@cexyio/cexy 0.1.0-dev.0

package/dist/index.js

@@ -0,0 +1,1752 @@
+// src/errors.ts
+var CexyError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = new.target.name;
+  }
+};
+var CexyConfigError = class extends CexyError {
+};
+var InvalidAmountError = class extends CexyError {
+  field;
+  constructor(field, message) {
+    super(message);
+    this.field = field;
+  }
+};
+var CexyConnectionError = class extends CexyError {
+  retryable = true;
+};
+var CexyTimeoutError = class extends CexyConnectionError {
+};
+var OrderStateUnknownError = class extends CexyError {
+  clientOrderId;
+  constructor(clientOrderId, cause) {
+    super(
+      `order state unknown for client_order_id ${clientOrderId}; check trading.orderByClientId() before retrying`,
+      { cause }
+    );
+    this.clientOrderId = clientOrderId;
+  }
+};
+var CexyApiError = class extends CexyError {
+  status;
+  code;
+  details;
+  fields;
+  requestId;
+  retryable;
+  constructor(init) {
+    super(init.message);
+    this.status = init.status;
+    this.code = init.code;
+    this.details = init.details ?? {};
+    this.fields = init.fields ?? {};
+    this.requestId = init.requestId ?? null;
+    this.retryable = init.retryable;
+  }
+  toString() {
+    const rid = this.requestId ? ` (request_id ${this.requestId})` : "";
+    return `${this.name}: [${this.status} ${this.code}] ${this.message}${rid}`;
+  }
+};
+var AuthenticationError = class extends CexyApiError {
+};
+var ForbiddenError = class extends CexyApiError {
+};
+var NotFoundError = class extends CexyApiError {
+};
+var ValidationError = class extends CexyApiError {
+};
+var ConflictError = class extends CexyApiError {
+};
+var UnprocessableError = class extends CexyApiError {
+};
+var RateLimitError = class extends CexyApiError {
+  retryAfterMs;
+  constructor(init, retryAfterMs2) {
+    super(init);
+    this.retryAfterMs = retryAfterMs2;
+  }
+};
+var ServerError = class extends CexyApiError {
+};
+var STATUS_CLASSES = {
+  400: ValidationError,
+  401: AuthenticationError,
+  403: ForbiddenError,
+  404: NotFoundError,
+  451: ForbiddenError,
+  // unavailable for legal reasons (JURISDICTION_BLOCKED)
+  409: ConflictError,
+  422: UnprocessableError
+};
+var KNOWN_CODES = /* @__PURE__ */ new Set([
+  "VALIDATION_FAILED",
+  "MALFORMED_REQUEST",
+  "INVALID_CURSOR",
+  "PRECISION_EXCEEDED",
+  "BELOW_MINIMUM",
+  "ABOVE_MAXIMUM",
+  "INVALID_ADDRESS",
+  "MEMO_REQUIRED",
+  "UNAUTHENTICATED",
+  "INVALID_CREDENTIALS",
+  "TOKEN_EXPIRED",
+  "SESSION_REVOKED",
+  "TWO_FACTOR_REQUIRED",
+  "TWO_FACTOR_INVALID",
+  "FRESH_TWO_FACTOR_REQUIRED",
+  "FORBIDDEN",
+  "API_KEY_NOT_ALLOWED",
+  "FUTURES_RESTRICTED",
+  "ACCOUNT_FROZEN",
+  "ACCOUNT_ON_HOLD",
+  "EMAIL_NOT_VERIFIED",
+  "REGION_BLOCKED",
+  "JURISDICTION_BLOCKED",
+  "NOT_FOUND",
+  "METHOD_NOT_ALLOWED",
+  "ALREADY_EXISTS",
+  "INVALID_STATE",
+  "IDEMPOTENCY_KEY_CONFLICT",
+  "WINDOW_OPEN",
+  "EVIDENCE_CONTRADICTS",
+  "AMOUNT_MISMATCH",
+  "CONCURRENT_MODIFICATION",
+  "INSUFFICIENT_FUNDS",
+  "INSUFFICIENT_FEE_FUNDS",
+  "MARKET_UNAVAILABLE",
+  "DEPOSIT_DISABLED",
+  "WITHDRAWAL_DISABLED",
+  "SELF_TRADE_BLOCKED",
+  "LIMIT_EXCEEDED",
+  "RATE_LIMITED",
+  "INTERNAL",
+  "SERVICE_UNAVAILABLE",
+  "UNDER_MAINTENANCE",
+  "ENGINE_OVERLOADED"
+]);
+function isKnownErrorCode(code) {
+  return KNOWN_CODES.has(code);
+}
+var DEFAULT_RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 429, 500, 502, 503, 504]);
+function retryAfterMs(headers, details) {
+  let best = null;
+  const h = headers?.get("retry-after");
+  if (h) {
+    const secs = Number(h);
+    if (Number.isFinite(secs)) best = Math.max(0, secs * 1e3);
+    else {
+      const at = Date.parse(h);
+      if (!Number.isNaN(at)) best = Math.max(0, at - Date.now());
+    }
+  }
+  const d = details?.["retry_after_seconds"];
+  const ds = typeof d === "number" ? d : typeof d === "string" ? Number(d) : NaN;
+  if (Number.isFinite(ds)) best = Math.max(best ?? 0, ds * 1e3);
+  return best;
+}
+function errorFromResponse(status, body, headers, redact = (t) => t) {
+  const env = extractEnvelope(body);
+  if (env) env.message = redact(env.message);
+  const init = env ? {
+    status,
+    code: env.code,
+    message: env.message,
+    details: env.details,
+    fields: env.fields,
+    requestId: env.request_id ?? headers?.get("x-request-id") ?? null,
+    retryable: typeof env.retryable === "boolean" ? env.retryable : DEFAULT_RETRYABLE_STATUS.has(status),
+    headers
+  } : {
+    status,
+    code: `HTTP_${status}`,
+    message: `HTTP ${status}`,
+    requestId: headers?.get("x-request-id") ?? null,
+    retryable: DEFAULT_RETRYABLE_STATUS.has(status),
+    headers
+  };
+  if (status === 429 || init.code === "RATE_LIMITED") {
+    return new RateLimitError(init, retryAfterMs(headers, init.details));
+  }
+  if (env && !isKnownErrorCode(env.code)) return new CexyApiError(init);
+  if (status >= 500) return new ServerError(init);
+  const Cls = STATUS_CLASSES[status] ?? CexyApiError;
+  return new Cls(init);
+}
+function extractEnvelope(body) {
+  if (!body || typeof body !== "object") return null;
+  const e = body.error;
+  if (!e || typeof e !== "object") return null;
+  const o = e;
+  if (typeof o["code"] !== "string") return null;
+  return {
+    code: o["code"],
+    message: typeof o["message"] === "string" ? o["message"] : o["code"],
+    details: isRecord(o["details"]) ? o["details"] : void 0,
+    fields: isRecord(o["fields"]) ? o["fields"] : void 0,
+    request_id: typeof o["request_id"] === "string" ? o["request_id"] : null,
+    retryable: typeof o["retryable"] === "boolean" ? o["retryable"] : void 0
+  };
+}
+function isRecord(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+
+// src/auth.ts
+var REDACTED = "[REDACTED]";
+var ApiKeyAuthenticator = class {
+  kind = "api-key";
+  #key;
+  #secret;
+  constructor(apiKey, apiSecret) {
+    if (typeof apiKey !== "string" || apiKey.trim() === "") throw new CexyConfigError("apiKey must be a non-empty string");
+    if (typeof apiSecret !== "string" || apiSecret.trim() === "")
+      throw new CexyConfigError("apiSecret must be a non-empty string");
+    if (/[\r\n]/.test(apiKey) || /[\r\n]/.test(apiSecret))
+      throw new CexyConfigError("apiKey and apiSecret must not contain line breaks");
+    this.#key = apiKey;
+    this.#secret = apiSecret;
+  }
+  /** A non-secret hint for logs: the first characters of the key id. */
+  get keyHint() {
+    return `${this.#key.slice(0, 6)}\u2026`;
+  }
+  authenticate(request) {
+    request.headers.set("X-API-Key", this.#key);
+    request.headers.set("X-API-Secret", this.#secret);
+  }
+  redact(text) {
+    let out = text;
+    for (const s of [this.#secret, this.#key]) {
+      if (s) out = out.split(s).join(REDACTED);
+    }
+    return out;
+  }
+  toString() {
+    return `ApiKeyAuthenticator(${this.keyHint}, secret=${REDACTED})`;
+  }
+  toJSON() {
+    return { kind: this.kind, apiKey: this.keyHint, apiSecret: REDACTED };
+  }
+  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")]() {
+    return this.toString();
+  }
+};
+
+// src/url.ts
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+function isLocalHost(hostname) {
+  return LOCAL_HOSTS.has(hostname.toLowerCase());
+}
+function assertSecureUrl(url, secure, insecure, allowInsecure, what) {
+  if (url.protocol === secure) return;
+  if (url.protocol === insecure) {
+    if (!allowInsecure) {
+      throw new CexyConfigError(`${what} must use ${secure}// (pass allowInsecure: true only for a local test server)`);
+    }
+    if (!isLocalHost(url.hostname)) {
+      throw new CexyConfigError(`${what}: ${insecure}// is only allowed for localhost, 127.0.0.1 or ::1`);
+    }
+    return;
+  }
+  throw new CexyConfigError(`${what} must use ${secure}//`);
+}
+
+// src/operations.ts
+var op = (method, path, auth, scope, sdkMethod) => ({ method, path, auth, scope, sdkMethod });
+var OPERATIONS = {
+  // Public market data
+  server_time: op("GET", "/api/v1/time", "none", null, "time"),
+  exchange_config: op("GET", "/api/v1/config", "none", null, "config"),
+  list_fee_schedules: op("GET", "/api/v1/fees", "none", null, "fees.get"),
+  list_assets: op("GET", "/api/v1/assets", "none", null, "assets.list"),
+  get_asset: op("GET", "/api/v1/assets/{symbol}", "none", null, "assets.get"),
+  list_networks: op("GET", "/api/v1/networks", "none", null, "networks.list"),
+  list_markets: op("GET", "/api/v1/markets", "none", null, "markets.list"),
+  get_market: op("GET", "/api/v1/markets/{symbol}", "none", null, "markets.get"),
+  get_order_book: op("GET", "/api/v1/markets/{symbol}/orderbook", "none", null, "markets.orderbook"),
+  get_market_trades: op("GET", "/api/v1/markets/{symbol}/trades", "none", null, "markets.trades"),
+  get_candles: op("GET", "/api/v1/markets/{symbol}/candles", "none", null, "markets.candles"),
+  list_pools: op("GET", "/api/v1/pools", "none", null, "pools.list"),
+  get_pool: op("GET", "/api/v1/pools/{symbol}", "none", null, "pools.get"),
+  // Account (read)
+  list_balances: op("GET", "/api/v1/account/balances", "api_key", "read", "account.balances"),
+  get_balance: op("GET", "/api/v1/account/balances/{asset}", "api_key", "read", "account.balance"),
+  get_ledger: op("GET", "/api/v1/account/ledger", "api_key", "read", "account.ledger"),
+  list_notifications: op("GET", "/api/v1/account/notifications", "api_key", "read", "account.notifications"),
+  list_sub_accounts: op("GET", "/api/v1/account/sub-accounts", "api_key", "read", "account.subAccounts"),
+  list_api_keys: op("GET", "/api/v1/account/api-keys", "api_key", "read", "account.apiKeys"),
+  // Exports (read)
+  export_deposits: op("GET", "/api/v1/exports/deposits", "api_key", "read", "exports.deposits"),
+  export_ledger: op("GET", "/api/v1/exports/ledger", "api_key", "read", "exports.ledger"),
+  export_orders: op("GET", "/api/v1/exports/orders", "api_key", "read", "exports.orders"),
+  export_trades: op("GET", "/api/v1/exports/trades", "api_key", "read", "exports.trades"),
+  export_withdrawals: op("GET", "/api/v1/exports/withdrawals", "api_key", "read", "exports.withdrawals"),
+  // Wallet (read)
+  list_deposits: op("GET", "/api/v1/wallet/deposits", "api_key", "read", "wallet.deposits"),
+  get_deposit: op("GET", "/api/v1/wallet/deposits/{deposit_id}", "api_key", "read", "wallet.deposit"),
+  list_withdrawals: op("GET", "/api/v1/wallet/withdrawals", "api_key", "read", "wallet.withdrawals"),
+  get_withdrawal: op("GET", "/api/v1/wallet/withdrawals/{withdrawal_id}", "api_key", "read", "wallet.withdrawal"),
+  list_withdrawal_addresses: op("GET", "/api/v1/wallet/withdrawal-addresses", "api_key", "read", "wallet.withdrawalAddresses"),
+  deposit_address: op("GET", "/api/v1/wallet/deposit-address", "api_key", "read", "wallet.depositAddress"),
+  // Trading
+  list_open_orders: op("GET", "/api/v1/trading/orders", "api_key", "read", "trading.openOrders"),
+  get_order: op("GET", "/api/v1/trading/orders/{order_id}", "api_key", "read", "trading.order"),
+  get_order_by_client_id: op("GET", "/api/v1/trading/orders/by-client-id/{client_order_id}", "api_key", "read", "trading.orderByClientId"),
+  order_history: op("GET", "/api/v1/trading/orders/history", "api_key", "read", "trading.orderHistory"),
+  trade_history: op("GET", "/api/v1/trading/trades", "api_key", "read", "trading.trades"),
+  place_order: op("POST", "/api/v1/trading/orders", "api_key", "trade", "trading.placeOrder"),
+  cancel_order: op("DELETE", "/api/v1/trading/orders/{order_id}", "api_key", "trade", "trading.cancelOrder"),
+  cancel_all: op("POST", "/api/v1/trading/orders/cancel-all", "api_key", "trade", "trading.cancelAll"),
+  // Liquidity pools (trade)
+  join_pool: op("POST", "/api/v1/pools/{symbol}/join", "api_key", "trade", "pools.join"),
+  exit_pool: op("POST", "/api/v1/pools/{symbol}/exit", "api_key", "trade", "pools.exit")
+};
+
+// src/http.ts
+var BACKOFF_BASE_MS = 500;
+var BACKOFF_MAX_MS = 1e4;
+var Transport = class {
+  config;
+  constructor(config) {
+    this.config = config;
+  }
+  /**
+   * Sends a request with the standard retry policy: GETs retry on retryable errors and
+   * network failures. Mutations carry an `Idempotency-Key` reused on every attempt; the server
+   * honours it on pool join/exit, which makes their retries safe. The other mutations routed
+   * here (cancel-all) are naturally repeatable. `placeOrder` and `cancelOrder` use
+   * `attempt()` with their own policies.
+   */
+  async request(spec, opts = {}) {
+    const info = OPERATIONS[spec.op];
+    const isMutation = info.method !== "GET";
+    const idempotencyKey = isMutation ? spec.idempotencyKey ?? opts.idempotencyKey ?? newId() : void 0;
+    const maxRetries = opts.maxRetries ?? this.config.maxRetries;
+    for (let attempt = 0; ; attempt++) {
+      try {
+        return await this.attempt({ ...spec, idempotencyKey }, opts);
+      } catch (err) {
+        if (attempt >= maxRetries || !isRetryable(err) || opts.signal?.aborted) throw err;
+        await this.backoff(spec.op, info, attempt, err, idempotencyKey, opts.signal);
+      }
+    }
+  }
+  /** Waits before retry number `attempt + 1`, honouring server hints. */
+  async backoff(op2, info, attempt, err, idempotencyKey, signal) {
+    const delayMs = this.retryDelay(attempt, err);
+    this.config.onRetry?.({
+      operation: op2,
+      method: info.method,
+      path: info.path,
+      attempt: attempt + 1,
+      delayMs,
+      error: err,
+      idempotencyKey
+    });
+    await this.config.sleep(delayMs, signal);
+  }
+  /** Full-jitter exponential backoff, or the server's hint plus a little jitter. */
+  retryDelay(attempt, err) {
+    const hint = err instanceof RateLimitError ? err.retryAfterMs : err instanceof CexyApiError ? retryAfterMs(void 0, err.details) : null;
+    if (hint !== null && hint > 0) return Math.ceil(hint + this.config.random() * 250);
+    const cap = Math.min(BACKOFF_MAX_MS, BACKOFF_BASE_MS * 2 ** attempt);
+    return Math.ceil(this.config.random() * cap);
+  }
+  /** One attempt: rate limiter, credentials, timeout, error mapping. No retries. */
+  async attempt(spec, opts = {}) {
+    const info = OPERATIONS[spec.op];
+    const url = this.buildUrl(info, spec.pathParams, spec.query);
+    const headers = new Headers({ Accept: spec.responseType === "text" ? "text/csv, application/json" : "application/json" });
+    if (this.config.userAgent) headers.set("User-Agent", this.config.userAgent);
+    let body;
+    if (spec.body !== void 0) {
+      body = JSON.stringify(spec.body);
+      headers.set("Content-Type", "application/json");
+    }
+    if (info.method !== "GET" && spec.idempotencyKey) headers.set("Idempotency-Key", spec.idempotencyKey);
+    if (info.auth === "api_key") {
+      const auth = this.config.authenticator;
+      if (!auth) {
+        throw new CexyConfigError(
+          `${info.sdkMethod}() needs an API key: construct the client with { apiKey, apiSecret }`
+        );
+      }
+      await auth.authenticate({ method: info.method, url, headers, body });
+    }
+    if (this.config.limiter) await this.config.limiter.acquire(opts.signal);
+    const timeoutMs = opts.timeoutMs ?? this.config.timeoutMs;
+    const ctrl = new AbortController();
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      ctrl.abort();
+    }, timeoutMs);
+    const onAbort = () => ctrl.abort(opts.signal?.reason);
+    opts.signal?.addEventListener("abort", onAbort, { once: true });
+    let res;
+    let text;
+    try {
+      res = await this.config.fetch(url.toString(), { method: info.method, headers, body, signal: ctrl.signal });
+      text = await res.text();
+    } catch (err) {
+      if (opts.signal?.aborted) throw opts.signal.reason ?? err;
+      if (timedOut) throw new CexyTimeoutError(`${info.method} ${info.path} timed out after ${timeoutMs} ms`);
+      throw new CexyConnectionError(this.redact(`${info.method} ${info.path} failed: ${errMessage(err)}`), {
+        cause: err
+      });
+    } finally {
+      clearTimeout(timer);
+      opts.signal?.removeEventListener("abort", onAbort);
+    }
+    this.config.limiter?.update(res.headers);
+    if (!res.ok) {
+      const parsed = safeJson(text);
+      const error = errorFromResponse(res.status, parsed, res.headers, (t) => this.redact(t));
+      if (error instanceof RateLimitError && error.retryAfterMs) this.config.limiter?.blockFor(error.retryAfterMs);
+      throw error;
+    }
+    if (spec.responseType === "text") return { status: res.status, headers: res.headers, data: text };
+    if (text === "") return { status: res.status, headers: res.headers, data: null };
+    const data = safeJson(text);
+    if (data === void 0) {
+      throw new CexyError(`${info.method} ${info.path}: expected JSON, got ${res.headers.get("content-type") ?? "unknown content"}`);
+    }
+    return { status: res.status, headers: res.headers, data };
+  }
+  buildUrl(info, pathParams = {}, query) {
+    const path = info.path.replace(/\{(\w+)\}/g, (_m, name) => {
+      const v = pathParams[name];
+      if (typeof v !== "string" || v === "") throw new CexyConfigError(`${info.sdkMethod}(): ${name} is required`);
+      return encodeURIComponent(v);
+    });
+    const url = new URL(this.config.baseUrl.replace(/\/+$/, "") + path);
+    for (const [k, v] of Object.entries(query ?? {})) {
+      if (v === void 0 || v === null) continue;
+      if (v instanceof Date) url.searchParams.set(k, v.toISOString());
+      else if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") url.searchParams.set(k, String(v));
+      else throw new CexyConfigError(`${info.sdkMethod}(): query parameter ${k} must be a string, number, boolean or Date`);
+    }
+    return url;
+  }
+  redact(text) {
+    return this.config.authenticator ? this.config.authenticator.redact(text) : text;
+  }
+};
+function isRetryable(err) {
+  if (err instanceof CexyConnectionError) return true;
+  if (err instanceof CexyApiError) return err.retryable || err.code === "CONCURRENT_MODIFICATION";
+  return false;
+}
+function isAmbiguous(err) {
+  if (err instanceof CexyConnectionError) return true;
+  return err instanceof CexyApiError && err.status >= 500;
+}
+function newId() {
+  const c = globalThis.crypto;
+  if (c?.randomUUID) return c.randomUUID();
+  throw new CexyConfigError("crypto.randomUUID is unavailable; pass an explicit id");
+}
+function safeJson(text) {
+  if (text === "") return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function errMessage(err) {
+  if (err instanceof Error) {
+    const cause = err.cause;
+    return cause instanceof Error ? `${err.message} (${cause.message})` : err.message;
+  }
+  return String(err);
+}
+
+// src/limiter.ts
+var RateLimiter = class {
+  #rpm;
+  #tokens;
+  #last;
+  #blockedUntil = 0;
+  #now;
+  #sleep;
+  constructor(opts) {
+    if (!(opts.requestsPerMinute > 0)) throw new RangeError("requestsPerMinute must be > 0");
+    this.#rpm = opts.requestsPerMinute;
+    this.#tokens = opts.requestsPerMinute;
+    this.#now = opts.now ?? Date.now;
+    this.#sleep = opts.sleep ?? sleep;
+    this.#last = this.#now();
+  }
+  get state() {
+    this.#refill();
+    return { requestsPerMinute: this.#rpm, tokens: this.#tokens, blockedUntil: this.#blockedUntil };
+  }
+  /** Waits until a request may be sent, then takes a token. */
+  async acquire(signal) {
+    for (; ; ) {
+      this.#refill();
+      const now = this.#now();
+      if (now < this.#blockedUntil) {
+        await this.#sleep(this.#blockedUntil - now, signal);
+        continue;
+      }
+      if (this.#tokens >= 1) {
+        this.#tokens -= 1;
+        return;
+      }
+      const msPerToken = 6e4 / this.#rpm;
+      await this.#sleep(Math.ceil((1 - this.#tokens) * msPerToken), signal);
+    }
+  }
+  /** Adapts to the server's rate-limit headers. Never raises the configured limit. */
+  update(headers) {
+    this.#refill();
+    const limit = num(headers.get("x-ratelimit-limit"));
+    if (limit !== null && limit > 0 && limit < this.#rpm) {
+      this.#rpm = limit;
+      this.#tokens = Math.min(this.#tokens, limit);
+    }
+    const remaining = num(headers.get("x-ratelimit-remaining"));
+    if (remaining !== null && remaining >= 0 && remaining < this.#tokens) this.#tokens = remaining;
+    if (remaining === 0) {
+      const reset = num(headers.get("x-ratelimit-reset"));
+      if (reset !== null) this.blockFor(resetToMs(reset, this.#now()));
+      else this.blockFor(6e4 / this.#rpm);
+    }
+  }
+  /** Blocks all requests for `ms` (used for 429 Retry-After). */
+  blockFor(ms) {
+    if (!(ms > 0)) return;
+    this.#blockedUntil = Math.max(this.#blockedUntil, this.#now() + ms);
+  }
+  #refill() {
+    const now = this.#now();
+    const elapsed = now - this.#last;
+    if (elapsed > 0) {
+      this.#tokens = Math.min(this.#rpm, this.#tokens + elapsed * this.#rpm / 6e4);
+      this.#last = now;
+    }
+  }
+};
+function resetToMs(reset, now) {
+  if (reset > 1e12) return Math.max(0, reset - now);
+  if (reset > 1e9) return Math.max(0, reset * 1e3 - now);
+  return Math.max(0, reset * 1e3);
+}
+function num(v) {
+  if (v === null || v.trim() === "") return null;
+  const n = Number(v);
+  return Number.isFinite(n) ? n : null;
+}
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(abortError(signal));
+      return;
+    }
+    const t = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(t);
+      reject(abortError(signal));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function abortError(signal) {
+  const r = signal?.reason;
+  return r instanceof Error ? r : new Error("aborted");
+}
+
+// src/amounts.ts
+var AMOUNT_RE = /^-?\d+(\.\d+)?$/;
+function isAmount(value) {
+  return typeof value === "string" && AMOUNT_RE.test(value);
+}
+function assertAmountFields(body, fields, context) {
+  for (const field of fields) {
+    const v = body[field];
+    if (v === void 0 || v === null) continue;
+    if (typeof v === "number" || typeof v === "bigint") {
+      throw new InvalidAmountError(
+        field,
+        `${context}: ${field} must be a decimal string such as "0.5", not a ${typeof v}. JS numbers are binary floats and cannot represent most decimals exactly.`
+      );
+    }
+    if (!isAmount(v)) {
+      throw new InvalidAmountError(field, `${context}: ${field} must be a plain decimal string (digits, optional "." and sign)`);
+    }
+  }
+}
+
+// src/pagination.ts
+async function* paginate(fetchPage, startCursor, opts = {}) {
+  let cursor = startCursor ?? void 0;
+  let yielded = 0;
+  const max = opts.maxItems ?? Infinity;
+  const seen = /* @__PURE__ */ new Set();
+  for (; ; ) {
+    const page = await fetchPage(cursor);
+    for (const item of page.items) {
+      if (yielded >= max) return;
+      yield item;
+      yielded++;
+    }
+    if (!page.has_more || !page.next_cursor) return;
+    if (seen.has(page.next_cursor)) return;
+    seen.add(page.next_cursor);
+    cursor = page.next_cursor;
+  }
+}
+
+// src/resources.ts
+var Resource = class {
+  t;
+  constructor(transport) {
+    this.t = transport;
+  }
+  async data(spec, opts) {
+    const raw = await this.t.request(spec, opts);
+    return raw.data.data;
+  }
+  async page(spec, opts) {
+    const raw = await this.t.request(spec, opts);
+    return raw.data;
+  }
+  async text(spec, opts) {
+    const raw = await this.t.request({ ...spec, responseType: "text" }, opts);
+    return raw.data;
+  }
+};
+function withoutCursor(p) {
+  const { cursor: _c, ...rest } = p ?? {};
+  return rest;
+}
+var MarketsResource = class extends Resource {
+  /** All markets with their current ticker. */
+  list(opts) {
+    return this.data({ op: "list_markets" }, opts);
+  }
+  /** One market, e.g. `"BTC/USDT"`. */
+  get(symbol, opts) {
+    return this.data({ op: "get_market", pathParams: { symbol } }, opts);
+  }
+  /**
+   * Order-book snapshot aggregated by price, with the realtime `sequence` it is current as of.
+   * To follow the book live, use `CexyWebSocket.orderBook()`, which applies the sync rules.
+   */
+  orderbook(symbol, params, opts) {
+    return this.data({ op: "get_order_book", pathParams: { symbol }, query: params }, opts);
+  }
+  /** One page of recent public trades. */
+  trades(symbol, params, opts) {
+    return this.page({ op: "get_market_trades", pathParams: { symbol }, query: params }, opts);
+  }
+  /** Every public trade, page by page (`for await`). */
+  iterateTrades(symbol, params, iter) {
+    return paginate((cursor) => this.trades(symbol, { ...withoutCursor(params), cursor }, iter), params?.cursor, iter);
+  }
+  /** OHLCV candles. `interval` is required. */
+  candles(symbol, params, opts) {
+    return this.data({ op: "get_candles", pathParams: { symbol }, query: params }, opts);
+  }
+};
+var AssetsResource = class extends Resource {
+  list(opts) {
+    return this.data({ op: "list_assets" }, opts);
+  }
+  get(symbol, opts) {
+    return this.data({ op: "get_asset", pathParams: { symbol } }, opts);
+  }
+};
+var NetworksResource = class extends Resource {
+  list(opts) {
+    return this.data({ op: "list_networks" }, opts);
+  }
+};
+var FeesResource = class extends Resource {
+  /** The fee schedules (maker/taker rates by tier). */
+  get(opts) {
+    return this.data({ op: "list_fee_schedules" }, opts);
+  }
+};
+var PoolsResource = class extends Resource {
+  list(opts) {
+    return this.data({ op: "list_pools" }, opts);
+  }
+  get(symbol, opts) {
+    return this.data({ op: "get_pool", pathParams: { symbol } }, opts);
+  }
+  /** Adds liquidity. Needs the `trade` scope. Amounts are decimal strings. */
+  async join(symbol, body, opts) {
+    assertAmountFields(body, ["base_amount", "quote_amount", "max_ratio_deviation_percent"], "pools.join");
+    return this.data({ op: "join_pool", pathParams: { symbol }, body }, opts);
+  }
+  /** Removes liquidity. Needs the `trade` scope. */
+  async exit(symbol, body, opts) {
+    assertAmountFields(body, ["shares"], "pools.exit");
+    return this.data({ op: "exit_pool", pathParams: { symbol }, body }, opts);
+  }
+};
+var AccountResource = class extends Resource {
+  balances(opts) {
+    return this.data({ op: "list_balances" }, opts);
+  }
+  balance(asset, opts) {
+    return this.data({ op: "get_balance", pathParams: { asset } }, opts);
+  }
+  ledger(params, opts) {
+    return this.page({ op: "get_ledger", query: params }, opts);
+  }
+  iterateLedger(params, iter) {
+    return paginate((cursor) => this.ledger({ ...withoutCursor(params), cursor }, iter), params?.cursor, iter);
+  }
+  notifications(params, opts) {
+    return this.page({ op: "list_notifications", query: params }, opts);
+  }
+  iterateNotifications(params, iter) {
+    return paginate((cursor) => this.notifications({ ...withoutCursor(params), cursor }, iter), params?.cursor, iter);
+  }
+  subAccounts(opts) {
+    return this.data({ op: "list_sub_accounts" }, opts);
+  }
+  /** Your API keys (metadata only; secrets are never returned). */
+  apiKeys(opts) {
+    return this.data({ op: "list_api_keys" }, opts);
+  }
+};
+var ExportsResource = class extends Resource {
+  deposits(params, opts) {
+    return this.text({ op: "export_deposits", query: params }, opts);
+  }
+  ledger(params, opts) {
+    return this.text({ op: "export_ledger", query: params }, opts);
+  }
+  orders(params, opts) {
+    return this.text({ op: "export_orders", query: params }, opts);
+  }
+  trades(params, opts) {
+    return this.text({ op: "export_trades", query: params }, opts);
+  }
+  withdrawals(params, opts) {
+    return this.text({ op: "export_withdrawals", query: params }, opts);
+  }
+};
+var WalletResource = class extends Resource {
+  deposits(params, opts) {
+    return this.page({ op: "list_deposits", query: params }, opts);
+  }
+  iterateDeposits(params, iter) {
+    return paginate((cursor) => this.deposits({ ...withoutCursor(params), cursor }, iter), params?.cursor, iter);
+  }
+  deposit(depositId, opts) {
+    return this.data({ op: "get_deposit", pathParams: { deposit_id: depositId } }, opts);
+  }
+  withdrawals(params, opts) {
+    return this.page({ op: "list_withdrawals", query: params }, opts);
+  }
+  iterateWithdrawals(params, iter) {
+    return paginate((cursor) => this.withdrawals({ ...withoutCursor(params), cursor }, iter), params?.cursor, iter);
+  }
+  withdrawal(withdrawalId, opts) {
+    return this.data({ op: "get_withdrawal", pathParams: { withdrawal_id: withdrawalId } }, opts);
+  }
+  withdrawalAddresses(opts) {
+    return this.data({ op: "list_withdrawal_addresses" }, opts);
+  }
+  /**
+   * Your deposit address for an asset on a network.
+   *
+   * **Side effect:** the first call for an asset/network CREATES the address (and it is
+   * permanent); later calls return the same address. Always send the `memo` too when the
+   * response has one, or the deposit may be unrecoverable.
+   */
+  depositAddress(params, opts) {
+    return this.data({ op: "deposit_address", query: params }, opts);
+  }
+};
+var ORDER_AMOUNT_FIELDS = ["price", "quantity", "quote_quantity", "stop_price"];
+var TradingResource = class extends Resource {
+  /** Open orders, optionally filtered by market/status. */
+  openOrders(params, opts) {
+    return this.data({ op: "list_open_orders", query: params }, opts);
+  }
+  order(orderId, opts) {
+    return this.data({ op: "get_order", pathParams: { order_id: orderId } }, opts);
+  }
+  orderByClientId(clientOrderId, opts) {
+    return this.data({ op: "get_order_by_client_id", pathParams: { client_order_id: clientOrderId } }, opts);
+  }
+  orderHistory(params, opts) {
+    return this.page({ op: "order_history", query: params }, opts);
+  }
+  iterateOrderHistory(params, iter) {
+    return paginate((cursor) => this.orderHistory({ ...withoutCursor(params), cursor }, iter), params?.cursor, iter);
+  }
+  /** Your executions. */
+  trades(params, opts) {
+    return this.page({ op: "trade_history", query: params }, opts);
+  }
+  iterateTrades(params, iter) {
+    return paginate((cursor) => this.trades({ ...withoutCursor(params), cursor }, iter), params?.cursor, iter);
+  }
+  /**
+   * Places a REAL order (needs the `trade` scope). Amounts must be decimal strings.
+   *
+   * Retry safety rests on `client_order_id` (generated as a UUID when absent): it is unique
+   * per account and the server refuses a repeat before any funds move. The server does NOT
+   * honour `Idempotency-Key` on orders (the header is sent but gives no protection). After an
+   * ambiguous failure (network error, timeout or 5xx) the SDK first looks the order up by
+   * `client_order_id` and returns it if it exists (`recovered: true`); only if it does not
+   * exist does it send the order again, with the same `client_order_id`, so a late-arriving
+   * first attempt makes the resend fail as a duplicate, which is again resolved by lookup.
+   * Throws `OrderStateUnknownError` when even the lookup fails.
+   */
+  async placeOrder(order, opts = {}) {
+    if (!order || typeof order !== "object") throw new CexyConfigError("placeOrder(): order is required");
+    for (const f of ["symbol", "side", "type"]) {
+      if (!order[f]) throw new CexyConfigError(`placeOrder(): ${f} is required`);
+    }
+    assertAmountFields(order, ORDER_AMOUNT_FIELDS, "placeOrder");
+    const clientOrderId = order.client_order_id ?? newId();
+    const body = { ...order, client_order_id: clientOrderId };
+    const idempotencyKey = opts.idempotencyKey ?? newId();
+    const maxRetries = opts.maxRetries ?? this.t.config.maxRetries;
+    const info = OPERATIONS.place_order;
+    for (let attempt = 0; ; attempt++) {
+      try {
+        const raw = await this.t.attempt({ op: "place_order", body, idempotencyKey }, opts);
+        const data = raw.data.data;
+        return { ...data, client_order_id: clientOrderId, recovered: false };
+      } catch (err) {
+        if (opts.signal?.aborted) throw err;
+        const duplicateAfterRetry = attempt > 0 && err instanceof ConflictError && (err.code === "ALREADY_EXISTS" || err.code === "IDEMPOTENCY_KEY_CONFLICT");
+        if (isAmbiguous(err) || duplicateAfterRetry) {
+          const existing = await this.#lookup(clientOrderId, err, opts);
+          if (existing) return { order: existing, fills: [], client_order_id: clientOrderId, recovered: true };
+          if (duplicateAfterRetry || attempt >= maxRetries) throw err;
+          await this.t.backoff("place_order", info, attempt, err, idempotencyKey, opts.signal);
+          continue;
+        }
+        if (isRetryable(err) && attempt < maxRetries) {
+          await this.t.backoff("place_order", info, attempt, err, idempotencyKey, opts.signal);
+          continue;
+        }
+        throw err;
+      }
+    }
+  }
+  async #lookup(clientOrderId, original, opts) {
+    try {
+      return await this.orderByClientId(clientOrderId, { signal: opts.signal, timeoutMs: opts.timeoutMs });
+    } catch (lookupErr) {
+      if (lookupErr instanceof NotFoundError) return null;
+      throw new OrderStateUnknownError(clientOrderId, original);
+    }
+  }
+  /**
+   * Cancels one order (needs the `trade` scope). Retried on network errors and retryable
+   * responses. If a RETRY gets `INVALID_STATE` (the order is no longer open, typically because
+   * the first attempt did cancel it), the cancel is treated as done and the order is fetched
+   * and returned. `INVALID_STATE` on the first attempt is thrown (e.g. already filled).
+   */
+  async cancelOrder(orderId, opts = {}) {
+    const maxRetries = opts.maxRetries ?? this.t.config.maxRetries;
+    const info = OPERATIONS.cancel_order;
+    const idempotencyKey = opts.idempotencyKey ?? newId();
+    for (let attempt = 0; ; attempt++) {
+      try {
+        const raw = await this.t.attempt({ op: "cancel_order", pathParams: { order_id: orderId }, idempotencyKey }, opts);
+        return raw.data.data;
+      } catch (err) {
+        if (opts.signal?.aborted) throw err;
+        if (attempt > 0 && err instanceof CexyApiError && err.code === "INVALID_STATE") {
+          return this.order(orderId, { signal: opts.signal, timeoutMs: opts.timeoutMs });
+        }
+        if (isRetryable(err) && attempt < maxRetries) {
+          await this.t.backoff("cancel_order", info, attempt, err, idempotencyKey, opts.signal);
+          continue;
+        }
+        throw err;
+      }
+    }
+  }
+  /**
+   * Cancels every open order in one market: `cancelAll({ symbol: "BTC/USDT" })`.
+   * To cancel across ALL markets, pass `symbol: null` explicitly: `cancelAll({ symbol: null })`.
+   * Omitting `symbol` is an error, so an account-wide cancel never happens by accident
+   * (the server itself treats `{}` as every market).
+   *
+   * The server limits cancel-all to 30 calls per minute per account. It is naturally
+   * repeatable, so it is retried after network errors; a retry reports only what that retry
+   * cancelled.
+   */
+  async cancelAll(params, opts) {
+    const hasSymbol = !!params && typeof params === "object" && Object.prototype.hasOwnProperty.call(params, "symbol");
+    const symbol = hasSymbol ? params.symbol : void 0;
+    let body;
+    if (typeof symbol === "string" && symbol !== "") body = { symbol };
+    else if (hasSymbol && symbol === null) body = {};
+    else throw new CexyConfigError('cancelAll(): pass { symbol: "BASE/QUOTE" }, or { symbol: null } to cancel in every market');
+    return this.data({ op: "cancel_all", body }, opts);
+  }
+};
+
+// src/version.ts
+var VERSION = "0.1.0-dev.0";
+var USER_AGENT = `cexy-typescript/${VERSION}`;
+
+// src/ws/emitter.ts
+var TypedEmitter = class {
+  #listeners = /* @__PURE__ */ new Map();
+  /** Adds a listener; returns a function that removes it. */
+  on(event, listener) {
+    let set = this.#listeners.get(event);
+    if (!set) this.#listeners.set(event, set = /* @__PURE__ */ new Set());
+    set.add(listener);
+    return () => this.off(event, listener);
+  }
+  once(event, listener) {
+    const off = this.on(event, ((...args) => {
+      off();
+      listener(...args);
+    }));
+    return off;
+  }
+  off(event, listener) {
+    this.#listeners.get(event)?.delete(listener);
+  }
+  removeAllListeners(event) {
+    if (event === void 0) this.#listeners.clear();
+    else this.#listeners.delete(event);
+  }
+  listenerCount(event) {
+    return this.#listeners.get(event)?.size ?? 0;
+  }
+  /** Calls listeners synchronously. A throwing listener does not stop the others. */
+  emit(event, ...args) {
+    const set = this.#listeners.get(event);
+    if (!set) return;
+    for (const l of [...set]) {
+      try {
+        l(...args);
+      } catch (err) {
+        queueMicrotask(() => {
+          throw err;
+        });
+      }
+    }
+  }
+};
+
+// src/ws/orderbook.ts
+var WS_BOOK_DEPTH = 50;
+var LiveOrderBook = class extends TypedEmitter {
+  symbol;
+  bids = [];
+  asks = [];
+  /** Sequence of the last applied snapshot/update on the current connection. */
+  sequence = null;
+  /** True after a sequence gap, until the next in-order update. */
+  stale = false;
+  /** False while waiting for a snapshot (after connect, reconnect or resync). */
+  synced = false;
+  #rest;
+  #onClose;
+  #retryMs;
+  #buffer = [];
+  #generation = 0;
+  #closed = false;
+  #retryTimer = null;
+  /** @internal use `CexyWebSocket.orderBook()` */
+  constructor(symbol, rest, options, onClose) {
+    super();
+    this.symbol = symbol;
+    this.#rest = rest;
+    this.#onClose = onClose;
+    this.#retryMs = options.snapshotRetryMs ?? 1e3;
+  }
+  /** Best bid and ask (null when that side is empty). */
+  get top() {
+    return { bid: this.bids[0] ?? null, ask: this.asks[0] ?? null };
+  }
+  /** @internal The connection dropped: sequences from the next connection are unrelated. */
+  markDisconnected() {
+    this.#generation++;
+    this.synced = false;
+    this.sequence = null;
+    this.#buffer = [];
+    if (this.#retryTimer) clearTimeout(this.#retryTimer);
+    this.#retryTimer = null;
+  }
+  /**
+   * Takes a fresh REST snapshot and replays buffered updates newer than it.
+   * Called automatically; safe to call yourself.
+   */
+  async resync(attempt = 0) {
+    if (this.#closed) return;
+    const gen = ++this.#generation;
+    this.synced = false;
+    this.sequence = null;
+    this.emit("resync");
+    try {
+      const snap = await this.#rest.markets.orderbook(this.symbol, { depth: WS_BOOK_DEPTH });
+      if (gen !== this.#generation || this.#closed) return;
+      this.bids = snap.bids.slice(0, WS_BOOK_DEPTH);
+      this.asks = snap.asks.slice(0, WS_BOOK_DEPTH);
+      this.sequence = snap.sequence;
+      this.stale = false;
+      this.synced = true;
+      const buffered = this.#buffer;
+      this.#buffer = [];
+      this.emit("update", this);
+      for (const u of buffered) this.#apply(u);
+    } catch (err) {
+      if (gen !== this.#generation || this.#closed) return;
+      this.emit("error", err instanceof Error ? err : new Error(String(err)));
+      const delay = Math.min(3e4, this.#retryMs * 2 ** attempt);
+      this.#retryTimer = setTimeout(() => {
+        this.#retryTimer = null;
+        if (gen === this.#generation) void this.resync(attempt + 1);
+      }, delay);
+    }
+  }
+  /** @internal */
+  onUpdate(event) {
+    if (this.#closed) return;
+    if (!this.synced) {
+      this.#buffer.push(event);
+      return;
+    }
+    this.#apply(event);
+  }
+  /** Stops following the book and unsubscribes. */
+  close() {
+    if (this.#closed) return;
+    this.#closed = true;
+    this.#generation++;
+    if (this.#retryTimer) clearTimeout(this.#retryTimer);
+    this.#onClose();
+    this.removeAllListeners();
+  }
+  #apply(event) {
+    const seq = event.sequence;
+    if (typeof seq === "number" && this.sequence !== null) {
+      if (seq <= this.sequence) return;
+      if (seq !== this.sequence + 1) {
+        this.stale = true;
+        this.emit("stale", { expected: this.sequence + 1, received: seq });
+      } else if (this.stale) {
+        this.stale = false;
+        this.emit("healed");
+      }
+    }
+    this.bids = (event.data.bids ?? []).slice(0, WS_BOOK_DEPTH);
+    this.asks = (event.data.asks ?? []).slice(0, WS_BOOK_DEPTH);
+    if (typeof seq === "number") this.sequence = seq;
+    this.emit("update", this);
+  }
+};
+
+// src/ws/types.ts
+var SUPPORTED_PROTOCOL_VERSION = 1;
+var KNOWN_EVENT_TYPES = /* @__PURE__ */ new Set([
+  "ticker.update",
+  "orderbook.update",
+  "trade.new",
+  "market.status",
+  "order.created",
+  "order.updated",
+  "order.cancelled",
+  "order.filled",
+  "balance.updated",
+  "deposit.detected",
+  "deposit.updated",
+  "deposit.completed",
+  "withdrawal.updated",
+  "session.revoked"
+]);
+var PRIVATE_CHANNELS = /* @__PURE__ */ new Set(["orders", "balances", "deposits", "withdrawals", "account"]);
+
+// src/ws/client.ts
+var DEFAULT_WS_URL = "wss://api.cexy.io/api/v1/ws";
+var MAX_CHANNEL_LENGTH = 64;
+var OPEN = 1;
+var CexyWebSocketError = class extends CexyError {
+  code;
+  /** True when this came from a server `error` frame (not a local guard or disconnect). */
+  fromServer;
+  constructor(code, message, fromServer = false) {
+    super(message);
+    this.code = code;
+    this.fromServer = fromServer;
+  }
+};
+var TEARDOWN_CODES = /* @__PURE__ */ new Set(["DISCONNECTED", "CLOSED"]);
+var ACK_TYPE = {
+  auth: "authenticated",
+  subscribe: "subscribed",
+  unsubscribe: "unsubscribed",
+  ping: "pong"
+};
+var defaultLogger = { warn: (m) => console.warn(`[cexy] ${m}`) };
+var CexyWebSocket = class extends TypedEmitter {
+  url;
+  #opts;
+  #reconnect;
+  #logger;
+  #random;
+  #restClient;
+  #userAgent;
+  #ctorOption;
+  #socket = null;
+  #welcome = null;
+  #channels = /* @__PURE__ */ new Set();
+  #token = null;
+  #closedByUser = true;
+  #everConnected = false;
+  #reconnectAttempt = 0;
+  #reconnectTimer = null;
+  #pingTimer = null;
+  #livenessTimer = null;
+  #pending = /* @__PURE__ */ new Map();
+  #nextId = 1;
+  #windowStart = 0;
+  #windowCount = 0;
+  #warnedVersion = false;
+  #books = /* @__PURE__ */ new Map();
+  #connecting = null;
+  constructor(options = {}) {
+    super();
+    this.url = options.url ?? DEFAULT_WS_URL;
+    let parsed;
+    try {
+      parsed = new URL(this.url);
+    } catch {
+      throw new CexyWebSocketError("CONFIG", `invalid WebSocket url: ${this.url}`);
+    }
+    try {
+      assertSecureUrl(parsed, "wss:", "ws:", options.allowInsecure === true, "WebSocket url");
+    } catch (err) {
+      throw new CexyWebSocketError("CONFIG", err.message);
+    }
+    this.#opts = {
+      pingIntervalMs: options.pingIntervalMs ?? 3e4,
+      livenessTimeoutMs: options.livenessTimeoutMs ?? 75e3,
+      welcomeTimeoutMs: options.welcomeTimeoutMs ?? 1e4,
+      ackTimeoutMs: options.ackTimeoutMs ?? 5e3,
+      maxSubscriptions: options.maxSubscriptions ?? 100,
+      maxMessagesPerMinute: options.maxMessagesPerMinute ?? 200
+    };
+    const rc = options.reconnect ?? true;
+    this.#reconnect = rc === false ? null : {
+      baseDelayMs: (rc === true ? void 0 : rc.baseDelayMs) ?? 1e3,
+      maxDelayMs: (rc === true ? void 0 : rc.maxDelayMs) ?? 3e4,
+      maxAttempts: (rc === true ? void 0 : rc.maxAttempts) ?? Infinity
+    };
+    this.#logger = options.logger ?? defaultLogger;
+    this.#random = options.random ?? Math.random;
+    this.#restClient = options.restClient;
+    this.#userAgent = options.userAgent;
+    this.#ctorOption = options.WebSocket;
+  }
+  /** The last `welcome` frame, or null before the first connection. */
+  get welcome() {
+    return this.#welcome;
+  }
+  get connected() {
+    return this.#socket?.readyState === OPEN && this.#welcome !== null;
+  }
+  /** Channels currently held (restored after every reconnect). */
+  get channels() {
+    return [...this.#channels];
+  }
+  /** Opens the connection; resolves on the server's `welcome` frame. */
+  connect() {
+    if (this.connected && this.#welcome) return Promise.resolve(this.#welcome);
+    if (this.#connecting) return this.#connecting;
+    this.#closedByUser = false;
+    this.#connecting = this.#open().finally(() => {
+      this.#connecting = null;
+    });
+    return this.#connecting;
+  }
+  /**
+   * Authenticates private channels with a session access token. Resolves on the server's
+   * `authenticated` acknowledgement (same request id); rejects on an `error` with that id
+   * (the token is then forgotten) or when no acknowledgement arrives within `ackTimeoutMs`.
+   * The token is kept in memory and re-sent after each reconnect. When not connected, the
+   * token is queued and the promise resolves with `queued: true`.
+   * (API-key authentication is not available on the WebSocket yet.)
+   */
+  auth(token) {
+    if (typeof token !== "string" || token === "") throw new CexyWebSocketError("CONFIG", "auth(): token is required");
+    this.#token = token;
+    if (!this.connected) return Promise.resolve({ userId: null, queued: true });
+    const p = this.#auth(token);
+    p.catch(() => {
+    });
+    return p;
+  }
+  /** Sends a ping with an id and resolves with the round-trip time in ms. */
+  async ping() {
+    const started = Date.now();
+    await this.#request("ping", {}, [], true);
+    return Date.now() - started;
+  }
+  /**
+   * Subscribes to channels, e.g. `["ticker:BTC/USDT", "trades:BTC/USDT"]`. Resolves when the
+   * server confirms. Beyond `maxSubscriptions` channels are refused locally (see `refused`).
+   */
+  async subscribe(channels) {
+    const wanted = [...new Set(channels)];
+    for (const c of wanted) {
+      if (typeof c !== "string" || c === "" || c.length > MAX_CHANNEL_LENGTH) {
+        throw new CexyWebSocketError("CONFIG", `invalid channel name: ${JSON.stringify(c)}`);
+      }
+    }
+    const alreadySubscribed = wanted.filter((c) => this.#channels.has(c));
+    const fresh = wanted.filter((c) => !this.#channels.has(c));
+    const room = Math.max(0, this.#opts.maxSubscriptions - this.#channels.size);
+    const accepted = fresh.slice(0, room);
+    const refused = fresh.slice(room);
+    if (refused.length) this.#logger.warn(`subscription cap (${this.#opts.maxSubscriptions}) reached; refused: ${refused.join(", ")}`);
+    if (accepted.length === 0) return { added: [], refused, alreadySubscribed };
+    for (const c of accepted) this.#channels.add(c);
+    if (!this.connected) return { added: [], refused, alreadySubscribed };
+    const added = await this.#sendSubscribe(accepted);
+    return { added, refused, alreadySubscribed };
+  }
+  /**
+   * Unsubscribes. Resolves on the `unsubscribed` acknowledgement (or after `ackTimeoutMs`
+   * without one); rejects on an `error` with the request id.
+   */
+  async unsubscribe(channels) {
+    const held = [...new Set(channels)].filter((c) => this.#channels.delete(c));
+    if (held.length && this.connected) await this.#request("unsubscribe", { channels: held }, held, false);
+  }
+  /**
+   * A live order book for `symbol` that follows the sync rules: subscribe first, then a REST
+   * snapshot (sequence S); drop updates with sequence <= S; each update replaces the top 50
+   * levels; a gap marks the book stale until the next update; a fresh snapshot after every
+   * reconnect and after `CONCURRENT_MODIFICATION`. Resolves after the first snapshot.
+   */
+  async orderBook(symbol, options = {}) {
+    const rest = this.#restClient;
+    if (!rest) throw new CexyWebSocketError("CONFIG", "orderBook() needs restClient (use CexyClient.websocket())");
+    const existing = this.#books.get(symbol);
+    if (existing) return existing;
+    const book = new LiveOrderBook(symbol, rest, options, () => {
+      this.#books.delete(symbol);
+      void this.unsubscribe([`orderbook:${symbol}`]);
+    });
+    this.#books.set(symbol, book);
+    const res = await this.subscribe([`orderbook:${symbol}`]);
+    if (res.refused.length) {
+      this.#books.delete(symbol);
+      throw new CexyWebSocketError("LOCAL_SUBSCRIPTION_LIMIT", `cannot subscribe to orderbook:${symbol}: cap reached`);
+    }
+    await book.resync();
+    return book;
+  }
+  /** Closes the connection for good (no reconnect). */
+  close() {
+    this.#closedByUser = true;
+    if (this.#reconnectTimer) clearTimeout(this.#reconnectTimer);
+    this.#reconnectTimer = null;
+    for (const b of [...this.#books.values()]) b.markDisconnected();
+    const s = this.#socket;
+    this.#teardown(new CexyWebSocketError("CLOSED", "connection closed by client"));
+    if (s) {
+      try {
+        s.close(1e3, "client closing");
+      } catch {
+      }
+    }
+    this.emit("close", { code: 1e3, reason: "client closing", willReconnect: false });
+  }
+  // ---------------------------------------------------------------------------------------
+  async #open() {
+    const Ctor = await this.#resolveCtor();
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const socket = Ctor.native ? new Ctor.ctor(this.url) : new Ctor.ctor(this.url, this.#userAgent ? { headers: { "User-Agent": this.#userAgent } } : void 0);
+      this.#socket = socket;
+      const welcomeTimer = setTimeout(() => fail(new CexyWebSocketError("TIMEOUT", "no welcome frame from server")), this.#opts.welcomeTimeoutMs);
+      const fail = (err) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(welcomeTimer);
+        this.#detach(socket);
+        try {
+          socket.close();
+        } catch {
+        }
+        if (this.#socket === socket) this.#socket = null;
+        reject(err);
+      };
+      socket.onopen = () => {
+        this.#startHeartbeat();
+        this.emit("open");
+      };
+      socket.onerror = () => {
+        if (!settled) fail(new CexyWebSocketError("CONNECT_FAILED", `could not connect to ${this.url}`));
+      };
+      socket.onclose = (ev) => {
+        if (!settled) {
+          fail(new CexyWebSocketError("CONNECT_FAILED", `connection closed before welcome (code ${ev?.code ?? "?"})`));
+          return;
+        }
+        if (this.#socket === socket) this.#onDropped(ev?.code, ev?.reason);
+      };
+      socket.onmessage = (ev) => {
+        const frame = parseFrame(ev.data);
+        if (!frame) return;
+        this.#touch();
+        if (!settled && frame["type"] === "welcome") {
+          settled = true;
+          clearTimeout(welcomeTimer);
+          const welcome = this.#onWelcome(frame);
+          resolve(welcome);
+          return;
+        }
+        this.#onFrame(frame);
+      };
+    });
+  }
+  async #resolveCtor() {
+    if (this.#ctorOption) return { ctor: this.#ctorOption, native: true };
+    const g = globalThis;
+    if (g.process?.versions?.node) {
+      try {
+        const name = "ws";
+        const mod = await import(
+          /* webpackIgnore: true */
+          /* @vite-ignore */
+          name
+        );
+        const def = mod.default;
+        const ctor = mod.WebSocket ?? (typeof def === "function" ? def : def?.WebSocket);
+        if (ctor) return { ctor, native: false };
+      } catch {
+      }
+    }
+    if (g.WebSocket) return { ctor: g.WebSocket, native: true };
+    throw new CexyWebSocketError("NO_WEBSOCKET", "no WebSocket implementation: install the `ws` package or use Node 22+");
+  }
+  #onWelcome(welcome) {
+    this.#welcome = welcome;
+    if (welcome.protocol_version !== SUPPORTED_PROTOCOL_VERSION && !this.#warnedVersion) {
+      this.#warnedVersion = true;
+      this.#logger.warn(
+        `server protocol_version ${welcome.protocol_version} is newer than this SDK supports (${SUPPORTED_PROTOCOL_VERSION}); continuing`
+      );
+    }
+    const isReconnect = this.#everConnected;
+    this.#everConnected = true;
+    this.#reconnectAttempt = 0;
+    this.emit("welcome", welcome);
+    if (isReconnect) {
+      if (this.#token) this.#reAuth(this.#token);
+      const channels = [...this.#channels];
+      if (channels.length) {
+        this.#sendSubscribe(channels).catch((err) => this.#emitError(err));
+      }
+      this.emit("reconnected", welcome);
+      this.emit("resync", "reconnect");
+      for (const b of this.#books.values()) void b.resync();
+    } else if (this.#channels.size) {
+      if (this.#token) this.#reAuth(this.#token);
+      this.#sendSubscribe([...this.#channels]).catch((err) => this.#emitError(err));
+    } else if (this.#token) {
+      this.#reAuth(this.#token);
+    }
+    return welcome;
+  }
+  #onFrame(frame) {
+    const type = frame["type"];
+    switch (type) {
+      case "welcome":
+        this.#onWelcome(frame);
+        return;
+      case "pong": {
+        const id = typeof frame["id"] === "string" ? frame["id"] : null;
+        if (id !== null) this.#settle(id, "ping", frame);
+        this.emit("pong", id);
+        return;
+      }
+      case "authenticated": {
+        const id = typeof frame["id"] === "string" ? frame["id"] : null;
+        if (id !== null) this.#settle(id, "auth", frame);
+        this.emit("authenticated", typeof frame["user_id"] === "string" ? frame["user_id"] : null);
+        return;
+      }
+      case "subscribed":
+      case "unsubscribed": {
+        const f = frame;
+        const channels = Array.isArray(f.channels) ? f.channels.filter((c) => typeof c === "string") : [];
+        const kind = type === "subscribed" ? "subscribe" : "unsubscribe";
+        const id = typeof f.id === "string" ? f.id : null;
+        if (id !== null) this.#settle(id, kind, frame);
+        else {
+          for (const p of this.#pending.values()) {
+            if (p.kind === kind && channels.some((c) => p.channels.includes(c))) {
+              this.#settle(p.id, kind, frame);
+              break;
+            }
+          }
+        }
+        if (type === "subscribed") this.emit("subscribed", channels);
+        else this.emit("unsubscribed", channels);
+        return;
+      }
+      case "error": {
+        const code = typeof frame["code"] === "string" ? frame["code"] : "UNKNOWN";
+        const message = typeof frame["message"] === "string" ? frame["message"] : code;
+        const f = { type: "error", code, message, id: typeof frame["id"] === "string" ? frame["id"] : null };
+        const err = new CexyWebSocketError(code, message, true);
+        const id = f.id ?? null;
+        if (id !== null) {
+          const pending = this.#pending.get(id);
+          if (pending) {
+            this.#pending.delete(id);
+            clearTimeout(pending.timer);
+            pending.reject(err);
+          }
+        }
+        this.emit("serverError", err, f);
+        if (f.code === "CONCURRENT_MODIFICATION" && id === null) {
+          this.emit("resync", "concurrent_modification");
+          for (const b of this.#books.values()) void b.resync();
+        }
+        return;
+      }
+    }
+    if (typeof type !== "string" || !KNOWN_EVENT_TYPES.has(type)) {
+      this.#logger.debug?.(`ignoring unknown frame type ${String(type)}`);
+      return;
+    }
+    const event = frame;
+    if (event.type === "session.revoked") this.#onAuthLost(event);
+    if (event.type === "orderbook.update") {
+      const symbol = event.channel.startsWith("orderbook:") ? event.channel.slice("orderbook:".length) : event.data?.symbol;
+      if (symbol) this.#books.get(symbol)?.onUpdate(event);
+    }
+    this.emit("event", event);
+  }
+  #onAuthLost(event) {
+    this.#token = null;
+    for (const c of [...this.#channels]) if (PRIVATE_CHANNELS.has(c)) this.#channels.delete(c);
+    this.emit("authLost", event);
+  }
+  /** Resolves the pending request `id` if the acknowledgement type matches its kind. */
+  #settle(id, kind, frame) {
+    const p = this.#pending.get(id);
+    if (!p || p.kind !== kind) return;
+    this.#pending.delete(id);
+    clearTimeout(p.timer);
+    p.resolve(frame);
+  }
+  /**
+   * Sends `{op, id, ...payload}` and waits for the acknowledgement with the same id
+   * (`ACK_TYPE[kind]`) or an `error` with that id. With `strict`, no acknowledgement within
+   * `ackTimeoutMs` rejects; otherwise it resolves with null.
+   */
+  #request(kind, payload, channels, strict) {
+    const id = this.#newId();
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.#pending.delete(id);
+        if (strict) reject(new CexyWebSocketError("TIMEOUT", `no ${ACK_TYPE[kind]} acknowledgement for ${kind} (id ${id})`));
+        else resolve(null);
+      }, this.#opts.ackTimeoutMs);
+      this.#pending.set(id, { id, kind, channels, resolve, reject, timer });
+      try {
+        this.#send({ op: kind, ...payload, id });
+      } catch (err) {
+        clearTimeout(timer);
+        this.#pending.delete(id);
+        reject(toError(err));
+      }
+    });
+  }
+  async #auth(token) {
+    try {
+      const ack = await this.#request("auth", { token }, [], true);
+      const userId = ack && typeof ack["user_id"] === "string" ? ack["user_id"] : null;
+      return { userId, queued: false };
+    } catch (err) {
+      if (err instanceof CexyWebSocketError && err.fromServer && this.#token === token) {
+        this.#token = null;
+      }
+      throw err;
+    }
+  }
+  /** Automatic (re-)authentication; failures surface as `error` events. */
+  #reAuth(token) {
+    this.#auth(token).catch((err) => this.#emitError(err));
+  }
+  async #sendSubscribe(channels) {
+    const ack = await this.#request("subscribe", { channels }, channels, false);
+    const acked = ack?.["channels"];
+    return Array.isArray(acked) ? acked.filter((c) => typeof c === "string") : [];
+  }
+  #send(frame) {
+    const s = this.#socket;
+    if (!s || s.readyState !== OPEN) throw new CexyWebSocketError("NOT_CONNECTED", "WebSocket is not connected");
+    const now = Date.now();
+    if (now - this.#windowStart >= 6e4) {
+      this.#windowStart = now;
+      this.#windowCount = 0;
+    }
+    if (frame["op"] !== "ping" && this.#windowCount >= this.#opts.maxMessagesPerMinute) {
+      throw new CexyWebSocketError(
+        "LOCAL_RATE_LIMIT",
+        `more than ${this.#opts.maxMessagesPerMinute} messages this minute; the server closes the socket above 240`
+      );
+    }
+    this.#windowCount++;
+    s.send(JSON.stringify(frame));
+  }
+  #startHeartbeat() {
+    this.#stopTimers();
+    this.#pingTimer = setInterval(() => {
+      try {
+        this.#send({ op: "ping" });
+      } catch {
+      }
+    }, this.#opts.pingIntervalMs);
+    this.#touch();
+  }
+  #touch() {
+    if (this.#livenessTimer) clearTimeout(this.#livenessTimer);
+    this.#livenessTimer = setTimeout(() => {
+      this.#logger.warn(`no frame from server for ${this.#opts.livenessTimeoutMs} ms; reconnecting`);
+      const s = this.#socket;
+      if (s) {
+        this.#detach(s);
+        try {
+          const terminate = s.terminate;
+          if (terminate) terminate.call(s);
+          else s.close(4e3, "liveness timeout");
+        } catch {
+        }
+      }
+      this.#onDropped(4e3, "liveness timeout");
+    }, this.#opts.livenessTimeoutMs);
+  }
+  #stopTimers() {
+    if (this.#pingTimer) clearInterval(this.#pingTimer);
+    if (this.#livenessTimer) clearTimeout(this.#livenessTimer);
+    this.#pingTimer = null;
+    this.#livenessTimer = null;
+  }
+  #detach(s) {
+    s.onopen = null;
+    s.onmessage = null;
+    s.onclose = null;
+    s.onerror = () => {
+    };
+  }
+  #teardown(err) {
+    this.#stopTimers();
+    if (this.#socket) this.#detach(this.#socket);
+    this.#socket = null;
+    this.#welcome = null;
+    for (const p of this.#pending.values()) {
+      clearTimeout(p.timer);
+      p.reject(err);
+    }
+    this.#pending.clear();
+  }
+  #onDropped(code, reason) {
+    this.#teardown(new CexyWebSocketError("DISCONNECTED", `connection lost (code ${code ?? "?"})`));
+    for (const b of this.#books.values()) b.markDisconnected();
+    const willReconnect = !this.#closedByUser && this.#reconnect !== null;
+    this.emit("close", { code, reason, willReconnect });
+    if (willReconnect) this.#scheduleReconnect();
+  }
+  #scheduleReconnect() {
+    const rc = this.#reconnect;
+    if (!rc || this.#closedByUser) return;
+    if (this.#reconnectAttempt >= rc.maxAttempts) {
+      this.emit("error", new CexyWebSocketError("RECONNECT_FAILED", `gave up after ${rc.maxAttempts} reconnect attempts`));
+      return;
+    }
+    const attempt = ++this.#reconnectAttempt;
+    const cap = Math.min(rc.maxDelayMs, rc.baseDelayMs * 2 ** (attempt - 1));
+    const delayMs = Math.floor(this.#random() * cap);
+    this.emit("reconnecting", { attempt, delayMs });
+    this.#reconnectTimer = setTimeout(() => {
+      this.#reconnectTimer = null;
+      if (this.#closedByUser) return;
+      this.#open().catch((err) => {
+        this.emit("error", toError(err));
+        this.#scheduleReconnect();
+      });
+    }, delayMs);
+  }
+  /** Emits `error`, except for requests cut short by a disconnect (the reconnect redoes them). */
+  #emitError(err) {
+    if (err instanceof CexyWebSocketError && TEARDOWN_CODES.has(err.code)) return;
+    this.emit("error", toError(err));
+  }
+  #newId() {
+    return String(this.#nextId++);
+  }
+};
+function parseFrame(data) {
+  let text;
+  if (typeof data === "string") text = data;
+  else if (data instanceof ArrayBuffer) text = new TextDecoder().decode(data);
+  else if (ArrayBuffer.isView(data)) text = new TextDecoder().decode(data);
+  else return null;
+  try {
+    const v = JSON.parse(text);
+    return v && typeof v === "object" && !Array.isArray(v) ? v : null;
+  } catch {
+    return null;
+  }
+}
+function toError(err) {
+  return err instanceof Error ? err : new Error(String(err));
+}
+
+// src/client.ts
+var DEFAULT_BASE_URL = "https://api.cexy.io";
+var DEFAULT_RPM_ANONYMOUS = 100;
+var DEFAULT_RPM_WITH_KEY = 300;
+var CexyClient = class {
+  markets;
+  assets;
+  networks;
+  fees;
+  pools;
+  account;
+  exports;
+  wallet;
+  trading;
+  #transport;
+  #baseUrl;
+  #allowInsecure;
+  constructor(options = {}) {
+    const { apiKey, apiSecret } = options;
+    const hasKey = apiKey !== void 0 && apiKey !== null && apiKey !== "";
+    const hasSecret = apiSecret !== void 0 && apiSecret !== null && apiSecret !== "";
+    if (hasKey !== hasSecret) {
+      throw new CexyConfigError("apiKey and apiSecret must be given together (got only one of them)");
+    }
+    if (hasKey && options.authenticator) {
+      throw new CexyConfigError("pass either apiKey/apiSecret or authenticator, not both");
+    }
+    const authenticator = options.authenticator ?? (hasKey ? new ApiKeyAuthenticator(apiKey, apiSecret) : null);
+    const baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+    let parsed;
+    try {
+      parsed = new URL(baseUrl);
+    } catch {
+      throw new CexyConfigError(`baseUrl is not a valid URL: ${baseUrl}`);
+    }
+    if (parsed.username || parsed.password || parsed.search) {
+      throw new CexyConfigError("baseUrl must not contain credentials or a query string");
+    }
+    assertSecureUrl(parsed, "https:", "http:", options.allowInsecure === true, "baseUrl");
+    this.#allowInsecure = options.allowInsecure === true;
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    if (!fetchImpl) throw new CexyConfigError("no global fetch found (Node 20+ required); pass options.fetch");
+    const timeoutMs = options.timeoutMs ?? 1e4;
+    const maxRetries = options.maxRetries ?? 3;
+    if (!(timeoutMs > 0)) throw new CexyConfigError("timeoutMs must be > 0");
+    if (!(maxRetries >= 0)) throw new CexyConfigError("maxRetries must be >= 0");
+    const sleep2 = options.sleep ?? sleep;
+    const limiter = options.rateLimit === false ? null : new RateLimiter({
+      requestsPerMinute: options.rateLimit?.requestsPerMinute ?? (authenticator ? DEFAULT_RPM_WITH_KEY : DEFAULT_RPM_ANONYMOUS),
+      sleep: sleep2
+    });
+    this.#baseUrl = baseUrl;
+    this.#transport = new Transport({
+      baseUrl,
+      timeoutMs,
+      maxRetries,
+      fetch: options.fetch ? fetchImpl : (input, init) => fetchImpl(input, init),
+      authenticator,
+      limiter,
+      userAgent: canSetUserAgent() ? [USER_AGENT, options.userAgentSuffix].filter(Boolean).join(" ") : null,
+      sleep: sleep2,
+      random: options.random ?? Math.random,
+      onRetry: options.onRetry
+    });
+    const t = this.#transport;
+    this.markets = new MarketsResource(t);
+    this.assets = new AssetsResource(t);
+    this.networks = new NetworksResource(t);
+    this.fees = new FeesResource(t);
+    this.pools = new PoolsResource(t);
+    this.account = new AccountResource(t);
+    this.exports = new ExportsResource(t);
+    this.wallet = new WalletResource(t);
+    this.trading = new TradingResource(t);
+  }
+  /** True if the client holds credentials (private endpoints are available). */
+  get hasCredentials() {
+    return this.#transport.config.authenticator !== null;
+  }
+  get baseUrl() {
+    return this.#baseUrl;
+  }
+  /** Current client-side rate limit state, or null when disabled. */
+  get rateLimit() {
+    return this.#transport.config.limiter?.state ?? null;
+  }
+  /** The User-Agent this client sends (null in browsers). */
+  get userAgent() {
+    return this.#transport.config.userAgent;
+  }
+  /** Server clock. Compare it with yours to detect skew. */
+  async time(opts) {
+    const raw = await this.#transport.request({ op: "server_time" }, opts);
+    return raw.data.data;
+  }
+  /** Public exchange configuration (maintenance state, page sizes, WebSocket path, ...). */
+  async config(opts) {
+    const raw = await this.#transport.request({ op: "exchange_config" }, opts);
+    return raw.data.data;
+  }
+  /**
+   * A WebSocket client for the same deployment, wired to this client for order-book
+   * snapshots. Call `connect()` on it.
+   */
+  websocket(options = {}) {
+    const url = options.url ?? this.#baseUrl.replace(/^http/, "ws") + "/api/v1/ws";
+    return new CexyWebSocket({
+      ...options,
+      allowInsecure: options.allowInsecure ?? this.#allowInsecure,
+      url,
+      restClient: this,
+      userAgent: options.userAgent ?? this.#transport.config.userAgent ?? void 0
+    });
+  }
+  toString() {
+    const auth = this.#transport.config.authenticator;
+    return `CexyClient(${this.#baseUrl}, auth=${auth ? `${auth.kind} [REDACTED]` : "none"})`;
+  }
+  toJSON() {
+    const auth = this.#transport.config.authenticator;
+    return { baseUrl: this.#baseUrl, auth: auth ? `${auth.kind} [REDACTED]` : "none" };
+  }
+  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")]() {
+    return this.toString();
+  }
+};
+function canSetUserAgent() {
+  const g = globalThis;
+  return !(typeof g.window !== "undefined" && typeof g.window.document !== "undefined");
+}
+
+export { AccountResource, ApiKeyAuthenticator, AssetsResource, AuthenticationError, CexyApiError, CexyClient, CexyConfigError, CexyConnectionError, CexyError, CexyTimeoutError, CexyWebSocket, CexyWebSocketError, ConflictError, DEFAULT_BASE_URL, DEFAULT_RPM_ANONYMOUS, DEFAULT_RPM_WITH_KEY, DEFAULT_WS_URL, ExportsResource, FeesResource, ForbiddenError, InvalidAmountError, KNOWN_EVENT_TYPES, LiveOrderBook, MarketsResource, NetworksResource, NotFoundError, OPERATIONS, OrderStateUnknownError, PRIVATE_CHANNELS, PoolsResource, RateLimitError, RateLimiter, SUPPORTED_PROTOCOL_VERSION, ServerError, TradingResource, TypedEmitter, USER_AGENT, UnprocessableError, VERSION, ValidationError, WS_BOOK_DEPTH, WalletResource, assertAmountFields, errorFromResponse, isAmount, isKnownErrorCode, isLocalHost, isRetryable, paginate };