Discord line-move alerts

import { createServer } from "node:http";
import { verifySignature } from "@0xinsider/sdk";

const SECRET = process.env.OXINSIDER_WEBHOOK_SECRET ?? "";
const DISCORD_URL = process.env.DISCORD_WEBHOOK_URL ?? "";
const PORT = Number(process.env.PORT ?? 8787);
if (!SECRET || !DISCORD_URL) {
  throw new Error("Set OXINSIDER_WEBHOOK_SECRET and DISCORD_WEBHOOK_URL");
}

// The fields of a market_price_moved delivery this server reads.
interface PriceMove {
  event_slug: string | null;
  label: string | null;
  direction: "up" | "down";
  from_price: string;
  to_price: string;
  move_cents: string;
  window_seconds: number;
  detected_at: string;
  spread_cents: string;
  phase: "pre_game" | "in_play" | "unknown";
  book_depth_within_2c: { bid_usd: string; ask_usd: string } | null;
  concurrent_sharp_flow: {
    detected: boolean;
    net_flow_usd: number;
    ranked_large_trades: number;
    large_trades_in_window: number;
  } | null;
}

// Event ids already posted. A retry of the same event carries the same id.
const posted = new Set<string>();
function remember(id: string): void {
  posted.add(id);
  if (posted.size > 1000) posted.delete(posted.values().next().value!);
}

function usd(value: string | number): string {
  const amount = Math.round(Number(value));
  return `${amount < 0 ? "-" : ""}$${Math.abs(amount).toLocaleString("en-US")}`;
}

function message(move: PriceMove): string {
  const name = move.label ?? move.event_slug ?? "Market";
  const cents = Math.abs(Number(move.move_cents)).toFixed(1);
  const minutes = move.window_seconds / 60;
  const phase = { pre_game: "before the game", in_play: "in play", unknown: "phase unknown" }[move.phase];
  const book = move.book_depth_within_2c;
  const flow = move.concurrent_sharp_flow;
  const lines = [
    `**${name}** ${move.direction} ${cents}c in ${minutes} min, ${move.from_price} to ${move.to_price} (${phase})`,
    `Spread ${move.spread_cents}c. Within 2c: ${book ? `${usd(book.bid_usd)} bid, ${usd(book.ask_usd)} ask` : "not measured"}.`,
  ];
  if (flow) {
    lines.push(
      `Large trades in the window: ${flow.large_trades_in_window}, ${flow.ranked_large_trades} of them by B-or-better wallets, net ${usd(flow.net_flow_usd)}${flow.detected ? ", with the move" : ""}.`,
    );
  }
  lines.push(`Detected <t:${Math.floor(Date.parse(move.detected_at) / 1000)}:R>`);
  if (move.event_slug) lines.push(`https://0xinsider.com/event/${move.event_slug}`);
  return lines.join("\n");
}

createServer(async (req, res) => {
  if (req.method !== "POST") {
    res.writeHead(405).end();
    return;
  }
  const chunks: Buffer[] = [];
  for await (const chunk of req) chunks.push(chunk as Buffer);
  const body = Buffer.concat(chunks);

  // Verify the raw bytes before parsing: re-serialized JSON no longer matches the signature.
  const signed = verifySignature({
    secret: SECRET,
    timestamp: String(req.headers["x-0xinsider-timestamp"] ?? ""),
    signature: String(req.headers["x-0xinsider-signature"] ?? ""),
    body,
  });
  if (!signed) {
    res.writeHead(401).end();
    return;
  }

  // The verification challenge, other event types and repeats are acknowledged and not posted.
  const event = JSON.parse(body.toString("utf8"));
  if (event.type !== "market_price_moved" || posted.has(event.id)) {
    res.writeHead(204).end();
    return;
  }

  const sent = await fetch(`${DISCORD_URL}?wait=true`, {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify({ content: message(event.data as PriceMove), allowed_mentions: { parse: [] } }),
  });
  if (sent.ok) {
    remember(event.id);
    res.writeHead(204).end();
    return;
  }
  // Discord refused or rate-limited the post. A 503 makes 0xinsider retry this delivery.
  const retryAfter = sent.headers.get("retry-after");
  res.writeHead(503, retryAfter ? { "retry-after": retryAfter } : {}).end();
}).listen(PORT, () => console.log(`listening on ${PORT}`));