@0xmonaco/types 1.0.57 → 1.0.58-develop.f12e78b

package/dist/wire/schema.d.ts

@@ -267,6 +267,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/accounts/self-trade-prevention": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get your self-trade-prevention default
+         * @description Get your self-trade-prevention default.
+         *
+         *      Return the authenticated wallet's self-trade-prevention default — the mode
+         *      applied when an order from this wallet family (every account sharing the
+         *      wallet address, across applications) would match against the family's own
+         *      resting order and the order itself names no override. `is_custom` is true
+         *      when the wallet has explicitly set a default; false means the platform
+         *      default (`CANCEL_MAKER`) is in effect.
+         */
+        get: operations["get_self_trade_prevention_default"];
+        /**
+         * Set your self-trade-prevention default
+         * @description Set your self-trade-prevention default.
+         *
+         *      Set the authenticated wallet's self-trade-prevention default to one of
+         *      `CANCEL_MAKER`, `CANCEL_TAKER`, `CANCEL_BOTH`, or `SKIP` (input is
+         *      case-insensitive; responses always carry these spellings). The default is
+         *      wallet-scoped — it covers every application and account sharing the wallet
+         *      address — and a per-order mode always overrides it. The write is sequenced
+         *      through the matching engine; on success the next order from the wallet
+         *      family already resolves the new mode. Delegated-agent sessions cannot
+         *      change it.
+         */
+        put: operations["set_self_trade_prevention_default"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/accounts/sub-accounts": {
         parameters: {
             query?: never;
@@ -545,8 +585,21 @@ export interface paths {
          * @description Create authentication challenge.
          *
          *      Generate a cryptographic challenge (nonce) for wallet-based authentication.
-         *      The user must sign the returned message with their private key to prove
-         *      ownership of the wallet.
+         *      The wallet must authorize the returned message to prove control of the
+         *      address. An EOA does that by signing it with its private key. A
+         *      smart-contract wallet has no private key and instead produces a signature
+         *      its own contract will accept, which Monaco checks under EIP-1271 — see
+         *      Verify.
+         *
+         *      The challenge is single-use and binds the session public key supplied here,
+         *      so it authorizes exactly one keypair, once. The lifetime is 5 minutes, or
+         *      30 minutes for EVERY address while contract-signature login is enabled on
+         *      the deployment — a multisig must collect owner approvals before it can
+         *      answer, and the window is uniform rather than eligibility-specific so this
+         *      unauthenticated endpoint cannot be used to probe which addresses hold a
+         *      BuilderCodes payout bucket. Widening it is cheap: a longer window is a
+         *      longer-lived offer to authorize one predetermined keypair once, never a
+         *      longer-lived credential.
          */
         post: operations["create_challenge"];
         delete?: never;
@@ -619,6 +672,30 @@ export interface paths {
          *      Verify the signed challenge message and create an authenticated session.
          *      Binds the caller-provided ed25519 session public key to the new session;
          *      subsequent requests are signed with the matching private key.
+         *
+         *      How the signature is checked depends on the address. Almost every address
+         *      is verified by recovering the signing key, exactly as before. EIP-1271
+         *      verification applies only to an address that is BOTH eligible for
+         *      contract-signature login AND has contract code deployed on chain: an
+         *      eligible payout wallet that is an ordinary EOA is still verified by
+         *      recovery. The two are mutually exclusive, and the request is identical
+         *      either way — `signature` carries whatever the wallet produced, and no
+         *      field changes. The one bound is length: a contract signature over 8192
+         *      decoded bytes is refused as invalid rather than forwarded to the chain,
+         *      which is far above any realistic owner set.
+         *
+         *      Because deciding that requires reading the chain, this adds one
+         *      client-visible outcome the recovery path does not have: UNAVAILABLE (REST
+         *      503). It is retryable and is NOT a verdict on the signature. It covers
+         *      three cases, and an eligible address can see any of them even when it turns
+         *      out to be an EOA, because the code lookup happens first: the chain did not
+         *      answer, it did not answer within the deadline, or the server declined to
+         *      ask because its own concurrent-verification capacity was full. That last
+         *      one is local saturation rather than a chain fault, so an operator
+         *      diagnosing it should check this service before the RPC endpoint.
+         *
+         *      A rejected signature is 401, and so is a contract that rejects by
+         *      REVERTING: that is the wallet answering "no", not a failure to ask.
          */
         post: operations["verify_signature"];
         delete?: never;
@@ -627,6 +704,180 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/buildercodes/config": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get your BuilderCodes program configuration
+         * @description Read this application's BuilderCodes program state.
+         *
+         *      The application is taken from the authenticated session; there is no
+         *      application id in the request. The caller must be the application's
+         *      configured payout wallet. This method is gated by `buildercodes_enabled`
+         *      like the rest of the service.
+         */
+        get: operations["get_buildercodes_config"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/buildercodes/payouts": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List your per-trade BuilderCodes earnings
+         * @description List this application's per-trade BuilderCodes earnings.
+         *
+         *      Newest credits are returned first. The application is taken from the
+         *      authenticated session and cannot be selected by the caller.
+         */
+        get: operations["list_buildercode_payouts"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/buildercodes/payouts/summary": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Summarize your BuilderCodes earnings
+         * @description Summarize this application's BuilderCodes earnings by token.
+         *
+         *      Amounts stay separated by token because they are RAW atomic units. The
+         *      application is taken from the authenticated session.
+         */
+        get: operations["get_buildercode_payout_summary"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/buildercodes/rewards/balance": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get your accrued BuilderCodes balance
+         * @description Read the caller's accrued BuilderCodes reward-bucket balances.
+         *
+         *      The bucket is derived from the authenticated wallet under the reserved
+         *      BuilderCodes application. Current enrollment is not required, so a former
+         *      payout wallet can still inspect and claim what it accrued. Returns an empty
+         *      list when no payout bucket or non-zero balance exists.
+         */
+        get: operations["get_buildercode_rewards_balance"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/buildercodes/rewards/claim": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Claim accrued BuilderCodes payout balance
+         * @description Claim accrued BuilderCodes payout balance.
+         *
+         *      Move accrued BuilderCodes payout balance from your reserved payout bucket
+         *      into a trading balance under the authenticated application, making it
+         *      withdrawable through the ordinary withdrawal flow. Ledger-only (one shared
+         *      vault + one backend ledger) — no on-chain transaction and no gas.
+         *
+         *      The bucket is resolved from the AUTHENTICATED caller's own wallet address,
+         *      never from the request body, so a caller can only ever claim their own
+         *      accrued balance. A wallet that has never been an enrolled frontend's payout
+         *      address simply has an empty bucket. A wallet that USED to be a payout
+         *      address keeps whatever it accrued back then and can still claim it —
+         *      payout-address changes are not retroactive, so current enrollment is
+         *      deliberately not required.
+         *
+         *      The payout wallet may be an EOA or a smart-contract wallet. An EOA answers
+         *      Monaco's signature challenge directly. A contract wallet — a multisig such
+         *      as a Safe — holds no private key and cannot, so it authenticates by EIP-1271
+         *      contract signature instead: Monaco asks the wallet contract whether it
+         *      accepts the challenge. That path is deliberately narrow. It is offered only
+         *      to a wallet that holds a BuilderCodes payout bucket, only while the
+         *      `contract_wallet_auth_enabled` flag is on, and only where the deployment has
+         *      a chain RPC endpoint configured. While any of those is not met, login is
+         *      EOA-only and a contract payout wallet can neither call this endpoint nor
+         *      withdraw afterwards, so its accrued share stays unclaimable.
+         *
+         *      Delegated-agent sessions are refused: a delegated grant conveys only
+         *      order-management authority, and this claim converts reserved balance into a
+         *      tradeable one. The refusal happens before the feature check, so a delegated
+         *      caller is refused whether or not BuilderCodes is enabled.
+         *
+         *      Transport contracts differ, and this comment is emitted into the generated
+         *      gRPC SDK where HTTP statuses do not exist. An insufficient payout balance
+         *      is **HTTP 409** on REST and **FAILED_PRECONDITION** on gRPC; a refused
+         *      caller (delegated session, or BuilderCodes disabled) is **HTTP 403** on
+         *      REST and **PERMISSION_DENIED** on gRPC.
+         *
+         *      A claim can also fail as **HTTP 503** / **UNAVAILABLE** when the matching
+         *      engine is unreachable, restarting, or slow to answer. Treat that as an
+         *      UNKNOWN outcome, NOT a rejection. The request is admitted to the sequencer
+         *      before its reply is sent, so a claim that timed out in transit may still
+         *      commit, and there is no idempotency key — a blind retry can claim a SECOND
+         *      time. Do NOT retry automatically, and do not settle it with a balance
+         *      read: an admitted claim can still be sitting in the sequencer queue when
+         *      the balance is read, so an unchanged balance does not prove the claim will
+         *      not commit. Treat the claim as PENDING rather than failed, re-check once
+         *      the engine is healthy again, and reconcile before issuing another claim.
+         *
+         *      Not every 503 is ambiguous, and the safe ones are tagged. TWO outcomes are
+         *      refused BEFORE the claim can be admitted to the sequencer, so they left no
+         *      durable-log or state footprint and definitely committed nothing. One is a
+         *      deliberate maintenance block, where REST carries
+         *      `"error": "OPERATIONS_BLOCKED"` and gRPC tags the status with
+         *      `x-maintenance-blocked: true`. The other is a sequencer admission rejection
+         *      when the engine is saturated, where REST carries `"code": "OVERLOADED"` and
+         *      gRPC carries the same code in the status' error details. Both are safe to
+         *      retry with backoff, and an overload positively wants one. Only an UNTAGGED
+         *      availability failure — matching-engine transport, timeout and fail-closed
+         *      paths — carries the unknown outcome.
+         */
+        post: operations["claim_buildercode_rewards"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/delegated-agents": {
         parameters: {
             query?: never;
@@ -2869,6 +3120,12 @@ export interface components {
             clientOrderId?: string | null;
             /** @description Optional submission identity, distinct from clientOrderId. Use 1-64 characters from [A-Za-z0-9._:-], without whitespace. Scoped to your authenticated user/subaccount and application, shared by create and batch-create items. Retrying the same key and normalized order payload within 24 hours of the original acceptance returns the original committed submission result, even after a fill or cancellation, without executing again. A full response cache does not prevent new keyed submissions: durable responses may be evicted while exact key history remains retained. If response capacity is protected by pending durability or persistence, a new key is refused with ORDER_SUBMISSION_CAPACITY_EXCEEDED. A retry whose original response cannot currently be retrieved returns ORDER_SUBMISSION_UNAVAILABLE and never executes again. Both are HTTP 503 / gRPC UNAVAILABLE, or per-item errors in batches. Retry the same key and payload; for previously accepted keys, stay within 24 hours of the original acceptance. A capacity refusal does not accept or reserve a new key. Different payload returns IDEMPOTENCY_KEY_CONFLICT (HTTP 409 / gRPC ALREADY_EXISTS; per-item error in batches). Validation failures before acceptance do not reserve the key. The window does not extend on retries; after it expires the key may execute a new order, so never retry an unresolved submission after 24 hours. Generate a fresh key for each intended new order and retain it across transport retries. Without a key, a timeout or 5xx leaves the outcome unknown and must not be blindly retried. */
             idempotencyKey?: string | null;
+            /**
+             * @description Per-order self-trade-prevention override: how the engine resolves this order matching against one of your own resting orders (your whole wallet family, subaccounts included; the incoming order's mode governs the step and resting orders' modes are never consulted). CANCEL_MAKER cancels each of your resting orders encountered and keeps matching. CANCEL_TAKER fills third-party liquidity up to the first self-touch, then cancels the incoming order's remainder — a zero-fill CANCELLED outcome is possible. CANCEL_BOTH additionally cancels the encountered resting orders. SKIP trades around your resting orders; a remainder that would rest crossing one of your surviving orders is cancelled instead of resting. Omitted, your wallet's configured default applies, else the platform default CANCEL_MAKER. STP cancellations carry terminalReason SELF_TRADE_PREVENTION and stpCounterpartyOrderId on reads and WebSocket events. With time_in_force FOK: CANCEL_MAKER cancels your makers first and then fills or kills; CANCEL_TAKER and SKIP cancel the whole order when self is in the fill path; CANCEL_BOTH fails only this item with a per-item SELF_TRADE_NOT_ALLOWED error — the batch itself still returns 2xx / OK. An unknown value likewise fails only this item, with error.code INVALID_SELF_TRADE_PREVENTION_MODE. The requested value is echoed back as selfTradePreventionMode on order reads, absent when omitted here.
+             * @example CANCEL_TAKER
+             * @enum {string|null}
+             */
+            selfTradePreventionMode?: "CANCEL_MAKER" | "CANCEL_TAKER" | "CANCEL_BOTH" | "SKIP" | null;
         };
         BatchCreateOrdersRequest: {
             orders: components["schemas"]["BatchCreateOrderItem"][];
@@ -2948,6 +3205,12 @@ export interface components {
              * @example quote-btc-1130-a
              */
             clientOrderId?: string | null;
+            /**
+             * @description Per-order self-trade-prevention override for the replacement: CANCEL_MAKER, CANCEL_TAKER, CANCEL_BOTH, or SKIP (see the create-order field for the full semantics). A replacement is a new order with a new id, so it carries its own value and inherits nothing from the original — restate it to keep the override. Omitted, your wallet's configured default applies, else the platform default CANCEL_MAKER. An unknown value fails only this item, with error.code INVALID_SELF_TRADE_PREVENTION_MODE. The requested value is echoed back as selfTradePreventionMode on order reads, absent when omitted here.
+             * @example CANCEL_TAKER
+             * @enum {string|null}
+             */
+            selfTradePreventionMode?: "CANCEL_MAKER" | "CANCEL_TAKER" | "CANCEL_BOTH" | "SKIP" | null;
         };
         BatchReplaceOrdersRequest: {
             orders: components["schemas"]["BatchReplaceOrderItem"][];
@@ -2990,6 +3253,73 @@ export interface components {
             matchResult?: components["schemas"]["MatchResult"];
             error?: components["schemas"]["BatchReplaceError"];
         };
+        BuildercodePayout: {
+            /**
+             * Format: uuid
+             * @description Trade that generated this credit.
+             */
+            tradeId?: string | null;
+            /**
+             * @description Application payout address at credit time.
+             * @example 0x0000000000000000000000000000000000000001
+             */
+            payoutAddress?: string | null;
+            /**
+             * @description Credit token contract address.
+             * @example 0x0000000000000000000000000000000000000002
+             */
+            token?: string | null;
+            /**
+             * @description Credited amount in RAW atomic units of the token.
+             * @example 1000000
+             */
+            amount?: string | null;
+            /**
+             * Format: int32
+             * @description Realized whole-basis-point rate for this credit after the Monaco-floor clamp, computed from the credited amount divided by the gross protocol take and truncated down. This can be lower than the configured BuilderCodes budget.
+             * @example 1000
+             */
+            appliedBps?: number | null;
+            /**
+             * Format: date-time
+             * @description RFC 3339 credit timestamp.
+             */
+            createdAt?: string | null;
+        };
+        BuildercodePayoutTokenTotal: {
+            /**
+             * @description Credit token contract address.
+             * @example 0x0000000000000000000000000000000000000002
+             */
+            token?: string | null;
+            /**
+             * @description Summed credits in RAW atomic units of this token.
+             * @example 5000000
+             */
+            totalAmount?: string | null;
+            /**
+             * Format: int64
+             * @description Number of credits included in this token total.
+             */
+            payoutCount?: number | null;
+            /**
+             * Format: date-time
+             * @description RFC 3339 timestamp of this token's newest credit.
+             */
+            lastCreditedAt?: string | null;
+        };
+        BuildercodeRewardsBalance: {
+            /**
+             * @description Reward token contract address.
+             * @example 0x0000000000000000000000000000000000000002
+             */
+            token?: string | null;
+            /**
+             * @description Available BuilderCodes reward balance in RAW atomic units.
+             * @example 1200000
+             */
+            available?: string | null;
+        };
         CancelConditionalOrderResponse: {
             /**
              * Format: uuid
@@ -3165,6 +3495,30 @@ export interface components {
              */
             reason?: string | null;
         };
+        ClaimBuildercodeRewardsRequest: {
+            /**
+             * @description Payout token contract address (0x-prefixed) to claim. BuilderCodes shares accrue in the quote token of the traded pair.
+             * @example 0x0000000000000000000000000000000000000002
+             */
+            token: string;
+            /**
+             * @description Amount to claim, in RAW atomic units of the token. Must be positive and no greater than the accrued payout balance.
+             * @example 1000000
+             */
+            amount: string;
+        };
+        ClaimBuildercodeRewardsResponse: {
+            /**
+             * @description Your BuilderCodes payout-bucket balance after the claim, RAW atomic units.
+             * @example 0
+             */
+            payoutBalance?: string | null;
+            /**
+             * @description Your trading balance for the token after the claim, RAW atomic units.
+             * @example 1000000
+             */
+            tradingBalance?: string | null;
+        };
         ClosePositionRequest: {
             quantity?: string | null;
             closeType?: string | null;
@@ -3383,6 +3737,12 @@ export interface components {
             clientOrderId?: string | null;
             /** @description Optional submission identity, distinct from clientOrderId. Use 1-64 characters from [A-Za-z0-9._:-], without whitespace. Scoped to your authenticated user/subaccount and application, shared by create and batch-create items. Retrying the same key and normalized order payload within 24 hours of the original acceptance returns the original committed submission result, even after a fill or cancellation, without executing again. A full response cache does not prevent new keyed submissions: durable responses may be evicted while exact key history remains retained. If response capacity is protected by pending durability or persistence, a new key is refused with ORDER_SUBMISSION_CAPACITY_EXCEEDED. A retry whose original response cannot currently be retrieved returns ORDER_SUBMISSION_UNAVAILABLE and never executes again. Both are HTTP 503 / gRPC UNAVAILABLE, or per-item errors in batches. Retry the same key and payload; for previously accepted keys, stay within 24 hours of the original acceptance. A capacity refusal does not accept or reserve a new key. Different payload returns IDEMPOTENCY_KEY_CONFLICT (HTTP 409 / gRPC ALREADY_EXISTS; per-item error in batches). Validation failures before acceptance do not reserve the key. The window does not extend on retries; after it expires the key may execute a new order, so never retry an unresolved submission after 24 hours. Generate a fresh key for each intended new order and retain it across transport retries. Without a key, a timeout or 5xx leaves the outcome unknown and must not be blindly retried. */
             idempotencyKey?: string | null;
+            /**
+             * @description Per-order self-trade-prevention override: how the engine resolves this order matching against one of your own resting orders (your whole wallet family, subaccounts included; the incoming order's mode governs the step and resting orders' modes are never consulted). CANCEL_MAKER cancels each of your resting orders encountered and keeps matching. CANCEL_TAKER fills third-party liquidity up to the first self-touch, then cancels the incoming order's remainder — a zero-fill CANCELLED outcome is possible. CANCEL_BOTH additionally cancels the encountered resting orders. SKIP trades around your resting orders; a remainder that would rest crossing one of your surviving orders is cancelled instead of resting. Omitted, your wallet's configured default applies, else the platform default CANCEL_MAKER. STP cancellations carry terminalReason SELF_TRADE_PREVENTION and stpCounterpartyOrderId on reads and WebSocket events. With time_in_force FOK: CANCEL_MAKER cancels your makers first and then fills or kills; CANCEL_TAKER and SKIP cancel the whole order when self is in the fill path; CANCEL_BOTH rejects the placement with SELF_TRADE_NOT_ALLOWED. The requested value is echoed back as selfTradePreventionMode on order reads, absent when omitted here.
+             * @example CANCEL_TAKER
+             * @enum {string|null}
+             */
+            selfTradePreventionMode?: "CANCEL_MAKER" | "CANCEL_TAKER" | "CANCEL_BOTH" | "SKIP" | null;
         };
         CreateOrderResponse: {
             /**
@@ -4003,6 +4363,46 @@ export interface components {
              */
             totalPages?: number | null;
         };
+        GetBuildercodePayoutSummaryResponse: {
+            /**
+             * Format: int64
+             * @description Total credit count across every token.
+             */
+            totalPayouts?: number | null;
+            /**
+             * Format: date-time
+             * @description RFC 3339 timestamp of the newest credit, or null when none exists.
+             */
+            lastCreditedAt?: string | null;
+            /** @description Per-token earnings totals. Empty when this application has no payouts. */
+            byToken?: components["schemas"]["BuildercodePayoutTokenTotal"][] | null;
+        };
+        GetBuildercodeRewardsBalanceResponse: {
+            /** @description One entry per reward token with a non-zero available balance. */
+            balances?: components["schemas"]["BuildercodeRewardsBalance"][] | null;
+        };
+        GetBuildercodesConfigResponse: {
+            /**
+             * Format: uuid
+             * @description Application id derived from the authenticated session.
+             */
+            applicationId?: string | null;
+            /** @description Whether this application is currently enrolled in BuilderCodes. */
+            enrolled?: boolean | null;
+            /**
+             * @description Current lowercase-normalized payout address, or null when none is configured.
+             * @example 0x0000000000000000000000000000000000000001
+             */
+            payoutAddress?: string | null;
+            /** @description Current BuilderCodes feature-flag state. Successful responses are true because this endpoint is gated by the flag. */
+            buildercodesEnabled?: boolean | null;
+            /**
+             * Format: uint32
+             * @description Target BuilderCodes share in basis points, computed from the fill's gross non-negative Monaco protocol take and capped by the remainder after Monaco's floor.
+             * @example 1000
+             */
+            buildercodesBudgetBps?: number | null;
+        };
         /** @description OHLCV candlestick data. */
         GetCandlesResponse: {
             candles?: components["schemas"]["Candle"][] | null;
@@ -4598,6 +4998,12 @@ export interface components {
              * @example 918342
              */
             version?: number | null;
+            /**
+             * @description The per-order self-trade-prevention override REQUESTED when this order was placed or replaced: CANCEL_MAKER, CANCEL_TAKER, CANCEL_BOTH, or SKIP. Absent when the order carried no override — including every order placed before the field was accepted on write — even though a wallet or platform default still governed its matching. This echoes the request, not the resolved default.
+             * @example CANCEL_TAKER
+             * @enum {string|null}
+             */
+            selfTradePreventionMode?: "CANCEL_MAKER" | "CANCEL_TAKER" | "CANCEL_BOTH" | "SKIP" | null;
         };
         /** @description Orderbook snapshot with token metadata and sequence number. */
         GetOrderbookResponse: {
@@ -4966,6 +5372,12 @@ export interface components {
              *      partial.
              */
             cumFees?: string | null;
+            /**
+             * Format: int64
+             * @description Opaque, non-negative producer-owned version for this position row. Compare only within the same position; higher is newer. 0 is the unranked legacy sentinel and never participates in ordering: treat it exactly as an absent version and fall back to a full field comparison rather than ranking it as oldest. It advances on sequenced position mutations (open, add, reduce, close, funding, margin transfer, liquidation, ADL) and is shared by the persisted read, the WebSocket positions snapshot and a RANKED live position_update frame. A live frame is ranked only when it is a faithful projection of the row persisted at that sequence: in practice the fills that leave a position open. Frames that re-read live risk state after sequencing (funding, margin_added/margin_reduced) and terminal frames (which report size 0 and LIQUIDATED, while the stored row keeps its size and records CLOSED) omit the version even though the mutation did advance the persisted one, so an absent version never implies that nothing was persisted. mark_price, unrealized_pnl, liquidation_price and leverage are UNVERSIONED valuation fields re-derived from the oracle mark on every frame: the version does not advance for them (a valuation-only oracle tick persists nothing; a state-transitioning one, a breach or recovery, does restamp the account's open positions), so the merge rule is per field group — on an equal version skip the versioned fields but still take those four from the newer payload, because discarding a whole payload on an equal version freezes displayed PnL. isolated_margin is the one exception among the versioned fields: the WebSocket positions snapshot overlays it from an independent live matching-engine read rather than the versioned row, so take it from the newest payload on an equal version too or a consumer can retain stale backing. A response served from live matching-engine state reports 0 (unranked): the engine holds the state but not the version.
+             * @example 918342
+             */
+            version?: number | null;
         };
         GetPositionRiskResponse: {
             positionId?: string | null;
@@ -5559,6 +5971,30 @@ export interface components {
              */
             totalPages?: number | null;
         };
+        ListBuildercodePayoutsResponse: {
+            /** @description Per-trade credits, newest first. */
+            payouts?: components["schemas"]["BuildercodePayout"][] | null;
+            /**
+             * Format: uint32
+             * @description Total payout rows for this application.
+             */
+            total?: number | null;
+            /**
+             * Format: uint32
+             * @description Current page number.
+             */
+            page?: number | null;
+            /**
+             * Format: uint32
+             * @description Items per page.
+             */
+            pageSize?: number | null;
+            /**
+             * Format: uint32
+             * @description Total number of pages.
+             */
+            totalPages?: number | null;
+        };
         ListConditionalOrdersResponse: {
             orders?: components["schemas"]["ConditionalOrder"][] | null;
             /** Format: uint32 */
@@ -6444,6 +6880,12 @@ export interface components {
              *      partial.
              */
             cumFees?: string | null;
+            /**
+             * Format: int64
+             * @description Opaque, non-negative producer-owned version for this position row. Compare only within the same position; higher is newer. 0 is the unranked legacy sentinel and never participates in ordering: it means the row predates this field or came from a producer that does not stamp it, so treat it exactly as an absent version and fall back to a full field comparison rather than ranking it as oldest. It advances on sequenced position mutations (open, add, reduce, close, funding, margin transfer, liquidation, ADL) and is shared by the persisted read, the WebSocket positions snapshot and a RANKED live position_update frame. A live frame is ranked only when it is a faithful projection of the row persisted at that sequence: in practice the fills that leave a position open. Frames that re-read live risk state after sequencing (funding, margin_added/margin_reduced) and terminal frames (which report size 0 and LIQUIDATED, while the stored row keeps its size and records CLOSED) omit the version even though the mutation did advance the persisted one, so an absent version never implies that nothing was persisted. mark_price, unrealized_pnl, liquidation_price and leverage are UNVERSIONED valuation fields re-derived from the oracle mark on every frame: the version does not advance for them (a valuation-only oracle tick persists nothing; a state-transitioning one, a breach or recovery, does restamp the account's open positions), so the merge rule is per field group — on an equal version skip the versioned fields but still take those four from the newer payload, because discarding a whole payload on an equal version freezes displayed PnL. isolated_margin is the one exception among the versioned fields: the WebSocket positions snapshot overlays it from an independent live matching-engine read rather than the versioned row, so take it from the newest payload on an equal version too or a consumer can retain stale backing. A response served from live matching-engine state reports 0 (unranked): the engine holds the state but not the version.
+             * @example 918342
+             */
+            version?: number | null;
         };
         PositionHistoryEvent: {
             id?: string | null;
@@ -6686,10 +7128,11 @@ export interface components {
         };
         ReplaceOrderRequest: {
             /**
-             * @description Client-assigned correlation handle, echoed back on order reads (detail and list) and on order WebSocket events. At most 64 characters from [A-Za-z0-9._:-]; surrounding whitespace is trimmed before storage, and a blank or whitespace-only value is treated as absent. Uniqueness is enforced only among your orders that are RESTING on the book: a create or replace reusing a value another of your resting orders still holds is rejected with HTTP 409 / gRPC ALREADY_EXISTS and the code CLIENT_ORDER_ID_CONFLICT. An order that never rests — MARKET, IOC/FOK, or a LIMIT that fills completely on arrival — does not take the handle, and the value is released the moment any order reaches a terminal state. It is therefore NOT an idempotency key, though on this replace path a retry cannot double-execute: the request names the original order id, and the sequencer revalidates that original in memory and on the book at sequence time, so once the first replacement succeeds the original is gone and a retry is rejected with ORDER_NOT_FOUND rather than placing a second order. That code is itself ambiguous — the original may instead have filled or been cancelled — so the risk here is acting on a stale view, not duplicate execution. Reconcile a lost response against the order WebSocket stream, which carries this value on the submit acknowledgement and on fills, including for orders that never rest; order history is replica-backed and can omit an order that did land. The stream is not replayable and has no sequence number to backfill from, and its fan-out is non-persistent Core NATS: the service can re-establish an ended upstream subscription without closing your socket, so events can be missed while your connection still looks healthy. A matching event is therefore positive proof the order was accepted, but silence is NEVER evidence it was not, and no client-observable condition makes it so. Absent positive evidence the outcome is unresolved: hold and escalate rather than resubmitting. A replacement carries no order type or time-in-force and its original must still be RESTING, so the post-acceptance rejection shapes are unreachable here: the reachable failures are all pre-acceptance — malformed, post-only would cross, handle conflict, or the original no longer resting (ORDER_NOT_FOUND) — and each fails the request, emits no event and is never written to order history (an order rejected AFTER acceptance is persisted with status REJECTED, so only the pre-acceptance class is absent). Where no surface is conclusive, do not resubmit. A replacement is a new order with a new id, so it carries its own value and inherits nothing from the original — restate it to keep the handle.
-             * @example quote-btc-1130-a
+             * @description Per-order self-trade-prevention override for the replacement: CANCEL_MAKER, CANCEL_TAKER, CANCEL_BOTH, or SKIP (see the create-order field for the full semantics). A replacement is a new order with a new id, so it carries its own value and inherits nothing from the original — restate it to keep the override. Omitted, your wallet's configured default applies, else the platform default CANCEL_MAKER. The requested value is echoed back as selfTradePreventionMode on order reads, absent when omitted here.
+             * @example CANCEL_TAKER
+             * @enum {string|null}
              */
-            clientOrderId?: string | null;
+            selfTradePreventionMode?: "CANCEL_MAKER" | "CANCEL_TAKER" | "CANCEL_BOTH" | "SKIP" | null;
             /**
              * @description New limit price (if changing)
              * @example 35500.00
@@ -6710,6 +7153,11 @@ export interface components {
              * @example false
              */
             postOnly?: boolean | null;
+            /**
+             * @description Client-assigned correlation handle, echoed back on order reads (detail and list) and on order WebSocket events. At most 64 characters from [A-Za-z0-9._:-]; surrounding whitespace is trimmed before storage, and a blank or whitespace-only value is treated as absent. Uniqueness is enforced only among your orders that are RESTING on the book: a create or replace reusing a value another of your resting orders still holds is rejected with HTTP 409 / gRPC ALREADY_EXISTS and the code CLIENT_ORDER_ID_CONFLICT. An order that never rests — MARKET, IOC/FOK, or a LIMIT that fills completely on arrival — does not take the handle, and the value is released the moment any order reaches a terminal state. It is therefore NOT an idempotency key, though on this replace path a retry cannot double-execute: the request names the original order id, and the sequencer revalidates that original in memory and on the book at sequence time, so once the first replacement succeeds the original is gone and a retry is rejected with ORDER_NOT_FOUND rather than placing a second order. That code is itself ambiguous — the original may instead have filled or been cancelled — so the risk here is acting on a stale view, not duplicate execution. Reconcile a lost response against the order WebSocket stream, which carries this value on the submit acknowledgement and on fills, including for orders that never rest; order history is replica-backed and can omit an order that did land. The stream is not replayable and has no sequence number to backfill from, and its fan-out is non-persistent Core NATS: the service can re-establish an ended upstream subscription without closing your socket, so events can be missed while your connection still looks healthy. A matching event is therefore positive proof the order was accepted, but silence is NEVER evidence it was not, and no client-observable condition makes it so. Absent positive evidence the outcome is unresolved: hold and escalate rather than resubmitting. A replacement carries no order type or time-in-force and its original must still be RESTING, so the post-acceptance rejection shapes are unreachable here: the reachable failures are all pre-acceptance — malformed, post-only would cross, handle conflict, or the original no longer resting (ORDER_NOT_FOUND) — and each fails the request, emits no event and is never written to order history (an order rejected AFTER acceptance is persisted with status REJECTED, so only the pre-acceptance class is absent). Where no surface is conclusive, do not resubmit. A replacement is a new order with a new id, so it carries its own value and inherits nothing from the original — restate it to keep the handle.
+             * @example quote-btc-1130-a
+             */
+            clientOrderId?: string | null;
         };
         ReplaceOrderResponse: {
             /**
@@ -6895,6 +7343,25 @@ export interface components {
              */
             priceChangePercent?: string | null;
         };
+        SelfTradePreventionDefaultResponse: {
+            /**
+             * @description The wallet's effective self-trade-prevention default: `CANCEL_MAKER`, `CANCEL_TAKER`, `CANCEL_BOTH`, or `SKIP`.
+             * @example CANCEL_MAKER
+             */
+            mode?: string | null;
+            /**
+             * @description True when this wallet has explicitly set a default; false when the platform default (`CANCEL_MAKER`) is in effect.
+             * @example false
+             */
+            isCustom?: boolean | null;
+        };
+        SetSelfTradePreventionDefaultRequest: {
+            /**
+             * @description The self-trade-prevention mode applied when an order from this wallet would match the wallet family's own resting order and the order names no override: `CANCEL_MAKER` (cancel the resting order — the platform default), `CANCEL_TAKER` (cancel the incoming order), `CANCEL_BOTH`, or `SKIP` (trade around own orders). Input is case-insensitive.
+             * @example SKIP
+             */
+            mode: string;
+        };
         SetTraderCodeRequest: {
             /**
              * @description The custom handle to claim or edit to: `[A-Za-z0-9_]`, must start with a letter, 5–20 characters. Case is preserved on store; uniqueness is case-insensitive.
@@ -7963,7 +8430,7 @@ export interface components {
              */
             address: string;
             /**
-             * @description Wallet signature over the challenge message
+             * @description Wallet authorization of the challenge message, hex with an optional 0x prefix. An EOA sends a 65-byte EIP-191 signature; a contract wallet verified under EIP-1271 sends whatever its own contract accepts, which is usually longer and need not be 65 bytes. Capped at 8192 decoded bytes (16386 characters with the prefix) — enough for well over a hundred owner slots — and a longer value is rejected as an invalid signature rather than forwarded to the chain.
              * @example 0x1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0
              */
             signature: string;
@@ -8707,7 +9174,7 @@ export interface operations {
             };
         };
     };
-    list_sub_accounts_with_balances: {
+    get_self_trade_prevention_default: {
         parameters: {
             query?: never;
             header?: never;
@@ -8722,12 +9189,98 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ListSubAccountsResponse"];
+                    "application/json": components["schemas"]["SelfTradePreventionDefaultResponse"];
                 };
             };
-            /** @description Invalid request */
-            400: {
-                headers: {
+            /** @description Authentication required */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    set_self_trade_prevention_default: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SetSelfTradePreventionDefaultRequest"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SelfTradePreventionDefaultResponse"];
+                };
+            };
+            /** @description Unknown mode */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Authentication required */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Delegated-agent sessions cannot change account settings */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    list_sub_accounts_with_balances: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ListSubAccountsResponse"];
+                };
+            };
+            /** @description Invalid request */
+            400: {
+                headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
@@ -9606,6 +10159,276 @@ export interface operations {
                 };
                 content?: never;
             };
+            /** @description Contract-wallet (EIP-1271) verification could not be completed for an eligible address: the chain did not answer, did not answer within the deadline, or the server was at its concurrent-verification capacity and declined to ask. Retryable, and not a verdict on the signature. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    get_buildercodes_config: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["GetBuildercodesConfigResponse"];
+                };
+            };
+            /** @description Authentication required */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Refused: BuilderCodes is disabled, the caller is delegated, or the caller is not this application's payout wallet (gRPC: PERMISSION_DENIED) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Authenticated application not found (gRPC: NOT_FOUND) */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    list_buildercode_payouts: {
+        parameters: {
+            query?: {
+                /** @description Page number (1-indexed) */
+                page?: number;
+                /** @description Items per page (max 100) */
+                pageSize?: number;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ListBuildercodePayoutsResponse"];
+                };
+            };
+            /** @description Invalid pagination */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Authentication required */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Refused: BuilderCodes is disabled, the caller is delegated, or the caller is not this application's payout wallet (gRPC: PERMISSION_DENIED) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Authenticated application not found (gRPC: NOT_FOUND) */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    get_buildercode_payout_summary: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["GetBuildercodePayoutSummaryResponse"];
+                };
+            };
+            /** @description Authentication required */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Refused: BuilderCodes is disabled, the caller is delegated, or the caller is not this application's payout wallet (gRPC: PERMISSION_DENIED) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Authenticated application not found (gRPC: NOT_FOUND) */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    get_buildercode_rewards_balance: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["GetBuildercodeRewardsBalanceResponse"];
+                };
+            };
+            /** @description Authentication required */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Refused: BuilderCodes is disabled or the caller is delegated (gRPC: PERMISSION_DENIED) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    claim_buildercode_rewards: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ClaimBuildercodeRewardsRequest"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ClaimBuildercodeRewardsResponse"];
+                };
+            };
+            /** @description Invalid token or amount */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Authentication required */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Refused: BuilderCodes is not enabled, or the caller is a delegated-agent session (gRPC: PERMISSION_DENIED) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Insufficient BuilderCodes payout balance, including a wallet that never accrued one (gRPC: FAILED_PRECONDITION) */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Internal server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Matching engine unavailable or slow to answer. Outcome UNKNOWN, not a rejection — the claim may still commit and there is no idempotency key, so treat it as pending and do not retry automatically; a balance read does not settle it, because an admitted claim may still be queued. Two tagged cases are the exception, both refused before the claim can be admitted and so provably non-committing, and both safe to retry: a maintenance block (`error: OPERATIONS_BLOCKED`; gRPC metadata `x-maintenance-blocked: true`) and a sequencer overload (`code: OVERLOADED`) (gRPC: UNAVAILABLE) */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
         };
     };
     list_delegated_agents: {