@openmarketsai/connect-node 0.1.0

package/README.md

@@ -0,0 +1,119 @@
+# @openmarketsai/connect-node
+
+Server SDK for **OpenMarkets Connect**. A thin, typed wrapper over the Flow API:
+provision your users, mint hosted link sessions, verify webhook deliveries, read
+on a user's behalf, and execute orders on their account. Pairs with
+[`@openmarketsai/connect-web`](../connect-web) (the in-app launcher).
+
+```bash
+npm install @openmarketsai/connect-node
+```
+
+Node 18+ (uses global `fetch` and `node:crypto`). No runtime dependencies.
+
+## Quickstart
+
+```ts
+import { createClient } from '@openmarketsai/connect-node'
+
+const om = createClient({
+  apiKey: process.env.OM_API_KEY!,          // your Connect org key
+  webhookSecret: process.env.OM_WHSEC,      // optional, enables om.connect.webhooks.*
+})
+
+// 1. Provision a user (idempotent)
+await om.connect.users.provision({ external_user_id: 'user-123', email: 'u@example.com' })
+
+// 2. Mint a hosted link token → hand to @openmarketsai/connect-web on the client
+const { token } = await om.connect.linkSessions.create({
+  external_user_id: 'user-123',
+  return_url: 'https://yourapp.com/connected',
+})
+
+// 4. Read prices, 5. execute on the user's behalf
+const liquidity = await om.data.contestLiquidity(contestId)
+await om.orders.buy(
+  [{ partner_id, liquidity_hash, buy_id, amount: 50, price: 0.42, order_type: 'fill_or_kill' }],
+  { actAs: 'user-123' },
+)
+
+// balances / positions, all on the user's behalf
+await om.account.balances('user-123')
+```
+
+Buy legs use the same field names as the liquidity/quote entries, so you can pass
+them through with minimal mapping.
+
+## Webhooks (3)
+
+Verify deliveries over the **raw** request body (don't re-serialize):
+
+```ts
+import express from 'express'
+const app = express()
+
+app.post('/webhooks/openmarkets', express.raw({ type: 'application/json' }), (req, res) => {
+  try {
+    const event = om.connect.webhooks.constructEvent(
+      req.body,                              // Buffer (raw)
+      req.header('X-OpenMarkets-Signature'),
+    )
+    if (event.type === 'user.partners_connected') { /* … */ }
+    res.sendStatus(200)
+  } catch {
+    res.sendStatus(400)                      // bad signature / stale / malformed
+  }
+})
+```
+
+Or use the standalone helpers without a client:
+
+```ts
+import { verifyWebhookSignature, constructWebhookEvent } from '@openmarketsai/connect-node'
+verifyWebhookSignature(secret, rawBody, sigHeader)   // boolean
+```
+
+Signature scheme: header `X-OpenMarkets-Signature: t=<unix_seconds>,v1=<hmac>`,
+where the HMAC-SHA256 is over `` `${t}.${rawBody}` `` with your `whsec_` secret;
+deliveries older than 5 minutes are rejected.
+
+## API
+
+| Method | Endpoint |
+|---|---|
+| `connect.users.provision(params)` | `POST /flow/v1/connect/users` |
+| `connect.users.get(id)` | `GET /flow/v1/connect/users/:id` |
+| `connect.users.getPolicy(id)` | `GET /flow/v1/connect/users/:id/policy` |
+| `connect.linkSessions.create(params)` | `POST /flow/v1/connect/link-sessions` |
+| `connect.linkSessions.get(id)` | `GET /flow/v1/connect/link-sessions/:id` |
+| `connect.webhooks.getConfig()` | `GET /flow/v1/connect/webhook-config` |
+| `connect.webhooks.verify / constructEvent` | (local, no network) |
+| `account.partners(id)` / `balances(id)` | `GET /flow/v1/auth/account/{partners,balances}` (act-as) |
+| `orders.list(id)` | `GET /flow/v1/auth/orders` (act-as) |
+| `orders.buy(orders, { actAs })` | `POST /flow/v1/auth/orders/buy` (act-as) |
+| `data.leagues()` / `contestLiquidity(id)` | `GET /flow/v1/leagues`, `…/contests/:id/liquidity` |
+| `request(method, path, opts)` | escape hatch (`opts.actAs` sets the header) |
+
+## Errors
+
+Non-2xx responses throw `OpenMarketsError` with `status`, `code`, `message`,
+and `details` from the Flow error envelope:
+
+```ts
+import { OpenMarketsError } from '@openmarketsai/connect-node'
+try {
+  await om.orders.buy(orders, { actAs: 'user-123' })
+} catch (e) {
+  if (e instanceof OpenMarketsError && e.code === 'execution_limit_exceeded') { /* … */ }
+}
+```
+
+## Options
+
+| Option | Default | Notes |
+|---|---|---|
+| `apiKey` | — | Required. Sent as `X-API-Key`. |
+| `baseUrl` | `https://api.openmarkets.ai` | Override for staging. |
+| `webhookSecret` | — | Enables `connect.webhooks.verify/constructEvent`. |
+| `fetch` | global `fetch` | Inject for Node < 18 or testing. |
+| `timeoutMs` | `30000` | Per-request timeout. |

package/dist/index.cjs

@@ -0,0 +1,163 @@
+'use strict';
+
+var crypto = require('crypto');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var crypto__default = /*#__PURE__*/_interopDefault(crypto);
+
+// src/index.ts
+var DEFAULT_BASE_URL = "https://api.openmarkets.ai";
+var OpenMarketsError = class extends Error {
+  constructor(status, code, message, details) {
+    super(message);
+    this.name = "OpenMarketsError";
+    this.status = status;
+    this.code = code;
+    this.details = details;
+  }
+};
+var WebhookSignatureError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WebhookSignatureError";
+  }
+};
+function toRaw(body) {
+  return typeof body === "string" ? body : body.toString("utf8");
+}
+function parseSignatureHeader(header) {
+  const parts = header.split(",").reduce((acc, kv) => {
+    const idx = kv.indexOf("=");
+    if (idx > 0) acc[kv.slice(0, idx).trim()] = kv.slice(idx + 1).trim();
+    return acc;
+  }, {});
+  const t = Number(parts.t);
+  if (!parts.v1 || !isFinite(t)) return null;
+  return { t, v1: parts.v1 };
+}
+function timingSafeEqualHex(a, b) {
+  const ab = Buffer.from(a, "hex");
+  const bb = Buffer.from(b, "hex");
+  if (ab.length === 0 || ab.length !== bb.length) return false;
+  return crypto__default.default.timingSafeEqual(ab, bb);
+}
+function verifyWebhookSignature(secret, rawBody, signatureHeader, opts = {}) {
+  if (!secret || !signatureHeader) return false;
+  const parsed = parseSignatureHeader(signatureHeader);
+  if (!parsed) return false;
+  const toleranceSec = opts.toleranceSec ?? 300;
+  const nowSec = opts.nowSec ?? Math.floor(Date.now() / 1e3);
+  if (toleranceSec > 0 && Math.abs(nowSec - parsed.t) > toleranceSec) return false;
+  const expected = crypto__default.default.createHmac("sha256", secret).update(`${parsed.t}.${toRaw(rawBody)}`).digest("hex");
+  return timingSafeEqualHex(expected, parsed.v1);
+}
+function constructWebhookEvent(secret, rawBody, signatureHeader, opts = {}) {
+  if (!verifyWebhookSignature(secret, rawBody, signatureHeader, opts)) {
+    throw new WebhookSignatureError("Invalid or expired webhook signature");
+  }
+  try {
+    return JSON.parse(toRaw(rawBody));
+  } catch {
+    throw new WebhookSignatureError("Webhook body is not valid JSON");
+  }
+}
+function createClient(options) {
+  if (!options.apiKey) throw new Error("createClient: apiKey is required");
+  const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+  const doFetch = options.fetch ?? globalThis.fetch;
+  if (!doFetch) throw new Error("No fetch available \u2014 pass options.fetch (Node < 18)");
+  const timeoutMs = options.timeoutMs ?? 3e4;
+  async function request(method, path, opts = {}) {
+    const url = new URL(baseUrl + path);
+    for (const [k, v] of Object.entries(opts.query ?? {})) {
+      if (v !== void 0) url.searchParams.set(k, String(v));
+    }
+    const headers = {
+      "X-API-Key": options.apiKey,
+      Accept: "application/json"
+    };
+    if (opts.body !== void 0) headers["Content-Type"] = "application/json";
+    if (opts.actAs) headers["X-OpenMarkets-Account"] = opts.actAs;
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+    let res;
+    try {
+      res = await doFetch(url.toString(), {
+        method,
+        headers,
+        body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0,
+        signal: ctrl.signal
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+    let envelope;
+    const text = await res.text();
+    if (text) {
+      try {
+        envelope = JSON.parse(text);
+      } catch {
+      }
+    }
+    if (!res.ok) {
+      const err = envelope?.error;
+      throw new OpenMarketsError(
+        res.status,
+        err?.code ?? "http_error",
+        err?.message ?? `Request failed with status ${res.status}`,
+        err?.details
+      );
+    }
+    return envelope?.data ?? void 0;
+  }
+  function requireSecret() {
+    if (!options.webhookSecret) {
+      throw new Error("webhookSecret was not provided to createClient()");
+    }
+    return options.webhookSecret;
+  }
+  return {
+    request,
+    connect: {
+      users: {
+        provision: (params) => request("POST", "/flow/v1/connect/users", { body: params }),
+        get: (externalUserId) => request("GET", `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}`),
+        getPolicy: (externalUserId) => request("GET", `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}/policy`)
+      },
+      linkSessions: {
+        create: (params) => request("POST", "/flow/v1/connect/link-sessions", { body: params }),
+        get: (linkSessionId) => request("GET", `/flow/v1/connect/link-sessions/${encodeURIComponent(linkSessionId)}`)
+      },
+      webhooks: {
+        getConfig: () => request("GET", "/flow/v1/connect/webhook-config"),
+        verify: (rawBody, sig, opts) => verifyWebhookSignature(requireSecret(), rawBody, sig, opts),
+        constructEvent: (rawBody, sig, opts) => constructWebhookEvent(requireSecret(), rawBody, sig, opts)
+      }
+    },
+    account: {
+      partners: (externalUserId) => request("GET", "/flow/v1/auth/account/partners", { actAs: externalUserId }),
+      balances: (externalUserId) => request("GET", "/flow/v1/auth/account/balances", { actAs: externalUserId })
+    },
+    orders: {
+      list: (externalUserId) => request("GET", "/flow/v1/auth/orders", { actAs: externalUserId }),
+      buy: (orders, opts) => request("POST", "/flow/v1/auth/orders/buy", {
+        body: { orders },
+        actAs: opts.actAs
+      })
+    },
+    data: {
+      leagues: () => request("GET", "/flow/v1/leagues"),
+      contestLiquidity: (contestId) => request("GET", `/flow/v1/contests/${encodeURIComponent(contestId)}/liquidity`)
+    }
+  };
+}
+
+exports.DEFAULT_BASE_URL = DEFAULT_BASE_URL;
+exports.OpenMarketsError = OpenMarketsError;
+exports.WebhookSignatureError = WebhookSignatureError;
+exports.constructWebhookEvent = constructWebhookEvent;
+exports.createClient = createClient;
+exports.verifyWebhookSignature = verifyWebhookSignature;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":["crypto"],"mappings":";;;;;;;;;AAkBO,IAAM,gBAAA,GAAmB;AAOzB,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAIxC,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAmC;AAC1F,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACnB;AACJ;AAGO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC7C,YAAY,OAAA,EAAiB;AACzB,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EAChB;AACJ;AA2BA,SAAS,MAAM,IAAA,EAA+B;AAC1C,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,IAAA,CAAK,SAAS,MAAM,CAAA;AACjE;AAEA,SAAS,qBAAqB,MAAA,EAAkD;AAC5E,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,CAAM,GAAG,EAAE,MAAA,CAA+B,CAAC,KAAK,EAAA,KAAO;AACxE,IAAA,MAAM,GAAA,GAAM,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,MAAM,CAAA,EAAG,GAAA,CAAI,EAAA,CAAG,KAAA,CAAM,GAAG,GAAG,CAAA,CAAE,IAAA,EAAM,IAAI,EAAA,CAAG,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxB,EAAA,IAAI,CAAC,KAAA,CAAM,EAAA,IAAM,CAAC,QAAA,CAAS,CAAC,GAAG,OAAO,IAAA;AACtC,EAAA,OAAO,EAAE,CAAA,EAAG,EAAA,EAAI,KAAA,CAAM,EAAA,EAAG;AAC7B;AAEA,SAAS,kBAAA,CAAmB,GAAW,CAAA,EAAoB;AACvD,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,IAAI,GAAG,MAAA,KAAW,CAAA,IAAK,GAAG,MAAA,KAAW,EAAA,CAAG,QAAQ,OAAO,KAAA;AACvD,EAAA,OAAOA,uBAAA,CAAO,eAAA,CAAgB,EAAA,EAAI,EAAE,CAAA;AACxC;AAGO,SAAS,uBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACvB;AACP,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,eAAA,EAAiB,OAAO,KAAA;AACxC,EAAA,MAAM,MAAA,GAAS,qBAAqB,eAAe,CAAA;AACnD,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,GAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC1D,EAAA,IAAI,YAAA,GAAe,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,MAAA,CAAO,CAAC,CAAA,GAAI,YAAA,EAAc,OAAO,KAAA;AAC3E,EAAA,MAAM,WAAWA,uBAAA,CACZ,UAAA,CAAW,QAAA,EAAU,MAAM,EAC3B,MAAA,CAAO,CAAA,EAAG,MAAA,CAAO,CAAC,IAAI,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,CAAA,CACtC,OAAO,KAAK,CAAA;AACjB,EAAA,OAAO,kBAAA,CAAmB,QAAA,EAAU,MAAA,CAAO,EAAE,CAAA;AACjD;AAGO,SAAS,sBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACX;AACnB,EAAA,IAAI,CAAC,sBAAA,CAAuB,MAAA,EAAQ,OAAA,EAAS,eAAA,EAAiB,IAAI,CAAA,EAAG;AACjE,IAAA,MAAM,IAAI,sBAAsB,sCAAsC,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI;AACA,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AACJ,IAAA,MAAM,IAAI,sBAAsB,gCAAgC,CAAA;AAAA,EACpE;AACJ;AA4GO,SAAS,aAAa,OAAA,EAAsD;AAC/E,EAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,MAAM,kCAAkC,CAAA;AACvE,EAAA,MAAM,WAAW,OAAA,CAAQ,OAAA,IAAW,gBAAA,EAAkB,OAAA,CAAQ,OAAO,EAAE,CAAA;AACvE,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,0DAAqD,CAAA;AACnF,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,GAAA;AAEvC,EAAA,eAAe,OAAA,CACX,MAAA,EACA,IAAA,EACA,IAAA,GAAuB,EAAC,EACd;AACV,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,GAAU,IAAI,CAAA;AAClC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA,EAAG;AACnD,MAAA,IAAI,CAAA,KAAM,QAAW,GAAA,CAAI,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,aAAa,OAAA,CAAQ,MAAA;AAAA,MACrB,MAAA,EAAQ;AAAA,KACZ;AACA,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AACvD,IAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAA,CAAQ,uBAAuB,IAAI,IAAA,CAAK,KAAA;AAExD,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,IAAA,CAAK,KAAA,IAAS,SAAS,CAAA;AACtD,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACA,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,IAAA,CAAK;AAAA,OAChB,CAAA;AAAA,IACL,CAAA,SAAE;AACE,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACtB;AAEA,IAAA,IAAI,QAAA;AACJ,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,IAAA,EAAM;AACN,MAAA,IAAI;AACA,QAAA,QAAA,GAAW,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,MAC9B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,MAAM,QAAA,EAAU,KAAA;AACtB,MAAA,MAAM,IAAI,gBAAA;AAAA,QACN,GAAA,CAAI,MAAA;AAAA,QACJ,KAAK,IAAA,IAAQ,YAAA;AAAA,QACb,GAAA,EAAK,OAAA,IAAW,CAAA,2BAAA,EAA8B,GAAA,CAAI,MAAM,CAAA,CAAA;AAAA,QACxD,GAAA,EAAK;AAAA,OACT;AAAA,IACJ;AACA,IAAA,OAAQ,UAAU,IAAA,IAAS,MAAA;AAAA,EAC/B;AAEA,EAAA,SAAS,aAAA,GAAwB;AAC7B,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AACxB,MAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,OAAA,CAAQ,aAAA;AAAA,EACnB;AAEA,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,KAAA,EAAO;AAAA,QACH,SAAA,EAAW,CAAC,MAAA,KACR,OAAA,CAAyB,QAAQ,wBAAA,EAA0B,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QAC/E,GAAA,EAAK,CAAC,cAAA,KACF,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,CAAE,CAAA;AAAA,QACjF,SAAA,EAAW,CAAC,cAAA,KACR,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,OAAA,CAAS;AAAA,OAC5F;AAAA,MACA,YAAA,EAAc;AAAA,QACV,MAAA,EAAQ,CAAC,MAAA,KACL,OAAA,CAAqB,QAAQ,gCAAA,EAAkC,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QACnF,GAAA,EAAK,CAAC,aAAA,KACF,OAAA,CAAQ,OAAO,CAAA,+BAAA,EAAkC,kBAAA,CAAmB,aAAa,CAAC,CAAA,CAAE;AAAA,OAC5F;AAAA,MACA,QAAA,EAAU;AAAA,QACN,SAAA,EAAW,MAAM,OAAA,CAAQ,KAAA,EAAO,iCAAiC,CAAA;AAAA,QACjE,MAAA,EAAQ,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KACnB,uBAAuB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI,CAAA;AAAA,QAC9D,cAAA,EAAgB,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KAC3B,sBAAsB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI;AAAA;AACjE,KACJ;AAAA,IACA,OAAA,EAAS;AAAA,MACL,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MAC9E,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB;AAAA,KAClF;AAAA,IACA,MAAA,EAAQ;AAAA,MACJ,IAAA,EAAM,CAAC,cAAA,KACH,OAAA,CAAQ,OAAO,sBAAA,EAAwB,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MACpE,KAAK,CAAC,MAAA,EAAQ,IAAA,KACV,OAAA,CAAmB,QAAQ,0BAAA,EAA4B;AAAA,QACnD,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,QACf,OAAO,IAAA,CAAK;AAAA,OACf;AAAA,KACT;AAAA,IACA,IAAA,EAAM;AAAA,MACF,OAAA,EAAS,MAAM,OAAA,CAAQ,KAAA,EAAO,kBAAkB,CAAA;AAAA,MAChD,gBAAA,EAAkB,CAAC,SAAA,KACf,OAAA,CAAQ,OAAO,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,SAAS,CAAC,CAAA,UAAA,CAAY;AAAA;AACrF,GACJ;AACJ","file":"index.cjs","sourcesContent":["/**\n * @openmarketsai/connect-node\n *\n * Server SDK for OpenMarkets Connect. A thin, typed wrapper over the Flow API:\n * provision your users, mint hosted link sessions, verify webhook deliveries,\n * read on a user's behalf, and execute orders on their account.\n *\n *   import { createClient } from '@openmarketsai/connect-node'\n *   const om = createClient({ apiKey: process.env.OM_API_KEY! })\n *\n *   await om.connect.users.provision({ external_user_id: 'user-123' })\n *   const { token } = await om.connect.linkSessions.create({ external_user_id: 'user-123' })\n *   await om.orders.buy([leg], { actAs: 'user-123' })\n *\n * Pairs with @openmarketsai/connect-web (the in-app launcher).\n */\nimport crypto from 'node:crypto'\n\nexport const DEFAULT_BASE_URL = 'https://api.openmarkets.ai'\n\n// ──────────────────────────────────────────────────────────────────────────\n// Errors\n// ──────────────────────────────────────────────────────────────────────────\n\n/** Thrown when the API returns a non-2xx response. Mirrors the Flow error envelope. */\nexport class OpenMarketsError extends Error {\n    readonly status: number\n    readonly code: string\n    readonly details?: Record<string, unknown>\n    constructor(status: number, code: string, message: string, details?: Record<string, unknown>) {\n        super(message)\n        this.name = 'OpenMarketsError'\n        this.status = status\n        this.code = code\n        this.details = details\n    }\n}\n\n/** Thrown by `constructWebhookEvent` when a signature is missing, stale, or invalid. */\nexport class WebhookSignatureError extends Error {\n    constructor(message: string) {\n        super(message)\n        this.name = 'WebhookSignatureError'\n    }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Webhook verification (matches src/utils/webhook-signature.ts byte-for-byte)\n//\n//   Header: X-OpenMarkets-Signature: t=<unix_seconds>,v1=<hex hmac>\n//   Signed string: `${t}.${rawBody}`, HMAC-SHA256 with your whsec_ secret.\n//   IMPORTANT: verify over the EXACT raw request body, not a re-serialized object.\n// ──────────────────────────────────────────────────────────────────────────\n\nexport type ConnectWebhookEventType =\n    | 'user.partners_connected'\n    | 'user.permissions_changed'\n    | (string & {})\n\nexport interface ConnectWebhookEvent {\n    type: ConnectWebhookEventType\n    [key: string]: unknown\n}\n\nexport interface VerifyWebhookOptions {\n    /** Max age of the signature timestamp, in seconds. Default 300 (5 min). 0 disables. */\n    toleranceSec?: number\n    /** Injectable clock for testing. */\n    nowSec?: number\n}\n\nfunction toRaw(body: string | Buffer): string {\n    return typeof body === 'string' ? body : body.toString('utf8')\n}\n\nfunction parseSignatureHeader(header: string): { t: number; v1: string } | null {\n    const parts = header.split(',').reduce<Record<string, string>>((acc, kv) => {\n        const idx = kv.indexOf('=')\n        if (idx > 0) acc[kv.slice(0, idx).trim()] = kv.slice(idx + 1).trim()\n        return acc\n    }, {})\n    const t = Number(parts.t)\n    if (!parts.v1 || !isFinite(t)) return null\n    return { t, v1: parts.v1 }\n}\n\nfunction timingSafeEqualHex(a: string, b: string): boolean {\n    const ab = Buffer.from(a, 'hex')\n    const bb = Buffer.from(b, 'hex')\n    if (ab.length === 0 || ab.length !== bb.length) return false\n    return crypto.timingSafeEqual(ab, bb)\n}\n\n/** Verify a webhook signature. Returns false on any failure (never throws). */\nexport function verifyWebhookSignature(\n    secret: string,\n    rawBody: string | Buffer,\n    signatureHeader: string | null | undefined,\n    opts: VerifyWebhookOptions = {},\n): boolean {\n    if (!secret || !signatureHeader) return false\n    const parsed = parseSignatureHeader(signatureHeader)\n    if (!parsed) return false\n    const toleranceSec = opts.toleranceSec ?? 300\n    const nowSec = opts.nowSec ?? Math.floor(Date.now() / 1000)\n    if (toleranceSec > 0 && Math.abs(nowSec - parsed.t) > toleranceSec) return false\n    const expected = crypto\n        .createHmac('sha256', secret)\n        .update(`${parsed.t}.${toRaw(rawBody)}`)\n        .digest('hex')\n    return timingSafeEqualHex(expected, parsed.v1)\n}\n\n/** Verify the signature and return the parsed event, or throw `WebhookSignatureError`. */\nexport function constructWebhookEvent(\n    secret: string,\n    rawBody: string | Buffer,\n    signatureHeader: string | null | undefined,\n    opts: VerifyWebhookOptions = {},\n): ConnectWebhookEvent {\n    if (!verifyWebhookSignature(secret, rawBody, signatureHeader, opts)) {\n        throw new WebhookSignatureError('Invalid or expired webhook signature')\n    }\n    try {\n        return JSON.parse(toRaw(rawBody)) as ConnectWebhookEvent\n    } catch {\n        throw new WebhookSignatureError('Webhook body is not valid JSON')\n    }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Client\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface OpenMarketsClientOptions {\n    /** Your Connect org API key. Sent as `X-API-Key`. */\n    apiKey: string\n    /** API base URL. Defaults to https://api.openmarkets.ai. */\n    baseUrl?: string\n    /** Your webhook signing secret (`whsec_…`), enabling `client.webhooks.*`. */\n    webhookSecret?: string\n    /** Custom fetch (defaults to global fetch; Node 18+). */\n    fetch?: typeof fetch\n    /** Per-request timeout in ms. Default 30000. */\n    timeoutMs?: number\n}\n\nexport type HttpMethod = 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE'\n\nexport interface RequestOptions {\n    query?: Record<string, string | number | boolean | undefined>\n    body?: unknown\n    /** Act on this user's behalf — sets the `X-OpenMarkets-Account` header. */\n    actAs?: string\n}\n\n// Inputs (snake_case to match the API — buy legs map 1:1 from liquidity entries).\nexport interface ProvisionUserParams {\n    external_user_id: string\n    email?: string\n    name?: string\n}\nexport type LinkSessionMode = 'connect' | 'manage'\nexport interface CreateLinkSessionParams {\n    external_user_id: string\n    return_url?: string\n    mode?: LinkSessionMode\n    allowed_partners?: string[]\n}\nexport interface BuyOrder {\n    partner_id: string\n    liquidity_hash: string\n    buy_id: string\n    amount: number\n    price: number\n    order_type: 'fill_or_kill' | 'limit'\n    currency?: string\n}\n\n// Outputs (light — partners can pass a type param for stricter typing).\nexport interface ProvisionResult {\n    created: boolean\n    external_user_id: string\n    [key: string]: unknown\n}\nexport interface LinkSession {\n    link_session_id: string\n    token: string\n    external_user_id: string\n    mode: LinkSessionMode\n    [key: string]: unknown\n}\nexport interface BuyResult {\n    results: Array<{ success?: boolean; error?: string; [key: string]: unknown }>\n}\n\ninterface FlowEnvelope<T> {\n    data?: T\n    error?: { code: string; message: string; details?: Record<string, unknown> }\n}\n\nexport interface OpenMarketsClient {\n    /** Generic typed request — escape hatch for endpoints without a helper. */\n    request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<T>\n    connect: {\n        users: {\n            provision(params: ProvisionUserParams): Promise<ProvisionResult>\n            get<T = unknown>(externalUserId: string): Promise<T>\n            getPolicy<T = unknown>(externalUserId: string): Promise<T>\n        }\n        linkSessions: {\n            create(params: CreateLinkSessionParams): Promise<LinkSession>\n            get<T = unknown>(linkSessionId: string): Promise<T>\n        }\n        webhooks: {\n            getConfig<T = unknown>(): Promise<T>\n            /** Verify a delivery using the configured `webhookSecret`. */\n            verify(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): boolean\n            /** Verify + parse, or throw. Uses the configured `webhookSecret`. */\n            constructEvent(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): ConnectWebhookEvent\n        }\n    }\n    account: {\n        partners<T = unknown>(externalUserId: string): Promise<T>\n        balances<T = unknown>(externalUserId: string): Promise<T>\n    }\n    orders: {\n        list<T = unknown>(externalUserId: string): Promise<T>\n        buy(orders: BuyOrder[], opts: { actAs: string }): Promise<BuyResult>\n    }\n    data: {\n        leagues<T = unknown>(): Promise<T>\n        contestLiquidity<T = unknown>(contestId: string): Promise<T>\n    }\n}\n\nexport function createClient(options: OpenMarketsClientOptions): OpenMarketsClient {\n    if (!options.apiKey) throw new Error('createClient: apiKey is required')\n    const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '')\n    const doFetch = options.fetch ?? globalThis.fetch\n    if (!doFetch) throw new Error('No fetch available — pass options.fetch (Node < 18)')\n    const timeoutMs = options.timeoutMs ?? 30_000\n\n    async function request<T = unknown>(\n        method: HttpMethod,\n        path: string,\n        opts: RequestOptions = {},\n    ): Promise<T> {\n        const url = new URL(baseUrl + path)\n        for (const [k, v] of Object.entries(opts.query ?? {})) {\n            if (v !== undefined) url.searchParams.set(k, String(v))\n        }\n        const headers: Record<string, string> = {\n            'X-API-Key': options.apiKey,\n            Accept: 'application/json',\n        }\n        if (opts.body !== undefined) headers['Content-Type'] = 'application/json'\n        if (opts.actAs) headers['X-OpenMarkets-Account'] = opts.actAs\n\n        const ctrl = new AbortController()\n        const timer = setTimeout(() => ctrl.abort(), timeoutMs)\n        let res: Response\n        try {\n            res = await doFetch(url.toString(), {\n                method,\n                headers,\n                body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,\n                signal: ctrl.signal,\n            })\n        } finally {\n            clearTimeout(timer)\n        }\n\n        let envelope: FlowEnvelope<T> | undefined\n        const text = await res.text()\n        if (text) {\n            try {\n                envelope = JSON.parse(text) as FlowEnvelope<T>\n            } catch {\n                /* non-JSON body */\n            }\n        }\n\n        if (!res.ok) {\n            const err = envelope?.error\n            throw new OpenMarketsError(\n                res.status,\n                err?.code ?? 'http_error',\n                err?.message ?? `Request failed with status ${res.status}`,\n                err?.details,\n            )\n        }\n        return (envelope?.data ?? (undefined as unknown)) as T\n    }\n\n    function requireSecret(): string {\n        if (!options.webhookSecret) {\n            throw new Error('webhookSecret was not provided to createClient()')\n        }\n        return options.webhookSecret\n    }\n\n    return {\n        request,\n        connect: {\n            users: {\n                provision: (params) =>\n                    request<ProvisionResult>('POST', '/flow/v1/connect/users', { body: params }),\n                get: (externalUserId) =>\n                    request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}`),\n                getPolicy: (externalUserId) =>\n                    request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}/policy`),\n            },\n            linkSessions: {\n                create: (params) =>\n                    request<LinkSession>('POST', '/flow/v1/connect/link-sessions', { body: params }),\n                get: (linkSessionId) =>\n                    request('GET', `/flow/v1/connect/link-sessions/${encodeURIComponent(linkSessionId)}`),\n            },\n            webhooks: {\n                getConfig: () => request('GET', '/flow/v1/connect/webhook-config'),\n                verify: (rawBody, sig, opts) =>\n                    verifyWebhookSignature(requireSecret(), rawBody, sig, opts),\n                constructEvent: (rawBody, sig, opts) =>\n                    constructWebhookEvent(requireSecret(), rawBody, sig, opts),\n            },\n        },\n        account: {\n            partners: (externalUserId) =>\n                request('GET', '/flow/v1/auth/account/partners', { actAs: externalUserId }),\n            balances: (externalUserId) =>\n                request('GET', '/flow/v1/auth/account/balances', { actAs: externalUserId }),\n        },\n        orders: {\n            list: (externalUserId) =>\n                request('GET', '/flow/v1/auth/orders', { actAs: externalUserId }),\n            buy: (orders, opts) =>\n                request<BuyResult>('POST', '/flow/v1/auth/orders/buy', {\n                    body: { orders },\n                    actAs: opts.actAs,\n                }),\n        },\n        data: {\n            leagues: () => request('GET', '/flow/v1/leagues'),\n            contestLiquidity: (contestId) =>\n                request('GET', `/flow/v1/contests/${encodeURIComponent(contestId)}/liquidity`),\n        },\n    }\n}\n"]}

package/dist/index.d.cts

@@ -0,0 +1,125 @@
+declare const DEFAULT_BASE_URL = "https://api.openmarkets.ai";
+/** Thrown when the API returns a non-2xx response. Mirrors the Flow error envelope. */
+declare class OpenMarketsError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly details?: Record<string, unknown>;
+    constructor(status: number, code: string, message: string, details?: Record<string, unknown>);
+}
+/** Thrown by `constructWebhookEvent` when a signature is missing, stale, or invalid. */
+declare class WebhookSignatureError extends Error {
+    constructor(message: string);
+}
+type ConnectWebhookEventType = 'user.partners_connected' | 'user.permissions_changed' | (string & {});
+interface ConnectWebhookEvent {
+    type: ConnectWebhookEventType;
+    [key: string]: unknown;
+}
+interface VerifyWebhookOptions {
+    /** Max age of the signature timestamp, in seconds. Default 300 (5 min). 0 disables. */
+    toleranceSec?: number;
+    /** Injectable clock for testing. */
+    nowSec?: number;
+}
+/** Verify a webhook signature. Returns false on any failure (never throws). */
+declare function verifyWebhookSignature(secret: string, rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): boolean;
+/** Verify the signature and return the parsed event, or throw `WebhookSignatureError`. */
+declare function constructWebhookEvent(secret: string, rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): ConnectWebhookEvent;
+interface OpenMarketsClientOptions {
+    /** Your Connect org API key. Sent as `X-API-Key`. */
+    apiKey: string;
+    /** API base URL. Defaults to https://api.openmarkets.ai. */
+    baseUrl?: string;
+    /** Your webhook signing secret (`whsec_…`), enabling `client.webhooks.*`. */
+    webhookSecret?: string;
+    /** Custom fetch (defaults to global fetch; Node 18+). */
+    fetch?: typeof fetch;
+    /** Per-request timeout in ms. Default 30000. */
+    timeoutMs?: number;
+}
+type HttpMethod = 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE';
+interface RequestOptions {
+    query?: Record<string, string | number | boolean | undefined>;
+    body?: unknown;
+    /** Act on this user's behalf — sets the `X-OpenMarkets-Account` header. */
+    actAs?: string;
+}
+interface ProvisionUserParams {
+    external_user_id: string;
+    email?: string;
+    name?: string;
+}
+type LinkSessionMode = 'connect' | 'manage';
+interface CreateLinkSessionParams {
+    external_user_id: string;
+    return_url?: string;
+    mode?: LinkSessionMode;
+    allowed_partners?: string[];
+}
+interface BuyOrder {
+    partner_id: string;
+    liquidity_hash: string;
+    buy_id: string;
+    amount: number;
+    price: number;
+    order_type: 'fill_or_kill' | 'limit';
+    currency?: string;
+}
+interface ProvisionResult {
+    created: boolean;
+    external_user_id: string;
+    [key: string]: unknown;
+}
+interface LinkSession {
+    link_session_id: string;
+    token: string;
+    external_user_id: string;
+    mode: LinkSessionMode;
+    [key: string]: unknown;
+}
+interface BuyResult {
+    results: Array<{
+        success?: boolean;
+        error?: string;
+        [key: string]: unknown;
+    }>;
+}
+interface OpenMarketsClient {
+    /** Generic typed request — escape hatch for endpoints without a helper. */
+    request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<T>;
+    connect: {
+        users: {
+            provision(params: ProvisionUserParams): Promise<ProvisionResult>;
+            get<T = unknown>(externalUserId: string): Promise<T>;
+            getPolicy<T = unknown>(externalUserId: string): Promise<T>;
+        };
+        linkSessions: {
+            create(params: CreateLinkSessionParams): Promise<LinkSession>;
+            get<T = unknown>(linkSessionId: string): Promise<T>;
+        };
+        webhooks: {
+            getConfig<T = unknown>(): Promise<T>;
+            /** Verify a delivery using the configured `webhookSecret`. */
+            verify(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): boolean;
+            /** Verify + parse, or throw. Uses the configured `webhookSecret`. */
+            constructEvent(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): ConnectWebhookEvent;
+        };
+    };
+    account: {
+        partners<T = unknown>(externalUserId: string): Promise<T>;
+        balances<T = unknown>(externalUserId: string): Promise<T>;
+    };
+    orders: {
+        list<T = unknown>(externalUserId: string): Promise<T>;
+        buy(orders: BuyOrder[], opts: {
+            actAs: string;
+        }): Promise<BuyResult>;
+    };
+    data: {
+        leagues<T = unknown>(): Promise<T>;
+        contestLiquidity<T = unknown>(contestId: string): Promise<T>;
+    };
+}
+declare function createClient(options: OpenMarketsClientOptions): OpenMarketsClient;
+
+export { type BuyOrder, type BuyResult, type ConnectWebhookEvent, type ConnectWebhookEventType, type CreateLinkSessionParams, DEFAULT_BASE_URL, type HttpMethod, type LinkSession, type LinkSessionMode, type OpenMarketsClient, type OpenMarketsClientOptions, OpenMarketsError, type ProvisionResult, type ProvisionUserParams, type RequestOptions, type VerifyWebhookOptions, WebhookSignatureError, constructWebhookEvent, createClient, verifyWebhookSignature };

package/dist/index.d.ts

@@ -0,0 +1,125 @@
+declare const DEFAULT_BASE_URL = "https://api.openmarkets.ai";
+/** Thrown when the API returns a non-2xx response. Mirrors the Flow error envelope. */
+declare class OpenMarketsError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly details?: Record<string, unknown>;
+    constructor(status: number, code: string, message: string, details?: Record<string, unknown>);
+}
+/** Thrown by `constructWebhookEvent` when a signature is missing, stale, or invalid. */
+declare class WebhookSignatureError extends Error {
+    constructor(message: string);
+}
+type ConnectWebhookEventType = 'user.partners_connected' | 'user.permissions_changed' | (string & {});
+interface ConnectWebhookEvent {
+    type: ConnectWebhookEventType;
+    [key: string]: unknown;
+}
+interface VerifyWebhookOptions {
+    /** Max age of the signature timestamp, in seconds. Default 300 (5 min). 0 disables. */
+    toleranceSec?: number;
+    /** Injectable clock for testing. */
+    nowSec?: number;
+}
+/** Verify a webhook signature. Returns false on any failure (never throws). */
+declare function verifyWebhookSignature(secret: string, rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): boolean;
+/** Verify the signature and return the parsed event, or throw `WebhookSignatureError`. */
+declare function constructWebhookEvent(secret: string, rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): ConnectWebhookEvent;
+interface OpenMarketsClientOptions {
+    /** Your Connect org API key. Sent as `X-API-Key`. */
+    apiKey: string;
+    /** API base URL. Defaults to https://api.openmarkets.ai. */
+    baseUrl?: string;
+    /** Your webhook signing secret (`whsec_…`), enabling `client.webhooks.*`. */
+    webhookSecret?: string;
+    /** Custom fetch (defaults to global fetch; Node 18+). */
+    fetch?: typeof fetch;
+    /** Per-request timeout in ms. Default 30000. */
+    timeoutMs?: number;
+}
+type HttpMethod = 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE';
+interface RequestOptions {
+    query?: Record<string, string | number | boolean | undefined>;
+    body?: unknown;
+    /** Act on this user's behalf — sets the `X-OpenMarkets-Account` header. */
+    actAs?: string;
+}
+interface ProvisionUserParams {
+    external_user_id: string;
+    email?: string;
+    name?: string;
+}
+type LinkSessionMode = 'connect' | 'manage';
+interface CreateLinkSessionParams {
+    external_user_id: string;
+    return_url?: string;
+    mode?: LinkSessionMode;
+    allowed_partners?: string[];
+}
+interface BuyOrder {
+    partner_id: string;
+    liquidity_hash: string;
+    buy_id: string;
+    amount: number;
+    price: number;
+    order_type: 'fill_or_kill' | 'limit';
+    currency?: string;
+}
+interface ProvisionResult {
+    created: boolean;
+    external_user_id: string;
+    [key: string]: unknown;
+}
+interface LinkSession {
+    link_session_id: string;
+    token: string;
+    external_user_id: string;
+    mode: LinkSessionMode;
+    [key: string]: unknown;
+}
+interface BuyResult {
+    results: Array<{
+        success?: boolean;
+        error?: string;
+        [key: string]: unknown;
+    }>;
+}
+interface OpenMarketsClient {
+    /** Generic typed request — escape hatch for endpoints without a helper. */
+    request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<T>;
+    connect: {
+        users: {
+            provision(params: ProvisionUserParams): Promise<ProvisionResult>;
+            get<T = unknown>(externalUserId: string): Promise<T>;
+            getPolicy<T = unknown>(externalUserId: string): Promise<T>;
+        };
+        linkSessions: {
+            create(params: CreateLinkSessionParams): Promise<LinkSession>;
+            get<T = unknown>(linkSessionId: string): Promise<T>;
+        };
+        webhooks: {
+            getConfig<T = unknown>(): Promise<T>;
+            /** Verify a delivery using the configured `webhookSecret`. */
+            verify(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): boolean;
+            /** Verify + parse, or throw. Uses the configured `webhookSecret`. */
+            constructEvent(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): ConnectWebhookEvent;
+        };
+    };
+    account: {
+        partners<T = unknown>(externalUserId: string): Promise<T>;
+        balances<T = unknown>(externalUserId: string): Promise<T>;
+    };
+    orders: {
+        list<T = unknown>(externalUserId: string): Promise<T>;
+        buy(orders: BuyOrder[], opts: {
+            actAs: string;
+        }): Promise<BuyResult>;
+    };
+    data: {
+        leagues<T = unknown>(): Promise<T>;
+        contestLiquidity<T = unknown>(contestId: string): Promise<T>;
+    };
+}
+declare function createClient(options: OpenMarketsClientOptions): OpenMarketsClient;
+
+export { type BuyOrder, type BuyResult, type ConnectWebhookEvent, type ConnectWebhookEventType, type CreateLinkSessionParams, DEFAULT_BASE_URL, type HttpMethod, type LinkSession, type LinkSessionMode, type OpenMarketsClient, type OpenMarketsClientOptions, OpenMarketsError, type ProvisionResult, type ProvisionUserParams, type RequestOptions, type VerifyWebhookOptions, WebhookSignatureError, constructWebhookEvent, createClient, verifyWebhookSignature };

package/dist/index.js

@@ -0,0 +1,152 @@
+import crypto from 'crypto';
+
+// src/index.ts
+var DEFAULT_BASE_URL = "https://api.openmarkets.ai";
+var OpenMarketsError = class extends Error {
+  constructor(status, code, message, details) {
+    super(message);
+    this.name = "OpenMarketsError";
+    this.status = status;
+    this.code = code;
+    this.details = details;
+  }
+};
+var WebhookSignatureError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WebhookSignatureError";
+  }
+};
+function toRaw(body) {
+  return typeof body === "string" ? body : body.toString("utf8");
+}
+function parseSignatureHeader(header) {
+  const parts = header.split(",").reduce((acc, kv) => {
+    const idx = kv.indexOf("=");
+    if (idx > 0) acc[kv.slice(0, idx).trim()] = kv.slice(idx + 1).trim();
+    return acc;
+  }, {});
+  const t = Number(parts.t);
+  if (!parts.v1 || !isFinite(t)) return null;
+  return { t, v1: parts.v1 };
+}
+function timingSafeEqualHex(a, b) {
+  const ab = Buffer.from(a, "hex");
+  const bb = Buffer.from(b, "hex");
+  if (ab.length === 0 || ab.length !== bb.length) return false;
+  return crypto.timingSafeEqual(ab, bb);
+}
+function verifyWebhookSignature(secret, rawBody, signatureHeader, opts = {}) {
+  if (!secret || !signatureHeader) return false;
+  const parsed = parseSignatureHeader(signatureHeader);
+  if (!parsed) return false;
+  const toleranceSec = opts.toleranceSec ?? 300;
+  const nowSec = opts.nowSec ?? Math.floor(Date.now() / 1e3);
+  if (toleranceSec > 0 && Math.abs(nowSec - parsed.t) > toleranceSec) return false;
+  const expected = crypto.createHmac("sha256", secret).update(`${parsed.t}.${toRaw(rawBody)}`).digest("hex");
+  return timingSafeEqualHex(expected, parsed.v1);
+}
+function constructWebhookEvent(secret, rawBody, signatureHeader, opts = {}) {
+  if (!verifyWebhookSignature(secret, rawBody, signatureHeader, opts)) {
+    throw new WebhookSignatureError("Invalid or expired webhook signature");
+  }
+  try {
+    return JSON.parse(toRaw(rawBody));
+  } catch {
+    throw new WebhookSignatureError("Webhook body is not valid JSON");
+  }
+}
+function createClient(options) {
+  if (!options.apiKey) throw new Error("createClient: apiKey is required");
+  const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+  const doFetch = options.fetch ?? globalThis.fetch;
+  if (!doFetch) throw new Error("No fetch available \u2014 pass options.fetch (Node < 18)");
+  const timeoutMs = options.timeoutMs ?? 3e4;
+  async function request(method, path, opts = {}) {
+    const url = new URL(baseUrl + path);
+    for (const [k, v] of Object.entries(opts.query ?? {})) {
+      if (v !== void 0) url.searchParams.set(k, String(v));
+    }
+    const headers = {
+      "X-API-Key": options.apiKey,
+      Accept: "application/json"
+    };
+    if (opts.body !== void 0) headers["Content-Type"] = "application/json";
+    if (opts.actAs) headers["X-OpenMarkets-Account"] = opts.actAs;
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+    let res;
+    try {
+      res = await doFetch(url.toString(), {
+        method,
+        headers,
+        body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0,
+        signal: ctrl.signal
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+    let envelope;
+    const text = await res.text();
+    if (text) {
+      try {
+        envelope = JSON.parse(text);
+      } catch {
+      }
+    }
+    if (!res.ok) {
+      const err = envelope?.error;
+      throw new OpenMarketsError(
+        res.status,
+        err?.code ?? "http_error",
+        err?.message ?? `Request failed with status ${res.status}`,
+        err?.details
+      );
+    }
+    return envelope?.data ?? void 0;
+  }
+  function requireSecret() {
+    if (!options.webhookSecret) {
+      throw new Error("webhookSecret was not provided to createClient()");
+    }
+    return options.webhookSecret;
+  }
+  return {
+    request,
+    connect: {
+      users: {
+        provision: (params) => request("POST", "/flow/v1/connect/users", { body: params }),
+        get: (externalUserId) => request("GET", `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}`),
+        getPolicy: (externalUserId) => request("GET", `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}/policy`)
+      },
+      linkSessions: {
+        create: (params) => request("POST", "/flow/v1/connect/link-sessions", { body: params }),
+        get: (linkSessionId) => request("GET", `/flow/v1/connect/link-sessions/${encodeURIComponent(linkSessionId)}`)
+      },
+      webhooks: {
+        getConfig: () => request("GET", "/flow/v1/connect/webhook-config"),
+        verify: (rawBody, sig, opts) => verifyWebhookSignature(requireSecret(), rawBody, sig, opts),
+        constructEvent: (rawBody, sig, opts) => constructWebhookEvent(requireSecret(), rawBody, sig, opts)
+      }
+    },
+    account: {
+      partners: (externalUserId) => request("GET", "/flow/v1/auth/account/partners", { actAs: externalUserId }),
+      balances: (externalUserId) => request("GET", "/flow/v1/auth/account/balances", { actAs: externalUserId })
+    },
+    orders: {
+      list: (externalUserId) => request("GET", "/flow/v1/auth/orders", { actAs: externalUserId }),
+      buy: (orders, opts) => request("POST", "/flow/v1/auth/orders/buy", {
+        body: { orders },
+        actAs: opts.actAs
+      })
+    },
+    data: {
+      leagues: () => request("GET", "/flow/v1/leagues"),
+      contestLiquidity: (contestId) => request("GET", `/flow/v1/contests/${encodeURIComponent(contestId)}/liquidity`)
+    }
+  };
+}
+
+export { DEFAULT_BASE_URL, OpenMarketsError, WebhookSignatureError, constructWebhookEvent, createClient, verifyWebhookSignature };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAkBO,IAAM,gBAAA,GAAmB;AAOzB,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAIxC,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAmC;AAC1F,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACnB;AACJ;AAGO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC7C,YAAY,OAAA,EAAiB;AACzB,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EAChB;AACJ;AA2BA,SAAS,MAAM,IAAA,EAA+B;AAC1C,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,IAAA,CAAK,SAAS,MAAM,CAAA;AACjE;AAEA,SAAS,qBAAqB,MAAA,EAAkD;AAC5E,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,CAAM,GAAG,EAAE,MAAA,CAA+B,CAAC,KAAK,EAAA,KAAO;AACxE,IAAA,MAAM,GAAA,GAAM,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,MAAM,CAAA,EAAG,GAAA,CAAI,EAAA,CAAG,KAAA,CAAM,GAAG,GAAG,CAAA,CAAE,IAAA,EAAM,IAAI,EAAA,CAAG,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxB,EAAA,IAAI,CAAC,KAAA,CAAM,EAAA,IAAM,CAAC,QAAA,CAAS,CAAC,GAAG,OAAO,IAAA;AACtC,EAAA,OAAO,EAAE,CAAA,EAAG,EAAA,EAAI,KAAA,CAAM,EAAA,EAAG;AAC7B;AAEA,SAAS,kBAAA,CAAmB,GAAW,CAAA,EAAoB;AACvD,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,IAAI,GAAG,MAAA,KAAW,CAAA,IAAK,GAAG,MAAA,KAAW,EAAA,CAAG,QAAQ,OAAO,KAAA;AACvD,EAAA,OAAO,MAAA,CAAO,eAAA,CAAgB,EAAA,EAAI,EAAE,CAAA;AACxC;AAGO,SAAS,uBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACvB;AACP,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,eAAA,EAAiB,OAAO,KAAA;AACxC,EAAA,MAAM,MAAA,GAAS,qBAAqB,eAAe,CAAA;AACnD,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,GAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC1D,EAAA,IAAI,YAAA,GAAe,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,MAAA,CAAO,CAAC,CAAA,GAAI,YAAA,EAAc,OAAO,KAAA;AAC3E,EAAA,MAAM,WAAW,MAAA,CACZ,UAAA,CAAW,QAAA,EAAU,MAAM,EAC3B,MAAA,CAAO,CAAA,EAAG,MAAA,CAAO,CAAC,IAAI,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,CAAA,CACtC,OAAO,KAAK,CAAA;AACjB,EAAA,OAAO,kBAAA,CAAmB,QAAA,EAAU,MAAA,CAAO,EAAE,CAAA;AACjD;AAGO,SAAS,sBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACX;AACnB,EAAA,IAAI,CAAC,sBAAA,CAAuB,MAAA,EAAQ,OAAA,EAAS,eAAA,EAAiB,IAAI,CAAA,EAAG;AACjE,IAAA,MAAM,IAAI,sBAAsB,sCAAsC,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI;AACA,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AACJ,IAAA,MAAM,IAAI,sBAAsB,gCAAgC,CAAA;AAAA,EACpE;AACJ;AA4GO,SAAS,aAAa,OAAA,EAAsD;AAC/E,EAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,MAAM,kCAAkC,CAAA;AACvE,EAAA,MAAM,WAAW,OAAA,CAAQ,OAAA,IAAW,gBAAA,EAAkB,OAAA,CAAQ,OAAO,EAAE,CAAA;AACvE,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,0DAAqD,CAAA;AACnF,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,GAAA;AAEvC,EAAA,eAAe,OAAA,CACX,MAAA,EACA,IAAA,EACA,IAAA,GAAuB,EAAC,EACd;AACV,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,GAAU,IAAI,CAAA;AAClC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA,EAAG;AACnD,MAAA,IAAI,CAAA,KAAM,QAAW,GAAA,CAAI,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,aAAa,OAAA,CAAQ,MAAA;AAAA,MACrB,MAAA,EAAQ;AAAA,KACZ;AACA,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AACvD,IAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAA,CAAQ,uBAAuB,IAAI,IAAA,CAAK,KAAA;AAExD,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,IAAA,CAAK,KAAA,IAAS,SAAS,CAAA;AACtD,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACA,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,IAAA,CAAK;AAAA,OAChB,CAAA;AAAA,IACL,CAAA,SAAE;AACE,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACtB;AAEA,IAAA,IAAI,QAAA;AACJ,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,IAAA,EAAM;AACN,MAAA,IAAI;AACA,QAAA,QAAA,GAAW,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,MAC9B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,MAAM,QAAA,EAAU,KAAA;AACtB,MAAA,MAAM,IAAI,gBAAA;AAAA,QACN,GAAA,CAAI,MAAA;AAAA,QACJ,KAAK,IAAA,IAAQ,YAAA;AAAA,QACb,GAAA,EAAK,OAAA,IAAW,CAAA,2BAAA,EAA8B,GAAA,CAAI,MAAM,CAAA,CAAA;AAAA,QACxD,GAAA,EAAK;AAAA,OACT;AAAA,IACJ;AACA,IAAA,OAAQ,UAAU,IAAA,IAAS,MAAA;AAAA,EAC/B;AAEA,EAAA,SAAS,aAAA,GAAwB;AAC7B,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AACxB,MAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,OAAA,CAAQ,aAAA;AAAA,EACnB;AAEA,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,KAAA,EAAO;AAAA,QACH,SAAA,EAAW,CAAC,MAAA,KACR,OAAA,CAAyB,QAAQ,wBAAA,EAA0B,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QAC/E,GAAA,EAAK,CAAC,cAAA,KACF,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,CAAE,CAAA;AAAA,QACjF,SAAA,EAAW,CAAC,cAAA,KACR,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,OAAA,CAAS;AAAA,OAC5F;AAAA,MACA,YAAA,EAAc;AAAA,QACV,MAAA,EAAQ,CAAC,MAAA,KACL,OAAA,CAAqB,QAAQ,gCAAA,EAAkC,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QACnF,GAAA,EAAK,CAAC,aAAA,KACF,OAAA,CAAQ,OAAO,CAAA,+BAAA,EAAkC,kBAAA,CAAmB,aAAa,CAAC,CAAA,CAAE;AAAA,OAC5F;AAAA,MACA,QAAA,EAAU;AAAA,QACN,SAAA,EAAW,MAAM,OAAA,CAAQ,KAAA,EAAO,iCAAiC,CAAA;AAAA,QACjE,MAAA,EAAQ,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KACnB,uBAAuB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI,CAAA;AAAA,QAC9D,cAAA,EAAgB,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KAC3B,sBAAsB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI;AAAA;AACjE,KACJ;AAAA,IACA,OAAA,EAAS;AAAA,MACL,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MAC9E,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB;AAAA,KAClF;AAAA,IACA,MAAA,EAAQ;AAAA,MACJ,IAAA,EAAM,CAAC,cAAA,KACH,OAAA,CAAQ,OAAO,sBAAA,EAAwB,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MACpE,KAAK,CAAC,MAAA,EAAQ,IAAA,KACV,OAAA,CAAmB,QAAQ,0BAAA,EAA4B;AAAA,QACnD,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,QACf,OAAO,IAAA,CAAK;AAAA,OACf;AAAA,KACT;AAAA,IACA,IAAA,EAAM;AAAA,MACF,OAAA,EAAS,MAAM,OAAA,CAAQ,KAAA,EAAO,kBAAkB,CAAA;AAAA,MAChD,gBAAA,EAAkB,CAAC,SAAA,KACf,OAAA,CAAQ,OAAO,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,SAAS,CAAC,CAAA,UAAA,CAAY;AAAA;AACrF,GACJ;AACJ","file":"index.js","sourcesContent":["/**\n * @openmarketsai/connect-node\n *\n * Server SDK for OpenMarkets Connect. A thin, typed wrapper over the Flow API:\n * provision your users, mint hosted link sessions, verify webhook deliveries,\n * read on a user's behalf, and execute orders on their account.\n *\n *   import { createClient } from '@openmarketsai/connect-node'\n *   const om = createClient({ apiKey: process.env.OM_API_KEY! })\n *\n *   await om.connect.users.provision({ external_user_id: 'user-123' })\n *   const { token } = await om.connect.linkSessions.create({ external_user_id: 'user-123' })\n *   await om.orders.buy([leg], { actAs: 'user-123' })\n *\n * Pairs with @openmarketsai/connect-web (the in-app launcher).\n */\nimport crypto from 'node:crypto'\n\nexport const DEFAULT_BASE_URL = 'https://api.openmarkets.ai'\n\n// ──────────────────────────────────────────────────────────────────────────\n// Errors\n// ──────────────────────────────────────────────────────────────────────────\n\n/** Thrown when the API returns a non-2xx response. Mirrors the Flow error envelope. */\nexport class OpenMarketsError extends Error {\n    readonly status: number\n    readonly code: string\n    readonly details?: Record<string, unknown>\n    constructor(status: number, code: string, message: string, details?: Record<string, unknown>) {\n        super(message)\n        this.name = 'OpenMarketsError'\n        this.status = status\n        this.code = code\n        this.details = details\n    }\n}\n\n/** Thrown by `constructWebhookEvent` when a signature is missing, stale, or invalid. */\nexport class WebhookSignatureError extends Error {\n    constructor(message: string) {\n        super(message)\n        this.name = 'WebhookSignatureError'\n    }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Webhook verification (matches src/utils/webhook-signature.ts byte-for-byte)\n//\n//   Header: X-OpenMarkets-Signature: t=<unix_seconds>,v1=<hex hmac>\n//   Signed string: `${t}.${rawBody}`, HMAC-SHA256 with your whsec_ secret.\n//   IMPORTANT: verify over the EXACT raw request body, not a re-serialized object.\n// ──────────────────────────────────────────────────────────────────────────\n\nexport type ConnectWebhookEventType =\n    | 'user.partners_connected'\n    | 'user.permissions_changed'\n    | (string & {})\n\nexport interface ConnectWebhookEvent {\n    type: ConnectWebhookEventType\n    [key: string]: unknown\n}\n\nexport interface VerifyWebhookOptions {\n    /** Max age of the signature timestamp, in seconds. Default 300 (5 min). 0 disables. */\n    toleranceSec?: number\n    /** Injectable clock for testing. */\n    nowSec?: number\n}\n\nfunction toRaw(body: string | Buffer): string {\n    return typeof body === 'string' ? body : body.toString('utf8')\n}\n\nfunction parseSignatureHeader(header: string): { t: number; v1: string } | null {\n    const parts = header.split(',').reduce<Record<string, string>>((acc, kv) => {\n        const idx = kv.indexOf('=')\n        if (idx > 0) acc[kv.slice(0, idx).trim()] = kv.slice(idx + 1).trim()\n        return acc\n    }, {})\n    const t = Number(parts.t)\n    if (!parts.v1 || !isFinite(t)) return null\n    return { t, v1: parts.v1 }\n}\n\nfunction timingSafeEqualHex(a: string, b: string): boolean {\n    const ab = Buffer.from(a, 'hex')\n    const bb = Buffer.from(b, 'hex')\n    if (ab.length === 0 || ab.length !== bb.length) return false\n    return crypto.timingSafeEqual(ab, bb)\n}\n\n/** Verify a webhook signature. Returns false on any failure (never throws). */\nexport function verifyWebhookSignature(\n    secret: string,\n    rawBody: string | Buffer,\n    signatureHeader: string | null | undefined,\n    opts: VerifyWebhookOptions = {},\n): boolean {\n    if (!secret || !signatureHeader) return false\n    const parsed = parseSignatureHeader(signatureHeader)\n    if (!parsed) return false\n    const toleranceSec = opts.toleranceSec ?? 300\n    const nowSec = opts.nowSec ?? Math.floor(Date.now() / 1000)\n    if (toleranceSec > 0 && Math.abs(nowSec - parsed.t) > toleranceSec) return false\n    const expected = crypto\n        .createHmac('sha256', secret)\n        .update(`${parsed.t}.${toRaw(rawBody)}`)\n        .digest('hex')\n    return timingSafeEqualHex(expected, parsed.v1)\n}\n\n/** Verify the signature and return the parsed event, or throw `WebhookSignatureError`. */\nexport function constructWebhookEvent(\n    secret: string,\n    rawBody: string | Buffer,\n    signatureHeader: string | null | undefined,\n    opts: VerifyWebhookOptions = {},\n): ConnectWebhookEvent {\n    if (!verifyWebhookSignature(secret, rawBody, signatureHeader, opts)) {\n        throw new WebhookSignatureError('Invalid or expired webhook signature')\n    }\n    try {\n        return JSON.parse(toRaw(rawBody)) as ConnectWebhookEvent\n    } catch {\n        throw new WebhookSignatureError('Webhook body is not valid JSON')\n    }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Client\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface OpenMarketsClientOptions {\n    /** Your Connect org API key. Sent as `X-API-Key`. */\n    apiKey: string\n    /** API base URL. Defaults to https://api.openmarkets.ai. */\n    baseUrl?: string\n    /** Your webhook signing secret (`whsec_…`), enabling `client.webhooks.*`. */\n    webhookSecret?: string\n    /** Custom fetch (defaults to global fetch; Node 18+). */\n    fetch?: typeof fetch\n    /** Per-request timeout in ms. Default 30000. */\n    timeoutMs?: number\n}\n\nexport type HttpMethod = 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE'\n\nexport interface RequestOptions {\n    query?: Record<string, string | number | boolean | undefined>\n    body?: unknown\n    /** Act on this user's behalf — sets the `X-OpenMarkets-Account` header. */\n    actAs?: string\n}\n\n// Inputs (snake_case to match the API — buy legs map 1:1 from liquidity entries).\nexport interface ProvisionUserParams {\n    external_user_id: string\n    email?: string\n    name?: string\n}\nexport type LinkSessionMode = 'connect' | 'manage'\nexport interface CreateLinkSessionParams {\n    external_user_id: string\n    return_url?: string\n    mode?: LinkSessionMode\n    allowed_partners?: string[]\n}\nexport interface BuyOrder {\n    partner_id: string\n    liquidity_hash: string\n    buy_id: string\n    amount: number\n    price: number\n    order_type: 'fill_or_kill' | 'limit'\n    currency?: string\n}\n\n// Outputs (light — partners can pass a type param for stricter typing).\nexport interface ProvisionResult {\n    created: boolean\n    external_user_id: string\n    [key: string]: unknown\n}\nexport interface LinkSession {\n    link_session_id: string\n    token: string\n    external_user_id: string\n    mode: LinkSessionMode\n    [key: string]: unknown\n}\nexport interface BuyResult {\n    results: Array<{ success?: boolean; error?: string; [key: string]: unknown }>\n}\n\ninterface FlowEnvelope<T> {\n    data?: T\n    error?: { code: string; message: string; details?: Record<string, unknown> }\n}\n\nexport interface OpenMarketsClient {\n    /** Generic typed request — escape hatch for endpoints without a helper. */\n    request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<T>\n    connect: {\n        users: {\n            provision(params: ProvisionUserParams): Promise<ProvisionResult>\n            get<T = unknown>(externalUserId: string): Promise<T>\n            getPolicy<T = unknown>(externalUserId: string): Promise<T>\n        }\n        linkSessions: {\n            create(params: CreateLinkSessionParams): Promise<LinkSession>\n            get<T = unknown>(linkSessionId: string): Promise<T>\n        }\n        webhooks: {\n            getConfig<T = unknown>(): Promise<T>\n            /** Verify a delivery using the configured `webhookSecret`. */\n            verify(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): boolean\n            /** Verify + parse, or throw. Uses the configured `webhookSecret`. */\n            constructEvent(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): ConnectWebhookEvent\n        }\n    }\n    account: {\n        partners<T = unknown>(externalUserId: string): Promise<T>\n        balances<T = unknown>(externalUserId: string): Promise<T>\n    }\n    orders: {\n        list<T = unknown>(externalUserId: string): Promise<T>\n        buy(orders: BuyOrder[], opts: { actAs: string }): Promise<BuyResult>\n    }\n    data: {\n        leagues<T = unknown>(): Promise<T>\n        contestLiquidity<T = unknown>(contestId: string): Promise<T>\n    }\n}\n\nexport function createClient(options: OpenMarketsClientOptions): OpenMarketsClient {\n    if (!options.apiKey) throw new Error('createClient: apiKey is required')\n    const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '')\n    const doFetch = options.fetch ?? globalThis.fetch\n    if (!doFetch) throw new Error('No fetch available — pass options.fetch (Node < 18)')\n    const timeoutMs = options.timeoutMs ?? 30_000\n\n    async function request<T = unknown>(\n        method: HttpMethod,\n        path: string,\n        opts: RequestOptions = {},\n    ): Promise<T> {\n        const url = new URL(baseUrl + path)\n        for (const [k, v] of Object.entries(opts.query ?? {})) {\n            if (v !== undefined) url.searchParams.set(k, String(v))\n        }\n        const headers: Record<string, string> = {\n            'X-API-Key': options.apiKey,\n            Accept: 'application/json',\n        }\n        if (opts.body !== undefined) headers['Content-Type'] = 'application/json'\n        if (opts.actAs) headers['X-OpenMarkets-Account'] = opts.actAs\n\n        const ctrl = new AbortController()\n        const timer = setTimeout(() => ctrl.abort(), timeoutMs)\n        let res: Response\n        try {\n            res = await doFetch(url.toString(), {\n                method,\n                headers,\n                body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,\n                signal: ctrl.signal,\n            })\n        } finally {\n            clearTimeout(timer)\n        }\n\n        let envelope: FlowEnvelope<T> | undefined\n        const text = await res.text()\n        if (text) {\n            try {\n                envelope = JSON.parse(text) as FlowEnvelope<T>\n            } catch {\n                /* non-JSON body */\n            }\n        }\n\n        if (!res.ok) {\n            const err = envelope?.error\n            throw new OpenMarketsError(\n                res.status,\n                err?.code ?? 'http_error',\n                err?.message ?? `Request failed with status ${res.status}`,\n                err?.details,\n            )\n        }\n        return (envelope?.data ?? (undefined as unknown)) as T\n    }\n\n    function requireSecret(): string {\n        if (!options.webhookSecret) {\n            throw new Error('webhookSecret was not provided to createClient()')\n        }\n        return options.webhookSecret\n    }\n\n    return {\n        request,\n        connect: {\n            users: {\n                provision: (params) =>\n                    request<ProvisionResult>('POST', '/flow/v1/connect/users', { body: params }),\n                get: (externalUserId) =>\n                    request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}`),\n                getPolicy: (externalUserId) =>\n                    request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}/policy`),\n            },\n            linkSessions: {\n                create: (params) =>\n                    request<LinkSession>('POST', '/flow/v1/connect/link-sessions', { body: params }),\n                get: (linkSessionId) =>\n                    request('GET', `/flow/v1/connect/link-sessions/${encodeURIComponent(linkSessionId)}`),\n            },\n            webhooks: {\n                getConfig: () => request('GET', '/flow/v1/connect/webhook-config'),\n                verify: (rawBody, sig, opts) =>\n                    verifyWebhookSignature(requireSecret(), rawBody, sig, opts),\n                constructEvent: (rawBody, sig, opts) =>\n                    constructWebhookEvent(requireSecret(), rawBody, sig, opts),\n            },\n        },\n        account: {\n            partners: (externalUserId) =>\n                request('GET', '/flow/v1/auth/account/partners', { actAs: externalUserId }),\n            balances: (externalUserId) =>\n                request('GET', '/flow/v1/auth/account/balances', { actAs: externalUserId }),\n        },\n        orders: {\n            list: (externalUserId) =>\n                request('GET', '/flow/v1/auth/orders', { actAs: externalUserId }),\n            buy: (orders, opts) =>\n                request<BuyResult>('POST', '/flow/v1/auth/orders/buy', {\n                    body: { orders },\n                    actAs: opts.actAs,\n                }),\n        },\n        data: {\n            leagues: () => request('GET', '/flow/v1/leagues'),\n            contestLiquidity: (contestId) =>\n                request('GET', `/flow/v1/contests/${encodeURIComponent(contestId)}/liquidity`),\n        },\n    }\n}\n"]}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@openmarketsai/connect-node",
+  "version": "0.1.0",
+  "description": "Server SDK for OpenMarkets Connect — provision users, mint link sessions, verify webhooks, and execute on a user's behalf.",
+  "license": "UNLICENSED",
+  "type": "module",
+  "sideEffects": false,
+  "files": ["dist", "README.md"],
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "type-check": "tsc --noEmit"
+  },
+  "keywords": ["openmarkets", "connect", "prediction-markets", "sdk", "server"],
+  "engines": {
+    "node": ">=18"
+  },
+  "devDependencies": {
+    "@types/node": "^20.19.25",
+    "tsup": "^8.3.5",
+    "typescript": "^5"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}