@tigeropenapi/tigeropen 0.5.5 → 0.5.7

package/dist/cjs/auth/oauth2/token-store.js

@@ -0,0 +1,252 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2TokenStore = exports.DEFAULT_SURFACE = exports.ENV_HOME = void 0;
+exports.hashIssuer = hashIssuer;
+/**
+ * File-backed OAuth 2.0 authorization state.
+ *
+ * Storage layout:
+ *
+ *     ~/.tiger/openapi/
+ *       tokens/{clientId}.json                authorization state, mode 0600, removed on logout
+ *       clients/{issuerHash}-{surface}.json   dynamic registration, retained across logout
+ *
+ * Registration files are keyed by issuer because the client ID is not yet available
+ * during lookup, and by surface so that each entry point registers its own client.
+ * Without the surface, whichever entry point ran first would own the registration and
+ * every other one would silently inherit its identity: one name on the user's
+ * authorization page, one revocation switch for all of them, and one shared token file
+ * whose refresh-token rotation they would race over.
+ *
+ * Token files need no surface: each surface registers a distinct client ID, so their
+ * token files are already distinct. A manually configured client ID is shared on
+ * purpose -- one client ID means one application.
+ *
+ * Storage root precedence is: explicit argument, `TIGEROPEN_HOME`, then
+ * `~/.tiger/openapi`. The format is shared with the Java and Python SDKs.
+ */
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const os_1 = require("os");
+const path = __importStar(require("path"));
+const client_registration_1 = require("./client-registration");
+const errors_1 = require("./errors");
+const token_1 = require("./token");
+exports.ENV_HOME = 'TIGEROPEN_HOME';
+/**
+ * Entry point owning a registration. Tools built on this SDK must pass their own value,
+ * otherwise they would be filed as the TypeScript SDK and share its client. Keep in
+ * step with the Java SDK's `sdk-java` and the Python SDK's `sdk-python`.
+ */
+exports.DEFAULT_SURFACE = 'sdk-typescript';
+const SAFE_CHARS = /[^a-zA-Z0-9\-_.]/g;
+/**
+ * Surfaces become part of a file name, so they are restricted rather than sanitised: a
+ * silently rewritten surface would file two entry points under one name.
+ */
+const SURFACE_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
+class OAuth2TokenStore {
+    /**
+     * @param home storage root; defaults to `TIGEROPEN_HOME` then `~/.tiger/openapi`
+     * @param surface entry point owning the registration, e.g. `sdk-typescript`, `cli`.
+     *   Lowercase alphanumerics and hyphens only
+     */
+    constructor(home, surface = exports.DEFAULT_SURFACE) {
+        const base = home || process.env[exports.ENV_HOME] || path.join((0, os_1.homedir)(), '.tiger', 'openapi');
+        this.home = path.resolve(expandHome(base));
+        this.surface = validateSurface(surface);
+    }
+    /** Load a token, treating a missing file or issuer mismatch as a cache miss. */
+    loadToken(clientId, expectedIssuer) {
+        const file = this.tokenFile(clientId);
+        if (!fs.existsSync(file))
+            return null;
+        let token;
+        try {
+            token = token_1.OAuth2Token.fromJSON(JSON.parse(fs.readFileSync(file, 'utf-8')));
+        }
+        catch (e) {
+            // A corrupt file tells us nothing; treat it as no authorization rather than crash.
+            console.error(`[TigerOpen] read token file fail: ${file}`, e);
+            return null;
+        }
+        if (!token)
+            return null;
+        if (token.schemaVersion !== token_1.TOKEN_SCHEMA_VERSION) {
+            // Unknown schema versions are not interpreted.
+            throw new errors_1.OAuth2Error(errors_1.OAuth2Category.StorageFailed, `unsupported token schema_version: ${token.schemaVersion}`);
+        }
+        if (expectedIssuer !== undefined && expectedIssuer !== token.issuer) {
+            return null;
+        }
+        return token;
+    }
+    saveToken(token) {
+        if (!token || !token.clientId) {
+            throw new errors_1.OAuth2Error(errors_1.OAuth2Category.StorageFailed, 'token or clientId is empty, cannot save');
+        }
+        writeAtomic(this.tokenFile(token.clientId), JSON.stringify(token.toJSON(), null, 2));
+    }
+    /**
+     * Delete authorization state while retaining client registration.
+     *
+     * @returns the path removed, or null when there was nothing to remove. A clientId is
+     *   not its own file name, so a caller reporting what it deleted has to be told rather
+     *   than build the path itself
+     */
+    deleteToken(clientId) {
+        if (!clientId)
+            return null;
+        const file = this.tokenFile(clientId);
+        return deleteFile(file) ? file : null;
+    }
+    loadClientId(issuer) {
+        return this.loadClientRegistration(issuer)?.clientId ?? null;
+    }
+    loadClientRegistration(issuer) {
+        const file = this.clientFile(issuer);
+        if (!fs.existsSync(file))
+            return null;
+        try {
+            return client_registration_1.OAuth2ClientRegistration.fromJSON(JSON.parse(fs.readFileSync(file, 'utf-8')));
+        }
+        catch (e) {
+            console.error(`[TigerOpen] read client registration file fail: ${file}`, e);
+            return null;
+        }
+    }
+    saveClientRegistration(registration) {
+        if (!registration || !registration.issuer) {
+            throw new errors_1.OAuth2Error(errors_1.OAuth2Category.StorageFailed, 'registration or issuer is empty, cannot save');
+        }
+        writeAtomic(this.clientFile(registration.issuer), JSON.stringify(registration.toJSON(), null, 2));
+    }
+    /** Delete registration state after an `invalid_client` response. */
+    deleteClientRegistration(issuer) {
+        if (!issuer)
+            return;
+        deleteFile(this.clientFile(issuer));
+    }
+    tokenFile(clientId) {
+        return path.join(this.home, 'tokens', `${safeFileName(clientId)}.json`);
+    }
+    clientFile(issuer) {
+        return path.join(this.home, 'clients', `${hashIssuer(issuer)}-${this.surface}.json`);
+    }
+}
+exports.OAuth2TokenStore = OAuth2TokenStore;
+/** Return the Java-compatible 32-character SHA-256 issuer file key. */
+function hashIssuer(issuer) {
+    return (0, crypto_1.createHash)('sha256').update(issuer || '', 'utf-8').digest('hex').slice(0, 32);
+}
+/** Sanitize an untrusted client ID for use as a file name. */
+function safeFileName(raw) {
+    let name = (raw || '').replace(SAFE_CHARS, '_');
+    while (name.includes('..')) {
+        name = name.replace(/\.\./g, '__');
+    }
+    return name || '_';
+}
+/** Reject a surface that cannot be used verbatim as part of a file name. */
+function validateSurface(surface) {
+    if (typeof surface !== 'string' || !SURFACE_PATTERN.test(surface)) {
+        throw new errors_1.OAuth2Error(errors_1.OAuth2Category.StorageFailed, `invalid surface '${surface}': expected lowercase alphanumerics and hyphens, e.g. 'cli'`);
+    }
+    return surface;
+}
+function expandHome(value) {
+    if (value === '~')
+        return (0, os_1.homedir)();
+    if (value.startsWith('~/') || value.startsWith(`~${path.sep}`)) {
+        return path.join((0, os_1.homedir)(), value.slice(2));
+    }
+    return value;
+}
+/** @returns true when the file was there and is now gone */
+function deleteFile(file) {
+    try {
+        if (fs.existsSync(file)) {
+            fs.unlinkSync(file);
+            return true;
+        }
+    }
+    catch (e) {
+        console.error(`[TigerOpen] delete file fail: ${file}`, e);
+    }
+    return false;
+}
+/**
+ * Atomically replace a file through a same-directory temporary file.
+ *
+ * Same-filesystem replacement prevents partial JSON writes. Directories and files are
+ * restricted to modes 0700 and 0600 where supported.
+ */
+function writeAtomic(file, content) {
+    const dir = path.dirname(file);
+    try {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        restrict(dir, 0o700);
+        // Same directory, so the rename below stays on one filesystem and is atomic.
+        const tmp = path.join(dir, `.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+        try {
+            fs.writeFileSync(tmp, content, { encoding: 'utf-8', mode: 0o600 });
+            restrict(tmp, 0o600);
+            fs.renameSync(tmp, file);
+        }
+        catch (e) {
+            try {
+                fs.unlinkSync(tmp);
+            }
+            catch {
+                // The temporary file was never created; nothing to clean up.
+            }
+            throw e;
+        }
+        restrict(file, 0o600);
+    }
+    catch (e) {
+        throw new errors_1.OAuth2Error(errors_1.OAuth2Category.StorageFailed, `write file fail: ${file}`, e);
+    }
+}
+/** Restrict a credential file or directory where the platform supports it. */
+function restrict(target, mode) {
+    try {
+        fs.chmodSync(target, mode);
+    }
+    catch {
+        // Windows and some network filesystems have no POSIX modes; the write still stands.
+    }
+}

package/dist/cjs/auth/oauth2/token.js

@@ -0,0 +1,76 @@
+"use strict";
+/**
+ * Persisted OAuth 2.0 authorization state.
+ *
+ * The `issuer` and `clientId` bind credentials to an authorization server and client,
+ * preventing credential reuse across environments. The on-disk field names are
+ * snake_case and shared with the Java and Python SDKs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2Token = exports.TOKEN_SCHEMA_VERSION = void 0;
+exports.currentMillis = currentMillis;
+/** On-disk format version. An unrecognised version is an error, not a guess. */
+exports.TOKEN_SCHEMA_VERSION = 1;
+function currentMillis() {
+    return Date.now();
+}
+/** An access token and its metadata. */
+class OAuth2Token {
+    constructor(init = {}) {
+        this.schemaVersion = init.schemaVersion ?? exports.TOKEN_SCHEMA_VERSION;
+        this.issuer = init.issuer;
+        this.clientId = init.clientId;
+        this.accessToken = init.accessToken;
+        this.refreshToken = init.refreshToken;
+        this.tokenType = init.tokenType || 'Bearer';
+        this.scope = init.scope;
+        this.expiresAt = init.expiresAt ?? 0;
+    }
+    /** Time until expiry; negative once already expired. */
+    remainingMillis() {
+        return this.expiresAt - currentMillis();
+    }
+    /**
+     * @param aheadMillis how early to refresh. The window exists because time passes
+     *   between sending a request and the server validating it, so using a token right up
+     *   to its expiry produces intermittent 401s
+     */
+    needsRefresh(aheadMillis) {
+        return this.remainingMillis() <= aheadMillis;
+    }
+    hasRefreshToken() {
+        return !!this.refreshToken;
+    }
+    toJSON() {
+        return {
+            schema_version: this.schemaVersion,
+            issuer: this.issuer,
+            client_id: this.clientId,
+            access_token: this.accessToken,
+            refresh_token: this.refreshToken,
+            token_type: this.tokenType,
+            scope: this.scope,
+            expires_at: this.expiresAt,
+        };
+    }
+    static fromJSON(data) {
+        if (!data)
+            return null;
+        return new OAuth2Token({
+            schemaVersion: data.schema_version ?? exports.TOKEN_SCHEMA_VERSION,
+            issuer: data.issuer,
+            clientId: data.client_id,
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            tokenType: data.token_type || 'Bearer',
+            scope: data.scope,
+            expiresAt: data.expires_at ?? 0,
+        });
+    }
+    /** Prints no token values. */
+    toString() {
+        return `OAuth2Token{clientId=${this.clientId}, issuer=${this.issuer}, scope=${this.scope}, `
+            + `expiresAt=${this.expiresAt}, hasRefreshToken=${this.hasRefreshToken()}}`;
+    }
+}
+exports.OAuth2Token = OAuth2Token;

package/dist/cjs/push/pb/Request.js

@@ -203,7 +203,7 @@ exports.Request_Connect = {
     },
 };
 function createBaseRequest_Subscribe() {
-    return { dataType: 0, symbols: undefined, account: undefined, market: undefined };
+    return { dataType: 0, symbols: undefined, account: undefined, market: undefined, assetQuoteType: undefined };
 }
 exports.Request_Subscribe = {
     encode(message, writer = new wire_1.BinaryWriter()) {
@@ -219,6 +219,9 @@ exports.Request_Subscribe = {
         if (message.market !== undefined) {
             writer.uint32(34).string(message.market);
         }
+        if (message.assetQuoteType !== undefined) {
+            writer.uint32(42).string(message.assetQuoteType);
+        }
         return writer;
     },
     decode(input, length) {
@@ -256,6 +259,13 @@ exports.Request_Subscribe = {
                     message.market = reader.string();
                     continue;
                 }
+                case 5: {
+                    if (tag !== 42) {
+                        break;
+                    }
+                    message.assetQuoteType = reader.string();
+                    continue;
+                }
             }
             if ((tag & 7) === 4 || tag === 0) {
                 break;
@@ -273,6 +283,7 @@ exports.Request_Subscribe = {
         message.symbols = object.symbols ?? undefined;
         message.account = object.account ?? undefined;
         message.market = object.market ?? undefined;
+        message.assetQuoteType = object.assetQuoteType ?? undefined;
         return message;
     },
 };

package/dist/cjs/push/proto-message.js

@@ -53,8 +53,11 @@ function buildHeartBeatMessage() {
 }
 /**
  * 构建 SUBSCRIBE 请求消息
+ *
+ * @param assetQuoteType 资产行情类型枚举名（ETH / RTH / OVERNIGHT），
+ *   仅对 Asset / Position 两种订阅有意义，其余场景传 undefined
  */
-function buildSubscribeMessage(dataType, symbols, account, market) {
+function buildSubscribeMessage(dataType, symbols, account, market, assetQuoteType) {
     return Request_1.Request.fromPartial({
         command: SocketCommon_1.SocketCommon_Command.SUBSCRIBE,
         id: nextRequestId(),
@@ -63,6 +66,7 @@ function buildSubscribeMessage(dataType, symbols, account, market) {
             symbols,
             account,
             market,
+            assetQuoteType,
         }),
     });
 }

package/dist/cjs/push/push-client.js

@@ -95,6 +95,8 @@ class PushClient {
         this.subscriptions = new Map();
         /** Account-level subscriptions: subject -> account string used at subscribe time */
         this.accountSubs = new Map();
+        /** Account-level subscriptions: subject -> assetQuoteType used at subscribe time (reconnect replay) */
+        this.accountSubQuoteTypes = new Map();
         this.heartbeatTimer = null;
         this.reconnectTimer = null;
         this.stopped = false;
@@ -355,7 +357,7 @@ class PushClient {
             this.doSubscribe(subject, Array.from(symbols));
         }
         for (const [subject, account] of this.accountSubs) {
-            this.doSubscribe(subject, undefined, account);
+            this.doSubscribe(subject, undefined, account, undefined, this.accountSubQuoteTypes.get(subject));
         }
     }
     /** Dispatch push data to the appropriate callback based on dataType */
@@ -425,10 +427,10 @@ class PushClient {
         }
     }
     /** Internal subscribe method */
-    doSubscribe(subject, symbols, account, market) {
+    doSubscribe(subject, symbols, account, market, assetQuoteType) {
         const dataType = (0, proto_message_1.subjectToDataType)(subject);
         const symbolsStr = symbols ? symbols.join(',') : undefined;
-        const req = (0, proto_message_1.buildSubscribeMessage)(dataType, symbolsStr, account, market);
+        const req = (0, proto_message_1.buildSubscribeMessage)(dataType, symbolsStr, account, market, assetQuoteType);
         this.sendMessage(req);
     }
     /** Internal unsubscribe method */
@@ -588,27 +590,41 @@ class PushClient {
         this.removeSubscription(push_message_1.SubjectType.Market, [market]);
     }
     // ===== Account push subscribe/unsubscribe =====
-    /** Subscribe to asset changes */
-    subscribeAsset(account) {
-        const acct = account || this.config.account;
-        this.doSubscribe(push_message_1.SubjectType.Asset, undefined, acct);
-        this.accountSubs.set(push_message_1.SubjectType.Asset, acct);
+    /**
+     * Shared implementation for the account/options overloads of
+     * subscribeAsset / subscribePosition.
+     */
+    subscribeAccount(subject, accountOrOptions) {
+        const opts = typeof accountOrOptions === 'string'
+            ? { account: accountOrOptions }
+            : (accountOrOptions ?? {});
+        const acct = opts.account || this.config.account;
+        this.doSubscribe(subject, undefined, acct, undefined, opts.assetQuoteType);
+        this.accountSubs.set(subject, acct);
+        if (opts.assetQuoteType) {
+            this.accountSubQuoteTypes.set(subject, opts.assetQuoteType);
+        }
+        else {
+            this.accountSubQuoteTypes.delete(subject);
+        }
+    }
+    subscribeAsset(accountOrOptions) {
+        this.subscribeAccount(push_message_1.SubjectType.Asset, accountOrOptions);
     }
     /** Unsubscribe from asset changes */
     unsubscribeAsset() {
         this.doUnsubscribe(push_message_1.SubjectType.Asset);
         this.accountSubs.delete(push_message_1.SubjectType.Asset);
+        this.accountSubQuoteTypes.delete(push_message_1.SubjectType.Asset);
     }
-    /** Subscribe to position changes */
-    subscribePosition(account) {
-        const acct = account || this.config.account;
-        this.doSubscribe(push_message_1.SubjectType.Position, undefined, acct);
-        this.accountSubs.set(push_message_1.SubjectType.Position, acct);
+    subscribePosition(accountOrOptions) {
+        this.subscribeAccount(push_message_1.SubjectType.Position, accountOrOptions);
     }
     /** Unsubscribe from position changes */
     unsubscribePosition() {
         this.doUnsubscribe(push_message_1.SubjectType.Position);
         this.accountSubs.delete(push_message_1.SubjectType.Position);
+        this.accountSubQuoteTypes.delete(push_message_1.SubjectType.Position);
     }
     /** Subscribe to order status */
     subscribeOrder(account) {

package/dist/cjs/trade/trade-client.js

@@ -257,11 +257,17 @@ class TradeClient {
     async getPositions(req) {
         return this.callIntoItems('positions', withAccount(req, this.account));
     }
-    /** Query assets. v0.4.0: supports sub-account list and aggregation options. */
+    /**
+     * Query assets. v0.4.0: supports sub-account list and aggregation options.
+     * `assetQuoteType`(ETH / RTH / OVERNIGHT) 选择资产行情口径。
+     */
     async getAssets(req) {
         return this.callIntoItems('assets', withAccount(req, this.account));
     }
-    /** Query prime assets. v0.4.0: takes AssetsRequest for filters. */
+    /**
+     * Query prime assets. v0.4.0: takes AssetsRequest for filters.
+     * `assetQuoteType`(ETH / RTH / OVERNIGHT) 选择资产行情口径。
+     */
     async getPrimeAssets(req) {
         return this.callInto('prime_assets', withAccount(req, this.account));
     }
@@ -282,7 +288,10 @@ class TradeClient {
     async getAnalyticsAsset(req) {
         return this.callIntoItems('analytics_asset', withAccount(req, this.account));
     }
-    /** Aggregate assets (prime) by base currency. */
+    /**
+     * Aggregate assets (prime) by base currency.
+     * `assetQuoteType`(ETH / RTH / OVERNIGHT) 选择资产行情口径。
+     */
     async getAggregateAssets(req) {
         return this.callInto('aggregate_assets', withAccount(req, this.account));
     }

package/dist/cjs/version.js

@@ -1,4 +1,4 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SDK_VERSION = void 0;
-exports.SDK_VERSION = '0.4.8';
+exports.SDK_VERSION = '0.5.7';

package/dist/esm/auth/authentication.js

@@ -0,0 +1,68 @@
+/**
+ * Request authentication interfaces.
+ *
+ * Implementations attach credentials, handle authentication retries, and release
+ * resources. OAuth 2.0 authorization flows live in `OAuth2SessionManager`; this module
+ * is the data plane and knows nothing about login.
+ */
+/** Which kind of authentication. */
+export var AuthenticationType;
+(function (AuthenticationType) {
+    /** tigerId + RSA private key signature */
+    AuthenticationType["Signature"] = "SIGNATURE";
+    /** `Authorization: Bearer <access_token>` */
+    AuthenticationType["OAuth2"] = "OAUTH2";
+})(AuthenticationType || (AuthenticationType = {}));
+/**
+ * Per-request authentication context.
+ *
+ * Business parameters (`method`, `version`, `biz_content`, `timestamp`) are filled in by
+ * the client and must not be modified by an authentication implementation.
+ */
+export class RequestAuthContext {
+    constructor(params, retryable = true) {
+        this.params = params;
+        this.retryable = retryable;
+    }
+}
+/**
+ * Credential snapshot used to coordinate authentication retries.
+ *
+ * Comparing the failed credential with current state detects rotation completed
+ * elsewhere and avoids duplicate refresh requests.
+ */
+export class AuthenticationAttempt {
+    constructor(authType, credential) {
+        this.authType = authType;
+        this.credential = credential;
+    }
+    /** Never prints the credential value. */
+    toString() {
+        return `AuthenticationAttempt{type=${this.authType}, credential=${this.credential === undefined ? '<none>' : '***'}}`;
+    }
+}
+/**
+ * Authentication retry decision.
+ *
+ * A retry always supplies a new full `Authorization` header value, including the
+ * `Bearer ` prefix. There is deliberately no "retry with the same credential" option:
+ * that only collects the same 401 twice.
+ */
+export class RetryDecision {
+    constructor(shouldRetry, authorizationHeader) {
+        this.shouldRetry = shouldRetry;
+        this.authorizationHeader = authorizationHeader;
+    }
+    static noRetry() {
+        return RetryDecision.NO_RETRY;
+    }
+    /** @param authorizationHeader full new header value, including `Bearer ` */
+    static retry(authorizationHeader) {
+        return new RetryDecision(true, authorizationHeader);
+    }
+    /** Never prints the header value. */
+    toString() {
+        return `RetryDecision{shouldRetry=${this.shouldRetry}}`;
+    }
+}
+RetryDecision.NO_RETRY = new RetryDecision(false, undefined);

package/dist/esm/auth/index.js

@@ -0,0 +1,3 @@
+/** Authentication layer: the request-level data plane plus the OAuth 2.0 control plane. */
+export { AuthenticationAttempt, AuthenticationType, RequestAuthContext, RetryDecision, } from './authentication.js';
+export * from './oauth2/index.js';

package/dist/esm/auth/oauth2/client-registration.js

@@ -0,0 +1,40 @@
+/**
+ * OAuth 2.0 dynamic client registration state (RFC 7591).
+ *
+ * Registration state is stored separately from tokens and retained across logout.
+ * `registeredScopes` records the granted scope set; scope expansion requires a new
+ * registration to avoid `invalid_scope`.
+ */
+export class OAuth2ClientRegistration {
+    constructor(init = {}) {
+        this.issuer = init.issuer;
+        this.clientId = init.clientId;
+        this.clientName = init.clientName;
+        this.registeredScopes = init.registeredScopes;
+        this.clientIdIssuedAt = init.clientIdIssuedAt ?? 0;
+    }
+    toJSON() {
+        return {
+            issuer: this.issuer,
+            client_id: this.clientId,
+            client_name: this.clientName,
+            registered_scopes: this.registeredScopes,
+            client_id_issued_at: this.clientIdIssuedAt,
+        };
+    }
+    static fromJSON(data) {
+        if (!data)
+            return null;
+        return new OAuth2ClientRegistration({
+            issuer: data.issuer,
+            clientId: data.client_id,
+            clientName: data.client_name,
+            registeredScopes: data.registered_scopes,
+            clientIdIssuedAt: data.client_id_issued_at ?? 0,
+        });
+    }
+    toString() {
+        return `OAuth2ClientRegistration{issuer=${this.issuer}, clientId=${this.clientId}, `
+            + `clientName=${this.clientName}, registeredScopes=${this.registeredScopes}}`;
+    }
+}

package/dist/esm/auth/oauth2/device-authorization.js

@@ -0,0 +1,36 @@
+/** Device authorization response (RFC 8628). */
+/**
+ * Default polling interval per RFC 8628 §3.5. Tiger's authorization server does not
+ * return `interval`, so this default applies in practice.
+ */
+export const DEFAULT_DEVICE_INTERVAL_SECONDS = 5;
+export class OAuth2DeviceAuthorization {
+    constructor(init = {}) {
+        this.deviceCode = init.deviceCode;
+        this.userCode = init.userCode;
+        this.verificationUri = init.verificationUri;
+        this.verificationUriComplete = init.verificationUriComplete;
+        this.expiresIn = init.expiresIn ?? 0;
+        this.interval = init.interval ?? 0;
+    }
+    effectiveIntervalSeconds() {
+        return this.interval > 0 ? this.interval : DEFAULT_DEVICE_INTERVAL_SECONDS;
+    }
+    static fromJSON(data) {
+        if (!data)
+            return null;
+        return new OAuth2DeviceAuthorization({
+            deviceCode: data.device_code,
+            userCode: data.user_code,
+            verificationUri: data.verification_uri,
+            verificationUriComplete: data.verification_uri_complete,
+            expiresIn: data.expires_in ?? 0,
+            interval: data.interval ?? 0,
+        });
+    }
+    /** Prints no deviceCode. */
+    toString() {
+        return `OAuth2DeviceAuthorization{userCode=${this.userCode}, verificationUri=${this.verificationUri}, `
+            + `expiresIn=${this.expiresIn}, interval=${this.interval}}`;
+    }
+}