@2bad/walt 2.0.0 → 2.1.1

package/README.md

@@ -21,6 +21,9 @@ npm install @2bad/walt
 
 ESM only. Requires Node.js 26 or later.
 
+`@2bad/walt/client` exports everything except `TelegramTokenSource`.
+It imports no Node.js API and no Telegram library, for runtimes such as Cloudflare Workers.
+
 ## Quick start
 
 ```ts
@@ -36,7 +39,7 @@ await source.disconnect()
 
 ## Examples
 
-- [Connecting](examples/connecting.md): Telegram credentials, token storage, retries and pacing
+- [Connecting](examples/connecting.md): Telegram credentials, token storage, refreshing without Telegram, retries and pacing
 - [Balances](examples/balances.md): accounts, portfolio, profit and loss, staked funds
 - [Prices](examples/prices.md): coin rates, charts and past prices
 - [Exchange](examples/exchange.md): available pairs, quotes, exchanges and limit orders
@@ -56,6 +59,12 @@ type TelegramTokenSource = {
   disconnect(): Promise<void>
 }
 
+new RefreshTokenSource(options: RefreshTokenSourceOptions)
+
+type RefreshTokenSource = {
+  token(rejected?: string): Promise<string>
+}
+
 new WaltClient(options: WaltClientOptions)
 
 type WaltClient = {

package/build/api/candles.d.ts

@@ -1,8 +1,9 @@
 export type CandleRequest = {
   /** `<currency>/USD/SPOT`, or `<base>/USD/PERP_TRADE` for a perps contract. */
   ticker: string;
-  /** Seen: `5m`, `15m`. */
+  /** Accepted: `1m`, `5m`, `15m`, `1h`, `4h`, `1d`, `1w`, `1mo`. */
   resolution: string;
+  /** At least 1. The whole batch may ask for 3000 candles at most. */
   limit: number;
 };
 export type Candle = {

package/build/bin/walt.js

@@ -46,6 +46,7 @@ const USAGE = `Usage: walt <command> [options]
 
 ${COMMANDS}
   login                     sign in to Telegram and print TG_SESSION
+  token                     sign in as a new device and print its token state as JSON
 
 Options:
   --json                    print JSON instead of a table
@@ -109,15 +110,26 @@ const session = process.env["TG_SESSION"];
 const apiId = Number(process.env["TG_API_ID"]);
 const apiHash = process.env["TG_API_HASH"];
 if (!session || !apiId || !apiHash) fail("set TG_API_ID, TG_API_HASH and TG_SESSION first (run `walt login` for the session)", 2);
+if (command === "token") console.log = console.error;
+let issued = null;
 const source = new TelegramTokenSource({
 	session: session ?? "",
 	apiId,
-	apiHash: apiHash ?? ""
+	apiHash: apiHash ?? "",
+	...command === "token" && { storage: {
+		load: async () => null,
+		save: async (state) => {
+			issued = state;
+		}
+	} }
 });
 const client = new WaltClient({ tokenProvider: (rejected) => source.token(rejected) });
 let exitCode = 0;
 try {
-	console.log(await run(client, command, args, values));
+	if (command === "token") {
+		await source.token();
+		stdout.write(`${JSON.stringify(issued)}\n`);
+	} else console.log(await run(client, command, args, values));
 } catch (error) {
 	if (error instanceof UsageError) {
 		console.error(`walt: ${error.message}\nRun \`walt --help\` for usage.`);

package/build/cli/run.d.ts

@@ -10,7 +10,7 @@ export type CliOptions = {
   closed?: boolean;
 };
 export declare class UsageError extends Error {}
-export declare const COMMANDS = "Commands:\n  balances                  every asset: spot, staked and held by limit orders\n  history [--monthly]       balance, deposits, withdrawals and P/L per day or month\n          [--from DATE]     start date, YYYY-MM-DD (default: 30 days or 12 months back)\n  transactions              latest transactions\n          [--asset SYM]     only this asset\n          [--limit N]       how many (default 20)\n  price SYM...              current price and change over 24h, 7d and 30d\n  quote FROM TO AMOUNT      what an exchange would give right now, without making it\n  orders [--all]            open limit orders, or every order with --all\n  perps [--closed]          open perpetual positions, or closed ones\n  earn [--all]              your earn stakes, or every active campaign with --all";
+export declare const COMMANDS = "Commands:\n  balances [--all]          every asset: spot, staked and held by limit orders,\n                            and with --all the ones worth less than 0.01\n  history [--monthly]       balance, deposits, withdrawals and P/L per day or month\n          [--from DATE]     start date, YYYY-MM-DD (default: 30 days or 12 months back)\n  transactions              latest transactions\n          [--asset SYM]     only this asset\n          [--limit N]       how many (default 20)\n  price SYM...              current price and change over 24h, 7d and 30d\n  quote FROM TO AMOUNT      what an exchange would give right now, without making it\n  orders [--all]            open limit orders, or every order with --all\n  perps [--closed]          open perpetual positions, or closed ones\n  earn [--all]              your earn stakes, or every active campaign with --all";
 /**
  * Runs one read-only command and returns what to print.
  *

package/build/cli/run.js

@@ -2,7 +2,8 @@ import { WaltRequestError } from "../transport.js";
 // source/cli/run.ts
 var UsageError = class extends Error {};
 const COMMANDS = `Commands:
-  balances                  every asset: spot, staked and held by limit orders
+  balances [--all]          every asset: spot, staked and held by limit orders,
+                            and with --all the ones worth less than 0.01
   history [--monthly]       balance, deposits, withdrawals and P/L per day or month
           [--from DATE]     start date, YYYY-MM-DD (default: 30 days or 12 months back)
   transactions              latest transactions
@@ -22,7 +23,7 @@ const trimmed = (value) => {
 	if (value === null || value === void 0 || value === "" || !Number.isFinite(parsed)) return "-";
 	return String(Number(parsed.toFixed(8)));
 };
-const significant = (value) => String(Number(value.toPrecision(8)));
+const significant = (value) => Number.isFinite(value) ? String(Number(value.toPrecision(8))) : "-";
 const percent = (value) => Number.isFinite(value) ? `${value >= 0 ? "+" : ""}${(value * 100).toFixed(2)}%` : "-";
 const change = (now, then) => then === void 0 || then === 0 ? "-" : percent(now / then - 1);
 const minute = (timestamp) => timestamp.slice(0, 16).replace("T", " ");
@@ -38,13 +39,15 @@ const positiveInteger = (value, fallback) => {
 	if (!Number.isSafeInteger(parsed) || parsed < 1) throw new UsageError(`--limit must be a whole number, got ${value}`);
 	return parsed;
 };
-const balances = async (client, fiat) => {
+const balances = async (client, fiat, options) => {
 	const data = await client.balances(fiat);
 	const total = Number(data.overall_available_balance_fiat_amount);
-	const rows = data.accounts.filter((account) => Number(account.total_balance) > 0).map((account) => ({
+	const held = data.accounts.filter((account) => Number(account.total_balance) > 0).map((account) => ({
 		account,
 		value: Number(account.available_balance_fiat_amount)
-	})).sort((a, b) => b.value - a.value).map(({ account, value }) => ({
+	}));
+	const shown = options.all ? held : held.filter(({ value }) => !(value < .005));
+	const rows = shown.sort((a, b) => b.value - a.value).map(({ account, value }) => ({
 		asset: account.currency,
 		kind: ACCOUNT_KINDS[account.account_type] ?? account.account_type.toLowerCase(),
 		amount: trimmed(account.total_balance),
@@ -78,7 +81,7 @@ const balances = async (client, fiat) => {
 			}
 		],
 		rows,
-		footer: [`total ${total.toFixed(2)} ${data.fiat_currency}`]
+		footer: [`total ${total.toFixed(2)} ${data.fiat_currency}`, ...shown.length < held.length ? [`${held.length - shown.length} worth less than 0.01 not shown, --all lists them`] : []]
 	};
 };
 const history = async (client, options) => {
@@ -168,7 +171,7 @@ const transactions = async (client, options) => {
 			time: minute(row.created_at),
 			type: row.type,
 			gateway: row.gateway,
-			amount: row.amount,
+			amount: trimmed(row.amount),
 			asset: row.currency,
 			status: row.status
 		}))
@@ -336,7 +339,7 @@ const orders = async (client, options) => {
 			fee: order.fee,
 			status: order.status
 		})),
-		footer: [`${held.toFixed(2)} held by open orders`]
+		footer: [`${held.toFixed(2)} USDT held by open orders`]
 	};
 };
 const perps = async (client, options) => {
@@ -397,13 +400,13 @@ const perps = async (client, options) => {
 			contract: position.contract_name,
 			side: position.side,
 			leverage: `${position.leverage}x`,
-			size: position.value_base,
-			entry: position.avg_entry_price,
+			size: trimmed(position.value_base),
+			entry: significant(Number(position.avg_entry_price)),
 			margin: fixed(position.margin_quote),
 			opened: minute(position.created_at),
 			closed: minute(position.updated_at),
-			mark: position.valuation.mark_price,
-			liquidation: fixed(position.liquidation_price, 4),
+			mark: significant(Number(position.valuation.mark_price)),
+			liquidation: significant(Number(position.liquidation_price)),
 			pnl: fixed(position.valuation.unrealized_pnl_quote)
 		}))
 	};
@@ -476,7 +479,7 @@ const run = async (client, command, args, options = {}) => {
 	let report;
 	switch (command) {
 		case "balances":
-			report = await balances(client, fiat);
+			report = await balances(client, fiat, options);
 			break;
 		case "history":
 			report = await history(client, options);

package/build/client.d.ts

@@ -28,9 +28,9 @@ export type Portfolio = {
   /** Spot balances above zero, largest fiat value first. */
   entries: PortfolioEntry[];
   entriesTotal: number;
-  /** The API's own total, which includes staked funds. */
+  /** `entriesTotal + staked`. */
   total: number;
-  /** `total - entriesTotal`, itemised by `earnCampaigns()`. */
+  /** What the API total counts beyond spot balances, itemised by `earnCampaigns()`. */
   staked: number;
   fiatCurrency: string;
 };
@@ -150,7 +150,7 @@ export declare class WaltClient {
   /**
    * OHLCV candles for several tickers in one request.
    *
-   * @param requests - One per series wanted.
+   * @param requests - One per series wanted, 20 at most.
    */
   candles(requests: CandleRequest[]): Promise<CandleSeries[]>;
   coinDetails(currency: string, fiatCurrency: FiatCurrency): Promise<CoinDetails>;
@@ -171,6 +171,9 @@ export declare class WaltClient {
    * @param request - The exchange, in the shape the API takes it.
    */
   createExchange(request: ExchangeRequest): Promise<Exchange>;
-  /** Non-zero spot balances against the API total, which also counts staked funds. */
+  /**
+   * Non-zero spot balances and the total, which also counts staked funds.
+   * A USD account is priced at the latest candle close, any other at the rates `accounts()` reports.
+   */
   portfolio(): Promise<Portfolio>;
 }

package/build/client.js

@@ -1,6 +1,7 @@
 import { Transport, WaltAuthError } from "./transport.js";
 // source/client.ts
 const BASE_URL = "https://walletbot.me";
+const CANDLE_BATCH_SIZE = 20;
 const calendarDate = (date) => [
 	date.getUTCFullYear(),
 	date.getUTCMonth() + 1,
@@ -271,7 +272,7 @@ var WaltClient = class {
 	/**
 	* OHLCV candles for several tickers in one request.
 	*
-	* @param requests - One per series wanted.
+	* @param requests - One per series wanted, 20 at most.
 	*/
 	async candles(requests) {
 		const { responses } = await this.transport.post("/kandelabr/public-api/v1/candles/batch", { requests });
@@ -317,12 +318,15 @@ var WaltClient = class {
 	createExchange(request) {
 		return this.transport.post("/api/v1/exchange/create_exchange/", request, 0);
 	}
-	/** Non-zero spot balances against the API total, which also counts staked funds. */
+	/**
+	* Non-zero spot balances and the total, which also counts staked funds.
+	* A USD account is priced at the latest candle close, any other at the rates `accounts()` reports.
+	*/
 	async portfolio() {
 		const data = await this.accounts();
 		if (!Array.isArray(data.accounts)) throw new Error("accounts response carries no accounts array");
-		const total = decimal(data.available_balance_total_fiat_amount);
-		if (total === null) throw new Error(`accounts total is not a number: ${String(data.available_balance_total_fiat_amount)}`);
+		const accountsTotal = decimal(data.available_balance_total_fiat_amount);
+		if (accountsTotal === null) throw new Error(`accounts total is not a number: ${String(data.available_balance_total_fiat_amount)}`);
 		const entries = [];
 		for (const account of data.accounts) {
 			const balance = decimal(account.available_balance);
@@ -336,12 +340,28 @@ var WaltClient = class {
 				fiatValue
 			});
 		}
+		const staked = accountsTotal - entries.reduce((sum, entry) => sum + entry.fiatValue, 0);
+		if (data.available_balance_total_fiat_currency === "USD") {
+			const requests = entries.map((entry) => ({
+				ticker: `${entry.currency}/USD/SPOT`,
+				resolution: "1m",
+				limit: 1
+			}));
+			const batches = Array.from({ length: Math.ceil(requests.length / CANDLE_BATCH_SIZE) }, (_, index) => requests.slice(index * CANDLE_BATCH_SIZE, (index + 1) * CANDLE_BATCH_SIZE));
+			const series = (await Promise.all(batches.map((batch) => this.candles(batch)))).flat();
+			const closes = new Map(series.map((item) => [item.ticker, decimal(item.candles.at(-1)?.c)]));
+			for (const entry of entries) {
+				const close = closes.get(`${entry.currency}/USD/SPOT`) ?? null;
+				if (close === null) throw new Error(`${entry.currency} has no candle price`);
+				entry.fiatValue = Number(entry.amount) * close;
+			}
+		}
 		const entriesTotal = entries.reduce((sum, entry) => sum + entry.fiatValue, 0);
 		return {
 			entries: entries.sort((a, b) => b.fiatValue - a.fiatValue),
 			entriesTotal,
-			total,
-			staked: total - entriesTotal,
+			total: entriesTotal + staked,
+			staked,
 			fiatCurrency: data.available_balance_total_fiat_currency
 		};
 	}

package/build/core.d.ts

@@ -0,0 +1,13 @@
+import { Account, AccountAction, AccountActions, AccountAddress, AccountsResponse, ChartPoint, Charts, Coin, CoinDetails, FiatCurrency, PriceAtTime, TradingHoursPeriod, TradingHoursState } from "./api/accounts.js";
+import { PnlPosition, PnlResponse, PnlTotals, PortfolioFlows, PortfolioHistory, PortfolioPeriod } from "./api/analytics.js";
+import { Balance, Balances } from "./api/balances.js";
+import { Candle, CandleRequest, CandleSeries } from "./api/candles.js";
+import { EarnAccessPolicy, EarnAccount, EarnAmount, EarnBonus, EarnCampaign, EarnCampaignsResponse, EarnDepegInfo, EarnInterestRate, EarnPayoutPool, EarnRate, EarnTransaction, EarnTransactionsPage } from "./api/earn.js";
+import { AvailableExchanges, Exchange, ExchangeQuote, ExchangeRequest } from "./api/exchange.js";
+import { LimitOrder, LimitOrderBounds, LimitOrderQuote, LimitOrderToken } from "./api/limit-orders.js";
+import { PerpContract, PerpOrder, PerpOrderStatus, PerpOrdersPage, PerpPosition, PerpPositionStatus, PerpSystemStatus } from "./api/perps.js";
+import { NormalizedTransaction, Transaction, TransactionDetails, TransactionGateway, TransactionLeg, TransactionsPage, normalizeTransaction } from "./api/transactions.js";
+import { Portfolio, PortfolioEntry, WaltClient, WaltClientOptions } from "./client.js";
+import { RefreshTokenSource, RefreshTokenSourceOptions, TokenState, TokenStorage } from "./refresh.js";
+import { WaltAuthError, WaltRequestError } from "./transport.js";
+export { type Account, type AccountAction, type AccountActions, type AccountAddress, type AccountsResponse, type AvailableExchanges, type Balance, type Balances, type Candle, type CandleRequest, type CandleSeries, type ChartPoint, type Charts, type Coin, type CoinDetails, type EarnAccessPolicy, type EarnAccount, type EarnAmount, type EarnBonus, type EarnCampaign, type EarnCampaignsResponse, type EarnDepegInfo, type EarnInterestRate, type EarnPayoutPool, type EarnRate, type EarnTransaction, type EarnTransactionsPage, type Exchange, type ExchangeQuote, type ExchangeRequest, type FiatCurrency, type LimitOrder, type LimitOrderBounds, type LimitOrderQuote, type LimitOrderToken, type NormalizedTransaction, type PerpContract, type PerpOrder, type PerpOrderStatus, type PerpOrdersPage, type PerpPosition, type PerpPositionStatus, type PerpSystemStatus, type PnlPosition, type PnlResponse, type PnlTotals, type Portfolio, type PortfolioEntry, type PortfolioFlows, type PortfolioHistory, type PortfolioPeriod, type PriceAtTime, RefreshTokenSource, type RefreshTokenSourceOptions, type TokenState, type TokenStorage, type TradingHoursPeriod, type TradingHoursState, type Transaction, type TransactionDetails, type TransactionGateway, type TransactionLeg, type TransactionsPage, WaltAuthError, WaltClient, type WaltClientOptions, WaltRequestError, normalizeTransaction };

package/build/core.js

@@ -0,0 +1,5 @@
+import { normalizeTransaction } from "./api/transactions.js";
+import { WaltClient } from "./client.js";
+import { RefreshTokenSource } from "./refresh.js";
+import { WaltAuthError, WaltRequestError } from "./transport.js";
+export { RefreshTokenSource, WaltAuthError, WaltClient, WaltRequestError, normalizeTransaction };

package/build/index.d.ts

@@ -8,6 +8,7 @@ import { LimitOrder, LimitOrderBounds, LimitOrderQuote, LimitOrderToken } from "
 import { PerpContract, PerpOrder, PerpOrderStatus, PerpOrdersPage, PerpPosition, PerpPositionStatus, PerpSystemStatus } from "./api/perps.js";
 import { NormalizedTransaction, Transaction, TransactionDetails, TransactionGateway, TransactionLeg, TransactionsPage, normalizeTransaction } from "./api/transactions.js";
 import { Portfolio, PortfolioEntry, WaltClient, WaltClientOptions } from "./client.js";
-import { TelegramTokenSource, TelegramTokenSourceOptions, TokenState, TokenStorage } from "./telegram/auth.js";
+import { RefreshTokenSource, RefreshTokenSourceOptions, TokenState, TokenStorage } from "./refresh.js";
 import { WaltAuthError, WaltRequestError } from "./transport.js";
-export { type Account, type AccountAction, type AccountActions, type AccountAddress, type AccountsResponse, type AvailableExchanges, type Balance, type Balances, type Candle, type CandleRequest, type CandleSeries, type ChartPoint, type Charts, type Coin, type CoinDetails, type EarnAccessPolicy, type EarnAccount, type EarnAmount, type EarnBonus, type EarnCampaign, type EarnCampaignsResponse, type EarnDepegInfo, type EarnInterestRate, type EarnPayoutPool, type EarnRate, type EarnTransaction, type EarnTransactionsPage, type Exchange, type ExchangeQuote, type ExchangeRequest, type FiatCurrency, type LimitOrder, type LimitOrderBounds, type LimitOrderQuote, type LimitOrderToken, type NormalizedTransaction, type PerpContract, type PerpOrder, type PerpOrderStatus, type PerpOrdersPage, type PerpPosition, type PerpPositionStatus, type PerpSystemStatus, type PnlPosition, type PnlResponse, type PnlTotals, type Portfolio, type PortfolioEntry, type PortfolioFlows, type PortfolioHistory, type PortfolioPeriod, type PriceAtTime, TelegramTokenSource, type TelegramTokenSourceOptions, type TokenState, type TokenStorage, type TradingHoursPeriod, type TradingHoursState, type Transaction, type TransactionDetails, type TransactionGateway, type TransactionLeg, type TransactionsPage, WaltAuthError, WaltClient, type WaltClientOptions, WaltRequestError, normalizeTransaction };
+import { TelegramTokenSource, TelegramTokenSourceOptions } from "./telegram/auth.js";
+export { type Account, type AccountAction, type AccountActions, type AccountAddress, type AccountsResponse, type AvailableExchanges, type Balance, type Balances, type Candle, type CandleRequest, type CandleSeries, type ChartPoint, type Charts, type Coin, type CoinDetails, type EarnAccessPolicy, type EarnAccount, type EarnAmount, type EarnBonus, type EarnCampaign, type EarnCampaignsResponse, type EarnDepegInfo, type EarnInterestRate, type EarnPayoutPool, type EarnRate, type EarnTransaction, type EarnTransactionsPage, type Exchange, type ExchangeQuote, type ExchangeRequest, type FiatCurrency, type LimitOrder, type LimitOrderBounds, type LimitOrderQuote, type LimitOrderToken, type NormalizedTransaction, type PerpContract, type PerpOrder, type PerpOrderStatus, type PerpOrdersPage, type PerpPosition, type PerpPositionStatus, type PerpSystemStatus, type PnlPosition, type PnlResponse, type PnlTotals, type Portfolio, type PortfolioEntry, type PortfolioFlows, type PortfolioHistory, type PortfolioPeriod, type PriceAtTime, RefreshTokenSource, type RefreshTokenSourceOptions, TelegramTokenSource, type TelegramTokenSourceOptions, type TokenState, type TokenStorage, type TradingHoursPeriod, type TradingHoursState, type Transaction, type TransactionDetails, type TransactionGateway, type TransactionLeg, type TransactionsPage, WaltAuthError, WaltClient, type WaltClientOptions, WaltRequestError, normalizeTransaction };

package/build/index.js

@@ -1,5 +1,6 @@
-import { normalizeTransaction } from "./api/transactions.js";
+import { WaltAuthError, WaltRequestError } from "./transport.js";
 import { WaltClient } from "./client.js";
+import { normalizeTransaction } from "./api/transactions.js";
+import { RefreshTokenSource } from "./refresh.js";
 import { TelegramTokenSource } from "./telegram/auth.js";
-import { WaltAuthError, WaltRequestError } from "./transport.js";
-export { TelegramTokenSource, WaltAuthError, WaltClient, WaltRequestError, normalizeTransaction };
+export { RefreshTokenSource, TelegramTokenSource, WaltAuthError, WaltClient, WaltRequestError, normalizeTransaction };

package/build/refresh.d.ts

@@ -0,0 +1,60 @@
+export type TokenState = {
+  jwt: string;
+  refreshToken: string;
+  sessionId: string;
+  expiresAt: number;
+  deviceSerial: string;
+};
+export type TokenStorage = {
+  load: () => Promise<TokenState | null>;
+  save: (state: TokenState) => Promise<void>;
+};
+export type RefreshTokenSourceOptions = {
+  /** Where to start. Without it the state comes from `storage.load()`. */
+  state?: TokenState;
+  /** `save` receives the new state after every renewal, rotated refresh token included. */
+  storage?: TokenStorage | undefined;
+  /** Origin of the web app, sent as `origin` and `referer`. */
+  baseUrl?: string | undefined;
+  /** Where the refresh requests go. */
+  authUrl?: string | undefined;
+  fetch?: typeof fetch | undefined;
+};
+export type AuthResponse = {
+  jwt: string;
+  refresh_token: string;
+  session_id: string;
+  access_token_expires_at: string;
+  access_token_expires_in: number;
+};
+/**
+ * Renews the access token from a stored refresh token over HTTPS, without Telegram.
+ * Throws `WaltAuthError` once the refresh token is rejected; a new token state is then needed.
+ */
+export declare class RefreshTokenSource {
+  protected readonly baseUrl: string;
+  protected readonly storage: TokenStorage | undefined;
+  protected state: TokenState | null;
+  private readonly authUrl;
+  private readonly fetchImpl;
+  private restored;
+  private pending;
+  constructor(options: RefreshTokenSourceOptions);
+  /**
+   * @param rejected - A token the API answered with 401. If it is the cached one, it is renewed even before expiry.
+   */
+  token(rejected?: string): Promise<string>;
+  private fresh;
+  private resolve;
+  private restore;
+  /**
+   * Called when there is no refresh token to use, or the server rejected it.
+   *
+   * @param cause - The rejection, if there was one.
+   * @returns The new jwt.
+   */
+  protected signIn(cause?: unknown): Promise<string>;
+  private refresh;
+  protected post(path: string, body: Record<string, unknown>): Promise<AuthResponse>;
+  protected store(data: AuthResponse, deviceSerial: string): Promise<string>;
+}

package/build/refresh.js

@@ -0,0 +1,131 @@
+import { BROWSER_HEADERS } from "./browser.js";
+import { WaltAuthError } from "./transport.js";
+// source/refresh.ts
+const BASE_URL = "https://walletbot.me";
+const AUTH_URL = "https://alectryon.walletbot.me";
+const EXPIRY_SKEW_MS = 3e4;
+var AuthEndpointError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+const isRejection = (error) => error instanceof AuthEndpointError && error.status >= 400 && error.status < 500 && error.status !== 429;
+/**
+* Renews the access token from a stored refresh token over HTTPS, without Telegram.
+* Throws `WaltAuthError` once the refresh token is rejected; a new token state is then needed.
+*/
+var RefreshTokenSource = class {
+	baseUrl;
+	storage;
+	state;
+	authUrl;
+	fetchImpl;
+	restored;
+	pending = null;
+	constructor(options) {
+		this.state = options.state ?? null;
+		this.storage = options.storage;
+		this.restored = options.state !== void 0;
+		this.baseUrl = options.baseUrl ?? BASE_URL;
+		this.authUrl = options.authUrl ?? AUTH_URL;
+		this.fetchImpl = options.fetch ?? fetch;
+	}
+	/**
+	* @param rejected - A token the API answered with 401. If it is the cached one, it is renewed even before expiry.
+	*/
+	async token(rejected) {
+		if (this.state && rejected !== void 0 && rejected === this.state.jwt) this.state = {
+			...this.state,
+			expiresAt: 0
+		};
+		if (this.state && this.fresh(this.state)) return this.state.jwt;
+		this.pending ??= this.resolve();
+		try {
+			return await this.pending;
+		} finally {
+			this.pending = null;
+		}
+	}
+	fresh(state) {
+		return Date.now() < state.expiresAt - EXPIRY_SKEW_MS;
+	}
+	async resolve() {
+		await this.restore();
+		const state = this.state;
+		if (state && this.fresh(state)) return state.jwt;
+		if (state?.refreshToken) try {
+			return await this.refresh(state);
+		} catch (error) {
+			if (!isRejection(error)) throw error;
+			this.state = {
+				...state,
+				refreshToken: ""
+			};
+			return this.signIn(error);
+		}
+		return this.signIn();
+	}
+	async restore() {
+		if (this.restored || !this.storage) return;
+		this.restored = true;
+		this.state = await this.storage.load();
+	}
+	/**
+	* Called when there is no refresh token to use, or the server rejected it.
+	*
+	* @param cause - The rejection, if there was one.
+	* @returns The new jwt.
+	*/
+	signIn(cause) {
+		const message = this.state ? "refresh token rejected, a new token state is needed" : "no token state to refresh";
+		return Promise.reject(new WaltAuthError(message, { cause }));
+	}
+	async refresh(state) {
+		const data = await this.post("/alectryon/public-api/auth-refresh", {
+			session_id: state.sessionId,
+			refresh_token: state.refreshToken,
+			device_serial: state.deviceSerial
+		});
+		return this.store(data, state.deviceSerial);
+	}
+	async post(path, body) {
+		const { fetchImpl } = this;
+		const response = await fetchImpl(`${this.authUrl}${path}`, {
+			method: "POST",
+			headers: {
+				...BROWSER_HEADERS,
+				accept: "*/*",
+				"sec-fetch-site": new URL(this.authUrl).origin === new URL(this.baseUrl).origin ? "same-origin" : "same-site",
+				"content-type": "application/json",
+				origin: this.baseUrl,
+				referer: `${this.baseUrl}/`,
+				"x-wallet-tz-name": Intl.DateTimeFormat().resolvedOptions().timeZone,
+				"x-wallet-tz-offset": String(-(/* @__PURE__ */ new Date()).getTimezoneOffset())
+			},
+			body: JSON.stringify(body)
+		});
+		if (!response.ok) throw new AuthEndpointError(`${path} failed (${response.status}): ${await response.text()}`, response.status);
+		return await response.json();
+	}
+	async store(data, deviceSerial) {
+		let expiresAt;
+		if (Number.isFinite(data.access_token_expires_in)) expiresAt = Date.now() + data.access_token_expires_in * 1e3;
+		else {
+			const parsed = Date.parse(data.access_token_expires_at);
+			expiresAt = Number.isNaN(parsed) ? Date.now() + 3e5 : parsed;
+		}
+		const state = {
+			jwt: data.jwt,
+			refreshToken: data.refresh_token,
+			sessionId: data.session_id,
+			expiresAt,
+			deviceSerial
+		};
+		this.state = state;
+		await this.storage?.save(state);
+		return state.jwt;
+	}
+};
+export { RefreshTokenSource };

package/build/telegram/auth.d.ts

@@ -1,14 +1,4 @@
-export type TokenState = {
-  jwt: string;
-  refreshToken: string;
-  sessionId: string;
-  expiresAt: number;
-  deviceSerial: string;
-};
-export type TokenStorage = {
-  load: () => Promise<TokenState | null>;
-  save: (state: TokenState) => Promise<void>;
-};
+import { RefreshTokenSource, TokenStorage } from "../refresh.js";
 export type TelegramTokenSourceOptions = {
   session: string;
   apiId: number;
@@ -24,34 +14,15 @@ export type TelegramTokenSourceOptions = {
   storage?: TokenStorage | false;
   maxFloodWaitMs?: number;
 };
-export declare class TelegramTokenSource {
+/** Signs in over Telegram, then renews like `RefreshTokenSource`, signing in again when the refresh token is rejected. */
+export declare class TelegramTokenSource extends RefreshTokenSource {
   private readonly client;
   private readonly bot;
-  private readonly baseUrl;
-  private readonly authUrl;
-  private readonly fetchImpl;
-  private readonly storage;
   private readonly maxFloodWaitMs;
-  private deviceSerial;
-  private deviceSerialKnown;
-  private jwt;
-  private refreshToken;
-  private sessionId;
-  private expiresAt;
-  private restored;
-  private pending;
+  private readonly knownDeviceSerial;
+  private readonly newDeviceSerial;
   constructor(options: TelegramTokenSourceOptions);
-  /**
-   * @param rejected - A token the API answered with 401. If it is the cached one, it is renewed even before expiry.
-   */
-  token(rejected?: string): Promise<string>;
-  private fresh;
-  private resolve;
-  private restore;
-  private authenticate;
+  protected signIn(): Promise<string>;
   private requestInitData;
-  private refresh;
-  private post;
-  private store;
   disconnect(): Promise<void>;
 }

package/build/telegram/auth.js

@@ -1,97 +1,40 @@
-import { BROWSER_HEADERS } from "../browser.js";
+import { RefreshTokenSource } from "../refresh.js";
 import { defaultTokenPath, fileTokenStorage } from "./file-storage.js";
 import { Api, TelegramClient, errors } from "teleproto";
 import { StringSession } from "teleproto/sessions/index.js";
 // source/telegram/auth.ts
-const BASE_URL = "https://walletbot.me";
-const AUTH_URL = "https://alectryon.walletbot.me";
-const EXPIRY_SKEW_MS = 3e4;
 const MAX_FLOOD_WAIT_MS = 6e4;
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-var AuthEndpointError = class extends Error {
-	status;
-	constructor(message, status) {
-		super(message);
-		this.status = status;
-	}
-};
-var TelegramTokenSource = class {
+/** Signs in over Telegram, then renews like `RefreshTokenSource`, signing in again when the refresh token is rejected. */
+var TelegramTokenSource = class extends RefreshTokenSource {
 	client;
 	bot;
-	baseUrl;
-	authUrl;
-	fetchImpl;
-	storage;
 	maxFloodWaitMs;
-	deviceSerial;
-	deviceSerialKnown;
-	jwt = null;
-	refreshToken = null;
-	sessionId = null;
-	expiresAt = 0;
-	restored = false;
-	pending = null;
+	knownDeviceSerial;
+	newDeviceSerial = `weba:${crypto.randomUUID()}`;
 	constructor(options) {
+		super({
+			storage: options.storage === false ? void 0 : options.storage ?? fileTokenStorage(defaultTokenPath(options.session)),
+			baseUrl: options.baseUrl,
+			authUrl: options.authUrl,
+			fetch: options.fetch
+		});
 		this.client = new TelegramClient(new StringSession(options.session), options.apiId, options.apiHash, { connectionRetries: 3 });
 		this.bot = options.bot ?? "walt";
-		this.deviceSerial = options.deviceSerial ?? `weba:${crypto.randomUUID()}`;
-		this.deviceSerialKnown = options.deviceSerial !== void 0;
-		this.baseUrl = options.baseUrl ?? BASE_URL;
-		this.authUrl = options.authUrl ?? AUTH_URL;
-		this.fetchImpl = options.fetch ?? fetch;
-		this.storage = options.storage === false ? void 0 : options.storage ?? fileTokenStorage(defaultTokenPath(options.session));
+		this.knownDeviceSerial = options.deviceSerial;
 		this.maxFloodWaitMs = options.maxFloodWaitMs ?? MAX_FLOOD_WAIT_MS;
 	}
-	/**
-	* @param rejected - A token the API answered with 401. If it is the cached one, it is renewed even before expiry.
-	*/
-	async token(rejected) {
-		if (rejected !== void 0 && rejected === this.jwt) this.expiresAt = 0;
-		if (this.fresh()) return this.jwt;
-		this.pending ??= this.resolve();
-		try {
-			return await this.pending;
-		} finally {
-			this.pending = null;
-		}
-	}
-	fresh() {
-		return this.jwt !== null && Date.now() < this.expiresAt - EXPIRY_SKEW_MS;
-	}
-	async resolve() {
-		await this.restore();
-		if (this.fresh()) return this.jwt;
-		if (this.refreshToken) try {
-			return await this.refresh();
-		} catch (error) {
-			if (!(error instanceof AuthEndpointError && error.status >= 400 && error.status < 500 && error.status !== 429)) throw error;
-			this.refreshToken = null;
-		}
-		return this.authenticate();
-	}
-	async restore() {
-		if (this.restored || !this.storage) return;
-		this.restored = true;
-		const state = await this.storage.load();
-		if (!state) return;
-		this.jwt = state.jwt;
-		this.refreshToken = state.refreshToken;
-		this.sessionId = state.sessionId;
-		this.expiresAt = state.expiresAt;
-		this.deviceSerial = state.deviceSerial;
-		this.deviceSerialKnown = true;
-	}
-	async authenticate() {
+	async signIn() {
 		const initData = await this.requestInitData();
-		const serial = this.deviceSerialKnown ? { device_serial: this.deviceSerial } : { device_serial_fallback: this.deviceSerial };
-		const token = await this.store(await this.post("/alectryon/public-api/auth", {
+		const known = this.state?.deviceSerial ?? this.knownDeviceSerial;
+		const serial = known === void 0 ? { device_serial_fallback: this.newDeviceSerial } : { device_serial: known };
+		const data = await this.post("/alectryon/public-api/auth", {
 			web_view_init_data_raw: initData,
 			ep: "menu",
 			device_serial_multi_domain_backup_supported: true,
 			...serial
-		}));
-		this.deviceSerialKnown = true;
-		return token;
+		});
+		return this.store(data, known ?? this.newDeviceSerial);
 	}
 	async requestInitData(retryAfterFlood = true) {
 		if (!this.client.connected) await this.client.connect();
@@ -114,49 +57,6 @@ var TelegramTokenSource = class {
 		if (!initData) throw new Error("no tgWebAppData in web view url");
 		return initData;
 	}
-	async refresh() {
-		return this.store(await this.post("/alectryon/public-api/auth-refresh", {
-			session_id: this.sessionId,
-			refresh_token: this.refreshToken,
-			device_serial: this.deviceSerial
-		}));
-	}
-	async post(path, body) {
-		const response = await this.fetchImpl(`${this.authUrl}${path}`, {
-			method: "POST",
-			headers: {
-				...BROWSER_HEADERS,
-				accept: "*/*",
-				"sec-fetch-site": new URL(this.authUrl).origin === new URL(this.baseUrl).origin ? "same-origin" : "same-site",
-				"content-type": "application/json",
-				origin: this.baseUrl,
-				referer: `${this.baseUrl}/`,
-				"x-wallet-tz-name": Intl.DateTimeFormat().resolvedOptions().timeZone,
-				"x-wallet-tz-offset": String(-(/* @__PURE__ */ new Date()).getTimezoneOffset())
-			},
-			body: JSON.stringify(body)
-		});
-		if (!response.ok) throw new AuthEndpointError(`${path} failed (${response.status}): ${await response.text()}`, response.status);
-		return await response.json();
-	}
-	async store(data) {
-		this.jwt = data.jwt;
-		this.refreshToken = data.refresh_token;
-		this.sessionId = data.session_id;
-		if (Number.isFinite(data.access_token_expires_in)) this.expiresAt = Date.now() + data.access_token_expires_in * 1e3;
-		else {
-			const parsed = Date.parse(data.access_token_expires_at);
-			this.expiresAt = Number.isNaN(parsed) ? Date.now() + 3e5 : parsed;
-		}
-		await this.storage?.save({
-			jwt: this.jwt,
-			refreshToken: this.refreshToken,
-			sessionId: this.sessionId,
-			expiresAt: this.expiresAt,
-			deviceSerial: this.deviceSerial
-		});
-		return this.jwt;
-	}
 	async disconnect() {
 		await this.client.disconnect();
 	}

package/build/telegram/file-storage.d.ts

@@ -1,3 +1,3 @@
-import { TokenStorage } from "./auth.js";
+import { TokenStorage } from "../refresh.js";
 export declare const defaultTokenPath: (session: string) => string;
 export declare const fileTokenStorage: (path: string) => TokenStorage;

package/build/transport.js

@@ -1,5 +1,4 @@
 import { BROWSER_HEADERS, SENTRY_PUBLIC_KEY, SENTRY_RELEASE } from "./browser.js";
-import { randomBytes } from "node:crypto";
 // source/transport.ts
 var WaltAuthError = class extends Error {};
 var WaltRequestError = class extends Error {
@@ -29,7 +28,7 @@ const BEARER_SERVICES = [
 	"/kandelabr/"
 ];
 const MAX_RETRY_DELAY_MS = 3e4;
-const hex = (bytes) => randomBytes(bytes).toString("hex");
+const hex = (bytes) => Array.from(crypto.getRandomValues(new Uint8Array(bytes)), (byte) => byte.toString(16).padStart(2, "0")).join("");
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const parseBody = (text) => {
 	try {
@@ -44,8 +43,9 @@ const retryAfterOf = (response) => {
 };
 const telegramUserIdOf = (token) => {
 	try {
-		const payload = token.split(".")[1] ?? "";
-		const id = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")).web_view_init_data?.user?.id;
+		const payload = (token.split(".")[1] ?? "").replaceAll("-", "+").replaceAll("_", "/");
+		const bytes = Uint8Array.from(atob(payload), (char) => char.charCodeAt(0));
+		const id = JSON.parse(new TextDecoder().decode(bytes)).web_view_init_data?.user?.id;
 		return typeof id === "number" ? id : null;
 	} catch {
 		return null;
@@ -136,9 +136,10 @@ var Transport = class {
 			headers["content-type"] = "application/json";
 			headers["origin"] = this.baseUrl;
 		}
+		const { fetchImpl } = this;
 		let response;
 		try {
-			response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+			response = await fetchImpl(`${this.baseUrl}${path}`, {
 				method,
 				headers,
 				body: method === "POST" ? JSON.stringify(body) : null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@2bad/walt",
-  "version": "2.0.0",
+  "version": "2.1.1",
   "description": "Client for the Walt (ex. Wallet) API in Telegram to track a crypto portfolio and exchange between assets",
   "keywords": [
     "telegram",
@@ -33,6 +33,12 @@
         "types": "./build/index.d.ts",
         "default": "./build/index.js"
       }
+    },
+    "./client": {
+      "import": {
+        "types": "./build/core.d.ts",
+        "default": "./build/core.js"
+      }
     }
   },
   "bin": {
@@ -42,28 +48,28 @@
     "build"
   ],
   "dependencies": {
-    "teleproto": "1.232.0"
+    "teleproto": "1.232.1"
   },
   "devDependencies": {
     "@2bad/axiom": "2.1.0",
     "@2bad/tsconfig": "4.0.0",
     "@arethetypeswrong/cli": "0.18.5",
     "@types/node": "26.6.6",
-    "@vitest/coverage-v8": "5.0.5",
+    "@vitest/coverage-v8": "5.1.0",
     "npm-run-all2": "9.0.4",
-    "oxfmt": "0.75.0",
-    "oxlint": "1.90.0",
+    "oxfmt": "0.76.0",
+    "oxlint": "1.91.0",
     "publint": "0.3.25",
-    "tsdown": "0.23.4",
+    "tsdown": "0.23.5",
     "typescript": "7.0.2",
-    "vitest": "5.0.5"
+    "vitest": "5.1.0"
   },
   "engines": {
     "node": ">=26"
   },
   "volta": {
     "node": "26.13.0",
-    "pnpm": "12.16.1"
+    "pnpm": "12.18.0"
   },
   "scripts": {
     "build": "tsdown",