@agg-build/sdk 1.2.0 → 1.2.13

package/dist/server.d.ts

@@ -12,6 +12,16 @@ interface VerifyWebhookOptions {
 }
 declare function verifyWebhook(payload: string, headers: Record<string, string | string[] | undefined>, secret: string, options?: VerifyWebhookOptions): void;
 declare function parseWebhookEvent(payload: string, headers: Record<string, string | string[] | undefined>, secret: string, options?: VerifyWebhookOptions): WebhookEvent;
+/**
+ * Async, edge-runtime-friendly variant of {@link verifyWebhook}. Same
+ * Svix v1 signing scheme. Use this in Cloudflare Workers / Vercel Edge /
+ * Deno / Bun. The sync variant remains available for Node.js consumers.
+ */
+declare function verifyWebhookAsync(payload: string, headers: Record<string, string | string[] | undefined>, secret: string, options?: VerifyWebhookOptions): Promise<void>;
+/**
+ * Async, edge-runtime-friendly variant of {@link parseWebhookEvent}.
+ */
+declare function parseWebhookEventAsync(payload: string, headers: Record<string, string | string[] | undefined>, secret: string, options?: VerifyWebhookOptions): Promise<WebhookEvent>;
 interface WebhookEventBase {
     id: string;
     createdAt: string;
@@ -21,6 +31,8 @@ interface AccountsCreatedEvent extends WebhookEventBase {
     data: {
         userId: string;
         appId: string;
+        createdAt: string;
+        email: string | null;
     };
 }
 interface AccountsLinkedEvent extends WebhookEventBase {
@@ -37,6 +49,7 @@ interface WalletsReadyEvent extends WebhookEventBase {
         userId: string;
         evmAddress: string;
         svmAddress: string;
+        createdAt: string;
     };
 }
 interface TradesPlacedEvent extends WebhookEventBase {
@@ -45,8 +58,16 @@ interface TradesPlacedEvent extends WebhookEventBase {
         orderId: string;
         userId: string;
         side: string;
-        venue: string;
-        venueMarketId: string;
+        timestamp: string;
+        /**
+         * @deprecated Never emitted by the server in 1.x — the SDK type lied
+         * here for several releases. Reads always return `undefined`. The field
+         * is retained as `undefined`-typed for one minor release so existing
+         * partner code that destructures it keeps compiling; remove in 2.0.
+         */
+        venue?: undefined;
+        /** @deprecated See `venue`. */
+        venueMarketId?: undefined;
     };
 }
 interface TradesFilledEvent extends WebhookEventBase {
@@ -55,16 +76,49 @@ interface TradesFilledEvent extends WebhookEventBase {
         orderId: string;
         userId: string;
         status: string;
-        fillPrice: number;
-        fillSize: number;
+        timestamp: string;
+        /**
+         * Post-execution accuracy data. All `*Raw` values are decimal strings in
+         * 6-decimal atomic units. `*PriceRaw` are decimal strings (e.g. "0.5").
+         * `partialFillReason` is set only on `status === "partial_fill"`.
+         */
+        filledAmountRaw?: string;
+        quotedSharesRaw?: string;
+        actualSharesRaw?: string;
+        quotedToWinRaw?: string;
+        actualToWinRaw?: string;
+        quotedPriceRaw?: string;
+        executionPriceRaw?: string;
+        partialFillReason?: string;
+        /** @deprecated See `executionPriceRaw` — never emitted; remove in 2.0. */
+        fillPrice?: undefined;
+        /** @deprecated See `actualSharesRaw` / `filledAmountRaw` — never emitted; remove in 2.0. */
+        fillSize?: undefined;
     };
 }
 interface MarketsResolvedEvent extends WebhookEventBase {
     type: "markets.resolved";
     data: {
         venueMarketId: string;
-        outcome: string;
+        externalIdentifier: string;
+        status: string;
+        outcomes: Array<{
+            label: string;
+            winner?: boolean;
+            externalIdentifier?: string;
+        }>;
         affectedUsersCount: number;
+        /**
+         * Path on the AGG API where this resolution's affected users can be
+         * paginated. Combine with the configured base URL — e.g.
+         * `https://api.agg.market${detailsPath}`.
+         */
+        detailsPath: string;
+        /**
+         * @deprecated Singular `outcome` was never emitted; use `outcomes` array.
+         * Remove in 2.0.
+         */
+        outcome?: undefined;
     };
 }
 interface UnknownWebhookEvent extends WebhookEventBase {
@@ -118,7 +172,9 @@ declare class AggAdminClient {
         ordersByStatus: Record<string, number>;
         ordersByVenue: Record<string, number>;
         usersLast30Days: number;
+        usersLast7Days: number;
         ordersLast30Days: number;
+        ordersLast7Days: number;
     }>;
     listOrders(appId: string, query?: {
         limit?: number;
@@ -152,4 +208,4 @@ declare class AggAdminClient {
     }>;
 }
 
-export { type AccountsCreatedEvent, type AccountsLinkedEvent, AggAdminClient, type AggAdminClientOptions, type ExternalIdAssertion, type KnownWebhookEvent, type MarketsResolvedEvent, type TradesFilledEvent, type TradesPlacedEvent, type UnknownWebhookEvent, type VerifyWebhookOptions, type WalletsReadyEvent, type WebhookEvent, WebhookVerificationError, parseWebhookEvent, signExternalId, verifyWebhook };
+export { type AccountsCreatedEvent, type AccountsLinkedEvent, AggAdminClient, type AggAdminClientOptions, type ExternalIdAssertion, type KnownWebhookEvent, type MarketsResolvedEvent, type TradesFilledEvent, type TradesPlacedEvent, type UnknownWebhookEvent, type VerifyWebhookOptions, type WalletsReadyEvent, type WebhookEvent, WebhookVerificationError, parseWebhookEvent, parseWebhookEventAsync, signExternalId, verifyWebhook, verifyWebhookAsync };

package/dist/server.js

@@ -60,8 +60,10 @@ __export(server_exports, {
   AggAdminClient: () => AggAdminClient,
   WebhookVerificationError: () => WebhookVerificationError,
   parseWebhookEvent: () => parseWebhookEvent,
+  parseWebhookEventAsync: () => parseWebhookEventAsync,
   signExternalId: () => signExternalId,
-  verifyWebhook: () => verifyWebhook
+  verifyWebhook: () => verifyWebhook,
+  verifyWebhookAsync: () => verifyWebhookAsync
 });
 module.exports = __toCommonJS(server_exports);
 var import_node_crypto = require("crypto");
@@ -74,6 +76,22 @@ function signExternalId(appSecret, externalId) {
     hmac
   };
 }
+var textEncoder = new TextEncoder();
+function base64Decode(s) {
+  const bin = atob(s);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function importHmacKey(secret) {
+  return __async(this, null, function* () {
+    const keyBytes = base64Decode(secret.replace(/^whsec_/, ""));
+    return crypto.subtle.importKey("raw", keyBytes, { name: "HMAC", hash: "SHA-256" }, false, [
+      "sign",
+      "verify"
+    ]);
+  });
+}
 var WebhookVerificationError = class extends Error {
   constructor(message) {
     super(message);
@@ -113,6 +131,45 @@ function parseWebhookEvent(payload, headers, secret, options) {
   const parsed = JSON.parse(payload);
   return parsed;
 }
+function verifyWebhookAsync(payload, headers, secret, options) {
+  return __async(this, null, function* () {
+    var _a;
+    const tolerance = (_a = options == null ? void 0 : options.toleranceSeconds) != null ? _a : 300;
+    const msgId = getHeader(headers, "webhook-id");
+    const timestamp = getHeader(headers, "webhook-timestamp");
+    const signatures = getHeader(headers, "webhook-signature");
+    if (!msgId) throw new WebhookVerificationError("Missing Webhook-Id header");
+    if (!timestamp) throw new WebhookVerificationError("Missing Webhook-Timestamp header");
+    if (!signatures) throw new WebhookVerificationError("Missing Webhook-Signature header");
+    const ts = parseInt(timestamp, 10);
+    if (isNaN(ts)) throw new WebhookVerificationError("Invalid Webhook-Timestamp");
+    const now = Math.floor(Date.now() / 1e3);
+    if (Math.abs(now - ts) > tolerance) {
+      throw new WebhookVerificationError("Webhook timestamp outside tolerance window");
+    }
+    const key = yield importHmacKey(secret);
+    const signed = textEncoder.encode(`${msgId}.${timestamp}.${payload}`);
+    for (const sig of signatures.split(" ")) {
+      if (!sig.startsWith("v1,")) continue;
+      let sigBytes;
+      try {
+        sigBytes = base64Decode(sig.slice(3));
+      } catch (e) {
+        continue;
+      }
+      const ok = yield crypto.subtle.verify("HMAC", key, sigBytes, signed);
+      if (ok) return;
+    }
+    throw new WebhookVerificationError("Invalid webhook signature");
+  });
+}
+function parseWebhookEventAsync(payload, headers, secret, options) {
+  return __async(this, null, function* () {
+    yield verifyWebhookAsync(payload, headers, secret, options);
+    const parsed = JSON.parse(payload);
+    return parsed;
+  });
+}
 var AggAdminClient = class {
   constructor(options) {
     this.baseUrl = options.baseUrl.replace(/\/$/, "");
@@ -249,6 +306,8 @@ function getHeader(headers, name) {
   AggAdminClient,
   WebhookVerificationError,
   parseWebhookEvent,
+  parseWebhookEventAsync,
   signExternalId,
-  verifyWebhook
+  verifyWebhook,
+  verifyWebhookAsync
 });

package/dist/server.mjs

@@ -15,6 +15,22 @@ function signExternalId(appSecret, externalId) {
     hmac
   };
 }
+var textEncoder = new TextEncoder();
+function base64Decode(s) {
+  const bin = atob(s);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function importHmacKey(secret) {
+  return __async(this, null, function* () {
+    const keyBytes = base64Decode(secret.replace(/^whsec_/, ""));
+    return crypto.subtle.importKey("raw", keyBytes, { name: "HMAC", hash: "SHA-256" }, false, [
+      "sign",
+      "verify"
+    ]);
+  });
+}
 var WebhookVerificationError = class extends Error {
   constructor(message) {
     super(message);
@@ -54,6 +70,45 @@ function parseWebhookEvent(payload, headers, secret, options) {
   const parsed = JSON.parse(payload);
   return parsed;
 }
+function verifyWebhookAsync(payload, headers, secret, options) {
+  return __async(this, null, function* () {
+    var _a;
+    const tolerance = (_a = options == null ? void 0 : options.toleranceSeconds) != null ? _a : 300;
+    const msgId = getHeader(headers, "webhook-id");
+    const timestamp = getHeader(headers, "webhook-timestamp");
+    const signatures = getHeader(headers, "webhook-signature");
+    if (!msgId) throw new WebhookVerificationError("Missing Webhook-Id header");
+    if (!timestamp) throw new WebhookVerificationError("Missing Webhook-Timestamp header");
+    if (!signatures) throw new WebhookVerificationError("Missing Webhook-Signature header");
+    const ts = parseInt(timestamp, 10);
+    if (isNaN(ts)) throw new WebhookVerificationError("Invalid Webhook-Timestamp");
+    const now = Math.floor(Date.now() / 1e3);
+    if (Math.abs(now - ts) > tolerance) {
+      throw new WebhookVerificationError("Webhook timestamp outside tolerance window");
+    }
+    const key = yield importHmacKey(secret);
+    const signed = textEncoder.encode(`${msgId}.${timestamp}.${payload}`);
+    for (const sig of signatures.split(" ")) {
+      if (!sig.startsWith("v1,")) continue;
+      let sigBytes;
+      try {
+        sigBytes = base64Decode(sig.slice(3));
+      } catch (e) {
+        continue;
+      }
+      const ok = yield crypto.subtle.verify("HMAC", key, sigBytes, signed);
+      if (ok) return;
+    }
+    throw new WebhookVerificationError("Invalid webhook signature");
+  });
+}
+function parseWebhookEventAsync(payload, headers, secret, options) {
+  return __async(this, null, function* () {
+    yield verifyWebhookAsync(payload, headers, secret, options);
+    const parsed = JSON.parse(payload);
+    return parsed;
+  });
+}
 var AggAdminClient = class {
   constructor(options) {
     this.baseUrl = options.baseUrl.replace(/\/$/, "");
@@ -189,6 +244,8 @@ export {
   AggAdminClient,
   WebhookVerificationError,
   parseWebhookEvent,
+  parseWebhookEventAsync,
   signExternalId,
-  verifyWebhook
+  verifyWebhook,
+  verifyWebhookAsync
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agg-build/sdk",
-  "version": "1.2.0",
+  "version": "1.2.13",
   "description": "Vanilla TypeScript client for the AGG prediction market aggregator (auth, markets, orderbooks, charts, trading, managed execution, WebSockets). Works in browsers, Node.js, and React Native.",
   "sideEffects": false,
   "license": "MIT",