@agg-build/sdk 1.2.11 → 1.3.0

package/dist/index.mjs

@@ -727,7 +727,14 @@ var AggWebSocket = class {
     this.pendingFlushUnsubs = /* @__PURE__ */ new Set();
     this.pendingFlushTradeSubs = /* @__PURE__ */ new Set();
     this.pendingFlushTradeUnsubs = /* @__PURE__ */ new Set();
+    this.pendingFlushArbSubs = /* @__PURE__ */ new Set();
+    this.pendingFlushArbUnsubs = /* @__PURE__ */ new Set();
     this.flushScheduled = false;
+    // ── Arb subscriptions ──
+    this.arbSubs = /* @__PURE__ */ new Map();
+    this.arbFeedCbs = /* @__PURE__ */ new Set();
+    /** Latest arb market update per marketId (last-value-wins, loss-tolerant). */
+    this.latestArb = /* @__PURE__ */ new Map();
     // ── Orderbook state per market ──
     this.books = /* @__PURE__ */ new Map();
     /** Markets currently resyncing (awaiting snapshot after seq gap / checksum mismatch). */
@@ -759,6 +766,69 @@ var AggWebSocket = class {
   isResyncing(outcomeId) {
     return this.resyncing.has(outcomeId);
   }
+  /** Get the latest arb update for a market (or null if none received yet). */
+  getArb(marketId) {
+    var _a;
+    return (_a = this.latestArb.get(marketId)) != null ? _a : null;
+  }
+  /**
+   * Subscribe to per-market arb updates for a given marketId.
+   * Ref-counted: multiple callers for the same marketId share one server subscription.
+   * Returns an unsubscribe function.
+   */
+  subscribeArb(marketId, cb) {
+    let entry = this.arbSubs.get(marketId);
+    if (!entry) {
+      entry = { refCount: 0, cbs: /* @__PURE__ */ new Set() };
+      this.arbSubs.set(marketId, entry);
+      this.ensureConnected();
+      if (this._connected) {
+        this.pendingFlushArbUnsubs.delete(marketId);
+        this.pendingFlushArbSubs.add(marketId);
+        this.scheduleFlush();
+      }
+    }
+    entry.cbs.add(cb);
+    entry.refCount++;
+    return () => {
+      const e = this.arbSubs.get(marketId);
+      if (!e) return;
+      e.cbs.delete(cb);
+      e.refCount--;
+      if (e.refCount <= 0) {
+        this.arbSubs.delete(marketId);
+        if (this._connected) {
+          if (this.pendingFlushArbSubs.has(marketId)) {
+            this.pendingFlushArbSubs.delete(marketId);
+          } else {
+            this.pendingFlushArbUnsubs.add(marketId);
+            this.scheduleFlush();
+          }
+        }
+      }
+    };
+  }
+  /**
+   * Subscribe to the global arb-feed batches.
+   * Only one server subscription is maintained regardless of how many callers.
+   * Returns an unsubscribe function.
+   */
+  subscribeArbFeed(cb) {
+    const wasEmpty = this.arbFeedCbs.size === 0;
+    this.arbFeedCbs.add(cb);
+    if (wasEmpty) {
+      this.ensureConnected();
+      if (this._connected) {
+        this.send({ action: "subscribe", channel: "arb-feed" });
+      }
+    }
+    return () => {
+      this.arbFeedCbs.delete(cb);
+      if (this.arbFeedCbs.size === 0 && this._connected) {
+        this.send({ action: "unsubscribe", channel: "arb-feed" });
+      }
+    };
+  }
   /**
    * Subscribe to a feed by outcome ID.
    * @param outcomeId  The venueMarketOutcomeId to subscribe to.
@@ -896,6 +966,11 @@ var AggWebSocket = class {
     this.pendingFlushUnsubs.clear();
     this.pendingFlushTradeSubs.clear();
     this.pendingFlushTradeUnsubs.clear();
+    this.arbSubs.clear();
+    this.arbFeedCbs.clear();
+    this.latestArb.clear();
+    this.pendingFlushArbSubs.clear();
+    this.pendingFlushArbUnsubs.clear();
     this.flushScheduled = false;
   }
   /** Update callbacks (e.g., after React re-render). */
@@ -941,7 +1016,7 @@ var AggWebSocket = class {
       if (wasConnected) {
         (_b = (_a = this.callbacks).onConnectionStateChange) == null ? void 0 : _b.call(_a, false);
       }
-      if (!this.destroyed && this.subs.size > 0) {
+      if (!this.destroyed && (this.subs.size > 0 || this.arbSubs.size > 0 || this.arbFeedCbs.size > 0)) {
         this.scheduleReconnect();
       }
     };
@@ -986,7 +1061,7 @@ var AggWebSocket = class {
   }
   // ── Message handling ──
   handleMessage(raw) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p;
     const type = raw.type;
     switch (type) {
       case "orderbook_snapshot":
@@ -1034,6 +1109,22 @@ var AggWebSocket = class {
       case "withdrawal_lifecycle":
         (_l = (_k = this.callbacks).onWithdrawalLifecycle) == null ? void 0 : _l.call(_k, raw);
         break;
+      case "arb_market_update": {
+        const arbMsg = raw;
+        this.latestArb.set(arbMsg.marketId, arbMsg);
+        const arbEntry = this.arbSubs.get(arbMsg.marketId);
+        if (arbEntry) {
+          for (const cb of arbEntry.cbs) cb(arbMsg);
+        }
+        (_n = (_m = this.callbacks).onArbMarket) == null ? void 0 : _n.call(_m, arbMsg);
+        break;
+      }
+      case "arb_feed_batch": {
+        const feedMsg = raw;
+        for (const cb of this.arbFeedCbs) cb(feedMsg);
+        (_p = (_o = this.callbacks).onArbFeed) == null ? void 0 : _p.call(_o, feedMsg);
+        break;
+      }
     }
   }
   /**
@@ -1070,6 +1161,17 @@ var AggWebSocket = class {
       this.send({ action: "resnapshot", channel: "orderbook", outcomeIds: resnapshotIds });
     }
     this.pendingResnapshots.clear();
+    const arbSet = new Set(this.activeArbMarkets());
+    this.pendingFlushArbSubs.forEach((id) => arbSet.add(id));
+    const arbIds = Array.from(arbSet);
+    if (arbIds.length > 0) {
+      this.send({ action: "subscribe", channel: "arb", marketIds: arbIds });
+    }
+    this.pendingFlushArbSubs.clear();
+    this.pendingFlushArbUnsubs.clear();
+    if (this.arbFeedCbs.size > 0) {
+      this.send({ action: "subscribe", channel: "arb-feed" });
+    }
   }
   handleSnapshot(raw) {
     var _a, _b;
@@ -1241,6 +1343,8 @@ var AggWebSocket = class {
         this.pendingFlushUnsubs.clear();
         this.pendingFlushTradeSubs.clear();
         this.pendingFlushTradeUnsubs.clear();
+        this.pendingFlushArbSubs.clear();
+        this.pendingFlushArbUnsubs.clear();
         return;
       }
       this.flushPending();
@@ -1287,6 +1391,28 @@ var AggWebSocket = class {
       });
       this.pendingFlushTradeUnsubs.clear();
     }
+    for (const id of [...this.pendingFlushArbSubs]) {
+      if (this.pendingFlushArbUnsubs.has(id)) {
+        this.pendingFlushArbSubs.delete(id);
+        this.pendingFlushArbUnsubs.delete(id);
+      }
+    }
+    if (this.pendingFlushArbSubs.size > 0) {
+      this.send({
+        action: "subscribe",
+        channel: "arb",
+        marketIds: Array.from(this.pendingFlushArbSubs)
+      });
+      this.pendingFlushArbSubs.clear();
+    }
+    if (this.pendingFlushArbUnsubs.size > 0) {
+      this.send({
+        action: "unsubscribe",
+        channel: "arb",
+        marketIds: Array.from(this.pendingFlushArbUnsubs)
+      });
+      this.pendingFlushArbUnsubs.clear();
+    }
   }
   sendSubscribe(outcomeIds) {
     this.send({ action: "subscribe", channel: "orderbook", outcomeIds });
@@ -1311,6 +1437,9 @@ var AggWebSocket = class {
     });
     return markets;
   }
+  activeArbMarkets() {
+    return Array.from(this.arbSubs.keys());
+  }
   emitDiagnostic(event) {
     var _a, _b;
     (_b = (_a = this.callbacks).onDiagnostics) == null ? void 0 : _b.call(_a, event);
@@ -1992,6 +2121,7 @@ Issued At: ${issuedAt}`;
       if (params.orderId) query.orderId = params.orderId;
       if (params.quoteId) query.quoteId = params.quoteId;
       if (params.status) query.status = params.status;
+      if (params.mode) query.mode = params.mode;
       if (params.cursor) query.cursor = params.cursor;
       if (params.limit != null) query.limit = String(params.limit);
       return this.request("/execution/orders", {
@@ -2018,6 +2148,7 @@ Issued At: ${issuedAt}`;
       if (params.cursor) query.cursor = params.cursor;
       if (params.limit != null) query.limit = String(params.limit);
       if (params.status) query.status = params.status;
+      if (params.mode) query.mode = params.mode;
       return this.request("/execution/positions", {
         query: Object.keys(query).length ? query : void 0
       });
@@ -2025,8 +2156,12 @@ Issued At: ${issuedAt}`;
   }
   /** Get managed wallet balances, including per-chain cash balances and per-venue position balances. */
   getManagedBalances() {
-    return __async(this, null, function* () {
-      return this.request("/execution/balances");
+    return __async(this, arguments, function* (params = {}) {
+      const query = {};
+      if (params.mode) query.mode = params.mode;
+      return this.request("/execution/balances", {
+        query: Object.keys(query).length ? query : void 0
+      });
     });
   }
   /** Cancel a pending managed execution by order id. */
@@ -2057,6 +2192,7 @@ Issued At: ${issuedAt}`;
       if ((options == null ? void 0 : options.status) && options.status.length > 0) query.status = options.status;
       if (options == null ? void 0 : options.sortBy) query.sortBy = options.sortBy;
       if (options == null ? void 0 : options.sortDir) query.sortDir = options.sortDir;
+      if (options == null ? void 0 : options.recurrence) query.recurrence = options.recurrence;
       if ((options == null ? void 0 : options.limit) != null) query.limit = String(options.limit);
       if (options == null ? void 0 : options.cursor) query.cursor = options.cursor;
       if ((options == null ? void 0 : options.minYesPrice) != null) query.minYesPrice = String(options.minYesPrice);
@@ -2102,6 +2238,7 @@ Issued At: ${issuedAt}`;
       const query = {};
       if ((options == null ? void 0 : options.limit) != null) query.limit = String(options.limit);
       if (options == null ? void 0 : options.cursor) query.cursor = options.cursor;
+      if (options == null ? void 0 : options.parentId) query.parentId = options.parentId;
       return this.request("/categories", {
         query: Object.keys(query).length > 0 ? query : void 0
       });
@@ -2259,7 +2396,7 @@ Issued At: ${issuedAt}`;
    */
   getSmartRoute(params, options) {
     return __async(this, null, function* () {
-      var _a, _b;
+      var _a, _b, _c;
       const venueMarketOutcomeId = (_b = (_a = params.venueMarketOutcomeId) != null ? _a : params.venueMarketId) != null ? _b : params.outcomeId;
       if (!venueMarketOutcomeId) {
         throw new Error("getSmartRoute requires venueMarketOutcomeId");
@@ -2270,7 +2407,9 @@ Issued At: ${issuedAt}`;
       if (params.chainBalances) query.chainBalances = JSON.stringify(params.chainBalances);
       if (params.slipCapBps != null) query.slipCapBps = String(params.slipCapBps);
       if (params.compareVenues) query.compareVenues = "true";
+      if ((_c = params.allowedVenues) == null ? void 0 : _c.length) query.allowedVenues = params.allowedVenues.map(String);
       if (params.tradeSide) query.side = params.tradeSide;
+      if (params.mode) query.mode = params.mode;
       if (params.deepEstimate) query.deepEstimate = "true";
       const response = yield this.request(
         `/orderbook/${encodeURIComponent(venueMarketOutcomeId)}/route`,
@@ -2372,6 +2511,7 @@ Issued At: ${issuedAt}`;
       if (params == null ? void 0 : params.cursor) query.cursor = params.cursor;
       if ((params == null ? void 0 : params.limit) != null) query.limit = String(params.limit);
       if (params == null ? void 0 : params.status) query.status = params.status;
+      if (params == null ? void 0 : params.mode) query.mode = params.mode;
       return this.request("/execution/positions", {
         query: Object.keys(query).length > 0 ? query : void 0
       });

package/dist/server.d.mts

@@ -12,6 +12,16 @@ interface VerifyWebhookOptions {
 }
 declare function verifyWebhook(payload: string, headers: Record<string, string | string[] | undefined>, secret: string, options?: VerifyWebhookOptions): void;
 declare function parseWebhookEvent(payload: string, headers: Record<string, string | string[] | undefined>, secret: string, options?: VerifyWebhookOptions): WebhookEvent;
+/**
+ * Async, edge-runtime-friendly variant of {@link verifyWebhook}. Same
+ * Svix v1 signing scheme. Use this in Cloudflare Workers / Vercel Edge /
+ * Deno / Bun. The sync variant remains available for Node.js consumers.
+ */
+declare function verifyWebhookAsync(payload: string, headers: Record<string, string | string[] | undefined>, secret: string, options?: VerifyWebhookOptions): Promise<void>;
+/**
+ * Async, edge-runtime-friendly variant of {@link parseWebhookEvent}.
+ */
+declare function parseWebhookEventAsync(payload: string, headers: Record<string, string | string[] | undefined>, secret: string, options?: VerifyWebhookOptions): Promise<WebhookEvent>;
 interface WebhookEventBase {
     id: string;
     createdAt: string;
@@ -21,6 +31,8 @@ interface AccountsCreatedEvent extends WebhookEventBase {
     data: {
         userId: string;
         appId: string;
+        createdAt: string;
+        email: string | null;
     };
 }
 interface AccountsLinkedEvent extends WebhookEventBase {
@@ -37,6 +49,7 @@ interface WalletsReadyEvent extends WebhookEventBase {
         userId: string;
         evmAddress: string;
         svmAddress: string;
+        createdAt: string;
     };
 }
 interface TradesPlacedEvent extends WebhookEventBase {
@@ -45,8 +58,16 @@ interface TradesPlacedEvent extends WebhookEventBase {
         orderId: string;
         userId: string;
         side: string;
-        venue: string;
-        venueMarketId: string;
+        timestamp: string;
+        /**
+         * @deprecated Never emitted by the server in 1.x — the SDK type lied
+         * here for several releases. Reads always return `undefined`. The field
+         * is retained as `undefined`-typed for one minor release so existing
+         * partner code that destructures it keeps compiling; remove in 2.0.
+         */
+        venue?: undefined;
+        /** @deprecated See `venue`. */
+        venueMarketId?: undefined;
     };
 }
 interface TradesFilledEvent extends WebhookEventBase {
@@ -55,16 +76,49 @@ interface TradesFilledEvent extends WebhookEventBase {
         orderId: string;
         userId: string;
         status: string;
-        fillPrice: number;
-        fillSize: number;
+        timestamp: string;
+        /**
+         * Post-execution accuracy data. All `*Raw` values are decimal strings in
+         * 6-decimal atomic units. `*PriceRaw` are decimal strings (e.g. "0.5").
+         * `partialFillReason` is set only on `status === "partial_fill"`.
+         */
+        filledAmountRaw?: string;
+        quotedSharesRaw?: string;
+        actualSharesRaw?: string;
+        quotedToWinRaw?: string;
+        actualToWinRaw?: string;
+        quotedPriceRaw?: string;
+        executionPriceRaw?: string;
+        partialFillReason?: string;
+        /** @deprecated See `executionPriceRaw` — never emitted; remove in 2.0. */
+        fillPrice?: undefined;
+        /** @deprecated See `actualSharesRaw` / `filledAmountRaw` — never emitted; remove in 2.0. */
+        fillSize?: undefined;
     };
 }
 interface MarketsResolvedEvent extends WebhookEventBase {
     type: "markets.resolved";
     data: {
         venueMarketId: string;
-        outcome: string;
+        externalIdentifier: string;
+        status: string;
+        outcomes: Array<{
+            label: string;
+            winner?: boolean;
+            externalIdentifier?: string;
+        }>;
         affectedUsersCount: number;
+        /**
+         * Path on the AGG API where this resolution's affected users can be
+         * paginated. Combine with the configured base URL — e.g.
+         * `https://api.agg.market${detailsPath}`.
+         */
+        detailsPath: string;
+        /**
+         * @deprecated Singular `outcome` was never emitted; use `outcomes` array.
+         * Remove in 2.0.
+         */
+        outcome?: undefined;
     };
 }
 interface UnknownWebhookEvent extends WebhookEventBase {
@@ -118,7 +172,9 @@ declare class AggAdminClient {
         ordersByStatus: Record<string, number>;
         ordersByVenue: Record<string, number>;
         usersLast30Days: number;
+        usersLast7Days: number;
         ordersLast30Days: number;
+        ordersLast7Days: number;
     }>;
     listOrders(appId: string, query?: {
         limit?: number;
@@ -152,4 +208,4 @@ declare class AggAdminClient {
     }>;
 }
 
-export { type AccountsCreatedEvent, type AccountsLinkedEvent, AggAdminClient, type AggAdminClientOptions, type ExternalIdAssertion, type KnownWebhookEvent, type MarketsResolvedEvent, type TradesFilledEvent, type TradesPlacedEvent, type UnknownWebhookEvent, type VerifyWebhookOptions, type WalletsReadyEvent, type WebhookEvent, WebhookVerificationError, parseWebhookEvent, signExternalId, verifyWebhook };
+export { type AccountsCreatedEvent, type AccountsLinkedEvent, AggAdminClient, type AggAdminClientOptions, type ExternalIdAssertion, type KnownWebhookEvent, type MarketsResolvedEvent, type TradesFilledEvent, type TradesPlacedEvent, type UnknownWebhookEvent, type VerifyWebhookOptions, type WalletsReadyEvent, type WebhookEvent, WebhookVerificationError, parseWebhookEvent, parseWebhookEventAsync, signExternalId, verifyWebhook, verifyWebhookAsync };

package/dist/server.d.ts

@@ -12,6 +12,16 @@ interface VerifyWebhookOptions {
 }
 declare function verifyWebhook(payload: string, headers: Record<string, string | string[] | undefined>, secret: string, options?: VerifyWebhookOptions): void;
 declare function parseWebhookEvent(payload: string, headers: Record<string, string | string[] | undefined>, secret: string, options?: VerifyWebhookOptions): WebhookEvent;
+/**
+ * Async, edge-runtime-friendly variant of {@link verifyWebhook}. Same
+ * Svix v1 signing scheme. Use this in Cloudflare Workers / Vercel Edge /
+ * Deno / Bun. The sync variant remains available for Node.js consumers.
+ */
+declare function verifyWebhookAsync(payload: string, headers: Record<string, string | string[] | undefined>, secret: string, options?: VerifyWebhookOptions): Promise<void>;
+/**
+ * Async, edge-runtime-friendly variant of {@link parseWebhookEvent}.
+ */
+declare function parseWebhookEventAsync(payload: string, headers: Record<string, string | string[] | undefined>, secret: string, options?: VerifyWebhookOptions): Promise<WebhookEvent>;
 interface WebhookEventBase {
     id: string;
     createdAt: string;
@@ -21,6 +31,8 @@ interface AccountsCreatedEvent extends WebhookEventBase {
     data: {
         userId: string;
         appId: string;
+        createdAt: string;
+        email: string | null;
     };
 }
 interface AccountsLinkedEvent extends WebhookEventBase {
@@ -37,6 +49,7 @@ interface WalletsReadyEvent extends WebhookEventBase {
         userId: string;
         evmAddress: string;
         svmAddress: string;
+        createdAt: string;
     };
 }
 interface TradesPlacedEvent extends WebhookEventBase {
@@ -45,8 +58,16 @@ interface TradesPlacedEvent extends WebhookEventBase {
         orderId: string;
         userId: string;
         side: string;
-        venue: string;
-        venueMarketId: string;
+        timestamp: string;
+        /**
+         * @deprecated Never emitted by the server in 1.x — the SDK type lied
+         * here for several releases. Reads always return `undefined`. The field
+         * is retained as `undefined`-typed for one minor release so existing
+         * partner code that destructures it keeps compiling; remove in 2.0.
+         */
+        venue?: undefined;
+        /** @deprecated See `venue`. */
+        venueMarketId?: undefined;
     };
 }
 interface TradesFilledEvent extends WebhookEventBase {
@@ -55,16 +76,49 @@ interface TradesFilledEvent extends WebhookEventBase {
         orderId: string;
         userId: string;
         status: string;
-        fillPrice: number;
-        fillSize: number;
+        timestamp: string;
+        /**
+         * Post-execution accuracy data. All `*Raw` values are decimal strings in
+         * 6-decimal atomic units. `*PriceRaw` are decimal strings (e.g. "0.5").
+         * `partialFillReason` is set only on `status === "partial_fill"`.
+         */
+        filledAmountRaw?: string;
+        quotedSharesRaw?: string;
+        actualSharesRaw?: string;
+        quotedToWinRaw?: string;
+        actualToWinRaw?: string;
+        quotedPriceRaw?: string;
+        executionPriceRaw?: string;
+        partialFillReason?: string;
+        /** @deprecated See `executionPriceRaw` — never emitted; remove in 2.0. */
+        fillPrice?: undefined;
+        /** @deprecated See `actualSharesRaw` / `filledAmountRaw` — never emitted; remove in 2.0. */
+        fillSize?: undefined;
     };
 }
 interface MarketsResolvedEvent extends WebhookEventBase {
     type: "markets.resolved";
     data: {
         venueMarketId: string;
-        outcome: string;
+        externalIdentifier: string;
+        status: string;
+        outcomes: Array<{
+            label: string;
+            winner?: boolean;
+            externalIdentifier?: string;
+        }>;
         affectedUsersCount: number;
+        /**
+         * Path on the AGG API where this resolution's affected users can be
+         * paginated. Combine with the configured base URL — e.g.
+         * `https://api.agg.market${detailsPath}`.
+         */
+        detailsPath: string;
+        /**
+         * @deprecated Singular `outcome` was never emitted; use `outcomes` array.
+         * Remove in 2.0.
+         */
+        outcome?: undefined;
     };
 }
 interface UnknownWebhookEvent extends WebhookEventBase {
@@ -118,7 +172,9 @@ declare class AggAdminClient {
         ordersByStatus: Record<string, number>;
         ordersByVenue: Record<string, number>;
         usersLast30Days: number;
+        usersLast7Days: number;
         ordersLast30Days: number;
+        ordersLast7Days: number;
     }>;
     listOrders(appId: string, query?: {
         limit?: number;
@@ -152,4 +208,4 @@ declare class AggAdminClient {
     }>;
 }
 
-export { type AccountsCreatedEvent, type AccountsLinkedEvent, AggAdminClient, type AggAdminClientOptions, type ExternalIdAssertion, type KnownWebhookEvent, type MarketsResolvedEvent, type TradesFilledEvent, type TradesPlacedEvent, type UnknownWebhookEvent, type VerifyWebhookOptions, type WalletsReadyEvent, type WebhookEvent, WebhookVerificationError, parseWebhookEvent, signExternalId, verifyWebhook };
+export { type AccountsCreatedEvent, type AccountsLinkedEvent, AggAdminClient, type AggAdminClientOptions, type ExternalIdAssertion, type KnownWebhookEvent, type MarketsResolvedEvent, type TradesFilledEvent, type TradesPlacedEvent, type UnknownWebhookEvent, type VerifyWebhookOptions, type WalletsReadyEvent, type WebhookEvent, WebhookVerificationError, parseWebhookEvent, parseWebhookEventAsync, signExternalId, verifyWebhook, verifyWebhookAsync };

package/dist/server.js

@@ -60,8 +60,10 @@ __export(server_exports, {
   AggAdminClient: () => AggAdminClient,
   WebhookVerificationError: () => WebhookVerificationError,
   parseWebhookEvent: () => parseWebhookEvent,
+  parseWebhookEventAsync: () => parseWebhookEventAsync,
   signExternalId: () => signExternalId,
-  verifyWebhook: () => verifyWebhook
+  verifyWebhook: () => verifyWebhook,
+  verifyWebhookAsync: () => verifyWebhookAsync
 });
 module.exports = __toCommonJS(server_exports);
 var import_node_crypto = require("crypto");
@@ -74,6 +76,22 @@ function signExternalId(appSecret, externalId) {
     hmac
   };
 }
+var textEncoder = new TextEncoder();
+function base64Decode(s) {
+  const bin = atob(s);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function importHmacKey(secret) {
+  return __async(this, null, function* () {
+    const keyBytes = base64Decode(secret.replace(/^whsec_/, ""));
+    return crypto.subtle.importKey("raw", keyBytes, { name: "HMAC", hash: "SHA-256" }, false, [
+      "sign",
+      "verify"
+    ]);
+  });
+}
 var WebhookVerificationError = class extends Error {
   constructor(message) {
     super(message);
@@ -113,6 +131,45 @@ function parseWebhookEvent(payload, headers, secret, options) {
   const parsed = JSON.parse(payload);
   return parsed;
 }
+function verifyWebhookAsync(payload, headers, secret, options) {
+  return __async(this, null, function* () {
+    var _a;
+    const tolerance = (_a = options == null ? void 0 : options.toleranceSeconds) != null ? _a : 300;
+    const msgId = getHeader(headers, "webhook-id");
+    const timestamp = getHeader(headers, "webhook-timestamp");
+    const signatures = getHeader(headers, "webhook-signature");
+    if (!msgId) throw new WebhookVerificationError("Missing Webhook-Id header");
+    if (!timestamp) throw new WebhookVerificationError("Missing Webhook-Timestamp header");
+    if (!signatures) throw new WebhookVerificationError("Missing Webhook-Signature header");
+    const ts = parseInt(timestamp, 10);
+    if (isNaN(ts)) throw new WebhookVerificationError("Invalid Webhook-Timestamp");
+    const now = Math.floor(Date.now() / 1e3);
+    if (Math.abs(now - ts) > tolerance) {
+      throw new WebhookVerificationError("Webhook timestamp outside tolerance window");
+    }
+    const key = yield importHmacKey(secret);
+    const signed = textEncoder.encode(`${msgId}.${timestamp}.${payload}`);
+    for (const sig of signatures.split(" ")) {
+      if (!sig.startsWith("v1,")) continue;
+      let sigBytes;
+      try {
+        sigBytes = base64Decode(sig.slice(3));
+      } catch (e) {
+        continue;
+      }
+      const ok = yield crypto.subtle.verify("HMAC", key, sigBytes, signed);
+      if (ok) return;
+    }
+    throw new WebhookVerificationError("Invalid webhook signature");
+  });
+}
+function parseWebhookEventAsync(payload, headers, secret, options) {
+  return __async(this, null, function* () {
+    yield verifyWebhookAsync(payload, headers, secret, options);
+    const parsed = JSON.parse(payload);
+    return parsed;
+  });
+}
 var AggAdminClient = class {
   constructor(options) {
     this.baseUrl = options.baseUrl.replace(/\/$/, "");
@@ -249,6 +306,8 @@ function getHeader(headers, name) {
   AggAdminClient,
   WebhookVerificationError,
   parseWebhookEvent,
+  parseWebhookEventAsync,
   signExternalId,
-  verifyWebhook
+  verifyWebhook,
+  verifyWebhookAsync
 });

package/dist/server.mjs

@@ -15,6 +15,22 @@ function signExternalId(appSecret, externalId) {
     hmac
   };
 }
+var textEncoder = new TextEncoder();
+function base64Decode(s) {
+  const bin = atob(s);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function importHmacKey(secret) {
+  return __async(this, null, function* () {
+    const keyBytes = base64Decode(secret.replace(/^whsec_/, ""));
+    return crypto.subtle.importKey("raw", keyBytes, { name: "HMAC", hash: "SHA-256" }, false, [
+      "sign",
+      "verify"
+    ]);
+  });
+}
 var WebhookVerificationError = class extends Error {
   constructor(message) {
     super(message);
@@ -54,6 +70,45 @@ function parseWebhookEvent(payload, headers, secret, options) {
   const parsed = JSON.parse(payload);
   return parsed;
 }
+function verifyWebhookAsync(payload, headers, secret, options) {
+  return __async(this, null, function* () {
+    var _a;
+    const tolerance = (_a = options == null ? void 0 : options.toleranceSeconds) != null ? _a : 300;
+    const msgId = getHeader(headers, "webhook-id");
+    const timestamp = getHeader(headers, "webhook-timestamp");
+    const signatures = getHeader(headers, "webhook-signature");
+    if (!msgId) throw new WebhookVerificationError("Missing Webhook-Id header");
+    if (!timestamp) throw new WebhookVerificationError("Missing Webhook-Timestamp header");
+    if (!signatures) throw new WebhookVerificationError("Missing Webhook-Signature header");
+    const ts = parseInt(timestamp, 10);
+    if (isNaN(ts)) throw new WebhookVerificationError("Invalid Webhook-Timestamp");
+    const now = Math.floor(Date.now() / 1e3);
+    if (Math.abs(now - ts) > tolerance) {
+      throw new WebhookVerificationError("Webhook timestamp outside tolerance window");
+    }
+    const key = yield importHmacKey(secret);
+    const signed = textEncoder.encode(`${msgId}.${timestamp}.${payload}`);
+    for (const sig of signatures.split(" ")) {
+      if (!sig.startsWith("v1,")) continue;
+      let sigBytes;
+      try {
+        sigBytes = base64Decode(sig.slice(3));
+      } catch (e) {
+        continue;
+      }
+      const ok = yield crypto.subtle.verify("HMAC", key, sigBytes, signed);
+      if (ok) return;
+    }
+    throw new WebhookVerificationError("Invalid webhook signature");
+  });
+}
+function parseWebhookEventAsync(payload, headers, secret, options) {
+  return __async(this, null, function* () {
+    yield verifyWebhookAsync(payload, headers, secret, options);
+    const parsed = JSON.parse(payload);
+    return parsed;
+  });
+}
 var AggAdminClient = class {
   constructor(options) {
     this.baseUrl = options.baseUrl.replace(/\/$/, "");
@@ -189,6 +244,8 @@ export {
   AggAdminClient,
   WebhookVerificationError,
   parseWebhookEvent,
+  parseWebhookEventAsync,
   signExternalId,
-  verifyWebhook
+  verifyWebhook,
+  verifyWebhookAsync
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agg-build/sdk",
-  "version": "1.2.11",
+  "version": "1.3.0",
   "description": "Vanilla TypeScript client for the AGG prediction market aggregator (auth, markets, orderbooks, charts, trading, managed execution, WebSockets). Works in browsers, Node.js, and React Native.",
   "sideEffects": false,
   "license": "MIT",