@0xmonaco/react 0.8.7 → 0.8.10

package/dist/coverage.d.ts

@@ -0,0 +1,85 @@
+/** operationId → the @0xmonaco/react hook that covers it. */
+export declare const COVERED: {
+    add_position_margin: string;
+    attach_position_tp_sl: string;
+    batch_cancel_all: string;
+    batch_cancel_all_by_pair: string;
+    batch_cancel_orders: string;
+    batch_create_orders: string;
+    batch_replace_orders: string;
+    cancel_conditional_order: string;
+    cancel_order: string;
+    close_position: string;
+    create_challenge: string;
+    create_order: string;
+    get_candles: string;
+    get_funding_state: string;
+    get_index_price: string;
+    get_mark_price: string;
+    get_market_metadata: string;
+    get_open_interest: string;
+    get_order_by_id: string;
+    get_orderbook_snapshot: string;
+    get_orders: string;
+    get_perp_market_config: string;
+    get_perp_market_summary: string;
+    get_position: string;
+    get_position_risk: string;
+    get_trades: string;
+    get_user_balance_by_asset: string;
+    get_user_balances: string;
+    get_user_movements: string;
+    get_user_profile: string;
+    get_withdrawal: string;
+    initiate_withdrawal: string;
+    list_conditional_orders: string;
+    list_funding_history: string;
+    list_position_history: string;
+    list_positions: string;
+    list_trading_pairs: string;
+    reduce_position_margin: string;
+    refresh_session: string;
+    replace_order: string;
+    revoke_session: string;
+    simulate_fees: string;
+};
+/** operationId → reason it is intentionally not covered by @0xmonaco/react. */
+export declare const INTENTIONALLY_EXCLUDED: {
+    authenticate_backend: string;
+    create_delegated_session: string;
+    create_sub_account_limit: string;
+    delete_sub_account_limit: string;
+    get_application_config: string;
+    get_application_stats: string;
+    get_available_collateral: string;
+    get_margin_account_movements: string;
+    get_margin_account_summary: string;
+    get_portfolio_chart: string;
+    get_portfolio_stats: string;
+    get_screener: string;
+    get_sub_account_limits: string;
+    get_trade_by_id: string;
+    get_trading_pair_by_id: string;
+    get_user_trades: string;
+    health_check: string;
+    list_application_balances: string;
+    list_application_movements: string;
+    list_application_orders: string;
+    list_application_users: string;
+    list_delegated_agent_owners: string;
+    list_delegated_agents: string;
+    list_funding_payments: string;
+    list_margin_accounts: string;
+    list_sub_accounts_with_balances: string;
+    mint_tokens: string;
+    revoke_delegated_agent: string;
+    simulate_auto_margin_order_risk: string;
+    simulate_order_risk: string;
+    submit_whitelist: string;
+    transfer_collateral_from_margin_account: string;
+    transfer_collateral_to_auto_margin_account: string;
+    transfer_collateral_to_margin_account: string;
+    update_sub_account_limit: string;
+    upsert_delegated_agent: string;
+    verify_signature: string;
+};

package/dist/coverage.js

@@ -0,0 +1,85 @@
+/** operationId → the @0xmonaco/react hook that covers it. */
+export const COVERED = {
+    add_position_margin: "usePositions",
+    attach_position_tp_sl: "usePositions",
+    batch_cancel_all: "useTrade",
+    batch_cancel_all_by_pair: "useTrade",
+    batch_cancel_orders: "useTrade",
+    batch_create_orders: "useTrade",
+    batch_replace_orders: "useTrade",
+    cancel_conditional_order: "useTrade",
+    cancel_order: "useTrade",
+    close_position: "usePositions",
+    create_challenge: "useAuth",
+    create_order: "useTrade",
+    get_candles: "useMarket",
+    get_funding_state: "useMarket",
+    get_index_price: "useMarket",
+    get_mark_price: "useMarket",
+    get_market_metadata: "useMarket",
+    get_open_interest: "useMarket",
+    get_order_by_id: "useTrade",
+    get_orderbook_snapshot: "useOrderbook",
+    get_orders: "useTrade",
+    get_perp_market_config: "useMarket",
+    get_perp_market_summary: "useMarket",
+    get_position: "usePositions",
+    get_position_risk: "usePositions",
+    get_trades: "useTradeFeed",
+    get_user_balance_by_asset: "useProfile",
+    get_user_balances: "useUserBalances",
+    get_user_movements: "useUserMovements",
+    get_user_profile: "useProfile",
+    get_withdrawal: "useVault (retryWithdrawal)",
+    initiate_withdrawal: "useVault (withdraw)",
+    list_conditional_orders: "useTrade",
+    list_funding_history: "useMarket",
+    list_position_history: "usePositions",
+    list_positions: "usePositions",
+    list_trading_pairs: "useMarket",
+    reduce_position_margin: "usePositions",
+    refresh_session: "useAuth",
+    replace_order: "useTrade",
+    revoke_session: "useAuth",
+    simulate_fees: "useFees",
+};
+/** operationId → reason it is intentionally not covered by @0xmonaco/react. */
+export const INTENTIONALLY_EXCLUDED = {
+    authenticate_backend: "Backend auth is header-based via setServerKey()/the x-server-key header, not an endpoint method (MON-1486).",
+    create_delegated_session: "Delegated-agent management is an automation/agent surface, not a UI workflow; no React hook.",
+    create_sub_account_limit: "Sub-account administration; no React hook.",
+    delete_sub_account_limit: "Sub-account administration; no React hook.",
+    get_application_config: "Application/backend (server-key) admin endpoint; not a user-wallet React workflow.",
+    get_application_stats: "Application/backend (server-key) admin endpoint; not a user-wallet React workflow.",
+    get_available_collateral: "Margin-account management/collateral/simulation endpoint; no React hook yet.",
+    get_margin_account_movements: "Margin-account management/collateral/simulation endpoint; no React hook yet.",
+    get_margin_account_summary: "Margin-account management/collateral/simulation endpoint; no React hook yet.",
+    get_portfolio_chart: "Portfolio analytics endpoint; no React hook yet.",
+    get_portfolio_stats: "Portfolio analytics endpoint; no React hook yet.",
+    get_screener: "Market lookup available via the core client / list+symbol hooks; no dedicated React hook.",
+    get_sub_account_limits: "Sub-account administration; no React hook.",
+    get_trade_by_id: "Trade-history lookup with a core client method but no dedicated React hook yet.",
+    get_trading_pair_by_id: "Market lookup available via the core client / list+symbol hooks; no dedicated React hook.",
+    get_user_trades: "Trade-history lookup with a core client method but no dedicated React hook yet.",
+    health_check: "Infrastructure liveness probe (GET /health); not part of the data SDK surface.",
+    list_application_balances: "Application/backend (server-key) admin endpoint; not a user-wallet React workflow.",
+    list_application_movements: "Application/backend (server-key) admin endpoint; not a user-wallet React workflow.",
+    list_application_orders: "Application/backend (server-key) admin endpoint; not a user-wallet React workflow.",
+    list_application_users: "Application/backend (server-key) admin endpoint; not a user-wallet React workflow.",
+    list_delegated_agent_owners: "Delegated-agent management is an automation/agent surface, not a UI workflow; no React hook.",
+    list_delegated_agents: "Delegated-agent management is an automation/agent surface, not a UI workflow; no React hook.",
+    list_funding_payments: "Perps funding-payment history; no React hook yet.",
+    list_margin_accounts: "Margin-account management/collateral/simulation endpoint; no React hook yet.",
+    list_sub_accounts_with_balances: "Sub-account administration; no React hook.",
+    mint_tokens: "Test-net faucet; no React hook (use the MCP/core faucet path).",
+    revoke_delegated_agent: "Delegated-agent management is an automation/agent surface, not a UI workflow; no React hook.",
+    simulate_auto_margin_order_risk: "Margin-account management/collateral/simulation endpoint; no React hook yet.",
+    simulate_order_risk: "Margin-account management/collateral/simulation endpoint; no React hook yet.",
+    submit_whitelist: "Whitelist submission; no React hook.",
+    transfer_collateral_from_margin_account: "Margin-account management/collateral/simulation endpoint; no React hook yet.",
+    transfer_collateral_to_auto_margin_account: "Margin-account management/collateral/simulation endpoint; no React hook yet.",
+    transfer_collateral_to_margin_account: "Margin-account management/collateral/simulation endpoint; no React hook yet.",
+    update_sub_account_limit: "Sub-account administration; no React hook.",
+    upsert_delegated_agent: "Delegated-agent management is an automation/agent surface, not a UI workflow; no React hook.",
+    verify_signature: "Auth verification runs inside login()/authenticate(); useAuth does not expose verifySignature as its own hook method.",
+};

package/dist/hooks/useAuth/types.d.ts

@@ -1,4 +1,4 @@
-import type { AuthState, ChallengeResponse, TokenRefreshResponse } from "@0xmonaco/types";
+import type { AuthState, ChallengeResponse, SessionRefreshResponse } from "@0xmonaco/types";
 import type { AuthenticationStatus } from "../../provider";
 export interface UseAuthState {
     /** Current authentication status */
@@ -6,25 +6,30 @@ export interface UseAuthState {
 }
 export interface UseAuthReturn extends UseAuthState {
     /**
-     * Complete authentication flow. Returns AuthState with accessToken and refreshToken.
+     * Complete authentication flow. Generates a session keypair, has the wallet
+     * authorize it, and returns the AuthState (including the session keypair).
      * @param options - Optional configuration
      * @param options.connectWebSocket - Auto-connect all authenticated WebSocket channels after login (currently Orders) (default: false)
      */
     login: (options?: {
         connectWebSocket?: boolean;
     }) => Promise<AuthState>;
-    /** Logout user and clear state. Revokes the refresh token on the server. */
+    /** Logout user and clear state. Revokes the session on the server. */
     logout: () => Promise<void>;
-    /** Refresh authentication tokens using the stored refresh token. */
+    /** Refresh the current session, extending its expiry. */
     refreshAuth: () => Promise<AuthState>;
     /** Sign a challenge message with the connected wallet. */
     signChallenge: (message: string) => Promise<string>;
-    /** Create authentication challenge for the given address. */
-    createChallenge: (address: string) => Promise<ChallengeResponse>;
-    /** Complete authentication with signature. Returns tokens. */
+    /**
+     * Create an authentication challenge for the given address, binding the
+     * provided session public key. Advanced/manual flow — most callers should
+     * use `login`/`authenticate`, which manage the keypair for you.
+     */
+    createChallenge: (address: string, sessionPublicKey: string) => Promise<ChallengeResponse>;
+    /** Complete authentication with signature. Returns the AuthState. */
     authenticate: () => Promise<AuthState>;
-    /** Refresh access token. Pass the refreshToken from authState. */
-    refreshToken: (refreshToken: string) => Promise<TokenRefreshResponse>;
-    /** Revoke the current session's refresh token on the server. */
-    revokeToken: () => Promise<void>;
+    /** Extend the current session's expiry (signed with the active session key). */
+    refreshSession: () => Promise<SessionRefreshResponse>;
+    /** Revoke the current session on the server. */
+    revokeSession: () => Promise<void>;
 }

package/dist/hooks/useAuth/useAuth.js

@@ -65,14 +65,16 @@ export const useAuth = () => {
             throw new Error("Message is required and cannot be empty");
         return await sdk.auth.signChallenge(message);
     }, [sdk]);
-    const createChallenge = useCallback(async (address) => {
+    const createChallenge = useCallback(async (address, sessionPublicKey) => {
         if (!sdk)
             throw new Error("SDK not available");
         if (!address?.trim())
             throw new Error("Address is required and cannot be empty");
+        if (!sessionPublicKey?.trim())
+            throw new Error("Session public key is required and cannot be empty");
         if (!clientId?.trim())
             throw new Error("Client ID is required and cannot be empty");
-        return await sdk.auth.createChallenge(address, clientId);
+        return await sdk.auth.createChallenge(address, clientId, sessionPublicKey);
     }, [sdk, clientId]);
     const authenticate = useCallback(async () => {
         if (!sdk)
@@ -84,26 +86,19 @@ export const useAuth = () => {
             const result = await sdk.auth.authenticate(clientId);
             const authenticated = sdk.isAuthenticated();
             setAuthenticationStatus(authenticated ? AuthenticationStatus.AUTHENTICATED : AuthenticationStatus.UNAUTHENTICATED);
-            return {
-                accessToken: result.accessToken,
-                refreshToken: result.refreshToken,
-                expiresAt: result.expiresAt,
-                user: result.user,
-            };
+            return result;
         }
         catch (error) {
             setAuthenticationStatus(AuthenticationStatus.UNAUTHENTICATED);
             throw error;
         }
     }, [sdk, clientId, setAuthenticationStatus]);
-    const refreshToken = useCallback(async (token) => {
+    const refreshSession = useCallback(async () => {
         if (!sdk)
             throw new Error("SDK not available");
-        if (!token?.trim())
-            throw new Error("Refresh token is required and cannot be empty");
         setAuthenticationStatus(AuthenticationStatus.AUTHENTICATING);
         try {
-            const result = await sdk.auth.refreshToken(token);
+            const result = await sdk.auth.refreshSession();
             const authenticated = sdk.isAuthenticated();
             setAuthenticationStatus(authenticated ? AuthenticationStatus.AUTHENTICATED : AuthenticationStatus.UNAUTHENTICATED);
             return result;
@@ -113,12 +108,12 @@ export const useAuth = () => {
             throw error;
         }
     }, [sdk, setAuthenticationStatus]);
-    const revokeToken = useCallback(async () => {
+    const revokeSession = useCallback(async () => {
         if (!sdk)
             throw new Error("SDK not available");
         setAuthenticationStatus(AuthenticationStatus.AUTHENTICATING);
         try {
-            await sdk.auth.revokeToken();
+            await sdk.auth.revokeSession();
             const authenticated = sdk.isAuthenticated();
             setAuthenticationStatus(authenticated ? AuthenticationStatus.AUTHENTICATED : AuthenticationStatus.UNAUTHENTICATED);
         }
@@ -133,10 +128,10 @@ export const useAuth = () => {
         // Primary auth actions
         login,
         logout,
-        // Token management
+        // Session management
         refreshAuth,
-        refreshToken,
-        revokeToken,
+        refreshSession,
+        revokeSession,
         // Low-level auth functions
         authenticate,
         signChallenge,

package/dist/hooks/useTokenLifecycle/useTokenLifecycle.js

@@ -53,8 +53,8 @@ export const useTokenLifecycle = (sdk, config = {}) => {
             return refreshPromiseRef.current;
         }
         const currentAuthState = currentAuthStateRef.current;
-        if (!currentAuthState?.refreshToken) {
-            console.warn("No refresh token available for token refresh");
+        if (!currentAuthState) {
+            console.warn("No active session available for refresh");
             return null;
         }
         const refreshPromise = (async () => {

package/dist/hooks/useTrade/types.d.ts

@@ -1,35 +1,13 @@
-import type { BatchCancelOrdersResponse, BatchCreateOrderParams, BatchCreateOrdersResponse, BatchReplaceOrderParams, BatchReplaceOrdersResponse, CancelConditionalOrderResponse, CancelOrderResponse, CreateConditionalOrderParams, CreateConditionalOrderResponse, CreateOrderResponse, GetOrderResponse, GetPaginatedOrdersParams, GetPaginatedOrdersResponse, ListConditionalOrdersParams, ListConditionalOrdersResponse, OrderSide, ParentTpSlLegParams, PositionSide, ReplaceOrderResponse, TimeInForce, TradingMode } from "@0xmonaco/types";
+import type { BatchCancelOrdersResponse, BatchCreateOrderParams, BatchCreateOrdersResponse, BatchReplaceOrderParams, BatchReplaceOrdersResponse, CancelConditionalOrderResponse, CancelOrderResponse, CreateOrderResponse, GetOrderResponse, GetPaginatedOrdersParams, GetPaginatedOrdersResponse, ListConditionalOrdersParams, ListConditionalOrdersResponse, OrderSide, ReplaceOrderResponse, TradingAPI } from "@0xmonaco/types";
+type PlaceLimitOrderOptions = NonNullable<Parameters<TradingAPI["placeLimitOrder"]>[4]>;
+type PlaceMarketOrderOptions = NonNullable<Parameters<TradingAPI["placeMarketOrder"]>[3]>;
 export interface UseTradeReturn {
     /** Place a limit order */
-    placeLimitOrder: (tradingPairId: string, side: OrderSide, quantity: string, price: string, options?: {
-        tradingMode?: TradingMode;
-        useMasterBalance?: boolean;
-        expirationDate?: string;
-        timeInForce?: TimeInForce;
-        marginAccountId?: string;
-        strategyKey?: string;
-        positionSide?: PositionSide;
-        leverage?: string;
-        reduceOnly?: boolean;
-        takeProfit?: ParentTpSlLegParams;
-        stopLoss?: ParentTpSlLegParams;
-    }) => Promise<CreateOrderResponse>;
+    placeLimitOrder: (tradingPairId: string, side: OrderSide, quantity: string, price: string, options?: PlaceLimitOrderOptions) => Promise<CreateOrderResponse>;
     /** Place a market order */
-    placeMarketOrder: (tradingPairId: string, side: OrderSide, quantity: string, options?: {
-        tradingMode?: TradingMode;
-        slippageTolerance?: number;
-        marginAccountId?: string;
-        strategyKey?: string;
-        positionSide?: PositionSide;
-        leverage?: string;
-        reduceOnly?: boolean;
-        takeProfit?: ParentTpSlLegParams;
-        stopLoss?: ParentTpSlLegParams;
-    }) => Promise<CreateOrderResponse>;
+    placeMarketOrder: (tradingPairId: string, side: OrderSide, quantity: string, options?: PlaceMarketOrderOptions) => Promise<CreateOrderResponse>;
     /** Cancel an existing order */
     cancelOrder: (orderId: string) => Promise<CancelOrderResponse>;
-    /** Create a standalone conditional TP/SL order */
-    createConditionalOrder: (params: CreateConditionalOrderParams) => Promise<CreateConditionalOrderResponse>;
     /** Cancel an active conditional TP/SL order */
     cancelConditionalOrder: (conditionalOrderId: string) => Promise<CancelConditionalOrderResponse>;
     /** List conditional TP/SL orders */
@@ -53,3 +31,4 @@ export interface UseTradeReturn {
     /** Get a single order by ID */
     getOrder: (orderId: string) => Promise<GetOrderResponse>;
 }
+export {};

package/dist/hooks/useTrade/useTrade.js

@@ -39,11 +39,6 @@ export const useTrade = () => {
             throw new Error("Order ID is required and cannot be empty");
         return await sdk.trading.cancelOrder(orderId);
     }, [sdk]);
-    const createConditionalOrder = useCallback(async (params) => {
-        if (!sdk)
-            throw new Error("SDK not available");
-        return await sdk.trading.createConditionalOrder(params);
-    }, [sdk]);
     const cancelConditionalOrder = useCallback(async (conditionalOrderId) => {
         if (!sdk)
             throw new Error("SDK not available");
@@ -117,7 +112,6 @@ export const useTrade = () => {
         placeMarketOrder,
         // Order management
         cancelOrder,
-        createConditionalOrder,
         cancelConditionalOrder,
         listConditionalOrders,
         batchCancel,

package/dist/utils/tokenStorage.d.ts

@@ -2,14 +2,18 @@ import type { AuthState } from "@0xmonaco/types";
 /**
  * Save auth state to localStorage
  *
- * @security This function stores authentication tokens (including refresh tokens) in localStorage,
- * which is accessible to any JavaScript running on the page. This makes tokens vulnerable to XSS attacks.
+ * @security This function stores the session keypair (including the private
+ * key) in localStorage, which is accessible to any JavaScript running on the
+ * page. This is the same XSS exposure as the previous JWT-based scheme — an
+ * attacker who can read localStorage can act as the user until the session
+ * expires either way.
  *
  * Security recommendations:
  * - Implement Content Security Policy (CSP) headers to mitigate XSS risks
  * - Sanitize all user input to prevent XSS vulnerabilities
  * - Consider the tradeoffs: localStorage provides persistence across sessions but sacrifices XSS protection
- * - For high-security requirements, consider httpOnly cookies (requires backend changes)
+ * - For higher-security requirements, back the session key with a
+ *   non-extractable WebCrypto key (out of scope for this default helper)
  *
  * @param authState - The authentication state to persist
  */

package/dist/utils/tokenStorage.js

@@ -5,22 +5,26 @@ const STORAGE_KEY = "monaco_auth_state";
 /**
  * Save auth state to localStorage
  *
- * @security This function stores authentication tokens (including refresh tokens) in localStorage,
- * which is accessible to any JavaScript running on the page. This makes tokens vulnerable to XSS attacks.
+ * @security This function stores the session keypair (including the private
+ * key) in localStorage, which is accessible to any JavaScript running on the
+ * page. This is the same XSS exposure as the previous JWT-based scheme — an
+ * attacker who can read localStorage can act as the user until the session
+ * expires either way.
  *
  * Security recommendations:
  * - Implement Content Security Policy (CSP) headers to mitigate XSS risks
  * - Sanitize all user input to prevent XSS vulnerabilities
  * - Consider the tradeoffs: localStorage provides persistence across sessions but sacrifices XSS protection
- * - For high-security requirements, consider httpOnly cookies (requires backend changes)
+ * - For higher-security requirements, back the session key with a
+ *   non-extractable WebCrypto key (out of scope for this default helper)
  *
  * @param authState - The authentication state to persist
  */
 export function saveAuthState(authState) {
     try {
         const data = JSON.stringify({
-            accessToken: authState.accessToken,
-            refreshToken: authState.refreshToken,
+            sessionPublicKey: authState.sessionPublicKey,
+            sessionPrivateKey: authState.sessionPrivateKey,
             expiresAt: authState.expiresAt,
             user: authState.user,
         });
@@ -41,10 +45,10 @@ export function loadAuthState() {
             return null;
         const parsed = JSON.parse(data);
         // Validate required fields and types
-        if (typeof parsed.accessToken !== "string" ||
-            parsed.accessToken.length === 0 ||
-            typeof parsed.refreshToken !== "string" ||
-            parsed.refreshToken.length === 0 ||
+        if (typeof parsed.sessionPublicKey !== "string" ||
+            parsed.sessionPublicKey.length === 0 ||
+            typeof parsed.sessionPrivateKey !== "string" ||
+            parsed.sessionPrivateKey.length === 0 ||
             typeof parsed.expiresAt !== "number" ||
             !Number.isFinite(parsed.expiresAt) ||
             parsed.expiresAt <= 0 ||
@@ -58,8 +62,8 @@ export function loadAuthState() {
             return null;
         }
         return {
-            accessToken: parsed.accessToken,
-            refreshToken: parsed.refreshToken,
+            sessionPublicKey: parsed.sessionPublicKey,
+            sessionPrivateKey: parsed.sessionPrivateKey,
             expiresAt: parsed.expiresAt,
             user: parsed.user,
         };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@0xmonaco/react",
-	"version": "0.8.7",
+	"version": "0.8.10",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -20,8 +20,8 @@
 		"lint": "biome lint ."
 	},
 	"dependencies": {
-		"@0xmonaco/core": "0.8.7",
-		"@0xmonaco/types": "0.8.7"
+		"@0xmonaco/core": "0.8.10",
+		"@0xmonaco/types": "0.8.10"
 	},
 	"devDependencies": {
 		"@types/react": "^19.1.12",