@0xmonaco/core 1.0.32 → 1.0.33-develop.c485f61

package/dist/api/base.js

@@ -34,6 +34,112 @@ import { APIError } from "../errors";
  * only takes effect in server runtimes (Node/undici, Bun, Deno).
  */
 const SDK_USER_AGENT = "@0xmonaco/core";
+const MONTHS = {
+    Jan: 0,
+    Feb: 1,
+    Mar: 2,
+    Apr: 3,
+    May: 4,
+    Jun: 5,
+    Jul: 6,
+    Aug: 7,
+    Sep: 8,
+    Oct: 9,
+    Nov: 10,
+    Dec: 11,
+};
+// The three RFC 7231 §7.1.1.1 `HTTP-date` grammars a recipient must accept.
+// Each is anchored so trailing junk is rejected, and `Date.parse` is avoided
+// entirely (it is permissive — it reads asctime in local time and rolls
+// impossible dates like 31 Feb forward instead of rejecting them).
+const MONTH = "Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec";
+const IMF_FIXDATE = new RegExp(`^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (\\d{2}) (${MONTH}) (\\d{4}) (\\d{2}):(\\d{2}):(\\d{2}) GMT$`);
+const RFC850_DATE = new RegExp(`^(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), (\\d{2})-(${MONTH})-(\\d{2}) (\\d{2}):(\\d{2}):(\\d{2}) GMT$`);
+const ASCTIME_DATE = new RegExp(`^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) (${MONTH}) ([ \\d]\\d) (\\d{2}):(\\d{2}):(\\d{2}) (\\d{4})$`);
+/**
+ * Expand an RFC 850 two-digit year per RFC 7231 §7.1.1.1: a full timestamp that
+ * appears more than 50 years in the future is interpreted as the most recent
+ * past year with the same last two digits. The comparison is against the exact
+ * receipt instant plus 50 years (not just calendar years), so the boundary can
+ * fall mid-year — e.g. received 2026-06-01, `31-Dec-76` is 50y7m ahead and maps
+ * to 1976, while `01-Jan-76` is under 50 years ahead and stays 2076.
+ */
+function expandTwoDigitYear(twoDigitYear, month, day, hour, minute, second) {
+    const now = new Date(Date.now());
+    const candidateYear = Math.floor(now.getUTCFullYear() / 100) * 100 + twoDigitYear;
+    const candidate = Date.UTC(candidateYear, month, day, hour, minute, second);
+    const fiftyYearsAhead = Date.UTC(now.getUTCFullYear() + 50, now.getUTCMonth(), now.getUTCDate(), now.getUTCHours(), now.getUTCMinutes(), now.getUTCSeconds());
+    return candidate > fiftyYearsAhead ? candidateYear - 100 : candidateYear;
+}
+/**
+ * Parse an RFC 7231 `HTTP-date` — in any of the three formats a recipient must
+ * accept (IMF-fixdate, the obsolete RFC 850 form, and asctime) — into a UTC
+ * epoch in milliseconds, or `undefined` if the value is not a well-formed, real
+ * calendar date. All three denote UTC, so timestamps are built with `Date.UTC`
+ * and the fields are round-tripped to reject impossible dates such as
+ * `31 Feb` or `25:00:00`. RFC 850's 2-digit year follows the RFC 7231 rule
+ * (see {@link expandTwoDigitYear}). The redundant day-name is intentionally not
+ * validated against the date — RFC 7231 encourages robust parsing, and the
+ * date/time fields already determine the instant unambiguously, so a mismatched
+ * weekday still yields the intended delay rather than a dropped header and an
+ * arbitrary fallback.
+ */
+function parseHttpDate(value) {
+    let day;
+    let month;
+    let year;
+    let hour;
+    let minute;
+    let second;
+    const imf = IMF_FIXDATE.exec(value);
+    const rfc850 = RFC850_DATE.exec(value);
+    const asctime = ASCTIME_DATE.exec(value);
+    if (imf) {
+        day = Number(imf[1]);
+        month = MONTHS[imf[2]];
+        year = Number(imf[3]);
+        hour = Number(imf[4]);
+        minute = Number(imf[5]);
+        second = Number(imf[6]);
+    }
+    else if (rfc850) {
+        day = Number(rfc850[1]);
+        month = MONTHS[rfc850[2]];
+        hour = Number(rfc850[4]);
+        minute = Number(rfc850[5]);
+        second = Number(rfc850[6]);
+        if (month === undefined)
+            return undefined;
+        year = expandTwoDigitYear(Number(rfc850[3]), month, day, hour, minute, second);
+    }
+    else if (asctime) {
+        month = MONTHS[asctime[1]];
+        day = Number((asctime[2] ?? "").trim());
+        hour = Number(asctime[3]);
+        minute = Number(asctime[4]);
+        second = Number(asctime[5]);
+        year = Number(asctime[6]);
+    }
+    else {
+        return undefined;
+    }
+    if (month === undefined)
+        return undefined;
+    const timestamp = Date.UTC(year, month, day, hour, minute, second);
+    const utc = new Date(timestamp);
+    // Reject impossible calendar/clock values that Date.UTC silently rolls over
+    // (e.g. 31 Feb, 25:00:00). A `:60` leap second is likewise dropped rather
+    // than special-cased — leap seconds never appear in a Retry-After header.
+    if (utc.getUTCFullYear() !== year ||
+        utc.getUTCMonth() !== month ||
+        utc.getUTCDate() !== day ||
+        utc.getUTCHours() !== hour ||
+        utc.getUTCMinutes() !== minute ||
+        utc.getUTCSeconds() !== second) {
+        return undefined;
+    }
+    return timestamp;
+}
 export class BaseAPI {
     apiUrl;
     /** Active session keypair (raw bytes) used to sign authenticated requests. */
@@ -138,12 +244,25 @@ export class BaseAPI {
         if (!headers)
             return {};
         const requestId = headers.get("x-request-id") || headers.get("request-id") || headers.get("x-correlation-id") || undefined;
-        // Parse Retry-After header with validation
+        // Parse the Retry-After header (RFC 7231). It is either a non-negative
+        // number of seconds (delay-seconds) or an HTTP-date. Both forms are
+        // normalized to a delay in SECONDS, so callers multiply by 1000 for
+        // setTimeout. An HTTP-date is converted to the remaining seconds from now
+        // (past dates clamp to 0). Values matching neither grammar are dropped so
+        // a malformed header can never masquerade as a 0s "retry immediately".
         const retryAfterHeader = headers.get("retry-after");
         let retryAfter;
         if (retryAfterHeader !== null) {
-            const parsed = Number.parseInt(retryAfterHeader, 10);
-            retryAfter = Number.isNaN(parsed) ? undefined : parsed;
+            const value = retryAfterHeader.trim();
+            if (/^\d+$/.test(value)) {
+                retryAfter = Number.parseInt(value, 10);
+            }
+            else {
+                const dateMs = parseHttpDate(value);
+                if (dateMs !== undefined) {
+                    retryAfter = Math.max(0, Math.ceil((dateMs - Date.now()) / 1000));
+                }
+            }
         }
         return { requestId, retryAfter };
     }

package/dist/api/pitpass/api.d.ts

@@ -33,13 +33,36 @@
  * console.log(`Rewards remaining: ${result.rewardsBalance}`);
  * ```
  */
-import type { GetRewardsBalanceResponse, PitpassAPI, TraderCodeInfoResponse, TraderCodeResponse, TransferRewardsParams, TransferRewardsResponse } from "@0xmonaco/types";
+import type { GetRewardsBalanceResponse, PitpassAPI, TraderCodeAvailabilityResponse, TraderCodeInfoResponse, TraderCodeResponse, TransferRewardsParams, TransferRewardsResponse } from "@0xmonaco/types";
 import { BaseAPI } from "../base";
 export declare class PitpassAPIImpl extends BaseAPI implements PitpassAPI {
     /**
-     * Return the authenticated caller's TraderCode (their normalized wallet address).
+     * Return the authenticated caller's TraderCode.
+     *
+     * The response carries both the permanent wallet-derived `code` and the
+     * custom-handle fields (`customCode`, `isCustom`, `display`).
      */
     getMyTraderCode(): Promise<TraderCodeResponse>;
+    /**
+     * Claim or edit the caller's custom (vanity) TraderCode handle.
+     *
+     * The handle is validated client-side (letter-first `[A-Za-z0-9_]`, length
+     * 5–20) and sent exactly as entered — casing is preserved. The server is the
+     * authoritative gate (409 taken, 422 invalid, 429 rate-limited, 403 disabled).
+     */
+    setTraderCode(code: string): Promise<TraderCodeResponse>;
+    /**
+     * Clear the caller's custom TraderCode handle, reverting to the wallet-derived
+     * default. The freed handle enters a cooldown before it can be reclaimed.
+     */
+    clearTraderCode(): Promise<TraderCodeResponse>;
+    /**
+     * Public advisory check of whether a custom TraderCode handle is available.
+     *
+     * As-you-type UX helper only; the authoritative gate is the atomic claim in
+     * {@link setTraderCode}. Returns `available` and, when unavailable, a `reason`.
+     */
+    checkTraderCodeAvailability(code: string): Promise<TraderCodeAvailabilityResponse>;
     /**
      * Public lookup of a TraderCode by wallet address.
      * Accepts the bare address or the `Monaco - <address>` display form.

package/dist/api/pitpass/api.js

@@ -33,15 +33,57 @@
  * console.log(`Rewards remaining: ${result.rewardsBalance}`);
  * ```
  */
-import { TransferRewardsParamsSchema, validate } from "@0xmonaco/types";
+import { SetTraderCodeParamsSchema, TransferRewardsParamsSchema, validate } from "@0xmonaco/types";
 import { BaseAPI } from "../base";
 export class PitpassAPIImpl extends BaseAPI {
     /**
-     * Return the authenticated caller's TraderCode (their normalized wallet address).
+     * Return the authenticated caller's TraderCode.
+     *
+     * The response carries both the permanent wallet-derived `code` and the
+     * custom-handle fields (`customCode`, `isCustom`, `display`).
      */
     async getMyTraderCode() {
         return await this.makeAuthenticatedRequest("/api/v1/pitpass/codes/me", { method: "GET" });
     }
+    /**
+     * Claim or edit the caller's custom (vanity) TraderCode handle.
+     *
+     * The handle is validated client-side (letter-first `[A-Za-z0-9_]`, length
+     * 5–20) and sent exactly as entered — casing is preserved. The server is the
+     * authoritative gate (409 taken, 422 invalid, 429 rate-limited, 403 disabled).
+     */
+    async setTraderCode(code) {
+        const validated = validate(SetTraderCodeParamsSchema, { code });
+        return await this.makeAuthenticatedRequest("/api/v1/pitpass/codes/me/custom", {
+            method: "PUT",
+            body: JSON.stringify({ code: validated.code }),
+        });
+    }
+    /**
+     * Clear the caller's custom TraderCode handle, reverting to the wallet-derived
+     * default. The freed handle enters a cooldown before it can be reclaimed.
+     */
+    async clearTraderCode() {
+        return await this.makeAuthenticatedRequest("/api/v1/pitpass/codes/me/custom", { method: "DELETE" });
+    }
+    /**
+     * Public advisory check of whether a custom TraderCode handle is available.
+     *
+     * As-you-type UX helper only; the authoritative gate is the atomic claim in
+     * {@link setTraderCode}. Returns `available` and, when unavailable, a `reason`.
+     */
+    async checkTraderCodeAvailability(code) {
+        // Trim to mirror the claim path (setTraderCode validates a trimmed handle),
+        // so the advisory check and the eventual claim agree on padded input.
+        const query = new URLSearchParams({ code: code.trim() }).toString();
+        const raw = await this.makePublicRequest(`/api/v1/pitpass/codes/available?${query}`, {
+            method: "GET",
+        });
+        // The API always serializes `reason`, sending "" (proto3 string default)
+        // when the handle is available; surface that as an omitted `reason` so
+        // callers can rely on the documented ergonomic shape.
+        return { available: raw.available, reason: raw.reason ? raw.reason : undefined };
+    }
     /**
      * Public lookup of a TraderCode by wallet address.
      * Accepts the bare address or the `Monaco - <address>` display form.

package/dist/api/websocket/websocket.js

@@ -150,6 +150,10 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
      * opens. The client signs `WS-AUTH\n<pubkey>\n<ts>` with the session private
      * key; the server binds the connection to the session. No-op if no session
      * is set (public channels work unauthenticated).
+     *
+     * `timestamp` is the current epoch-ms and is bound into the signature; the
+     * server rejects it outside a ±30s skew window, so the handshake is freshly
+     * signed on every (re)connect rather than cached and replayed.
      */
     const sendAuthenticate = () => {
         if (!session || ws?.readyState !== WebSocket.OPEN)
@@ -504,7 +508,7 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
         });
     };
     const subscribeMovements = (handler) => {
-        // User is identified from the JWT token, so channel is just "movements"
+        // User is identified from the authenticated session, so channel is just "movements"
         const channel = "movements";
         return subscribe(channel, (rawData) => {
             try {
@@ -541,10 +545,10 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
     };
     /**
      * Subscribe to authenticated user's order events (all trading pairs)
-     * Requires authentication - user is identified from the JWT token
+     * Requires authentication - user is identified from the signed session-key handshake
      */
     const subscribeUserOrders = (handler) => {
-        // User is identified from the JWT token, so channel is just "orders"
+        // User is identified from the authenticated session, so channel is just "orders"
         const channel = "orders";
         return subscribe(channel, (rawData) => {
             try {
@@ -564,10 +568,10 @@ export function createMonacoWebSocket(baseUrl, options = {}) {
     };
     /**
      * Subscribe to authenticated user's balance events
-     * Requires authentication - user is identified from the JWT token
+     * Requires authentication - user is identified from the signed session-key handshake
      */
     const subscribeBalances = (handler) => {
-        // User is identified from the JWT token, so channel is just "balances"
+        // User is identified from the authenticated session, so channel is just "balances"
         const channel = "balances";
         return subscribe(channel, (rawData) => {
             try {

package/dist/coverage.d.ts

@@ -34,6 +34,9 @@ export declare const COVERED: {
     get_my_trader_code: string;
     get_rewards_balance: string;
     get_trader_code_info: string;
+    set_trader_code: string;
+    clear_trader_code: string;
+    check_trader_code_availability: string;
     get_open_interest: string;
     get_order_by_id: string;
     get_orderbook_snapshot: string;

package/dist/coverage.js

@@ -34,6 +34,9 @@ export const COVERED = {
     get_my_trader_code: "pitpass.getMyTraderCode",
     get_rewards_balance: "pitpass.getRewardsBalance",
     get_trader_code_info: "pitpass.getTraderCodeInfo",
+    set_trader_code: "pitpass.setTraderCode",
+    clear_trader_code: "pitpass.clearTraderCode",
+    check_trader_code_availability: "pitpass.checkTraderCodeAvailability",
     get_open_interest: "getOpenInterest",
     get_order_by_id: "getOrder",
     get_orderbook_snapshot: "getOrderbook",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@0xmonaco/core",
-	"version": "1.0.32",
+	"version": "1.0.33-develop.c485f61",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -23,8 +23,8 @@
 		"viem": "^2.45.2"
 	},
 	"dependencies": {
-		"@0xmonaco/contracts": "1.0.32",
-		"@0xmonaco/types": "1.0.32",
+		"@0xmonaco/contracts": "1.0.33-develop.c485f61",
+		"@0xmonaco/types": "1.0.33-develop.c485f61",
 		"@noble/curves": "^1.9.1",
 		"@noble/hashes": "^1.8.0",
 		"http-status-codes": "^2.3.0"