@0xmonaco/core 1.0.47 → 1.0.50

package/dist/api/margin-accounts/api.d.ts

@@ -5,6 +5,16 @@ export declare class MarginAccountsAPIImpl extends BaseAPI implements MarginAcco
     getMarginAccountSummary(marginAccountId: string, params?: GetMarginAccountSummaryParams): Promise<MarginAccountSummary>;
     getParentMarginAccountSummary(params?: GetMarginAccountSummaryParams): Promise<MarginAccountSummary>;
     getAvailableCollateral(params?: GetAvailableCollateralParams): Promise<GetAvailableCollateralResponse>;
+    /**
+     * @deprecated This endpoint overloads two unrelated operations: with
+     * `tradingPairId` it allocates into that pair's isolated risk bucket
+     * (crediting the sole open position's stored margin), without it it
+     * performs a wallet-debiting deposit to the parent margin account. Use
+     * {@link transferCollateralToRiskBucket} for bucket funding (which now
+     * applies the same position-margin credit) and
+     * {@link transferCollateralToParentMarginAccount} for wallet-to-margin
+     * deposits. Kept for backward compatibility; no removal date scheduled.
+     */
     transferCollateralToMarginAccount(marginAccountId: string, request: TransferCollateralRequest): Promise<TransferCollateralResponse>;
     transferCollateralToParentMarginAccount(request: TransferCollateralToParentMarginAccountRequest): Promise<TransferCollateralResponse>;
     transferCollateralToRiskBucket(request: TransferCollateralToRiskBucketRequest): Promise<TransferCollateralResponse>;

package/dist/api/margin-accounts/api.js

@@ -27,6 +27,16 @@ export class MarginAccountsAPIImpl extends BaseAPI {
         validate(GetAvailableCollateralSchema, params);
         return await this.makeAuthenticatedRequest(perpRoutes.marginAccounts.availableCollateral(params));
     }
+    /**
+     * @deprecated This endpoint overloads two unrelated operations: with
+     * `tradingPairId` it allocates into that pair's isolated risk bucket
+     * (crediting the sole open position's stored margin), without it it
+     * performs a wallet-debiting deposit to the parent margin account. Use
+     * {@link transferCollateralToRiskBucket} for bucket funding (which now
+     * applies the same position-margin credit) and
+     * {@link transferCollateralToParentMarginAccount} for wallet-to-margin
+     * deposits. Kept for backward compatibility; no removal date scheduled.
+     */
     async transferCollateralToMarginAccount(marginAccountId, request) {
         validate(TransferCollateralSchema, { marginAccountId, request });
         return await this.makeAuthenticatedRequest(perpRoutes.marginAccounts.transferIn(marginAccountId), {
@@ -60,6 +70,10 @@ export class MarginAccountsAPIImpl extends BaseAPI {
                 strategyKey: request.strategyKey,
                 marginMode: request.marginMode,
                 selectedTradingPairIds: request.selectedTradingPairIds,
+                // JSON.stringify drops it when omitted; an explicit false MUST reach
+                // the wire or the server applies its Adjust Margin default and every
+                // funding-loop top-up converts into initial margin requirement.
+                applyToPositionMargin: request.applyToPositionMargin,
             }),
         });
     }

package/dist/api/sweeper/api.d.ts

@@ -1,10 +1,14 @@
 /**
  * Sweeper API Implementation
  *
- * Public (unauthenticated) deposit-address registration. Every (application,
- * user) pair has a deterministic deposit address; registering the pair makes
- * the backend monitor that address and sweep every ERC20 deposit into the
- * rollup automatically, crediting the user.
+ * Authenticated deposit-address registration. Every (application, user,
+ * deposit target) triple has a deterministic deposit address; registering the
+ * triple makes the backend monitor that address and sweep every ERC20 deposit
+ * into the rollup automatically, crediting the user.
+ *
+ * The credited address is the calling session's own — it is not a request
+ * field, so this can only ever register an address the caller holds the
+ * session key for.
  *
  * The reply returns immediately with the derived address; the one-time
  * initial balance check (sweeping anything already sitting on the address)
@@ -12,27 +16,36 @@
  *
  * @example
  * ```typescript
- * const { status, sweeperAddress, initialSweepCheck } = await sdk.sweeper.register({
- *   clientId: "60eb377aab9f4ea18dcdf4747204c792",
- *   userAddress: "0x...",
- * });
+ * const { status, sweeperAddress, initialSweepCheck } = await sdk.sweeper.register();
+ *
+ * // Or ask for the margin address instead — a different address.
+ * const margin = await sdk.sweeper.register({ depositTarget: "margin" });
  * ```
  */
 import type { RegisterSweeperRequest, RegisterSweeperResponse, SweeperAPI } from "@0xmonaco/types";
 import { BaseAPI } from "../base";
 export declare class SweeperAPIImpl extends BaseAPI implements SweeperAPI {
     /**
-     * Registers an (application, user) deposit address for monitoring. Public —
-     * no auth required.
+     * Registers an (application, user, deposit target) deposit address for
+     * monitoring. Requires authentication; the user is the session's own
+     * address.
+     *
+     * `registered` means the triple was added by this call,
+     * `already_registered` that it was known before; both carry the same derived
+     * deposit address. Idempotent and safe to retry — a repeat never re-triggers
+     * the initial balance check.
      *
-     * `registered` means the pair was added by this call, `already_registered`
-     * that it was known before; both carry the same derived deposit address.
-     * Idempotent and safe to retry — a repeat never re-triggers the initial
-     * balance check.
+     * `depositTarget` defaults to `"spot"`. Because it is part of the address
+     * derivation, `"spot"` and `"margin"` return two different addresses for the
+     * same application and user, each carrying its own routing request. A
+     * `"spot"` address is never credited to margin; `"margin"` is a request
+     * rather than a guarantee, since a deposit the backend cannot route to
+     * collateral is credited to the spot wallet instead.
      *
-     * @param body - The application and user identifying the pair
+     * @param body - Optionally the destination ledger; everything else comes
+     *   from the session
      * @returns Promise resolving to the deposit address and the initial-check
      *   state
      */
-    register(body: RegisterSweeperRequest): Promise<RegisterSweeperResponse>;
+    register(body?: RegisterSweeperRequest): Promise<RegisterSweeperResponse>;
 }

package/dist/api/sweeper/api.js

@@ -1,10 +1,14 @@
 /**
  * Sweeper API Implementation
  *
- * Public (unauthenticated) deposit-address registration. Every (application,
- * user) pair has a deterministic deposit address; registering the pair makes
- * the backend monitor that address and sweep every ERC20 deposit into the
- * rollup automatically, crediting the user.
+ * Authenticated deposit-address registration. Every (application, user,
+ * deposit target) triple has a deterministic deposit address; registering the
+ * triple makes the backend monitor that address and sweep every ERC20 deposit
+ * into the rollup automatically, crediting the user.
+ *
+ * The credited address is the calling session's own — it is not a request
+ * field, so this can only ever register an address the caller holds the
+ * session key for.
  *
  * The reply returns immediately with the derived address; the one-time
  * initial balance check (sweeping anything already sitting on the address)
@@ -12,32 +16,70 @@
  *
  * @example
  * ```typescript
- * const { status, sweeperAddress, initialSweepCheck } = await sdk.sweeper.register({
- *   clientId: "60eb377aab9f4ea18dcdf4747204c792",
- *   userAddress: "0x...",
- * });
+ * const { status, sweeperAddress, initialSweepCheck } = await sdk.sweeper.register();
+ *
+ * // Or ask for the margin address instead — a different address.
+ * const margin = await sdk.sweeper.register({ depositTarget: "margin" });
  * ```
  */
+import { InvalidConfigError } from "../../errors";
 import { BaseAPI } from "../base";
 import { perpRoutes } from "../perp/routes";
+/**
+ * Ergonomic target to its wire form.
+ *
+ * The public surface is lowercase; the contract's enum is `SPOT`/`MARGIN`, and
+ * the generated wire type is `"SPOT" | "MARGIN" | null`. Serializing the
+ * ergonomic value verbatim would put the official SDK outside its own OpenAPI
+ * schema — it happens to be accepted today only because the gateway uppercases
+ * before matching, so a server tightened to the published enum would break the
+ * SDK rather than the caller.
+ *
+ * Deliberately a comparison rather than an object lookup. A lookup resolves
+ * inherited keys, so an untyped `depositTarget: "toString"` would return
+ * `Object.prototype.toString` — not `undefined`, so it passes a
+ * validity check — and `JSON.stringify` then drops the function-valued field
+ * entirely, leaving the server to apply its SPOT default and hand back a
+ * fundable address for a target that was never valid.
+ */
+function toWireDepositTarget(target) {
+    if (target === "spot") {
+        return "SPOT";
+    }
+    if (target === "margin") {
+        return "MARGIN";
+    }
+    throw new InvalidConfigError(`Invalid deposit target: ${JSON.stringify(target)}. Expected "spot" or "margin".`);
+}
 export class SweeperAPIImpl extends BaseAPI {
     /**
-     * Registers an (application, user) deposit address for monitoring. Public —
-     * no auth required.
+     * Registers an (application, user, deposit target) deposit address for
+     * monitoring. Requires authentication; the user is the session's own
+     * address.
+     *
+     * `registered` means the triple was added by this call,
+     * `already_registered` that it was known before; both carry the same derived
+     * deposit address. Idempotent and safe to retry — a repeat never re-triggers
+     * the initial balance check.
      *
-     * `registered` means the pair was added by this call, `already_registered`
-     * that it was known before; both carry the same derived deposit address.
-     * Idempotent and safe to retry — a repeat never re-triggers the initial
-     * balance check.
+     * `depositTarget` defaults to `"spot"`. Because it is part of the address
+     * derivation, `"spot"` and `"margin"` return two different addresses for the
+     * same application and user, each carrying its own routing request. A
+     * `"spot"` address is never credited to margin; `"margin"` is a request
+     * rather than a guarantee, since a deposit the backend cannot route to
+     * collateral is credited to the spot wallet instead.
      *
-     * @param body - The application and user identifying the pair
+     * @param body - Optionally the destination ledger; everything else comes
+     *   from the session
      * @returns Promise resolving to the deposit address and the initial-check
      *   state
      */
-    async register(body) {
-        return await this.makePublicRequest(perpRoutes.sweeper.register(), {
+    async register(body = {}) {
+        const { depositTarget, ...rest } = body;
+        const wireBody = depositTarget === undefined ? rest : { ...rest, depositTarget: toWireDepositTarget(depositTarget) };
+        return await this.makeAuthenticatedRequest(perpRoutes.sweeper.register(), {
             method: "POST",
-            body: JSON.stringify(body),
+            body: JSON.stringify(wireBody),
         });
     }
 }

package/dist/api/vault/api.d.ts

@@ -23,21 +23,19 @@
  * console.log(`Deposit transaction: ${result.hash}`);
  * ```
  */
+import { encodeDepositApplicationData } from "@0xmonaco/contracts";
 import type { ApplicationsAPI, Balance, DepositOptions, DepositTarget, ProfileAPI, TransactionResult, VaultAPI, WithdrawalRetryOptions, WithdrawalSource, WithdrawResult } from "@0xmonaco/types";
 import { type Address, type Chain, type PublicClient, type WalletClient } from "viem";
 import { BaseAPI } from "../base";
 /**
  * Encode the on-chain `applicationData` for a deposit.
  *
- * For `"spot"` (the default) this stays the bare `clientId` string — byte-for-byte
- * identical to the legacy encoding, so existing deposits are unchanged. For
- * `"margin"` it emits a small JSON routing hint the indexer decodes to credit the
- * deposit to margin collateral.
- *
- * MUST stay in sync with the indexer decoder in
- * `indexer/src/listeners/deposit_routing.rs`.
+ * Re-exported from `@0xmonaco/contracts` rather than defined here: the same
+ * encoding also derives sweeper deposit addresses, and two copies of it could
+ * disagree about the bytes a deposit address is a hash of. Its Rust
+ * counterpart is `utils::deposit_routing::encode_application_data`.
  */
-export declare function encodeDepositApplicationData(clientId: string, target: DepositTarget): string;
+export { encodeDepositApplicationData };
 export declare class VaultAPIImpl extends BaseAPI implements VaultAPI {
     private readonly publicClient;
     private readonly chain;

package/dist/api/vault/api.js

@@ -23,7 +23,7 @@
  * console.log(`Deposit transaction: ${result.hash}`);
  * ```
  */
-import { CONTRACT_ABIS } from "@0xmonaco/contracts";
+import { CONTRACT_ABIS, encodeDepositApplicationData } from "@0xmonaco/contracts";
 import { ApproveTokenSchema, DepositSchema, validate, WithdrawSchema } from "@0xmonaco/types";
 import { erc20Abi } from "viem";
 import { APIError, ContractError, InvalidConfigError } from "../../errors";
@@ -42,17 +42,12 @@ const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**
  * Encode the on-chain `applicationData` for a deposit.
  *
- * For `"spot"` (the default) this stays the bare `clientId` string — byte-for-byte
- * identical to the legacy encoding, so existing deposits are unchanged. For
- * `"margin"` it emits a small JSON routing hint the indexer decodes to credit the
- * deposit to margin collateral.
- *
- * MUST stay in sync with the indexer decoder in
- * `indexer/src/listeners/deposit_routing.rs`.
+ * Re-exported from `@0xmonaco/contracts` rather than defined here: the same
+ * encoding also derives sweeper deposit addresses, and two copies of it could
+ * disagree about the bytes a deposit address is a hash of. Its Rust
+ * counterpart is `utils::deposit_routing::encode_application_data`.
  */
-export function encodeDepositApplicationData(clientId, target) {
-    return target === "margin" ? JSON.stringify({ clientId, depositTarget: "MARGIN" }) : clientId;
-}
+export { encodeDepositApplicationData };
 export class VaultAPIImpl extends BaseAPI {
     publicClient;
     chain;

package/dist/api/websocket/websocket.js

@@ -7,11 +7,6 @@ const CONNECTION_TIMEOUT = 10000;
 const HEARTBEAT_INTERVAL = 15000;
 const MAX_RECONNECT_DELAY = 30000;
 const RECONNECT_BASE_DELAY = 1000;
-const CONDITIONAL_ORDER_REASONS = ["created", "activated", "cancelled", "parent_cancelled", "triggered", "failed", "oco_cancelled"];
-const CONDITIONAL_ORDER_CONDITION_TYPES = ["STOP_LOSS", "TAKE_PROFIT"];
-const CONDITIONAL_ORDER_TRIGGER_SOURCES = ["MARK_PRICE"];
-const CONDITIONAL_ORDER_STATES = ["PENDING_PARENT", "ACTIVE", "TRIGGERING", "TRIGGERED", "CANCELLED", "EXPIRED", "FAILED"];
-const CONDITIONAL_ORDER_ASSOCIATION_TYPES = ["POSITION", "PARENT_ORDER"];
 const TWAP_ORDER_STATES = ["PENDING", "ACTIVE", "COMPLETED", "CANCELLED"];
 const INSTRUMENT_CHANGE_KINDS = ["listing", "delisting", "halt", "unhalt", "config_change"];
 function isRecord(value) {
@@ -76,14 +71,20 @@ function readEnum(source, field, allowed) {
     }
     return value;
 }
-function readOptionalEnum(source, field, allowed) {
-    const value = source[field];
-    if (value === undefined || value === null)
-        return undefined;
-    if (typeof value !== "string" || !allowed.includes(value)) {
-        throw new Error(`Invalid WebSocket event: ${field} must be one of ${allowed.join(", ")}`);
-    }
-    return value;
+/**
+ * Read an optional wire enum leniently.
+ *
+ * Absent, `null`, and a present-but-empty string all mean "not set": server
+ * side these fields are `Option<..>` over closed enums, so `""` is a malformed
+ * value rather than a variant this SDK version predates, and letting it through
+ * would put a string the union does not contain onto the typed surface. It is
+ * mapped to absent rather than thrown on, because throwing would drop the whole
+ * frame over one optional field. A non-empty value is passed through untouched,
+ * whether or not the SDK recognizes it.
+ */
+function readOptionalEnumValue(source, field) {
+    const value = readOptionalString(source, field);
+    return value === undefined || value.length === 0 ? undefined : value;
 }
 function parseConditionalOrderEvent(rawData) {
     if (!isRecord(rawData)) {
@@ -94,6 +95,13 @@ function parseConditionalOrderEvent(rawData) {
     }
     const data = keysToCamelCase(rawData.data);
     return {
+        // event_type is the event-class discriminator, validated strictly so a
+        // mis-routed frame is rejected rather than parsed as a conditional order.
+        // The value fields below stay lenient — read as strings and cast, never
+        // checked against an allow-list — so an unexpected *value* never drops the
+        // whole update (0XM-2627). The parse throw is swallowed by the
+        // message-handler catch, so a strict enum here means a silently lost frame
+        // with nothing surfaced to the consumer.
         eventType: readEnum(rawData, "event_type", ["conditional_order_update"]),
         userId: readString(rawData, "user_id"),
         data: {
@@ -102,27 +110,29 @@ function parseConditionalOrderEvent(rawData) {
             marginAccountId: readString(data, "marginAccountId"),
             positionId: readOptionalString(data, "positionId"),
             parentOrderId: readOptionalString(data, "parentOrderId"),
-            associationType: readOptionalEnum(data, "associationType", CONDITIONAL_ORDER_ASSOCIATION_TYPES),
+            associationType: readOptionalEnumValue(data, "associationType"),
             linkedGroupId: readOptionalString(data, "linkedGroupId"),
-            conditionType: readEnum(data, "conditionType", CONDITIONAL_ORDER_CONDITION_TYPES),
-            triggerSource: readEnum(data, "triggerSource", CONDITIONAL_ORDER_TRIGGER_SOURCES),
+            conditionType: readString(data, "conditionType"),
+            triggerSource: readString(data, "triggerSource"),
             triggerPrice: readString(data, "triggerPrice"),
-            side: readEnum(data, "side", ["BUY", "SELL"]),
-            positionSide: readEnum(data, "positionSide", ["LONG", "SHORT", "NONE"]),
-            orderType: readEnum(data, "orderType", ["LIMIT", "MARKET"]),
+            side: readString(data, "side"),
+            positionSide: readString(data, "positionSide"),
+            orderType: readString(data, "orderType"),
             limitPrice: readOptionalString(data, "limitPrice"),
             quantity: readOptionalString(data, "quantity"),
             slippageToleranceBps: readOptionalNumber(data, "slippageToleranceBps"),
             reduceOnly: readBoolean(data, "reduceOnly"),
-            timeInForce: readOptionalEnum(data, "timeInForce", ["GTC", "IOC"]),
-            state: readEnum(data, "state", CONDITIONAL_ORDER_STATES),
+            timeInForce: readOptionalEnumValue(data, "timeInForce"),
+            state: readString(data, "state"),
             triggeredOrderId: readOptionalString(data, "triggeredOrderId"),
             triggeredAt: readOptionalString(data, "triggeredAt"),
             activatedAt: readOptionalString(data, "activatedAt"),
             cancelledAt: readOptionalString(data, "cancelledAt"),
             expiresAt: readOptionalString(data, "expiresAt"),
             failureReason: readOptionalString(data, "failureReason"),
-            reason: readEnum(data, "reason", CONDITIONAL_ORDER_REASONS),
+            // Free-form on the wire (the server field is a plain string), so it is
+            // passed through untouched rather than matched against a value list.
+            reason: readString(data, "reason"),
             updatedAt: readString(data, "updatedAt"),
         },
     };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@0xmonaco/core",
-	"version": "1.0.47",
+	"version": "1.0.50",
 	"type": "module",
 	"homepage": "https://docs.0xmonaco.com/sdk/typescript",
 	"main": "./dist/index.js",
@@ -19,8 +19,8 @@
 		"viem": "^2.45.2"
 	},
 	"dependencies": {
-		"@0xmonaco/contracts": "1.0.47",
-		"@0xmonaco/types": "1.0.47",
+		"@0xmonaco/contracts": "1.0.50",
+		"@0xmonaco/types": "1.0.50",
 		"@noble/curves": "^1.9.1",
 		"@noble/hashes": "^1.8.0",
 		"http-status-codes": "^2.3.0"