@0xmonaco/core 1.0.56 → 1.0.58-develop.f12e78b

package/dist/api/auth/api.d.ts

@@ -75,10 +75,24 @@ export declare class AuthAPIImpl extends BaseAPI implements AuthAPI {
     /**
      * Signs a challenge message using the wallet client.
      *
-     * Signs the provided message using the wallet's private key.
-     * This is used in the authentication flow to prove ownership of the wallet.
-     *
-     * @param message - The message to sign
+     * Asks the connected wallet to authorize the message, proving control of the
+     * address. An EOA signs it with its private key (EIP-191 `personal_sign`). A
+     * smart-contract wallet such as a Safe has no private key and returns a
+     * signature its own contract will accept, which the server checks under
+     * EIP-1271; the wallet client handles that difference, and the returned value
+     * is submitted unchanged either way.
+     *
+     * The returned signature is therefore not guaranteed to be 65 bytes — a
+     * contract signature is usually longer — so callers must not assume the EOA
+     * shape.
+     *
+     * Note the scope. Server-side EIP-1271 verification is deliberately narrow:
+     * it is offered only to a wallet holding a BuilderCodes payout bucket, on a
+     * deployment with the contract-wallet flag on and a chain RPC endpoint
+     * configured. An ordinary smart-contract trading account is not covered — it
+     * still takes the recovery path, which it cannot satisfy.
+     *
+     * @param message - The message to authorize
      * @returns Promise resolving to the signature
      * @throws {InvalidConfigError} When wallet account is not available
      * @throws {APIError} When signing fails

package/dist/api/auth/api.js

@@ -102,10 +102,24 @@ export class AuthAPIImpl extends BaseAPI {
     /**
      * Signs a challenge message using the wallet client.
      *
-     * Signs the provided message using the wallet's private key.
-     * This is used in the authentication flow to prove ownership of the wallet.
+     * Asks the connected wallet to authorize the message, proving control of the
+     * address. An EOA signs it with its private key (EIP-191 `personal_sign`). A
+     * smart-contract wallet such as a Safe has no private key and returns a
+     * signature its own contract will accept, which the server checks under
+     * EIP-1271; the wallet client handles that difference, and the returned value
+     * is submitted unchanged either way.
      *
-     * @param message - The message to sign
+     * The returned signature is therefore not guaranteed to be 65 bytes — a
+     * contract signature is usually longer — so callers must not assume the EOA
+     * shape.
+     *
+     * Note the scope. Server-side EIP-1271 verification is deliberately narrow:
+     * it is offered only to a wallet holding a BuilderCodes payout bucket, on a
+     * deployment with the contract-wallet flag on and a chain RPC endpoint
+     * configured. An ordinary smart-contract trading account is not covered — it
+     * still takes the recovery path, which it cannot satisfy.
+     *
+     * @param message - The message to authorize
      * @returns Promise resolving to the signature
      * @throws {InvalidConfigError} When wallet account is not available
      * @throws {APIError} When signing fails

package/dist/api/base.js

@@ -20,7 +20,7 @@
  * }
  * ```
  */
-import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils";
+import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils.js";
 import { StatusCodes } from "http-status-codes";
 import { buildHttpSignatureHeaders } from "../crypto/http-signatures";
 import { composeSigningString, keypairFromHex, sha256Hex, signMessage } from "../crypto/session";

package/dist/api/buildercodes/api.d.ts

@@ -0,0 +1,81 @@
+/**
+ * BuilderCodes API Implementation
+ *
+ * Provides authenticated reads of an enrolled frontend's BuilderCodes program,
+ * earnings, and reserved balance, plus the claim into a tradeable balance.
+ *
+ * `claimBuildercodeRewards` requires authentication: the payout bucket is
+ * resolved from the authenticated caller's own wallet address, so a caller can
+ * only ever claim their own accrued balance.
+ *
+ * @example
+ * ```typescript
+ * // Claim accrued payout balance into a trading balance (authenticated)
+ * const result = await sdk.buildercodes.claimBuildercodeRewards({
+ *   token: "0x0000000000000000000000000000000000000002",
+ *   amount: "1000000",
+ * });
+ * console.log(`Payout remaining: ${result.payoutBalance}`);
+ * console.log(`Now tradeable: ${result.tradingBalance}`);
+ * ```
+ */
+import type { BuildercodesAPI, ClaimBuildercodeRewardsParams, ClaimBuildercodeRewardsResponse, GetBuildercodePayoutSummaryResponse, GetBuildercodeRewardsBalanceResponse, GetBuildercodesConfigResponse, ListBuildercodePayoutsParams, ListBuildercodePayoutsResponse } from "@0xmonaco/types";
+import { BaseAPI } from "../base";
+export declare class BuildercodesAPIImpl extends BaseAPI implements BuildercodesAPI {
+    /**
+     * Read this frontend's current BuilderCodes program state.
+     *
+     * The application comes from the authenticated session; callers cannot
+     * select another application. The authenticated wallet must match the
+     * application's configured payout address.
+     */
+    getConfig(): Promise<GetBuildercodesConfigResponse>;
+    /**
+     * List this frontend's per-trade BuilderCodes credits, newest first.
+     *
+     * The server scopes every query to the authenticated application; neither
+     * the application id nor payout wallet can be supplied by the caller.
+     */
+    listPayouts(params?: ListBuildercodePayoutsParams): Promise<ListBuildercodePayoutsResponse>;
+    /**
+     * Summarize this frontend's BuilderCodes earnings by token.
+     *
+     * Amounts are RAW atomic units and remain separated by token.
+     */
+    getPayoutSummary(): Promise<GetBuildercodePayoutSummaryResponse>;
+    /**
+     * Read the authenticated wallet's available BuilderCodes reward balances.
+     *
+     * Current enrollment is not required: a former payout wallet can still see
+     * and claim the balance it accrued before an address rotation.
+     */
+    getRewardsBalance(): Promise<GetBuildercodeRewardsBalanceResponse>;
+    /**
+     * Claim accrued BuilderCodes payout balance into a trading balance.
+     *
+     * Throws 403 when the caller is refused — either BuilderCodes is not
+     * enabled, or the session is a delegated agent. Delegated sessions are
+     * refused before the feature flag is read, so a 403 there is permanent for
+     * that session type rather than a rollout state.
+     *
+     * Throws 409 when the payout balance is insufficient for the requested
+     * amount (including when the caller has never accrued a share).
+     *
+     * Throws 503 when the matching engine is unreachable, restarting, or slow to
+     * answer. Treat that as an UNKNOWN outcome rather than a rejection: the claim
+     * is admitted to the sequencer before its reply is sent, so it may still
+     * commit, and there is no idempotency key — a blind retry can claim twice.
+     * Do not retry automatically, and do not settle it with a balance read: an
+     * admitted claim can still be queued, so an unchanged balance does not prove
+     * it will not commit. Treat the claim as pending and reconcile first.
+     *
+     * Because that warning has to hold for code as well as readers, an ambiguous
+     * failure (any 5xx, or a network error with no response at all) is thrown
+     * with `retryable: false`, against the SDK's usual "every 5xx is retryable"
+     * rule, so a caller driving retries off that flag cannot claim twice. A
+     * pre-admission rejection is exempt and stays retryable: a maintenance block,
+     * and a sequencer overload (`code: "OVERLOADED"`), both of which are refused
+     * before the claim is queued and so committed nothing.
+     */
+    claimBuildercodeRewards(params: ClaimBuildercodeRewardsParams): Promise<ClaimBuildercodeRewardsResponse>;
+}

package/dist/api/buildercodes/api.js

@@ -0,0 +1,182 @@
+/**
+ * BuilderCodes API Implementation
+ *
+ * Provides authenticated reads of an enrolled frontend's BuilderCodes program,
+ * earnings, and reserved balance, plus the claim into a tradeable balance.
+ *
+ * `claimBuildercodeRewards` requires authentication: the payout bucket is
+ * resolved from the authenticated caller's own wallet address, so a caller can
+ * only ever claim their own accrued balance.
+ *
+ * @example
+ * ```typescript
+ * // Claim accrued payout balance into a trading balance (authenticated)
+ * const result = await sdk.buildercodes.claimBuildercodeRewards({
+ *   token: "0x0000000000000000000000000000000000000002",
+ *   amount: "1000000",
+ * });
+ * console.log(`Payout remaining: ${result.payoutBalance}`);
+ * console.log(`Now tradeable: ${result.tradingBalance}`);
+ * ```
+ */
+import { ClaimBuildercodeRewardsParamsSchema, ListBuildercodePayoutsParamsSchema, validate } from "@0xmonaco/types";
+import { APIError } from "../../errors";
+import { BaseAPI } from "../base";
+/**
+ * REST `error` code carried by a deliberate maintenance block. The write guard
+ * runs as middleware BEFORE the handler, so nothing was admitted to the
+ * sequencer and the claim provably did not commit — that 503 stays retryable.
+ */
+const MAINTENANCE_BLOCK_ERROR = "OPERATIONS_BLOCKED";
+/**
+ * Stable engine `code` for a sequencer admission rejection. The engine refuses a
+ * full lane strictly before sequencing, so the command was never queued and left
+ * no durable-log or state footprint — provably nothing committed, and exactly the
+ * case a client SHOULD retry with backoff.
+ */
+const OVERLOADED_ENGINE_CODE = "OVERLOADED";
+/**
+ * Clear `retryable` on a claim failure whose outcome is UNKNOWN.
+ *
+ * A claim is not idempotent and is admitted to the sequencer before its reply
+ * is sent, so a 5xx or a dropped connection can arrive after the claim already
+ * committed. `APIError` classifies every 5xx and every network failure as
+ * `retryable: true`, and the documented consumer pattern retries whenever that
+ * flag is set — which would claim a second amount. The prose warning on the
+ * method is not enough on its own: the flag is the machine-readable signal, so
+ * it has to agree with it.
+ *
+ * Left alone deliberately: the two 503s that are provably PRE-admission and so
+ * committed nothing — a maintenance block (`OPERATIONS_BLOCKED`, refused in
+ * middleware ahead of the handler) and a sequencer admission rejection
+ * (`OVERLOADED`, refused before the command is queued) — plus every 4xx, which
+ * is a decided outcome. Marking those non-retryable would tell a client to
+ * reconcile a claim that never existed, and would stop it backing off and
+ * retrying an overload, which is the one 503 that most wants a retry.
+ *
+ * The error is mutated rather than replaced so the endpoint, status, request id
+ * and response body all survive for the caller's logs; `APIError`'s constructor
+ * recomputes `retryable` from the status, so a fresh instance could not carry
+ * the override anyway.
+ */
+function markAmbiguousOutcomeNonRetryable(error) {
+    if (!(error instanceof APIError) || !error.retryable) {
+        return error;
+    }
+    // No status at all means the response was never seen — the most ambiguous
+    // case of the lot, since the request may well have been served.
+    const outcomeUnknown = error.statusCode === undefined || error.statusCode >= 500;
+    if (!outcomeUnknown || isPreAdmissionRejection(error)) {
+        return error;
+    }
+    error.retryable = false;
+    error.suggestion =
+        "The claim's outcome is unknown: it may have committed after this failure. Do not retry automatically, and do not rely on a balance read to decide — an admitted claim can still be queued, so an unchanged balance does not prove it will not commit. Treat the claim as pending and reconcile before issuing another; this endpoint has no idempotency key, so a retry can claim a second time.";
+    return error;
+}
+/**
+ * Whether the failure was refused before the claim could be admitted to the
+ * sequencer, which makes it provably non-committing and safe to retry.
+ *
+ * `error` is the gateway's own classification; `code` is the stable engine code
+ * the matching engine tags onto an otherwise-ambiguous `Unavailable`.
+ */
+function isPreAdmissionRejection(error) {
+    const body = error.responseBody;
+    if (body === null || typeof body !== "object") {
+        return false;
+    }
+    const { error: errorCode, code: engineCode } = body;
+    return errorCode === MAINTENANCE_BLOCK_ERROR || engineCode === OVERLOADED_ENGINE_CODE;
+}
+export class BuildercodesAPIImpl extends BaseAPI {
+    /**
+     * Read this frontend's current BuilderCodes program state.
+     *
+     * The application comes from the authenticated session; callers cannot
+     * select another application. The authenticated wallet must match the
+     * application's configured payout address.
+     */
+    async getConfig() {
+        return this.makeAuthenticatedRequest("/api/v1/buildercodes/config", {
+            method: "GET",
+        });
+    }
+    /**
+     * List this frontend's per-trade BuilderCodes credits, newest first.
+     *
+     * The server scopes every query to the authenticated application; neither
+     * the application id nor payout wallet can be supplied by the caller.
+     */
+    async listPayouts(params) {
+        if (params) {
+            validate(ListBuildercodePayoutsParamsSchema, params);
+        }
+        const searchParams = new URLSearchParams();
+        if (params?.page !== undefined) {
+            searchParams.append("page", params.page.toString());
+        }
+        if (params?.pageSize !== undefined) {
+            searchParams.append("pageSize", params.pageSize.toString());
+        }
+        const query = searchParams.toString();
+        const path = query ? `/api/v1/buildercodes/payouts?${query}` : "/api/v1/buildercodes/payouts";
+        return this.makeAuthenticatedRequest(path, { method: "GET" });
+    }
+    /**
+     * Summarize this frontend's BuilderCodes earnings by token.
+     *
+     * Amounts are RAW atomic units and remain separated by token.
+     */
+    async getPayoutSummary() {
+        return this.makeAuthenticatedRequest("/api/v1/buildercodes/payouts/summary", { method: "GET" });
+    }
+    /**
+     * Read the authenticated wallet's available BuilderCodes reward balances.
+     *
+     * Current enrollment is not required: a former payout wallet can still see
+     * and claim the balance it accrued before an address rotation.
+     */
+    async getRewardsBalance() {
+        return this.makeAuthenticatedRequest("/api/v1/buildercodes/rewards/balance", { method: "GET" });
+    }
+    /**
+     * Claim accrued BuilderCodes payout balance into a trading balance.
+     *
+     * Throws 403 when the caller is refused — either BuilderCodes is not
+     * enabled, or the session is a delegated agent. Delegated sessions are
+     * refused before the feature flag is read, so a 403 there is permanent for
+     * that session type rather than a rollout state.
+     *
+     * Throws 409 when the payout balance is insufficient for the requested
+     * amount (including when the caller has never accrued a share).
+     *
+     * Throws 503 when the matching engine is unreachable, restarting, or slow to
+     * answer. Treat that as an UNKNOWN outcome rather than a rejection: the claim
+     * is admitted to the sequencer before its reply is sent, so it may still
+     * commit, and there is no idempotency key — a blind retry can claim twice.
+     * Do not retry automatically, and do not settle it with a balance read: an
+     * admitted claim can still be queued, so an unchanged balance does not prove
+     * it will not commit. Treat the claim as pending and reconcile first.
+     *
+     * Because that warning has to hold for code as well as readers, an ambiguous
+     * failure (any 5xx, or a network error with no response at all) is thrown
+     * with `retryable: false`, against the SDK's usual "every 5xx is retryable"
+     * rule, so a caller driving retries off that flag cannot claim twice. A
+     * pre-admission rejection is exempt and stays retryable: a maintenance block,
+     * and a sequencer overload (`code: "OVERLOADED"`), both of which are refused
+     * before the claim is queued and so committed nothing.
+     */
+    async claimBuildercodeRewards(params) {
+        const validated = validate(ClaimBuildercodeRewardsParamsSchema, params);
+        try {
+            return await this.makeAuthenticatedRequest("/api/v1/buildercodes/rewards/claim", {
+                method: "POST",
+                body: JSON.stringify({ token: validated.token, amount: validated.amount }),
+            });
+        }
+        catch (error) {
+            throw markAmbiguousOutcomeNonRetryable(error);
+        }
+    }
+}

package/dist/api/buildercodes/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * BuilderCodes API Module
+ *
+ * Exports the BuilderCodes payout API implementation.
+ */
+export { BuildercodesAPIImpl } from "./api";

package/dist/api/buildercodes/index.js

@@ -0,0 +1,6 @@
+/**
+ * BuilderCodes API Module
+ *
+ * Exports the BuilderCodes payout API implementation.
+ */
+export { BuildercodesAPIImpl } from "./api";

package/dist/api/index.d.ts

@@ -5,6 +5,7 @@
  */
 export * from "./applications/index";
 export * from "./base";
+export * from "./buildercodes";
 export * from "./delegated-agents";
 export * from "./faucet";
 export * from "./fees";

package/dist/api/index.js

@@ -5,6 +5,7 @@
  */
 export * from "./applications/index";
 export * from "./base";
+export * from "./buildercodes";
 export * from "./delegated-agents";
 export * from "./faucet";
 export * from "./fees";

package/dist/api/profile/api.d.ts

@@ -17,7 +17,7 @@
  * console.log(`User: ${profile.username} (${profile.address})`);
  * ```
  */
-import type { AccountBalance, GetPaginatedUserMovementsResponse, GetUserBalancesParams, GetUserBalancesResponse, GetUserMovementsParams, GetUserTradesParams, GetUserTradesResponse, ListFundingPaymentsParams, ListFundingPaymentsResponse, PortfolioChartResponse, PortfolioMetric, PortfolioPeriod, PortfolioStats, ProfileAPI, UserProfile } from "@0xmonaco/types";
+import type { AccountBalance, GetPaginatedUserMovementsResponse, GetUserBalancesParams, GetUserBalancesResponse, GetUserMovementsParams, GetUserTradesParams, GetUserTradesResponse, ListFundingPaymentsParams, ListFundingPaymentsResponse, PortfolioChartResponse, PortfolioMetric, PortfolioPeriod, PortfolioStats, ProfileAPI, SelfTradePreventionDefault, SelfTradePreventionMode, UserProfile } from "@0xmonaco/types";
 import { BaseAPI } from "../base";
 export declare class ProfileAPIImpl extends BaseAPI implements ProfileAPI {
     /**
@@ -245,4 +245,42 @@ export declare class ProfileAPIImpl extends BaseAPI implements ProfileAPI {
      * ```
      */
     listFundingPayments(params?: ListFundingPaymentsParams): Promise<ListFundingPaymentsResponse>;
+    /**
+     * Get the wallet's self-trade-prevention default.
+     *
+     * Fetches the setting from the /api/v1/accounts/self-trade-prevention endpoint.
+     * Requires a valid access token to be set. The default is wallet-scoped: it
+     * covers every application and account sharing the wallet address, and a
+     * per-order mode always overrides it.
+     *
+     * @returns Promise resolving to the effective mode plus whether it was explicitly set
+     * @throws {APIError} When the request fails or user is not authenticated
+     *
+     * @example
+     * ```typescript
+     * const stp = await profileAPI.getSelfTradePreventionDefault();
+     * console.log(`Mode: ${stp.mode} (explicitly set: ${stp.isCustom})`);
+     * ```
+     */
+    getSelfTradePreventionDefault(): Promise<SelfTradePreventionDefault>;
+    /**
+     * Set the wallet's self-trade-prevention default.
+     *
+     * Sends a PUT to the /api/v1/accounts/self-trade-prevention endpoint. The
+     * write is sequenced through the matching engine; on success the wallet
+     * family's next order already resolves the new mode. Delegated-agent
+     * sessions cannot change it (403).
+     *
+     * @param mode - One of "CANCEL_MAKER", "CANCEL_TAKER", "CANCEL_BOTH", "SKIP"
+     * @returns Promise resolving to the setting now in force
+     * @throws ValidationError If mode is not a known token; this occurs before any network request.
+     * @throws {APIError} When the request fails or user is not authenticated
+     *
+     * @example
+     * ```typescript
+     * const stp = await profileAPI.setSelfTradePreventionDefault("SKIP");
+     * console.log(`Mode is now ${stp.mode}`);
+     * ```
+     */
+    setSelfTradePreventionDefault(mode: SelfTradePreventionMode): Promise<SelfTradePreventionDefault>;
 }

package/dist/api/profile/api.js

@@ -17,7 +17,7 @@
  * console.log(`User: ${profile.username} (${profile.address})`);
  * ```
  */
-import { GetUserMovementsSchema, GetUserTradesSchema, ListFundingPaymentsSchema, validate } from "@0xmonaco/types";
+import { GetUserMovementsSchema, GetUserTradesSchema, ListFundingPaymentsSchema, SetSelfTradePreventionDefaultSchema, validate } from "@0xmonaco/types";
 import { APIError } from "../../errors";
 import { BaseAPI } from "../base";
 export class ProfileAPIImpl extends BaseAPI {
@@ -360,4 +360,50 @@ export class ProfileAPIImpl extends BaseAPI {
         const url = queryString ? `/api/v1/accounts/funding-payments?${queryString}` : "/api/v1/accounts/funding-payments";
         return await this.makeAuthenticatedRequest(url);
     }
+    /**
+     * Get the wallet's self-trade-prevention default.
+     *
+     * Fetches the setting from the /api/v1/accounts/self-trade-prevention endpoint.
+     * Requires a valid access token to be set. The default is wallet-scoped: it
+     * covers every application and account sharing the wallet address, and a
+     * per-order mode always overrides it.
+     *
+     * @returns Promise resolving to the effective mode plus whether it was explicitly set
+     * @throws {APIError} When the request fails or user is not authenticated
+     *
+     * @example
+     * ```typescript
+     * const stp = await profileAPI.getSelfTradePreventionDefault();
+     * console.log(`Mode: ${stp.mode} (explicitly set: ${stp.isCustom})`);
+     * ```
+     */
+    async getSelfTradePreventionDefault() {
+        return await this.makeAuthenticatedRequest("/api/v1/accounts/self-trade-prevention");
+    }
+    /**
+     * Set the wallet's self-trade-prevention default.
+     *
+     * Sends a PUT to the /api/v1/accounts/self-trade-prevention endpoint. The
+     * write is sequenced through the matching engine; on success the wallet
+     * family's next order already resolves the new mode. Delegated-agent
+     * sessions cannot change it (403).
+     *
+     * @param mode - One of "CANCEL_MAKER", "CANCEL_TAKER", "CANCEL_BOTH", "SKIP"
+     * @returns Promise resolving to the setting now in force
+     * @throws ValidationError If mode is not a known token; this occurs before any network request.
+     * @throws {APIError} When the request fails or user is not authenticated
+     *
+     * @example
+     * ```typescript
+     * const stp = await profileAPI.setSelfTradePreventionDefault("SKIP");
+     * console.log(`Mode is now ${stp.mode}`);
+     * ```
+     */
+    async setSelfTradePreventionDefault(mode) {
+        const validated = validate(SetSelfTradePreventionDefaultSchema, { mode });
+        return await this.makeAuthenticatedRequest("/api/v1/accounts/self-trade-prevention", {
+            method: "PUT",
+            body: JSON.stringify(validated),
+        });
+    }
 }

package/dist/api/trading/api.d.ts

@@ -21,7 +21,7 @@
  * );
  * ```
  */
-import type { BatchCancelOrdersResponse, BatchCreateOrderParams, BatchCreateOrdersResponse, BatchReplaceOrderParams, BatchReplaceOrdersResponse, CancelConditionalOrderResponse, CancelOrderResponse, CancelTwapOrderResponse, ConditionalOrder, CreateOrderResponse, CreateTwapOrderOptions, CreateTwapOrderResponse, GetOrderResponse, GetPaginatedOrdersParams, GetPaginatedOrdersResponse, GetTwapOrderTcaResponse, ListConditionalOrdersParams, ListConditionalOrdersResponse, ListTwapOrdersParams, ListTwapOrdersResponse, MarginMode, OrderSide, ParentTpSlLegParams, PositionSide, ReplaceOrderResponse, TimeInForce, TradingAPI, TradingMode, TwapOrder } from "@0xmonaco/types";
+import type { BatchCancelOrdersResponse, BatchCreateOrderParams, BatchCreateOrdersResponse, BatchReplaceOrderParams, BatchReplaceOrdersResponse, CancelConditionalOrderResponse, CancelOrderResponse, CancelTwapOrderResponse, ConditionalOrder, CreateOrderResponse, CreateTwapOrderOptions, CreateTwapOrderResponse, GetOrderResponse, GetPaginatedOrdersParams, GetPaginatedOrdersResponse, GetTwapOrderTcaResponse, ListConditionalOrdersParams, ListConditionalOrdersResponse, ListTwapOrdersParams, ListTwapOrdersResponse, MarginMode, OrderSide, ParentTpSlLegParams, PositionSide, ReplaceOrderResponse, SelfTradePreventionMode, TimeInForce, TradingAPI, TradingMode, TwapOrder } from "@0xmonaco/types";
 import { BaseAPI } from "../base";
 export declare class TradingAPIImpl extends BaseAPI implements TradingAPI {
     /**
@@ -88,6 +88,7 @@ export declare class TradingAPIImpl extends BaseAPI implements TradingAPI {
         leverage?: string;
         reduceOnly?: boolean;
         postOnly?: boolean;
+        selfTradePreventionMode?: SelfTradePreventionMode;
         clientOrderId?: string;
         /** Generated once per call when omitted. Supply the same key to retry a logical order within 24 hours. */
         idempotencyKey?: string;
@@ -148,6 +149,7 @@ export declare class TradingAPIImpl extends BaseAPI implements TradingAPI {
         positionSide?: PositionSide;
         leverage?: string;
         reduceOnly?: boolean;
+        selfTradePreventionMode?: SelfTradePreventionMode;
         takeProfit?: ParentTpSlLegParams;
         stopLoss?: ParentTpSlLegParams;
         clientOrderId?: string;
@@ -218,6 +220,7 @@ export declare class TradingAPIImpl extends BaseAPI implements TradingAPI {
         quantity?: string;
         useMasterBalance?: boolean;
         postOnly?: boolean;
+        selfTradePreventionMode?: SelfTradePreventionMode;
         clientOrderId?: string;
     }): Promise<ReplaceOrderResponse>;
     /**
@@ -257,6 +260,17 @@ export declare class TradingAPIImpl extends BaseAPI implements TradingAPI {
      * Each order is canceled and re-created with new parameters.
      * Failed replacements do not prevent other orders from being replaced.
      *
+     * Pre-sequencing validation is scoped per item too, matching `batchCreate`:
+     * a malformed `orderId`, `price`, `quantity` or `clientOrderId`, or a
+     * `postOnly` violation, fails only that item — its result slot carries a
+     * structured `error.code` (`INVALID_ORDER_ID`, `INVALID_PRICE`,
+     * `INVALID_QUANTITY`, `INVALID_CLIENT_ORDER_ID`, `INVALID_POST_ONLY`) and its
+     * original is left untouched — while the valid items proceed. A `2xx`
+     * response can therefore mix executed replacements and failed items: read
+     * `results[]` per item rather than treating the status code as the verdict.
+     * Only an empty or oversize (>100) batch rejects the whole request.
+     * `totalRequested === totalSucceeded + totalFailed` always holds.
+     *
      * @param orders - Array of order replacement parameters
      * @returns Promise resolving to BatchReplaceOrdersResponse with individual results
      * @throws {APIError} When API communication fails
@@ -281,6 +295,11 @@ export declare class TradingAPIImpl extends BaseAPI implements TradingAPI {
      * Gets orders based on query parameters, cursor-paginated by default.
      *
      * Retrieves orders with optional filtering by status, trading pair, and pagination.
+     * Every kind of order comes back in ONE stream ordered by timestamp: book orders,
+     * TWAP parents (`orderType: "TWAP"`, detail on `twap`) and conditional orders
+     * (`orderType: "CONDITIONAL"`, detail on `conditional`). There is no separate
+     * open-orders call — filter `status` to `["SUBMITTED", "PARTIALLY_FILLED"]` for the
+     * working set.
      * When neither `page` nor `pageToken` is passed, the SDK drives cursor (pageToken)
      * pagination: it starts a cursor walk from the newest (or oldest, for
      * `orderBy: "ASC"`) row and the response's `nextPageToken` resumes it. Cursor
@@ -305,6 +324,17 @@ export declare class TradingAPIImpl extends BaseAPI implements TradingAPI {
      *
      * @example
      * ```typescript
+     * // Every working order, of every kind, in one page
+     * const open = await tradingAPI.getPaginatedOrders({ status: ["SUBMITTED", "PARTIALLY_FILLED"] });
+     * for (const order of open.orders) {
+     *   if (order.orderType === "TWAP") console.log("TWAP parent", order.twap?.slicesPlaced);
+     *   else if (order.orderType === "CONDITIONAL") console.log("trigger", order.conditional?.triggerPrice);
+     *   else console.log("resting", order.price);
+     * }
+     * ```
+     *
+     * @example
+     * ```typescript
      * // Walk full order history with cursor pagination (the default mode)
      * let pageToken: string | undefined;
      * do {

package/dist/api/trading/api.js

@@ -120,6 +120,7 @@ export class TradingAPIImpl extends BaseAPI {
             leverage: options?.leverage,
             reduceOnly: options?.reduceOnly,
             postOnly: options?.postOnly,
+            selfTradePreventionMode: options?.selfTradePreventionMode,
             clientOrderId: options?.clientOrderId,
             idempotencyKey: options?.idempotencyKey === undefined ? crypto.randomUUID() : options.idempotencyKey,
             takeProfit: parentTpSlLegToRequest(options?.takeProfit),
@@ -197,6 +198,7 @@ export class TradingAPIImpl extends BaseAPI {
             positionSide: options?.positionSide,
             leverage: options?.leverage,
             reduceOnly: options?.reduceOnly,
+            selfTradePreventionMode: options?.selfTradePreventionMode,
             takeProfit: parentTpSlLegToRequest(options?.takeProfit),
             stopLoss: parentTpSlLegToRequest(options?.stopLoss),
             clientOrderId: options?.clientOrderId,
@@ -327,6 +329,9 @@ export class TradingAPIImpl extends BaseAPI {
         if (newOrder.postOnly !== undefined) {
             requestBody.postOnly = newOrder.postOnly;
         }
+        if (newOrder.selfTradePreventionMode !== undefined) {
+            requestBody.selfTradePreventionMode = newOrder.selfTradePreventionMode;
+        }
         if (newOrder.clientOrderId !== undefined) {
             requestBody.clientOrderId = newOrder.clientOrderId;
         }
@@ -388,6 +393,7 @@ export class TradingAPIImpl extends BaseAPI {
                 leverage: order.leverage,
                 reduceOnly: order.reduceOnly,
                 postOnly: order.postOnly,
+                selfTradePreventionMode: order.selfTradePreventionMode,
                 clientOrderId: order.clientOrderId,
                 idempotencyKey: order.idempotencyKey === undefined ? crypto.randomUUID() : order.idempotencyKey,
             })),
@@ -403,6 +409,17 @@ export class TradingAPIImpl extends BaseAPI {
      * Each order is canceled and re-created with new parameters.
      * Failed replacements do not prevent other orders from being replaced.
      *
+     * Pre-sequencing validation is scoped per item too, matching `batchCreate`:
+     * a malformed `orderId`, `price`, `quantity` or `clientOrderId`, or a
+     * `postOnly` violation, fails only that item — its result slot carries a
+     * structured `error.code` (`INVALID_ORDER_ID`, `INVALID_PRICE`,
+     * `INVALID_QUANTITY`, `INVALID_CLIENT_ORDER_ID`, `INVALID_POST_ONLY`) and its
+     * original is left untouched — while the valid items proceed. A `2xx`
+     * response can therefore mix executed replacements and failed items: read
+     * `results[]` per item rather than treating the status code as the verdict.
+     * Only an empty or oversize (>100) batch rejects the whole request.
+     * `totalRequested === totalSucceeded + totalFailed` always holds.
+     *
      * @param orders - Array of order replacement parameters
      * @returns Promise resolving to BatchReplaceOrdersResponse with individual results
      * @throws {APIError} When API communication fails
@@ -431,6 +448,7 @@ export class TradingAPIImpl extends BaseAPI {
                 quantity: order.quantity,
                 useMasterBalance: order.useMasterBalance,
                 postOnly: order.postOnly,
+                selfTradePreventionMode: order.selfTradePreventionMode,
                 clientOrderId: order.clientOrderId,
             })),
         };
@@ -443,6 +461,11 @@ export class TradingAPIImpl extends BaseAPI {
      * Gets orders based on query parameters, cursor-paginated by default.
      *
      * Retrieves orders with optional filtering by status, trading pair, and pagination.
+     * Every kind of order comes back in ONE stream ordered by timestamp: book orders,
+     * TWAP parents (`orderType: "TWAP"`, detail on `twap`) and conditional orders
+     * (`orderType: "CONDITIONAL"`, detail on `conditional`). There is no separate
+     * open-orders call — filter `status` to `["SUBMITTED", "PARTIALLY_FILLED"]` for the
+     * working set.
      * When neither `page` nor `pageToken` is passed, the SDK drives cursor (pageToken)
      * pagination: it starts a cursor walk from the newest (or oldest, for
      * `orderBy: "ASC"`) row and the response's `nextPageToken` resumes it. Cursor
@@ -467,6 +490,17 @@ export class TradingAPIImpl extends BaseAPI {
      *
      * @example
      * ```typescript
+     * // Every working order, of every kind, in one page
+     * const open = await tradingAPI.getPaginatedOrders({ status: ["SUBMITTED", "PARTIALLY_FILLED"] });
+     * for (const order of open.orders) {
+     *   if (order.orderType === "TWAP") console.log("TWAP parent", order.twap?.slicesPlaced);
+     *   else if (order.orderType === "CONDITIONAL") console.log("trigger", order.conditional?.triggerPrice);
+     *   else console.log("resting", order.price);
+     * }
+     * ```
+     *
+     * @example
+     * ```typescript
      * // Walk full order history with cursor pagination (the default mode)
      * let pageToken: string | undefined;
      * do {

package/dist/api/websocket/websocket.js

@@ -1,4 +1,4 @@
-import { hexToBytes } from "@noble/hashes/utils";
+import { hexToBytes } from "@noble/hashes/utils.js";
 import { composeWsSigningString, signMessage } from "../../crypto/session";
 import { ALL_MAGNITUDES } from "../../utils";
 import { keysToCamelCase } from "./utils";
@@ -208,6 +208,14 @@ function parsePositionEventData(raw) {
         orderId: readOptionalString(data, "orderId"),
         reason: readString(data, "reason"),
         updatedAt: readString(data, "updatedAt"),
+        // Opaque durable row version (0XM-2673). `readOptionalSequence`, not
+        // `readOptionalNumber`: this is an ordering counter, so a fractional,
+        // negative, or unsafe-integer value would silently corrupt every
+        // comparison against it. Same helper the balance version uses. Absent
+        // stays absent — a definite 0 would be read as a real revision and lose
+        // every `>=` comparison, so the server omits the key rather than sending
+        // zero.
+        version: readOptionalSequence(data, "version"),
     };
 }
 function parsePositionEvent(rawData) {
@@ -543,6 +551,7 @@ function parseOrderSnapshotItem(raw) {
     // conditionally so an absent one stays absent rather than becoming
     // `clientOrderId: undefined`, which a structural comparison would see.
     const clientOrderId = readOptionalString(item, "clientOrderId");
+    const selfTradePreventionMode = readOptionalString(item, "selfTradePreventionMode");
     const version = readOptionalNumber(item, "version");
     return {
         orderId: readString(item, "orderId"),
@@ -574,6 +583,9 @@ function parseOrderSnapshotItem(raw) {
         leverage: readNullableString(item, "leverage"),
         reduceOnly: readBoolean(item, "reduceOnly"),
         ...(clientOrderId === undefined ? {} : { clientOrderId }),
+        // Spread in conditionally like `clientOrderId`: absent means the order
+        // requested no override, and must stay absent (0XM-2733).
+        ...(selfTradePreventionMode === undefined ? {} : { selfTradePreventionMode }),
         // Spread in conditionally for the same reason as `clientOrderId`: the
         // server omits the key when unknown, and absent must stay absent rather
         // than becoming `version: undefined` — a resync compares this value, and

package/dist/coverage.d.ts

@@ -24,6 +24,9 @@ export declare const COVERED: {
     get_application_config: string;
     get_application_stats: string;
     get_available_collateral: string;
+    get_buildercode_payout_summary: string;
+    get_buildercode_rewards_balance: string;
+    get_buildercodes_config: string;
     get_candles: string;
     get_faucet_info: string;
     get_funding_state: string;
@@ -38,7 +41,9 @@ export declare const COVERED: {
     get_sweeper_chains: string;
     get_my_trader_code: string;
     get_rewards_balance: string;
+    get_self_trade_prevention_default: string;
     get_trader_code_info: string;
+    set_self_trade_prevention_default: string;
     set_trader_code: string;
     clear_trader_code: string;
     check_trader_code_availability: string;
@@ -78,6 +83,7 @@ export declare const COVERED: {
     list_application_movements: string;
     list_application_orders: string;
     list_application_users: string;
+    list_buildercode_payouts: string;
     list_conditional_orders: string;
     list_delegated_agent_owners: string;
     list_delegated_agents: string;
@@ -104,6 +110,7 @@ export declare const COVERED: {
     transfer_collateral_to_margin_account: string;
     transfer_collateral_to_parent_margin_account: string;
     transfer_collateral_to_risk_bucket: string;
+    claim_buildercode_rewards: string;
     transfer_rewards: string;
     update_sub_account_limit: string;
     upsert_delegated_agent: string;

package/dist/coverage.js

@@ -24,6 +24,9 @@ export const COVERED = {
     get_application_config: "getApplicationConfig",
     get_application_stats: "getApplicationStats",
     get_available_collateral: "getAvailableCollateral",
+    get_buildercode_payout_summary: "buildercodes.getPayoutSummary",
+    get_buildercode_rewards_balance: "buildercodes.getRewardsBalance",
+    get_buildercodes_config: "buildercodes.getConfig",
     get_candles: "getCandlesticks",
     get_faucet_info: "faucet.getInfo",
     get_funding_state: "getFundingState",
@@ -38,7 +41,9 @@ export const COVERED = {
     get_sweeper_chains: "sweeper.getChains",
     get_my_trader_code: "pitpass.getMyTraderCode",
     get_rewards_balance: "pitpass.getRewardsBalance",
+    get_self_trade_prevention_default: "profile.getSelfTradePreventionDefault",
     get_trader_code_info: "pitpass.getTraderCodeInfo",
+    set_self_trade_prevention_default: "profile.setSelfTradePreventionDefault",
     set_trader_code: "pitpass.setTraderCode",
     clear_trader_code: "pitpass.clearTraderCode",
     check_trader_code_availability: "pitpass.checkTraderCodeAvailability",
@@ -78,6 +83,7 @@ export const COVERED = {
     list_application_movements: "listApplicationMovements",
     list_application_orders: "listApplicationOrders",
     list_application_users: "listApplicationUsers",
+    list_buildercode_payouts: "buildercodes.listPayouts",
     list_conditional_orders: "listConditionalOrders",
     list_delegated_agent_owners: "listDelegatedOwners",
     list_delegated_agents: "listDelegatedAgents",
@@ -104,6 +110,7 @@ export const COVERED = {
     transfer_collateral_to_margin_account: "transferCollateralToMarginAccount",
     transfer_collateral_to_parent_margin_account: "transferCollateralToParentMarginAccount",
     transfer_collateral_to_risk_bucket: "transferCollateralToRiskBucket",
+    claim_buildercode_rewards: "buildercodes.claimBuildercodeRewards",
     transfer_rewards: "pitpass.transferRewards",
     update_sub_account_limit: "subAccounts.updateLimit",
     upsert_delegated_agent: "upsertDelegatedAgent",

package/dist/crypto/http-signatures.js

@@ -1,7 +1,7 @@
 /** Monaco's RFC 9421 Ed25519 profile; key registration remains wallet-authorized. */
 import { ed25519 } from "@noble/curves/ed25519";
-import { sha256 } from "@noble/hashes/sha2";
-import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils.js";
 function base64(bytes) {
     return btoa(String.fromCharCode(...bytes));
 }

package/dist/crypto/session.js

@@ -8,8 +8,8 @@
  * key — it never sees the private key, so it cannot mint requests as the user.
  */
 import { ed25519 } from "@noble/curves/ed25519";
-import { sha256 } from "@noble/hashes/sha2";
-import { bytesToHex, hexToBytes, utf8ToBytes } from "@noble/hashes/utils";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex, hexToBytes, utf8ToBytes } from "@noble/hashes/utils.js";
 /**
  * Generate a fresh ed25519 session keypair.
  *

package/dist/sdk.d.ts

@@ -1,4 +1,4 @@
-import type { ApplicationsAPI, AuthAPI, AuthState, DelegatedAgentsAPI, FaucetAPI, FeesAPI, MarginAccountsAPI, MarketAPI, MonacoSDK, Network, PitpassAPI, PortfolioAPI, PositionsAPI, ProfileAPI, PulseAPI, SDKConfig, SubAccountsAPI, SweeperAPI, TradingAPI, VaultAPI, WhitelistAPI, WithdrawalsAPI } from "@0xmonaco/types";
+import type { ApplicationsAPI, AuthAPI, AuthState, BuildercodesAPI, DelegatedAgentsAPI, FaucetAPI, FeesAPI, MarginAccountsAPI, MarketAPI, MonacoSDK, Network, PitpassAPI, PortfolioAPI, PositionsAPI, ProfileAPI, PulseAPI, SDKConfig, SubAccountsAPI, SweeperAPI, TradingAPI, VaultAPI, WhitelistAPI, WithdrawalsAPI } from "@0xmonaco/types";
 import { type Address, type PublicClient, type TransactionReceipt, type WalletClient } from "viem";
 import { type MonacoWebSocket, OrderbookAPIImpl, TradesAPIImpl } from "./api";
 export declare class MonacoSDKImpl implements MonacoSDK {
@@ -6,6 +6,7 @@ export declare class MonacoSDKImpl implements MonacoSDK {
     delegatedAgents: DelegatedAgentsAPI;
     applications: ApplicationsAPI;
     fees: FeesAPI;
+    buildercodes: BuildercodesAPI;
     pitpass: PitpassAPI;
     vault: VaultAPI;
     withdrawals: WithdrawalsAPI;

package/dist/sdk.js

@@ -3,6 +3,7 @@ import { createPublicClient, http } from "viem";
 import { sei, seiTestnet } from "viem/chains";
 import { ApplicationsAPIImpl, createMonacoWebSocket, OrderbookAPIImpl, TradesAPIImpl } from "./api";
 import { AuthAPIImpl } from "./api/auth";
+import { BuildercodesAPIImpl } from "./api/buildercodes";
 import { DelegatedAgentsAPIImpl } from "./api/delegated-agents";
 import { FaucetAPIImpl } from "./api/faucet";
 import { FeesAPIImpl } from "./api/fees";
@@ -44,6 +45,7 @@ export class MonacoSDKImpl {
     delegatedAgents;
     applications;
     fees;
+    buildercodes;
     pitpass;
     vault;
     withdrawals;
@@ -75,6 +77,7 @@ export class MonacoSDKImpl {
         this.delegatedAgents.setSessionKeypair(credentials);
         this.applications.setSessionKeypair(credentials);
         this.fees.setSessionKeypair(credentials);
+        this.buildercodes.setSessionKeypair(credentials);
         this.pitpass.setSessionKeypair(credentials);
         this.vault.setSessionKeypair(credentials);
         this.withdrawals.setSessionKeypair(credentials);
@@ -115,6 +118,7 @@ export class MonacoSDKImpl {
         this.delegatedAgents.setServerKey(serverKey);
         this.applications.setServerKey(serverKey);
         this.fees.setServerKey(serverKey);
+        this.buildercodes.setServerKey(serverKey);
         this.pitpass.setServerKey(serverKey);
         this.vault.setServerKey(serverKey);
         this.withdrawals.setServerKey(serverKey);
@@ -198,6 +202,7 @@ export class MonacoSDKImpl {
         this.auth = configureSigning(new AuthAPIImpl(this.walletClient, this.chain, apiUrl));
         this.delegatedAgents = configureSigning(new DelegatedAgentsAPIImpl(apiUrl));
         this.fees = configureSigning(new FeesAPIImpl(apiUrl));
+        this.buildercodes = configureSigning(new BuildercodesAPIImpl(apiUrl));
         this.pitpass = configureSigning(new PitpassAPIImpl(apiUrl));
         this.profile = configureSigning(new ProfileAPIImpl(apiUrl));
         this.vault = configureSigning(new VaultAPIImpl(this.publicClient, this.walletClient, this.chain, this.applications, this.profile, apiUrl));

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@0xmonaco/core",
-	"version": "1.0.56",
+	"version": "1.0.58-develop.f12e78b",
 	"type": "module",
 	"homepage": "https://docs.0xmonaco.com/sdk/typescript",
 	"main": "./dist/index.js",
@@ -19,10 +19,10 @@
 		"viem": "^2.45.2"
 	},
 	"dependencies": {
-		"@0xmonaco/contracts": "1.0.56",
-		"@0xmonaco/types": "1.0.56",
+		"@0xmonaco/contracts": "1.0.58-develop.f12e78b",
+		"@0xmonaco/types": "1.0.58-develop.f12e78b",
 		"@noble/curves": "^1.9.1",
-		"@noble/hashes": "^1.8.0",
+		"@noble/hashes": "^2.4.0",
 		"http-status-codes": "^2.3.0"
 	},
 	"devDependencies": {