@cexyio/cexy 0.1.0-dev.3 → 0.1.0-dev.5

package/dist/index.d.cts

@@ -36,12 +36,6 @@ declare class ApiKeyAuthenticator implements Authenticator {
     toJSON(): Record<string, string>;
 }
 
-/**
- * Client-side token bucket. `CexyClient` defaults to 100 requests/minute without credentials
- * and 300/minute with an API key (the server allows about 120/min per IP and 600/min per
- * key; this keeps a margin). It adapts to `X-RateLimit-Limit`, `X-RateLimit-Remaining` and
- * `X-RateLimit-Reset` when the server sends them, and to 429 `Retry-After`.
- */
 interface RateLimiterOptions {
     requestsPerMinute: number;
     /** @internal for tests */
@@ -62,7 +56,10 @@ declare class RateLimiter {
     acquire(signal?: AbortSignal): Promise<void>;
     /** Adapts to the server's rate-limit headers. Never raises the configured limit. */
     update(headers: Headers): void;
-    /** Blocks all requests for `ms` (used for 429 Retry-After). */
+    /**
+     * Blocks all requests for `ms` (used for 429 Retry-After and `X-RateLimit-Reset`). Server
+     * hints are untrusted: non-finite values are ignored and the block is capped at 120 s.
+     */
     blockFor(ms: number): void;
 }
 
@@ -135,10 +132,10 @@ interface RequestOptions {
     /** Overrides the client's `maxRetries`. */
     maxRetries?: number;
     /**
-     * Mutations only: the `Idempotency-Key` to send. Generated automatically when absent.
-     * The server honours it on pool join/exit; set it yourself to make a retry across process
-     * restarts safe there. Orders and cancels do NOT honour it: their safety comes from
-     * `client_order_id` (see `placeOrder`).
+     * Pool join/exit only: the `Idempotency-Key` to send (generated automatically when absent,
+     * and reused on every retry). The server honours it there; set it yourself to make a retry
+     * across process restarts safe. No other request sends the header: orders and cancels do
+     * not honour it, and their safety comes from `client_order_id` (see `placeOrder`).
      */
     idempotencyKey?: string;
 }
@@ -163,6 +160,8 @@ interface TransportConfig {
     userAgent: string | null;
     sleep: (ms: number, signal?: AbortSignal) => Promise<void>;
     random: () => number;
+    /** Milliseconds clock (default `Date.now`); injectable for tests. */
+    now?: () => number;
     onRetry?: ((info: RetryInfo) => void) | undefined;
 }
 interface CallSpec {
@@ -182,14 +181,17 @@ declare class Transport {
     readonly config: TransportConfig;
     constructor(config: TransportConfig);
     /**
-     * Sends a request with the standard retry policy: GETs retry on retryable errors and
-     * network failures. Mutations carry an `Idempotency-Key` reused on every attempt; the server
-     * honours it on pool join/exit, which makes their retries safe. The other mutations routed
-     * here (cancel-all) are naturally repeatable. `placeOrder` and `cancelOrder` use
+     * Sends a request with the standard retry policy: retryable errors and network failures are
+     * retried. Pool join/exit carry an `Idempotency-Key` reused on every attempt (the server
+     * honours it there, which makes their retries safe); the other mutations routed here
+     * (cancel-all) are naturally repeatable and send no key. `placeOrder` and `cancelOrder` use
      * `attempt()` with their own policies.
      */
     request(spec: CallSpec, opts?: RequestOptions): Promise<RawResponse>;
-    /** Waits before retry number `attempt + 1`, honouring server hints. */
+    /**
+     * Waits before retry number `attempt + 1`, honouring server hints. A server hint longer than
+     * `MAX_SERVER_WAIT_MS` is not waited: `err` is thrown at once (it still carries the hint).
+     */
     backoff(op: OperationId, info: OperationInfo, attempt: number, err: unknown, idempotencyKey: string | undefined, signal?: AbortSignal): Promise<void>;
     /** Full-jitter exponential backoff, or the server's hint plus a little jitter. */
     retryDelay(attempt: number, err: unknown): number;
@@ -730,7 +732,11 @@ interface paths {
         put?: never;
         /**
          * Cancels every open order, optionally within one market.
-         * @description Best-effort: a failure on one order does not stop the rest, and both outcomes are reported. A panic-button endpoint that stops at the first problem is worse than useless.
+         * @description Best-effort: a failure on one order does not stop the rest, and every outcome is reported. A panic-button endpoint that stops at the first problem is worse than useless.
+         *
+         *     An order still being placed when the call starts (status `pending`, for as long as its own placement request runs) is waited for, up to 500 ms per call in total: cancelled if it opens, reported in `already_closed` if it fills or is refused, and in `failed` with code `INVALID_STATE` if it is still being placed at the deadline. Orders placed after the call starts are not part of it. At most 500 orders per call; `has_more` says there are others.
+         *
+         *     Limited to 30 calls a minute per account, on top of the general request limit.
          */
         post: operations["cancel_all"];
         delete?: never;
@@ -1037,12 +1043,31 @@ interface components {
             /** @description Limit the cancellation to one market. Omitted or `null`, every market's open orders are cancelled. */
             symbol?: string | null;
         };
-        /** @description What a bulk cancellation achieved. */
+        /**
+         * @description What a bulk cancellation achieved.
+         *
+         *     Every order the call handled is in exactly one of `cancelled`, `already_closed` and `failed`.
+         */
         CancelAllResponse: {
+            /** @description Orders that closed on their own (filled, rejected, cancelled elsewhere) before this call reached them. Nothing was done to them, and they are not failures. */
+            already_closed: string[];
             /** @description Orders cancelled. */
             cancelled: string[];
-            /** @description Orders that could not be cancelled. Each failure is logged server-side. */
+            /** @description Orders that could not be cancelled in this call. Check `failures` for why, then refresh or call again. */
             failed: string[];
+            /** @description Why each order in `failed` could not be cancelled. */
+            failures: components["schemas"]["CancelFailureResponse"][];
+            /** @description More open orders exist than one call handles (500). Call again. */
+            has_more: boolean;
+        };
+        /** @description Why one order could not be cancelled. */
+        CancelFailureResponse: {
+            /** @description The error code of the attempt, as in any error response: e.g. `INVALID_STATE` for an order still being placed when the wait ran out, or `MARKET_UNAVAILABLE`. */
+            code: string;
+            /** @description Its message. */
+            message: string;
+            /** @description The order. */
+            order_id: string;
         };
         /**
          * @description Candle/kline intervals for market data.
@@ -2877,6 +2902,24 @@ interface operations {
                     };
                 };
             };
+            /** @description No such market */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Over 30 calls a minute for this account; `details.retry_after_seconds` says when to retry */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
         };
     };
     order_history: {
@@ -3181,6 +3224,26 @@ type AssetNetwork = S["AssetNetworkResponse"];
 type Balance = S["BalanceResponse"];
 type CancelAllRequest = S["CancelAllRequest"];
 type CancelAllResult = S["CancelAllResponse"];
+/** Why one order could not be cancelled (`CancelAllResult.failures`). */
+type CancelFailure = S["CancelFailureResponse"];
+/** Why a `cancelAll({ ..., untilDone: true })` loop ended. */
+type CancelAllStopReason = "done" | "max_rounds" | "time_budget";
+/**
+ * Merged result of a `cancelAll({ ..., untilDone: true })` loop. Every order is in exactly one
+ * of `cancelled`, `already_closed` and `failed`, in its latest state; `has_more` is the last
+ * round's.
+ */
+interface CancelAllUntilDoneResult extends CancelAllResult {
+    /** Number of cancel-all calls made. */
+    rounds: number;
+    /** `done`: nothing left to retry; otherwise the loop's limit that ended it. */
+    stopped: CancelAllStopReason;
+    /**
+     * The error code of the last round when that round failed with a retryable error (e.g.
+     * `RATE_LIMITED`, `SERVICE_UNAVAILABLE`, `CONNECTION_ERROR`); absent when it succeeded.
+     */
+    last_error_code?: string;
+}
 type Candle = S["CandleResponse"];
 type CandleInterval = S["CandleInterval"];
 type DepositAddress = S["DepositAddressResponse"];
@@ -3344,6 +3407,14 @@ interface PlaceOrderResult extends PlaceOrderResponse {
  */
 interface CancelAllParams {
     symbol: string | null;
+    /**
+     * Repeat the call until nothing is left to retry (see `cancelAll`). Default false: one call.
+     */
+    untilDone?: boolean;
+    /** With `untilDone`: at most this many calls. Default 20. */
+    maxRounds?: number;
+    /** With `untilDone`: stop before a wait would take the loop to this many ms. Default 120000. */
+    timeBudgetMs?: number;
 }
 declare class TradingResource extends Resource {
     #private;
@@ -3361,7 +3432,7 @@ declare class TradingResource extends Resource {
      *
      * Retry safety rests on `client_order_id` (generated as a UUID when absent): it is unique
      * per account and the server refuses a repeat before any funds move. The server does NOT
-     * honour `Idempotency-Key` on orders (the header is sent but gives no protection). After an
+     * honour `Idempotency-Key` on orders, so none is sent. After an
      * ambiguous failure (network error, timeout or 5xx) the SDK first looks the order up by
      * `client_order_id` and returns it if it exists (`recovered: true`); only if it does not
      * exist does it send the order again, with the same `client_order_id`, so a late-arriving
@@ -3380,12 +3451,35 @@ declare class TradingResource extends Resource {
      * Cancels every open order in one market: `cancelAll({ symbol: "BTC/USDT" })`.
      * To cancel across ALL markets, pass `symbol: null` explicitly: `cancelAll({ symbol: null })`.
      * Omitting `symbol` is an error, so an account-wide cancel never happens by accident
-     * (the server itself treats `{}` as every market).
+     * (the server itself treats `{}` as every market). An unknown symbol throws `NotFoundError`.
+     *
+     * One call handles at most 500 orders. Every order it handled is in exactly one list:
+     * `cancelled`; `already_closed` (it filled, was refused or was cancelled elsewhere first:
+     * not an error); or `failed`, with the reason in `failures` (`INVALID_STATE` for an order
+     * still being placed when the server's 500 ms wait ran out). `has_more` says more orders
+     * remain: call again.
      *
-     * The server limits cancel-all to 30 calls per minute per account. It is naturally
-     * repeatable, so it is retried after network errors; a retry reports only what that retry
-     * cancelled.
+     * With `untilDone: true` the SDK does that for you. It repeats while `has_more` is true or a
+     * failure is `INVALID_STATE` / `SERVICE_UNAVAILABLE`. After a call that made no progress it
+     * waits 1, 2, 4, 8 and then 15 s, starting over after any progress. It stops after
+     * `maxRounds` calls or before a wait would pass `timeBudgetMs`, and returns the merged
+     * result with `rounds` and `stopped`. Other failure codes are returned, never retried.
+     * In this mode every round is exactly one HTTP request (the loop owns the retries, so it
+     * never sends more than `maxRounds` requests): a 429 round waits the server's Retry-After
+     * (without advancing the backoff), another retryable error (5xx, network) takes the next
+     * backoff step, and a wait that would pass the budget ends the loop with
+     * `stopped: "time_budget"` and `last_error_code`. A non-retryable error (e.g. a key without
+     * the trade scope) throws `CancelAllInterruptedError`, which carries the error and the
+     * partial result.
+     *
+     * The server allows 30 cancel-all calls per minute per account. A single call (without
+     * `untilDone`) follows the normal retry policy: a 429 is retried after its Retry-After (up to
+     * 120 s; a longer one fails at once) and network errors are retried, since the call is
+     * naturally repeatable; a retry reports only what that retry did. No Idempotency-Key is sent.
      */
+    cancelAll(params: CancelAllParams & {
+        untilDone: true;
+    }, opts?: RequestOptions): Promise<CancelAllUntilDoneResult>;
     cancelAll(params: CancelAllParams, opts?: RequestOptions): Promise<CancelAllResult>;
 }
 
@@ -3431,6 +3525,16 @@ declare class OrderStateUnknownError extends CexyError {
     readonly clientOrderId: string;
     constructor(clientOrderId: string, cause: unknown);
 }
+/**
+ * A `cancelAll({ ..., untilDone: true })` loop hit an error it does not retry (for example
+ * `ForbiddenError` for a key without the trade scope). `error` is that error; `partial` is what
+ * the earlier rounds did, in the same shape as the loop's normal result.
+ */
+declare class CancelAllInterruptedError extends CexyError {
+    readonly error: unknown;
+    readonly partial: CancelAllUntilDoneResult;
+    constructor(error: unknown, partial: CancelAllUntilDoneResult);
+}
 interface CexyApiErrorInit {
     status: number;
     code: ErrorCode;
@@ -3484,8 +3588,23 @@ declare class RateLimitError extends CexyApiError {
 /** 5xx */
 declare class ServerError extends CexyApiError {
 }
-/** True for codes listed in errors.yaml. */
+/**
+ * Codes the SDK itself sets on a `CexyApiError`; the API never sends them, so they are not in
+ * errors.yaml and `isKnownErrorCode()` returns false for them.
+ * - `UNEXPECTED_REDIRECT`: the server answered with a 3xx. The SDK never follows redirects (the
+ *   credentials would go to the redirect target); not retryable.
+ */
+declare const CLIENT_ERROR_CODES: {
+    readonly UNEXPECTED_REDIRECT: "UNEXPECTED_REDIRECT";
+};
+/** True for codes listed in errors.yaml (server codes; see `CLIENT_ERROR_CODES` for the SDK's own). */
 declare function isKnownErrorCode(code: string): code is KnownErrorCode;
+/**
+ * The longest wait the SDK accepts from a server hint (`Retry-After`, `retry_after_seconds`,
+ * `X-RateLimit-Reset`): 120 s. A longer hint is never waited; the call fails at once instead
+ * (see `Transport.backoff`), and the client-side rate limiter caps its block at this value.
+ */
+declare const MAX_SERVER_WAIT_MS = 120000;
 /**
  * Builds the right error subclass for an HTTP error response.
  * - A known code maps by HTTP status (401 -> AuthenticationError, 403 -> ForbiddenError, ...).
@@ -3844,7 +3963,12 @@ interface CexyClientOptions {
     timeoutMs?: number;
     /** Retries after the first attempt for retryable failures. Default 3. */
     maxRetries?: number;
-    /** A `fetch` implementation. Default: the global `fetch` (Node 22+, browsers). */
+    /**
+     * A `fetch` implementation. Default: the global `fetch` (Node 22+, browsers).
+     * It must honour `redirect: "manual"` (the SDK never follows redirects). A fetch that follows
+     * them anyway has already sent the credentials to the redirect target by the time the SDK sees
+     * `response.redirected` and throws `UNEXPECTED_REDIRECT`.
+     */
     fetch?: FetchLike;
     /**
      * Client-side rate limit in requests per minute, or `false` to disable. Default 100/min
@@ -3866,6 +3990,8 @@ interface CexyClientOptions {
     sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
     /** @internal Deterministic jitter in tests. */
     random?: () => number;
+    /** @internal Replace the clock in tests (milliseconds). */
+    now?: () => number;
 }
 /**
  * CEXY.io REST client.
@@ -3925,11 +4051,11 @@ declare function isAmount(value: unknown): value is Amount;
 declare function assertAmountFields(body: Record<string, unknown>, fields: readonly string[], context: string): void;
 
 /** SDK version, kept in sync with package.json (a test enforces this). */
-declare const VERSION = "0.1.0-dev.3";
+declare const VERSION = "0.1.0-dev.5";
 /** Default User-Agent product token. */
-declare const USER_AGENT = "cexy-typescript/0.1.0-dev.3";
+declare const USER_AGENT = "cexy-typescript/0.1.0-dev.5";
 
 /** True for loopback hosts, the only ones where plain-text transport may be allowed. */
 declare function isLocalHost(hostname: string): boolean;
 
-export { AccountResource, type Amount, type ApiKey, ApiKeyAuthenticator, type ApiScope, type Asset, type AssetNetwork, AssetsResource, type AuthRequest, type AuthResult, type AuthenticatedFrame, AuthenticationError, type Authenticator, type Balance, type BalanceUpdatedEvent, type BookLevel, type CancelAllParams, type CancelAllRequest, type CancelAllResult, type Candle, type CandleInterval, CexyApiError, type CexyApiErrorInit, CexyClient, type CexyClientOptions, CexyConfigError, CexyConnectionError, CexyError, CexyTimeoutError, CexyWebSocket, CexyWebSocketError, type CexyWebSocketEvents, type CexyWebSocketOptions, type CloseInfo, ConflictError, type CursorParams, DEFAULT_BASE_URL, DEFAULT_RPM_ANONYMOUS, DEFAULT_RPM_WITH_KEY, DEFAULT_WS_URL, type Deposit, type DepositAddress, type DepositEvent, type DepositStatus, type ErrorBody, type ErrorCode, type ErrorFrame, type EventMap, type ExchangeConfig, type ExitPoolRequest, type ExitPoolResult, ExportsResource, type FeeSchedule, FeesResource, type FetchLike, type Fill, ForbiddenError, InvalidAmountError, type IterateOptions, type JoinPoolRequest, type JoinPoolResult, JurisdictionBlockedError, KNOWN_EVENT_TYPES, type KnownErrorCode, type LedgerEntry, type LedgerEntryKind, type LiquidityRole, type Listener, LiveOrderBook, type LiveOrderBookEvents, type LiveOrderBookOptions, type MaintenanceState, type Market, type MarketStatus, type MarketStatusEvent, MarketsResource, type Network, NetworksResource, NotFoundError, type Notification, type NotificationKind, OPERATIONS, type OperationAuth, type OperationId, type OperationInfo, type OperationScope, type Order, type OrderBook, type OrderBookUpdateData, type OrderBookUpdateEvent, type OrderEvent, type OrderSide, OrderStateUnknownError, type OrderStatus, type OrderType, PRIVATE_CHANNELS, type Page, type PlaceOrderRequest, type PlaceOrderResponse, type PlaceOrderResult, type PongFrame, type Pool, type PoolStatus, PoolsResource, type PublicTrade, type QueryOf, RateLimitError, RateLimiter, type RateLimiterOptions, type RateLimiterState, type ReconnectOptions, type RequestOptions, type ResyncReason, type RetryInfo, SUPPORTED_PROTOCOL_VERSION, ServerError, type ServerTime, type SessionRevokedData, type SessionRevokedEvent, type SnapshotSource, type SortDirection, type SubAccount, type SubscribeResult, type SubscribedFrame, type TickerUpdateEvent, type TimeInForce, type TradeNewEvent, TradingResource, type TriggerDirection, TypedEmitter, USER_AGENT, UnprocessableError, type UnsubscribedFrame, VERSION, ValidationError, WS_BOOK_DEPTH, WalletResource, type WebSocketConstructor, type WebSocketLike, type WelcomeFrame, type Withdrawal, type WithdrawalAddress, type WithdrawalStatus, type WithdrawalUpdatedEvent, type WsEvent, type WsLogger, assertAmountFields, type components, errorFromResponse, isAmount, isKnownErrorCode, isLocalHost, isRetryable, type operations, paginate, type paths };
+export { AccountResource, type Amount, type ApiKey, ApiKeyAuthenticator, type ApiScope, type Asset, type AssetNetwork, AssetsResource, type AuthRequest, type AuthResult, type AuthenticatedFrame, AuthenticationError, type Authenticator, type Balance, type BalanceUpdatedEvent, type BookLevel, CLIENT_ERROR_CODES, CancelAllInterruptedError, type CancelAllParams, type CancelAllRequest, type CancelAllResult, type CancelAllStopReason, type CancelAllUntilDoneResult, type CancelFailure, type Candle, type CandleInterval, CexyApiError, type CexyApiErrorInit, CexyClient, type CexyClientOptions, CexyConfigError, CexyConnectionError, CexyError, CexyTimeoutError, CexyWebSocket, CexyWebSocketError, type CexyWebSocketEvents, type CexyWebSocketOptions, type CloseInfo, ConflictError, type CursorParams, DEFAULT_BASE_URL, DEFAULT_RPM_ANONYMOUS, DEFAULT_RPM_WITH_KEY, DEFAULT_WS_URL, type Deposit, type DepositAddress, type DepositEvent, type DepositStatus, type ErrorBody, type ErrorCode, type ErrorFrame, type EventMap, type ExchangeConfig, type ExitPoolRequest, type ExitPoolResult, ExportsResource, type FeeSchedule, FeesResource, type FetchLike, type Fill, ForbiddenError, InvalidAmountError, type IterateOptions, type JoinPoolRequest, type JoinPoolResult, JurisdictionBlockedError, KNOWN_EVENT_TYPES, type KnownErrorCode, type LedgerEntry, type LedgerEntryKind, type LiquidityRole, type Listener, LiveOrderBook, type LiveOrderBookEvents, type LiveOrderBookOptions, MAX_SERVER_WAIT_MS, type MaintenanceState, type Market, type MarketStatus, type MarketStatusEvent, MarketsResource, type Network, NetworksResource, NotFoundError, type Notification, type NotificationKind, OPERATIONS, type OperationAuth, type OperationId, type OperationInfo, type OperationScope, type Order, type OrderBook, type OrderBookUpdateData, type OrderBookUpdateEvent, type OrderEvent, type OrderSide, OrderStateUnknownError, type OrderStatus, type OrderType, PRIVATE_CHANNELS, type Page, type PlaceOrderRequest, type PlaceOrderResponse, type PlaceOrderResult, type PongFrame, type Pool, type PoolStatus, PoolsResource, type PublicTrade, type QueryOf, RateLimitError, RateLimiter, type RateLimiterOptions, type RateLimiterState, type ReconnectOptions, type RequestOptions, type ResyncReason, type RetryInfo, SUPPORTED_PROTOCOL_VERSION, ServerError, type ServerTime, type SessionRevokedData, type SessionRevokedEvent, type SnapshotSource, type SortDirection, type SubAccount, type SubscribeResult, type SubscribedFrame, type TickerUpdateEvent, type TimeInForce, type TradeNewEvent, TradingResource, type TriggerDirection, TypedEmitter, USER_AGENT, UnprocessableError, type UnsubscribedFrame, VERSION, ValidationError, WS_BOOK_DEPTH, WalletResource, type WebSocketConstructor, type WebSocketLike, type WelcomeFrame, type Withdrawal, type WithdrawalAddress, type WithdrawalStatus, type WithdrawalUpdatedEvent, type WsEvent, type WsLogger, assertAmountFields, type components, errorFromResponse, isAmount, isKnownErrorCode, isLocalHost, isRetryable, type operations, paginate, type paths };

package/dist/index.d.ts

@@ -36,12 +36,6 @@ declare class ApiKeyAuthenticator implements Authenticator {
     toJSON(): Record<string, string>;
 }
 
-/**
- * Client-side token bucket. `CexyClient` defaults to 100 requests/minute without credentials
- * and 300/minute with an API key (the server allows about 120/min per IP and 600/min per
- * key; this keeps a margin). It adapts to `X-RateLimit-Limit`, `X-RateLimit-Remaining` and
- * `X-RateLimit-Reset` when the server sends them, and to 429 `Retry-After`.
- */
 interface RateLimiterOptions {
     requestsPerMinute: number;
     /** @internal for tests */
@@ -62,7 +56,10 @@ declare class RateLimiter {
     acquire(signal?: AbortSignal): Promise<void>;
     /** Adapts to the server's rate-limit headers. Never raises the configured limit. */
     update(headers: Headers): void;
-    /** Blocks all requests for `ms` (used for 429 Retry-After). */
+    /**
+     * Blocks all requests for `ms` (used for 429 Retry-After and `X-RateLimit-Reset`). Server
+     * hints are untrusted: non-finite values are ignored and the block is capped at 120 s.
+     */
     blockFor(ms: number): void;
 }
 
@@ -135,10 +132,10 @@ interface RequestOptions {
     /** Overrides the client's `maxRetries`. */
     maxRetries?: number;
     /**
-     * Mutations only: the `Idempotency-Key` to send. Generated automatically when absent.
-     * The server honours it on pool join/exit; set it yourself to make a retry across process
-     * restarts safe there. Orders and cancels do NOT honour it: their safety comes from
-     * `client_order_id` (see `placeOrder`).
+     * Pool join/exit only: the `Idempotency-Key` to send (generated automatically when absent,
+     * and reused on every retry). The server honours it there; set it yourself to make a retry
+     * across process restarts safe. No other request sends the header: orders and cancels do
+     * not honour it, and their safety comes from `client_order_id` (see `placeOrder`).
      */
     idempotencyKey?: string;
 }
@@ -163,6 +160,8 @@ interface TransportConfig {
     userAgent: string | null;
     sleep: (ms: number, signal?: AbortSignal) => Promise<void>;
     random: () => number;
+    /** Milliseconds clock (default `Date.now`); injectable for tests. */
+    now?: () => number;
     onRetry?: ((info: RetryInfo) => void) | undefined;
 }
 interface CallSpec {
@@ -182,14 +181,17 @@ declare class Transport {
     readonly config: TransportConfig;
     constructor(config: TransportConfig);
     /**
-     * Sends a request with the standard retry policy: GETs retry on retryable errors and
-     * network failures. Mutations carry an `Idempotency-Key` reused on every attempt; the server
-     * honours it on pool join/exit, which makes their retries safe. The other mutations routed
-     * here (cancel-all) are naturally repeatable. `placeOrder` and `cancelOrder` use
+     * Sends a request with the standard retry policy: retryable errors and network failures are
+     * retried. Pool join/exit carry an `Idempotency-Key` reused on every attempt (the server
+     * honours it there, which makes their retries safe); the other mutations routed here
+     * (cancel-all) are naturally repeatable and send no key. `placeOrder` and `cancelOrder` use
      * `attempt()` with their own policies.
      */
     request(spec: CallSpec, opts?: RequestOptions): Promise<RawResponse>;
-    /** Waits before retry number `attempt + 1`, honouring server hints. */
+    /**
+     * Waits before retry number `attempt + 1`, honouring server hints. A server hint longer than
+     * `MAX_SERVER_WAIT_MS` is not waited: `err` is thrown at once (it still carries the hint).
+     */
     backoff(op: OperationId, info: OperationInfo, attempt: number, err: unknown, idempotencyKey: string | undefined, signal?: AbortSignal): Promise<void>;
     /** Full-jitter exponential backoff, or the server's hint plus a little jitter. */
     retryDelay(attempt: number, err: unknown): number;
@@ -730,7 +732,11 @@ interface paths {
         put?: never;
         /**
          * Cancels every open order, optionally within one market.
-         * @description Best-effort: a failure on one order does not stop the rest, and both outcomes are reported. A panic-button endpoint that stops at the first problem is worse than useless.
+         * @description Best-effort: a failure on one order does not stop the rest, and every outcome is reported. A panic-button endpoint that stops at the first problem is worse than useless.
+         *
+         *     An order still being placed when the call starts (status `pending`, for as long as its own placement request runs) is waited for, up to 500 ms per call in total: cancelled if it opens, reported in `already_closed` if it fills or is refused, and in `failed` with code `INVALID_STATE` if it is still being placed at the deadline. Orders placed after the call starts are not part of it. At most 500 orders per call; `has_more` says there are others.
+         *
+         *     Limited to 30 calls a minute per account, on top of the general request limit.
          */
         post: operations["cancel_all"];
         delete?: never;
@@ -1037,12 +1043,31 @@ interface components {
             /** @description Limit the cancellation to one market. Omitted or `null`, every market's open orders are cancelled. */
             symbol?: string | null;
         };
-        /** @description What a bulk cancellation achieved. */
+        /**
+         * @description What a bulk cancellation achieved.
+         *
+         *     Every order the call handled is in exactly one of `cancelled`, `already_closed` and `failed`.
+         */
         CancelAllResponse: {
+            /** @description Orders that closed on their own (filled, rejected, cancelled elsewhere) before this call reached them. Nothing was done to them, and they are not failures. */
+            already_closed: string[];
             /** @description Orders cancelled. */
             cancelled: string[];
-            /** @description Orders that could not be cancelled. Each failure is logged server-side. */
+            /** @description Orders that could not be cancelled in this call. Check `failures` for why, then refresh or call again. */
             failed: string[];
+            /** @description Why each order in `failed` could not be cancelled. */
+            failures: components["schemas"]["CancelFailureResponse"][];
+            /** @description More open orders exist than one call handles (500). Call again. */
+            has_more: boolean;
+        };
+        /** @description Why one order could not be cancelled. */
+        CancelFailureResponse: {
+            /** @description The error code of the attempt, as in any error response: e.g. `INVALID_STATE` for an order still being placed when the wait ran out, or `MARKET_UNAVAILABLE`. */
+            code: string;
+            /** @description Its message. */
+            message: string;
+            /** @description The order. */
+            order_id: string;
         };
         /**
          * @description Candle/kline intervals for market data.
@@ -2877,6 +2902,24 @@ interface operations {
                     };
                 };
             };
+            /** @description No such market */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            /** @description Over 30 calls a minute for this account; `details.retry_after_seconds` says when to retry */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
         };
     };
     order_history: {
@@ -3181,6 +3224,26 @@ type AssetNetwork = S["AssetNetworkResponse"];
 type Balance = S["BalanceResponse"];
 type CancelAllRequest = S["CancelAllRequest"];
 type CancelAllResult = S["CancelAllResponse"];
+/** Why one order could not be cancelled (`CancelAllResult.failures`). */
+type CancelFailure = S["CancelFailureResponse"];
+/** Why a `cancelAll({ ..., untilDone: true })` loop ended. */
+type CancelAllStopReason = "done" | "max_rounds" | "time_budget";
+/**
+ * Merged result of a `cancelAll({ ..., untilDone: true })` loop. Every order is in exactly one
+ * of `cancelled`, `already_closed` and `failed`, in its latest state; `has_more` is the last
+ * round's.
+ */
+interface CancelAllUntilDoneResult extends CancelAllResult {
+    /** Number of cancel-all calls made. */
+    rounds: number;
+    /** `done`: nothing left to retry; otherwise the loop's limit that ended it. */
+    stopped: CancelAllStopReason;
+    /**
+     * The error code of the last round when that round failed with a retryable error (e.g.
+     * `RATE_LIMITED`, `SERVICE_UNAVAILABLE`, `CONNECTION_ERROR`); absent when it succeeded.
+     */
+    last_error_code?: string;
+}
 type Candle = S["CandleResponse"];
 type CandleInterval = S["CandleInterval"];
 type DepositAddress = S["DepositAddressResponse"];
@@ -3344,6 +3407,14 @@ interface PlaceOrderResult extends PlaceOrderResponse {
  */
 interface CancelAllParams {
     symbol: string | null;
+    /**
+     * Repeat the call until nothing is left to retry (see `cancelAll`). Default false: one call.
+     */
+    untilDone?: boolean;
+    /** With `untilDone`: at most this many calls. Default 20. */
+    maxRounds?: number;
+    /** With `untilDone`: stop before a wait would take the loop to this many ms. Default 120000. */
+    timeBudgetMs?: number;
 }
 declare class TradingResource extends Resource {
     #private;
@@ -3361,7 +3432,7 @@ declare class TradingResource extends Resource {
      *
      * Retry safety rests on `client_order_id` (generated as a UUID when absent): it is unique
      * per account and the server refuses a repeat before any funds move. The server does NOT
-     * honour `Idempotency-Key` on orders (the header is sent but gives no protection). After an
+     * honour `Idempotency-Key` on orders, so none is sent. After an
      * ambiguous failure (network error, timeout or 5xx) the SDK first looks the order up by
      * `client_order_id` and returns it if it exists (`recovered: true`); only if it does not
      * exist does it send the order again, with the same `client_order_id`, so a late-arriving
@@ -3380,12 +3451,35 @@ declare class TradingResource extends Resource {
      * Cancels every open order in one market: `cancelAll({ symbol: "BTC/USDT" })`.
      * To cancel across ALL markets, pass `symbol: null` explicitly: `cancelAll({ symbol: null })`.
      * Omitting `symbol` is an error, so an account-wide cancel never happens by accident
-     * (the server itself treats `{}` as every market).
+     * (the server itself treats `{}` as every market). An unknown symbol throws `NotFoundError`.
+     *
+     * One call handles at most 500 orders. Every order it handled is in exactly one list:
+     * `cancelled`; `already_closed` (it filled, was refused or was cancelled elsewhere first:
+     * not an error); or `failed`, with the reason in `failures` (`INVALID_STATE` for an order
+     * still being placed when the server's 500 ms wait ran out). `has_more` says more orders
+     * remain: call again.
      *
-     * The server limits cancel-all to 30 calls per minute per account. It is naturally
-     * repeatable, so it is retried after network errors; a retry reports only what that retry
-     * cancelled.
+     * With `untilDone: true` the SDK does that for you. It repeats while `has_more` is true or a
+     * failure is `INVALID_STATE` / `SERVICE_UNAVAILABLE`. After a call that made no progress it
+     * waits 1, 2, 4, 8 and then 15 s, starting over after any progress. It stops after
+     * `maxRounds` calls or before a wait would pass `timeBudgetMs`, and returns the merged
+     * result with `rounds` and `stopped`. Other failure codes are returned, never retried.
+     * In this mode every round is exactly one HTTP request (the loop owns the retries, so it
+     * never sends more than `maxRounds` requests): a 429 round waits the server's Retry-After
+     * (without advancing the backoff), another retryable error (5xx, network) takes the next
+     * backoff step, and a wait that would pass the budget ends the loop with
+     * `stopped: "time_budget"` and `last_error_code`. A non-retryable error (e.g. a key without
+     * the trade scope) throws `CancelAllInterruptedError`, which carries the error and the
+     * partial result.
+     *
+     * The server allows 30 cancel-all calls per minute per account. A single call (without
+     * `untilDone`) follows the normal retry policy: a 429 is retried after its Retry-After (up to
+     * 120 s; a longer one fails at once) and network errors are retried, since the call is
+     * naturally repeatable; a retry reports only what that retry did. No Idempotency-Key is sent.
      */
+    cancelAll(params: CancelAllParams & {
+        untilDone: true;
+    }, opts?: RequestOptions): Promise<CancelAllUntilDoneResult>;
     cancelAll(params: CancelAllParams, opts?: RequestOptions): Promise<CancelAllResult>;
 }
 
@@ -3431,6 +3525,16 @@ declare class OrderStateUnknownError extends CexyError {
     readonly clientOrderId: string;
     constructor(clientOrderId: string, cause: unknown);
 }
+/**
+ * A `cancelAll({ ..., untilDone: true })` loop hit an error it does not retry (for example
+ * `ForbiddenError` for a key without the trade scope). `error` is that error; `partial` is what
+ * the earlier rounds did, in the same shape as the loop's normal result.
+ */
+declare class CancelAllInterruptedError extends CexyError {
+    readonly error: unknown;
+    readonly partial: CancelAllUntilDoneResult;
+    constructor(error: unknown, partial: CancelAllUntilDoneResult);
+}
 interface CexyApiErrorInit {
     status: number;
     code: ErrorCode;
@@ -3484,8 +3588,23 @@ declare class RateLimitError extends CexyApiError {
 /** 5xx */
 declare class ServerError extends CexyApiError {
 }
-/** True for codes listed in errors.yaml. */
+/**
+ * Codes the SDK itself sets on a `CexyApiError`; the API never sends them, so they are not in
+ * errors.yaml and `isKnownErrorCode()` returns false for them.
+ * - `UNEXPECTED_REDIRECT`: the server answered with a 3xx. The SDK never follows redirects (the
+ *   credentials would go to the redirect target); not retryable.
+ */
+declare const CLIENT_ERROR_CODES: {
+    readonly UNEXPECTED_REDIRECT: "UNEXPECTED_REDIRECT";
+};
+/** True for codes listed in errors.yaml (server codes; see `CLIENT_ERROR_CODES` for the SDK's own). */
 declare function isKnownErrorCode(code: string): code is KnownErrorCode;
+/**
+ * The longest wait the SDK accepts from a server hint (`Retry-After`, `retry_after_seconds`,
+ * `X-RateLimit-Reset`): 120 s. A longer hint is never waited; the call fails at once instead
+ * (see `Transport.backoff`), and the client-side rate limiter caps its block at this value.
+ */
+declare const MAX_SERVER_WAIT_MS = 120000;
 /**
  * Builds the right error subclass for an HTTP error response.
  * - A known code maps by HTTP status (401 -> AuthenticationError, 403 -> ForbiddenError, ...).
@@ -3844,7 +3963,12 @@ interface CexyClientOptions {
     timeoutMs?: number;
     /** Retries after the first attempt for retryable failures. Default 3. */
     maxRetries?: number;
-    /** A `fetch` implementation. Default: the global `fetch` (Node 22+, browsers). */
+    /**
+     * A `fetch` implementation. Default: the global `fetch` (Node 22+, browsers).
+     * It must honour `redirect: "manual"` (the SDK never follows redirects). A fetch that follows
+     * them anyway has already sent the credentials to the redirect target by the time the SDK sees
+     * `response.redirected` and throws `UNEXPECTED_REDIRECT`.
+     */
     fetch?: FetchLike;
     /**
      * Client-side rate limit in requests per minute, or `false` to disable. Default 100/min
@@ -3866,6 +3990,8 @@ interface CexyClientOptions {
     sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
     /** @internal Deterministic jitter in tests. */
     random?: () => number;
+    /** @internal Replace the clock in tests (milliseconds). */
+    now?: () => number;
 }
 /**
  * CEXY.io REST client.
@@ -3925,11 +4051,11 @@ declare function isAmount(value: unknown): value is Amount;
 declare function assertAmountFields(body: Record<string, unknown>, fields: readonly string[], context: string): void;
 
 /** SDK version, kept in sync with package.json (a test enforces this). */
-declare const VERSION = "0.1.0-dev.3";
+declare const VERSION = "0.1.0-dev.5";
 /** Default User-Agent product token. */
-declare const USER_AGENT = "cexy-typescript/0.1.0-dev.3";
+declare const USER_AGENT = "cexy-typescript/0.1.0-dev.5";
 
 /** True for loopback hosts, the only ones where plain-text transport may be allowed. */
 declare function isLocalHost(hostname: string): boolean;
 
-export { AccountResource, type Amount, type ApiKey, ApiKeyAuthenticator, type ApiScope, type Asset, type AssetNetwork, AssetsResource, type AuthRequest, type AuthResult, type AuthenticatedFrame, AuthenticationError, type Authenticator, type Balance, type BalanceUpdatedEvent, type BookLevel, type CancelAllParams, type CancelAllRequest, type CancelAllResult, type Candle, type CandleInterval, CexyApiError, type CexyApiErrorInit, CexyClient, type CexyClientOptions, CexyConfigError, CexyConnectionError, CexyError, CexyTimeoutError, CexyWebSocket, CexyWebSocketError, type CexyWebSocketEvents, type CexyWebSocketOptions, type CloseInfo, ConflictError, type CursorParams, DEFAULT_BASE_URL, DEFAULT_RPM_ANONYMOUS, DEFAULT_RPM_WITH_KEY, DEFAULT_WS_URL, type Deposit, type DepositAddress, type DepositEvent, type DepositStatus, type ErrorBody, type ErrorCode, type ErrorFrame, type EventMap, type ExchangeConfig, type ExitPoolRequest, type ExitPoolResult, ExportsResource, type FeeSchedule, FeesResource, type FetchLike, type Fill, ForbiddenError, InvalidAmountError, type IterateOptions, type JoinPoolRequest, type JoinPoolResult, JurisdictionBlockedError, KNOWN_EVENT_TYPES, type KnownErrorCode, type LedgerEntry, type LedgerEntryKind, type LiquidityRole, type Listener, LiveOrderBook, type LiveOrderBookEvents, type LiveOrderBookOptions, type MaintenanceState, type Market, type MarketStatus, type MarketStatusEvent, MarketsResource, type Network, NetworksResource, NotFoundError, type Notification, type NotificationKind, OPERATIONS, type OperationAuth, type OperationId, type OperationInfo, type OperationScope, type Order, type OrderBook, type OrderBookUpdateData, type OrderBookUpdateEvent, type OrderEvent, type OrderSide, OrderStateUnknownError, type OrderStatus, type OrderType, PRIVATE_CHANNELS, type Page, type PlaceOrderRequest, type PlaceOrderResponse, type PlaceOrderResult, type PongFrame, type Pool, type PoolStatus, PoolsResource, type PublicTrade, type QueryOf, RateLimitError, RateLimiter, type RateLimiterOptions, type RateLimiterState, type ReconnectOptions, type RequestOptions, type ResyncReason, type RetryInfo, SUPPORTED_PROTOCOL_VERSION, ServerError, type ServerTime, type SessionRevokedData, type SessionRevokedEvent, type SnapshotSource, type SortDirection, type SubAccount, type SubscribeResult, type SubscribedFrame, type TickerUpdateEvent, type TimeInForce, type TradeNewEvent, TradingResource, type TriggerDirection, TypedEmitter, USER_AGENT, UnprocessableError, type UnsubscribedFrame, VERSION, ValidationError, WS_BOOK_DEPTH, WalletResource, type WebSocketConstructor, type WebSocketLike, type WelcomeFrame, type Withdrawal, type WithdrawalAddress, type WithdrawalStatus, type WithdrawalUpdatedEvent, type WsEvent, type WsLogger, assertAmountFields, type components, errorFromResponse, isAmount, isKnownErrorCode, isLocalHost, isRetryable, type operations, paginate, type paths };
+export { AccountResource, type Amount, type ApiKey, ApiKeyAuthenticator, type ApiScope, type Asset, type AssetNetwork, AssetsResource, type AuthRequest, type AuthResult, type AuthenticatedFrame, AuthenticationError, type Authenticator, type Balance, type BalanceUpdatedEvent, type BookLevel, CLIENT_ERROR_CODES, CancelAllInterruptedError, type CancelAllParams, type CancelAllRequest, type CancelAllResult, type CancelAllStopReason, type CancelAllUntilDoneResult, type CancelFailure, type Candle, type CandleInterval, CexyApiError, type CexyApiErrorInit, CexyClient, type CexyClientOptions, CexyConfigError, CexyConnectionError, CexyError, CexyTimeoutError, CexyWebSocket, CexyWebSocketError, type CexyWebSocketEvents, type CexyWebSocketOptions, type CloseInfo, ConflictError, type CursorParams, DEFAULT_BASE_URL, DEFAULT_RPM_ANONYMOUS, DEFAULT_RPM_WITH_KEY, DEFAULT_WS_URL, type Deposit, type DepositAddress, type DepositEvent, type DepositStatus, type ErrorBody, type ErrorCode, type ErrorFrame, type EventMap, type ExchangeConfig, type ExitPoolRequest, type ExitPoolResult, ExportsResource, type FeeSchedule, FeesResource, type FetchLike, type Fill, ForbiddenError, InvalidAmountError, type IterateOptions, type JoinPoolRequest, type JoinPoolResult, JurisdictionBlockedError, KNOWN_EVENT_TYPES, type KnownErrorCode, type LedgerEntry, type LedgerEntryKind, type LiquidityRole, type Listener, LiveOrderBook, type LiveOrderBookEvents, type LiveOrderBookOptions, MAX_SERVER_WAIT_MS, type MaintenanceState, type Market, type MarketStatus, type MarketStatusEvent, MarketsResource, type Network, NetworksResource, NotFoundError, type Notification, type NotificationKind, OPERATIONS, type OperationAuth, type OperationId, type OperationInfo, type OperationScope, type Order, type OrderBook, type OrderBookUpdateData, type OrderBookUpdateEvent, type OrderEvent, type OrderSide, OrderStateUnknownError, type OrderStatus, type OrderType, PRIVATE_CHANNELS, type Page, type PlaceOrderRequest, type PlaceOrderResponse, type PlaceOrderResult, type PongFrame, type Pool, type PoolStatus, PoolsResource, type PublicTrade, type QueryOf, RateLimitError, RateLimiter, type RateLimiterOptions, type RateLimiterState, type ReconnectOptions, type RequestOptions, type ResyncReason, type RetryInfo, SUPPORTED_PROTOCOL_VERSION, ServerError, type ServerTime, type SessionRevokedData, type SessionRevokedEvent, type SnapshotSource, type SortDirection, type SubAccount, type SubscribeResult, type SubscribedFrame, type TickerUpdateEvent, type TimeInForce, type TradeNewEvent, TradingResource, type TriggerDirection, TypedEmitter, USER_AGENT, UnprocessableError, type UnsubscribedFrame, VERSION, ValidationError, WS_BOOK_DEPTH, WalletResource, type WebSocketConstructor, type WebSocketLike, type WelcomeFrame, type Withdrawal, type WithdrawalAddress, type WithdrawalStatus, type WithdrawalUpdatedEvent, type WsEvent, type WsLogger, assertAmountFields, type components, errorFromResponse, isAmount, isKnownErrorCode, isLocalHost, isRetryable, type operations, paginate, type paths };