@0xmonaco/core 1.0.32 → 1.0.33

package/dist/api/base.js

@@ -34,6 +34,112 @@ import { APIError } from "../errors";
  * only takes effect in server runtimes (Node/undici, Bun, Deno).
  */
 const SDK_USER_AGENT = "@0xmonaco/core";
+const MONTHS = {
+    Jan: 0,
+    Feb: 1,
+    Mar: 2,
+    Apr: 3,
+    May: 4,
+    Jun: 5,
+    Jul: 6,
+    Aug: 7,
+    Sep: 8,
+    Oct: 9,
+    Nov: 10,
+    Dec: 11,
+};
+// The three RFC 7231 §7.1.1.1 `HTTP-date` grammars a recipient must accept.
+// Each is anchored so trailing junk is rejected, and `Date.parse` is avoided
+// entirely (it is permissive — it reads asctime in local time and rolls
+// impossible dates like 31 Feb forward instead of rejecting them).
+const MONTH = "Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec";
+const IMF_FIXDATE = new RegExp(`^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (\\d{2}) (${MONTH}) (\\d{4}) (\\d{2}):(\\d{2}):(\\d{2}) GMT$`);
+const RFC850_DATE = new RegExp(`^(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), (\\d{2})-(${MONTH})-(\\d{2}) (\\d{2}):(\\d{2}):(\\d{2}) GMT$`);
+const ASCTIME_DATE = new RegExp(`^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) (${MONTH}) ([ \\d]\\d) (\\d{2}):(\\d{2}):(\\d{2}) (\\d{4})$`);
+/**
+ * Expand an RFC 850 two-digit year per RFC 7231 §7.1.1.1: a full timestamp that
+ * appears more than 50 years in the future is interpreted as the most recent
+ * past year with the same last two digits. The comparison is against the exact
+ * receipt instant plus 50 years (not just calendar years), so the boundary can
+ * fall mid-year — e.g. received 2026-06-01, `31-Dec-76` is 50y7m ahead and maps
+ * to 1976, while `01-Jan-76` is under 50 years ahead and stays 2076.
+ */
+function expandTwoDigitYear(twoDigitYear, month, day, hour, minute, second) {
+    const now = new Date(Date.now());
+    const candidateYear = Math.floor(now.getUTCFullYear() / 100) * 100 + twoDigitYear;
+    const candidate = Date.UTC(candidateYear, month, day, hour, minute, second);
+    const fiftyYearsAhead = Date.UTC(now.getUTCFullYear() + 50, now.getUTCMonth(), now.getUTCDate(), now.getUTCHours(), now.getUTCMinutes(), now.getUTCSeconds());
+    return candidate > fiftyYearsAhead ? candidateYear - 100 : candidateYear;
+}
+/**
+ * Parse an RFC 7231 `HTTP-date` — in any of the three formats a recipient must
+ * accept (IMF-fixdate, the obsolete RFC 850 form, and asctime) — into a UTC
+ * epoch in milliseconds, or `undefined` if the value is not a well-formed, real
+ * calendar date. All three denote UTC, so timestamps are built with `Date.UTC`
+ * and the fields are round-tripped to reject impossible dates such as
+ * `31 Feb` or `25:00:00`. RFC 850's 2-digit year follows the RFC 7231 rule
+ * (see {@link expandTwoDigitYear}). The redundant day-name is intentionally not
+ * validated against the date — RFC 7231 encourages robust parsing, and the
+ * date/time fields already determine the instant unambiguously, so a mismatched
+ * weekday still yields the intended delay rather than a dropped header and an
+ * arbitrary fallback.
+ */
+function parseHttpDate(value) {
+    let day;
+    let month;
+    let year;
+    let hour;
+    let minute;
+    let second;
+    const imf = IMF_FIXDATE.exec(value);
+    const rfc850 = RFC850_DATE.exec(value);
+    const asctime = ASCTIME_DATE.exec(value);
+    if (imf) {
+        day = Number(imf[1]);
+        month = MONTHS[imf[2]];
+        year = Number(imf[3]);
+        hour = Number(imf[4]);
+        minute = Number(imf[5]);
+        second = Number(imf[6]);
+    }
+    else if (rfc850) {
+        day = Number(rfc850[1]);
+        month = MONTHS[rfc850[2]];
+        hour = Number(rfc850[4]);
+        minute = Number(rfc850[5]);
+        second = Number(rfc850[6]);
+        if (month === undefined)
+            return undefined;
+        year = expandTwoDigitYear(Number(rfc850[3]), month, day, hour, minute, second);
+    }
+    else if (asctime) {
+        month = MONTHS[asctime[1]];
+        day = Number((asctime[2] ?? "").trim());
+        hour = Number(asctime[3]);
+        minute = Number(asctime[4]);
+        second = Number(asctime[5]);
+        year = Number(asctime[6]);
+    }
+    else {
+        return undefined;
+    }
+    if (month === undefined)
+        return undefined;
+    const timestamp = Date.UTC(year, month, day, hour, minute, second);
+    const utc = new Date(timestamp);
+    // Reject impossible calendar/clock values that Date.UTC silently rolls over
+    // (e.g. 31 Feb, 25:00:00). A `:60` leap second is likewise dropped rather
+    // than special-cased — leap seconds never appear in a Retry-After header.
+    if (utc.getUTCFullYear() !== year ||
+        utc.getUTCMonth() !== month ||
+        utc.getUTCDate() !== day ||
+        utc.getUTCHours() !== hour ||
+        utc.getUTCMinutes() !== minute ||
+        utc.getUTCSeconds() !== second) {
+        return undefined;
+    }
+    return timestamp;
+}
 export class BaseAPI {
     apiUrl;
     /** Active session keypair (raw bytes) used to sign authenticated requests. */
@@ -138,12 +244,25 @@ export class BaseAPI {
         if (!headers)
             return {};
         const requestId = headers.get("x-request-id") || headers.get("request-id") || headers.get("x-correlation-id") || undefined;
-        // Parse Retry-After header with validation
+        // Parse the Retry-After header (RFC 7231). It is either a non-negative
+        // number of seconds (delay-seconds) or an HTTP-date. Both forms are
+        // normalized to a delay in SECONDS, so callers multiply by 1000 for
+        // setTimeout. An HTTP-date is converted to the remaining seconds from now
+        // (past dates clamp to 0). Values matching neither grammar are dropped so
+        // a malformed header can never masquerade as a 0s "retry immediately".
         const retryAfterHeader = headers.get("retry-after");
         let retryAfter;
         if (retryAfterHeader !== null) {
-            const parsed = Number.parseInt(retryAfterHeader, 10);
-            retryAfter = Number.isNaN(parsed) ? undefined : parsed;
+            const value = retryAfterHeader.trim();
+            if (/^\d+$/.test(value)) {
+                retryAfter = Number.parseInt(value, 10);
+            }
+            else {
+                const dateMs = parseHttpDate(value);
+                if (dateMs !== undefined) {
+                    retryAfter = Math.max(0, Math.ceil((dateMs - Date.now()) / 1000));
+                }
+            }
         }
         return { requestId, retryAfter };
     }

package/dist/api/websocket/websocket.js

@@ -150,6 +150,10 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
      * opens. The client signs `WS-AUTH\n<pubkey>\n<ts>` with the session private
      * key; the server binds the connection to the session. No-op if no session
      * is set (public channels work unauthenticated).
+     *
+     * `timestamp` is the current epoch-ms and is bound into the signature; the
+     * server rejects it outside a ±30s skew window, so the handshake is freshly
+     * signed on every (re)connect rather than cached and replayed.
      */
     const sendAuthenticate = () => {
         if (!session || ws?.readyState !== WebSocket.OPEN)
@@ -504,7 +508,7 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
         });
     };
     const subscribeMovements = (handler) => {
-        // User is identified from the JWT token, so channel is just "movements"
+        // User is identified from the authenticated session, so channel is just "movements"
         const channel = "movements";
         return subscribe(channel, (rawData) => {
             try {
@@ -541,10 +545,10 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
     };
     /**
      * Subscribe to authenticated user's order events (all trading pairs)
-     * Requires authentication - user is identified from the JWT token
+     * Requires authentication - user is identified from the signed session-key handshake
      */
     const subscribeUserOrders = (handler) => {
-        // User is identified from the JWT token, so channel is just "orders"
+        // User is identified from the authenticated session, so channel is just "orders"
         const channel = "orders";
         return subscribe(channel, (rawData) => {
             try {
@@ -564,10 +568,10 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
     };
     /**
      * Subscribe to authenticated user's balance events
-     * Requires authentication - user is identified from the JWT token
+     * Requires authentication - user is identified from the signed session-key handshake
      */
     const subscribeBalances = (handler) => {
-        // User is identified from the JWT token, so channel is just "balances"
+        // User is identified from the authenticated session, so channel is just "balances"
         const channel = "balances";
         return subscribe(channel, (rawData) => {
             try {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@0xmonaco/core",
-	"version": "1.0.32",
+	"version": "1.0.33",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -23,8 +23,8 @@
 		"viem": "^2.45.2"
 	},
 	"dependencies": {
-		"@0xmonaco/contracts": "1.0.32",
-		"@0xmonaco/types": "1.0.32",
+		"@0xmonaco/contracts": "1.0.33",
+		"@0xmonaco/types": "1.0.33",
 		"@noble/curves": "^1.9.1",
 		"@noble/hashes": "^1.8.0",
 		"http-status-codes": "^2.3.0"