@tigeropenapi/tigeropen 0.5.5 → 0.5.7

package/README.md

@@ -276,10 +276,24 @@ pc.disconnect();
 | `subscribeFuture(symbols)` | Futures quotes | `onFuture(QuoteData)` |
 | `subscribeKline(symbols)` | K-line data | `onKline(KlineData)` |
 | `subscribeAsset(account?)` | Asset changes | `onAsset(AssetData)` |
+| `subscribeAsset(options)` | Asset changes, `{ account?, assetQuoteType? }` | `onAsset(AssetData)` |
 | `subscribePosition(account?)` | Position changes | `onPosition(PositionData)` |
+| `subscribePosition(options)` | Position changes, `{ account?, assetQuoteType? }` | `onPosition(PositionData)` |
 | `subscribeOrder(account?)` | Order status | `onOrder(OrderStatusData)` |
 | `subscribeTransaction(account?)` | Transactions | `onTransaction(OrderTransactionData)` |
 
+`assetQuoteType` selects the quote basis of the pushed asset / position data —
+`'ETH'`, `'RTH'` or `'OVERNIGHT'`. Omit it to keep the server default.
+
+```typescript
+pc.subscribeAsset({ assetQuoteType: 'OVERNIGHT' });
+pc.subscribePosition({ account: 'U1234567', assetQuoteType: 'RTH' });
+```
+
+The same enum name is accepted as `assetQuoteType` on the HTTP side by
+`getPositions` / `getAssets` / `getPrimeAssets` / `getAggregateAssets`
+(wire name `asset_quote_type`).
+
 ## Project Structure
 
 ```
@@ -652,10 +666,23 @@ pc.disconnect();
 | `subscribeFuture(symbols)` | 期货行情 | `onFuture(QuoteData)` |
 | `subscribeKline(symbols)` | K 线数据 | `onKline(KlineData)` |
 | `subscribeAsset(account?)` | 资产变动 | `onAsset(AssetData)` |
+| `subscribeAsset(options)` | 资产变动,`{ account?, assetQuoteType? }` | `onAsset(AssetData)` |
 | `subscribePosition(account?)` | 持仓变动 | `onPosition(PositionData)` |
+| `subscribePosition(options)` | 持仓变动,`{ account?, assetQuoteType? }` | `onPosition(PositionData)` |
 | `subscribeOrder(account?)` | 订单状态 | `onOrder(OrderStatusData)` |
 | `subscribeTransaction(account?)` | 成交明细 | `onTransaction(OrderTransactionData)` |
 
+`assetQuoteType` 用于选择推送的资产/持仓行情口径,取值为枚举名
+`'ETH'` / `'RTH'` / `'OVERNIGHT'`,不传则用服务端默认值。
+
+```typescript
+pc.subscribeAsset({ assetQuoteType: 'OVERNIGHT' });
+pc.subscribePosition({ account: 'U1234567', assetQuoteType: 'RTH' });
+```
+
+拉取侧 `getPositions` / `getAssets` / `getPrimeAssets` / `getAggregateAssets`
+同样接受 `assetQuoteType` 字段(wire 名 `asset_quote_type`)。
+
 ## 项目结构
 
 ```

package/dist/cjs/auth/authentication.js

@@ -0,0 +1,74 @@
+"use strict";
+/**
+ * Request authentication interfaces.
+ *
+ * Implementations attach credentials, handle authentication retries, and release
+ * resources. OAuth 2.0 authorization flows live in `OAuth2SessionManager`; this module
+ * is the data plane and knows nothing about login.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RetryDecision = exports.AuthenticationAttempt = exports.RequestAuthContext = exports.AuthenticationType = void 0;
+/** Which kind of authentication. */
+var AuthenticationType;
+(function (AuthenticationType) {
+    /** tigerId + RSA private key signature */
+    AuthenticationType["Signature"] = "SIGNATURE";
+    /** `Authorization: Bearer <access_token>` */
+    AuthenticationType["OAuth2"] = "OAUTH2";
+})(AuthenticationType || (exports.AuthenticationType = AuthenticationType = {}));
+/**
+ * Per-request authentication context.
+ *
+ * Business parameters (`method`, `version`, `biz_content`, `timestamp`) are filled in by
+ * the client and must not be modified by an authentication implementation.
+ */
+class RequestAuthContext {
+    constructor(params, retryable = true) {
+        this.params = params;
+        this.retryable = retryable;
+    }
+}
+exports.RequestAuthContext = RequestAuthContext;
+/**
+ * Credential snapshot used to coordinate authentication retries.
+ *
+ * Comparing the failed credential with current state detects rotation completed
+ * elsewhere and avoids duplicate refresh requests.
+ */
+class AuthenticationAttempt {
+    constructor(authType, credential) {
+        this.authType = authType;
+        this.credential = credential;
+    }
+    /** Never prints the credential value. */
+    toString() {
+        return `AuthenticationAttempt{type=${this.authType}, credential=${this.credential === undefined ? '<none>' : '***'}}`;
+    }
+}
+exports.AuthenticationAttempt = AuthenticationAttempt;
+/**
+ * Authentication retry decision.
+ *
+ * A retry always supplies a new full `Authorization` header value, including the
+ * `Bearer ` prefix. There is deliberately no "retry with the same credential" option:
+ * that only collects the same 401 twice.
+ */
+class RetryDecision {
+    constructor(shouldRetry, authorizationHeader) {
+        this.shouldRetry = shouldRetry;
+        this.authorizationHeader = authorizationHeader;
+    }
+    static noRetry() {
+        return RetryDecision.NO_RETRY;
+    }
+    /** @param authorizationHeader full new header value, including `Bearer ` */
+    static retry(authorizationHeader) {
+        return new RetryDecision(true, authorizationHeader);
+    }
+    /** Never prints the header value. */
+    toString() {
+        return `RetryDecision{shouldRetry=${this.shouldRetry}}`;
+    }
+}
+exports.RetryDecision = RetryDecision;
+RetryDecision.NO_RETRY = new RetryDecision(false, undefined);

package/dist/cjs/auth/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RetryDecision = exports.RequestAuthContext = exports.AuthenticationType = exports.AuthenticationAttempt = void 0;
+/** Authentication layer: the request-level data plane plus the OAuth 2.0 control plane. */
+var authentication_1 = require("./authentication");
+Object.defineProperty(exports, "AuthenticationAttempt", { enumerable: true, get: function () { return authentication_1.AuthenticationAttempt; } });
+Object.defineProperty(exports, "AuthenticationType", { enumerable: true, get: function () { return authentication_1.AuthenticationType; } });
+Object.defineProperty(exports, "RequestAuthContext", { enumerable: true, get: function () { return authentication_1.RequestAuthContext; } });
+Object.defineProperty(exports, "RetryDecision", { enumerable: true, get: function () { return authentication_1.RetryDecision; } });
+__exportStar(require("./oauth2"), exports);

package/dist/cjs/auth/oauth2/client-registration.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * OAuth 2.0 dynamic client registration state (RFC 7591).
+ *
+ * Registration state is stored separately from tokens and retained across logout.
+ * `registeredScopes` records the granted scope set; scope expansion requires a new
+ * registration to avoid `invalid_scope`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2ClientRegistration = void 0;
+class OAuth2ClientRegistration {
+    constructor(init = {}) {
+        this.issuer = init.issuer;
+        this.clientId = init.clientId;
+        this.clientName = init.clientName;
+        this.registeredScopes = init.registeredScopes;
+        this.clientIdIssuedAt = init.clientIdIssuedAt ?? 0;
+    }
+    toJSON() {
+        return {
+            issuer: this.issuer,
+            client_id: this.clientId,
+            client_name: this.clientName,
+            registered_scopes: this.registeredScopes,
+            client_id_issued_at: this.clientIdIssuedAt,
+        };
+    }
+    static fromJSON(data) {
+        if (!data)
+            return null;
+        return new OAuth2ClientRegistration({
+            issuer: data.issuer,
+            clientId: data.client_id,
+            clientName: data.client_name,
+            registeredScopes: data.registered_scopes,
+            clientIdIssuedAt: data.client_id_issued_at ?? 0,
+        });
+    }
+    toString() {
+        return `OAuth2ClientRegistration{issuer=${this.issuer}, clientId=${this.clientId}, `
+            + `clientName=${this.clientName}, registeredScopes=${this.registeredScopes}}`;
+    }
+}
+exports.OAuth2ClientRegistration = OAuth2ClientRegistration;

package/dist/cjs/auth/oauth2/device-authorization.js

@@ -0,0 +1,40 @@
+"use strict";
+/** Device authorization response (RFC 8628). */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2DeviceAuthorization = exports.DEFAULT_DEVICE_INTERVAL_SECONDS = void 0;
+/**
+ * Default polling interval per RFC 8628 §3.5. Tiger's authorization server does not
+ * return `interval`, so this default applies in practice.
+ */
+exports.DEFAULT_DEVICE_INTERVAL_SECONDS = 5;
+class OAuth2DeviceAuthorization {
+    constructor(init = {}) {
+        this.deviceCode = init.deviceCode;
+        this.userCode = init.userCode;
+        this.verificationUri = init.verificationUri;
+        this.verificationUriComplete = init.verificationUriComplete;
+        this.expiresIn = init.expiresIn ?? 0;
+        this.interval = init.interval ?? 0;
+    }
+    effectiveIntervalSeconds() {
+        return this.interval > 0 ? this.interval : exports.DEFAULT_DEVICE_INTERVAL_SECONDS;
+    }
+    static fromJSON(data) {
+        if (!data)
+            return null;
+        return new OAuth2DeviceAuthorization({
+            deviceCode: data.device_code,
+            userCode: data.user_code,
+            verificationUri: data.verification_uri,
+            verificationUriComplete: data.verification_uri_complete,
+            expiresIn: data.expires_in ?? 0,
+            interval: data.interval ?? 0,
+        });
+    }
+    /** Prints no deviceCode. */
+    toString() {
+        return `OAuth2DeviceAuthorization{userCode=${this.userCode}, verificationUri=${this.verificationUri}, `
+            + `expiresIn=${this.expiresIn}, interval=${this.interval}}`;
+    }
+}
+exports.OAuth2DeviceAuthorization = OAuth2DeviceAuthorization;

package/dist/cjs/auth/oauth2/errors.js

@@ -0,0 +1,64 @@
+"use strict";
+/**
+ * Categorized errors from OAuth 2.0 authorization flows.
+ *
+ * Authorization server error details are retained in the error message.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RejectedGrantError = exports.OAuth2Error = exports.OAuth2Category = void 0;
+/** Error category. Each one implies a different action. */
+var OAuth2Category;
+(function (OAuth2Category) {
+    /** Cannot fetch authorization server metadata: wrong address, service down, no network */
+    OAuth2Category["MetadataUnavailable"] = "METADATA_UNAVAILABLE";
+    /** No usable client_id, and automatic registration is not possible */
+    OAuth2Category["ClientRegistrationRequired"] = "CLIENT_REGISTRATION_REQUIRED";
+    /** Callback stage failed: timeout, user denial, or state mismatch */
+    OAuth2Category["CallbackFailed"] = "CALLBACK_FAILED";
+    /**
+     * Device flow not approved in time, or explicitly denied. Kept separate from
+     * ReauthorizationRequired because only a new device authorization is needed -- the
+     * stored token was not touched.
+     */
+    OAuth2Category["DeviceAuthorizationFailed"] = "DEVICE_AUTHORIZATION_FAILED";
+    /** refresh_token expired, revoked, or never obtained. Retrying is pointless */
+    OAuth2Category["ReauthorizationRequired"] = "REAUTHORIZATION_REQUIRED";
+    /** Token endpoint call failed, and not in the terminal way above */
+    OAuth2Category["TokenRequestFailed"] = "TOKEN_REQUEST_FAILED";
+    /** Reading or writing the local token file failed */
+    OAuth2Category["StorageFailed"] = "STORAGE_FAILED";
+})(OAuth2Category || (exports.OAuth2Category = OAuth2Category = {}));
+/** Thrown by any stage of the OAuth2 flow. */
+class OAuth2Error extends Error {
+    constructor(category, message, cause) {
+        super(message);
+        this.name = 'OAuth2Error';
+        this.category = category;
+        this.cause = cause;
+    }
+    get reauthorizationRequired() {
+        return this.category === OAuth2Category.ReauthorizationRequired;
+    }
+    toString() {
+        return `OAuth2Error{${this.category}: ${this.message}}`;
+    }
+}
+exports.OAuth2Error = OAuth2Error;
+/**
+ * A grant the authorization server refused.
+ *
+ * Carries the error code so a caller can tell a rejected credential from a rejected
+ * client registration. Its category is `ReauthorizationRequired`, so callers that only
+ * know the public type behave as they would for any terminal authorization failure.
+ */
+class RejectedGrantError extends OAuth2Error {
+    constructor(error, description) {
+        super(OAuth2Category.ReauthorizationRequired, `token request rejected: ${error} ${description}`);
+        this.name = 'RejectedGrantError';
+        this.error = error;
+    }
+    get isClientRejected() {
+        return this.error === 'invalid_client';
+    }
+}
+exports.RejectedGrantError = RejectedGrantError;

package/dist/cjs/auth/oauth2/http-utils.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.READ_TIMEOUT_SECONDS = exports.CONNECT_TIMEOUT_SECONDS = void 0;
+exports.getJson = getJson;
+exports.postJson = postJson;
+exports.postForm = postForm;
+exports.postFormForStatus = postFormForStatus;
+/**
+ * HTTP helpers for OAuth 2.0 JSON and form-encoded requests.
+ *
+ * OAuth error responses retain 4xx response bodies for protocol-level error handling.
+ */
+const errors_1 = require("./errors");
+/**
+ * Every call here is a small JSON exchange with the authorization server, so a request
+ * that has not answered in this long is not going to. Same values as the Java and
+ * Python SDKs.
+ */
+exports.CONNECT_TIMEOUT_SECONDS = 5;
+exports.READ_TIMEOUT_SECONDS = 10;
+/** Combined budget handed to `AbortSignal.timeout`; fetch does not split the two. */
+const REQUEST_TIMEOUT_MS = (exports.CONNECT_TIMEOUT_SECONDS + exports.READ_TIMEOUT_SECONDS) * 1000;
+const JSON_CONTENT_TYPE = 'application/json; charset=utf-8';
+const FORM_CONTENT_TYPE = 'application/x-www-form-urlencoded; charset=utf-8';
+function encodeForm(form) {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(form)) {
+        if (value !== undefined && value !== null) {
+            params.append(key, value);
+        }
+    }
+    return params.toString();
+}
+async function getJson(url) {
+    return execute('GET', url, undefined, undefined);
+}
+async function postJson(url, payload) {
+    return execute('POST', url, JSON.stringify(payload), JSON_CONTENT_TYPE);
+}
+async function postForm(url, form) {
+    return execute('POST', url, encodeForm(form), FORM_CONTENT_TYPE);
+}
+/**
+ * Post a form and return the HTTP status without requiring a response body.
+ *
+ * RFC 7009 revocation returns an empty success body, so no parsing is performed.
+ *
+ * @returns the HTTP status code
+ * @throws OAuth2Error on connection failure
+ */
+async function postFormForStatus(url, form) {
+    let response;
+    try {
+        response = await fetch(url, {
+            method: 'POST',
+            headers: { Accept: 'application/json', 'Content-Type': FORM_CONTENT_TYPE },
+            body: encodeForm(form),
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (e) {
+        throw new errors_1.OAuth2Error(errors_1.OAuth2Category.TokenRequestFailed, `request fail: ${url}`, e);
+    }
+    return response.status;
+}
+/**
+ * Send the request and parse the response body as an object.
+ *
+ * A 4xx returns its body instead of throwing: OAuth2 errors (`invalid_grant`,
+ * `authorization_pending` and friends) live in the 4xx body, and the caller needs the
+ * `error` field to tell "wait and retry" from "re-authorize". Only a connection failure
+ * or a non-JSON response throws.
+ */
+async function execute(method, url, body, contentType) {
+    const headers = { Accept: 'application/json' };
+    if (contentType) {
+        headers['Content-Type'] = contentType;
+    }
+    let response;
+    try {
+        response = await fetch(url, {
+            method,
+            headers,
+            body,
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (e) {
+        throw new errors_1.OAuth2Error(errors_1.OAuth2Category.MetadataUnavailable, `request fail: ${url}`, e);
+    }
+    let text;
+    try {
+        text = await response.text();
+    }
+    catch (e) {
+        throw new errors_1.OAuth2Error(errors_1.OAuth2Category.TokenRequestFailed, `cannot decode response from ${url}, http status ${response.status}`, e);
+    }
+    if (!text) {
+        throw new errors_1.OAuth2Error(errors_1.OAuth2Category.TokenRequestFailed, `empty response from ${url}, http status ${response.status}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (e) {
+        throw new errors_1.OAuth2Error(errors_1.OAuth2Category.TokenRequestFailed, `non-JSON response from ${url}, http status ${response.status}`, e);
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new errors_1.OAuth2Error(errors_1.OAuth2Category.TokenRequestFailed, `unexpected response from ${url}, http status ${response.status}`);
+    }
+    return parsed;
+}

package/dist/cjs/auth/oauth2/index.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.READ_TIMEOUT_SECONDS = exports.CONNECT_TIMEOUT_SECONDS = exports.hashIssuer = exports.ENV_HOME = exports.DEFAULT_SURFACE = exports.OAuth2TokenStore = exports.currentMillis = exports.TOKEN_SCHEMA_VERSION = exports.OAuth2Token = exports.MIN_USABLE_REMAINING_MILLIS = exports.ENV_ISSUER = exports.DEFAULT_REFRESH_AHEAD_MILLIS = exports.DEFAULT_MANUAL_CALLBACK_PORT = exports.DEFAULT_AUTHORIZE_TIMEOUT_SECONDS = exports.CLIENT_NAME = exports.BUILTIN_ISSUER = exports.OAuth2SessionManager = exports.BEARER_PREFIX = exports.OAuth2Authentication = exports.OAuth2Metadata = exports.CALLBACK_PATH = exports.LoopbackReceiver = exports.RejectedGrantError = exports.OAuth2Error = exports.OAuth2Category = exports.DEFAULT_DEVICE_INTERVAL_SECONDS = exports.OAuth2DeviceAuthorization = exports.OAuth2ClientRegistration = void 0;
+/** OAuth 2.0 authentication, authorization flows, and token persistence. */
+var client_registration_1 = require("./client-registration");
+Object.defineProperty(exports, "OAuth2ClientRegistration", { enumerable: true, get: function () { return client_registration_1.OAuth2ClientRegistration; } });
+var device_authorization_1 = require("./device-authorization");
+Object.defineProperty(exports, "OAuth2DeviceAuthorization", { enumerable: true, get: function () { return device_authorization_1.OAuth2DeviceAuthorization; } });
+Object.defineProperty(exports, "DEFAULT_DEVICE_INTERVAL_SECONDS", { enumerable: true, get: function () { return device_authorization_1.DEFAULT_DEVICE_INTERVAL_SECONDS; } });
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "OAuth2Category", { enumerable: true, get: function () { return errors_1.OAuth2Category; } });
+Object.defineProperty(exports, "OAuth2Error", { enumerable: true, get: function () { return errors_1.OAuth2Error; } });
+Object.defineProperty(exports, "RejectedGrantError", { enumerable: true, get: function () { return errors_1.RejectedGrantError; } });
+var loopback_receiver_1 = require("./loopback-receiver");
+Object.defineProperty(exports, "LoopbackReceiver", { enumerable: true, get: function () { return loopback_receiver_1.LoopbackReceiver; } });
+Object.defineProperty(exports, "CALLBACK_PATH", { enumerable: true, get: function () { return loopback_receiver_1.CALLBACK_PATH; } });
+var metadata_1 = require("./metadata");
+Object.defineProperty(exports, "OAuth2Metadata", { enumerable: true, get: function () { return metadata_1.OAuth2Metadata; } });
+var oauth2_authentication_1 = require("./oauth2-authentication");
+Object.defineProperty(exports, "OAuth2Authentication", { enumerable: true, get: function () { return oauth2_authentication_1.OAuth2Authentication; } });
+Object.defineProperty(exports, "BEARER_PREFIX", { enumerable: true, get: function () { return oauth2_authentication_1.BEARER_PREFIX; } });
+var session_manager_1 = require("./session-manager");
+Object.defineProperty(exports, "OAuth2SessionManager", { enumerable: true, get: function () { return session_manager_1.OAuth2SessionManager; } });
+Object.defineProperty(exports, "BUILTIN_ISSUER", { enumerable: true, get: function () { return session_manager_1.BUILTIN_ISSUER; } });
+Object.defineProperty(exports, "CLIENT_NAME", { enumerable: true, get: function () { return session_manager_1.CLIENT_NAME; } });
+Object.defineProperty(exports, "DEFAULT_AUTHORIZE_TIMEOUT_SECONDS", { enumerable: true, get: function () { return session_manager_1.DEFAULT_AUTHORIZE_TIMEOUT_SECONDS; } });
+Object.defineProperty(exports, "DEFAULT_MANUAL_CALLBACK_PORT", { enumerable: true, get: function () { return session_manager_1.DEFAULT_MANUAL_CALLBACK_PORT; } });
+Object.defineProperty(exports, "DEFAULT_REFRESH_AHEAD_MILLIS", { enumerable: true, get: function () { return session_manager_1.DEFAULT_REFRESH_AHEAD_MILLIS; } });
+Object.defineProperty(exports, "ENV_ISSUER", { enumerable: true, get: function () { return session_manager_1.ENV_ISSUER; } });
+Object.defineProperty(exports, "MIN_USABLE_REMAINING_MILLIS", { enumerable: true, get: function () { return session_manager_1.MIN_USABLE_REMAINING_MILLIS; } });
+var token_1 = require("./token");
+Object.defineProperty(exports, "OAuth2Token", { enumerable: true, get: function () { return token_1.OAuth2Token; } });
+Object.defineProperty(exports, "TOKEN_SCHEMA_VERSION", { enumerable: true, get: function () { return token_1.TOKEN_SCHEMA_VERSION; } });
+Object.defineProperty(exports, "currentMillis", { enumerable: true, get: function () { return token_1.currentMillis; } });
+var token_store_1 = require("./token-store");
+Object.defineProperty(exports, "OAuth2TokenStore", { enumerable: true, get: function () { return token_store_1.OAuth2TokenStore; } });
+Object.defineProperty(exports, "DEFAULT_SURFACE", { enumerable: true, get: function () { return token_store_1.DEFAULT_SURFACE; } });
+Object.defineProperty(exports, "ENV_HOME", { enumerable: true, get: function () { return token_store_1.ENV_HOME; } });
+Object.defineProperty(exports, "hashIssuer", { enumerable: true, get: function () { return token_store_1.hashIssuer; } });
+var http_utils_1 = require("./http-utils");
+Object.defineProperty(exports, "CONNECT_TIMEOUT_SECONDS", { enumerable: true, get: function () { return http_utils_1.CONNECT_TIMEOUT_SECONDS; } });
+Object.defineProperty(exports, "READ_TIMEOUT_SECONDS", { enumerable: true, get: function () { return http_utils_1.READ_TIMEOUT_SECONDS; } });

package/dist/cjs/auth/oauth2/loopback-receiver.js

@@ -0,0 +1,215 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LoopbackReceiver = exports.CALLBACK_PATH = void 0;
+/**
+ * Single-use OAuth 2.0 loopback redirect receiver (RFC 8252).
+ *
+ * The receiver binds only to `127.0.0.1` to prevent authorization code exposure on the
+ * local network. Dynamic registration uses a system-assigned port as permitted by
+ * RFC 8252 §7.3; manual registration requires a port matching its redirect URI. The IP
+ * literal avoids the name-resolution risks described by RFC 8252 §8.3.
+ */
+const http = __importStar(require("http"));
+const errors_1 = require("./errors");
+exports.CALLBACK_PATH = '/callback';
+/** Inline SVG avoids external resources and font-dependent glyph rendering. */
+function icon(color, path) {
+    return `<svg width='64' height='64' viewBox='0 0 64 64' aria-hidden='true'>`
+        + `<circle cx='32' cy='32' r='29' fill='none' stroke='${color}' stroke-width='4'/>`
+        + `<path d='${path}' fill='none' stroke='${color}' stroke-width='5'`
+        + ` stroke-linecap='round' stroke-linejoin='round'/></svg>`;
+}
+/** Green tick. */
+const ICON_SUCCESS = icon('#22c55e', 'M19 33l9.5 9.5L45 22');
+/** Grey dash for the normal `access_denied` outcome. */
+const ICON_CANCELLED = icon('#9ca3af', 'M20 32h24');
+/** Red cross, for outcomes that really are failures. */
+const ICON_FAILED = icon('#ef4444', 'M22 22l20 20M42 22L22 42');
+/** English callback text, kept consistent with the Java and Python SDKs. */
+const TEXT = {
+    title: 'Tiger OpenAPI',
+    success: ['Authorization successful', 'You can close this page and return to the application.'],
+    cancelled: ['Authorization cancelled', 'You declined this authorization. You can close this page.'],
+    failed: ['Authorization failed', 'Please return to the application and try again.'],
+};
+/** Classify `access_denied` as cancellation and other errors as failures. */
+function outcomeOf(params) {
+    if ('code' in params)
+        return 'success';
+    if (params['error'] === 'access_denied')
+        return 'cancelled';
+    return 'failed';
+}
+/**
+ * Render a redacted callback outcome page.
+ *
+ * Callback parameters, including authorization codes and errors, are omitted because
+ * browser history, screenshots, and extensions may expose page content. Full parameters
+ * remain available to internal callback processing.
+ */
+function renderPage(params) {
+    const outcome = outcomeOf(params);
+    const svg = { success: ICON_SUCCESS, cancelled: ICON_CANCELLED, failed: ICON_FAILED }[outcome];
+    const [heading, detail] = TEXT[outcome];
+    return `<!DOCTYPE html><html><head><meta charset='utf-8'>`
+        + `<meta name='viewport' content='width=device-width,initial-scale=1'>`
+        + `<title>${TEXT['title']}</title></head>`
+        + `<body style="margin:0;min-height:100vh;display:flex;align-items:center;`
+        + `justify-content:center;`
+        + `font-family:-apple-system,BlinkMacSystemFont,'PingFang SC','Microsoft YaHei',`
+        + `sans-serif;background:#fafafa;color:#1f2328">`
+        + `<main style='text-align:center;padding:48px 24px;max-width:420px'>`
+        + `${svg}`
+        + `<h2 style='margin:24px 0 8px;font-size:20px;font-weight:600'>${heading}</h2>`
+        + `<p style='margin:0;font-size:14px;line-height:1.6;color:#6b7280'>${detail}</p>`
+        + `</main></body></html>`;
+}
+/** Single-shot local callback server. */
+class LoopbackReceiver {
+    constructor(server) {
+        this.port = 0;
+        this.params = {};
+        this.fired = false;
+        this.waiters = [];
+        this.server = server;
+    }
+    /**
+     * Bind the receiver. It must be listening before the authorization request is issued.
+     *
+     * @param port port to bind; 0 lets the system assign a free one
+     */
+    static async start(port = 0) {
+        const server = http.createServer();
+        const receiver = new LoopbackReceiver(server);
+        server.on('request', (req, res) => {
+            const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+            if (url.pathname !== exports.CALLBACK_PATH) {
+                res.writeHead(404, { 'Content-Length': '0' });
+                res.end();
+                return;
+            }
+            const snapshot = receiver.record(url.searchParams);
+            const body = Buffer.from(renderPage(snapshot), 'utf-8');
+            res.writeHead(200, {
+                'Content-Type': 'text/html; charset=utf-8',
+                'Content-Length': String(body.length),
+            });
+            res.end(body);
+            receiver.release(snapshot);
+        });
+        await new Promise((resolve, reject) => {
+            const onError = (e) => {
+                // A fixed port can conflict with another listener; system-assigned ports do not.
+                const hint = port === 0 ? '' : ` (port ${port} is in use; free it or set another callbackPort`
+                    + ' matching the redirect_uri registered for your client)';
+                reject(new errors_1.OAuth2Error(errors_1.OAuth2Category.CallbackFailed, `cannot bind loopback callback server on 127.0.0.1:${port}${hint}`, e));
+            };
+            server.once('error', onError);
+            server.listen(port, '127.0.0.1', () => {
+                server.removeListener('error', onError);
+                const address = server.address();
+                receiver.port = typeof address === 'object' && address ? address.port : port;
+                resolve();
+            });
+        });
+        return receiver;
+    }
+    get redirectUri() {
+        return `http://127.0.0.1:${this.port}${exports.CALLBACK_PATH}`;
+    }
+    get boundPort() {
+        return this.port;
+    }
+    /**
+     * Wait for the browser callback.
+     *
+     * @returns the query parameters carried by the callback
+     * @throws OAuth2Error on timeout
+     */
+    waitForCallback(timeoutSeconds) {
+        if (this.fired) {
+            return Promise.resolve({ ...this.params });
+        }
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.waiters = this.waiters.filter((w) => w !== onParams);
+                reject(new errors_1.OAuth2Error(errors_1.OAuth2Category.CallbackFailed, 'waiting for authorization callback timed out'));
+            }, timeoutSeconds * 1000);
+            const onParams = (params) => {
+                clearTimeout(timer);
+                resolve(params);
+            };
+            this.waiters.push(onParams);
+        });
+    }
+    close() {
+        try {
+            // The browser keeps its connection alive after the redirect, and close() alone
+            // waits for it. That would hold the port -- which matters for the fixed port a
+            // manually registered client has to reuse on the next authorization.
+            this.server.closeAllConnections?.();
+        }
+        catch {
+            // Older runtimes have no such method; the idle timeout releases the port instead.
+        }
+        try {
+            this.server.close();
+        }
+        catch {
+            // Already closed; nothing to release.
+        }
+    }
+    /** Record the callback params (first one wins) and return a snapshot of them. */
+    record(search) {
+        if (!this.fired) {
+            for (const [key, value] of search.entries()) {
+                this.params[key] = value;
+            }
+        }
+        return { ...this.params };
+    }
+    release(snapshot) {
+        if (this.fired)
+            return;
+        this.fired = true;
+        const waiters = this.waiters;
+        this.waiters = [];
+        for (const waiter of waiters) {
+            waiter(snapshot);
+        }
+    }
+}
+exports.LoopbackReceiver = LoopbackReceiver;