@trade-it/core 0.3.0 → 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/CHANGELOG.md +6 -0
  2. package/README.md +6 -0
  3. package/dist/index.cjs +26 -1
  4. package/dist/index.d.cts +26 -7
  5. package/dist/index.d.ts +26 -7
  6. package/dist/index.js +25 -2
  7. package/package.json +4 -1
package/CHANGELOG.md CHANGED
@@ -2,6 +2,12 @@
2
2
 
3
3
  All notable changes to `@trade-it/core` will be documented in this file.
4
4
 
5
+ ## Unreleased
6
+
7
+ ## 1.0.0 - 2026-10-15
8
+
9
+ - Typed OAuth authorization artifacts, credential event validation, and embedded authorization event names
10
+
5
11
  ## 0.2.0 - 2026-07-27
6
12
 
7
13
  ### Added
package/README.md CHANGED
@@ -29,3 +29,9 @@ Integration guides and reference docs:
29
29
 
30
30
  - This package is intended for framework wrappers or advanced integrations.
31
31
  - Request Trade It session URLs from your server immediately before launch; they expire after 30 minutes.
32
+
33
+ ## Authorization events
34
+
35
+ `EmbedEventType.Authorization` carries `TradeItAuthorization` (`code`, `state`, `issuer`). Use `isTradeItAuthorization` to narrow the payload and validate the exact message origin and sending iframe before accepting it. Forward the artifacts to your authenticated backend; keep client secrets, PKCE verifiers, and OAuth tokens off the frontend.
36
+
37
+ The React SDK handles these checks and invokes its async `onAuthorization` callback. See the [Onboarding Portal guide](https://docs.tradeit.app/sdk/onboarding).
package/dist/index.cjs CHANGED
@@ -54,12 +54,35 @@ let TradeType = /* @__PURE__ */ function(TradeType$1) {
54
54
  return TradeType$1;
55
55
  }({});
56
56
 
57
+ //#endregion
58
+ //#region ../../lib/types/src/enums/embedding.enums.ts
59
+ /** Version-one messages exchanged between a Trade It frame and its host. */
60
+ let EmbedEventType = /* @__PURE__ */ function(EmbedEventType$1) {
61
+ EmbedEventType$1["Ready"] = "tradeit.ready";
62
+ EmbedEventType$1["CloseRequested"] = "tradeit.close_requested";
63
+ EmbedEventType$1["BrokerageConnected"] = "tradeit.brokerage_connected";
64
+ EmbedEventType$1["TradeSubmitted"] = "tradeit.trade_submitted";
65
+ EmbedEventType$1["TradeExecuted"] = "tradeit.trade_executed";
66
+ EmbedEventType$1["Error"] = "tradeit.error";
67
+ EmbedEventType$1["LoginRequired"] = "tradeit.login_required";
68
+ EmbedEventType$1["Authorization"] = "tradeit.authorization";
69
+ EmbedEventType$1["AuthorizationResult"] = "tradeit.authorization_result";
70
+ return EmbedEventType$1;
71
+ }({});
72
+
57
73
  //#endregion
58
74
  //#region src/events.ts
75
+ /** Validates supported embedded messages before dispatch. */
59
76
  function isTradeItEvent(data) {
60
77
  if (!data || typeof data !== "object") return false;
61
78
  const message = data;
62
- return message.source === "tradeit" && message.version === 1 && typeof message.type === "string" && message.type.startsWith("tradeit.");
79
+ return message.source === "tradeit" && message.version === 1 && typeof message.type === "string" && Object.values(EmbedEventType).some((type) => type === message.type);
80
+ }
81
+ /** Narrows credential events before they can reach an integration callback. */
82
+ function isTradeItAuthorization(data) {
83
+ if (data == null || typeof data !== "object") return false;
84
+ const value = data;
85
+ return typeof value.code === "string" && value.code.length > 0 && typeof value.state === "string" && value.state.length > 0 && typeof value.issuer === "string" && /^https?:\/\//.test(value.issuer);
63
86
  }
64
87
  function getTradeItErrorMessage(event) {
65
88
  const message = event.payload?.message;
@@ -164,6 +187,7 @@ function getUrlOrigin(url) {
164
187
  }
165
188
 
166
189
  //#endregion
190
+ exports.EmbedEventType = EmbedEventType;
167
191
  exports.LegType = LegType;
168
192
  exports.OrderDirection = OrderDirection;
169
193
  exports.OrderType = OrderType;
@@ -176,5 +200,6 @@ exports.TradeUnit = TradeUnit;
176
200
  exports.TriggerUnit = TriggerUnit;
177
201
  exports.getTradeItErrorMessage = getTradeItErrorMessage;
178
202
  exports.getUrlOrigin = getUrlOrigin;
203
+ exports.isTradeItAuthorization = isTradeItAuthorization;
179
204
  exports.isTradeItEvent = isTradeItEvent;
180
205
  exports.resolveLaunchUrl = resolveLaunchUrl;
package/dist/index.d.cts CHANGED
@@ -50,8 +50,28 @@ declare enum TradeType {
50
50
  * what happened to a contract, so `action` is not meaningful on them.
51
51
  */
52
52
  //#endregion
53
+ //#region ../../lib/types/src/enums/embedding.enums.d.ts
54
+ /** Version-one messages exchanged between a Trade It frame and its host. */
55
+ declare enum EmbedEventType {
56
+ Ready = "tradeit.ready",
57
+ CloseRequested = "tradeit.close_requested",
58
+ BrokerageConnected = "tradeit.brokerage_connected",
59
+ TradeSubmitted = "tradeit.trade_submitted",
60
+ TradeExecuted = "tradeit.trade_executed",
61
+ Error = "tradeit.error",
62
+ LoginRequired = "tradeit.login_required",
63
+ Authorization = "tradeit.authorization",
64
+ AuthorizationResult = "tradeit.authorization_result",
65
+ }
66
+ //#endregion
53
67
  //#region src/types.d.ts
54
- type TradeItEventType = 'tradeit.ready' | 'tradeit.close_requested' | 'tradeit.brokerage_connected' | 'tradeit.trade_submitted' | 'tradeit.trade_executed' | 'tradeit.error' | 'tradeit.login_required';
68
+ type TradeItEventType = `${EmbedEventType}`;
69
+ /** OAuth artifacts forwarded to the partner's authenticated backend. */
70
+ interface TradeItAuthorization {
71
+ code: string;
72
+ state: string;
73
+ issuer: string;
74
+ }
55
75
  interface TradeItEvent<TPayload = Record<string, unknown>> {
56
76
  source: 'tradeit';
57
77
  version: 1;
@@ -97,11 +117,7 @@ interface TradeItExitTrigger {
97
117
  value: number;
98
118
  unit: '$' | '%';
99
119
  }
100
- /**
101
- * Query params accepted by Trade It's /t/[ticker] page.
102
- * User-facing config uses descriptive keys; core converts them to the short-key
103
- * query format used by the page parser (tt, t, dir, ot, a, u, lp, sp, tif, tp, sl, ref, legs).
104
- */
120
+ /** Descriptive trade configuration serialized into the page's compact query parameters. */
105
121
  interface TradeItTradeConfigBase {
106
122
  ticker: string;
107
123
  orderType?: OrderType;
@@ -141,11 +157,14 @@ type TradeItConnectLaunch = TradeItLaunch<'connect'>;
141
157
  type TradeItTradeLaunch = TradeItLaunch<'trade'>;
142
158
  //#endregion
143
159
  //#region src/events.d.ts
160
+ /** Validates supported embedded messages before dispatch. */
144
161
  declare function isTradeItEvent(data: unknown): data is TradeItEvent;
162
+ /** Narrows credential events before they can reach an integration callback. */
163
+ declare function isTradeItAuthorization(data: unknown): data is TradeItAuthorization;
145
164
  declare function getTradeItErrorMessage(event: TradeItEvent): string;
146
165
  //#endregion
147
166
  //#region src/url.d.ts
148
167
  declare function resolveLaunchUrl(launch: TradeItLaunch): string;
149
168
  declare function getUrlOrigin(url: string): string | null;
150
169
  //#endregion
151
- export { LegType, OrderDirection, OrderType, PositionEffect, TimeInForce, TradeAction, type TradeItConnectLaunch, type TradeItEvent, type TradeItEventType, type TradeItExitTrigger, type TradeItLaunch, type TradeItLaunchConfigMap, type TradeItMode, type TradeItMultiLegTradeConfig, type TradeItMultiLegTradeLegConfig, type TradeItQueryPrimitive, type TradeItSimpleTradeConfig, type TradeItTradeConfig, type TradeItTradeLaunch, type TradeLinkLegConfig, TradeLinkParam, TradeType, TradeUnit, TriggerUnit, getTradeItErrorMessage, getUrlOrigin, isTradeItEvent, resolveLaunchUrl };
170
+ export { EmbedEventType, LegType, OrderDirection, OrderType, PositionEffect, TimeInForce, TradeAction, type TradeItAuthorization, type TradeItConnectLaunch, type TradeItEvent, type TradeItEventType, type TradeItExitTrigger, type TradeItLaunch, type TradeItLaunchConfigMap, type TradeItMode, type TradeItMultiLegTradeConfig, type TradeItMultiLegTradeLegConfig, type TradeItQueryPrimitive, type TradeItSimpleTradeConfig, type TradeItTradeConfig, type TradeItTradeLaunch, type TradeLinkLegConfig, TradeLinkParam, TradeType, TradeUnit, TriggerUnit, getTradeItErrorMessage, getUrlOrigin, isTradeItAuthorization, isTradeItEvent, resolveLaunchUrl };
package/dist/index.d.ts CHANGED
@@ -50,8 +50,28 @@ declare enum TradeType {
50
50
  * what happened to a contract, so `action` is not meaningful on them.
51
51
  */
52
52
  //#endregion
53
+ //#region ../../lib/types/src/enums/embedding.enums.d.ts
54
+ /** Version-one messages exchanged between a Trade It frame and its host. */
55
+ declare enum EmbedEventType {
56
+ Ready = "tradeit.ready",
57
+ CloseRequested = "tradeit.close_requested",
58
+ BrokerageConnected = "tradeit.brokerage_connected",
59
+ TradeSubmitted = "tradeit.trade_submitted",
60
+ TradeExecuted = "tradeit.trade_executed",
61
+ Error = "tradeit.error",
62
+ LoginRequired = "tradeit.login_required",
63
+ Authorization = "tradeit.authorization",
64
+ AuthorizationResult = "tradeit.authorization_result",
65
+ }
66
+ //#endregion
53
67
  //#region src/types.d.ts
54
- type TradeItEventType = 'tradeit.ready' | 'tradeit.close_requested' | 'tradeit.brokerage_connected' | 'tradeit.trade_submitted' | 'tradeit.trade_executed' | 'tradeit.error' | 'tradeit.login_required';
68
+ type TradeItEventType = `${EmbedEventType}`;
69
+ /** OAuth artifacts forwarded to the partner's authenticated backend. */
70
+ interface TradeItAuthorization {
71
+ code: string;
72
+ state: string;
73
+ issuer: string;
74
+ }
55
75
  interface TradeItEvent<TPayload = Record<string, unknown>> {
56
76
  source: 'tradeit';
57
77
  version: 1;
@@ -97,11 +117,7 @@ interface TradeItExitTrigger {
97
117
  value: number;
98
118
  unit: '$' | '%';
99
119
  }
100
- /**
101
- * Query params accepted by Trade It's /t/[ticker] page.
102
- * User-facing config uses descriptive keys; core converts them to the short-key
103
- * query format used by the page parser (tt, t, dir, ot, a, u, lp, sp, tif, tp, sl, ref, legs).
104
- */
120
+ /** Descriptive trade configuration serialized into the page's compact query parameters. */
105
121
  interface TradeItTradeConfigBase {
106
122
  ticker: string;
107
123
  orderType?: OrderType;
@@ -141,11 +157,14 @@ type TradeItConnectLaunch = TradeItLaunch<'connect'>;
141
157
  type TradeItTradeLaunch = TradeItLaunch<'trade'>;
142
158
  //#endregion
143
159
  //#region src/events.d.ts
160
+ /** Validates supported embedded messages before dispatch. */
144
161
  declare function isTradeItEvent(data: unknown): data is TradeItEvent;
162
+ /** Narrows credential events before they can reach an integration callback. */
163
+ declare function isTradeItAuthorization(data: unknown): data is TradeItAuthorization;
145
164
  declare function getTradeItErrorMessage(event: TradeItEvent): string;
146
165
  //#endregion
147
166
  //#region src/url.d.ts
148
167
  declare function resolveLaunchUrl(launch: TradeItLaunch): string;
149
168
  declare function getUrlOrigin(url: string): string | null;
150
169
  //#endregion
151
- export { LegType, OrderDirection, OrderType, PositionEffect, TimeInForce, TradeAction, type TradeItConnectLaunch, type TradeItEvent, type TradeItEventType, type TradeItExitTrigger, type TradeItLaunch, type TradeItLaunchConfigMap, type TradeItMode, type TradeItMultiLegTradeConfig, type TradeItMultiLegTradeLegConfig, type TradeItQueryPrimitive, type TradeItSimpleTradeConfig, type TradeItTradeConfig, type TradeItTradeLaunch, type TradeLinkLegConfig, TradeLinkParam, TradeType, TradeUnit, TriggerUnit, getTradeItErrorMessage, getUrlOrigin, isTradeItEvent, resolveLaunchUrl };
170
+ export { EmbedEventType, LegType, OrderDirection, OrderType, PositionEffect, TimeInForce, TradeAction, type TradeItAuthorization, type TradeItConnectLaunch, type TradeItEvent, type TradeItEventType, type TradeItExitTrigger, type TradeItLaunch, type TradeItLaunchConfigMap, type TradeItMode, type TradeItMultiLegTradeConfig, type TradeItMultiLegTradeLegConfig, type TradeItQueryPrimitive, type TradeItSimpleTradeConfig, type TradeItTradeConfig, type TradeItTradeLaunch, type TradeLinkLegConfig, TradeLinkParam, TradeType, TradeUnit, TriggerUnit, getTradeItErrorMessage, getUrlOrigin, isTradeItAuthorization, isTradeItEvent, resolveLaunchUrl };
package/dist/index.js CHANGED
@@ -53,12 +53,35 @@ let TradeType = /* @__PURE__ */ function(TradeType$1) {
53
53
  return TradeType$1;
54
54
  }({});
55
55
 
56
+ //#endregion
57
+ //#region ../../lib/types/src/enums/embedding.enums.ts
58
+ /** Version-one messages exchanged between a Trade It frame and its host. */
59
+ let EmbedEventType = /* @__PURE__ */ function(EmbedEventType$1) {
60
+ EmbedEventType$1["Ready"] = "tradeit.ready";
61
+ EmbedEventType$1["CloseRequested"] = "tradeit.close_requested";
62
+ EmbedEventType$1["BrokerageConnected"] = "tradeit.brokerage_connected";
63
+ EmbedEventType$1["TradeSubmitted"] = "tradeit.trade_submitted";
64
+ EmbedEventType$1["TradeExecuted"] = "tradeit.trade_executed";
65
+ EmbedEventType$1["Error"] = "tradeit.error";
66
+ EmbedEventType$1["LoginRequired"] = "tradeit.login_required";
67
+ EmbedEventType$1["Authorization"] = "tradeit.authorization";
68
+ EmbedEventType$1["AuthorizationResult"] = "tradeit.authorization_result";
69
+ return EmbedEventType$1;
70
+ }({});
71
+
56
72
  //#endregion
57
73
  //#region src/events.ts
74
+ /** Validates supported embedded messages before dispatch. */
58
75
  function isTradeItEvent(data) {
59
76
  if (!data || typeof data !== "object") return false;
60
77
  const message = data;
61
- return message.source === "tradeit" && message.version === 1 && typeof message.type === "string" && message.type.startsWith("tradeit.");
78
+ return message.source === "tradeit" && message.version === 1 && typeof message.type === "string" && Object.values(EmbedEventType).some((type) => type === message.type);
79
+ }
80
+ /** Narrows credential events before they can reach an integration callback. */
81
+ function isTradeItAuthorization(data) {
82
+ if (data == null || typeof data !== "object") return false;
83
+ const value = data;
84
+ return typeof value.code === "string" && value.code.length > 0 && typeof value.state === "string" && value.state.length > 0 && typeof value.issuer === "string" && /^https?:\/\//.test(value.issuer);
62
85
  }
63
86
  function getTradeItErrorMessage(event) {
64
87
  const message = event.payload?.message;
@@ -163,4 +186,4 @@ function getUrlOrigin(url) {
163
186
  }
164
187
 
165
188
  //#endregion
166
- export { LegType, OrderDirection, OrderType, PositionEffect, TimeInForce, TradeAction, TradeLinkParam, TradeType, TradeUnit, TriggerUnit, getTradeItErrorMessage, getUrlOrigin, isTradeItEvent, resolveLaunchUrl };
189
+ export { EmbedEventType, LegType, OrderDirection, OrderType, PositionEffect, TimeInForce, TradeAction, TradeLinkParam, TradeType, TradeUnit, TriggerUnit, getTradeItErrorMessage, getUrlOrigin, isTradeItAuthorization, isTradeItEvent, resolveLaunchUrl };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@trade-it/core",
3
- "version": "0.3.0",
3
+ "version": "1.0.0",
4
4
  "description": "Framework-agnostic core for Trade It embedded SDKs.",
5
5
  "author": "Trade It, Inc.",
6
6
  "license": "MIT",
@@ -37,6 +37,9 @@
37
37
  "scripts": {
38
38
  "build": "tsdown src/index.ts --format esm,cjs --dts --out-dir dist && node ../../scripts/fix-trade-it-sdk-dts.mjs dist/index.d.ts dist/index.d.cts",
39
39
  "dev": "tsdown src/index.ts --format esm,cjs --dts --out-dir dist --watch",
40
+ "release:major": "node ../../scripts/release-trade-it-sdk.mjs core major",
41
+ "release:minor": "node ../../scripts/release-trade-it-sdk.mjs core minor",
42
+ "release:patch": "node ../../scripts/release-trade-it-sdk.mjs core patch",
40
43
  "test": "npm run build && tsc -p tsconfig.test.json --noEmit && node --test test/*.test.mjs",
41
44
  "prepublishOnly": "npm test"
42
45
  },