npm - @openmarketsai/connect-node - Versions diffs - 0.4.1 → 0.5.0 - Mend

@openmarketsai/connect-node 0.4.1 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/README.md CHANGED Viewed

@@ -93,7 +93,39 @@ deliveries older than 5 minutes are rejected.
 | `orders.list(id)` | `GET /flow/v1/auth/orders` (act-as) |
 | `orders.buy(orders, { actAs })` | `POST /flow/v1/auth/orders/buy` (act-as) |
 | `data.leagues()` / `contestLiquidity(id)` | `GET /flow/v1/leagues`, `…/contests/:id/liquidity` |
-| `request(method, path, opts)` | escape hatch (`opts.actAs` sets the header) |
+| `ai.invoke(params, { actAs })` | `POST /flow/v1/ai/inferences` + polls `GET …/:id` |
+| `ai.inferences.create / get` | the same, one request at a time |
+| `ai.providers({ actAs })` | `GET /flow/v1/ai/providers` |
+| `request(method, path, opts)` | escape hatch (`opts.actAs` sets the header, `opts.idempotencyKey` sends `Idempotency-Key`) |
+| `requestPage(path, opts)` / `requestAll(path, opts)` | list endpoints with their `next_cursor` — one page, or every page |
+## AI Connect — run models on your user's own key
+Turn it on for your org with `ai_providers: ['anthropic', 'openai']` in your Connect
+config. Your users then see an **AI models** section in the hosted flow, where they
+paste their own Anthropic or OpenAI API key. You never see the key.
+```ts
+const r = await om.ai.invoke<{ pick: 'home' | 'away'; confidence: number }>({
+  provider: 'anthropic',
+  model: 'claude-opus-5',
+  system: 'You pick sides. Answer only in the schema.',
+  messages: [{ role: 'user', content: JSON.stringify(snapshot) }],
+  output_schema: { schema: PICK_SCHEMA },
+}, { actAs: 'user-123' })
+if (r.stop_reason === 'refusal') { /* not an answer */ }
+r.output?.pick      // parsed, schema-shaped
+r.billing           // 'byok' — calls on the user's key are NEVER charged by OpenMarkets
+```
+`billing` defaults to `'auto'`: the user's own key when they linked and shared it,
+otherwise OpenMarkets-hosted models charged in reasoning credits. Send
+`billing: 'byok'` to guarantee a call is never charged (it fails with
+`409 ai_provider_not_linked` instead of falling back).
+Long calls return 202 server-side; `invoke` polls for you and throws
+`AiInferenceFailedError` if the call fails.
 ## Errors

package/dist/index.cjs CHANGED Viewed

@@ -62,13 +62,20 @@ function constructWebhookEvent(secret, rawBody, signatureHeader, opts = {}) {
     throw new WebhookSignatureError("Webhook body is not valid JSON");
   }
 }
+var AiInferenceFailedError = class extends Error {
+  constructor(inference) {
+    super(inference.error?.message ?? "The inference failed");
+    this.name = "AiInferenceFailedError";
+    this.inference = inference;
+  }
+};
 function createClient(options) {
   if (!options.apiKey) throw new Error("createClient: apiKey is required");
   const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
   const doFetch = options.fetch ?? globalThis.fetch;
   if (!doFetch) throw new Error("No fetch available \u2014 pass options.fetch (Node < 18)");
   const timeoutMs = options.timeoutMs ?? 3e4;
-  async function request(method, path, opts = {}) {
+  async function send(method, path, opts = {}) {
     const url = new URL(baseUrl + path);
     for (const [k, v] of Object.entries(opts.query ?? {})) {
       if (v !== void 0) url.searchParams.set(k, String(v));
@@ -79,6 +86,7 @@ function createClient(options) {
     };
     if (opts.body !== void 0) headers["Content-Type"] = "application/json";
     if (opts.actAs) headers["X-OpenMarkets-Account"] = opts.actAs;
+    if (opts.idempotencyKey) headers["Idempotency-Key"] = opts.idempotencyKey;
     const ctrl = new AbortController();
     const timer = setTimeout(() => ctrl.abort(), timeoutMs);
     let res;
@@ -109,7 +117,56 @@ function createClient(options) {
         err?.details
       );
     }
-    return envelope?.data ?? void 0;
+    return envelope ?? {};
+  }
+  async function request(method, path, opts = {}) {
+    return (await send(method, path, opts)).data ?? void 0;
+  }
+  async function requestPage(path, opts = {}) {
+    const env = await send("GET", path, opts);
+    return {
+      data: env.data ?? [],
+      next_cursor: env.pagination?.next_cursor ?? null,
+      has_more: env.pagination?.has_more ?? !!env.pagination?.next_cursor
+    };
+  }
+  async function requestAll(path, opts = {}) {
+    const { maxPages = 50, ...rest } = opts;
+    const out = [];
+    let cursor;
+    for (let page = 0; page < maxPages; page++) {
+      const p = await requestPage(path, { ...rest, query: { ...rest.query ?? {}, cursor } });
+      out.push(...p.data);
+      if (!p.next_cursor) break;
+      cursor = p.next_cursor;
+    }
+    return out;
+  }
+  async function invoke(params, opts = {}) {
+    const deadline = Date.now() + (opts.timeoutMs ?? 6e5);
+    const pollMs = opts.pollIntervalMs ?? 2e3;
+    let inf = await request("POST", "/flow/v1/ai/inferences", {
+      body: params,
+      actAs: opts.actAs,
+      idempotencyKey: crypto__default.default.randomUUID()
+    });
+    while (inf.status === "running") {
+      if (Date.now() > deadline) {
+        throw new OpenMarketsError(
+          408,
+          "poll_timeout",
+          `Inference ${inf.inference_id} is still running; poll ai.inferences.get() to collect it`
+        );
+      }
+      await new Promise((r) => setTimeout(r, pollMs));
+      inf = await request(
+        "GET",
+        `/flow/v1/ai/inferences/${encodeURIComponent(inf.inference_id)}`,
+        { actAs: opts.actAs }
+      );
+    }
+    if (inf.status === "failed") throw new AiInferenceFailedError(inf);
+    return inf;
   }
   function requireSecret() {
     if (!options.webhookSecret) {
@@ -119,6 +176,8 @@ function createClient(options) {
   }
   return {
     request,
+    requestPage,
+    requestAll,
     connect: {
       users: {
         provision: (params) => request("POST", "/flow/v1/connect/users", { body: params }),
@@ -160,10 +219,23 @@ function createClient(options) {
     data: {
       leagues: () => request("GET", "/flow/v1/leagues"),
       contestLiquidity: (contestId) => request("GET", `/flow/v1/contests/${encodeURIComponent(contestId)}/liquidity`)
+    },
+    ai: {
+      invoke,
+      inferences: {
+        create: (params, opts = {}) => request("POST", "/flow/v1/ai/inferences", {
+          body: params,
+          actAs: opts.actAs,
+          idempotencyKey: opts.idempotencyKey
+        }),
+        get: (inferenceId, opts = {}) => request("GET", `/flow/v1/ai/inferences/${encodeURIComponent(inferenceId)}`, { actAs: opts.actAs })
+      },
+      providers: (opts = {}) => request("GET", "/flow/v1/ai/providers", { actAs: opts.actAs })
     }
   };
 }
+exports.AiInferenceFailedError = AiInferenceFailedError;
 exports.DEFAULT_BASE_URL = DEFAULT_BASE_URL;
 exports.OpenMarketsError = OpenMarketsError;
 exports.WebhookSignatureError = WebhookSignatureError;

package/dist/index.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/index.ts"],"names":["crypto"],"mappings":";;;;;;;;;AAkBO,IAAM,gBAAA,GAAmB;AAOzB,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAIxC,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAmC;AAC1F,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACnB;AACJ;AAGO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC7C,YAAY,OAAA,EAAiB;AACzB,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EAChB;AACJ;AA2BA,SAAS,MAAM,IAAA,EAA+B;AAC1C,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,IAAA,CAAK,SAAS,MAAM,CAAA;AACjE;AAEA,SAAS,qBAAqB,MAAA,EAAkD;AAC5E,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,CAAM,GAAG,EAAE,MAAA,CAA+B,CAAC,KAAK,EAAA,KAAO;AACxE,IAAA,MAAM,GAAA,GAAM,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,MAAM,CAAA,EAAG,GAAA,CAAI,EAAA,CAAG,KAAA,CAAM,GAAG,GAAG,CAAA,CAAE,IAAA,EAAM,IAAI,EAAA,CAAG,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxB,EAAA,IAAI,CAAC,KAAA,CAAM,EAAA,IAAM,CAAC,QAAA,CAAS,CAAC,GAAG,OAAO,IAAA;AACtC,EAAA,OAAO,EAAE,CAAA,EAAG,EAAA,EAAI,KAAA,CAAM,EAAA,EAAG;AAC7B;AAEA,SAAS,kBAAA,CAAmB,GAAW,CAAA,EAAoB;AACvD,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,IAAI,GAAG,MAAA,KAAW,CAAA,IAAK,GAAG,MAAA,KAAW,EAAA,CAAG,QAAQ,OAAO,KAAA;AACvD,EAAA,OAAOA,uBAAA,CAAO,eAAA,CAAgB,EAAA,EAAI,EAAE,CAAA;AACxC;AAGO,SAAS,uBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACvB;AACP,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,eAAA,EAAiB,OAAO,KAAA;AACxC,EAAA,MAAM,MAAA,GAAS,qBAAqB,eAAe,CAAA;AACnD,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,GAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC1D,EAAA,IAAI,YAAA,GAAe,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,MAAA,CAAO,CAAC,CAAA,GAAI,YAAA,EAAc,OAAO,KAAA;AAC3E,EAAA,MAAM,WAAWA,uBAAA,CACZ,UAAA,CAAW,QAAA,EAAU,MAAM,EAC3B,MAAA,CAAO,CAAA,EAAG,MAAA,CAAO,CAAC,IAAI,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,CAAA,CACtC,OAAO,KAAK,CAAA;AACjB,EAAA,OAAO,kBAAA,CAAmB,QAAA,EAAU,MAAA,CAAO,EAAE,CAAA;AACjD;AAGO,SAAS,sBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACX;AACnB,EAAA,IAAI,CAAC,sBAAA,CAAuB,MAAA,EAAQ,OAAA,EAAS,eAAA,EAAiB,IAAI,CAAA,EAAG;AACjE,IAAA,MAAM,IAAI,sBAAsB,sCAAsC,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI;AACA,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AACJ,IAAA,MAAM,IAAI,sBAAsB,gCAAgC,CAAA;AAAA,EACpE;AACJ;AA0OO,SAAS,aAAa,OAAA,EAAsD;AAC/E,EAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,MAAM,kCAAkC,CAAA;AACvE,EAAA,MAAM,WAAW,OAAA,CAAQ,OAAA,IAAW,gBAAA,EAAkB,OAAA,CAAQ,OAAO,EAAE,CAAA;AACvE,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,0DAAqD,CAAA;AACnF,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,GAAA;AAEvC,EAAA,eAAe,OAAA,CACX,MAAA,EACA,IAAA,EACA,IAAA,GAAuB,EAAC,EACd;AACV,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,GAAU,IAAI,CAAA;AAClC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA,EAAG;AACnD,MAAA,IAAI,CAAA,KAAM,QAAW,GAAA,CAAI,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,aAAa,OAAA,CAAQ,MAAA;AAAA,MACrB,MAAA,EAAQ;AAAA,KACZ;AACA,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AACvD,IAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAA,CAAQ,uBAAuB,IAAI,IAAA,CAAK,KAAA;AAExD,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,IAAA,CAAK,KAAA,IAAS,SAAS,CAAA;AACtD,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACA,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,IAAA,CAAK;AAAA,OAChB,CAAA;AAAA,IACL,CAAA,SAAE;AACE,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACtB;AAEA,IAAA,IAAI,QAAA;AACJ,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,IAAA,EAAM;AACN,MAAA,IAAI;AACA,QAAA,QAAA,GAAW,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,MAC9B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,MAAM,QAAA,EAAU,KAAA;AACtB,MAAA,MAAM,IAAI,gBAAA;AAAA,QACN,GAAA,CAAI,MAAA;AAAA,QACJ,KAAK,IAAA,IAAQ,YAAA;AAAA,QACb,GAAA,EAAK,OAAA,IAAW,CAAA,2BAAA,EAA8B,GAAA,CAAI,MAAM,CAAA,CAAA;AAAA,QACxD,GAAA,EAAK;AAAA,OACT;AAAA,IACJ;AACA,IAAA,OAAQ,UAAU,IAAA,IAAS,MAAA;AAAA,EAC/B;AAEA,EAAA,SAAS,aAAA,GAAwB;AAC7B,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AACxB,MAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,OAAA,CAAQ,aAAA;AAAA,EACnB;AAEA,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,KAAA,EAAO;AAAA,QACH,SAAA,EAAW,CAAC,MAAA,KACR,OAAA,CAAyB,QAAQ,wBAAA,EAA0B,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QAC/E,GAAA,EAAK,CAAC,cAAA,KACF,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,CAAE,CAAA;AAAA,QACjF,SAAA,EAAW,CAAC,cAAA,KACR,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,OAAA,CAAS;AAAA,OAC5F;AAAA,MACA,YAAA,EAAc;AAAA,QACV,MAAA,EAAQ,CAAC,MAAA,KACL,OAAA,CAAqB,QAAQ,gCAAA,EAAkC,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QACnF,GAAA,EAAK,CAAC,aAAA,KACF,OAAA,CAAQ,OAAO,CAAA,+BAAA,EAAkC,kBAAA,CAAmB,aAAa,CAAC,CAAA,CAAE;AAAA,OAC5F;AAAA,MACA,OAAA,EAAS;AAAA,QACL,GAAA,EAAK,CAAC,WAAA,KACF,OAAA;AAAA,UACI,KAAA;AAAA,UAAO,CAAA,oBAAA,EAAuB,kBAAA,CAAmB,WAAW,CAAC,CAAA,eAAA;AAAA,SACjE;AAAA,QACJ,MAAA,EAAQ,CAAC,WAAA,EAAqB,MAAA,KAC1B,OAAA;AAAA,UACI,KAAA;AAAA,UAAO,CAAA,oBAAA,EAAuB,kBAAA,CAAmB,WAAW,CAAC,CAAA,eAAA,CAAA;AAAA,UAC7D,EAAE,IAAA,EAAM,EAAE,MAAA,EAAO;AAAE;AACvB,OACR;AAAA,MACA,QAAA,EAAU;AAAA,QACN,SAAA,EAAW,MAAM,OAAA,CAAQ,KAAA,EAAO,iCAAiC,CAAA;AAAA,QACjE,MAAA,EAAQ,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KACnB,uBAAuB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI,CAAA;AAAA,QAC9D,cAAA,EAAgB,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KAC3B,sBAAsB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI;AAAA;AACjE,KACJ;AAAA,IACA,OAAA,EAAS;AAAA,MACL,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MAC9E,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB;AAAA,KAClF;AAAA,IACA,MAAA,EAAQ;AAAA,MACJ,IAAA,EAAM,CAAC,cAAA,KACH,OAAA,CAAQ,OAAO,sBAAA,EAAwB,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MACpE,KAAK,CAAC,MAAA,EAAQ,IAAA,KACV,OAAA,CAAmB,QAAQ,0BAAA,EAA4B;AAAA,QACnD,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,QACf,OAAO,IAAA,CAAK;AAAA,OACf;AAAA,KACT;AAAA,IACA,IAAA,EAAM;AAAA,MACF,OAAA,EAAS,MAAM,OAAA,CAAQ,KAAA,EAAO,kBAAkB,CAAA;AAAA,MAChD,gBAAA,EAAkB,CAAC,SAAA,KACf,OAAA,CAAQ,OAAO,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,SAAS,CAAC,CAAA,UAAA,CAAY;AAAA;AACrF,GACJ;AACJ","file":"index.cjs","sourcesContent":["/*\n @openmarketsai/connect-node\n \n Server SDK for OpenMarkets Connect. A thin, typed wrapper over the Flow API:\n * provision your users, mint hosted link sessions, verify webhook deliveries,\n * read on a user's behalf, and execute orders on their account.\n \n import { createClient } from '@openmarketsai/connect-node'\n * const om = createClient({ apiKey: process.env.OM_API_KEY! })\n \n await om.connect.users.provision({ external_user_id: 'user-123' })\n * const { token } = await om.connect.linkSessions.create({ external_user_id: 'user-123' })\n * await om.orders.buy([leg], { actAs: 'user-123' })\n \n Pairs with @openmarketsai/connect-web (the in-app launcher).\n /\nimport crypto from 'node:crypto'\n\nexport const DEFAULT_BASE_URL = 'https://api.openmarkets.ai'\n\n// ──────────────────────────────────────────────────────────────────────────\n// Errors\n// ──────────────────────────────────────────────────────────────────────────\n\n/* Thrown when the API returns a non-2xx response. Mirrors the Flow error envelope. /\nexport class OpenMarketsError extends Error {\n readonly status: number\n readonly code: string\n readonly details?: Record<string, unknown>\n constructor(status: number, code: string, message: string, details?: Record<string, unknown>) {\n super(message)\n this.name = 'OpenMarketsError'\n this.status = status\n this.code = code\n this.details = details\n }\n}\n\n/* Thrown by `constructWebhookEvent` when a signature is missing, stale, or invalid. /\nexport class WebhookSignatureError extends Error {\n constructor(message: string) {\n super(message)\n this.name = 'WebhookSignatureError'\n }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Webhook verification (matches src/utils/webhook-signature.ts byte-for-byte)\n//\n// Header: X-OpenMarkets-Signature: t=<unix_seconds>,v1=<hex hmac>\n// Signed string: `${t}.${rawBody}`, HMAC-SHA256 with your whsec_ secret.\n// IMPORTANT: verify over the EXACT raw request body, not a re-serialized object.\n// ──────────────────────────────────────────────────────────────────────────\n\nexport type ConnectWebhookEventType =\n \| 'user.partners_connected'\n \| 'user.permissions_changed'\n \| (string & {})\n\nexport interface ConnectWebhookEvent {\n type: ConnectWebhookEventType\n [key: string]: unknown\n}\n\nexport interface VerifyWebhookOptions {\n /* Max age of the signature timestamp, in seconds. Default 300 (5 min). 0 disables. /\n toleranceSec?: number\n /* Injectable clock for testing. /\n nowSec?: number\n}\n\nfunction toRaw(body: string \| Buffer): string {\n return typeof body === 'string' ? body : body.toString('utf8')\n}\n\nfunction parseSignatureHeader(header: string): { t: number; v1: string } \| null {\n const parts = header.split(',').reduce<Record<string, string>>((acc, kv) => {\n const idx = kv.indexOf('=')\n if (idx > 0) acc[kv.slice(0, idx).trim()] = kv.slice(idx + 1).trim()\n return acc\n }, {})\n const t = Number(parts.t)\n if (!parts.v1 \|\| !isFinite(t)) return null\n return { t, v1: parts.v1 }\n}\n\nfunction timingSafeEqualHex(a: string, b: string): boolean {\n const ab = Buffer.from(a, 'hex')\n const bb = Buffer.from(b, 'hex')\n if (ab.length === 0 \|\| ab.length !== bb.length) return false\n return crypto.timingSafeEqual(ab, bb)\n}\n\n/* Verify a webhook signature. Returns false on any failure (never throws). /\nexport function verifyWebhookSignature(\n secret: string,\n rawBody: string \| Buffer,\n signatureHeader: string \| null \| undefined,\n opts: VerifyWebhookOptions = {},\n): boolean {\n if (!secret \|\| !signatureHeader) return false\n const parsed = parseSignatureHeader(signatureHeader)\n if (!parsed) return false\n const toleranceSec = opts.toleranceSec ?? 300\n const nowSec = opts.nowSec ?? Math.floor(Date.now() / 1000)\n if (toleranceSec > 0 && Math.abs(nowSec - parsed.t) > toleranceSec) return false\n const expected = crypto\n .createHmac('sha256', secret)\n .update(`${parsed.t}.${toRaw(rawBody)}`)\n .digest('hex')\n return timingSafeEqualHex(expected, parsed.v1)\n}\n\n/* Verify the signature and return the parsed event, or throw `WebhookSignatureError`. /\nexport function constructWebhookEvent(\n secret: string,\n rawBody: string \| Buffer,\n signatureHeader: string \| null \| undefined,\n opts: VerifyWebhookOptions = {},\n): ConnectWebhookEvent {\n if (!verifyWebhookSignature(secret, rawBody, signatureHeader, opts)) {\n throw new WebhookSignatureError('Invalid or expired webhook signature')\n }\n try {\n return JSON.parse(toRaw(rawBody)) as ConnectWebhookEvent\n } catch {\n throw new WebhookSignatureError('Webhook body is not valid JSON')\n }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Client\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface OpenMarketsClientOptions {\n /* Your Connect org API key. Sent as `X-API-Key`. /\n apiKey: string\n /* API base URL. Defaults to https://api.openmarkets.ai. /\n baseUrl?: string\n /* Your webhook signing secret (`whsec_…`), enabling `client.webhooks.`. /\n webhookSecret?: string\n /** Custom fetch (defaults to global fetch; Node 18+). /\n fetch?: typeof fetch\n /* Per-request timeout in ms. Default 30000. /\n timeoutMs?: number\n}\n\nexport type HttpMethod = 'GET' \| 'POST' \| 'PATCH' \| 'PUT' \| 'DELETE'\n\nexport interface RequestOptions {\n query?: Record<string, string \| number \| boolean \| undefined>\n body?: unknown\n /* Act on this user's behalf — sets the `X-OpenMarkets-Account` header. /\n actAs?: string\n}\n\n// Inputs (snake_case to match the API — buy legs map 1:1 from liquidity entries).\nexport interface ProvisionUserParams {\n external_user_id: string\n email?: string\n name?: string\n}\nexport type LinkSessionMode = 'connect' \| 'manage'\nexport interface CreateLinkSessionParams {\n external_user_id: string\n return_url?: string\n mode?: LinkSessionMode\n allowed_partners?: string[]\n /* Pick a specific org Connect config; omit to use the org's default (if any). /\n connect_config_id?: string\n}\nexport interface BuyOrder {\n /* What to buy — set exactly one of position_hash or liquidity_hash. /\n position_hash?: string\n liquidity_hash?: string\n /* Size — set exactly one of amount or shares. /\n amount?: number // stake, notional USD\n shares?: number // contract count (each pays $1 on win)\n /* Price ceiling, 0..1 exclusive — won't fill above this. /\n max_price: number\n /* Optional — pin a venue; omit to route to the best price. /\n partner_id?: string\n /* Optional — 'real' (default) or 'paper' (practice book). /\n mode?: 'real' \| 'paper'\n}\n\n// Outputs (light — partners can pass a type param for stricter typing).\n/\n `POST /flow/v1/connect/users`. Idempotent — safe to call on every login.\n \n `om_account_id` is the field an integration actually needs (it addresses the\n * user in later calls) and was previously absent, so it typed as `unknown` via\n * the index signature.\n /\nexport interface ProvisionResult {\n /* Our id for this user. Pass as `actAs` when trading on their behalf. /\n om_account_id: string\n external_user_id: string\n /* false when the user already existed. /\n created: boolean\n [key: string]: unknown\n}\n/\n The response of `POST /flow/v1/connect/link-sessions`.\n \n These names are the API's, verified against the route rather than assumed:\n * it returns `link_token`, NOT `token`. The previous declaration named `token`,\n * `external_user_id` and `mode` — none of which the endpoint sends — so the one\n * field an integration actually needs type-checked as a string and arrived\n * `undefined`, opening the hosted flow with `token=undefined`. The index\n * signature below is what kept that quiet; keep these names in step with\n * `CreateLinkSessionResult` in LinkSessionOrchestrator.\n /\nexport interface LinkSession {\n link_session_id: string\n /* Single-use, expires in 15 minutes. Hand to `createConnect().open()`. /\n link_token: string\n /* The hosted flow URL, for redirect mode or a native in-app browser. /\n hosted_url: string\n expires_at: string\n [key: string]: unknown\n}\n/\n The status of one leg, mirroring `flowLegStatus` in the API.\n \n ALL FIVE values are reachable. This union previously listed only three, so a\n * `switch` written against the SDK's types compiled clean and silently fell\n * through for a resting or pending order — an order that IS live, sitting on a\n * venue book, treated as if it had never been placed. Any change here must\n * follow the API, not the other way round.\n /\nexport type BuyLegStatus =\n /* Filled or partially filled. /\n \| 'completed'\n /* Live on the venue's book, unfilled. Not a failure — check back. /\n \| 'resting'\n /* Accepted by the venue, fill not yet confirmed (async venues). /\n \| 'pending'\n /* The venue or a pre-trade gate rejected it. /\n \| 'failed'\n /* No viable venue was found; nothing was sent. /\n \| 'rejected'\n\n/\n What an organization's END USERS see and may do in the hosted flow. Mirrors\n * `ConnectConfigBody` server-side.\n \n A `null` field means \"no restriction / use the default\" throughout, so an\n * organization with no config behaves exactly as Connect did before configs\n * existed. Read that as permissive, not as unset.\n /\nexport interface ConnectConfig {\n version: number\n /* Partner ids or names offered in the picker. null = every venue we support. /\n venue_allowlist: string[] \| null\n /* Surface the OpenMarkets practice book as a credential-less venue. /\n offer_internal_book: boolean\n /\n Currencies users may trade. `['ATLAS']` is practice-only and is ENFORCED\n * on every order path, not merely hidden in the UI — users can still link\n * venues, read balances and sync history; only real-money orders are\n * refused.\n /\n allowed_currencies: string[]\n /* DERIVED from allowed_currencies server-side. Sending it has no effect. /\n allow_real_money: boolean\n /* Permissions the user is asked to grant. null = all of them. /\n available_scopes: ConnectScope[] \| null\n branding: { display_name?: string; logo_url?: string; primary_color?: string } \| null\n allowed_return_urls: string[] \| null\n default_link_mode: LinkSessionMode\n [key: string]: unknown\n}\n\n/* Permissions an end user grants per connected venue. /\nexport type ConnectScope = 'history:read' \| 'trade:execute' \| 'balance:read'\n\nexport interface ConnectConfigResult {\n /* null when the organization has never saved one — `config` is the defaults. /\n connect_config_id: string \| null\n config: ConnectConfig\n /\n Present on update: how many EXISTING users the change was applied to.\n * A funding-mode change reaches users already provisioned, not just future\n * ones, so this reports what actually happened.\n /\n reconcile?: { scanned: number; reconciled: number; failed: number } \| null\n}\n\nexport interface BuyResult {\n results: Array<{\n index: number\n status: BuyLegStatus\n /* NULL when the leg was rejected before routing — no decision was made. /\n sor_decision_id: string \| null\n filled_notional: number\n filled_shares: number\n /* The un-buyable remainder of the requested stake. /\n unfilled_notional: number\n avg_price: number \| null\n rejected_reason: string \| null\n venues: Array<{\n partner_id: string\n success: boolean\n router_order_id: string \| null\n error: string \| null\n }>\n }>\n}\n\ninterface FlowEnvelope<T> {\n data?: T\n error?: { code: string; message: string; details?: Record<string, unknown> }\n}\n\nexport interface OpenMarketsClient {\n /* Generic typed request — escape hatch for endpoints without a helper. /\n request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<T>\n connect: {\n users: {\n provision(params: ProvisionUserParams): Promise<ProvisionResult>\n get<T = unknown>(externalUserId: string): Promise<T>\n getPolicy<T = unknown>(externalUserId: string): Promise<T>\n }\n linkSessions: {\n create(params: CreateLinkSessionParams): Promise<LinkSession>\n get<T = unknown>(linkSessionId: string): Promise<T>\n }\n /\n The organization's Connect config — which venues appear, whether real\n * money is allowed, and how the hosted flow is branded.\n \n Requires a PLAYER JWT with workspace admin, not an API key: this is\n * account governance rather than a data-API capability. `update` sends a\n * whole body (it is normalized server-side), so read, change, write.\n /\n configs: {\n get(workspaceId: string): Promise<ConnectConfigResult>\n update(workspaceId: string, config: Partial<ConnectConfig>): Promise<ConnectConfigResult>\n }\n webhooks: {\n getConfig<T = unknown>(): Promise<T>\n /* Verify a delivery using the configured `webhookSecret`. /\n verify(rawBody: string \| Buffer, signatureHeader: string \| null \| undefined, opts?: VerifyWebhookOptions): boolean\n /* Verify + parse, or throw. Uses the configured `webhookSecret`. /\n constructEvent(rawBody: string \| Buffer, signatureHeader: string \| null \| undefined, opts?: VerifyWebhookOptions): ConnectWebhookEvent\n }\n }\n account: {\n partners<T = unknown>(externalUserId: string): Promise<T>\n balances<T = unknown>(externalUserId: string): Promise<T>\n }\n orders: {\n list<T = unknown>(externalUserId: string): Promise<T>\n buy(orders: BuyOrder[], opts: { actAs: string }): Promise<BuyResult>\n }\n data: {\n leagues<T = unknown>(): Promise<T>\n contestLiquidity<T = unknown>(contestId: string): Promise<T>\n }\n}\n\nexport function createClient(options: OpenMarketsClientOptions): OpenMarketsClient {\n if (!options.apiKey) throw new Error('createClient: apiKey is required')\n const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '')\n const doFetch = options.fetch ?? globalThis.fetch\n if (!doFetch) throw new Error('No fetch available — pass options.fetch (Node < 18)')\n const timeoutMs = options.timeoutMs ?? 30_000\n\n async function request<T = unknown>(\n method: HttpMethod,\n path: string,\n opts: RequestOptions = {},\n ): Promise<T> {\n const url = new URL(baseUrl + path)\n for (const [k, v] of Object.entries(opts.query ?? {})) {\n if (v !== undefined) url.searchParams.set(k, String(v))\n }\n const headers: Record<string, string> = {\n 'X-API-Key': options.apiKey,\n Accept: 'application/json',\n }\n if (opts.body !== undefined) headers['Content-Type'] = 'application/json'\n if (opts.actAs) headers['X-OpenMarkets-Account'] = opts.actAs\n\n const ctrl = new AbortController()\n const timer = setTimeout(() => ctrl.abort(), timeoutMs)\n let res: Response\n try {\n res = await doFetch(url.toString(), {\n method,\n headers,\n body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,\n signal: ctrl.signal,\n })\n } finally {\n clearTimeout(timer)\n }\n\n let envelope: FlowEnvelope<T> \| undefined\n const text = await res.text()\n if (text) {\n try {\n envelope = JSON.parse(text) as FlowEnvelope<T>\n } catch {\n / non-JSON body */\n }\n }\n\n if (!res.ok) {\n const err = envelope?.error\n throw new OpenMarketsError(\n res.status,\n err?.code ?? 'http_error',\n err?.message ?? `Request failed with status ${res.status}`,\n err?.details,\n )\n }\n return (envelope?.data ?? (undefined as unknown)) as T\n }\n\n function requireSecret(): string {\n if (!options.webhookSecret) {\n throw new Error('webhookSecret was not provided to createClient()')\n }\n return options.webhookSecret\n }\n\n return {\n request,\n connect: {\n users: {\n provision: (params) =>\n request<ProvisionResult>('POST', '/flow/v1/connect/users', { body: params }),\n get: (externalUserId) =>\n request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}`),\n getPolicy: (externalUserId) =>\n request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}/policy`),\n },\n linkSessions: {\n create: (params) =>\n request<LinkSession>('POST', '/flow/v1/connect/link-sessions', { body: params }),\n get: (linkSessionId) =>\n request('GET', `/flow/v1/connect/link-sessions/${encodeURIComponent(linkSessionId)}`),\n },\n configs: {\n get: (workspaceId: string) =>\n request<ConnectConfigResult>(\n 'GET', `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`,\n ),\n update: (workspaceId: string, config: Partial<ConnectConfig>) =>\n request<ConnectConfigResult>(\n 'PUT', `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`,\n { body: { config } },\n ),\n },\n webhooks: {\n getConfig: () => request('GET', '/flow/v1/connect/webhook-config'),\n verify: (rawBody, sig, opts) =>\n verifyWebhookSignature(requireSecret(), rawBody, sig, opts),\n constructEvent: (rawBody, sig, opts) =>\n constructWebhookEvent(requireSecret(), rawBody, sig, opts),\n },\n },\n account: {\n partners: (externalUserId) =>\n request('GET', '/flow/v1/auth/account/partners', { actAs: externalUserId }),\n balances: (externalUserId) =>\n request('GET', '/flow/v1/auth/account/balances', { actAs: externalUserId }),\n },\n orders: {\n list: (externalUserId) =>\n request('GET', '/flow/v1/auth/orders', { actAs: externalUserId }),\n buy: (orders, opts) =>\n request<BuyResult>('POST', '/flow/v1/auth/orders/buy', {\n body: { orders },\n actAs: opts.actAs,\n }),\n },\n data: {\n leagues: () => request('GET', '/flow/v1/leagues'),\n contestLiquidity: (contestId) =>\n request('GET', `/flow/v1/contests/${encodeURIComponent(contestId)}/liquidity`),\n },\n }\n}\n"]}
1	+ {"version":3,"sources":["../src/index.ts"],"names":["crypto"],"mappings":";;;;;;;;;AAmBO,IAAM,gBAAA,GAAmB;AAOzB,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAIxC,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAmC;AAC1F,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACnB;AACJ;AAGO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC7C,YAAY,OAAA,EAAiB;AACzB,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EAChB;AACJ;AA4BA,SAAS,MAAM,IAAA,EAA+B;AAC1C,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,IAAA,CAAK,SAAS,MAAM,CAAA;AACjE;AAEA,SAAS,qBAAqB,MAAA,EAAkD;AAC5E,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,CAAM,GAAG,EAAE,MAAA,CAA+B,CAAC,KAAK,EAAA,KAAO;AACxE,IAAA,MAAM,GAAA,GAAM,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,MAAM,CAAA,EAAG,GAAA,CAAI,EAAA,CAAG,KAAA,CAAM,GAAG,GAAG,CAAA,CAAE,IAAA,EAAM,IAAI,EAAA,CAAG,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxB,EAAA,IAAI,CAAC,KAAA,CAAM,EAAA,IAAM,CAAC,QAAA,CAAS,CAAC,GAAG,OAAO,IAAA;AACtC,EAAA,OAAO,EAAE,CAAA,EAAG,EAAA,EAAI,KAAA,CAAM,EAAA,EAAG;AAC7B;AAEA,SAAS,kBAAA,CAAmB,GAAW,CAAA,EAAoB;AACvD,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,IAAI,GAAG,MAAA,KAAW,CAAA,IAAK,GAAG,MAAA,KAAW,EAAA,CAAG,QAAQ,OAAO,KAAA;AACvD,EAAA,OAAOA,uBAAA,CAAO,eAAA,CAAgB,EAAA,EAAI,EAAE,CAAA;AACxC;AAGO,SAAS,uBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACvB;AACP,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,eAAA,EAAiB,OAAO,KAAA;AACxC,EAAA,MAAM,MAAA,GAAS,qBAAqB,eAAe,CAAA;AACnD,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,GAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC1D,EAAA,IAAI,YAAA,GAAe,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,MAAA,CAAO,CAAC,CAAA,GAAI,YAAA,EAAc,OAAO,KAAA;AAC3E,EAAA,MAAM,WAAWA,uBAAA,CACZ,UAAA,CAAW,QAAA,EAAU,MAAM,EAC3B,MAAA,CAAO,CAAA,EAAG,MAAA,CAAO,CAAC,IAAI,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,CAAA,CACtC,OAAO,KAAK,CAAA;AACjB,EAAA,OAAO,kBAAA,CAAmB,QAAA,EAAU,MAAA,CAAO,EAAE,CAAA;AACjD;AAGO,SAAS,sBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACX;AACnB,EAAA,IAAI,CAAC,sBAAA,CAAuB,MAAA,EAAQ,OAAA,EAAS,eAAA,EAAiB,IAAI,CAAA,EAAG;AACjE,IAAA,MAAM,IAAI,sBAAsB,sCAAsC,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI;AACA,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AACJ,IAAA,MAAM,IAAI,sBAAsB,gCAAgC,CAAA;AAAA,EACpE;AACJ;AAuQO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAE9C,YAAY,SAAA,EAAwB;AAChC,IAAA,KAAA,CAAM,SAAA,CAAU,KAAA,EAAO,OAAA,IAAW,sBAAsB,CAAA;AACxD,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACrB;AACJ;AAsFO,SAAS,aAAa,OAAA,EAAsD;AAC/E,EAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,MAAM,kCAAkC,CAAA;AACvE,EAAA,MAAM,WAAW,OAAA,CAAQ,OAAA,IAAW,gBAAA,EAAkB,OAAA,CAAQ,OAAO,EAAE,CAAA;AACvE,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,0DAAqD,CAAA;AACnF,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,GAAA;AAEvC,EAAA,eAAe,IAAA,CAAQ,MAAA,EAAoB,IAAA,EAAc,IAAA,GAAuB,EAAC,EAA6B;AAC1G,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,GAAU,IAAI,CAAA;AAClC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA,EAAG;AACnD,MAAA,IAAI,CAAA,KAAM,QAAW,GAAA,CAAI,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,aAAa,OAAA,CAAQ,MAAA;AAAA,MACrB,MAAA,EAAQ;AAAA,KACZ;AACA,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AACvD,IAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAA,CAAQ,uBAAuB,IAAI,IAAA,CAAK,KAAA;AACxD,IAAA,IAAI,IAAA,CAAK,cAAA,EAAgB,OAAA,CAAQ,iBAAiB,IAAI,IAAA,CAAK,cAAA;AAE3D,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,IAAA,CAAK,KAAA,IAAS,SAAS,CAAA;AACtD,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACA,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,IAAA,CAAK;AAAA,OAChB,CAAA;AAAA,IACL,CAAA,SAAE;AACE,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACtB;AAEA,IAAA,IAAI,QAAA;AACJ,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,IAAA,EAAM;AACN,MAAA,IAAI;AACA,QAAA,QAAA,GAAW,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,MAC9B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,MAAM,QAAA,EAAU,KAAA;AACtB,MAAA,MAAM,IAAI,gBAAA;AAAA,QACN,GAAA,CAAI,MAAA;AAAA,QACJ,KAAK,IAAA,IAAQ,YAAA;AAAA,QACb,GAAA,EAAK,OAAA,IAAW,CAAA,2BAAA,EAA8B,GAAA,CAAI,MAAM,CAAA,CAAA;AAAA,QACxD,GAAA,EAAK;AAAA,OACT;AAAA,IACJ;AACA,IAAA,OAAO,YAAY,EAAC;AAAA,EACxB;AAEA,EAAA,eAAe,OAAA,CAAqB,MAAA,EAAoB,IAAA,EAAc,IAAA,GAAuB,EAAC,EAAe;AACzG,IAAA,OAAA,CAAS,MAAM,IAAA,CAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,GAAG,IAAA,IAAS,MAAA;AAAA,EACzD;AAEA,EAAA,eAAe,WAAA,CAAyB,IAAA,EAAc,IAAA,GAAqC,EAAC,EAAqB;AAC7G,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAU,KAAA,EAAO,MAAM,IAAI,CAAA;AAC7C,IAAA,OAAO;AAAA,MACH,IAAA,EAAM,GAAA,CAAI,IAAA,IAAQ,EAAC;AAAA,MACnB,WAAA,EAAa,GAAA,CAAI,UAAA,EAAY,WAAA,IAAe,IAAA;AAAA,MAC5C,UAAU,GAAA,CAAI,UAAA,EAAY,YAAY,CAAC,CAAC,IAAI,UAAA,EAAY;AAAA,KAC5D;AAAA,EACJ;AAEA,EAAA,eAAe,UAAA,CACX,IAAA,EACA,IAAA,GAA6D,EAAC,EAClD;AACZ,IAAA,MAAM,EAAE,QAAA,GAAW,EAAA,EAAI,GAAG,MAAK,GAAI,IAAA;AACnC,IAAA,MAAM,MAAW,EAAC;AAClB,IAAA,IAAI,MAAA;AACJ,IAAA,KAAA,IAAS,IAAA,GAAO,CAAA,EAAG,IAAA,GAAO,QAAA,EAAU,IAAA,EAAA,EAAQ;AACxC,MAAA,MAAM,IAAI,MAAM,WAAA,CAAe,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,KAAA,EAAO,EAAE,GAAI,KAAK,KAAA,IAAS,EAAC,EAAI,MAAA,IAAU,CAAA;AAC1F,MAAA,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA,CAAE,IAAI,CAAA;AAClB,MAAA,IAAI,CAAC,EAAE,WAAA,EAAa;AACpB,MAAA,MAAA,GAAS,CAAA,CAAE,WAAA;AAAA,IACf;AACA,IAAA,OAAO,GAAA;AAAA,EACX;AAEA,EAAA,eAAe,MAAA,CAAgB,MAAA,EAA2B,IAAA,GAAwB,EAAC,EAAkC;AACjH,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,IAAK,KAAK,SAAA,IAAa,GAAA,CAAA;AACjD,IAAA,MAAM,MAAA,GAAS,KAAK,cAAA,IAAkB,GAAA;AAGtC,IAAA,IAAI,GAAA,GAAM,MAAM,OAAA,CAA8B,MAAA,EAAQ,wBAAA,EAA0B;AAAA,MAC5E,IAAA,EAAM,MAAA;AAAA,MACN,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,cAAA,EAAgBA,wBAAO,UAAA;AAAW,KACrC,CAAA;AACD,IAAA,OAAO,GAAA,CAAI,WAAW,SAAA,EAAW;AAC7B,MAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AACvB,QAAA,MAAM,IAAI,gBAAA;AAAA,UAAiB,GAAA;AAAA,UAAK,cAAA;AAAA,UAC5B,CAAA,UAAA,EAAa,IAAI,YAAY,CAAA,yDAAA;AAAA,SAA2D;AAAA,MAChG;AACA,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,MAAM,CAAC,CAAA;AAC9C,MAAA,GAAA,GAAM,MAAM,OAAA;AAAA,QACR,KAAA;AAAA,QAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,GAAA,CAAI,YAAY,CAAC,CAAA,CAAA;AAAA,QAAI,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA;AAAM,OACjG;AAAA,IACJ;AACA,IAAA,IAAI,IAAI,MAAA,KAAW,QAAA,EAAU,MAAM,IAAI,uBAAuB,GAAkB,CAAA;AAChF,IAAA,OAAO,GAAA;AAAA,EACX;AAEA,EAAA,SAAS,aAAA,GAAwB;AAC7B,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AACxB,MAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,OAAA,CAAQ,aAAA;AAAA,EACnB;AAEA,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,WAAA;AAAA,IACA,UAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,KAAA,EAAO;AAAA,QACH,SAAA,EAAW,CAAC,MAAA,KACR,OAAA,CAAyB,QAAQ,wBAAA,EAA0B,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QAC/E,GAAA,EAAK,CAAC,cAAA,KACF,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,CAAE,CAAA;AAAA,QACjF,SAAA,EAAW,CAAC,cAAA,KACR,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,OAAA,CAAS;AAAA,OAC5F;AAAA,MACA,YAAA,EAAc;AAAA,QACV,MAAA,EAAQ,CAAC,MAAA,KACL,OAAA,CAAqB,QAAQ,gCAAA,EAAkC,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QACnF,GAAA,EAAK,CAAC,aAAA,KACF,OAAA,CAAQ,OAAO,CAAA,+BAAA,EAAkC,kBAAA,CAAmB,aAAa,CAAC,CAAA,CAAE;AAAA,OAC5F;AAAA,MACA,OAAA,EAAS;AAAA,QACL,GAAA,EAAK,CAAC,WAAA,KACF,OAAA;AAAA,UACI,KAAA;AAAA,UAAO,CAAA,oBAAA,EAAuB,kBAAA,CAAmB,WAAW,CAAC,CAAA,eAAA;AAAA,SACjE;AAAA,QACJ,MAAA,EAAQ,CAAC,WAAA,EAAqB,MAAA,KAC1B,OAAA;AAAA,UACI,KAAA;AAAA,UAAO,CAAA,oBAAA,EAAuB,kBAAA,CAAmB,WAAW,CAAC,CAAA,eAAA,CAAA;AAAA,UAC7D,EAAE,IAAA,EAAM,EAAE,MAAA,EAAO;AAAE;AACvB,OACR;AAAA,MACA,QAAA,EAAU;AAAA,QACN,SAAA,EAAW,MAAM,OAAA,CAAQ,KAAA,EAAO,iCAAiC,CAAA;AAAA,QACjE,MAAA,EAAQ,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KACnB,uBAAuB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI,CAAA;AAAA,QAC9D,cAAA,EAAgB,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KAC3B,sBAAsB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI;AAAA;AACjE,KACJ;AAAA,IACA,OAAA,EAAS;AAAA,MACL,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MAC9E,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB;AAAA,KAClF;AAAA,IACA,MAAA,EAAQ;AAAA,MACJ,IAAA,EAAM,CAAC,cAAA,KACH,OAAA,CAAQ,OAAO,sBAAA,EAAwB,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MACpE,KAAK,CAAC,MAAA,EAAQ,IAAA,KACV,OAAA,CAAmB,QAAQ,0BAAA,EAA4B;AAAA,QACnD,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,QACf,OAAO,IAAA,CAAK;AAAA,OACf;AAAA,KACT;AAAA,IACA,IAAA,EAAM;AAAA,MACF,OAAA,EAAS,MAAM,OAAA,CAAQ,KAAA,EAAO,kBAAkB,CAAA;AAAA,MAChD,gBAAA,EAAkB,CAAC,SAAA,KACf,OAAA,CAAQ,OAAO,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,SAAS,CAAC,CAAA,UAAA,CAAY;AAAA,KACrF;AAAA,IACA,EAAA,EAAI;AAAA,MACA,MAAA;AAAA,MACA,UAAA,EAAY;AAAA,QACR,MAAA,EAAQ,CAAC,MAAA,EAAQ,IAAA,GAAO,EAAC,KACrB,OAAA,CAAQ,QAAQ,wBAAA,EAA0B;AAAA,UACtC,IAAA,EAAM,MAAA;AAAA,UACN,OAAO,IAAA,CAAK,KAAA;AAAA,UACZ,gBAAgB,IAAA,CAAK;AAAA,SACxB,CAAA;AAAA,QACL,KAAK,CAAC,WAAA,EAAa,IAAA,GAAO,OACtB,OAAA,CAAQ,KAAA,EAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,WAAW,CAAC,CAAA,CAAA,EAAI,EAAE,KAAA,EAAO,IAAA,CAAK,OAAO;AAAA,OACzG;AAAA,MACA,SAAA,EAAW,CAAC,IAAA,GAAO,EAAC,KAAM,OAAA,CAAQ,KAAA,EAAO,uBAAA,EAAyB,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO;AAAA;AAC3F,GACJ;AACJ","file":"index.cjs","sourcesContent":["/*\n @openmarketsai/connect-node\n \n Server SDK for OpenMarkets Connect. A thin, typed wrapper over the Flow API:\n * provision your users, mint hosted link sessions, verify webhook deliveries,\n * read on a user's behalf, and execute orders on their account.\n \n import { createClient } from '@openmarketsai/connect-node'\n * const om = createClient({ apiKey: process.env.OM_API_KEY! })\n \n await om.connect.users.provision({ external_user_id: 'user-123' })\n * const { token } = await om.connect.linkSessions.create({ external_user_id: 'user-123' })\n * await om.orders.buy([leg], { actAs: 'user-123' })\n * const r = await om.ai.invoke({ provider: 'anthropic', model: 'claude-opus-5', messages }, { actAs: 'user-123' })\n \n Pairs with @openmarketsai/connect-web (the in-app launcher).\n /\nimport crypto from 'node:crypto'\n\nexport const DEFAULT_BASE_URL = 'https://api.openmarkets.ai'\n\n// ──────────────────────────────────────────────────────────────────────────\n// Errors\n// ──────────────────────────────────────────────────────────────────────────\n\n/* Thrown when the API returns a non-2xx response. Mirrors the Flow error envelope. /\nexport class OpenMarketsError extends Error {\n readonly status: number\n readonly code: string\n readonly details?: Record<string, unknown>\n constructor(status: number, code: string, message: string, details?: Record<string, unknown>) {\n super(message)\n this.name = 'OpenMarketsError'\n this.status = status\n this.code = code\n this.details = details\n }\n}\n\n/* Thrown by `constructWebhookEvent` when a signature is missing, stale, or invalid. /\nexport class WebhookSignatureError extends Error {\n constructor(message: string) {\n super(message)\n this.name = 'WebhookSignatureError'\n }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Webhook verification (matches src/utils/webhook-signature.ts byte-for-byte)\n//\n// Header: X-OpenMarkets-Signature: t=<unix_seconds>,v1=<hex hmac>\n// Signed string: `${t}.${rawBody}`, HMAC-SHA256 with your whsec_ secret.\n// IMPORTANT: verify over the EXACT raw request body, not a re-serialized object.\n// ──────────────────────────────────────────────────────────────────────────\n\nexport type ConnectWebhookEventType =\n \| 'user.partners_connected'\n \| 'user.permissions_changed'\n \| 'user.history_synced'\n \| (string & {})\n\nexport interface ConnectWebhookEvent {\n type: ConnectWebhookEventType\n [key: string]: unknown\n}\n\nexport interface VerifyWebhookOptions {\n /* Max age of the signature timestamp, in seconds. Default 300 (5 min). 0 disables. /\n toleranceSec?: number\n /* Injectable clock for testing. /\n nowSec?: number\n}\n\nfunction toRaw(body: string \| Buffer): string {\n return typeof body === 'string' ? body : body.toString('utf8')\n}\n\nfunction parseSignatureHeader(header: string): { t: number; v1: string } \| null {\n const parts = header.split(',').reduce<Record<string, string>>((acc, kv) => {\n const idx = kv.indexOf('=')\n if (idx > 0) acc[kv.slice(0, idx).trim()] = kv.slice(idx + 1).trim()\n return acc\n }, {})\n const t = Number(parts.t)\n if (!parts.v1 \|\| !isFinite(t)) return null\n return { t, v1: parts.v1 }\n}\n\nfunction timingSafeEqualHex(a: string, b: string): boolean {\n const ab = Buffer.from(a, 'hex')\n const bb = Buffer.from(b, 'hex')\n if (ab.length === 0 \|\| ab.length !== bb.length) return false\n return crypto.timingSafeEqual(ab, bb)\n}\n\n/* Verify a webhook signature. Returns false on any failure (never throws). /\nexport function verifyWebhookSignature(\n secret: string,\n rawBody: string \| Buffer,\n signatureHeader: string \| null \| undefined,\n opts: VerifyWebhookOptions = {},\n): boolean {\n if (!secret \|\| !signatureHeader) return false\n const parsed = parseSignatureHeader(signatureHeader)\n if (!parsed) return false\n const toleranceSec = opts.toleranceSec ?? 300\n const nowSec = opts.nowSec ?? Math.floor(Date.now() / 1000)\n if (toleranceSec > 0 && Math.abs(nowSec - parsed.t) > toleranceSec) return false\n const expected = crypto\n .createHmac('sha256', secret)\n .update(`${parsed.t}.${toRaw(rawBody)}`)\n .digest('hex')\n return timingSafeEqualHex(expected, parsed.v1)\n}\n\n/* Verify the signature and return the parsed event, or throw `WebhookSignatureError`. /\nexport function constructWebhookEvent(\n secret: string,\n rawBody: string \| Buffer,\n signatureHeader: string \| null \| undefined,\n opts: VerifyWebhookOptions = {},\n): ConnectWebhookEvent {\n if (!verifyWebhookSignature(secret, rawBody, signatureHeader, opts)) {\n throw new WebhookSignatureError('Invalid or expired webhook signature')\n }\n try {\n return JSON.parse(toRaw(rawBody)) as ConnectWebhookEvent\n } catch {\n throw new WebhookSignatureError('Webhook body is not valid JSON')\n }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Client\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface OpenMarketsClientOptions {\n /* Your Connect org API key. Sent as `X-API-Key`. /\n apiKey: string\n /* API base URL. Defaults to https://api.openmarkets.ai. /\n baseUrl?: string\n /* Your webhook signing secret (`whsec_…`), enabling `client.webhooks.`. /\n webhookSecret?: string\n /** Custom fetch (defaults to global fetch; Node 18+). /\n fetch?: typeof fetch\n /* Per-request timeout in ms. Default 30000. /\n timeoutMs?: number\n}\n\nexport type HttpMethod = 'GET' \| 'POST' \| 'PATCH' \| 'PUT' \| 'DELETE'\n\nexport interface RequestOptions {\n query?: Record<string, string \| number \| boolean \| undefined>\n body?: unknown\n /* Act on this user's behalf — sets the `X-OpenMarkets-Account` header. /\n actAs?: string\n /* Sent as `Idempotency-Key`: a retried POST replays instead of repeating. /\n idempotencyKey?: string\n}\n\n// Inputs (snake_case to match the API — buy legs map 1:1 from liquidity entries).\nexport interface ProvisionUserParams {\n external_user_id: string\n email?: string\n name?: string\n}\nexport type LinkSessionMode = 'connect' \| 'manage'\nexport interface CreateLinkSessionParams {\n external_user_id: string\n return_url?: string\n mode?: LinkSessionMode\n allowed_partners?: string[]\n /* Pick a specific org Connect config; omit to use the org's default (if any). /\n connect_config_id?: string\n}\nexport interface BuyOrder {\n /* What to buy — set exactly one of position_hash or liquidity_hash. /\n position_hash?: string\n liquidity_hash?: string\n /* Size — set exactly one of amount or shares. /\n amount?: number // stake, notional USD\n shares?: number // contract count (each pays $1 on win)\n /* Price ceiling, 0..1 exclusive — won't fill above this. /\n max_price: number\n /* Optional — pin a venue; omit to route to the best price. /\n partner_id?: string\n /* Optional — 'real' (default) or 'paper' (practice book). /\n mode?: 'real' \| 'paper'\n}\n\n// Outputs (light — partners can pass a type param for stricter typing).\n/\n `POST /flow/v1/connect/users`. Idempotent — safe to call on every login.\n \n `om_account_id` is the field an integration actually needs (it addresses the\n * user in later calls) and was previously absent, so it typed as `unknown` via\n * the index signature.\n /\nexport interface ProvisionResult {\n /* Our id for this user. Pass as `actAs` when trading on their behalf. /\n om_account_id: string\n external_user_id: string\n /* false when the user already existed. /\n created: boolean\n [key: string]: unknown\n}\n/\n The response of `POST /flow/v1/connect/link-sessions`.\n \n These names are the API's, verified against the route rather than assumed:\n * it returns `link_token`, NOT `token`. The previous declaration named `token`,\n * `external_user_id` and `mode` — none of which the endpoint sends — so the one\n * field an integration actually needs type-checked as a string and arrived\n * `undefined`, opening the hosted flow with `token=undefined`. The index\n * signature below is what kept that quiet; keep these names in step with\n * `CreateLinkSessionResult` in LinkSessionOrchestrator.\n /\nexport interface LinkSession {\n link_session_id: string\n /* Single-use, expires in 15 minutes. Hand to `createConnect().open()`. /\n link_token: string\n /* The hosted flow URL, for redirect mode or a native in-app browser. /\n hosted_url: string\n expires_at: string\n [key: string]: unknown\n}\n/\n The status of one leg, mirroring `flowLegStatus` in the API.\n \n ALL FIVE values are reachable. This union previously listed only three, so a\n * `switch` written against the SDK's types compiled clean and silently fell\n * through for a resting or pending order — an order that IS live, sitting on a\n * venue book, treated as if it had never been placed. Any change here must\n * follow the API, not the other way round.\n /\nexport type BuyLegStatus =\n /* Filled or partially filled. /\n \| 'completed'\n /* Live on the venue's book, unfilled. Not a failure — check back. /\n \| 'resting'\n /* Accepted by the venue, fill not yet confirmed (async venues). /\n \| 'pending'\n /* The venue or a pre-trade gate rejected it. /\n \| 'failed'\n /* No viable venue was found; nothing was sent. /\n \| 'rejected'\n\n/\n What an organization's END USERS see and may do in the hosted flow. Mirrors\n * `ConnectConfigBody` server-side.\n \n A `null` field means \"no restriction / use the default\" throughout, so an\n * organization with no config behaves exactly as Connect did before configs\n * existed. Read that as permissive, not as unset.\n /\nexport interface ConnectConfig {\n version: number\n /* Partner ids or names offered in the picker. null = every venue we support. /\n venue_allowlist: string[] \| null\n /* Surface the OpenMarkets practice book as a credential-less venue. /\n offer_internal_book: boolean\n /\n Currencies users may trade. `['ATLAS']` is practice-only and is ENFORCED\n * on every order path, not merely hidden in the UI — users can still link\n * venues, read balances and sync history; only real-money orders are\n * refused.\n /\n allowed_currencies: string[]\n /* DERIVED from allowed_currencies server-side. Sending it has no effect. /\n allow_real_money: boolean\n /* Permissions the user is asked to grant. null = all of them. /\n available_scopes: ConnectScope[] \| null\n branding: { display_name?: string; logo_url?: string; primary_color?: string } \| null\n allowed_return_urls: string[] \| null\n default_link_mode: LinkSessionMode\n /\n AI providers whose keys your users may link (AI Connect). OPT-IN: empty\n * means the hosted flow offers none — unlike venue_allowlist, where null\n * means everything.\n /\n ai_providers?: AiProvider[]\n [key: string]: unknown\n}\n\n/* Permissions an end user grants per connected venue. /\nexport type ConnectScope = 'history:read' \| 'trade:execute' \| 'balance:read'\n\nexport interface ConnectConfigResult {\n /* null when the organization has never saved one — `config` is the defaults. /\n connect_config_id: string \| null\n config: ConnectConfig\n /\n Present on update: how many EXISTING users the change was applied to.\n * A funding-mode change reaches users already provisioned, not just future\n * ones, so this reports what actually happened.\n /\n reconcile?: { scanned: number; reconciled: number; failed: number } \| null\n}\n\nexport interface BuyResult {\n results: Array<{\n index: number\n status: BuyLegStatus\n /* NULL when the leg was rejected before routing — no decision was made. /\n sor_decision_id: string \| null\n filled_notional: number\n filled_shares: number\n /* The un-buyable remainder of the requested stake. /\n unfilled_notional: number\n avg_price: number \| null\n rejected_reason: string \| null\n venues: Array<{\n partner_id: string\n success: boolean\n router_order_id: string \| null\n error: string \| null\n }>\n }>\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// AI Connect — run models on a user's OWN linked key (never charged by\n// OpenMarkets) or on OpenMarkets' key (charged in reasoning credits).\n// ──────────────────────────────────────────────────────────────────────────\n\nexport type AiProvider = 'anthropic' \| 'openai'\n/* 'auto' (default): the user's own key when linked and shared, else managed. /\nexport type AiBilling = 'auto' \| 'byok' \| 'managed'\nexport type AiStopReason = 'end' \| 'max_tokens' \| 'stop_sequence' \| 'refusal' \| 'tool_use' \| 'paused' \| 'context_exceeded'\n\nexport interface AiInferenceParams {\n provider: AiProvider\n /* The provider's own model id, passed through verbatim (e.g. 'claude-opus-5'). /\n model: string\n system?: string\n messages: Array<{ role: 'user' \| 'assistant'; content: string }>\n /* 1..21000. Default 8192. /\n max_tokens?: number\n /* Only sent when set — several current models reject any explicit value. /\n temperature?: number\n /* Constrain the answer to a JSON schema; the parsed object arrives as `output`. /\n output_schema?: { name?: string; schema: Record<string, unknown>; strict?: boolean }\n billing?: AiBilling\n /* Seconds the server holds the request before answering 202 (0..25). /\n wait_seconds?: number\n /* Your own bookkeeping labels, returned on the result. /\n metadata?: Record<string, string>\n}\n\nexport interface AiInference<TOutput = unknown> {\n inference_id: string\n status: 'running' \| 'succeeded' \| 'failed'\n provider: AiProvider\n model: string\n /* The model the provider says actually served the call. /\n served_model: string \| null\n /* 'byok' calls are never charged by OpenMarkets. /\n billing: 'byok' \| 'managed'\n output_text: string \| null\n /* Parsed JSON when `output_schema` was sent and the answer parsed; else null. /\n output: TOutput \| null\n /* Check this before trusting `output` — a refusal is not an answer. /\n stop_reason: AiStopReason \| null\n usage: { input_tokens: number; output_tokens: number; credits_charged: number }\n error: { code: string; message: string } \| null\n metadata: Record<string, string> \| null\n latency_ms: number \| null\n created_at: string\n completed_at: string \| null\n}\n\nexport interface AiProviderConnection {\n provider: AiProvider\n label: string\n key_hint: string\n credential_status: 'pending' \| 'connected' \| 'failed'\n /* Whether the user shares the key with your app. /\n invoke_granted: boolean\n monthly_token_cap: number \| null\n last_used_at: string \| null\n connected_at: string\n}\n\nexport interface AiInvokeOptions {\n /* Run on this Connect user's account (their linked key). /\n actAs?: string\n /* Give up polling after this many ms (the call keeps running server-side). Default 600000. /\n timeoutMs?: number\n /* Delay between polls once the server has answered 202. Default 2000. /\n pollIntervalMs?: number\n}\n\n/* Thrown by `ai.invoke` when the inference finished in `failed`. /\nexport class AiInferenceFailedError extends Error {\n readonly inference: AiInference\n constructor(inference: AiInference) {\n super(inference.error?.message ?? 'The inference failed')\n this.name = 'AiInferenceFailedError'\n this.inference = inference\n }\n}\n\ninterface FlowEnvelope<T> {\n data?: T\n pagination?: { next_cursor?: string \| null; has_more?: boolean }\n error?: { code: string; message: string; details?: Record<string, unknown> }\n}\n\n/* One page of a list endpoint, with the cursor `request()` drops. /\nexport interface Page<T> {\n data: T[]\n /* Pass back as `query.cursor` for the next page; null on the last page. /\n next_cursor: string \| null\n has_more: boolean\n}\n\nexport interface OpenMarketsClient {\n /* Generic typed request — escape hatch for endpoints without a helper. /\n request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<T>\n /\n GET one page of a list endpoint. `request()` returns only `data`, so a list's\n * `pagination.next_cursor` was unreachable through the SDK — found by the model\n * arena, which could not page through `/contests` or `/auth/orders`.\n /\n requestPage<T = unknown>(path: string, opts?: Omit<RequestOptions, 'body'>): Promise<Page<T>>\n /* Every item of a list endpoint, following cursors (stops after `maxPages`, default 50). /\n requestAll<T = unknown>(path: string, opts?: Omit<RequestOptions, 'body'> & { maxPages?: number }): Promise<T[]>\n connect: {\n users: {\n provision(params: ProvisionUserParams): Promise<ProvisionResult>\n get<T = unknown>(externalUserId: string): Promise<T>\n getPolicy<T = unknown>(externalUserId: string): Promise<T>\n }\n linkSessions: {\n create(params: CreateLinkSessionParams): Promise<LinkSession>\n get<T = unknown>(linkSessionId: string): Promise<T>\n }\n /\n The organization's Connect config — which venues appear, whether real\n * money is allowed, and how the hosted flow is branded.\n \n Requires a PLAYER JWT with workspace admin, not an API key: this is\n * account governance rather than a data-API capability. `update` sends a\n * whole body (it is normalized server-side), so read, change, write.\n /\n configs: {\n get(workspaceId: string): Promise<ConnectConfigResult>\n update(workspaceId: string, config: Partial<ConnectConfig>): Promise<ConnectConfigResult>\n }\n webhooks: {\n getConfig<T = unknown>(): Promise<T>\n /* Verify a delivery using the configured `webhookSecret`. /\n verify(rawBody: string \| Buffer, signatureHeader: string \| null \| undefined, opts?: VerifyWebhookOptions): boolean\n /* Verify + parse, or throw. Uses the configured `webhookSecret`. /\n constructEvent(rawBody: string \| Buffer, signatureHeader: string \| null \| undefined, opts?: VerifyWebhookOptions): ConnectWebhookEvent\n }\n }\n account: {\n partners<T = unknown>(externalUserId: string): Promise<T>\n balances<T = unknown>(externalUserId: string): Promise<T>\n }\n orders: {\n list<T = unknown>(externalUserId: string): Promise<T>\n buy(orders: BuyOrder[], opts: { actAs: string }): Promise<BuyResult>\n }\n data: {\n leagues<T = unknown>(): Promise<T>\n contestLiquidity<T = unknown>(contestId: string): Promise<T>\n }\n ai: {\n /\n Run a model and wait for the result — polls through a 202 for you.\n * Throws `AiInferenceFailedError` when the call fails, `OpenMarketsError`\n * when it is refused up front (e.g. 409 ai_provider_not_linked).\n /\n invoke<TOutput = unknown>(params: AiInferenceParams, opts?: AiInvokeOptions): Promise<AiInference<TOutput>>\n inferences: {\n /* One request; may return `status: 'running'` (poll with `get`). /\n create<TOutput = unknown>(params: AiInferenceParams, opts?: { actAs?: string; idempotencyKey?: string }): Promise<AiInference<TOutput>>\n get<TOutput = unknown>(inferenceId: string, opts?: { actAs?: string }): Promise<AiInference<TOutput>>\n }\n /* Which AI providers the user has linked (never the key itself). /\n providers(opts?: { actAs?: string }): Promise<{ providers: AiProviderConnection[] }>\n }\n}\n\nexport function createClient(options: OpenMarketsClientOptions): OpenMarketsClient {\n if (!options.apiKey) throw new Error('createClient: apiKey is required')\n const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '')\n const doFetch = options.fetch ?? globalThis.fetch\n if (!doFetch) throw new Error('No fetch available — pass options.fetch (Node < 18)')\n const timeoutMs = options.timeoutMs ?? 30_000\n\n async function send<T>(method: HttpMethod, path: string, opts: RequestOptions = {}): Promise<FlowEnvelope<T>> {\n const url = new URL(baseUrl + path)\n for (const [k, v] of Object.entries(opts.query ?? {})) {\n if (v !== undefined) url.searchParams.set(k, String(v))\n }\n const headers: Record<string, string> = {\n 'X-API-Key': options.apiKey,\n Accept: 'application/json',\n }\n if (opts.body !== undefined) headers['Content-Type'] = 'application/json'\n if (opts.actAs) headers['X-OpenMarkets-Account'] = opts.actAs\n if (opts.idempotencyKey) headers['Idempotency-Key'] = opts.idempotencyKey\n\n const ctrl = new AbortController()\n const timer = setTimeout(() => ctrl.abort(), timeoutMs)\n let res: Response\n try {\n res = await doFetch(url.toString(), {\n method,\n headers,\n body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,\n signal: ctrl.signal,\n })\n } finally {\n clearTimeout(timer)\n }\n\n let envelope: FlowEnvelope<T> \| undefined\n const text = await res.text()\n if (text) {\n try {\n envelope = JSON.parse(text) as FlowEnvelope<T>\n } catch {\n / non-JSON body */\n }\n }\n\n if (!res.ok) {\n const err = envelope?.error\n throw new OpenMarketsError(\n res.status,\n err?.code ?? 'http_error',\n err?.message ?? `Request failed with status ${res.status}`,\n err?.details,\n )\n }\n return envelope ?? {}\n }\n\n async function request<T = unknown>(method: HttpMethod, path: string, opts: RequestOptions = {}): Promise<T> {\n return ((await send<T>(method, path, opts)).data ?? (undefined as unknown)) as T\n }\n\n async function requestPage<T = unknown>(path: string, opts: Omit<RequestOptions, 'body'> = {}): Promise<Page<T>> {\n const env = await send<T[]>('GET', path, opts)\n return {\n data: env.data ?? [],\n next_cursor: env.pagination?.next_cursor ?? null,\n has_more: env.pagination?.has_more ?? !!env.pagination?.next_cursor,\n }\n }\n\n async function requestAll<T = unknown>(\n path: string,\n opts: Omit<RequestOptions, 'body'> & { maxPages?: number } = {},\n ): Promise<T[]> {\n const { maxPages = 50, ...rest } = opts\n const out: T[] = []\n let cursor: string \| undefined\n for (let page = 0; page < maxPages; page++) {\n const p = await requestPage<T>(path, { ...rest, query: { ...(rest.query ?? {}), cursor } })\n out.push(...p.data)\n if (!p.next_cursor) break\n cursor = p.next_cursor\n }\n return out\n }\n\n async function invoke<TOutput>(params: AiInferenceParams, opts: AiInvokeOptions = {}): Promise<AiInference<TOutput>> {\n const deadline = Date.now() + (opts.timeoutMs ?? 600_000)\n const pollMs = opts.pollIntervalMs ?? 2_000\n // One key per logical call: if the POST is retried after a network drop,\n // the server replays it instead of running (and charging for) it twice.\n let inf = await request<AiInference<TOutput>>('POST', '/flow/v1/ai/inferences', {\n body: params,\n actAs: opts.actAs,\n idempotencyKey: crypto.randomUUID(),\n })\n while (inf.status === 'running') {\n if (Date.now() > deadline) {\n throw new OpenMarketsError(408, 'poll_timeout',\n `Inference ${inf.inference_id} is still running; poll ai.inferences.get() to collect it`)\n }\n await new Promise((r) => setTimeout(r, pollMs))\n inf = await request<AiInference<TOutput>>(\n 'GET', `/flow/v1/ai/inferences/${encodeURIComponent(inf.inference_id)}`, { actAs: opts.actAs },\n )\n }\n if (inf.status === 'failed') throw new AiInferenceFailedError(inf as AiInference)\n return inf\n }\n\n function requireSecret(): string {\n if (!options.webhookSecret) {\n throw new Error('webhookSecret was not provided to createClient()')\n }\n return options.webhookSecret\n }\n\n return {\n request,\n requestPage,\n requestAll,\n connect: {\n users: {\n provision: (params) =>\n request<ProvisionResult>('POST', '/flow/v1/connect/users', { body: params }),\n get: (externalUserId) =>\n request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}`),\n getPolicy: (externalUserId) =>\n request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}/policy`),\n },\n linkSessions: {\n create: (params) =>\n request<LinkSession>('POST', '/flow/v1/connect/link-sessions', { body: params }),\n get: (linkSessionId) =>\n request('GET', `/flow/v1/connect/link-sessions/${encodeURIComponent(linkSessionId)}`),\n },\n configs: {\n get: (workspaceId: string) =>\n request<ConnectConfigResult>(\n 'GET', `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`,\n ),\n update: (workspaceId: string, config: Partial<ConnectConfig>) =>\n request<ConnectConfigResult>(\n 'PUT', `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`,\n { body: { config } },\n ),\n },\n webhooks: {\n getConfig: () => request('GET', '/flow/v1/connect/webhook-config'),\n verify: (rawBody, sig, opts) =>\n verifyWebhookSignature(requireSecret(), rawBody, sig, opts),\n constructEvent: (rawBody, sig, opts) =>\n constructWebhookEvent(requireSecret(), rawBody, sig, opts),\n },\n },\n account: {\n partners: (externalUserId) =>\n request('GET', '/flow/v1/auth/account/partners', { actAs: externalUserId }),\n balances: (externalUserId) =>\n request('GET', '/flow/v1/auth/account/balances', { actAs: externalUserId }),\n },\n orders: {\n list: (externalUserId) =>\n request('GET', '/flow/v1/auth/orders', { actAs: externalUserId }),\n buy: (orders, opts) =>\n request<BuyResult>('POST', '/flow/v1/auth/orders/buy', {\n body: { orders },\n actAs: opts.actAs,\n }),\n },\n data: {\n leagues: () => request('GET', '/flow/v1/leagues'),\n contestLiquidity: (contestId) =>\n request('GET', `/flow/v1/contests/${encodeURIComponent(contestId)}/liquidity`),\n },\n ai: {\n invoke,\n inferences: {\n create: (params, opts = {}) =>\n request('POST', '/flow/v1/ai/inferences', {\n body: params,\n actAs: opts.actAs,\n idempotencyKey: opts.idempotencyKey,\n }),\n get: (inferenceId, opts = {}) =>\n request('GET', `/flow/v1/ai/inferences/${encodeURIComponent(inferenceId)}`, { actAs: opts.actAs }),\n },\n providers: (opts = {}) => request('GET', '/flow/v1/ai/providers', { actAs: opts.actAs }),\n },\n }\n}\n"]}

package/dist/index.d.cts CHANGED Viewed

@@ -10,7 +10,7 @@ declare class OpenMarketsError extends Error {
 declare class WebhookSignatureError extends Error {
     constructor(message: string);
 }
-type ConnectWebhookEventType = 'user.partners_connected' | 'user.permissions_changed' | (string & {});
+type ConnectWebhookEventType = 'user.partners_connected' | 'user.permissions_changed' | 'user.history_synced' | (string & {});
 interface ConnectWebhookEvent {
     type: ConnectWebhookEventType;
     [key: string]: unknown;
@@ -43,6 +43,8 @@ interface RequestOptions {
     body?: unknown;
     /** Act on this user's behalf — sets the `X-OpenMarkets-Account` header. */
     actAs?: string;
+    /** Sent as `Idempotency-Key`: a retried POST replays instead of repeating. */
+    idempotencyKey?: string;
 }
 interface ProvisionUserParams {
     external_user_id: string;
@@ -159,6 +161,12 @@ interface ConnectConfig {
     } | null;
     allowed_return_urls: string[] | null;
     default_link_mode: LinkSessionMode;
+    /**
+     * AI providers whose keys your users may link (AI Connect). OPT-IN: empty
+     * means the hosted flow offers none — unlike venue_allowlist, where null
+     * means everything.
+     */
+    ai_providers?: AiProvider[];
     [key: string]: unknown;
 }
 /** Permissions an end user grants per connected venue. */
@@ -198,9 +206,107 @@ interface BuyResult {
         }>;
     }>;
 }
+type AiProvider = 'anthropic' | 'openai';
+/** 'auto' (default): the user's own key when linked and shared, else managed. */
+type AiBilling = 'auto' | 'byok' | 'managed';
+type AiStopReason = 'end' | 'max_tokens' | 'stop_sequence' | 'refusal' | 'tool_use' | 'paused' | 'context_exceeded';
+interface AiInferenceParams {
+    provider: AiProvider;
+    /** The provider's own model id, passed through verbatim (e.g. 'claude-opus-5'). */
+    model: string;
+    system?: string;
+    messages: Array<{
+        role: 'user' | 'assistant';
+        content: string;
+    }>;
+    /** 1..21000. Default 8192. */
+    max_tokens?: number;
+    /** Only sent when set — several current models reject any explicit value. */
+    temperature?: number;
+    /** Constrain the answer to a JSON schema; the parsed object arrives as `output`. */
+    output_schema?: {
+        name?: string;
+        schema: Record<string, unknown>;
+        strict?: boolean;
+    };
+    billing?: AiBilling;
+    /** Seconds the server holds the request before answering 202 (0..25). */
+    wait_seconds?: number;
+    /** Your own bookkeeping labels, returned on the result. */
+    metadata?: Record<string, string>;
+}
+interface AiInference<TOutput = unknown> {
+    inference_id: string;
+    status: 'running' | 'succeeded' | 'failed';
+    provider: AiProvider;
+    model: string;
+    /** The model the provider says actually served the call. */
+    served_model: string | null;
+    /** 'byok' calls are never charged by OpenMarkets. */
+    billing: 'byok' | 'managed';
+    output_text: string | null;
+    /** Parsed JSON when `output_schema` was sent and the answer parsed; else null. */
+    output: TOutput | null;
+    /** Check this before trusting `output` — a refusal is not an answer. */
+    stop_reason: AiStopReason | null;
+    usage: {
+        input_tokens: number;
+        output_tokens: number;
+        credits_charged: number;
+    };
+    error: {
+        code: string;
+        message: string;
+    } | null;
+    metadata: Record<string, string> | null;
+    latency_ms: number | null;
+    created_at: string;
+    completed_at: string | null;
+}
+interface AiProviderConnection {
+    provider: AiProvider;
+    label: string;
+    key_hint: string;
+    credential_status: 'pending' | 'connected' | 'failed';
+    /** Whether the user shares the key with your app. */
+    invoke_granted: boolean;
+    monthly_token_cap: number | null;
+    last_used_at: string | null;
+    connected_at: string;
+}
+interface AiInvokeOptions {
+    /** Run on this Connect user's account (their linked key). */
+    actAs?: string;
+    /** Give up polling after this many ms (the call keeps running server-side). Default 600000. */
+    timeoutMs?: number;
+    /** Delay between polls once the server has answered 202. Default 2000. */
+    pollIntervalMs?: number;
+}
+/** Thrown by `ai.invoke` when the inference finished in `failed`. */
+declare class AiInferenceFailedError extends Error {
+    readonly inference: AiInference;
+    constructor(inference: AiInference);
+}
+/** One page of a list endpoint, with the cursor `request()` drops. */
+interface Page<T> {
+    data: T[];
+    /** Pass back as `query.cursor` for the next page; null on the last page. */
+    next_cursor: string | null;
+    has_more: boolean;
+}
 interface OpenMarketsClient {
     /** Generic typed request — escape hatch for endpoints without a helper. */
     request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<T>;
+    /**
+     * GET one page of a list endpoint. `request()` returns only `data`, so a list's
+     * `pagination.next_cursor` was unreachable through the SDK — found by the model
+     * arena, which could not page through `/contests` or `/auth/orders`.
+     */
+    requestPage<T = unknown>(path: string, opts?: Omit<RequestOptions, 'body'>): Promise<Page<T>>;
+    /** Every item of a list endpoint, following cursors (stops after `maxPages`, default 50). */
+    requestAll<T = unknown>(path: string, opts?: Omit<RequestOptions, 'body'> & {
+        maxPages?: number;
+    }): Promise<T[]>;
     connect: {
         users: {
             provision(params: ProvisionUserParams): Promise<ProvisionResult>;
@@ -245,7 +351,31 @@ interface OpenMarketsClient {
         leagues<T = unknown>(): Promise<T>;
         contestLiquidity<T = unknown>(contestId: string): Promise<T>;
     };
+    ai: {
+        /**
+         * Run a model and wait for the result — polls through a 202 for you.
+         * Throws `AiInferenceFailedError` when the call fails, `OpenMarketsError`
+         * when it is refused up front (e.g. 409 ai_provider_not_linked).
+         */
+        invoke<TOutput = unknown>(params: AiInferenceParams, opts?: AiInvokeOptions): Promise<AiInference<TOutput>>;
+        inferences: {
+            /** One request; may return `status: 'running'` (poll with `get`). */
+            create<TOutput = unknown>(params: AiInferenceParams, opts?: {
+                actAs?: string;
+                idempotencyKey?: string;
+            }): Promise<AiInference<TOutput>>;
+            get<TOutput = unknown>(inferenceId: string, opts?: {
+                actAs?: string;
+            }): Promise<AiInference<TOutput>>;
+        };
+        /** Which AI providers the user has linked (never the key itself). */
+        providers(opts?: {
+            actAs?: string;
+        }): Promise<{
+            providers: AiProviderConnection[];
+        }>;
+    };
 }
 declare function createClient(options: OpenMarketsClientOptions): OpenMarketsClient;
-export { type BuyLegStatus, type BuyOrder, type BuyResult, type ConnectConfig, type ConnectConfigResult, type ConnectScope, type ConnectWebhookEvent, type ConnectWebhookEventType, type CreateLinkSessionParams, DEFAULT_BASE_URL, type HttpMethod, type LinkSession, type LinkSessionMode, type OpenMarketsClient, type OpenMarketsClientOptions, OpenMarketsError, type ProvisionResult, type ProvisionUserParams, type RequestOptions, type VerifyWebhookOptions, WebhookSignatureError, constructWebhookEvent, createClient, verifyWebhookSignature };
+export { type AiBilling, type AiInference, AiInferenceFailedError, type AiInferenceParams, type AiInvokeOptions, type AiProvider, type AiProviderConnection, type AiStopReason, type BuyLegStatus, type BuyOrder, type BuyResult, type ConnectConfig, type ConnectConfigResult, type ConnectScope, type ConnectWebhookEvent, type ConnectWebhookEventType, type CreateLinkSessionParams, DEFAULT_BASE_URL, type HttpMethod, type LinkSession, type LinkSessionMode, type OpenMarketsClient, type OpenMarketsClientOptions, OpenMarketsError, type Page, type ProvisionResult, type ProvisionUserParams, type RequestOptions, type VerifyWebhookOptions, WebhookSignatureError, constructWebhookEvent, createClient, verifyWebhookSignature };

package/dist/index.d.ts CHANGED Viewed

@@ -10,7 +10,7 @@ declare class OpenMarketsError extends Error {
 declare class WebhookSignatureError extends Error {
     constructor(message: string);
 }
-type ConnectWebhookEventType = 'user.partners_connected' | 'user.permissions_changed' | (string & {});
+type ConnectWebhookEventType = 'user.partners_connected' | 'user.permissions_changed' | 'user.history_synced' | (string & {});
 interface ConnectWebhookEvent {
     type: ConnectWebhookEventType;
     [key: string]: unknown;
@@ -43,6 +43,8 @@ interface RequestOptions {
     body?: unknown;
     /** Act on this user's behalf — sets the `X-OpenMarkets-Account` header. */
     actAs?: string;
+    /** Sent as `Idempotency-Key`: a retried POST replays instead of repeating. */
+    idempotencyKey?: string;
 }
 interface ProvisionUserParams {
     external_user_id: string;
@@ -159,6 +161,12 @@ interface ConnectConfig {
     } | null;
     allowed_return_urls: string[] | null;
     default_link_mode: LinkSessionMode;
+    /**
+     * AI providers whose keys your users may link (AI Connect). OPT-IN: empty
+     * means the hosted flow offers none — unlike venue_allowlist, where null
+     * means everything.
+     */
+    ai_providers?: AiProvider[];
     [key: string]: unknown;
 }
 /** Permissions an end user grants per connected venue. */
@@ -198,9 +206,107 @@ interface BuyResult {
         }>;
     }>;
 }
+type AiProvider = 'anthropic' | 'openai';
+/** 'auto' (default): the user's own key when linked and shared, else managed. */
+type AiBilling = 'auto' | 'byok' | 'managed';
+type AiStopReason = 'end' | 'max_tokens' | 'stop_sequence' | 'refusal' | 'tool_use' | 'paused' | 'context_exceeded';
+interface AiInferenceParams {
+    provider: AiProvider;
+    /** The provider's own model id, passed through verbatim (e.g. 'claude-opus-5'). */
+    model: string;
+    system?: string;
+    messages: Array<{
+        role: 'user' | 'assistant';
+        content: string;
+    }>;
+    /** 1..21000. Default 8192. */
+    max_tokens?: number;
+    /** Only sent when set — several current models reject any explicit value. */
+    temperature?: number;
+    /** Constrain the answer to a JSON schema; the parsed object arrives as `output`. */
+    output_schema?: {
+        name?: string;
+        schema: Record<string, unknown>;
+        strict?: boolean;
+    };
+    billing?: AiBilling;
+    /** Seconds the server holds the request before answering 202 (0..25). */
+    wait_seconds?: number;
+    /** Your own bookkeeping labels, returned on the result. */
+    metadata?: Record<string, string>;
+}
+interface AiInference<TOutput = unknown> {
+    inference_id: string;
+    status: 'running' | 'succeeded' | 'failed';
+    provider: AiProvider;
+    model: string;
+    /** The model the provider says actually served the call. */
+    served_model: string | null;
+    /** 'byok' calls are never charged by OpenMarkets. */
+    billing: 'byok' | 'managed';
+    output_text: string | null;
+    /** Parsed JSON when `output_schema` was sent and the answer parsed; else null. */
+    output: TOutput | null;
+    /** Check this before trusting `output` — a refusal is not an answer. */
+    stop_reason: AiStopReason | null;
+    usage: {
+        input_tokens: number;
+        output_tokens: number;
+        credits_charged: number;
+    };
+    error: {
+        code: string;
+        message: string;
+    } | null;
+    metadata: Record<string, string> | null;
+    latency_ms: number | null;
+    created_at: string;
+    completed_at: string | null;
+}
+interface AiProviderConnection {
+    provider: AiProvider;
+    label: string;
+    key_hint: string;
+    credential_status: 'pending' | 'connected' | 'failed';
+    /** Whether the user shares the key with your app. */
+    invoke_granted: boolean;
+    monthly_token_cap: number | null;
+    last_used_at: string | null;
+    connected_at: string;
+}
+interface AiInvokeOptions {
+    /** Run on this Connect user's account (their linked key). */
+    actAs?: string;
+    /** Give up polling after this many ms (the call keeps running server-side). Default 600000. */
+    timeoutMs?: number;
+    /** Delay between polls once the server has answered 202. Default 2000. */
+    pollIntervalMs?: number;
+}
+/** Thrown by `ai.invoke` when the inference finished in `failed`. */
+declare class AiInferenceFailedError extends Error {
+    readonly inference: AiInference;
+    constructor(inference: AiInference);
+}
+/** One page of a list endpoint, with the cursor `request()` drops. */
+interface Page<T> {
+    data: T[];
+    /** Pass back as `query.cursor` for the next page; null on the last page. */
+    next_cursor: string | null;
+    has_more: boolean;
+}
 interface OpenMarketsClient {
     /** Generic typed request — escape hatch for endpoints without a helper. */
     request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<T>;
+    /**
+     * GET one page of a list endpoint. `request()` returns only `data`, so a list's
+     * `pagination.next_cursor` was unreachable through the SDK — found by the model
+     * arena, which could not page through `/contests` or `/auth/orders`.
+     */
+    requestPage<T = unknown>(path: string, opts?: Omit<RequestOptions, 'body'>): Promise<Page<T>>;
+    /** Every item of a list endpoint, following cursors (stops after `maxPages`, default 50). */
+    requestAll<T = unknown>(path: string, opts?: Omit<RequestOptions, 'body'> & {
+        maxPages?: number;
+    }): Promise<T[]>;
     connect: {
         users: {
             provision(params: ProvisionUserParams): Promise<ProvisionResult>;
@@ -245,7 +351,31 @@ interface OpenMarketsClient {
         leagues<T = unknown>(): Promise<T>;
         contestLiquidity<T = unknown>(contestId: string): Promise<T>;
     };
+    ai: {
+        /**
+         * Run a model and wait for the result — polls through a 202 for you.
+         * Throws `AiInferenceFailedError` when the call fails, `OpenMarketsError`
+         * when it is refused up front (e.g. 409 ai_provider_not_linked).
+         */
+        invoke<TOutput = unknown>(params: AiInferenceParams, opts?: AiInvokeOptions): Promise<AiInference<TOutput>>;
+        inferences: {
+            /** One request; may return `status: 'running'` (poll with `get`). */
+            create<TOutput = unknown>(params: AiInferenceParams, opts?: {
+                actAs?: string;
+                idempotencyKey?: string;
+            }): Promise<AiInference<TOutput>>;
+            get<TOutput = unknown>(inferenceId: string, opts?: {
+                actAs?: string;
+            }): Promise<AiInference<TOutput>>;
+        };
+        /** Which AI providers the user has linked (never the key itself). */
+        providers(opts?: {
+            actAs?: string;
+        }): Promise<{
+            providers: AiProviderConnection[];
+        }>;
+    };
 }
 declare function createClient(options: OpenMarketsClientOptions): OpenMarketsClient;
-export { type BuyLegStatus, type BuyOrder, type BuyResult, type ConnectConfig, type ConnectConfigResult, type ConnectScope, type ConnectWebhookEvent, type ConnectWebhookEventType, type CreateLinkSessionParams, DEFAULT_BASE_URL, type HttpMethod, type LinkSession, type LinkSessionMode, type OpenMarketsClient, type OpenMarketsClientOptions, OpenMarketsError, type ProvisionResult, type ProvisionUserParams, type RequestOptions, type VerifyWebhookOptions, WebhookSignatureError, constructWebhookEvent, createClient, verifyWebhookSignature };
+export { type AiBilling, type AiInference, AiInferenceFailedError, type AiInferenceParams, type AiInvokeOptions, type AiProvider, type AiProviderConnection, type AiStopReason, type BuyLegStatus, type BuyOrder, type BuyResult, type ConnectConfig, type ConnectConfigResult, type ConnectScope, type ConnectWebhookEvent, type ConnectWebhookEventType, type CreateLinkSessionParams, DEFAULT_BASE_URL, type HttpMethod, type LinkSession, type LinkSessionMode, type OpenMarketsClient, type OpenMarketsClientOptions, OpenMarketsError, type Page, type ProvisionResult, type ProvisionUserParams, type RequestOptions, type VerifyWebhookOptions, WebhookSignatureError, constructWebhookEvent, createClient, verifyWebhookSignature };

package/dist/index.js CHANGED Viewed

@@ -56,13 +56,20 @@ function constructWebhookEvent(secret, rawBody, signatureHeader, opts = {}) {
     throw new WebhookSignatureError("Webhook body is not valid JSON");
   }
 }
+var AiInferenceFailedError = class extends Error {
+  constructor(inference) {
+    super(inference.error?.message ?? "The inference failed");
+    this.name = "AiInferenceFailedError";
+    this.inference = inference;
+  }
+};
 function createClient(options) {
   if (!options.apiKey) throw new Error("createClient: apiKey is required");
   const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
   const doFetch = options.fetch ?? globalThis.fetch;
   if (!doFetch) throw new Error("No fetch available \u2014 pass options.fetch (Node < 18)");
   const timeoutMs = options.timeoutMs ?? 3e4;
-  async function request(method, path, opts = {}) {
+  async function send(method, path, opts = {}) {
     const url = new URL(baseUrl + path);
     for (const [k, v] of Object.entries(opts.query ?? {})) {
       if (v !== void 0) url.searchParams.set(k, String(v));
@@ -73,6 +80,7 @@ function createClient(options) {
     };
     if (opts.body !== void 0) headers["Content-Type"] = "application/json";
     if (opts.actAs) headers["X-OpenMarkets-Account"] = opts.actAs;
+    if (opts.idempotencyKey) headers["Idempotency-Key"] = opts.idempotencyKey;
     const ctrl = new AbortController();
     const timer = setTimeout(() => ctrl.abort(), timeoutMs);
     let res;
@@ -103,7 +111,56 @@ function createClient(options) {
         err?.details
       );
     }
-    return envelope?.data ?? void 0;
+    return envelope ?? {};
+  }
+  async function request(method, path, opts = {}) {
+    return (await send(method, path, opts)).data ?? void 0;
+  }
+  async function requestPage(path, opts = {}) {
+    const env = await send("GET", path, opts);
+    return {
+      data: env.data ?? [],
+      next_cursor: env.pagination?.next_cursor ?? null,
+      has_more: env.pagination?.has_more ?? !!env.pagination?.next_cursor
+    };
+  }
+  async function requestAll(path, opts = {}) {
+    const { maxPages = 50, ...rest } = opts;
+    const out = [];
+    let cursor;
+    for (let page = 0; page < maxPages; page++) {
+      const p = await requestPage(path, { ...rest, query: { ...rest.query ?? {}, cursor } });
+      out.push(...p.data);
+      if (!p.next_cursor) break;
+      cursor = p.next_cursor;
+    }
+    return out;
+  }
+  async function invoke(params, opts = {}) {
+    const deadline = Date.now() + (opts.timeoutMs ?? 6e5);
+    const pollMs = opts.pollIntervalMs ?? 2e3;
+    let inf = await request("POST", "/flow/v1/ai/inferences", {
+      body: params,
+      actAs: opts.actAs,
+      idempotencyKey: crypto.randomUUID()
+    });
+    while (inf.status === "running") {
+      if (Date.now() > deadline) {
+        throw new OpenMarketsError(
+          408,
+          "poll_timeout",
+          `Inference ${inf.inference_id} is still running; poll ai.inferences.get() to collect it`
+        );
+      }
+      await new Promise((r) => setTimeout(r, pollMs));
+      inf = await request(
+        "GET",
+        `/flow/v1/ai/inferences/${encodeURIComponent(inf.inference_id)}`,
+        { actAs: opts.actAs }
+      );
+    }
+    if (inf.status === "failed") throw new AiInferenceFailedError(inf);
+    return inf;
   }
   function requireSecret() {
     if (!options.webhookSecret) {
@@ -113,6 +170,8 @@ function createClient(options) {
   }
   return {
     request,
+    requestPage,
+    requestAll,
     connect: {
       users: {
         provision: (params) => request("POST", "/flow/v1/connect/users", { body: params }),
@@ -154,10 +213,22 @@ function createClient(options) {
     data: {
       leagues: () => request("GET", "/flow/v1/leagues"),
       contestLiquidity: (contestId) => request("GET", `/flow/v1/contests/${encodeURIComponent(contestId)}/liquidity`)
+    },
+    ai: {
+      invoke,
+      inferences: {
+        create: (params, opts = {}) => request("POST", "/flow/v1/ai/inferences", {
+          body: params,
+          actAs: opts.actAs,
+          idempotencyKey: opts.idempotencyKey
+        }),
+        get: (inferenceId, opts = {}) => request("GET", `/flow/v1/ai/inferences/${encodeURIComponent(inferenceId)}`, { actAs: opts.actAs })
+      },
+      providers: (opts = {}) => request("GET", "/flow/v1/ai/providers", { actAs: opts.actAs })
     }
   };
 }
-export { DEFAULT_BASE_URL, OpenMarketsError, WebhookSignatureError, constructWebhookEvent, createClient, verifyWebhookSignature };
+export { AiInferenceFailedError, DEFAULT_BASE_URL, OpenMarketsError, WebhookSignatureError, constructWebhookEvent, createClient, verifyWebhookSignature };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAkBO,IAAM,gBAAA,GAAmB;AAOzB,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAIxC,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAmC;AAC1F,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACnB;AACJ;AAGO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC7C,YAAY,OAAA,EAAiB;AACzB,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EAChB;AACJ;AA2BA,SAAS,MAAM,IAAA,EAA+B;AAC1C,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,IAAA,CAAK,SAAS,MAAM,CAAA;AACjE;AAEA,SAAS,qBAAqB,MAAA,EAAkD;AAC5E,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,CAAM,GAAG,EAAE,MAAA,CAA+B,CAAC,KAAK,EAAA,KAAO;AACxE,IAAA,MAAM,GAAA,GAAM,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,MAAM,CAAA,EAAG,GAAA,CAAI,EAAA,CAAG,KAAA,CAAM,GAAG,GAAG,CAAA,CAAE,IAAA,EAAM,IAAI,EAAA,CAAG,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxB,EAAA,IAAI,CAAC,KAAA,CAAM,EAAA,IAAM,CAAC,QAAA,CAAS,CAAC,GAAG,OAAO,IAAA;AACtC,EAAA,OAAO,EAAE,CAAA,EAAG,EAAA,EAAI,KAAA,CAAM,EAAA,EAAG;AAC7B;AAEA,SAAS,kBAAA,CAAmB,GAAW,CAAA,EAAoB;AACvD,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,IAAI,GAAG,MAAA,KAAW,CAAA,IAAK,GAAG,MAAA,KAAW,EAAA,CAAG,QAAQ,OAAO,KAAA;AACvD,EAAA,OAAO,MAAA,CAAO,eAAA,CAAgB,EAAA,EAAI,EAAE,CAAA;AACxC;AAGO,SAAS,uBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACvB;AACP,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,eAAA,EAAiB,OAAO,KAAA;AACxC,EAAA,MAAM,MAAA,GAAS,qBAAqB,eAAe,CAAA;AACnD,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,GAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC1D,EAAA,IAAI,YAAA,GAAe,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,MAAA,CAAO,CAAC,CAAA,GAAI,YAAA,EAAc,OAAO,KAAA;AAC3E,EAAA,MAAM,WAAW,MAAA,CACZ,UAAA,CAAW,QAAA,EAAU,MAAM,EAC3B,MAAA,CAAO,CAAA,EAAG,MAAA,CAAO,CAAC,IAAI,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,CAAA,CACtC,OAAO,KAAK,CAAA;AACjB,EAAA,OAAO,kBAAA,CAAmB,QAAA,EAAU,MAAA,CAAO,EAAE,CAAA;AACjD;AAGO,SAAS,sBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACX;AACnB,EAAA,IAAI,CAAC,sBAAA,CAAuB,MAAA,EAAQ,OAAA,EAAS,eAAA,EAAiB,IAAI,CAAA,EAAG;AACjE,IAAA,MAAM,IAAI,sBAAsB,sCAAsC,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI;AACA,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AACJ,IAAA,MAAM,IAAI,sBAAsB,gCAAgC,CAAA;AAAA,EACpE;AACJ;AA0OO,SAAS,aAAa,OAAA,EAAsD;AAC/E,EAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,MAAM,kCAAkC,CAAA;AACvE,EAAA,MAAM,WAAW,OAAA,CAAQ,OAAA,IAAW,gBAAA,EAAkB,OAAA,CAAQ,OAAO,EAAE,CAAA;AACvE,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,0DAAqD,CAAA;AACnF,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,GAAA;AAEvC,EAAA,eAAe,OAAA,CACX,MAAA,EACA,IAAA,EACA,IAAA,GAAuB,EAAC,EACd;AACV,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,GAAU,IAAI,CAAA;AAClC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA,EAAG;AACnD,MAAA,IAAI,CAAA,KAAM,QAAW,GAAA,CAAI,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,aAAa,OAAA,CAAQ,MAAA;AAAA,MACrB,MAAA,EAAQ;AAAA,KACZ;AACA,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AACvD,IAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAA,CAAQ,uBAAuB,IAAI,IAAA,CAAK,KAAA;AAExD,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,IAAA,CAAK,KAAA,IAAS,SAAS,CAAA;AACtD,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACA,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,IAAA,CAAK;AAAA,OAChB,CAAA;AAAA,IACL,CAAA,SAAE;AACE,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACtB;AAEA,IAAA,IAAI,QAAA;AACJ,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,IAAA,EAAM;AACN,MAAA,IAAI;AACA,QAAA,QAAA,GAAW,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,MAC9B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,MAAM,QAAA,EAAU,KAAA;AACtB,MAAA,MAAM,IAAI,gBAAA;AAAA,QACN,GAAA,CAAI,MAAA;AAAA,QACJ,KAAK,IAAA,IAAQ,YAAA;AAAA,QACb,GAAA,EAAK,OAAA,IAAW,CAAA,2BAAA,EAA8B,GAAA,CAAI,MAAM,CAAA,CAAA;AAAA,QACxD,GAAA,EAAK;AAAA,OACT;AAAA,IACJ;AACA,IAAA,OAAQ,UAAU,IAAA,IAAS,MAAA;AAAA,EAC/B;AAEA,EAAA,SAAS,aAAA,GAAwB;AAC7B,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AACxB,MAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,OAAA,CAAQ,aAAA;AAAA,EACnB;AAEA,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,KAAA,EAAO;AAAA,QACH,SAAA,EAAW,CAAC,MAAA,KACR,OAAA,CAAyB,QAAQ,wBAAA,EAA0B,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QAC/E,GAAA,EAAK,CAAC,cAAA,KACF,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,CAAE,CAAA;AAAA,QACjF,SAAA,EAAW,CAAC,cAAA,KACR,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,OAAA,CAAS;AAAA,OAC5F;AAAA,MACA,YAAA,EAAc;AAAA,QACV,MAAA,EAAQ,CAAC,MAAA,KACL,OAAA,CAAqB,QAAQ,gCAAA,EAAkC,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QACnF,GAAA,EAAK,CAAC,aAAA,KACF,OAAA,CAAQ,OAAO,CAAA,+BAAA,EAAkC,kBAAA,CAAmB,aAAa,CAAC,CAAA,CAAE;AAAA,OAC5F;AAAA,MACA,OAAA,EAAS;AAAA,QACL,GAAA,EAAK,CAAC,WAAA,KACF,OAAA;AAAA,UACI,KAAA;AAAA,UAAO,CAAA,oBAAA,EAAuB,kBAAA,CAAmB,WAAW,CAAC,CAAA,eAAA;AAAA,SACjE;AAAA,QACJ,MAAA,EAAQ,CAAC,WAAA,EAAqB,MAAA,KAC1B,OAAA;AAAA,UACI,KAAA;AAAA,UAAO,CAAA,oBAAA,EAAuB,kBAAA,CAAmB,WAAW,CAAC,CAAA,eAAA,CAAA;AAAA,UAC7D,EAAE,IAAA,EAAM,EAAE,MAAA,EAAO;AAAE;AACvB,OACR;AAAA,MACA,QAAA,EAAU;AAAA,QACN,SAAA,EAAW,MAAM,OAAA,CAAQ,KAAA,EAAO,iCAAiC,CAAA;AAAA,QACjE,MAAA,EAAQ,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KACnB,uBAAuB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI,CAAA;AAAA,QAC9D,cAAA,EAAgB,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KAC3B,sBAAsB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI;AAAA;AACjE,KACJ;AAAA,IACA,OAAA,EAAS;AAAA,MACL,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MAC9E,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB;AAAA,KAClF;AAAA,IACA,MAAA,EAAQ;AAAA,MACJ,IAAA,EAAM,CAAC,cAAA,KACH,OAAA,CAAQ,OAAO,sBAAA,EAAwB,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MACpE,KAAK,CAAC,MAAA,EAAQ,IAAA,KACV,OAAA,CAAmB,QAAQ,0BAAA,EAA4B;AAAA,QACnD,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,QACf,OAAO,IAAA,CAAK;AAAA,OACf;AAAA,KACT;AAAA,IACA,IAAA,EAAM;AAAA,MACF,OAAA,EAAS,MAAM,OAAA,CAAQ,KAAA,EAAO,kBAAkB,CAAA;AAAA,MAChD,gBAAA,EAAkB,CAAC,SAAA,KACf,OAAA,CAAQ,OAAO,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,SAAS,CAAC,CAAA,UAAA,CAAY;AAAA;AACrF,GACJ;AACJ","file":"index.js","sourcesContent":["/*\n @openmarketsai/connect-node\n \n Server SDK for OpenMarkets Connect. A thin, typed wrapper over the Flow API:\n * provision your users, mint hosted link sessions, verify webhook deliveries,\n * read on a user's behalf, and execute orders on their account.\n \n import { createClient } from '@openmarketsai/connect-node'\n * const om = createClient({ apiKey: process.env.OM_API_KEY! })\n \n await om.connect.users.provision({ external_user_id: 'user-123' })\n * const { token } = await om.connect.linkSessions.create({ external_user_id: 'user-123' })\n * await om.orders.buy([leg], { actAs: 'user-123' })\n \n Pairs with @openmarketsai/connect-web (the in-app launcher).\n /\nimport crypto from 'node:crypto'\n\nexport const DEFAULT_BASE_URL = 'https://api.openmarkets.ai'\n\n// ──────────────────────────────────────────────────────────────────────────\n// Errors\n// ──────────────────────────────────────────────────────────────────────────\n\n/* Thrown when the API returns a non-2xx response. Mirrors the Flow error envelope. /\nexport class OpenMarketsError extends Error {\n readonly status: number\n readonly code: string\n readonly details?: Record<string, unknown>\n constructor(status: number, code: string, message: string, details?: Record<string, unknown>) {\n super(message)\n this.name = 'OpenMarketsError'\n this.status = status\n this.code = code\n this.details = details\n }\n}\n\n/* Thrown by `constructWebhookEvent` when a signature is missing, stale, or invalid. /\nexport class WebhookSignatureError extends Error {\n constructor(message: string) {\n super(message)\n this.name = 'WebhookSignatureError'\n }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Webhook verification (matches src/utils/webhook-signature.ts byte-for-byte)\n//\n// Header: X-OpenMarkets-Signature: t=<unix_seconds>,v1=<hex hmac>\n// Signed string: `${t}.${rawBody}`, HMAC-SHA256 with your whsec_ secret.\n// IMPORTANT: verify over the EXACT raw request body, not a re-serialized object.\n// ──────────────────────────────────────────────────────────────────────────\n\nexport type ConnectWebhookEventType =\n \| 'user.partners_connected'\n \| 'user.permissions_changed'\n \| (string & {})\n\nexport interface ConnectWebhookEvent {\n type: ConnectWebhookEventType\n [key: string]: unknown\n}\n\nexport interface VerifyWebhookOptions {\n /* Max age of the signature timestamp, in seconds. Default 300 (5 min). 0 disables. /\n toleranceSec?: number\n /* Injectable clock for testing. /\n nowSec?: number\n}\n\nfunction toRaw(body: string \| Buffer): string {\n return typeof body === 'string' ? body : body.toString('utf8')\n}\n\nfunction parseSignatureHeader(header: string): { t: number; v1: string } \| null {\n const parts = header.split(',').reduce<Record<string, string>>((acc, kv) => {\n const idx = kv.indexOf('=')\n if (idx > 0) acc[kv.slice(0, idx).trim()] = kv.slice(idx + 1).trim()\n return acc\n }, {})\n const t = Number(parts.t)\n if (!parts.v1 \|\| !isFinite(t)) return null\n return { t, v1: parts.v1 }\n}\n\nfunction timingSafeEqualHex(a: string, b: string): boolean {\n const ab = Buffer.from(a, 'hex')\n const bb = Buffer.from(b, 'hex')\n if (ab.length === 0 \|\| ab.length !== bb.length) return false\n return crypto.timingSafeEqual(ab, bb)\n}\n\n/* Verify a webhook signature. Returns false on any failure (never throws). /\nexport function verifyWebhookSignature(\n secret: string,\n rawBody: string \| Buffer,\n signatureHeader: string \| null \| undefined,\n opts: VerifyWebhookOptions = {},\n): boolean {\n if (!secret \|\| !signatureHeader) return false\n const parsed = parseSignatureHeader(signatureHeader)\n if (!parsed) return false\n const toleranceSec = opts.toleranceSec ?? 300\n const nowSec = opts.nowSec ?? Math.floor(Date.now() / 1000)\n if (toleranceSec > 0 && Math.abs(nowSec - parsed.t) > toleranceSec) return false\n const expected = crypto\n .createHmac('sha256', secret)\n .update(`${parsed.t}.${toRaw(rawBody)}`)\n .digest('hex')\n return timingSafeEqualHex(expected, parsed.v1)\n}\n\n/* Verify the signature and return the parsed event, or throw `WebhookSignatureError`. /\nexport function constructWebhookEvent(\n secret: string,\n rawBody: string \| Buffer,\n signatureHeader: string \| null \| undefined,\n opts: VerifyWebhookOptions = {},\n): ConnectWebhookEvent {\n if (!verifyWebhookSignature(secret, rawBody, signatureHeader, opts)) {\n throw new WebhookSignatureError('Invalid or expired webhook signature')\n }\n try {\n return JSON.parse(toRaw(rawBody)) as ConnectWebhookEvent\n } catch {\n throw new WebhookSignatureError('Webhook body is not valid JSON')\n }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Client\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface OpenMarketsClientOptions {\n /* Your Connect org API key. Sent as `X-API-Key`. /\n apiKey: string\n /* API base URL. Defaults to https://api.openmarkets.ai. /\n baseUrl?: string\n /* Your webhook signing secret (`whsec_…`), enabling `client.webhooks.`. /\n webhookSecret?: string\n /** Custom fetch (defaults to global fetch; Node 18+). /\n fetch?: typeof fetch\n /* Per-request timeout in ms. Default 30000. /\n timeoutMs?: number\n}\n\nexport type HttpMethod = 'GET' \| 'POST' \| 'PATCH' \| 'PUT' \| 'DELETE'\n\nexport interface RequestOptions {\n query?: Record<string, string \| number \| boolean \| undefined>\n body?: unknown\n /* Act on this user's behalf — sets the `X-OpenMarkets-Account` header. /\n actAs?: string\n}\n\n// Inputs (snake_case to match the API — buy legs map 1:1 from liquidity entries).\nexport interface ProvisionUserParams {\n external_user_id: string\n email?: string\n name?: string\n}\nexport type LinkSessionMode = 'connect' \| 'manage'\nexport interface CreateLinkSessionParams {\n external_user_id: string\n return_url?: string\n mode?: LinkSessionMode\n allowed_partners?: string[]\n /* Pick a specific org Connect config; omit to use the org's default (if any). /\n connect_config_id?: string\n}\nexport interface BuyOrder {\n /* What to buy — set exactly one of position_hash or liquidity_hash. /\n position_hash?: string\n liquidity_hash?: string\n /* Size — set exactly one of amount or shares. /\n amount?: number // stake, notional USD\n shares?: number // contract count (each pays $1 on win)\n /* Price ceiling, 0..1 exclusive — won't fill above this. /\n max_price: number\n /* Optional — pin a venue; omit to route to the best price. /\n partner_id?: string\n /* Optional — 'real' (default) or 'paper' (practice book). /\n mode?: 'real' \| 'paper'\n}\n\n// Outputs (light — partners can pass a type param for stricter typing).\n/\n `POST /flow/v1/connect/users`. Idempotent — safe to call on every login.\n \n `om_account_id` is the field an integration actually needs (it addresses the\n * user in later calls) and was previously absent, so it typed as `unknown` via\n * the index signature.\n /\nexport interface ProvisionResult {\n /* Our id for this user. Pass as `actAs` when trading on their behalf. /\n om_account_id: string\n external_user_id: string\n /* false when the user already existed. /\n created: boolean\n [key: string]: unknown\n}\n/\n The response of `POST /flow/v1/connect/link-sessions`.\n \n These names are the API's, verified against the route rather than assumed:\n * it returns `link_token`, NOT `token`. The previous declaration named `token`,\n * `external_user_id` and `mode` — none of which the endpoint sends — so the one\n * field an integration actually needs type-checked as a string and arrived\n * `undefined`, opening the hosted flow with `token=undefined`. The index\n * signature below is what kept that quiet; keep these names in step with\n * `CreateLinkSessionResult` in LinkSessionOrchestrator.\n /\nexport interface LinkSession {\n link_session_id: string\n /* Single-use, expires in 15 minutes. Hand to `createConnect().open()`. /\n link_token: string\n /* The hosted flow URL, for redirect mode or a native in-app browser. /\n hosted_url: string\n expires_at: string\n [key: string]: unknown\n}\n/\n The status of one leg, mirroring `flowLegStatus` in the API.\n \n ALL FIVE values are reachable. This union previously listed only three, so a\n * `switch` written against the SDK's types compiled clean and silently fell\n * through for a resting or pending order — an order that IS live, sitting on a\n * venue book, treated as if it had never been placed. Any change here must\n * follow the API, not the other way round.\n /\nexport type BuyLegStatus =\n /* Filled or partially filled. /\n \| 'completed'\n /* Live on the venue's book, unfilled. Not a failure — check back. /\n \| 'resting'\n /* Accepted by the venue, fill not yet confirmed (async venues). /\n \| 'pending'\n /* The venue or a pre-trade gate rejected it. /\n \| 'failed'\n /* No viable venue was found; nothing was sent. /\n \| 'rejected'\n\n/\n What an organization's END USERS see and may do in the hosted flow. Mirrors\n * `ConnectConfigBody` server-side.\n \n A `null` field means \"no restriction / use the default\" throughout, so an\n * organization with no config behaves exactly as Connect did before configs\n * existed. Read that as permissive, not as unset.\n /\nexport interface ConnectConfig {\n version: number\n /* Partner ids or names offered in the picker. null = every venue we support. /\n venue_allowlist: string[] \| null\n /* Surface the OpenMarkets practice book as a credential-less venue. /\n offer_internal_book: boolean\n /\n Currencies users may trade. `['ATLAS']` is practice-only and is ENFORCED\n * on every order path, not merely hidden in the UI — users can still link\n * venues, read balances and sync history; only real-money orders are\n * refused.\n /\n allowed_currencies: string[]\n /* DERIVED from allowed_currencies server-side. Sending it has no effect. /\n allow_real_money: boolean\n /* Permissions the user is asked to grant. null = all of them. /\n available_scopes: ConnectScope[] \| null\n branding: { display_name?: string; logo_url?: string; primary_color?: string } \| null\n allowed_return_urls: string[] \| null\n default_link_mode: LinkSessionMode\n [key: string]: unknown\n}\n\n/* Permissions an end user grants per connected venue. /\nexport type ConnectScope = 'history:read' \| 'trade:execute' \| 'balance:read'\n\nexport interface ConnectConfigResult {\n /* null when the organization has never saved one — `config` is the defaults. /\n connect_config_id: string \| null\n config: ConnectConfig\n /\n Present on update: how many EXISTING users the change was applied to.\n * A funding-mode change reaches users already provisioned, not just future\n * ones, so this reports what actually happened.\n /\n reconcile?: { scanned: number; reconciled: number; failed: number } \| null\n}\n\nexport interface BuyResult {\n results: Array<{\n index: number\n status: BuyLegStatus\n /* NULL when the leg was rejected before routing — no decision was made. /\n sor_decision_id: string \| null\n filled_notional: number\n filled_shares: number\n /* The un-buyable remainder of the requested stake. /\n unfilled_notional: number\n avg_price: number \| null\n rejected_reason: string \| null\n venues: Array<{\n partner_id: string\n success: boolean\n router_order_id: string \| null\n error: string \| null\n }>\n }>\n}\n\ninterface FlowEnvelope<T> {\n data?: T\n error?: { code: string; message: string; details?: Record<string, unknown> }\n}\n\nexport interface OpenMarketsClient {\n /* Generic typed request — escape hatch for endpoints without a helper. /\n request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<T>\n connect: {\n users: {\n provision(params: ProvisionUserParams): Promise<ProvisionResult>\n get<T = unknown>(externalUserId: string): Promise<T>\n getPolicy<T = unknown>(externalUserId: string): Promise<T>\n }\n linkSessions: {\n create(params: CreateLinkSessionParams): Promise<LinkSession>\n get<T = unknown>(linkSessionId: string): Promise<T>\n }\n /\n The organization's Connect config — which venues appear, whether real\n * money is allowed, and how the hosted flow is branded.\n \n Requires a PLAYER JWT with workspace admin, not an API key: this is\n * account governance rather than a data-API capability. `update` sends a\n * whole body (it is normalized server-side), so read, change, write.\n /\n configs: {\n get(workspaceId: string): Promise<ConnectConfigResult>\n update(workspaceId: string, config: Partial<ConnectConfig>): Promise<ConnectConfigResult>\n }\n webhooks: {\n getConfig<T = unknown>(): Promise<T>\n /* Verify a delivery using the configured `webhookSecret`. /\n verify(rawBody: string \| Buffer, signatureHeader: string \| null \| undefined, opts?: VerifyWebhookOptions): boolean\n /* Verify + parse, or throw. Uses the configured `webhookSecret`. /\n constructEvent(rawBody: string \| Buffer, signatureHeader: string \| null \| undefined, opts?: VerifyWebhookOptions): ConnectWebhookEvent\n }\n }\n account: {\n partners<T = unknown>(externalUserId: string): Promise<T>\n balances<T = unknown>(externalUserId: string): Promise<T>\n }\n orders: {\n list<T = unknown>(externalUserId: string): Promise<T>\n buy(orders: BuyOrder[], opts: { actAs: string }): Promise<BuyResult>\n }\n data: {\n leagues<T = unknown>(): Promise<T>\n contestLiquidity<T = unknown>(contestId: string): Promise<T>\n }\n}\n\nexport function createClient(options: OpenMarketsClientOptions): OpenMarketsClient {\n if (!options.apiKey) throw new Error('createClient: apiKey is required')\n const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '')\n const doFetch = options.fetch ?? globalThis.fetch\n if (!doFetch) throw new Error('No fetch available — pass options.fetch (Node < 18)')\n const timeoutMs = options.timeoutMs ?? 30_000\n\n async function request<T = unknown>(\n method: HttpMethod,\n path: string,\n opts: RequestOptions = {},\n ): Promise<T> {\n const url = new URL(baseUrl + path)\n for (const [k, v] of Object.entries(opts.query ?? {})) {\n if (v !== undefined) url.searchParams.set(k, String(v))\n }\n const headers: Record<string, string> = {\n 'X-API-Key': options.apiKey,\n Accept: 'application/json',\n }\n if (opts.body !== undefined) headers['Content-Type'] = 'application/json'\n if (opts.actAs) headers['X-OpenMarkets-Account'] = opts.actAs\n\n const ctrl = new AbortController()\n const timer = setTimeout(() => ctrl.abort(), timeoutMs)\n let res: Response\n try {\n res = await doFetch(url.toString(), {\n method,\n headers,\n body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,\n signal: ctrl.signal,\n })\n } finally {\n clearTimeout(timer)\n }\n\n let envelope: FlowEnvelope<T> \| undefined\n const text = await res.text()\n if (text) {\n try {\n envelope = JSON.parse(text) as FlowEnvelope<T>\n } catch {\n / non-JSON body */\n }\n }\n\n if (!res.ok) {\n const err = envelope?.error\n throw new OpenMarketsError(\n res.status,\n err?.code ?? 'http_error',\n err?.message ?? `Request failed with status ${res.status}`,\n err?.details,\n )\n }\n return (envelope?.data ?? (undefined as unknown)) as T\n }\n\n function requireSecret(): string {\n if (!options.webhookSecret) {\n throw new Error('webhookSecret was not provided to createClient()')\n }\n return options.webhookSecret\n }\n\n return {\n request,\n connect: {\n users: {\n provision: (params) =>\n request<ProvisionResult>('POST', '/flow/v1/connect/users', { body: params }),\n get: (externalUserId) =>\n request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}`),\n getPolicy: (externalUserId) =>\n request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}/policy`),\n },\n linkSessions: {\n create: (params) =>\n request<LinkSession>('POST', '/flow/v1/connect/link-sessions', { body: params }),\n get: (linkSessionId) =>\n request('GET', `/flow/v1/connect/link-sessions/${encodeURIComponent(linkSessionId)}`),\n },\n configs: {\n get: (workspaceId: string) =>\n request<ConnectConfigResult>(\n 'GET', `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`,\n ),\n update: (workspaceId: string, config: Partial<ConnectConfig>) =>\n request<ConnectConfigResult>(\n 'PUT', `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`,\n { body: { config } },\n ),\n },\n webhooks: {\n getConfig: () => request('GET', '/flow/v1/connect/webhook-config'),\n verify: (rawBody, sig, opts) =>\n verifyWebhookSignature(requireSecret(), rawBody, sig, opts),\n constructEvent: (rawBody, sig, opts) =>\n constructWebhookEvent(requireSecret(), rawBody, sig, opts),\n },\n },\n account: {\n partners: (externalUserId) =>\n request('GET', '/flow/v1/auth/account/partners', { actAs: externalUserId }),\n balances: (externalUserId) =>\n request('GET', '/flow/v1/auth/account/balances', { actAs: externalUserId }),\n },\n orders: {\n list: (externalUserId) =>\n request('GET', '/flow/v1/auth/orders', { actAs: externalUserId }),\n buy: (orders, opts) =>\n request<BuyResult>('POST', '/flow/v1/auth/orders/buy', {\n body: { orders },\n actAs: opts.actAs,\n }),\n },\n data: {\n leagues: () => request('GET', '/flow/v1/leagues'),\n contestLiquidity: (contestId) =>\n request('GET', `/flow/v1/contests/${encodeURIComponent(contestId)}/liquidity`),\n },\n }\n}\n"]}
1	+ {"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAmBO,IAAM,gBAAA,GAAmB;AAOzB,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAIxC,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAiB,OAAA,EAAmC;AAC1F,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACnB;AACJ;AAGO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC7C,YAAY,OAAA,EAAiB;AACzB,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EAChB;AACJ;AA4BA,SAAS,MAAM,IAAA,EAA+B;AAC1C,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,IAAA,CAAK,SAAS,MAAM,CAAA;AACjE;AAEA,SAAS,qBAAqB,MAAA,EAAkD;AAC5E,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,CAAM,GAAG,EAAE,MAAA,CAA+B,CAAC,KAAK,EAAA,KAAO;AACxE,IAAA,MAAM,GAAA,GAAM,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAA;AAC1B,IAAA,IAAI,MAAM,CAAA,EAAG,GAAA,CAAI,EAAA,CAAG,KAAA,CAAM,GAAG,GAAG,CAAA,CAAE,IAAA,EAAM,IAAI,EAAA,CAAG,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACnE,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,EAAG,EAAE,CAAA;AACL,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxB,EAAA,IAAI,CAAC,KAAA,CAAM,EAAA,IAAM,CAAC,QAAA,CAAS,CAAC,GAAG,OAAO,IAAA;AACtC,EAAA,OAAO,EAAE,CAAA,EAAG,EAAA,EAAI,KAAA,CAAM,EAAA,EAAG;AAC7B;AAEA,SAAS,kBAAA,CAAmB,GAAW,CAAA,EAAoB;AACvD,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA;AAC/B,EAAA,IAAI,GAAG,MAAA,KAAW,CAAA,IAAK,GAAG,MAAA,KAAW,EAAA,CAAG,QAAQ,OAAO,KAAA;AACvD,EAAA,OAAO,MAAA,CAAO,eAAA,CAAgB,EAAA,EAAI,EAAE,CAAA;AACxC;AAGO,SAAS,uBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACvB;AACP,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,eAAA,EAAiB,OAAO,KAAA;AACxC,EAAA,MAAM,MAAA,GAAS,qBAAqB,eAAe,CAAA;AACnD,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,YAAA,GAAe,KAAK,YAAA,IAAgB,GAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC1D,EAAA,IAAI,YAAA,GAAe,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,MAAA,CAAO,CAAC,CAAA,GAAI,YAAA,EAAc,OAAO,KAAA;AAC3E,EAAA,MAAM,WAAW,MAAA,CACZ,UAAA,CAAW,QAAA,EAAU,MAAM,EAC3B,MAAA,CAAO,CAAA,EAAG,MAAA,CAAO,CAAC,IAAI,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,CAAA,CACtC,OAAO,KAAK,CAAA;AACjB,EAAA,OAAO,kBAAA,CAAmB,QAAA,EAAU,MAAA,CAAO,EAAE,CAAA;AACjD;AAGO,SAAS,sBACZ,MAAA,EACA,OAAA,EACA,eAAA,EACA,IAAA,GAA6B,EAAC,EACX;AACnB,EAAA,IAAI,CAAC,sBAAA,CAAuB,MAAA,EAAQ,OAAA,EAAS,eAAA,EAAiB,IAAI,CAAA,EAAG;AACjE,IAAA,MAAM,IAAI,sBAAsB,sCAAsC,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI;AACA,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AACJ,IAAA,MAAM,IAAI,sBAAsB,gCAAgC,CAAA;AAAA,EACpE;AACJ;AAuQO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAE9C,YAAY,SAAA,EAAwB;AAChC,IAAA,KAAA,CAAM,SAAA,CAAU,KAAA,EAAO,OAAA,IAAW,sBAAsB,CAAA;AACxD,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACrB;AACJ;AAsFO,SAAS,aAAa,OAAA,EAAsD;AAC/E,EAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,EAAQ,MAAM,IAAI,MAAM,kCAAkC,CAAA;AACvE,EAAA,MAAM,WAAW,OAAA,CAAQ,OAAA,IAAW,gBAAA,EAAkB,OAAA,CAAQ,OAAO,EAAE,CAAA;AACvE,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,0DAAqD,CAAA;AACnF,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,GAAA;AAEvC,EAAA,eAAe,IAAA,CAAQ,MAAA,EAAoB,IAAA,EAAc,IAAA,GAAuB,EAAC,EAA6B;AAC1G,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,GAAU,IAAI,CAAA;AAClC,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,QAAQ,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA,EAAG;AACnD,MAAA,IAAI,CAAA,KAAM,QAAW,GAAA,CAAI,YAAA,CAAa,IAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,aAAa,OAAA,CAAQ,MAAA;AAAA,MACrB,MAAA,EAAQ;AAAA,KACZ;AACA,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AACvD,IAAA,IAAI,IAAA,CAAK,KAAA,EAAO,OAAA,CAAQ,uBAAuB,IAAI,IAAA,CAAK,KAAA;AACxD,IAAA,IAAI,IAAA,CAAK,cAAA,EAAgB,OAAA,CAAQ,iBAAiB,IAAI,IAAA,CAAK,cAAA;AAE3D,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,IAAA,CAAK,KAAA,IAAS,SAAS,CAAA;AACtD,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACA,MAAA,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,QAChC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,IAAA,CAAK;AAAA,OAChB,CAAA;AAAA,IACL,CAAA,SAAE;AACE,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACtB;AAEA,IAAA,IAAI,QAAA;AACJ,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,IAAA,EAAM;AACN,MAAA,IAAI;AACA,QAAA,QAAA,GAAW,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,MAC9B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,MAAM,QAAA,EAAU,KAAA;AACtB,MAAA,MAAM,IAAI,gBAAA;AAAA,QACN,GAAA,CAAI,MAAA;AAAA,QACJ,KAAK,IAAA,IAAQ,YAAA;AAAA,QACb,GAAA,EAAK,OAAA,IAAW,CAAA,2BAAA,EAA8B,GAAA,CAAI,MAAM,CAAA,CAAA;AAAA,QACxD,GAAA,EAAK;AAAA,OACT;AAAA,IACJ;AACA,IAAA,OAAO,YAAY,EAAC;AAAA,EACxB;AAEA,EAAA,eAAe,OAAA,CAAqB,MAAA,EAAoB,IAAA,EAAc,IAAA,GAAuB,EAAC,EAAe;AACzG,IAAA,OAAA,CAAS,MAAM,IAAA,CAAQ,MAAA,EAAQ,IAAA,EAAM,IAAI,GAAG,IAAA,IAAS,MAAA;AAAA,EACzD;AAEA,EAAA,eAAe,WAAA,CAAyB,IAAA,EAAc,IAAA,GAAqC,EAAC,EAAqB;AAC7G,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAU,KAAA,EAAO,MAAM,IAAI,CAAA;AAC7C,IAAA,OAAO;AAAA,MACH,IAAA,EAAM,GAAA,CAAI,IAAA,IAAQ,EAAC;AAAA,MACnB,WAAA,EAAa,GAAA,CAAI,UAAA,EAAY,WAAA,IAAe,IAAA;AAAA,MAC5C,UAAU,GAAA,CAAI,UAAA,EAAY,YAAY,CAAC,CAAC,IAAI,UAAA,EAAY;AAAA,KAC5D;AAAA,EACJ;AAEA,EAAA,eAAe,UAAA,CACX,IAAA,EACA,IAAA,GAA6D,EAAC,EAClD;AACZ,IAAA,MAAM,EAAE,QAAA,GAAW,EAAA,EAAI,GAAG,MAAK,GAAI,IAAA;AACnC,IAAA,MAAM,MAAW,EAAC;AAClB,IAAA,IAAI,MAAA;AACJ,IAAA,KAAA,IAAS,IAAA,GAAO,CAAA,EAAG,IAAA,GAAO,QAAA,EAAU,IAAA,EAAA,EAAQ;AACxC,MAAA,MAAM,IAAI,MAAM,WAAA,CAAe,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,KAAA,EAAO,EAAE,GAAI,KAAK,KAAA,IAAS,EAAC,EAAI,MAAA,IAAU,CAAA;AAC1F,MAAA,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA,CAAE,IAAI,CAAA;AAClB,MAAA,IAAI,CAAC,EAAE,WAAA,EAAa;AACpB,MAAA,MAAA,GAAS,CAAA,CAAE,WAAA;AAAA,IACf;AACA,IAAA,OAAO,GAAA;AAAA,EACX;AAEA,EAAA,eAAe,MAAA,CAAgB,MAAA,EAA2B,IAAA,GAAwB,EAAC,EAAkC;AACjH,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,IAAK,KAAK,SAAA,IAAa,GAAA,CAAA;AACjD,IAAA,MAAM,MAAA,GAAS,KAAK,cAAA,IAAkB,GAAA;AAGtC,IAAA,IAAI,GAAA,GAAM,MAAM,OAAA,CAA8B,MAAA,EAAQ,wBAAA,EAA0B;AAAA,MAC5E,IAAA,EAAM,MAAA;AAAA,MACN,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,cAAA,EAAgB,OAAO,UAAA;AAAW,KACrC,CAAA;AACD,IAAA,OAAO,GAAA,CAAI,WAAW,SAAA,EAAW;AAC7B,MAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AACvB,QAAA,MAAM,IAAI,gBAAA;AAAA,UAAiB,GAAA;AAAA,UAAK,cAAA;AAAA,UAC5B,CAAA,UAAA,EAAa,IAAI,YAAY,CAAA,yDAAA;AAAA,SAA2D;AAAA,MAChG;AACA,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,MAAM,CAAC,CAAA;AAC9C,MAAA,GAAA,GAAM,MAAM,OAAA;AAAA,QACR,KAAA;AAAA,QAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,GAAA,CAAI,YAAY,CAAC,CAAA,CAAA;AAAA,QAAI,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA;AAAM,OACjG;AAAA,IACJ;AACA,IAAA,IAAI,IAAI,MAAA,KAAW,QAAA,EAAU,MAAM,IAAI,uBAAuB,GAAkB,CAAA;AAChF,IAAA,OAAO,GAAA;AAAA,EACX;AAEA,EAAA,SAAS,aAAA,GAAwB;AAC7B,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AACxB,MAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,OAAA,CAAQ,aAAA;AAAA,EACnB;AAEA,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,WAAA;AAAA,IACA,UAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACL,KAAA,EAAO;AAAA,QACH,SAAA,EAAW,CAAC,MAAA,KACR,OAAA,CAAyB,QAAQ,wBAAA,EAA0B,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QAC/E,GAAA,EAAK,CAAC,cAAA,KACF,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,CAAE,CAAA;AAAA,QACjF,SAAA,EAAW,CAAC,cAAA,KACR,OAAA,CAAQ,OAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,cAAc,CAAC,CAAA,OAAA,CAAS;AAAA,OAC5F;AAAA,MACA,YAAA,EAAc;AAAA,QACV,MAAA,EAAQ,CAAC,MAAA,KACL,OAAA,CAAqB,QAAQ,gCAAA,EAAkC,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA;AAAA,QACnF,GAAA,EAAK,CAAC,aAAA,KACF,OAAA,CAAQ,OAAO,CAAA,+BAAA,EAAkC,kBAAA,CAAmB,aAAa,CAAC,CAAA,CAAE;AAAA,OAC5F;AAAA,MACA,OAAA,EAAS;AAAA,QACL,GAAA,EAAK,CAAC,WAAA,KACF,OAAA;AAAA,UACI,KAAA;AAAA,UAAO,CAAA,oBAAA,EAAuB,kBAAA,CAAmB,WAAW,CAAC,CAAA,eAAA;AAAA,SACjE;AAAA,QACJ,MAAA,EAAQ,CAAC,WAAA,EAAqB,MAAA,KAC1B,OAAA;AAAA,UACI,KAAA;AAAA,UAAO,CAAA,oBAAA,EAAuB,kBAAA,CAAmB,WAAW,CAAC,CAAA,eAAA,CAAA;AAAA,UAC7D,EAAE,IAAA,EAAM,EAAE,MAAA,EAAO;AAAE;AACvB,OACR;AAAA,MACA,QAAA,EAAU;AAAA,QACN,SAAA,EAAW,MAAM,OAAA,CAAQ,KAAA,EAAO,iCAAiC,CAAA;AAAA,QACjE,MAAA,EAAQ,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KACnB,uBAAuB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI,CAAA;AAAA,QAC9D,cAAA,EAAgB,CAAC,OAAA,EAAS,GAAA,EAAK,IAAA,KAC3B,sBAAsB,aAAA,EAAc,EAAG,OAAA,EAAS,GAAA,EAAK,IAAI;AAAA;AACjE,KACJ;AAAA,IACA,OAAA,EAAS;AAAA,MACL,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MAC9E,QAAA,EAAU,CAAC,cAAA,KACP,OAAA,CAAQ,OAAO,gCAAA,EAAkC,EAAE,KAAA,EAAO,cAAA,EAAgB;AAAA,KAClF;AAAA,IACA,MAAA,EAAQ;AAAA,MACJ,IAAA,EAAM,CAAC,cAAA,KACH,OAAA,CAAQ,OAAO,sBAAA,EAAwB,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAA;AAAA,MACpE,KAAK,CAAC,MAAA,EAAQ,IAAA,KACV,OAAA,CAAmB,QAAQ,0BAAA,EAA4B;AAAA,QACnD,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,QACf,OAAO,IAAA,CAAK;AAAA,OACf;AAAA,KACT;AAAA,IACA,IAAA,EAAM;AAAA,MACF,OAAA,EAAS,MAAM,OAAA,CAAQ,KAAA,EAAO,kBAAkB,CAAA;AAAA,MAChD,gBAAA,EAAkB,CAAC,SAAA,KACf,OAAA,CAAQ,OAAO,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,SAAS,CAAC,CAAA,UAAA,CAAY;AAAA,KACrF;AAAA,IACA,EAAA,EAAI;AAAA,MACA,MAAA;AAAA,MACA,UAAA,EAAY;AAAA,QACR,MAAA,EAAQ,CAAC,MAAA,EAAQ,IAAA,GAAO,EAAC,KACrB,OAAA,CAAQ,QAAQ,wBAAA,EAA0B;AAAA,UACtC,IAAA,EAAM,MAAA;AAAA,UACN,OAAO,IAAA,CAAK,KAAA;AAAA,UACZ,gBAAgB,IAAA,CAAK;AAAA,SACxB,CAAA;AAAA,QACL,KAAK,CAAC,WAAA,EAAa,IAAA,GAAO,OACtB,OAAA,CAAQ,KAAA,EAAO,CAAA,uBAAA,EAA0B,kBAAA,CAAmB,WAAW,CAAC,CAAA,CAAA,EAAI,EAAE,KAAA,EAAO,IAAA,CAAK,OAAO;AAAA,OACzG;AAAA,MACA,SAAA,EAAW,CAAC,IAAA,GAAO,EAAC,KAAM,OAAA,CAAQ,KAAA,EAAO,uBAAA,EAAyB,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO;AAAA;AAC3F,GACJ;AACJ","file":"index.js","sourcesContent":["/*\n @openmarketsai/connect-node\n \n Server SDK for OpenMarkets Connect. A thin, typed wrapper over the Flow API:\n * provision your users, mint hosted link sessions, verify webhook deliveries,\n * read on a user's behalf, and execute orders on their account.\n \n import { createClient } from '@openmarketsai/connect-node'\n * const om = createClient({ apiKey: process.env.OM_API_KEY! })\n \n await om.connect.users.provision({ external_user_id: 'user-123' })\n * const { token } = await om.connect.linkSessions.create({ external_user_id: 'user-123' })\n * await om.orders.buy([leg], { actAs: 'user-123' })\n * const r = await om.ai.invoke({ provider: 'anthropic', model: 'claude-opus-5', messages }, { actAs: 'user-123' })\n \n Pairs with @openmarketsai/connect-web (the in-app launcher).\n /\nimport crypto from 'node:crypto'\n\nexport const DEFAULT_BASE_URL = 'https://api.openmarkets.ai'\n\n// ──────────────────────────────────────────────────────────────────────────\n// Errors\n// ──────────────────────────────────────────────────────────────────────────\n\n/* Thrown when the API returns a non-2xx response. Mirrors the Flow error envelope. /\nexport class OpenMarketsError extends Error {\n readonly status: number\n readonly code: string\n readonly details?: Record<string, unknown>\n constructor(status: number, code: string, message: string, details?: Record<string, unknown>) {\n super(message)\n this.name = 'OpenMarketsError'\n this.status = status\n this.code = code\n this.details = details\n }\n}\n\n/* Thrown by `constructWebhookEvent` when a signature is missing, stale, or invalid. /\nexport class WebhookSignatureError extends Error {\n constructor(message: string) {\n super(message)\n this.name = 'WebhookSignatureError'\n }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Webhook verification (matches src/utils/webhook-signature.ts byte-for-byte)\n//\n// Header: X-OpenMarkets-Signature: t=<unix_seconds>,v1=<hex hmac>\n// Signed string: `${t}.${rawBody}`, HMAC-SHA256 with your whsec_ secret.\n// IMPORTANT: verify over the EXACT raw request body, not a re-serialized object.\n// ──────────────────────────────────────────────────────────────────────────\n\nexport type ConnectWebhookEventType =\n \| 'user.partners_connected'\n \| 'user.permissions_changed'\n \| 'user.history_synced'\n \| (string & {})\n\nexport interface ConnectWebhookEvent {\n type: ConnectWebhookEventType\n [key: string]: unknown\n}\n\nexport interface VerifyWebhookOptions {\n /* Max age of the signature timestamp, in seconds. Default 300 (5 min). 0 disables. /\n toleranceSec?: number\n /* Injectable clock for testing. /\n nowSec?: number\n}\n\nfunction toRaw(body: string \| Buffer): string {\n return typeof body === 'string' ? body : body.toString('utf8')\n}\n\nfunction parseSignatureHeader(header: string): { t: number; v1: string } \| null {\n const parts = header.split(',').reduce<Record<string, string>>((acc, kv) => {\n const idx = kv.indexOf('=')\n if (idx > 0) acc[kv.slice(0, idx).trim()] = kv.slice(idx + 1).trim()\n return acc\n }, {})\n const t = Number(parts.t)\n if (!parts.v1 \|\| !isFinite(t)) return null\n return { t, v1: parts.v1 }\n}\n\nfunction timingSafeEqualHex(a: string, b: string): boolean {\n const ab = Buffer.from(a, 'hex')\n const bb = Buffer.from(b, 'hex')\n if (ab.length === 0 \|\| ab.length !== bb.length) return false\n return crypto.timingSafeEqual(ab, bb)\n}\n\n/* Verify a webhook signature. Returns false on any failure (never throws). /\nexport function verifyWebhookSignature(\n secret: string,\n rawBody: string \| Buffer,\n signatureHeader: string \| null \| undefined,\n opts: VerifyWebhookOptions = {},\n): boolean {\n if (!secret \|\| !signatureHeader) return false\n const parsed = parseSignatureHeader(signatureHeader)\n if (!parsed) return false\n const toleranceSec = opts.toleranceSec ?? 300\n const nowSec = opts.nowSec ?? Math.floor(Date.now() / 1000)\n if (toleranceSec > 0 && Math.abs(nowSec - parsed.t) > toleranceSec) return false\n const expected = crypto\n .createHmac('sha256', secret)\n .update(`${parsed.t}.${toRaw(rawBody)}`)\n .digest('hex')\n return timingSafeEqualHex(expected, parsed.v1)\n}\n\n/* Verify the signature and return the parsed event, or throw `WebhookSignatureError`. /\nexport function constructWebhookEvent(\n secret: string,\n rawBody: string \| Buffer,\n signatureHeader: string \| null \| undefined,\n opts: VerifyWebhookOptions = {},\n): ConnectWebhookEvent {\n if (!verifyWebhookSignature(secret, rawBody, signatureHeader, opts)) {\n throw new WebhookSignatureError('Invalid or expired webhook signature')\n }\n try {\n return JSON.parse(toRaw(rawBody)) as ConnectWebhookEvent\n } catch {\n throw new WebhookSignatureError('Webhook body is not valid JSON')\n }\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Client\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface OpenMarketsClientOptions {\n /* Your Connect org API key. Sent as `X-API-Key`. /\n apiKey: string\n /* API base URL. Defaults to https://api.openmarkets.ai. /\n baseUrl?: string\n /* Your webhook signing secret (`whsec_…`), enabling `client.webhooks.`. /\n webhookSecret?: string\n /** Custom fetch (defaults to global fetch; Node 18+). /\n fetch?: typeof fetch\n /* Per-request timeout in ms. Default 30000. /\n timeoutMs?: number\n}\n\nexport type HttpMethod = 'GET' \| 'POST' \| 'PATCH' \| 'PUT' \| 'DELETE'\n\nexport interface RequestOptions {\n query?: Record<string, string \| number \| boolean \| undefined>\n body?: unknown\n /* Act on this user's behalf — sets the `X-OpenMarkets-Account` header. /\n actAs?: string\n /* Sent as `Idempotency-Key`: a retried POST replays instead of repeating. /\n idempotencyKey?: string\n}\n\n// Inputs (snake_case to match the API — buy legs map 1:1 from liquidity entries).\nexport interface ProvisionUserParams {\n external_user_id: string\n email?: string\n name?: string\n}\nexport type LinkSessionMode = 'connect' \| 'manage'\nexport interface CreateLinkSessionParams {\n external_user_id: string\n return_url?: string\n mode?: LinkSessionMode\n allowed_partners?: string[]\n /* Pick a specific org Connect config; omit to use the org's default (if any). /\n connect_config_id?: string\n}\nexport interface BuyOrder {\n /* What to buy — set exactly one of position_hash or liquidity_hash. /\n position_hash?: string\n liquidity_hash?: string\n /* Size — set exactly one of amount or shares. /\n amount?: number // stake, notional USD\n shares?: number // contract count (each pays $1 on win)\n /* Price ceiling, 0..1 exclusive — won't fill above this. /\n max_price: number\n /* Optional — pin a venue; omit to route to the best price. /\n partner_id?: string\n /* Optional — 'real' (default) or 'paper' (practice book). /\n mode?: 'real' \| 'paper'\n}\n\n// Outputs (light — partners can pass a type param for stricter typing).\n/\n `POST /flow/v1/connect/users`. Idempotent — safe to call on every login.\n \n `om_account_id` is the field an integration actually needs (it addresses the\n * user in later calls) and was previously absent, so it typed as `unknown` via\n * the index signature.\n /\nexport interface ProvisionResult {\n /* Our id for this user. Pass as `actAs` when trading on their behalf. /\n om_account_id: string\n external_user_id: string\n /* false when the user already existed. /\n created: boolean\n [key: string]: unknown\n}\n/\n The response of `POST /flow/v1/connect/link-sessions`.\n \n These names are the API's, verified against the route rather than assumed:\n * it returns `link_token`, NOT `token`. The previous declaration named `token`,\n * `external_user_id` and `mode` — none of which the endpoint sends — so the one\n * field an integration actually needs type-checked as a string and arrived\n * `undefined`, opening the hosted flow with `token=undefined`. The index\n * signature below is what kept that quiet; keep these names in step with\n * `CreateLinkSessionResult` in LinkSessionOrchestrator.\n /\nexport interface LinkSession {\n link_session_id: string\n /* Single-use, expires in 15 minutes. Hand to `createConnect().open()`. /\n link_token: string\n /* The hosted flow URL, for redirect mode or a native in-app browser. /\n hosted_url: string\n expires_at: string\n [key: string]: unknown\n}\n/\n The status of one leg, mirroring `flowLegStatus` in the API.\n \n ALL FIVE values are reachable. This union previously listed only three, so a\n * `switch` written against the SDK's types compiled clean and silently fell\n * through for a resting or pending order — an order that IS live, sitting on a\n * venue book, treated as if it had never been placed. Any change here must\n * follow the API, not the other way round.\n /\nexport type BuyLegStatus =\n /* Filled or partially filled. /\n \| 'completed'\n /* Live on the venue's book, unfilled. Not a failure — check back. /\n \| 'resting'\n /* Accepted by the venue, fill not yet confirmed (async venues). /\n \| 'pending'\n /* The venue or a pre-trade gate rejected it. /\n \| 'failed'\n /* No viable venue was found; nothing was sent. /\n \| 'rejected'\n\n/\n What an organization's END USERS see and may do in the hosted flow. Mirrors\n * `ConnectConfigBody` server-side.\n \n A `null` field means \"no restriction / use the default\" throughout, so an\n * organization with no config behaves exactly as Connect did before configs\n * existed. Read that as permissive, not as unset.\n /\nexport interface ConnectConfig {\n version: number\n /* Partner ids or names offered in the picker. null = every venue we support. /\n venue_allowlist: string[] \| null\n /* Surface the OpenMarkets practice book as a credential-less venue. /\n offer_internal_book: boolean\n /\n Currencies users may trade. `['ATLAS']` is practice-only and is ENFORCED\n * on every order path, not merely hidden in the UI — users can still link\n * venues, read balances and sync history; only real-money orders are\n * refused.\n /\n allowed_currencies: string[]\n /* DERIVED from allowed_currencies server-side. Sending it has no effect. /\n allow_real_money: boolean\n /* Permissions the user is asked to grant. null = all of them. /\n available_scopes: ConnectScope[] \| null\n branding: { display_name?: string; logo_url?: string; primary_color?: string } \| null\n allowed_return_urls: string[] \| null\n default_link_mode: LinkSessionMode\n /\n AI providers whose keys your users may link (AI Connect). OPT-IN: empty\n * means the hosted flow offers none — unlike venue_allowlist, where null\n * means everything.\n /\n ai_providers?: AiProvider[]\n [key: string]: unknown\n}\n\n/* Permissions an end user grants per connected venue. /\nexport type ConnectScope = 'history:read' \| 'trade:execute' \| 'balance:read'\n\nexport interface ConnectConfigResult {\n /* null when the organization has never saved one — `config` is the defaults. /\n connect_config_id: string \| null\n config: ConnectConfig\n /\n Present on update: how many EXISTING users the change was applied to.\n * A funding-mode change reaches users already provisioned, not just future\n * ones, so this reports what actually happened.\n /\n reconcile?: { scanned: number; reconciled: number; failed: number } \| null\n}\n\nexport interface BuyResult {\n results: Array<{\n index: number\n status: BuyLegStatus\n /* NULL when the leg was rejected before routing — no decision was made. /\n sor_decision_id: string \| null\n filled_notional: number\n filled_shares: number\n /* The un-buyable remainder of the requested stake. /\n unfilled_notional: number\n avg_price: number \| null\n rejected_reason: string \| null\n venues: Array<{\n partner_id: string\n success: boolean\n router_order_id: string \| null\n error: string \| null\n }>\n }>\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// AI Connect — run models on a user's OWN linked key (never charged by\n// OpenMarkets) or on OpenMarkets' key (charged in reasoning credits).\n// ──────────────────────────────────────────────────────────────────────────\n\nexport type AiProvider = 'anthropic' \| 'openai'\n/* 'auto' (default): the user's own key when linked and shared, else managed. /\nexport type AiBilling = 'auto' \| 'byok' \| 'managed'\nexport type AiStopReason = 'end' \| 'max_tokens' \| 'stop_sequence' \| 'refusal' \| 'tool_use' \| 'paused' \| 'context_exceeded'\n\nexport interface AiInferenceParams {\n provider: AiProvider\n /* The provider's own model id, passed through verbatim (e.g. 'claude-opus-5'). /\n model: string\n system?: string\n messages: Array<{ role: 'user' \| 'assistant'; content: string }>\n /* 1..21000. Default 8192. /\n max_tokens?: number\n /* Only sent when set — several current models reject any explicit value. /\n temperature?: number\n /* Constrain the answer to a JSON schema; the parsed object arrives as `output`. /\n output_schema?: { name?: string; schema: Record<string, unknown>; strict?: boolean }\n billing?: AiBilling\n /* Seconds the server holds the request before answering 202 (0..25). /\n wait_seconds?: number\n /* Your own bookkeeping labels, returned on the result. /\n metadata?: Record<string, string>\n}\n\nexport interface AiInference<TOutput = unknown> {\n inference_id: string\n status: 'running' \| 'succeeded' \| 'failed'\n provider: AiProvider\n model: string\n /* The model the provider says actually served the call. /\n served_model: string \| null\n /* 'byok' calls are never charged by OpenMarkets. /\n billing: 'byok' \| 'managed'\n output_text: string \| null\n /* Parsed JSON when `output_schema` was sent and the answer parsed; else null. /\n output: TOutput \| null\n /* Check this before trusting `output` — a refusal is not an answer. /\n stop_reason: AiStopReason \| null\n usage: { input_tokens: number; output_tokens: number; credits_charged: number }\n error: { code: string; message: string } \| null\n metadata: Record<string, string> \| null\n latency_ms: number \| null\n created_at: string\n completed_at: string \| null\n}\n\nexport interface AiProviderConnection {\n provider: AiProvider\n label: string\n key_hint: string\n credential_status: 'pending' \| 'connected' \| 'failed'\n /* Whether the user shares the key with your app. /\n invoke_granted: boolean\n monthly_token_cap: number \| null\n last_used_at: string \| null\n connected_at: string\n}\n\nexport interface AiInvokeOptions {\n /* Run on this Connect user's account (their linked key). /\n actAs?: string\n /* Give up polling after this many ms (the call keeps running server-side). Default 600000. /\n timeoutMs?: number\n /* Delay between polls once the server has answered 202. Default 2000. /\n pollIntervalMs?: number\n}\n\n/* Thrown by `ai.invoke` when the inference finished in `failed`. /\nexport class AiInferenceFailedError extends Error {\n readonly inference: AiInference\n constructor(inference: AiInference) {\n super(inference.error?.message ?? 'The inference failed')\n this.name = 'AiInferenceFailedError'\n this.inference = inference\n }\n}\n\ninterface FlowEnvelope<T> {\n data?: T\n pagination?: { next_cursor?: string \| null; has_more?: boolean }\n error?: { code: string; message: string; details?: Record<string, unknown> }\n}\n\n/* One page of a list endpoint, with the cursor `request()` drops. /\nexport interface Page<T> {\n data: T[]\n /* Pass back as `query.cursor` for the next page; null on the last page. /\n next_cursor: string \| null\n has_more: boolean\n}\n\nexport interface OpenMarketsClient {\n /* Generic typed request — escape hatch for endpoints without a helper. /\n request<T = unknown>(method: HttpMethod, path: string, opts?: RequestOptions): Promise<T>\n /\n GET one page of a list endpoint. `request()` returns only `data`, so a list's\n * `pagination.next_cursor` was unreachable through the SDK — found by the model\n * arena, which could not page through `/contests` or `/auth/orders`.\n /\n requestPage<T = unknown>(path: string, opts?: Omit<RequestOptions, 'body'>): Promise<Page<T>>\n /* Every item of a list endpoint, following cursors (stops after `maxPages`, default 50). /\n requestAll<T = unknown>(path: string, opts?: Omit<RequestOptions, 'body'> & { maxPages?: number }): Promise<T[]>\n connect: {\n users: {\n provision(params: ProvisionUserParams): Promise<ProvisionResult>\n get<T = unknown>(externalUserId: string): Promise<T>\n getPolicy<T = unknown>(externalUserId: string): Promise<T>\n }\n linkSessions: {\n create(params: CreateLinkSessionParams): Promise<LinkSession>\n get<T = unknown>(linkSessionId: string): Promise<T>\n }\n /\n The organization's Connect config — which venues appear, whether real\n * money is allowed, and how the hosted flow is branded.\n \n Requires a PLAYER JWT with workspace admin, not an API key: this is\n * account governance rather than a data-API capability. `update` sends a\n * whole body (it is normalized server-side), so read, change, write.\n /\n configs: {\n get(workspaceId: string): Promise<ConnectConfigResult>\n update(workspaceId: string, config: Partial<ConnectConfig>): Promise<ConnectConfigResult>\n }\n webhooks: {\n getConfig<T = unknown>(): Promise<T>\n /* Verify a delivery using the configured `webhookSecret`. /\n verify(rawBody: string \| Buffer, signatureHeader: string \| null \| undefined, opts?: VerifyWebhookOptions): boolean\n /* Verify + parse, or throw. Uses the configured `webhookSecret`. /\n constructEvent(rawBody: string \| Buffer, signatureHeader: string \| null \| undefined, opts?: VerifyWebhookOptions): ConnectWebhookEvent\n }\n }\n account: {\n partners<T = unknown>(externalUserId: string): Promise<T>\n balances<T = unknown>(externalUserId: string): Promise<T>\n }\n orders: {\n list<T = unknown>(externalUserId: string): Promise<T>\n buy(orders: BuyOrder[], opts: { actAs: string }): Promise<BuyResult>\n }\n data: {\n leagues<T = unknown>(): Promise<T>\n contestLiquidity<T = unknown>(contestId: string): Promise<T>\n }\n ai: {\n /\n Run a model and wait for the result — polls through a 202 for you.\n * Throws `AiInferenceFailedError` when the call fails, `OpenMarketsError`\n * when it is refused up front (e.g. 409 ai_provider_not_linked).\n /\n invoke<TOutput = unknown>(params: AiInferenceParams, opts?: AiInvokeOptions): Promise<AiInference<TOutput>>\n inferences: {\n /* One request; may return `status: 'running'` (poll with `get`). /\n create<TOutput = unknown>(params: AiInferenceParams, opts?: { actAs?: string; idempotencyKey?: string }): Promise<AiInference<TOutput>>\n get<TOutput = unknown>(inferenceId: string, opts?: { actAs?: string }): Promise<AiInference<TOutput>>\n }\n /* Which AI providers the user has linked (never the key itself). /\n providers(opts?: { actAs?: string }): Promise<{ providers: AiProviderConnection[] }>\n }\n}\n\nexport function createClient(options: OpenMarketsClientOptions): OpenMarketsClient {\n if (!options.apiKey) throw new Error('createClient: apiKey is required')\n const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '')\n const doFetch = options.fetch ?? globalThis.fetch\n if (!doFetch) throw new Error('No fetch available — pass options.fetch (Node < 18)')\n const timeoutMs = options.timeoutMs ?? 30_000\n\n async function send<T>(method: HttpMethod, path: string, opts: RequestOptions = {}): Promise<FlowEnvelope<T>> {\n const url = new URL(baseUrl + path)\n for (const [k, v] of Object.entries(opts.query ?? {})) {\n if (v !== undefined) url.searchParams.set(k, String(v))\n }\n const headers: Record<string, string> = {\n 'X-API-Key': options.apiKey,\n Accept: 'application/json',\n }\n if (opts.body !== undefined) headers['Content-Type'] = 'application/json'\n if (opts.actAs) headers['X-OpenMarkets-Account'] = opts.actAs\n if (opts.idempotencyKey) headers['Idempotency-Key'] = opts.idempotencyKey\n\n const ctrl = new AbortController()\n const timer = setTimeout(() => ctrl.abort(), timeoutMs)\n let res: Response\n try {\n res = await doFetch(url.toString(), {\n method,\n headers,\n body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,\n signal: ctrl.signal,\n })\n } finally {\n clearTimeout(timer)\n }\n\n let envelope: FlowEnvelope<T> \| undefined\n const text = await res.text()\n if (text) {\n try {\n envelope = JSON.parse(text) as FlowEnvelope<T>\n } catch {\n / non-JSON body */\n }\n }\n\n if (!res.ok) {\n const err = envelope?.error\n throw new OpenMarketsError(\n res.status,\n err?.code ?? 'http_error',\n err?.message ?? `Request failed with status ${res.status}`,\n err?.details,\n )\n }\n return envelope ?? {}\n }\n\n async function request<T = unknown>(method: HttpMethod, path: string, opts: RequestOptions = {}): Promise<T> {\n return ((await send<T>(method, path, opts)).data ?? (undefined as unknown)) as T\n }\n\n async function requestPage<T = unknown>(path: string, opts: Omit<RequestOptions, 'body'> = {}): Promise<Page<T>> {\n const env = await send<T[]>('GET', path, opts)\n return {\n data: env.data ?? [],\n next_cursor: env.pagination?.next_cursor ?? null,\n has_more: env.pagination?.has_more ?? !!env.pagination?.next_cursor,\n }\n }\n\n async function requestAll<T = unknown>(\n path: string,\n opts: Omit<RequestOptions, 'body'> & { maxPages?: number } = {},\n ): Promise<T[]> {\n const { maxPages = 50, ...rest } = opts\n const out: T[] = []\n let cursor: string \| undefined\n for (let page = 0; page < maxPages; page++) {\n const p = await requestPage<T>(path, { ...rest, query: { ...(rest.query ?? {}), cursor } })\n out.push(...p.data)\n if (!p.next_cursor) break\n cursor = p.next_cursor\n }\n return out\n }\n\n async function invoke<TOutput>(params: AiInferenceParams, opts: AiInvokeOptions = {}): Promise<AiInference<TOutput>> {\n const deadline = Date.now() + (opts.timeoutMs ?? 600_000)\n const pollMs = opts.pollIntervalMs ?? 2_000\n // One key per logical call: if the POST is retried after a network drop,\n // the server replays it instead of running (and charging for) it twice.\n let inf = await request<AiInference<TOutput>>('POST', '/flow/v1/ai/inferences', {\n body: params,\n actAs: opts.actAs,\n idempotencyKey: crypto.randomUUID(),\n })\n while (inf.status === 'running') {\n if (Date.now() > deadline) {\n throw new OpenMarketsError(408, 'poll_timeout',\n `Inference ${inf.inference_id} is still running; poll ai.inferences.get() to collect it`)\n }\n await new Promise((r) => setTimeout(r, pollMs))\n inf = await request<AiInference<TOutput>>(\n 'GET', `/flow/v1/ai/inferences/${encodeURIComponent(inf.inference_id)}`, { actAs: opts.actAs },\n )\n }\n if (inf.status === 'failed') throw new AiInferenceFailedError(inf as AiInference)\n return inf\n }\n\n function requireSecret(): string {\n if (!options.webhookSecret) {\n throw new Error('webhookSecret was not provided to createClient()')\n }\n return options.webhookSecret\n }\n\n return {\n request,\n requestPage,\n requestAll,\n connect: {\n users: {\n provision: (params) =>\n request<ProvisionResult>('POST', '/flow/v1/connect/users', { body: params }),\n get: (externalUserId) =>\n request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}`),\n getPolicy: (externalUserId) =>\n request('GET', `/flow/v1/connect/users/${encodeURIComponent(externalUserId)}/policy`),\n },\n linkSessions: {\n create: (params) =>\n request<LinkSession>('POST', '/flow/v1/connect/link-sessions', { body: params }),\n get: (linkSessionId) =>\n request('GET', `/flow/v1/connect/link-sessions/${encodeURIComponent(linkSessionId)}`),\n },\n configs: {\n get: (workspaceId: string) =>\n request<ConnectConfigResult>(\n 'GET', `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`,\n ),\n update: (workspaceId: string, config: Partial<ConnectConfig>) =>\n request<ConnectConfigResult>(\n 'PUT', `/flow/v1/workspaces/${encodeURIComponent(workspaceId)}/connect-config`,\n { body: { config } },\n ),\n },\n webhooks: {\n getConfig: () => request('GET', '/flow/v1/connect/webhook-config'),\n verify: (rawBody, sig, opts) =>\n verifyWebhookSignature(requireSecret(), rawBody, sig, opts),\n constructEvent: (rawBody, sig, opts) =>\n constructWebhookEvent(requireSecret(), rawBody, sig, opts),\n },\n },\n account: {\n partners: (externalUserId) =>\n request('GET', '/flow/v1/auth/account/partners', { actAs: externalUserId }),\n balances: (externalUserId) =>\n request('GET', '/flow/v1/auth/account/balances', { actAs: externalUserId }),\n },\n orders: {\n list: (externalUserId) =>\n request('GET', '/flow/v1/auth/orders', { actAs: externalUserId }),\n buy: (orders, opts) =>\n request<BuyResult>('POST', '/flow/v1/auth/orders/buy', {\n body: { orders },\n actAs: opts.actAs,\n }),\n },\n data: {\n leagues: () => request('GET', '/flow/v1/leagues'),\n contestLiquidity: (contestId) =>\n request('GET', `/flow/v1/contests/${encodeURIComponent(contestId)}/liquidity`),\n },\n ai: {\n invoke,\n inferences: {\n create: (params, opts = {}) =>\n request('POST', '/flow/v1/ai/inferences', {\n body: params,\n actAs: opts.actAs,\n idempotencyKey: opts.idempotencyKey,\n }),\n get: (inferenceId, opts = {}) =>\n request('GET', `/flow/v1/ai/inferences/${encodeURIComponent(inferenceId)}`, { actAs: opts.actAs }),\n },\n providers: (opts = {}) => request('GET', '/flow/v1/ai/providers', { actAs: opts.actAs }),\n },\n }\n}\n"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@openmarketsai/connect-node",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Server SDK for OpenMarkets Connect \u2014 provision users, mint link sessions, verify webhooks, and execute on a user's behalf.",
   "license": "Apache-2.0",
   "type": "module",