@tigeropenapi/tigeropen 0.5.4 → 0.5.7

package/dist/cjs/quote/quote-client.js

@@ -46,6 +46,7 @@ const http_client_1 = require("../client/http-client");
 const api_request_1 = require("../client/api-request");
 const api_response_1 = require("../client/api-response");
 const tokenMethods = __importStar(require("../client/token-methods"));
+const tick_util_1 = require("../push/tick-util");
 /**
  * resolveOptionTimezone returns the timezone string to use for expiry conversion.
  * Explicit tz takes precedence; otherwise infer from symbol (.HK suffix → Asia/Hong_Kong, else America/New_York).
@@ -185,12 +186,22 @@ class QuoteClient {
     async getKline(req) {
         return this.callInto('kline', req);
     }
-    async getTimeline(symbols) {
-        return this.callInto('timeline', { symbols });
+    async getTimeline(symbolsOrRequest) {
+        const req = Array.isArray(symbolsOrRequest) ? { symbols: symbolsOrRequest } : symbolsOrRequest;
+        return this.callInto('timeline', req, req.secType === 'CC' ? '3.0' : undefined);
     }
     /** Tick-by-tick trades. wire: trade_tick */
     async getTradeTick(req) {
-        return this.callInto('trade_tick', req);
+        const out = await this.callInto('trade_tick', req);
+        for (const tick of out) {
+            const isUs = (0, tick_util_1.isUsStockSymbol)(tick.symbol);
+            for (const item of tick.items) {
+                if (item.cond && item.cond.length > 0) {
+                    item.cond = (0, tick_util_1.getTradeCondByCode)(isUs, item.cond[0]);
+                }
+            }
+        }
+        return out;
     }
     /** Depth snapshot. wire: quote_depth */
     async getQuoteDepth(req) {
@@ -356,6 +367,7 @@ class QuoteClient {
         while (acc.length < totalSize) {
             const sub = {
                 symbols: req.symbol ? [req.symbol] : undefined,
+                secType: req.secType,
                 period: req.period,
                 right: req.right,
                 beginTime,
@@ -406,7 +418,7 @@ class QuoteClient {
     async getStockIndustry(req) {
         return this.callInto('stock_industry', req);
     }
-    /** Quote permission detail. wire: get_quote_permission */
+    /** Market data permission entries. wire: get_quote_permission */
     async getQuotePermission(req) {
         return this.callInto('get_quote_permission', req);
     }
@@ -417,9 +429,16 @@ class QuoteClient {
     // ==========================================================================
     // Batch 4: option / future extensions
     // ==========================================================================
-    /** Option tick trades. wire: option_trade_tick */
+    /** Option tick trades. wire: option_trade_tick
+     *
+     * Server expects `biz_content` as a top-level JSON array (matches Java's
+     * `BatchApiModel` and Python's `MultipleContractParams.to_openapi_dict`).
+     * We unwrap the request here so the array is emitted directly instead of
+     * `{"contracts": [...]}`. Sending it as an object triggers
+     * `biz param error(failed to parse parameters in 'biz_content')`.
+     */
     async getOptionTradeTicks(req) {
-        return this.callInto('option_trade_tick', req);
+        return this.callInto('option_trade_tick', req.contracts ?? []);
     }
     /** Option intraday timeline. wire: option_timeline */
     async getOptionTimeline(req) {
@@ -458,10 +477,16 @@ class QuoteClient {
         return this.callInto('future_main_contract', req);
     }
     /** Futures K-line. wire: future_kline
-     * beginTime / endTime default to -1 when unset (server requires them present). */
+     * beginTime / endTime default to -1 when unset (server requires them present).
+     * Server expects `contract_codes` (plural) — normalize singular `contractCode`
+     * to the plural form so callers can pass either shape. */
     async getFutureKline(req) {
+        const contractCodes = req.contractCodes
+            ?? (req.contractCode ? [req.contractCode] : undefined);
+        const { contractCode: _drop, ...rest } = req;
         const body = {
-            ...req,
+            ...rest,
+            ...(contractCodes ? { contractCodes } : {}),
             beginTime: req.beginTime ?? -1,
             endTime: req.endTime ?? -1,
         };
@@ -479,8 +504,9 @@ class QuoteClient {
             endTime = -1;
         const acc = [];
         while (acc.length < totalSize) {
+            // Server rejects singular `contract_code` — send the plural form.
             const sub = {
-                contractCode: req.contractCode,
+                contractCodes: req.contractCode ? [req.contractCode] : undefined,
                 period: req.period,
                 beginTime,
                 endTime,
@@ -559,9 +585,30 @@ class QuoteClient {
     async getWarrantFilter(req) {
         return this.callInto('warrant_filter', req);
     }
-    /** Industry list. wire: industry_list */
-    async getIndustryList(req) {
-        return this.callInto('industry_list', req);
+    /** Industry list. wire: industry_list
+     *
+     * `industryLevel` is required by the server — omitting it returns
+     * `industry level error, all supported is: [GSECTOR, GGROUP, GIND, GSUBIND]`.
+     * Defaults to `GGROUP` when unset, matching Python SDK's
+     * `IndustryLevel.GGROUP` default.
+     *
+     * Wire fields differ from other endpoints (see `IndustryItem`): server sends
+     * `nameCN` / `nameEN` / `industryLevel`. This method hydrates the
+     * backwards-compat `name` (from `nameEN || nameCN`) and mirrors
+     * `industryLevel` to `level` so existing callers keep working.
+     */
+    async getIndustryList(req = {}) {
+        const payload = { industryLevel: 'GGROUP', ...req };
+        const items = await this.callInto('industry_list', payload);
+        if (!Array.isArray(items))
+            return [];
+        for (const it of items) {
+            if (it.name === undefined)
+                it.name = it.nameEN || it.nameCN;
+            if (it.level === undefined)
+                it.level = it.industryLevel;
+        }
+        return items;
     }
     /** Stocks inside an industry. wire: industry_stock_list */
     async getIndustryStocks(req) {

package/dist/cjs/trade/trade-client.js

@@ -145,14 +145,54 @@ class TradeClient {
         });
     }
     // === Order operations ===
+    /**
+     * Prepare an order request for the wire.
+     *
+     * The gateway expects `algo_params` as a `[{tag, value}, ...]` array
+     * (matching the Python SDK's AlgoParams.to_dict serialization), not the
+     * plain object shape that reads naturally in TypeScript. This helper
+     * normalizes the object form into the array form on outbound payloads
+     * so callers can pass the natural object and TWAP/VWAP orders work end
+     * to end without wire-format workarounds.
+     *
+     * Fields with undefined/null values are dropped; empty algoParams
+     * becomes an empty array rather than being stripped, matching the
+     * Python SDK behavior when the user passes an empty AlgoParams().
+     */
+    marshalOrderForWire(order) {
+        const { algoParams, ...rest } = order;
+        const withAccount = { ...rest, account: this.account };
+        if (algoParams === undefined)
+            return withAccount;
+        // Already a tag/value array (advanced callers who want raw control)
+        if (Array.isArray(algoParams)) {
+            withAccount.algoParams = algoParams;
+            return withAccount;
+        }
+        // Object shape → tag/value array.
+        // Keys are converted to snake_case explicitly here (e.g. `startTime` →
+        // `start_time`) so they land correctly in the `tag` string that the
+        // gateway reads. `keysToSnakeCase` only rewrites object *keys*, not
+        // string *values*, so `tag` would be left camelCase if we didn't do
+        // this conversion ourselves.
+        const tagValues = [];
+        for (const [key, value] of Object.entries(algoParams)) {
+            if (value === undefined || value === null)
+                continue;
+            const snakeKey = key.replace(/[A-Z]/g, (c) => '_' + c.toLowerCase());
+            tagValues.push({ tag: snakeKey, value });
+        }
+        withAccount.algoParams = tagValues;
+        return withAccount;
+    }
     async placeOrder(order) {
-        return this.callInto('place_order', { ...order, account: this.account });
+        return this.callInto('place_order', this.marshalOrderForWire(order));
     }
     async previewOrder(order) {
-        return this.callInto('preview_order', { ...order, account: this.account });
+        return this.callInto('preview_order', this.marshalOrderForWire(order));
     }
     async modifyOrder(id, order) {
-        return this.callInto('modify_order', { ...order, account: this.account, id });
+        return this.callInto('modify_order', { ...this.marshalOrderForWire(order), id });
     }
     async cancelOrder(id, secretKey) {
         const params = { account: this.account, id };
@@ -217,11 +257,17 @@ class TradeClient {
     async getPositions(req) {
         return this.callIntoItems('positions', withAccount(req, this.account));
     }
-    /** Query assets. v0.4.0: supports sub-account list and aggregation options. */
+    /**
+     * Query assets. v0.4.0: supports sub-account list and aggregation options.
+     * `assetQuoteType`(ETH / RTH / OVERNIGHT) 选择资产行情口径。
+     */
     async getAssets(req) {
         return this.callIntoItems('assets', withAccount(req, this.account));
     }
-    /** Query prime assets. v0.4.0: takes AssetsRequest for filters. */
+    /**
+     * Query prime assets. v0.4.0: takes AssetsRequest for filters.
+     * `assetQuoteType`(ETH / RTH / OVERNIGHT) 选择资产行情口径。
+     */
     async getPrimeAssets(req) {
         return this.callInto('prime_assets', withAccount(req, this.account));
     }
@@ -242,7 +288,10 @@ class TradeClient {
     async getAnalyticsAsset(req) {
         return this.callIntoItems('analytics_asset', withAccount(req, this.account));
     }
-    /** Aggregate assets (prime) by base currency. */
+    /**
+     * Aggregate assets (prime) by base currency.
+     * `assetQuoteType`(ETH / RTH / OVERNIGHT) 选择资产行情口径。
+     */
     async getAggregateAssets(req) {
         return this.callInto('aggregate_assets', withAccount(req, this.account));
     }

package/dist/cjs/version.js

@@ -1,4 +1,4 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SDK_VERSION = void 0;
-exports.SDK_VERSION = '0.4.8';
+exports.SDK_VERSION = '0.5.7';

package/dist/esm/auth/authentication.js

@@ -0,0 +1,68 @@
+/**
+ * Request authentication interfaces.
+ *
+ * Implementations attach credentials, handle authentication retries, and release
+ * resources. OAuth 2.0 authorization flows live in `OAuth2SessionManager`; this module
+ * is the data plane and knows nothing about login.
+ */
+/** Which kind of authentication. */
+export var AuthenticationType;
+(function (AuthenticationType) {
+    /** tigerId + RSA private key signature */
+    AuthenticationType["Signature"] = "SIGNATURE";
+    /** `Authorization: Bearer <access_token>` */
+    AuthenticationType["OAuth2"] = "OAUTH2";
+})(AuthenticationType || (AuthenticationType = {}));
+/**
+ * Per-request authentication context.
+ *
+ * Business parameters (`method`, `version`, `biz_content`, `timestamp`) are filled in by
+ * the client and must not be modified by an authentication implementation.
+ */
+export class RequestAuthContext {
+    constructor(params, retryable = true) {
+        this.params = params;
+        this.retryable = retryable;
+    }
+}
+/**
+ * Credential snapshot used to coordinate authentication retries.
+ *
+ * Comparing the failed credential with current state detects rotation completed
+ * elsewhere and avoids duplicate refresh requests.
+ */
+export class AuthenticationAttempt {
+    constructor(authType, credential) {
+        this.authType = authType;
+        this.credential = credential;
+    }
+    /** Never prints the credential value. */
+    toString() {
+        return `AuthenticationAttempt{type=${this.authType}, credential=${this.credential === undefined ? '<none>' : '***'}}`;
+    }
+}
+/**
+ * Authentication retry decision.
+ *
+ * A retry always supplies a new full `Authorization` header value, including the
+ * `Bearer ` prefix. There is deliberately no "retry with the same credential" option:
+ * that only collects the same 401 twice.
+ */
+export class RetryDecision {
+    constructor(shouldRetry, authorizationHeader) {
+        this.shouldRetry = shouldRetry;
+        this.authorizationHeader = authorizationHeader;
+    }
+    static noRetry() {
+        return RetryDecision.NO_RETRY;
+    }
+    /** @param authorizationHeader full new header value, including `Bearer ` */
+    static retry(authorizationHeader) {
+        return new RetryDecision(true, authorizationHeader);
+    }
+    /** Never prints the header value. */
+    toString() {
+        return `RetryDecision{shouldRetry=${this.shouldRetry}}`;
+    }
+}
+RetryDecision.NO_RETRY = new RetryDecision(false, undefined);

package/dist/esm/auth/index.js

@@ -0,0 +1,3 @@
+/** Authentication layer: the request-level data plane plus the OAuth 2.0 control plane. */
+export { AuthenticationAttempt, AuthenticationType, RequestAuthContext, RetryDecision, } from './authentication.js';
+export * from './oauth2/index.js';

package/dist/esm/auth/oauth2/client-registration.js

@@ -0,0 +1,40 @@
+/**
+ * OAuth 2.0 dynamic client registration state (RFC 7591).
+ *
+ * Registration state is stored separately from tokens and retained across logout.
+ * `registeredScopes` records the granted scope set; scope expansion requires a new
+ * registration to avoid `invalid_scope`.
+ */
+export class OAuth2ClientRegistration {
+    constructor(init = {}) {
+        this.issuer = init.issuer;
+        this.clientId = init.clientId;
+        this.clientName = init.clientName;
+        this.registeredScopes = init.registeredScopes;
+        this.clientIdIssuedAt = init.clientIdIssuedAt ?? 0;
+    }
+    toJSON() {
+        return {
+            issuer: this.issuer,
+            client_id: this.clientId,
+            client_name: this.clientName,
+            registered_scopes: this.registeredScopes,
+            client_id_issued_at: this.clientIdIssuedAt,
+        };
+    }
+    static fromJSON(data) {
+        if (!data)
+            return null;
+        return new OAuth2ClientRegistration({
+            issuer: data.issuer,
+            clientId: data.client_id,
+            clientName: data.client_name,
+            registeredScopes: data.registered_scopes,
+            clientIdIssuedAt: data.client_id_issued_at ?? 0,
+        });
+    }
+    toString() {
+        return `OAuth2ClientRegistration{issuer=${this.issuer}, clientId=${this.clientId}, `
+            + `clientName=${this.clientName}, registeredScopes=${this.registeredScopes}}`;
+    }
+}

package/dist/esm/auth/oauth2/device-authorization.js

@@ -0,0 +1,36 @@
+/** Device authorization response (RFC 8628). */
+/**
+ * Default polling interval per RFC 8628 §3.5. Tiger's authorization server does not
+ * return `interval`, so this default applies in practice.
+ */
+export const DEFAULT_DEVICE_INTERVAL_SECONDS = 5;
+export class OAuth2DeviceAuthorization {
+    constructor(init = {}) {
+        this.deviceCode = init.deviceCode;
+        this.userCode = init.userCode;
+        this.verificationUri = init.verificationUri;
+        this.verificationUriComplete = init.verificationUriComplete;
+        this.expiresIn = init.expiresIn ?? 0;
+        this.interval = init.interval ?? 0;
+    }
+    effectiveIntervalSeconds() {
+        return this.interval > 0 ? this.interval : DEFAULT_DEVICE_INTERVAL_SECONDS;
+    }
+    static fromJSON(data) {
+        if (!data)
+            return null;
+        return new OAuth2DeviceAuthorization({
+            deviceCode: data.device_code,
+            userCode: data.user_code,
+            verificationUri: data.verification_uri,
+            verificationUriComplete: data.verification_uri_complete,
+            expiresIn: data.expires_in ?? 0,
+            interval: data.interval ?? 0,
+        });
+    }
+    /** Prints no deviceCode. */
+    toString() {
+        return `OAuth2DeviceAuthorization{userCode=${this.userCode}, verificationUri=${this.verificationUri}, `
+            + `expiresIn=${this.expiresIn}, interval=${this.interval}}`;
+    }
+}

package/dist/esm/auth/oauth2/errors.js

@@ -0,0 +1,59 @@
+/**
+ * Categorized errors from OAuth 2.0 authorization flows.
+ *
+ * Authorization server error details are retained in the error message.
+ */
+/** Error category. Each one implies a different action. */
+export var OAuth2Category;
+(function (OAuth2Category) {
+    /** Cannot fetch authorization server metadata: wrong address, service down, no network */
+    OAuth2Category["MetadataUnavailable"] = "METADATA_UNAVAILABLE";
+    /** No usable client_id, and automatic registration is not possible */
+    OAuth2Category["ClientRegistrationRequired"] = "CLIENT_REGISTRATION_REQUIRED";
+    /** Callback stage failed: timeout, user denial, or state mismatch */
+    OAuth2Category["CallbackFailed"] = "CALLBACK_FAILED";
+    /**
+     * Device flow not approved in time, or explicitly denied. Kept separate from
+     * ReauthorizationRequired because only a new device authorization is needed -- the
+     * stored token was not touched.
+     */
+    OAuth2Category["DeviceAuthorizationFailed"] = "DEVICE_AUTHORIZATION_FAILED";
+    /** refresh_token expired, revoked, or never obtained. Retrying is pointless */
+    OAuth2Category["ReauthorizationRequired"] = "REAUTHORIZATION_REQUIRED";
+    /** Token endpoint call failed, and not in the terminal way above */
+    OAuth2Category["TokenRequestFailed"] = "TOKEN_REQUEST_FAILED";
+    /** Reading or writing the local token file failed */
+    OAuth2Category["StorageFailed"] = "STORAGE_FAILED";
+})(OAuth2Category || (OAuth2Category = {}));
+/** Thrown by any stage of the OAuth2 flow. */
+export class OAuth2Error extends Error {
+    constructor(category, message, cause) {
+        super(message);
+        this.name = 'OAuth2Error';
+        this.category = category;
+        this.cause = cause;
+    }
+    get reauthorizationRequired() {
+        return this.category === OAuth2Category.ReauthorizationRequired;
+    }
+    toString() {
+        return `OAuth2Error{${this.category}: ${this.message}}`;
+    }
+}
+/**
+ * A grant the authorization server refused.
+ *
+ * Carries the error code so a caller can tell a rejected credential from a rejected
+ * client registration. Its category is `ReauthorizationRequired`, so callers that only
+ * know the public type behave as they would for any terminal authorization failure.
+ */
+export class RejectedGrantError extends OAuth2Error {
+    constructor(error, description) {
+        super(OAuth2Category.ReauthorizationRequired, `token request rejected: ${error} ${description}`);
+        this.name = 'RejectedGrantError';
+        this.error = error;
+    }
+    get isClientRejected() {
+        return this.error === 'invalid_client';
+    }
+}

package/dist/esm/auth/oauth2/http-utils.js

@@ -0,0 +1,105 @@
+/**
+ * HTTP helpers for OAuth 2.0 JSON and form-encoded requests.
+ *
+ * OAuth error responses retain 4xx response bodies for protocol-level error handling.
+ */
+import { OAuth2Category, OAuth2Error } from './errors.js';
+/**
+ * Every call here is a small JSON exchange with the authorization server, so a request
+ * that has not answered in this long is not going to. Same values as the Java and
+ * Python SDKs.
+ */
+export const CONNECT_TIMEOUT_SECONDS = 5;
+export const READ_TIMEOUT_SECONDS = 10;
+/** Combined budget handed to `AbortSignal.timeout`; fetch does not split the two. */
+const REQUEST_TIMEOUT_MS = (CONNECT_TIMEOUT_SECONDS + READ_TIMEOUT_SECONDS) * 1000;
+const JSON_CONTENT_TYPE = 'application/json; charset=utf-8';
+const FORM_CONTENT_TYPE = 'application/x-www-form-urlencoded; charset=utf-8';
+function encodeForm(form) {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(form)) {
+        if (value !== undefined && value !== null) {
+            params.append(key, value);
+        }
+    }
+    return params.toString();
+}
+export async function getJson(url) {
+    return execute('GET', url, undefined, undefined);
+}
+export async function postJson(url, payload) {
+    return execute('POST', url, JSON.stringify(payload), JSON_CONTENT_TYPE);
+}
+export async function postForm(url, form) {
+    return execute('POST', url, encodeForm(form), FORM_CONTENT_TYPE);
+}
+/**
+ * Post a form and return the HTTP status without requiring a response body.
+ *
+ * RFC 7009 revocation returns an empty success body, so no parsing is performed.
+ *
+ * @returns the HTTP status code
+ * @throws OAuth2Error on connection failure
+ */
+export async function postFormForStatus(url, form) {
+    let response;
+    try {
+        response = await fetch(url, {
+            method: 'POST',
+            headers: { Accept: 'application/json', 'Content-Type': FORM_CONTENT_TYPE },
+            body: encodeForm(form),
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (e) {
+        throw new OAuth2Error(OAuth2Category.TokenRequestFailed, `request fail: ${url}`, e);
+    }
+    return response.status;
+}
+/**
+ * Send the request and parse the response body as an object.
+ *
+ * A 4xx returns its body instead of throwing: OAuth2 errors (`invalid_grant`,
+ * `authorization_pending` and friends) live in the 4xx body, and the caller needs the
+ * `error` field to tell "wait and retry" from "re-authorize". Only a connection failure
+ * or a non-JSON response throws.
+ */
+async function execute(method, url, body, contentType) {
+    const headers = { Accept: 'application/json' };
+    if (contentType) {
+        headers['Content-Type'] = contentType;
+    }
+    let response;
+    try {
+        response = await fetch(url, {
+            method,
+            headers,
+            body,
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (e) {
+        throw new OAuth2Error(OAuth2Category.MetadataUnavailable, `request fail: ${url}`, e);
+    }
+    let text;
+    try {
+        text = await response.text();
+    }
+    catch (e) {
+        throw new OAuth2Error(OAuth2Category.TokenRequestFailed, `cannot decode response from ${url}, http status ${response.status}`, e);
+    }
+    if (!text) {
+        throw new OAuth2Error(OAuth2Category.TokenRequestFailed, `empty response from ${url}, http status ${response.status}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (e) {
+        throw new OAuth2Error(OAuth2Category.TokenRequestFailed, `non-JSON response from ${url}, http status ${response.status}`, e);
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new OAuth2Error(OAuth2Category.TokenRequestFailed, `unexpected response from ${url}, http status ${response.status}`);
+    }
+    return parsed;
+}

package/dist/esm/auth/oauth2/index.js

@@ -0,0 +1,11 @@
+/** OAuth 2.0 authentication, authorization flows, and token persistence. */
+export { OAuth2ClientRegistration } from './client-registration.js';
+export { OAuth2DeviceAuthorization, DEFAULT_DEVICE_INTERVAL_SECONDS } from './device-authorization.js';
+export { OAuth2Category, OAuth2Error, RejectedGrantError } from './errors.js';
+export { LoopbackReceiver, CALLBACK_PATH } from './loopback-receiver.js';
+export { OAuth2Metadata } from './metadata.js';
+export { OAuth2Authentication, BEARER_PREFIX } from './oauth2-authentication.js';
+export { OAuth2SessionManager, BUILTIN_ISSUER, CLIENT_NAME, DEFAULT_AUTHORIZE_TIMEOUT_SECONDS, DEFAULT_MANUAL_CALLBACK_PORT, DEFAULT_REFRESH_AHEAD_MILLIS, ENV_ISSUER, MIN_USABLE_REMAINING_MILLIS, } from './session-manager.js';
+export { OAuth2Token, TOKEN_SCHEMA_VERSION, currentMillis } from './token.js';
+export { OAuth2TokenStore, DEFAULT_SURFACE, ENV_HOME, hashIssuer } from './token-store.js';
+export { CONNECT_TIMEOUT_SECONDS, READ_TIMEOUT_SECONDS } from './http-utils.js';