@0xmonaco/core 0.8.7 → 0.8.10

package/dist/sdk.js

@@ -4,25 +4,44 @@ import { sei, seiTestnet } from "viem/chains";
 import { ApplicationsAPIImpl, createMonacoWebSocket, OrderbookAPIImpl, TradesAPIImpl } from "./api";
 import { AuthAPIImpl } from "./api/auth";
 import { DelegatedAgentsAPIImpl } from "./api/delegated-agents";
+import { FaucetAPIImpl } from "./api/faucet";
 import { FeesAPIImpl } from "./api/fees";
 import { MarginAccountsAPIImpl } from "./api/margin-accounts";
 import { MarketAPIImpl } from "./api/market";
 import { PositionsAPIImpl } from "./api/positions";
 import { ProfileAPIImpl } from "./api/profile";
+import { SubAccountsAPIImpl } from "./api/sub-accounts";
 import { TradingAPIImpl } from "./api/trading";
 import { VaultAPIImpl } from "./api/vault";
+import { WhitelistAPIImpl } from "./api/whitelist";
+import { WithdrawalsAPIImpl } from "./api/withdrawals";
+import { generateSessionKeypair, privateKeyHex, publicKeyHex } from "./crypto/session";
 import { APIError, InvalidConfigError, InvalidStateError } from "./errors";
 import { resolveApiUrl, resolveWsUrl } from "./networks";
+/** Validate a user-supplied URL override, returning it unchanged when valid. */
+function validateUrl(value, field) {
+    try {
+        new URL(value);
+    }
+    catch (_e) {
+        throw new InvalidConfigError(`${field} must be a valid URL, got: ${value}`, field);
+    }
+    return value;
+}
 export class MonacoSDKImpl {
     auth;
     delegatedAgents;
     applications;
     fees;
     vault;
+    withdrawals;
     trading;
     market;
     marginAccounts;
     positions;
+    subAccounts;
+    faucet;
+    whitelist;
     profile;
     orderbook;
     trades;
@@ -33,22 +52,69 @@ export class MonacoSDKImpl {
     network;
     chain;
     /**
-     * Propagate the access token to all APIs and WebSocket
+     * Propagate the session keypair (or `undefined` to clear) to all APIs and
+     * the WebSocket client.
+     */
+    propagateSession(credentials) {
+        this.auth.setSessionKeypair(credentials);
+        this.delegatedAgents.setSessionKeypair(credentials);
+        this.applications.setSessionKeypair(credentials);
+        this.fees.setSessionKeypair(credentials);
+        this.vault.setSessionKeypair(credentials);
+        this.withdrawals.setSessionKeypair(credentials);
+        this.trading.setSessionKeypair(credentials);
+        this.market.setSessionKeypair(credentials);
+        this.marginAccounts.setSessionKeypair(credentials);
+        this.positions.setSessionKeypair(credentials);
+        this.subAccounts.setSessionKeypair(credentials);
+        this.faucet.setSessionKeypair(credentials);
+        this.whitelist.setSessionKeypair(credentials);
+        this.profile.setSessionKeypair(credentials);
+        this.orderbook.setSessionKeypair(credentials);
+        this.trades.setSessionKeypair(credentials);
+        this.ws.setSessionKeypair(credentials);
+    }
+    /**
+     * Set (or clear) the application secret key used for backend-authenticated
+     * requests (those annotated `#[require_backend]` on the gateway, e.g. the
+     * `applications` reporting endpoints).
+     *
+     * The raw `sk_...` key is sent in the `x-server-key` header on each such
+     * request. This is independent of {@link login}/session auth — a client may
+     * hold both a session and a server key at once.
+     *
+     * @param serverKey - The application secret key (`sk_...`), or `undefined` to clear.
+     *
+     * @example
+     * ```typescript
+     * sdk.setServerKey("sk_live_...");
+     * const orders = await sdk.applications.listApplicationOrders({ status: "FILLED" });
+     * ```
      */
-    propagateAccessToken(accessToken) {
-        this.auth.setAccessToken(accessToken);
-        this.delegatedAgents.setAccessToken(accessToken);
-        this.applications.setAccessToken(accessToken);
-        this.fees.setAccessToken(accessToken);
-        this.vault.setAccessToken(accessToken);
-        this.trading.setAccessToken(accessToken);
-        this.market.setAccessToken(accessToken);
-        this.marginAccounts.setAccessToken(accessToken);
-        this.positions.setAccessToken(accessToken);
-        this.profile.setAccessToken(accessToken);
-        this.orderbook.setAccessToken(accessToken);
-        this.trades.setAccessToken(accessToken);
-        this.ws.setToken(accessToken);
+    setServerKey(serverKey) {
+        this.auth.setServerKey(serverKey);
+        this.delegatedAgents.setServerKey(serverKey);
+        this.applications.setServerKey(serverKey);
+        this.fees.setServerKey(serverKey);
+        this.vault.setServerKey(serverKey);
+        this.withdrawals.setServerKey(serverKey);
+        this.trading.setServerKey(serverKey);
+        this.market.setServerKey(serverKey);
+        this.marginAccounts.setServerKey(serverKey);
+        this.positions.setServerKey(serverKey);
+        this.subAccounts.setServerKey(serverKey);
+        this.faucet.setServerKey(serverKey);
+        this.whitelist.setServerKey(serverKey);
+        this.profile.setServerKey(serverKey);
+        this.orderbook.setServerKey(serverKey);
+        this.trades.setServerKey(serverKey);
+    }
+    /** Extract the session keypair from an auth state. */
+    sessionFromAuthState(authState) {
+        return {
+            publicKey: authState.sessionPublicKey,
+            privateKey: authState.sessionPrivateKey,
+        };
     }
     constructor(cfg) {
         // Validate network - must be a preset
@@ -67,8 +133,8 @@ export class MonacoSDKImpl {
         catch (_e) {
             throw new InvalidConfigError(`seiRpcUrl must be a valid URL, got: ${cfg.seiRpcUrl}`, "seiRpcUrl");
         }
-        // Infer WebSocket URL from network
-        const wsUrl = resolveWsUrl(this.network);
+        // Resolve the WebSocket URL: explicit override (validated) or network preset.
+        const wsUrl = cfg.wsUrl ? validateUrl(cfg.wsUrl, "wsUrl") : resolveWsUrl(this.network);
         // Use Sei mainnet chain only for "mainnet" network, testnet for everything else
         const chain = this.network === "mainnet" ? sei : seiTestnet;
         this.chain = chain;
@@ -78,8 +144,8 @@ export class MonacoSDKImpl {
             chain,
             transport,
         });
-        // Resolve the API URL (from preset or custom URL)
-        const apiUrl = resolveApiUrl(this.network);
+        // Resolve the API URL: explicit override (validated) or network preset.
+        const apiUrl = cfg.apiUrl ? validateUrl(cfg.apiUrl, "apiUrl") : resolveApiUrl(this.network);
         // Validate wallet client chain if provided
         if (cfg.walletClient) {
             if (cfg.walletClient.chain?.id !== chain.id) {
@@ -92,11 +158,15 @@ export class MonacoSDKImpl {
         this.market = new MarketAPIImpl(apiUrl);
         this.marginAccounts = new MarginAccountsAPIImpl(apiUrl);
         this.positions = new PositionsAPIImpl(apiUrl);
+        this.subAccounts = new SubAccountsAPIImpl(apiUrl);
+        this.faucet = new FaucetAPIImpl(apiUrl);
+        this.whitelist = new WhitelistAPIImpl(apiUrl);
         this.auth = new AuthAPIImpl(this.walletClient, this.chain, apiUrl);
         this.delegatedAgents = new DelegatedAgentsAPIImpl(apiUrl);
         this.fees = new FeesAPIImpl(apiUrl);
         this.profile = new ProfileAPIImpl(apiUrl);
         this.vault = new VaultAPIImpl(this.publicClient, this.walletClient, this.chain, this.applications, this.profile, apiUrl);
+        this.withdrawals = new WithdrawalsAPIImpl(apiUrl);
         this.trading = new TradingAPIImpl(apiUrl);
         this.orderbook = new OrderbookAPIImpl(apiUrl);
         this.trades = new TradesAPIImpl(apiUrl);
@@ -107,14 +177,16 @@ export class MonacoSDKImpl {
     /**
      * Authenticate the user
      *
-     * Returns an AuthState object containing:
-     * - `accessToken`: For making authenticated API requests
-     * - `refreshToken`: For refreshing tokens AND revoking (logout)
-     * - `expiresAt`: When the access token expires
+     * Generates a session keypair, has the wallet authorize it, and returns an
+     * AuthState object containing:
+     * - `sessionPublicKey` / `sessionPrivateKey`: the session keypair used to
+     *   sign subsequent requests (the private key is the credential — persist it
+     *   to survive reloads without re-prompting the wallet)
+     * - `expiresAt`: When the session expires
      * - `user`: User information
      *
-     * Note: Use `sdk.logout()` to revoke the token and clean up, or call
-     * `sdk.auth.revokeToken()` directly to just revoke.
+     * Note: Use `sdk.logout()` to revoke the session and clean up, or call
+     * `sdk.auth.revokeSession()` directly to just revoke.
      *
      * @param clientId - The client ID for authentication
      * @param options - Optional configuration
@@ -128,30 +200,57 @@ export class MonacoSDKImpl {
      * // Login and auto-connect WebSocket
      * const authState = await sdk.login(clientId, { connectWebSocket: true });
      *
-     * // Manual WebSocket connection
-     * await sdk.ws.connect();
-     *
      * // Later, to revoke:
-     * await sdk.auth.revokeToken(); // ✅
+     * await sdk.auth.revokeSession(); // ✅
      * // Or revoke and disconnect WebSocket:
-     * await sdk.logout(); // ✅ Calls revokeToken internally and disconnects WebSocket
+     * await sdk.logout(); // ✅ Calls revokeSession internally and disconnects WebSocket
      * ```
      */
     async login(clientId, options) {
-        const response = await this.auth.authenticate(clientId);
-        this.authState = {
-            accessToken: response.accessToken,
-            refreshToken: response.refreshToken,
-            expiresAt: response.expiresAt,
-            user: response.user,
-        };
-        this.propagateAccessToken(this.authState.accessToken);
+        this.authState = await this.auth.authenticate(clientId);
+        this.propagateSession(this.sessionFromAuthState(this.authState));
         // Auto-connect WebSocket if requested
         if (options?.connectWebSocket) {
             await this.ws.connect();
         }
         return this.authState;
     }
+    /**
+     * Create and adopt an owner-scoped delegated session.
+     *
+     * This must be called while authenticated as the agent wallet. The delegated
+     * session uses a fresh ed25519 keypair generated locally; the current agent
+     * session signs the registration request, and subsequent SDK calls use the
+     * delegated session keypair.
+     */
+    async loginAsDelegatedOwner(ownerUserId) {
+        if (!this.authState) {
+            throw new APIError("No active agent session to create delegated session", {
+                endpoint: "delegated-agents/sessions",
+                statusCode: StatusCodes.UNAUTHORIZED,
+            });
+        }
+        const keypair = generateSessionKeypair();
+        const session = {
+            publicKey: publicKeyHex(keypair),
+            privateKey: privateKeyHex(keypair),
+        };
+        const delegatedSession = await this.delegatedAgents.createDelegatedSession({
+            ownerUserId,
+            sessionPublicKey: session.publicKey,
+        });
+        this.authState = {
+            sessionPublicKey: session.publicKey,
+            sessionPrivateKey: session.privateKey,
+            expiresAt: delegatedSession.expires_at,
+            user: {
+                id: delegatedSession.owner_user_id,
+                address: delegatedSession.agent_address,
+            },
+        };
+        this.propagateSession(this.sessionFromAuthState(this.authState));
+        return this.authState;
+    }
     /**
      * Get the current authentication state
      *
@@ -168,59 +267,63 @@ export class MonacoSDKImpl {
      */
     setAuthState(authState) {
         this.authState = authState;
-        this.propagateAccessToken(authState.accessToken);
+        this.propagateSession(this.sessionFromAuthState(authState));
     }
     /**
      * Log the user out
      *
-     * This method revokes the refresh token (if available), disconnects all authenticated
+     * This method revokes the session (if authenticated), disconnects all authenticated
      * WebSocket channels, and clears the local auth state.
-     * It internally calls `auth.revokeToken()` to invalidate the token on the server.
+     * It internally calls `auth.revokeSession()` to invalidate the session on the server.
      *
      * @example
      * ```typescript
      * await sdk.logout();
-     * // Token is revoked, authenticated WebSockets disconnected, and local state cleared
+     * // Session is revoked, authenticated WebSockets disconnected, and local state cleared
      * ```
      */
     async logout() {
-        if (this.authState?.refreshToken) {
+        if (this.authState) {
             try {
-                await this.auth.revokeToken();
+                await this.auth.revokeSession();
             }
             catch (error) {
                 // Log but don't throw - we want to clear the local state regardless
-                console.warn("Failed to revoke token on logout:", error);
+                console.warn("Failed to revoke session on logout:", error);
             }
         }
         this.authState = undefined;
-        this.propagateAccessToken("");
+        this.propagateSession(undefined);
         this.ws.disconnect();
     }
     /**
-     * Refresh the access token
+     * Refresh the current session, extending its expiry.
+     *
+     * Signs a refresh request with the active session key and updates the local
+     * `expiresAt`. The session keypair is unchanged. If no session is active, or
+     * the session has expired/been revoked, this throws.
+     *
      * @returns The updated authentication state
      */
     async refreshAuth() {
-        if (!this.authState?.refreshToken) {
-            throw new APIError("No refresh token available", {
+        if (!this.authState) {
+            throw new APIError("No active session to refresh", {
                 endpoint: "auth/refresh",
                 statusCode: StatusCodes.UNAUTHORIZED,
             });
         }
         try {
-            const response = await this.auth.refreshToken(this.authState.refreshToken);
+            const response = await this.auth.refreshSession();
             this.authState = {
                 ...this.authState,
-                accessToken: response.accessToken,
                 expiresAt: response.expiresAt,
             };
-            this.propagateAccessToken(this.authState.accessToken);
             return this.authState;
         }
         catch (error) {
-            // If refresh fails, set the auth state to undefined
+            // If refresh fails, the session is no longer usable.
             this.authState = undefined;
+            this.propagateSession(undefined);
             throw error;
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@0xmonaco/core",
-	"version": "0.8.7",
+	"version": "0.8.10",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -23,8 +23,10 @@
 		"viem": "^2.45.2"
 	},
 	"dependencies": {
-		"@0xmonaco/contracts": "0.8.7",
-		"@0xmonaco/types": "0.8.7",
+		"@0xmonaco/contracts": "0.8.10",
+		"@0xmonaco/types": "0.8.10",
+		"@noble/curves": "^1.9.1",
+		"@noble/hashes": "^1.8.0",
 		"http-status-codes": "^2.3.0"
 	},
 	"devDependencies": {