@morpho-org/midnight-sdk 1.3.0 → 1.3.1

package/lib/cjs/api/MidnightApi.d.ts

@@ -67,7 +67,7 @@ export declare class MidnightApi {
      * @param params.request - Optional fetch options forwarded to this request.
      * @returns Paginated books mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when a returned book's `market_id` does not match, or cannot be derived from, its own market params, or when a returned book falls outside the supplied `marketIds` filter.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";
@@ -92,7 +92,7 @@ export declare class MidnightApi {
      * @param params.request - Optional fetch options forwarded to this request.
      * @returns Book snapshot mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when the returned book's `market_id` does not match, or cannot be derived from, its own market params, or when it differs from the requested `marketId`.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";
@@ -320,7 +320,7 @@ export declare class MidnightApi {
      * @param params.cursor - Optional opaque pagination cursor from a previous response.
      * @returns Paginated books mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when a returned book's `market_id` does not match, or cannot be derived from, its own market params, or when a returned book falls outside the supplied `marketIds` filter.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";
@@ -340,7 +340,7 @@ export declare class MidnightApi {
      * @param params.depth - Optional maximum levels returned per side.
      * @returns Book snapshot mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when the returned book's `market_id` does not match, or cannot be derived from, its own market params, or when it differs from the requested `marketId`.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";

package/lib/cjs/api/MidnightApi.js

@@ -79,7 +79,7 @@ class MidnightApi {
      * @param params.request - Optional fetch options forwarded to this request.
      * @returns Paginated books mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when a returned book's `market_id` does not match, or cannot be derived from, its own market params, or when a returned book falls outside the supplied `marketIds` filter.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";
@@ -110,7 +110,7 @@ class MidnightApi {
         });
         return {
             cursor: response.cursor,
-            data: response.data.map(helpers_js_1.mapBookMarket),
+            data: (0, helpers_js_1.mapBoundBooks)(response.data, input.marketIds),
         };
     }
     /**
@@ -125,7 +125,7 @@ class MidnightApi {
      * @param params.request - Optional fetch options forwarded to this request.
      * @returns Book snapshot mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when the returned book's `market_id` does not match, or cannot be derived from, its own market params, or when it differs from the requested `marketId`.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";
@@ -147,7 +147,7 @@ class MidnightApi {
             },
         });
         return {
-            data: (0, helpers_js_1.mapBookMarket)(response.data),
+            data: (0, helpers_js_1.mapBoundBookMarket)(response.data, input.marketId),
         };
     }
     /**
@@ -525,7 +525,7 @@ class MidnightApi {
      * @param params.cursor - Optional opaque pagination cursor from a previous response.
      * @returns Paginated books mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when a returned book's `market_id` does not match, or cannot be derived from, its own market params, or when a returned book falls outside the supplied `marketIds` filter.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";
@@ -550,7 +550,7 @@ class MidnightApi {
      * @param params.depth - Optional maximum levels returned per side.
      * @returns Book snapshot mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when the returned book's `market_id` does not match, or cannot be derived from, its own market params, or when it differs from the requested `marketId`.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";

package/lib/cjs/api/helpers.d.ts

@@ -8,8 +8,18 @@ export declare function buildBookPath(params: {
     readonly side?: MidnightApiBookSide;
     readonly suffix?: "quote" | "takeable-offers";
 }): string;
-/** @internal Maps a book market API payload to the SDK response shape. */
+/**
+ * @internal Maps a book market API payload to the SDK response shape, rejecting any
+ * response whose advertised `market_id` cannot be derived from — or does not match —
+ * its own market params. Recomputing the id with `MarketUtils.toId` (mirroring the
+ * takeable-offers path) stops a hostile API from pairing a trusted id with foreign
+ * metadata; every book flows through here, so both bound paths reject the same substitution.
+ */
 export declare function mapBookMarket(book: ApiBookMarketResponse): MidnightApiBookMarket;
+/** @internal Maps a book market, binding its verified id to the requested market. */
+export declare function mapBoundBookMarket(book: ApiBookMarketResponse, requestedMarketId: Hash): MidnightApiBookMarket;
+/** @internal Maps listed book markets, binding each verified id to the requested market_ids filter when present. */
+export declare function mapBoundBooks(books: readonly ApiBookMarketResponse[], marketIds?: readonly Hash[]): MidnightApiBookMarket[];
 /** @internal Maps a collateral API payload to the SDK response shape. */
 export declare function mapCollateral(collateral: ApiCollateralResponse): MidnightApiCollateral;
 /** @internal Maps a price-level API payload to the SDK response shape. */

package/lib/cjs/api/helpers.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.requestMidnightApi = requestMidnightApi;
 exports.buildBookPath = buildBookPath;
 exports.mapBookMarket = mapBookMarket;
+exports.mapBoundBookMarket = mapBoundBookMarket;
+exports.mapBoundBooks = mapBoundBooks;
 exports.mapCollateral = mapCollateral;
 exports.mapPriceLevel = mapPriceLevel;
 exports.mapTakeableOffer = mapTakeableOffer;
@@ -90,8 +92,42 @@ function buildBookPath(params) {
     ].filter((segment) => segment !== undefined);
     return segments.map(encodeURIComponent).join("/");
 }
-/** @internal Maps a book market API payload to the SDK response shape. */
+/**
+ * @internal Maps a book market API payload to the SDK response shape, rejecting any
+ * response whose advertised `market_id` cannot be derived from — or does not match —
+ * its own market params. Recomputing the id with `MarketUtils.toId` (mirroring the
+ * takeable-offers path) stops a hostile API from pairing a trusted id with foreign
+ * metadata; every book flows through here, so both bound paths reject the same substitution.
+ */
 function mapBookMarket(book) {
+    let derivedMarketId;
+    let matchesAdvertisedId;
+    try {
+        derivedMarketId = index_js_1.MarketUtils.toId({
+            chainId: book.chain_id,
+            midnight: book.midnight,
+            loanToken: book.loan_token,
+            collateralParams: book.collaterals.map((collateral) => ({
+                token: collateral.token,
+                lltv: collateral.lltv,
+                liquidationCursor: collateral.liquidation_cursor,
+                oracle: collateral.oracle,
+            })),
+            maturity: book.maturity,
+            rcfThreshold: book.rcf_threshold,
+            enterGate: book.enter_gate,
+            liquidatorGate: book.liquidator_gate,
+        });
+        // Comparison stays inside the try so a malformed advertised `market_id`
+        // (non-hex value) surfaces as a wrapped response error, not a raw TypeError.
+        matchesAdvertisedId = (0, morpho_ts_1.isHexEqual)(derivedMarketId, book.market_id);
+    }
+    catch (cause) {
+        throw new errors_js_1.InvalidMidnightApiResponseError(`Midnight API book market_id "${book.market_id}" could not be validated against its market params.`, { cause });
+    }
+    if (!matchesAdvertisedId) {
+        throw new errors_js_1.InvalidMidnightApiResponseError(`Midnight API book market_id "${book.market_id}" does not match the id "${derivedMarketId}" derived from its market params.`);
+    }
     return {
         marketId: book.market_id,
         chainId: book.chain_id,
@@ -106,6 +142,26 @@ function mapBookMarket(book) {
         bids: book.bids.map(mapPriceLevel),
     };
 }
+/** @internal Maps a book market, binding its verified id to the requested market. */
+function mapBoundBookMarket(book, requestedMarketId) {
+    const market = mapBookMarket(book);
+    if (!(0, morpho_ts_1.isHexEqual)(market.marketId, requestedMarketId)) {
+        throw new errors_js_1.InvalidMidnightApiResponseError(`Midnight API book market_id "${market.marketId}" does not match requested market "${requestedMarketId}".`);
+    }
+    return market;
+}
+/** @internal Maps listed book markets, binding each verified id to the requested market_ids filter when present. */
+function mapBoundBooks(books, marketIds) {
+    return books.map((book) => {
+        const market = mapBookMarket(book);
+        if (marketIds != null &&
+            marketIds.length > 0 &&
+            !marketIds.some((marketId) => (0, morpho_ts_1.isHexEqual)(marketId, market.marketId))) {
+            throw new errors_js_1.InvalidMidnightApiResponseError(`Midnight API book market_id "${market.marketId}" is outside the requested market_ids filter.`);
+        }
+        return market;
+    });
+}
 /** @internal Maps a collateral API payload to the SDK response shape. */
 function mapCollateral(collateral) {
     return {

package/lib/cjs/api/version.generated.d.ts

@@ -1,2 +1,2 @@
 /** @internal Installed Midnight SDK package version. */
-export declare const MIDNIGHT_SDK_VERSION = "1.3.0";
+export declare const MIDNIGHT_SDK_VERSION = "1.3.1";

package/lib/cjs/api/version.generated.js

@@ -3,4 +3,4 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MIDNIGHT_SDK_VERSION = void 0;
 /** @internal Installed Midnight SDK package version. */
-exports.MIDNIGHT_SDK_VERSION = "1.3.0";
+exports.MIDNIGHT_SDK_VERSION = "1.3.1";

package/lib/cjs/fetch/utils.d.ts

@@ -3,6 +3,6 @@ import type { DeploylessFetchParameters, MidnightCallParameters } from "./types.
 /** @internal Extracts viem call parameters from Midnight fetch inputs. */
 export declare const callParameters: (params: MidnightCallParameters) => MidnightCallParameters;
 /** @internal Returns the configured deployless mode, defaulting to enabled. */
-export declare const shouldUseDeployless: (params: DeploylessFetchParameters) => boolean | "force";
+export declare const shouldUseDeployless: (params: DeploylessFetchParameters) => "force" | boolean;
 /** @internal Returns the RPC chain id and rejects configured-chain drift. */
 export declare const resolveChainId: (client: Client) => Promise<number>;

package/lib/cjs/signatures/EcrecoverRatifierUtils.d.ts

@@ -434,7 +434,7 @@ export declare namespace EcrecoverRatifierUtils {
      * console.log(EcrecoverRatifierUtils.treeTypeHash(0));
      * ```
      */
-    function treeTypeHash(height: number): "0x270da1ebafc0f24637af3612fb8c3a1d828fcb56d3637c24e86dd006b12ca7f9" | "0x828b9cdf8326a1cf234328e4d5229546a98fb72ef73624f5b6b31538e555b96c" | "0xfcb7a3ca4094246b8185620c4cf025c93032b6f0384805aa3f22afe04290e982" | "0xcc97cb1955496a5269b5a7afca62ba694edcab26ba838a1adbd257931249de92" | "0xda3feb08db360ad9e09540132ff04d2b6a596fdaa4747892217aaa4c7c9bcc31" | "0x15bd6e2aa1a7a61614187ac16d2cbf8610c8f2f3c3d9eaa380ae7a501ee3cf06" | "0xb726cb7fab1a24c28213cbd482fa5a301f127fb25feb01da341919983a72711a" | "0xcea9cd557c6f821868ea287304199d0e0554af630bfa8fe36c64eb3bbacca418" | "0xf7dbde8234e8e345cec8fc0a8ac5909ee336b214882751ecd51e7b37df4f6cdd" | "0x5400a5d43d39e6bfe910af8cb84ac77bf501d310413769dffd62ccecda8b00c6" | "0x0754209b60d99d0822b3ecd5a970f9db09df9c8998a8441e24b81f06d6c76fee" | "0xf5d561d88647c3b38ed6636709d3166819fc66f8ed52a0daf4ae186387b4646c" | "0x5801c07a6c7df039ce00a7a2b8bd92aa1cf333c30b0bc3d78768590b6063d09e" | "0xc9da7190eaf4b14c7cb1c14f9898256c0adb6b1dc303afe79594dea64fe199c0" | "0xa47534c85ac57c583568465d40fd46683d2d558d8129fe1aca01e93023afca92" | "0xb1e841691fb54f4ef85e2ed9de45d610e57f49e1e6eb2510ceead16e447dd519" | "0x4fa4f16f09f0c36c7670449a4032073380d28a60071e12ee8874bb3e5a8318fc" | "0x817bbaac8bb863670f488b454cdd5d0990d9d81871a68e9df381c3c13d3f2ba2" | "0xc447f06079bddf4b011523c4bce119e9e90fdf937de4ee88f48010406560e9c1" | "0x1608d5eb56943c667c34b413f9f8a1c24a84ddfe1301a9c25487e638de1f5822" | "0x3a677100d2e855c24a62d1e9c365bff90d02287f066a07064843ca1ee70ea113";
+    function treeTypeHash(height: number): "0x0754209b60d99d0822b3ecd5a970f9db09df9c8998a8441e24b81f06d6c76fee" | "0x15bd6e2aa1a7a61614187ac16d2cbf8610c8f2f3c3d9eaa380ae7a501ee3cf06" | "0x1608d5eb56943c667c34b413f9f8a1c24a84ddfe1301a9c25487e638de1f5822" | "0x270da1ebafc0f24637af3612fb8c3a1d828fcb56d3637c24e86dd006b12ca7f9" | "0x3a677100d2e855c24a62d1e9c365bff90d02287f066a07064843ca1ee70ea113" | "0x4fa4f16f09f0c36c7670449a4032073380d28a60071e12ee8874bb3e5a8318fc" | "0x5400a5d43d39e6bfe910af8cb84ac77bf501d310413769dffd62ccecda8b00c6" | "0x5801c07a6c7df039ce00a7a2b8bd92aa1cf333c30b0bc3d78768590b6063d09e" | "0x817bbaac8bb863670f488b454cdd5d0990d9d81871a68e9df381c3c13d3f2ba2" | "0x828b9cdf8326a1cf234328e4d5229546a98fb72ef73624f5b6b31538e555b96c" | "0xa47534c85ac57c583568465d40fd46683d2d558d8129fe1aca01e93023afca92" | "0xb1e841691fb54f4ef85e2ed9de45d610e57f49e1e6eb2510ceead16e447dd519" | "0xb726cb7fab1a24c28213cbd482fa5a301f127fb25feb01da341919983a72711a" | "0xc447f06079bddf4b011523c4bce119e9e90fdf937de4ee88f48010406560e9c1" | "0xc9da7190eaf4b14c7cb1c14f9898256c0adb6b1dc303afe79594dea64fe199c0" | "0xcc97cb1955496a5269b5a7afca62ba694edcab26ba838a1adbd257931249de92" | "0xcea9cd557c6f821868ea287304199d0e0554af630bfa8fe36c64eb3bbacca418" | "0xda3feb08db360ad9e09540132ff04d2b6a596fdaa4747892217aaa4c7c9bcc31" | "0xf5d561d88647c3b38ed6636709d3166819fc66f8ed52a0daf4ae186387b4646c" | "0xf7dbde8234e8e345cec8fc0a8ac5909ee336b214882751ecd51e7b37df4f6cdd" | "0xfcb7a3ca4094246b8185620c4cf025c93032b6f0384805aa3f22afe04290e982";
     /**
      * Builds EcrecoverRatifier typed data for a tree-like input.
      *

package/lib/esm/api/MidnightApi.d.ts

@@ -67,7 +67,7 @@ export declare class MidnightApi {
      * @param params.request - Optional fetch options forwarded to this request.
      * @returns Paginated books mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when a returned book's `market_id` does not match, or cannot be derived from, its own market params, or when a returned book falls outside the supplied `marketIds` filter.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";
@@ -92,7 +92,7 @@ export declare class MidnightApi {
      * @param params.request - Optional fetch options forwarded to this request.
      * @returns Book snapshot mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when the returned book's `market_id` does not match, or cannot be derived from, its own market params, or when it differs from the requested `marketId`.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";
@@ -320,7 +320,7 @@ export declare class MidnightApi {
      * @param params.cursor - Optional opaque pagination cursor from a previous response.
      * @returns Paginated books mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when a returned book's `market_id` does not match, or cannot be derived from, its own market params, or when a returned book falls outside the supplied `marketIds` filter.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";
@@ -340,7 +340,7 @@ export declare class MidnightApi {
      * @param params.depth - Optional maximum levels returned per side.
      * @returns Book snapshot mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when the returned book's `market_id` does not match, or cannot be derived from, its own market params, or when it differs from the requested `marketId`.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";

package/lib/esm/api/MidnightApi.js

@@ -2,7 +2,7 @@ import { MathLib } from "@morpho-org/morpho-ts";
 import { InvalidMidnightApiResponseError } from "../errors.js";
 import { TickLib } from "../math/index.js";
 import { Payload } from "../signatures/Payload.js";
-import { buildBookPath, mapBookMarket, mapBoundTakeableOffers, mapPriceLevel, parseValidationResponse, requestMidnightApi, } from "./helpers.js";
+import { buildBookPath, mapBoundBookMarket, mapBoundBooks, mapBoundTakeableOffers, mapPriceLevel, parseValidationResponse, requestMidnightApi, } from "./helpers.js";
 export { MempoolPayloadValidationRule } from "./types.js";
 /**
  * Midnight API client and stateless helper surface for books and mempool data.
@@ -75,7 +75,7 @@ export class MidnightApi {
      * @param params.request - Optional fetch options forwarded to this request.
      * @returns Paginated books mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when a returned book's `market_id` does not match, or cannot be derived from, its own market params, or when a returned book falls outside the supplied `marketIds` filter.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";
@@ -106,7 +106,7 @@ export class MidnightApi {
         });
         return {
             cursor: response.cursor,
-            data: response.data.map(mapBookMarket),
+            data: mapBoundBooks(response.data, input.marketIds),
         };
     }
     /**
@@ -121,7 +121,7 @@ export class MidnightApi {
      * @param params.request - Optional fetch options forwarded to this request.
      * @returns Book snapshot mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when the returned book's `market_id` does not match, or cannot be derived from, its own market params, or when it differs from the requested `marketId`.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";
@@ -143,7 +143,7 @@ export class MidnightApi {
             },
         });
         return {
-            data: mapBookMarket(response.data),
+            data: mapBoundBookMarket(response.data, input.marketId),
         };
     }
     /**
@@ -521,7 +521,7 @@ export class MidnightApi {
      * @param params.cursor - Optional opaque pagination cursor from a previous response.
      * @returns Paginated books mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when a returned book's `market_id` does not match, or cannot be derived from, its own market params, or when a returned book falls outside the supplied `marketIds` filter.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";
@@ -546,7 +546,7 @@ export class MidnightApi {
      * @param params.depth - Optional maximum levels returned per side.
      * @returns Book snapshot mapped to SDK camelCase fields.
      * @throws {MidnightApiError} when the API returns a non-2xx response.
-     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON.
+     * @throws {InvalidMidnightApiResponseError} when the API success response is not JSON, when the returned book's `market_id` does not match, or cannot be derived from, its own market params, or when it differs from the requested `marketId`.
      * @example
      * ```ts
      * import { MidnightApi } from "@morpho-org/midnight-sdk/api";

package/lib/esm/api/helpers.d.ts

@@ -8,8 +8,18 @@ export declare function buildBookPath(params: {
     readonly side?: MidnightApiBookSide;
     readonly suffix?: "quote" | "takeable-offers";
 }): string;
-/** @internal Maps a book market API payload to the SDK response shape. */
+/**
+ * @internal Maps a book market API payload to the SDK response shape, rejecting any
+ * response whose advertised `market_id` cannot be derived from — or does not match —
+ * its own market params. Recomputing the id with `MarketUtils.toId` (mirroring the
+ * takeable-offers path) stops a hostile API from pairing a trusted id with foreign
+ * metadata; every book flows through here, so both bound paths reject the same substitution.
+ */
 export declare function mapBookMarket(book: ApiBookMarketResponse): MidnightApiBookMarket;
+/** @internal Maps a book market, binding its verified id to the requested market. */
+export declare function mapBoundBookMarket(book: ApiBookMarketResponse, requestedMarketId: Hash): MidnightApiBookMarket;
+/** @internal Maps listed book markets, binding each verified id to the requested market_ids filter when present. */
+export declare function mapBoundBooks(books: readonly ApiBookMarketResponse[], marketIds?: readonly Hash[]): MidnightApiBookMarket[];
 /** @internal Maps a collateral API payload to the SDK response shape. */
 export declare function mapCollateral(collateral: ApiCollateralResponse): MidnightApiCollateral;
 /** @internal Maps a price-level API payload to the SDK response shape. */

package/lib/esm/api/helpers.js

@@ -80,8 +80,42 @@ export function buildBookPath(params) {
     ].filter((segment) => segment !== undefined);
     return segments.map(encodeURIComponent).join("/");
 }
-/** @internal Maps a book market API payload to the SDK response shape. */
+/**
+ * @internal Maps a book market API payload to the SDK response shape, rejecting any
+ * response whose advertised `market_id` cannot be derived from — or does not match —
+ * its own market params. Recomputing the id with `MarketUtils.toId` (mirroring the
+ * takeable-offers path) stops a hostile API from pairing a trusted id with foreign
+ * metadata; every book flows through here, so both bound paths reject the same substitution.
+ */
 export function mapBookMarket(book) {
+    let derivedMarketId;
+    let matchesAdvertisedId;
+    try {
+        derivedMarketId = MarketUtils.toId({
+            chainId: book.chain_id,
+            midnight: book.midnight,
+            loanToken: book.loan_token,
+            collateralParams: book.collaterals.map((collateral) => ({
+                token: collateral.token,
+                lltv: collateral.lltv,
+                liquidationCursor: collateral.liquidation_cursor,
+                oracle: collateral.oracle,
+            })),
+            maturity: book.maturity,
+            rcfThreshold: book.rcf_threshold,
+            enterGate: book.enter_gate,
+            liquidatorGate: book.liquidator_gate,
+        });
+        // Comparison stays inside the try so a malformed advertised `market_id`
+        // (non-hex value) surfaces as a wrapped response error, not a raw TypeError.
+        matchesAdvertisedId = isHexEqual(derivedMarketId, book.market_id);
+    }
+    catch (cause) {
+        throw new InvalidMidnightApiResponseError(`Midnight API book market_id "${book.market_id}" could not be validated against its market params.`, { cause });
+    }
+    if (!matchesAdvertisedId) {
+        throw new InvalidMidnightApiResponseError(`Midnight API book market_id "${book.market_id}" does not match the id "${derivedMarketId}" derived from its market params.`);
+    }
     return {
         marketId: book.market_id,
         chainId: book.chain_id,
@@ -96,6 +130,26 @@ export function mapBookMarket(book) {
         bids: book.bids.map(mapPriceLevel),
     };
 }
+/** @internal Maps a book market, binding its verified id to the requested market. */
+export function mapBoundBookMarket(book, requestedMarketId) {
+    const market = mapBookMarket(book);
+    if (!isHexEqual(market.marketId, requestedMarketId)) {
+        throw new InvalidMidnightApiResponseError(`Midnight API book market_id "${market.marketId}" does not match requested market "${requestedMarketId}".`);
+    }
+    return market;
+}
+/** @internal Maps listed book markets, binding each verified id to the requested market_ids filter when present. */
+export function mapBoundBooks(books, marketIds) {
+    return books.map((book) => {
+        const market = mapBookMarket(book);
+        if (marketIds != null &&
+            marketIds.length > 0 &&
+            !marketIds.some((marketId) => isHexEqual(marketId, market.marketId))) {
+            throw new InvalidMidnightApiResponseError(`Midnight API book market_id "${market.marketId}" is outside the requested market_ids filter.`);
+        }
+        return market;
+    });
+}
 /** @internal Maps a collateral API payload to the SDK response shape. */
 export function mapCollateral(collateral) {
     return {

package/lib/esm/api/version.generated.d.ts

@@ -1,2 +1,2 @@
 /** @internal Installed Midnight SDK package version. */
-export declare const MIDNIGHT_SDK_VERSION = "1.3.0";
+export declare const MIDNIGHT_SDK_VERSION = "1.3.1";

package/lib/esm/api/version.generated.js

@@ -1,3 +1,3 @@
 // Generated by scripts/release/generate-midnight-package-version.mjs. Do not edit.
 /** @internal Installed Midnight SDK package version. */
-export const MIDNIGHT_SDK_VERSION = "1.3.0";
+export const MIDNIGHT_SDK_VERSION = "1.3.1";

package/lib/esm/fetch/utils.d.ts

@@ -3,6 +3,6 @@ import type { DeploylessFetchParameters, MidnightCallParameters } from "./types.
 /** @internal Extracts viem call parameters from Midnight fetch inputs. */
 export declare const callParameters: (params: MidnightCallParameters) => MidnightCallParameters;
 /** @internal Returns the configured deployless mode, defaulting to enabled. */
-export declare const shouldUseDeployless: (params: DeploylessFetchParameters) => boolean | "force";
+export declare const shouldUseDeployless: (params: DeploylessFetchParameters) => "force" | boolean;
 /** @internal Returns the RPC chain id and rejects configured-chain drift. */
 export declare const resolveChainId: (client: Client) => Promise<number>;

package/lib/esm/signatures/EcrecoverRatifierUtils.d.ts

@@ -434,7 +434,7 @@ export declare namespace EcrecoverRatifierUtils {
      * console.log(EcrecoverRatifierUtils.treeTypeHash(0));
      * ```
      */
-    function treeTypeHash(height: number): "0x270da1ebafc0f24637af3612fb8c3a1d828fcb56d3637c24e86dd006b12ca7f9" | "0x828b9cdf8326a1cf234328e4d5229546a98fb72ef73624f5b6b31538e555b96c" | "0xfcb7a3ca4094246b8185620c4cf025c93032b6f0384805aa3f22afe04290e982" | "0xcc97cb1955496a5269b5a7afca62ba694edcab26ba838a1adbd257931249de92" | "0xda3feb08db360ad9e09540132ff04d2b6a596fdaa4747892217aaa4c7c9bcc31" | "0x15bd6e2aa1a7a61614187ac16d2cbf8610c8f2f3c3d9eaa380ae7a501ee3cf06" | "0xb726cb7fab1a24c28213cbd482fa5a301f127fb25feb01da341919983a72711a" | "0xcea9cd557c6f821868ea287304199d0e0554af630bfa8fe36c64eb3bbacca418" | "0xf7dbde8234e8e345cec8fc0a8ac5909ee336b214882751ecd51e7b37df4f6cdd" | "0x5400a5d43d39e6bfe910af8cb84ac77bf501d310413769dffd62ccecda8b00c6" | "0x0754209b60d99d0822b3ecd5a970f9db09df9c8998a8441e24b81f06d6c76fee" | "0xf5d561d88647c3b38ed6636709d3166819fc66f8ed52a0daf4ae186387b4646c" | "0x5801c07a6c7df039ce00a7a2b8bd92aa1cf333c30b0bc3d78768590b6063d09e" | "0xc9da7190eaf4b14c7cb1c14f9898256c0adb6b1dc303afe79594dea64fe199c0" | "0xa47534c85ac57c583568465d40fd46683d2d558d8129fe1aca01e93023afca92" | "0xb1e841691fb54f4ef85e2ed9de45d610e57f49e1e6eb2510ceead16e447dd519" | "0x4fa4f16f09f0c36c7670449a4032073380d28a60071e12ee8874bb3e5a8318fc" | "0x817bbaac8bb863670f488b454cdd5d0990d9d81871a68e9df381c3c13d3f2ba2" | "0xc447f06079bddf4b011523c4bce119e9e90fdf937de4ee88f48010406560e9c1" | "0x1608d5eb56943c667c34b413f9f8a1c24a84ddfe1301a9c25487e638de1f5822" | "0x3a677100d2e855c24a62d1e9c365bff90d02287f066a07064843ca1ee70ea113";
+    function treeTypeHash(height: number): "0x0754209b60d99d0822b3ecd5a970f9db09df9c8998a8441e24b81f06d6c76fee" | "0x15bd6e2aa1a7a61614187ac16d2cbf8610c8f2f3c3d9eaa380ae7a501ee3cf06" | "0x1608d5eb56943c667c34b413f9f8a1c24a84ddfe1301a9c25487e638de1f5822" | "0x270da1ebafc0f24637af3612fb8c3a1d828fcb56d3637c24e86dd006b12ca7f9" | "0x3a677100d2e855c24a62d1e9c365bff90d02287f066a07064843ca1ee70ea113" | "0x4fa4f16f09f0c36c7670449a4032073380d28a60071e12ee8874bb3e5a8318fc" | "0x5400a5d43d39e6bfe910af8cb84ac77bf501d310413769dffd62ccecda8b00c6" | "0x5801c07a6c7df039ce00a7a2b8bd92aa1cf333c30b0bc3d78768590b6063d09e" | "0x817bbaac8bb863670f488b454cdd5d0990d9d81871a68e9df381c3c13d3f2ba2" | "0x828b9cdf8326a1cf234328e4d5229546a98fb72ef73624f5b6b31538e555b96c" | "0xa47534c85ac57c583568465d40fd46683d2d558d8129fe1aca01e93023afca92" | "0xb1e841691fb54f4ef85e2ed9de45d610e57f49e1e6eb2510ceead16e447dd519" | "0xb726cb7fab1a24c28213cbd482fa5a301f127fb25feb01da341919983a72711a" | "0xc447f06079bddf4b011523c4bce119e9e90fdf937de4ee88f48010406560e9c1" | "0xc9da7190eaf4b14c7cb1c14f9898256c0adb6b1dc303afe79594dea64fe199c0" | "0xcc97cb1955496a5269b5a7afca62ba694edcab26ba838a1adbd257931249de92" | "0xcea9cd557c6f821868ea287304199d0e0554af630bfa8fe36c64eb3bbacca418" | "0xda3feb08db360ad9e09540132ff04d2b6a596fdaa4747892217aaa4c7c9bcc31" | "0xf5d561d88647c3b38ed6636709d3166819fc66f8ed52a0daf4ae186387b4646c" | "0xf7dbde8234e8e345cec8fc0a8ac5909ee336b214882751ecd51e7b37df4f6cdd" | "0xfcb7a3ca4094246b8185620c4cf025c93032b6f0384805aa3f22afe04290e982";
     /**
      * Builds EcrecoverRatifier typed data for a tree-like input.
      *

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@morpho-org/midnight-sdk",
   "description": "Viem-based package for Morpho Midnight that exports protocol utilities, fetch helpers, and Midnight API utilities under a dedicated API subpath.",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "author": "Morpho Association <contact@morpho.org>",
   "contributors": [
     "Rubilmax <rmilon@gmail.com>"
@@ -47,12 +47,12 @@
     "viem": "^2.0.0"
   },
   "devDependencies": {
-    "fast-check": "^4.8.0",
-    "typescript": "^6.0.3",
-    "viem": "^2.54.2",
-    "vitest": "^4.1.9",
-    "@morpho-org/morpho-ts": "^2.8.0",
-    "@morpho-org/test": "^2.8.3"
+    "fast-check": "^4.9.0",
+    "typescript": "^7.0.2",
+    "viem": "^2.55.10",
+    "vitest": "^4.1.10",
+    "@morpho-org/morpho-ts": "^2.11.1",
+    "@morpho-org/test": "^2.10.0"
   },
   "scripts": {
     "prepublish": "$npm_execpath build",
@@ -61,7 +61,7 @@
     "build:cjs": "tsc --build tsconfig.build.cjs.json && echo '{\"type\":\"commonjs\"}' > lib/cjs/package.json",
     "build:esm": "tsc --build tsconfig.build.esm.json && echo '{\"type\":\"module\"}' > lib/esm/package.json",
     "generate:version": "node ../../scripts/release/generate-midnight-package-version.mjs",
-    "test": "vitest --root ../.. --project midnight-sdk"
+    "test": "vitest --root ../.. --project midnight-sdk --project midnight-sdk-fork"
   },
   "types": "./lib/esm/index.d.ts"
 }