@tigeropenapi/tigeropen 0.5.4 → 0.5.7

package/dist/esm/quote/quote-client.js

@@ -9,6 +9,7 @@ import { HttpClient } from '../client/http-client.js';
 import { createApiRequest } from '../client/api-request.js';
 import { unmarshalData } from '../client/api-response.js';
 import * as tokenMethods from '../client/token-methods.js';
+import { getTradeCondByCode, isUsStockSymbol } from '../push/tick-util.js';
 /**
  * resolveOptionTimezone returns the timezone string to use for expiry conversion.
  * Explicit tz takes precedence; otherwise infer from symbol (.HK suffix → Asia/Hong_Kong, else America/New_York).
@@ -148,12 +149,22 @@ export class QuoteClient {
     async getKline(req) {
         return this.callInto('kline', req);
     }
-    async getTimeline(symbols) {
-        return this.callInto('timeline', { symbols });
+    async getTimeline(symbolsOrRequest) {
+        const req = Array.isArray(symbolsOrRequest) ? { symbols: symbolsOrRequest } : symbolsOrRequest;
+        return this.callInto('timeline', req, req.secType === 'CC' ? '3.0' : undefined);
     }
     /** Tick-by-tick trades. wire: trade_tick */
     async getTradeTick(req) {
-        return this.callInto('trade_tick', req);
+        const out = await this.callInto('trade_tick', req);
+        for (const tick of out) {
+            const isUs = isUsStockSymbol(tick.symbol);
+            for (const item of tick.items) {
+                if (item.cond && item.cond.length > 0) {
+                    item.cond = getTradeCondByCode(isUs, item.cond[0]);
+                }
+            }
+        }
+        return out;
     }
     /** Depth snapshot. wire: quote_depth */
     async getQuoteDepth(req) {
@@ -319,6 +330,7 @@ export class QuoteClient {
         while (acc.length < totalSize) {
             const sub = {
                 symbols: req.symbol ? [req.symbol] : undefined,
+                secType: req.secType,
                 period: req.period,
                 right: req.right,
                 beginTime,
@@ -369,7 +381,7 @@ export class QuoteClient {
     async getStockIndustry(req) {
         return this.callInto('stock_industry', req);
     }
-    /** Quote permission detail. wire: get_quote_permission */
+    /** Market data permission entries. wire: get_quote_permission */
     async getQuotePermission(req) {
         return this.callInto('get_quote_permission', req);
     }
@@ -380,9 +392,16 @@ export class QuoteClient {
     // ==========================================================================
     // Batch 4: option / future extensions
     // ==========================================================================
-    /** Option tick trades. wire: option_trade_tick */
+    /** Option tick trades. wire: option_trade_tick
+     *
+     * Server expects `biz_content` as a top-level JSON array (matches Java's
+     * `BatchApiModel` and Python's `MultipleContractParams.to_openapi_dict`).
+     * We unwrap the request here so the array is emitted directly instead of
+     * `{"contracts": [...]}`. Sending it as an object triggers
+     * `biz param error(failed to parse parameters in 'biz_content')`.
+     */
     async getOptionTradeTicks(req) {
-        return this.callInto('option_trade_tick', req);
+        return this.callInto('option_trade_tick', req.contracts ?? []);
     }
     /** Option intraday timeline. wire: option_timeline */
     async getOptionTimeline(req) {
@@ -421,10 +440,16 @@ export class QuoteClient {
         return this.callInto('future_main_contract', req);
     }
     /** Futures K-line. wire: future_kline
-     * beginTime / endTime default to -1 when unset (server requires them present). */
+     * beginTime / endTime default to -1 when unset (server requires them present).
+     * Server expects `contract_codes` (plural) — normalize singular `contractCode`
+     * to the plural form so callers can pass either shape. */
     async getFutureKline(req) {
+        const contractCodes = req.contractCodes
+            ?? (req.contractCode ? [req.contractCode] : undefined);
+        const { contractCode: _drop, ...rest } = req;
         const body = {
-            ...req,
+            ...rest,
+            ...(contractCodes ? { contractCodes } : {}),
             beginTime: req.beginTime ?? -1,
             endTime: req.endTime ?? -1,
         };
@@ -442,8 +467,9 @@ export class QuoteClient {
             endTime = -1;
         const acc = [];
         while (acc.length < totalSize) {
+            // Server rejects singular `contract_code` — send the plural form.
             const sub = {
-                contractCode: req.contractCode,
+                contractCodes: req.contractCode ? [req.contractCode] : undefined,
                 period: req.period,
                 beginTime,
                 endTime,
@@ -522,9 +548,30 @@ export class QuoteClient {
     async getWarrantFilter(req) {
         return this.callInto('warrant_filter', req);
     }
-    /** Industry list. wire: industry_list */
-    async getIndustryList(req) {
-        return this.callInto('industry_list', req);
+    /** Industry list. wire: industry_list
+     *
+     * `industryLevel` is required by the server — omitting it returns
+     * `industry level error, all supported is: [GSECTOR, GGROUP, GIND, GSUBIND]`.
+     * Defaults to `GGROUP` when unset, matching Python SDK's
+     * `IndustryLevel.GGROUP` default.
+     *
+     * Wire fields differ from other endpoints (see `IndustryItem`): server sends
+     * `nameCN` / `nameEN` / `industryLevel`. This method hydrates the
+     * backwards-compat `name` (from `nameEN || nameCN`) and mirrors
+     * `industryLevel` to `level` so existing callers keep working.
+     */
+    async getIndustryList(req = {}) {
+        const payload = { industryLevel: 'GGROUP', ...req };
+        const items = await this.callInto('industry_list', payload);
+        if (!Array.isArray(items))
+            return [];
+        for (const it of items) {
+            if (it.name === undefined)
+                it.name = it.nameEN || it.nameCN;
+            if (it.level === undefined)
+                it.level = it.industryLevel;
+        }
+        return items;
     }
     /** Stocks inside an industry. wire: industry_stock_list */
     async getIndustryStocks(req) {

package/dist/esm/trade/trade-client.js

@@ -109,14 +109,54 @@ export class TradeClient {
         });
     }
     // === Order operations ===
+    /**
+     * Prepare an order request for the wire.
+     *
+     * The gateway expects `algo_params` as a `[{tag, value}, ...]` array
+     * (matching the Python SDK's AlgoParams.to_dict serialization), not the
+     * plain object shape that reads naturally in TypeScript. This helper
+     * normalizes the object form into the array form on outbound payloads
+     * so callers can pass the natural object and TWAP/VWAP orders work end
+     * to end without wire-format workarounds.
+     *
+     * Fields with undefined/null values are dropped; empty algoParams
+     * becomes an empty array rather than being stripped, matching the
+     * Python SDK behavior when the user passes an empty AlgoParams().
+     */
+    marshalOrderForWire(order) {
+        const { algoParams, ...rest } = order;
+        const withAccount = { ...rest, account: this.account };
+        if (algoParams === undefined)
+            return withAccount;
+        // Already a tag/value array (advanced callers who want raw control)
+        if (Array.isArray(algoParams)) {
+            withAccount.algoParams = algoParams;
+            return withAccount;
+        }
+        // Object shape → tag/value array.
+        // Keys are converted to snake_case explicitly here (e.g. `startTime` →
+        // `start_time`) so they land correctly in the `tag` string that the
+        // gateway reads. `keysToSnakeCase` only rewrites object *keys*, not
+        // string *values*, so `tag` would be left camelCase if we didn't do
+        // this conversion ourselves.
+        const tagValues = [];
+        for (const [key, value] of Object.entries(algoParams)) {
+            if (value === undefined || value === null)
+                continue;
+            const snakeKey = key.replace(/[A-Z]/g, (c) => '_' + c.toLowerCase());
+            tagValues.push({ tag: snakeKey, value });
+        }
+        withAccount.algoParams = tagValues;
+        return withAccount;
+    }
     async placeOrder(order) {
-        return this.callInto('place_order', { ...order, account: this.account });
+        return this.callInto('place_order', this.marshalOrderForWire(order));
     }
     async previewOrder(order) {
-        return this.callInto('preview_order', { ...order, account: this.account });
+        return this.callInto('preview_order', this.marshalOrderForWire(order));
     }
     async modifyOrder(id, order) {
-        return this.callInto('modify_order', { ...order, account: this.account, id });
+        return this.callInto('modify_order', { ...this.marshalOrderForWire(order), id });
     }
     async cancelOrder(id, secretKey) {
         const params = { account: this.account, id };
@@ -181,11 +221,17 @@ export class TradeClient {
     async getPositions(req) {
         return this.callIntoItems('positions', withAccount(req, this.account));
     }
-    /** Query assets. v0.4.0: supports sub-account list and aggregation options. */
+    /**
+     * Query assets. v0.4.0: supports sub-account list and aggregation options.
+     * `assetQuoteType`(ETH / RTH / OVERNIGHT) 选择资产行情口径。
+     */
     async getAssets(req) {
         return this.callIntoItems('assets', withAccount(req, this.account));
     }
-    /** Query prime assets. v0.4.0: takes AssetsRequest for filters. */
+    /**
+     * Query prime assets. v0.4.0: takes AssetsRequest for filters.
+     * `assetQuoteType`(ETH / RTH / OVERNIGHT) 选择资产行情口径。
+     */
     async getPrimeAssets(req) {
         return this.callInto('prime_assets', withAccount(req, this.account));
     }
@@ -206,7 +252,10 @@ export class TradeClient {
     async getAnalyticsAsset(req) {
         return this.callIntoItems('analytics_asset', withAccount(req, this.account));
     }
-    /** Aggregate assets (prime) by base currency. */
+    /**
+     * Aggregate assets (prime) by base currency.
+     * `assetQuoteType`(ETH / RTH / OVERNIGHT) 选择资产行情口径。
+     */
     async getAggregateAssets(req) {
         return this.callInto('aggregate_assets', withAccount(req, this.account));
     }

package/dist/esm/version.js

@@ -1 +1 @@
-export const SDK_VERSION = '0.4.8';
+export const SDK_VERSION = '0.5.7';

package/dist/types/auth/authentication.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Request authentication interfaces.
+ *
+ * Implementations attach credentials, handle authentication retries, and release
+ * resources. OAuth 2.0 authorization flows live in `OAuth2SessionManager`; this module
+ * is the data plane and knows nothing about login.
+ */
+/** Which kind of authentication. */
+export declare enum AuthenticationType {
+    /** tigerId + RSA private key signature */
+    Signature = "SIGNATURE",
+    /** `Authorization: Bearer <access_token>` */
+    OAuth2 = "OAUTH2"
+}
+/**
+ * Per-request authentication context.
+ *
+ * Business parameters (`method`, `version`, `biz_content`, `timestamp`) are filled in by
+ * the client and must not be modified by an authentication implementation.
+ */
+export declare class RequestAuthContext {
+    /** Request body parameters. Read-only as far as authentication is concerned. */
+    readonly params: Record<string, string>;
+    /**
+     * Whether a request may be retried with a new credential after a 401.
+     *
+     * Order placement, modification, and cancellation are not retryable because a 401
+     * does not prove that the operation was not executed.
+     */
+    readonly retryable: boolean;
+    /** Full `Authorization` header value; undefined means do not send the header. */
+    authorizationHeader?: string;
+    constructor(params: Record<string, string>, retryable?: boolean);
+}
+/**
+ * Credential snapshot used to coordinate authentication retries.
+ *
+ * Comparing the failed credential with current state detects rotation completed
+ * elsewhere and avoids duplicate refresh requests.
+ */
+export declare class AuthenticationAttempt {
+    readonly authType: AuthenticationType;
+    /**
+     * Credential used by the request, including a raw OAuth 2.0 access token.
+     *
+     * This value is restricted to equality comparisons and must not be logged or exposed.
+     */
+    readonly credential: string | undefined;
+    constructor(authType: AuthenticationType, credential: string | undefined);
+    /** Never prints the credential value. */
+    toString(): string;
+}
+/**
+ * Authentication retry decision.
+ *
+ * A retry always supplies a new full `Authorization` header value, including the
+ * `Bearer ` prefix. There is deliberately no "retry with the same credential" option:
+ * that only collects the same 401 twice.
+ */
+export declare class RetryDecision {
+    private static readonly NO_RETRY;
+    readonly shouldRetry: boolean;
+    readonly authorizationHeader: string | undefined;
+    private constructor();
+    static noRetry(): RetryDecision;
+    /** @param authorizationHeader full new header value, including `Bearer ` */
+    static retry(authorizationHeader: string): RetryDecision;
+    /** Never prints the header value. */
+    toString(): string;
+}
+/** Authentication interface. */
+export interface Authentication {
+    /**
+     * Which kind of authentication. For logging and assertions; business logic should not
+     * branch on it.
+     */
+    readonly authType: AuthenticationType;
+    /**
+     * Write the credential into the request and return a snapshot of which credential was
+     * used.
+     *
+     * The OAuth2 implementation may refresh here, so this may reject with an
+     * `OAuth2Error`.
+     *
+     * @returns snapshot, passed back to {@link onUnauthorized}
+     */
+    apply(context: RequestAuthContext): Promise<AuthenticationAttempt>;
+    /**
+     * Return the retry decision for an unauthorized response.
+     *
+     * Refresh applies only to HTTP 401 credential failures, never to HTTP 403, server
+     * errors, or timeouts. Authentication retries occur at most once per request and
+     * require a different credential.
+     */
+    onUnauthorized(attempt: AuthenticationAttempt | undefined, statusCode: number): Promise<RetryDecision>;
+    /** Release resources. Must be called when switching authentication method. */
+    close(): void;
+}

package/dist/types/auth/index.d.ts

@@ -0,0 +1,4 @@
+/** Authentication layer: the request-level data plane plus the OAuth 2.0 control plane. */
+export { AuthenticationAttempt, AuthenticationType, RequestAuthContext, RetryDecision, } from './authentication';
+export type { Authentication } from './authentication';
+export * from './oauth2';

package/dist/types/auth/oauth2/client-registration.d.ts

@@ -0,0 +1,32 @@
+/**
+ * OAuth 2.0 dynamic client registration state (RFC 7591).
+ *
+ * Registration state is stored separately from tokens and retained across logout.
+ * `registeredScopes` records the granted scope set; scope expansion requires a new
+ * registration to avoid `invalid_scope`.
+ */
+/** Raw on-disk shape, shared with the Java and Python SDKs. */
+export interface OAuth2ClientRegistrationJson {
+    issuer?: string;
+    client_id?: string;
+    client_name?: string;
+    registered_scopes?: string;
+    client_id_issued_at?: number;
+}
+export declare class OAuth2ClientRegistration {
+    issuer?: string;
+    clientId?: string;
+    clientName?: string;
+    registeredScopes?: string;
+    clientIdIssuedAt: number;
+    constructor(init?: {
+        issuer?: string;
+        clientId?: string;
+        clientName?: string;
+        registeredScopes?: string;
+        clientIdIssuedAt?: number;
+    });
+    toJSON(): OAuth2ClientRegistrationJson;
+    static fromJSON(data: OAuth2ClientRegistrationJson | null | undefined): OAuth2ClientRegistration | null;
+    toString(): string;
+}

package/dist/types/auth/oauth2/device-authorization.d.ts

@@ -0,0 +1,40 @@
+/** Device authorization response (RFC 8628). */
+/**
+ * Default polling interval per RFC 8628 §3.5. Tiger's authorization server does not
+ * return `interval`, so this default applies in practice.
+ */
+export declare const DEFAULT_DEVICE_INTERVAL_SECONDS = 5;
+/** Raw shape of the device authorization response. */
+export interface OAuth2DeviceAuthorizationJson {
+    device_code?: string;
+    user_code?: string;
+    verification_uri?: string;
+    verification_uri_complete?: string;
+    expires_in?: number;
+    interval?: number;
+}
+export declare class OAuth2DeviceAuthorization {
+    /** Credential used to redeem the token; it must not be displayed or logged. */
+    deviceCode?: string;
+    /** Short code presented to the resource owner. */
+    userCode?: string;
+    /** Verification URI presented to the resource owner. */
+    verificationUri?: string;
+    /** Verification URI with the user code included. */
+    verificationUriComplete?: string;
+    expiresIn: number;
+    /** Polling interval in seconds; 0 means the server sent none */
+    interval: number;
+    constructor(init?: {
+        deviceCode?: string;
+        userCode?: string;
+        verificationUri?: string;
+        verificationUriComplete?: string;
+        expiresIn?: number;
+        interval?: number;
+    });
+    effectiveIntervalSeconds(): number;
+    static fromJSON(data: OAuth2DeviceAuthorizationJson | null | undefined): OAuth2DeviceAuthorization | null;
+    /** Prints no deviceCode. */
+    toString(): string;
+}

package/dist/types/auth/oauth2/errors.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Categorized errors from OAuth 2.0 authorization flows.
+ *
+ * Authorization server error details are retained in the error message.
+ */
+/** Error category. Each one implies a different action. */
+export declare enum OAuth2Category {
+    /** Cannot fetch authorization server metadata: wrong address, service down, no network */
+    MetadataUnavailable = "METADATA_UNAVAILABLE",
+    /** No usable client_id, and automatic registration is not possible */
+    ClientRegistrationRequired = "CLIENT_REGISTRATION_REQUIRED",
+    /** Callback stage failed: timeout, user denial, or state mismatch */
+    CallbackFailed = "CALLBACK_FAILED",
+    /**
+     * Device flow not approved in time, or explicitly denied. Kept separate from
+     * ReauthorizationRequired because only a new device authorization is needed -- the
+     * stored token was not touched.
+     */
+    DeviceAuthorizationFailed = "DEVICE_AUTHORIZATION_FAILED",
+    /** refresh_token expired, revoked, or never obtained. Retrying is pointless */
+    ReauthorizationRequired = "REAUTHORIZATION_REQUIRED",
+    /** Token endpoint call failed, and not in the terminal way above */
+    TokenRequestFailed = "TOKEN_REQUEST_FAILED",
+    /** Reading or writing the local token file failed */
+    StorageFailed = "STORAGE_FAILED"
+}
+/** Thrown by any stage of the OAuth2 flow. */
+export declare class OAuth2Error extends Error {
+    readonly category: OAuth2Category;
+    readonly cause?: unknown;
+    constructor(category: OAuth2Category, message: string, cause?: unknown);
+    get reauthorizationRequired(): boolean;
+    toString(): string;
+}
+/**
+ * A grant the authorization server refused.
+ *
+ * Carries the error code so a caller can tell a rejected credential from a rejected
+ * client registration. Its category is `ReauthorizationRequired`, so callers that only
+ * know the public type behave as they would for any terminal authorization failure.
+ */
+export declare class RejectedGrantError extends OAuth2Error {
+    readonly error: string;
+    constructor(error: string, description: string);
+    get isClientRejected(): boolean;
+}

package/dist/types/auth/oauth2/http-utils.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Every call here is a small JSON exchange with the authorization server, so a request
+ * that has not answered in this long is not going to. Same values as the Java and
+ * Python SDKs.
+ */
+export declare const CONNECT_TIMEOUT_SECONDS = 5;
+export declare const READ_TIMEOUT_SECONDS = 10;
+/** Form fields whose value is null or undefined are skipped. */
+export type FormFields = Record<string, string | undefined | null>;
+export declare function getJson(url: string): Promise<Record<string, unknown>>;
+export declare function postJson(url: string, payload: unknown): Promise<Record<string, unknown>>;
+export declare function postForm(url: string, form: FormFields): Promise<Record<string, unknown>>;
+/**
+ * Post a form and return the HTTP status without requiring a response body.
+ *
+ * RFC 7009 revocation returns an empty success body, so no parsing is performed.
+ *
+ * @returns the HTTP status code
+ * @throws OAuth2Error on connection failure
+ */
+export declare function postFormForStatus(url: string, form: FormFields): Promise<number>;

package/dist/types/auth/oauth2/index.d.ts

@@ -0,0 +1,16 @@
+/** OAuth 2.0 authentication, authorization flows, and token persistence. */
+export { OAuth2ClientRegistration } from './client-registration';
+export type { OAuth2ClientRegistrationJson } from './client-registration';
+export { OAuth2DeviceAuthorization, DEFAULT_DEVICE_INTERVAL_SECONDS } from './device-authorization';
+export type { OAuth2DeviceAuthorizationJson } from './device-authorization';
+export { OAuth2Category, OAuth2Error, RejectedGrantError } from './errors';
+export { LoopbackReceiver, CALLBACK_PATH } from './loopback-receiver';
+export { OAuth2Metadata } from './metadata';
+export { OAuth2Authentication, BEARER_PREFIX } from './oauth2-authentication';
+export { OAuth2SessionManager, BUILTIN_ISSUER, CLIENT_NAME, DEFAULT_AUTHORIZE_TIMEOUT_SECONDS, DEFAULT_MANUAL_CALLBACK_PORT, DEFAULT_REFRESH_AHEAD_MILLIS, ENV_ISSUER, MIN_USABLE_REMAINING_MILLIS, } from './session-manager';
+export type { AuthorizationUrlHandler, DeviceAuthorizationHandler, OAuth2SessionManagerOptions, } from './session-manager';
+export { OAuth2Token, TOKEN_SCHEMA_VERSION, currentMillis } from './token';
+export type { OAuth2TokenJson } from './token';
+export { OAuth2TokenStore, DEFAULT_SURFACE, ENV_HOME, hashIssuer } from './token-store';
+export type { TokenStore } from './token-store';
+export { CONNECT_TIMEOUT_SECONDS, READ_TIMEOUT_SECONDS } from './http-utils';

package/dist/types/auth/oauth2/loopback-receiver.d.ts

@@ -0,0 +1,29 @@
+export declare const CALLBACK_PATH = "/callback";
+/** Single-shot local callback server. */
+export declare class LoopbackReceiver {
+    private readonly server;
+    private port;
+    private params;
+    private fired;
+    private waiters;
+    private constructor();
+    /**
+     * Bind the receiver. It must be listening before the authorization request is issued.
+     *
+     * @param port port to bind; 0 lets the system assign a free one
+     */
+    static start(port?: number): Promise<LoopbackReceiver>;
+    get redirectUri(): string;
+    get boundPort(): number;
+    /**
+     * Wait for the browser callback.
+     *
+     * @returns the query parameters carried by the callback
+     * @throws OAuth2Error on timeout
+     */
+    waitForCallback(timeoutSeconds: number): Promise<Record<string, string>>;
+    close(): void;
+    /** Record the callback params (first one wins) and return a snapshot of them. */
+    private record;
+    private release;
+}

package/dist/types/auth/oauth2/metadata.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Authorization server metadata (RFC 8414).
+ *
+ * Endpoints always come from metadata, never hardcoded, so switching environments only
+ * means changing the issuer.
+ */
+/** Raw shape of `{issuer}/.well-known/oauth-authorization-server`. */
+export interface OAuth2MetadataJson {
+    issuer?: string;
+    authorization_endpoint?: string;
+    token_endpoint?: string;
+    registration_endpoint?: string;
+    device_authorization_endpoint?: string;
+    revocation_endpoint?: string;
+    scopes_supported?: string[];
+}
+export declare class OAuth2Metadata {
+    issuer?: string;
+    authorizationEndpoint?: string;
+    tokenEndpoint?: string;
+    /** Absent means only a manually configured clientId can be used */
+    registrationEndpoint?: string;
+    /** Absent means this environment does not support the device flow */
+    deviceAuthorizationEndpoint?: string;
+    /** RFC 7009 revocation. Absent means logout can only clear the local token */
+    revocationEndpoint?: string;
+    scopesSupported: string[];
+    constructor(init?: Partial<Omit<OAuth2Metadata, 'scopesSupported'>> & {
+        scopesSupported?: string[];
+    });
+    static fromJSON(data: OAuth2MetadataJson | null | undefined): OAuth2Metadata | null;
+}

package/dist/types/auth/oauth2/oauth2-authentication.d.ts

@@ -0,0 +1,31 @@
+/** Request authentication backed by an OAuth 2.0 session manager. */
+import { AuthenticationAttempt, AuthenticationType, RequestAuthContext, RetryDecision, type Authentication } from '../authentication';
+import type { OAuth2SessionManager } from './session-manager';
+export declare const BEARER_PREFIX = "Bearer ";
+/** Authenticate with an OAuth2 access token. */
+export declare class OAuth2Authentication implements Authentication {
+    private readonly sessions;
+    constructor(sessionManager: OAuth2SessionManager);
+    get authType(): AuthenticationType;
+    get sessionManager(): OAuth2SessionManager;
+    /**
+     * Attach a Bearer token to the request context.
+     *
+     * Near-expiry refreshes use the session manager's single-flight synchronization.
+     * Missing authorization rejects with `ReauthorizationRequired` without starting an
+     * implicit browser flow.
+     */
+    apply(context: RequestAuthContext): Promise<AuthenticationAttempt>;
+    /**
+     * Process HTTP 401 responses.
+     *
+     * HTTP 403 indicates insufficient permission and cannot be resolved by refreshing a
+     * token with the same scope. Server errors and timeouts are not credential failures.
+     */
+    onUnauthorized(attempt: AuthenticationAttempt | undefined, statusCode: number): Promise<RetryDecision>;
+    /**
+     * The session is owned by the application and may still be in use, so it is not
+     * closed here.
+     */
+    close(): void;
+}