@0xmonaco/core 1.0.29 → 1.0.32-develop.522174b

package/dist/api/base.js

@@ -34,6 +34,112 @@ import { APIError } from "../errors";
  * only takes effect in server runtimes (Node/undici, Bun, Deno).
  */
 const SDK_USER_AGENT = "@0xmonaco/core";
+const MONTHS = {
+    Jan: 0,
+    Feb: 1,
+    Mar: 2,
+    Apr: 3,
+    May: 4,
+    Jun: 5,
+    Jul: 6,
+    Aug: 7,
+    Sep: 8,
+    Oct: 9,
+    Nov: 10,
+    Dec: 11,
+};
+// The three RFC 7231 §7.1.1.1 `HTTP-date` grammars a recipient must accept.
+// Each is anchored so trailing junk is rejected, and `Date.parse` is avoided
+// entirely (it is permissive — it reads asctime in local time and rolls
+// impossible dates like 31 Feb forward instead of rejecting them).
+const MONTH = "Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec";
+const IMF_FIXDATE = new RegExp(`^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (\\d{2}) (${MONTH}) (\\d{4}) (\\d{2}):(\\d{2}):(\\d{2}) GMT$`);
+const RFC850_DATE = new RegExp(`^(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), (\\d{2})-(${MONTH})-(\\d{2}) (\\d{2}):(\\d{2}):(\\d{2}) GMT$`);
+const ASCTIME_DATE = new RegExp(`^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) (${MONTH}) ([ \\d]\\d) (\\d{2}):(\\d{2}):(\\d{2}) (\\d{4})$`);
+/**
+ * Expand an RFC 850 two-digit year per RFC 7231 §7.1.1.1: a full timestamp that
+ * appears more than 50 years in the future is interpreted as the most recent
+ * past year with the same last two digits. The comparison is against the exact
+ * receipt instant plus 50 years (not just calendar years), so the boundary can
+ * fall mid-year — e.g. received 2026-06-01, `31-Dec-76` is 50y7m ahead and maps
+ * to 1976, while `01-Jan-76` is under 50 years ahead and stays 2076.
+ */
+function expandTwoDigitYear(twoDigitYear, month, day, hour, minute, second) {
+    const now = new Date(Date.now());
+    const candidateYear = Math.floor(now.getUTCFullYear() / 100) * 100 + twoDigitYear;
+    const candidate = Date.UTC(candidateYear, month, day, hour, minute, second);
+    const fiftyYearsAhead = Date.UTC(now.getUTCFullYear() + 50, now.getUTCMonth(), now.getUTCDate(), now.getUTCHours(), now.getUTCMinutes(), now.getUTCSeconds());
+    return candidate > fiftyYearsAhead ? candidateYear - 100 : candidateYear;
+}
+/**
+ * Parse an RFC 7231 `HTTP-date` — in any of the three formats a recipient must
+ * accept (IMF-fixdate, the obsolete RFC 850 form, and asctime) — into a UTC
+ * epoch in milliseconds, or `undefined` if the value is not a well-formed, real
+ * calendar date. All three denote UTC, so timestamps are built with `Date.UTC`
+ * and the fields are round-tripped to reject impossible dates such as
+ * `31 Feb` or `25:00:00`. RFC 850's 2-digit year follows the RFC 7231 rule
+ * (see {@link expandTwoDigitYear}). The redundant day-name is intentionally not
+ * validated against the date — RFC 7231 encourages robust parsing, and the
+ * date/time fields already determine the instant unambiguously, so a mismatched
+ * weekday still yields the intended delay rather than a dropped header and an
+ * arbitrary fallback.
+ */
+function parseHttpDate(value) {
+    let day;
+    let month;
+    let year;
+    let hour;
+    let minute;
+    let second;
+    const imf = IMF_FIXDATE.exec(value);
+    const rfc850 = RFC850_DATE.exec(value);
+    const asctime = ASCTIME_DATE.exec(value);
+    if (imf) {
+        day = Number(imf[1]);
+        month = MONTHS[imf[2]];
+        year = Number(imf[3]);
+        hour = Number(imf[4]);
+        minute = Number(imf[5]);
+        second = Number(imf[6]);
+    }
+    else if (rfc850) {
+        day = Number(rfc850[1]);
+        month = MONTHS[rfc850[2]];
+        hour = Number(rfc850[4]);
+        minute = Number(rfc850[5]);
+        second = Number(rfc850[6]);
+        if (month === undefined)
+            return undefined;
+        year = expandTwoDigitYear(Number(rfc850[3]), month, day, hour, minute, second);
+    }
+    else if (asctime) {
+        month = MONTHS[asctime[1]];
+        day = Number((asctime[2] ?? "").trim());
+        hour = Number(asctime[3]);
+        minute = Number(asctime[4]);
+        second = Number(asctime[5]);
+        year = Number(asctime[6]);
+    }
+    else {
+        return undefined;
+    }
+    if (month === undefined)
+        return undefined;
+    const timestamp = Date.UTC(year, month, day, hour, minute, second);
+    const utc = new Date(timestamp);
+    // Reject impossible calendar/clock values that Date.UTC silently rolls over
+    // (e.g. 31 Feb, 25:00:00). A `:60` leap second is likewise dropped rather
+    // than special-cased — leap seconds never appear in a Retry-After header.
+    if (utc.getUTCFullYear() !== year ||
+        utc.getUTCMonth() !== month ||
+        utc.getUTCDate() !== day ||
+        utc.getUTCHours() !== hour ||
+        utc.getUTCMinutes() !== minute ||
+        utc.getUTCSeconds() !== second) {
+        return undefined;
+    }
+    return timestamp;
+}
 export class BaseAPI {
     apiUrl;
     /** Active session keypair (raw bytes) used to sign authenticated requests. */
@@ -138,12 +244,25 @@ export class BaseAPI {
         if (!headers)
             return {};
         const requestId = headers.get("x-request-id") || headers.get("request-id") || headers.get("x-correlation-id") || undefined;
-        // Parse Retry-After header with validation
+        // Parse the Retry-After header (RFC 7231). It is either a non-negative
+        // number of seconds (delay-seconds) or an HTTP-date. Both forms are
+        // normalized to a delay in SECONDS, so callers multiply by 1000 for
+        // setTimeout. An HTTP-date is converted to the remaining seconds from now
+        // (past dates clamp to 0). Values matching neither grammar are dropped so
+        // a malformed header can never masquerade as a 0s "retry immediately".
         const retryAfterHeader = headers.get("retry-after");
         let retryAfter;
         if (retryAfterHeader !== null) {
-            const parsed = Number.parseInt(retryAfterHeader, 10);
-            retryAfter = Number.isNaN(parsed) ? undefined : parsed;
+            const value = retryAfterHeader.trim();
+            if (/^\d+$/.test(value)) {
+                retryAfter = Number.parseInt(value, 10);
+            }
+            else {
+                const dateMs = parseHttpDate(value);
+                if (dateMs !== undefined) {
+                    retryAfter = Math.max(0, Math.ceil((dateMs - Date.now()) / 1000));
+                }
+            }
         }
         return { requestId, retryAfter };
     }

package/dist/api/profile/api.d.ts

@@ -169,30 +169,65 @@ export declare class ProfileAPIImpl extends BaseAPI implements ProfileAPI {
      * Fetches the user's executed trades from the /api/v1/accounts/trades endpoint.
      * Requires a valid access token to be set.
      *
+     * When neither `page` nor `pageToken` is passed, the SDK drives cursor (pageToken)
+     * pagination: it starts a cursor walk from the newest row and the response's
+     * `nextPageToken` resumes it. Cursor responses carry no exact totals
+     * (`total`/`page`/`totalPages` are 0).
+     *
      * @param params - Optional query parameters for pagination and filtering
-     * @param params.page - Page number (starts from 1, default: 1)
-     * @param params.pageSize - Number of items per page (default: 20, max: 100)
+     * @param params.page - Deprecated: page number for legacy offset pagination (starts
+     * from 1). Passing it selects legacy page-number mode, which only sees recent (hot)
+     * history and populates `total`/`totalPages`. Use cursor pagination (`pageToken`)
+     * instead.
+     * @param params.pageSize - Number of items per page (default: 20; max 100
+     * in page-number mode, up to 1000 when pageToken is present)
      * @param params.tradingPairId - Filter by trading pair ID (UUID)
-     * @param params.pageToken - Pagination cursor (optional): omit for legacy page-number
-     * pagination; pass `""` to start a cursor walk from the newest row; pass a previous
-     * response's `nextPageToken` to resume. Any cursor-walk value (`""` or non-empty)
-     * ignores `page` and covers full trade history (hot and archived rows merged), unlike
-     * page-number mode.
+     * @param params.pageToken - Pagination cursor: pass `""` to start a cursor walk from
+     * the newest row; pass a previous response's `nextPageToken` to resume. Any
+     * cursor-walk value (`""` or non-empty) ignores `page` and covers full trade history
+     * (hot and archived rows merged), unlike page-number mode. Omitting both `page` and
+     * `pageToken` starts a cursor walk (`pageToken=""`).
      * @returns Promise resolving to paginated trades response
      * @throws {ValidationError} When the provided params fail client-side validation
      * @throws {APIError} When the request fails or user is not authenticated
      *
      * @example
      * ```typescript
-     * // Get first page of trades
-     * const trades = await profileAPI.getUserTrades();
-     * console.log(`Total trades: ${trades.total}`);
+     * // Walk full trade history with cursor pagination (the default mode)
+     * let pageToken: string | undefined;
+     * do {
+     *   const res = await profileAPI.getUserTrades({ pageToken });
+     *   handle(res.trades);
+     *   pageToken = res.nextPageToken;
+     * } while (pageToken);
      *
      * // Filter by trading pair
      * const pairTrades = await profileAPI.getUserTrades({ tradingPairId: "550e8400-e29b-41d4-a716-446655440000" });
      * ```
      */
     getUserTrades(params?: GetUserTradesParams): Promise<GetUserTradesResponse>;
+    /**
+     * Walks the user's full trade history with cursor pagination, yielding one
+     * trade at a time.
+     *
+     * Starts a cursor walk (`pageToken: ""`) and follows each response's
+     * `nextPageToken` until the server proves exhaustion (a page with zero rows
+     * and an empty token). Covers full trade history — hot and archived rows
+     * merged — unlike the deprecated page-number mode.
+     *
+     * @param params - Optional filters and page size; `page`/`pageToken` are
+     * managed by the iterator and cannot be passed.
+     * @returns Async generator yielding trades newest-first
+     * @throws {APIError} When any underlying request fails
+     *
+     * @example
+     * ```typescript
+     * for await (const trade of profileAPI.iterateUserTrades()) {
+     *   console.log(trade.tradeId);
+     * }
+     * ```
+     */
+    iterateUserTrades(params?: Omit<GetUserTradesParams, "page" | "pageToken">): AsyncGenerator<GetUserTradesResponse["trades"][number], void, undefined>;
     /**
      * List the current user's funding payment history with pagination and filters.
      *

package/dist/api/profile/api.js

@@ -220,24 +220,37 @@ export class ProfileAPIImpl extends BaseAPI {
      * Fetches the user's executed trades from the /api/v1/accounts/trades endpoint.
      * Requires a valid access token to be set.
      *
+     * When neither `page` nor `pageToken` is passed, the SDK drives cursor (pageToken)
+     * pagination: it starts a cursor walk from the newest row and the response's
+     * `nextPageToken` resumes it. Cursor responses carry no exact totals
+     * (`total`/`page`/`totalPages` are 0).
+     *
      * @param params - Optional query parameters for pagination and filtering
-     * @param params.page - Page number (starts from 1, default: 1)
-     * @param params.pageSize - Number of items per page (default: 20, max: 100)
+     * @param params.page - Deprecated: page number for legacy offset pagination (starts
+     * from 1). Passing it selects legacy page-number mode, which only sees recent (hot)
+     * history and populates `total`/`totalPages`. Use cursor pagination (`pageToken`)
+     * instead.
+     * @param params.pageSize - Number of items per page (default: 20; max 100
+     * in page-number mode, up to 1000 when pageToken is present)
      * @param params.tradingPairId - Filter by trading pair ID (UUID)
-     * @param params.pageToken - Pagination cursor (optional): omit for legacy page-number
-     * pagination; pass `""` to start a cursor walk from the newest row; pass a previous
-     * response's `nextPageToken` to resume. Any cursor-walk value (`""` or non-empty)
-     * ignores `page` and covers full trade history (hot and archived rows merged), unlike
-     * page-number mode.
+     * @param params.pageToken - Pagination cursor: pass `""` to start a cursor walk from
+     * the newest row; pass a previous response's `nextPageToken` to resume. Any
+     * cursor-walk value (`""` or non-empty) ignores `page` and covers full trade history
+     * (hot and archived rows merged), unlike page-number mode. Omitting both `page` and
+     * `pageToken` starts a cursor walk (`pageToken=""`).
      * @returns Promise resolving to paginated trades response
      * @throws {ValidationError} When the provided params fail client-side validation
      * @throws {APIError} When the request fails or user is not authenticated
      *
      * @example
      * ```typescript
-     * // Get first page of trades
-     * const trades = await profileAPI.getUserTrades();
-     * console.log(`Total trades: ${trades.total}`);
+     * // Walk full trade history with cursor pagination (the default mode)
+     * let pageToken: string | undefined;
+     * do {
+     *   const res = await profileAPI.getUserTrades({ pageToken });
+     *   handle(res.trades);
+     *   pageToken = res.nextPageToken;
+     * } while (pageToken);
      *
      * // Filter by trading pair
      * const pairTrades = await profileAPI.getUserTrades({ tradingPairId: "550e8400-e29b-41d4-a716-446655440000" });
@@ -247,8 +260,11 @@ export class ProfileAPIImpl extends BaseAPI {
         if (params) {
             validate(GetUserTradesSchema, params);
         }
+        // Legacy offset mode only when the caller explicitly asked for a page and
+        // no cursor was given; everything else drives cursor (pageToken) mode.
+        const legacyOffsetMode = params?.page !== undefined && params?.pageToken === undefined;
         const searchParams = new URLSearchParams();
-        if (params?.page !== undefined) {
+        if (legacyOffsetMode && params?.page !== undefined) {
             searchParams.append("page", params.page.toString());
         }
         if (params?.pageSize !== undefined) {
@@ -257,13 +273,53 @@ export class ProfileAPIImpl extends BaseAPI {
         if (params?.tradingPairId !== undefined) {
             searchParams.append("tradingPairId", params.tradingPairId);
         }
-        if (params?.pageToken !== undefined) {
-            searchParams.append("pageToken", params.pageToken);
+        // Cursor mode selects itself by the *presence* of `pageToken` on the wire,
+        // even when it is the empty string (the documented way to start a walk),
+        // so it must be sent explicitly rather than dropped like a falsy value.
+        // When the caller gave neither `page` nor `pageToken`, default to starting
+        // a cursor walk (`pageToken=""`).
+        if (!legacyOffsetMode) {
+            searchParams.append("pageToken", params?.pageToken ?? "");
         }
         const queryString = searchParams.toString();
         const url = queryString ? `/api/v1/accounts/trades?${queryString}` : "/api/v1/accounts/trades";
         return await this.makeAuthenticatedRequest(url);
     }
+    /**
+     * Walks the user's full trade history with cursor pagination, yielding one
+     * trade at a time.
+     *
+     * Starts a cursor walk (`pageToken: ""`) and follows each response's
+     * `nextPageToken` until the server proves exhaustion (a page with zero rows
+     * and an empty token). Covers full trade history — hot and archived rows
+     * merged — unlike the deprecated page-number mode.
+     *
+     * @param params - Optional filters and page size; `page`/`pageToken` are
+     * managed by the iterator and cannot be passed.
+     * @returns Async generator yielding trades newest-first
+     * @throws {APIError} When any underlying request fails
+     *
+     * @example
+     * ```typescript
+     * for await (const trade of profileAPI.iterateUserTrades()) {
+     *   console.log(trade.tradeId);
+     * }
+     * ```
+     */
+    async *iterateUserTrades(params) {
+        let pageToken = "";
+        // A non-empty token never guarantees further results (AIP-158 "maybe
+        // more"): keep following it until a response returns zero rows and an
+        // empty token, the sole proof the walk is exhausted.
+        for (;;) {
+            const response = await this.getUserTrades({ ...params, pageToken });
+            yield* response.trades;
+            if (!response.nextPageToken) {
+                return;
+            }
+            pageToken = response.nextPageToken;
+        }
+    }
     /**
      * List the current user's funding payment history with pagination and filters.
      *

package/dist/api/trading/api.d.ts

@@ -260,40 +260,66 @@ export declare class TradingAPIImpl extends BaseAPI implements TradingAPI {
      */
     batchReplace(orders: BatchReplaceOrderParams[]): Promise<BatchReplaceOrdersResponse>;
     /**
-     * Gets paginated orders based on query parameters with automatic pagination.
+     * Gets orders based on query parameters, cursor-paginated by default.
      *
      * Retrieves orders with optional filtering by status, trading pair, and pagination.
-     * Pagination parameters are always included with sensible defaults for consistent API behavior.
+     * When neither `page` nor `pageToken` is passed, the SDK drives cursor (pageToken)
+     * pagination: it starts a cursor walk from the newest (or oldest, for
+     * `orderBy: "ASC"`) row and the response's `nextPageToken` resumes it. Cursor
+     * responses carry no exact totals (`total`/`page`/`totalPages` are 0).
      *
      * @param params - Query parameters for filtering orders
-     * @param params.status - Filter by order status (e.g., "SUBMITTED", "FILLED") (optional)
+     * @param params.status - Filter by order status (e.g., "SUBMITTED", "FILLED"), or by
+     * any of several statuses at once by passing an array (e.g., ["SUBMITTED", "PARTIALLY_FILLED"]) (optional)
      * @param params.tradingPairId - Filter by trading pair UUID (optional)
-     * @param params.page - Page number for pagination (defaults to 1, must be > 0)
-     * @param params.pageSize - Number of orders per page (defaults to 10, max 100, must be > 0)
-     * @param params.pageToken - Pagination cursor (optional): omit for legacy page-number
-     * pagination; pass `""` to start a cursor walk from the newest (or oldest, for
-     * `orderBy: "ASC"`) row; pass a previous response's `nextPageToken` to resume. Any
-     * cursor-walk value (`""` or non-empty) ignores `page` and covers full order history
-     * (hot and archived rows merged), unlike page-number mode.
+     * @param params.page - Deprecated: page number for legacy offset pagination (must be > 0).
+     * Passing it selects legacy page-number mode, which only sees recent (hot) history and
+     * populates `total`/`totalPages`. Use cursor pagination (`pageToken`) instead.
+     * @param params.pageSize - Number of orders per page (defaults to 10, must be > 0; max 100
+     * in page-number mode, up to 1000 when pageToken is present)
+     * @param params.pageToken - Pagination cursor: pass `""` to start a cursor walk from
+     * the newest (or oldest, for `orderBy: "ASC"`) row; pass a previous response's
+     * `nextPageToken` to resume. Any cursor-walk value (`""` or non-empty) ignores `page`
+     * and covers full order history (hot and archived rows merged), unlike page-number
+     * mode. Omitting both `page` and `pageToken` starts a cursor walk (`pageToken=""`).
      * @returns Promise resolving to GetPaginatedOrdersResponse with orders and pagination info
      * @throws {APIError} When API communication fails
      *
      * @example
      * ```typescript
-     * // Get submitted orders for a specific trading pair with custom pagination
-     * const orders = await tradingAPI.getPaginatedOrders({
-     *   status: "SUBMITTED",
-     *   tradingPairId: "456e7890-e12b-12d3-a456-426614174000",
-     *   page: 1,
-     *   pageSize: 20
-     * });
-     * console.log(`Found ${orders.total} orders, showing page ${orders.page}`);
-     *
-     * // Get all orders with default pagination (page=1, pageSize=10)
-     * const allOrders = await tradingAPI.getPaginatedOrders();
+     * // Walk full order history with cursor pagination (the default mode)
+     * let pageToken: string | undefined;
+     * do {
+     *   const res = await tradingAPI.getPaginatedOrders({ status: "FILLED", pageToken });
+     *   handle(res.orders);
+     *   pageToken = res.nextPageToken;
+     * } while (pageToken);
      * ```
      */
     getPaginatedOrders(params?: GetPaginatedOrdersParams): Promise<GetPaginatedOrdersResponse>;
+    /**
+     * Walks the user's full order history with cursor pagination, yielding one
+     * order at a time.
+     *
+     * Starts a cursor walk (`pageToken: ""`) and follows each response's
+     * `nextPageToken` until the server proves exhaustion (a page with zero rows
+     * and an empty token). Covers full order history — hot and archived rows
+     * merged — unlike the deprecated page-number mode.
+     *
+     * @param params - Optional filters and page size; `page`/`pageToken` are
+     * managed by the iterator and cannot be passed.
+     * @returns Async generator yielding orders newest-first (or oldest-first for
+     * `orderBy: "ASC"`)
+     * @throws {APIError} When any underlying request fails
+     *
+     * @example
+     * ```typescript
+     * for await (const order of tradingAPI.iterateOrders({ status: "FILLED" })) {
+     *   console.log(order.id);
+     * }
+     * ```
+     */
+    iterateOrders(params?: Omit<GetPaginatedOrdersParams, "page" | "pageToken">): AsyncGenerator<GetPaginatedOrdersResponse["orders"][number], void, undefined>;
     /**
      * Gets a single order by its ID.
      *

package/dist/api/trading/api.js

@@ -409,37 +409,40 @@ export class TradingAPIImpl extends BaseAPI {
         });
     }
     /**
-     * Gets paginated orders based on query parameters with automatic pagination.
+     * Gets orders based on query parameters, cursor-paginated by default.
      *
      * Retrieves orders with optional filtering by status, trading pair, and pagination.
-     * Pagination parameters are always included with sensible defaults for consistent API behavior.
+     * When neither `page` nor `pageToken` is passed, the SDK drives cursor (pageToken)
+     * pagination: it starts a cursor walk from the newest (or oldest, for
+     * `orderBy: "ASC"`) row and the response's `nextPageToken` resumes it. Cursor
+     * responses carry no exact totals (`total`/`page`/`totalPages` are 0).
      *
      * @param params - Query parameters for filtering orders
-     * @param params.status - Filter by order status (e.g., "SUBMITTED", "FILLED") (optional)
+     * @param params.status - Filter by order status (e.g., "SUBMITTED", "FILLED"), or by
+     * any of several statuses at once by passing an array (e.g., ["SUBMITTED", "PARTIALLY_FILLED"]) (optional)
      * @param params.tradingPairId - Filter by trading pair UUID (optional)
-     * @param params.page - Page number for pagination (defaults to 1, must be > 0)
-     * @param params.pageSize - Number of orders per page (defaults to 10, max 100, must be > 0)
-     * @param params.pageToken - Pagination cursor (optional): omit for legacy page-number
-     * pagination; pass `""` to start a cursor walk from the newest (or oldest, for
-     * `orderBy: "ASC"`) row; pass a previous response's `nextPageToken` to resume. Any
-     * cursor-walk value (`""` or non-empty) ignores `page` and covers full order history
-     * (hot and archived rows merged), unlike page-number mode.
+     * @param params.page - Deprecated: page number for legacy offset pagination (must be > 0).
+     * Passing it selects legacy page-number mode, which only sees recent (hot) history and
+     * populates `total`/`totalPages`. Use cursor pagination (`pageToken`) instead.
+     * @param params.pageSize - Number of orders per page (defaults to 10, must be > 0; max 100
+     * in page-number mode, up to 1000 when pageToken is present)
+     * @param params.pageToken - Pagination cursor: pass `""` to start a cursor walk from
+     * the newest (or oldest, for `orderBy: "ASC"`) row; pass a previous response's
+     * `nextPageToken` to resume. Any cursor-walk value (`""` or non-empty) ignores `page`
+     * and covers full order history (hot and archived rows merged), unlike page-number
+     * mode. Omitting both `page` and `pageToken` starts a cursor walk (`pageToken=""`).
      * @returns Promise resolving to GetPaginatedOrdersResponse with orders and pagination info
      * @throws {APIError} When API communication fails
      *
      * @example
      * ```typescript
-     * // Get submitted orders for a specific trading pair with custom pagination
-     * const orders = await tradingAPI.getPaginatedOrders({
-     *   status: "SUBMITTED",
-     *   tradingPairId: "456e7890-e12b-12d3-a456-426614174000",
-     *   page: 1,
-     *   pageSize: 20
-     * });
-     * console.log(`Found ${orders.total} orders, showing page ${orders.page}`);
-     *
-     * // Get all orders with default pagination (page=1, pageSize=10)
-     * const allOrders = await tradingAPI.getPaginatedOrders();
+     * // Walk full order history with cursor pagination (the default mode)
+     * let pageToken: string | undefined;
+     * do {
+     *   const res = await tradingAPI.getPaginatedOrders({ status: "FILLED", pageToken });
+     *   handle(res.orders);
+     *   pageToken = res.nextPageToken;
+     * } while (pageToken);
      * ```
      */
     async getPaginatedOrders(params) {
@@ -448,16 +451,25 @@ export class TradingAPIImpl extends BaseAPI {
             validate(GetPaginatedOrdersSchema, params);
         }
         // Set pagination defaults with destructuring and validation
-        const { page = 1, pageSize: requestedPageSize = 10, status, tradingPairId, tradingMode, marginAccountId, pageToken } = params || {};
-        const validPage = page > 0 ? page : 1;
+        const { page, pageSize: requestedPageSize = 10, status, tradingPairId, tradingMode, marginAccountId, pageToken } = params || {};
         const validPageSize = requestedPageSize > 0 ? requestedPageSize : 10;
-        const pageSize = Math.min(validPageSize, 100);
+        // Legacy offset mode only when the caller explicitly asked for a page and
+        // no cursor was given; everything else drives cursor (pageToken) mode.
+        const legacyOffsetMode = page !== undefined && pageToken === undefined;
+        // Cursor requests may use pages up to 1000 (keyset reads); page-number
+        // requests keep the server's 100 cap.
+        const pageSize = Math.min(validPageSize, legacyOffsetMode ? 100 : 1000);
         const searchParams = new URLSearchParams();
-        // Always include pagination parameters for consistent API behavior
-        searchParams.append("page", validPage.toString());
+        if (legacyOffsetMode) {
+            const validPage = page > 0 ? page : 1;
+            searchParams.append("page", validPage.toString());
+        }
         searchParams.append("pageSize", pageSize.toString());
-        if (status) {
-            searchParams.append("status", status);
+        // An array filter is sent as one comma-separated `status` value, which the
+        // API reads as "any of these", so several statuses cost a single request.
+        const statusFilter = typeof status === "string" ? status : status?.join(",");
+        if (statusFilter) {
+            searchParams.append("status", statusFilter);
         }
         if (tradingPairId) {
             searchParams.append("tradingPairId", tradingPairId);
@@ -468,18 +480,55 @@ export class TradingAPIImpl extends BaseAPI {
         if (marginAccountId) {
             searchParams.append("marginAccountId", marginAccountId);
         }
-        // `!== undefined` (not a truthy check): an explicitly-provided empty
-        // string is the documented way to start a cursor walk (distinct from
-        // omitting `pageToken` entirely), so it must still be sent rather than
-        // silently dropped like a falsy value would be.
-        if (pageToken !== undefined) {
-            searchParams.append("pageToken", pageToken);
+        // Cursor mode selects itself by the *presence* of `pageToken` on the wire,
+        // even when it is the empty string (the documented way to start a walk),
+        // so it must be sent explicitly rather than dropped like a falsy value.
+        // When the caller gave neither `page` nor `pageToken`, default to starting
+        // a cursor walk (`pageToken=""`).
+        if (!legacyOffsetMode) {
+            searchParams.append("pageToken", pageToken ?? "");
         }
         const endpoint = `/api/v1/orders?${searchParams.toString()}`;
         return await this.makeAuthenticatedRequest(endpoint, {
             method: "GET",
         });
     }
+    /**
+     * Walks the user's full order history with cursor pagination, yielding one
+     * order at a time.
+     *
+     * Starts a cursor walk (`pageToken: ""`) and follows each response's
+     * `nextPageToken` until the server proves exhaustion (a page with zero rows
+     * and an empty token). Covers full order history — hot and archived rows
+     * merged — unlike the deprecated page-number mode.
+     *
+     * @param params - Optional filters and page size; `page`/`pageToken` are
+     * managed by the iterator and cannot be passed.
+     * @returns Async generator yielding orders newest-first (or oldest-first for
+     * `orderBy: "ASC"`)
+     * @throws {APIError} When any underlying request fails
+     *
+     * @example
+     * ```typescript
+     * for await (const order of tradingAPI.iterateOrders({ status: "FILLED" })) {
+     *   console.log(order.id);
+     * }
+     * ```
+     */
+    async *iterateOrders(params) {
+        let pageToken = "";
+        // A non-empty token never guarantees further results (AIP-158 "maybe
+        // more"): keep following it until a response returns zero rows and an
+        // empty token, the sole proof the walk is exhausted.
+        for (;;) {
+            const response = await this.getPaginatedOrders({ ...params, pageToken });
+            yield* response.orders;
+            if (!response.nextPageToken) {
+                return;
+            }
+            pageToken = response.nextPageToken;
+        }
+    }
     /**
      * Gets a single order by its ID.
      *

package/dist/api/websocket/websocket.js

@@ -150,6 +150,10 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
      * opens. The client signs `WS-AUTH\n<pubkey>\n<ts>` with the session private
      * key; the server binds the connection to the session. No-op if no session
      * is set (public channels work unauthenticated).
+     *
+     * `timestamp` is the current epoch-ms and is bound into the signature; the
+     * server rejects it outside a ±30s skew window, so the handshake is freshly
+     * signed on every (re)connect rather than cached and replayed.
      */
     const sendAuthenticate = () => {
         if (!session || ws?.readyState !== WebSocket.OPEN)
@@ -504,7 +508,7 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
         });
     };
     const subscribeMovements = (handler) => {
-        // User is identified from the JWT token, so channel is just "movements"
+        // User is identified from the authenticated session, so channel is just "movements"
         const channel = "movements";
         return subscribe(channel, (rawData) => {
             try {
@@ -541,10 +545,10 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
     };
     /**
      * Subscribe to authenticated user's order events (all trading pairs)
-     * Requires authentication - user is identified from the JWT token
+     * Requires authentication - user is identified from the signed session-key handshake
      */
     const subscribeUserOrders = (handler) => {
-        // User is identified from the JWT token, so channel is just "orders"
+        // User is identified from the authenticated session, so channel is just "orders"
         const channel = "orders";
         return subscribe(channel, (rawData) => {
             try {
@@ -564,10 +568,10 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
     };
     /**
      * Subscribe to authenticated user's balance events
-     * Requires authentication - user is identified from the JWT token
+     * Requires authentication - user is identified from the signed session-key handshake
      */
     const subscribeBalances = (handler) => {
-        // User is identified from the JWT token, so channel is just "balances"
+        // User is identified from the authenticated session, so channel is just "balances"
         const channel = "balances";
         return subscribe(channel, (rawData) => {
             try {

package/dist/errors/errors.js

@@ -421,7 +421,7 @@ function getSuggestionForConfigField(field) {
         case "seirpcurl":
             return "Use 'https://evm-rpc-testnet.sei-apis.com' for testnet or 'https://evm-rpc.sei-apis.com' for mainnet.";
         case "wsurl":
-            return "Use 'wss://development.apimonaco.xyz/ws' for testnet or 'wss://api.monaco.xyz/ws' for mainnet.";
+            return "Use 'wss://ws-develop.apimonaco.xyz/ws' for testnet or 'wss://ws.apimonaco.xyz/ws' for mainnet.";
         case "network":
             return "Valid networks are: 'mainnet', 'development', 'staging', 'local'.";
         default:

package/dist/networks/networks.js

@@ -27,7 +27,9 @@ const DEFAULT_WS_URLS = {
     // keep working during the migration window.
     development: "wss://ws-develop.apimonaco.xyz/ws",
     staging: "wss://ws-staging.apimonaco.xyz/ws",
-    mainnet: "wss://api.monaco.xyz/ws",
+    // wss://api.monaco.xyz/ws never resolved (the monaco.xyz zone has no NS
+    // delegation), so this is not a behavior change for any working client.
+    mainnet: "wss://ws.apimonaco.xyz/ws",
 };
 /**
  * Resolve the API URL based on network

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@0xmonaco/core",
-	"version": "1.0.29",
+	"version": "1.0.32-develop.522174b",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -23,8 +23,8 @@
 		"viem": "^2.45.2"
 	},
 	"dependencies": {
-		"@0xmonaco/contracts": "1.0.29",
-		"@0xmonaco/types": "1.0.29",
+		"@0xmonaco/contracts": "1.0.32-develop.522174b",
+		"@0xmonaco/types": "1.0.32-develop.522174b",
 		"@noble/curves": "^1.9.1",
 		"@noble/hashes": "^1.8.0",
 		"http-status-codes": "^2.3.0"