@coinlist-co/react 0.11.0 → 0.11.1-rc.22d81d4

package/dist/server/index.cjs

@@ -24,7 +24,9 @@ __export(server_exports, {
   ServerOffersNamespaceImpl: () => ServerOffersNamespaceImpl,
   ServerRequirementsNamespaceImpl: () => ServerRequirementsNamespaceImpl,
   WritableSessionStoreRequiredError: () => WritableSessionStoreRequiredError,
-  createCoinListServer: () => createCoinListServer
+  createCoinListServer: () => createCoinListServer,
+  emptySessionStore: () => emptySessionStore,
+  pinoServerLogger: () => pinoServerLogger
 });
 module.exports = __toCommonJS(server_exports);
 
@@ -55,6 +57,8 @@ var retryAttempt = (attempt) => ({
 var renewAttempted = (value) => ({
   renewAttempted: value
 });
+var requestId = (id) => ({ requestId: id });
+var getRequestId = (attrs) => attrs?.requestId ?? null;
 var isProtected = (attrs) => attrs?.protected === true;
 var needUserAgent = (attrs) => attrs?.userAgent === true;
 var isIdempotent = (attrs) => attrs?.idempotencyKey === true;
@@ -76,7 +80,9 @@ var Attributes = {
   renewAttempted,
   wasRenewAttempted,
   clientCredentials,
-  getClientCredentials
+  getClientCredentials,
+  requestId,
+  getRequestId
 };
 
 // src/shared/api/http.ts
@@ -86,7 +92,24 @@ var HttpError = class extends Error {
     this.name = "HttpError";
     this.response = response;
   }
+  /**
+   * Correlates this failure with the `[HTTP]` log lines for the same request,
+   * which carry the method, the URL, the duration and every retry. `null` when
+   * the response did not come from an {@link HttpClient}.
+   *
+   * Worth quoting in a bug report: it is what makes a log excerpt readable.
+   */
+  get requestId() {
+    return this.response.requestId ?? null;
+  }
 };
+function apiErrorCode(error) {
+  if (!(error instanceof HttpError)) return null;
+  const body = error.response.body;
+  if (typeof body !== "object" || body === null) return null;
+  const code = body.code;
+  return typeof code === "string" ? code : null;
+}
 async function makeRequest(request) {
   const headers = {
     Accept: "application/json",
@@ -192,11 +215,185 @@ var HEADER_API_VERSION = "X-API-Version";
 var HEADER_IDEMPOTENCY_KEY = "Idempotency-Key";
 var API_VERSION = "2025-10-17";
 
+// src/shared/types/errors.ts
+var NotImplementedError = class extends Error {
+  constructor(message = "Not implemented yet") {
+    super(message);
+    this.name = "NotImplementedError";
+  }
+};
+var NotAuthenticatedError = class extends Error {
+  constructor(message = "The user is not authenticated. Go through the OAuth flow first!") {
+    super(message);
+    this.name = "NotAuthenticatedError";
+  }
+};
+var ValidationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ValidationError";
+  }
+};
+var InvariantError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InvariantError";
+  }
+};
+
+// src/shared/core/observability/log-cause.ts
+function classifyLogCause(error) {
+  if (error instanceof HttpError) {
+    return httpCause(error);
+  }
+  if (error instanceof ValidationError) {
+    return { type: "validation", message: error.message };
+  }
+  if (error instanceof InvariantError) {
+    return { type: "invariant", message: error.message };
+  }
+  if (error instanceof NotAuthenticatedError) {
+    return { type: "not-authenticated" };
+  }
+  if (error instanceof NotImplementedError) {
+    return { type: "not-implemented" };
+  }
+  return { type: "generic-error", name: errorName(error) };
+}
+function describeErrorUnredacted(error) {
+  if (error instanceof HttpError) {
+    return describeHttpErrorRedacted(error);
+  }
+  if (error instanceof Error) {
+    return `${error.name}: ${error.message}`;
+  }
+  return `thrown non-error: ${stringifyUnredacted(error)}`;
+}
+function stringifyUnredacted(value) {
+  if (value === void 0) return "";
+  try {
+    return JSON.stringify(
+      value,
+      (_key, item) => typeof item === "bigint" ? `${item}` : item
+    ) ?? String(value);
+  } catch (_) {
+    return "<unserializable>";
+  }
+}
+function describeHttpErrorRedacted(error) {
+  const code = apiErrorCode(error);
+  const status = error.response.status;
+  return code === null ? `HttpError ${status}` : `HttpError ${status} (${code})`;
+}
+function errorName(error) {
+  return error instanceof Error ? error.name : `non-error ${typeof error}`;
+}
+function httpCause(error) {
+  return {
+    type: "http",
+    requestId: error.requestId,
+    status: error.response.status,
+    code: apiErrorCode(error),
+    eventId: apiErrorEventId(error)
+  };
+}
+function apiErrorEventId(error) {
+  const body = error.response.body;
+  if (typeof body !== "object" || body === null) return null;
+  const eventId = body.event_id;
+  return typeof eventId === "string" ? eventId : null;
+}
+
+// src/shared/core/observability/internal-logger.ts
+function internalLogger(logger, scope) {
+  return logger ? scopedLogger(logger, scope, {}) : noopInternalLogger;
+}
+var LEVEL_RANK = {
+  none: 0,
+  error: 1,
+  warn: 2,
+  info: 3,
+  debug: 4
+};
+function scopedLogger(logger, scope, bindings) {
+  const admits = (level) => LEVEL_RANK[logger.level()] >= LEVEL_RANK[level];
+  const safe = (event) => ({
+    msg: event.msg,
+    scope,
+    bindings,
+    fields: event.fields ?? {},
+    ...event.cause === void 0 ? {} : { cause: event.cause }
+  });
+  const unredacted = (event) => ({
+    msg: event.msg,
+    scope,
+    bindings,
+    fields: event.fields ?? {}
+  });
+  const self = {
+    child: (binding) => scopedLogger(logger, scope, { ...bindings, ...binding }),
+    debug: (event) => {
+      if (admits("debug")) logger.debug(() => unredacted(event()));
+    },
+    info: (event) => {
+      if (admits("info")) logger.info(() => safe(event()));
+    },
+    warn: (event) => {
+      if (admits("warn")) logger.warn(() => safe(event()));
+    },
+    error: (event) => {
+      if (admits("error")) logger.error(() => safe(event()));
+    },
+    failure: (event, error) => {
+      if (admits("debug"))
+        logger.debug(() => unredacted(verbatim(event(), error)));
+      if (admits("error")) logger.error(() => safe(classified(event(), error)));
+    },
+    warning: (event, error) => {
+      if (admits("debug"))
+        logger.debug(() => unredacted(verbatim(event(), error)));
+      if (admits("warn")) logger.warn(() => safe(classified(event(), error)));
+    },
+    wrap: async (op, params, run) => {
+      const opLog = self.child({ op });
+      opLog.debug(() => ({ msg: "call", fields: { params } }));
+      try {
+        return await run();
+      } catch (error) {
+        opLog.failure(() => ({ msg: "call failed" }), error);
+        throw error;
+      }
+    }
+  };
+  return self;
+}
+function verbatim(event, error) {
+  return {
+    msg: event.msg,
+    fields: { ...event.fields, error: describeErrorUnredacted(error) }
+  };
+}
+function classified(event, error) {
+  return { ...event, cause: event.cause ?? classifyLogCause(error) };
+}
+var noopInternalLogger = {
+  child: () => noopInternalLogger,
+  debug: () => void 0,
+  info: () => void 0,
+  warn: () => void 0,
+  error: () => void 0,
+  failure: () => void 0,
+  warning: () => void 0,
+  wrap: (_op, _params, run) => run()
+};
+
 // src/shared/api/http-client.ts
 var HttpClient = class {
-  constructor(config, middleware = {}) {
+  constructor(config, middleware = {}, logger = null, options = {}) {
     this.config = config;
     this.middleware = middleware;
+    this.log = internalLogger(logger, "HTTP");
+    this.makeRequestId = options.makeRequestId ?? defaultMakeRequestId;
   }
   async send(request) {
     return this.runRequestWithAfterMiddleware(request);
@@ -232,7 +429,13 @@ var HttpClient = class {
     return {
       ...request,
       url,
-      headers
+      headers,
+      // Only when absent: a retry or a post-renewal re-send arrives with the
+      // first attempt's id already on it, and keeping it is the whole point.
+      attributes: Attributes.getRequestId(request.attributes) === null ? Attributes.concat(
+        request.attributes ?? Attributes.empty,
+        Attributes.requestId(this.makeRequestId())
+      ) : request.attributes
     };
   }
   /**
@@ -256,10 +459,89 @@ var HttpClient = class {
     }
     return request;
   }
-  executeRequest(request) {
-    return makeRequest(request);
+  /**
+   * One physical attempt, logged as one line.
+   *
+   * A non-2xx is a `warn` rather than an `error` because the wire does not
+   * know whether it is a failure: the retry middleware may turn a 503 into a
+   * success, and the token registry reads a 404 as "not listed". The namespace
+   * above decides, and logs the `error` when it does.
+   */
+  async executeRequest(request) {
+    const requestId2 = Attributes.getRequestId(request.attributes);
+    const log = requestId2 === null ? this.log : this.log.child({ requestId: requestId2 });
+    const attempt = Attributes.getRetryAttempt(request.attributes) + 1;
+    const startedAt = Date.now();
+    log.debug(() => ({
+      msg: "request sent",
+      fields: describeRequestUnredacted(request)
+    }));
+    try {
+      const response = await makeRequest(request);
+      const elapsed = Date.now() - startedAt;
+      const outcome = () => ({
+        msg: "request completed",
+        fields: {
+          ...identifyRequest(request),
+          "http.response.status_code": response.status,
+          duration_ms: elapsed,
+          attempt
+        }
+      });
+      if (response.status >= 200 && response.status < 300) {
+        log.info(outcome);
+      } else {
+        log.warn(outcome);
+      }
+      log.debug(() => ({
+        msg: "response received",
+        fields: { body: response.body }
+      }));
+      return requestId2 === null ? response : { ...response, requestId: requestId2 };
+    } catch (error) {
+      const elapsed = Date.now() - startedAt;
+      log.warning(
+        () => ({
+          msg: "request threw",
+          fields: {
+            ...identifyRequest(request),
+            duration_ms: elapsed,
+            attempt
+          }
+        }),
+        error
+      );
+      throw error;
+    }
   }
 };
+function identifyRequest(request) {
+  const { host, path } = splitUrl(request.url);
+  return {
+    "http.request.method": request.method,
+    "server.address": host,
+    "url.path": path
+  };
+}
+function splitUrl(url) {
+  try {
+    const parsed = new URL(url);
+    return { host: parsed.host, path: parsed.pathname };
+  } catch (_) {
+    return { host: null, path: url };
+  }
+}
+function defaultMakeRequestId() {
+  return Math.random().toString(36).slice(2, 10).padEnd(8, "0");
+}
+function describeRequestUnredacted(request) {
+  return {
+    "http.request.method": request.method,
+    "url.full": buildUrlWithQueryParams(request.url, request.queryParams),
+    headers: request.headers,
+    ...request.method === "POST" ? { body: request.body } : {}
+  };
+}
 
 // src/shared/api/middleware/attach-session-middleware.ts
 function attachSessionMiddleware(fetchAccessToken) {
@@ -390,18 +672,22 @@ function renewSessionMiddleware(fetchAccessToken) {
 
 // src/shared/api/authenticated-api-client.ts
 var AuthenticatedApiClient = class {
-  constructor(config, fetchAccessToken, additionalBeforeRequest = []) {
-    this.httpClient = new HttpClient(config, {
-      beforeRequest: [
-        attachSessionMiddleware(fetchAccessToken),
-        ...additionalBeforeRequest,
-        idempotencyKeyMiddleware
-      ],
-      afterRequest: [
-        renewSessionMiddleware(fetchAccessToken),
-        requestRetryMiddleware
-      ]
-    });
+  constructor(config, fetchAccessToken, additionalBeforeRequest = [], logger = null) {
+    this.httpClient = new HttpClient(
+      config,
+      {
+        beforeRequest: [
+          attachSessionMiddleware(fetchAccessToken),
+          ...additionalBeforeRequest,
+          idempotencyKeyMiddleware
+        ],
+        afterRequest: [
+          renewSessionMiddleware(fetchAccessToken),
+          requestRetryMiddleware
+        ]
+      },
+      logger
+    );
   }
   async send(request) {
     const response = await this.httpClient.send(request);
@@ -415,8 +701,13 @@ var AuthenticatedApiClient = class {
 
 // src/server/core/api/api-client.ts
 var ApiClient = class {
-  constructor(config, fetchAccessToken) {
-    this.client = new AuthenticatedApiClient(config, fetchAccessToken);
+  constructor(config, fetchAccessToken, logger = null) {
+    this.client = new AuthenticatedApiClient(
+      config,
+      fetchAccessToken,
+      [],
+      logger
+    );
   }
   async send(request) {
     return this.client.send(request);
@@ -448,33 +739,43 @@ var OAuthSession = {
 };
 
 // src/server/core/server-auth-namespace.ts
+function emptySessionStore() {
+  return { getSession: async () => null };
+}
 var ServerAuthNamespaceImpl = class {
   constructor(api, config) {
     this.api = api;
     this.config = config;
+    this.log = internalLogger(config.logger ?? null, "AUTH");
   }
-  async completeOAuth({
-    code,
-    codeVerifier
-  }) {
-    const setSession = this.writableSessionStore();
-    const sessionDto = await this.api.send({
-      method: "POST",
-      url: `/oauth/token`,
-      body: {
-        grant_type: "authorization_code",
-        code,
-        redirect_uri: this.config.redirectUri,
-        client_id: this.config.clientId,
-        client_secret: this.config.clientSecret,
-        code_verifier: codeVerifier
-      }
+  async completeOAuth(params) {
+    return this.log.wrap("completeOAuth", void 0, async () => {
+      const setSession = this.writableSessionStore();
+      const sessionDto = await this.api.send({
+        method: "POST",
+        url: `/oauth/token`,
+        body: {
+          grant_type: "authorization_code",
+          code: params.code,
+          redirect_uri: this.config.redirectUri,
+          client_id: this.config.clientId,
+          client_secret: this.config.clientSecret,
+          code_verifier: params.codeVerifier
+        }
+      });
+      const session = OAuthSession.fromDto(sessionDto);
+      await setSession(session);
+      return session;
     });
-    const session = OAuthSession.fromDto(sessionDto);
-    await setSession(session);
-    return session;
   }
   async getAccessToken() {
+    return this.log.wrap(
+      "getAccessToken",
+      void 0,
+      () => this.readAccessToken()
+    );
+  }
+  async readAccessToken() {
     const sessionStore = this.config.sessionStore;
     const session = await sessionStore.getSession();
     if (session == null) return null;
@@ -486,12 +787,19 @@ var ServerAuthNamespaceImpl = class {
     }
     const setSession = sessionStore.setSession?.bind(sessionStore);
     if (!setSession) {
+      this.log.child({ op: "getAccessToken" }).warn(() => ({
+        msg: "serving an expired token: the session store is read-only, so it cannot be refreshed"
+      }));
       return session.accessToken;
     }
     return this.refreshSession(session.refreshToken, setSession);
   }
   async refreshSession(refreshToken, setSession) {
+    const log = this.log.child({ op: "refresh" });
     if (!refreshToken) {
+      log.warn(() => ({
+        msg: "clearing the session: it carries no refresh token"
+      }));
       await setSession(null);
       return null;
     }
@@ -508,26 +816,36 @@ var ServerAuthNamespaceImpl = class {
       });
       const newSession = OAuthSession.fromDto(sessionDto);
       await setSession(newSession);
+      log.info(() => ({ msg: "session renewed" }));
       return newSession.accessToken;
-    } catch {
+    } catch (error) {
+      log.failure(
+        () => ({ msg: "refresh failed; clearing the session" }),
+        error
+      );
       await setSession(null);
       return null;
     }
   }
   async clientCredentials() {
-    const sessionDto = await this.api.send({
-      method: "POST",
-      url: `/oauth/token`,
-      body: {
-        grant_type: "client_credentials",
-        client_id: this.config.clientId,
-        client_secret: this.config.clientSecret
-      }
+    return this.log.wrap("clientCredentials", void 0, async () => {
+      const sessionDto = await this.api.send({
+        method: "POST",
+        url: `/oauth/token`,
+        body: {
+          grant_type: "client_credentials",
+          client_id: this.config.clientId,
+          client_secret: this.config.clientSecret
+        }
+      });
+      const session = OAuthSession.fromDto(sessionDto);
+      return ClientCredentialsOAuth(session.accessToken);
     });
-    const session = OAuthSession.fromDto(sessionDto);
-    return ClientCredentialsOAuth(session.accessToken);
   }
   async logout() {
+    return this.log.wrap("logout", void 0, () => this.revokeAndClear());
+  }
+  async revokeAndClear() {
     const setSession = this.writableSessionStore();
     const session = await this.config.sessionStore.getSession();
     if (session == null) return;
@@ -545,6 +863,9 @@ var ServerAuthNamespaceImpl = class {
       if (!(err instanceof HttpError) || this.config.strict) {
         throw err;
       }
+      this.log.child({ op: "logout" }).warn(() => ({
+        msg: "the token was not revoked upstream; the local session is cleared regardless"
+      }));
     }
     await setSession(null);
   }
@@ -578,48 +899,6 @@ async function fetchAllPages(fetchPage, baseParams) {
   return items;
 }
 
-// src/shared/types/offer.ts
-var OfferId = (value) => value;
-var OfferSlug = (value) => value;
-var Offer = {
-  fromDto: (dto) => ({
-    id: OfferId(dto.id),
-    slug: OfferSlug(dto.slug),
-    type: dto.type,
-    tagline: dto.tagline,
-    bannerUrl: dto.banner_url,
-    logoUrl: dto.logo_url,
-    startsAt: new Date(dto.starts_at),
-    endsAt: dto.ends_at ? new Date(dto.ends_at) : null
-  })
-};
-
-// src/shared/types/asset.ts
-var AssetId = (value) => value;
-var AssetCode = (value) => value;
-var Asset = {
-  fromDto: (dto) => ({
-    id: AssetId(dto.id),
-    code: AssetCode(dto.code),
-    name: dto.name,
-    fractionalDigits: dto.fractional_digits
-  })
-};
-
-// src/shared/types/errors.ts
-var NotAuthenticatedError = class extends Error {
-  constructor(message = "The user is not authenticated. Go through the OAuth flow first!") {
-    super(message);
-    this.name = "NotAuthenticatedError";
-  }
-};
-var ValidationError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ValidationError";
-  }
-};
-
 // src/shared/types/blockchain/core.ts
 var ETHEREUM_CHAINS = {
   ethereum_mainnet: true,
@@ -660,11 +939,14 @@ var STABLE_DECIMALS = AssetDecimals(6);
 var DecimalString = (value) => value;
 var MAX_UINT_256 = 2n ** 256n - 1n;
 var assertUint256 = (value) => {
-  if (value < 0n || value > MAX_UINT_256) {
-    throw new Error(`Value out of uint256 bounds: ${value}`);
-  }
-  return value;
+  if (isUint256(value)) return value;
+  throw new InvariantError(`Value out of uint256 bounds: ${value}`);
 };
+var parseUint256 = (value, label) => {
+  if (isUint256(value)) return value;
+  throw new ValidationError(`${label}: out of uint256 bounds (${value})`);
+};
+var isUint256 = (value) => value >= 0n && value <= MAX_UINT_256;
 var BlockchainAmount = Object.assign(
   (value) => value,
   {
@@ -674,43 +956,100 @@ var BlockchainAmount = Object.assign(
 );
 function combineAmounts(a, b, op) {
   if (a.decimals !== b.decimals) {
-    throw new Error(
+    throw new InvariantError(
       `Cannot combine BlockchainAmounts with different decimals: ${a.decimals} vs ${b.decimals}`
     );
   }
   const raw = op(a.raw, b.raw);
   if (raw < 0n || raw > MAX_UINT_256) {
-    throw new Error(`BlockchainAmount out of uint256 bounds: ${raw}`);
+    throw new InvariantError(`BlockchainAmount out of uint256 bounds: ${raw}`);
   }
   return BlockchainAmount({ raw, decimals: a.decimals });
 }
 var AssetSymbol = (value) => value;
 
+// src/shared/types/offer.ts
+var OfferId = (value) => value;
+var OfferSlug = (value) => value;
+var Offer = {
+  fromDto: (dto) => {
+    if (!Array.isArray(dto.tokens)) {
+      throw new ValidationError(
+        `Offer.tokens: expected an array, got ${typeof dto.tokens}`
+      );
+    }
+    return {
+      id: OfferId(dto.id),
+      slug: OfferSlug(dto.slug),
+      type: dto.type,
+      tagline: dto.tagline,
+      bannerUrl: dto.banner_url,
+      logoUrl: dto.logo_url,
+      startsAt: new Date(dto.starts_at),
+      endsAt: dto.ends_at ? new Date(dto.ends_at) : null,
+      tokens: dto.tokens.map(OfferToken.fromDto)
+    };
+  }
+};
+var OfferToken = {
+  fromDto: (dto) => ({
+    role: dto.role,
+    chain: Chain(dto.chain),
+    address: EvmContractAddress(dto.address)
+  })
+};
+
+// src/shared/types/asset.ts
+var AssetId = (value) => value;
+var AssetCode = (value) => value;
+var Asset = {
+  fromDto: (dto) => ({
+    id: AssetId(dto.id),
+    code: AssetCode(dto.code),
+    name: dto.name,
+    fractionalDigits: dto.fractional_digits
+  })
+};
+
 // src/shared/types/offer-detail.ts
 var OfferOptionId = (value) => value;
 var OfferOptionSlug = (value) => value;
 var OfferDetail = {
   fromDto: (dto) => {
     if (!Array.isArray(dto.funding_assets)) {
-      throw new Error(`funding_assets must be an array`);
+      throw new ValidationError(
+        `OfferDetail.funding_assets: expected an array, got ${typeof dto.funding_assets}`
+      );
     }
     if (!Array.isArray(dto.options)) {
-      throw new Error(`options must be an array`);
+      throw new ValidationError(
+        `OfferDetail.options: expected an array, got ${typeof dto.options}`
+      );
     }
     if (!Array.isArray(dto.terms)) {
-      throw new Error(`terms must be an array`);
+      throw new ValidationError(
+        `OfferDetail.terms: expected an array, got ${typeof dto.terms}`
+      );
     }
     if (!Array.isArray(dto.links)) {
-      throw new Error(`links must be an array`);
+      throw new ValidationError(
+        `OfferDetail.links: expected an array, got ${typeof dto.links}`
+      );
     }
     if (!Array.isArray(dto.faqs)) {
-      throw new Error(`faqs must be an array`);
+      throw new ValidationError(
+        `OfferDetail.faqs: expected an array, got ${typeof dto.faqs}`
+      );
     }
     if (!Array.isArray(dto.milestones)) {
-      throw new Error(`milestones must be an array`);
+      throw new ValidationError(
+        `OfferDetail.milestones: expected an array, got ${typeof dto.milestones}`
+      );
     }
     if (!Array.isArray(dto.tokens)) {
-      throw new Error(`tokens must be an array`);
+      throw new ValidationError(
+        `OfferDetail.tokens: expected an array, got ${typeof dto.tokens}`
+      );
     }
     return {
       id: OfferId(dto.id),
@@ -772,13 +1111,6 @@ var Milestone = {
     status: dto.status
   })
 };
-var OfferToken = {
-  fromDto: (dto) => ({
-    role: dto.role,
-    chain: Chain(dto.chain),
-    address: EvmContractAddress(dto.address)
-  })
-};
 
 // src/shared/types/pagination.ts
 var Cursor = (value) => value;
@@ -838,18 +1170,25 @@ async function fetchOfferDetails(api, id, clientCreds) {
 var ServerOffersNamespaceImpl = class {
   constructor(ctx) {
     this.ctx = ctx;
+    this.log = internalLogger(ctx.logger, "OFFERS");
   }
   async list(clientCreds) {
-    await this.ctx.ensureAuthenticated(clientCreds);
-    return fetchOffers(this.ctx.api, clientCreds);
+    return this.log.wrap("list", clientCreds, async () => {
+      await this.ctx.ensureAuthenticated(clientCreds);
+      return fetchOffers(this.ctx.api, clientCreds);
+    });
   }
   async listPage(params, clientCreds) {
-    await this.ctx.ensureAuthenticated(clientCreds);
-    return fetchOffersPage(this.ctx.api, params, clientCreds);
+    return this.log.wrap("listPage", { params, clientCreds }, async () => {
+      await this.ctx.ensureAuthenticated(clientCreds);
+      return fetchOffersPage(this.ctx.api, params, clientCreds);
+    });
   }
   async get(id, clientCreds) {
-    await this.ctx.ensureAuthenticated(clientCreds);
-    return fetchOfferDetails(this.ctx.api, id, clientCreds);
+    return this.log.wrap("get", { id, clientCreds }, async () => {
+      await this.ctx.ensureAuthenticated(clientCreds);
+      return fetchOfferDetails(this.ctx.api, id, clientCreds);
+    });
   }
 };
 
@@ -982,38 +1321,49 @@ async function fetchPii(api) {
 var RequirementsNamespaceImpl = class {
   constructor(ctx) {
     this.ctx = ctx;
+    this.log = internalLogger(ctx.logger, "REQUIREMENTS");
   }
   async forOffer(offerId) {
-    await this.ctx.ensureUserAuthenticated();
-    return fetchOfferRequirements(
-      this.ctx.api,
-      offerId,
-      void 0
-    );
+    return this.log.wrap("forOffer", offerId, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return fetchOfferRequirements(
+        this.ctx.api,
+        offerId,
+        void 0
+      );
+    });
   }
   async statuses(offerId) {
-    await this.ctx.ensureUserAuthenticated();
-    return fetchRequirementStatuses(this.ctx.api, offerId);
+    return this.log.wrap("statuses", offerId, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return fetchRequirementStatuses(this.ctx.api, offerId);
+    });
   }
   async createKycToken(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return createKycToken(
-      this.ctx.api,
-      params?.levelName,
-      params?.reset
-    );
+    return this.log.wrap("createKycToken", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return createKycToken(
+        this.ctx.api,
+        params?.levelName,
+        params?.reset
+      );
+    });
   }
   async getPii() {
-    await this.ctx.ensureUserAuthenticated();
-    return fetchPii(this.ctx.api);
+    return this.log.wrap("getPii", void 0, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return fetchPii(this.ctx.api);
+    });
   }
   async submitDocument(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return submitDocument(
-      this.ctx.api,
-      params.documentType,
-      params.fields
-    );
+    return this.log.wrap("submitDocument", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return submitDocument(
+        this.ctx.api,
+        params.documentType,
+        params.fields
+      );
+    });
   }
 };
 
@@ -1024,12 +1374,14 @@ var ServerRequirementsNamespaceImpl = class extends RequirementsNamespaceImpl {
     this.serverCtx = serverCtx;
   }
   async forOffer(offerId, clientCreds) {
-    await this.serverCtx.ensureAuthenticated(clientCreds);
-    return fetchOfferRequirements(
-      this.serverCtx.api,
-      offerId,
-      clientCreds
-    );
+    return this.log.wrap("forOffer", { offerId, clientCreds }, async () => {
+      await this.serverCtx.ensureAuthenticated(clientCreds);
+      return fetchOfferRequirements(
+        this.serverCtx.api,
+        offerId,
+        clientCreds
+      );
+    });
   }
 };
 
@@ -1044,25 +1396,31 @@ var SwapAuthorization = {
 };
 var SwapPreview = {
   fromDto: (dto) => ({
-    inputAmount: assertUint256(BigInt(dto.pay_input_amount)),
-    fee: assertUint256(BigInt(dto.fee)),
-    outputAmount: assertUint256(BigInt(dto.receive_output_amount))
+    inputAmount: parseUint256(
+      BigInt(dto.pay_input_amount),
+      "SwapPreview.pay_input_amount"
+    ),
+    fee: parseUint256(BigInt(dto.fee), "SwapPreview.fee"),
+    outputAmount: parseUint256(
+      BigInt(dto.receive_output_amount),
+      "SwapPreview.receive_output_amount"
+    )
   })
 };
 var SwapStatus = {
   fromDto: (dto) => ({
-    stopped: assertUint256(BigInt(dto.stopped)),
-    swapLevel: assertUint256(BigInt(dto.swap_level))
+    stopped: parseUint256(BigInt(dto.stopped), "SwapStatus.stopped"),
+    swapLevel: parseUint256(BigInt(dto.swap_level), "SwapStatus.swap_level")
   })
 };
 var TokenAllowance = {
   fromDto: (dto) => ({
-    allowance: assertUint256(BigInt(dto.allowance))
+    allowance: parseUint256(BigInt(dto.allowance), "TokenAllowance.allowance")
   })
 };
 var TokenBalance = {
   fromDto: (dto) => ({
-    balance: assertUint256(BigInt(dto.balance))
+    balance: parseUint256(BigInt(dto.balance), "TokenBalance.balance")
   })
 };
 var AllowWalletResponse = {
@@ -1191,14 +1549,19 @@ function toErc20Asset(dto) {
 var Erc20NamespaceImpl = class {
   constructor(ctx) {
     this.ctx = ctx;
+    this.log = internalLogger(ctx.logger, "ERC20");
   }
   async getAllowance(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getTokenAllowance(this.ctx.api, params);
+    return this.log.wrap("getAllowance", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getTokenAllowance(this.ctx.api, params);
+    });
   }
   async getBalance(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getTokenBalance(this.ctx.api, params);
+    return this.log.wrap("getBalance", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getTokenBalance(this.ctx.api, params);
+    });
   }
 };
 
@@ -1287,22 +1650,31 @@ async function createParticipation(api, params) {
 var CoinListTokenSaleNamespaceImpl = class {
   constructor(ctx) {
     this.ctx = ctx;
+    this.log = internalLogger(ctx.logger, "TOKEN_SALE");
   }
   async list(offerId) {
-    await this.ctx.ensureUserAuthenticated();
-    return fetchParticipations(this.ctx.api, offerId);
+    return this.log.wrap("list", offerId, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return fetchParticipations(this.ctx.api, offerId);
+    });
   }
   async listPage(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return fetchParticipationsPage(this.ctx.api, params);
+    return this.log.wrap("listPage", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return fetchParticipationsPage(this.ctx.api, params);
+    });
   }
   async get(id) {
-    await this.ctx.ensureUserAuthenticated();
-    return fetchParticipation(this.ctx.api, id);
+    return this.log.wrap("get", id, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return fetchParticipation(this.ctx.api, id);
+    });
   }
   async createParticipation(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return createParticipation(this.ctx.api, params);
+    return this.log.wrap("createParticipation", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return createParticipation(this.ctx.api, params);
+    });
   }
 };
 
@@ -1520,18 +1892,25 @@ function sizeParam(params) {
 var OndoNamespaceImpl = class {
   constructor(ctx) {
     this.ctx = ctx;
+    this.log = internalLogger(ctx.logger, "ONDO");
   }
   async getTradingStatus(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getOndoTradingStatus(this.ctx.api, params);
+    return this.log.wrap("getTradingStatus", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getOndoTradingStatus(this.ctx.api, params);
+    });
   }
   async getQuote(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getOndoQuote(this.ctx.api, params);
+    return this.log.wrap("getQuote", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getOndoQuote(this.ctx.api, params);
+    });
   }
   async buildSwapTransaction(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return buildOndoSwapTransaction(this.ctx.api, params);
+    return this.log.wrap("buildSwapTransaction", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return buildOndoSwapTransaction(this.ctx.api, params);
+    });
   }
 };
 
@@ -1539,26 +1918,37 @@ var OndoNamespaceImpl = class {
 var SuperstateSwapNamespaceImpl = class {
   constructor(ctx) {
     this.ctx = ctx;
+    this.log = internalLogger(ctx.logger, "SUPERSTATE");
   }
   async getAuthorization(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getSwapAuthorization(this.ctx.api, params);
+    return this.log.wrap("getAuthorization", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getSwapAuthorization(this.ctx.api, params);
+    });
   }
   async getPreview(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getSwapPreview(this.ctx.api, params);
+    return this.log.wrap("getPreview", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getSwapPreview(this.ctx.api, params);
+    });
   }
   async getStatus(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getSwapStatus(this.ctx.api, params);
+    return this.log.wrap("getStatus", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getSwapStatus(this.ctx.api, params);
+    });
   }
   async getOutputToken(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return getSwapOutputToken(this.ctx.api, params);
+    return this.log.wrap("getOutputToken", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return getSwapOutputToken(this.ctx.api, params);
+    });
   }
   async allowWallet(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return allowWallet(this.ctx.api, params);
+    return this.log.wrap("allowWallet", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return allowWallet(this.ctx.api, params);
+    });
   }
 };
 
@@ -1629,8 +2019,8 @@ var resolveLogoUrl = (url, baseUrl) => TokenLogoUrl(
 );
 
 // src/shared/api/nabu/tokens.ts
-function createNabuApiClient(baseUrl) {
-  return new HttpClient({ baseUrl });
+function createNabuApiClient(baseUrl, logger = null) {
+  return new HttpClient({ baseUrl }, {}, logger);
 }
 async function fetchTokenMetadata(client, token) {
   const address = checksummed(token.address);
@@ -1703,14 +2093,23 @@ var TokensNamespaceImpl = class {
    * registry is unauthenticated and on its own host, so the frontline sender
    * and the auth check would both be dead weight here.
    */
-  constructor(baseUrl) {
-    this.api = createNabuApiClient(baseUrl);
+  constructor(baseUrl, logger = null) {
+    this.api = createNabuApiClient(baseUrl, logger);
+    this.log = internalLogger(logger, "TOKENS");
   }
   get(token) {
-    return fetchTokenMetadata(this.api, token);
+    return this.log.wrap(
+      "get",
+      token,
+      () => fetchTokenMetadata(this.api, token)
+    );
   }
   list(chain) {
-    return fetchTokensMetadata(this.api, chain);
+    return this.log.wrap(
+      "list",
+      chain,
+      () => fetchTokensMetadata(this.api, chain)
+    );
   }
 };
 
@@ -1816,33 +2215,42 @@ async function removeOptionAddress(api, offerId, addressId) {
 var WalletsNamespaceImpl = class {
   constructor(ctx) {
     this.ctx = ctx;
+    this.log = internalLogger(ctx.logger, "WALLETS");
   }
   async createOwnershipChallenge(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return createWalletOwnershipChallenge(
-      this.ctx.api,
-      params
-    );
+    return this.log.wrap("createOwnershipChallenge", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return createWalletOwnershipChallenge(
+        this.ctx.api,
+        params
+      );
+    });
   }
   async connectExternal(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return connectExternalWallet(this.ctx.api, params);
+    return this.log.wrap("connectExternal", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return connectExternalWallet(this.ctx.api, params);
+    });
   }
   async list(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return listOptionAddresses(
-      this.ctx.api,
-      params.offerId,
-      params.offerOptionId
-    );
+    return this.log.wrap("list", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return listOptionAddresses(
+        this.ctx.api,
+        params.offerId,
+        params.offerOptionId
+      );
+    });
   }
   async remove(params) {
-    await this.ctx.ensureUserAuthenticated();
-    return removeOptionAddress(
-      this.ctx.api,
-      params.offerId,
-      params.addressId
-    );
+    return this.log.wrap("remove", params, async () => {
+      await this.ctx.ensureUserAuthenticated();
+      return removeOptionAddress(
+        this.ctx.api,
+        params.offerId,
+        params.addressId
+      );
+    });
   }
 };
 
@@ -1851,6 +2259,7 @@ var ACCESS_TOKEN_EXPIRY_BUFFER_SECONDS = 60;
 var CoinListServerImpl = class {
   constructor(_config) {
     this._config = _config;
+    const logger = _config.logger ?? null;
     this.api = new ApiClient(
       {
         baseUrl: _config.baseUrl ?? PUBLIC_API_BASE_URL,
@@ -1860,7 +2269,8 @@ var CoinListServerImpl = class {
       // fresh token. A read-only store cannot persist a new session, so return
       // null immediately — this tells the middleware to skip the retry rather
       // than re-sending with the same expired token and wasting a round-trip.
-      (refresh) => refresh && !this._config.sessionStore.setSession ? Promise.resolve(null) : this.auth.getAccessToken()
+      (refresh) => refresh && !this._config.sessionStore.setSession ? Promise.resolve(null) : this.auth.getAccessToken(),
+      logger
     );
     this.auth = new ServerAuthNamespaceImpl(this.api, {
       ..._config,
@@ -1869,6 +2279,7 @@ var CoinListServerImpl = class {
     });
     const ctx = {
       api: this.api,
+      logger,
       ensureUserAuthenticated: () => this.ensureAuthenticated(void 0),
       ensureAuthenticated: (clientCreds) => this.ensureAuthenticated(clientCreds)
     };
@@ -1880,7 +2291,8 @@ var CoinListServerImpl = class {
     this.superstate = new SuperstateSwapNamespaceImpl(ctx);
     this.ondo = new OndoNamespaceImpl(ctx);
     this.tokens = new TokensNamespaceImpl(
-      _config.tokensBaseUrl ?? NABU_BASE_URL
+      _config.tokensBaseUrl ?? NABU_BASE_URL,
+      logger
     );
   }
   /**
@@ -1898,12 +2310,157 @@ var CoinListServerImpl = class {
 function createCoinListServer(config) {
   return new CoinListServerImpl(config);
 }
+
+// src/server/core/observability/pino-server-logger.ts
+var import_pino = require("pino");
+
+// src/shared/core/observability/pino-logger.ts
+function toPinoRecord(event) {
+  try {
+    const record = {};
+    for (const key of ownKeys(event.fields)) {
+      record[key] = readProperty(event.fields, key, 0, /* @__PURE__ */ new WeakSet());
+    }
+    const cause = "cause" in event ? event.cause : void 0;
+    if (cause !== void 0) {
+      record.cause = sanitize(cause, 0, /* @__PURE__ */ new WeakSet());
+    }
+    return { ...record, scope: event.scope, ...event.bindings };
+  } catch (_) {
+    return { "log.render": "<unrenderable event>" };
+  }
+}
+var PINO_LEVEL = {
+  none: "silent",
+  error: "error",
+  warn: "warn",
+  info: "info",
+  debug: "debug"
+};
+var MAX_DEPTH = 8;
+function sanitize(value, depth, seen) {
+  switch (typeof value) {
+    case "string":
+    case "boolean":
+      return value;
+    case "number":
+      return Number.isFinite(value) ? value : String(value);
+    case "bigint":
+      return value.toString();
+    case "undefined":
+      return "<undefined>";
+    case "function":
+      return "<function>";
+    case "symbol":
+      return value.toString();
+    case "object":
+      return value === null ? null : sanitizeObject(value, depth, seen);
+    default:
+      return "<unrenderable>";
+  }
+}
+function sanitizeObject(value, depth, seen) {
+  if (seen.has(value)) return "<circular>";
+  if (depth >= MAX_DEPTH) return "<max depth>";
+  if (value instanceof Error) return describeError(value);
+  if (value instanceof Date) return describeDate(value);
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) {
+      return value.map(
+        (_item, index) => readProperty(value, String(index), depth, seen)
+      );
+    }
+    const out = {};
+    for (const key of ownKeys(value)) {
+      out[key] = readProperty(value, key, depth, seen);
+    }
+    return out;
+  } finally {
+    seen.delete(value);
+  }
+}
+function readProperty(owner, key, depth, seen) {
+  try {
+    return sanitize(owner[key], depth + 1, seen);
+  } catch (_) {
+    return "<unreadable>";
+  }
+}
+function ownKeys(value) {
+  try {
+    return Object.keys(value);
+  } catch (_) {
+    return [];
+  }
+}
+function describeError(error) {
+  return {
+    name: safeRead(() => error.name),
+    message: safeRead(() => error.message),
+    stack: safeRead(() => error.stack)
+  };
+}
+function describeDate(date) {
+  return safeRead(() => date.toISOString());
+}
+function safeRead(read) {
+  try {
+    const value = read();
+    return typeof value === "string" ? value : "<unreadable>";
+  } catch (_) {
+    return "<unreadable>";
+  }
+}
+var SDK_LOGGER_NAME = "@coinlist-co/react";
+function loggerOverPino(sink, level) {
+  return {
+    level: () => level,
+    debug: (event) => emit(sink, "debug", event),
+    info: (event) => emit(sink, "info", event),
+    warn: (event) => emit(sink, "warn", event),
+    error: (event) => emit(sink, "error", event)
+  };
+}
+function emit(sink, method, event) {
+  try {
+    const value = event();
+    sink[method](toPinoRecord(value), value.msg);
+  } catch (error) {
+    reportRenderFailure(sink, error);
+  }
+}
+function reportRenderFailure(sink, error) {
+  try {
+    sink.error(
+      { "error.type": error instanceof Error ? error.name : typeof error },
+      "log event failed to render"
+    );
+  } catch (_) {
+  }
+}
+
+// src/server/core/observability/pino-server-logger.ts
+function pinoServerLogger(options) {
+  return loggerOverPino(
+    // `name` as a child binding rather than pino's `name` option: the option
+    // is honoured by pino's node build and silently dropped by its browser
+    // build, so a binding is the only spelling that identifies the SDK in
+    // both environments.
+    (0, import_pino.pino)({
+      level: PINO_LEVEL[options.level]
+    }).child({ name: SDK_LOGGER_NAME }),
+    options.level
+  );
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ServerAuthNamespaceImpl,
   ServerOffersNamespaceImpl,
   ServerRequirementsNamespaceImpl,
   WritableSessionStoreRequiredError,
-  createCoinListServer
+  createCoinListServer,
+  emptySessionStore,
+  pinoServerLogger
 });
 //# sourceMappingURL=index.cjs.map