@0xmonaco/core 0.8.5 → 0.8.7-develop.0f12336

package/dist/api/vault/api.js

@@ -28,6 +28,31 @@ import { ApproveTokenSchema, DepositSchema, validate, WithdrawSchema } from "@0x
 import { erc20Abi, zeroAddress } from "viem";
 import { APIError, ContractError, InvalidConfigError } from "../../errors";
 import { BaseAPI } from "../base";
+/** Default delay between polls while waiting for a withdrawal's proof. */
+const DEFAULT_WITHDRAWAL_POLL_INTERVAL_MS = 5_000;
+/**
+ * Default total wait for a withdrawal's proof (5 minutes). A withdrawal's merkle
+ * proof only lands after its root is confirmed on-chain, which on a healthy
+ * pipeline takes ~20s but can lag behind a brief proposer hiccup; the previous
+ * 60s tripped too eagerly. On timeout the SDK returns `awaiting_proof` rather
+ * than throwing, so the caller never loses the index — it just retries later.
+ */
+const DEFAULT_WITHDRAWAL_TIMEOUT_MS = 300_000;
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Encode the on-chain `applicationData` for a deposit.
+ *
+ * For `"spot"` (the default) this stays the bare `clientId` string — byte-for-byte
+ * identical to the legacy encoding, so existing deposits are unchanged. For
+ * `"margin"` it emits a small JSON routing hint the indexer decodes to credit the
+ * deposit to margin collateral.
+ *
+ * MUST stay in sync with the indexer decoder in
+ * `indexer/src/listeners/deposit_routing.rs`.
+ */
+export function encodeDepositApplicationData(clientId, target) {
+    return target === "margin" ? JSON.stringify({ clientId, depositTarget: "MARGIN" }) : clientId;
+}
 export class VaultAPIImpl extends BaseAPI {
     publicClient;
     chain;
@@ -196,6 +221,10 @@ export class VaultAPIImpl extends BaseAPI {
      * @param assetId - The asset identifier (UUID) to deposit
      * @param amount - The amount of tokens to deposit (as bigint)
      * @param autoWait - Whether to automatically wait for transaction confirmation (defaults to true)
+     * @param target - Destination ledger: `"spot"` (default) credits the spot
+     *   wallet; `"margin"` routes the deposit into the parent margin account's
+     *   collateral (auto-creating the account if needed). Margin deposits that
+     *   cannot be routed safely fall back to spot.
      * @returns Promise resolving to TransactionResult with transaction details
      * @throws {ContractError} When deposit fails or approval is insufficient
      * @throws {APIError} When the asset is not found or the assetId is invalid
@@ -211,6 +240,14 @@ export class VaultAPIImpl extends BaseAPI {
      * console.log(`Deposit transaction: ${result.hash}`);
      * console.log(`Status: ${result.status}`); // "confirmed" if successful
      *
+     * // Deposit straight into margin collateral
+     * const marginDeposit = await vaultAPI.deposit(
+     *   "123e4567-e89b-12d3-a456-426614174000",
+     *   parseUnits("100", 6),
+     *   true,
+     *   "margin"
+     * );
+     *
      * // Or skip auto-waiting
      * const result = await vaultAPI.deposit(
      *   "123e4567-e89b-12d3-a456-426614174000",
@@ -221,14 +258,17 @@ export class VaultAPIImpl extends BaseAPI {
      * const receipt = await sdk.waitForTransaction(result.hash);
      * ```
      */
-    async deposit(assetId, amount, autoWait = true) {
+    async deposit(assetId, amount, autoWait = true, target = "spot") {
         if (!this.walletClient) {
             throw new InvalidConfigError("Wallet client not set. Connect a wallet first.", "walletClient");
         }
         // Validate inputs
-        validate(DepositSchema, { assetId, amount, autoWait });
+        validate(DepositSchema, { assetId, amount, autoWait, target });
         const vaultAddress = await this.getVaultAddress();
         const clientId = await this.getClientId();
+        // The on-chain applicationData carries the client id plus, for margin
+        // deposits, the routing hint the indexer decodes.
+        const applicationData = encodeDepositApplicationData(clientId, target);
         const { tokenAddress, isNativeToken } = await this.resolveAsset(assetId);
         if (!isNativeToken) {
             // Check if approval is needed before proceeding
@@ -250,7 +290,7 @@ export class VaultAPIImpl extends BaseAPI {
                 address: vaultAddress,
                 abi: CONTRACT_ABIS.vault,
                 functionName: "depositNative",
-                args: [walletAccount.address, clientId],
+                args: [walletAccount.address, applicationData],
                 account: walletAccount,
                 chain: this.chain,
                 value: amount,
@@ -261,7 +301,7 @@ export class VaultAPIImpl extends BaseAPI {
                 address: vaultAddress,
                 abi: CONTRACT_ABIS.vault,
                 functionName: "depositERC20",
-                args: [walletAccount.address, clientId, tokenAddress, amount],
+                args: [walletAccount.address, applicationData, tokenAddress, amount],
                 account: walletAccount,
                 chain: this.chain,
             });
@@ -275,21 +315,80 @@ export class VaultAPIImpl extends BaseAPI {
         return await this.waitForTransaction(txResult, autoWait);
     }
     /**
-     * Initiates a withdrawal through the API Gateway and submits the resulting
-     * pre-signed calldata on-chain via the connected wallet.
+     * Polls `GET /api/v1/withdrawals/{index}` until the gateway can serve the
+     * `executeWithdrawal` calldata, then returns it with the vault address.
+     *
+     * The calldata only exists once the withdrawal's root is confirmed on-chain
+     * and its merkle proof is persisted. Until then the gateway returns 404 (the
+     * row is written asynchronously by the persistor after `initiate`) or 409
+     * (the proof is not confirmed yet); both are transient for a freshly-allocated
+     * index, so we retry on each until ready or the timeout elapses.
      *
-     * The gateway allocates a `withdrawalIndex` via the matching engine and returns
-     * ABI-encoded calldata for `executeSignedWithdrawal(...)` signed by the
-     * server-side `WITHDRAWAL_SIGNER`. The user's wallet pays gas to submit it,
-     * but the contract authenticates against the embedded signature — not the
-     * `msg.sender`. The connected wallet's address is sent as the on-chain
-     * `destination`.
+     * Returns `null` when the timeout elapses before the proof is available — the
+     * index is still valid and the balance already debited, so callers surface
+     * this as `awaiting_proof` (with the index intact) rather than as a thrown
+     * error that would strand the index. Only non-transient errors (anything
+     * other than 404/409) throw.
+     *
+     * @throws {APIError} On non-transient errors while polling.
+     */
+    async pollWithdrawalCalldata(withdrawalIndex, retry) {
+        const pollIntervalMs = retry?.pollIntervalMs ?? DEFAULT_WITHDRAWAL_POLL_INTERVAL_MS;
+        const timeoutMs = retry?.timeoutMs ?? DEFAULT_WITHDRAWAL_TIMEOUT_MS;
+        const deadline = Date.now() + timeoutMs;
+        for (;;) {
+            try {
+                const { vaultAddress, calldata } = await this.makePublicRequest(`/api/v1/withdrawals/${withdrawalIndex}`);
+                // Ready: non-empty calldata. (Defensively treat an empty/`0x` body as
+                // not-ready too, though the gateway returns an error in that case.)
+                if (calldata && calldata !== "0x") {
+                    return { vaultAddress, calldata };
+                }
+            }
+            catch (error) {
+                // 404 (row not persisted yet) and 409 (proof not confirmed yet) are
+                // transient for a valid index — keep polling. Anything else is fatal.
+                const isTransient = error instanceof APIError && (error.statusCode === 404 || error.statusCode === 409);
+                if (!isTransient) {
+                    throw error;
+                }
+            }
+            if (Date.now() + pollIntervalMs > deadline) {
+                // Timed out waiting for the proof. Signal not-ready; the caller keeps the
+                // index and retries later rather than losing it inside a thrown error.
+                return null;
+            }
+            await sleep(pollIntervalMs);
+        }
+    }
+    /**
+     * Initiates a withdrawal through the API Gateway, waits for its on-chain
+     * confirmation, then submits the resulting `executeWithdrawal` calldata via
+     * the connected wallet.
+     *
+     * The gateway allocates a `withdrawalIndex` via the matching engine and debits
+     * the balance immediately, but the executable calldata needs the withdrawal's
+     * merkle proof, which only exists once its root is confirmed on-chain. This
+     * method polls until the calldata is available (see `retry`), then submits it.
+     * The connected wallet pays gas; the contract authorises the withdrawal
+     * against the merkle proof embedded in the calldata. The wallet's address is
+     * sent as the on-chain `destination`.
+     *
+     * If the proof does not become available within the poll window, this method
+     * does NOT throw — it returns `{ withdrawalIndex, status: "awaiting_proof" }`
+     * with nothing submitted on-chain. The balance is already debited, so losing
+     * the index would strand the funds; the caller keeps it and finishes the
+     * withdrawal later with `retryWithdrawal(withdrawalIndex)`.
      *
      * @param assetId - The asset identifier (UUID) to withdraw
      * @param amount - The raw token amount to withdraw (as bigint)
      * @param autoWait - Whether to automatically wait for transaction confirmation (defaults to true)
-     * @returns Promise resolving to `{ withdrawalIndex, transaction }`
-     * @throws {APIError} When the asset is not found or the request is rejected
+     * @param sourceOrRetry - Source ledger (`"spot"` or `"margin"`) or legacy retry options
+     * @param retry - Polling cadence/timeout while waiting for the proof when a source is supplied
+     * @returns Promise resolving to a [`WithdrawResult`]: on success the submitted
+     *   transaction plus `withdrawalIndex`; on poll-timeout `{ withdrawalIndex,
+     *   status: "awaiting_proof" }`.
+     * @throws {APIError} When the asset is not found or the initiate request is rejected
      * @throws {ContractError} When the on-chain submission fails
      * @throws {InvalidConfigError} When wallet account is not available
      *
@@ -301,18 +400,23 @@ export class VaultAPIImpl extends BaseAPI {
      *   parseUnits("50", 6),
      * );
      * console.log(`Withdrawal index: ${result.withdrawalIndex}`);
-     * console.log(`Tx hash: ${result.hash}, status: ${result.status}`);
+     * if (result.status === "awaiting_proof") {
+     *   // Proof not ready yet — balance already debited. Finish later:
+     *   await vaultAPI.retryWithdrawal(result.withdrawalIndex);
+     * } else {
+     *   console.log(`Tx hash: ${result.hash}, status: ${result.status}`);
+     * }
      *
-     * // Or skip auto-waiting and finalise later
+     * // Custom polling (check every 10s, wait up to an hour)
      * const result = await vaultAPI.withdraw(
      *   "123e4567-e89b-12d3-a456-426614174000",
      *   parseUnits("50", 6),
-     *   false,
+     *   true,
+     *   { pollIntervalMs: 10_000, timeoutMs: 3_600_000 },
      * );
-     * const receipt = await sdk.waitForTransaction(result.hash);
      * ```
      */
-    async withdraw(assetId, amount, autoWait = true) {
+    async withdraw(assetId, amount, autoWait = true, sourceOrRetry, retry) {
         if (!this.walletClient) {
             throw new InvalidConfigError("Wallet client not set. Connect a wallet first.", "walletClient");
         }
@@ -321,21 +425,33 @@ export class VaultAPIImpl extends BaseAPI {
             throw new InvalidConfigError("No account available in wallet client", "account");
         }
         const destination = walletAccount.address.toLowerCase();
-        validate(WithdrawSchema, { assetId, amount, destination, autoWait });
-        // 1. Gateway allocates withdrawal_index + returns pre-signed
-        // executeSignedWithdrawal calldata along with the vault address to send
-        // it to. Sourcing the vault address from this response (instead of
-        // GET /applications/config) keeps the calldata + target contract in
-        // lockstep and avoids an extra round-trip.
-        const { withdrawal_index: withdrawalIndex, vault_address: vaultAddress, calldata, } = await this.makeAuthenticatedRequest("/api/v1/withdrawals", {
+        const source = typeof sourceOrRetry === "string" ? sourceOrRetry : "spot";
+        const retryOptions = typeof sourceOrRetry === "string" ? retry : sourceOrRetry;
+        validate(WithdrawSchema, { assetId, amount, destination, autoWait, source });
+        // 1. Gateway allocates the withdrawalIndex and debits the balance. No
+        // executable calldata yet — it needs the merkle proof, available only once
+        // the withdrawal root is confirmed on-chain.
+        const { withdrawalIndex } = await this.makeAuthenticatedRequest("/api/v1/withdrawals", {
             method: "POST",
             body: JSON.stringify({
-                asset_id: assetId,
+                assetId: assetId,
                 amount: amount.toString(),
                 destination,
+                source,
             }),
         });
-        // 2. Submit the calldata on-chain through the connected wallet.
+        // 2. Poll for the executeWithdrawal calldata until the proof is confirmed.
+        // The vault address comes back with it, keeping calldata + target contract
+        // in lockstep.
+        const poll = await this.pollWithdrawalCalldata(withdrawalIndex, retryOptions);
+        if (!poll) {
+            // Proof not available within the poll window. The balance is already
+            // debited and the index is valid; return it (without submitting anything
+            // on-chain) so the caller can finish later via retryWithdrawal(index).
+            return { withdrawalIndex, status: "awaiting_proof" };
+        }
+        const { vaultAddress, calldata } = poll;
+        // 3. Submit the calldata on-chain through the connected wallet.
         let hash;
         try {
             hash = await this.walletClient.sendTransaction({
@@ -346,7 +462,7 @@ export class VaultAPIImpl extends BaseAPI {
             });
         }
         catch (error) {
-            throw new ContractError(`Failed to submit executeSignedWithdrawal for withdrawal ${withdrawalIndex}: ${error instanceof Error ? error.message : "unknown error"}`, { cause: error instanceof Error ? error : undefined });
+            throw new ContractError(`Failed to submit executeWithdrawal for withdrawal ${withdrawalIndex}: ${error instanceof Error ? error.message : "unknown error"}`, { cause: error instanceof Error ? error : undefined });
         }
         const nonce = walletAccount.getNonce ? await walletAccount.getNonce() : 0n;
         const txResult = {
@@ -358,25 +474,32 @@ export class VaultAPIImpl extends BaseAPI {
         return { ...settled, withdrawalIndex };
     }
     /**
-     * Retries a previously-initiated withdrawal whose on-chain submission never
-     * landed — e.g. the wallet rejected the tx, the page reloaded before the
-     * receipt came back, or a stuck mempool entry needs resending.
+     * Submits (or resubmits) a previously-initiated withdrawal on-chain.
+     *
+     * Use this when the original `withdraw()` could not complete — e.g. the proof
+     * was not yet confirmed within its polling window, the wallet rejected the tx,
+     * the page reloaded before the receipt came back, or a stuck mempool entry
+     * needs resending. Polls `GET /withdrawals/{index}` for the
+     * `executeWithdrawal` calldata (retrying while it is not yet confirmed), then
+     * submits it through the connected wallet. Does NOT initiate a new withdrawal
+     * — the matching engine already debited the balance and allocated the index.
+     * The contract is idempotent against double-submission of a settled
+     * withdrawal: it reverts once the index is consumed on-chain.
      *
-     * Re-fetches the same `executeSignedWithdrawal` calldata the gateway
-     * generated when the withdrawal was initiated, then submits it through the
-     * connected wallet. Does NOT initiate a new withdrawal — the matching engine
-     * already debited the balance and allocated the index. The contract is
-     * idempotent against double-submission of a settled withdrawal: it will
-     * revert once the index is consumed on-chain.
+     * Like `withdraw()`, if the proof is still unavailable within the poll window
+     * this returns `{ withdrawalIndex, status: "awaiting_proof" }` instead of
+     * throwing, so the caller can simply retry again later.
      *
      * @param withdrawalIndex - The index returned by the original `withdraw()` call
      * @param autoWait - Whether to await on-chain confirmation (defaults to true)
-     * @returns Promise resolving to `{ withdrawalIndex, ...transaction }`
-     * @throws {APIError} When the index doesn't exist
+     * @param retry - Polling cadence/timeout while waiting for the proof
+     * @returns Promise resolving to a [`WithdrawResult`]: the submitted transaction
+     *   plus `withdrawalIndex`, or `{ withdrawalIndex, status: "awaiting_proof" }`
+     *   if the proof did not arrive within the poll window.
      * @throws {ContractError} When the on-chain submission fails
      * @throws {InvalidConfigError} When wallet account is not available
      */
-    async retryWithdrawal(withdrawalIndex, autoWait = true) {
+    async retryWithdrawal(withdrawalIndex, autoWait = true, retry) {
         if (!this.walletClient) {
             throw new InvalidConfigError("Wallet client not set. Connect a wallet first.", "walletClient");
         }
@@ -384,7 +507,13 @@ export class VaultAPIImpl extends BaseAPI {
         if (!walletAccount) {
             throw new InvalidConfigError("No account available in wallet client", "account");
         }
-        const { vault_address: vaultAddress, calldata } = await this.makePublicRequest(`/api/v1/withdrawals/${withdrawalIndex}`);
+        const poll = await this.pollWithdrawalCalldata(withdrawalIndex, retry);
+        if (!poll) {
+            // Still not confirmed on-chain within the poll window — return the index
+            // so the caller can retry again later, rather than throwing.
+            return { withdrawalIndex, status: "awaiting_proof" };
+        }
+        const { vaultAddress, calldata } = poll;
         let hash;
         try {
             hash = await this.walletClient.sendTransaction({
@@ -395,7 +524,7 @@ export class VaultAPIImpl extends BaseAPI {
             });
         }
         catch (error) {
-            throw new ContractError(`Failed to resubmit executeSignedWithdrawal for withdrawal ${withdrawalIndex}: ${error instanceof Error ? error.message : "unknown error"}`, { cause: error instanceof Error ? error : undefined });
+            throw new ContractError(`Failed to resubmit executeWithdrawal for withdrawal ${withdrawalIndex}: ${error instanceof Error ? error.message : "unknown error"}`, { cause: error instanceof Error ? error : undefined });
         }
         const nonce = walletAccount.getNonce ? await walletAccount.getNonce() : 0n;
         const txResult = {

package/dist/api/vault/index.d.ts

@@ -1,4 +1,4 @@
 /**
  * Vault API Module
  */
-export { VaultAPIImpl } from "./api";
+export { encodeDepositApplicationData, VaultAPIImpl } from "./api";

package/dist/api/vault/index.js

@@ -1,4 +1,4 @@
 /**
  * Vault API Module
  */
-export { VaultAPIImpl } from "./api";
+export { encodeDepositApplicationData, VaultAPIImpl } from "./api";

package/dist/api/websocket/types.d.ts

@@ -1,9 +1,9 @@
-import type { ConditionalOrderEvent, Interval, OHLCVEvent, OrderbookEvent, OrderbookQuotationMode, OrderEvent, TradeEvent, TradingMode, UserBalanceEvent, UserMovementEvent, WebSocketStatus } from "@0xmonaco/types";
+import type { ConditionalOrderEvent, Interval, OHLCVEvent, OrderbookEvent, OrderbookQuotationMode, OrderEvent, SessionCredentials, TradeEvent, TradingMode, UserBalanceEvent, UserMovementEvent, WebSocketStatus } from "@0xmonaco/types";
 export type StatusHandler = (status: WebSocketStatus) => void;
 export type MessageHandler<T> = (data: T) => void;
 export interface MonacoWebSocketOptions {
-    /** JWT access token for authenticated channels (orders) */
-    token?: string;
+    /** Session keypair for authenticated channels (orders, balances, etc.) */
+    session?: SessionCredentials;
     /** Enable auto-reconnect on disconnect (default: true) */
     autoReconnect?: boolean;
     /** Maximum reconnection attempts (default: 5) */
@@ -20,8 +20,8 @@ export interface MonacoWebSocket {
     isConnected: () => boolean;
     /** Get current websocket connection status */
     getStatus: () => WebSocketStatus;
-    /** Update the access token (for re-auth) */
-    setToken: (token: string) => void;
+    /** Set (or clear) the session keypair used to authenticate the connection */
+    setSessionKeypair: (credentials: SessionCredentials | undefined) => void;
     /** Subscribe to order events (requires authentication) */
     orders: (tradingPairId: string, tradingMode: TradingMode, handler: MessageHandler<OrderEvent>) => () => void;
     /** Subscribe to orderbook events (public) */

package/dist/api/websocket/websocket.js

@@ -1,3 +1,5 @@
+import { hexToBytes } from "@noble/hashes/utils";
+import { composeWsSigningString, signMessage } from "../../crypto/session";
 import { ALL_MAGNITUDES } from "../../utils";
 import { keysToCamelCase } from "./utils";
 // Connection constants
@@ -107,7 +109,7 @@ function parseConditionalOrderEvent(rawData) {
  */
 export function createMonacoWebSocket(baseUrl, options = {}) {
     let ws = null;
-    let token = options.token;
+    let session = options.session;
     let reconnectAttempts = 0;
     let reconnectTimer = null;
     let heartbeatTimer = null;
@@ -127,11 +129,24 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
                 return "disconnected";
         }
     };
-    const getUrl = () => {
-        const url = new URL(baseUrl);
-        if (token)
-            url.searchParams.set("token", token);
-        return url.toString();
+    const getUrl = () => baseUrl;
+    /**
+     * Send the signed auth handshake as the first message after the socket
+     * opens. The client signs `WS-AUTH\n<pubkey>\n<ts>` with the session private
+     * key; the server binds the connection to the session. No-op if no session
+     * is set (public channels work unauthenticated).
+     */
+    const sendAuthenticate = () => {
+        if (!session || ws?.readyState !== WebSocket.OPEN)
+            return;
+        const timestamp = Date.now();
+        const signature = signMessage(hexToBytes(session.privateKey), composeWsSigningString(session.publicKey, timestamp));
+        ws.send(JSON.stringify({
+            type: "Authenticate",
+            public_key: session.publicKey,
+            timestamp,
+            signature,
+        }));
     };
     const stopHeartbeat = () => {
         if (heartbeatTimer) {
@@ -217,6 +232,9 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
                     }
                     reconnectAttempts = 0;
                     startHeartbeat();
+                    // Authenticate before resubscribing so user-specific channels
+                    // (orders, balances, …) are authorized when the Subscribe arrives.
+                    sendAuthenticate();
                     resubscribeAll();
                     options.onStatusChange?.("connected");
                     resolve();
@@ -324,7 +342,9 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
                 const data = rawData;
                 const orderbookData = data.data;
                 const event = {
-                    tradingPairId: data.symbol,
+                    // `trading_pair_id` is the pair UUID; `symbol` is the display string
+                    // (e.g. "AMZN/USDC"). `tradingPairId` must carry the UUID.
+                    tradingPairId: data.trading_pair_id,
                     tradingMode: data.trading_mode,
                     bids: (orderbookData?.bids || []).map((level) => ({
                         price: level.price,
@@ -368,7 +388,9 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
                 const data = rawData;
                 const ohlcvData = data.data;
                 const event = {
-                    tradingPairId: data.symbol,
+                    // `trading_pair_id` is the pair UUID; `symbol` is the display string.
+                    // `tradingPairId` must carry the UUID (the symbol lives in `candlestick.s`).
+                    tradingPairId: data.trading_pair_id,
                     tradingMode: data.trading_mode,
                     interval: data.interval,
                     candlestick: {
@@ -532,21 +554,20 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
         disconnect,
         isConnected: () => ws?.readyState === WebSocket.OPEN,
         getStatus,
-        setToken: (newToken) => {
-            token = newToken || undefined;
-            stopReconnect();
-            const currentSocket = ws;
-            if (currentSocket?.readyState === WebSocket.OPEN ||
-                currentSocket?.readyState === WebSocket.CONNECTING ||
-                currentSocket?.readyState === WebSocket.CLOSING) {
-                currentSocket.close(1000, newToken ? "Token updated, reconnecting." : "Token cleared.");
-                ws = null;
+        setSessionKeypair: (credentials) => {
+            session = credentials ?? undefined;
+            // If already connected, (re)send the signed handshake so the connection
+            // picks up the new session without tearing down. If not yet connected,
+            // onopen will send it. Clearing the session leaves the connection up for
+            // public channels; logout calls disconnect() to fully tear down.
+            if (session && ws?.readyState === WebSocket.OPEN) {
+                sendAuthenticate();
+            }
+            else if (session && (!ws || ws.readyState === WebSocket.CLOSED)) {
+                connect().catch((err) => {
+                    console.warn("WebSocket: Failed to connect after session update:", err);
+                });
             }
-            if (!newToken)
-                return;
-            connect().catch((err) => {
-                console.warn("WebSocket: Failed to reconnect after token update:", err);
-            });
         },
         orders: subscribeOrders,
         orderbook: subscribeOrderbook,

package/dist/api/whitelist/api.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Whitelist API Implementation
+ *
+ * Public (unauthenticated) whitelist/waitlist application submission. The
+ * server validates and de-duplicates by wallet address and email, creating an
+ * inactive user pending manual approval. This is an onboarding endpoint, not a
+ * trading operation.
+ *
+ * @example
+ * ```typescript
+ * const { message, userId } = await sdk.whitelist.submit({
+ *   walletAddress: "0x...",
+ *   email: "user@example.com",
+ * });
+ * ```
+ */
+import type { SubmitWhitelistRequest, SubmitWhitelistResponse, WhitelistAPI } from "@0xmonaco/types";
+import { BaseAPI } from "../base";
+export declare class WhitelistAPIImpl extends BaseAPI implements WhitelistAPI {
+    /**
+     * Submits a whitelist (waitlist) application. Public — no auth required.
+     *
+     * @param body - Applicant details
+     * @returns Promise resolving to the status message and created user id
+     */
+    submit(body: SubmitWhitelistRequest): Promise<SubmitWhitelistResponse>;
+}

package/dist/api/whitelist/api.js

@@ -0,0 +1,32 @@
+/**
+ * Whitelist API Implementation
+ *
+ * Public (unauthenticated) whitelist/waitlist application submission. The
+ * server validates and de-duplicates by wallet address and email, creating an
+ * inactive user pending manual approval. This is an onboarding endpoint, not a
+ * trading operation.
+ *
+ * @example
+ * ```typescript
+ * const { message, userId } = await sdk.whitelist.submit({
+ *   walletAddress: "0x...",
+ *   email: "user@example.com",
+ * });
+ * ```
+ */
+import { BaseAPI } from "../base";
+import { perpRoutes } from "../perp/routes";
+export class WhitelistAPIImpl extends BaseAPI {
+    /**
+     * Submits a whitelist (waitlist) application. Public — no auth required.
+     *
+     * @param body - Applicant details
+     * @returns Promise resolving to the status message and created user id
+     */
+    async submit(body) {
+        return await this.makePublicRequest(perpRoutes.whitelist.submit(), {
+            method: "POST",
+            body: JSON.stringify(body),
+        });
+    }
+}

package/dist/api/whitelist/index.d.ts

@@ -0,0 +1 @@
+export { WhitelistAPIImpl } from "./api";

package/dist/api/whitelist/index.js

@@ -0,0 +1 @@
+export { WhitelistAPIImpl } from "./api";

package/dist/api/withdrawals/api.d.ts

@@ -0,0 +1,18 @@
+import type { InitiateWithdrawalRequest, ListPendingWithdrawalsParams, ListPendingWithdrawalsResponse, WithdrawalResponse, WithdrawalsAPI } from "@0xmonaco/types";
+import { BaseAPI } from "../base";
+/**
+ * Low-level withdrawals client.
+ *
+ * `initiateWithdrawal` debits the caller's balance via the matching engine and
+ * allocates a `withdrawalIndex` (its `calldata` is empty — the proof is not
+ * available until the withdrawal root is confirmed on-chain). `getWithdrawal`
+ * returns the `executeWithdrawal` calldata once that proof is ready, and throws
+ * an `APIError` (404 not-persisted-yet / 409 not-confirmed-yet) while it is not.
+ * Neither submits on-chain — use the high-level vault API, which polls for the
+ * calldata and broadcasts the transaction.
+ */
+export declare class WithdrawalsAPIImpl extends BaseAPI implements WithdrawalsAPI {
+    initiateWithdrawal(request: InitiateWithdrawalRequest): Promise<WithdrawalResponse>;
+    getWithdrawal(withdrawalIndex: number): Promise<WithdrawalResponse>;
+    listPendingWithdrawals(params?: ListPendingWithdrawalsParams): Promise<ListPendingWithdrawalsResponse>;
+}

package/dist/api/withdrawals/api.js

@@ -0,0 +1,35 @@
+import { BaseAPI } from "../base";
+import { perpRoutes } from "../perp";
+/**
+ * Low-level withdrawals client.
+ *
+ * `initiateWithdrawal` debits the caller's balance via the matching engine and
+ * allocates a `withdrawalIndex` (its `calldata` is empty — the proof is not
+ * available until the withdrawal root is confirmed on-chain). `getWithdrawal`
+ * returns the `executeWithdrawal` calldata once that proof is ready, and throws
+ * an `APIError` (404 not-persisted-yet / 409 not-confirmed-yet) while it is not.
+ * Neither submits on-chain — use the high-level vault API, which polls for the
+ * calldata and broadcasts the transaction.
+ */
+export class WithdrawalsAPIImpl extends BaseAPI {
+    async initiateWithdrawal(request) {
+        return this.makeAuthenticatedRequest(perpRoutes.withdrawals.initiate(), {
+            method: "POST",
+            body: JSON.stringify({
+                assetId: request.assetId,
+                amount: request.amount,
+                destination: request.destination,
+                source: request.source ?? "spot",
+            }),
+        });
+    }
+    async getWithdrawal(withdrawalIndex) {
+        // Public lookup — no auth required.
+        return this.makePublicRequest(perpRoutes.withdrawals.byIndex(withdrawalIndex));
+    }
+    async listPendingWithdrawals(params) {
+        // The gateway serves camelCase (the REST wire format), which matches the
+        // public surface, so the response is returned directly with no remapping.
+        return this.makeAuthenticatedRequest(perpRoutes.withdrawals.list({ page: params?.page, pageSize: params?.pageSize }));
+    }
+}

package/dist/api/withdrawals/index.d.ts

@@ -0,0 +1 @@
+export * from "./api";

package/dist/api/withdrawals/index.js

@@ -0,0 +1 @@
+export * from "./api";