@cexyio/cexy 0.1.0-dev.2 → 0.1.0-dev.3

package/README.md

@@ -5,7 +5,7 @@ The official TypeScript/JavaScript SDK for the [CEXY.io](https://cexy.io) REST a
 - Typed models generated from the public OpenAPI spec ([cexy-api-spec](https://github.com/cexyio/cexy-api-spec)).
 - Safe by default: retries with backoff, order placement that never duplicates (via `client_order_id`), a client-side rate limiter.
 - A WebSocket client with heartbeat, reconnect and a live order book that applies the sync rules for you.
-- ESM and CommonJS, Node 20+, zero runtime dependencies.
+- ESM and CommonJS, Node 22+, zero runtime dependencies.
 
 > **Status: 0.x.** The API is not yet frozen. It stays 0.x until the exchange ships HMAC request signing,
 > which will change how credentials are sent.
@@ -15,7 +15,7 @@ The official TypeScript/JavaScript SDK for the [CEXY.io](https://cexy.io) REST a
 
 ```bash
 npm install @cexyio/cexy@next
-# Node only, optional: lets the WebSocket client send a User-Agent (recommended before Node 22)
+# Node only, optional: lets the WebSocket client send a User-Agent
 npm install ws
 ```
 
@@ -215,7 +215,7 @@ use public channels and poll REST for private state. If the session is revoked,
 `authLost`; public channels keep working.
 
 In Node the client uses the optional `ws` package when installed (so it can send the SDK User-Agent),
-otherwise the global `WebSocket` (Node 22+, browsers).
+otherwise the global `WebSocket` (Node, browsers).
 
 ## Browsers
 
@@ -229,6 +229,9 @@ endpoints from a server. Browsers do not let scripts set `User-Agent`, so the SD
 - Credentials go only in the `X-API-Key` / `X-API-Secret` headers and only on private endpoints; never in URLs.
 - Only `https://` base URLs and `wss://` WebSocket URLs are accepted. `allowInsecure: true` permits
   `http://` / `ws://` solely for `localhost`, `127.0.0.1` or `::1` (local test servers).
+- The SDK **never follows HTTP redirects**. A 3xx answer throws a `CexyApiError` with code
+  `UNEXPECTED_REDIRECT` (not retried), so credentials are never re-sent to another host and an order
+  is never re-posted to a redirect target. If you pass your own `fetch`, it must honour `redirect: "manual"`.
 - The SDK redacts the secret from `toString()`, `util.inspect`, `JSON.stringify` and error messages.
 - Keep keys in environment variables or a secret manager, not in code.
 

package/dist/index.cjs

@@ -394,7 +394,13 @@ var Transport = class {
     let res;
     let text;
     try {
-      res = await this.config.fetch(url.toString(), { method: info.method, headers, body, signal: ctrl.signal });
+      res = await this.config.fetch(url.toString(), {
+        method: info.method,
+        headers,
+        body,
+        signal: ctrl.signal,
+        redirect: "manual"
+      });
       text = await res.text();
     } catch (err) {
       if (opts.signal?.aborted) throw opts.signal.reason ?? err;
@@ -406,6 +412,14 @@ var Transport = class {
       clearTimeout(timer);
       opts.signal?.removeEventListener("abort", onAbort);
     }
+    if (res.type === "opaqueredirect" || res.status >= 300 && res.status < 400 || res.redirected) {
+      throw new CexyApiError({
+        status: res.status,
+        code: "UNEXPECTED_REDIRECT",
+        message: `${info.method} ${info.path}: the server answered with a redirect (HTTP ${res.status}); the SDK does not follow redirects. Check baseUrl.`,
+        retryable: false
+      });
+    }
     this.config.limiter?.update(res.headers);
     if (!res.ok) {
       const parsed = safeJson(text);
@@ -904,7 +918,7 @@ var TradingResource = class extends Resource {
 };
 
 // src/version.ts
-var VERSION = "0.1.0-dev.2";
+var VERSION = "0.1.0-dev.3";
 var USER_AGENT = `cexy-typescript/${VERSION}`;
 
 // src/ws/emitter.ts
@@ -1664,7 +1678,7 @@ var CexyClient = class {
     assertSecureUrl(parsed, "https:", "http:", options.allowInsecure === true, "baseUrl");
     this.#allowInsecure = options.allowInsecure === true;
     const fetchImpl = options.fetch ?? globalThis.fetch;
-    if (!fetchImpl) throw new CexyConfigError("no global fetch found (Node 20+ required); pass options.fetch");
+    if (!fetchImpl) throw new CexyConfigError("no global fetch found (Node 22+ required); pass options.fetch");
     const timeoutMs = options.timeoutMs ?? 1e4;
     const maxRetries = options.maxRetries ?? 3;
     if (!(timeoutMs > 0)) throw new CexyConfigError("timeoutMs must be > 0");

package/dist/index.d.cts

@@ -3844,7 +3844,7 @@ interface CexyClientOptions {
     timeoutMs?: number;
     /** Retries after the first attempt for retryable failures. Default 3. */
     maxRetries?: number;
-    /** A `fetch` implementation. Default: the global `fetch` (Node 20+, browsers). */
+    /** A `fetch` implementation. Default: the global `fetch` (Node 22+, browsers). */
     fetch?: FetchLike;
     /**
      * Client-side rate limit in requests per minute, or `false` to disable. Default 100/min
@@ -3925,9 +3925,9 @@ declare function isAmount(value: unknown): value is Amount;
 declare function assertAmountFields(body: Record<string, unknown>, fields: readonly string[], context: string): void;
 
 /** SDK version, kept in sync with package.json (a test enforces this). */
-declare const VERSION = "0.1.0-dev.2";
+declare const VERSION = "0.1.0-dev.3";
 /** Default User-Agent product token. */
-declare const USER_AGENT = "cexy-typescript/0.1.0-dev.2";
+declare const USER_AGENT = "cexy-typescript/0.1.0-dev.3";
 
 /** True for loopback hosts, the only ones where plain-text transport may be allowed. */
 declare function isLocalHost(hostname: string): boolean;

package/dist/index.d.ts

@@ -3844,7 +3844,7 @@ interface CexyClientOptions {
     timeoutMs?: number;
     /** Retries after the first attempt for retryable failures. Default 3. */
     maxRetries?: number;
-    /** A `fetch` implementation. Default: the global `fetch` (Node 20+, browsers). */
+    /** A `fetch` implementation. Default: the global `fetch` (Node 22+, browsers). */
     fetch?: FetchLike;
     /**
      * Client-side rate limit in requests per minute, or `false` to disable. Default 100/min
@@ -3925,9 +3925,9 @@ declare function isAmount(value: unknown): value is Amount;
 declare function assertAmountFields(body: Record<string, unknown>, fields: readonly string[], context: string): void;
 
 /** SDK version, kept in sync with package.json (a test enforces this). */
-declare const VERSION = "0.1.0-dev.2";
+declare const VERSION = "0.1.0-dev.3";
 /** Default User-Agent product token. */
-declare const USER_AGENT = "cexy-typescript/0.1.0-dev.2";
+declare const USER_AGENT = "cexy-typescript/0.1.0-dev.3";
 
 /** True for loopback hosts, the only ones where plain-text transport may be allowed. */
 declare function isLocalHost(hostname: string): boolean;

package/dist/index.js

@@ -392,7 +392,13 @@ var Transport = class {
     let res;
     let text;
     try {
-      res = await this.config.fetch(url.toString(), { method: info.method, headers, body, signal: ctrl.signal });
+      res = await this.config.fetch(url.toString(), {
+        method: info.method,
+        headers,
+        body,
+        signal: ctrl.signal,
+        redirect: "manual"
+      });
       text = await res.text();
     } catch (err) {
       if (opts.signal?.aborted) throw opts.signal.reason ?? err;
@@ -404,6 +410,14 @@ var Transport = class {
       clearTimeout(timer);
       opts.signal?.removeEventListener("abort", onAbort);
     }
+    if (res.type === "opaqueredirect" || res.status >= 300 && res.status < 400 || res.redirected) {
+      throw new CexyApiError({
+        status: res.status,
+        code: "UNEXPECTED_REDIRECT",
+        message: `${info.method} ${info.path}: the server answered with a redirect (HTTP ${res.status}); the SDK does not follow redirects. Check baseUrl.`,
+        retryable: false
+      });
+    }
     this.config.limiter?.update(res.headers);
     if (!res.ok) {
       const parsed = safeJson(text);
@@ -902,7 +916,7 @@ var TradingResource = class extends Resource {
 };
 
 // src/version.ts
-var VERSION = "0.1.0-dev.2";
+var VERSION = "0.1.0-dev.3";
 var USER_AGENT = `cexy-typescript/${VERSION}`;
 
 // src/ws/emitter.ts
@@ -1662,7 +1676,7 @@ var CexyClient = class {
     assertSecureUrl(parsed, "https:", "http:", options.allowInsecure === true, "baseUrl");
     this.#allowInsecure = options.allowInsecure === true;
     const fetchImpl = options.fetch ?? globalThis.fetch;
-    if (!fetchImpl) throw new CexyConfigError("no global fetch found (Node 20+ required); pass options.fetch");
+    if (!fetchImpl) throw new CexyConfigError("no global fetch found (Node 22+ required); pass options.fetch");
     const timeoutMs = options.timeoutMs ?? 1e4;
     const maxRetries = options.maxRetries ?? 3;
     if (!(timeoutMs > 0)) throw new CexyConfigError("timeoutMs must be > 0");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cexyio/cexy",
-  "version": "0.1.0-dev.2",
+  "version": "0.1.0-dev.3",
   "description": "Official TypeScript/JavaScript SDK for the CEXY.io REST and WebSocket API",
   "license": "MIT",
   "author": "CEXY.io",
@@ -43,7 +43,7 @@
   ],
   "sideEffects": false,
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "scripts": {
     "generate": "node scripts/generate.mjs",
@@ -65,16 +65,16 @@
     }
   },
   "devDependencies": {
-    "@eslint/js": "^9.39.0",
-    "@types/node": "^20.19.0",
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^22.20.4",
     "@types/ws": "^8.18.0",
-    "eslint": "^9.39.0",
+    "eslint": "^10.11.0",
     "openapi-typescript": "^7.13.0",
     "tsup": "^8.5.0",
     "typescript": "~5.9.3",
     "typescript-eslint": "^8.70.0",
-    "vite": "^6.4.0",
-    "vitest": "^3.2.7",
+    "vite": "^8.3.0",
+    "vitest": "^5.0.2",
     "ws": "^8.18.0"
   },
   "publishConfig": {