@coinlist-co/react 0.10.1 → 0.11.1-rc.209af8d

package/dist/server/index.cjs

@@ -20,8 +20,13 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/server/index.ts
 var server_exports = {};
 __export(server_exports, {
+  ServerAuthNamespaceImpl: () => ServerAuthNamespaceImpl,
+  ServerOffersNamespaceImpl: () => ServerOffersNamespaceImpl,
+  ServerRequirementsNamespaceImpl: () => ServerRequirementsNamespaceImpl,
   WritableSessionStoreRequiredError: () => WritableSessionStoreRequiredError,
-  createCoinListServer: () => createCoinListServer
+  createCoinListServer: () => createCoinListServer,
+  emptySessionStore: () => emptySessionStore,
+  pinoServerLogger: () => pinoServerLogger
 });
 module.exports = __toCommonJS(server_exports);
 
@@ -52,6 +57,8 @@ var retryAttempt = (attempt) => ({
 var renewAttempted = (value) => ({
   renewAttempted: value
 });
+var requestId = (id) => ({ requestId: id });
+var getRequestId = (attrs) => attrs?.requestId ?? null;
 var isProtected = (attrs) => attrs?.protected === true;
 var needUserAgent = (attrs) => attrs?.userAgent === true;
 var isIdempotent = (attrs) => attrs?.idempotencyKey === true;
@@ -73,7 +80,9 @@ var Attributes = {
   renewAttempted,
   wasRenewAttempted,
   clientCredentials,
-  getClientCredentials
+  getClientCredentials,
+  requestId,
+  getRequestId
 };
 
 // src/shared/api/http.ts
@@ -83,7 +92,24 @@ var HttpError = class extends Error {
     this.name = "HttpError";
     this.response = response;
   }
+  /**
+   * Correlates this failure with the `[HTTP]` log lines for the same request,
+   * which carry the method, the URL, the duration and every retry. `null` when
+   * the response did not come from an {@link HttpClient}.
+   *
+   * Worth quoting in a bug report: it is what makes a log excerpt readable.
+   */
+  get requestId() {
+    return this.response.requestId ?? null;
+  }
 };
+function apiErrorCode(error) {
+  if (!(error instanceof HttpError)) return null;
+  const body = error.response.body;
+  if (typeof body !== "object" || body === null) return null;
+  const code = body.code;
+  return typeof code === "string" ? code : null;
+}
 async function makeRequest(request) {
   const headers = {
     Accept: "application/json",
@@ -119,7 +145,16 @@ async function makeRequest(request) {
     };
   }
   const text = await response.text();
-  const body = text ? JSON.parse(text) : null;
+  let body;
+  try {
+    body = text ? JSON.parse(text) : null;
+  } catch (_) {
+    throw new HttpError({
+      status: response.status,
+      headers: responseHeaders,
+      body: text
+    });
+  }
   return {
     status: response.status,
     body,
@@ -180,11 +215,185 @@ var HEADER_API_VERSION = "X-API-Version";
 var HEADER_IDEMPOTENCY_KEY = "Idempotency-Key";
 var API_VERSION = "2025-10-17";
 
+// src/shared/types/errors.ts
+var NotImplementedError = class extends Error {
+  constructor(message = "Not implemented yet") {
+    super(message);
+    this.name = "NotImplementedError";
+  }
+};
+var NotAuthenticatedError = class extends Error {
+  constructor(message = "The user is not authenticated. Go through the OAuth flow first!") {
+    super(message);
+    this.name = "NotAuthenticatedError";
+  }
+};
+var ValidationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ValidationError";
+  }
+};
+var InvariantError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InvariantError";
+  }
+};
+
+// src/shared/core/observability/log-cause.ts
+function classifyLogCause(error) {
+  if (error instanceof HttpError) {
+    return httpCause(error);
+  }
+  if (error instanceof ValidationError) {
+    return { type: "validation", message: error.message };
+  }
+  if (error instanceof InvariantError) {
+    return { type: "invariant", message: error.message };
+  }
+  if (error instanceof NotAuthenticatedError) {
+    return { type: "not-authenticated" };
+  }
+  if (error instanceof NotImplementedError) {
+    return { type: "not-implemented" };
+  }
+  return { type: "generic-error", name: errorName(error) };
+}
+function describeErrorUnredacted(error) {
+  if (error instanceof HttpError) {
+    return describeHttpErrorRedacted(error);
+  }
+  if (error instanceof Error) {
+    return `${error.name}: ${error.message}`;
+  }
+  return `thrown non-error: ${stringifyUnredacted(error)}`;
+}
+function stringifyUnredacted(value) {
+  if (value === void 0) return "";
+  try {
+    return JSON.stringify(
+      value,
+      (_key, item) => typeof item === "bigint" ? `${item}` : item
+    ) ?? String(value);
+  } catch (_) {
+    return "<unserializable>";
+  }
+}
+function describeHttpErrorRedacted(error) {
+  const code = apiErrorCode(error);
+  const status = error.response.status;
+  return code === null ? `HttpError ${status}` : `HttpError ${status} (${code})`;
+}
+function errorName(error) {
+  return error instanceof Error ? error.name : `non-error ${typeof error}`;
+}
+function httpCause(error) {
+  return {
+    type: "http",
+    requestId: error.requestId,
+    status: error.response.status,
+    code: apiErrorCode(error),
+    eventId: apiErrorEventId(error)
+  };
+}
+function apiErrorEventId(error) {
+  const body = error.response.body;
+  if (typeof body !== "object" || body === null) return null;
+  const eventId = body.event_id;
+  return typeof eventId === "string" ? eventId : null;
+}
+
+// src/shared/core/observability/internal-logger.ts
+function internalLogger(logger, scope) {
+  return logger ? scopedLogger(logger, scope, {}) : noopInternalLogger;
+}
+var LEVEL_RANK = {
+  none: 0,
+  error: 1,
+  warn: 2,
+  info: 3,
+  debug: 4
+};
+function scopedLogger(logger, scope, bindings) {
+  const admits = (level) => LEVEL_RANK[logger.level()] >= LEVEL_RANK[level];
+  const safe = (event) => ({
+    msg: event.msg,
+    scope,
+    bindings,
+    fields: event.fields ?? {},
+    ...event.cause === void 0 ? {} : { cause: event.cause }
+  });
+  const unredacted = (event) => ({
+    msg: event.msg,
+    scope,
+    bindings,
+    fields: event.fields ?? {}
+  });
+  const self = {
+    child: (binding) => scopedLogger(logger, scope, { ...bindings, ...binding }),
+    debug: (event) => {
+      if (admits("debug")) logger.debug(() => unredacted(event()));
+    },
+    info: (event) => {
+      if (admits("info")) logger.info(() => safe(event()));
+    },
+    warn: (event) => {
+      if (admits("warn")) logger.warn(() => safe(event()));
+    },
+    error: (event) => {
+      if (admits("error")) logger.error(() => safe(event()));
+    },
+    failure: (event, error) => {
+      if (admits("debug"))
+        logger.debug(() => unredacted(verbatim(event(), error)));
+      if (admits("error")) logger.error(() => safe(classified(event(), error)));
+    },
+    warning: (event, error) => {
+      if (admits("debug"))
+        logger.debug(() => unredacted(verbatim(event(), error)));
+      if (admits("warn")) logger.warn(() => safe(classified(event(), error)));
+    },
+    wrap: async (op, params, run) => {
+      const opLog = self.child({ op });
+      opLog.debug(() => ({ msg: "call", fields: { params } }));
+      try {
+        return await run();
+      } catch (error) {
+        opLog.failure(() => ({ msg: "call failed" }), error);
+        throw error;
+      }
+    }
+  };
+  return self;
+}
+function verbatim(event, error) {
+  return {
+    msg: event.msg,
+    fields: { ...event.fields, error: describeErrorUnredacted(error) }
+  };
+}
+function classified(event, error) {
+  return { ...event, cause: event.cause ?? classifyLogCause(error) };
+}
+var noopInternalLogger = {
+  child: () => noopInternalLogger,
+  debug: () => void 0,
+  info: () => void 0,
+  warn: () => void 0,
+  error: () => void 0,
+  failure: () => void 0,
+  warning: () => void 0,
+  wrap: (_op, _params, run) => run()
+};
+
 // src/shared/api/http-client.ts
 var HttpClient = class {
-  constructor(config, middleware = {}) {
+  constructor(config, middleware = {}, logger = null, options = {}) {
     this.config = config;
     this.middleware = middleware;
+    this.log = internalLogger(logger, "HTTP");
+    this.makeRequestId = options.makeRequestId ?? defaultMakeRequestId;
   }
   async send(request) {
     return this.runRequestWithAfterMiddleware(request);
@@ -215,12 +424,18 @@ var HttpClient = class {
     const url = this.resolveUrl(request.url);
     const headers = {
       ...request.headers ?? {},
-      [HEADER_API_VERSION]: this.config.xApiVersion
+      ...this.config.xApiVersion !== void 0 ? { [HEADER_API_VERSION]: this.config.xApiVersion } : {}
     };
     return {
       ...request,
       url,
-      headers
+      headers,
+      // Only when absent: a retry or a post-renewal re-send arrives with the
+      // first attempt's id already on it, and keeping it is the whole point.
+      attributes: Attributes.getRequestId(request.attributes) === null ? Attributes.concat(
+        request.attributes ?? Attributes.empty,
+        Attributes.requestId(this.makeRequestId())
+      ) : request.attributes
     };
   }
   /**
@@ -244,10 +459,89 @@ var HttpClient = class {
     }
     return request;
   }
-  executeRequest(request) {
-    return makeRequest(request);
+  /**
+   * One physical attempt, logged as one line.
+   *
+   * A non-2xx is a `warn` rather than an `error` because the wire does not
+   * know whether it is a failure: the retry middleware may turn a 503 into a
+   * success, and the token registry reads a 404 as "not listed". The namespace
+   * above decides, and logs the `error` when it does.
+   */
+  async executeRequest(request) {
+    const requestId2 = Attributes.getRequestId(request.attributes);
+    const log = requestId2 === null ? this.log : this.log.child({ requestId: requestId2 });
+    const attempt = Attributes.getRetryAttempt(request.attributes) + 1;
+    const startedAt = Date.now();
+    log.debug(() => ({
+      msg: "request sent",
+      fields: describeRequestUnredacted(request)
+    }));
+    try {
+      const response = await makeRequest(request);
+      const elapsed = Date.now() - startedAt;
+      const outcome = () => ({
+        msg: "request completed",
+        fields: {
+          ...identifyRequest(request),
+          "http.response.status_code": response.status,
+          duration_ms: elapsed,
+          attempt
+        }
+      });
+      if (response.status >= 200 && response.status < 300) {
+        log.info(outcome);
+      } else {
+        log.warn(outcome);
+      }
+      log.debug(() => ({
+        msg: "response received",
+        fields: { body: response.body }
+      }));
+      return requestId2 === null ? response : { ...response, requestId: requestId2 };
+    } catch (error) {
+      const elapsed = Date.now() - startedAt;
+      log.warning(
+        () => ({
+          msg: "request threw",
+          fields: {
+            ...identifyRequest(request),
+            duration_ms: elapsed,
+            attempt
+          }
+        }),
+        error
+      );
+      throw error;
+    }
   }
 };
+function identifyRequest(request) {
+  const { host, path } = splitUrl(request.url);
+  return {
+    "http.request.method": request.method,
+    "server.address": host,
+    "url.path": path
+  };
+}
+function splitUrl(url) {
+  try {
+    const parsed = new URL(url);
+    return { host: parsed.host, path: parsed.pathname };
+  } catch (_) {
+    return { host: null, path: url };
+  }
+}
+function defaultMakeRequestId() {
+  return Math.random().toString(36).slice(2, 10).padEnd(8, "0");
+}
+function describeRequestUnredacted(request) {
+  return {
+    "http.request.method": request.method,
+    "url.full": buildUrlWithQueryParams(request.url, request.queryParams),
+    headers: request.headers,
+    ...request.method === "POST" ? { body: request.body } : {}
+  };
+}
 
 // src/shared/api/middleware/attach-session-middleware.ts
 function attachSessionMiddleware(fetchAccessToken) {
@@ -275,7 +569,7 @@ function attachSessionMiddleware(fetchAccessToken) {
   };
 }
 
-// src/shared/utils.ts
+// src/shared/core/utils/crypto.ts
 function getUUIDv4() {
   if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
     return crypto.randomUUID();
@@ -378,18 +672,22 @@ function renewSessionMiddleware(fetchAccessToken) {
 
 // src/shared/api/authenticated-api-client.ts
 var AuthenticatedApiClient = class {
-  constructor(config, fetchAccessToken, additionalBeforeRequest = []) {
-    this.httpClient = new HttpClient(config, {
-      beforeRequest: [
-        attachSessionMiddleware(fetchAccessToken),
-        ...additionalBeforeRequest,
-        idempotencyKeyMiddleware
-      ],
-      afterRequest: [
-        renewSessionMiddleware(fetchAccessToken),
-        requestRetryMiddleware
-      ]
-    });
+  constructor(config, fetchAccessToken, additionalBeforeRequest = [], logger = null) {
+    this.httpClient = new HttpClient(
+      config,
+      {
+        beforeRequest: [
+          attachSessionMiddleware(fetchAccessToken),
+          ...additionalBeforeRequest,
+          idempotencyKeyMiddleware
+        ],
+        afterRequest: [
+          renewSessionMiddleware(fetchAccessToken),
+          requestRetryMiddleware
+        ]
+      },
+      logger
+    );
   }
   async send(request) {
     const response = await this.httpClient.send(request);
@@ -401,10 +699,15 @@ var AuthenticatedApiClient = class {
   }
 };
 
-// src/server/api/api.server.ts
-var Api = class {
-  constructor(config, fetchAccessToken) {
-    this.client = new AuthenticatedApiClient(config, fetchAccessToken);
+// src/server/core/api/api-client.ts
+var ApiClient = class {
+  constructor(config, fetchAccessToken, logger = null) {
+    this.client = new AuthenticatedApiClient(
+      config,
+      fetchAccessToken,
+      [],
+      logger
+    );
   }
   async send(request) {
     return this.client.send(request);
@@ -419,48 +722,168 @@ var WritableSessionStoreRequiredError = class extends Error {
   }
 };
 
-// src/shared/types/document-submission.ts
-var DocumentSubmission = {
-  fromDto: (dto) => ({
-    status: dto.status,
-    formType: dto.form_type
-  })
+// src/shared/types/oauth-session.ts
+var ClientCredentialsOAuth = (value) => value;
+var OAuthRefreshToken = (value) => value;
+var OAuthSession = {
+  fromDto: (dto) => {
+    const expiresAt = new Date(Date.now() + dto.expires_in * 1e3);
+    return {
+      accessToken: {
+        value: dto.access_token,
+        expiresAt
+      },
+      ...dto.refresh_token != null && dto.refresh_token !== "" ? { refreshToken: OAuthRefreshToken(dto.refresh_token) } : void 0
+    };
+  }
 };
 
-// src/shared/api/frontline/documents.ts
-async function submitDocument(api, documentType, fields) {
-  const dto = await api.send({
-    method: "POST",
-    url: `/v1/documents/${documentType}/submission`,
-    body: fields,
-    attributes: Attributes.protected()
-  });
-  return DocumentSubmission.fromDto(dto);
+// src/server/core/server-auth-namespace.ts
+function emptySessionStore() {
+  return { getSession: async () => null };
 }
-
-// src/shared/types/kyc.ts
-var KycToken = {
-  fromDto: (dto) => ({
-    token: dto.token
-  })
+var ServerAuthNamespaceImpl = class {
+  constructor(api, config) {
+    this.api = api;
+    this.config = config;
+    this.log = internalLogger(config.logger ?? null, "AUTH");
+  }
+  async completeOAuth(params) {
+    return this.log.wrap("completeOAuth", void 0, async () => {
+      const setSession = this.writableSessionStore();
+      const sessionDto = await this.api.send({
+        method: "POST",
+        url: `/oauth/token`,
+        body: {
+          grant_type: "authorization_code",
+          code: params.code,
+          redirect_uri: this.config.redirectUri,
+          client_id: this.config.clientId,
+          client_secret: this.config.clientSecret,
+          code_verifier: params.codeVerifier
+        }
+      });
+      const session = OAuthSession.fromDto(sessionDto);
+      await setSession(session);
+      return session;
+    });
+  }
+  async getAccessToken() {
+    return this.log.wrap(
+      "getAccessToken",
+      void 0,
+      () => this.readAccessToken()
+    );
+  }
+  async readAccessToken() {
+    const sessionStore = this.config.sessionStore;
+    const session = await sessionStore.getSession();
+    if (session == null) return null;
+    const now = Date.now();
+    const expiresAt = session.accessToken.expiresAt.getTime();
+    const bufferMs = this.config.accessTokenExpiryBufferSeconds * 1e3;
+    if (expiresAt > now + bufferMs) {
+      return session.accessToken;
+    }
+    const setSession = sessionStore.setSession?.bind(sessionStore);
+    if (!setSession) {
+      this.log.child({ op: "getAccessToken" }).warn(() => ({
+        msg: "serving an expired token: the session store is read-only, so it cannot be refreshed"
+      }));
+      return session.accessToken;
+    }
+    return this.refreshSession(session.refreshToken, setSession);
+  }
+  async refreshSession(refreshToken, setSession) {
+    const log = this.log.child({ op: "refresh" });
+    if (!refreshToken) {
+      log.warn(() => ({
+        msg: "clearing the session: it carries no refresh token"
+      }));
+      await setSession(null);
+      return null;
+    }
+    try {
+      const sessionDto = await this.api.send({
+        method: "POST",
+        url: `/oauth/token`,
+        body: {
+          grant_type: "refresh_token",
+          refresh_token: refreshToken,
+          client_id: this.config.clientId,
+          client_secret: this.config.clientSecret
+        }
+      });
+      const newSession = OAuthSession.fromDto(sessionDto);
+      await setSession(newSession);
+      log.info(() => ({ msg: "session renewed" }));
+      return newSession.accessToken;
+    } catch (error) {
+      log.failure(
+        () => ({ msg: "refresh failed; clearing the session" }),
+        error
+      );
+      await setSession(null);
+      return null;
+    }
+  }
+  async clientCredentials() {
+    return this.log.wrap("clientCredentials", void 0, async () => {
+      const sessionDto = await this.api.send({
+        method: "POST",
+        url: `/oauth/token`,
+        body: {
+          grant_type: "client_credentials",
+          client_id: this.config.clientId,
+          client_secret: this.config.clientSecret
+        }
+      });
+      const session = OAuthSession.fromDto(sessionDto);
+      return ClientCredentialsOAuth(session.accessToken);
+    });
+  }
+  async logout() {
+    return this.log.wrap("logout", void 0, () => this.revokeAndClear());
+  }
+  async revokeAndClear() {
+    const setSession = this.writableSessionStore();
+    const session = await this.config.sessionStore.getSession();
+    if (session == null) return;
+    try {
+      await this.api.send({
+        method: "POST",
+        url: `/oauth/revoke`,
+        body: {
+          token: session.accessToken.value,
+          client_id: this.config.clientId,
+          client_secret: this.config.clientSecret
+        }
+      });
+    } catch (err) {
+      if (!(err instanceof HttpError) || this.config.strict) {
+        throw err;
+      }
+      this.log.child({ op: "logout" }).warn(() => ({
+        msg: "the token was not revoked upstream; the local session is cleared regardless"
+      }));
+    }
+    await setSession(null);
+  }
+  /**
+   * Returns the store's `setSession`, or throws — the guard every
+   * session-writing operation shares.
+   */
+  writableSessionStore() {
+    const sessionStore = this.config.sessionStore;
+    const setSession = sessionStore.setSession?.bind(sessionStore);
+    if (!setSession) {
+      throw new WritableSessionStoreRequiredError();
+    }
+    return setSession;
+  }
 };
 
-// src/shared/api/frontline/kyc.ts
-async function createKycToken(api, levelName, reset) {
-  const dto = await api.send({
-    method: "POST",
-    url: "/v1/kyc-token",
-    body: {
-      ...levelName === void 0 ? {} : { level_name: levelName },
-      ...reset === void 0 ? {} : { reset }
-    },
-    attributes: Attributes.protected()
-  });
-  return KycToken.fromDto(dto);
-}
-
 // src/shared/api/pagination.ts
-var Cursor = (value) => value;
 async function fetchAllPages(fetchPage, baseParams) {
   const items = [];
   let cursor = null;
@@ -475,79 +898,158 @@ async function fetchAllPages(fetchPage, baseParams) {
   } while (cursor);
   return items;
 }
-var PaginatedResponse = {
-  fromDto: (dto, itemMapper) => ({
-    data: dto.data.map(itemMapper),
-    startingAfter: dto.starting_after ? Cursor(dto.starting_after) : null,
-    startingBefore: dto.starting_before ? Cursor(dto.starting_before) : null
-  })
+
+// src/shared/types/blockchain/core.ts
+var ETHEREUM_CHAINS = {
+  ethereum_mainnet: true,
+  ethereum_sepolia: true
 };
-var PaginationParams = {
-  toQueryParams: (params) => {
-    const queryParams = {};
-    if (params.after) {
-      queryParams.starting_after = params.after;
-    }
-    if (params.before) {
-      queryParams.starting_before = params.before;
-    }
-    if (params.limit) {
-      queryParams.limit = params.limit;
-    }
-    return queryParams;
+var EthereumChain = (value) => {
+  if (!Object.keys(ETHEREUM_CHAINS).includes(value)) {
+    throw new ValidationError(`Unsupported Ethereum chain: "${value}"`);
   }
+  return value;
 };
-
-// src/shared/types/offer.ts
-var OfferId = (value) => value;
-var OfferSlug = (value) => value;
-var Offer = {
-  fromDto: (dto) => ({
-    id: OfferId(dto.id),
-    slug: OfferSlug(dto.slug),
-    type: dto.type,
-    tagline: dto.tagline,
-    bannerUrl: dto.banner_url,
-    logoUrl: dto.logo_url,
-    startsAt: new Date(dto.starts_at),
-    endsAt: dto.ends_at ? new Date(dto.ends_at) : null
-  })
+var SOLANA_CHAINS = {
+  solana_mainnet: true,
+  solana_devnet: true
 };
-
-// src/shared/types/asset.ts
-var AssetId = (value) => value;
-var AssetCode = (value) => value;
-var Asset = {
-  fromDto: (dto) => ({
-    id: AssetId(dto.id),
-    code: AssetCode(dto.code),
-    name: dto.name,
-    fractionalDigits: dto.fractional_digits
-  })
+var Chain = (value) => {
+  if (!Object.keys(ETHEREUM_CHAINS).includes(value) && !Object.keys(SOLANA_CHAINS).includes(value)) {
+    throw new ValidationError(`Unsupported chain: "${value}"`);
+  }
+  return value;
 };
-
-// src/shared/types/offer-detail.ts
-var OfferOptionId = (value) => value;
-var OfferOptionSlug = (value) => value;
+var EvmWalletAddress = (value) => value;
+var EvmContractAddress = (value) => value;
+var HexEncodedTransactionData = (value) => value;
+var MAX_ASSET_DECIMALS = 77;
+var AssetDecimals = (value) => {
+  if (!Number.isInteger(value)) {
+    throw new ValidationError(`Asset decimals must be an integer: ${value}`);
+  }
+  if (value < 0 || value > MAX_ASSET_DECIMALS) {
+    throw new ValidationError(
+      `Asset decimals out of range [0, ${MAX_ASSET_DECIMALS}]: ${value}`
+    );
+  }
+  return value;
+};
+var STABLE_DECIMALS = AssetDecimals(6);
+var DecimalString = (value) => value;
+var MAX_UINT_256 = 2n ** 256n - 1n;
+var assertUint256 = (value) => {
+  if (isUint256(value)) return value;
+  throw new InvariantError(`Value out of uint256 bounds: ${value}`);
+};
+var parseUint256 = (value, label) => {
+  if (isUint256(value)) return value;
+  throw new ValidationError(`${label}: out of uint256 bounds (${value})`);
+};
+var isUint256 = (value) => value >= 0n && value <= MAX_UINT_256;
+var BlockchainAmount = Object.assign(
+  (value) => value,
+  {
+    add: (a, b) => combineAmounts(a, b, (x, y) => x + y),
+    sub: (a, b) => combineAmounts(a, b, (x, y) => x - y)
+  }
+);
+function combineAmounts(a, b, op) {
+  if (a.decimals !== b.decimals) {
+    throw new InvariantError(
+      `Cannot combine BlockchainAmounts with different decimals: ${a.decimals} vs ${b.decimals}`
+    );
+  }
+  const raw = op(a.raw, b.raw);
+  if (raw < 0n || raw > MAX_UINT_256) {
+    throw new InvariantError(`BlockchainAmount out of uint256 bounds: ${raw}`);
+  }
+  return BlockchainAmount({ raw, decimals: a.decimals });
+}
+var AssetSymbol = (value) => value;
+
+// src/shared/types/offer.ts
+var OfferId = (value) => value;
+var OfferSlug = (value) => value;
+var Offer = {
+  fromDto: (dto) => {
+    if (!Array.isArray(dto.tokens)) {
+      throw new ValidationError(
+        `Offer.tokens: expected an array, got ${typeof dto.tokens}`
+      );
+    }
+    return {
+      id: OfferId(dto.id),
+      slug: OfferSlug(dto.slug),
+      type: dto.type,
+      tagline: dto.tagline,
+      bannerUrl: dto.banner_url,
+      logoUrl: dto.logo_url,
+      startsAt: new Date(dto.starts_at),
+      endsAt: dto.ends_at ? new Date(dto.ends_at) : null,
+      tokens: dto.tokens.map(OfferToken.fromDto)
+    };
+  }
+};
+var OfferToken = {
+  fromDto: (dto) => ({
+    role: dto.role,
+    chain: Chain(dto.chain),
+    address: EvmContractAddress(dto.address)
+  })
+};
+
+// src/shared/types/asset.ts
+var AssetId = (value) => value;
+var AssetCode = (value) => value;
+var Asset = {
+  fromDto: (dto) => ({
+    id: AssetId(dto.id),
+    code: AssetCode(dto.code),
+    name: dto.name,
+    fractionalDigits: dto.fractional_digits
+  })
+};
+
+// src/shared/types/offer-detail.ts
+var OfferOptionId = (value) => value;
+var OfferOptionSlug = (value) => value;
 var OfferDetail = {
   fromDto: (dto) => {
     if (!Array.isArray(dto.funding_assets)) {
-      throw new Error(`funding_assets must be an array`);
+      throw new ValidationError(
+        `OfferDetail.funding_assets: expected an array, got ${typeof dto.funding_assets}`
+      );
     }
     if (!Array.isArray(dto.options)) {
-      throw new Error(`options must be an array`);
+      throw new ValidationError(
+        `OfferDetail.options: expected an array, got ${typeof dto.options}`
+      );
     }
     if (!Array.isArray(dto.terms)) {
-      throw new Error(`terms must be an array`);
+      throw new ValidationError(
+        `OfferDetail.terms: expected an array, got ${typeof dto.terms}`
+      );
     }
     if (!Array.isArray(dto.links)) {
-      throw new Error(`links must be an array`);
+      throw new ValidationError(
+        `OfferDetail.links: expected an array, got ${typeof dto.links}`
+      );
     }
     if (!Array.isArray(dto.faqs)) {
-      throw new Error(`faqs must be an array`);
+      throw new ValidationError(
+        `OfferDetail.faqs: expected an array, got ${typeof dto.faqs}`
+      );
     }
     if (!Array.isArray(dto.milestones)) {
-      throw new Error(`milestones must be an array`);
+      throw new ValidationError(
+        `OfferDetail.milestones: expected an array, got ${typeof dto.milestones}`
+      );
+    }
+    if (!Array.isArray(dto.tokens)) {
+      throw new ValidationError(
+        `OfferDetail.tokens: expected an array, got ${typeof dto.tokens}`
+      );
     }
     return {
       id: OfferId(dto.id),
@@ -556,6 +1058,7 @@ var OfferDetail = {
       name: dto.name,
       asset: Asset.fromDto(dto.asset),
       fundingAssets: dto.funding_assets.map(Asset.fromDto),
+      tokens: dto.tokens.map(OfferToken.fromDto),
       about: notBlankStringOrNull(dto.about),
       tagline: dto.tagline,
       bannerUrl: dto.banner_url,
@@ -609,6 +1112,31 @@ var Milestone = {
   })
 };
 
+// src/shared/types/pagination.ts
+var Cursor = (value) => value;
+var PaginatedResponse = {
+  fromDto: (dto, itemMapper) => ({
+    data: dto.data.map(itemMapper),
+    startingAfter: dto.starting_after ? Cursor(dto.starting_after) : null,
+    startingBefore: dto.starting_before ? Cursor(dto.starting_before) : null
+  })
+};
+var PaginationParams = {
+  toQueryParams: (params) => {
+    const queryParams = {};
+    if (params.after) {
+      queryParams.starting_after = params.after;
+    }
+    if (params.before) {
+      queryParams.starting_before = params.before;
+    }
+    if (params.limit) {
+      queryParams.limit = params.limit;
+    }
+    return queryParams;
+  }
+};
+
 // src/shared/api/frontline/offers.ts
 async function fetchOffers(api, clientCreds) {
   return fetchAllPages((params) => fetchOffersPage(api, params, clientCreds));
@@ -638,44 +1166,32 @@ async function fetchOfferDetails(api, id, clientCreds) {
   return OfferDetail.fromDto(dto);
 }
 
-// src/shared/types/pii.ts
-var Iso2CountryCode = (value) => value;
-var PiiJurisdiction = {
-  fromDto: (dto) => ({
-    iso2: Iso2CountryCode(dto.iso_2),
-    name: dto.name
-  })
-};
-var PiiAddress = {
-  fromDto: (dto) => ({
-    street: dto.street,
-    city: dto.city,
-    state: dto.state,
-    postalCode: dto.postal_code,
-    country: dto.country
-  })
-};
-var Pii = {
-  fromDto: (dto) => ({
-    kind: dto.kind,
-    fullLegalName: dto.full_legal_name,
-    dateOfBirth: dto.date_of_birth,
-    jurisdiction: dto.jurisdiction ? PiiJurisdiction.fromDto(dto.jurisdiction) : null,
-    taxId: dto.tax_id,
-    permanentAddress: PiiAddress.fromDto(dto.permanent_address)
-  })
+// src/server/core/server-offers-namespace.ts
+var ServerOffersNamespaceImpl = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+    this.log = internalLogger(ctx.logger, "OFFERS");
+  }
+  async list(clientCreds) {
+    return this.log.wrap("list", clientCreds, async () => {
+      await this.ctx.ensureAuthenticated(clientCreds);
+      return fetchOffers(this.ctx.api, clientCreds);
+    });
+  }
+  async listPage(params, clientCreds) {
+    return this.log.wrap("listPage", { params, clientCreds }, async () => {
+      await this.ctx.ensureAuthenticated(clientCreds);
+      return fetchOffersPage(this.ctx.api, params, clientCreds);
+    });
+  }
+  async get(id, clientCreds) {
+    return this.log.wrap("get", { id, clientCreds }, async () => {
+      await this.ctx.ensureAuthenticated(clientCreds);
+      return fetchOfferDetails(this.ctx.api, id, clientCreds);
+    });
+  }
 };
 
-// src/shared/api/frontline/pii.ts
-async function fetchPii(api) {
-  const dto = await api.send({
-    method: "GET",
-    url: "/v1/pii",
-    attributes: Attributes.protected()
-  });
-  return Pii.fromDto(dto);
-}
-
 // src/shared/types/requirement.ts
 var RequirementId = (value) => value;
 var Requirement = {
@@ -723,138 +1239,156 @@ async function fetchRequirementStatuses(api, offerId) {
   return RequirementStatusInfo.fromStatusesDto(response);
 }
 
-// src/shared/types/blockchain/core.ts
-var EvmWalletAddress = (value) => value;
-var EvmContractAddress = (value) => value;
-var HexEncodedTransactionData = (value) => value;
-var AssetDecimals = (value) => value;
-var MAX_UINT_256 = 2n ** 256n - 1n;
-var assertUint256 = (value) => {
-  if (value < 0n || value > MAX_UINT_256) {
-    throw new Error(`Value out of uint256 bounds: ${value}`);
-  }
-  return value;
-};
-var BlockchainAmount = Object.assign(
-  (value) => value,
-  {
-    add: (a, b) => combineAmounts(a, b, (x, y) => x + y),
-    sub: (a, b) => combineAmounts(a, b, (x, y) => x - y)
-  }
-);
-function combineAmounts(a, b, op) {
-  if (a.decimals !== b.decimals) {
-    throw new Error(
-      `Cannot combine BlockchainAmounts with different decimals: ${a.decimals} vs ${b.decimals}`
-    );
-  }
-  const raw = op(a.raw, b.raw);
-  if (raw < 0n || raw > MAX_UINT_256) {
-    throw new Error(`BlockchainAmount out of uint256 bounds: ${raw}`);
-  }
-  return BlockchainAmount({ raw, decimals: a.decimals });
-}
-var AssetSymbol = (value) => value;
-
-// src/shared/types/offer-option-address.ts
-var OfferOptionAddressId = (value) => value;
-var OfferOptionAddress = {
-  /** Maps the API DTO into the SDK offer-option-address domain model. */
+// src/shared/types/document-submission.ts
+var DocumentSubmission = {
   fromDto: (dto) => ({
-    id: OfferOptionAddressId(dto.id),
-    offerOptionId: OfferOptionId(dto.offer_option_id),
-    address: EvmWalletAddress(dto.address),
-    protocol: dto.protocol,
-    createdAt: new Date(dto.created_at)
-  })
-};
-var ConnectExternalWalletParams = {
-  /** Maps connect-wallet params into the API DTO payload. */
-  toDto: (params) => ({
-    offer_option_id: params.offerOptionId,
-    wallet_address: params.walletAddress,
-    chain: params.chain,
-    signature: params.signature
+    status: dto.status,
+    formType: dto.form_type
   })
 };
 
-// src/shared/types/wallet-ownership-challenge.ts
-var WalletOwnershipChallenge = {
-  /** Maps the API DTO into the SDK wallet-ownership-challenge domain model. */
+// src/shared/api/frontline/documents.ts
+async function submitDocument(api, documentType, fields) {
+  const dto = await api.send({
+    method: "POST",
+    url: `/v1/documents/${documentType}/submission`,
+    body: fields,
+    attributes: Attributes.protected()
+  });
+  return DocumentSubmission.fromDto(dto);
+}
+
+// src/shared/types/kyc.ts
+var KycToken = {
   fromDto: (dto) => ({
-    message: dto.message,
-    expiresAt: new Date(dto.expires_at)
+    token: dto.token
   })
 };
-var CreateWalletOwnershipChallengeParams = {
-  /**
-   * Maps challenge-request params into the API DTO payload. The discriminated
-   * union guarantees SIWE fields are present exactly when `challengeType` is
-   * `siwe`, so the mapping narrows on the discriminant.
-   */
-  toDto: (params) => {
-    switch (params.challengeType) {
-      case "plain":
-        return {
-          wallet_address: params.walletAddress,
-          chain: params.chain,
-          challenge_type: "plain"
-        };
-      case "siwe":
-        return {
-          wallet_address: params.walletAddress,
-          chain: params.chain,
-          challenge_type: "siwe",
-          domain: params.domain,
-          uri: params.uri,
-          statement: params.statement
-        };
-      default: {
-        const _exhaustive = params;
-        return _exhaustive;
-      }
-    }
-  }
-};
 
-// src/shared/api/frontline/wallet-connect.ts
-async function createWalletOwnershipChallenge(api, params) {
+// src/shared/api/frontline/kyc.ts
+async function createKycToken(api, levelName, reset) {
   const dto = await api.send({
     method: "POST",
-    url: "/v1/wallet-ownership",
-    body: CreateWalletOwnershipChallengeParams.toDto(params),
+    url: "/v1/kyc-token",
+    body: {
+      ...levelName === void 0 ? {} : { level_name: levelName },
+      ...reset === void 0 ? {} : { reset }
+    },
     attributes: Attributes.protected()
   });
-  return WalletOwnershipChallenge.fromDto(dto);
+  return KycToken.fromDto(dto);
 }
-async function connectExternalWallet(api, offerId, params) {
+
+// src/shared/types/pii.ts
+var Iso2CountryCode = (value) => value;
+var PiiJurisdiction = {
+  fromDto: (dto) => ({
+    iso2: Iso2CountryCode(dto.iso_2),
+    name: dto.name
+  })
+};
+var PiiAddress = {
+  fromDto: (dto) => ({
+    street: dto.street,
+    city: dto.city,
+    state: dto.state,
+    postalCode: dto.postal_code,
+    country: dto.country
+  })
+};
+var Pii = {
+  fromDto: (dto) => ({
+    kind: dto.kind,
+    fullLegalName: dto.full_legal_name,
+    dateOfBirth: dto.date_of_birth,
+    jurisdiction: dto.jurisdiction ? PiiJurisdiction.fromDto(dto.jurisdiction) : null,
+    taxId: dto.tax_id,
+    permanentAddress: PiiAddress.fromDto(dto.permanent_address)
+  })
+};
+
+// src/shared/api/frontline/pii.ts
+async function fetchPii(api) {
   const dto = await api.send({
-    method: "POST",
-    url: `/v1/offers/${offerId}/addresses`,
-    body: ConnectExternalWalletParams.toDto(params),
-    attributes: Attributes.protected()
-  });
-  return OfferOptionAddress.fromDto(dto);
-}
-async function listOptionAddresses(api, offerId, offerOptionId) {
-  const { data } = await api.send({
     method: "GET",
-    url: `/v1/offers/${offerId}/addresses`,
-    queryParams: { offer_option_id: offerOptionId },
-    attributes: Attributes.protected()
-  });
-  return data.map(OfferOptionAddress.fromDto);
-}
-async function removeOptionAddress(api, offerId, addressId) {
-  const dto = await api.send({
-    method: "DELETE",
-    url: `/v1/offers/${offerId}/addresses/${addressId}`,
+    url: "/v1/pii",
     attributes: Attributes.protected()
   });
-  return OfferOptionAddress.fromDto(dto);
+  return Pii.fromDto(dto);
 }
 
-// src/shared/types/swap.ts
+// src/shared/core/requirements/requirements-namespace.ts
+var RequirementsNamespaceImpl = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+    this.log = internalLogger(ctx.logger, "REQUIREMENTS");
+  }
+  async forOffer(offerId) {
+    return this.log.wrap("forOffer", offerId, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return fetchOfferRequirements(
+        this.ctx.api,
+        offerId,
+        void 0
+      );
+    });
+  }
+  async statuses(offerId) {
+    return this.log.wrap("statuses", offerId, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return fetchRequirementStatuses(this.ctx.api, offerId);
+    });
+  }
+  async createKycToken(params) {
+    return this.log.wrap("createKycToken", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return createKycToken(
+        this.ctx.api,
+        params?.levelName,
+        params?.reset
+      );
+    });
+  }
+  async getPii() {
+    return this.log.wrap("getPii", void 0, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return fetchPii(this.ctx.api);
+    });
+  }
+  async submitDocument(params) {
+    return this.log.wrap("submitDocument", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return submitDocument(
+        this.ctx.api,
+        params.documentType,
+        params.fields
+      );
+    });
+  }
+};
+
+// src/server/core/server-requirements-namespace.ts
+var ServerRequirementsNamespaceImpl = class extends RequirementsNamespaceImpl {
+  constructor(serverCtx) {
+    super(serverCtx);
+    this.serverCtx = serverCtx;
+  }
+  async forOffer(offerId, clientCreds) {
+    return this.log.wrap("forOffer", { offerId, clientCreds }, async () => {
+      await this.serverCtx.ensureAuthenticated(clientCreds);
+      return fetchOfferRequirements(
+        this.serverCtx.api,
+        offerId,
+        clientCreds
+      );
+    });
+  }
+};
+
+// src/shared/api/nabu/config.ts
+var NABU_BASE_URL = "https://asset.coinlist.co";
+
+// src/shared/types/providers/superstate/swap.ts
 var SwapAuthorization = {
   fromDto: (dto) => ({
     authorized: dto.authorized
@@ -862,25 +1396,31 @@ var SwapAuthorization = {
 };
 var SwapPreview = {
   fromDto: (dto) => ({
-    inputAmount: assertUint256(BigInt(dto.pay_input_amount)),
-    fee: assertUint256(BigInt(dto.fee)),
-    outputAmount: assertUint256(BigInt(dto.receive_output_amount))
+    inputAmount: parseUint256(
+      BigInt(dto.pay_input_amount),
+      "SwapPreview.pay_input_amount"
+    ),
+    fee: parseUint256(BigInt(dto.fee), "SwapPreview.fee"),
+    outputAmount: parseUint256(
+      BigInt(dto.receive_output_amount),
+      "SwapPreview.receive_output_amount"
+    )
   })
 };
 var SwapStatus = {
   fromDto: (dto) => ({
-    stopped: assertUint256(BigInt(dto.stopped)),
-    swapLevel: assertUint256(BigInt(dto.swap_level))
+    stopped: parseUint256(BigInt(dto.stopped), "SwapStatus.stopped"),
+    swapLevel: parseUint256(BigInt(dto.swap_level), "SwapStatus.swap_level")
   })
 };
 var TokenAllowance = {
   fromDto: (dto) => ({
-    allowance: assertUint256(BigInt(dto.allowance))
+    allowance: parseUint256(BigInt(dto.allowance), "TokenAllowance.allowance")
   })
 };
 var TokenBalance = {
   fromDto: (dto) => ({
-    balance: assertUint256(BigInt(dto.balance))
+    balance: parseUint256(BigInt(dto.balance), "TokenBalance.balance")
   })
 };
 var AllowWalletResponse = {
@@ -905,7 +1445,7 @@ var AllowWalletResponse = {
   }
 };
 
-// src/shared/api/frontline/swap.ts
+// src/shared/api/frontline/providers/superstate/swap.ts
 async function getSwapAuthorization(api, params) {
   const dto = await api.send({
     method: "GET",
@@ -1005,53 +1545,27 @@ function toErc20Asset(dto) {
   };
 }
 
-// src/shared/core/erc20-namespace.ts
+// src/shared/core/blockchain/erc20/erc20-namespace.ts
 var Erc20NamespaceImpl = class {
   constructor(ctx) {
     this.ctx = ctx;
+    this.log = internalLogger(ctx.logger, "ERC20");
   }
-  async getTokenAllowance(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getTokenAllowance(this.ctx.api, params);
-  }
-  async getTokenBalance(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getTokenBalance(this.ctx.api, params);
-  }
-};
-
-// src/shared/core/swap-namespace.ts
-var SwapNamespaceImpl = class {
-  constructor(ctx) {
-    this.ctx = ctx;
-  }
-  async getAuthorization(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getSwapAuthorization(this.ctx.api, params);
-  }
-  async getPreview(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getSwapPreview(this.ctx.api, params);
-  }
-  async getStatus(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getSwapStatus(this.ctx.api, params);
-  }
-  async getOutputToken(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getSwapOutputToken(this.ctx.api, params);
-  }
-  async requestWalletOwnershipChallenge(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return createWalletOwnershipChallenge(this.ctx.api, params);
+  async getAllowance(params) {
+    return this.log.wrap("getAllowance", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getTokenAllowance(this.ctx.api, params);
+    });
   }
-  async allowWallet(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return allowWallet(this.ctx.api, params);
+  async getBalance(params) {
+    return this.log.wrap("getBalance", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getTokenBalance(this.ctx.api, params);
+    });
   }
 };
 
-// src/shared/types/participation.ts
+// src/shared/types/providers/coin-list/token-sale.ts
 var ParticipationId = (value) => value;
 var Blockchain = (value) => value;
 var WalletAddress = (value) => value;
@@ -1098,7 +1612,7 @@ var CreateParticipationParams = {
   })
 };
 
-// src/shared/api/frontline/participations.ts
+// src/shared/api/frontline/providers/coin-list/token-sale.ts
 async function fetchParticipations(api, offerId) {
   return fetchAllPages(
     (params) => fetchParticipationsPage(api, params),
@@ -1132,261 +1646,864 @@ async function createParticipation(api, params) {
   return Participation.fromDto(dto);
 }
 
-// src/shared/core/token-sale-namespace.ts
-var TokenSaleNamespaceImpl = class {
+// src/shared/core/checkout/coin-list/token-sale-namespace.ts
+var CoinListTokenSaleNamespaceImpl = class {
   constructor(ctx) {
     this.ctx = ctx;
+    this.log = internalLogger(ctx.logger, "TOKEN_SALE");
   }
-  async fetchParticipations(offerId) {
-    await this.ctx.ensureUserAuthenticated();
-    return fetchParticipations(this.ctx.api, offerId);
+  async list(offerId) {
+    return this.log.wrap("list", offerId, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return fetchParticipations(this.ctx.api, offerId);
+    });
   }
-  async fetchParticipationsPage(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return fetchParticipationsPage(this.ctx.api, params);
+  async listPage(params) {
+    return this.log.wrap("listPage", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return fetchParticipationsPage(this.ctx.api, params);
+    });
   }
-  async fetchParticipation(id) {
-    await this.ctx.ensureUserAuthenticated();
-    return fetchParticipation(this.ctx.api, id);
+  async get(id) {
+    return this.log.wrap("get", id, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return fetchParticipation(this.ctx.api, id);
+    });
   }
   async createParticipation(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return createParticipation(this.ctx.api, params);
+    return this.log.wrap("createParticipation", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return createParticipation(this.ctx.api, params);
+    });
   }
 };
 
-// src/shared/types/errors.ts
-var NotAuthenticatedError = class extends Error {
-  constructor(message = "The user is not authenticated. Go through the OAuth flow first!") {
-    super(message);
-    this.name = "NotAuthenticatedError";
-  }
+// src/shared/core/blockchain/formatters.ts
+var import_viem = require("viem");
+
+// src/shared/types/blockchain/ui.ts
+var FormattedAmountAssetUi = (value) => value;
+
+// src/shared/core/blockchain/formatters.ts
+function formatRawAmount(amount) {
+  return (0, import_viem.formatUnits)(amount.raw, amount.decimals);
+}
+var NA_AMOUNT_ASSET_UI = FormattedAmountAssetUi("-");
+var USD_FRACTION_DIGITS = AssetDecimals(2);
+
+// src/shared/core/blockchain/chain.ts
+var CHAIN_IDS = {
+  ethereum_mainnet: 1,
+  ethereum_sepolia: 11155111
 };
+function chainFromId(chainId) {
+  const chains = Object.keys(CHAIN_IDS);
+  const chain = chains.find((c) => String(CHAIN_IDS[c]) === chainId);
+  if (!chain) {
+    throw new ValidationError(`Unsupported EIP-155 chain id: "${chainId}"`);
+  }
+  return chain;
+}
 
-// src/shared/types/oauth-session.ts
-var ClientCredentialsOAuth = (value) => value;
-var OAuthRefreshToken = (value) => value;
-var OAuthSession = {
+// src/shared/core/blockchain/math.ts
+var import_viem2 = require("viem");
+function blockchainAmountFromRawOrThrow({
+  label,
+  raw,
+  decimals
+}) {
+  const trimmed = raw.trim();
+  if (trimmed === "") {
+    throw new ValidationError(`${label}: not a uint256 integer ("${raw}")`);
+  }
+  let value;
+  try {
+    value = BigInt(trimmed);
+  } catch {
+    throw new ValidationError(`${label}: not a uint256 integer ("${raw}")`);
+  }
+  try {
+    return BlockchainAmount({ raw: assertUint256(value), decimals });
+  } catch {
+    throw new ValidationError(`${label}: out of uint256 bounds (${value})`);
+  }
+}
+
+// src/shared/types/trading.ts
+var Ticker = (value) => value;
+
+// src/shared/types/providers/ondo/ondo.ts
+var OndoTradingStatus = {
   fromDto: (dto) => {
-    const expiresAt = new Date(Date.now() + dto.expires_in * 1e3);
+    if (!dto.tradable) return { type: "not-tradable", side: dto.side };
     return {
-      accessToken: {
-        value: dto.access_token,
-        expiresAt
+      type: "tradable",
+      side: dto.side,
+      grossMaxTokens: decimalOrNull(dto.gross_max_tokens),
+      grossMaxNotionalValue: decimalOrNull(dto.gross_max_notional_value),
+      grossMaxActiveNotionalValue: decimalOrNull(
+        dto.gross_max_active_notional_value
+      )
+    };
+  }
+};
+var decimalOrNull = (value) => value === null ? null : DecimalString(value);
+var OndoQuote = {
+  fromDto: (dto) => {
+    const assetDecimals = AssetDecimals(dto.asset_decimals);
+    return {
+      chain: chainFromId(dto.chain_id),
+      ticker: Ticker(dto.ticker),
+      assetAddress: EvmContractAddress(dto.asset_address),
+      asset: {
+        name: dto.ticker,
+        symbol: AssetSymbol(dto.symbol),
+        decimals: assetDecimals
       },
-      ...dto.refresh_token != null && dto.refresh_token !== "" ? { refreshToken: OAuthRefreshToken(dto.refresh_token) } : void 0
+      side: dto.side,
+      tokenBaseUnits: blockchainAmountFromRawOrThrow({
+        label: "tokenBaseUnits",
+        raw: dto.token_base_units,
+        decimals: assetDecimals
+      }),
+      price: DecimalString(dto.price)
     };
   }
 };
-
-// src/server/coinlist.server.ts
-var ACCESS_TOKEN_EXPIRY_BUFFER_SECONDS = 60;
-var CoinListServerImpl = class {
-  constructor(_config) {
-    this._config = _config;
-    this.baseUrl = _config.baseUrl ?? PUBLIC_API_BASE_URL;
-    this.accessTokenExpiryBufferSeconds = _config.accessTokenExpiryBufferSeconds ?? ACCESS_TOKEN_EXPIRY_BUFFER_SECONDS;
-    this.strict = _config.strict ?? false;
-    this.api = new Api(
-      {
-        baseUrl: this.baseUrl,
-        xApiVersion: API_VERSION
+var OndoSwapTransaction = {
+  fromDto: (dto) => {
+    const inputDecimals = AssetDecimals(dto.pay_input_decimals);
+    const outputDecimals = AssetDecimals(dto.receive_output_decimals);
+    return {
+      tx: {
+        to: EvmContractAddress(dto.to),
+        data: HexEncodedTransactionData(dto.data)
       },
-      // When refresh=true the renewal middleware has received a 401 and wants a
-      // fresh token. A read-only store cannot persist a new session, so return
-      // null immediately — this tells the middleware to skip the retry rather
-      // than re-sending with the same expired token and wasting a round-trip.
-      (refresh) => refresh && !this._config.sessionStore.setSession ? Promise.resolve(null) : this.accessToken()
-    );
-    const ctx = {
-      api: this.api,
-      ensureUserAuthenticated: () => this.ensureUserAuthenticated()
+      expiresAt: parseExpiresAt(dto.expires_at),
+      payInputAmount: blockchainAmountFromRawOrThrow({
+        label: "pay_input_amount",
+        raw: dto.pay_input_amount,
+        decimals: inputDecimals
+      }),
+      fee: blockchainAmountFromRawOrThrow({
+        label: "fee",
+        raw: dto.fee,
+        decimals: inputDecimals
+      }),
+      notionalValue: blockchainAmountFromRawOrThrow({
+        label: "notional_value",
+        raw: dto.notional_value,
+        decimals: inputDecimals
+      }),
+      receiveOutputAmount: parseReceiveOutputAmount(
+        dto.receive_output_amount,
+        outputDecimals
+      )
     };
-    this.erc20 = new Erc20NamespaceImpl(ctx);
-    this.tokenSale = new TokenSaleNamespaceImpl(ctx);
-    this.swap = new SwapNamespaceImpl(ctx);
   }
-  async completeOAuth(code, codeVerifier) {
-    const sessionStore = this._config.sessionStore;
-    const setSession = sessionStore.setSession?.bind(sessionStore);
-    if (!setSession) {
-      throw new WritableSessionStoreRequiredError();
+};
+function parseReceiveOutputAmount(raw, decimals) {
+  const amount = blockchainAmountFromRawOrThrow({
+    label: "receive_output_amount",
+    raw,
+    decimals
+  });
+  if (amount.raw <= 0n) {
+    throw new ValidationError(
+      `receive_output_amount: must be greater than zero ("${raw}")`
+    );
+  }
+  return amount;
+}
+function parseExpiresAt(value) {
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    throw new ValidationError(`expires_at: not a date ("${value}")`);
+  }
+  return date;
+}
+
+// src/shared/api/frontline/providers/ondo/ondo.ts
+async function getOndoTradingStatus(api, params) {
+  const dto = await api.send({
+    method: "GET",
+    url: "/v1/ondo/swap/trading-status",
+    queryParams: { symbol: params.symbol, side: params.side },
+    attributes: Attributes.protected()
+  });
+  return OndoTradingStatus.fromDto(dto);
+}
+async function getOndoQuote(api, params) {
+  const dto = await api.send({
+    method: "GET",
+    url: "/v1/ondo/swap/quote",
+    queryParams: {
+      symbol: params.symbol,
+      side: params.side,
+      duration: params.duration,
+      ...sizeParam(params)
+    },
+    attributes: Attributes.protected()
+  });
+  return OndoQuote.fromDto(dto);
+}
+async function buildOndoSwapTransaction(api, params) {
+  const dto = await api.send({
+    method: "POST",
+    url: "/v1/ondo/swap/transaction",
+    body: {
+      symbol: params.symbol,
+      chain: params.chain,
+      wallet_address: params.walletAddress,
+      amount: params.amount.raw.toString()
+    },
+    attributes: Attributes.protected()
+  });
+  assertFundingScaleAgrees(dto, params);
+  return OndoSwapTransaction.fromDto(dto);
+}
+function assertFundingScaleAgrees(dto, params) {
+  if (dto.pay_input_decimals !== params.amount.decimals) {
+    throw new ValidationError(
+      `pay_input_decimals: the swap was priced in ${dto.pay_input_decimals} decimals but the order was sized in ${params.amount.decimals}`
+    );
+  }
+}
+function sizeParam(params) {
+  const tokenAmount = "tokenAmount" in params ? params.tokenAmount : void 0;
+  const notionalValue = "notionalValue" in params ? params.notionalValue : void 0;
+  if (tokenAmount !== void 0) {
+    if (notionalValue !== void 0) {
+      throw new ValidationError(
+        "An Ondo quote takes tokenAmount or notionalValue, not both"
+      );
     }
-    const sessionDto = await this.api.send({
-      method: "POST",
-      url: `/oauth/token`,
-      body: {
-        grant_type: "authorization_code",
-        code,
-        redirect_uri: this._config.redirectUri,
-        client_id: this._config.clientId,
-        client_secret: this._config.clientSecret,
-        code_verifier: codeVerifier
-      }
+    return { token_amount: formatRawAmount(tokenAmount) };
+  }
+  if (notionalValue === void 0) {
+    throw new ValidationError(
+      "An Ondo quote must be sized by tokenAmount or notionalValue"
+    );
+  }
+  return { notional_value: notionalValue };
+}
+
+// src/shared/core/checkout/ondo/ondo-namespace.ts
+var OndoNamespaceImpl = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+    this.log = internalLogger(ctx.logger, "ONDO");
+  }
+  async getTradingStatus(params) {
+    return this.log.wrap("getTradingStatus", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getOndoTradingStatus(this.ctx.api, params);
     });
-    const session = OAuthSession.fromDto(sessionDto);
-    await setSession(session);
-    return session;
-  }
-  async clientCredentialsOAuth() {
-    const sessionDto = await this.api.send({
-      method: "POST",
-      url: `/oauth/token`,
-      body: {
-        grant_type: "client_credentials",
-        client_id: this._config.clientId,
-        client_secret: this._config.clientSecret
-      }
+  }
+  async getQuote(params) {
+    return this.log.wrap("getQuote", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getOndoQuote(this.ctx.api, params);
     });
-    const session = OAuthSession.fromDto(sessionDto);
-    return ClientCredentialsOAuth(session.accessToken);
   }
-  async accessToken() {
-    const sessionStore = this._config.sessionStore;
-    const session = await sessionStore.getSession();
-    if (session == null) return null;
-    const now = Date.now();
-    const expiresAt = session.accessToken.expiresAt.getTime();
-    const bufferMs = this.accessTokenExpiryBufferSeconds * 1e3;
-    if (expiresAt > now + bufferMs) {
-      return session.accessToken;
-    }
-    const setSession = sessionStore.setSession?.bind(sessionStore);
-    if (!setSession) {
-      return session.accessToken;
-    } else {
-      return this.refreshSession(session.refreshToken, setSession);
-    }
+  async buildSwapTransaction(params) {
+    return this.log.wrap("buildSwapTransaction", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return buildOndoSwapTransaction(this.ctx.api, params);
+    });
   }
-  async refreshSession(refreshToken, setSession) {
-    if (!refreshToken) {
-      await setSession(null);
-      return null;
-    }
-    try {
-      const sessionDto = await this.api.send({
-        method: "POST",
-        url: `/oauth/token`,
-        body: {
-          grant_type: "refresh_token",
-          refresh_token: refreshToken,
-          client_id: this._config.clientId,
-          client_secret: this._config.clientSecret
-        }
-      });
-      const newSession = OAuthSession.fromDto(sessionDto);
-      await setSession(newSession);
-      return newSession.accessToken;
-    } catch {
-      await setSession(null);
-      return null;
-    }
+};
+
+// src/shared/core/checkout/superstate/swap-namespace.ts
+var SuperstateSwapNamespaceImpl = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+    this.log = internalLogger(ctx.logger, "SUPERSTATE");
   }
-  async logout() {
-    const sessionStore = this._config.sessionStore;
-    const setSession = sessionStore.setSession?.bind(sessionStore);
-    if (!setSession) {
-      throw new WritableSessionStoreRequiredError();
-    }
-    const session = await sessionStore.getSession();
-    if (session != null) {
-      const tokenToRevoke = session.accessToken.value;
+  async getAuthorization(params) {
+    return this.log.wrap("getAuthorization", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getSwapAuthorization(this.ctx.api, params);
+    });
+  }
+  async getPreview(params) {
+    return this.log.wrap("getPreview", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getSwapPreview(this.ctx.api, params);
+    });
+  }
+  async getStatus(params) {
+    return this.log.wrap("getStatus", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getSwapStatus(this.ctx.api, params);
+    });
+  }
+  async getOutputToken(params) {
+    return this.log.wrap("getOutputToken", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getSwapOutputToken(this.ctx.api, params);
+    });
+  }
+  async allowWallet(params) {
+    return this.log.wrap("allowWallet", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return allowWallet(this.ctx.api, params);
+    });
+  }
+};
+
+// src/shared/api/nabu/tokens.ts
+var import_viem3 = require("viem");
+
+// src/shared/types/token-metadata.ts
+var TokenLogoUrl = (value) => value;
+var TokenLogo = {
+  /** `baseUrl` is the registry origin; registry URLs are root-relative. */
+  fromDto: (dto, baseUrl) => dto.kind === "VECTOR" ? { kind: "VECTOR", url: resolveLogoUrl(dto.url, baseUrl) } : {
+    kind: "RASTER",
+    original: logoImageFromDto(dto.original, baseUrl),
+    variants: dto.variants.map((v) => logoImageFromDto(v, baseUrl))
+  }
+};
+var TokenMetadata = {
+  /** `baseUrl` is the registry origin; registry logo URLs are root-relative. */
+  fromDto: (dto, baseUrl) => {
+    assertSupportedSchemaVersion(dto.schema_version);
+    return {
+      identifier: {
+        chain: EthereumChain(dto.chain),
+        address: EvmContractAddress(dto.address)
+      },
+      name: dto.name,
+      symbol: AssetSymbol(dto.symbol),
+      decimals: AssetDecimals(dto.decimals),
+      logo: TokenLogo.fromDto(dto.logo, baseUrl),
+      logoDark: dto.logo_dark === void 0 ? null : TokenLogo.fromDto(dto.logo_dark, baseUrl)
+    };
+  },
+  /**
+   * Maps the complete registry snapshot to every token it lists across the
+   * chains this SDK models, skipping native coins and chains outside
+   * {@link EthereumChain} (e.g. Solana) rather than failing on them — the
+   * registry may serve chains ahead of the SDK's type surface.
+   */
+  fromRegistryDto: (dto, baseUrl) => {
+    assertSupportedSchemaVersion(dto.schema_version);
+    return dto.chains.flatMap((chainDto) => {
+      let chain;
       try {
-        await this.api.send({
-          method: "POST",
-          url: `/oauth/revoke`,
-          body: {
-            token: tokenToRevoke,
-            client_id: this._config.clientId,
-            client_secret: this._config.clientSecret
-          }
-        });
-      } catch (err) {
-        if (err instanceof HttpError) {
-          if (this.strict) {
-            throw err;
-          }
-        } else {
-          throw err;
-        }
+        chain = EthereumChain(chainDto.chain);
+      } catch {
+        return [];
       }
-      await setSession(null);
+      return tokensOfChain(chain, chainDto.assets, baseUrl);
+    });
+  },
+  /**
+   * Maps a chain snapshot to the tokens it lists, skipping the chain's native
+   * coin (`kind: 'COIN'`, no contract address).
+   */
+  fromChainAssetsDto: (dto, baseUrl) => {
+    assertSupportedSchemaVersion(dto.schema_version);
+    return tokensOfChain(EthereumChain(dto.chain), dto.assets, baseUrl);
+  }
+};
+function tokensOfChain(chain, assets, baseUrl) {
+  return assets.filter((asset) => asset.kind === "TOKEN" && asset.address !== void 0).map((asset) => ({
+    identifier: {
+      chain,
+      // The filter above cannot narrow `address` for the type checker.
+      address: EvmContractAddress(asset.address)
+    },
+    name: asset.name,
+    symbol: AssetSymbol(asset.symbol),
+    decimals: AssetDecimals(asset.decimals),
+    logo: TokenLogo.fromDto(asset.logo, baseUrl),
+    logoDark: asset.logo_dark === void 0 ? null : TokenLogo.fromDto(asset.logo_dark, baseUrl)
+  }));
+}
+function assertSupportedSchemaVersion(version) {
+  if (version !== 1) {
+    throw new ValidationError(
+      `Unsupported token registry schema_version: ${version}`
+    );
+  }
+}
+var logoImageFromDto = (dto, baseUrl) => ({
+  url: resolveLogoUrl(dto.url, baseUrl),
+  width: dto.width,
+  height: dto.height
+});
+var resolveLogoUrl = (url, baseUrl) => TokenLogoUrl(
+  url.startsWith("http") ? url : `${baseUrl.replace(/\/$/, "")}${url}`
+);
+
+// src/shared/api/nabu/tokens.ts
+function createNabuApiClient(baseUrl, logger = null) {
+  return new HttpClient({ baseUrl }, {}, logger);
+}
+async function fetchTokenMetadata(client, token) {
+  const address = checksummed(token.address);
+  let response;
+  try {
+    response = await client.send({
+      method: "GET",
+      url: `/${token.chain}/token/${address}`
+    });
+  } catch (error) {
+    if (isRegistryHtmlFallback(error)) {
+      return null;
     }
+    throw error;
   }
-  async fetchOffers(clientCreds) {
-    await this.ensureAuthenticated(clientCreds);
-    return fetchOffers(this.api, clientCreds);
+  if (response.status === 404) {
+    return null;
   }
-  async fetchOffersPage(params, clientCreds) {
-    await this.ensureAuthenticated(clientCreds);
-    return fetchOffersPage(this.api, params, clientCreds);
+  assertOk(response);
+  if (response.body === null) {
+    throw new ValidationError(
+      `Token registry returned an empty body for token "${address}" on "${token.chain}"`
+    );
   }
-  async fetchOfferDetails(id, clientCreds) {
-    await this.ensureAuthenticated(clientCreds);
-    return fetchOfferDetails(this.api, id, clientCreds);
+  return TokenMetadata.fromDto(response.body, client.config.baseUrl);
+}
+async function fetchTokensMetadata(client, chain) {
+  let response;
+  try {
+    response = await client.send({
+      method: "GET",
+      url: `/${chain}/assets.json`
+    });
+  } catch (error) {
+    if (isRegistryHtmlFallback(error)) {
+      throw new ValidationError(
+        `Token registry returned non-JSON for the "${chain}" snapshot`
+      );
+    }
+    throw error;
   }
-  async createWalletOwnershipChallenge(params) {
-    await this.ensureUserAuthenticated();
-    return createWalletOwnershipChallenge(this.api, params);
+  assertOk(response);
+  if (response.body === null) {
+    throw new ValidationError(
+      `Token registry returned an empty "${chain}" snapshot`
+    );
   }
-  async connectExternalWallet(offerId, params) {
-    await this.ensureUserAuthenticated();
-    return connectExternalWallet(this.api, offerId, params);
+  return TokenMetadata.fromChainAssetsDto(response.body, client.config.baseUrl);
+}
+async function fetchAllTokensMetadata(client) {
+  let response;
+  try {
+    response = await client.send({
+      method: "GET",
+      url: `/assets.json`
+    });
+  } catch (error) {
+    if (isRegistryHtmlFallback(error)) {
+      throw new ValidationError(
+        "Token registry returned non-JSON for the complete snapshot"
+      );
+    }
+    throw error;
   }
-  async listOptionAddresses(offerId, offerOptionId) {
-    await this.ensureUserAuthenticated();
-    return listOptionAddresses(
-      this.api,
-      offerId,
-      offerOptionId
+  assertOk(response);
+  if (response.body === null) {
+    throw new ValidationError(
+      "Token registry returned an empty complete snapshot"
     );
   }
-  async removeOptionAddress(offerId, addressId) {
-    await this.ensureUserAuthenticated();
-    return removeOptionAddress(this.api, offerId, addressId);
+  return TokenMetadata.fromRegistryDto(response.body, client.config.baseUrl);
+}
+function isRegistryHtmlFallback(error) {
+  return error instanceof HttpError && error.response.status >= 200 && error.response.status < 300;
+}
+function assertOk(response) {
+  if (response.status < 200 || response.status >= 300) {
+    throw new HttpError(response);
+  }
+}
+function checksummed(address) {
+  try {
+    return (0, import_viem3.getAddress)(address);
+  } catch (_) {
+    throw new ValidationError(`Invalid EVM contract address: "${address}"`);
   }
-  async fetchOfferRequirements(offerId, clientCreds) {
-    await this.ensureAuthenticated(clientCreds);
-    return fetchOfferRequirements(
-      this.api,
-      offerId,
-      clientCreds
+}
+
+// src/shared/core/tokens/tokens-namespace.ts
+var TokensNamespaceImpl = class {
+  /**
+   * Takes the registry origin rather than a `SharedNamespaceContext`: the
+   * registry is unauthenticated and on its own host, so the frontline sender
+   * and the auth check would both be dead weight here.
+   */
+  constructor(baseUrl, logger = null) {
+    this.api = createNabuApiClient(baseUrl, logger);
+    this.log = internalLogger(logger, "TOKENS");
+  }
+  get(token) {
+    return this.log.wrap(
+      "get",
+      token,
+      () => fetchTokenMetadata(this.api, token)
     );
   }
-  async fetchRequirementStatuses(offerId) {
-    await this.ensureUserAuthenticated();
-    return fetchRequirementStatuses(this.api, offerId);
+  list(chain) {
+    return this.log.wrap(
+      "list",
+      chain,
+      () => chain === void 0 ? fetchAllTokensMetadata(this.api) : fetchTokensMetadata(this.api, chain)
+    );
   }
-  async ensureAuthenticated(clientCreds) {
-    if (!clientCreds) {
-      await this.ensureUserAuthenticated();
+};
+
+// src/shared/types/offer-option-address.ts
+var OfferOptionAddressId = (value) => value;
+var OfferOptionAddress = {
+  /** Maps the API DTO into the SDK offer-option-address domain model. */
+  fromDto: (dto) => ({
+    id: OfferOptionAddressId(dto.id),
+    offerOptionId: OfferOptionId(dto.offer_option_id),
+    address: EvmWalletAddress(dto.address),
+    protocol: dto.protocol,
+    createdAt: new Date(dto.created_at)
+  })
+};
+var ConnectExternalWalletParams = {
+  /** Maps connect-wallet params into the API DTO payload. */
+  toDto: (params) => ({
+    offer_option_id: params.offerOptionId,
+    wallet_address: params.walletAddress,
+    chain: params.chain,
+    signature: params.signature
+  })
+};
+
+// src/shared/types/wallet-ownership-challenge.ts
+var WalletOwnershipChallenge = {
+  /** Maps the API DTO into the SDK wallet-ownership-challenge domain model. */
+  fromDto: (dto) => ({
+    message: dto.message,
+    expiresAt: new Date(dto.expires_at)
+  })
+};
+var CreateWalletOwnershipChallengeParams = {
+  /**
+   * Maps challenge-request params into the API DTO payload. The discriminated
+   * union guarantees SIWE fields are present exactly when `challengeType` is
+   * `siwe`, so the mapping narrows on the discriminant.
+   */
+  toDto: (params) => {
+    switch (params.challengeType) {
+      case "plain":
+        return {
+          wallet_address: params.walletAddress,
+          chain: params.chain,
+          challenge_type: "plain"
+        };
+      case "siwe":
+        return {
+          wallet_address: params.walletAddress,
+          chain: params.chain,
+          challenge_type: "siwe",
+          domain: params.domain,
+          uri: params.uri,
+          statement: params.statement
+        };
+      default: {
+        const _exhaustive = params;
+        return _exhaustive;
+      }
     }
   }
-  async ensureUserAuthenticated() {
-    const token = await this.accessToken();
-    if (token === null) {
-      throw new NotAuthenticatedError();
-    }
+};
+
+// src/shared/api/frontline/wallet-connect.ts
+async function createWalletOwnershipChallenge(api, params) {
+  const dto = await api.send({
+    method: "POST",
+    url: "/v1/wallet-ownership",
+    body: CreateWalletOwnershipChallengeParams.toDto(params),
+    attributes: Attributes.protected()
+  });
+  return WalletOwnershipChallenge.fromDto(dto);
+}
+async function connectExternalWallet(api, params) {
+  const dto = await api.send({
+    method: "POST",
+    url: `/v1/offers/${params.offerId}/addresses`,
+    body: ConnectExternalWalletParams.toDto(params),
+    attributes: Attributes.protected()
+  });
+  return OfferOptionAddress.fromDto(dto);
+}
+async function listOptionAddresses(api, offerId, offerOptionId) {
+  const { data } = await api.send({
+    method: "GET",
+    url: `/v1/offers/${offerId}/addresses`,
+    queryParams: { offer_option_id: offerOptionId },
+    attributes: Attributes.protected()
+  });
+  return data.map(OfferOptionAddress.fromDto);
+}
+async function removeOptionAddress(api, offerId, addressId) {
+  const dto = await api.send({
+    method: "DELETE",
+    url: `/v1/offers/${offerId}/addresses/${addressId}`,
+    attributes: Attributes.protected()
+  });
+  return OfferOptionAddress.fromDto(dto);
+}
+
+// src/shared/core/wallets/wallets-namespace.ts
+var WalletsNamespaceImpl = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+    this.log = internalLogger(ctx.logger, "WALLETS");
+  }
+  async createOwnershipChallenge(params) {
+    return this.log.wrap("createOwnershipChallenge", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return createWalletOwnershipChallenge(
+        this.ctx.api,
+        params
+      );
+    });
   }
-  async fetchPii() {
-    await this.ensureUserAuthenticated();
-    return fetchPii(this.api);
+  async connectExternal(params) {
+    return this.log.wrap("connectExternal", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return connectExternalWallet(this.ctx.api, params);
+    });
   }
-  async submitDocument(documentType, fields) {
-    await this.ensureUserAuthenticated();
-    return submitDocument(this.api, documentType, fields);
+  async list(params) {
+    return this.log.wrap("list", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return listOptionAddresses(
+        this.ctx.api,
+        params.offerId,
+        params.offerOptionId
+      );
+    });
   }
-  async createKycToken(levelName, reset) {
-    await this.ensureUserAuthenticated();
-    return createKycToken(this.api, levelName, reset);
+  async remove(params) {
+    return this.log.wrap("remove", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return removeOptionAddress(
+        this.ctx.api,
+        params.offerId,
+        params.addressId
+      );
+    });
+  }
+};
+
+// src/server/core/coinlist-server.ts
+var ACCESS_TOKEN_EXPIRY_BUFFER_SECONDS = 60;
+var CoinListServerImpl = class {
+  constructor(_config) {
+    this._config = _config;
+    const logger = _config.logger ?? null;
+    this.api = new ApiClient(
+      {
+        baseUrl: _config.baseUrl ?? PUBLIC_API_BASE_URL,
+        xApiVersion: API_VERSION
+      },
+      // When refresh=true the renewal middleware has received a 401 and wants a
+      // fresh token. A read-only store cannot persist a new session, so return
+      // null immediately — this tells the middleware to skip the retry rather
+      // than re-sending with the same expired token and wasting a round-trip.
+      (refresh) => refresh && !this._config.sessionStore.setSession ? Promise.resolve(null) : this.auth.getAccessToken(),
+      logger
+    );
+    this.auth = new ServerAuthNamespaceImpl(this.api, {
+      ..._config,
+      accessTokenExpiryBufferSeconds: _config.accessTokenExpiryBufferSeconds ?? ACCESS_TOKEN_EXPIRY_BUFFER_SECONDS,
+      strict: _config.strict ?? false
+    });
+    const ctx = {
+      api: this.api,
+      logger,
+      ensureUserAuthenticated: () => this.ensureAuthenticated(void 0),
+      ensureAuthenticated: (clientCreds) => this.ensureAuthenticated(clientCreds)
+    };
+    this.offers = new ServerOffersNamespaceImpl(ctx);
+    this.requirements = new ServerRequirementsNamespaceImpl(ctx);
+    this.wallets = new WalletsNamespaceImpl(ctx);
+    this.erc20 = new Erc20NamespaceImpl(ctx);
+    this.tokenSale = new CoinListTokenSaleNamespaceImpl(ctx);
+    this.superstate = new SuperstateSwapNamespaceImpl(ctx);
+    this.ondo = new OndoNamespaceImpl(ctx);
+    this.tokens = new TokensNamespaceImpl(
+      _config.tokensBaseUrl ?? NABU_BASE_URL,
+      logger
+    );
+  }
+  /**
+   * An app-level token authenticates a request on its own; without one the
+   * caller needs a user session.
+   */
+  async ensureAuthenticated(clientCreds) {
+    if (clientCreds) return;
+    const token = await this.auth.getAccessToken();
+    if (token === null) {
+      throw new NotAuthenticatedError();
+    }
   }
 };
 function createCoinListServer(config) {
   return new CoinListServerImpl(config);
 }
+
+// src/server/core/observability/pino-server-logger.ts
+var import_pino = require("pino");
+
+// src/shared/core/observability/pino-logger.ts
+function toPinoRecord(event) {
+  try {
+    const record = {};
+    for (const key of ownKeys(event.fields)) {
+      record[key] = readProperty(event.fields, key, 0, /* @__PURE__ */ new WeakSet());
+    }
+    const cause = "cause" in event ? event.cause : void 0;
+    if (cause !== void 0) {
+      record.cause = sanitize(cause, 0, /* @__PURE__ */ new WeakSet());
+    }
+    return { ...record, scope: event.scope, ...event.bindings };
+  } catch (_) {
+    return { "log.render": "<unrenderable event>" };
+  }
+}
+var PINO_LEVEL = {
+  none: "silent",
+  error: "error",
+  warn: "warn",
+  info: "info",
+  debug: "debug"
+};
+var MAX_DEPTH = 8;
+function sanitize(value, depth, seen) {
+  switch (typeof value) {
+    case "string":
+    case "boolean":
+      return value;
+    case "number":
+      return Number.isFinite(value) ? value : String(value);
+    case "bigint":
+      return value.toString();
+    case "undefined":
+      return "<undefined>";
+    case "function":
+      return "<function>";
+    case "symbol":
+      return value.toString();
+    case "object":
+      return value === null ? null : sanitizeObject(value, depth, seen);
+    default:
+      return "<unrenderable>";
+  }
+}
+function sanitizeObject(value, depth, seen) {
+  if (seen.has(value)) return "<circular>";
+  if (depth >= MAX_DEPTH) return "<max depth>";
+  if (value instanceof Error) return describeError(value);
+  if (value instanceof Date) return describeDate(value);
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) {
+      return value.map(
+        (_item, index) => readProperty(value, String(index), depth, seen)
+      );
+    }
+    const out = {};
+    for (const key of ownKeys(value)) {
+      out[key] = readProperty(value, key, depth, seen);
+    }
+    return out;
+  } finally {
+    seen.delete(value);
+  }
+}
+function readProperty(owner, key, depth, seen) {
+  try {
+    return sanitize(owner[key], depth + 1, seen);
+  } catch (_) {
+    return "<unreadable>";
+  }
+}
+function ownKeys(value) {
+  try {
+    return Object.keys(value);
+  } catch (_) {
+    return [];
+  }
+}
+function describeError(error) {
+  return {
+    name: safeRead(() => error.name),
+    message: safeRead(() => error.message),
+    stack: safeRead(() => error.stack)
+  };
+}
+function describeDate(date) {
+  return safeRead(() => date.toISOString());
+}
+function safeRead(read) {
+  try {
+    const value = read();
+    return typeof value === "string" ? value : "<unreadable>";
+  } catch (_) {
+    return "<unreadable>";
+  }
+}
+var SDK_LOGGER_NAME = "@coinlist-co/react";
+function loggerOverPino(sink, level) {
+  return {
+    level: () => level,
+    debug: (event) => emit(sink, "debug", event),
+    info: (event) => emit(sink, "info", event),
+    warn: (event) => emit(sink, "warn", event),
+    error: (event) => emit(sink, "error", event)
+  };
+}
+function emit(sink, method, event) {
+  try {
+    const value = event();
+    sink[method](toPinoRecord(value), value.msg);
+  } catch (error) {
+    reportRenderFailure(sink, error);
+  }
+}
+function reportRenderFailure(sink, error) {
+  try {
+    sink.error(
+      { "error.type": error instanceof Error ? error.name : typeof error },
+      "log event failed to render"
+    );
+  } catch (_) {
+  }
+}
+
+// src/server/core/observability/pino-server-logger.ts
+function pinoServerLogger(options) {
+  return loggerOverPino(
+    // `name` as a child binding rather than pino's `name` option: the option
+    // is honoured by pino's node build and silently dropped by its browser
+    // build, so a binding is the only spelling that identifies the SDK in
+    // both environments.
+    (0, import_pino.pino)({
+      level: PINO_LEVEL[options.level]
+    }).child({ name: SDK_LOGGER_NAME }),
+    options.level
+  );
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ServerAuthNamespaceImpl,
+  ServerOffersNamespaceImpl,
+  ServerRequirementsNamespaceImpl,
   WritableSessionStoreRequiredError,
-  createCoinListServer
+  createCoinListServer,
+  emptySessionStore,
+  pinoServerLogger
 });
 //# sourceMappingURL=index.cjs.map