(cause===void 0?`analytics: ${events} events not sent: ${status} ${body}`:`analytics: ${events} events not sent: ${cause instanceof Error?cause.message:String(cause)}`,cause===void 0?void 0:{cause});this.name="AnalyticsBatchError",this.status=status,this.body=body,this.events=events}}var QUEUE_FULL="analytics: the queue is full; event dropped",CLOSED="analytics: client closed",rfc3339=(time)=>time.toISOString().replace(/\.?0+Z$/,"Z");function wire(event){return{name:event.name,url:event.url,referrer:event.referrer||void 0,timestamp:rfc3339(event.time),props:event.props&&Object.keys(event.props).length>0?event.props:void 0,revenue:event.revenue?{a:event.revenue.amount,c:event.revenue.currency}:void 0,interactive:event.nonInteractive?!1:void 0,consent:event.consent||void 0,ip:event.ip||void 0,user_agent:event.userAgent||void 0,sec_ch_ua_platform:event.secChUaPlatform||void 0,sec_ch_ua_mobile:event.secChUaMobile||void 0,accept_language:event.acceptLanguage||void 0,visitor_key:event.visitorKey||void 0,persistent_id:event.persistentId||void 0,identity_token:event.identityToken||void 0}}function requestURL(request){let url=new URL(request.url);if(request.headers.get("x-forwarded-proto")?.toLowerCase()==="https")url.protocol="https:";return url.hash="",url.href}var socketIP=(request)=>{let ip=request.ip;return typeof ip==="string"?ip:void 0};function unref(timer){if(typeof timer==="object"&&timer&&"unref"in timer&&typeof timer.unref==="function")timer.unref();else globalThis.Deno?.unrefTimer?.(timer);return timer}var sleep=(ms,hold)=>new Promise((resolve)=>{let timer=setTimeout(resolve,ms);if(!hold)unref(timer)});function createAnalytics(config){if(!config.server||!config.apiKey||!config.propertyId)throw Error("analytics: server, apiKey and propertyId are required");let endpoint=`${config.server.replace(/\/+$/,"")}/v1/analytics/properties/${encodeURIComponent(config.propertyId)}/events`,interval=config.flushInterval&&config.flushInterval>0?config.flushInterval:5000,queueSize=config.queueSize&&config.queueSize>0?config.queueSize:1e4,maxRetries=config.maxRetries||5,minBackoff=config.minBackoff&&config.minBackoff>0?config.minBackoff:1000,clientIP=config.clientIP??socketIP,queue=[],closed=!1,timer,chain=Promise.resolve(),report=(error)=>{try{config.onError?.(error)}catch{}};async function post(body){let res=await(config.fetch??fetch)(endpoint,{method:"POST",headers:{Authorization:`Bearer ${config.apiKey}`,"Content-Type":"application/json"},body}),raw=(await res.text()).slice(0,65536).trim(),seconds=Number(res.headers.get("retry-after"));return{status:res.status,raw,retryAfter:Number.isInteger(seconds)&&seconds>0?seconds*1000:0}}async function sendBatch(batch,hold){let body=JSON.stringify({events:batch.map(wire)}),backoff=minBackoff;for(let attempt=0;;attempt++){let res=await post(body).catch((error)=>({error}));if(!("error"in res)){if(res.status===202){try{let result=JSON.parse(res.raw);for(let{index,detail}of result.errors??[]){let event=batch[index];if(event)report(new AnalyticsEventError(event,detail))}}catch{}return}if(res.status!==429&&res.status<500)return new AnalyticsBatchError(batch.length,res.status,res.raw)}if(attempt>=maxRetries)return"error"in res?new AnalyticsBatchError(batch.length,0,"",res.error):new AnalyticsBatchError(batch.length,res.status,res.raw);await sleep(Math.max(backoff,"error"in res?0:res.retryAfter),hold),backoff=Math.min(backoff*2,60000)}}async function sendAll(hold){let last;for(;;){let batch=queue.slice(0,100);if(queue=queue.slice(batch.length),batch.length===0)return last;let error=await sendBatch(batch,hold);if(error)last=error,report(error)}}let run=(hold)=>{let next=chain.then(()=>sendAll(hold));return chain=next,next};function send(event){if(!event.name||!event.url)throw Error("analytics: an event needs a name and a url");if(closed)throw Error(CLOSED);if(queue.length>=queueSize){report(Error(QUEUE_FULL));return}if(queue.push({...event,time:event.time??new Date}),queue.length>=100)run(!1);else if(!timer)timer=unref(setTimeout(()=>{timer=void 0,run(!1)},interval))}function track(request,event){let headers=request.headers;if(headers.get("dnt")==="1"||headers.get("sec-gpc")==="1")return;let e={...event};if(!e.visitorKey){if(!e.ip)e.ip=clientIP(request)??void 0;if(!e.userAgent)e.userAgent=headers.get("user-agent")??void 0,e.secChUaPlatform=headers.get("sec-ch-ua-platform")??void 0,e.secChUaMobile=headers.get("sec-ch-ua-mobile")??void 0}if(!e.acceptLanguage)e.acceptLanguage=headers.get("accept-language")??void 0;if(!e.url)e.url=requestURL(request);if(!e.referrer)e.referrer=headers.get("referer")??void 0;send(e)}return{track,send,flush:()=>run(!0),async close(){if(closed)return;if(closed=!0,timer)clearTimeout(timer);return timer=void 0,run(!0)}}}export{AnalyticsBatchError,AnalyticsEventError,DEFAULT_IDENTITY_TTL2 as DEFAULT_IDENTITY_TTL,DEFAULT_WEBHOOK_TOLERANCE2 as DEFAULT_WEBHOOK_TOLERANCE,MAX_BATCH,MAX_IDENTITY_TTL2 as MAX_IDENTITY_TTL,WebhookVerificationError2 as WebhookVerificationError,createAnalytics,signIdentityToken2 as signIdentityToken,signWebhook2 as signWebhook,verifyWebhook2 as verifyWebhook,verifyWebhookBody2 as verifyWebhookBody};

package/dist/esm/{thread-6dcd0yms.js → thread-gx5pssds.js}

@@ -1,4 +1,4 @@
-import{el}from"./index-rdzxvj2r.js";import{inlineNodes}from"./index-jdxce2se.js";import{translate}from"./index-r9f9ttb2.js";var messages=JSON.parse('{"2Hlmdt":["Write a reply…"],"3CApMv":["All discussions"],"3PqJQG":["Nothing to preview."],"4-S4QM":["Unmark as answer"],"5lWFkC":["Sign in"],"8wRl7c":["The opening post was deleted."],"99w-GZ":["Sign in to start a discussion. Your name is shown with your post."],"F_vGso":["Your reply"],"HkXOWm":["This reply was deleted."],"Hw3P48":["Replies: ",["0"]],"ImOQa9":["Reply"],"JfAIiv":["This discussion is locked. New replies are closed."],"Kl3TuI":["Get an e-mail when someone replies or an answer is accepted."],"Klsidc":["Delete this reply?"],"MHrjPM":["Title"],"MKEPCY":["Follow"],"NjUiZ4":["Ask a question, share an idea or describe a problem with this page."],"NrGspR":["Thanks! Your discussion will appear for everyone once the team approves it."],"OVijcR":["Remove your vote (",["0"]," votes)"],"PL0621":["Sign in to reply, vote and follow this discussion."],"PN38hZ":["Your question or idea"],"PZ_kxo":["Keep"],"Pwqkdw":["Loading…"],"RqsQKK":["Your first posts are checked by the team before they appear for everyone."],"Sad2tK":["Sending…"],"VGqKyv":["This discussion is no longer available."],"Vwy_nT":["Markdown is supported."],"YZayoP":["Thanks! Your reply will appear for everyone once the team approves it."],"cnGeoo":["Delete"],"dEgA5A":["Cancel"],"dNOvhg":["Upvote (",["0"]," votes)"],"ePK91l":["Edit"],"i4_LY_":["Write"],"jhu92n":["Mark as answer"],"k4b5_X":["edited"],"n5vqdp":["Start discussion"],"qzVesX":["Edit your post"],"rAl91-":["Delete this discussion?"],"rdUucN":["Preview"],"tfDRzk":["Save"],"y-KXxN":["Accepted answer"],"y6sq5j":["Following"],"z1qf6l":["Start a discussion"]}');var messages2=JSON.parse('{"2Hlmdt":["Antwort schreiben…"],"3CApMv":["Alle Diskussionen"],"3PqJQG":["Noch nichts für die Vorschau."],"4-S4QM":["Antwortmarkierung entfernen"],"5lWFkC":["Anmelden"],"8wRl7c":["Der erste Beitrag wurde gelöscht."],"99w-GZ":["Melden Sie sich an, um eine Diskussion zu starten. Ihr Name wird mit Ihrem Beitrag angezeigt."],"F_vGso":["Ihre Antwort"],"HkXOWm":["Diese Antwort wurde gelöscht."],"Hw3P48":["Antworten: ",["0"]],"ImOQa9":["Antworten"],"JfAIiv":["Diese Diskussion ist gesperrt. Neue Antworten sind nicht möglich."],"Kl3TuI":["Erhalten Sie eine E-Mail, wenn jemand antwortet oder eine Antwort akzeptiert wird."],"Klsidc":["Diese Antwort löschen?"],"MHrjPM":["Titel"],"MKEPCY":["Folgen"],"NjUiZ4":["Stellen Sie eine Frage, teilen Sie eine Idee oder beschreiben Sie ein Problem mit dieser Seite."],"NrGspR":["Danke! Ihre Diskussion ist für alle sichtbar, sobald das Team sie freigibt."],"OVijcR":["Stimme zurückziehen (",["0"]," Stimmen)"],"PL0621":["Melden Sie sich an, um zu antworten, abzustimmen und dieser Diskussion zu folgen."],"PN38hZ":["Ihre Frage oder Idee"],"PZ_kxo":["Behalten"],"Pwqkdw":["Wird geladen…"],"RqsQKK":["Ihre ersten Beiträge prüft das Team, bevor sie für alle sichtbar sind."],"Sad2tK":["Wird gesendet…"],"VGqKyv":["Diese Diskussion ist nicht mehr verfügbar."],"Vwy_nT":["Markdown wird unterstützt."],"YZayoP":["Danke! Ihre Antwort ist für alle sichtbar, sobald das Team sie freigibt."],"cnGeoo":["Löschen"],"dEgA5A":["Abbrechen"],"dNOvhg":["Zustimmen (",["0"]," Stimmen)"],"ePK91l":["Bearbeiten"],"i4_LY_":["Schreiben"],"jhu92n":["Als Antwort markieren"],"k4b5_X":["bearbeitet"],"n5vqdp":["Diskussion starten"],"qzVesX":["Beitrag bearbeiten"],"rAl91-":["Diese Diskussion löschen?"],"rdUucN":["Vorschau"],"tfDRzk":["Speichern"],"y-KXxN":["Akzeptierte Antwort"],"y6sq5j":["Gefolgt"],"z1qf6l":["Diskussion starten"]}');var messages3=JSON.parse('{"2Hlmdt":["Bir yanıt yazın…"],"3CApMv":["Tüm tartışmalar"],"3PqJQG":["Önizlenecek bir şey yok."],"4-S4QM":["Yanıt işaretini kaldır"],"5lWFkC":["Giriş yap"],"8wRl7c":["Açılış gönderisi silindi."],"99w-GZ":["Tartışma başlatmak için giriş yapın. Adınız gönderinizle birlikte gösterilir."],"F_vGso":["Yanıtınız"],"HkXOWm":["Bu yanıt silindi."],"Hw3P48":["Yanıtlar: ",["0"]],"ImOQa9":["Yanıtla"],"JfAIiv":["Bu tartışma kilitli. Yeni yanıt yazılamaz."],"Kl3TuI":["Biri yanıt yazdığında ya da bir yanıt kabul edildiğinde e-posta alın."],"Klsidc":["Bu yanıt silinsin mi?"],"MHrjPM":["Başlık"],"MKEPCY":["Takip et"],"NjUiZ4":["Bir soru sorun, bir fikir paylaşın ya da bu sayfadaki bir sorunu anlatın."],"NrGspR":["Teşekkürler! Tartışmanız ekip onayladığında herkese görünecek."],"OVijcR":["Oyunuzu geri alın (",["0"]," oy)"],"PL0621":["Bu tartışmada yanıt yazmak, oy vermek ve takip etmek için giriş yapın."],"PN38hZ":["Sorunuz ya da fikriniz"],"PZ_kxo":["Kalsın"],"Pwqkdw":["Yükleniyor…"],"RqsQKK":["İlk gönderileriniz herkese görünmeden önce ekip tarafından kontrol edilir."],"Sad2tK":["Gönderiliyor…"],"VGqKyv":["Bu tartışma artık mevcut değil."],"Vwy_nT":["Markdown desteklenir."],"YZayoP":["Teşekkürler! Yanıtınız ekip onayladığında herkese görünecek."],"cnGeoo":["Sil"],"dEgA5A":["Vazgeç"],"dNOvhg":["Oy ver (",["0"]," oy)"],"ePK91l":["Düzenle"],"i4_LY_":["Yaz"],"jhu92n":["Yanıt olarak işaretle"],"k4b5_X":["düzenlendi"],"n5vqdp":["Tartışmayı başlat"],"qzVesX":["Gönderinizi düzenleyin"],"rAl91-":["Bu tartışma silinsin mi?"],"rdUucN":["Önizleme"],"tfDRzk":["Kaydet"],"y-KXxN":["Kabul edilen yanıt"],"y6sq5j":["Takip ediliyor"],"z1qf6l":["Tartışma başlat"]}');var linkPattern=/\[([^\]\n]+)\]\(([^)\s]+)\)/g;function inline(text){let nodes=[],last=0;for(let match of text.matchAll(linkPattern)){let index=match.index??0;if(index>last)nodes.push(...inlineNodes(text.slice(last,index)));let[whole,label="",href=""]=match,url=null;try{url=new URL(href)}catch{}if(url&&(url.protocol==="http:"||url.protocol==="https:")){let a=document.createElement("a");a.href=url.href,a.target="_blank",a.rel="nofollow ugc noopener",a.append(...inlineNodes(label)),nodes.push(a)}else nodes.push(document.createTextNode(whole));last=index+whole.length}if(last<text.length)nodes.push(...inlineNodes(text.slice(last)));return nodes}function block(tag,lines){let element=document.createElement(tag);return element.append(...inline(lines.join(" "))),element}function preview(markdown){let fragment=document.createDocumentFragment(),lines=markdown.replace(/\r\n?/g,`
+import{inlineNodes}from"./index-jdxce2se.js";import{el}from"./index-rdzxvj2r.js";import{translate}from"./index-r9f9ttb2.js";var messages=JSON.parse('{"2Hlmdt":["Write a reply…"],"3CApMv":["All discussions"],"3PqJQG":["Nothing to preview."],"4-S4QM":["Unmark as answer"],"5lWFkC":["Sign in"],"8wRl7c":["The opening post was deleted."],"99w-GZ":["Sign in to start a discussion. Your name is shown with your post."],"F_vGso":["Your reply"],"HkXOWm":["This reply was deleted."],"Hw3P48":["Replies: ",["0"]],"ImOQa9":["Reply"],"JfAIiv":["This discussion is locked. New replies are closed."],"Kl3TuI":["Get an e-mail when someone replies or an answer is accepted."],"Klsidc":["Delete this reply?"],"MHrjPM":["Title"],"MKEPCY":["Follow"],"NjUiZ4":["Ask a question, share an idea or describe a problem with this page."],"NrGspR":["Thanks! Your discussion will appear for everyone once the team approves it."],"OVijcR":["Remove your vote (",["0"]," votes)"],"PL0621":["Sign in to reply, vote and follow this discussion."],"PN38hZ":["Your question or idea"],"PZ_kxo":["Keep"],"Pwqkdw":["Loading…"],"RqsQKK":["Your first posts are checked by the team before they appear for everyone."],"Sad2tK":["Sending…"],"VGqKyv":["This discussion is no longer available."],"Vwy_nT":["Markdown is supported."],"YZayoP":["Thanks! Your reply will appear for everyone once the team approves it."],"cnGeoo":["Delete"],"dEgA5A":["Cancel"],"dNOvhg":["Upvote (",["0"]," votes)"],"ePK91l":["Edit"],"i4_LY_":["Write"],"jhu92n":["Mark as answer"],"k4b5_X":["edited"],"n5vqdp":["Start discussion"],"qzVesX":["Edit your post"],"rAl91-":["Delete this discussion?"],"rdUucN":["Preview"],"tfDRzk":["Save"],"y-KXxN":["Accepted answer"],"y6sq5j":["Following"],"z1qf6l":["Start a discussion"]}');var messages2=JSON.parse('{"2Hlmdt":["Antwort schreiben…"],"3CApMv":["Alle Diskussionen"],"3PqJQG":["Noch nichts für die Vorschau."],"4-S4QM":["Antwortmarkierung entfernen"],"5lWFkC":["Anmelden"],"8wRl7c":["Der erste Beitrag wurde gelöscht."],"99w-GZ":["Melden Sie sich an, um eine Diskussion zu starten. Ihr Name wird mit Ihrem Beitrag angezeigt."],"F_vGso":["Ihre Antwort"],"HkXOWm":["Diese Antwort wurde gelöscht."],"Hw3P48":["Antworten: ",["0"]],"ImOQa9":["Antworten"],"JfAIiv":["Diese Diskussion ist gesperrt. Neue Antworten sind nicht möglich."],"Kl3TuI":["Erhalten Sie eine E-Mail, wenn jemand antwortet oder eine Antwort akzeptiert wird."],"Klsidc":["Diese Antwort löschen?"],"MHrjPM":["Titel"],"MKEPCY":["Folgen"],"NjUiZ4":["Stellen Sie eine Frage, teilen Sie eine Idee oder beschreiben Sie ein Problem mit dieser Seite."],"NrGspR":["Danke! Ihre Diskussion ist für alle sichtbar, sobald das Team sie freigibt."],"OVijcR":["Stimme zurückziehen (",["0"]," Stimmen)"],"PL0621":["Melden Sie sich an, um zu antworten, abzustimmen und dieser Diskussion zu folgen."],"PN38hZ":["Ihre Frage oder Idee"],"PZ_kxo":["Behalten"],"Pwqkdw":["Wird geladen…"],"RqsQKK":["Ihre ersten Beiträge prüft das Team, bevor sie für alle sichtbar sind."],"Sad2tK":["Wird gesendet…"],"VGqKyv":["Diese Diskussion ist nicht mehr verfügbar."],"Vwy_nT":["Markdown wird unterstützt."],"YZayoP":["Danke! Ihre Antwort ist für alle sichtbar, sobald das Team sie freigibt."],"cnGeoo":["Löschen"],"dEgA5A":["Abbrechen"],"dNOvhg":["Zustimmen (",["0"]," Stimmen)"],"ePK91l":["Bearbeiten"],"i4_LY_":["Schreiben"],"jhu92n":["Als Antwort markieren"],"k4b5_X":["bearbeitet"],"n5vqdp":["Diskussion starten"],"qzVesX":["Beitrag bearbeiten"],"rAl91-":["Diese Diskussion löschen?"],"rdUucN":["Vorschau"],"tfDRzk":["Speichern"],"y-KXxN":["Akzeptierte Antwort"],"y6sq5j":["Gefolgt"],"z1qf6l":["Diskussion starten"]}');var messages3=JSON.parse('{"2Hlmdt":["Bir yanıt yazın…"],"3CApMv":["Tüm tartışmalar"],"3PqJQG":["Önizlenecek bir şey yok."],"4-S4QM":["Yanıt işaretini kaldır"],"5lWFkC":["Giriş yap"],"8wRl7c":["Açılış gönderisi silindi."],"99w-GZ":["Tartışma başlatmak için giriş yapın. Adınız gönderinizle birlikte gösterilir."],"F_vGso":["Yanıtınız"],"HkXOWm":["Bu yanıt silindi."],"Hw3P48":["Yanıtlar: ",["0"]],"ImOQa9":["Yanıtla"],"JfAIiv":["Bu tartışma kilitli. Yeni yanıt yazılamaz."],"Kl3TuI":["Biri yanıt yazdığında ya da bir yanıt kabul edildiğinde e-posta alın."],"Klsidc":["Bu yanıt silinsin mi?"],"MHrjPM":["Başlık"],"MKEPCY":["Takip et"],"NjUiZ4":["Bir soru sorun, bir fikir paylaşın ya da bu sayfadaki bir sorunu anlatın."],"NrGspR":["Teşekkürler! Tartışmanız ekip onayladığında herkese görünecek."],"OVijcR":["Oyunuzu geri alın (",["0"]," oy)"],"PL0621":["Bu tartışmada yanıt yazmak, oy vermek ve takip etmek için giriş yapın."],"PN38hZ":["Sorunuz ya da fikriniz"],"PZ_kxo":["Kalsın"],"Pwqkdw":["Yükleniyor…"],"RqsQKK":["İlk gönderileriniz herkese görünmeden önce ekip tarafından kontrol edilir."],"Sad2tK":["Gönderiliyor…"],"VGqKyv":["Bu tartışma artık mevcut değil."],"Vwy_nT":["Markdown desteklenir."],"YZayoP":["Teşekkürler! Yanıtınız ekip onayladığında herkese görünecek."],"cnGeoo":["Sil"],"dEgA5A":["Vazgeç"],"dNOvhg":["Oy ver (",["0"]," oy)"],"ePK91l":["Düzenle"],"i4_LY_":["Yaz"],"jhu92n":["Yanıt olarak işaretle"],"k4b5_X":["düzenlendi"],"n5vqdp":["Tartışmayı başlat"],"qzVesX":["Gönderinizi düzenleyin"],"rAl91-":["Bu tartışma silinsin mi?"],"rdUucN":["Önizleme"],"tfDRzk":["Kaydet"],"y-KXxN":["Kabul edilen yanıt"],"y6sq5j":["Takip ediliyor"],"z1qf6l":["Tartışma başlat"]}');var linkPattern=/\[([^\]\n]+)\]\(([^)\s]+)\)/g;function inline(text){let nodes=[],last=0;for(let match of text.matchAll(linkPattern)){let index=match.index??0;if(index>last)nodes.push(...inlineNodes(text.slice(last,index)));let[whole,label="",href=""]=match,url=null;try{url=new URL(href)}catch{}if(url&&(url.protocol==="http:"||url.protocol==="https:")){let a=document.createElement("a");a.href=url.href,a.target="_blank",a.rel="nofollow ugc noopener",a.append(...inlineNodes(label)),nodes.push(a)}else nodes.push(document.createTextNode(whole));last=index+whole.length}if(last<text.length)nodes.push(...inlineNodes(text.slice(last)));return nodes}function block(tag,lines){let element=document.createElement(tag);return element.append(...inline(lines.join(" "))),element}function preview(markdown){let fragment=document.createDocumentFragment(),lines=markdown.replace(/\r\n?/g,`
 `).split(`
 `),paragraph=[],list=null,quote=[],flush=()=>{if(paragraph.length)fragment.append(block("p",paragraph));if(quote.length){let element=document.createElement("blockquote");element.append(preview(quote.join(`
 `))),fragment.append(element)}paragraph=[],quote=[],list=null};for(let i=0;i<lines.length;i++){let line=lines[i]??"",fence=/^\s*(```|~~~)/.exec(line);if(fence){flush();let code=[];while(++i<lines.length&&!(lines[i]??"").trimStart().startsWith(fence[1]??"```"))code.push(lines[i]??"");let pre=document.createElement("pre");pre.append(Object.assign(document.createElement("code"),{textContent:code.join(`

package/dist/types/h3.d.ts

@@ -0,0 +1,36 @@
+import { type EventHandlerRequest, type EventHandlerWithFetch, type H3Event, type Middleware } from "h3";
+import type { ServerAnalytics, ServerEvent } from "./server/analytics.js";
+import { type IdentityClaims } from "./server/identity.js";
+import { type WebhookEvent, type WebhookEventType } from "./server/webhook.js";
+export interface YuvaContext {
+    track(event: ServerEvent): void;
+}
+declare module "h3" {
+    interface H3EventContext {
+        yuva?: YuvaContext;
+    }
+}
+type MaybePromise<T> = T | Promise<T>;
+export interface YuvaIdentityHandlerOptions {
+    secret: string;
+    user: (event: H3Event) => MaybePromise<IdentityClaims | null | undefined>;
+    ttl?: number;
+}
+export declare function defineYuvaIdentityHandler({ secret, user, ttl, }: YuvaIdentityHandlerOptions): EventHandlerWithFetch<EventHandlerRequest, Promise<Response>>;
+export type WebhookPayload<K extends WebhookEventType> = Extract<WebhookEvent, {
+    type: K;
+}>;
+export type YuvaWebhookHandlers = {
+    [K in WebhookEventType]?: (payload: WebhookPayload<K>, event: H3Event) => unknown;
+};
+export interface YuvaWebhookHandlerOptions {
+    secret: string;
+    tolerance?: number;
+    on: YuvaWebhookHandlers;
+}
+export declare function defineYuvaWebhookHandler({ secret, tolerance, on, }: YuvaWebhookHandlerOptions): EventHandlerWithFetch<EventHandlerRequest, Promise<Response>>;
+export interface YuvaAnalyticsOptions {
+    analytics: ServerAnalytics;
+}
+export declare function defineYuvaAnalytics({ analytics }: YuvaAnalyticsOptions): Middleware;
+export {};

package/dist/types/nitro/module.d.ts

@@ -0,0 +1,8 @@
+import type { NitroModule } from "nitro/types";
+import { type YuvaServerOptions } from "./setup.js";
+export interface YuvaNitroOptions extends YuvaServerOptions {
+    server?: string;
+}
+export declare function yuva(options?: YuvaNitroOptions): NitroModule;
+declare const _default: NitroModule;
+export default _default;

package/dist/types/nitro/runtime/core.d.ts

@@ -0,0 +1,41 @@
+import type { YuvaServer } from "./define.js";
+export interface YuvaServerRuntimeConfig {
+    server?: string;
+    identitySecret?: string;
+    webhookSecret?: string;
+    analytics?: {
+        apiKey?: string;
+        propertyId?: string;
+    };
+}
+export interface YuvaRuntimeConfig {
+    yuva?: YuvaServerRuntimeConfig;
+    public?: {
+        yuva?: {
+            server?: string;
+            analytics?: {
+                server?: string;
+            };
+        };
+    };
+}
+export interface YuvaHookEvent {
+    context: Record<string, unknown>;
+}
+export interface YuvaHooks {
+    hook(name: string, fn: (...args: never[]) => unknown): unknown;
+}
+export interface YuvaAdapter {
+    server: YuvaServer<YuvaHookEvent>;
+    config(): YuvaRuntimeConfig;
+    defineHandler(handler: (event: YuvaHookEvent) => Promise<Response>): unknown;
+    toRequest(event: YuvaHookEvent): Request;
+    trackRequest(event: YuvaHookEvent): Request;
+    onResponse(hooks: YuvaHooks, fn: (event: YuvaHookEvent) => void): void;
+    waitUntil(event: YuvaHookEvent): ((promise: Promise<unknown>) => void) | undefined;
+}
+export declare function identityHandler(yuva: YuvaAdapter): unknown;
+export declare function webhookHandler(yuva: YuvaAdapter): unknown;
+export declare function analyticsPlugin(yuva: YuvaAdapter): (nitroApp: {
+    hooks: YuvaHooks;
+}) => void;

package/dist/types/nitro/runtime/define.d.ts

@@ -0,0 +1,21 @@
+import type { IdentityClaims, ServerEvent, WebhookEvent, WebhookEventType } from "../../server.js";
+export interface YuvaServerTypes {
+}
+export type YuvaServerEvent = YuvaServerTypes extends {
+    event: infer E;
+} ? E : import("h3").H3Event;
+type MaybePromise<T> = T | Promise<T>;
+export type YuvaServerWebhooks<E = YuvaServerEvent> = {
+    [K in WebhookEventType]?: (payload: Extract<WebhookEvent, {
+        type: K;
+    }>, event: E) => unknown;
+};
+export interface YuvaServer<E = YuvaServerEvent> {
+    user?: (event: E) => MaybePromise<IdentityClaims | null | undefined>;
+    webhooks?: YuvaServerWebhooks<E>;
+}
+export interface YuvaContext {
+    track(event: ServerEvent): void;
+}
+export declare function defineYuvaServer<E = YuvaServerEvent>(server: YuvaServer<E>): YuvaServer<E>;
+export {};

package/dist/types/nitro/setup.d.ts

@@ -0,0 +1,36 @@
+import type { YuvaServerRuntimeConfig } from "./runtime/core.js";
+export type { YuvaServerRuntimeConfig };
+export declare const IDENTITY_ROUTE = "/_yuva/identity";
+export declare const WEBHOOK_ROUTE = "/_yuva/webhook";
+export declare const SERVER_MODULE = "#yuva/server";
+export interface YuvaServerOptions {
+    identitySecret?: string;
+    webhookSecret?: string;
+    analytics?: {
+        apiKey?: string;
+        propertyId?: string;
+    };
+}
+export interface YuvaServerParts {
+    identity: boolean;
+    webhook: boolean;
+    analytics: boolean;
+}
+export declare function serverRuntimeConfig(current: YuvaServerRuntimeConfig | undefined, options: YuvaServerOptions & {
+    server?: string;
+}): Required<Omit<YuvaServerRuntimeConfig, "analytics">> & {
+    analytics: {
+        apiKey: string;
+        propertyId: string;
+    };
+};
+export declare function serverParts(config: YuvaServerRuntimeConfig, env: Record<string, string | undefined>, prefix: string): YuvaServerParts;
+export declare function findServerFile(dir: string): string | undefined;
+export declare function runtimePath(name: "identity" | "webhook" | "plugin"): string;
+export interface ServerModuleOptions {
+    nitro: number;
+    server: string | undefined;
+    runtimeConfig: string;
+    h3?: string;
+}
+export declare function serverModule({ nitro, server, runtimeConfig, h3 }: ServerModuleOptions): string;

package/dist/types/nuxt/module.d.ts

@@ -1,18 +1,32 @@
 import type { AnalyticsOptions } from "../analytics.js";
+import { type YuvaServerRuntimeConfig } from "../nitro/setup.js";
 export interface AnalyticsModuleOptions extends Omit<AnalyticsOptions, "server"> {
     server?: string;
+    apiKey?: string;
+    propertyId?: string;
 }
+export type PublicAnalyticsOptions = Omit<AnalyticsModuleOptions, "apiKey" | "propertyId">;
 export interface ModuleOptions {
     server?: string;
     channel?: string;
     locale?: string;
     analytics?: AnalyticsModuleOptions;
+    identitySecret?: string;
+    webhookSecret?: string;
+}
+export interface PublicModuleConfig {
+    server: string;
+    channel: string;
+    locale: string;
+    identity: string;
+    analytics?: PublicAnalyticsOptions;
 }
 declare module "@nuxt/schema" {
     interface PublicRuntimeConfig {
-        yuva: Required<Omit<ModuleOptions, "analytics">> & {
-            analytics?: AnalyticsModuleOptions;
-        };
+        yuva: PublicModuleConfig;
+    }
+    interface RuntimeConfig {
+        yuva?: YuvaServerRuntimeConfig;
     }
 }
 declare const _default: import("@nuxt/schema").NuxtModule<ModuleOptions, ModuleOptions, false>;

package/dist/types/server/analytics.d.ts

@@ -0,0 +1,52 @@
+export declare const MAX_BATCH = 100;
+export interface ServerAnalyticsConfig {
+    server: string;
+    apiKey: string;
+    propertyId: string;
+    fetch?: typeof fetch;
+    flushInterval?: number;
+    queueSize?: number;
+    maxRetries?: number;
+    minBackoff?: number;
+    clientIP?: (request: Request) => string | null | undefined;
+    onError?: (error: Error) => void;
+}
+export interface ServerEvent {
+    name: string;
+    url?: string;
+    referrer?: string;
+    time?: Date;
+    props?: Record<string, string | number | boolean>;
+    revenue?: {
+        amount: string;
+        currency: string;
+    };
+    nonInteractive?: boolean;
+    consent?: boolean;
+    ip?: string;
+    userAgent?: string;
+    secChUaPlatform?: string;
+    secChUaMobile?: string;
+    acceptLanguage?: string;
+    visitorKey?: string;
+    persistentId?: string;
+    identityToken?: string;
+}
+export interface ServerAnalytics {
+    track(request: Request, event: ServerEvent): void;
+    send(event: ServerEvent): void;
+    flush(): Promise<Error | undefined>;
+    close(): Promise<Error | undefined>;
+}
+export declare class AnalyticsEventError extends Error {
+    readonly event: ServerEvent;
+    readonly detail: string;
+    constructor(event: ServerEvent, detail: string);
+}
+export declare class AnalyticsBatchError extends Error {
+    readonly status: number;
+    readonly body: string;
+    readonly events: number;
+    constructor(events: number, status: number, body: string, cause?: unknown);
+}
+export declare function createAnalytics(config: ServerAnalyticsConfig): ServerAnalytics;

package/dist/types/server/encoding.d.ts

@@ -0,0 +1,6 @@
+export declare const utf8: (text: string) => Uint8Array<ArrayBuffer>;
+export declare function base64(bytes: Uint8Array): string;
+export declare const base64url: (bytes: Uint8Array) => string;
+export declare function decodeBase64(text: string): Uint8Array<ArrayBuffer> | undefined;
+export declare const hmacKey: (key: Uint8Array<ArrayBuffer>, usages: KeyUsage[]) => Promise<CryptoKey>;
+export declare function goJSON(value: unknown): string | undefined;

package/dist/types/server/identity.d.ts

@@ -0,0 +1,14 @@
+export declare const DEFAULT_IDENTITY_TTL = 300;
+export declare const MAX_IDENTITY_TTL = 600;
+export interface IdentityClaims {
+    subject: string;
+    email?: string;
+    emailVerified?: boolean;
+    name?: string;
+    locale?: string;
+    attrs?: Record<string, unknown>;
+    id?: string;
+    issuedAt?: Date;
+    ttl?: number;
+}
+export declare function signIdentityToken(secret: string, claims: IdentityClaims): Promise<string>;

package/dist/types/server/webhook.d.ts

@@ -0,0 +1,28 @@
+import type { webhooks } from "../schema.gen.js";
+type Payload<K extends keyof webhooks> = webhooks[K]["post"] extends {
+    requestBody: {
+        content: {
+            "application/json": infer Body;
+        };
+    };
+} ? Body : never;
+export type WebhookEventType = keyof webhooks;
+export type WebhookEvent = {
+    [K in WebhookEventType]: Omit<Payload<K>, "type"> & {
+        type: K;
+    };
+}[WebhookEventType];
+export declare const DEFAULT_WEBHOOK_TOLERANCE = 300;
+export type WebhookErrorCode = "invalid_secret" | "missing_headers" | "invalid_timestamp" | "timestamp_too_old" | "timestamp_too_new" | "invalid_signature";
+export declare class WebhookVerificationError extends Error {
+    readonly code: WebhookErrorCode;
+    constructor(code: WebhookErrorCode);
+}
+export interface VerifyWebhookOptions {
+    tolerance?: number;
+    now?: Date;
+}
+export declare function signWebhook(secret: string, id: string, timestamp: Date, body: string | Uint8Array): Promise<string>;
+export declare function verifyWebhookBody(secret: string, headers: Headers, body: Uint8Array, { tolerance, now }?: VerifyWebhookOptions): Promise<void>;
+export declare function verifyWebhook<T = WebhookEvent>(secret: string, request: Request, options?: VerifyWebhookOptions): Promise<T>;
+export {};

package/dist/types/server.d.ts

@@ -0,0 +1,3 @@
+export { DEFAULT_IDENTITY_TTL, MAX_IDENTITY_TTL, signIdentityToken, type IdentityClaims } from "./server/identity.js";
+export { DEFAULT_WEBHOOK_TOLERANCE, signWebhook, verifyWebhook, verifyWebhookBody, WebhookVerificationError, type VerifyWebhookOptions, type WebhookErrorCode, type WebhookEvent, type WebhookEventType, } from "./server/webhook.js";
+export { AnalyticsBatchError, AnalyticsEventError, createAnalytics, MAX_BATCH, type ServerAnalytics, type ServerAnalyticsConfig, type ServerEvent, } from "./server/analytics.js";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "useyuva",
-  "version": "0.0.13",
-  "description": "Yuva for the web: a headless client for contacts, the <yuva-chat> element, documentation page feedback and discussions, the <yuva-subscribe> mailing list form, cookieless web analytics, React hooks, a Nuxt module and a typed /v1 client.",
+  "version": "0.0.14",
+  "description": "Yuva for the web: a headless client for contacts, the <yuva-chat> element, documentation page feedback and discussions, the <yuva-subscribe> mailing list form, cookieless web analytics, React hooks, a Nuxt module, a typed /v1 client and server helpers for identity tokens, webhooks and server-side analytics.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -17,6 +17,7 @@
     "web-component",
     "customer-messaging",
     "nuxt",
+    "nitro",
     "newsletter",
     "analytics"
   ],
@@ -61,6 +62,14 @@
       "types": "./dist/types/api.d.ts",
       "default": "./dist/esm/api.js"
     },
+    "./server": {
+      "types": "./dist/types/server.d.ts",
+      "default": "./dist/esm/server.js"
+    },
+    "./h3": {
+      "types": "./dist/types/h3.d.ts",
+      "default": "./dist/esm/h3.js"
+    },
     "./nuxt": {
       "types": "./dist/types/nuxt/module.d.ts",
       "default": "./dist/esm/nuxt/module.js"
@@ -77,6 +86,14 @@
       "types": "./dist/types/nuxt/runtime/plugin.d.ts",
       "default": "./dist/esm/nuxt/runtime/plugin.js"
     },
+    "./nitro": {
+      "types": "./dist/types/nitro/module.d.ts",
+      "default": "./dist/esm/nitro/module.js"
+    },
+    "./nitro/runtime": {
+      "types": "./dist/types/nitro/runtime/define.d.ts",
+      "default": "./dist/esm/nitro/runtime/define.js"
+    },
     "./package.json": "./package.json"
   },
   "types": "./dist/types/index.d.ts",
@@ -105,6 +122,7 @@
   },
   "peerDependencies": {
     "@nuxt/kit": ">=3.15.0",
+    "h3": "^2.0.0",
     "react": ">=18",
     "vue": ">=3.5.0"
   },
@@ -112,6 +130,9 @@
     "@nuxt/kit": {
       "optional": true
     },
+    "h3": {
+      "optional": true
+    },
     "react": {
       "optional": true
     },
@@ -130,7 +151,10 @@
     "@types/bun": "^1.4.2",
     "@types/react": "19.2.2",
     "@types/react-dom": "19.2.2",
+    "h3": "2.0.2",
+    "h3-v1": "npm:h3@1.15.11",
     "happy-dom": "^20.14.5",
+    "nitro": "3.0.260903-beta",
     "oxfmt": "0.72.0",
     "oxlint": "1.87.0",
     "react": "19.2.0",