0.32.10 — take the two Polymarket SDK majors, on one verified baseline

CHANGELOG.md

@@ -2,6 +2,58 @@
 
 All notable changes to BlockRun MCP will be documented in this file.
 
+## 0.32.10
+
+Takes the two Polymarket SDK majors that had been sitting unreviewed, so the
+CLOB module and Franklin's port of it share one baseline again.
+
+- **`chore(deps)` — `@polymarket/clob-client-v2` 1.0.8 → 1.1.0.** `postOrder`
+  gained `waitForResolvedTrades`: when an order matches, the client now
+  back-fills the settlement transaction hashes of its fills, and the return type
+  tightens from `Promise<any>` to `Promise<OrderResponse>`. `orders.ts` already
+  read `transactionsHashes` and `tradeIDs` off the response, so this makes an
+  existing display path more often correct rather than changing it — `filled` and
+  the `tx:` line now resolve on matched orders instead of only when the server
+  happened to include them.
+
+  Verified against the shipped bundle rather than the release notes, because no
+  test here places an order: an unmatched order returns untouched with zero polls
+  and zero added latency (the resting-limit path is unaffected); a response that
+  already carries hashes short-circuits; `FAILED` trades are filtered out, so a
+  failed fill can never be reported as a settlement hash; and the worst case —
+  `getTrades` failing persistently — was measured end to end at **30.1 s**
+  (`RESOLVE_TRADES_TIMEOUT_MS`, 250 ms poll), after which it degrades and returns
+  the placed order rather than throwing. The added latency lands only on matched
+  orders, and it is bounded.
+
+- **`chore(deps)` — `@polymarket/builder-signing-sdk` 0.0.8 → 1.0.0, with an
+  override.** 1.0.0 is a pure CJS→ESM port: every non-import change in the bundle
+  is `exports.X` → `export` boilerplate, the HMAC signing logic is untouched, and
+  it drops `tslib` plus a stale `@types/node ^18` that should never have been a
+  runtime dependency.
+
+  It needs an `overrides` entry because `@polymarket/builder-relayer-client`
+  still pins `^0.0.8`, and a caret on `0.0.x` is patch-only under npm semver — so
+  without it npm installs a second copy, and both `BuilderConfig` declarations
+  carry a private `ensureValid`, which TypeScript compares nominally. Collapsing
+  to one copy is safe for a specific reason worth recording: relayer-client
+  **never requires the signing SDK at runtime**. It is a type-only dependency,
+  consumed by duck-typing (`builderConfig.generateBuilderHeaders()`,
+  `.isValid()`), with no `instanceof` check anywhere in its bundle, and nothing
+  else in the tree requires it either. The CJS/ESM seam was then exercised for
+  real: a 1.0.0 `BuilderConfig` handed to the CJS `RelayClient` produced correct
+  `POLY_BUILDER_*` headers across the boundary.
+
+  Note that npm `overrides` do not propagate to consumers, so an installed
+  `@blockrun/mcp` gets both copies on disk. That is harmless for the same reason
+  — nothing loads the nested one.
+
+Neither upgrade adds a transitive dependency: clob-client-v2's dependency set is
+identical between the two versions, and builder-signing-sdk's is strictly
+smaller. 250 tests, typecheck and build green, plus a CLI load smoke
+(`node dist/index.js --version`) since a broken module graph is exactly the class
+of failure 0.32.3 shipped.
+
 ## 0.32.9
 
 Closes the external-review backlog: all 8 findings from the Kimi K3 review

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blockrun/mcp",
-  "version": "0.32.9",
+  "version": "0.32.10",
   "mcpName": "io.github.BlockRunAI/blockrun-mcp",
   "description": "BlockRun MCP Server - Give your AI agent web search, deep research, prediction markets, and crypto data. Paid via x402 micropayments.",
   "type": "module",
@@ -56,8 +56,8 @@
     "@blockrun/llm": "^3.6.1",
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@polymarket/builder-relayer-client": "^0.0.10",
-    "@polymarket/builder-signing-sdk": "0.0.8",
-    "@polymarket/clob-client-v2": "1.0.8",
+    "@polymarket/builder-signing-sdk": "1.0.0",
+    "@polymarket/clob-client-v2": "1.1.0",
     "@solana/spl-token": "^0.4.14",
     "@solana/web3.js": "^1.98.4",
     "axios": "^1.18.1",
@@ -74,7 +74,8 @@
   "overrides": {
     "viem": {
       "ws": "8.21.0"
-    }
+    },
+    "@polymarket/builder-signing-sdk": "1.0.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",