@mathieuc/tradingview 4.0.0-beta.4 → 4.0.0-rc.0

package/README.md

@@ -25,7 +25,7 @@ console.log(candles.at(-1)); // { time, open, high, low, close, volume }
 
 Prefer to start without code? The setup paths below work too.
 
-> **Version 4 is a breaking rewrite** in TypeScript, with a new API and no compatibility layer. Coming from v3? Read the [migration guide](docs/migration-v4.md). Every v3 feature is still available: see the [coverage matrix](docs/v4-coverage.md) and [reliability evidence](docs/v4-reliability.md). npm versions 3.x keep the previous `Client` API; check the [npm page](https://www.npmjs.com/package/@mathieuc/tradingview) for the version you install.
+> **Version 4 is a breaking rewrite** in TypeScript, with a new API and no compatibility layer. Coming from v3? Read the [migration guide](docs/migration-v4.md). Every v3 feature is still available: see the [coverage matrix](docs/v4-coverage.md) and [reliability evidence](docs/v4-reliability.md). The [RC preparation report](docs/v4-stabilization.md) tracks current checks and remaining release gates. npm versions 3.x keep the previous `Client` API; check the [npm page](https://www.npmjs.com/package/@mathieuc/tradingview) for the version you install.
 
 ## Get started
 
@@ -95,6 +95,8 @@ const { values } = await getIndicatorData({
 | Quotes: last price, change, bid/ask, volume... | `getQuote`, `getQuotes`, `watchQuotes` |
 | Indicator values, drawings and strategy reports | `getIndicatorData`, `watchIndicator` |
 | Symbol metadata | `getSymbolInfo` |
+| Stock/crypto screening and ranked lists | `getScreener`, `getHotlist` |
+| Account watchlists (read-only) | `getWatchlists` |
 | Search and ratings | `searchMarkets`, `searchIndicators`, `getTechnicalAnalysis` |
 
 Websocket data functions accept `timeoutMs`, an `AbortSignal`, account `credentials`, and an optional shared `client`. HTTP lookups accept an `AbortSignal` through their options. Errors are `TradingViewError`s with a `code` such as `SYMBOL_ERROR`, `TIMEOUT` or `STUDY_ERROR`. Read the [data API guide](docs/data-api.md) for every option.

package/dist/client/client.js

@@ -21,6 +21,7 @@ export class TradingViewClient extends Emitter {
     ready;
     #authenticated = false;
     #authToken;
+    #authController = new AbortController();
     #closed = false;
     #closing = false;
     #closeRequested = false;
@@ -71,14 +72,16 @@ export class TradingViewClient extends Emitter {
             this.#authToken = options.authToken;
         }
         else if (options.credentials?.session) {
-            getUser(options.credentials, { location: options.location, fetch: options.fetch })
+            getUser(options.credentials, { location: options.location, fetch: options.fetch, signal: this.#authController.signal })
                 .then((user) => {
-                if (this.#closed)
+                if (this.#closed || this.#closing)
                     return;
                 this.#authToken = user.authToken;
                 this.#authenticate();
             })
                 .catch((error) => {
+                if (this.#closed || this.#closing)
+                    return;
                 this.#fail(new TradingViewError('AUTH_ERROR', `Credentials error: ${toTradingViewError(error).message}`, {
                     cause: error,
                 }));
@@ -145,6 +148,7 @@ export class TradingViewClient extends Emitter {
             if (this.#closing)
                 return;
             this.#closing = true;
+            this.#authController.abort();
             // Do not hang if the server never acknowledges the close.
             setTimeout(() => this.#onClose(1000, 'Close timeout'), 3_000).unref?.();
             this.#transport.close();
@@ -224,6 +228,7 @@ export class TradingViewClient extends Emitter {
             this.emit('error', error);
         if (!wasReady || error.code === 'AUTH_ERROR' || error.code === 'CONNECTION_ERROR') {
             this.#closing = true;
+            this.#authController.abort();
             this.#transport.close();
             // Some transports never emit close after a failed handshake.
             setTimeout(() => this.#onClose(undefined, error.message), 3_000).unref?.();
@@ -233,6 +238,7 @@ export class TradingViewClient extends Emitter {
         if (this.#closed)
             return;
         this.#closed = true;
+        this.#authController.abort();
         this.#authenticated = false;
         clearTimeout(this.#readyTimer);
         this.#log?.('close', code, reason);

package/dist/http/account.js

@@ -112,8 +112,11 @@ export async function getUser(credentials, options = {}) {
     let location = trustedAccountLocation(options.location ?? 'https://www.tradingview.com/chart/');
     for (let redirects = 0;; redirects += 1) {
         const { status, text, headers } = await request(location, { credentials, redirect: 'manual' }, options);
-        if (text.includes('auth_token'))
-            return parseUserPage(text, credentials);
+        if (status >= 200 && status < 300 && text.includes('auth_token')) {
+            const user = parseUserPage(text, credentials);
+            if (user.authToken)
+                return user;
+        }
         const next = headers.get('location');
         const resolved = status >= 300 && status < 400 && next ? new URL(next, location).toString() : undefined;
         if (!resolved || resolved === location) {

package/dist/http/request.js

@@ -51,6 +51,7 @@ export async function request(url, init, options = {}) {
     const body = requestBody(init, headers);
     const fetchImpl = options.fetch ?? globalThis.fetch;
     let response;
+    let text;
     try {
         response = await fetchImpl(target.toString(), {
             method: init.method ?? (body === undefined ? 'GET' : 'POST'),
@@ -59,11 +60,11 @@ export async function request(url, init, options = {}) {
             redirect: init.redirect ?? 'follow',
             signal: options.signal,
         });
+        text = await response.text();
     }
     catch (error) {
         throw toTradingViewError(error, 'HTTP_ERROR');
     }
-    const text = await response.text();
     if (response.status >= 500) {
         throw new TradingViewError('HTTP_ERROR', `${target.host} answered HTTP ${response.status}`, {
             details: { status: response.status, body: text.slice(0, 500) },

package/docs/README.es.md

@@ -35,7 +35,7 @@ const watcher = await watchCandles({ symbol: 'BINANCE:BTCUSDT', timeframe: '1' }
 await watcher.stop();
 ```
 
-Cada función gestiona la conexión, el tiempo máximo (`timeoutMs`), la cancelación (`signal`) y la limpieza. Otras funciones: `getQuotes`, `watchQuotes`, `getSymbolInfo`, `getIndicatorData`, `watchIndicator`, `searchMarkets`, `searchIndicators`, `getTechnicalAnalysis`. Detalles: [guía de la API de datos](data-api.md).
+Cada función gestiona la conexión, el tiempo máximo (`timeoutMs`), la cancelación (`signal`) y la limpieza. Otras funciones: `getQuotes`, `watchQuotes`, `getSymbolInfo`, `getIndicatorData`, `watchIndicator`, `searchMarkets`, `searchIndicators`, `getTechnicalAnalysis`, `getScreener`, `getHotlist`, `getWatchlists`. Detalles: [guía de la API de datos](data-api.md).
 
 ## API de bajo nivel
 

package/docs/README.fr.md

@@ -35,7 +35,7 @@ const watcher = await watchCandles({ symbol: 'BINANCE:BTCUSDT', timeframe: '1' }
 await watcher.stop();
 ```
 
-Chaque fonction gère la connexion, le délai maximal (`timeoutMs`), l'annulation (`signal`) et le nettoyage. Autres fonctions : `getQuotes`, `watchQuotes`, `getSymbolInfo`, `getIndicatorData`, `watchIndicator`, `searchMarkets`, `searchIndicators`, `getTechnicalAnalysis`. Détails : [guide de l'API de données](data-api.md).
+Chaque fonction gère la connexion, le délai maximal (`timeoutMs`), l'annulation (`signal`) et le nettoyage. Autres fonctions : `getQuotes`, `watchQuotes`, `getSymbolInfo`, `getIndicatorData`, `watchIndicator`, `searchMarkets`, `searchIndicators`, `getTechnicalAnalysis`, `getScreener`, `getHotlist`, `getWatchlists`. Détails : [guide de l'API de données](data-api.md).
 
 ## API bas niveau
 

package/docs/README.pt.md

@@ -35,7 +35,7 @@ const watcher = await watchCandles({ symbol: 'BINANCE:BTCUSDT', timeframe: '1' }
 await watcher.stop();
 ```
 
-Cada função cuida da conexão, do tempo máximo (`timeoutMs`), do cancelamento (`signal`) e da limpeza. Outras funções: `getQuotes`, `watchQuotes`, `getSymbolInfo`, `getIndicatorData`, `watchIndicator`, `searchMarkets`, `searchIndicators`, `getTechnicalAnalysis`. Detalhes: [guia da API de dados](data-api.md).
+Cada função cuida da conexão, do tempo máximo (`timeoutMs`), do cancelamento (`signal`) e da limpeza. Outras funções: `getQuotes`, `watchQuotes`, `getSymbolInfo`, `getIndicatorData`, `watchIndicator`, `searchMarkets`, `searchIndicators`, `getTechnicalAnalysis`, `getScreener`, `getHotlist`, `getWatchlists`. Detalhes: [guia da API de dados](data-api.md).
 
 ## API de baixo nível
 

package/docs/v4-backlog-triage.md

@@ -2,14 +2,14 @@
 
 Baseline: `da67081` / published `4.0.0-beta.1`. Snapshot: **96 open issues and 8 open PRs**.
 
-Follow-up: #334 was merged on 3 October 2026. The focused fixes are included in the beta.2 release candidate. Reliability tools from #330 were subsequently ported without its stale version/README changes; the completed two-hour result is recorded in [reliability evidence](v4-reliability.md). Historical rows below describe the initial snapshot, not current PR state.
+Follow-up: #334 was merged on 3 October 2026. The focused fixes are included in the beta.2 release candidate. Reliability tools from #330 were subsequently ported without its stale version/README changes; the completed two-hour result is recorded in [reliability evidence](v4-reliability.md). The issue table below is refreshed through beta.5/stabilization; dated verification sections retain their original evidence.
 
 This is an issue-by-issue disposition, not a claim that 96 bugs were reproduced or fixed.
 Evidence comes from issue descriptions, current source/tests and the existing [coverage matrix](v4-coverage.md).
 “Covered by code” is weaker than a targeted regression or live reproduction. “Needs” means keep open.
 No issues/legacy PRs were closed, and no contributor comments were sent by this pass.
 
-## Immediate findings
+## Initial beta.1 findings (historical)
 
 1. **Authentication gap:** PR #330 is still open. Its `/chart/` default and non-3xx redirect guard are absent from beta.1. This change ports only that focused fix with its regression test, not its old release/version text.
 2. **Concrete missing feature:** #225 country/sector search filters implemented in this change, with deterministic query coverage and a public live endpoint probe.
@@ -18,9 +18,12 @@ No issues/legacy PRs were closed, and no contributor comments were sent by this
 
 ## Issues
 
+Current inventory: **95 open issues and 7 legacy open PRs** on 3 October 2026.
+Rows describe capability disposition, not automatic authorization to close reports.
+
 | Issue | Disposition | Evidence / next action |
 | --- | --- | --- |
-| [#321](https://github.com/Mathieu2301/TradingView-API/issues/321) getUser reports "Too many redirects" for HTTP 200 responses without auth_token | Partial → patched | The beta avoids missing-Location loops, but still starts at the homepage and follows a Location on HTTP 200. Ported the focused fix from PR #330; HTTP regression test passes. Not yet published. |
+| [#321](https://github.com/Mathieu2301/TradingView-API/issues/321) getUser reports "Too many redirects" for HTTP 200 responses without auth_token | Partial → patched | Published since beta.2: starts at /chart/ and follows Location only on 3xx. HTTP regression and authenticated live suite pass; CAPTCHA/WAF remains outside this fix. |
 | [#319](https://github.com/Mathieu2301/TradingView-API/issues/319) More Control and access to data | Missing | Paper-trading account management and order execution are not exposed by V4. |
 | [#313](https://github.com/Mathieu2301/TradingView-API/issues/313) History Create Session / Request History Data Features help | Missing / gated | No HistorySession or request_history_data implementation. PR #204 is a protocol reference, not V4-compatible code; requires entitled-account live validation. |
 | [#312](https://github.com/Mathieu2301/TradingView-API/issues/312) tradingview wss is updated? | Needs reproduction | Current transport and timeouts are implemented, but the original connection timeout has no host/network trace. Capture exact endpoint, Node version and error on V4. |
@@ -49,7 +52,7 @@ No issues/legacy PRs were closed, and no contributor comments were sent by this
 | [#232](https://github.com/Mathieu2301/TradingView-API/issues/232) Crypto Cap (e.g. CRYPTOCAP:TOTAL) symbols return "invalid symbol" | Needs reproduction | Issue is specifically CRYPTOCAP Replay, not ordinary candles. Test replay on TOTAL/OTHERS with an entitled account. |
 | [#231](https://github.com/Mathieu2301/TradingView-API/issues/231) Missing data in examples/FromToData.js - provided date and custom date | Partial / server limits | getCandles from/to pagination is implemented; historical intraday availability remains server/account limited. Reproduce original window, not just a recent range. |
 | [#230](https://github.com/Mathieu2301/TradingView-API/issues/230) os.version is not a function / Can't resolve 'os" | Unsupported environment | V4 targets Node/Bun and imports node:os/ws. Browser-extension support is not established by removing the old os.version call. |
-| [#225](https://github.com/Mathieu2301/TradingView-API/issues/225) Add additional filter on search market v3 | Missing → implemented | Added country/sector to searchMarkets, preserving exchange/type/offset. Unit coverage and public endpoint probe; not yet published. |
+| [#225](https://github.com/Mathieu2301/TradingView-API/issues/225) Add additional filter on search market v3 | Missing → implemented | Published since beta.2: country/sector filters preserve exchange/type/offset. Deterministic forwarding checks and public endpoint probe. |
 | [#224](https://github.com/Mathieu2301/TradingView-API/issues/224) Default setting indicators | Partial | getIndicator provides defaults and PineIndicator.clone preserves a baseline. No reset-to-defaults convenience method; document reload/clone workflow. |
 | [#223](https://github.com/Mathieu2301/TradingView-API/issues/223) Premium account doesn't return 20000 bars for server='prodata' | Needs entitled account | Pagination and credentials exist, but Premium/prodata 20k-bar entitlement is not proven with Basic. |
 | [#222](https://github.com/Mathieu2301/TradingView-API/issues/222) Wrong or expired sessionid/signature - all time | Needs account reproduction | V4 credentials are { session, signature }; focused getUser patch helps page selection, but does not establish the original account entitlement or cookie validity. |
@@ -63,7 +66,7 @@ No issues/legacy PRs were closed, and no contributor comments were sent by this
 | [#201](https://github.com/Mathieu2301/TradingView-API/issues/201) Private indicators | Needs private asset | Private listing/auth paths are implemented; specific invite-only access and private study values require an authorized matching script fixture. |
 | [#199](https://github.com/Mathieu2301/TradingView-API/issues/199) Manage pine scripts | Missing | Pine permissions/listing are not script source create/update/delete APIs. |
 | [#193](https://github.com/Mathieu2301/TradingView-API/issues/193) TypeError: str.replace is not a function - Handling Buffer Input in parseWSPacket | Covered by code | src/client/transport.ts converts Buffer, Buffer[] and ArrayBuffer to text before framing. Historical caller-specific environment not reproduced. |
-| [#192](https://github.com/Mathieu2301/TradingView-API/issues/192) 15 minutes delay for MOEX market | Upstream entitlement / missing | Exchange real-time rights and server delays must be checked with that venue/account. General stock screener API is not implemented. |
+| [#192](https://github.com/Mathieu2301/TradingView-API/issues/192) 15 minutes delay for MOEX market | Upstream entitlement / missing | Exchange real-time rights and server delays must be checked with that venue/account. getScreener is available since beta.3, but does not grant exchange real-time rights. |
 | [#191](https://github.com/Mathieu2301/TradingView-API/issues/191) How to install? | Covered | README installation/quick start, docs/data-api.md and examples cover the requested entry point; package consumer smoke passes. |
 | [#188](https://github.com/Mathieu2301/TradingView-API/issues/188) Pine 'referencing length of a series' error after about 12 hours | Needs long-run reproduction | 12-hour Pine max_bars_back failure is not a normal indicator input. Need script and long-running capture; short endurance runs cannot resolve it. |
 | [#184](https://github.com/Mathieu2301/TradingView-API/issues/184) Proxy support  | Partial | Custom WebSocket transport and HTTP fetch hooks permit adapters, but no documented/tested unified proxy configuration. PR #208 cannot be merged unchanged. |
@@ -104,27 +107,27 @@ No issues/legacy PRs were closed, and no contributor comments were sent by this
 | [#101](https://github.com/Mathieu2301/TradingView-API/issues/101) FakeReplay always returning the same day | Needs targeted regression | Negative-count history is live-tested generally; exact repeated-day/gap cases and exchange holidays still need reproduction. |
 | [#89](https://github.com/Mathieu2301/TradingView-API/issues/89) No "strategyReport.trades"  data for private strategy  backtest | Needs private asset | Public and compressed reports are proven; missing trades for the specific private strategy is not yet reproduced. |
 | [#88](https://github.com/Mathieu2301/TradingView-API/issues/88) Data point is missing in FakeReplayMode example output | Needs targeted regression | Negative-count history is live-tested generally; exact repeated-day/gap cases and exchange holidays still need reproduction. |
-| [#87](https://github.com/Mathieu2301/TradingView-API/issues/87) Feature : get watchlists | Missing | No watchlist or hotlist API; useful next discovery target alongside screener. |
-| [#85](https://github.com/Mathieu2301/TradingView-API/issues/85) Question : Can you enable stock screener real-time ? | Upstream entitlement / missing | Exchange real-time rights and server delays must be checked with that venue/account. General stock screener API is not implemented. |
+| [#87](https://github.com/Mathieu2301/TradingView-API/issues/87) Feature : get watchlists | Covered with live limits | Published in beta.4: getWatchlists and scanner-ranked getHotlist. Populated lists are fixture-tested; available account lists are empty. UI parity is not claimed. |
+| [#85](https://github.com/Mathieu2301/TradingView-API/issues/85) Question : Can you enable stock screener real-time ? | Upstream entitlement / missing | Exchange real-time rights and server delays must be checked with that venue/account. getScreener is available since beta.3, but does not grant exchange real-time rights. |
 | [#84](https://github.com/Mathieu2301/TradingView-API/issues/84) Alerts feature | Missing | No TradingView alert CRUD or triggered-alert subscription. Local quote/study listeners are not server-side alerts. |
 | [#83](https://github.com/Mathieu2301/TradingView-API/issues/83) how to get update data of strategy.entry trigger signal. | Partial | Strategy reports and study updates exist; no dedicated exactly-once strategy.entry signal stream. Application must distinguish intrabar updates. |
 | [#80](https://github.com/Mathieu2301/TradingView-API/issues/80) [V3] Same output multiple times | Needs reproduction | Repeated update events may be intrabar updates or study lifecycle effects. No evidence yet of a V4 fix for this exact script. |
 | [#79](https://github.com/Mathieu2301/TradingView-API/issues/79) Where can I find the chart_id for getDrawings? | Partial documentation | getDrawings supports chartId/layout inputs, but extracting the correct internal chart ID needs a saved-layout example and private validation. |
 | [#73](https://github.com/Mathieu2301/TradingView-API/issues/73) Strategy Optimization Steps | Partial | Inputs and reports exist; no bounded optimization runner, date-window Deep Backtest or throttle-aware multithreading API. |
 | [#66](https://github.com/Mathieu2301/TradingView-API/issues/66) Maximum number of studies per chart has been reached | Upstream limits | Server study/session/calculation limits are not removed by V4. Bound concurrency, release sessions and reproduce account-specific thresholds; no bulk retry flood. |
-| [#53](https://github.com/Mathieu2301/TradingView-API/issues/53) Stock Screener API | Missing | No general stock screener API; getTechnicalAnalysis is only a fixed-column ratings request. |
+| [#53](https://github.com/Mathieu2301/TradingView-API/issues/53) Stock Screener API | Covered HTTP API | Published in beta.3: getScreener supports columns, filters, ranking and pagination; deterministic and anonymous live checks. Not a push subscription. |
 | [#51](https://github.com/Mathieu2301/TradingView-API/issues/51) Adding some sort of documentation | Covered | README installation/quick start, docs/data-api.md and examples cover the requested entry point; package consumer smoke passes. |
 | [#30](https://github.com/Mathieu2301/TradingView-API/issues/30) Can I Hire You To Set This Up For Me? | Administrative | Collaboration/service proposal, not a reproducible library defect. No unsolicited outreach in this triage. |
 | [#24](https://github.com/Mathieu2301/TradingView-API/issues/24) Renko chart's indicator value does not match GUI-based TradingView's, given same configurations | Needs parity reproduction | Renko chart type is live-tested, but this exact multi-timeframe study/GUI value mismatch is not. Need matched bars, inputs and account. |
 
-## Open pull requests
+## Legacy pull requests
 
 | PR | Verified disposition | Next action |
 | --- | --- | --- |
-| [#330](https://github.com/Mathieu2301/TradingView-API/pull/330) | **Not merged.** Auth fix, parity/endurance scripts and recovery live test remain useful. Version/release prose is stale. | Focused auth port included here. Retain/rebase remaining reliability work; recover saved endurance results before claiming completion. |
+| [#330](https://github.com/Mathieu2301/TradingView-API/pull/330) | Closed/superseded after focused ports in #334/#335. Authentication, parity/endurance tooling and recovery checks are included in beta.2. | No remaining code port from this PR is needed for the documented scope; the recovered two-hour result is in reliability evidence. |
 | [#322](https://github.com/Mathieu2301/TradingView-API/pull/322) | Legacy V3 authentication patch; not directly applicable to TS V4. | Its chart-page/status semantics are carried through #330 into this port. Decide V3 backport separately while latest is 3.5.2. |
 | [#320](https://github.com/Mathieu2301/TradingView-API/pull/320) | V3 this-binding patch. V4 HTTP functions are standalone, not receiver-based. | Superseded for V4; possible V3 maintenance value. |
-| [#318](https://github.com/Mathieu2301/TradingView-API/pull/318) | Binding fix is superseded, but dependency upgrade is **not** automatically superseded: The baseline still uses Vitest 3. | Audit confirmed GHSA-82fw-gwwq-j7x9 in Vitest/mocker. Updated to patched Vitest 4.1.11+ in this change; not the older vulnerable 4.1.9 from the PR. |
+| [#318](https://github.com/Mathieu2301/TradingView-API/pull/318) | V4 uses standalone HTTP functions and patched Vitest 4.1.11. The original Vitest 3 baseline no longer applies. | Audit confirmed GHSA-82fw-gwwq-j7x9 in Vitest/mocker. Updated to patched Vitest 4.1.11+ in this change; not the older vulnerable 4.1.9 from the PR. |
 | [#289](https://github.com/Mathieu2301/TradingView-API/pull/289) | General chart event registration exists via Emitter.on/onAny and event tests. | Superseded for V4; no need to port V3 callback storage. |
 | [#219](https://github.com/Mathieu2301/TradingView-API/pull/219) | Native TS build emits declarations and package smoke compiles a strict consumer. | Superseded for V4; avoid stale generated V3 declarations. |
 | [#208](https://github.com/Mathieu2301/TradingView-API/pull/208) | Axios/ws proxy patch targets removed V3 architecture. V4 offers transport/fetch injection, not a turnkey proxy. | Preserve intent; implement/test an adapter recipe across both HTTP and WS before resolving #184. |
@@ -143,10 +146,19 @@ No issues/legacy PRs were closed, and no contributor comments were sent by this
 
 Beta.3 adds `getScreener` for #53 and scanner fields relevant to #280. See
 [screener documentation](screener.md). #85 real-time exchange entitlement is not
-resolved by a successful HTTP scan. Watchlists and paid/private cases remain open.
+resolved by a successful HTTP scan. Watchlists shipped subsequently in beta.4; paid/private case limitations remain.
 
 ## Watchlist follow-up
 
 Beta.4 adds read-only `getWatchlists` and scanner-ranked `getHotlist` (#87).
 Authenticated discovery returned two empty lists; populated entries are fixture-tested.
 Exact TradingView UI hotlist parity is not claimed. See [watchlists](watchlists.md).
+
+## Account and endurance follow-up
+
+Beta.5 ships opt-in account/endurance diagnostics and documents six successful
+private USER-script runs. Deep Backtesting reached the server but returned
+`request_error` / `not_allowed` with the available account. This is a concrete
+prerequisite blocker, not implemented Premium support. Original private-script,
+CME/GUI and 12-hour issue fixtures remain necessary; no historical issue is closed
+from the broader smoke results. See [reliability evidence](v4-reliability.md).

package/docs/v4-coverage.md

@@ -6,7 +6,7 @@ This matrix lists every capability of v3 (`main.js`, `src/`, examples, tests) an
 
 **Evidence columns**
 
-- **Unit**: deterministic test in `tests/unit/` (`npm test` with Vitest on Node, `npm run test:bun` with Bun's runner; 118 tests, both green). Websocket tests use a scripted fake server (`tests/helpers/fake-server.ts`) or packets captured from TradingView (`tests/fixtures/live-session.json`); HTTP tests use a mocked `fetch`.
+- **Unit**: deterministic test in `tests/unit/` (`npm test` with Vitest on Node, `npm run test:bun` with Bun's runner; 135 tests in the stabilization candidate, both green). Websocket tests include the native Node/Bun transport against a loopback server (`tests/unit/transport.test.ts`), a scripted fake server (`tests/helpers/fake-server.ts`) or packets captured from TradingView (`tests/fixtures/live-session.json`); HTTP tests use a mocked `fetch`.
 - **Live**: result of `npm run test:live` (`tests/live/`) and examples against TradingView on **2 October 2026**: 16 anonymous tests locally and 21 tests (including five authenticated) in the [manual GitHub Actions run](https://github.com/Mathieu2301/TradingView-API/actions/runs/37075296707):
   - ✅ verified live anonymously;
   - 🔒 path or variant not exercised live (often requires a specific account asset); deterministic tests only;
@@ -16,6 +16,25 @@ Beta.2 follow-up on **3 October 2026**: all 22 current live tests passed locally
 
 Test names are abbreviated as `file › test`.
 
+## Stabilization checks — 3 October 2026
+
+`npm run test:coverage` measures **source files only** with V8 (test helpers are excluded).
+The CI Node 22 job enforces minimums of 90% lines, 85% statements/functions and 75%
+branches, and uploads the HTML/JSON report. These are regression floors, not claims
+of universal behavior. Network/account coverage is tracked independently below.
+See the [stabilization report](v4-stabilization.md) for release gates and current results.
+
+| Capability / failure path | Deterministic evidence | Live evidence / limit |
+| --- | --- | --- |
+| Screener pagination, fields, types and errors | `screener.test.ts` | `live/data.test.ts`: requested BTC symbol and price |
+| Ranked lists (four kinds) | `watchlists.test.ts` | `live/data.test.ts`: populated volume ranking; not UI parity |
+| Read-only account watchlists | `watchlists.test.ts`: populated lists, sections, metadata, auth failures | `live/authenticated.test.ts`: read-only response; available lists are empty |
+| HTTP response stream failure / cancellation | `http.test.ts`: typed HTTP_ERROR / ABORTED after headers | Simulated, not an upstream failure claim |
+| Authentication cancelled by close, disconnect or timeout | `client.test.ts`: request aborted, no late AUTH_ERROR or auth packet | Simulated lifecycle failures |
+| Empty/malformed auth token or rejected HTTP page | `http.test.ts`: AUTH_ERROR | Existing authenticated suite checks successful lookup |
+| Native websocket framing, Origin and handshake failure | `transport.test.ts`: real loopback websocket under both runners | Does not reproduce DNS, proxy or internet loss |
+| Published exports and declarations | `scripts/smoke.mjs`: tarball, Node/Bun, require(esm), strict TS including discovery APIs | No TradingView access in smoke |
+
 ## Package and tooling
 
 | v3 capability | v4 | Unit evidence | Live |
@@ -111,7 +130,7 @@ Test names are abbreviated as `file › test`.
 | `PineIndicator` getters (`pineId`, `pineVersion`, description, inputs, plots, script, type) and `setType` | `id`, `version`, same others; `setType`, `clone` | `indicators › clones independently...` | ✅ (`sessions › loads Pine indicator definitions`) |
 | `PineIndicator.setOption` (by `in_N`, number, inline name, internal ID; type and option checks) | `setInput`, `setInputs`, `findInput` | `indicators › finds inputs by ID...` | ✅ (definition-level) |
 | `BuiltInIndicator(type)`, defaults for Volume and volume profiles, `setOption(key, value, FORCE)` | Same (+ initial options; time defaults computed per instance instead of at import) | `indicators › BuiltInIndicator › *` | ✅ (`Volume`, `VbPFixed@tv-basicstudies-241!`) |
-| `getIndicator(id, version, session, signature)` (pine-facade translate, input/plot naming) | `getIndicator(id, { version, credentials })`, `parseIndicatorDefinition` | `indicators › parseIndicatorDefinition...`, `http › loads an indicator definition...`, `throws NOT_FOUND...` | ✅ public scripts; 🔒 private/invite-only |
+| `getIndicator(id, version, session, signature)` (pine-facade translate, input/plot naming) | `getIndicator(id, { version, credentials })`, `parseIndicatorDefinition` | `indicators › parseIndicatorDefinition...`, `http › loads an indicator definition...`, `throws NOT_FOUND...` | ✅ public scripts and six saved USER scripts; 🔒 original invite-only issue fixtures |
 | (new) One-shot / streaming indicator values | `getIndicatorData`, `watchIndicator` | `data › indicator data › *` | ✅ built-in and one-shot Pine RSI with account; Pine stream unit-tested |
 
 ## Quotes
@@ -137,7 +156,7 @@ Test names are abbreviated as `file › test`.
 | `getTA(symbol)` (8 periods × All/MA/Other, scaled) | `getTechnicalAnalysis(symbol)` (`null` instead of `false` without data) | `http › getTechnicalAnalysis › *` | ✅ |
 | `searchIndicator(text)` (built-in lists cached + community suggestions, access mapping) | `searchIndicators(text)`, `clearIndicatorCache()` | `http › searches built-in and community indicators` | ✅ |
 | `result.get()` on indicator results | `getIndicator(result.id, { version: result.version })` | `http › loads an indicator definition...` | ✅ |
-| `getPrivateIndicators(session, signature)` | `getPrivateIndicators(credentials)` | `http › lists private indicators with credentials` | ✅ authenticated listing endpoint; actual private item not available |
+| `getPrivateIndicators(session, signature)` | `getPrivateIndicators(credentials)` | `http › lists private indicators with credentials` | ✅ authenticated listing; six saved USER scripts evaluated separately (see reliability evidence) |
 | `loginUser(username, password, remember, UA)` | `loginUser({ username, password, remember, userAgent })` (form now URL-encoded) | `http › loginUser posts an encoded form and reads cookies` | 🔒 |
 | `getUser(session, signature, location)` with redirect-loop protection | `getUser(credentials, { location, maxRedirects })` (relative redirects resolved) | `http › getUser parses the account page...`, `getUser stops redirect loops...` | ✅ authenticated success and wrong-cookie rejection |
 | `getChartToken(layout, credentials)` | `getChartToken(layoutId, { userId, credentials })` | `http › gets a chart token...` | 🔒 (needs a layout ID) |

package/docs/v4-reliability.md

@@ -34,3 +34,61 @@ V4 now starts the account lookup at `/chart/` and follows `Location` only on HTT
 - Basic daily Replay and strategy reports are documented in [v4-coverage.md](v4-coverage.md); this is not proof of Deep Backtesting or universal intraday entitlement.
 - Private/invite-only script cases, subscribed futures parity, owned layouts and long-running Pine failures need matching assets and targeted reproductions. See [backlog triage](v4-backlog-triage.md).
 - Live CI is non-blocking. Review its actual test results, not just the overall workflow conclusion, before release.
+
+## Account-scoped diagnostics (beta.5)
+
+From a source checkout, set `SESSION` and `SIGNATURE` securely and run
+`npm run probe:account`. The read-only probe authenticates, lists saved scripts,
+then evaluates at most ten scripts sequentially on 100 daily BTCUSDT bars. Use
+`--max-scripts=N` and `--timeout-ms=N` after `--` to change these bounds.
+It prints only counts, index-based outcomes, script namespace categories and the
+account token's plan claim. It does not print script IDs, names, source, values,
+account identifiers or credentials. A plan claim is informational, not proof of
+exchange or Deep Backtesting entitlement. Failures exit nonzero; an empty saved
+script list is not considered successful private-script coverage.
+
+The package now includes both diagnostics, so installed consumers can run:
+
+```sh
+node node_modules/@mathieuc/tradingview/scripts/probe-account.mjs
+node node_modules/@mathieuc/tradingview/scripts/endurance.mjs --minutes=7 --cycle-seconds=600 --require-post-threshold-updates
+```
+
+The second command requires candle **and** quote callbacks after more than 30
+heartbeats on the same connection. `--heartbeat-threshold=N` changes the threshold.
+Counters reset per connection for threshold eligibility; ten short connections do
+not constitute one long connection. Initial snapshots alone cannot satisfy this
+mode. Any recorded error or interruption also makes the probe fail. Without the
+flag, a completed run remains a transport/lifecycle check, not a liveness guarantee.
+Run strict mode on an open market; a closed venue cannot supply the required proof.
+
+### Verified private scripts and outstanding paid-account prerequisite
+
+On 3 October 2026, all six saved `USER;` scripts accessible to the available account
+completed: two studies and four strategies, each returning 100 candles and 200
+study rows. Three strategies returned 208, 4 and 69 trades respectively; the fourth
+returned a report with zero trades. These are account-specific fixtures, not a
+reproduction of the private strategy in #89 or the table payload in #251.
+
+A bounded request to `history-data` using the protocol in PR #204 reached the server
+and returned `request_error` / `not_allowed`. No Deep Backtesting success is claimed.
+An eligible account and current successful protocol capture are required before
+shipping that API. No subscription was purchased and no account content was modified.
+The original scripts/fixtures for #188 (long-running Pine depth error), #24 (Renko
+GUI parity) and #311 (subscribed CME sessions) remain unavailable for exact reproduction.
+
+### Unbroken-socket checks, 3 October 2026
+
+- **BTCUSDT, six minutes, one connection:** 35 heartbeats, 85 candle callbacks,
+  89 quote callbacks; after heartbeat 30 on that same connection, 13 candle and
+  12 quote callbacks. Zero errors/failures; strict mode exited successfully.
+- **OANDA:EURUSD HeikinAshi, seven minutes, one connection:** 41 heartbeats,
+  one initial candle callback and one initial quote callback, zero errors/failures.
+  The forex market was closed: this proves heartbeat continuity only and does not
+  resolve #236's reported price-stream freeze on an open market.
+- Negative controls: a short initial-snapshot-only run fails strict mode, and an
+  interrupted run exits nonzero after cleanup. Account diagnostics also fail cleanly
+  without credentials; a bounded one-script run was separately verified on Bun.
+
+Neither run is a 12-hour Pine reproduction. The full authenticated live suite on
+beta.4 passed all 22 tests; beta.5 changes diagnostic tooling/documentation only.

package/docs/v4-stabilization.md

@@ -0,0 +1,87 @@
+# V4 stabilization and release-candidate gates
+
+Snapshot: 3 October 2026, starting from beta.5 (`b793115`).
+The source/package version is staged as **4.0.0-rc.0**. This is a prepared candidate,
+not a claim of npm publication or promotion of `latest`. Install the published beta
+until the candidate is released. [Migration guide](migration-v4.md).
+
+## What changed
+
+- Normalize failures while consuming an HTTP response body, not only while fetching
+  headers. Cancellation remains `ABORTED`; other stream failures become `HTTP_ERROR`.
+- Cancel pending account lookup when the client closes, disconnects or times out.
+  An intentional cancellation must not emit a late `AUTH_ERROR` or send an auth packet.
+- Reject empty/malformed account tokens and token-like content in rejected HTTP pages.
+- Exercise the real Node/Bun websocket transport against a Node loopback fixture:
+  Origin/custom headers, Unicode binary decoding, remote close and failed handshake.
+- Add repeatable live scanner, ranked-list and read-only watchlist checks.
+- Add source-only V8 coverage with CI floors and downloadable HTML/JSON evidence.
+- Extend packed-consumer checks to discovery exports and types; include examples,
+  assets, the agent index and parity diagnostic in the tarball.
+- Refresh the capability/backlog tables without closing unreproduced historical issues.
+
+## Deterministic evidence
+
+| Check | Result |
+| --- | --- |
+| Typecheck, lint, build | Passed locally |
+| Node unit suite | 135 passed, 14 files |
+| Bun unit suite | 135 passed, 14 files |
+| Source lines | 95.21% (1,235 / 1,297) |
+| Source statements | 92.62% (1,394 / 1,505) |
+| Source functions | 94.73% (342 / 361) |
+| Source branches | 83.67% (820 / 980) |
+| Dependency audit | Zero reported vulnerabilities at install |
+| Packed consumer | Node ESM, Node require(esm), Bun and strict TypeScript |
+
+Negative control: the six new lifecycle/body/token regression scenarios were run
+against unmodified beta.5 source; all six failed as expected. Restoring the candidate
+source makes all six pass. This verifies that the assertions detect the actual defects.
+
+Run `npm ci && npm run check`, `npm run test:bun` and `npm run test:coverage`.
+Coverage excludes test helpers and is **not** a measure of TradingView symbols,
+permissions, server behavior, GUI parity or account-feature completeness. Loopback
+handshake tests do not establish DNS/proxy/internet-failure coverage.
+
+CI runs deterministic checks on Node 20/22/24 and Bun. Node 22 additionally measures
+coverage with floors of 90% lines, 85% statements/functions and 75% branches.
+A growing test count is not itself a release gate; assertions and tested behavior matter.
+
+## Live evidence
+
+The local candidate suite passed **19 anonymous tests**; **six authenticated tests
+were skipped**, not passed, because credentials were not loaded into that run.
+The [manual authenticated CI run](https://github.com/Mathieu2301/TradingView-API/actions/runs/37149955645)
+on candidate commit `8e0e564` subsequently passed **all 25 tests**, including all six
+account tests (none skipped). Its Node 20/22/24 and Bun jobs also passed. A green
+workflow with a non-blocking failed live job or skipped account tests is insufficient.
+
+Earlier beta evidence remains in [reliability evidence](v4-reliability.md): six
+private USER scripts, 22 authenticated-suite tests, BTC updates after 30 heartbeats,
+and a two-hour rotating-connection endurance run. These are distinct observations,
+not substitutes for running the current candidate or reproducing original reports.
+
+## Release gates and explicit non-goals
+
+| Gate / limitation | Disposition |
+| --- | --- |
+| Candidate deterministic CI and package consumption | Passed on Node 20/22/24 and Bun in the linked CI run |
+| Current authenticated live suite | Passed: 25/25 in the linked manual CI run |
+| Open-market EUR/USD HeikinAshi after 30 heartbeats | Scheduled for Monday 5 October, 09:00 Europe/Paris; remains pending |
+| Populated account watchlists | Deterministic fixtures only; do not modify account content just to manufacture coverage |
+| Deep Backtesting | Not shipped; available account returned `not_allowed` |
+| Renko GUI parity, subscribed CME, original private scripts and 12-hour Pine issue | Matching assets/reproduction needed; no resolution claimed |
+| Automatic reconnection / server-side alerts / trading execution | Outside this release's scope |
+
+Do not promote npm `latest` (still V3) as part of candidate preparation. Once the
+remaining required evidence is reviewed, publish the exact validated candidate
+under a prerelease tag, verify registry installation on Node/Bun, and record the
+published integrity/version. A stable V4 release is a separate promotion decision.
+
+## Cleanup
+
+The 13 initial local worktrees were inventoried. Two clean, fully ancestral
+worktrees were removed; the old beta.1 tarball was retained separately. Branch
+references were kept. The primary managed project, worktrees with local context,
+and divergent/squash-merged branches were retained rather than assuming ancestry.
+No remote branches, contributor PRs, account data or historical issues were deleted.

package/examples/README.md

@@ -0,0 +1,37 @@
+# Examples
+
+Build once, then run any example with Node or Bun:
+
+```bash
+npm ci && npm run build
+node examples/candles.js
+bun examples/candles.js          # Bun loads .env automatically
+node --env-file=.env examples/indicator-data.js   # Examples that need an account
+```
+
+Examples that need an account read the `SESSION` and `SIGNATURE` cookies from the environment (see `.env.sample`). Never commit them.
+
+| Example | API | Account |
+| --- | --- | --- |
+| [candles.js](candles.js) | `getCandles` (count, from/to) | No |
+| [watch-candles.js](watch-candles.js) | `watchCandles` | No |
+| [quotes.js](quotes.js) | `getQuote`, `getQuotes`, `watchQuotes` | No |
+| [indicator-data.js](indicator-data.js) | `getIndicatorData` | Pine scripts only |
+| [screener.js](screener.js) | `getScreener` (filters, columns, ranking) | No |
+| [search.js](search.js) | `searchMarkets`, `searchIndicators`, `getTechnicalAnalysis` | No |
+| [custom-chart-types.js](custom-chart-types.js) | Heikin Ashi, Renko, Line Break, Kagi, P&F, Range | No (daily) |
+| [errors.js](errors.js) | `TradingViewError` codes | Partly |
+| [simple-chart.js](simple-chart.js) | `TradingViewClient`, `ChartSession` | No |
+| [quote-session.js](quote-session.js) | `QuoteSession` | No |
+| [builtin-indicator.js](builtin-indicator.js) | `BuiltInIndicator`, study graphics | No |
+| [fake-replay.js](fake-replay.js) | Negative counts and `fetchMore` | No |
+| [strategy-report.js](strategy-report.js) | Public strategy → trade records → closed/open PnL summary | Yes (Basic tested) |
+| [replay.js](replay.js) | Replay mode with studies | Pine studies only |
+| [custom-timeframe.js](custom-timeframe.js) | Second-based timeframes | Yes |
+| [from-to.js](from-to.js) | Reference times and ranges | Yes |
+| [graphic-indicator.js](graphic-indicator.js) | Labels, lines, boxes, tables | Yes |
+| [multiple-indicators.js](multiple-indicators.js) | Shared connection | Yes |
+| [private-indicators.js](private-indicators.js) | `getPrivateIndicators` | Yes |
+| [drawings.js](drawings.js) | `getDrawings` | Private layouts |
+| [pine-permissions.js](pine-permissions.js) | `PinePermissionManager` | Yes (script owner) |
+| [user-login.js](user-login.js) | `loginUser`, `getUser` | Username/password |

package/examples/builtin-indicator.js

@@ -0,0 +1,22 @@
+// Built-in studies such as the fixed-range volume profile.
+// Run: npm run build && node examples/builtin-indicator.js
+import { BuiltInIndicator, TradingViewClient } from '@mathieuc/tradingview';
+
+const profile = new BuiltInIndicator('VbPFixed@tv-basicstudies-241!');
+profile.setOption('first_bar_time', Date.now() - 10 ** 8);
+
+const client = new TradingViewClient();
+const chart = client.createChart();
+chart.setMarket('BINANCE:BTCEUR', { timeframe: '60', count: 1 });
+
+const study = chart.createStudy(profile);
+study.on('update', async () => {
+  const rows = study.graphics.horizHists
+    .filter((h) => h.lastBarTime === 0) // Profile that ends on the latest bar
+    .sort((a, b) => b.priceHigh - a.priceHigh);
+  if (!rows.length) return;
+  for (const h of rows) {
+    console.log(`~ ${Math.round((h.priceHigh + h.priceLow) / 2)} € : ${'_'.repeat(h.rate[0] / 3)}${'_'.repeat(h.rate[1] / 3)}`);
+  }
+  await client.close();
+});

package/examples/candles.js

@@ -0,0 +1,15 @@
+// One-shot candles with the high-level data API.
+// Run: npm run build && node examples/candles.js [SYMBOL] [TIMEFRAME]
+import { getCandles } from '@mathieuc/tradingview/data';
+
+const symbol = process.argv[2] ?? 'BINANCE:BTCUSDT';
+const timeframe = process.argv[3] ?? 'D';
+
+// The 100 most recent bars, oldest first. Resources are released automatically.
+const candles = await getCandles({ symbol, timeframe, count: 100 });
+const last = candles.at(-1);
+console.log(`${candles.length} ${timeframe} candles for ${symbol}; last close ${last.close} at ${new Date(last.time * 1000).toISOString()}`);
+
+// Every 4-hour bar of the last 7 days (history is loaded as deep as needed).
+const week = await getCandles({ symbol, timeframe: '240', from: new Date(Date.now() - 7 * 86_400_000) });
+console.log(`${week.length} 4h candles since ${new Date(week[0].time * 1000).toISOString()}`);

package/examples/custom-chart-types.js

@@ -0,0 +1,17 @@
+// Custom bar types: Heikin Ashi, Renko, Line Break, Kagi, Point & Figure and Range.
+// Run: npm run build && node examples/custom-chart-types.js
+import { getCandles } from '@mathieuc/tradingview/data';
+
+const types = {
+  HeikinAshi: {},
+  Renko: { source: 'close', sources: 'Close', boxSize: 3, style: 'ATR', atrLength: 14, wicks: true },
+  LineBreak: { source: 'close', lb: 3 },
+  Kagi: { source: 'close', style: 'ATR', atrLength: 14, reversalAmount: 1 },
+  PointAndFigure: { sources: 'Close', reversalAmount: 3, boxSize: 1, style: 'ATR', atrLength: 14, oneStepBackBuilding: false },
+  Range: { range: 1, phantomBars: false },
+};
+
+for (const [chartType, chartInputs] of Object.entries(types)) {
+  const candles = await getCandles({ symbol: 'BINANCE:BTCEUR', timeframe: 'D', count: 50, chartType, chartInputs });
+  console.log(chartType.padEnd(15), `${candles.length} bars, last close ${candles.at(-1)?.close}`);
+}

package/examples/custom-timeframe.js

@@ -0,0 +1,14 @@
+// Second-based and other custom timeframes need an account with access to them.
+// Run: npm run build && node --env-file=.env examples/custom-timeframe.js
+import { getCandles } from '@mathieuc/tradingview/data';
+
+if (!process.env.SESSION || !process.env.SIGNATURE) throw new Error('Please set your SESSION and SIGNATURE cookies');
+
+const candles = await getCandles({
+  symbol: 'CAPITALCOM:US100',
+  timeframe: '1S',
+  count: 10,
+  timezone: 'Europe/Paris',
+  credentials: { session: process.env.SESSION, signature: process.env.SIGNATURE },
+});
+console.log(candles);

package/examples/drawings.js

@@ -0,0 +1,16 @@
+// Drawings of a saved layout (the ID in tradingview.com/chart/<ID>/).
+// Private layouts need credentials and your user ID (see examples/user-login.js).
+// Run: npm run build && node --env-file=.env examples/drawings.js <layoutId> [userId]
+import { getDrawings } from '@mathieuc/tradingview';
+
+const [layoutId, userId] = process.argv.slice(2);
+if (!layoutId) throw new Error('Please specify a layout ID');
+
+const drawings = await getDrawings(layoutId, {
+  credentials: process.env.SESSION ? { session: process.env.SESSION, signature: process.env.SIGNATURE } : undefined,
+  userId: userId ? Number(userId) : undefined,
+});
+
+console.log(`Found ${drawings.length} drawings:`, drawings.map((d) => ({
+  id: d.id, symbol: d.symbol, type: d.type, text: d.state?.text,
+})));