@openmarketsai/connect-node 0.3.0 → 0.4.0

package/dist/index.cjs

@@ -129,6 +129,17 @@ function createClient(options) {
         create: (params) => request("POST", "/flow/v1/connect/link-sessions", { body: params }),
         get: (linkSessionId) => request("GET", `/flow/v1/connect/link-sessions/${encodeURIComponent(linkSessionId)}`)
       },
+      configs: {
+        get: (workspaceId) => request(
+          "GET",
+          `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`
+        ),
+        update: (workspaceId, config) => request(
+          "PUT",
+          `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`,
+          { body: { config } }
+        )
+      },
       webhooks: {
         getConfig: () => request("GET", "/flow/v1/connect/webhook-config"),
         verify: (rawBody, sig, opts) => verifyWebhookSignature(requireSecret(), rawBody, sig, opts),

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["crypto"],"mappings":";;;;;;;;;AAkBO,IAAM,gBAAA,GAAmB;AAOzB,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAIxC,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAmC;AAC1F,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACnB;AACJ;AAGO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC7C,YAAY,OAAA,EAAiB;AACzB,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EAChB;AACJ;AA2BA,SAAS,MAAM,IAAA,EAA+B;AAC1C,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,IAAA,CAAK,SAAS,MAAM,CAAA;AACjE;AAEA,SAAS,qBAAqB,MAAA,EAAkD;AAC5E,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,CAAM,GAAG,EAAE,MAAA,CAA+B,CAAC,KAAK,EAAA,KAAO;AACxE,IAAA,MAAM,GAAA,GAAM,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,MAAM,CAAA,EAAG,GAAA,CAAI,EAAA,CAAG,KAAA,CAAM,GAAG,GAAG,CAAA,CAAE,IAAA,EAAM,IAAI,EAAA,CAAG,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxB,EAAA,IAAI,CAAC,KAAA,CAAM,EAAA,IAAM,CAAC,QAAA,CAAS,CAAC,GAAG,OAAO,IAAA;AACtC,EAAA,OAAO,EAAE,CAAA,EAAG,EAAA,EAAI,KAAA,CAAM,EAAA,EAAG;AAC7B;AAEA,SAAS,kBAAA,CAAmB,GAAW,CAAA,EAAoB;AACvD,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,IAAI,GAAG,MAAA,KAAW,CAAA,IAAK,GAAG,MAAA,KAAW,EAAA,CAAG,QAAQ,OAAO,KAAA;AACvD,EAAA,OAAOA,uBAAA,CAAO,eAAA,CAAgB,EAAA,EAAI,EAAE,CAAA;AACxC;AAGO,SAAS,uBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACvB;AACP,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,eAAA,EAAiB,OAAO,KAAA;AACxC,EAAA,MAAM,MAAA,GAAS,qBAAqB,eAAe,CAAA;AACnD,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,GAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC1D,EAAA,IAAI,YAAA,GAAe,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,MAAA,CAAO,CAAC,CAAA,GAAI,YAAA,EAAc,OAAO,KAAA;AAC3E,EAAA,MAAM,WAAWA,uBAAA,CACZ,UAAA,CAAW,QAAA,EAAU,MAAM,EAC3B,MAAA,CAAO,CAAA,EAAG,MAAA,CAAO,CAAC,IAAI,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,CAAA,CACtC,OAAO,KAAK,CAAA;AACjB,EAAA,OAAO,kBAAA,CAAmB,QAAA,EAAU,MAAA,CAAO,EAAE,CAAA;AACjD;AAGO,SAAS,sBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACX;AACnB,EAAA,IAAI,CAAC,sBAAA,CAAuB,MAAA,EAAQ,OAAA,EAAS,eAAA,EAAiB,IAAI,CAAA,EAAG;AACjE,IAAA,MAAM,IAAI,sBAAsB,sCAAsC,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI;AACA,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AACJ,IAAA,MAAM,IAAI,sBAAsB,gCAAgC,CAAA;AAAA,EACpE;AACJ;AAgLO,SAAS,aAAa,OAAA,EAAsD;AAC/E,EAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,MAAM,kCAAkC,CAAA;AACvE,EAAA,MAAM,WAAW,OAAA,CAAQ,OAAA,IAAW,gBAAA,EAAkB,OAAA,CAAQ,OAAO,EAAE,CAAA;AACvE,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,0DAAqD,CAAA;AACnF,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,GAAA;AAEvC,EAAA,eAAe,OAAA,CACX,MAAA,EACA,IAAA,EACA,IAAA,GAAuB,EAAC,EACd;AACV,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,GAAU,IAAI,CAAA;AAClC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA,EAAG;AACnD,MAAA,IAAI,CAAA,KAAM,QAAW,GAAA,CAAI,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,aAAa,OAAA,CAAQ,MAAA;AAAA,MACrB,MAAA,EAAQ;AAAA,KACZ;AACA,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AACvD,IAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAA,CAAQ,uBAAuB,IAAI,IAAA,CAAK,KAAA;AAExD,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,IAAA,CAAK,KAAA,IAAS,SAAS,CAAA;AACtD,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACA,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,IAAA,CAAK;AAAA,OAChB,CAAA;AAAA,IACL,CAAA,SAAE;AACE,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACtB;AAEA,IAAA,IAAI,QAAA;AACJ,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,IAAA,EAAM;AACN,MAAA,IAAI;AACA,QAAA,QAAA,GAAW,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,MAC9B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,MAAM,QAAA,EAAU,KAAA;AACtB,MAAA,MAAM,IAAI,gBAAA;AAAA,QACN,GAAA,CAAI,MAAA;AAAA,QACJ,KAAK,IAAA,IAAQ,YAAA;AAAA,QACb,GAAA,EAAK,OAAA,IAAW,CAAA,2BAAA,EAA8B,GAAA,CAAI,MAAM,CAAA,CAAA;AAAA,QACxD,GAAA,EAAK;AAAA,OACT;AAAA,IACJ;AACA,IAAA,OAAQ,UAAU,IAAA,IAAS,MAAA;AAAA,EAC/B;AAEA,EAAA,SAAS,aAAA,GAAwB;AAC7B,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AACxB,MAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,OAAA,CAAQ,aAAA;AAAA,EACnB;AAEA,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,KAAA,EAAO;AAAA,QACH,SAAA,EAAW,CAAC,MAAA,KACR,OAAA,CAAyB,QAAQ,wBAAA,EAA0B,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QAC/E,GAAA,EAAK,CAAC,cAAA,KACF,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,CAAE,CAAA;AAAA,QACjF,SAAA,EAAW,CAAC,cAAA,KACR,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,OAAA,CAAS;AAAA,OAC5F;AAAA,MACA,YAAA,EAAc;AAAA,QACV,MAAA,EAAQ,CAAC,MAAA,KACL,OAAA,CAAqB,QAAQ,gCAAA,EAAkC,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QACnF,GAAA,EAAK,CAAC,aAAA,KACF,OAAA,CAAQ,OAAO,CAAA,+BAAA,EAAkC,kBAAA,CAAmB,aAAa,CAAC,CAAA,CAAE;AAAA,OAC5F;AAAA,MACA,QAAA,EAAU;AAAA,QACN,SAAA,EAAW,MAAM,OAAA,CAAQ,KAAA,EAAO,iCAAiC,CAAA;AAAA,QACjE,MAAA,EAAQ,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KACnB,uBAAuB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI,CAAA;AAAA,QAC9D,cAAA,EAAgB,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KAC3B,sBAAsB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI;AAAA;AACjE,KACJ;AAAA,IACA,OAAA,EAAS;AAAA,MACL,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MAC9E,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB;AAAA,KAClF;AAAA,IACA,MAAA,EAAQ;AAAA,MACJ,IAAA,EAAM,CAAC,cAAA,KACH,OAAA,CAAQ,OAAO,sBAAA,EAAwB,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MACpE,KAAK,CAAC,MAAA,EAAQ,IAAA,KACV,OAAA,CAAmB,QAAQ,0BAAA,EAA4B;AAAA,QACnD,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,QACf,OAAO,IAAA,CAAK;AAAA,OACf;AAAA,KACT;AAAA,IACA,IAAA,EAAM;AAAA,MACF,OAAA,EAAS,MAAM,OAAA,CAAQ,KAAA,EAAO,kBAAkB,CAAA;AAAA,MAChD,gBAAA,EAAkB,CAAC,SAAA,KACf,OAAA,CAAQ,OAAO,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,SAAS,CAAC,CAAA,UAAA,CAAY;AAAA;AACrF,GACJ;AACJ","file":"index.cjs","sourcesContent":["/**\n * @openmarketsai/connect-node\n *\n * Server SDK for OpenMarkets Connect. A thin, typed wrapper over the Flow API:\n * provision your users, mint hosted link sessions, verify webhook deliveries,\n * read on a user's behalf, and execute orders on their account.\n *\n *   import { createClient } from '@openmarketsai/connect-node'\n *   const om = createClient({ apiKey: process.env.OM_API_KEY! })\n *\n *   await om.connect.users.provision({ external_user_id: 'user-123' })\n *   const { token } = await om.connect.linkSessions.create({ external_user_id: 'user-123' })\n *   await om.orders.buy([leg], { actAs: 'user-123' })\n *\n * Pairs with @openmarketsai/connect-web (the in-app launcher).\n */\nimport crypto from 'node:crypto'\n\nexport const DEFAULT_BASE_URL = 'https://api.openmarkets.ai'\n\n// ──────────────────────────────────────────────────────────────────────────\n// Errors\n// ──────────────────────────────────────────────────────────────────────────\n\n/** Thrown when the API returns a non-2xx response. Mirrors the Flow error envelope. */\nexport class OpenMarketsError extends Error {\n    readonly status: number\n    readonly code: string\n    readonly details?: Record<string, unknown>\n    constructor(status: number, code: string, message: string, details?: Record<string, unknown>) {\n        super(message)\n        this.name = 'OpenMarketsError'\n        this.status = status\n        this.code = code\n        this.details = details\n    }\n}\n\n/** Thrown by `constructWebhookEvent` when a signature is missing, stale, or invalid. */\nexport class WebhookSignatureError extends Error {\n    constructor(message: string) {\n        super(message)\n        this.name = 'WebhookSignatureError'\n    }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Webhook verification (matches src/utils/webhook-signature.ts byte-for-byte)\n//\n//   Header: X-OpenMarkets-Signature: t=<unix_seconds>,v1=<hex hmac>\n//   Signed string: `${t}.${rawBody}`, HMAC-SHA256 with your whsec_ secret.\n//   IMPORTANT: verify over the EXACT raw request body, not a re-serialized object.\n// ──────────────────────────────────────────────────────────────────────────\n\nexport type ConnectWebhookEventType =\n    | 'user.partners_connected'\n    | 'user.permissions_changed'\n    | (string & {})\n\nexport interface ConnectWebhookEvent {\n    type: ConnectWebhookEventType\n    [key: string]: unknown\n}\n\nexport interface VerifyWebhookOptions {\n    /** Max age of the signature timestamp, in seconds. Default 300 (5 min). 0 disables. */\n    toleranceSec?: number\n    /** Injectable clock for testing. */\n    nowSec?: number\n}\n\nfunction toRaw(body: string | Buffer): string {\n    return typeof body === 'string' ? body : body.toString('utf8')\n}\n\nfunction parseSignatureHeader(header: string): { t: number; v1: string } | null {\n    const parts = header.split(',').reduce<Record<string, string>>((acc, kv) => {\n        const idx = kv.indexOf('=')\n        if (idx > 0) acc[kv.slice(0, idx).trim()] = kv.slice(idx + 1).trim()\n        return acc\n    }, {})\n    const t = Number(parts.t)\n    if (!parts.v1 || !isFinite(t)) return null\n    return { t, v1: parts.v1 }\n}\n\nfunction timingSafeEqualHex(a: string, b: string): boolean {\n    const ab = Buffer.from(a, 'hex')\n    const bb = Buffer.from(b, 'hex')\n    if (ab.length === 0 || ab.length !== bb.length) return false\n    return crypto.timingSafeEqual(ab, bb)\n}\n\n/** Verify a webhook signature. Returns false on any failure (never throws). */\nexport function verifyWebhookSignature(\n    secret: string,\n    rawBody: string | Buffer,\n    signatureHeader: string | null | undefined,\n    opts: VerifyWebhookOptions = {},\n): boolean {\n    if (!secret || !signatureHeader) return false\n    const parsed = parseSignatureHeader(signatureHeader)\n    if (!parsed) return false\n    const toleranceSec = opts.toleranceSec ?? 300\n    const nowSec = opts.nowSec ?? Math.floor(Date.now() / 1000)\n    if (toleranceSec > 0 && Math.abs(nowSec - parsed.t) > toleranceSec) return false\n    const expected = crypto\n        .createHmac('sha256', secret)\n        .update(`${parsed.t}.${toRaw(rawBody)}`)\n        .digest('hex')\n    return timingSafeEqualHex(expected, parsed.v1)\n}\n\n/** Verify the signature and return the parsed event, or throw `WebhookSignatureError`. */\nexport function constructWebhookEvent(\n    secret: string,\n    rawBody: string | Buffer,\n    signatureHeader: string | null | undefined,\n    opts: VerifyWebhookOptions = {},\n): ConnectWebhookEvent {\n    if (!verifyWebhookSignature(secret, rawBody, signatureHeader, opts)) {\n        throw new WebhookSignatureError('Invalid or expired webhook signature')\n    }\n    try {\n        return JSON.parse(toRaw(rawBody)) as ConnectWebhookEvent\n    } catch {\n        throw new WebhookSignatureError('Webhook body is not valid JSON')\n    }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Client\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface OpenMarketsClientOptions {\n    /** Your Connect org API key. Sent as `X-API-Key`. */\n    apiKey: string\n    /** API base URL. Defaults to https://api.openmarkets.ai. */\n    baseUrl?: string\n    /** Your webhook signing secret (`whsec_…`), enabling `client.webhooks.*`. */\n    webhookSecret?: string\n    /** Custom fetch (defaults to global fetch; Node 18+). */\n    fetch?: typeof fetch\n    /** Per-request timeout in ms. Default 30000. */\n    timeoutMs?: number\n}\n\nexport type HttpMethod = 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE'\n\nexport interface RequestOptions {\n    query?: Record<string, string | number | boolean | undefined>\n    body?: unknown\n    /** Act on this user's behalf — sets the `X-OpenMarkets-Account` header. */\n    actAs?: string\n}\n\n// Inputs (snake_case to match the API — buy legs map 1:1 from liquidity entries).\nexport interface ProvisionUserParams {\n    external_user_id: string\n    email?: string\n    name?: string\n}\nexport type LinkSessionMode = 'connect' | 'manage'\nexport interface CreateLinkSessionParams {\n    external_user_id: string\n    return_url?: string\n    mode?: LinkSessionMode\n    allowed_partners?: string[]\n    /** Pick a specific org Connect config; omit to use the org's default (if any). */\n    connect_config_id?: string\n}\nexport interface BuyOrder {\n    /** What to buy — set exactly one of position_hash or liquidity_hash. */\n    position_hash?: string\n    liquidity_hash?: string\n    /** Size — set exactly one of amount or shares. */\n    amount?: number // stake, notional USD\n    shares?: number // contract count (each pays $1 on win)\n    /** Price ceiling, 0..1 exclusive — won't fill above this. */\n    max_price: number\n    /** Optional — pin a venue; omit to route to the best price. */\n    partner_id?: string\n    /** Optional — 'real' (default) or 'paper' (practice book). */\n    mode?: 'real' | 'paper'\n}\n\n// Outputs (light — partners can pass a type param for stricter typing).\n/**\n * `POST /flow/v1/connect/users`. Idempotent — safe to call on every login.\n *\n * `om_account_id` is the field an integration actually needs (it addresses the\n * user in later calls) and was previously absent, so it typed as `unknown` via\n * the index signature.\n */\nexport interface ProvisionResult {\n    /** Our id for this user. Pass as `actAs` when trading on their behalf. */\n    om_account_id: string\n    external_user_id: string\n    /** false when the user already existed. */\n    created: boolean\n    [key: string]: unknown\n}\n/**\n * The response of `POST /flow/v1/connect/link-sessions`.\n *\n * These names are the API's, verified against the route rather than assumed:\n * it returns `link_token`, NOT `token`. The previous declaration named `token`,\n * `external_user_id` and `mode` — none of which the endpoint sends — so the one\n * field an integration actually needs type-checked as a string and arrived\n * `undefined`, opening the hosted flow with `token=undefined`. The index\n * signature below is what kept that quiet; keep these names in step with\n * `CreateLinkSessionResult` in LinkSessionOrchestrator.\n */\nexport interface LinkSession {\n    link_session_id: string\n    /** Single-use, expires in 15 minutes. Hand to `createConnect().open()`. */\n    link_token: string\n    /** The hosted flow URL, for redirect mode or a native in-app browser. */\n    hosted_url: string\n    expires_at: string\n    [key: string]: unknown\n}\n/**\n * The status of one leg, mirroring `flowLegStatus` in the API.\n *\n * ALL FIVE values are reachable. This union previously listed only three, so a\n * `switch` written against the SDK's types compiled clean and silently fell\n * through for a resting or pending order — an order that IS live, sitting on a\n * venue book, treated as if it had never been placed. Any change here must\n * follow the API, not the other way round.\n */\nexport type BuyLegStatus =\n    /** Filled or partially filled. */\n    | 'completed'\n    /** Live on the venue's book, unfilled. Not a failure — check back. */\n    | 'resting'\n    /** Accepted by the venue, fill not yet confirmed (async venues). */\n    | 'pending'\n    /** The venue or a pre-trade gate rejected it. */\n    | 'failed'\n    /** No viable venue was found; nothing was sent. */\n    | 'rejected'\n\nexport interface BuyResult {\n    results: Array<{\n        index: number\n        status: BuyLegStatus\n        /** NULL when the leg was rejected before routing — no decision was made. */\n        sor_decision_id: string | null\n        filled_notional: number\n        filled_shares: number\n        /** The un-buyable remainder of the requested stake. */\n        unfilled_notional: number\n        avg_price: number | null\n        rejected_reason: string | null\n        venues: Array<{\n            partner_id: string\n            success: boolean\n            router_order_id: string | null\n            error: string | null\n        }>\n    }>\n}\n\ninterface FlowEnvelope<T> {\n    data?: T\n    error?: { code: string; message: string; details?: Record<string, unknown> }\n}\n\nexport interface OpenMarketsClient {\n    /** Generic typed request — escape hatch for endpoints without a helper. */\n    request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<T>\n    connect: {\n        users: {\n            provision(params: ProvisionUserParams): Promise<ProvisionResult>\n            get<T = unknown>(externalUserId: string): Promise<T>\n            getPolicy<T = unknown>(externalUserId: string): Promise<T>\n        }\n        linkSessions: {\n            create(params: CreateLinkSessionParams): Promise<LinkSession>\n            get<T = unknown>(linkSessionId: string): Promise<T>\n        }\n        webhooks: {\n            getConfig<T = unknown>(): Promise<T>\n            /** Verify a delivery using the configured `webhookSecret`. */\n            verify(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): boolean\n            /** Verify + parse, or throw. Uses the configured `webhookSecret`. */\n            constructEvent(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): ConnectWebhookEvent\n        }\n    }\n    account: {\n        partners<T = unknown>(externalUserId: string): Promise<T>\n        balances<T = unknown>(externalUserId: string): Promise<T>\n    }\n    orders: {\n        list<T = unknown>(externalUserId: string): Promise<T>\n        buy(orders: BuyOrder[], opts: { actAs: string }): Promise<BuyResult>\n    }\n    data: {\n        leagues<T = unknown>(): Promise<T>\n        contestLiquidity<T = unknown>(contestId: string): Promise<T>\n    }\n}\n\nexport function createClient(options: OpenMarketsClientOptions): OpenMarketsClient {\n    if (!options.apiKey) throw new Error('createClient: apiKey is required')\n    const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '')\n    const doFetch = options.fetch ?? globalThis.fetch\n    if (!doFetch) throw new Error('No fetch available — pass options.fetch (Node < 18)')\n    const timeoutMs = options.timeoutMs ?? 30_000\n\n    async function request<T = unknown>(\n        method: HttpMethod,\n        path: string,\n        opts: RequestOptions = {},\n    ): Promise<T> {\n        const url = new URL(baseUrl + path)\n        for (const [k, v] of Object.entries(opts.query ?? {})) {\n            if (v !== undefined) url.searchParams.set(k, String(v))\n        }\n        const headers: Record<string, string> = {\n            'X-API-Key': options.apiKey,\n            Accept: 'application/json',\n        }\n        if (opts.body !== undefined) headers['Content-Type'] = 'application/json'\n        if (opts.actAs) headers['X-OpenMarkets-Account'] = opts.actAs\n\n        const ctrl = new AbortController()\n        const timer = setTimeout(() => ctrl.abort(), timeoutMs)\n        let res: Response\n        try {\n            res = await doFetch(url.toString(), {\n                method,\n                headers,\n                body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,\n                signal: ctrl.signal,\n            })\n        } finally {\n            clearTimeout(timer)\n        }\n\n        let envelope: FlowEnvelope<T> | undefined\n        const text = await res.text()\n        if (text) {\n            try {\n                envelope = JSON.parse(text) as FlowEnvelope<T>\n            } catch {\n                /* non-JSON body */\n            }\n        }\n\n        if (!res.ok) {\n            const err = envelope?.error\n            throw new OpenMarketsError(\n                res.status,\n                err?.code ?? 'http_error',\n                err?.message ?? `Request failed with status ${res.status}`,\n                err?.details,\n            )\n        }\n        return (envelope?.data ?? (undefined as unknown)) as T\n    }\n\n    function requireSecret(): string {\n        if (!options.webhookSecret) {\n            throw new Error('webhookSecret was not provided to createClient()')\n        }\n        return options.webhookSecret\n    }\n\n    return {\n        request,\n        connect: {\n            users: {\n                provision: (params) =>\n                    request<ProvisionResult>('POST', '/flow/v1/connect/users', { body: params }),\n                get: (externalUserId) =>\n                    request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}`),\n                getPolicy: (externalUserId) =>\n                    request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}/policy`),\n            },\n            linkSessions: {\n                create: (params) =>\n                    request<LinkSession>('POST', '/flow/v1/connect/link-sessions', { body: params }),\n                get: (linkSessionId) =>\n                    request('GET', `/flow/v1/connect/link-sessions/${encodeURIComponent(linkSessionId)}`),\n            },\n            webhooks: {\n                getConfig: () => request('GET', '/flow/v1/connect/webhook-config'),\n                verify: (rawBody, sig, opts) =>\n                    verifyWebhookSignature(requireSecret(), rawBody, sig, opts),\n                constructEvent: (rawBody, sig, opts) =>\n                    constructWebhookEvent(requireSecret(), rawBody, sig, opts),\n            },\n        },\n        account: {\n            partners: (externalUserId) =>\n                request('GET', '/flow/v1/auth/account/partners', { actAs: externalUserId }),\n            balances: (externalUserId) =>\n                request('GET', '/flow/v1/auth/account/balances', { actAs: externalUserId }),\n        },\n        orders: {\n            list: (externalUserId) =>\n                request('GET', '/flow/v1/auth/orders', { actAs: externalUserId }),\n            buy: (orders, opts) =>\n                request<BuyResult>('POST', '/flow/v1/auth/orders/buy', {\n                    body: { orders },\n                    actAs: opts.actAs,\n                }),\n        },\n        data: {\n            leagues: () => request('GET', '/flow/v1/leagues'),\n            contestLiquidity: (contestId) =>\n                request('GET', `/flow/v1/contests/${encodeURIComponent(contestId)}/liquidity`),\n        },\n    }\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["crypto"],"mappings":";;;;;;;;;AAkBO,IAAM,gBAAA,GAAmB;AAOzB,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAIxC,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAmC;AAC1F,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACnB;AACJ;AAGO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC7C,YAAY,OAAA,EAAiB;AACzB,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EAChB;AACJ;AA2BA,SAAS,MAAM,IAAA,EAA+B;AAC1C,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,IAAA,CAAK,SAAS,MAAM,CAAA;AACjE;AAEA,SAAS,qBAAqB,MAAA,EAAkD;AAC5E,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,CAAM,GAAG,EAAE,MAAA,CAA+B,CAAC,KAAK,EAAA,KAAO;AACxE,IAAA,MAAM,GAAA,GAAM,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,MAAM,CAAA,EAAG,GAAA,CAAI,EAAA,CAAG,KAAA,CAAM,GAAG,GAAG,CAAA,CAAE,IAAA,EAAM,IAAI,EAAA,CAAG,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxB,EAAA,IAAI,CAAC,KAAA,CAAM,EAAA,IAAM,CAAC,QAAA,CAAS,CAAC,GAAG,OAAO,IAAA;AACtC,EAAA,OAAO,EAAE,CAAA,EAAG,EAAA,EAAI,KAAA,CAAM,EAAA,EAAG;AAC7B;AAEA,SAAS,kBAAA,CAAmB,GAAW,CAAA,EAAoB;AACvD,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,IAAI,GAAG,MAAA,KAAW,CAAA,IAAK,GAAG,MAAA,KAAW,EAAA,CAAG,QAAQ,OAAO,KAAA;AACvD,EAAA,OAAOA,uBAAA,CAAO,eAAA,CAAgB,EAAA,EAAI,EAAE,CAAA;AACxC;AAGO,SAAS,uBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACvB;AACP,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,eAAA,EAAiB,OAAO,KAAA;AACxC,EAAA,MAAM,MAAA,GAAS,qBAAqB,eAAe,CAAA;AACnD,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,GAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC1D,EAAA,IAAI,YAAA,GAAe,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,MAAA,CAAO,CAAC,CAAA,GAAI,YAAA,EAAc,OAAO,KAAA;AAC3E,EAAA,MAAM,WAAWA,uBAAA,CACZ,UAAA,CAAW,QAAA,EAAU,MAAM,EAC3B,MAAA,CAAO,CAAA,EAAG,MAAA,CAAO,CAAC,IAAI,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,CAAA,CACtC,OAAO,KAAK,CAAA;AACjB,EAAA,OAAO,kBAAA,CAAmB,QAAA,EAAU,MAAA,CAAO,EAAE,CAAA;AACjD;AAGO,SAAS,sBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACX;AACnB,EAAA,IAAI,CAAC,sBAAA,CAAuB,MAAA,EAAQ,OAAA,EAAS,eAAA,EAAiB,IAAI,CAAA,EAAG;AACjE,IAAA,MAAM,IAAI,sBAAsB,sCAAsC,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI;AACA,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AACJ,IAAA,MAAM,IAAI,sBAAsB,gCAAgC,CAAA;AAAA,EACpE;AACJ;AA0OO,SAAS,aAAa,OAAA,EAAsD;AAC/E,EAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,MAAM,kCAAkC,CAAA;AACvE,EAAA,MAAM,WAAW,OAAA,CAAQ,OAAA,IAAW,gBAAA,EAAkB,OAAA,CAAQ,OAAO,EAAE,CAAA;AACvE,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,0DAAqD,CAAA;AACnF,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,GAAA;AAEvC,EAAA,eAAe,OAAA,CACX,MAAA,EACA,IAAA,EACA,IAAA,GAAuB,EAAC,EACd;AACV,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,GAAU,IAAI,CAAA;AAClC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA,EAAG;AACnD,MAAA,IAAI,CAAA,KAAM,QAAW,GAAA,CAAI,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,aAAa,OAAA,CAAQ,MAAA;AAAA,MACrB,MAAA,EAAQ;AAAA,KACZ;AACA,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AACvD,IAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAA,CAAQ,uBAAuB,IAAI,IAAA,CAAK,KAAA;AAExD,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,IAAA,CAAK,KAAA,IAAS,SAAS,CAAA;AACtD,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACA,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,IAAA,CAAK;AAAA,OAChB,CAAA;AAAA,IACL,CAAA,SAAE;AACE,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACtB;AAEA,IAAA,IAAI,QAAA;AACJ,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,IAAA,EAAM;AACN,MAAA,IAAI;AACA,QAAA,QAAA,GAAW,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,MAC9B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,MAAM,QAAA,EAAU,KAAA;AACtB,MAAA,MAAM,IAAI,gBAAA;AAAA,QACN,GAAA,CAAI,MAAA;AAAA,QACJ,KAAK,IAAA,IAAQ,YAAA;AAAA,QACb,GAAA,EAAK,OAAA,IAAW,CAAA,2BAAA,EAA8B,GAAA,CAAI,MAAM,CAAA,CAAA;AAAA,QACxD,GAAA,EAAK;AAAA,OACT;AAAA,IACJ;AACA,IAAA,OAAQ,UAAU,IAAA,IAAS,MAAA;AAAA,EAC/B;AAEA,EAAA,SAAS,aAAA,GAAwB;AAC7B,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AACxB,MAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,OAAA,CAAQ,aAAA;AAAA,EACnB;AAEA,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,KAAA,EAAO;AAAA,QACH,SAAA,EAAW,CAAC,MAAA,KACR,OAAA,CAAyB,QAAQ,wBAAA,EAA0B,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QAC/E,GAAA,EAAK,CAAC,cAAA,KACF,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,CAAE,CAAA;AAAA,QACjF,SAAA,EAAW,CAAC,cAAA,KACR,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,OAAA,CAAS;AAAA,OAC5F;AAAA,MACA,YAAA,EAAc;AAAA,QACV,MAAA,EAAQ,CAAC,MAAA,KACL,OAAA,CAAqB,QAAQ,gCAAA,EAAkC,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QACnF,GAAA,EAAK,CAAC,aAAA,KACF,OAAA,CAAQ,OAAO,CAAA,+BAAA,EAAkC,kBAAA,CAAmB,aAAa,CAAC,CAAA,CAAE;AAAA,OAC5F;AAAA,MACA,OAAA,EAAS;AAAA,QACL,GAAA,EAAK,CAAC,WAAA,KACF,OAAA;AAAA,UACI,KAAA;AAAA,UAAO,CAAA,oBAAA,EAAuB,kBAAA,CAAmB,WAAW,CAAC,CAAA,eAAA;AAAA,SACjE;AAAA,QACJ,MAAA,EAAQ,CAAC,WAAA,EAAqB,MAAA,KAC1B,OAAA;AAAA,UACI,KAAA;AAAA,UAAO,CAAA,oBAAA,EAAuB,kBAAA,CAAmB,WAAW,CAAC,CAAA,eAAA,CAAA;AAAA,UAC7D,EAAE,IAAA,EAAM,EAAE,MAAA,EAAO;AAAE;AACvB,OACR;AAAA,MACA,QAAA,EAAU;AAAA,QACN,SAAA,EAAW,MAAM,OAAA,CAAQ,KAAA,EAAO,iCAAiC,CAAA;AAAA,QACjE,MAAA,EAAQ,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KACnB,uBAAuB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI,CAAA;AAAA,QAC9D,cAAA,EAAgB,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KAC3B,sBAAsB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI;AAAA;AACjE,KACJ;AAAA,IACA,OAAA,EAAS;AAAA,MACL,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MAC9E,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB;AAAA,KAClF;AAAA,IACA,MAAA,EAAQ;AAAA,MACJ,IAAA,EAAM,CAAC,cAAA,KACH,OAAA,CAAQ,OAAO,sBAAA,EAAwB,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MACpE,KAAK,CAAC,MAAA,EAAQ,IAAA,KACV,OAAA,CAAmB,QAAQ,0BAAA,EAA4B;AAAA,QACnD,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,QACf,OAAO,IAAA,CAAK;AAAA,OACf;AAAA,KACT;AAAA,IACA,IAAA,EAAM;AAAA,MACF,OAAA,EAAS,MAAM,OAAA,CAAQ,KAAA,EAAO,kBAAkB,CAAA;AAAA,MAChD,gBAAA,EAAkB,CAAC,SAAA,KACf,OAAA,CAAQ,OAAO,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,SAAS,CAAC,CAAA,UAAA,CAAY;AAAA;AACrF,GACJ;AACJ","file":"index.cjs","sourcesContent":["/**\n * @openmarketsai/connect-node\n *\n * Server SDK for OpenMarkets Connect. A thin, typed wrapper over the Flow API:\n * provision your users, mint hosted link sessions, verify webhook deliveries,\n * read on a user's behalf, and execute orders on their account.\n *\n *   import { createClient } from '@openmarketsai/connect-node'\n *   const om = createClient({ apiKey: process.env.OM_API_KEY! })\n *\n *   await om.connect.users.provision({ external_user_id: 'user-123' })\n *   const { token } = await om.connect.linkSessions.create({ external_user_id: 'user-123' })\n *   await om.orders.buy([leg], { actAs: 'user-123' })\n *\n * Pairs with @openmarketsai/connect-web (the in-app launcher).\n */\nimport crypto from 'node:crypto'\n\nexport const DEFAULT_BASE_URL = 'https://api.openmarkets.ai'\n\n// ──────────────────────────────────────────────────────────────────────────\n// Errors\n// ──────────────────────────────────────────────────────────────────────────\n\n/** Thrown when the API returns a non-2xx response. Mirrors the Flow error envelope. */\nexport class OpenMarketsError extends Error {\n    readonly status: number\n    readonly code: string\n    readonly details?: Record<string, unknown>\n    constructor(status: number, code: string, message: string, details?: Record<string, unknown>) {\n        super(message)\n        this.name = 'OpenMarketsError'\n        this.status = status\n        this.code = code\n        this.details = details\n    }\n}\n\n/** Thrown by `constructWebhookEvent` when a signature is missing, stale, or invalid. */\nexport class WebhookSignatureError extends Error {\n    constructor(message: string) {\n        super(message)\n        this.name = 'WebhookSignatureError'\n    }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Webhook verification (matches src/utils/webhook-signature.ts byte-for-byte)\n//\n//   Header: X-OpenMarkets-Signature: t=<unix_seconds>,v1=<hex hmac>\n//   Signed string: `${t}.${rawBody}`, HMAC-SHA256 with your whsec_ secret.\n//   IMPORTANT: verify over the EXACT raw request body, not a re-serialized object.\n// ──────────────────────────────────────────────────────────────────────────\n\nexport type ConnectWebhookEventType =\n    | 'user.partners_connected'\n    | 'user.permissions_changed'\n    | (string & {})\n\nexport interface ConnectWebhookEvent {\n    type: ConnectWebhookEventType\n    [key: string]: unknown\n}\n\nexport interface VerifyWebhookOptions {\n    /** Max age of the signature timestamp, in seconds. Default 300 (5 min). 0 disables. */\n    toleranceSec?: number\n    /** Injectable clock for testing. */\n    nowSec?: number\n}\n\nfunction toRaw(body: string | Buffer): string {\n    return typeof body === 'string' ? body : body.toString('utf8')\n}\n\nfunction parseSignatureHeader(header: string): { t: number; v1: string } | null {\n    const parts = header.split(',').reduce<Record<string, string>>((acc, kv) => {\n        const idx = kv.indexOf('=')\n        if (idx > 0) acc[kv.slice(0, idx).trim()] = kv.slice(idx + 1).trim()\n        return acc\n    }, {})\n    const t = Number(parts.t)\n    if (!parts.v1 || !isFinite(t)) return null\n    return { t, v1: parts.v1 }\n}\n\nfunction timingSafeEqualHex(a: string, b: string): boolean {\n    const ab = Buffer.from(a, 'hex')\n    const bb = Buffer.from(b, 'hex')\n    if (ab.length === 0 || ab.length !== bb.length) return false\n    return crypto.timingSafeEqual(ab, bb)\n}\n\n/** Verify a webhook signature. Returns false on any failure (never throws). */\nexport function verifyWebhookSignature(\n    secret: string,\n    rawBody: string | Buffer,\n    signatureHeader: string | null | undefined,\n    opts: VerifyWebhookOptions = {},\n): boolean {\n    if (!secret || !signatureHeader) return false\n    const parsed = parseSignatureHeader(signatureHeader)\n    if (!parsed) return false\n    const toleranceSec = opts.toleranceSec ?? 300\n    const nowSec = opts.nowSec ?? Math.floor(Date.now() / 1000)\n    if (toleranceSec > 0 && Math.abs(nowSec - parsed.t) > toleranceSec) return false\n    const expected = crypto\n        .createHmac('sha256', secret)\n        .update(`${parsed.t}.${toRaw(rawBody)}`)\n        .digest('hex')\n    return timingSafeEqualHex(expected, parsed.v1)\n}\n\n/** Verify the signature and return the parsed event, or throw `WebhookSignatureError`. */\nexport function constructWebhookEvent(\n    secret: string,\n    rawBody: string | Buffer,\n    signatureHeader: string | null | undefined,\n    opts: VerifyWebhookOptions = {},\n): ConnectWebhookEvent {\n    if (!verifyWebhookSignature(secret, rawBody, signatureHeader, opts)) {\n        throw new WebhookSignatureError('Invalid or expired webhook signature')\n    }\n    try {\n        return JSON.parse(toRaw(rawBody)) as ConnectWebhookEvent\n    } catch {\n        throw new WebhookSignatureError('Webhook body is not valid JSON')\n    }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Client\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface OpenMarketsClientOptions {\n    /** Your Connect org API key. Sent as `X-API-Key`. */\n    apiKey: string\n    /** API base URL. Defaults to https://api.openmarkets.ai. */\n    baseUrl?: string\n    /** Your webhook signing secret (`whsec_…`), enabling `client.webhooks.*`. */\n    webhookSecret?: string\n    /** Custom fetch (defaults to global fetch; Node 18+). */\n    fetch?: typeof fetch\n    /** Per-request timeout in ms. Default 30000. */\n    timeoutMs?: number\n}\n\nexport type HttpMethod = 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE'\n\nexport interface RequestOptions {\n    query?: Record<string, string | number | boolean | undefined>\n    body?: unknown\n    /** Act on this user's behalf — sets the `X-OpenMarkets-Account` header. */\n    actAs?: string\n}\n\n// Inputs (snake_case to match the API — buy legs map 1:1 from liquidity entries).\nexport interface ProvisionUserParams {\n    external_user_id: string\n    email?: string\n    name?: string\n}\nexport type LinkSessionMode = 'connect' | 'manage'\nexport interface CreateLinkSessionParams {\n    external_user_id: string\n    return_url?: string\n    mode?: LinkSessionMode\n    allowed_partners?: string[]\n    /** Pick a specific org Connect config; omit to use the org's default (if any). */\n    connect_config_id?: string\n}\nexport interface BuyOrder {\n    /** What to buy — set exactly one of position_hash or liquidity_hash. */\n    position_hash?: string\n    liquidity_hash?: string\n    /** Size — set exactly one of amount or shares. */\n    amount?: number // stake, notional USD\n    shares?: number // contract count (each pays $1 on win)\n    /** Price ceiling, 0..1 exclusive — won't fill above this. */\n    max_price: number\n    /** Optional — pin a venue; omit to route to the best price. */\n    partner_id?: string\n    /** Optional — 'real' (default) or 'paper' (practice book). */\n    mode?: 'real' | 'paper'\n}\n\n// Outputs (light — partners can pass a type param for stricter typing).\n/**\n * `POST /flow/v1/connect/users`. Idempotent — safe to call on every login.\n *\n * `om_account_id` is the field an integration actually needs (it addresses the\n * user in later calls) and was previously absent, so it typed as `unknown` via\n * the index signature.\n */\nexport interface ProvisionResult {\n    /** Our id for this user. Pass as `actAs` when trading on their behalf. */\n    om_account_id: string\n    external_user_id: string\n    /** false when the user already existed. */\n    created: boolean\n    [key: string]: unknown\n}\n/**\n * The response of `POST /flow/v1/connect/link-sessions`.\n *\n * These names are the API's, verified against the route rather than assumed:\n * it returns `link_token`, NOT `token`. The previous declaration named `token`,\n * `external_user_id` and `mode` — none of which the endpoint sends — so the one\n * field an integration actually needs type-checked as a string and arrived\n * `undefined`, opening the hosted flow with `token=undefined`. The index\n * signature below is what kept that quiet; keep these names in step with\n * `CreateLinkSessionResult` in LinkSessionOrchestrator.\n */\nexport interface LinkSession {\n    link_session_id: string\n    /** Single-use, expires in 15 minutes. Hand to `createConnect().open()`. */\n    link_token: string\n    /** The hosted flow URL, for redirect mode or a native in-app browser. */\n    hosted_url: string\n    expires_at: string\n    [key: string]: unknown\n}\n/**\n * The status of one leg, mirroring `flowLegStatus` in the API.\n *\n * ALL FIVE values are reachable. This union previously listed only three, so a\n * `switch` written against the SDK's types compiled clean and silently fell\n * through for a resting or pending order — an order that IS live, sitting on a\n * venue book, treated as if it had never been placed. Any change here must\n * follow the API, not the other way round.\n */\nexport type BuyLegStatus =\n    /** Filled or partially filled. */\n    | 'completed'\n    /** Live on the venue's book, unfilled. Not a failure — check back. */\n    | 'resting'\n    /** Accepted by the venue, fill not yet confirmed (async venues). */\n    | 'pending'\n    /** The venue or a pre-trade gate rejected it. */\n    | 'failed'\n    /** No viable venue was found; nothing was sent. */\n    | 'rejected'\n\n/**\n * What an organization's END USERS see and may do in the hosted flow. Mirrors\n * `ConnectConfigBody` server-side.\n *\n * A `null` field means \"no restriction / use the default\" throughout, so an\n * organization with no config behaves exactly as Connect did before configs\n * existed. Read that as permissive, not as unset.\n */\nexport interface ConnectConfig {\n    version: number\n    /** Partner ids or names offered in the picker. null = every venue we support. */\n    venue_allowlist: string[] | null\n    /** Surface the OpenMarkets practice book as a credential-less venue. */\n    offer_internal_book: boolean\n    /**\n     * Currencies users may trade. `['ATLAS']` is practice-only and is ENFORCED\n     * on every order path, not merely hidden in the UI — users can still link\n     * venues, read balances and sync history; only real-money orders are\n     * refused.\n     */\n    allowed_currencies: string[]\n    /** DERIVED from allowed_currencies server-side. Sending it has no effect. */\n    allow_real_money: boolean\n    /** Permissions the user is asked to grant. null = all of them. */\n    available_scopes: ConnectScope[] | null\n    branding: { display_name?: string; logo_url?: string; primary_color?: string } | null\n    allowed_return_urls: string[] | null\n    default_link_mode: LinkSessionMode\n    [key: string]: unknown\n}\n\n/** Permissions an end user grants per connected venue. */\nexport type ConnectScope = 'history:read' | 'trade:execute' | 'balance:read'\n\nexport interface ConnectConfigResult {\n    /** null when the organization has never saved one — `config` is the defaults. */\n    connect_config_id: string | null\n    config: ConnectConfig\n    /**\n     * Present on update: how many EXISTING users the change was applied to.\n     * A funding-mode change reaches users already provisioned, not just future\n     * ones, so this reports what actually happened.\n     */\n    reconcile?: { scanned: number; reconciled: number; failed: number } | null\n}\n\nexport interface BuyResult {\n    results: Array<{\n        index: number\n        status: BuyLegStatus\n        /** NULL when the leg was rejected before routing — no decision was made. */\n        sor_decision_id: string | null\n        filled_notional: number\n        filled_shares: number\n        /** The un-buyable remainder of the requested stake. */\n        unfilled_notional: number\n        avg_price: number | null\n        rejected_reason: string | null\n        venues: Array<{\n            partner_id: string\n            success: boolean\n            router_order_id: string | null\n            error: string | null\n        }>\n    }>\n}\n\ninterface FlowEnvelope<T> {\n    data?: T\n    error?: { code: string; message: string; details?: Record<string, unknown> }\n}\n\nexport interface OpenMarketsClient {\n    /** Generic typed request — escape hatch for endpoints without a helper. */\n    request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<T>\n    connect: {\n        users: {\n            provision(params: ProvisionUserParams): Promise<ProvisionResult>\n            get<T = unknown>(externalUserId: string): Promise<T>\n            getPolicy<T = unknown>(externalUserId: string): Promise<T>\n        }\n        linkSessions: {\n            create(params: CreateLinkSessionParams): Promise<LinkSession>\n            get<T = unknown>(linkSessionId: string): Promise<T>\n        }\n        /**\n         * The organization's Connect config — which venues appear, whether real\n         * money is allowed, and how the hosted flow is branded.\n         *\n         * Requires a PLAYER JWT with workspace admin, not an API key: this is\n         * account governance rather than a data-API capability. `update` sends a\n         * whole body (it is normalized server-side), so read, change, write.\n         */\n        configs: {\n            get(workspaceId: string): Promise<ConnectConfigResult>\n            update(workspaceId: string, config: Partial<ConnectConfig>): Promise<ConnectConfigResult>\n        }\n        webhooks: {\n            getConfig<T = unknown>(): Promise<T>\n            /** Verify a delivery using the configured `webhookSecret`. */\n            verify(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): boolean\n            /** Verify + parse, or throw. Uses the configured `webhookSecret`. */\n            constructEvent(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): ConnectWebhookEvent\n        }\n    }\n    account: {\n        partners<T = unknown>(externalUserId: string): Promise<T>\n        balances<T = unknown>(externalUserId: string): Promise<T>\n    }\n    orders: {\n        list<T = unknown>(externalUserId: string): Promise<T>\n        buy(orders: BuyOrder[], opts: { actAs: string }): Promise<BuyResult>\n    }\n    data: {\n        leagues<T = unknown>(): Promise<T>\n        contestLiquidity<T = unknown>(contestId: string): Promise<T>\n    }\n}\n\nexport function createClient(options: OpenMarketsClientOptions): OpenMarketsClient {\n    if (!options.apiKey) throw new Error('createClient: apiKey is required')\n    const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '')\n    const doFetch = options.fetch ?? globalThis.fetch\n    if (!doFetch) throw new Error('No fetch available — pass options.fetch (Node < 18)')\n    const timeoutMs = options.timeoutMs ?? 30_000\n\n    async function request<T = unknown>(\n        method: HttpMethod,\n        path: string,\n        opts: RequestOptions = {},\n    ): Promise<T> {\n        const url = new URL(baseUrl + path)\n        for (const [k, v] of Object.entries(opts.query ?? {})) {\n            if (v !== undefined) url.searchParams.set(k, String(v))\n        }\n        const headers: Record<string, string> = {\n            'X-API-Key': options.apiKey,\n            Accept: 'application/json',\n        }\n        if (opts.body !== undefined) headers['Content-Type'] = 'application/json'\n        if (opts.actAs) headers['X-OpenMarkets-Account'] = opts.actAs\n\n        const ctrl = new AbortController()\n        const timer = setTimeout(() => ctrl.abort(), timeoutMs)\n        let res: Response\n        try {\n            res = await doFetch(url.toString(), {\n                method,\n                headers,\n                body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,\n                signal: ctrl.signal,\n            })\n        } finally {\n            clearTimeout(timer)\n        }\n\n        let envelope: FlowEnvelope<T> | undefined\n        const text = await res.text()\n        if (text) {\n            try {\n                envelope = JSON.parse(text) as FlowEnvelope<T>\n            } catch {\n                /* non-JSON body */\n            }\n        }\n\n        if (!res.ok) {\n            const err = envelope?.error\n            throw new OpenMarketsError(\n                res.status,\n                err?.code ?? 'http_error',\n                err?.message ?? `Request failed with status ${res.status}`,\n                err?.details,\n            )\n        }\n        return (envelope?.data ?? (undefined as unknown)) as T\n    }\n\n    function requireSecret(): string {\n        if (!options.webhookSecret) {\n            throw new Error('webhookSecret was not provided to createClient()')\n        }\n        return options.webhookSecret\n    }\n\n    return {\n        request,\n        connect: {\n            users: {\n                provision: (params) =>\n                    request<ProvisionResult>('POST', '/flow/v1/connect/users', { body: params }),\n                get: (externalUserId) =>\n                    request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}`),\n                getPolicy: (externalUserId) =>\n                    request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}/policy`),\n            },\n            linkSessions: {\n                create: (params) =>\n                    request<LinkSession>('POST', '/flow/v1/connect/link-sessions', { body: params }),\n                get: (linkSessionId) =>\n                    request('GET', `/flow/v1/connect/link-sessions/${encodeURIComponent(linkSessionId)}`),\n            },\n            configs: {\n                get: (workspaceId: string) =>\n                    request<ConnectConfigResult>(\n                        'GET', `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`,\n                    ),\n                update: (workspaceId: string, config: Partial<ConnectConfig>) =>\n                    request<ConnectConfigResult>(\n                        'PUT', `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`,\n                        { body: { config } },\n                    ),\n            },\n            webhooks: {\n                getConfig: () => request('GET', '/flow/v1/connect/webhook-config'),\n                verify: (rawBody, sig, opts) =>\n                    verifyWebhookSignature(requireSecret(), rawBody, sig, opts),\n                constructEvent: (rawBody, sig, opts) =>\n                    constructWebhookEvent(requireSecret(), rawBody, sig, opts),\n            },\n        },\n        account: {\n            partners: (externalUserId) =>\n                request('GET', '/flow/v1/auth/account/partners', { actAs: externalUserId }),\n            balances: (externalUserId) =>\n                request('GET', '/flow/v1/auth/account/balances', { actAs: externalUserId }),\n        },\n        orders: {\n            list: (externalUserId) =>\n                request('GET', '/flow/v1/auth/orders', { actAs: externalUserId }),\n            buy: (orders, opts) =>\n                request<BuyResult>('POST', '/flow/v1/auth/orders/buy', {\n                    body: { orders },\n                    actAs: opts.actAs,\n                }),\n        },\n        data: {\n            leagues: () => request('GET', '/flow/v1/leagues'),\n            contestLiquidity: (contestId) =>\n                request('GET', `/flow/v1/contests/${encodeURIComponent(contestId)}/liquidity`),\n        },\n    }\n}\n"]}

package/dist/index.d.cts

@@ -127,6 +127,57 @@ type BuyLegStatus =
  | 'failed'
 /** No viable venue was found; nothing was sent. */
  | 'rejected';
+/**
+ * What an organization's END USERS see and may do in the hosted flow. Mirrors
+ * `ConnectConfigBody` server-side.
+ *
+ * A `null` field means "no restriction / use the default" throughout, so an
+ * organization with no config behaves exactly as Connect did before configs
+ * existed. Read that as permissive, not as unset.
+ */
+interface ConnectConfig {
+    version: number;
+    /** Partner ids or names offered in the picker. null = every venue we support. */
+    venue_allowlist: string[] | null;
+    /** Surface the OpenMarkets practice book as a credential-less venue. */
+    offer_internal_book: boolean;
+    /**
+     * Currencies users may trade. `['ATLAS']` is practice-only and is ENFORCED
+     * on every order path, not merely hidden in the UI — users can still link
+     * venues, read balances and sync history; only real-money orders are
+     * refused.
+     */
+    allowed_currencies: string[];
+    /** DERIVED from allowed_currencies server-side. Sending it has no effect. */
+    allow_real_money: boolean;
+    /** Permissions the user is asked to grant. null = all of them. */
+    available_scopes: ConnectScope[] | null;
+    branding: {
+        display_name?: string;
+        logo_url?: string;
+        primary_color?: string;
+    } | null;
+    allowed_return_urls: string[] | null;
+    default_link_mode: LinkSessionMode;
+    [key: string]: unknown;
+}
+/** Permissions an end user grants per connected venue. */
+type ConnectScope = 'history:read' | 'trade:execute' | 'balance:read';
+interface ConnectConfigResult {
+    /** null when the organization has never saved one — `config` is the defaults. */
+    connect_config_id: string | null;
+    config: ConnectConfig;
+    /**
+     * Present on update: how many EXISTING users the change was applied to.
+     * A funding-mode change reaches users already provisioned, not just future
+     * ones, so this reports what actually happened.
+     */
+    reconcile?: {
+        scanned: number;
+        reconciled: number;
+        failed: number;
+    } | null;
+}
 interface BuyResult {
     results: Array<{
         index: number;
@@ -160,6 +211,18 @@ interface OpenMarketsClient {
             create(params: CreateLinkSessionParams): Promise<LinkSession>;
             get<T = unknown>(linkSessionId: string): Promise<T>;
         };
+        /**
+         * The organization's Connect config — which venues appear, whether real
+         * money is allowed, and how the hosted flow is branded.
+         *
+         * Requires a PLAYER JWT with workspace admin, not an API key: this is
+         * account governance rather than a data-API capability. `update` sends a
+         * whole body (it is normalized server-side), so read, change, write.
+         */
+        configs: {
+            get(workspaceId: string): Promise<ConnectConfigResult>;
+            update(workspaceId: string, config: Partial<ConnectConfig>): Promise<ConnectConfigResult>;
+        };
         webhooks: {
             getConfig<T = unknown>(): Promise<T>;
             /** Verify a delivery using the configured `webhookSecret`. */
@@ -185,4 +248,4 @@ interface OpenMarketsClient {
 }
 declare function createClient(options: OpenMarketsClientOptions): OpenMarketsClient;
 
-export { type BuyLegStatus, type BuyOrder, type BuyResult, type ConnectWebhookEvent, type ConnectWebhookEventType, type CreateLinkSessionParams, DEFAULT_BASE_URL, type HttpMethod, type LinkSession, type LinkSessionMode, type OpenMarketsClient, type OpenMarketsClientOptions, OpenMarketsError, type ProvisionResult, type ProvisionUserParams, type RequestOptions, type VerifyWebhookOptions, WebhookSignatureError, constructWebhookEvent, createClient, verifyWebhookSignature };
+export { type BuyLegStatus, type BuyOrder, type BuyResult, type ConnectConfig, type ConnectConfigResult, type ConnectScope, type ConnectWebhookEvent, type ConnectWebhookEventType, type CreateLinkSessionParams, DEFAULT_BASE_URL, type HttpMethod, type LinkSession, type LinkSessionMode, type OpenMarketsClient, type OpenMarketsClientOptions, OpenMarketsError, type ProvisionResult, type ProvisionUserParams, type RequestOptions, type VerifyWebhookOptions, WebhookSignatureError, constructWebhookEvent, createClient, verifyWebhookSignature };

package/dist/index.d.ts

@@ -127,6 +127,57 @@ type BuyLegStatus =
  | 'failed'
 /** No viable venue was found; nothing was sent. */
  | 'rejected';
+/**
+ * What an organization's END USERS see and may do in the hosted flow. Mirrors
+ * `ConnectConfigBody` server-side.
+ *
+ * A `null` field means "no restriction / use the default" throughout, so an
+ * organization with no config behaves exactly as Connect did before configs
+ * existed. Read that as permissive, not as unset.
+ */
+interface ConnectConfig {
+    version: number;
+    /** Partner ids or names offered in the picker. null = every venue we support. */
+    venue_allowlist: string[] | null;
+    /** Surface the OpenMarkets practice book as a credential-less venue. */
+    offer_internal_book: boolean;
+    /**
+     * Currencies users may trade. `['ATLAS']` is practice-only and is ENFORCED
+     * on every order path, not merely hidden in the UI — users can still link
+     * venues, read balances and sync history; only real-money orders are
+     * refused.
+     */
+    allowed_currencies: string[];
+    /** DERIVED from allowed_currencies server-side. Sending it has no effect. */
+    allow_real_money: boolean;
+    /** Permissions the user is asked to grant. null = all of them. */
+    available_scopes: ConnectScope[] | null;
+    branding: {
+        display_name?: string;
+        logo_url?: string;
+        primary_color?: string;
+    } | null;
+    allowed_return_urls: string[] | null;
+    default_link_mode: LinkSessionMode;
+    [key: string]: unknown;
+}
+/** Permissions an end user grants per connected venue. */
+type ConnectScope = 'history:read' | 'trade:execute' | 'balance:read';
+interface ConnectConfigResult {
+    /** null when the organization has never saved one — `config` is the defaults. */
+    connect_config_id: string | null;
+    config: ConnectConfig;
+    /**
+     * Present on update: how many EXISTING users the change was applied to.
+     * A funding-mode change reaches users already provisioned, not just future
+     * ones, so this reports what actually happened.
+     */
+    reconcile?: {
+        scanned: number;
+        reconciled: number;
+        failed: number;
+    } | null;
+}
 interface BuyResult {
     results: Array<{
         index: number;
@@ -160,6 +211,18 @@ interface OpenMarketsClient {
             create(params: CreateLinkSessionParams): Promise<LinkSession>;
             get<T = unknown>(linkSessionId: string): Promise<T>;
         };
+        /**
+         * The organization's Connect config — which venues appear, whether real
+         * money is allowed, and how the hosted flow is branded.
+         *
+         * Requires a PLAYER JWT with workspace admin, not an API key: this is
+         * account governance rather than a data-API capability. `update` sends a
+         * whole body (it is normalized server-side), so read, change, write.
+         */
+        configs: {
+            get(workspaceId: string): Promise<ConnectConfigResult>;
+            update(workspaceId: string, config: Partial<ConnectConfig>): Promise<ConnectConfigResult>;
+        };
         webhooks: {
             getConfig<T = unknown>(): Promise<T>;
             /** Verify a delivery using the configured `webhookSecret`. */
@@ -185,4 +248,4 @@ interface OpenMarketsClient {
 }
 declare function createClient(options: OpenMarketsClientOptions): OpenMarketsClient;
 
-export { type BuyLegStatus, type BuyOrder, type BuyResult, type ConnectWebhookEvent, type ConnectWebhookEventType, type CreateLinkSessionParams, DEFAULT_BASE_URL, type HttpMethod, type LinkSession, type LinkSessionMode, type OpenMarketsClient, type OpenMarketsClientOptions, OpenMarketsError, type ProvisionResult, type ProvisionUserParams, type RequestOptions, type VerifyWebhookOptions, WebhookSignatureError, constructWebhookEvent, createClient, verifyWebhookSignature };
+export { type BuyLegStatus, type BuyOrder, type BuyResult, type ConnectConfig, type ConnectConfigResult, type ConnectScope, type ConnectWebhookEvent, type ConnectWebhookEventType, type CreateLinkSessionParams, DEFAULT_BASE_URL, type HttpMethod, type LinkSession, type LinkSessionMode, type OpenMarketsClient, type OpenMarketsClientOptions, OpenMarketsError, type ProvisionResult, type ProvisionUserParams, type RequestOptions, type VerifyWebhookOptions, WebhookSignatureError, constructWebhookEvent, createClient, verifyWebhookSignature };

package/dist/index.js

@@ -123,6 +123,17 @@ function createClient(options) {
         create: (params) => request("POST", "/flow/v1/connect/link-sessions", { body: params }),
         get: (linkSessionId) => request("GET", `/flow/v1/connect/link-sessions/${encodeURIComponent(linkSessionId)}`)
       },
+      configs: {
+        get: (workspaceId) => request(
+          "GET",
+          `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`
+        ),
+        update: (workspaceId, config) => request(
+          "PUT",
+          `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`,
+          { body: { config } }
+        )
+      },
       webhooks: {
         getConfig: () => request("GET", "/flow/v1/connect/webhook-config"),
         verify: (rawBody, sig, opts) => verifyWebhookSignature(requireSecret(), rawBody, sig, opts),

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAkBO,IAAM,gBAAA,GAAmB;AAOzB,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAIxC,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAmC;AAC1F,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACnB;AACJ;AAGO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC7C,YAAY,OAAA,EAAiB;AACzB,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EAChB;AACJ;AA2BA,SAAS,MAAM,IAAA,EAA+B;AAC1C,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,IAAA,CAAK,SAAS,MAAM,CAAA;AACjE;AAEA,SAAS,qBAAqB,MAAA,EAAkD;AAC5E,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,CAAM,GAAG,EAAE,MAAA,CAA+B,CAAC,KAAK,EAAA,KAAO;AACxE,IAAA,MAAM,GAAA,GAAM,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,MAAM,CAAA,EAAG,GAAA,CAAI,EAAA,CAAG,KAAA,CAAM,GAAG,GAAG,CAAA,CAAE,IAAA,EAAM,IAAI,EAAA,CAAG,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxB,EAAA,IAAI,CAAC,KAAA,CAAM,EAAA,IAAM,CAAC,QAAA,CAAS,CAAC,GAAG,OAAO,IAAA;AACtC,EAAA,OAAO,EAAE,CAAA,EAAG,EAAA,EAAI,KAAA,CAAM,EAAA,EAAG;AAC7B;AAEA,SAAS,kBAAA,CAAmB,GAAW,CAAA,EAAoB;AACvD,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,IAAI,GAAG,MAAA,KAAW,CAAA,IAAK,GAAG,MAAA,KAAW,EAAA,CAAG,QAAQ,OAAO,KAAA;AACvD,EAAA,OAAO,MAAA,CAAO,eAAA,CAAgB,EAAA,EAAI,EAAE,CAAA;AACxC;AAGO,SAAS,uBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACvB;AACP,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,eAAA,EAAiB,OAAO,KAAA;AACxC,EAAA,MAAM,MAAA,GAAS,qBAAqB,eAAe,CAAA;AACnD,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,GAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC1D,EAAA,IAAI,YAAA,GAAe,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,MAAA,CAAO,CAAC,CAAA,GAAI,YAAA,EAAc,OAAO,KAAA;AAC3E,EAAA,MAAM,WAAW,MAAA,CACZ,UAAA,CAAW,QAAA,EAAU,MAAM,EAC3B,MAAA,CAAO,CAAA,EAAG,MAAA,CAAO,CAAC,IAAI,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,CAAA,CACtC,OAAO,KAAK,CAAA;AACjB,EAAA,OAAO,kBAAA,CAAmB,QAAA,EAAU,MAAA,CAAO,EAAE,CAAA;AACjD;AAGO,SAAS,sBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACX;AACnB,EAAA,IAAI,CAAC,sBAAA,CAAuB,MAAA,EAAQ,OAAA,EAAS,eAAA,EAAiB,IAAI,CAAA,EAAG;AACjE,IAAA,MAAM,IAAI,sBAAsB,sCAAsC,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI;AACA,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AACJ,IAAA,MAAM,IAAI,sBAAsB,gCAAgC,CAAA;AAAA,EACpE;AACJ;AAgLO,SAAS,aAAa,OAAA,EAAsD;AAC/E,EAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,MAAM,kCAAkC,CAAA;AACvE,EAAA,MAAM,WAAW,OAAA,CAAQ,OAAA,IAAW,gBAAA,EAAkB,OAAA,CAAQ,OAAO,EAAE,CAAA;AACvE,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,0DAAqD,CAAA;AACnF,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,GAAA;AAEvC,EAAA,eAAe,OAAA,CACX,MAAA,EACA,IAAA,EACA,IAAA,GAAuB,EAAC,EACd;AACV,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,GAAU,IAAI,CAAA;AAClC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA,EAAG;AACnD,MAAA,IAAI,CAAA,KAAM,QAAW,GAAA,CAAI,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,aAAa,OAAA,CAAQ,MAAA;AAAA,MACrB,MAAA,EAAQ;AAAA,KACZ;AACA,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AACvD,IAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAA,CAAQ,uBAAuB,IAAI,IAAA,CAAK,KAAA;AAExD,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,IAAA,CAAK,KAAA,IAAS,SAAS,CAAA;AACtD,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACA,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,IAAA,CAAK;AAAA,OAChB,CAAA;AAAA,IACL,CAAA,SAAE;AACE,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACtB;AAEA,IAAA,IAAI,QAAA;AACJ,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,IAAA,EAAM;AACN,MAAA,IAAI;AACA,QAAA,QAAA,GAAW,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,MAC9B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,MAAM,QAAA,EAAU,KAAA;AACtB,MAAA,MAAM,IAAI,gBAAA;AAAA,QACN,GAAA,CAAI,MAAA;AAAA,QACJ,KAAK,IAAA,IAAQ,YAAA;AAAA,QACb,GAAA,EAAK,OAAA,IAAW,CAAA,2BAAA,EAA8B,GAAA,CAAI,MAAM,CAAA,CAAA;AAAA,QACxD,GAAA,EAAK;AAAA,OACT;AAAA,IACJ;AACA,IAAA,OAAQ,UAAU,IAAA,IAAS,MAAA;AAAA,EAC/B;AAEA,EAAA,SAAS,aAAA,GAAwB;AAC7B,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AACxB,MAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,OAAA,CAAQ,aAAA;AAAA,EACnB;AAEA,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,KAAA,EAAO;AAAA,QACH,SAAA,EAAW,CAAC,MAAA,KACR,OAAA,CAAyB,QAAQ,wBAAA,EAA0B,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QAC/E,GAAA,EAAK,CAAC,cAAA,KACF,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,CAAE,CAAA;AAAA,QACjF,SAAA,EAAW,CAAC,cAAA,KACR,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,OAAA,CAAS;AAAA,OAC5F;AAAA,MACA,YAAA,EAAc;AAAA,QACV,MAAA,EAAQ,CAAC,MAAA,KACL,OAAA,CAAqB,QAAQ,gCAAA,EAAkC,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QACnF,GAAA,EAAK,CAAC,aAAA,KACF,OAAA,CAAQ,OAAO,CAAA,+BAAA,EAAkC,kBAAA,CAAmB,aAAa,CAAC,CAAA,CAAE;AAAA,OAC5F;AAAA,MACA,QAAA,EAAU;AAAA,QACN,SAAA,EAAW,MAAM,OAAA,CAAQ,KAAA,EAAO,iCAAiC,CAAA;AAAA,QACjE,MAAA,EAAQ,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KACnB,uBAAuB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI,CAAA;AAAA,QAC9D,cAAA,EAAgB,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KAC3B,sBAAsB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI;AAAA;AACjE,KACJ;AAAA,IACA,OAAA,EAAS;AAAA,MACL,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MAC9E,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB;AAAA,KAClF;AAAA,IACA,MAAA,EAAQ;AAAA,MACJ,IAAA,EAAM,CAAC,cAAA,KACH,OAAA,CAAQ,OAAO,sBAAA,EAAwB,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MACpE,KAAK,CAAC,MAAA,EAAQ,IAAA,KACV,OAAA,CAAmB,QAAQ,0BAAA,EAA4B;AAAA,QACnD,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,QACf,OAAO,IAAA,CAAK;AAAA,OACf;AAAA,KACT;AAAA,IACA,IAAA,EAAM;AAAA,MACF,OAAA,EAAS,MAAM,OAAA,CAAQ,KAAA,EAAO,kBAAkB,CAAA;AAAA,MAChD,gBAAA,EAAkB,CAAC,SAAA,KACf,OAAA,CAAQ,OAAO,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,SAAS,CAAC,CAAA,UAAA,CAAY;AAAA;AACrF,GACJ;AACJ","file":"index.js","sourcesContent":["/**\n * @openmarketsai/connect-node\n *\n * Server SDK for OpenMarkets Connect. A thin, typed wrapper over the Flow API:\n * provision your users, mint hosted link sessions, verify webhook deliveries,\n * read on a user's behalf, and execute orders on their account.\n *\n *   import { createClient } from '@openmarketsai/connect-node'\n *   const om = createClient({ apiKey: process.env.OM_API_KEY! })\n *\n *   await om.connect.users.provision({ external_user_id: 'user-123' })\n *   const { token } = await om.connect.linkSessions.create({ external_user_id: 'user-123' })\n *   await om.orders.buy([leg], { actAs: 'user-123' })\n *\n * Pairs with @openmarketsai/connect-web (the in-app launcher).\n */\nimport crypto from 'node:crypto'\n\nexport const DEFAULT_BASE_URL = 'https://api.openmarkets.ai'\n\n// ──────────────────────────────────────────────────────────────────────────\n// Errors\n// ──────────────────────────────────────────────────────────────────────────\n\n/** Thrown when the API returns a non-2xx response. Mirrors the Flow error envelope. */\nexport class OpenMarketsError extends Error {\n    readonly status: number\n    readonly code: string\n    readonly details?: Record<string, unknown>\n    constructor(status: number, code: string, message: string, details?: Record<string, unknown>) {\n        super(message)\n        this.name = 'OpenMarketsError'\n        this.status = status\n        this.code = code\n        this.details = details\n    }\n}\n\n/** Thrown by `constructWebhookEvent` when a signature is missing, stale, or invalid. */\nexport class WebhookSignatureError extends Error {\n    constructor(message: string) {\n        super(message)\n        this.name = 'WebhookSignatureError'\n    }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Webhook verification (matches src/utils/webhook-signature.ts byte-for-byte)\n//\n//   Header: X-OpenMarkets-Signature: t=<unix_seconds>,v1=<hex hmac>\n//   Signed string: `${t}.${rawBody}`, HMAC-SHA256 with your whsec_ secret.\n//   IMPORTANT: verify over the EXACT raw request body, not a re-serialized object.\n// ──────────────────────────────────────────────────────────────────────────\n\nexport type ConnectWebhookEventType =\n    | 'user.partners_connected'\n    | 'user.permissions_changed'\n    | (string & {})\n\nexport interface ConnectWebhookEvent {\n    type: ConnectWebhookEventType\n    [key: string]: unknown\n}\n\nexport interface VerifyWebhookOptions {\n    /** Max age of the signature timestamp, in seconds. Default 300 (5 min). 0 disables. */\n    toleranceSec?: number\n    /** Injectable clock for testing. */\n    nowSec?: number\n}\n\nfunction toRaw(body: string | Buffer): string {\n    return typeof body === 'string' ? body : body.toString('utf8')\n}\n\nfunction parseSignatureHeader(header: string): { t: number; v1: string } | null {\n    const parts = header.split(',').reduce<Record<string, string>>((acc, kv) => {\n        const idx = kv.indexOf('=')\n        if (idx > 0) acc[kv.slice(0, idx).trim()] = kv.slice(idx + 1).trim()\n        return acc\n    }, {})\n    const t = Number(parts.t)\n    if (!parts.v1 || !isFinite(t)) return null\n    return { t, v1: parts.v1 }\n}\n\nfunction timingSafeEqualHex(a: string, b: string): boolean {\n    const ab = Buffer.from(a, 'hex')\n    const bb = Buffer.from(b, 'hex')\n    if (ab.length === 0 || ab.length !== bb.length) return false\n    return crypto.timingSafeEqual(ab, bb)\n}\n\n/** Verify a webhook signature. Returns false on any failure (never throws). */\nexport function verifyWebhookSignature(\n    secret: string,\n    rawBody: string | Buffer,\n    signatureHeader: string | null | undefined,\n    opts: VerifyWebhookOptions = {},\n): boolean {\n    if (!secret || !signatureHeader) return false\n    const parsed = parseSignatureHeader(signatureHeader)\n    if (!parsed) return false\n    const toleranceSec = opts.toleranceSec ?? 300\n    const nowSec = opts.nowSec ?? Math.floor(Date.now() / 1000)\n    if (toleranceSec > 0 && Math.abs(nowSec - parsed.t) > toleranceSec) return false\n    const expected = crypto\n        .createHmac('sha256', secret)\n        .update(`${parsed.t}.${toRaw(rawBody)}`)\n        .digest('hex')\n    return timingSafeEqualHex(expected, parsed.v1)\n}\n\n/** Verify the signature and return the parsed event, or throw `WebhookSignatureError`. */\nexport function constructWebhookEvent(\n    secret: string,\n    rawBody: string | Buffer,\n    signatureHeader: string | null | undefined,\n    opts: VerifyWebhookOptions = {},\n): ConnectWebhookEvent {\n    if (!verifyWebhookSignature(secret, rawBody, signatureHeader, opts)) {\n        throw new WebhookSignatureError('Invalid or expired webhook signature')\n    }\n    try {\n        return JSON.parse(toRaw(rawBody)) as ConnectWebhookEvent\n    } catch {\n        throw new WebhookSignatureError('Webhook body is not valid JSON')\n    }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Client\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface OpenMarketsClientOptions {\n    /** Your Connect org API key. Sent as `X-API-Key`. */\n    apiKey: string\n    /** API base URL. Defaults to https://api.openmarkets.ai. */\n    baseUrl?: string\n    /** Your webhook signing secret (`whsec_…`), enabling `client.webhooks.*`. */\n    webhookSecret?: string\n    /** Custom fetch (defaults to global fetch; Node 18+). */\n    fetch?: typeof fetch\n    /** Per-request timeout in ms. Default 30000. */\n    timeoutMs?: number\n}\n\nexport type HttpMethod = 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE'\n\nexport interface RequestOptions {\n    query?: Record<string, string | number | boolean | undefined>\n    body?: unknown\n    /** Act on this user's behalf — sets the `X-OpenMarkets-Account` header. */\n    actAs?: string\n}\n\n// Inputs (snake_case to match the API — buy legs map 1:1 from liquidity entries).\nexport interface ProvisionUserParams {\n    external_user_id: string\n    email?: string\n    name?: string\n}\nexport type LinkSessionMode = 'connect' | 'manage'\nexport interface CreateLinkSessionParams {\n    external_user_id: string\n    return_url?: string\n    mode?: LinkSessionMode\n    allowed_partners?: string[]\n    /** Pick a specific org Connect config; omit to use the org's default (if any). */\n    connect_config_id?: string\n}\nexport interface BuyOrder {\n    /** What to buy — set exactly one of position_hash or liquidity_hash. */\n    position_hash?: string\n    liquidity_hash?: string\n    /** Size — set exactly one of amount or shares. */\n    amount?: number // stake, notional USD\n    shares?: number // contract count (each pays $1 on win)\n    /** Price ceiling, 0..1 exclusive — won't fill above this. */\n    max_price: number\n    /** Optional — pin a venue; omit to route to the best price. */\n    partner_id?: string\n    /** Optional — 'real' (default) or 'paper' (practice book). */\n    mode?: 'real' | 'paper'\n}\n\n// Outputs (light — partners can pass a type param for stricter typing).\n/**\n * `POST /flow/v1/connect/users`. Idempotent — safe to call on every login.\n *\n * `om_account_id` is the field an integration actually needs (it addresses the\n * user in later calls) and was previously absent, so it typed as `unknown` via\n * the index signature.\n */\nexport interface ProvisionResult {\n    /** Our id for this user. Pass as `actAs` when trading on their behalf. */\n    om_account_id: string\n    external_user_id: string\n    /** false when the user already existed. */\n    created: boolean\n    [key: string]: unknown\n}\n/**\n * The response of `POST /flow/v1/connect/link-sessions`.\n *\n * These names are the API's, verified against the route rather than assumed:\n * it returns `link_token`, NOT `token`. The previous declaration named `token`,\n * `external_user_id` and `mode` — none of which the endpoint sends — so the one\n * field an integration actually needs type-checked as a string and arrived\n * `undefined`, opening the hosted flow with `token=undefined`. The index\n * signature below is what kept that quiet; keep these names in step with\n * `CreateLinkSessionResult` in LinkSessionOrchestrator.\n */\nexport interface LinkSession {\n    link_session_id: string\n    /** Single-use, expires in 15 minutes. Hand to `createConnect().open()`. */\n    link_token: string\n    /** The hosted flow URL, for redirect mode or a native in-app browser. */\n    hosted_url: string\n    expires_at: string\n    [key: string]: unknown\n}\n/**\n * The status of one leg, mirroring `flowLegStatus` in the API.\n *\n * ALL FIVE values are reachable. This union previously listed only three, so a\n * `switch` written against the SDK's types compiled clean and silently fell\n * through for a resting or pending order — an order that IS live, sitting on a\n * venue book, treated as if it had never been placed. Any change here must\n * follow the API, not the other way round.\n */\nexport type BuyLegStatus =\n    /** Filled or partially filled. */\n    | 'completed'\n    /** Live on the venue's book, unfilled. Not a failure — check back. */\n    | 'resting'\n    /** Accepted by the venue, fill not yet confirmed (async venues). */\n    | 'pending'\n    /** The venue or a pre-trade gate rejected it. */\n    | 'failed'\n    /** No viable venue was found; nothing was sent. */\n    | 'rejected'\n\nexport interface BuyResult {\n    results: Array<{\n        index: number\n        status: BuyLegStatus\n        /** NULL when the leg was rejected before routing — no decision was made. */\n        sor_decision_id: string | null\n        filled_notional: number\n        filled_shares: number\n        /** The un-buyable remainder of the requested stake. */\n        unfilled_notional: number\n        avg_price: number | null\n        rejected_reason: string | null\n        venues: Array<{\n            partner_id: string\n            success: boolean\n            router_order_id: string | null\n            error: string | null\n        }>\n    }>\n}\n\ninterface FlowEnvelope<T> {\n    data?: T\n    error?: { code: string; message: string; details?: Record<string, unknown> }\n}\n\nexport interface OpenMarketsClient {\n    /** Generic typed request — escape hatch for endpoints without a helper. */\n    request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<T>\n    connect: {\n        users: {\n            provision(params: ProvisionUserParams): Promise<ProvisionResult>\n            get<T = unknown>(externalUserId: string): Promise<T>\n            getPolicy<T = unknown>(externalUserId: string): Promise<T>\n        }\n        linkSessions: {\n            create(params: CreateLinkSessionParams): Promise<LinkSession>\n            get<T = unknown>(linkSessionId: string): Promise<T>\n        }\n        webhooks: {\n            getConfig<T = unknown>(): Promise<T>\n            /** Verify a delivery using the configured `webhookSecret`. */\n            verify(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): boolean\n            /** Verify + parse, or throw. Uses the configured `webhookSecret`. */\n            constructEvent(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): ConnectWebhookEvent\n        }\n    }\n    account: {\n        partners<T = unknown>(externalUserId: string): Promise<T>\n        balances<T = unknown>(externalUserId: string): Promise<T>\n    }\n    orders: {\n        list<T = unknown>(externalUserId: string): Promise<T>\n        buy(orders: BuyOrder[], opts: { actAs: string }): Promise<BuyResult>\n    }\n    data: {\n        leagues<T = unknown>(): Promise<T>\n        contestLiquidity<T = unknown>(contestId: string): Promise<T>\n    }\n}\n\nexport function createClient(options: OpenMarketsClientOptions): OpenMarketsClient {\n    if (!options.apiKey) throw new Error('createClient: apiKey is required')\n    const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '')\n    const doFetch = options.fetch ?? globalThis.fetch\n    if (!doFetch) throw new Error('No fetch available — pass options.fetch (Node < 18)')\n    const timeoutMs = options.timeoutMs ?? 30_000\n\n    async function request<T = unknown>(\n        method: HttpMethod,\n        path: string,\n        opts: RequestOptions = {},\n    ): Promise<T> {\n        const url = new URL(baseUrl + path)\n        for (const [k, v] of Object.entries(opts.query ?? {})) {\n            if (v !== undefined) url.searchParams.set(k, String(v))\n        }\n        const headers: Record<string, string> = {\n            'X-API-Key': options.apiKey,\n            Accept: 'application/json',\n        }\n        if (opts.body !== undefined) headers['Content-Type'] = 'application/json'\n        if (opts.actAs) headers['X-OpenMarkets-Account'] = opts.actAs\n\n        const ctrl = new AbortController()\n        const timer = setTimeout(() => ctrl.abort(), timeoutMs)\n        let res: Response\n        try {\n            res = await doFetch(url.toString(), {\n                method,\n                headers,\n                body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,\n                signal: ctrl.signal,\n            })\n        } finally {\n            clearTimeout(timer)\n        }\n\n        let envelope: FlowEnvelope<T> | undefined\n        const text = await res.text()\n        if (text) {\n            try {\n                envelope = JSON.parse(text) as FlowEnvelope<T>\n            } catch {\n                /* non-JSON body */\n            }\n        }\n\n        if (!res.ok) {\n            const err = envelope?.error\n            throw new OpenMarketsError(\n                res.status,\n                err?.code ?? 'http_error',\n                err?.message ?? `Request failed with status ${res.status}`,\n                err?.details,\n            )\n        }\n        return (envelope?.data ?? (undefined as unknown)) as T\n    }\n\n    function requireSecret(): string {\n        if (!options.webhookSecret) {\n            throw new Error('webhookSecret was not provided to createClient()')\n        }\n        return options.webhookSecret\n    }\n\n    return {\n        request,\n        connect: {\n            users: {\n                provision: (params) =>\n                    request<ProvisionResult>('POST', '/flow/v1/connect/users', { body: params }),\n                get: (externalUserId) =>\n                    request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}`),\n                getPolicy: (externalUserId) =>\n                    request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}/policy`),\n            },\n            linkSessions: {\n                create: (params) =>\n                    request<LinkSession>('POST', '/flow/v1/connect/link-sessions', { body: params }),\n                get: (linkSessionId) =>\n                    request('GET', `/flow/v1/connect/link-sessions/${encodeURIComponent(linkSessionId)}`),\n            },\n            webhooks: {\n                getConfig: () => request('GET', '/flow/v1/connect/webhook-config'),\n                verify: (rawBody, sig, opts) =>\n                    verifyWebhookSignature(requireSecret(), rawBody, sig, opts),\n                constructEvent: (rawBody, sig, opts) =>\n                    constructWebhookEvent(requireSecret(), rawBody, sig, opts),\n            },\n        },\n        account: {\n            partners: (externalUserId) =>\n                request('GET', '/flow/v1/auth/account/partners', { actAs: externalUserId }),\n            balances: (externalUserId) =>\n                request('GET', '/flow/v1/auth/account/balances', { actAs: externalUserId }),\n        },\n        orders: {\n            list: (externalUserId) =>\n                request('GET', '/flow/v1/auth/orders', { actAs: externalUserId }),\n            buy: (orders, opts) =>\n                request<BuyResult>('POST', '/flow/v1/auth/orders/buy', {\n                    body: { orders },\n                    actAs: opts.actAs,\n                }),\n        },\n        data: {\n            leagues: () => request('GET', '/flow/v1/leagues'),\n            contestLiquidity: (contestId) =>\n                request('GET', `/flow/v1/contests/${encodeURIComponent(contestId)}/liquidity`),\n        },\n    }\n}\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAkBO,IAAM,gBAAA,GAAmB;AAOzB,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAIxC,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAmC;AAC1F,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACnB;AACJ;AAGO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC7C,YAAY,OAAA,EAAiB;AACzB,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EAChB;AACJ;AA2BA,SAAS,MAAM,IAAA,EAA+B;AAC1C,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,IAAA,CAAK,SAAS,MAAM,CAAA;AACjE;AAEA,SAAS,qBAAqB,MAAA,EAAkD;AAC5E,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,CAAM,GAAG,EAAE,MAAA,CAA+B,CAAC,KAAK,EAAA,KAAO;AACxE,IAAA,MAAM,GAAA,GAAM,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,MAAM,CAAA,EAAG,GAAA,CAAI,EAAA,CAAG,KAAA,CAAM,GAAG,GAAG,CAAA,CAAE,IAAA,EAAM,IAAI,EAAA,CAAG,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxB,EAAA,IAAI,CAAC,KAAA,CAAM,EAAA,IAAM,CAAC,QAAA,CAAS,CAAC,GAAG,OAAO,IAAA;AACtC,EAAA,OAAO,EAAE,CAAA,EAAG,EAAA,EAAI,KAAA,CAAM,EAAA,EAAG;AAC7B;AAEA,SAAS,kBAAA,CAAmB,GAAW,CAAA,EAAoB;AACvD,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,IAAI,GAAG,MAAA,KAAW,CAAA,IAAK,GAAG,MAAA,KAAW,EAAA,CAAG,QAAQ,OAAO,KAAA;AACvD,EAAA,OAAO,MAAA,CAAO,eAAA,CAAgB,EAAA,EAAI,EAAE,CAAA;AACxC;AAGO,SAAS,uBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACvB;AACP,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,eAAA,EAAiB,OAAO,KAAA;AACxC,EAAA,MAAM,MAAA,GAAS,qBAAqB,eAAe,CAAA;AACnD,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,GAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC1D,EAAA,IAAI,YAAA,GAAe,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,MAAA,CAAO,CAAC,CAAA,GAAI,YAAA,EAAc,OAAO,KAAA;AAC3E,EAAA,MAAM,WAAW,MAAA,CACZ,UAAA,CAAW,QAAA,EAAU,MAAM,EAC3B,MAAA,CAAO,CAAA,EAAG,MAAA,CAAO,CAAC,IAAI,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,CAAA,CACtC,OAAO,KAAK,CAAA;AACjB,EAAA,OAAO,kBAAA,CAAmB,QAAA,EAAU,MAAA,CAAO,EAAE,CAAA;AACjD;AAGO,SAAS,sBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACX;AACnB,EAAA,IAAI,CAAC,sBAAA,CAAuB,MAAA,EAAQ,OAAA,EAAS,eAAA,EAAiB,IAAI,CAAA,EAAG;AACjE,IAAA,MAAM,IAAI,sBAAsB,sCAAsC,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI;AACA,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AACJ,IAAA,MAAM,IAAI,sBAAsB,gCAAgC,CAAA;AAAA,EACpE;AACJ;AA0OO,SAAS,aAAa,OAAA,EAAsD;AAC/E,EAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,MAAM,kCAAkC,CAAA;AACvE,EAAA,MAAM,WAAW,OAAA,CAAQ,OAAA,IAAW,gBAAA,EAAkB,OAAA,CAAQ,OAAO,EAAE,CAAA;AACvE,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,0DAAqD,CAAA;AACnF,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,GAAA;AAEvC,EAAA,eAAe,OAAA,CACX,MAAA,EACA,IAAA,EACA,IAAA,GAAuB,EAAC,EACd;AACV,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,GAAU,IAAI,CAAA;AAClC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA,EAAG;AACnD,MAAA,IAAI,CAAA,KAAM,QAAW,GAAA,CAAI,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,aAAa,OAAA,CAAQ,MAAA;AAAA,MACrB,MAAA,EAAQ;AAAA,KACZ;AACA,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AACvD,IAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAA,CAAQ,uBAAuB,IAAI,IAAA,CAAK,KAAA;AAExD,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,IAAA,CAAK,KAAA,IAAS,SAAS,CAAA;AACtD,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACA,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,IAAA,CAAK;AAAA,OAChB,CAAA;AAAA,IACL,CAAA,SAAE;AACE,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACtB;AAEA,IAAA,IAAI,QAAA;AACJ,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,IAAA,EAAM;AACN,MAAA,IAAI;AACA,QAAA,QAAA,GAAW,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,MAC9B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,MAAM,QAAA,EAAU,KAAA;AACtB,MAAA,MAAM,IAAI,gBAAA;AAAA,QACN,GAAA,CAAI,MAAA;AAAA,QACJ,KAAK,IAAA,IAAQ,YAAA;AAAA,QACb,GAAA,EAAK,OAAA,IAAW,CAAA,2BAAA,EAA8B,GAAA,CAAI,MAAM,CAAA,CAAA;AAAA,QACxD,GAAA,EAAK;AAAA,OACT;AAAA,IACJ;AACA,IAAA,OAAQ,UAAU,IAAA,IAAS,MAAA;AAAA,EAC/B;AAEA,EAAA,SAAS,aAAA,GAAwB;AAC7B,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AACxB,MAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,OAAA,CAAQ,aAAA;AAAA,EACnB;AAEA,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,KAAA,EAAO;AAAA,QACH,SAAA,EAAW,CAAC,MAAA,KACR,OAAA,CAAyB,QAAQ,wBAAA,EAA0B,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QAC/E,GAAA,EAAK,CAAC,cAAA,KACF,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,CAAE,CAAA;AAAA,QACjF,SAAA,EAAW,CAAC,cAAA,KACR,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,OAAA,CAAS;AAAA,OAC5F;AAAA,MACA,YAAA,EAAc;AAAA,QACV,MAAA,EAAQ,CAAC,MAAA,KACL,OAAA,CAAqB,QAAQ,gCAAA,EAAkC,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QACnF,GAAA,EAAK,CAAC,aAAA,KACF,OAAA,CAAQ,OAAO,CAAA,+BAAA,EAAkC,kBAAA,CAAmB,aAAa,CAAC,CAAA,CAAE;AAAA,OAC5F;AAAA,MACA,OAAA,EAAS;AAAA,QACL,GAAA,EAAK,CAAC,WAAA,KACF,OAAA;AAAA,UACI,KAAA;AAAA,UAAO,CAAA,oBAAA,EAAuB,kBAAA,CAAmB,WAAW,CAAC,CAAA,eAAA;AAAA,SACjE;AAAA,QACJ,MAAA,EAAQ,CAAC,WAAA,EAAqB,MAAA,KAC1B,OAAA;AAAA,UACI,KAAA;AAAA,UAAO,CAAA,oBAAA,EAAuB,kBAAA,CAAmB,WAAW,CAAC,CAAA,eAAA,CAAA;AAAA,UAC7D,EAAE,IAAA,EAAM,EAAE,MAAA,EAAO;AAAE;AACvB,OACR;AAAA,MACA,QAAA,EAAU;AAAA,QACN,SAAA,EAAW,MAAM,OAAA,CAAQ,KAAA,EAAO,iCAAiC,CAAA;AAAA,QACjE,MAAA,EAAQ,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KACnB,uBAAuB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI,CAAA;AAAA,QAC9D,cAAA,EAAgB,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KAC3B,sBAAsB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI;AAAA;AACjE,KACJ;AAAA,IACA,OAAA,EAAS;AAAA,MACL,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MAC9E,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB;AAAA,KAClF;AAAA,IACA,MAAA,EAAQ;AAAA,MACJ,IAAA,EAAM,CAAC,cAAA,KACH,OAAA,CAAQ,OAAO,sBAAA,EAAwB,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MACpE,KAAK,CAAC,MAAA,EAAQ,IAAA,KACV,OAAA,CAAmB,QAAQ,0BAAA,EAA4B;AAAA,QACnD,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,QACf,OAAO,IAAA,CAAK;AAAA,OACf;AAAA,KACT;AAAA,IACA,IAAA,EAAM;AAAA,MACF,OAAA,EAAS,MAAM,OAAA,CAAQ,KAAA,EAAO,kBAAkB,CAAA;AAAA,MAChD,gBAAA,EAAkB,CAAC,SAAA,KACf,OAAA,CAAQ,OAAO,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,SAAS,CAAC,CAAA,UAAA,CAAY;AAAA;AACrF,GACJ;AACJ","file":"index.js","sourcesContent":["/**\n * @openmarketsai/connect-node\n *\n * Server SDK for OpenMarkets Connect. A thin, typed wrapper over the Flow API:\n * provision your users, mint hosted link sessions, verify webhook deliveries,\n * read on a user's behalf, and execute orders on their account.\n *\n *   import { createClient } from '@openmarketsai/connect-node'\n *   const om = createClient({ apiKey: process.env.OM_API_KEY! })\n *\n *   await om.connect.users.provision({ external_user_id: 'user-123' })\n *   const { token } = await om.connect.linkSessions.create({ external_user_id: 'user-123' })\n *   await om.orders.buy([leg], { actAs: 'user-123' })\n *\n * Pairs with @openmarketsai/connect-web (the in-app launcher).\n */\nimport crypto from 'node:crypto'\n\nexport const DEFAULT_BASE_URL = 'https://api.openmarkets.ai'\n\n// ──────────────────────────────────────────────────────────────────────────\n// Errors\n// ──────────────────────────────────────────────────────────────────────────\n\n/** Thrown when the API returns a non-2xx response. Mirrors the Flow error envelope. */\nexport class OpenMarketsError extends Error {\n    readonly status: number\n    readonly code: string\n    readonly details?: Record<string, unknown>\n    constructor(status: number, code: string, message: string, details?: Record<string, unknown>) {\n        super(message)\n        this.name = 'OpenMarketsError'\n        this.status = status\n        this.code = code\n        this.details = details\n    }\n}\n\n/** Thrown by `constructWebhookEvent` when a signature is missing, stale, or invalid. */\nexport class WebhookSignatureError extends Error {\n    constructor(message: string) {\n        super(message)\n        this.name = 'WebhookSignatureError'\n    }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Webhook verification (matches src/utils/webhook-signature.ts byte-for-byte)\n//\n//   Header: X-OpenMarkets-Signature: t=<unix_seconds>,v1=<hex hmac>\n//   Signed string: `${t}.${rawBody}`, HMAC-SHA256 with your whsec_ secret.\n//   IMPORTANT: verify over the EXACT raw request body, not a re-serialized object.\n// ──────────────────────────────────────────────────────────────────────────\n\nexport type ConnectWebhookEventType =\n    | 'user.partners_connected'\n    | 'user.permissions_changed'\n    | (string & {})\n\nexport interface ConnectWebhookEvent {\n    type: ConnectWebhookEventType\n    [key: string]: unknown\n}\n\nexport interface VerifyWebhookOptions {\n    /** Max age of the signature timestamp, in seconds. Default 300 (5 min). 0 disables. */\n    toleranceSec?: number\n    /** Injectable clock for testing. */\n    nowSec?: number\n}\n\nfunction toRaw(body: string | Buffer): string {\n    return typeof body === 'string' ? body : body.toString('utf8')\n}\n\nfunction parseSignatureHeader(header: string): { t: number; v1: string } | null {\n    const parts = header.split(',').reduce<Record<string, string>>((acc, kv) => {\n        const idx = kv.indexOf('=')\n        if (idx > 0) acc[kv.slice(0, idx).trim()] = kv.slice(idx + 1).trim()\n        return acc\n    }, {})\n    const t = Number(parts.t)\n    if (!parts.v1 || !isFinite(t)) return null\n    return { t, v1: parts.v1 }\n}\n\nfunction timingSafeEqualHex(a: string, b: string): boolean {\n    const ab = Buffer.from(a, 'hex')\n    const bb = Buffer.from(b, 'hex')\n    if (ab.length === 0 || ab.length !== bb.length) return false\n    return crypto.timingSafeEqual(ab, bb)\n}\n\n/** Verify a webhook signature. Returns false on any failure (never throws). */\nexport function verifyWebhookSignature(\n    secret: string,\n    rawBody: string | Buffer,\n    signatureHeader: string | null | undefined,\n    opts: VerifyWebhookOptions = {},\n): boolean {\n    if (!secret || !signatureHeader) return false\n    const parsed = parseSignatureHeader(signatureHeader)\n    if (!parsed) return false\n    const toleranceSec = opts.toleranceSec ?? 300\n    const nowSec = opts.nowSec ?? Math.floor(Date.now() / 1000)\n    if (toleranceSec > 0 && Math.abs(nowSec - parsed.t) > toleranceSec) return false\n    const expected = crypto\n        .createHmac('sha256', secret)\n        .update(`${parsed.t}.${toRaw(rawBody)}`)\n        .digest('hex')\n    return timingSafeEqualHex(expected, parsed.v1)\n}\n\n/** Verify the signature and return the parsed event, or throw `WebhookSignatureError`. */\nexport function constructWebhookEvent(\n    secret: string,\n    rawBody: string | Buffer,\n    signatureHeader: string | null | undefined,\n    opts: VerifyWebhookOptions = {},\n): ConnectWebhookEvent {\n    if (!verifyWebhookSignature(secret, rawBody, signatureHeader, opts)) {\n        throw new WebhookSignatureError('Invalid or expired webhook signature')\n    }\n    try {\n        return JSON.parse(toRaw(rawBody)) as ConnectWebhookEvent\n    } catch {\n        throw new WebhookSignatureError('Webhook body is not valid JSON')\n    }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Client\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface OpenMarketsClientOptions {\n    /** Your Connect org API key. Sent as `X-API-Key`. */\n    apiKey: string\n    /** API base URL. Defaults to https://api.openmarkets.ai. */\n    baseUrl?: string\n    /** Your webhook signing secret (`whsec_…`), enabling `client.webhooks.*`. */\n    webhookSecret?: string\n    /** Custom fetch (defaults to global fetch; Node 18+). */\n    fetch?: typeof fetch\n    /** Per-request timeout in ms. Default 30000. */\n    timeoutMs?: number\n}\n\nexport type HttpMethod = 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE'\n\nexport interface RequestOptions {\n    query?: Record<string, string | number | boolean | undefined>\n    body?: unknown\n    /** Act on this user's behalf — sets the `X-OpenMarkets-Account` header. */\n    actAs?: string\n}\n\n// Inputs (snake_case to match the API — buy legs map 1:1 from liquidity entries).\nexport interface ProvisionUserParams {\n    external_user_id: string\n    email?: string\n    name?: string\n}\nexport type LinkSessionMode = 'connect' | 'manage'\nexport interface CreateLinkSessionParams {\n    external_user_id: string\n    return_url?: string\n    mode?: LinkSessionMode\n    allowed_partners?: string[]\n    /** Pick a specific org Connect config; omit to use the org's default (if any). */\n    connect_config_id?: string\n}\nexport interface BuyOrder {\n    /** What to buy — set exactly one of position_hash or liquidity_hash. */\n    position_hash?: string\n    liquidity_hash?: string\n    /** Size — set exactly one of amount or shares. */\n    amount?: number // stake, notional USD\n    shares?: number // contract count (each pays $1 on win)\n    /** Price ceiling, 0..1 exclusive — won't fill above this. */\n    max_price: number\n    /** Optional — pin a venue; omit to route to the best price. */\n    partner_id?: string\n    /** Optional — 'real' (default) or 'paper' (practice book). */\n    mode?: 'real' | 'paper'\n}\n\n// Outputs (light — partners can pass a type param for stricter typing).\n/**\n * `POST /flow/v1/connect/users`. Idempotent — safe to call on every login.\n *\n * `om_account_id` is the field an integration actually needs (it addresses the\n * user in later calls) and was previously absent, so it typed as `unknown` via\n * the index signature.\n */\nexport interface ProvisionResult {\n    /** Our id for this user. Pass as `actAs` when trading on their behalf. */\n    om_account_id: string\n    external_user_id: string\n    /** false when the user already existed. */\n    created: boolean\n    [key: string]: unknown\n}\n/**\n * The response of `POST /flow/v1/connect/link-sessions`.\n *\n * These names are the API's, verified against the route rather than assumed:\n * it returns `link_token`, NOT `token`. The previous declaration named `token`,\n * `external_user_id` and `mode` — none of which the endpoint sends — so the one\n * field an integration actually needs type-checked as a string and arrived\n * `undefined`, opening the hosted flow with `token=undefined`. The index\n * signature below is what kept that quiet; keep these names in step with\n * `CreateLinkSessionResult` in LinkSessionOrchestrator.\n */\nexport interface LinkSession {\n    link_session_id: string\n    /** Single-use, expires in 15 minutes. Hand to `createConnect().open()`. */\n    link_token: string\n    /** The hosted flow URL, for redirect mode or a native in-app browser. */\n    hosted_url: string\n    expires_at: string\n    [key: string]: unknown\n}\n/**\n * The status of one leg, mirroring `flowLegStatus` in the API.\n *\n * ALL FIVE values are reachable. This union previously listed only three, so a\n * `switch` written against the SDK's types compiled clean and silently fell\n * through for a resting or pending order — an order that IS live, sitting on a\n * venue book, treated as if it had never been placed. Any change here must\n * follow the API, not the other way round.\n */\nexport type BuyLegStatus =\n    /** Filled or partially filled. */\n    | 'completed'\n    /** Live on the venue's book, unfilled. Not a failure — check back. */\n    | 'resting'\n    /** Accepted by the venue, fill not yet confirmed (async venues). */\n    | 'pending'\n    /** The venue or a pre-trade gate rejected it. */\n    | 'failed'\n    /** No viable venue was found; nothing was sent. */\n    | 'rejected'\n\n/**\n * What an organization's END USERS see and may do in the hosted flow. Mirrors\n * `ConnectConfigBody` server-side.\n *\n * A `null` field means \"no restriction / use the default\" throughout, so an\n * organization with no config behaves exactly as Connect did before configs\n * existed. Read that as permissive, not as unset.\n */\nexport interface ConnectConfig {\n    version: number\n    /** Partner ids or names offered in the picker. null = every venue we support. */\n    venue_allowlist: string[] | null\n    /** Surface the OpenMarkets practice book as a credential-less venue. */\n    offer_internal_book: boolean\n    /**\n     * Currencies users may trade. `['ATLAS']` is practice-only and is ENFORCED\n     * on every order path, not merely hidden in the UI — users can still link\n     * venues, read balances and sync history; only real-money orders are\n     * refused.\n     */\n    allowed_currencies: string[]\n    /** DERIVED from allowed_currencies server-side. Sending it has no effect. */\n    allow_real_money: boolean\n    /** Permissions the user is asked to grant. null = all of them. */\n    available_scopes: ConnectScope[] | null\n    branding: { display_name?: string; logo_url?: string; primary_color?: string } | null\n    allowed_return_urls: string[] | null\n    default_link_mode: LinkSessionMode\n    [key: string]: unknown\n}\n\n/** Permissions an end user grants per connected venue. */\nexport type ConnectScope = 'history:read' | 'trade:execute' | 'balance:read'\n\nexport interface ConnectConfigResult {\n    /** null when the organization has never saved one — `config` is the defaults. */\n    connect_config_id: string | null\n    config: ConnectConfig\n    /**\n     * Present on update: how many EXISTING users the change was applied to.\n     * A funding-mode change reaches users already provisioned, not just future\n     * ones, so this reports what actually happened.\n     */\n    reconcile?: { scanned: number; reconciled: number; failed: number } | null\n}\n\nexport interface BuyResult {\n    results: Array<{\n        index: number\n        status: BuyLegStatus\n        /** NULL when the leg was rejected before routing — no decision was made. */\n        sor_decision_id: string | null\n        filled_notional: number\n        filled_shares: number\n        /** The un-buyable remainder of the requested stake. */\n        unfilled_notional: number\n        avg_price: number | null\n        rejected_reason: string | null\n        venues: Array<{\n            partner_id: string\n            success: boolean\n            router_order_id: string | null\n            error: string | null\n        }>\n    }>\n}\n\ninterface FlowEnvelope<T> {\n    data?: T\n    error?: { code: string; message: string; details?: Record<string, unknown> }\n}\n\nexport interface OpenMarketsClient {\n    /** Generic typed request — escape hatch for endpoints without a helper. */\n    request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<T>\n    connect: {\n        users: {\n            provision(params: ProvisionUserParams): Promise<ProvisionResult>\n            get<T = unknown>(externalUserId: string): Promise<T>\n            getPolicy<T = unknown>(externalUserId: string): Promise<T>\n        }\n        linkSessions: {\n            create(params: CreateLinkSessionParams): Promise<LinkSession>\n            get<T = unknown>(linkSessionId: string): Promise<T>\n        }\n        /**\n         * The organization's Connect config — which venues appear, whether real\n         * money is allowed, and how the hosted flow is branded.\n         *\n         * Requires a PLAYER JWT with workspace admin, not an API key: this is\n         * account governance rather than a data-API capability. `update` sends a\n         * whole body (it is normalized server-side), so read, change, write.\n         */\n        configs: {\n            get(workspaceId: string): Promise<ConnectConfigResult>\n            update(workspaceId: string, config: Partial<ConnectConfig>): Promise<ConnectConfigResult>\n        }\n        webhooks: {\n            getConfig<T = unknown>(): Promise<T>\n            /** Verify a delivery using the configured `webhookSecret`. */\n            verify(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): boolean\n            /** Verify + parse, or throw. Uses the configured `webhookSecret`. */\n            constructEvent(rawBody: string | Buffer, signatureHeader: string | null | undefined, opts?: VerifyWebhookOptions): ConnectWebhookEvent\n        }\n    }\n    account: {\n        partners<T = unknown>(externalUserId: string): Promise<T>\n        balances<T = unknown>(externalUserId: string): Promise<T>\n    }\n    orders: {\n        list<T = unknown>(externalUserId: string): Promise<T>\n        buy(orders: BuyOrder[], opts: { actAs: string }): Promise<BuyResult>\n    }\n    data: {\n        leagues<T = unknown>(): Promise<T>\n        contestLiquidity<T = unknown>(contestId: string): Promise<T>\n    }\n}\n\nexport function createClient(options: OpenMarketsClientOptions): OpenMarketsClient {\n    if (!options.apiKey) throw new Error('createClient: apiKey is required')\n    const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '')\n    const doFetch = options.fetch ?? globalThis.fetch\n    if (!doFetch) throw new Error('No fetch available — pass options.fetch (Node < 18)')\n    const timeoutMs = options.timeoutMs ?? 30_000\n\n    async function request<T = unknown>(\n        method: HttpMethod,\n        path: string,\n        opts: RequestOptions = {},\n    ): Promise<T> {\n        const url = new URL(baseUrl + path)\n        for (const [k, v] of Object.entries(opts.query ?? {})) {\n            if (v !== undefined) url.searchParams.set(k, String(v))\n        }\n        const headers: Record<string, string> = {\n            'X-API-Key': options.apiKey,\n            Accept: 'application/json',\n        }\n        if (opts.body !== undefined) headers['Content-Type'] = 'application/json'\n        if (opts.actAs) headers['X-OpenMarkets-Account'] = opts.actAs\n\n        const ctrl = new AbortController()\n        const timer = setTimeout(() => ctrl.abort(), timeoutMs)\n        let res: Response\n        try {\n            res = await doFetch(url.toString(), {\n                method,\n                headers,\n                body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,\n                signal: ctrl.signal,\n            })\n        } finally {\n            clearTimeout(timer)\n        }\n\n        let envelope: FlowEnvelope<T> | undefined\n        const text = await res.text()\n        if (text) {\n            try {\n                envelope = JSON.parse(text) as FlowEnvelope<T>\n            } catch {\n                /* non-JSON body */\n            }\n        }\n\n        if (!res.ok) {\n            const err = envelope?.error\n            throw new OpenMarketsError(\n                res.status,\n                err?.code ?? 'http_error',\n                err?.message ?? `Request failed with status ${res.status}`,\n                err?.details,\n            )\n        }\n        return (envelope?.data ?? (undefined as unknown)) as T\n    }\n\n    function requireSecret(): string {\n        if (!options.webhookSecret) {\n            throw new Error('webhookSecret was not provided to createClient()')\n        }\n        return options.webhookSecret\n    }\n\n    return {\n        request,\n        connect: {\n            users: {\n                provision: (params) =>\n                    request<ProvisionResult>('POST', '/flow/v1/connect/users', { body: params }),\n                get: (externalUserId) =>\n                    request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}`),\n                getPolicy: (externalUserId) =>\n                    request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}/policy`),\n            },\n            linkSessions: {\n                create: (params) =>\n                    request<LinkSession>('POST', '/flow/v1/connect/link-sessions', { body: params }),\n                get: (linkSessionId) =>\n                    request('GET', `/flow/v1/connect/link-sessions/${encodeURIComponent(linkSessionId)}`),\n            },\n            configs: {\n                get: (workspaceId: string) =>\n                    request<ConnectConfigResult>(\n                        'GET', `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`,\n                    ),\n                update: (workspaceId: string, config: Partial<ConnectConfig>) =>\n                    request<ConnectConfigResult>(\n                        'PUT', `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`,\n                        { body: { config } },\n                    ),\n            },\n            webhooks: {\n                getConfig: () => request('GET', '/flow/v1/connect/webhook-config'),\n                verify: (rawBody, sig, opts) =>\n                    verifyWebhookSignature(requireSecret(), rawBody, sig, opts),\n                constructEvent: (rawBody, sig, opts) =>\n                    constructWebhookEvent(requireSecret(), rawBody, sig, opts),\n            },\n        },\n        account: {\n            partners: (externalUserId) =>\n                request('GET', '/flow/v1/auth/account/partners', { actAs: externalUserId }),\n            balances: (externalUserId) =>\n                request('GET', '/flow/v1/auth/account/balances', { actAs: externalUserId }),\n        },\n        orders: {\n            list: (externalUserId) =>\n                request('GET', '/flow/v1/auth/orders', { actAs: externalUserId }),\n            buy: (orders, opts) =>\n                request<BuyResult>('POST', '/flow/v1/auth/orders/buy', {\n                    body: { orders },\n                    actAs: opts.actAs,\n                }),\n        },\n        data: {\n            leagues: () => request('GET', '/flow/v1/leagues'),\n            contestLiquidity: (contestId) =>\n                request('GET', `/flow/v1/contests/${encodeURIComponent(contestId)}/liquidity`),\n        },\n    }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openmarketsai/connect-node",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Server SDK for OpenMarkets Connect — provision users, mint link sessions, verify webhooks, and execute on a user's behalf.",
   "license": "UNLICENSED",
   "type": "module",
@@ -18,6 +18,7 @@
   },
   "scripts": {
     "build": "tsup",
+    "prepublishOnly": "npm run type-check && npm run build",
     "dev": "tsup --watch",
     "type-check": "tsc --noEmit"
   },