@0xmonaco/core 1.0.74 → 1.0.76

package/README.md

@@ -19,7 +19,6 @@ npm install viem@^2.31.7
 - **Session-key Authentication**: Noncustodial ed25519 session keys — the server never holds a credential that can impersonate you
 - **Wallet Signature Verification**: EIP-712 signature authorizes each session key
 - **Session Refresh**: Extend session expiry without re-prompting the wallet
-- **Server-key Auth**: Optional `sk_...` application key for backend/service access
 
 ### 🏦 **Vault Operations**
 - **Token Approvals**: ERC20 token approvals for vault usage
@@ -280,9 +279,6 @@ await sdk.logout(); // Automatically calls revokeSession internally
 - `getAuthState()` - Get current auth state with the session keypair
 - `setAuthState(authState)` - Set auth state directly (useful for sharing across SDK instances)
 
-**Server-key Auth (backend/service access):**
-- `setServerKey(serverKey)` - Authenticate with an application secret key (`sk_...`) instead of, or alongside, a session. Useful for server-side integrations.
-
 ### Vault API
 
 The vault API provides secure token management operations:
@@ -513,7 +509,6 @@ bun run lint --filter @0xmonaco/core
 - **Noncustodial**: ed25519 session keys are generated locally; the server never holds a credential that can impersonate you
 - **EIP-712 login**: Wallet signature authorizes each session key
 - **Session refresh**: Extend expiry without re-prompting the wallet
-- **Server-key auth**: Optional `sk_...` application key for backend/service access
 
 ### API Gateway Integration
 - **Secure communication**: TLS encryption for all API calls

package/dist/api/applications/api.d.ts

@@ -1,10 +1,10 @@
 /**
  * Applications API Implementation
  *
- * Handles application configuration and reporting operations. This is a
- * mixed-auth domain: `getApplicationConfig` is session-authenticated, while
- * the reporting methods are backend-authenticated via the application secret
- * key (set with {@link BaseAPI.setServerKey}, sent as `x-server-key`).
+ * Handles application configuration and reporting operations.
+ * `getApplicationConfig` is session-authenticated; the reporting methods are
+ * public, select their application by `clientId`, and are rate limited per
+ * client IP.
  *
  * @example
  * ```typescript
@@ -14,9 +14,8 @@
  * const config = await applicationsAPI.getApplicationConfig();
  * console.log(`App name: ${config.name}`);
  *
- * // Reporting endpoints (backend auth)
- * applicationsAPI.setServerKey("sk_live_...");
- * const orders = await applicationsAPI.listApplicationOrders({ status: "FILLED" });
+ * // Reporting endpoints (public, selected by client ID)
+ * const orders = await applicationsAPI.listApplicationOrders({ clientId: config.clientId, status: "FILLED" });
  * ```
  */
 import type { ApplicationConfigResponse, ApplicationsAPI, GetAppStatsParams, GetAppStatsResponse, ListAppBalancesParams, ListAppBalancesResponse, ListAppMovementsParams, ListAppMovementsResponse, ListAppOrdersParams, ListAppOrdersResponse, ListAppUsersParams, ListAppUsersResponse } from "@0xmonaco/types";
@@ -45,52 +44,84 @@ export declare class ApplicationsAPIImpl extends BaseAPI implements Applications
     /**
      * Lists orders placed by the application's users.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of orders
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
-    listApplicationOrders(params?: ListAppOrdersParams): Promise<ListAppOrdersResponse>;
+    listApplicationOrders(params: ListAppOrdersParams): Promise<ListAppOrdersResponse>;
     /**
      * Lists the application's users.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of users
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
-    listApplicationUsers(params?: ListAppUsersParams): Promise<ListAppUsersResponse>;
+    listApplicationUsers(params: ListAppUsersParams): Promise<ListAppUsersResponse>;
     /**
      * Lists ledger movements for the application's users.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of movements
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
-    listApplicationMovements(params?: ListAppMovementsParams): Promise<ListAppMovementsResponse>;
+    listApplicationMovements(params: ListAppMovementsParams): Promise<ListAppMovementsResponse>;
     /**
      * Lists user balances held within the application.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of balances
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
-    listApplicationBalances(params?: ListAppBalancesParams): Promise<ListAppBalancesResponse>;
+    listApplicationBalances(params: ListAppBalancesParams): Promise<ListAppBalancesResponse>;
     /**
      * Gets aggregate volume and fee stats for the application.
      *
      * Stats are scoped to trades where the application's users were the taker.
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
      *
      * @param params - Optional `since` filter
      * @returns Promise resolving to the application stats
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
-    getApplicationStats(params?: GetAppStatsParams): Promise<GetAppStatsResponse>;
+    getApplicationStats(params: GetAppStatsParams): Promise<GetAppStatsResponse>;
 }

package/dist/api/applications/api.js

@@ -1,10 +1,10 @@
 /**
  * Applications API Implementation
  *
- * Handles application configuration and reporting operations. This is a
- * mixed-auth domain: `getApplicationConfig` is session-authenticated, while
- * the reporting methods are backend-authenticated via the application secret
- * key (set with {@link BaseAPI.setServerKey}, sent as `x-server-key`).
+ * Handles application configuration and reporting operations.
+ * `getApplicationConfig` is session-authenticated; the reporting methods are
+ * public, select their application by `clientId`, and are rate limited per
+ * client IP.
  *
  * @example
  * ```typescript
@@ -14,11 +14,11 @@
  * const config = await applicationsAPI.getApplicationConfig();
  * console.log(`App name: ${config.name}`);
  *
- * // Reporting endpoints (backend auth)
- * applicationsAPI.setServerKey("sk_live_...");
- * const orders = await applicationsAPI.listApplicationOrders({ status: "FILLED" });
+ * // Reporting endpoints (public, selected by client ID)
+ * const orders = await applicationsAPI.listApplicationOrders({ clientId: config.clientId, status: "FILLED" });
  * ```
  */
+import { ListAppBalancesSchema, ListAppMovementsSchema, ListAppOrdersSchema, ListAppUsersSchema, validate } from "@0xmonaco/types";
 import { BaseAPI } from "../base";
 import { perpRoutes } from "../perp/routes";
 export class ApplicationsAPIImpl extends BaseAPI {
@@ -57,62 +57,128 @@ export class ApplicationsAPIImpl extends BaseAPI {
     /**
      * Lists orders placed by the application's users.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of orders
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
     async listApplicationOrders(params) {
-        return await this.makeBackendRequest(perpRoutes.applications.orders(params));
+        validate(ListAppOrdersSchema, params);
+        return await this.makePublicRequest(perpRoutes.applications.orders({
+            clientId: params.clientId,
+            pageSize: params.pageSize,
+            pageToken: params.pageToken,
+            status: params.status,
+            userId: params.userId,
+            tradingPairId: params.tradingPairId,
+            side: params.side,
+            orderType: params.orderType,
+        }));
     }
     /**
      * Lists the application's users.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of users
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
     async listApplicationUsers(params) {
-        return await this.makeBackendRequest(perpRoutes.applications.users(params));
+        validate(ListAppUsersSchema, params);
+        return await this.makePublicRequest(perpRoutes.applications.users({
+            clientId: params.clientId,
+            pageSize: params.pageSize,
+            pageToken: params.pageToken,
+            isActive: params.isActive,
+            accountType: params.accountType,
+            address: params.address,
+        }));
     }
     /**
      * Lists ledger movements for the application's users.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of movements
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
     async listApplicationMovements(params) {
-        return await this.makeBackendRequest(perpRoutes.applications.movements(params));
+        validate(ListAppMovementsSchema, params);
+        return await this.makePublicRequest(perpRoutes.applications.movements({
+            clientId: params.clientId,
+            pageSize: params.pageSize,
+            pageToken: params.pageToken,
+            userId: params.userId,
+            transactionType: params.transactionType,
+            entryType: params.entryType,
+            assetId: params.assetId,
+        }));
     }
     /**
      * Lists user balances held within the application.
      *
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
+     *
+     *
+     * Cursor paged (0XM-2822): omit `pageToken` or pass `""` to start, then
+     * follow `nextPageToken` until it comes back empty. There is no `page`: it
+     * is REJECTED here, not dropped. The params are forwarded field by field
+     * rather than spread, so a stray `page` would otherwise never reach the
+     * server's 400 and a loose (`any`) caller looping on it would be handed the
+     * first cursor page forever.
      *
      * @param params - Pagination and filter options
      * @returns Promise resolving to a paginated list of balances
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
     async listApplicationBalances(params) {
-        return await this.makeBackendRequest(perpRoutes.applications.balances(params));
+        validate(ListAppBalancesSchema, params);
+        return await this.makePublicRequest(perpRoutes.applications.balances({
+            clientId: params.clientId,
+            pageSize: params.pageSize,
+            pageToken: params.pageToken,
+            userId: params.userId,
+            assetId: params.assetId,
+        }));
     }
     /**
      * Gets aggregate volume and fee stats for the application.
      *
      * Stats are scoped to trades where the application's users were the taker.
-     * Backend-authenticated — call {@link BaseAPI.setServerKey} first.
+     * Public — the application is selected by `params.clientId`.
      *
      * @param params - Optional `since` filter
      * @returns Promise resolving to the application stats
-     * @throws {APIError} When the server key is unset or the request fails
+     * @throws {APIError} When the request fails (404 for an unknown client ID, 429 when rate limited)
      */
     async getApplicationStats(params) {
-        return await this.makeBackendRequest(perpRoutes.applications.stats(params));
+        return await this.makePublicRequest(perpRoutes.applications.stats({ clientId: params.clientId, since: params.since }));
     }
 }

package/dist/api/auth/api.d.ts

@@ -5,9 +5,7 @@
  * verification, and session lifecycle. All operations go through the API Gateway.
  *
  * This class provides a complete interface for wallet-based authentication on the
- * Monaco protocol. Backend services authenticate separately by setting their
- * application secret key (`sk_...`) via {@link BaseAPI.setServerKey}, which is sent
- * in the `x-server-key` header on backend requests — there is no token exchange.
+ * Monaco protocol.
  *
  * @example
  * ```typescript

package/dist/api/auth/api.js

@@ -5,9 +5,7 @@
  * verification, and session lifecycle. All operations go through the API Gateway.
  *
  * This class provides a complete interface for wallet-based authentication on the
- * Monaco protocol. Backend services authenticate separately by setting their
- * application secret key (`sk_...`) via {@link BaseAPI.setServerKey}, which is sent
- * in the `x-server-key` header on backend requests — there is no token exchange.
+ * Monaco protocol.
  *
  * @example
  * ```typescript

package/dist/api/base.d.ts

@@ -31,8 +31,6 @@ export declare abstract class BaseAPI {
     protected readonly apiUrl: string;
     /** Active session keypair (raw bytes) used to sign authenticated requests. */
     protected sessionKeypair?: SessionKeypair;
-    /** Application secret key (`sk_...`) sent in the `x-server-key` header for backend-authenticated requests. */
-    protected serverKey?: string;
     private requestSigning;
     private redirectPolicy?;
     /** Server time learned from responses; signing timestamps are read from it. */
@@ -57,19 +55,6 @@ export declare abstract class BaseAPI {
      * @param credentials - Hex-encoded session keypair, or `undefined` to clear.
      */
     setSessionKeypair(credentials: SessionCredentials | undefined): void;
-    /**
-     * Set (or clear) the application secret key used for backend-authenticated
-     * requests.
-     *
-     * Backend endpoints (those annotated `#[require_backend]` on the gateway)
-     * authenticate with a static application secret key rather than a session
-     * signature. When set, the raw key is sent verbatim in the `x-server-key`
-     * header on every {@link makeBackendRequest}. This is independent of the
-     * session keypair — a client may hold both.
-     *
-     * @param serverKey - The application secret key (`sk_...`), or `undefined` to clear.
-     */
-    setServerKey(serverKey: string | undefined): void;
     /**
      * Parse request body for error logging
      *
@@ -126,26 +111,6 @@ export declare abstract class BaseAPI {
      * and covers the final URL path/query plus Content-Digest.
      */
     private buildSignatureHeaders;
-    /**
-     * Makes a backend-authenticated API request using the application secret key.
-     *
-     * Sends the raw `sk_...` key (set via {@link setServerKey}) in the
-     * `x-server-key` header. The gateway hashes and matches it against the
-     * application on every request — there is no signing and no token exchange.
-     * Use this for endpoints annotated `#[require_backend]`.
-     *
-     * @param endpoint - The API endpoint to call (should start with /)
-     * @param options - Request options (method, body, headers, etc.)
-     * @returns Promise resolving to the response data
-     * @throws {APIError} When the server key is not set or the API request fails
-     *
-     * @example
-     * ```typescript
-     * this.setServerKey("sk_live_...");
-     * const orders = await this.makeBackendRequest<ListAppOrdersResponse>('/api/v1/applications/orders');
-     * ```
-     */
-    protected makeBackendRequest<T>(endpoint: string, options?: RequestInit): Promise<T>;
     /**
      * Makes an unauthenticated API request.
      *

package/dist/api/base.js

@@ -41,8 +41,6 @@ export class BaseAPI {
     apiUrl;
     /** Active session keypair (raw bytes) used to sign authenticated requests. */
     sessionKeypair;
-    /** Application secret key (`sk_...`) sent in the `x-server-key` header for backend-authenticated requests. */
-    serverKey;
     requestSigning = "legacy";
     redirectPolicy;
     /** Server time learned from responses; signing timestamps are read from it. */
@@ -83,21 +81,6 @@ export class BaseAPI {
     setSessionKeypair(credentials) {
         this.sessionKeypair = credentials ? keypairFromHex(credentials.publicKey, credentials.privateKey) : undefined;
     }
-    /**
-     * Set (or clear) the application secret key used for backend-authenticated
-     * requests.
-     *
-     * Backend endpoints (those annotated `#[require_backend]` on the gateway)
-     * authenticate with a static application secret key rather than a session
-     * signature. When set, the raw key is sent verbatim in the `x-server-key`
-     * header on every {@link makeBackendRequest}. This is independent of the
-     * session keypair — a client may hold both.
-     *
-     * @param serverKey - The application secret key (`sk_...`), or `undefined` to clear.
-     */
-    setServerKey(serverKey) {
-        this.serverKey = serverKey;
-    }
     /**
      * Parse request body for error logging
      *
@@ -374,43 +357,6 @@ export class BaseAPI {
             "X-Monaco-Signature": signature,
         };
     }
-    /**
-     * Makes a backend-authenticated API request using the application secret key.
-     *
-     * Sends the raw `sk_...` key (set via {@link setServerKey}) in the
-     * `x-server-key` header. The gateway hashes and matches it against the
-     * application on every request — there is no signing and no token exchange.
-     * Use this for endpoints annotated `#[require_backend]`.
-     *
-     * @param endpoint - The API endpoint to call (should start with /)
-     * @param options - Request options (method, body, headers, etc.)
-     * @returns Promise resolving to the response data
-     * @throws {APIError} When the server key is not set or the API request fails
-     *
-     * @example
-     * ```typescript
-     * this.setServerKey("sk_live_...");
-     * const orders = await this.makeBackendRequest<ListAppOrdersResponse>('/api/v1/applications/orders');
-     * ```
-     */
-    async makeBackendRequest(endpoint, options = {}) {
-        if (!this.serverKey) {
-            throw new APIError("Server key not set. Call setServerKey(sk_...) first.", {
-                endpoint: `${this.apiUrl}${endpoint}`,
-                statusCode: StatusCodes.UNAUTHORIZED,
-            });
-        }
-        const url = `${this.apiUrl}${endpoint}`;
-        const requestBody = this.parseRequestBody(options.body);
-        return this.executeRequest(url, endpoint, {
-            ...options,
-            headers: {
-                "Content-Type": "application/json",
-                "x-server-key": this.serverKey,
-                ...options.headers,
-            },
-        }, requestBody);
-    }
     /**
      * Makes an unauthenticated API request.
      *

package/dist/api/buildercodes/api.d.ts

@@ -62,10 +62,9 @@ export declare class BuildercodesAPIImpl extends BaseAPI implements Buildercodes
     /**
      * Claim accrued BuilderCodes payout balance into a trading balance.
      *
-     * Throws 403 when the caller is refused — either BuilderCodes is not
-     * enabled, or the session is a delegated agent. Delegated sessions are
-     * refused before the feature flag is read, so a 403 there is permanent for
-     * that session type rather than a rollout state.
+     * Throws 403 when the session is a delegated agent — permanent for that
+     * session type rather than a rollout state. No program switch gates the
+     * claim, so a balance already credited stays claimable.
      *
      * Throws 409 when the payout balance is insufficient for the requested
      * amount (including when the caller has never accrued a share).

package/dist/api/buildercodes/api.js

@@ -140,12 +140,12 @@ export class BuildercodesAPIImpl extends BaseAPI {
             validate(ListBuildercodePayoutsParamsSchema, params);
         }
         const searchParams = new URLSearchParams();
-        if (params?.page !== undefined) {
-            searchParams.append("page", params.page.toString());
-        }
         if (params?.pageSize !== undefined) {
             searchParams.append("pageSize", params.pageSize.toString());
         }
+        if (params?.pageToken !== undefined) {
+            searchParams.append("pageToken", params.pageToken);
+        }
         if (params?.kind !== undefined) {
             searchParams.append("kind", params.kind);
         }
@@ -175,10 +175,9 @@ export class BuildercodesAPIImpl extends BaseAPI {
     /**
      * Claim accrued BuilderCodes payout balance into a trading balance.
      *
-     * Throws 403 when the caller is refused — either BuilderCodes is not
-     * enabled, or the session is a delegated agent. Delegated sessions are
-     * refused before the feature flag is read, so a 403 there is permanent for
-     * that session type rather than a rollout state.
+     * Throws 403 when the session is a delegated agent — permanent for that
+     * session type rather than a rollout state. No program switch gates the
+     * claim, so a balance already credited stays claimable.
      *
      * Throws 409 when the payout balance is insufficient for the requested
      * amount (including when the caller has never accrued a share).

package/dist/api/managed-markets/index.js

@@ -1,12 +1,14 @@
+import { ListManagedMarketAssignmentsSchema, validate } from "@0xmonaco/types";
 import { BaseAPI } from "../base";
 /** Managed quote intents use the existing wallet session and never move funding. */
 export class ManagedMarketsAPIImpl extends BaseAPI {
     async listAssignments(request = {}) {
+        validate(ListManagedMarketAssignmentsSchema, request);
         const query = new URLSearchParams();
-        if (request.page !== undefined)
-            query.set("page", String(request.page));
         if (request.pageSize !== undefined)
             query.set("pageSize", String(request.pageSize));
+        if (request.pageToken !== undefined)
+            query.set("pageToken", request.pageToken);
         return this.makeAuthenticatedRequest(`/api/v1/managed-markets/assignments${query.size ? `?${query}` : ""}`);
     }
     async claimLease(launchId, request) {

package/dist/api/margin-accounts/api.d.ts

@@ -5,6 +5,8 @@ export declare class MarginAccountsAPIImpl extends BaseAPI implements MarginAcco
     closeMarginSubAccount(marginAccountId: string): Promise<CloseMarginSubAccountResponse>;
     getMarginAccountPnl(marginAccountId: string): Promise<MarginAccountPnl>;
     transferMarginCollateral(request: TransferMarginCollateralRequest): Promise<TransferMarginCollateralResponse>;
+    transferCollateralToSubAccount(marginAccountId: string, amount: string): Promise<TransferMarginCollateralResponse>;
+    transferCollateralFromSubAccount(marginAccountId: string, amount: string): Promise<TransferMarginCollateralResponse>;
     listMarginAccounts(params?: ListMarginAccountsParams): Promise<ListMarginAccountsResponse>;
     getMarginAccountSummary(marginAccountId: string, params?: GetMarginAccountSummaryParams): Promise<MarginAccountSummary>;
     getParentMarginAccountSummary(params?: GetMarginAccountSummaryParams): Promise<MarginAccountSummary>;

package/dist/api/margin-accounts/api.js

@@ -1,4 +1,4 @@
-import { CloseMarginSubAccountSchema, CreateMarginSubAccountSchema, GetAvailableCollateralSchema, GetMarginAccountMovementsSchema, GetMarginAccountPnlSchema, GetMarginAccountSummarySchema, GetParentMarginAccountMovementsSchema, GetParentMarginAccountSummarySchema, ListMarginAccountsSchema, SimulateOrderRiskSchema, SimulateParentMarginOrderRiskSchema, SimulateRiskBucketOrderRiskSchema, TransferCollateralFromParentMarginAccountSchema, TransferCollateralSchema, TransferCollateralToParentMarginAccountSchema, TransferCollateralToRiskBucketSchema, TransferMarginCollateralSchema, validate, } from "@0xmonaco/types";
+import { CloseMarginSubAccountSchema, CreateMarginSubAccountSchema, GetAvailableCollateralSchema, GetMarginAccountMovementsSchema, GetMarginAccountPnlSchema, GetMarginAccountSummarySchema, GetParentMarginAccountMovementsSchema, GetParentMarginAccountSummarySchema, ListMarginAccountsSchema, SimulateOrderRiskSchema, SimulateParentMarginOrderRiskSchema, SimulateRiskBucketOrderRiskSchema, SubAccountCollateralTransferSchema, TransferCollateralFromParentMarginAccountSchema, TransferCollateralSchema, TransferCollateralToParentMarginAccountSchema, TransferCollateralToRiskBucketSchema, TransferMarginCollateralSchema, validate, } from "@0xmonaco/types";
 import { BaseAPI } from "../base";
 import { perpRoutes } from "../perp";
 export class MarginAccountsAPIImpl extends BaseAPI {
@@ -32,14 +32,28 @@ export class MarginAccountsAPIImpl extends BaseAPI {
             }),
         });
     }
+    async transferCollateralToSubAccount(marginAccountId, amount) {
+        validate(SubAccountCollateralTransferSchema, { marginAccountId, amount });
+        return await this.makeAuthenticatedRequest(perpRoutes.marginAccounts.subAccountTransferIn(marginAccountId), {
+            method: "POST",
+            body: JSON.stringify({ amount }),
+        });
+    }
+    async transferCollateralFromSubAccount(marginAccountId, amount) {
+        validate(SubAccountCollateralTransferSchema, { marginAccountId, amount });
+        return await this.makeAuthenticatedRequest(perpRoutes.marginAccounts.subAccountTransferOut(marginAccountId), {
+            method: "POST",
+            body: JSON.stringify({ amount }),
+        });
+    }
     async listMarginAccounts(params) {
         if (params) {
             validate(ListMarginAccountsSchema, params);
         }
         return await this.makeAuthenticatedRequest(perpRoutes.marginAccounts.list(params
             ? {
-                page: params.page,
                 pageSize: params.pageSize,
+                pageToken: params.pageToken,
                 state: params.state,
                 tradingPairId: params.tradingPairId,
             }

package/dist/api/market/api.js

@@ -1,4 +1,4 @@
-import { GetCandlesticksByPairIdSchema, GetMarketMetadataSchema, validate } from "@0xmonaco/types";
+import { GetCandlesticksByPairIdSchema, GetMarketMetadataSchema, ListAllFundingHistorySchema, ListFundingHistorySchema, validate } from "@0xmonaco/types";
 import { BaseAPI } from "../base";
 import { perpRoutes } from "../perp";
 /**
@@ -102,9 +102,11 @@ export class MarketAPIImpl extends BaseAPI {
     }
     async listFundingHistory(tradingPairId, params) {
         validate(GetMarketMetadataSchema, { tradingPairId });
+        validate(ListFundingHistorySchema, params ?? {});
         return await this.makePublicRequest(perpRoutes.market.listFundingHistory(tradingPairId, params));
     }
     async listAllFundingHistory(params) {
+        validate(ListAllFundingHistorySchema, params ?? {});
         return await this.makePublicRequest(perpRoutes.market.listAllFundingHistory(params));
     }
     async getOpenInterest(tradingPairId) {