@0xmonaco/core 1.0.73 → 1.0.75

package/README.md

@@ -19,7 +19,6 @@ npm install viem@^2.31.7
 - **Session-key Authentication**: Noncustodial ed25519 session keys — the server never holds a credential that can impersonate you
 - **Wallet Signature Verification**: EIP-712 signature authorizes each session key
 - **Session Refresh**: Extend session expiry without re-prompting the wallet
-- **Server-key Auth**: Optional `sk_...` application key for backend/service access
 
 ### 🏦 **Vault Operations**
 - **Token Approvals**: ERC20 token approvals for vault usage
@@ -280,9 +279,6 @@ await sdk.logout(); // Automatically calls revokeSession internally
 - `getAuthState()` - Get current auth state with the session keypair
 - `setAuthState(authState)` - Set auth state directly (useful for sharing across SDK instances)
 
-**Server-key Auth (backend/service access):**
-- `setServerKey(serverKey)` - Authenticate with an application secret key (`sk_...`) instead of, or alongside, a session. Useful for server-side integrations.
-
 ### Vault API
 
 The vault API provides secure token management operations:
@@ -513,7 +509,6 @@ bun run lint --filter @0xmonaco/core
 - **Noncustodial**: ed25519 session keys are generated locally; the server never holds a credential that can impersonate you
 - **EIP-712 login**: Wallet signature authorizes each session key
 - **Session refresh**: Extend expiry without re-prompting the wallet
-- **Server-key auth**: Optional `sk_...` application key for backend/service access
 
 ### API Gateway Integration
 - **Secure communication**: TLS encryption for all API calls

package/dist/api/applications/api.d.ts

@@ -1,10 +1,10 @@
 /**
  * Applications API Implementation
  *
- * Handles application configuration and reporting operations. This is a
- * mixed-auth domain: `getApplicationConfig` is session-authenticated, while
- * the reporting methods are backend-authenticated via the application secret
- * key (set with {@link BaseAPI.setServerKey}, sent as `x-server-key`).
+ * Handles application configuration and reporting operations.
+ * `getApplicationConfig` is session-authenticated; the reporting methods are
+ * public, select their application by `clientId`, and are rate limited per
+ * client IP.
  *
  * @example
  * ```typescript
@@ -14,9 +14,8 @@
  * const config = await applicationsAPI.getApplicationConfig();
  * console.log(`App name: ${config.name}`);
  *
- * // Reporting endpoints (backend auth)
- * applicationsAPI.setServerKey("sk_live_...");
- * const orders = await applicationsAPI.listApplicationOrders({ status: "FILLED" });
+ * // Reporting endpoints (public, selected by client ID)
+ * const orders = await applicationsAPI.listApplicationOrders({ clientId: config.clientId, status: "FILLED" });
  * ```
  */
 import type { ApplicationConfigResponse, ApplicationsAPI, GetAppStatsParams, GetAppStatsResponse, ListAppBalancesParams, ListAppBalancesResponse, ListAppMovementsParams, ListAppMovementsResponse, ListAppOrdersParams, ListAppOrdersResponse, ListAppUsersParams, ListAppUsersResponse } from "@0xmonaco/types";
@@ -45,52 +44,84 @@ export declare class ApplicationsAPIImpl extends BaseAPI implements Applications
     /**
      * Lists orders placed by the application's users.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of orders
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
-    listApplicationOrders(params?: ListAppOrdersParams): Promise<ListAppOrdersResponse>;
+    listApplicationOrders(params: ListAppOrdersParams): Promise<ListAppOrdersResponse>;
     /**
      * Lists the application's users.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of users
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
-    listApplicationUsers(params?: ListAppUsersParams): Promise<ListAppUsersResponse>;
+    listApplicationUsers(params: ListAppUsersParams): Promise<ListAppUsersResponse>;
     /**
      * Lists ledger movements for the application's users.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of movements
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
-    listApplicationMovements(params?: ListAppMovementsParams): Promise<ListAppMovementsResponse>;
+    listApplicationMovements(params: ListAppMovementsParams): Promise<ListAppMovementsResponse>;
     /**
      * Lists user balances held within the application.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of balances
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
-    listApplicationBalances(params?: ListAppBalancesParams): Promise<ListAppBalancesResponse>;
+    listApplicationBalances(params: ListAppBalancesParams): Promise<ListAppBalancesResponse>;
     /**
      * Gets aggregate volume and fee stats for the application.
      *
      * Stats are scoped to trades where the application's users were the taker.
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
      *
      * @param params - Optional `since` filter
      * @returns Promise resolving to the application stats
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
-    getApplicationStats(params?: GetAppStatsParams): Promise<GetAppStatsResponse>;
+    getApplicationStats(params: GetAppStatsParams): Promise<GetAppStatsResponse>;
 }

package/dist/api/applications/api.js

@@ -1,10 +1,10 @@
 /**
  * Applications API Implementation
  *
- * Handles application configuration and reporting operations. This is a
- * mixed-auth domain: `getApplicationConfig` is session-authenticated, while
- * the reporting methods are backend-authenticated via the application secret
- * key (set with {@link BaseAPI.setServerKey}, sent as `x-server-key`).
+ * Handles application configuration and reporting operations.
+ * `getApplicationConfig` is session-authenticated; the reporting methods are
+ * public, select their application by `clientId`, and are rate limited per
+ * client IP.
  *
  * @example
  * ```typescript
@@ -14,11 +14,11 @@
  * const config = await applicationsAPI.getApplicationConfig();
  * console.log(`App name: ${config.name}`);
  *
- * // Reporting endpoints (backend auth)
- * applicationsAPI.setServerKey("sk_live_...");
- * const orders = await applicationsAPI.listApplicationOrders({ status: "FILLED" });
+ * // Reporting endpoints (public, selected by client ID)
+ * const orders = await applicationsAPI.listApplicationOrders({ clientId: config.clientId, status: "FILLED" });
  * ```
  */
+import { ListAppBalancesSchema, ListAppMovementsSchema, ListAppOrdersSchema, ListAppUsersSchema, validate } from "@0xmonaco/types";
 import { BaseAPI } from "../base";
 import { perpRoutes } from "../perp/routes";
 export class ApplicationsAPIImpl extends BaseAPI {
@@ -57,62 +57,128 @@ export class ApplicationsAPIImpl extends BaseAPI {
     /**
      * Lists orders placed by the application's users.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of orders
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
     async listApplicationOrders(params) {
-        return await this.makeBackendRequest(perpRoutes.applications.orders(params));
+        validate(ListAppOrdersSchema, params);
+        return await this.makePublicRequest(perpRoutes.applications.orders({
+            clientId: params.clientId,
+            pageSize: params.pageSize,
+            pageToken: params.pageToken,
+            status: params.status,
+            userId: params.userId,
+            tradingPairId: params.tradingPairId,
+            side: params.side,
+            orderType: params.orderType,
+        }));
     }
     /**
      * Lists the application's users.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of users
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
     async listApplicationUsers(params) {
-        return await this.makeBackendRequest(perpRoutes.applications.users(params));
+        validate(ListAppUsersSchema, params);
+        return await this.makePublicRequest(perpRoutes.applications.users({
+            clientId: params.clientId,
+            pageSize: params.pageSize,
+            pageToken: params.pageToken,
+            isActive: params.isActive,
+            accountType: params.accountType,
+            address: params.address,
+        }));
     }
     /**
      * Lists ledger movements for the application's users.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of movements
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
     async listApplicationMovements(params) {
-        return await this.makeBackendRequest(perpRoutes.applications.movements(params));
+        validate(ListAppMovementsSchema, params);
+        return await this.makePublicRequest(perpRoutes.applications.movements({
+            clientId: params.clientId,
+            pageSize: params.pageSize,
+            pageToken: params.pageToken,
+            userId: params.userId,
+            transactionType: params.transactionType,
+            entryType: params.entryType,
+            assetId: params.assetId,
+        }));
     }
     /**
      * Lists user balances held within the application.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of balances
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
     async listApplicationBalances(params) {
-        return await this.makeBackendRequest(perpRoutes.applications.balances(params));
+        validate(ListAppBalancesSchema, params);
+        return await this.makePublicRequest(perpRoutes.applications.balances({
+            clientId: params.clientId,
+            pageSize: params.pageSize,
+            pageToken: params.pageToken,
+            userId: params.userId,
+            assetId: params.assetId,
+        }));
     }
     /**
      * Gets aggregate volume and fee stats for the application.
      *
      * Stats are scoped to trades where the application's users were the taker.
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
      *
      * @param params - Optional `since` filter
      * @returns Promise resolving to the application stats
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
     async getApplicationStats(params) {
-        return await this.makeBackendRequest(perpRoutes.applications.stats(params));
+        return await this.makePublicRequest(perpRoutes.applications.stats({ clientId: params.clientId, since: params.since }));
     }
 }

package/dist/api/auth/api.d.ts

@@ -5,9 +5,7 @@
  * verification, and session lifecycle. All operations go through the API Gateway.
  *
  * This class provides a complete interface for wallet-based authentication on the
- * Monaco protocol. Backend services authenticate separately by setting their
- * application secret key (`sk_...`) via {@link BaseAPI.setServerKey}, which is sent
- * in the `x-server-key` header on backend requests — there is no token exchange.
+ * Monaco protocol.
  *
  * @example
  * ```typescript

package/dist/api/auth/api.js

@@ -5,9 +5,7 @@
  * verification, and session lifecycle. All operations go through the API Gateway.
  *
  * This class provides a complete interface for wallet-based authentication on the
- * Monaco protocol. Backend services authenticate separately by setting their
- * application secret key (`sk_...`) via {@link BaseAPI.setServerKey}, which is sent
- * in the `x-server-key` header on backend requests — there is no token exchange.
+ * Monaco protocol.
  *
  * @example
  * ```typescript

package/dist/api/base.d.ts

@@ -31,8 +31,6 @@ export declare abstract class BaseAPI {
     protected readonly apiUrl: string;
     /** Active session keypair (raw bytes) used to sign authenticated requests. */
     protected sessionKeypair?: SessionKeypair;
-    /** Application secret key (`sk_...`) sent in the `x-server-key` header for backend-authenticated requests. */
-    protected serverKey?: string;
     private requestSigning;
     private redirectPolicy?;
     /** Server time learned from responses; signing timestamps are read from it. */
@@ -57,19 +55,6 @@ export declare abstract class BaseAPI {
      * @param credentials - Hex-encoded session keypair, or `undefined` to clear.
      */
     setSessionKeypair(credentials: SessionCredentials | undefined): void;
-    /**
-     * Set (or clear) the application secret key used for backend-authenticated
-     * requests.
-     *
-     * Backend endpoints (those annotated `#[require_backend]` on the gateway)
-     * authenticate with a static application secret key rather than a session
-     * signature. When set, the raw key is sent verbatim in the `x-server-key`
-     * header on every {@link makeBackendRequest}. This is independent of the
-     * session keypair — a client may hold both.
-     *
-     * @param serverKey - The application secret key (`sk_...`), or `undefined` to clear.
-     */
-    setServerKey(serverKey: string | undefined): void;
     /**
      * Parse request body for error logging
      *
@@ -126,26 +111,6 @@ export declare abstract class BaseAPI {
      * and covers the final URL path/query plus Content-Digest.
      */
     private buildSignatureHeaders;
-    /**
-     * Makes a backend-authenticated API request using the application secret key.
-     *
-     * Sends the raw `sk_...` key (set via {@link setServerKey}) in the
-     * `x-server-key` header. The gateway hashes and matches it against the
-     * application on every request — there is no signing and no token exchange.
-     * Use this for endpoints annotated `#[require_backend]`.
-     *
-     * @param endpoint - The API endpoint to call (should start with /)
-     * @param options - Request options (method, body, headers, etc.)
-     * @returns Promise resolving to the response data
-     * @throws {APIError} When the server key is not set or the API request fails
-     *
-     * @example
-     * ```typescript
-     * this.setServerKey("sk_live_...");
-     * const orders = await this.makeBackendRequest<ListAppOrdersResponse>('/api/v1/applications/orders');
-     * ```
-     */
-    protected makeBackendRequest<T>(endpoint: string, options?: RequestInit): Promise<T>;
     /**
      * Makes an unauthenticated API request.
      *

package/dist/api/base.js

@@ -41,8 +41,6 @@ export class BaseAPI {
     apiUrl;
     /** Active session keypair (raw bytes) used to sign authenticated requests. */
     sessionKeypair;
-    /** Application secret key (`sk_...`) sent in the `x-server-key` header for backend-authenticated requests. */
-    serverKey;
     requestSigning = "legacy";
     redirectPolicy;
     /** Server time learned from responses; signing timestamps are read from it. */
@@ -83,21 +81,6 @@ export class BaseAPI {
     setSessionKeypair(credentials) {
         this.sessionKeypair = credentials ? keypairFromHex(credentials.publicKey, credentials.privateKey) : undefined;
     }
-    /**
-     * Set (or clear) the application secret key used for backend-authenticated
-     * requests.
-     *
-     * Backend endpoints (those annotated `#[require_backend]` on the gateway)
-     * authenticate with a static application secret key rather than a session
-     * signature. When set, the raw key is sent verbatim in the `x-server-key`
-     * header on every {@link makeBackendRequest}. This is independent of the
-     * session keypair — a client may hold both.
-     *
-     * @param serverKey - The application secret key (`sk_...`), or `undefined` to clear.
-     */
-    setServerKey(serverKey) {
-        this.serverKey = serverKey;
-    }
     /**
      * Parse request body for error logging
      *
@@ -374,43 +357,6 @@ export class BaseAPI {
             "X-Monaco-Signature": signature,
         };
     }
-    /**
-     * Makes a backend-authenticated API request using the application secret key.
-     *
-     * Sends the raw `sk_...` key (set via {@link setServerKey}) in the
-     * `x-server-key` header. The gateway hashes and matches it against the
-     * application on every request — there is no signing and no token exchange.
-     * Use this for endpoints annotated `#[require_backend]`.
-     *
-     * @param endpoint - The API endpoint to call (should start with /)
-     * @param options - Request options (method, body, headers, etc.)
-     * @returns Promise resolving to the response data
-     * @throws {APIError} When the server key is not set or the API request fails
-     *
-     * @example
-     * ```typescript
-     * this.setServerKey("sk_live_...");
-     * const orders = await this.makeBackendRequest<ListAppOrdersResponse>('/api/v1/applications/orders');
-     * ```
-     */
-    async makeBackendRequest(endpoint, options = {}) {
-        if (!this.serverKey) {
-            throw new APIError("Server key not set. Call setServerKey(sk_...) first.", {
-                endpoint: `${this.apiUrl}${endpoint}`,
-                statusCode: StatusCodes.UNAUTHORIZED,
-            });
-        }
-        const url = `${this.apiUrl}${endpoint}`;
-        const requestBody = this.parseRequestBody(options.body);
-        return this.executeRequest(url, endpoint, {
-            ...options,
-            headers: {
-                "Content-Type": "application/json",
-                "x-server-key": this.serverKey,
-                ...options.headers,
-            },
-        }, requestBody);
-    }
     /**
      * Makes an unauthenticated API request.
      *

package/dist/api/buildercodes/api.d.ts

@@ -36,9 +36,9 @@ export declare class BuildercodesAPIImpl extends BaseAPI implements Buildercodes
     listBuilderFeeChanges(params?: ListBuilderFeeChangesParams): Promise<ListBuilderFeeChangesResponse>;
     /**
      * List this frontend's per-trade BuilderCodes credits, newest first. Each
-     * credit carries its payout `kind`. `REVENUE_SHARE` is active;
-     * `BUILDER_FEE` is reserved and is not currently emitted. Pass `kind` to
-     * filter the list; `total` then counts only that category.
+     * credit carries its payout `kind`: `REVENUE_SHARE` for Monaco revenue share
+     * or `BUILDER_FEE` for builder fees charged to takers. Pass `kind` to filter
+     * the list; `total` then counts only that category.
      *
      * The server scopes every query to the authenticated application; neither
      * the application id nor payout wallet can be supplied by the caller.

package/dist/api/buildercodes/api.js

@@ -128,9 +128,9 @@ export class BuildercodesAPIImpl extends BaseAPI {
     }
     /**
      * List this frontend's per-trade BuilderCodes credits, newest first. Each
-     * credit carries its payout `kind`. `REVENUE_SHARE` is active;
-     * `BUILDER_FEE` is reserved and is not currently emitted. Pass `kind` to
-     * filter the list; `total` then counts only that category.
+     * credit carries its payout `kind`: `REVENUE_SHARE` for Monaco revenue share
+     * or `BUILDER_FEE` for builder fees charged to takers. Pass `kind` to filter
+     * the list; `total` then counts only that category.
      *
      * The server scopes every query to the authenticated application; neither
      * the application id nor payout wallet can be supplied by the caller.

package/dist/api/delegated-agents/api.js

@@ -16,6 +16,7 @@ export class DelegatedAgentsAPIImpl extends BaseAPI {
                 maxLeverage: request.maxLeverage,
                 maxOrderNotional: request.maxOrderNotional,
                 maxOpenOrders: request.maxOpenOrders,
+                ipAllowlist: request.ipAllowlist,
             }),
         });
     }

package/dist/api/margin-accounts/api.d.ts

@@ -1,6 +1,12 @@
-import type { GetAvailableCollateralParams, GetAvailableCollateralResponse, GetMarginAccountMovementsParams, GetMarginAccountMovementsResponse, GetMarginAccountSummaryParams, ListMarginAccountsParams, ListMarginAccountsResponse, MarginAccountSummary, MarginAccountsAPI, SimulateOrderRiskRequest, SimulateOrderRiskResponse, SimulateRiskBucketOrderRiskRequest, TransferCollateralFromParentMarginAccountRequest, TransferCollateralRequest, TransferCollateralResponse, TransferCollateralToParentMarginAccountRequest, TransferCollateralToRiskBucketRequest } from "@0xmonaco/types";
+import type { CloseMarginSubAccountResponse, CreateMarginSubAccountRequest, CreateMarginSubAccountResponse, GetAvailableCollateralParams, GetAvailableCollateralResponse, GetMarginAccountMovementsParams, GetMarginAccountMovementsResponse, GetMarginAccountSummaryParams, ListMarginAccountsParams, ListMarginAccountsResponse, MarginAccountPnl, MarginAccountSummary, MarginAccountsAPI, SimulateOrderRiskRequest, SimulateOrderRiskResponse, SimulateRiskBucketOrderRiskRequest, TransferCollateralFromParentMarginAccountRequest, TransferCollateralRequest, TransferCollateralResponse, TransferCollateralToParentMarginAccountRequest, TransferCollateralToRiskBucketRequest, TransferMarginCollateralRequest, TransferMarginCollateralResponse } from "@0xmonaco/types";
 import { BaseAPI } from "../base";
 export declare class MarginAccountsAPIImpl extends BaseAPI implements MarginAccountsAPI {
+    createMarginSubAccount(request: CreateMarginSubAccountRequest): Promise<CreateMarginSubAccountResponse>;
+    closeMarginSubAccount(marginAccountId: string): Promise<CloseMarginSubAccountResponse>;
+    getMarginAccountPnl(marginAccountId: string): Promise<MarginAccountPnl>;
+    transferMarginCollateral(request: TransferMarginCollateralRequest): Promise<TransferMarginCollateralResponse>;
+    transferCollateralToSubAccount(marginAccountId: string, amount: string): Promise<TransferMarginCollateralResponse>;
+    transferCollateralFromSubAccount(marginAccountId: string, amount: string): Promise<TransferMarginCollateralResponse>;
     listMarginAccounts(params?: ListMarginAccountsParams): Promise<ListMarginAccountsResponse>;
     getMarginAccountSummary(marginAccountId: string, params?: GetMarginAccountSummaryParams): Promise<MarginAccountSummary>;
     getParentMarginAccountSummary(params?: GetMarginAccountSummaryParams): Promise<MarginAccountSummary>;

package/dist/api/margin-accounts/api.js

@@ -1,15 +1,59 @@
-import { GetAvailableCollateralSchema, GetMarginAccountMovementsSchema, GetMarginAccountSummarySchema, GetParentMarginAccountMovementsSchema, GetParentMarginAccountSummarySchema, ListMarginAccountsSchema, SimulateOrderRiskSchema, SimulateParentMarginOrderRiskSchema, SimulateRiskBucketOrderRiskSchema, TransferCollateralFromParentMarginAccountSchema, TransferCollateralSchema, TransferCollateralToParentMarginAccountSchema, TransferCollateralToRiskBucketSchema, validate, } from "@0xmonaco/types";
+import { CloseMarginSubAccountSchema, CreateMarginSubAccountSchema, GetAvailableCollateralSchema, GetMarginAccountMovementsSchema, GetMarginAccountPnlSchema, GetMarginAccountSummarySchema, GetParentMarginAccountMovementsSchema, GetParentMarginAccountSummarySchema, ListMarginAccountsSchema, SimulateOrderRiskSchema, SimulateParentMarginOrderRiskSchema, SimulateRiskBucketOrderRiskSchema, SubAccountCollateralTransferSchema, TransferCollateralFromParentMarginAccountSchema, TransferCollateralSchema, TransferCollateralToParentMarginAccountSchema, TransferCollateralToRiskBucketSchema, TransferMarginCollateralSchema, validate, } from "@0xmonaco/types";
 import { BaseAPI } from "../base";
 import { perpRoutes } from "../perp";
 export class MarginAccountsAPIImpl extends BaseAPI {
+    async createMarginSubAccount(request) {
+        validate(CreateMarginSubAccountSchema, { request });
+        return await this.makeAuthenticatedRequest(perpRoutes.marginAccounts.createSubAccount(), {
+            method: "POST",
+            body: JSON.stringify({ subaccountKey: request.subaccountKey, label: request.label }),
+        });
+    }
+    async closeMarginSubAccount(marginAccountId) {
+        validate(CloseMarginSubAccountSchema, { marginAccountId });
+        return await this.makeAuthenticatedRequest(perpRoutes.marginAccounts.closeSubAccount(marginAccountId), {
+            method: "POST",
+            body: JSON.stringify({}),
+        });
+    }
+    async getMarginAccountPnl(marginAccountId) {
+        validate(GetMarginAccountPnlSchema, { marginAccountId });
+        return await this.makeAuthenticatedRequest(perpRoutes.marginAccounts.pnl(marginAccountId));
+    }
+    async transferMarginCollateral(request) {
+        validate(TransferMarginCollateralSchema, { request });
+        return await this.makeAuthenticatedRequest(perpRoutes.marginAccounts.transferCollateral(), {
+            method: "POST",
+            body: JSON.stringify({
+                asset: request.asset,
+                amount: request.amount,
+                from: request.from,
+                to: request.to,
+            }),
+        });
+    }
+    async transferCollateralToSubAccount(marginAccountId, amount) {
+        validate(SubAccountCollateralTransferSchema, { marginAccountId, amount });
+        return await this.makeAuthenticatedRequest(perpRoutes.marginAccounts.subAccountTransferIn(marginAccountId), {
+            method: "POST",
+            body: JSON.stringify({ amount }),
+        });
+    }
+    async transferCollateralFromSubAccount(marginAccountId, amount) {
+        validate(SubAccountCollateralTransferSchema, { marginAccountId, amount });
+        return await this.makeAuthenticatedRequest(perpRoutes.marginAccounts.subAccountTransferOut(marginAccountId), {
+            method: "POST",
+            body: JSON.stringify({ amount }),
+        });
+    }
     async listMarginAccounts(params) {
         if (params) {
             validate(ListMarginAccountsSchema, params);
         }
         return await this.makeAuthenticatedRequest(perpRoutes.marginAccounts.list(params
             ? {
-                page: params.page,
                 pageSize: params.pageSize,
+                pageToken: params.pageToken,
                 state: params.state,
                 tradingPairId: params.tradingPairId,
             }
@@ -69,6 +113,7 @@ export class MarginAccountsAPIImpl extends BaseAPI {
                 tradingPairId: request.tradingPairId,
                 strategyKey: request.strategyKey,
                 marginMode: request.marginMode,
+                marginAccountId: request.marginAccountId,
                 // No selectedTradingPairIds: cross scope is derived from trading, and
                 // the server ignores the deprecated field. Not sending it keeps a
                 // pre-upgrade caller's stale list from reaching the wire at all.
@@ -152,6 +197,7 @@ export class MarginAccountsAPIImpl extends BaseAPI {
                 tradingPairId: request.tradingPairId,
                 strategyKey: request.strategyKey,
                 marginMode: request.marginMode,
+                marginAccountId: request.marginAccountId,
                 // No selectedTradingPairIds: cross scope is derived from trading, and
                 // the server ignores the deprecated field. Not sending it keeps a
                 // pre-upgrade caller's stale list from reaching the wire at all.

package/dist/api/market/api.js

@@ -1,4 +1,4 @@
-import { GetCandlesticksByPairIdSchema, GetMarketMetadataSchema, validate } from "@0xmonaco/types";
+import { GetCandlesticksByPairIdSchema, GetMarketMetadataSchema, ListAllFundingHistorySchema, ListFundingHistorySchema, validate } from "@0xmonaco/types";
 import { BaseAPI } from "../base";
 import { perpRoutes } from "../perp";
 /**
@@ -102,9 +102,11 @@ export class MarketAPIImpl extends BaseAPI {
     }
     async listFundingHistory(tradingPairId, params) {
         validate(GetMarketMetadataSchema, { tradingPairId });
+        validate(ListFundingHistorySchema, params ?? {});
         return await this.makePublicRequest(perpRoutes.market.listFundingHistory(tradingPairId, params));
     }
     async listAllFundingHistory(params) {
+        validate(ListAllFundingHistorySchema, params ?? {});
         return await this.makePublicRequest(perpRoutes.market.listAllFundingHistory(params));
     }
     async getOpenInterest(tradingPairId) {