[kartojal]

Routes existing discovery, pricing, account, trading, portfolio, wallet and combo SDK methods through supported Predictions routes. Saved L2 credentials migrate to bearer credentials before business requests. Perps and WebSocket transports remain separate.

Routing follows the DeFi Gateway passthrough tables at master 5d031a59. Keyset comments use /v1/comments and its cursor envelope. Two operations keep their direct endpoints because the Gateway has no equivalent: offset-only comment filters with legacy offset cursors, and order heartbeats. The Gateway still forwards /v1/trading/heartbeats to legacy /heartbeats, which returns {status:"ok"} and reads only L2 credentials. So sendOrderHeartbeat stays on /v1/heartbeats until the Gateway serves the V1 contract. No new public SDK methods were added for Gateway-only endpoints.

API keys sign only the operations of their credential family, against the upstream method and path. Builder keys sign trading operations and builder RFQ writes. Keys that support gasless transactions sign wallet, collateral return and session-signer operations. Discovery, Gamma, Data and auth requests carry no API-key headers, so a relayer key or a remote builder signer no longer runs on every read. Request query, body, pagination and Blob responses stay intact. Routing decisions occur before dispatch, with no automatic fallback on failure.

The unused L2 signing branch is gone, along with the builder gateway and collateral transports that no action uses after the move.

Tests follow AGENTS.md. prediction-signing.test.ts covers the signing table as a pure function, with no client or mocked responses. Routing proof and the activity query cases moved to the live integration suite with fetch spies. The integration URL assertions now name the Gateway routes, and the live event walk stops at 20 pages because each Gateway page adds about 0.1 s.

Inherits #437's setup-failure session revocation and deferred new-session credential notifications.

Stack: #442 → #481 → #437 → #463 → #438 → #441. Restacked onto main on 2026-11-03 after #448 removed the accounting snapshot download.

Validation on 2026-11-03: build, lint and workspace typecheck pass, and 1,101 client tests pass. The live integration suites for the moved public reads pass against production. The exceptions are two holder-comment depth tests, which fail the same way on the #437 base. Suites that need wallet secrets were not run. Live production checks on the previous head covered signed login, automatic saved-L2 migration, authenticated order, trade, notification, trading-status and balance-allowance reads, bearer refresh and logout. No trading, transfers, approvals or wallet deployment were performed.

Human reviews and unresolved review threads remain outstanding.

---

Note

^{Cursor Bugbot is generating a summary for commit ebb8ddc. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c99441d. Configure here.}