@trade-it/core 0.2.0 → 1.0.0

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to `@trade-it/core` will be documented in this file.
 
+## Unreleased
+
+## 1.0.0 - 2026-10-15
+
+- Typed OAuth authorization artifacts, credential event validation, and embedded authorization event names
+
 ## 0.2.0 - 2026-07-27
 
 ### Added

package/README.md

@@ -29,3 +29,9 @@ Integration guides and reference docs:
 
 - This package is intended for framework wrappers or advanced integrations.
 - Request Trade It session URLs from your server immediately before launch; they expire after 30 minutes.
+
+## Authorization events
+
+`EmbedEventType.Authorization` carries `TradeItAuthorization` (`code`, `state`, `issuer`). Use `isTradeItAuthorization` to narrow the payload and validate the exact message origin and sending iframe before accepting it. Forward the artifacts to your authenticated backend; keep client secrets, PKCE verifiers, and OAuth tokens off the frontend.
+
+The React SDK handles these checks and invokes its async `onAuthorization` callback. See the [Onboarding Portal guide](https://docs.tradeit.app/sdk/onboarding).

package/dist/index.cjs

@@ -54,12 +54,35 @@ let TradeType = /* @__PURE__ */ function(TradeType$1) {
 	return TradeType$1;
 }({});
 
+//#endregion
+//#region ../../lib/types/src/enums/embedding.enums.ts
+/** Version-one messages exchanged between a Trade It frame and its host. */
+let EmbedEventType = /* @__PURE__ */ function(EmbedEventType$1) {
+	EmbedEventType$1["Ready"] = "tradeit.ready";
+	EmbedEventType$1["CloseRequested"] = "tradeit.close_requested";
+	EmbedEventType$1["BrokerageConnected"] = "tradeit.brokerage_connected";
+	EmbedEventType$1["TradeSubmitted"] = "tradeit.trade_submitted";
+	EmbedEventType$1["TradeExecuted"] = "tradeit.trade_executed";
+	EmbedEventType$1["Error"] = "tradeit.error";
+	EmbedEventType$1["LoginRequired"] = "tradeit.login_required";
+	EmbedEventType$1["Authorization"] = "tradeit.authorization";
+	EmbedEventType$1["AuthorizationResult"] = "tradeit.authorization_result";
+	return EmbedEventType$1;
+}({});
+
 //#endregion
 //#region src/events.ts
+/** Validates supported embedded messages before dispatch. */
 function isTradeItEvent(data) {
 	if (!data || typeof data !== "object") return false;
 	const message = data;
-	return message.source === "tradeit" && message.version === 1 && typeof message.type === "string" && message.type.startsWith("tradeit.");
+	return message.source === "tradeit" && message.version === 1 && typeof message.type === "string" && Object.values(EmbedEventType).some((type) => type === message.type);
+}
+/** Narrows credential events before they can reach an integration callback. */
+function isTradeItAuthorization(data) {
+	if (data == null || typeof data !== "object") return false;
+	const value = data;
+	return typeof value.code === "string" && value.code.length > 0 && typeof value.state === "string" && value.state.length > 0 && typeof value.issuer === "string" && /^https?:\/\//.test(value.issuer);
 }
 function getTradeItErrorMessage(event) {
 	const message = event.payload?.message;
@@ -164,6 +187,7 @@ function getUrlOrigin(url) {
 }
 
 //#endregion
+exports.EmbedEventType = EmbedEventType;
 exports.LegType = LegType;
 exports.OrderDirection = OrderDirection;
 exports.OrderType = OrderType;
@@ -176,5 +200,6 @@ exports.TradeUnit = TradeUnit;
 exports.TriggerUnit = TriggerUnit;
 exports.getTradeItErrorMessage = getTradeItErrorMessage;
 exports.getUrlOrigin = getUrlOrigin;
+exports.isTradeItAuthorization = isTradeItAuthorization;
 exports.isTradeItEvent = isTradeItEvent;
 exports.resolveLaunchUrl = resolveLaunchUrl;

package/dist/index.d.cts

@@ -45,9 +45,33 @@ declare enum TradeType {
   Simple = 0,
   MultiLeg = 1,
 }
+/**
+ * A brokerage-reported option lifecycle event. Rows carrying an event describe
+ * what happened to a contract, so `action` is not meaningful on them.
+ */
+//#endregion
+//#region ../../lib/types/src/enums/embedding.enums.d.ts
+/** Version-one messages exchanged between a Trade It frame and its host. */
+declare enum EmbedEventType {
+  Ready = "tradeit.ready",
+  CloseRequested = "tradeit.close_requested",
+  BrokerageConnected = "tradeit.brokerage_connected",
+  TradeSubmitted = "tradeit.trade_submitted",
+  TradeExecuted = "tradeit.trade_executed",
+  Error = "tradeit.error",
+  LoginRequired = "tradeit.login_required",
+  Authorization = "tradeit.authorization",
+  AuthorizationResult = "tradeit.authorization_result",
+}
 //#endregion
 //#region src/types.d.ts
-type TradeItEventType = 'tradeit.ready' | 'tradeit.close_requested' | 'tradeit.brokerage_connected' | 'tradeit.trade_submitted' | 'tradeit.trade_executed' | 'tradeit.error' | 'tradeit.login_required';
+type TradeItEventType = `${EmbedEventType}`;
+/** OAuth artifacts forwarded to the partner's authenticated backend. */
+interface TradeItAuthorization {
+  code: string;
+  state: string;
+  issuer: string;
+}
 interface TradeItEvent<TPayload = Record<string, unknown>> {
   source: 'tradeit';
   version: 1;
@@ -93,11 +117,7 @@ interface TradeItExitTrigger {
   value: number;
   unit: '$' | '%';
 }
-/**
- * Query params accepted by Trade It's /t/[ticker] page.
- * User-facing config uses descriptive keys; core converts them to the short-key
- * query format used by the page parser (tt, t, dir, ot, a, u, lp, sp, tif, tp, sl, ref, legs).
- */
+/** Descriptive trade configuration serialized into the page's compact query parameters. */
 interface TradeItTradeConfigBase {
   ticker: string;
   orderType?: OrderType;
@@ -137,11 +157,14 @@ type TradeItConnectLaunch = TradeItLaunch<'connect'>;
 type TradeItTradeLaunch = TradeItLaunch<'trade'>;
 //#endregion
 //#region src/events.d.ts
+/** Validates supported embedded messages before dispatch. */
 declare function isTradeItEvent(data: unknown): data is TradeItEvent;
+/** Narrows credential events before they can reach an integration callback. */
+declare function isTradeItAuthorization(data: unknown): data is TradeItAuthorization;
 declare function getTradeItErrorMessage(event: TradeItEvent): string;
 //#endregion
 //#region src/url.d.ts
 declare function resolveLaunchUrl(launch: TradeItLaunch): string;
 declare function getUrlOrigin(url: string): string | null;
 //#endregion
-export { LegType, OrderDirection, OrderType, PositionEffect, TimeInForce, TradeAction, type TradeItConnectLaunch, type TradeItEvent, type TradeItEventType, type TradeItExitTrigger, type TradeItLaunch, type TradeItLaunchConfigMap, type TradeItMode, type TradeItMultiLegTradeConfig, type TradeItMultiLegTradeLegConfig, type TradeItQueryPrimitive, type TradeItSimpleTradeConfig, type TradeItTradeConfig, type TradeItTradeLaunch, type TradeLinkLegConfig, TradeLinkParam, TradeType, TradeUnit, TriggerUnit, getTradeItErrorMessage, getUrlOrigin, isTradeItEvent, resolveLaunchUrl };
+export { EmbedEventType, LegType, OrderDirection, OrderType, PositionEffect, TimeInForce, TradeAction, type TradeItAuthorization, type TradeItConnectLaunch, type TradeItEvent, type TradeItEventType, type TradeItExitTrigger, type TradeItLaunch, type TradeItLaunchConfigMap, type TradeItMode, type TradeItMultiLegTradeConfig, type TradeItMultiLegTradeLegConfig, type TradeItQueryPrimitive, type TradeItSimpleTradeConfig, type TradeItTradeConfig, type TradeItTradeLaunch, type TradeLinkLegConfig, TradeLinkParam, TradeType, TradeUnit, TriggerUnit, getTradeItErrorMessage, getUrlOrigin, isTradeItAuthorization, isTradeItEvent, resolveLaunchUrl };

package/dist/index.d.ts

@@ -45,9 +45,33 @@ declare enum TradeType {
   Simple = 0,
   MultiLeg = 1,
 }
+/**
+ * A brokerage-reported option lifecycle event. Rows carrying an event describe
+ * what happened to a contract, so `action` is not meaningful on them.
+ */
+//#endregion
+//#region ../../lib/types/src/enums/embedding.enums.d.ts
+/** Version-one messages exchanged between a Trade It frame and its host. */
+declare enum EmbedEventType {
+  Ready = "tradeit.ready",
+  CloseRequested = "tradeit.close_requested",
+  BrokerageConnected = "tradeit.brokerage_connected",
+  TradeSubmitted = "tradeit.trade_submitted",
+  TradeExecuted = "tradeit.trade_executed",
+  Error = "tradeit.error",
+  LoginRequired = "tradeit.login_required",
+  Authorization = "tradeit.authorization",
+  AuthorizationResult = "tradeit.authorization_result",
+}
 //#endregion
 //#region src/types.d.ts
-type TradeItEventType = 'tradeit.ready' | 'tradeit.close_requested' | 'tradeit.brokerage_connected' | 'tradeit.trade_submitted' | 'tradeit.trade_executed' | 'tradeit.error' | 'tradeit.login_required';
+type TradeItEventType = `${EmbedEventType}`;
+/** OAuth artifacts forwarded to the partner's authenticated backend. */
+interface TradeItAuthorization {
+  code: string;
+  state: string;
+  issuer: string;
+}
 interface TradeItEvent<TPayload = Record<string, unknown>> {
   source: 'tradeit';
   version: 1;
@@ -93,11 +117,7 @@ interface TradeItExitTrigger {
   value: number;
   unit: '$' | '%';
 }
-/**
- * Query params accepted by Trade It's /t/[ticker] page.
- * User-facing config uses descriptive keys; core converts them to the short-key
- * query format used by the page parser (tt, t, dir, ot, a, u, lp, sp, tif, tp, sl, ref, legs).
- */
+/** Descriptive trade configuration serialized into the page's compact query parameters. */
 interface TradeItTradeConfigBase {
   ticker: string;
   orderType?: OrderType;
@@ -137,11 +157,14 @@ type TradeItConnectLaunch = TradeItLaunch<'connect'>;
 type TradeItTradeLaunch = TradeItLaunch<'trade'>;
 //#endregion
 //#region src/events.d.ts
+/** Validates supported embedded messages before dispatch. */
 declare function isTradeItEvent(data: unknown): data is TradeItEvent;
+/** Narrows credential events before they can reach an integration callback. */
+declare function isTradeItAuthorization(data: unknown): data is TradeItAuthorization;
 declare function getTradeItErrorMessage(event: TradeItEvent): string;
 //#endregion
 //#region src/url.d.ts
 declare function resolveLaunchUrl(launch: TradeItLaunch): string;
 declare function getUrlOrigin(url: string): string | null;
 //#endregion
-export { LegType, OrderDirection, OrderType, PositionEffect, TimeInForce, TradeAction, type TradeItConnectLaunch, type TradeItEvent, type TradeItEventType, type TradeItExitTrigger, type TradeItLaunch, type TradeItLaunchConfigMap, type TradeItMode, type TradeItMultiLegTradeConfig, type TradeItMultiLegTradeLegConfig, type TradeItQueryPrimitive, type TradeItSimpleTradeConfig, type TradeItTradeConfig, type TradeItTradeLaunch, type TradeLinkLegConfig, TradeLinkParam, TradeType, TradeUnit, TriggerUnit, getTradeItErrorMessage, getUrlOrigin, isTradeItEvent, resolveLaunchUrl };
+export { EmbedEventType, LegType, OrderDirection, OrderType, PositionEffect, TimeInForce, TradeAction, type TradeItAuthorization, type TradeItConnectLaunch, type TradeItEvent, type TradeItEventType, type TradeItExitTrigger, type TradeItLaunch, type TradeItLaunchConfigMap, type TradeItMode, type TradeItMultiLegTradeConfig, type TradeItMultiLegTradeLegConfig, type TradeItQueryPrimitive, type TradeItSimpleTradeConfig, type TradeItTradeConfig, type TradeItTradeLaunch, type TradeLinkLegConfig, TradeLinkParam, TradeType, TradeUnit, TriggerUnit, getTradeItErrorMessage, getUrlOrigin, isTradeItAuthorization, isTradeItEvent, resolveLaunchUrl };

package/dist/index.js

@@ -53,12 +53,35 @@ let TradeType = /* @__PURE__ */ function(TradeType$1) {
 	return TradeType$1;
 }({});
 
+//#endregion
+//#region ../../lib/types/src/enums/embedding.enums.ts
+/** Version-one messages exchanged between a Trade It frame and its host. */
+let EmbedEventType = /* @__PURE__ */ function(EmbedEventType$1) {
+	EmbedEventType$1["Ready"] = "tradeit.ready";
+	EmbedEventType$1["CloseRequested"] = "tradeit.close_requested";
+	EmbedEventType$1["BrokerageConnected"] = "tradeit.brokerage_connected";
+	EmbedEventType$1["TradeSubmitted"] = "tradeit.trade_submitted";
+	EmbedEventType$1["TradeExecuted"] = "tradeit.trade_executed";
+	EmbedEventType$1["Error"] = "tradeit.error";
+	EmbedEventType$1["LoginRequired"] = "tradeit.login_required";
+	EmbedEventType$1["Authorization"] = "tradeit.authorization";
+	EmbedEventType$1["AuthorizationResult"] = "tradeit.authorization_result";
+	return EmbedEventType$1;
+}({});
+
 //#endregion
 //#region src/events.ts
+/** Validates supported embedded messages before dispatch. */
 function isTradeItEvent(data) {
 	if (!data || typeof data !== "object") return false;
 	const message = data;
-	return message.source === "tradeit" && message.version === 1 && typeof message.type === "string" && message.type.startsWith("tradeit.");
+	return message.source === "tradeit" && message.version === 1 && typeof message.type === "string" && Object.values(EmbedEventType).some((type) => type === message.type);
+}
+/** Narrows credential events before they can reach an integration callback. */
+function isTradeItAuthorization(data) {
+	if (data == null || typeof data !== "object") return false;
+	const value = data;
+	return typeof value.code === "string" && value.code.length > 0 && typeof value.state === "string" && value.state.length > 0 && typeof value.issuer === "string" && /^https?:\/\//.test(value.issuer);
 }
 function getTradeItErrorMessage(event) {
 	const message = event.payload?.message;
@@ -163,4 +186,4 @@ function getUrlOrigin(url) {
 }
 
 //#endregion
-export { LegType, OrderDirection, OrderType, PositionEffect, TimeInForce, TradeAction, TradeLinkParam, TradeType, TradeUnit, TriggerUnit, getTradeItErrorMessage, getUrlOrigin, isTradeItEvent, resolveLaunchUrl };
+export { EmbedEventType, LegType, OrderDirection, OrderType, PositionEffect, TimeInForce, TradeAction, TradeLinkParam, TradeType, TradeUnit, TriggerUnit, getTradeItErrorMessage, getUrlOrigin, isTradeItAuthorization, isTradeItEvent, resolveLaunchUrl };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trade-it/core",
-  "version": "0.2.0",
+  "version": "1.0.0",
   "description": "Framework-agnostic core for Trade It embedded SDKs.",
   "author": "Trade It, Inc.",
   "license": "MIT",
@@ -37,6 +37,9 @@
   "scripts": {
     "build": "tsdown src/index.ts --format esm,cjs --dts --out-dir dist && node ../../scripts/fix-trade-it-sdk-dts.mjs dist/index.d.ts dist/index.d.cts",
     "dev": "tsdown src/index.ts --format esm,cjs --dts --out-dir dist --watch",
+    "release:major": "node ../../scripts/release-trade-it-sdk.mjs core major",
+    "release:minor": "node ../../scripts/release-trade-it-sdk.mjs core minor",
+    "release:patch": "node ../../scripts/release-trade-it-sdk.mjs core patch",
     "test": "npm run build && tsc -p tsconfig.test.json --noEmit && node --test test/*.test.mjs",
     "prepublishOnly": "npm test"
   },