@coinlist-co/react 0.10.1 → 0.11.0

package/dist/server/index.cjs

@@ -20,6 +20,9 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/server/index.ts
 var server_exports = {};
 __export(server_exports, {
+  ServerAuthNamespaceImpl: () => ServerAuthNamespaceImpl,
+  ServerOffersNamespaceImpl: () => ServerOffersNamespaceImpl,
+  ServerRequirementsNamespaceImpl: () => ServerRequirementsNamespaceImpl,
   WritableSessionStoreRequiredError: () => WritableSessionStoreRequiredError,
   createCoinListServer: () => createCoinListServer
 });
@@ -119,7 +122,16 @@ async function makeRequest(request) {
     };
   }
   const text = await response.text();
-  const body = text ? JSON.parse(text) : null;
+  let body;
+  try {
+    body = text ? JSON.parse(text) : null;
+  } catch (_) {
+    throw new HttpError({
+      status: response.status,
+      headers: responseHeaders,
+      body: text
+    });
+  }
   return {
     status: response.status,
     body,
@@ -215,7 +227,7 @@ var HttpClient = class {
     const url = this.resolveUrl(request.url);
     const headers = {
       ...request.headers ?? {},
-      [HEADER_API_VERSION]: this.config.xApiVersion
+      ...this.config.xApiVersion !== void 0 ? { [HEADER_API_VERSION]: this.config.xApiVersion } : {}
     };
     return {
       ...request,
@@ -275,7 +287,7 @@ function attachSessionMiddleware(fetchAccessToken) {
   };
 }
 
-// src/shared/utils.ts
+// src/shared/core/utils/crypto.ts
 function getUUIDv4() {
   if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
     return crypto.randomUUID();
@@ -401,8 +413,8 @@ var AuthenticatedApiClient = class {
   }
 };
 
-// src/server/api/api.server.ts
-var Api = class {
+// src/server/core/api/api-client.ts
+var ApiClient = class {
   constructor(config, fetchAccessToken) {
     this.client = new AuthenticatedApiClient(config, fetchAccessToken);
   }
@@ -419,48 +431,138 @@ var WritableSessionStoreRequiredError = class extends Error {
   }
 };
 
-// src/shared/types/document-submission.ts
-var DocumentSubmission = {
-  fromDto: (dto) => ({
-    status: dto.status,
-    formType: dto.form_type
-  })
+// src/shared/types/oauth-session.ts
+var ClientCredentialsOAuth = (value) => value;
+var OAuthRefreshToken = (value) => value;
+var OAuthSession = {
+  fromDto: (dto) => {
+    const expiresAt = new Date(Date.now() + dto.expires_in * 1e3);
+    return {
+      accessToken: {
+        value: dto.access_token,
+        expiresAt
+      },
+      ...dto.refresh_token != null && dto.refresh_token !== "" ? { refreshToken: OAuthRefreshToken(dto.refresh_token) } : void 0
+    };
+  }
 };
 
-// src/shared/api/frontline/documents.ts
-async function submitDocument(api, documentType, fields) {
-  const dto = await api.send({
-    method: "POST",
-    url: `/v1/documents/${documentType}/submission`,
-    body: fields,
-    attributes: Attributes.protected()
-  });
-  return DocumentSubmission.fromDto(dto);
-}
-
-// src/shared/types/kyc.ts
-var KycToken = {
-  fromDto: (dto) => ({
-    token: dto.token
-  })
+// src/server/core/server-auth-namespace.ts
+var ServerAuthNamespaceImpl = class {
+  constructor(api, config) {
+    this.api = api;
+    this.config = config;
+  }
+  async completeOAuth({
+    code,
+    codeVerifier
+  }) {
+    const setSession = this.writableSessionStore();
+    const sessionDto = await this.api.send({
+      method: "POST",
+      url: `/oauth/token`,
+      body: {
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: this.config.redirectUri,
+        client_id: this.config.clientId,
+        client_secret: this.config.clientSecret,
+        code_verifier: codeVerifier
+      }
+    });
+    const session = OAuthSession.fromDto(sessionDto);
+    await setSession(session);
+    return session;
+  }
+  async getAccessToken() {
+    const sessionStore = this.config.sessionStore;
+    const session = await sessionStore.getSession();
+    if (session == null) return null;
+    const now = Date.now();
+    const expiresAt = session.accessToken.expiresAt.getTime();
+    const bufferMs = this.config.accessTokenExpiryBufferSeconds * 1e3;
+    if (expiresAt > now + bufferMs) {
+      return session.accessToken;
+    }
+    const setSession = sessionStore.setSession?.bind(sessionStore);
+    if (!setSession) {
+      return session.accessToken;
+    }
+    return this.refreshSession(session.refreshToken, setSession);
+  }
+  async refreshSession(refreshToken, setSession) {
+    if (!refreshToken) {
+      await setSession(null);
+      return null;
+    }
+    try {
+      const sessionDto = await this.api.send({
+        method: "POST",
+        url: `/oauth/token`,
+        body: {
+          grant_type: "refresh_token",
+          refresh_token: refreshToken,
+          client_id: this.config.clientId,
+          client_secret: this.config.clientSecret
+        }
+      });
+      const newSession = OAuthSession.fromDto(sessionDto);
+      await setSession(newSession);
+      return newSession.accessToken;
+    } catch {
+      await setSession(null);
+      return null;
+    }
+  }
+  async clientCredentials() {
+    const sessionDto = await this.api.send({
+      method: "POST",
+      url: `/oauth/token`,
+      body: {
+        grant_type: "client_credentials",
+        client_id: this.config.clientId,
+        client_secret: this.config.clientSecret
+      }
+    });
+    const session = OAuthSession.fromDto(sessionDto);
+    return ClientCredentialsOAuth(session.accessToken);
+  }
+  async logout() {
+    const setSession = this.writableSessionStore();
+    const session = await this.config.sessionStore.getSession();
+    if (session == null) return;
+    try {
+      await this.api.send({
+        method: "POST",
+        url: `/oauth/revoke`,
+        body: {
+          token: session.accessToken.value,
+          client_id: this.config.clientId,
+          client_secret: this.config.clientSecret
+        }
+      });
+    } catch (err) {
+      if (!(err instanceof HttpError) || this.config.strict) {
+        throw err;
+      }
+    }
+    await setSession(null);
+  }
+  /**
+   * Returns the store's `setSession`, or throws — the guard every
+   * session-writing operation shares.
+   */
+  writableSessionStore() {
+    const sessionStore = this.config.sessionStore;
+    const setSession = sessionStore.setSession?.bind(sessionStore);
+    if (!setSession) {
+      throw new WritableSessionStoreRequiredError();
+    }
+    return setSession;
+  }
 };
 
-// src/shared/api/frontline/kyc.ts
-async function createKycToken(api, levelName, reset) {
-  const dto = await api.send({
-    method: "POST",
-    url: "/v1/kyc-token",
-    body: {
-      ...levelName === void 0 ? {} : { level_name: levelName },
-      ...reset === void 0 ? {} : { reset }
-    },
-    attributes: Attributes.protected()
-  });
-  return KycToken.fromDto(dto);
-}
-
 // src/shared/api/pagination.ts
-var Cursor = (value) => value;
 async function fetchAllPages(fetchPage, baseParams) {
   const items = [];
   let cursor = null;
@@ -475,28 +577,6 @@ async function fetchAllPages(fetchPage, baseParams) {
   } while (cursor);
   return items;
 }
-var PaginatedResponse = {
-  fromDto: (dto, itemMapper) => ({
-    data: dto.data.map(itemMapper),
-    startingAfter: dto.starting_after ? Cursor(dto.starting_after) : null,
-    startingBefore: dto.starting_before ? Cursor(dto.starting_before) : null
-  })
-};
-var PaginationParams = {
-  toQueryParams: (params) => {
-    const queryParams = {};
-    if (params.after) {
-      queryParams.starting_after = params.after;
-    }
-    if (params.before) {
-      queryParams.starting_before = params.before;
-    }
-    if (params.limit) {
-      queryParams.limit = params.limit;
-    }
-    return queryParams;
-  }
-};
 
 // src/shared/types/offer.ts
 var OfferId = (value) => value;
@@ -526,6 +606,86 @@ var Asset = {
   })
 };
 
+// src/shared/types/errors.ts
+var NotAuthenticatedError = class extends Error {
+  constructor(message = "The user is not authenticated. Go through the OAuth flow first!") {
+    super(message);
+    this.name = "NotAuthenticatedError";
+  }
+};
+var ValidationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ValidationError";
+  }
+};
+
+// src/shared/types/blockchain/core.ts
+var ETHEREUM_CHAINS = {
+  ethereum_mainnet: true,
+  ethereum_sepolia: true
+};
+var EthereumChain = (value) => {
+  if (!Object.keys(ETHEREUM_CHAINS).includes(value)) {
+    throw new ValidationError(`Unsupported Ethereum chain: "${value}"`);
+  }
+  return value;
+};
+var SOLANA_CHAINS = {
+  solana_mainnet: true,
+  solana_devnet: true
+};
+var Chain = (value) => {
+  if (!Object.keys(ETHEREUM_CHAINS).includes(value) && !Object.keys(SOLANA_CHAINS).includes(value)) {
+    throw new ValidationError(`Unsupported chain: "${value}"`);
+  }
+  return value;
+};
+var EvmWalletAddress = (value) => value;
+var EvmContractAddress = (value) => value;
+var HexEncodedTransactionData = (value) => value;
+var MAX_ASSET_DECIMALS = 77;
+var AssetDecimals = (value) => {
+  if (!Number.isInteger(value)) {
+    throw new ValidationError(`Asset decimals must be an integer: ${value}`);
+  }
+  if (value < 0 || value > MAX_ASSET_DECIMALS) {
+    throw new ValidationError(
+      `Asset decimals out of range [0, ${MAX_ASSET_DECIMALS}]: ${value}`
+    );
+  }
+  return value;
+};
+var STABLE_DECIMALS = AssetDecimals(6);
+var DecimalString = (value) => value;
+var MAX_UINT_256 = 2n ** 256n - 1n;
+var assertUint256 = (value) => {
+  if (value < 0n || value > MAX_UINT_256) {
+    throw new Error(`Value out of uint256 bounds: ${value}`);
+  }
+  return value;
+};
+var BlockchainAmount = Object.assign(
+  (value) => value,
+  {
+    add: (a, b) => combineAmounts(a, b, (x, y) => x + y),
+    sub: (a, b) => combineAmounts(a, b, (x, y) => x - y)
+  }
+);
+function combineAmounts(a, b, op) {
+  if (a.decimals !== b.decimals) {
+    throw new Error(
+      `Cannot combine BlockchainAmounts with different decimals: ${a.decimals} vs ${b.decimals}`
+    );
+  }
+  const raw = op(a.raw, b.raw);
+  if (raw < 0n || raw > MAX_UINT_256) {
+    throw new Error(`BlockchainAmount out of uint256 bounds: ${raw}`);
+  }
+  return BlockchainAmount({ raw, decimals: a.decimals });
+}
+var AssetSymbol = (value) => value;
+
 // src/shared/types/offer-detail.ts
 var OfferOptionId = (value) => value;
 var OfferOptionSlug = (value) => value;
@@ -549,6 +709,9 @@ var OfferDetail = {
     if (!Array.isArray(dto.milestones)) {
       throw new Error(`milestones must be an array`);
     }
+    if (!Array.isArray(dto.tokens)) {
+      throw new Error(`tokens must be an array`);
+    }
     return {
       id: OfferId(dto.id),
       slug: OfferSlug(dto.slug),
@@ -556,6 +719,7 @@ var OfferDetail = {
       name: dto.name,
       asset: Asset.fromDto(dto.asset),
       fundingAssets: dto.funding_assets.map(Asset.fromDto),
+      tokens: dto.tokens.map(OfferToken.fromDto),
       about: notBlankStringOrNull(dto.about),
       tagline: dto.tagline,
       bannerUrl: dto.banner_url,
@@ -608,6 +772,38 @@ var Milestone = {
     status: dto.status
   })
 };
+var OfferToken = {
+  fromDto: (dto) => ({
+    role: dto.role,
+    chain: Chain(dto.chain),
+    address: EvmContractAddress(dto.address)
+  })
+};
+
+// src/shared/types/pagination.ts
+var Cursor = (value) => value;
+var PaginatedResponse = {
+  fromDto: (dto, itemMapper) => ({
+    data: dto.data.map(itemMapper),
+    startingAfter: dto.starting_after ? Cursor(dto.starting_after) : null,
+    startingBefore: dto.starting_before ? Cursor(dto.starting_before) : null
+  })
+};
+var PaginationParams = {
+  toQueryParams: (params) => {
+    const queryParams = {};
+    if (params.after) {
+      queryParams.starting_after = params.after;
+    }
+    if (params.before) {
+      queryParams.starting_before = params.before;
+    }
+    if (params.limit) {
+      queryParams.limit = params.limit;
+    }
+    return queryParams;
+  }
+};
 
 // src/shared/api/frontline/offers.ts
 async function fetchOffers(api, clientCreds) {
@@ -638,51 +834,32 @@ async function fetchOfferDetails(api, id, clientCreds) {
   return OfferDetail.fromDto(dto);
 }
 
-// src/shared/types/pii.ts
-var Iso2CountryCode = (value) => value;
-var PiiJurisdiction = {
+// src/server/core/server-offers-namespace.ts
+var ServerOffersNamespaceImpl = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  async list(clientCreds) {
+    await this.ctx.ensureAuthenticated(clientCreds);
+    return fetchOffers(this.ctx.api, clientCreds);
+  }
+  async listPage(params, clientCreds) {
+    await this.ctx.ensureAuthenticated(clientCreds);
+    return fetchOffersPage(this.ctx.api, params, clientCreds);
+  }
+  async get(id, clientCreds) {
+    await this.ctx.ensureAuthenticated(clientCreds);
+    return fetchOfferDetails(this.ctx.api, id, clientCreds);
+  }
+};
+
+// src/shared/types/requirement.ts
+var RequirementId = (value) => value;
+var Requirement = {
   fromDto: (dto) => ({
-    iso2: Iso2CountryCode(dto.iso_2),
-    name: dto.name
-  })
-};
-var PiiAddress = {
-  fromDto: (dto) => ({
-    street: dto.street,
-    city: dto.city,
-    state: dto.state,
-    postalCode: dto.postal_code,
-    country: dto.country
-  })
-};
-var Pii = {
-  fromDto: (dto) => ({
-    kind: dto.kind,
-    fullLegalName: dto.full_legal_name,
-    dateOfBirth: dto.date_of_birth,
-    jurisdiction: dto.jurisdiction ? PiiJurisdiction.fromDto(dto.jurisdiction) : null,
-    taxId: dto.tax_id,
-    permanentAddress: PiiAddress.fromDto(dto.permanent_address)
-  })
-};
-
-// src/shared/api/frontline/pii.ts
-async function fetchPii(api) {
-  const dto = await api.send({
-    method: "GET",
-    url: "/v1/pii",
-    attributes: Attributes.protected()
-  });
-  return Pii.fromDto(dto);
-}
-
-// src/shared/types/requirement.ts
-var RequirementId = (value) => value;
-var Requirement = {
-  fromDto: (dto) => ({
-    id: RequirementId(dto.id),
-    type: dto.type,
-    details: dto.details
+    id: RequirementId(dto.id),
+    type: dto.type,
+    details: dto.details
   })
 };
 var RequirementStatusInfo = {
@@ -723,138 +900,143 @@ async function fetchRequirementStatuses(api, offerId) {
   return RequirementStatusInfo.fromStatusesDto(response);
 }
 
-// src/shared/types/blockchain/core.ts
-var EvmWalletAddress = (value) => value;
-var EvmContractAddress = (value) => value;
-var HexEncodedTransactionData = (value) => value;
-var AssetDecimals = (value) => value;
-var MAX_UINT_256 = 2n ** 256n - 1n;
-var assertUint256 = (value) => {
-  if (value < 0n || value > MAX_UINT_256) {
-    throw new Error(`Value out of uint256 bounds: ${value}`);
-  }
-  return value;
-};
-var BlockchainAmount = Object.assign(
-  (value) => value,
-  {
-    add: (a, b) => combineAmounts(a, b, (x, y) => x + y),
-    sub: (a, b) => combineAmounts(a, b, (x, y) => x - y)
-  }
-);
-function combineAmounts(a, b, op) {
-  if (a.decimals !== b.decimals) {
-    throw new Error(
-      `Cannot combine BlockchainAmounts with different decimals: ${a.decimals} vs ${b.decimals}`
-    );
-  }
-  const raw = op(a.raw, b.raw);
-  if (raw < 0n || raw > MAX_UINT_256) {
-    throw new Error(`BlockchainAmount out of uint256 bounds: ${raw}`);
-  }
-  return BlockchainAmount({ raw, decimals: a.decimals });
-}
-var AssetSymbol = (value) => value;
-
-// src/shared/types/offer-option-address.ts
-var OfferOptionAddressId = (value) => value;
-var OfferOptionAddress = {
-  /** Maps the API DTO into the SDK offer-option-address domain model. */
-  fromDto: (dto) => ({
-    id: OfferOptionAddressId(dto.id),
-    offerOptionId: OfferOptionId(dto.offer_option_id),
-    address: EvmWalletAddress(dto.address),
-    protocol: dto.protocol,
-    createdAt: new Date(dto.created_at)
-  })
-};
-var ConnectExternalWalletParams = {
-  /** Maps connect-wallet params into the API DTO payload. */
-  toDto: (params) => ({
-    offer_option_id: params.offerOptionId,
-    wallet_address: params.walletAddress,
-    chain: params.chain,
-    signature: params.signature
-  })
-};
-
-// src/shared/types/wallet-ownership-challenge.ts
-var WalletOwnershipChallenge = {
-  /** Maps the API DTO into the SDK wallet-ownership-challenge domain model. */
+// src/shared/types/document-submission.ts
+var DocumentSubmission = {
   fromDto: (dto) => ({
-    message: dto.message,
-    expiresAt: new Date(dto.expires_at)
+    status: dto.status,
+    formType: dto.form_type
   })
 };
-var CreateWalletOwnershipChallengeParams = {
-  /**
-   * Maps challenge-request params into the API DTO payload. The discriminated
-   * union guarantees SIWE fields are present exactly when `challengeType` is
-   * `siwe`, so the mapping narrows on the discriminant.
-   */
-  toDto: (params) => {
-    switch (params.challengeType) {
-      case "plain":
-        return {
-          wallet_address: params.walletAddress,
-          chain: params.chain,
-          challenge_type: "plain"
-        };
-      case "siwe":
-        return {
-          wallet_address: params.walletAddress,
-          chain: params.chain,
-          challenge_type: "siwe",
-          domain: params.domain,
-          uri: params.uri,
-          statement: params.statement
-        };
-      default: {
-        const _exhaustive = params;
-        return _exhaustive;
-      }
-    }
-  }
-};
 
-// src/shared/api/frontline/wallet-connect.ts
-async function createWalletOwnershipChallenge(api, params) {
+// src/shared/api/frontline/documents.ts
+async function submitDocument(api, documentType, fields) {
   const dto = await api.send({
     method: "POST",
-    url: "/v1/wallet-ownership",
-    body: CreateWalletOwnershipChallengeParams.toDto(params),
+    url: `/v1/documents/${documentType}/submission`,
+    body: fields,
     attributes: Attributes.protected()
   });
-  return WalletOwnershipChallenge.fromDto(dto);
+  return DocumentSubmission.fromDto(dto);
 }
-async function connectExternalWallet(api, offerId, params) {
+
+// src/shared/types/kyc.ts
+var KycToken = {
+  fromDto: (dto) => ({
+    token: dto.token
+  })
+};
+
+// src/shared/api/frontline/kyc.ts
+async function createKycToken(api, levelName, reset) {
   const dto = await api.send({
     method: "POST",
-    url: `/v1/offers/${offerId}/addresses`,
-    body: ConnectExternalWalletParams.toDto(params),
-    attributes: Attributes.protected()
-  });
-  return OfferOptionAddress.fromDto(dto);
-}
-async function listOptionAddresses(api, offerId, offerOptionId) {
-  const { data } = await api.send({
-    method: "GET",
-    url: `/v1/offers/${offerId}/addresses`,
-    queryParams: { offer_option_id: offerOptionId },
+    url: "/v1/kyc-token",
+    body: {
+      ...levelName === void 0 ? {} : { level_name: levelName },
+      ...reset === void 0 ? {} : { reset }
+    },
     attributes: Attributes.protected()
   });
-  return data.map(OfferOptionAddress.fromDto);
+  return KycToken.fromDto(dto);
 }
-async function removeOptionAddress(api, offerId, addressId) {
+
+// src/shared/types/pii.ts
+var Iso2CountryCode = (value) => value;
+var PiiJurisdiction = {
+  fromDto: (dto) => ({
+    iso2: Iso2CountryCode(dto.iso_2),
+    name: dto.name
+  })
+};
+var PiiAddress = {
+  fromDto: (dto) => ({
+    street: dto.street,
+    city: dto.city,
+    state: dto.state,
+    postalCode: dto.postal_code,
+    country: dto.country
+  })
+};
+var Pii = {
+  fromDto: (dto) => ({
+    kind: dto.kind,
+    fullLegalName: dto.full_legal_name,
+    dateOfBirth: dto.date_of_birth,
+    jurisdiction: dto.jurisdiction ? PiiJurisdiction.fromDto(dto.jurisdiction) : null,
+    taxId: dto.tax_id,
+    permanentAddress: PiiAddress.fromDto(dto.permanent_address)
+  })
+};
+
+// src/shared/api/frontline/pii.ts
+async function fetchPii(api) {
   const dto = await api.send({
-    method: "DELETE",
-    url: `/v1/offers/${offerId}/addresses/${addressId}`,
+    method: "GET",
+    url: "/v1/pii",
     attributes: Attributes.protected()
   });
-  return OfferOptionAddress.fromDto(dto);
+  return Pii.fromDto(dto);
 }
 
-// src/shared/types/swap.ts
+// src/shared/core/requirements/requirements-namespace.ts
+var RequirementsNamespaceImpl = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  async forOffer(offerId) {
+    await this.ctx.ensureUserAuthenticated();
+    return fetchOfferRequirements(
+      this.ctx.api,
+      offerId,
+      void 0
+    );
+  }
+  async statuses(offerId) {
+    await this.ctx.ensureUserAuthenticated();
+    return fetchRequirementStatuses(this.ctx.api, offerId);
+  }
+  async createKycToken(params) {
+    await this.ctx.ensureUserAuthenticated();
+    return createKycToken(
+      this.ctx.api,
+      params?.levelName,
+      params?.reset
+    );
+  }
+  async getPii() {
+    await this.ctx.ensureUserAuthenticated();
+    return fetchPii(this.ctx.api);
+  }
+  async submitDocument(params) {
+    await this.ctx.ensureUserAuthenticated();
+    return submitDocument(
+      this.ctx.api,
+      params.documentType,
+      params.fields
+    );
+  }
+};
+
+// src/server/core/server-requirements-namespace.ts
+var ServerRequirementsNamespaceImpl = class extends RequirementsNamespaceImpl {
+  constructor(serverCtx) {
+    super(serverCtx);
+    this.serverCtx = serverCtx;
+  }
+  async forOffer(offerId, clientCreds) {
+    await this.serverCtx.ensureAuthenticated(clientCreds);
+    return fetchOfferRequirements(
+      this.serverCtx.api,
+      offerId,
+      clientCreds
+    );
+  }
+};
+
+// src/shared/api/nabu/config.ts
+var NABU_BASE_URL = "https://asset.coinlist.co";
+
+// src/shared/types/providers/superstate/swap.ts
 var SwapAuthorization = {
   fromDto: (dto) => ({
     authorized: dto.authorized
@@ -905,7 +1087,7 @@ var AllowWalletResponse = {
   }
 };
 
-// src/shared/api/frontline/swap.ts
+// src/shared/api/frontline/providers/superstate/swap.ts
 async function getSwapAuthorization(api, params) {
   const dto = await api.send({
     method: "GET",
@@ -1005,65 +1187,34 @@ function toErc20Asset(dto) {
   };
 }
 
-// src/shared/core/erc20-namespace.ts
+// src/shared/core/blockchain/erc20/erc20-namespace.ts
 var Erc20NamespaceImpl = class {
   constructor(ctx) {
     this.ctx = ctx;
   }
-  async getTokenAllowance(params) {
+  async getAllowance(params) {
     await this.ctx.ensureUserAuthenticated();
     return getTokenAllowance(this.ctx.api, params);
   }
-  async getTokenBalance(params) {
+  async getBalance(params) {
     await this.ctx.ensureUserAuthenticated();
     return getTokenBalance(this.ctx.api, params);
   }
 };
 
-// src/shared/core/swap-namespace.ts
-var SwapNamespaceImpl = class {
-  constructor(ctx) {
-    this.ctx = ctx;
-  }
-  async getAuthorization(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getSwapAuthorization(this.ctx.api, params);
-  }
-  async getPreview(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getSwapPreview(this.ctx.api, params);
-  }
-  async getStatus(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getSwapStatus(this.ctx.api, params);
-  }
-  async getOutputToken(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getSwapOutputToken(this.ctx.api, params);
-  }
-  async requestWalletOwnershipChallenge(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return createWalletOwnershipChallenge(this.ctx.api, params);
-  }
-  async allowWallet(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return allowWallet(this.ctx.api, params);
-  }
-};
-
-// src/shared/types/participation.ts
-var ParticipationId = (value) => value;
-var Blockchain = (value) => value;
-var WalletAddress = (value) => value;
-var ParticipationsPaginationParams = {
-  toQueryParams: (params) => {
-    const queryParams = PaginationParams.toQueryParams(params);
-    if (params.offerId) {
-      queryParams["filters[0][field]"] = "offer_id";
-      queryParams["filters[0][op]"] = "==";
-      queryParams["filters[0][value]"] = params.offerId;
-    }
-    return queryParams;
+// src/shared/types/providers/coin-list/token-sale.ts
+var ParticipationId = (value) => value;
+var Blockchain = (value) => value;
+var WalletAddress = (value) => value;
+var ParticipationsPaginationParams = {
+  toQueryParams: (params) => {
+    const queryParams = PaginationParams.toQueryParams(params);
+    if (params.offerId) {
+      queryParams["filters[0][field]"] = "offer_id";
+      queryParams["filters[0][op]"] = "==";
+      queryParams["filters[0][value]"] = params.offerId;
+    }
+    return queryParams;
   }
 };
 var Participation = {
@@ -1098,7 +1249,7 @@ var CreateParticipationParams = {
   })
 };
 
-// src/shared/api/frontline/participations.ts
+// src/shared/api/frontline/providers/coin-list/token-sale.ts
 async function fetchParticipations(api, offerId) {
   return fetchAllPages(
     (params) => fetchParticipationsPage(api, params),
@@ -1132,20 +1283,20 @@ async function createParticipation(api, params) {
   return Participation.fromDto(dto);
 }
 
-// src/shared/core/token-sale-namespace.ts
-var TokenSaleNamespaceImpl = class {
+// src/shared/core/checkout/coin-list/token-sale-namespace.ts
+var CoinListTokenSaleNamespaceImpl = class {
   constructor(ctx) {
     this.ctx = ctx;
   }
-  async fetchParticipations(offerId) {
+  async list(offerId) {
     await this.ctx.ensureUserAuthenticated();
     return fetchParticipations(this.ctx.api, offerId);
   }
-  async fetchParticipationsPage(params) {
+  async listPage(params) {
     await this.ctx.ensureUserAuthenticated();
     return fetchParticipationsPage(this.ctx.api, params);
   }
-  async fetchParticipation(id) {
+  async get(id) {
     await this.ctx.ensureUserAuthenticated();
     return fetchParticipation(this.ctx.api, id);
   }
@@ -1155,237 +1306,603 @@ var TokenSaleNamespaceImpl = class {
   }
 };
 
-// src/shared/types/errors.ts
-var NotAuthenticatedError = class extends Error {
-  constructor(message = "The user is not authenticated. Go through the OAuth flow first!") {
-    super(message);
-    this.name = "NotAuthenticatedError";
-  }
+// src/shared/core/blockchain/formatters.ts
+var import_viem = require("viem");
+
+// src/shared/types/blockchain/ui.ts
+var FormattedAmountAssetUi = (value) => value;
+
+// src/shared/core/blockchain/formatters.ts
+function formatRawAmount(amount) {
+  return (0, import_viem.formatUnits)(amount.raw, amount.decimals);
+}
+var NA_AMOUNT_ASSET_UI = FormattedAmountAssetUi("-");
+var USD_FRACTION_DIGITS = AssetDecimals(2);
+
+// src/shared/core/blockchain/chain.ts
+var CHAIN_IDS = {
+  ethereum_mainnet: 1,
+  ethereum_sepolia: 11155111
 };
+function chainFromId(chainId) {
+  const chains = Object.keys(CHAIN_IDS);
+  const chain = chains.find((c) => String(CHAIN_IDS[c]) === chainId);
+  if (!chain) {
+    throw new ValidationError(`Unsupported EIP-155 chain id: "${chainId}"`);
+  }
+  return chain;
+}
 
-// src/shared/types/oauth-session.ts
-var ClientCredentialsOAuth = (value) => value;
-var OAuthRefreshToken = (value) => value;
-var OAuthSession = {
+// src/shared/core/blockchain/math.ts
+var import_viem2 = require("viem");
+function blockchainAmountFromRawOrThrow({
+  label,
+  raw,
+  decimals
+}) {
+  const trimmed = raw.trim();
+  if (trimmed === "") {
+    throw new ValidationError(`${label}: not a uint256 integer ("${raw}")`);
+  }
+  let value;
+  try {
+    value = BigInt(trimmed);
+  } catch {
+    throw new ValidationError(`${label}: not a uint256 integer ("${raw}")`);
+  }
+  try {
+    return BlockchainAmount({ raw: assertUint256(value), decimals });
+  } catch {
+    throw new ValidationError(`${label}: out of uint256 bounds (${value})`);
+  }
+}
+
+// src/shared/types/trading.ts
+var Ticker = (value) => value;
+
+// src/shared/types/providers/ondo/ondo.ts
+var OndoTradingStatus = {
   fromDto: (dto) => {
-    const expiresAt = new Date(Date.now() + dto.expires_in * 1e3);
+    if (!dto.tradable) return { type: "not-tradable", side: dto.side };
     return {
-      accessToken: {
-        value: dto.access_token,
-        expiresAt
+      type: "tradable",
+      side: dto.side,
+      grossMaxTokens: decimalOrNull(dto.gross_max_tokens),
+      grossMaxNotionalValue: decimalOrNull(dto.gross_max_notional_value),
+      grossMaxActiveNotionalValue: decimalOrNull(
+        dto.gross_max_active_notional_value
+      )
+    };
+  }
+};
+var decimalOrNull = (value) => value === null ? null : DecimalString(value);
+var OndoQuote = {
+  fromDto: (dto) => {
+    const assetDecimals = AssetDecimals(dto.asset_decimals);
+    return {
+      chain: chainFromId(dto.chain_id),
+      ticker: Ticker(dto.ticker),
+      assetAddress: EvmContractAddress(dto.asset_address),
+      asset: {
+        name: dto.ticker,
+        symbol: AssetSymbol(dto.symbol),
+        decimals: assetDecimals
       },
-      ...dto.refresh_token != null && dto.refresh_token !== "" ? { refreshToken: OAuthRefreshToken(dto.refresh_token) } : void 0
+      side: dto.side,
+      tokenBaseUnits: blockchainAmountFromRawOrThrow({
+        label: "tokenBaseUnits",
+        raw: dto.token_base_units,
+        decimals: assetDecimals
+      }),
+      price: DecimalString(dto.price)
     };
   }
 };
-
-// src/server/coinlist.server.ts
-var ACCESS_TOKEN_EXPIRY_BUFFER_SECONDS = 60;
-var CoinListServerImpl = class {
-  constructor(_config) {
-    this._config = _config;
-    this.baseUrl = _config.baseUrl ?? PUBLIC_API_BASE_URL;
-    this.accessTokenExpiryBufferSeconds = _config.accessTokenExpiryBufferSeconds ?? ACCESS_TOKEN_EXPIRY_BUFFER_SECONDS;
-    this.strict = _config.strict ?? false;
-    this.api = new Api(
-      {
-        baseUrl: this.baseUrl,
-        xApiVersion: API_VERSION
+var OndoSwapTransaction = {
+  fromDto: (dto) => {
+    const inputDecimals = AssetDecimals(dto.pay_input_decimals);
+    const outputDecimals = AssetDecimals(dto.receive_output_decimals);
+    return {
+      tx: {
+        to: EvmContractAddress(dto.to),
+        data: HexEncodedTransactionData(dto.data)
       },
-      // When refresh=true the renewal middleware has received a 401 and wants a
-      // fresh token. A read-only store cannot persist a new session, so return
-      // null immediately — this tells the middleware to skip the retry rather
-      // than re-sending with the same expired token and wasting a round-trip.
-      (refresh) => refresh && !this._config.sessionStore.setSession ? Promise.resolve(null) : this.accessToken()
-    );
-    const ctx = {
-      api: this.api,
-      ensureUserAuthenticated: () => this.ensureUserAuthenticated()
+      expiresAt: parseExpiresAt(dto.expires_at),
+      payInputAmount: blockchainAmountFromRawOrThrow({
+        label: "pay_input_amount",
+        raw: dto.pay_input_amount,
+        decimals: inputDecimals
+      }),
+      fee: blockchainAmountFromRawOrThrow({
+        label: "fee",
+        raw: dto.fee,
+        decimals: inputDecimals
+      }),
+      notionalValue: blockchainAmountFromRawOrThrow({
+        label: "notional_value",
+        raw: dto.notional_value,
+        decimals: inputDecimals
+      }),
+      receiveOutputAmount: parseReceiveOutputAmount(
+        dto.receive_output_amount,
+        outputDecimals
+      )
     };
-    this.erc20 = new Erc20NamespaceImpl(ctx);
-    this.tokenSale = new TokenSaleNamespaceImpl(ctx);
-    this.swap = new SwapNamespaceImpl(ctx);
   }
-  async completeOAuth(code, codeVerifier) {
-    const sessionStore = this._config.sessionStore;
-    const setSession = sessionStore.setSession?.bind(sessionStore);
-    if (!setSession) {
-      throw new WritableSessionStoreRequiredError();
-    }
-    const sessionDto = await this.api.send({
-      method: "POST",
-      url: `/oauth/token`,
-      body: {
-        grant_type: "authorization_code",
-        code,
-        redirect_uri: this._config.redirectUri,
-        client_id: this._config.clientId,
-        client_secret: this._config.clientSecret,
-        code_verifier: codeVerifier
-      }
-    });
-    const session = OAuthSession.fromDto(sessionDto);
-    await setSession(session);
-    return session;
+};
+function parseReceiveOutputAmount(raw, decimals) {
+  const amount = blockchainAmountFromRawOrThrow({
+    label: "receive_output_amount",
+    raw,
+    decimals
+  });
+  if (amount.raw <= 0n) {
+    throw new ValidationError(
+      `receive_output_amount: must be greater than zero ("${raw}")`
+    );
   }
-  async clientCredentialsOAuth() {
-    const sessionDto = await this.api.send({
-      method: "POST",
-      url: `/oauth/token`,
-      body: {
-        grant_type: "client_credentials",
-        client_id: this._config.clientId,
-        client_secret: this._config.clientSecret
-      }
-    });
-    const session = OAuthSession.fromDto(sessionDto);
-    return ClientCredentialsOAuth(session.accessToken);
+  return amount;
+}
+function parseExpiresAt(value) {
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    throw new ValidationError(`expires_at: not a date ("${value}")`);
   }
-  async accessToken() {
-    const sessionStore = this._config.sessionStore;
-    const session = await sessionStore.getSession();
-    if (session == null) return null;
-    const now = Date.now();
-    const expiresAt = session.accessToken.expiresAt.getTime();
-    const bufferMs = this.accessTokenExpiryBufferSeconds * 1e3;
-    if (expiresAt > now + bufferMs) {
-      return session.accessToken;
-    }
-    const setSession = sessionStore.setSession?.bind(sessionStore);
-    if (!setSession) {
-      return session.accessToken;
-    } else {
-      return this.refreshSession(session.refreshToken, setSession);
-    }
+  return date;
+}
+
+// src/shared/api/frontline/providers/ondo/ondo.ts
+async function getOndoTradingStatus(api, params) {
+  const dto = await api.send({
+    method: "GET",
+    url: "/v1/ondo/swap/trading-status",
+    queryParams: { symbol: params.symbol, side: params.side },
+    attributes: Attributes.protected()
+  });
+  return OndoTradingStatus.fromDto(dto);
+}
+async function getOndoQuote(api, params) {
+  const dto = await api.send({
+    method: "GET",
+    url: "/v1/ondo/swap/quote",
+    queryParams: {
+      symbol: params.symbol,
+      side: params.side,
+      duration: params.duration,
+      ...sizeParam(params)
+    },
+    attributes: Attributes.protected()
+  });
+  return OndoQuote.fromDto(dto);
+}
+async function buildOndoSwapTransaction(api, params) {
+  const dto = await api.send({
+    method: "POST",
+    url: "/v1/ondo/swap/transaction",
+    body: {
+      symbol: params.symbol,
+      chain: params.chain,
+      wallet_address: params.walletAddress,
+      amount: params.amount.raw.toString()
+    },
+    attributes: Attributes.protected()
+  });
+  assertFundingScaleAgrees(dto, params);
+  return OndoSwapTransaction.fromDto(dto);
+}
+function assertFundingScaleAgrees(dto, params) {
+  if (dto.pay_input_decimals !== params.amount.decimals) {
+    throw new ValidationError(
+      `pay_input_decimals: the swap was priced in ${dto.pay_input_decimals} decimals but the order was sized in ${params.amount.decimals}`
+    );
   }
-  async refreshSession(refreshToken, setSession) {
-    if (!refreshToken) {
-      await setSession(null);
-      return null;
+}
+function sizeParam(params) {
+  const tokenAmount = "tokenAmount" in params ? params.tokenAmount : void 0;
+  const notionalValue = "notionalValue" in params ? params.notionalValue : void 0;
+  if (tokenAmount !== void 0) {
+    if (notionalValue !== void 0) {
+      throw new ValidationError(
+        "An Ondo quote takes tokenAmount or notionalValue, not both"
+      );
     }
-    try {
-      const sessionDto = await this.api.send({
-        method: "POST",
-        url: `/oauth/token`,
-        body: {
-          grant_type: "refresh_token",
-          refresh_token: refreshToken,
-          client_id: this._config.clientId,
-          client_secret: this._config.clientSecret
-        }
-      });
-      const newSession = OAuthSession.fromDto(sessionDto);
-      await setSession(newSession);
-      return newSession.accessToken;
-    } catch {
-      await setSession(null);
+    return { token_amount: formatRawAmount(tokenAmount) };
+  }
+  if (notionalValue === void 0) {
+    throw new ValidationError(
+      "An Ondo quote must be sized by tokenAmount or notionalValue"
+    );
+  }
+  return { notional_value: notionalValue };
+}
+
+// src/shared/core/checkout/ondo/ondo-namespace.ts
+var OndoNamespaceImpl = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  async getTradingStatus(params) {
+    await this.ctx.ensureUserAuthenticated();
+    return getOndoTradingStatus(this.ctx.api, params);
+  }
+  async getQuote(params) {
+    await this.ctx.ensureUserAuthenticated();
+    return getOndoQuote(this.ctx.api, params);
+  }
+  async buildSwapTransaction(params) {
+    await this.ctx.ensureUserAuthenticated();
+    return buildOndoSwapTransaction(this.ctx.api, params);
+  }
+};
+
+// src/shared/core/checkout/superstate/swap-namespace.ts
+var SuperstateSwapNamespaceImpl = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  async getAuthorization(params) {
+    await this.ctx.ensureUserAuthenticated();
+    return getSwapAuthorization(this.ctx.api, params);
+  }
+  async getPreview(params) {
+    await this.ctx.ensureUserAuthenticated();
+    return getSwapPreview(this.ctx.api, params);
+  }
+  async getStatus(params) {
+    await this.ctx.ensureUserAuthenticated();
+    return getSwapStatus(this.ctx.api, params);
+  }
+  async getOutputToken(params) {
+    await this.ctx.ensureUserAuthenticated();
+    return getSwapOutputToken(this.ctx.api, params);
+  }
+  async allowWallet(params) {
+    await this.ctx.ensureUserAuthenticated();
+    return allowWallet(this.ctx.api, params);
+  }
+};
+
+// src/shared/api/nabu/tokens.ts
+var import_viem3 = require("viem");
+
+// src/shared/types/token-metadata.ts
+var TokenLogoUrl = (value) => value;
+var TokenLogo = {
+  /** `baseUrl` is the registry origin; registry URLs are root-relative. */
+  fromDto: (dto, baseUrl) => dto.kind === "VECTOR" ? { kind: "VECTOR", url: resolveLogoUrl(dto.url, baseUrl) } : {
+    kind: "RASTER",
+    original: logoImageFromDto(dto.original, baseUrl),
+    variants: dto.variants.map((v) => logoImageFromDto(v, baseUrl))
+  }
+};
+var TokenMetadata = {
+  /** `baseUrl` is the registry origin; registry logo URLs are root-relative. */
+  fromDto: (dto, baseUrl) => {
+    assertSupportedSchemaVersion(dto.schema_version);
+    return {
+      identifier: {
+        chain: EthereumChain(dto.chain),
+        address: EvmContractAddress(dto.address)
+      },
+      name: dto.name,
+      symbol: AssetSymbol(dto.symbol),
+      decimals: AssetDecimals(dto.decimals),
+      logo: TokenLogo.fromDto(dto.logo, baseUrl),
+      logoDark: dto.logo_dark === void 0 ? null : TokenLogo.fromDto(dto.logo_dark, baseUrl)
+    };
+  },
+  /**
+   * Maps a chain snapshot to the tokens it lists, skipping the chain's native
+   * coin (`kind: 'COIN'`, no contract address).
+   */
+  fromChainAssetsDto: (dto, baseUrl) => {
+    assertSupportedSchemaVersion(dto.schema_version);
+    const chain = EthereumChain(dto.chain);
+    return dto.assets.filter((asset) => asset.kind === "TOKEN" && asset.address !== void 0).map((asset) => ({
+      identifier: {
+        chain,
+        // The filter above cannot narrow `address` for the type checker.
+        address: EvmContractAddress(asset.address)
+      },
+      name: asset.name,
+      symbol: AssetSymbol(asset.symbol),
+      decimals: AssetDecimals(asset.decimals),
+      logo: TokenLogo.fromDto(asset.logo, baseUrl),
+      logoDark: asset.logo_dark === void 0 ? null : TokenLogo.fromDto(asset.logo_dark, baseUrl)
+    }));
+  }
+};
+function assertSupportedSchemaVersion(version) {
+  if (version !== 1) {
+    throw new ValidationError(
+      `Unsupported token registry schema_version: ${version}`
+    );
+  }
+}
+var logoImageFromDto = (dto, baseUrl) => ({
+  url: resolveLogoUrl(dto.url, baseUrl),
+  width: dto.width,
+  height: dto.height
+});
+var resolveLogoUrl = (url, baseUrl) => TokenLogoUrl(
+  url.startsWith("http") ? url : `${baseUrl.replace(/\/$/, "")}${url}`
+);
+
+// src/shared/api/nabu/tokens.ts
+function createNabuApiClient(baseUrl) {
+  return new HttpClient({ baseUrl });
+}
+async function fetchTokenMetadata(client, token) {
+  const address = checksummed(token.address);
+  let response;
+  try {
+    response = await client.send({
+      method: "GET",
+      url: `/${token.chain}/token/${address}`
+    });
+  } catch (error) {
+    if (isRegistryHtmlFallback(error)) {
       return null;
     }
+    throw error;
   }
-  async logout() {
-    const sessionStore = this._config.sessionStore;
-    const setSession = sessionStore.setSession?.bind(sessionStore);
-    if (!setSession) {
-      throw new WritableSessionStoreRequiredError();
-    }
-    const session = await sessionStore.getSession();
-    if (session != null) {
-      const tokenToRevoke = session.accessToken.value;
-      try {
-        await this.api.send({
-          method: "POST",
-          url: `/oauth/revoke`,
-          body: {
-            token: tokenToRevoke,
-            client_id: this._config.clientId,
-            client_secret: this._config.clientSecret
-          }
-        });
-      } catch (err) {
-        if (err instanceof HttpError) {
-          if (this.strict) {
-            throw err;
-          }
-        } else {
-          throw err;
-        }
-      }
-      await setSession(null);
+  if (response.status === 404) {
+    return null;
+  }
+  assertOk(response);
+  if (response.body === null) {
+    throw new ValidationError(
+      `Token registry returned an empty body for token "${address}" on "${token.chain}"`
+    );
+  }
+  return TokenMetadata.fromDto(response.body, client.config.baseUrl);
+}
+async function fetchTokensMetadata(client, chain) {
+  let response;
+  try {
+    response = await client.send({
+      method: "GET",
+      url: `/${chain}/assets.json`
+    });
+  } catch (error) {
+    if (isRegistryHtmlFallback(error)) {
+      throw new ValidationError(
+        `Token registry returned non-JSON for the "${chain}" snapshot`
+      );
     }
+    throw error;
   }
-  async fetchOffers(clientCreds) {
-    await this.ensureAuthenticated(clientCreds);
-    return fetchOffers(this.api, clientCreds);
+  assertOk(response);
+  if (response.body === null) {
+    throw new ValidationError(
+      `Token registry returned an empty "${chain}" snapshot`
+    );
   }
-  async fetchOffersPage(params, clientCreds) {
-    await this.ensureAuthenticated(clientCreds);
-    return fetchOffersPage(this.api, params, clientCreds);
+  return TokenMetadata.fromChainAssetsDto(response.body, client.config.baseUrl);
+}
+function isRegistryHtmlFallback(error) {
+  return error instanceof HttpError && error.response.status >= 200 && error.response.status < 300;
+}
+function assertOk(response) {
+  if (response.status < 200 || response.status >= 300) {
+    throw new HttpError(response);
   }
-  async fetchOfferDetails(id, clientCreds) {
-    await this.ensureAuthenticated(clientCreds);
-    return fetchOfferDetails(this.api, id, clientCreds);
+}
+function checksummed(address) {
+  try {
+    return (0, import_viem3.getAddress)(address);
+  } catch (_) {
+    throw new ValidationError(`Invalid EVM contract address: "${address}"`);
   }
-  async createWalletOwnershipChallenge(params) {
-    await this.ensureUserAuthenticated();
-    return createWalletOwnershipChallenge(this.api, params);
+}
+
+// src/shared/core/tokens/tokens-namespace.ts
+var TokensNamespaceImpl = class {
+  /**
+   * Takes the registry origin rather than a `SharedNamespaceContext`: the
+   * registry is unauthenticated and on its own host, so the frontline sender
+   * and the auth check would both be dead weight here.
+   */
+  constructor(baseUrl) {
+    this.api = createNabuApiClient(baseUrl);
   }
-  async connectExternalWallet(offerId, params) {
-    await this.ensureUserAuthenticated();
-    return connectExternalWallet(this.api, offerId, params);
+  get(token) {
+    return fetchTokenMetadata(this.api, token);
   }
-  async listOptionAddresses(offerId, offerOptionId) {
-    await this.ensureUserAuthenticated();
-    return listOptionAddresses(
-      this.api,
-      offerId,
-      offerOptionId
+  list(chain) {
+    return fetchTokensMetadata(this.api, chain);
+  }
+};
+
+// src/shared/types/offer-option-address.ts
+var OfferOptionAddressId = (value) => value;
+var OfferOptionAddress = {
+  /** Maps the API DTO into the SDK offer-option-address domain model. */
+  fromDto: (dto) => ({
+    id: OfferOptionAddressId(dto.id),
+    offerOptionId: OfferOptionId(dto.offer_option_id),
+    address: EvmWalletAddress(dto.address),
+    protocol: dto.protocol,
+    createdAt: new Date(dto.created_at)
+  })
+};
+var ConnectExternalWalletParams = {
+  /** Maps connect-wallet params into the API DTO payload. */
+  toDto: (params) => ({
+    offer_option_id: params.offerOptionId,
+    wallet_address: params.walletAddress,
+    chain: params.chain,
+    signature: params.signature
+  })
+};
+
+// src/shared/types/wallet-ownership-challenge.ts
+var WalletOwnershipChallenge = {
+  /** Maps the API DTO into the SDK wallet-ownership-challenge domain model. */
+  fromDto: (dto) => ({
+    message: dto.message,
+    expiresAt: new Date(dto.expires_at)
+  })
+};
+var CreateWalletOwnershipChallengeParams = {
+  /**
+   * Maps challenge-request params into the API DTO payload. The discriminated
+   * union guarantees SIWE fields are present exactly when `challengeType` is
+   * `siwe`, so the mapping narrows on the discriminant.
+   */
+  toDto: (params) => {
+    switch (params.challengeType) {
+      case "plain":
+        return {
+          wallet_address: params.walletAddress,
+          chain: params.chain,
+          challenge_type: "plain"
+        };
+      case "siwe":
+        return {
+          wallet_address: params.walletAddress,
+          chain: params.chain,
+          challenge_type: "siwe",
+          domain: params.domain,
+          uri: params.uri,
+          statement: params.statement
+        };
+      default: {
+        const _exhaustive = params;
+        return _exhaustive;
+      }
+    }
+  }
+};
+
+// src/shared/api/frontline/wallet-connect.ts
+async function createWalletOwnershipChallenge(api, params) {
+  const dto = await api.send({
+    method: "POST",
+    url: "/v1/wallet-ownership",
+    body: CreateWalletOwnershipChallengeParams.toDto(params),
+    attributes: Attributes.protected()
+  });
+  return WalletOwnershipChallenge.fromDto(dto);
+}
+async function connectExternalWallet(api, params) {
+  const dto = await api.send({
+    method: "POST",
+    url: `/v1/offers/${params.offerId}/addresses`,
+    body: ConnectExternalWalletParams.toDto(params),
+    attributes: Attributes.protected()
+  });
+  return OfferOptionAddress.fromDto(dto);
+}
+async function listOptionAddresses(api, offerId, offerOptionId) {
+  const { data } = await api.send({
+    method: "GET",
+    url: `/v1/offers/${offerId}/addresses`,
+    queryParams: { offer_option_id: offerOptionId },
+    attributes: Attributes.protected()
+  });
+  return data.map(OfferOptionAddress.fromDto);
+}
+async function removeOptionAddress(api, offerId, addressId) {
+  const dto = await api.send({
+    method: "DELETE",
+    url: `/v1/offers/${offerId}/addresses/${addressId}`,
+    attributes: Attributes.protected()
+  });
+  return OfferOptionAddress.fromDto(dto);
+}
+
+// src/shared/core/wallets/wallets-namespace.ts
+var WalletsNamespaceImpl = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  async createOwnershipChallenge(params) {
+    await this.ctx.ensureUserAuthenticated();
+    return createWalletOwnershipChallenge(
+      this.ctx.api,
+      params
     );
   }
-  async removeOptionAddress(offerId, addressId) {
-    await this.ensureUserAuthenticated();
-    return removeOptionAddress(this.api, offerId, addressId);
+  async connectExternal(params) {
+    await this.ctx.ensureUserAuthenticated();
+    return connectExternalWallet(this.ctx.api, params);
   }
-  async fetchOfferRequirements(offerId, clientCreds) {
-    await this.ensureAuthenticated(clientCreds);
-    return fetchOfferRequirements(
-      this.api,
-      offerId,
-      clientCreds
+  async list(params) {
+    await this.ctx.ensureUserAuthenticated();
+    return listOptionAddresses(
+      this.ctx.api,
+      params.offerId,
+      params.offerOptionId
     );
   }
-  async fetchRequirementStatuses(offerId) {
-    await this.ensureUserAuthenticated();
-    return fetchRequirementStatuses(this.api, offerId);
+  async remove(params) {
+    await this.ctx.ensureUserAuthenticated();
+    return removeOptionAddress(
+      this.ctx.api,
+      params.offerId,
+      params.addressId
+    );
   }
-  async ensureAuthenticated(clientCreds) {
-    if (!clientCreds) {
-      await this.ensureUserAuthenticated();
-    }
+};
+
+// src/server/core/coinlist-server.ts
+var ACCESS_TOKEN_EXPIRY_BUFFER_SECONDS = 60;
+var CoinListServerImpl = class {
+  constructor(_config) {
+    this._config = _config;
+    this.api = new ApiClient(
+      {
+        baseUrl: _config.baseUrl ?? PUBLIC_API_BASE_URL,
+        xApiVersion: API_VERSION
+      },
+      // When refresh=true the renewal middleware has received a 401 and wants a
+      // fresh token. A read-only store cannot persist a new session, so return
+      // null immediately — this tells the middleware to skip the retry rather
+      // than re-sending with the same expired token and wasting a round-trip.
+      (refresh) => refresh && !this._config.sessionStore.setSession ? Promise.resolve(null) : this.auth.getAccessToken()
+    );
+    this.auth = new ServerAuthNamespaceImpl(this.api, {
+      ..._config,
+      accessTokenExpiryBufferSeconds: _config.accessTokenExpiryBufferSeconds ?? ACCESS_TOKEN_EXPIRY_BUFFER_SECONDS,
+      strict: _config.strict ?? false
+    });
+    const ctx = {
+      api: this.api,
+      ensureUserAuthenticated: () => this.ensureAuthenticated(void 0),
+      ensureAuthenticated: (clientCreds) => this.ensureAuthenticated(clientCreds)
+    };
+    this.offers = new ServerOffersNamespaceImpl(ctx);
+    this.requirements = new ServerRequirementsNamespaceImpl(ctx);
+    this.wallets = new WalletsNamespaceImpl(ctx);
+    this.erc20 = new Erc20NamespaceImpl(ctx);
+    this.tokenSale = new CoinListTokenSaleNamespaceImpl(ctx);
+    this.superstate = new SuperstateSwapNamespaceImpl(ctx);
+    this.ondo = new OndoNamespaceImpl(ctx);
+    this.tokens = new TokensNamespaceImpl(
+      _config.tokensBaseUrl ?? NABU_BASE_URL
+    );
   }
-  async ensureUserAuthenticated() {
-    const token = await this.accessToken();
+  /**
+   * An app-level token authenticates a request on its own; without one the
+   * caller needs a user session.
+   */
+  async ensureAuthenticated(clientCreds) {
+    if (clientCreds) return;
+    const token = await this.auth.getAccessToken();
     if (token === null) {
       throw new NotAuthenticatedError();
     }
   }
-  async fetchPii() {
-    await this.ensureUserAuthenticated();
-    return fetchPii(this.api);
-  }
-  async submitDocument(documentType, fields) {
-    await this.ensureUserAuthenticated();
-    return submitDocument(this.api, documentType, fields);
-  }
-  async createKycToken(levelName, reset) {
-    await this.ensureUserAuthenticated();
-    return createKycToken(this.api, levelName, reset);
-  }
 };
 function createCoinListServer(config) {
   return new CoinListServerImpl(config);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ServerAuthNamespaceImpl,
+  ServerOffersNamespaceImpl,
+  ServerRequirementsNamespaceImpl,
   WritableSessionStoreRequiredError,
   createCoinListServer
 });