@0xmonaco/core 0.8.5 → 0.8.7-develop.0f12336

package/dist/api/auth/api.js

@@ -1,11 +1,13 @@
 /**
  * Auth API Implementation
  *
- * Handles authentication operations including challenge creation, signature verification,
- * and backend authentication. All operations go through the API Gateway.
+ * Handles wallet authentication operations including challenge creation, signature
+ * verification, and session lifecycle. All operations go through the API Gateway.
  *
- * This class provides a complete interface for authentication on the Monaco protocol,
- * including frontend wallet authentication and backend service authentication.
+ * This class provides a complete interface for wallet-based authentication on the
+ * Monaco protocol. Backend services authenticate separately by setting their
+ * application secret key (`sk_...`) via {@link BaseAPI.setServerKey}, which is sent
+ * in the `x-server-key` header on backend requests — there is no token exchange.
  *
  * @example
  * ```typescript
@@ -23,11 +25,9 @@
  *   challenge.nonce,
  *   clientId
  * );
- *
- * // Authenticate backend service
- * const backendAuth = await authAPI.authenticateBackend(secretKey);
  * ```
  */
+import { generateSessionKeypair, privateKeyHex, publicKeyHex } from "../../crypto/session";
 import { InvalidConfigError } from "../../errors";
 import { BaseAPI } from "../base";
 export class AuthAPIImpl extends BaseAPI {
@@ -56,20 +56,24 @@ export class AuthAPIImpl extends BaseAPI {
      * Complete authentication flow for frontend applications.
      *
      * This method handles the entire authentication process:
-     * 1. Creates a challenge
-     * 2. Signs the challenge message
-     * 3. Verifies the signature and returns JWT tokens
+     * 1. Generates a fresh ed25519 session keypair locally
+     * 2. Creates a challenge that commits to the session public key
+     * 3. Signs the challenge message with the wallet
+     * 4. Verifies the signature, registering the session public key
+     *
+     * The returned {@link AuthState} carries the session keypair; sign subsequent
+     * requests with the private key (the wallet is not used again until the
+     * session expires).
      *
      * @param clientId - Client ID of the application
-     * @returns Promise resolving to the verification response with JWT tokens
+     * @returns Promise resolving to the authentication state (with the session keypair)
      * @throws {APIError} When authentication fails
      * @throws {InvalidConfigError} When wallet account is not available
      *
      * @example
      * ```typescript
-     * // Complete authentication in one call
      * const authResult = await authAPI.authenticate("my-app-client-id");
-     * console.log(`Access token: ${authResult.access_token}`);
+     * console.log(`Session public key: ${authResult.sessionPublicKey}`);
      * console.log(`User ID: ${authResult.user.id}`);
      * ```
      */
@@ -81,12 +85,19 @@ export class AuthAPIImpl extends BaseAPI {
         if (!account) {
             throw new InvalidConfigError("No account available in wallet client", "account");
         }
-        // 1. Create challenge
-        const challenge = await this.createChallenge(account.address, clientId);
-        // 2. Sign the challenge message
+        // 1. Generate a fresh session keypair locally — the server never sees the
+        //    private key.
+        const keypair = generateSessionKeypair();
+        const session = {
+            publicKey: publicKeyHex(keypair),
+            privateKey: privateKeyHex(keypair),
+        };
+        // 2. Create challenge (binds the session public key into the signed message)
+        const challenge = await this.createChallenge(account.address, clientId, session.publicKey);
+        // 3. Sign the challenge message with the wallet
         const signature = await this.signChallenge(challenge.message);
-        // 3. Verify signature and get tokens
-        return await this.verifySignature(account.address, signature, challenge.nonce, clientId);
+        // 4. Verify signature, registering the session public key
+        return await this.verifySignature(account.address, signature, challenge.nonce, clientId, session);
     }
     /**
      * Signs a challenge message using the wallet client.
@@ -141,19 +152,20 @@ export class AuthAPIImpl extends BaseAPI {
      * console.log(`Nonce: ${challenge.nonce}`);
      * ```
      */
-    async createChallenge(address, clientId) {
+    async createChallenge(address, clientId, sessionPublicKey) {
         const responseBody = await this.makePublicRequest("/api/v1/auth/challenge", {
             method: "POST",
             body: JSON.stringify({
                 address,
-                client_id: clientId,
-                chain_id: this.chain.id,
+                clientId: clientId,
+                chainId: this.chain.id,
+                sessionPublicKey: sessionPublicKey,
             }),
         });
         return {
             nonce: responseBody.nonce,
             message: responseBody.message,
-            expiresAt: responseBody.expires_at,
+            expiresAt: responseBody.expiresAt,
         };
     }
     /**
@@ -163,47 +175,39 @@ export class AuthAPIImpl extends BaseAPI {
      * authenticated API access. This is the second step in the authentication flow.
      *
      * @param address - Wallet address of the user
-     * @param signature - Signature of the challenge message
+     * @param signature - Wallet signature of the challenge message
      * @param nonce - Nonce from the challenge response
      * @param clientId - Client ID of the application
-     * @returns Promise resolving to the verification response with JWT tokens
+     * @param session - The locally-generated session keypair (hex-encoded)
+     * @returns Promise resolving to the authentication state (with the session keypair)
      * @throws {APIError} When signature verification fails
      *
      * @example
      * ```typescript
-     * // First create a challenge
-     * const challenge = await authAPI.createChallenge(address, clientId);
-     *
-     * // User signs the challenge message with their wallet
+     * const keypair = generateSessionKeypair();
+     * const session = { publicKey: publicKeyHex(keypair), privateKey: privateKeyHex(keypair) };
+     * const challenge = await authAPI.createChallenge(address, clientId, session.publicKey);
      * const signature = await wallet.signMessage(challenge.message);
-     *
-     * // Verify the signature and get tokens
-     * const authResult = await authAPI.verifySignature(
-     *   address,
-     *   signature,
-     *   challenge.nonce,
-     *   clientId
-     * );
-     *
-     * console.log(`Access token: ${authResult.accessToken}`);
-     * console.log(`User ID: ${authResult.user.id}`);
+     * const authResult = await authAPI.verifySignature(address, signature, challenge.nonce, clientId, session);
+     * console.log(`Session public key: ${authResult.sessionPublicKey}`);
      * ```
      */
-    async verifySignature(address, signature, nonce, clientId) {
+    async verifySignature(address, signature, nonce, clientId, session) {
         const responseBody = await this.makePublicRequest("/api/v1/auth/verify", {
             method: "POST",
             body: JSON.stringify({
                 address,
                 signature,
                 nonce,
-                client_id: clientId,
-                chain_id: this.chain.id,
+                clientId: clientId,
+                chainId: this.chain.id,
+                sessionPublicKey: session.publicKey,
             }),
         });
         return {
-            accessToken: responseBody.access_token,
-            refreshToken: responseBody.refresh_token,
-            expiresAt: responseBody.expires_at,
+            sessionPublicKey: session.publicKey,
+            sessionPrivateKey: session.privateKey,
+            expiresAt: responseBody.expiresAt,
             user: {
                 id: responseBody.user.id,
                 address: responseBody.user.address,
@@ -212,92 +216,45 @@ export class AuthAPIImpl extends BaseAPI {
         };
     }
     /**
-     * Authenticates a backend service using a secret key.
-     *
-     * Returns JWT tokens for API access. This method is used for backend services
-     * that need to authenticate with the Monaco API Gateway.
-     *
-     * @param secretKey - Secret key of the application
-     * @returns Promise resolving to the backend auth response with JWT tokens
-     * @throws {APIError} When backend authentication fails
-     *
-     * @example
-     * ```typescript
-     * const backendAuth = await authAPI.authenticateBackend("my-secret-key");
-     * console.log(`Backend access token: ${backendAuth.accessToken}`);
-     * console.log(`Application: ${backendAuth.application.name}`);
-     * ```
-     */
-    async authenticateBackend(secretKey) {
-        const responseBody = await this.makePublicRequest("/api/v1/auth/backend", {
-            method: "POST",
-            body: JSON.stringify({
-                secret_key: secretKey,
-                chain_id: this.chain.id,
-            }),
-        });
-        return {
-            accessToken: responseBody.access_token,
-            expiresAt: responseBody.expires_at,
-            application: {
-                id: responseBody.application.id,
-                name: responseBody.application.name,
-                clientId: responseBody.application.client_id,
-            },
-        };
-    }
-    /**
-     * Refreshes an access token using a refresh token.
+     * Extends the current session's expiry.
      *
-     * Obtains a new access token using a valid refresh token. This is useful for
-     * maintaining long-term authentication without requiring the user to sign
-     * a new challenge.
+     * The request is signed with the active session key (set via
+     * {@link setSessionKeypair}); the server bumps the session's `expiresAt`.
+     * No new credential is issued — the same keypair keeps working.
      *
-     * @param refreshToken - The refresh token to use
-     * @returns Promise resolving to new access and refresh tokens
-     * @throws {APIError} When token refresh fails
+     * @returns Promise resolving to the new expiry
+     * @throws {APIError} When refresh fails (e.g. session expired or revoked)
      *
      * @example
      * ```typescript
-     * const newTokens = await authAPI.refreshToken(refreshToken);
-     * console.log(`New access token: ${newTokens.accessToken}`);
-     * console.log(`Expires at: ${new Date(newTokens.expiresAt * 1000)}`);
+     * const { expiresAt } = await authAPI.refreshSession();
+     * console.log(`Session now expires at: ${new Date(expiresAt * 1000)}`);
      * ```
      */
-    async refreshToken(refreshToken) {
-        const responseBody = await this.makePublicRequest("/api/v1/auth/refresh", {
+    async refreshSession() {
+        const responseBody = await this.makeAuthenticatedRequest("/api/v1/auth/refresh", {
             method: "POST",
-            body: JSON.stringify({
-                refresh_token: refreshToken,
-            }),
         });
         return {
-            accessToken: responseBody.access_token,
-            expiresAt: responseBody.expires_at,
+            expiresAt: responseBody.expiresAt,
         };
     }
     /**
-     * Revokes the current session's refresh token.
-     *
-     * Invalidates the refresh token associated with the current access token,
-     * preventing it from being used to obtain new access tokens. This is useful
-     * for logout functionality or when a token has been compromised.
+     * Revokes the current session.
      *
-     * The server identifies the token to revoke from the access token in the
-     * Authorization header — no request body is needed.
+     * The request is signed with the active session key; the server deletes the
+     * matching session row. Used for logout or when a key may be compromised.
      *
-     * @returns Promise resolving when the token is revoked
-     * @throws {APIError} When token revocation fails
+     * @returns Promise resolving when the session is revoked
+     * @throws {APIError} When revocation fails
      *
      * @example
      * ```typescript
-     * // After authentication
-     * const authResult = await authAPI.authenticate(clientId);
-     * await authAPI.revokeToken();
-     * console.log("Token revoked successfully");
+     * await authAPI.revokeSession();
+     * console.log("Session revoked successfully");
      * ```
      */
-    async revokeToken() {
+    async revokeSession() {
         await this.makeAuthenticatedRequest("/api/v1/auth/revoke", {
             method: "POST",
         });

package/dist/api/base.d.ts

@@ -20,13 +20,18 @@
  * }
  * ```
  */
+import type { SessionCredentials } from "@0xmonaco/types";
+import { type SessionKeypair } from "../crypto/session";
 export interface RetryOptions {
     maxRetries?: number;
     baseDelayMs?: number;
 }
 export declare abstract class BaseAPI {
     protected readonly apiUrl: string;
-    protected accessToken?: string;
+    /** Active session keypair (raw bytes) used to sign authenticated requests. */
+    protected sessionKeypair?: SessionKeypair;
+    /** Application secret key (`sk_...`) sent in the `x-server-key` header for backend-authenticated requests. */
+    protected serverKey?: string;
     protected retryOptions: Required<RetryOptions>;
     /**
      * Creates a new BaseAPI instance.
@@ -36,17 +41,24 @@ export declare abstract class BaseAPI {
      */
     constructor(apiUrl: string, retryOptions?: RetryOptions);
     /**
-     * Set the access token for authenticated requests.
+     * Set (or clear) the session keypair used to sign authenticated requests.
      *
-     * @param token - JWT access token
+     * @param credentials - Hex-encoded session keypair, or `undefined` to clear.
      */
-    setAccessToken(token: string): void;
+    setSessionKeypair(credentials: SessionCredentials | undefined): void;
     /**
-     * Get the current access token.
+     * Set (or clear) the application secret key used for backend-authenticated
+     * requests.
      *
-     * @returns The current access token or undefined if not set
+     * Backend endpoints (those annotated `#[require_backend]` on the gateway)
+     * authenticate with a static application secret key rather than a session
+     * signature. When set, the raw key is sent verbatim in the `x-server-key`
+     * header on every {@link makeBackendRequest}. This is independent of the
+     * session keypair — a client may hold both.
+     *
+     * @param serverKey - The application secret key (`sk_...`), or `undefined` to clear.
      */
-    protected getAccessToken(): string | undefined;
+    setServerKey(serverKey: string | undefined): void;
     /**
      * Parse request body for error logging
      *
@@ -87,12 +99,41 @@ export declare abstract class BaseAPI {
      *   '/api/v1/orders',
      *   {
      *     method: 'POST',
-     *     body: JSON.stringify({ trading_pair: 'ETH-USD', side: 'BUY' })
+     *     body: JSON.stringify({ tradingPair: 'ETH-USD', side: 'BUY' })
      *   }
      * );
      * ```
      */
     protected makeAuthenticatedRequest<T>(endpoint: string, options?: RequestInit): Promise<T>;
+    /**
+     * Compute the per-request ed25519 signature headers.
+     *
+     * The signed payload is `METHOD\nPATH_WITH_QUERY\nTIMESTAMP_MS\nSHA256_BODY_HEX`,
+     * matching the server (`handlers::auth::compose_signing_string`). `endpoint`
+     * is the path-with-query exactly as sent; the body hash covers the raw bytes
+     * so a request can't be replayed with a different body.
+     */
+    private buildSignatureHeaders;
+    /**
+     * Makes a backend-authenticated API request using the application secret key.
+     *
+     * Sends the raw `sk_...` key (set via {@link setServerKey}) in the
+     * `x-server-key` header. The gateway hashes and matches it against the
+     * application on every request — there is no signing and no token exchange.
+     * Use this for endpoints annotated `#[require_backend]`.
+     *
+     * @param endpoint - The API endpoint to call (should start with /)
+     * @param options - Request options (method, body, headers, etc.)
+     * @returns Promise resolving to the response data
+     * @throws {APIError} When the server key is not set or the API request fails
+     *
+     * @example
+     * ```typescript
+     * this.setServerKey("sk_live_...");
+     * const orders = await this.makeBackendRequest<ListAppOrdersResponse>('/api/v1/applications/orders');
+     * ```
+     */
+    protected makeBackendRequest<T>(endpoint: string, options?: RequestInit): Promise<T>;
     /**
      * Makes an unauthenticated API request.
      *
@@ -114,7 +155,7 @@ export declare abstract class BaseAPI {
      *   '/api/v1/auth/challenge',
      *   {
      *     method: 'POST',
-     *     body: JSON.stringify({ address, client_id: clientId })
+     *     body: JSON.stringify({ address, clientId: clientId })
      *   }
      * );
      * ```

package/dist/api/base.js

@@ -20,11 +20,16 @@
  * }
  * ```
  */
+import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils";
 import { StatusCodes } from "http-status-codes";
+import { composeSigningString, keypairFromHex, sha256Hex, signMessage } from "../crypto/session";
 import { APIError } from "../errors";
 export class BaseAPI {
     apiUrl;
-    accessToken;
+    /** Active session keypair (raw bytes) used to sign authenticated requests. */
+    sessionKeypair;
+    /** Application secret key (`sk_...`) sent in the `x-server-key` header for backend-authenticated requests. */
+    serverKey;
     retryOptions;
     /**
      * Creates a new BaseAPI instance.
@@ -40,20 +45,27 @@ export class BaseAPI {
         };
     }
     /**
-     * Set the access token for authenticated requests.
+     * Set (or clear) the session keypair used to sign authenticated requests.
      *
-     * @param token - JWT access token
+     * @param credentials - Hex-encoded session keypair, or `undefined` to clear.
      */
-    setAccessToken(token) {
-        this.accessToken = token;
+    setSessionKeypair(credentials) {
+        this.sessionKeypair = credentials ? keypairFromHex(credentials.publicKey, credentials.privateKey) : undefined;
     }
     /**
-     * Get the current access token.
+     * Set (or clear) the application secret key used for backend-authenticated
+     * requests.
      *
-     * @returns The current access token or undefined if not set
+     * Backend endpoints (those annotated `#[require_backend]` on the gateway)
+     * authenticate with a static application secret key rather than a session
+     * signature. When set, the raw key is sent verbatim in the `x-server-key`
+     * header on every {@link makeBackendRequest}. This is independent of the
+     * session keypair — a client may hold both.
+     *
+     * @param serverKey - The application secret key (`sk_...`), or `undefined` to clear.
      */
-    getAccessToken() {
-        return this.accessToken;
+    setServerKey(serverKey) {
+        this.serverKey = serverKey;
     }
     /**
      * Parse request body for error logging
@@ -175,6 +187,12 @@ export class BaseAPI {
                     retryAfter,
                 });
             }
+            // A successful response with an empty body (e.g. 204 No Content from a
+            // DELETE) is not an error — there is simply nothing to parse. Return
+            // `undefined` so void-returning methods resolve cleanly.
+            if (responseText.trim() === "") {
+                return undefined;
+            }
             // If response is OK but not JSON, throw a more specific error
             throw new APIError(`Expected JSON response but received ${contentType}`, {
                 endpoint: url,
@@ -223,14 +241,79 @@ export class BaseAPI {
      *   '/api/v1/orders',
      *   {
      *     method: 'POST',
-     *     body: JSON.stringify({ trading_pair: 'ETH-USD', side: 'BUY' })
+     *     body: JSON.stringify({ tradingPair: 'ETH-USD', side: 'BUY' })
      *   }
      * );
      * ```
      */
     async makeAuthenticatedRequest(endpoint, options = {}) {
-        if (!this.accessToken) {
-            throw new APIError("Access token not set. Call setAccessToken() first.", {
+        if (!this.sessionKeypair) {
+            throw new APIError("Session keypair not set. Authenticate (login) first.", {
+                endpoint: `${this.apiUrl}${endpoint}`,
+                statusCode: StatusCodes.UNAUTHORIZED,
+            });
+        }
+        const url = `${this.apiUrl}${endpoint}`;
+        const requestBody = this.parseRequestBody(options.body);
+        const signatureHeaders = this.buildSignatureHeaders(endpoint, options);
+        return this.executeRequest(url, endpoint, {
+            ...options,
+            headers: {
+                "Content-Type": "application/json",
+                ...signatureHeaders,
+                ...options.headers,
+            },
+        }, requestBody);
+    }
+    /**
+     * Compute the per-request ed25519 signature headers.
+     *
+     * The signed payload is `METHOD\nPATH_WITH_QUERY\nTIMESTAMP_MS\nSHA256_BODY_HEX`,
+     * matching the server (`handlers::auth::compose_signing_string`). `endpoint`
+     * is the path-with-query exactly as sent; the body hash covers the raw bytes
+     * so a request can't be replayed with a different body.
+     */
+    buildSignatureHeaders(endpoint, options) {
+        if (!this.sessionKeypair) {
+            throw new APIError("Session keypair not set. Authenticate (login) first.", {
+                endpoint: `${this.apiUrl}${endpoint}`,
+                statusCode: StatusCodes.UNAUTHORIZED,
+            });
+        }
+        const method = (options.method ?? "GET").toUpperCase();
+        const timestampMs = Date.now();
+        const bodyBytes = typeof options.body === "string" ? utf8ToBytes(options.body) : new Uint8Array(0);
+        const bodyHash = sha256Hex(bodyBytes);
+        const signingString = composeSigningString(method, endpoint, timestampMs, bodyHash);
+        const signature = signMessage(this.sessionKeypair.privateKey, signingString);
+        return {
+            "X-Monaco-PublicKey": bytesToHex(this.sessionKeypair.publicKey),
+            "X-Monaco-Timestamp": String(timestampMs),
+            "X-Monaco-Signature": signature,
+        };
+    }
+    /**
+     * Makes a backend-authenticated API request using the application secret key.
+     *
+     * Sends the raw `sk_...` key (set via {@link setServerKey}) in the
+     * `x-server-key` header. The gateway hashes and matches it against the
+     * application on every request — there is no signing and no token exchange.
+     * Use this for endpoints annotated `#[require_backend]`.
+     *
+     * @param endpoint - The API endpoint to call (should start with /)
+     * @param options - Request options (method, body, headers, etc.)
+     * @returns Promise resolving to the response data
+     * @throws {APIError} When the server key is not set or the API request fails
+     *
+     * @example
+     * ```typescript
+     * this.setServerKey("sk_live_...");
+     * const orders = await this.makeBackendRequest<ListAppOrdersResponse>('/api/v1/applications/orders');
+     * ```
+     */
+    async makeBackendRequest(endpoint, options = {}) {
+        if (!this.serverKey) {
+            throw new APIError("Server key not set. Call setServerKey(sk_...) first.", {
                 endpoint: `${this.apiUrl}${endpoint}`,
                 statusCode: StatusCodes.UNAUTHORIZED,
             });
@@ -241,7 +324,7 @@ export class BaseAPI {
             ...options,
             headers: {
                 "Content-Type": "application/json",
-                Authorization: `Bearer ${this.accessToken}`,
+                "x-server-key": this.serverKey,
                 ...options.headers,
             },
         }, requestBody);
@@ -267,7 +350,7 @@ export class BaseAPI {
      *   '/api/v1/auth/challenge',
      *   {
      *     method: 'POST',
-     *     body: JSON.stringify({ address, client_id: clientId })
+     *     body: JSON.stringify({ address, clientId: clientId })
      *   }
      * );
      * ```

package/dist/api/delegated-agents/api.d.ts

@@ -1,8 +1,9 @@
-import type { CreateDelegatedSessionRequest, CreateDelegatedSessionResponse, DelegatedAgent, DelegatedAgentsAPI, ListDelegatedAgentsResponse, UpsertDelegatedAgentRequest } from "@0xmonaco/types";
+import type { CreateDelegatedSessionRequest, CreateDelegatedSessionResponse, DelegatedAgent, DelegatedAgentsAPI, ListDelegatedAgentsResponse, ListDelegatedOwnersResponse, UpsertDelegatedAgentRequest } from "@0xmonaco/types";
 import { BaseAPI } from "../base";
 export declare class DelegatedAgentsAPIImpl extends BaseAPI implements DelegatedAgentsAPI {
     upsertDelegatedAgent(request: UpsertDelegatedAgentRequest): Promise<DelegatedAgent>;
     listDelegatedAgents(): Promise<ListDelegatedAgentsResponse>;
+    listDelegatedOwners(): Promise<ListDelegatedOwnersResponse>;
     revokeDelegatedAgent(delegatedAgentId: string): Promise<{
         status: "REVOKED";
     }>;

package/dist/api/delegated-agents/api.js

@@ -5,23 +5,26 @@ export class DelegatedAgentsAPIImpl extends BaseAPI {
         return this.makeAuthenticatedRequest(perpRoutes.delegatedAgents.list(), {
             method: "POST",
             body: JSON.stringify({
-                agent_address: request.agentAddress,
+                agentAddress: request.agentAddress,
                 name: request.name,
-                expires_at: request.expiresAt,
-                allowed_actions: request.allowedActions,
-                allowed_trading_pair_ids: request.allowedTradingPairIds,
-                allowed_margin_account_ids: request.allowedMarginAccountIds,
-                allowed_order_types: request.allowedOrderTypes,
-                allowed_time_in_force: request.allowedTimeInForce,
-                max_leverage: request.maxLeverage,
-                max_order_notional: request.maxOrderNotional,
-                max_open_orders: request.maxOpenOrders,
+                expiresAt: request.expiresAt,
+                allowedActions: request.allowedActions,
+                allowedTradingPairIds: request.allowedTradingPairIds,
+                allowedMarginAccountIds: request.allowedMarginAccountIds,
+                allowedOrderTypes: request.allowedOrderTypes,
+                allowedTimeInForce: request.allowedTimeInForce,
+                maxLeverage: request.maxLeverage,
+                maxOrderNotional: request.maxOrderNotional,
+                maxOpenOrders: request.maxOpenOrders,
             }),
         });
     }
     async listDelegatedAgents() {
         return this.makeAuthenticatedRequest(perpRoutes.delegatedAgents.list());
     }
+    async listDelegatedOwners() {
+        return this.makeAuthenticatedRequest(perpRoutes.delegatedAgents.owners());
+    }
     async revokeDelegatedAgent(delegatedAgentId) {
         return this.makeAuthenticatedRequest(perpRoutes.delegatedAgents.byId(delegatedAgentId), {
             method: "DELETE",
@@ -31,7 +34,8 @@ export class DelegatedAgentsAPIImpl extends BaseAPI {
         return this.makeAuthenticatedRequest(perpRoutes.delegatedAgents.sessions(), {
             method: "POST",
             body: JSON.stringify({
-                owner_user_id: request.ownerUserId,
+                ownerUserId: request.ownerUserId,
+                sessionPublicKey: request.sessionPublicKey,
             }),
         });
     }

package/dist/api/faucet/api.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Faucet API Implementation
+ *
+ * Testnet token faucet. Session-authenticated. Performs real on-chain mints
+ * from a backend-operator-funded signer and is rate-limited per user
+ * (default 1 request / 24h). It is unavailable if the gateway operator has not
+ * configured a signer — the SDK caller has no control over that.
+ *
+ * @example
+ * ```typescript
+ * const { minted, failed, remainingRequests24h } = await sdk.faucet.mint();
+ * ```
+ */
+import type { FaucetAPI, MintTokensResponse } from "@0xmonaco/types";
+import { BaseAPI } from "../base";
+export declare class FaucetAPIImpl extends BaseAPI implements FaucetAPI {
+    /**
+     * Mints the full set of testnet tokens to the authenticated user.
+     *
+     * Partial success is possible — inspect `minted` and `failed` in the response.
+     *
+     * @returns Promise resolving to the minted/failed tokens and remaining quota
+     */
+    mint(): Promise<MintTokensResponse>;
+}