@tigeropenapi/tigeropen 0.5.4 → 0.5.7

package/dist/types/auth/oauth2/session-manager.d.ts

@@ -0,0 +1,241 @@
+import { OAuth2DeviceAuthorization } from './device-authorization';
+import { OAuth2Token } from './token';
+import { type TokenStore } from './token-store';
+export declare const ENV_ISSUER = "TIGEROPEN_OAUTH2_ISSUER";
+/**
+ * Production authorization server. The environment variable or constructor argument
+ * overrides this value.
+ */
+export declare const BUILTIN_ISSUER = "https://openapi-oauth2.tigerfintech.com";
+/** How early to refresh an access token. */
+export declare const DEFAULT_REFRESH_AHEAD_MILLIS: number;
+/** Remaining lifetime below which a token is no longer handed out. */
+export declare const MIN_USABLE_REMAINING_MILLIS: number;
+/** How long to wait for the browser callback. */
+export declare const DEFAULT_AUTHORIZE_TIMEOUT_SECONDS: number;
+/**
+ * Fixed callback port for a manually configured clientId. Chosen to stay clear of the
+ * default Linux ephemeral range (from 32768) and of common dev ports.
+ */
+export declare const DEFAULT_MANUAL_CALLBACK_PORT = 18888;
+/**
+ * Application name registered by the SDK itself. Shown on the user's authorization
+ * page, so an entry point that registers its own client passes its own name.
+ */
+export declare const CLIENT_NAME = "Tiger TypeScript SDK";
+/** Receives the authorization URL. The SDK does not open a browser itself. */
+export type AuthorizationUrlHandler = (url: string) => void | Promise<void>;
+/** Receives the device authorization so the caller can display it. */
+export type DeviceAuthorizationHandler = (device: OAuth2DeviceAuthorization) => void | Promise<void>;
+export interface OAuth2SessionManagerOptions {
+    /** Authorization server; defaults to `TIGEROPEN_OAUTH2_ISSUER` or the built-in issuer */
+    issuer?: string;
+    /** Manually issued client ID; omit for dynamic registration */
+    clientId?: string;
+    /**
+     * Loopback port; 0 selects a system-assigned port for dynamic registration. Do not
+     * pass one in dynamic registration mode: it pins the registered redirect_uri to that
+     * port, and later dropping the argument leaves the registration behind.
+     */
+    callbackPort?: number;
+    /**
+     * Storage root; defaults to `TIGEROPEN_HOME` or `~/.tiger/openapi`. Ignored when
+     * `store` is provided
+     */
+    home?: string;
+    /**
+     * Persistence provider; when given, it owns its own surface and `surface` is ignored
+     */
+    store?: TokenStore;
+    /**
+     * Entry point owning the dynamic registration, e.g. `sdk-typescript`, `cli`, `mcp`.
+     * Each surface registers its own client, so it appears separately on the user's
+     * authorization page and can be revoked on its own. Tools built on this SDK must pass
+     * their own value
+     */
+    surface?: string;
+    /**
+     * Application name sent with dynamic registration and shown on the user's
+     * authorization page. A tool passing its own `surface` passes its own name too, or
+     * the user sees the SDK's name where the tool's belongs
+     */
+    clientName?: string;
+    /** Loopback callback timeout in seconds */
+    authorizeTimeoutSeconds?: number;
+}
+/** OAuth 2.0 authorization session manager. */
+export declare class OAuth2SessionManager {
+    private readonly _issuer;
+    private readonly _callbackPort;
+    /** Fixed for the session because it determines storage keys and registration mode. */
+    private readonly explicitClientId;
+    private readonly authorizeTimeoutSeconds;
+    private readonly clientName;
+    private readonly store;
+    private registeredClientId;
+    private metadata;
+    private token;
+    private resolvedScopes;
+    /** In-flight refresh, so concurrent callers share one token request (single-flight). */
+    private refreshInFlight;
+    /** In-flight metadata discovery, so concurrent callers share one round trip. */
+    private metadataInFlight;
+    constructor(options?: OAuth2SessionManagerOptions);
+    static defaultIssuer(): string;
+    get issuer(): string;
+    /** Currently known clientId; undefined before registration in dynamic mode. */
+    get clientId(): string | undefined;
+    get hasExplicitClientId(): boolean;
+    get callbackPort(): number;
+    /** Scopes requested by this session, space-separated. Fetches metadata. */
+    scopes(): Promise<string>;
+    /**
+     * Create a default session and perform browser authorization when required.
+     *
+     * The callback receives the authorization URL; the SDK does not open a browser.
+     */
+    static loginWithDefaults(onAuthorizationUrl: AuthorizationUrlHandler): Promise<OAuth2SessionManager>;
+    /** Create a default session and perform device authorization when required. */
+    static loginWithDeviceCodeDefaults(onDeviceAuthorization: DeviceAuthorizationHandler): Promise<OAuth2SessionManager>;
+    /**
+     * Perform browser authorization with a loopback redirect and PKCE.
+     *
+     * @param onAuthorizationUrl callback receiving the authorization URL
+     */
+    login(onAuthorizationUrl: AuthorizationUrlHandler): Promise<OAuth2Token>;
+    /**
+     * Use the existing local authorization if usable, otherwise run a full loopback +
+     * PKCE authorization.
+     */
+    loginIfNeeded(onAuthorizationUrl: AuthorizationUrlHandler): Promise<OAuth2Token>;
+    /**
+     * Reuse local authorization or perform device authorization (RFC 8628).
+     *
+     * Device authorization supports environments without a local browser. Unlike loopback
+     * authorization with PKCE, it has no redirect binding or proof that the initiating and
+     * redeeming clients are the same party, increasing phishing risk. Loopback
+     * authorization is preferred when a local browser is available.
+     */
+    loginWithDeviceCodeIfNeeded(onDeviceAuthorization: DeviceAuthorizationHandler): Promise<OAuth2Token>;
+    /**
+     * Perform device authorization as defined by RFC 8628.
+     *
+     * This flow is intended for environments without a local browser and has the security
+     * limitations documented by {@link loginWithDeviceCodeIfNeeded}.
+     */
+    loginWithDeviceCode(onDeviceAuthorization: DeviceAuthorizationHandler): Promise<OAuth2Token>;
+    /**
+     * Revoke authorization under RFC 7009 and delete the local token.
+     *
+     * Dynamic client registration is retained across logout. The local token is deleted
+     * even if server-side revocation fails.
+     *
+     * @returns true when server-side revocation succeeds; false when only local state is
+     *   cleared and the server credential may remain valid
+     */
+    logout(): Promise<boolean>;
+    /**
+     * Return a usable access token, refreshing near expiry.
+     *
+     * Throws `ReauthorizationRequired` when no authorization is available. Browser
+     * authorization is never started implicitly.
+     *
+     * A refresh being due does not make the caller wait for one. While the current token
+     * still has {@link MIN_USABLE_REMAINING_MILLIS} of life, a refresh already running
+     * elsewhere is left to finish and the current token is returned.
+     */
+    getAccessToken(): Promise<string>;
+    /** The current token, or undefined. Sends no requests and triggers no authorization. */
+    status(): OAuth2Token | undefined;
+    /**
+     * Whether asking for a token now would trigger a refresh. Reads memory only.
+     *
+     * Exists so no other component needs a refresh-ahead window of its own.
+     */
+    shouldRefreshSoon(): boolean;
+    isAuthorized(): boolean;
+    /** Refresh because the token is close to expiry. */
+    refresh(failedAccessToken?: string): Promise<OAuth2Token>;
+    /**
+     * Refresh after a 401 even when the token is not near expiry.
+     *
+     * @param failedAccessToken token used by the failed request; comparison with the
+     *   current token detects rotation completed elsewhere and preserves single-flight
+     *   refresh behavior
+     */
+    refreshAfterUnauthorized(failedAccessToken: string | undefined): Promise<OAuth2Token>;
+    /**
+     * Single-flight refresh: the first caller performs rotation while others await the
+     * same promise.
+     */
+    private doRefresh;
+    private refreshOnce;
+    /**
+     * Handle a refresh the authorization server rejected.
+     *
+     * Refresh tokens rotate, so the rejected value may already have been replaced by
+     * another process sharing this store. The store is re-read before any local state is
+     * removed, and the authorization is treated as ended only once the newest stored
+     * credential is rejected too.
+     */
+    private recoverOrGiveUp;
+    /** Exchange the given token's refresh token for a new access token and persist it. */
+    private exchangeRefreshToken;
+    /**
+     * Read the stored token from disk, bypassing the in-memory copy.
+     *
+     * @returns the stored token, or null when there is none or it cannot be read
+     */
+    private reloadFromStore;
+    /**
+     * Remove the local token, and the dynamic registration when that was refused.
+     *
+     * Only the credential that was refused is removed, and only while it is still the one
+     * on disk. Another process sharing the store may have replaced it in the meantime, and
+     * that replacement was never refused.
+     */
+    private forgetRejectedAuthorization;
+    /**
+     * Remove a refused dynamic client registration so the next authorization registers a
+     * new one. Explicit clientIds are left alone.
+     */
+    private forgetRejectedRegistration;
+    /**
+     * Return a reusable local token, refreshing it when required.
+     *
+     * @returns undefined when interactive authorization is required
+     */
+    private reusableToken;
+    private currentToken;
+    /**
+     * The known clientId, without triggering registration. Manual mode never reads
+     * `clients/`.
+     */
+    private knownClientId;
+    private persist;
+    private effectiveCallbackPort;
+    private resolveScopes;
+    private metadataOf;
+    /** Manual clientId > saved registration whose scopes still cover > register. */
+    private resolveClientId;
+    /**
+     * Register a public client under RFC 7591.
+     *
+     * Registration omits scope. The granted scope set is stored separately so a wider
+     * requirement triggers re-registration instead of `invalid_scope`.
+     */
+    private register;
+    private requestDeviceAuthorization;
+    /** Poll the token endpoint according to RFC 8628 response semantics. */
+    private pollForDeviceToken;
+    private exchange;
+    private toToken;
+    /**
+     * Attempt server-side revocation without throwing.
+     *
+     * The refresh token is preferred because RFC 7009 §2.1 permits revocation of its
+     * associated access tokens. RFC 7009 §2.2 also returns success for unknown or
+     * previously revoked tokens.
+     */
+    private revoke;
+}

package/dist/types/auth/oauth2/token-store.d.ts

@@ -0,0 +1,49 @@
+import { OAuth2ClientRegistration } from './client-registration';
+import { OAuth2Token } from './token';
+export declare const ENV_HOME = "TIGEROPEN_HOME";
+/**
+ * Entry point owning a registration. Tools built on this SDK must pass their own value,
+ * otherwise they would be filed as the TypeScript SDK and share its client. Keep in
+ * step with the Java SDK's `sdk-java` and the Python SDK's `sdk-python`.
+ */
+export declare const DEFAULT_SURFACE = "sdk-typescript";
+/** Persistence provider contract, so a caller can store tokens somewhere else. */
+export interface TokenStore {
+    loadToken(clientId: string, expectedIssuer?: string): OAuth2Token | null;
+    saveToken(token: OAuth2Token): void;
+    deleteToken(clientId: string): string | null;
+    loadClientId(issuer: string): string | null;
+    loadClientRegistration(issuer: string): OAuth2ClientRegistration | null;
+    saveClientRegistration(registration: OAuth2ClientRegistration): void;
+    deleteClientRegistration(issuer: string): void;
+}
+export declare class OAuth2TokenStore implements TokenStore {
+    readonly home: string;
+    readonly surface: string;
+    /**
+     * @param home storage root; defaults to `TIGEROPEN_HOME` then `~/.tiger/openapi`
+     * @param surface entry point owning the registration, e.g. `sdk-typescript`, `cli`.
+     *   Lowercase alphanumerics and hyphens only
+     */
+    constructor(home?: string, surface?: string);
+    /** Load a token, treating a missing file or issuer mismatch as a cache miss. */
+    loadToken(clientId: string, expectedIssuer?: string): OAuth2Token | null;
+    saveToken(token: OAuth2Token): void;
+    /**
+     * Delete authorization state while retaining client registration.
+     *
+     * @returns the path removed, or null when there was nothing to remove. A clientId is
+     *   not its own file name, so a caller reporting what it deleted has to be told rather
+     *   than build the path itself
+     */
+    deleteToken(clientId: string): string | null;
+    loadClientId(issuer: string): string | null;
+    loadClientRegistration(issuer: string): OAuth2ClientRegistration | null;
+    saveClientRegistration(registration: OAuth2ClientRegistration): void;
+    /** Delete registration state after an `invalid_client` response. */
+    deleteClientRegistration(issuer: string): void;
+    private tokenFile;
+    private clientFile;
+}
+/** Return the Java-compatible 32-character SHA-256 issuer file key. */
+export declare function hashIssuer(issuer: string): string;

package/dist/types/auth/oauth2/token.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Persisted OAuth 2.0 authorization state.
+ *
+ * The `issuer` and `clientId` bind credentials to an authorization server and client,
+ * preventing credential reuse across environments. The on-disk field names are
+ * snake_case and shared with the Java and Python SDKs.
+ */
+/** On-disk format version. An unrecognised version is an error, not a guess. */
+export declare const TOKEN_SCHEMA_VERSION = 1;
+export declare function currentMillis(): number;
+/** Raw on-disk shape. */
+export interface OAuth2TokenJson {
+    schema_version?: number;
+    issuer?: string;
+    client_id?: string;
+    access_token?: string;
+    refresh_token?: string;
+    token_type?: string;
+    scope?: string;
+    expires_at?: number;
+}
+/** An access token and its metadata. */
+export declare class OAuth2Token {
+    schemaVersion: number;
+    issuer?: string;
+    clientId?: string;
+    accessToken?: string;
+    refreshToken?: string;
+    tokenType: string;
+    scope?: string;
+    /** Absolute expiry as epoch millis, not expires_in */
+    expiresAt: number;
+    constructor(init?: {
+        issuer?: string;
+        clientId?: string;
+        accessToken?: string;
+        refreshToken?: string;
+        tokenType?: string;
+        scope?: string;
+        expiresAt?: number;
+        schemaVersion?: number;
+    });
+    /** Time until expiry; negative once already expired. */
+    remainingMillis(): number;
+    /**
+     * @param aheadMillis how early to refresh. The window exists because time passes
+     *   between sending a request and the server validating it, so using a token right up
+     *   to its expiry produces intermittent 401s
+     */
+    needsRefresh(aheadMillis: number): boolean;
+    hasRefreshToken(): boolean;
+    toJSON(): OAuth2TokenJson;
+    static fromJSON(data: OAuth2TokenJson | null | undefined): OAuth2Token | null;
+    /** Prints no token values. */
+    toString(): string;
+}

package/dist/types/index.d.ts

@@ -26,7 +26,7 @@ export type { ErrorCategory } from './client';
 export { QuoteClient, parseOptionIdentifier } from './quote';
 export { TradeClient } from './trade';
 export { PushClient, ConnectionState, SubjectType } from './push';
-export type { PushClientOptions } from './push';
+export type { PushClientOptions, AccountSubscribeOptions } from './push';
 export type { Order, OrderRequest, ContractLegRequest } from './model/order';
 export { marketOrder, limitOrder, stopOrder, stopLimitOrder } from './model/order-helpers';
 export { normalizeOrderStatus } from './model/order-status';
@@ -35,5 +35,5 @@ export type { Position } from './model/position';
 export type { Asset, AssetSegment, PrimeAsset, PreviewResult, PlaceOrderResult, OrderIdResult, Transaction, ManagedAccount, AnalyticsAsset, AggregateAssets, EstimateTradableQuantity, ForexOrderResult, SegmentFund, SegmentFundAvailableItem, SegmentFundHistoryItem, FundDetails, FundingHistoryItem, PositionTransferRecord, PositionTransferDetail, PositionTransferExternalRecord, OptionExerciseCheckResult, OptionExercisePositionPageResult, OptionExerciseRecordPageResult, } from './model/trade';
 export type { OrdersRequest, GetOrderRequest, OrderTransactionsRequest, PositionsRequest, AssetsRequest, ManagedAccountsRequest, DerivativeContractsRequest, AnalyticsAssetRequest, AggregateAssetsRequest, EstimateTradableQuantityRequest, ForexOrderRequest, SegmentFundRequest, FundDetailsRequest, FundingHistoryRequest, PositionTransferRequest, PositionTransferRecordsRequest, PositionTransferDetailRequest, PositionTransferExternalRecordsRequest, OptionExerciseCheckRequest, OptionExercisePositionRequest, OptionExerciseSubmitRequest, OptionExerciseRecordsRequest, OptionExerciseCancelRequest, } from './model/trade-requests';
 export type { MarketState, Brief, Kline, KlineItem, Timeline, TimelineItem, TradeTick, TradeTickItem, Depth, DepthLevel, OptionExpiration, OptionChain, OptionChainRow, OptionSymbol, OptionChainFilter, OptionChainFilterGreeks, Range, FutureExchange, FutureContractInfo, FutureQuote, FutureKline, FutureKlineItem, FutureDepth, FutureTradeTickItem, FutureTradingTime, FinancialDailyItem, FinancialReportItem, CorporateAction, CorporateSymbolChange, CorporateDelisting, CorporateIPO, CapitalFlow, CapitalFlowItem, CapitalDistribution, ScannerResult, ScannerResultItem, QuotePermission, SymbolName, TradeMeta, StockDetail, StockBroker, StockBrokerItem, ShortInterest, StockIndustry, IndustryItem, IndustryStock, WarrantBrief, WarrantFilterResult, FundContractInfo, FundQuote, FundHistoryQuote, QuoteOvernight, KlineQuota, MarketScannerTag, MarketScannerTags, OptionAnalysis, OptionLeg, OptionVolatilityPoint, ExchangeRate, FinancialCurrency, BrokerDetail, TradingCalendarItem, FutureMainContractHistory, } from './model/quote';
-export type { BriefRequest, DepthQuoteRequest, TradeTickRequest, KlineRequest, KlineByPageRequest, FutureBriefRequest, FutureKlineRequest, FutureKlineByPageRequest, FutureTradeTicksRequest, FutureDepthRequest, FutureContractSingleRequest, FutureContinuousContractsRequest, FutureHistoryMainContractRequest, FutureTradingTimesRequest, AllFutureContractsRequest, OptionTradeTicksRequest, OptionTimelineRequest, OptionDepthRequest, OptionSymbolsRequest, OptionAnalysisRequest, OptionQueryItem, ShortInterestRequest, StockBrokerRequest, StockDetailsRequest, StockFundamentalRequest, StockIndustryRequest, StockDelayBriefsRequest, SymbolsRequest, TradeMetasRequest, TradeRankRequest, TimelineHistoryRequest, TradingCalendarRequest, KlineQuotaRequest, QuotePermissionRequest, QuoteOvernightRequest, IndustryListRequest, IndustryStocksRequest, FundSymbolsRequest, FundContractsRequest, FundQuoteRequest, FundHistoryQuoteRequest, WarrantBriefsRequest, WarrantFilterRequest, MarketScannerTagsRequest, FinancialCurrencyRequest, FinancialExchangeRateRequest, } from './model/quote-requests';
+export type { BriefRequest, DepthQuoteRequest, TradeTickRequest, KlineRequest, KlineByPageRequest, TimelineRequest, FutureBriefRequest, FutureKlineRequest, FutureKlineByPageRequest, FutureTradeTicksRequest, FutureDepthRequest, FutureContractSingleRequest, FutureContinuousContractsRequest, FutureHistoryMainContractRequest, FutureTradingTimesRequest, AllFutureContractsRequest, OptionTradeTicksRequest, OptionTimelineRequest, OptionDepthRequest, OptionSymbolsRequest, OptionAnalysisRequest, OptionQueryItem, ShortInterestRequest, StockBrokerRequest, StockDetailsRequest, StockFundamentalRequest, StockIndustryRequest, StockDelayBriefsRequest, SymbolsRequest, TradeMetasRequest, TradeRankRequest, TimelineHistoryRequest, TradingCalendarRequest, KlineQuotaRequest, QuotePermissionRequest, QuoteOvernightRequest, IndustryListRequest, IndustryStocksRequest, FundSymbolsRequest, FundContractsRequest, FundQuoteRequest, FundHistoryQuoteRequest, WarrantBriefsRequest, WarrantFilterRequest, MarketScannerTagsRequest, FinancialCurrencyRequest, FinancialExchangeRateRequest, } from './model/quote-requests';
 export { OrderStatus, SecurityType, OrderType, TimeInForce, Market, Currency, QuoteRight, SegmentType, OrderSortBy, CorporateActionType, IndustryLevel, SortDirection, OptionAnalysisPeriod, FinancialReportPeriod, Language, License, BarPeriod, orderStatusCode, } from './model/enums';

package/dist/types/model/order.d.ts

@@ -12,11 +12,28 @@ export interface OrderLeg {
     timeInForce?: string;
     quantity?: number;
 }
-/** Algo order parameters — response side */
+/**
+ * Algo order parameters — response side.
+ *
+ * The response shape flattens the [{tag, value}, ...] wire form into an
+ * object, and the server historically emits `startTime` / `endTime` as
+ * epoch-ms numbers (matching what the request side sends). Some legacy
+ * paths still return the raw string; accept both.
+ *
+ * Note: `algoStrategy` on the response side is server-echoed; on the
+ * request side it lives on `OrderRequest`, not `AlgoParamsRequest`.
+ */
 export interface AlgoParams {
     algoStrategy?: string;
-    startTime?: string;
-    endTime?: string;
+    /** Epoch-ms; server may echo as string on legacy paths */
+    startTime?: number | string;
+    /** Epoch-ms; server may echo as string on legacy paths */
+    endTime?: number | string;
+    /** Whether to minimize trade count (VWAP) */
+    noTakeLiq?: boolean;
+    /** Whether to allow completion after end_time (TWAP / VWAP) */
+    allowPastEndTime?: boolean;
+    /** Participation rate 0.01–0.5 (VWAP only) */
     participationRate?: number;
 }
 /** Order response model (returned by order query methods). */
@@ -135,10 +152,18 @@ export interface OrderRequest {
     checkIntervals?: number;
     /** 冰山单：价格类型（LIMIT_PRICE / ASK_PRICE / BID_PRICE / LATEST_PRICE） */
     priceType?: string;
-    /** 冰山单：生效开始时间（epoch ms） */
-    startTime?: number;
-    /** 冰山单：生效结束时间（epoch ms） */
-    endTime?: number;
+    /**
+     * 冰山单：生效开始时间（epoch ms）。
+     * Wire note: the gateway accepts both `number` (epoch ms) and `string`
+     * (epoch ms as string) for ICEBERG orders; `number | string` keeps
+     * TypeScript callers who pass `String(now)` from hitting a compile error.
+     */
+    startTime?: number | string;
+    /**
+     * 冰山单：生效结束时间（epoch ms）。
+     * Same dual-type note as `startTime` above.
+     */
+    endTime?: number | string;
     /** GTD 到期时间（epoch ms） */
     expireTime?: number;
     /** 盘后委托价格 */
@@ -180,6 +205,17 @@ export interface OrderRequest {
     contractLegs?: ContractLegRequest[];
     /** 组合单类型（如 MLEG） */
     comboType?: string;
+    /**
+     * Algo strategy name for TWAP / VWAP orders (e.g. `'TWAP'`, `'VWAP'`).
+     * Lives on `OrderRequest`, not inside `algoParams` — the Python SDK
+     * places it at the top-level order object, and the gateway expects
+     * `algo_strategy` as a sibling of `algo_params`.
+     *
+     * Note: `AlgoParamsRequest` intentionally omits this field (see its
+     * doc-comment). Pass `algoStrategy` here and `algoParams` as the
+     * companion object.
+     */
+    algoStrategy?: string;
 }
 /** Single leg of a multi-leg option order (MLEG) */
 export interface ContractLegRequest {
@@ -198,10 +234,25 @@ export interface OrderLegRequest {
     timeInForce?: string;
     quantity?: number;
 }
-/** Algo parameters for request side */
+/**
+ * Algo parameters for request side (TWAP / VWAP).
+ *
+ * Fields match the Python SDK's AlgoParams. On the wire, the SDK marshals
+ * this object into the `[{tag, value}, ...]` array shape the gateway
+ * expects — callers should just pass the natural object.
+ *
+ * `algoStrategy` is intentionally not here: it lives on the parent
+ * `OrderRequest`, not inside `algoParams`.
+ */
 export interface AlgoParamsRequest {
-    algoStrategy?: string;
-    startTime?: string;
-    endTime?: string;
+    /** Epoch-ms start time (TWAP / VWAP only) */
+    startTime?: number;
+    /** Epoch-ms end time (TWAP / VWAP only) */
+    endTime?: number;
+    /** Try to minimize trade count (VWAP only) */
+    noTakeLiq?: boolean;
+    /** Allow completing after end_time (TWAP / VWAP only) */
+    allowPastEndTime?: boolean;
+    /** Participation rate 0.01–0.5 (VWAP only) */
     participationRate?: number;
 }

package/dist/types/model/quote-requests.d.ts

@@ -27,6 +27,7 @@ export interface TradeTickRequest {
     beginIndex?: number;
     endIndex?: number;
     limit?: number;
+    tradeSession?: string;
     lang?: string;
 }
 /** Real-time futures quotes. wire: future_brief */
@@ -80,6 +81,7 @@ export interface KlineRequest {
 /** K-line client-side pagination wrapper. */
 export interface KlineByPageRequest {
     symbol?: string;
+    secType?: string;
     period?: string;
     beginTime?: number;
     endTime?: number;
@@ -89,6 +91,11 @@ export interface KlineByPageRequest {
     lang?: string;
     tradeSession?: string;
 }
+/** Intraday timeline request. wire: timeline */
+export interface TimelineRequest {
+    symbols?: string[];
+    secType?: string;
+}
 /** Historical intraday timeline. wire: history_timeline */
 export interface TimelineHistoryRequest {
     symbols?: string[];
@@ -134,7 +141,7 @@ export interface KlineQuotaRequest {
     withDetails?: boolean;
     lang?: string;
 }
-/** Quote permission detail. wire: get_quote_permission */
+/** Market data permission entry request. wire: get_quote_permission */
 export interface QuotePermissionRequest {
     beginDate?: string;
     endDate?: string;
@@ -154,9 +161,21 @@ export interface OptionQueryItem {
     endIndex?: number;
     pageToken?: string;
 }
-/** Option tick trades. wire: option_trade_tick */
+/** Option tick trades. wire: option_trade_tick
+ *
+ * **Wire contract:** the server expects `biz_content` to be a **top-level
+ * JSON array** (`[{symbol, expiry, ...}, ...]`), not `{"contracts": [...]}`.
+ * This matches Java (`BatchApiModel.items` serialized directly) and Python
+ * (`MultipleContractParams.to_openapi_dict` returns a list).
+ *
+ * The client unwraps `contracts` before serialization; sending it as an
+ * object caused `biz param error(failed to parse parameters in 'biz_content')`.
+ * `lang` is retained for API symmetry but is not sent on the wire — the
+ * gateway has no `lang` input for this method.
+ */
 export interface OptionTradeTicksRequest {
     contracts?: OptionQueryItem[];
+    /** Retained for API symmetry; wire is a top-level array, so `lang` is not sent. */
     lang?: string;
 }
 /** Option intraday timeline. wire: option_timeline */