@tigeropenapi/tigeropen 0.5.5 → 0.5.7

package/dist/types/auth/oauth2/errors.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Categorized errors from OAuth 2.0 authorization flows.
+ *
+ * Authorization server error details are retained in the error message.
+ */
+/** Error category. Each one implies a different action. */
+export declare enum OAuth2Category {
+    /** Cannot fetch authorization server metadata: wrong address, service down, no network */
+    MetadataUnavailable = "METADATA_UNAVAILABLE",
+    /** No usable client_id, and automatic registration is not possible */
+    ClientRegistrationRequired = "CLIENT_REGISTRATION_REQUIRED",
+    /** Callback stage failed: timeout, user denial, or state mismatch */
+    CallbackFailed = "CALLBACK_FAILED",
+    /**
+     * Device flow not approved in time, or explicitly denied. Kept separate from
+     * ReauthorizationRequired because only a new device authorization is needed -- the
+     * stored token was not touched.
+     */
+    DeviceAuthorizationFailed = "DEVICE_AUTHORIZATION_FAILED",
+    /** refresh_token expired, revoked, or never obtained. Retrying is pointless */
+    ReauthorizationRequired = "REAUTHORIZATION_REQUIRED",
+    /** Token endpoint call failed, and not in the terminal way above */
+    TokenRequestFailed = "TOKEN_REQUEST_FAILED",
+    /** Reading or writing the local token file failed */
+    StorageFailed = "STORAGE_FAILED"
+}
+/** Thrown by any stage of the OAuth2 flow. */
+export declare class OAuth2Error extends Error {
+    readonly category: OAuth2Category;
+    readonly cause?: unknown;
+    constructor(category: OAuth2Category, message: string, cause?: unknown);
+    get reauthorizationRequired(): boolean;
+    toString(): string;
+}
+/**
+ * A grant the authorization server refused.
+ *
+ * Carries the error code so a caller can tell a rejected credential from a rejected
+ * client registration. Its category is `ReauthorizationRequired`, so callers that only
+ * know the public type behave as they would for any terminal authorization failure.
+ */
+export declare class RejectedGrantError extends OAuth2Error {
+    readonly error: string;
+    constructor(error: string, description: string);
+    get isClientRejected(): boolean;
+}

package/dist/types/auth/oauth2/http-utils.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Every call here is a small JSON exchange with the authorization server, so a request
+ * that has not answered in this long is not going to. Same values as the Java and
+ * Python SDKs.
+ */
+export declare const CONNECT_TIMEOUT_SECONDS = 5;
+export declare const READ_TIMEOUT_SECONDS = 10;
+/** Form fields whose value is null or undefined are skipped. */
+export type FormFields = Record<string, string | undefined | null>;
+export declare function getJson(url: string): Promise<Record<string, unknown>>;
+export declare function postJson(url: string, payload: unknown): Promise<Record<string, unknown>>;
+export declare function postForm(url: string, form: FormFields): Promise<Record<string, unknown>>;
+/**
+ * Post a form and return the HTTP status without requiring a response body.
+ *
+ * RFC 7009 revocation returns an empty success body, so no parsing is performed.
+ *
+ * @returns the HTTP status code
+ * @throws OAuth2Error on connection failure
+ */
+export declare function postFormForStatus(url: string, form: FormFields): Promise<number>;

package/dist/types/auth/oauth2/index.d.ts

@@ -0,0 +1,16 @@
+/** OAuth 2.0 authentication, authorization flows, and token persistence. */
+export { OAuth2ClientRegistration } from './client-registration';
+export type { OAuth2ClientRegistrationJson } from './client-registration';
+export { OAuth2DeviceAuthorization, DEFAULT_DEVICE_INTERVAL_SECONDS } from './device-authorization';
+export type { OAuth2DeviceAuthorizationJson } from './device-authorization';
+export { OAuth2Category, OAuth2Error, RejectedGrantError } from './errors';
+export { LoopbackReceiver, CALLBACK_PATH } from './loopback-receiver';
+export { OAuth2Metadata } from './metadata';
+export { OAuth2Authentication, BEARER_PREFIX } from './oauth2-authentication';
+export { OAuth2SessionManager, BUILTIN_ISSUER, CLIENT_NAME, DEFAULT_AUTHORIZE_TIMEOUT_SECONDS, DEFAULT_MANUAL_CALLBACK_PORT, DEFAULT_REFRESH_AHEAD_MILLIS, ENV_ISSUER, MIN_USABLE_REMAINING_MILLIS, } from './session-manager';
+export type { AuthorizationUrlHandler, DeviceAuthorizationHandler, OAuth2SessionManagerOptions, } from './session-manager';
+export { OAuth2Token, TOKEN_SCHEMA_VERSION, currentMillis } from './token';
+export type { OAuth2TokenJson } from './token';
+export { OAuth2TokenStore, DEFAULT_SURFACE, ENV_HOME, hashIssuer } from './token-store';
+export type { TokenStore } from './token-store';
+export { CONNECT_TIMEOUT_SECONDS, READ_TIMEOUT_SECONDS } from './http-utils';

package/dist/types/auth/oauth2/loopback-receiver.d.ts

@@ -0,0 +1,29 @@
+export declare const CALLBACK_PATH = "/callback";
+/** Single-shot local callback server. */
+export declare class LoopbackReceiver {
+    private readonly server;
+    private port;
+    private params;
+    private fired;
+    private waiters;
+    private constructor();
+    /**
+     * Bind the receiver. It must be listening before the authorization request is issued.
+     *
+     * @param port port to bind; 0 lets the system assign a free one
+     */
+    static start(port?: number): Promise<LoopbackReceiver>;
+    get redirectUri(): string;
+    get boundPort(): number;
+    /**
+     * Wait for the browser callback.
+     *
+     * @returns the query parameters carried by the callback
+     * @throws OAuth2Error on timeout
+     */
+    waitForCallback(timeoutSeconds: number): Promise<Record<string, string>>;
+    close(): void;
+    /** Record the callback params (first one wins) and return a snapshot of them. */
+    private record;
+    private release;
+}

package/dist/types/auth/oauth2/metadata.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Authorization server metadata (RFC 8414).
+ *
+ * Endpoints always come from metadata, never hardcoded, so switching environments only
+ * means changing the issuer.
+ */
+/** Raw shape of `{issuer}/.well-known/oauth-authorization-server`. */
+export interface OAuth2MetadataJson {
+    issuer?: string;
+    authorization_endpoint?: string;
+    token_endpoint?: string;
+    registration_endpoint?: string;
+    device_authorization_endpoint?: string;
+    revocation_endpoint?: string;
+    scopes_supported?: string[];
+}
+export declare class OAuth2Metadata {
+    issuer?: string;
+    authorizationEndpoint?: string;
+    tokenEndpoint?: string;
+    /** Absent means only a manually configured clientId can be used */
+    registrationEndpoint?: string;
+    /** Absent means this environment does not support the device flow */
+    deviceAuthorizationEndpoint?: string;
+    /** RFC 7009 revocation. Absent means logout can only clear the local token */
+    revocationEndpoint?: string;
+    scopesSupported: string[];
+    constructor(init?: Partial<Omit<OAuth2Metadata, 'scopesSupported'>> & {
+        scopesSupported?: string[];
+    });
+    static fromJSON(data: OAuth2MetadataJson | null | undefined): OAuth2Metadata | null;
+}

package/dist/types/auth/oauth2/oauth2-authentication.d.ts

@@ -0,0 +1,31 @@
+/** Request authentication backed by an OAuth 2.0 session manager. */
+import { AuthenticationAttempt, AuthenticationType, RequestAuthContext, RetryDecision, type Authentication } from '../authentication';
+import type { OAuth2SessionManager } from './session-manager';
+export declare const BEARER_PREFIX = "Bearer ";
+/** Authenticate with an OAuth2 access token. */
+export declare class OAuth2Authentication implements Authentication {
+    private readonly sessions;
+    constructor(sessionManager: OAuth2SessionManager);
+    get authType(): AuthenticationType;
+    get sessionManager(): OAuth2SessionManager;
+    /**
+     * Attach a Bearer token to the request context.
+     *
+     * Near-expiry refreshes use the session manager's single-flight synchronization.
+     * Missing authorization rejects with `ReauthorizationRequired` without starting an
+     * implicit browser flow.
+     */
+    apply(context: RequestAuthContext): Promise<AuthenticationAttempt>;
+    /**
+     * Process HTTP 401 responses.
+     *
+     * HTTP 403 indicates insufficient permission and cannot be resolved by refreshing a
+     * token with the same scope. Server errors and timeouts are not credential failures.
+     */
+    onUnauthorized(attempt: AuthenticationAttempt | undefined, statusCode: number): Promise<RetryDecision>;
+    /**
+     * The session is owned by the application and may still be in use, so it is not
+     * closed here.
+     */
+    close(): void;
+}

package/dist/types/auth/oauth2/session-manager.d.ts

@@ -0,0 +1,241 @@
+import { OAuth2DeviceAuthorization } from './device-authorization';
+import { OAuth2Token } from './token';
+import { type TokenStore } from './token-store';
+export declare const ENV_ISSUER = "TIGEROPEN_OAUTH2_ISSUER";
+/**
+ * Production authorization server. The environment variable or constructor argument
+ * overrides this value.
+ */
+export declare const BUILTIN_ISSUER = "https://openapi-oauth2.tigerfintech.com";
+/** How early to refresh an access token. */
+export declare const DEFAULT_REFRESH_AHEAD_MILLIS: number;
+/** Remaining lifetime below which a token is no longer handed out. */
+export declare const MIN_USABLE_REMAINING_MILLIS: number;
+/** How long to wait for the browser callback. */
+export declare const DEFAULT_AUTHORIZE_TIMEOUT_SECONDS: number;
+/**
+ * Fixed callback port for a manually configured clientId. Chosen to stay clear of the
+ * default Linux ephemeral range (from 32768) and of common dev ports.
+ */
+export declare const DEFAULT_MANUAL_CALLBACK_PORT = 18888;
+/**
+ * Application name registered by the SDK itself. Shown on the user's authorization
+ * page, so an entry point that registers its own client passes its own name.
+ */
+export declare const CLIENT_NAME = "Tiger TypeScript SDK";
+/** Receives the authorization URL. The SDK does not open a browser itself. */
+export type AuthorizationUrlHandler = (url: string) => void | Promise<void>;
+/** Receives the device authorization so the caller can display it. */
+export type DeviceAuthorizationHandler = (device: OAuth2DeviceAuthorization) => void | Promise<void>;
+export interface OAuth2SessionManagerOptions {
+    /** Authorization server; defaults to `TIGEROPEN_OAUTH2_ISSUER` or the built-in issuer */
+    issuer?: string;
+    /** Manually issued client ID; omit for dynamic registration */
+    clientId?: string;
+    /**
+     * Loopback port; 0 selects a system-assigned port for dynamic registration. Do not
+     * pass one in dynamic registration mode: it pins the registered redirect_uri to that
+     * port, and later dropping the argument leaves the registration behind.
+     */
+    callbackPort?: number;
+    /**
+     * Storage root; defaults to `TIGEROPEN_HOME` or `~/.tiger/openapi`. Ignored when
+     * `store` is provided
+     */
+    home?: string;
+    /**
+     * Persistence provider; when given, it owns its own surface and `surface` is ignored
+     */
+    store?: TokenStore;
+    /**
+     * Entry point owning the dynamic registration, e.g. `sdk-typescript`, `cli`, `mcp`.
+     * Each surface registers its own client, so it appears separately on the user's
+     * authorization page and can be revoked on its own. Tools built on this SDK must pass
+     * their own value
+     */
+    surface?: string;
+    /**
+     * Application name sent with dynamic registration and shown on the user's
+     * authorization page. A tool passing its own `surface` passes its own name too, or
+     * the user sees the SDK's name where the tool's belongs
+     */
+    clientName?: string;
+    /** Loopback callback timeout in seconds */
+    authorizeTimeoutSeconds?: number;
+}
+/** OAuth 2.0 authorization session manager. */
+export declare class OAuth2SessionManager {
+    private readonly _issuer;
+    private readonly _callbackPort;
+    /** Fixed for the session because it determines storage keys and registration mode. */
+    private readonly explicitClientId;
+    private readonly authorizeTimeoutSeconds;
+    private readonly clientName;
+    private readonly store;
+    private registeredClientId;
+    private metadata;
+    private token;
+    private resolvedScopes;
+    /** In-flight refresh, so concurrent callers share one token request (single-flight). */
+    private refreshInFlight;
+    /** In-flight metadata discovery, so concurrent callers share one round trip. */
+    private metadataInFlight;
+    constructor(options?: OAuth2SessionManagerOptions);
+    static defaultIssuer(): string;
+    get issuer(): string;
+    /** Currently known clientId; undefined before registration in dynamic mode. */
+    get clientId(): string | undefined;
+    get hasExplicitClientId(): boolean;
+    get callbackPort(): number;
+    /** Scopes requested by this session, space-separated. Fetches metadata. */
+    scopes(): Promise<string>;
+    /**
+     * Create a default session and perform browser authorization when required.
+     *
+     * The callback receives the authorization URL; the SDK does not open a browser.
+     */
+    static loginWithDefaults(onAuthorizationUrl: AuthorizationUrlHandler): Promise<OAuth2SessionManager>;
+    /** Create a default session and perform device authorization when required. */
+    static loginWithDeviceCodeDefaults(onDeviceAuthorization: DeviceAuthorizationHandler): Promise<OAuth2SessionManager>;
+    /**
+     * Perform browser authorization with a loopback redirect and PKCE.
+     *
+     * @param onAuthorizationUrl callback receiving the authorization URL
+     */
+    login(onAuthorizationUrl: AuthorizationUrlHandler): Promise<OAuth2Token>;
+    /**
+     * Use the existing local authorization if usable, otherwise run a full loopback +
+     * PKCE authorization.
+     */
+    loginIfNeeded(onAuthorizationUrl: AuthorizationUrlHandler): Promise<OAuth2Token>;
+    /**
+     * Reuse local authorization or perform device authorization (RFC 8628).
+     *
+     * Device authorization supports environments without a local browser. Unlike loopback
+     * authorization with PKCE, it has no redirect binding or proof that the initiating and
+     * redeeming clients are the same party, increasing phishing risk. Loopback
+     * authorization is preferred when a local browser is available.
+     */
+    loginWithDeviceCodeIfNeeded(onDeviceAuthorization: DeviceAuthorizationHandler): Promise<OAuth2Token>;
+    /**
+     * Perform device authorization as defined by RFC 8628.
+     *
+     * This flow is intended for environments without a local browser and has the security
+     * limitations documented by {@link loginWithDeviceCodeIfNeeded}.
+     */
+    loginWithDeviceCode(onDeviceAuthorization: DeviceAuthorizationHandler): Promise<OAuth2Token>;
+    /**
+     * Revoke authorization under RFC 7009 and delete the local token.
+     *
+     * Dynamic client registration is retained across logout. The local token is deleted
+     * even if server-side revocation fails.
+     *
+     * @returns true when server-side revocation succeeds; false when only local state is
+     *   cleared and the server credential may remain valid
+     */
+    logout(): Promise<boolean>;
+    /**
+     * Return a usable access token, refreshing near expiry.
+     *
+     * Throws `ReauthorizationRequired` when no authorization is available. Browser
+     * authorization is never started implicitly.
+     *
+     * A refresh being due does not make the caller wait for one. While the current token
+     * still has {@link MIN_USABLE_REMAINING_MILLIS} of life, a refresh already running
+     * elsewhere is left to finish and the current token is returned.
+     */
+    getAccessToken(): Promise<string>;
+    /** The current token, or undefined. Sends no requests and triggers no authorization. */
+    status(): OAuth2Token | undefined;
+    /**
+     * Whether asking for a token now would trigger a refresh. Reads memory only.
+     *
+     * Exists so no other component needs a refresh-ahead window of its own.
+     */
+    shouldRefreshSoon(): boolean;
+    isAuthorized(): boolean;
+    /** Refresh because the token is close to expiry. */
+    refresh(failedAccessToken?: string): Promise<OAuth2Token>;
+    /**
+     * Refresh after a 401 even when the token is not near expiry.
+     *
+     * @param failedAccessToken token used by the failed request; comparison with the
+     *   current token detects rotation completed elsewhere and preserves single-flight
+     *   refresh behavior
+     */
+    refreshAfterUnauthorized(failedAccessToken: string | undefined): Promise<OAuth2Token>;
+    /**
+     * Single-flight refresh: the first caller performs rotation while others await the
+     * same promise.
+     */
+    private doRefresh;
+    private refreshOnce;
+    /**
+     * Handle a refresh the authorization server rejected.
+     *
+     * Refresh tokens rotate, so the rejected value may already have been replaced by
+     * another process sharing this store. The store is re-read before any local state is
+     * removed, and the authorization is treated as ended only once the newest stored
+     * credential is rejected too.
+     */
+    private recoverOrGiveUp;
+    /** Exchange the given token's refresh token for a new access token and persist it. */
+    private exchangeRefreshToken;
+    /**
+     * Read the stored token from disk, bypassing the in-memory copy.
+     *
+     * @returns the stored token, or null when there is none or it cannot be read
+     */
+    private reloadFromStore;
+    /**
+     * Remove the local token, and the dynamic registration when that was refused.
+     *
+     * Only the credential that was refused is removed, and only while it is still the one
+     * on disk. Another process sharing the store may have replaced it in the meantime, and
+     * that replacement was never refused.
+     */
+    private forgetRejectedAuthorization;
+    /**
+     * Remove a refused dynamic client registration so the next authorization registers a
+     * new one. Explicit clientIds are left alone.
+     */
+    private forgetRejectedRegistration;
+    /**
+     * Return a reusable local token, refreshing it when required.
+     *
+     * @returns undefined when interactive authorization is required
+     */
+    private reusableToken;
+    private currentToken;
+    /**
+     * The known clientId, without triggering registration. Manual mode never reads
+     * `clients/`.
+     */
+    private knownClientId;
+    private persist;
+    private effectiveCallbackPort;
+    private resolveScopes;
+    private metadataOf;
+    /** Manual clientId > saved registration whose scopes still cover > register. */
+    private resolveClientId;
+    /**
+     * Register a public client under RFC 7591.
+     *
+     * Registration omits scope. The granted scope set is stored separately so a wider
+     * requirement triggers re-registration instead of `invalid_scope`.
+     */
+    private register;
+    private requestDeviceAuthorization;
+    /** Poll the token endpoint according to RFC 8628 response semantics. */
+    private pollForDeviceToken;
+    private exchange;
+    private toToken;
+    /**
+     * Attempt server-side revocation without throwing.
+     *
+     * The refresh token is preferred because RFC 7009 §2.1 permits revocation of its
+     * associated access tokens. RFC 7009 §2.2 also returns success for unknown or
+     * previously revoked tokens.
+     */
+    private revoke;
+}

package/dist/types/auth/oauth2/token-store.d.ts

@@ -0,0 +1,49 @@
+import { OAuth2ClientRegistration } from './client-registration';
+import { OAuth2Token } from './token';
+export declare const ENV_HOME = "TIGEROPEN_HOME";
+/**
+ * Entry point owning a registration. Tools built on this SDK must pass their own value,
+ * otherwise they would be filed as the TypeScript SDK and share its client. Keep in
+ * step with the Java SDK's `sdk-java` and the Python SDK's `sdk-python`.
+ */
+export declare const DEFAULT_SURFACE = "sdk-typescript";
+/** Persistence provider contract, so a caller can store tokens somewhere else. */
+export interface TokenStore {
+    loadToken(clientId: string, expectedIssuer?: string): OAuth2Token | null;
+    saveToken(token: OAuth2Token): void;
+    deleteToken(clientId: string): string | null;
+    loadClientId(issuer: string): string | null;
+    loadClientRegistration(issuer: string): OAuth2ClientRegistration | null;
+    saveClientRegistration(registration: OAuth2ClientRegistration): void;
+    deleteClientRegistration(issuer: string): void;
+}
+export declare class OAuth2TokenStore implements TokenStore {
+    readonly home: string;
+    readonly surface: string;
+    /**
+     * @param home storage root; defaults to `TIGEROPEN_HOME` then `~/.tiger/openapi`
+     * @param surface entry point owning the registration, e.g. `sdk-typescript`, `cli`.
+     *   Lowercase alphanumerics and hyphens only
+     */
+    constructor(home?: string, surface?: string);
+    /** Load a token, treating a missing file or issuer mismatch as a cache miss. */
+    loadToken(clientId: string, expectedIssuer?: string): OAuth2Token | null;
+    saveToken(token: OAuth2Token): void;
+    /**
+     * Delete authorization state while retaining client registration.
+     *
+     * @returns the path removed, or null when there was nothing to remove. A clientId is
+     *   not its own file name, so a caller reporting what it deleted has to be told rather
+     *   than build the path itself
+     */
+    deleteToken(clientId: string): string | null;
+    loadClientId(issuer: string): string | null;
+    loadClientRegistration(issuer: string): OAuth2ClientRegistration | null;
+    saveClientRegistration(registration: OAuth2ClientRegistration): void;
+    /** Delete registration state after an `invalid_client` response. */
+    deleteClientRegistration(issuer: string): void;
+    private tokenFile;
+    private clientFile;
+}
+/** Return the Java-compatible 32-character SHA-256 issuer file key. */
+export declare function hashIssuer(issuer: string): string;

package/dist/types/auth/oauth2/token.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Persisted OAuth 2.0 authorization state.
+ *
+ * The `issuer` and `clientId` bind credentials to an authorization server and client,
+ * preventing credential reuse across environments. The on-disk field names are
+ * snake_case and shared with the Java and Python SDKs.
+ */
+/** On-disk format version. An unrecognised version is an error, not a guess. */
+export declare const TOKEN_SCHEMA_VERSION = 1;
+export declare function currentMillis(): number;
+/** Raw on-disk shape. */
+export interface OAuth2TokenJson {
+    schema_version?: number;
+    issuer?: string;
+    client_id?: string;
+    access_token?: string;
+    refresh_token?: string;
+    token_type?: string;
+    scope?: string;
+    expires_at?: number;
+}
+/** An access token and its metadata. */
+export declare class OAuth2Token {
+    schemaVersion: number;
+    issuer?: string;
+    clientId?: string;
+    accessToken?: string;
+    refreshToken?: string;
+    tokenType: string;
+    scope?: string;
+    /** Absolute expiry as epoch millis, not expires_in */
+    expiresAt: number;
+    constructor(init?: {
+        issuer?: string;
+        clientId?: string;
+        accessToken?: string;
+        refreshToken?: string;
+        tokenType?: string;
+        scope?: string;
+        expiresAt?: number;
+        schemaVersion?: number;
+    });
+    /** Time until expiry; negative once already expired. */
+    remainingMillis(): number;
+    /**
+     * @param aheadMillis how early to refresh. The window exists because time passes
+     *   between sending a request and the server validating it, so using a token right up
+     *   to its expiry produces intermittent 401s
+     */
+    needsRefresh(aheadMillis: number): boolean;
+    hasRefreshToken(): boolean;
+    toJSON(): OAuth2TokenJson;
+    static fromJSON(data: OAuth2TokenJson | null | undefined): OAuth2Token | null;
+    /** Prints no token values. */
+    toString(): string;
+}

package/dist/types/index.d.ts

@@ -26,7 +26,7 @@ export type { ErrorCategory } from './client';
 export { QuoteClient, parseOptionIdentifier } from './quote';
 export { TradeClient } from './trade';
 export { PushClient, ConnectionState, SubjectType } from './push';
-export type { PushClientOptions } from './push';
+export type { PushClientOptions, AccountSubscribeOptions } from './push';
 export type { Order, OrderRequest, ContractLegRequest } from './model/order';
 export { marketOrder, limitOrder, stopOrder, stopLimitOrder } from './model/order-helpers';
 export { normalizeOrderStatus } from './model/order-status';

package/dist/types/model/quote.d.ts

@@ -23,6 +23,7 @@ export interface Brief {
     bidPrice?: number;
     bidSize?: number;
     volume?: number;
+    amount?: number;
     status?: string;
     adjPreClose?: number;
     change?: number;

package/dist/types/model/trade-requests.d.ts

@@ -72,6 +72,7 @@ export interface PositionsRequest {
     expiry?: string;
     strike?: string;
     right?: string;
+    /** 资产行情类型枚举名: ETH / RTH / OVERNIGHT (wire: asset_quote_type) */
     assetQuoteType?: string;
     lang?: string;
 }
@@ -82,6 +83,8 @@ export interface AssetsRequest {
     subAccounts?: string[];
     segment?: boolean;
     marketValue?: boolean;
+    /** 资产行情类型枚举名: ETH / RTH / OVERNIGHT (wire: asset_quote_type) */
+    assetQuoteType?: string;
     lang?: string;
 }
 export interface ManagedAccountsRequest {
@@ -115,6 +118,8 @@ export interface AggregateAssetsRequest {
     secretKey?: string;
     baseCurrency?: string;
     segType?: string;
+    /** 资产行情类型枚举名: ETH / RTH / OVERNIGHT (wire: asset_quote_type) */
+    assetQuoteType?: string;
     lang?: string;
 }
 export interface EstimateTradableQuantityRequest {

package/dist/types/push/index.d.ts

@@ -7,4 +7,4 @@ export * from './varint';
 export * from './tick-util';
 export * from './proto-message';
 export { PushClient, ConnectionState } from './push-client';
-export type { PushClientOptions, TLSSocketLike, TLSSocketFactory } from './push-client';
+export type { PushClientOptions, AccountSubscribeOptions, TLSSocketLike, TLSSocketFactory, } from './push-client';

package/dist/types/push/pb/Request.d.ts

@@ -21,6 +21,7 @@ export interface Request_Subscribe {
     symbols?: string | undefined;
     account?: string | undefined;
     market?: string | undefined;
+    assetQuoteType?: string | undefined;
 }
 export declare const Request: MessageFns<Request>;
 export declare const Request_Connect: MessageFns<Request_Connect>;

package/dist/types/push/proto-message.d.ts

@@ -17,8 +17,11 @@ export declare function buildConnectMessage(tigerId: string, sign: string, sdkVe
 export declare function buildHeartBeatMessage(): Request;
 /**
  * 构建 SUBSCRIBE 请求消息
+ *
+ * @param assetQuoteType 资产行情类型枚举名（ETH / RTH / OVERNIGHT），
+ *   仅对 Asset / Position 两种订阅有意义，其余场景传 undefined
  */
-export declare function buildSubscribeMessage(dataType: SocketCommon_DataType, symbols?: string, account?: string, market?: string): Request;
+export declare function buildSubscribeMessage(dataType: SocketCommon_DataType, symbols?: string, account?: string, market?: string, assetQuoteType?: string): Request;
 /**
  * 构建 UNSUBSCRIBE 请求消息
  */

package/dist/types/push/push-client.d.ts

@@ -7,6 +7,18 @@ export declare enum ConnectionState {
     Connecting = 1,
     Connected = 2
 }
+/**
+ * Options for account-level subscriptions (asset / position).
+ *
+ * `assetQuoteType` 用于选择资产/持仓推送的行情口径,通过重载传入,
+ * 老的 `subscribeAsset(account?)` / `subscribePosition(account?)` 签名保持不变。
+ */
+export interface AccountSubscribeOptions {
+    /** Account to subscribe; omit to use the account from ClientConfig. */
+    account?: string;
+    /** 资产行情类型枚举名: ETH / RTH / OVERNIGHT,省略则由服务端取默认值 */
+    assetQuoteType?: string;
+}
 /** PushClient configuration options */
 export interface PushClientOptions {
     pushHost?: string;
@@ -51,6 +63,8 @@ export declare class PushClient {
     private subscriptions;
     /** Account-level subscriptions: subject -> account string used at subscribe time */
     private accountSubs;
+    /** Account-level subscriptions: subject -> assetQuoteType used at subscribe time (reconnect replay) */
+    private accountSubQuoteTypes;
     private heartbeatTimer;
     private reconnectTimer;
     private stopped;
@@ -150,12 +164,31 @@ export declare class PushClient {
     subscribeMarket(market: string): void;
     /** Unsubscribe from market status (v0.4.0). */
     unsubscribeMarket(market: string): void;
+    /**
+     * Shared implementation for the account/options overloads of
+     * subscribeAsset / subscribePosition.
+     */
+    private subscribeAccount;
     /** Subscribe to asset changes */
     subscribeAsset(account?: string): void;
+    /**
+     * Subscribe to asset changes with extra options.
+     *
+     * @example
+     * client.subscribeAsset({ assetQuoteType: 'OVERNIGHT' });
+     */
+    subscribeAsset(options: AccountSubscribeOptions): void;
     /** Unsubscribe from asset changes */
     unsubscribeAsset(): void;
     /** Subscribe to position changes */
     subscribePosition(account?: string): void;
+    /**
+     * Subscribe to position changes with extra options.
+     *
+     * @example
+     * client.subscribePosition({ assetQuoteType: 'OVERNIGHT' });
+     */
+    subscribePosition(options: AccountSubscribeOptions): void;
     /** Unsubscribe from position changes */
     unsubscribePosition(): void;
     /** Subscribe to order status */