@coinlist-co/react 0.11.0 → 0.11.1-rc.8cfcd2a

package/dist/server/index.d.cts

@@ -1,4 +1,4 @@
-import { A as AuthorizationCode, C as CodeVerifier, a1 as OAuthSession, r as OAuthAccessToken, a2 as ClientCredentialsOAuth, q as Config, a3 as ClientSecret, a4 as Sender, s as OffersNamespace, y as Offer, a5 as PaginationParams, a6 as PaginatedResponse, O as OfferId, v as OfferDetail, R as RequirementsNamespace, e as OfferOptionId, o as Requirement, p as RequirementsNamespaceImpl, S as SharedNamespaceContext, W as WalletsNamespace, b as Erc20Namespace, d as CoinListTokenSaleNamespace, l as SuperstateSwapNamespace, h as OndoNamespace, t as TokensNamespace } from '../config-B5mwS_2l.cjs';
+import { A as AuthorizationCode, C as CodeVerifier, ah as OAuthSession, s as OAuthAccessToken, ai as ClientCredentialsOAuth, r as Config, aj as ClientSecret, ak as Sender, L as Logger, t as OffersNamespace, y as Offer, al as PaginationParams, am as PaginatedResponse, O as OfferId, v as OfferDetail, R as RequirementsNamespace, d as OfferOptionId, p as Requirement, q as RequirementsNamespaceImpl, S as SharedNamespaceContext, l as WalletsNamespace, E as Erc20Namespace, c as CoinListTokenSaleNamespace, k as SuperstateSwapNamespace, g as OndoNamespace, T as TokensNamespace, M as PinoLoggerOptions } from '../config-C6vlghJY.cjs';
 import 'viem';
 
 interface SessionStore {
@@ -24,6 +24,18 @@ interface SessionStore {
      */
     setSession?(session: OAuthSession | null): Promise<void>;
 }
+/**
+ * The empty session store: holds no session, reads nothing, never writes.
+ *
+ * For server contexts that act without a user — the client-credentials grant
+ * (`auth.clientCredentials`) and the public token registry (`tokens`) read
+ * nothing from the store, so hosts building those paths need no store of
+ * their own.
+ *
+ * `setSession` is deliberately absent, not a no-op — see
+ * {@link SessionStore.setSession} for why a no-op is a bug.
+ */
+declare function emptySessionStore(): SessionStore;
 /** The PKCE pair `CoinListClient#auth.completeOAuth` hands to the backend. */
 interface CompleteOAuthParams {
     /** The short-lived authorization code parsed out of the redirect URL. */
@@ -101,12 +113,15 @@ type ServerAuthConfig = Config & {
 declare class ServerAuthNamespaceImpl implements ServerAuthNamespace {
     private readonly api;
     private readonly config;
+    private readonly log;
     constructor(api: Sender, config: ServerAuthConfig);
-    completeOAuth({ code, codeVerifier, }: CompleteOAuthParams): Promise<OAuthSession>;
+    completeOAuth(params: CompleteOAuthParams): Promise<OAuthSession>;
     getAccessToken(): Promise<OAuthAccessToken | null>;
+    private readAccessToken;
     private refreshSession;
     clientCredentials(): Promise<ClientCredentialsOAuth>;
     logout(): Promise<void>;
+    private revokeAndClear;
     /**
      * Returns the store's `setSession`, or throws — the guard every
      * session-writing operation shares.
@@ -121,6 +136,8 @@ declare class ServerAuthNamespaceImpl implements ServerAuthNamespace {
  */
 interface ServerNamespaceContext {
     readonly api: Sender;
+    /** As {@link SharedNamespaceContext.logger}: the raw port, scoped per namespace. */
+    readonly logger: Logger | null;
     /**
      * Requires a user session, unless `clientCreds` is supplied — an app-level
      * token authenticates the request on its own. Throws
@@ -147,6 +164,7 @@ interface ServerOffersNamespace extends OffersNamespace {
 }
 declare class ServerOffersNamespaceImpl implements ServerOffersNamespace {
     private readonly ctx;
+    private readonly log;
     constructor(ctx: ServerNamespaceContext);
     list(clientCreds?: ClientCredentialsOAuth): Promise<Offer[]>;
     listPage(params: PaginationParams, clientCreds?: ClientCredentialsOAuth): Promise<PaginatedResponse<Offer>>;
@@ -270,8 +288,67 @@ interface CoinListServer {
 }
 declare function createCoinListServer(config: ServerConfig): CoinListServer;
 
+/**
+ * A {@link Logger} that writes newline-delimited JSON to stdout through pino.
+ *
+ * ```ts
+ * createCoinListServer({
+ *   ...config,
+ *   logger: pinoServerLogger({ isDev: false, level: 'info' }),
+ * });
+ * ```
+ *
+ * The Node counterpart of {@link pinoClientLogger}, for a route handler, a BFF
+ * or SSR. One line per record, which is what every log aggregator ingests
+ * without configuration.
+ *
+ * ## What it deliberately does not do
+ *
+ * **No transport, and no `pino-pretty`.** A pino transport runs on a worker
+ * thread through `thread-stream`, which every bundler has to be told about
+ * (`serverExternalPackages` in Next) and which edge runtimes cannot run at
+ * all. Pretty-printing is a pipe the host owns rather than a dependency the
+ * SDK takes on their behalf:
+ *
+ * ```sh
+ * node server.js | npx pino-pretty
+ * ```
+ *
+ * **No environment-dependent formatting.** `isDev` decides which levels are
+ * legal and nothing else, so a development record and a production record are
+ * the same shape - what you debug is what you ship.
+ *
+ * If you already run pino, or want transports, redaction or `destination`,
+ * implement {@link Logger} yourself: it is four methods over an event, and
+ * `@opentelemetry/instrumentation-pino` patches the pino module rather than an
+ * instance, so trace correlation reaches this logger either way.
+ *
+ * ## Production
+ *
+ * **Not advised in production**, the same as everywhere else this seam is
+ * documented: the SDK's default answer is to leave {@link Config.logger}
+ * undefined outside development, staging and incident reproduction. A backend
+ * is the least bad place to disregard that - the records go to your process
+ * and your sink rather than to a page the end user can read - but it is still
+ * a disregard, and the retention and access questions become yours.
+ *
+ * If you run one, `isDev: false` restricts you to `'error'`, `'warn'` and
+ * `'info'` - `{ isDev: false, level: 'debug' }` does not compile, see
+ * {@link PinoLoggerOptions}. Those levels are redacted by construction, which
+ * is a mechanism the SDK holds itself to; whether that clears your bar is a
+ * judgement the SDK is not in a position to make for you.
+ *
+ * Holds no module-level state: every call builds its own pino instance, and
+ * the level is fixed at construction, so two loggers never interfere. Fixed is
+ * this implementation's choice, not the seam's - the SDK re-reads
+ * {@link Logger.level} before every log call - so if you want a level you can
+ * change at runtime, implement {@link Logger} over your own pino instance
+ * rather than calling this.
+ */
+declare function pinoServerLogger(options: PinoLoggerOptions): Logger;
+
 declare class WritableSessionStoreRequiredError extends Error {
     constructor(message?: string);
 }
 
-export { type CoinListServer, type CompleteOAuthParams, type ServerAuthConfig, type ServerAuthNamespace, ServerAuthNamespaceImpl, type ServerConfig, type ServerNamespaceContext, type ServerOffersNamespace, ServerOffersNamespaceImpl, type ServerRequirementsNamespace, ServerRequirementsNamespaceImpl, type SessionStore, WritableSessionStoreRequiredError, createCoinListServer };
+export { type CoinListServer, type CompleteOAuthParams, type ServerAuthConfig, type ServerAuthNamespace, ServerAuthNamespaceImpl, type ServerConfig, type ServerNamespaceContext, type ServerOffersNamespace, ServerOffersNamespaceImpl, type ServerRequirementsNamespace, ServerRequirementsNamespaceImpl, type SessionStore, WritableSessionStoreRequiredError, createCoinListServer, emptySessionStore, pinoServerLogger };

package/dist/server/index.d.ts

@@ -1,4 +1,4 @@
-import { A as AuthorizationCode, C as CodeVerifier, a1 as OAuthSession, r as OAuthAccessToken, a2 as ClientCredentialsOAuth, q as Config, a3 as ClientSecret, a4 as Sender, s as OffersNamespace, y as Offer, a5 as PaginationParams, a6 as PaginatedResponse, O as OfferId, v as OfferDetail, R as RequirementsNamespace, e as OfferOptionId, o as Requirement, p as RequirementsNamespaceImpl, S as SharedNamespaceContext, W as WalletsNamespace, b as Erc20Namespace, d as CoinListTokenSaleNamespace, l as SuperstateSwapNamespace, h as OndoNamespace, t as TokensNamespace } from '../config-B5mwS_2l.js';
+import { A as AuthorizationCode, C as CodeVerifier, ah as OAuthSession, s as OAuthAccessToken, ai as ClientCredentialsOAuth, r as Config, aj as ClientSecret, ak as Sender, L as Logger, t as OffersNamespace, y as Offer, al as PaginationParams, am as PaginatedResponse, O as OfferId, v as OfferDetail, R as RequirementsNamespace, d as OfferOptionId, p as Requirement, q as RequirementsNamespaceImpl, S as SharedNamespaceContext, l as WalletsNamespace, E as Erc20Namespace, c as CoinListTokenSaleNamespace, k as SuperstateSwapNamespace, g as OndoNamespace, T as TokensNamespace, M as PinoLoggerOptions } from '../config-C6vlghJY.js';
 import 'viem';
 
 interface SessionStore {
@@ -24,6 +24,18 @@ interface SessionStore {
      */
     setSession?(session: OAuthSession | null): Promise<void>;
 }
+/**
+ * The empty session store: holds no session, reads nothing, never writes.
+ *
+ * For server contexts that act without a user — the client-credentials grant
+ * (`auth.clientCredentials`) and the public token registry (`tokens`) read
+ * nothing from the store, so hosts building those paths need no store of
+ * their own.
+ *
+ * `setSession` is deliberately absent, not a no-op — see
+ * {@link SessionStore.setSession} for why a no-op is a bug.
+ */
+declare function emptySessionStore(): SessionStore;
 /** The PKCE pair `CoinListClient#auth.completeOAuth` hands to the backend. */
 interface CompleteOAuthParams {
     /** The short-lived authorization code parsed out of the redirect URL. */
@@ -101,12 +113,15 @@ type ServerAuthConfig = Config & {
 declare class ServerAuthNamespaceImpl implements ServerAuthNamespace {
     private readonly api;
     private readonly config;
+    private readonly log;
     constructor(api: Sender, config: ServerAuthConfig);
-    completeOAuth({ code, codeVerifier, }: CompleteOAuthParams): Promise<OAuthSession>;
+    completeOAuth(params: CompleteOAuthParams): Promise<OAuthSession>;
     getAccessToken(): Promise<OAuthAccessToken | null>;
+    private readAccessToken;
     private refreshSession;
     clientCredentials(): Promise<ClientCredentialsOAuth>;
     logout(): Promise<void>;
+    private revokeAndClear;
     /**
      * Returns the store's `setSession`, or throws — the guard every
      * session-writing operation shares.
@@ -121,6 +136,8 @@ declare class ServerAuthNamespaceImpl implements ServerAuthNamespace {
  */
 interface ServerNamespaceContext {
     readonly api: Sender;
+    /** As {@link SharedNamespaceContext.logger}: the raw port, scoped per namespace. */
+    readonly logger: Logger | null;
     /**
      * Requires a user session, unless `clientCreds` is supplied — an app-level
      * token authenticates the request on its own. Throws
@@ -147,6 +164,7 @@ interface ServerOffersNamespace extends OffersNamespace {
 }
 declare class ServerOffersNamespaceImpl implements ServerOffersNamespace {
     private readonly ctx;
+    private readonly log;
     constructor(ctx: ServerNamespaceContext);
     list(clientCreds?: ClientCredentialsOAuth): Promise<Offer[]>;
     listPage(params: PaginationParams, clientCreds?: ClientCredentialsOAuth): Promise<PaginatedResponse<Offer>>;
@@ -270,8 +288,67 @@ interface CoinListServer {
 }
 declare function createCoinListServer(config: ServerConfig): CoinListServer;
 
+/**
+ * A {@link Logger} that writes newline-delimited JSON to stdout through pino.
+ *
+ * ```ts
+ * createCoinListServer({
+ *   ...config,
+ *   logger: pinoServerLogger({ isDev: false, level: 'info' }),
+ * });
+ * ```
+ *
+ * The Node counterpart of {@link pinoClientLogger}, for a route handler, a BFF
+ * or SSR. One line per record, which is what every log aggregator ingests
+ * without configuration.
+ *
+ * ## What it deliberately does not do
+ *
+ * **No transport, and no `pino-pretty`.** A pino transport runs on a worker
+ * thread through `thread-stream`, which every bundler has to be told about
+ * (`serverExternalPackages` in Next) and which edge runtimes cannot run at
+ * all. Pretty-printing is a pipe the host owns rather than a dependency the
+ * SDK takes on their behalf:
+ *
+ * ```sh
+ * node server.js | npx pino-pretty
+ * ```
+ *
+ * **No environment-dependent formatting.** `isDev` decides which levels are
+ * legal and nothing else, so a development record and a production record are
+ * the same shape - what you debug is what you ship.
+ *
+ * If you already run pino, or want transports, redaction or `destination`,
+ * implement {@link Logger} yourself: it is four methods over an event, and
+ * `@opentelemetry/instrumentation-pino` patches the pino module rather than an
+ * instance, so trace correlation reaches this logger either way.
+ *
+ * ## Production
+ *
+ * **Not advised in production**, the same as everywhere else this seam is
+ * documented: the SDK's default answer is to leave {@link Config.logger}
+ * undefined outside development, staging and incident reproduction. A backend
+ * is the least bad place to disregard that - the records go to your process
+ * and your sink rather than to a page the end user can read - but it is still
+ * a disregard, and the retention and access questions become yours.
+ *
+ * If you run one, `isDev: false` restricts you to `'error'`, `'warn'` and
+ * `'info'` - `{ isDev: false, level: 'debug' }` does not compile, see
+ * {@link PinoLoggerOptions}. Those levels are redacted by construction, which
+ * is a mechanism the SDK holds itself to; whether that clears your bar is a
+ * judgement the SDK is not in a position to make for you.
+ *
+ * Holds no module-level state: every call builds its own pino instance, and
+ * the level is fixed at construction, so two loggers never interfere. Fixed is
+ * this implementation's choice, not the seam's - the SDK re-reads
+ * {@link Logger.level} before every log call - so if you want a level you can
+ * change at runtime, implement {@link Logger} over your own pino instance
+ * rather than calling this.
+ */
+declare function pinoServerLogger(options: PinoLoggerOptions): Logger;
+
 declare class WritableSessionStoreRequiredError extends Error {
     constructor(message?: string);
 }
 
-export { type CoinListServer, type CompleteOAuthParams, type ServerAuthConfig, type ServerAuthNamespace, ServerAuthNamespaceImpl, type ServerConfig, type ServerNamespaceContext, type ServerOffersNamespace, ServerOffersNamespaceImpl, type ServerRequirementsNamespace, ServerRequirementsNamespaceImpl, type SessionStore, WritableSessionStoreRequiredError, createCoinListServer };
+export { type CoinListServer, type CompleteOAuthParams, type ServerAuthConfig, type ServerAuthNamespace, ServerAuthNamespaceImpl, type ServerConfig, type ServerNamespaceContext, type ServerOffersNamespace, ServerOffersNamespaceImpl, type ServerRequirementsNamespace, ServerRequirementsNamespaceImpl, type SessionStore, WritableSessionStoreRequiredError, createCoinListServer, emptySessionStore, pinoServerLogger };

package/dist/server/index.js

@@ -1,7 +1,10 @@
 import {
   AuthenticatedApiClient,
-  NABU_BASE_URL
-} from "../chunk-KDGNDAHA.js";
+  NABU_BASE_URL,
+  PINO_LEVEL,
+  SDK_LOGGER_NAME,
+  loggerOverPino
+} from "../chunk-AQIHCFW4.js";
 import {
   API_VERSION,
   ClientCredentialsOAuth,
@@ -19,13 +22,19 @@ import {
   fetchOfferDetails,
   fetchOfferRequirements,
   fetchOffers,
-  fetchOffersPage
-} from "../chunk-UIIXXLA7.js";
+  fetchOffersPage,
+  internalLogger
+} from "../chunk-ZVB6KWZ2.js";
 
 // src/server/core/api/api-client.ts
 var ApiClient = class {
-  constructor(config, fetchAccessToken) {
-    this.client = new AuthenticatedApiClient(config, fetchAccessToken);
+  constructor(config, fetchAccessToken, logger = null) {
+    this.client = new AuthenticatedApiClient(
+      config,
+      fetchAccessToken,
+      [],
+      logger
+    );
   }
   async send(request) {
     return this.client.send(request);
@@ -41,33 +50,43 @@ var WritableSessionStoreRequiredError = class extends Error {
 };
 
 // src/server/core/server-auth-namespace.ts
+function emptySessionStore() {
+  return { getSession: async () => null };
+}
 var ServerAuthNamespaceImpl = class {
   constructor(api, config) {
     this.api = api;
     this.config = config;
+    this.log = internalLogger(config.logger ?? null, "AUTH");
   }
-  async completeOAuth({
-    code,
-    codeVerifier
-  }) {
-    const setSession = this.writableSessionStore();
-    const sessionDto = await this.api.send({
-      method: "POST",
-      url: `/oauth/token`,
-      body: {
-        grant_type: "authorization_code",
-        code,
-        redirect_uri: this.config.redirectUri,
-        client_id: this.config.clientId,
-        client_secret: this.config.clientSecret,
-        code_verifier: codeVerifier
-      }
+  async completeOAuth(params) {
+    return this.log.wrap("completeOAuth", void 0, async () => {
+      const setSession = this.writableSessionStore();
+      const sessionDto = await this.api.send({
+        method: "POST",
+        url: `/oauth/token`,
+        body: {
+          grant_type: "authorization_code",
+          code: params.code,
+          redirect_uri: this.config.redirectUri,
+          client_id: this.config.clientId,
+          client_secret: this.config.clientSecret,
+          code_verifier: params.codeVerifier
+        }
+      });
+      const session = OAuthSession.fromDto(sessionDto);
+      await setSession(session);
+      return session;
     });
-    const session = OAuthSession.fromDto(sessionDto);
-    await setSession(session);
-    return session;
   }
   async getAccessToken() {
+    return this.log.wrap(
+      "getAccessToken",
+      void 0,
+      () => this.readAccessToken()
+    );
+  }
+  async readAccessToken() {
     const sessionStore = this.config.sessionStore;
     const session = await sessionStore.getSession();
     if (session == null) return null;
@@ -79,12 +98,19 @@ var ServerAuthNamespaceImpl = class {
     }
     const setSession = sessionStore.setSession?.bind(sessionStore);
     if (!setSession) {
+      this.log.child({ op: "getAccessToken" }).warn(() => ({
+        msg: "serving an expired token: the session store is read-only, so it cannot be refreshed"
+      }));
       return session.accessToken;
     }
     return this.refreshSession(session.refreshToken, setSession);
   }
   async refreshSession(refreshToken, setSession) {
+    const log = this.log.child({ op: "refresh" });
     if (!refreshToken) {
+      log.warn(() => ({
+        msg: "clearing the session: it carries no refresh token"
+      }));
       await setSession(null);
       return null;
     }
@@ -101,26 +127,36 @@ var ServerAuthNamespaceImpl = class {
       });
       const newSession = OAuthSession.fromDto(sessionDto);
       await setSession(newSession);
+      log.info(() => ({ msg: "session renewed" }));
       return newSession.accessToken;
-    } catch {
+    } catch (error) {
+      log.failure(
+        () => ({ msg: "refresh failed; clearing the session" }),
+        error
+      );
       await setSession(null);
       return null;
     }
   }
   async clientCredentials() {
-    const sessionDto = await this.api.send({
-      method: "POST",
-      url: `/oauth/token`,
-      body: {
-        grant_type: "client_credentials",
-        client_id: this.config.clientId,
-        client_secret: this.config.clientSecret
-      }
+    return this.log.wrap("clientCredentials", void 0, async () => {
+      const sessionDto = await this.api.send({
+        method: "POST",
+        url: `/oauth/token`,
+        body: {
+          grant_type: "client_credentials",
+          client_id: this.config.clientId,
+          client_secret: this.config.clientSecret
+        }
+      });
+      const session = OAuthSession.fromDto(sessionDto);
+      return ClientCredentialsOAuth(session.accessToken);
     });
-    const session = OAuthSession.fromDto(sessionDto);
-    return ClientCredentialsOAuth(session.accessToken);
   }
   async logout() {
+    return this.log.wrap("logout", void 0, () => this.revokeAndClear());
+  }
+  async revokeAndClear() {
     const setSession = this.writableSessionStore();
     const session = await this.config.sessionStore.getSession();
     if (session == null) return;
@@ -138,6 +174,9 @@ var ServerAuthNamespaceImpl = class {
       if (!(err instanceof HttpError) || this.config.strict) {
         throw err;
       }
+      this.log.child({ op: "logout" }).warn(() => ({
+        msg: "the token was not revoked upstream; the local session is cleared regardless"
+      }));
     }
     await setSession(null);
   }
@@ -159,18 +198,25 @@ var ServerAuthNamespaceImpl = class {
 var ServerOffersNamespaceImpl = class {
   constructor(ctx) {
     this.ctx = ctx;
+    this.log = internalLogger(ctx.logger, "OFFERS");
   }
   async list(clientCreds) {
-    await this.ctx.ensureAuthenticated(clientCreds);
-    return fetchOffers(this.ctx.api, clientCreds);
+    return this.log.wrap("list", clientCreds, async () => {
+      await this.ctx.ensureAuthenticated(clientCreds);
+      return fetchOffers(this.ctx.api, clientCreds);
+    });
   }
   async listPage(params, clientCreds) {
-    await this.ctx.ensureAuthenticated(clientCreds);
-    return fetchOffersPage(this.ctx.api, params, clientCreds);
+    return this.log.wrap("listPage", { params, clientCreds }, async () => {
+      await this.ctx.ensureAuthenticated(clientCreds);
+      return fetchOffersPage(this.ctx.api, params, clientCreds);
+    });
   }
   async get(id, clientCreds) {
-    await this.ctx.ensureAuthenticated(clientCreds);
-    return fetchOfferDetails(this.ctx.api, id, clientCreds);
+    return this.log.wrap("get", { id, clientCreds }, async () => {
+      await this.ctx.ensureAuthenticated(clientCreds);
+      return fetchOfferDetails(this.ctx.api, id, clientCreds);
+    });
   }
 };
 
@@ -181,12 +227,14 @@ var ServerRequirementsNamespaceImpl = class extends RequirementsNamespaceImpl {
     this.serverCtx = serverCtx;
   }
   async forOffer(offerId, clientCreds) {
-    await this.serverCtx.ensureAuthenticated(clientCreds);
-    return fetchOfferRequirements(
-      this.serverCtx.api,
-      offerId,
-      clientCreds
-    );
+    return this.log.wrap("forOffer", { offerId, clientCreds }, async () => {
+      await this.serverCtx.ensureAuthenticated(clientCreds);
+      return fetchOfferRequirements(
+        this.serverCtx.api,
+        offerId,
+        clientCreds
+      );
+    });
   }
 };
 
@@ -195,6 +243,7 @@ var ACCESS_TOKEN_EXPIRY_BUFFER_SECONDS = 60;
 var CoinListServerImpl = class {
   constructor(_config) {
     this._config = _config;
+    const logger = _config.logger ?? null;
     this.api = new ApiClient(
       {
         baseUrl: _config.baseUrl ?? PUBLIC_API_BASE_URL,
@@ -204,7 +253,8 @@ var CoinListServerImpl = class {
       // fresh token. A read-only store cannot persist a new session, so return
       // null immediately — this tells the middleware to skip the retry rather
       // than re-sending with the same expired token and wasting a round-trip.
-      (refresh) => refresh && !this._config.sessionStore.setSession ? Promise.resolve(null) : this.auth.getAccessToken()
+      (refresh) => refresh && !this._config.sessionStore.setSession ? Promise.resolve(null) : this.auth.getAccessToken(),
+      logger
     );
     this.auth = new ServerAuthNamespaceImpl(this.api, {
       ..._config,
@@ -213,6 +263,7 @@ var CoinListServerImpl = class {
     });
     const ctx = {
       api: this.api,
+      logger,
       ensureUserAuthenticated: () => this.ensureAuthenticated(void 0),
       ensureAuthenticated: (clientCreds) => this.ensureAuthenticated(clientCreds)
     };
@@ -224,7 +275,8 @@ var CoinListServerImpl = class {
     this.superstate = new SuperstateSwapNamespaceImpl(ctx);
     this.ondo = new OndoNamespaceImpl(ctx);
     this.tokens = new TokensNamespaceImpl(
-      _config.tokensBaseUrl ?? NABU_BASE_URL
+      _config.tokensBaseUrl ?? NABU_BASE_URL,
+      logger
     );
   }
   /**
@@ -242,11 +294,28 @@ var CoinListServerImpl = class {
 function createCoinListServer(config) {
   return new CoinListServerImpl(config);
 }
+
+// src/server/core/observability/pino-server-logger.ts
+import { pino } from "pino";
+function pinoServerLogger(options) {
+  return loggerOverPino(
+    // `name` as a child binding rather than pino's `name` option: the option
+    // is honoured by pino's node build and silently dropped by its browser
+    // build, so a binding is the only spelling that identifies the SDK in
+    // both environments.
+    pino({
+      level: PINO_LEVEL[options.level]
+    }).child({ name: SDK_LOGGER_NAME }),
+    options.level
+  );
+}
 export {
   ServerAuthNamespaceImpl,
   ServerOffersNamespaceImpl,
   ServerRequirementsNamespaceImpl,
   WritableSessionStoreRequiredError,
-  createCoinListServer
+  createCoinListServer,
+  emptySessionStore,
+  pinoServerLogger
 };
 //# sourceMappingURL=index.js.map