@coinlist-co/react 0.12.1 → 0.12.2-rc.0ff2d03

package/dist/{tokens-namespace-CIWBtgt2.d.cts → time-BDzqB806.d.ts}

@@ -1,4 +1,4 @@
-import { Hash, Transport, PublicClient, Hex } from 'viem';
+import { Hash, Hex, Transport } from 'viem';
 
 declare const __brand: unique symbol;
 type Newtype<Base, Branding> = Base & {
@@ -78,1623 +78,930 @@ type RedactedWalletError = Exclude<WalletError, {
 }> | {
     type: 'unknown';
 };
-declare const RedactedWalletError: {
-    fromWalletError: (error: WalletError) => RedactedWalletError;
-};
 
 /**
- * The observability seam a host implements to see inside the SDK.
- *
- * Pass an implementation as {@link Config.logger} and the SDK reports every
- * request it makes, every failure it classifies, and every state a hook
- * settles into. Leave it out and the SDK logs nothing at all - there is no
- * fallback to `console`, at any level, on any codepath.
- *
- * Four methods over a {@link LogEvent} lambda, plus {@link level}. An event is
- * a constant `msg`, the {@link LogScope} it came from, the accumulated
- * {@link LogBindings}, and a bag of `fields` - so a host forwards structured
- * records rather than parsing strings.
- *
- * ```ts
- * const logger: Logger = {
- *   level: () => 'info',
- *   debug: () => {},
- *   info: (event) => sink.info(toRecord(event())),
- *   warn: (event) => sink.warn(toRecord(event())),
- *   error: (event) => sink.error(toRecord(event())),
- * };
- * ```
- *
- * {@link pinoClientLogger} and {@link pinoServerLogger} are ready-made
- * implementations over pino, and are what most hosts should reach for.
- *
- * ## Where to run it
- *
- * **Not in production, as the default answer.** Development, tests, staging,
- * and reproducing a reported bug are where this seam earns its keep. Left
- * undefined elsewhere it discloses nothing, and that holds no matter what a
- * later revision of the SDK puts on a line.
- *
- * Where you do run one in production, `'info'` and above is the only sane
- * choice, and the shipped implementations make the alternative unrepresentable
- * rather than merely discouraged: `isDev: false` narrows the level to
- * {@link ProductionLogLevel}, so `'debug'` does not compile. That narrowing is
- * a guard for the partner who ignored this paragraph, not an endorsement of
- * the practice.
- *
- * The distinction worth holding onto: `'info'` and above are **redacted by
- * construction** - see the next section for exactly what that covers, and the
- * type that enforces it. Redacted is a mechanism the SDK can hold itself to. A
- * blanket "safe in production" is a promise about your environment that the
- * SDK is in no position to make, and one that a single future field could
- * quietly break.
- *
- * `'debug'` is for reproducing a bug: a developer's machine, tests, and beta
- * or staging environments where the data flowing through the SDK is not real
- * customer data.
- *
- * ## What each level may disclose
- *
- * **`'debug'` is unredacted. Every other level is not.**
- *
- * At `'debug'` the SDK reports request and response bodies, request headers,
- * the full URL including its query string, and operation parameters
- * **verbatim** - bearer tokens, KYC answers, tax-document fields, wallet
- * signatures, the lot. There is no denylist and no redaction: see ADR-8 for
- * why a partial guarantee was rejected in favour of an honest absence of one.
- *
- * At `'info'`, `'warn'` and `'error'` the SDK emits only its own
- * classification of what happened and identifiers the server minted: a method
- * and a bare path, a status, a duration, a {@link RequestId}, a frontline
- * error code and event id, a {@link LogCause} arm. No request body, no
- * response body, no query string, no host-supplied parameters, and no message
- * text read off a thrown error the SDK did not author.
- *
- * The type carries that boundary rather than merely documenting it:
- * {@link SafeEvent} constrains every field value to a {@link LogValue} scalar,
- * so spreading a body, a DTO or an operation's params into an `info`, `warn`
- * or `error` line does not compile. Only {@link DebugEvent} accepts arbitrary
- * values.
- *
- * The one deliberate exception is an SDK-authored validation message, which
- * quotes the single scalar that failed to map - `Unsupported chain:
- * "solana_mainnet"`. It is a hand-written template naming one offending value,
- * not a payload, and it is the whole reason this seam exists.
- *
- * ## Your responsibility
- *
- * The SDK hands you events. What happens next is yours: **you own the final
- * filtering, redaction and retention** before anything is written to a file, a
- * console, or a third-party sink such as Sentry or Datadog. In particular, if
- * you implement {@link debug} and forward it anywhere durable, you have taken
- * on storing live credentials and personal data, deliberately. Implement
- * `debug` as a no-op - or return a level below it from {@link level} - in any
- * environment where that is not acceptable.
- *
- * **Every event is a lambda, and that is load bearing.** The SDK consults
- * {@link level} first and never invokes the lambda when the level forbids it,
- * so an expensive debug event - a serialized DTO, a loop over balances - costs
- * nothing in production where the level is `'error'` or `'none'`. Build the
- * event inside the lambda, never outside it.
- *
- * ## Every method must be total
- *
- * **None of the five methods may throw, and that includes {@link level}.** The
- * SDK calls them inline, on the codepath of the work it is reporting, and it
- * does not catch them: a `logger.error` that throws while reporting a failed
- * request turns that request's rejection into your logger's exception, and a
- * `level()` that throws breaks the call it was asked about even when nothing
- * else went wrong.
- *
- * That is deliberate. Swallowing would hide a logger that is broken in every
- * environment, and the SDK cannot tell a transport blip in your sink from a
- * bug in your implementation. So the contract is on this side of the seam:
- * catch inside your implementation, and never let an exception out. The
- * shipped pino implementations do exactly that.
- *
- * ```ts
- * error: (event) => {
- *   try {
- *     const e = event();
- *     Sentry.captureMessage(e.msg, { extra: e });
- *   } catch {
- *     // never rethrow: the SDK is on the other side of this call
- *   }
- * },
- * ```
+ * The exhaustive chain set: a new {@link EthereumChain} is a compile error
+ * here until it is listed, which is what keeps the constructor total.
  */
-interface Logger {
-    /**
-     * The most detailed level this logger wants. Consulted before **every** log
-     * call, so keep it cheap and pure: return a captured constant or read a
-     * plain field. Do not read an environment variable, hit storage, or call
-     * out to a feature-flag service here.
-     *
-     * Returning `'none'` silences the SDK as completely as omitting the logger.
-     *
-     * **Must not throw.** It is consulted inside every SDK operation, so an
-     * exception here fails the operation itself.
-     */
-    level(): LogLevel;
-    /**
-     * Fine-grained detail: request and response bodies, full URLs, headers,
-     * operation parameters, hook transitions.
-     *
-     * **Unredacted.** This is the only level that may carry credentials or
-     * personal data, and it always may. Its event is a {@link DebugEvent}, whose
-     * fields accept arbitrary values for exactly that reason. Do not forward it
-     * to a durable or third-party sink outside development and beta.
-     *
-     * **Must not throw**, here and on every method below.
-     */
-    debug(event: () => DebugEvent): void;
-    /** Notable, expected events: a request completing, a flow advancing. */
-    info(event: () => SafeEvent): void;
-    /**
-     * Recoverable trouble: a retried request, a renewed session, a poll tick
-     * that failed while the last value still stands.
-     *
-     * Carries a {@link LogCause} when one was classified, the same as
-     * {@link error} does. What separates the two levels is whether anything
-     * actually broke, not how much is known about it.
-     */
-    warn(event: () => SafeEvent): void;
-    /**
-     * A failure. {@link SafeEvent.cause} carries what the SDK knows about it,
-     * classified into {@link LogCause}, and is absent when the failure is not an
-     * error the SDK caught - a flow reporting the step it stopped at, for
-     * instance.
-     *
-     * Every part of the event is SDK-authored classification or server-authored
-     * identifiers, so forwarding it as it stands is safe. `scope` says which
-     * part of the SDK the line came from, which is what to route or filter on.
-     */
-    error(event: () => SafeEvent): void;
-}
+declare const ETHEREUM_CHAINS: Record<EthereumChain, true>;
+type EthereumChain = 'ethereum_mainnet' | 'ethereum_sepolia' | 'base_mainnet' | 'base_sepolia';
 /**
- * A value the SDK is willing to put in a structured field above `'debug'`.
- *
- * Scalars only, and that is the redaction boundary made structural rather than
- * documentary. Every leak ADR-8 found was an *object* spread onto a line that
- * a host forwards to a tracker - an operation's params, a thrown wallet error,
- * a response body. None of them is assignable to this, so each is now a
- * compile error rather than a review catch.
+ * Validates that a raw backend string names a chain the SDK supports.
  *
- * It does not stop a call site writing `{ token: accessToken }`, and it is not
- * meant to: a string is a string. What it stops is the mistake that actually
- * happened.
+ * @throws ValidationError on anything else. Passing an unknown chain through
+ * would let downstream EIP-155 lookups blow up far from the response that
+ * caused it.
  */
-type LogValue = string | number | boolean | null;
+declare const EthereumChain: (value: string) => EthereumChain;
 /**
- * Fields safe at every level: SDK-authored classification and server-minted
- * identifiers, constrained to {@link LogValue}.
+ * The exhaustive chain set: a new {@link SolanaChain} is a compile error
+ * here until it is listed, which is what keeps the constructor total.
  */
-type SafeFields = Readonly<Record<string, LogValue>>;
+declare const SOLANA_CHAINS: Record<SolanaChain, true>;
+type SolanaChain = 'solana_mainnet' | 'solana_devnet';
 /**
- * Fields for `'debug'` only: bodies, headers, full URLs, operation params,
- * raw thrown values. Arbitrary values, because that is the point of the level.
+ * Validates that a raw backend string names a chain the SDK supports.
  *
- * The SDK's own implementations render these into a form that cannot fail to
- * serialize - a `bigint`, a cycle or a getter that throws must never turn a
- * log line into a second failure - but they are otherwise passed through.
+ * @throws ValidationError on anything else. Passing an unknown chain through
+ * would let downstream EIP-155 lookups blow up far from the response that
+ * caused it.
  */
-type UnredactedFields = Readonly<Record<string, unknown>>;
+declare const SolanaChain: (value: string) => SolanaChain;
 /**
- * One narrowing applied to a logger by {@link InternalLogger.child}.
- *
- * A union of single-key objects rather than a positional `string`, because the
- * three things the SDK narrows by are not the same kind of thing: a request id
- * correlates retries of one wire call, a flow name names an on-chain
- * procedure, a hook name names a React binding. Rendered into one `[SCOPE:x]`
- * prefix they were indistinguishable; as fields they must not be.
- *
- * `requestId` keeps its {@link RequestId} newtype rather than widening to
- * `string` at the seam.
+ * {@link Chain}'s check without the throw, for a mapper over a list that drops
+ * the entries it cannot name rather than rejecting the whole list. Frontline's
+ * chain registry may carry chains this SDK does not model yet.
  */
-type LogBinding = {
-    readonly requestId: RequestId;
-} | {
-    readonly flow: string;
-} | {
-    readonly hook: string;
-} | {
-    readonly op: string;
-};
+declare const isChain: (value: string) => value is Chain;
+type Chain = EthereumChain | SolanaChain;
+declare const Chain: (value: string) => Chain;
 /**
- * Every {@link LogBinding} applied so far, merged. This is what reaches a
- * host, so a line from `prepareOndoSell` carries `flow: 'prepareSell'` as its
- * own key and is filterable without parsing anything.
+ * Protocol a wallet binding is scoped to. EVM-only for now: an EVM address
+ * binds once per option regardless of which EVM chain proved ownership.
+ * Frontline's enum also has `:solana`, but we don't handle Solana bindings yet,
+ * so this stays `'ethereum'` until Solana support lands.
  */
-type LogBindings = {
-    readonly [K in LogBinding as keyof K]?: K[keyof K];
-};
-type BaseEvent = {
-    /**
-     * What happened, as a **constant string literal**.
-     *
-     * Never interpolated. A log aggregator groups by message, so a `msg` that
-     * embeds a status, a count or a reason produces one group per distinct
-     * value and is not groupable at all. Every varying value belongs in
-     * `fields`, which is what a host filters and facets on.
-     *
-     * This is a convention, not a checked rule: deslop reasons about import
-     * edges and cannot see a template literal, and the type-level approximations
-     * catch only some interpolations. ADR-8 records why a partial guarantee was
-     * refused here as elsewhere.
-     */
-    readonly msg: string;
-    /**
-     * Which part of the SDK reported this. Stamped by
-     * {@link internalLogger}, never by a call site.
-     */
-    readonly scope: LogScope;
-    /** Every {@link LogBinding} applied by {@link InternalLogger.child}. */
-    readonly bindings: LogBindings;
-};
+type WalletProtocol = 'ethereum';
 /**
- * An event for `'info'`, `'warn'` and `'error'` - the levels a host may run in
- * production.
- *
- * Its fields are {@link SafeFields}, so nothing but a scalar can reach it.
+ * EVM addresses keep a `0x${string}` base so they stay assignable to the
+ * `0x${string}` shapes that on-chain libraries (viem/wagmi) expect. We only
+ * drop the runtime `0x` narrowing: values are trusted at the boundary and
+ * branded via the constructor.
  */
-type SafeEvent = BaseEvent & {
-    readonly fields: SafeFields;
+type EvmWalletAddress = Newtype<`0x${string}`, 'EvmWalletAddress'>;
+declare const EvmWalletAddress: (value: string) => EvmWalletAddress;
+type EvmContractAddress = Newtype<`0x${string}`, 'EvmContractAddress'>;
+declare const EvmContractAddress: (value: string) => EvmContractAddress;
+/**
+ * What uniquely identifies a token: the chain it is deployed on plus its
+ * contract address. Never a symbol, which can collide across issuers.
+ */
+type TokenIdentifier = {
+    /** The chain the token contract is deployed on. */
+    chain: EthereumChain;
     /**
-     * What the SDK knows about an accompanying failure, classified. Absent when
-     * there is nothing to classify.
+     * The token's contract address, in any casing — consumers that need the
+     * EIP-55 form (e.g. the token registry routes) checksum it themselves.
      */
-    readonly cause?: LogCause;
+    address: EvmContractAddress;
 };
+type HexEncodedTransactionData = Newtype<`0x${string}`, 'HexEncodedTransactionData'>;
+declare const HexEncodedTransactionData: (value: string) => HexEncodedTransactionData;
 /**
- * An event for `'debug'`, the unredacted level. Its fields accept anything.
+ * A transaction the backend has already encoded for us — the caller only
+ * broadcasts it. Used by the flows that hand a wallet a ready-made `to`/`data`
+ * pair (allow-listing a wallet, an Ondo swap) rather than encoding a contract
+ * call themselves.
  */
-type DebugEvent = BaseEvent & {
-    readonly fields: UnredactedFields;
+type Tx = {
+    to: EvmContractAddress;
+    data: HexEncodedTransactionData;
 };
 /**
- * How much the SDK may report, from silent to everything.
- *
- * Ordered: each level admits itself and everything before it, so `'info'`
- * shows errors, warnings and info but not debug. `'none'` admits nothing.
+ * The largest exponent whose power of ten still fits a uint256: 10^77 fits,
+ * 10^78 does not.
  *
- * `'debug'` is the unredacted level, and it is deliberately the bottom of the
- * ladder: the guarantee "`debug` is unredacted and every other level is not"
- * only closes if there is nothing below it. That is why the SDK keeps its own
- * five levels rather than adopting pino's seven, which put `trace` underneath.
+ * The bound is arithmetic rather than a token standard's. ERC-20 reports
+ * `decimals()` as a `uint8`, so 255 is what a contract *can* say, but every
+ * {@link AssetDecimals} in this codebase is paired with a {@link Uint256} raw
+ * by construction, and scaling by anything past this leaves that pairing
+ * unrepresentable. A value between 78 and 255 would therefore pass a
+ * standard-faithful check and then break the first multiplication it reached.
  */
-type LogLevel = 'none' | 'error' | 'warn' | 'info' | 'debug';
+declare const MAX_ASSET_DECIMALS = 77;
 /**
- * The redacted levels: the only ones to consider running in production.
- *
- * Every level except `'debug'`, which is unredacted by design. Used by the
- * shipped pino implementations to make a production `'debug'` logger
- * unrepresentable rather than merely discouraged - see
- * {@link PinoLoggerOptions}.
+ * How many decimal places one whole token divides into.
  *
- * The name marks which levels are *redacted*, not a verdict that running them
- * in production is safe. The SDK's advice is to leave {@link Config.logger}
- * undefined there; this type is what stops the partner who does not take it
- * from reaching the unredacted level as well.
- */
-type ProductionLogLevel = Exclude<LogLevel, 'debug'>;
-/**
- * How to build one of the SDK's pino-backed loggers.
+ * Validated, unlike its neighbours here — {@link Uint256} is a bare `bigint`
+ * with a separate {@link assertUint256} guard, and {@link DecimalString} casts
+ * unchecked. The asymmetry is deliberate and follows the value's provenance:
+ * an `AssetDecimals` used to come only from literals and the token registry,
+ * but backends now publish exponents of their own (`asset_decimals` on an Ondo
+ * quote, both scales on a built swap), and those feed `10n ** BigInt(d)`
+ * during render. Guarding at construction is what keeps a fractional or
+ * unbounded exponent from surfacing as a `RangeError` mid-render — or, at
+ * 10^200, as a hung tab — instead of as the failed state the screen has.
  *
- * A union rather than `{ level, isDev }`, and that is the whole point:
- * `{ isDev: false, level: 'debug' }` does not typecheck, so a production
- * build cannot ship a logger that prints bearer tokens to a browser console.
+ * See docs/ADR-7-VALIDATED-NEWTYPES.md.
  *
- * `isDev` does exactly one thing - decide whether `'debug'` is a legal level.
- * It changes no formatting: dev output and production output are the same
- * shape, so what you debug is what you ship. Pretty-printing is a pipe the
- * host owns (`node server.js | npx pino-pretty`), not a dependency the SDK
- * takes.
+ * @throws ValidationError on a non-integer, a negative, or anything above
+ * {@link MAX_ASSET_DECIMALS}.
  */
-type PinoLoggerOptions = {
-    readonly isDev: true;
-    readonly level: LogLevel;
-} | {
-    readonly isDev: false;
-    readonly level: ProductionLogLevel;
-};
+type AssetDecimals = Newtype<number, 'AssetDecimals'>;
+declare const AssetDecimals: (value: number) => AssetDecimals;
+declare const STABLE_DECIMALS: AssetDecimals;
 /**
- * Which part of the SDK a line came from, carried as the `scope` field on
- * every event.
+ * A non-negative decimal number the backend sent as a string, kept unscaled.
  *
- * It names the seam that **reported** the line, not the layer that raised what
- * it reports: an error from `OFFERS` surfaced by `useOffers` is reported on a
- * `HOOKS` line, because that is the hook telling you what it did with it. The
- * `OFFERS` line for the same error is emitted separately, by the namespace.
+ * Reach for it when a response gives you a number but not the decimals to
+ * scale it by, or gives you one it has already applied. Inventing an exponent
+ * for either is how a display ends up orders of magnitude out.
  *
- * A closed union rather than a free string so that `ONDO` and `Ondo` cannot
- * both appear, so that adding a namespace without giving it a scope fails to
- * compile, and so that a host can `switch` on it when routing. Anything finer
- * - an operation, a flow, a hook - is a {@link LogBinding} and appears as its
- * own field.
- */
-type LogScope = 'HTTP' | 'RPC' | 'AUTH' | 'OFFERS' | 'REQUIREMENTS' | 'WALLETS' | 'ERC20' | 'TOKEN_SALE' | 'SUPERSTATE' | 'ONDO' | 'TOKENS' | 'SUPPORT' | 'HOOKS';
-/**
- * Correlates every line one logical request produces. The first attempt, each
- * retry, and the re-send after a session renewal all carry the same id, so a
- * failure can be read back to the request that caused it.
+ * Contrast {@link BlockchainAmount}, which pairs a raw uint256 with the
+ * decimals it is denominated in and so is only constructible when you know
+ * both. Arithmetic on a `DecimalString` needs a decimal library we
+ * deliberately do not ship.
  */
-type RequestId = Newtype<string, 'RequestId'>;
+type DecimalString = Newtype<string, 'DecimalString'>;
+declare const DecimalString: (value: string) => DecimalString;
+declare const MAX_UINT_256: bigint;
 /**
- * The id frontline keys its own logs by, minted server-side and returned as
- * `event_id` on an error envelope. Quote it when raising a ticket with
- * CoinList support: it is what leads from a partner's log line to the request
- * as the backend saw it.
- *
- * A {@link Newtype} rather than a bare `string` because it sits next to
- * {@link RequestId} and frontline's `code` on the same cause, and the three
- * are not interchangeable: an id swapped for a code reads plausibly and points
- * a support engineer at nothing.
+ * A non-negative integer within uint256 bounds. Kept unbranded (a plain
+ * `bigint`) so raw on-chain amounts flow in without ceremony; bounds are
+ * enforced where it matters (see {@link combineAmounts}).
  */
-type FrontlineEventId = Newtype<string, 'FrontlineEventId'>;
+type Uint256 = bigint;
 /**
- * What the SDK knows about a failure, classified.
- *
- * **Safe to forward as it stands.** Every arm is SDK-authored classification
- * or a server-authored identifier: no request or response body, no host-
- * supplied parameter, and no value read off a thrown error the SDK did not
- * author. There is nothing here to strip before handing it to an error
- * tracker, which is deliberate - a `LogCause` reaches {@link Logger.error},
- * the level a host actually runs in production, and a guarantee that depends
- * on the host remembering to strip a field is not a guarantee.
- *
- * It is the SDK's **only** structured classification of a thrown error, and it
- * reaches {@link Logger.warn} as well as {@link Logger.error}: a recoverable
- * failure is no less worth naming than a fatal one, and rendering it into a
- * string instead would have meant interpolating into `msg`.
- *
- * Bodies are a `'debug'`-only disclosure and stay on the `HTTP` lines, which
- * {@link RequestId} points at.
- *
- * The arms are the remedies, not the exception classes: a `validation` cause
- * means the backend sent something the SDK does not understand and is worth
- * reporting to CoinList, while an `invariant` cause means the SDK itself
- * computed something impossible and is worth reporting as an SDK bug. Reading
- * `type` should tell you who has to fix it.
+ * Asserts a computed bigint falls within uint256 bounds. Use at on-chain
+ * arithmetic boundaries (bps math, price computation) where the SDK's own
+ * arithmetic could underflow below zero or overflow above 2^256-1.
  *
- * It carries no scope of its own. The {@link SafeEvent} it arrives on has one,
- * and a cause could only ever have repeated it: the scope is stamped by the
- * logger that *emits* the line, not by the layer that raised the error, so a
- * `validation` failure from `OFFERS` surfaced by `useOffers` would have been
- * tagged `HOOKS` on the hook's line. Forward the event, not the cause alone.
- */
-/**
- * Why an on-chain read failed, named after what a caller would do about it
- * rather than after the viem error class that reported it. See the `rpc` arm
- * of {@link LogCause}.
+ * Throws {@link InvariantError}, because reaching it means the SDK computed
+ * something no chain could represent. **For a value that came off the wire,
+ * use {@link parseUint256} instead**: the backend sending an unrepresentable
+ * number is a {@link ValidationError}, and the two have different remedies.
  */
-type RpcFailureReason = 'reverted' | 'node-rejected' | 'transport' | 'malformed-response' | 'unknown';
-type LogCause = 
+declare const assertUint256: (value: bigint) => Uint256;
 /**
- * A request reached the backend and came back non-2xx.
+ * {@link assertUint256} at a wire boundary: the same bounds check, reported as
+ * a {@link ValidationError} against the named field, because a value out of
+ * range here is the backend's, not the SDK's.
  *
- * Deliberately carries no response body. `requestId` is how you get the
- * rest: the `HTTP` lines for the same request carry the method, the path,
- * the duration, every retry, and at `'debug'` the body itself. `code` and
- * `eventId` are frontline's own - quote `eventId` when raising a ticket with
- * CoinList support.
+ * `label` names the field the way a DTO mapper's other failures do, so a log
+ * line says which one - `SwapPreview.pay_input_amount`, not `a number`.
  */
-{
-    type: 'http';
-    requestId: RequestId | null;
-    status: number;
-    code: string | null;
-    eventId: FrontlineEventId | null;
-}
+declare const parseUint256: (value: bigint, label: string) => Uint256;
+type BlockchainAmount = Newtype<{
+    raw: Uint256;
+    decimals: AssetDecimals;
+}, 'BlockchainAmount'>;
 /**
- * The wire succeeded; the payload was not a shape the SDK can map.
- *
- * `message` is an SDK-authored template and may quote the single scalar that
- * failed - `Unsupported chain: "solana_mainnet"`, `expires_at: not a date
- * ("13/40/2026")`. That one value is the point of the arm; it is never a
- * body and never a whole field set.
+ * Constructs a {@link BlockchainAmount} and exposes arithmetic helpers.
+ * TypeScript has no operator overloading, so use `BlockchainAmount.add(a, b)`
+ * instead of `+`/`-`/`*`/`/` on the objects directly.
  */
- | {
-    type: 'validation';
-    message: string;
-}
+declare const BlockchainAmount: ((value: {
+    raw: Uint256;
+    decimals: AssetDecimals;
+}) => BlockchainAmount) & {
+    add: (a: BlockchainAmount, b: BlockchainAmount) => BlockchainAmount;
+    sub: (a: BlockchainAmount, b: BlockchainAmount) => BlockchainAmount;
+    /**
+     * `a * b`, in `a`'s decimals - a price times a quantity. Multiplies before
+     * it rescales, then truncates towards zero. The exact inverse of `div`.
+     */
+    mul: (a: BlockchainAmount, b: BlockchainAmount) => BlockchainAmount;
+    /**
+     * `a / b`, in `a`'s decimals - a price, a ratio. Rescales before it
+     * divides, then truncates towards zero.
+     *
+     * @throws MathError when `b` is zero.
+     */
+    div: (a: BlockchainAmount, b: BlockchainAmount) => BlockchainAmount;
+};
+type AssetSymbol = Newtype<string, 'AssetSymbol'>;
+declare const AssetSymbol: (value: string) => AssetSymbol;
 /**
- * The SDK computed something impossible. An SDK bug - please report it.
- * `message` is an SDK-authored template, like `validation`'s.
+ * A stablecoin symbol is an {@link AssetSymbol} narrowed to the coins we
+ * support. It shares the `AssetSymbol` brand so it stays assignable to it.
  */
- | {
-    type: 'invariant';
-    message: string;
-}
-/**
- * Every operand was well-formed and the arithmetic on them still had no
- * answer: a division by zero, a result outside the range its type can hold.
- * `message` is an SDK-authored template, like `validation`'s.
- *
- * Separate from `invariant` because the remedy differs. An `invariant` says
- * the SDK computed something impossible and is a bug to report against the
- * SDK; a `math` says the operation was well-posed and the operands, which
- * came off the wire, admit no result - so it points at the response the same
- * way `validation` does, one step later.
- */
- | {
-    type: 'math';
-    message: string;
-}
-/** An API-backed call was made without a logged-in user. */
- | {
-    type: 'not-authenticated';
-}
-/** A code path the SDK has not shipped yet. */
- | {
-    type: 'not-implemented';
-}
-/**
- * The user's wallet, or the chain, refused.
- *
- * {@link RedactedWalletError} rather than the full `WalletError`: its
- * `unknown` arm arrives with its `cause` dropped, that field holding the raw
- * wallet-library error whose message and metadata carry the transaction's
- * `from`, `to`, `value` and calldata. It is still on the flow's own returned
- * result, and on the `'debug'` line the flow seam emits beside this one.
- *
- * A type rather than a scrub applied at the call site, so an arm that grew a
- * raw field would fail the build.
- */
- | {
-    type: 'wallet';
-    error: RedactedWalletError;
-}
-/**
- * An on-chain read did not answer. `reason` names the remedy, not the viem
- * class that carried it:
- *
- * - `reverted` - the contract refused the call. Check the arguments, or the
- *   contract's own state (a stopped swap reverts its `preview`).
- * - `node-rejected` - the node reached the contract and declined. Usually a
- *   malformed request, a rate limit, or a method the node does not serve.
- *   Also where a host-supplied `Transport` throwing something viem cannot
- *   read a code off lands: `buildRequest` wraps it in `UnknownRpcError`.
- * - `transport` - the node was not reached at all. Retry, or fail over.
- *   A dropped `webSocket()` socket included.
- * - `malformed-response` - the call returned something the ABI cannot
- *   decode, which in practice means the wrong address or a stale ABI.
- * - `unknown` - anything else. Rare, since viem wraps most of what a read
- *   can throw into one of the classes the arms above name.
- *
- * Decided by `instanceof` alone. Nothing is read off the thrown error - not
- * its `name`, not its `message`, not a revert reason - because a viem
- * message embeds the calldata, the contract address and the caller, and
- * `name` is a writable property a host-supplied transport could set to
- * anything. All of that is on the paired `'debug'` line.
- */
- | {
-    type: 'rpc';
-    reason: RpcFailureReason;
-}
-/**
- * Something the SDK does not recognise - usually a host-supplied lambda
- * (`getAccessToken`, an {@link EvmWallet} method) throwing, or a
- * network-level `fetch` failure.
- *
- * `name` is the error's class name and nothing else. The message and the
- * thrown value itself are host-authored, so they are a `'debug'` disclosure:
- * the paired debug line renders them in full.
- */
- | {
-    type: 'generic-error';
+type StablecoinSymbol = Newtype<'USDC' | 'USDT', 'AssetSymbol'>;
+declare const StablecoinSymbol: (value: "USDC" | "USDT") => StablecoinSymbol;
+type KnownAssetSymbol = StablecoinSymbol;
+declare const KnownAssetSymbol: (value: "USDC" | "USDT") => StablecoinSymbol;
+type Erc20Asset = {
     name: string;
+    symbol: AssetSymbol;
+    decimals: AssetDecimals;
+};
+type Bps = Newtype<bigint, 'Bps'>;
+declare const Bps: (value: bigint) => Bps;
+
+type AssetId = Newtype<string, 'AssetId'>;
+declare const AssetId: (value: string) => AssetId;
+type AssetCode = Newtype<string, 'AssetCode'>;
+declare const AssetCode: (value: string) => AssetCode;
+type Asset = {
+    id: AssetId;
+    code: AssetCode;
+    name: string;
+    fractionalDigits: number;
 };
 
+type OfferId = Newtype<string, 'OfferId'>;
+declare const OfferId: (value: string) => OfferId;
+type OfferSlug = Newtype<string, 'OfferSlug'>;
+declare const OfferSlug: (value: string) => OfferSlug;
+type OfferType = 'coinlist::token_sale' | 'superstate::swap' | 'ondo::swap' | 'centrifuge::vault';
+declare const isOfferType: (value: string) => value is OfferType;
 /**
- * The exhaustive chain set: a new {@link EthereumChain} is a compile error
- * here until it is listed, which is what keeps the constructor total.
+ * An offer as `GET /v1/offers` lists it: a union on {@link OfferType}, each
+ * variant carrying only the fields that mean something for it. Narrow on
+ * `type` before reading anything beyond {@link OfferBase} - an Ondo swap has
+ * no `startsAt` to read, and the compiler says so.
  */
-declare const ETHEREUM_CHAINS: Record<EthereumChain, true>;
-type EthereumChain = 'ethereum_mainnet' | 'ethereum_sepolia' | 'base_mainnet' | 'base_sepolia';
+type Offer = CoinListTokenSaleOffer | SuperstateSwapOffer | OndoSwapOffer | CentrifugeVaultOffer;
+type OfferBase = {
+    id: OfferId;
+    slug: OfferSlug;
+    endsAt: Date | null;
+    tokens: OfferToken[];
+};
 /**
- * Validates that a raw backend string names a chain the SDK supports.
- *
- * @throws ValidationError on anything else. Passing an unknown chain through
- * would let downstream EIP-155 lookups blow up far from the response that
- * caused it.
+ * A curated sale window and the hand-authored copy that goes with it. Every
+ * variant that runs such a campaign carries all three, validated; an Ondo swap
+ * trades continuously and a Centrifuge vault takes deposits continuously, so
+ * neither runs one and neither carries any.
  */
-declare const EthereumChain: (value: string) => EthereumChain;
+type OfferEditorial = {
+    tagline: string;
+    bannerUrl: string;
+    startsAt: Date;
+};
+type CoinListTokenSaleOffer = OfferBase & OfferEditorial & {
+    type: 'coinlist::token_sale';
+    logoUrl: string;
+};
+type SuperstateSwapOffer = OfferBase & OfferEditorial & {
+    type: 'superstate::swap';
+    /** Null when nobody has uploaded artwork: a swap publishes without it. */
+    logoUrl: string | null;
+};
+type OndoSwapOffer = OfferBase & {
+    type: 'ondo::swap';
+    /** Null when nobody has uploaded artwork: a swap publishes without it. */
+    logoUrl: string | null;
+};
+/** @alpha */
+type CentrifugeVaultOffer = OfferBase & {
+    type: 'centrifuge::vault';
+    /** Null when nobody has uploaded artwork: a vault publishes without it. */
+    logoUrl: string | null;
+};
 /**
- * The exhaustive chain set: a new {@link SolanaChain} is a compile error
- * here until it is listed, which is what keeps the constructor total.
+ * `vault` is the share token a `centrifuge::vault` offer issues for deposits,
+ * as `swap` is the token a swap offer trades into.
  */
-declare const SOLANA_CHAINS: Record<SolanaChain, true>;
-type SolanaChain = 'solana_mainnet' | 'solana_devnet';
+type TokenRole = 'funding' | 'distribution' | 'swap' | 'vault';
+type OfferToken = {
+    role: TokenRole;
+    chain: Chain;
+    address: EvmContractAddress;
+};
+
+type Ticker = Newtype<string, 'Ticker'>;
+declare const Ticker: (value: string) => Ticker;
 /**
- * Validates that a raw backend string names a chain the SDK supports.
+ * An ISO 6166 International Securities Identification Number, e.g.
+ * `US0378331005`. Identifies the security itself, which is what makes it the
+ * stable key across venues where a {@link Ticker} is not: the same security
+ * trades under different tickers in different places, and the same ticker
+ * means different securities in different places.
  *
- * @throws ValidationError on anything else. Passing an unknown chain through
- * would let downstream EIP-155 lookups blow up far from the response that
- * caused it.
- */
-declare const SolanaChain: (value: string) => SolanaChain;
-/**
- * {@link Chain}'s check without the throw, for a mapper over a list that drops
- * the entries it cannot name rather than rejecting the whole list. Frontline's
- * chain registry may carry chains this SDK does not model yet.
- */
-declare const isChain: (value: string) => value is Chain;
-type Chain = EthereumChain | SolanaChain;
-declare const Chain: (value: string) => Chain;
-/**
- * Protocol a wallet binding is scoped to. EVM-only for now: an EVM address
- * binds once per option regardless of which EVM chain proved ownership.
- * Frontline's enum also has `:solana`, but we don't handle Solana bindings yet,
- * so this stays `'ethereum'` until Solana support lands.
+ * Not validated on construction — the value comes from a supplier that has
+ * already checked it, and a client-side check-digit test could only reject
+ * data the SDK still has to display.
  */
-type WalletProtocol = 'ethereum';
+type Isin = Newtype<string, 'Isin'>;
+declare const Isin: (value: string) => Isin;
+type OrderBookSide = 'buy' | 'sell';
+
 /**
- * EVM addresses keep a `0x${string}` base so they stay assignable to the
- * `0x${string}` shapes that on-chain libraries (viem/wagmi) expect. We only
- * drop the runtime `0x` narrowing: values are trusted at the boundary and
- * branded via the constructor.
+ * An offer as `GET /v1/offers/:id` serves it: the same union on `type` as
+ * {@link Offer}, each variant carrying only the fields that mean something
+ * for it. Narrow on `type` before reading anything beyond
+ * {@link OfferDetailBase}.
  */
-type EvmWalletAddress = Newtype<`0x${string}`, 'EvmWalletAddress'>;
-declare const EvmWalletAddress: (value: string) => EvmWalletAddress;
-type EvmContractAddress = Newtype<`0x${string}`, 'EvmContractAddress'>;
-declare const EvmContractAddress: (value: string) => EvmContractAddress;
+type OfferDetail = CoinListTokenSaleOfferDetail | SuperstateSwapOfferDetail | OndoSwapOfferDetail | CentrifugeVaultOfferDetail;
+/** The `type` of every {@link AsyncOfferDetail}. */
+type AsyncOfferType = AsyncOfferDetail['type'];
 /**
- * What uniquely identifies a token: the chain it is deployed on plus its
- * contract address. Never a symbol, which can collide across issuers.
+ * An offer whose trade settles later: the user places a request, the fund
+ * fills it on its own schedule, and the user comes back to claim the result.
+ * Only these have a second leg for `ClaimContainer` to show.
+ *
+ * A subset of {@link OfferDetail} picked by `type`, so it narrows like any
+ * other variant and a new async provider is one more member here.
+ *
+ * @alpha
  */
-type TokenIdentifier = {
-    /** The chain the token contract is deployed on. */
-    chain: EthereumChain;
+type AsyncOfferDetail = CentrifugeVaultOfferDetail;
+/** @alpha */
+declare const AsyncOfferDetail: {
     /**
-     * The token's contract address, in any casing — consumers that need the
-     * EIP-55 form (e.g. the token registry routes) checksum it themselves.
+     * Narrows an offer fetched generically, e.g. on an offer page, to one with
+     * something to claim.
+     *
+     * An exhaustive `switch` rather than a list of async types, so a new offer
+     * type is a compile error here until someone decides whether it settles
+     * later.
      */
-    address: EvmContractAddress;
+    is: (offer: OfferDetail) => offer is AsyncOfferDetail;
 };
-type HexEncodedTransactionData = Newtype<`0x${string}`, 'HexEncodedTransactionData'>;
-declare const HexEncodedTransactionData: (value: string) => HexEncodedTransactionData;
-/**
- * A transaction the backend has already encoded for us — the caller only
- * broadcasts it. Used by the flows that hand a wallet a ready-made `to`/`data`
- * pair (allow-listing a wallet, an Ondo swap) rather than encoding a contract
- * call themselves.
- */
-type Tx = {
-    to: EvmContractAddress;
-    data: HexEncodedTransactionData;
+type CoinListTokenSaleOfferDetail = OfferDetailBase & OfferEditorial & {
+    type: 'coinlist::token_sale';
+    logoUrl: string;
+};
+type SuperstateSwapOfferDetail = OfferDetailBase & OfferEditorial & {
+    type: 'superstate::swap';
+    /** Null when nobody has uploaded artwork: a swap publishes without it. */
+    logoUrl: string | null;
+};
+type OndoSwapOfferDetail = OfferDetailBase & {
+    type: 'ondo::swap';
+    /** Null when nobody has uploaded artwork: a swap publishes without it. */
+    logoUrl: string | null;
+    /**
+     * Every chain this offer can be swapped on, with the CoinList contract each
+     * settles through. Empty means it cannot be swapped anywhere.
+     */
+    swapContracts: OfferSwapContract[];
+};
+/** @alpha */
+type CentrifugeVaultOfferDetail = OfferDetailBase & {
+    type: 'centrifuge::vault';
+    /** Null when nobody has uploaded artwork: a vault publishes without it. */
+    logoUrl: string | null;
+    /**
+     * Every chain this vault takes deposits on, with the CoinList proxy each
+     * request goes through. Empty means it takes deposits nowhere yet.
+     */
+    vaultContracts: OfferVaultContract[];
+};
+type OfferDetailBase = {
+    id: OfferId;
+    slug: OfferSlug;
+    name: string;
+    asset: Asset;
+    fundingAssets: Asset[];
+    tokens: OfferToken[];
+    about: string | null;
+    category: string;
+    /**
+     * The legal issuer of the *token*, e.g. `'Ondo Global Markets'`. The issuer
+     * of the security it tracks is {@link OfferDetail.name} (`'Apple Inc.'`).
+     * Null on offers with no single named issuer.
+     */
+    issuer: string | null;
+    /**
+     * ISO 6166 identifier of the underlying security, e.g. `'US0378331005'`.
+     * Null both on offers that tokenize no security and on the few that do but
+     * whose supplier publishes no ISIN, so absence does not imply "not a
+     * security".
+     */
+    isin: Isin | null;
+    /**
+     * The underlying security's symbol on its listing venue, e.g. `'QQQ'`. This
+     * is *not* the token's symbol — that is `asset.code` (`'QQQon'`). Null on
+     * offers that tokenize no listed security.
+     */
+    ticker: Ticker | null;
+    /**
+     * What kind of instrument the underlying is, as the supplier classifies it:
+     * `'Stock'`, `'ETF'`. Distinct from {@link OfferDetail.category}, which is
+     * the broader class the offer is grouped under (`'Equities'`) — this field
+     * describes the single instrument, `category` describes the shelf it sits
+     * on.
+     *
+     * An open set: the vocabulary belongs to the supplier and may grow without
+     * notice, so render an unrecognized value rather than branching on it. Note
+     * the supplier's spelling is its own — a common stock arrives as `'Stock'`.
+     */
+    instrumentType: string | null;
+    /**
+     * The exchange the underlying security lists on, e.g. `'NASDAQ'`. Not
+     * derivable from {@link OfferDetail.isin}, whose country prefix is the
+     * country of issuance rather than the venue.
+     *
+     * Unlike the fields above, this one is recorded by hand rather than served
+     * by the supplier, so it is null until someone records it — on a newly
+     * listed offer that is the normal state, and it says nothing about whether
+     * the offer tokenizes a security.
+     */
+    listingVenue: string | null;
+    endsAt: Date | null;
+    faqs: FaqItem[];
+    links: Link[];
+    milestones: Milestone[];
+    options: OfferOption[];
+    terms: TermItem[];
+};
+type OfferOptionId = Newtype<string, 'OfferOptionId'>;
+declare const OfferOptionId: (value: string) => OfferOptionId;
+type OfferOptionSlug = Newtype<string, 'OfferOptionSlug'>;
+declare const OfferOptionSlug: (value: string) => OfferOptionSlug;
+type OfferOption = {
+    id: OfferOptionId;
+    slug: OfferOptionSlug;
+    bidIncrement: number | null;
+    floorPriceUsd: number | null;
+    minimumPurchaseUsd: number | null;
+    priceUsd: string | null;
+    saleAgreementUrl: string | null;
+    totalTokenSupply: number | null;
+};
+type FaqItem = {
+    question: string | null;
+    answer: string | null;
+};
+type TermItem = {
+    key: string | null;
+    value: string | null;
+};
+type Milestone = {
+    name: string | null;
+    schedule: string | null;
+    status: 'completed' | 'active' | 'upcoming';
+};
+type Link = {
+    label: string | null;
+    url: string | null;
 };
 /**
- * The largest exponent whose power of ten still fits a uint256: 10^77 fits,
- * 10^78 does not.
- *
- * The bound is arithmetic rather than a token standard's. ERC-20 reports
- * `decimals()` as a `uint8`, so 255 is what a contract *can* say, but every
- * {@link AssetDecimals} in this codebase is paired with a {@link Uint256} raw
- * by construction, and scaling by anything past this leaves that pairing
- * unrepresentable. A value between 78 and 255 would therefore pass a
- * standard-faithful check and then break the first multiplication it reached.
- */
-declare const MAX_ASSET_DECIMALS = 77;
-/**
- * How many decimal places one whole token divides into.
- *
- * Validated, unlike its neighbours here — {@link Uint256} is a bare `bigint`
- * with a separate {@link assertUint256} guard, and {@link DecimalString} casts
- * unchecked. The asymmetry is deliberate and follows the value's provenance:
- * an `AssetDecimals` used to come only from literals and the token registry,
- * but backends now publish exponents of their own (`asset_decimals` on an Ondo
- * quote, both scales on a built swap), and those feed `10n ** BigInt(d)`
- * during render. Guarding at construction is what keeps a fractional or
- * unbounded exponent from surfacing as a `RangeError` mid-render — or, at
- * 10^200, as a hung tab — instead of as the failed state the screen has.
- *
- * See docs/ADR-7-VALIDATED-NEWTYPES.md.
- *
- * @throws ValidationError on a non-integer, a negative, or anything above
- * {@link MAX_ASSET_DECIMALS}.
- */
-type AssetDecimals = Newtype<number, 'AssetDecimals'>;
-declare const AssetDecimals: (value: number) => AssetDecimals;
-declare const STABLE_DECIMALS: AssetDecimals;
-/**
- * A non-negative decimal number the backend sent as a string, kept unscaled.
- *
- * Reach for it when a response gives you a number but not the decimals to
- * scale it by, or gives you one it has already applied. Inventing an exponent
- * for either is how a display ends up orders of magnitude out.
+ * A chain an offer can be swapped on, with the CoinList contract the swap
+ * settles through - the spender to approve before any quote exists.
  *
- * Contrast {@link BlockchainAmount}, which pairs a raw uint256 with the
- * decimals it is denominated in and so is only constructible when you know
- * both. Arithmetic on a `DecimalString` needs a decimal library we
- * deliberately do not ship.
+ * Carries no role, unlike {@link OfferToken}: there is one swap contract per
+ * chain and it serves every Ondo asset on it, so which token is being traded
+ * does not change the answer.
  */
-type DecimalString = Newtype<string, 'DecimalString'>;
-declare const DecimalString: (value: string) => DecimalString;
-declare const MAX_UINT_256: bigint;
+type OfferSwapContract = {
+    chain: Chain;
+    address: EvmContractAddress;
+};
 /**
- * A non-negative integer within uint256 bounds. Kept unbranded (a plain
- * `bigint`) so raw on-chain amounts flow in without ceremony; bounds are
- * enforced where it matters (see {@link combineAmounts}).
+ * A chain a Centrifuge vault takes deposits on, with the CoinList proxy the
+ * request goes through. Not a token, so the token registry knows nothing about
+ * it: it is the spender the user approves the funding token to, and the `to`
+ * the buy and claim transactions are sent to.
+ *
+ * Its own type rather than an {@link OfferSwapContract}, although the shape is
+ * the same, because the meaning is not: a swap contract serves every Ondo
+ * asset on its chain, while a proxy belongs to one offer on one chain, so the
+ * same chain carries a different address on every vault.
+ *
+ * @alpha
  */
-type Uint256 = bigint;
+type OfferVaultContract = {
+    chain: Chain;
+    address: EvmContractAddress;
+};
+
 /**
- * Asserts a computed bigint falls within uint256 bounds. Use at on-chain
- * arithmetic boundaries (bps math, price computation) where the SDK's own
- * arithmetic could underflow below zero or overflow above 2^256-1.
+ * One vault: a share token on one chain. What the status and position reads
+ * are keyed by, since an offer runs one vault per chain it has a proxy on.
  *
- * Throws {@link InvariantError}, because reaching it means the SDK computed
- * something no chain could represent. **For a value that came off the wire,
- * use {@link parseUint256} instead**: the backend sending an unrepresentable
- * number is a {@link ValidationError}, and the two have different remedies.
+ * @alpha
  */
-declare const assertUint256: (value: bigint) => Uint256;
+type CentrifugeVaultRef = {
+    /** Share token symbol of the vault, e.g. `deJTRSY`. */
+    symbol: AssetSymbol;
+    chain: EthereumChain;
+};
 /**
- * {@link assertUint256} at a wire boundary: the same bounds check, reported as
- * a {@link ValidationError} against the named field, because a value out of
- * range here is the backend's, not the SDK's.
+ * Which side of a vault trade: `deposit` (buy) turns the funding token into
+ * shares, `redeem` (sell) turns shares back into the funding token. The
+ * contract's own names. Each wallet holds one pooled position per vault per
+ * direction, and a claim settles one of them.
  *
- * `label` names the field the way a DTO mapper's other failures do, so a log
- * line says which one - `SwapPreview.pay_input_amount`, not `a number`.
+ * @alpha
  */
-declare const parseUint256: (value: bigint, label: string) => Uint256;
-type BlockchainAmount = Newtype<{
-    raw: Uint256;
-    decimals: AssetDecimals;
-}, 'BlockchainAmount'>;
+type CentrifugeClaimDirection = 'deposit' | 'redeem';
 /**
- * Constructs a {@link BlockchainAmount} and exposes arithmetic helpers.
- * TypeScript has no operator overloading, so use `BlockchainAmount.add(a, b)`
- * instead of `+`/`-`/`*`/`/` on the objects directly.
+ * Why a deposit cannot be placed on a vault right now. Kept verbatim from the
+ * wire: frontline publishes it as a closed set for clients to branch on.
+ *
+ * @alpha
  */
-declare const BlockchainAmount: ((value: {
-    raw: Uint256;
-    decimals: AssetDecimals;
-}) => BlockchainAmount) & {
-    add: (a: BlockchainAmount, b: BlockchainAmount) => BlockchainAmount;
-    sub: (a: BlockchainAmount, b: BlockchainAmount) => BlockchainAmount;
-    mul: typeof multiplyAmounts;
-    div: typeof divideAmounts;
-};
+type CentrifugeOrderReason = 'vault_unlinked' | 'vault_halted' | 'proxy_not_permissioned' | 'price_unavailable' | 'below_minimum';
 /**
- * `a * b`, denominated in `a`'s decimals - a price times a quantity, an amount
- * times a rate.
+ * The reasons a vault status can report - all but `below_minimum`.
  *
- * The exact inverse of {@link divideAmounts}, and it reads the same way round:
- * the answer stays in `a`'s scale and `b`'s divides back out, so the two
- * compose - `mul(div(a, b), b)` is `a` again, short only what truncation took.
- * That is what makes `price x quantity` land in the currency the price was
- * quoted in rather than at some product of two exponents no token uses.
- *
- * The multiplication happens *before* the division by `10^b.decimals`, so the
- * full precision of both operands survives into the one rounding at the end.
- * Like `div` it truncates towards zero on both signs, which is the safe
- * direction for money: a total is never inflated past what the parts hold.
- *
- * Total - unlike `div`, there is nothing here to reject. The scale it divides
- * by is a power of ten, never zero, and a product is not bounds-checked for
- * the same reason a quotient is not: whether one past uint256 is a corrupt
- * response or an expected magnitude belongs to the caller.
+ * @alpha
  */
-declare function multiplyAmounts(a: BlockchainAmount, b: BlockchainAmount): BlockchainAmount;
+type CentrifugeVaultReason = Exclude<CentrifugeOrderReason, 'below_minimum'>;
 /**
- * `a / b`, denominated in `a`'s decimals - a price, a ratio, a rate.
- *
- * Unlike {@link combineAmounts}, the two operands may be at different scales,
- * and usually are: dividing dollars by shares is the point of the operation,
- * and the two tokens rarely share an exponent. `b`'s scale divides back out -
- * the numerator is scaled by `10^b.decimals` *before* the division, so nothing
- * is lost to integer truncation early and the quotient lands in `a`'s scale,
- * which is the one the amounts it is rendered beside are in.
- *
- * Truncates towards zero on both signs, which is what BigInt division already
- * does and the safe direction for money: the total a price implies never
- * exceeds, in magnitude, the amount that actually moved.
+ * Whether a deposit can be placed, as one union rather than the wire's
+ * `can_order` beside `reasons`: a blocked answer always says why, and an
+ * orderable one has nothing to say. The wire pair can contradict itself; this
+ * cannot, because `fromDto` refuses the payloads that do.
  *
- * A zero divisor is the only rejection. The quotient is deliberately *not*
- * bounds-checked the way {@link combineAmounts} checks a sum: scaling the
- * numerator carries even legal pairs past uint256 (a maximal amount over a
- * single base unit), and whether that reads as a corrupt response or an
- * expected magnitude is the caller's to judge - see `computeOndoBuyPrice` and
- * `computeOndoSellPrice`, which bounds-check the price they build out of this.
- *
- * @throws MathError when `b` is zero. `add` and `sub` throw a bare `Error`
- * because a scale mismatch is a programming error caught in review; a zero
- * divisor arrives from a server response and is divided by during render, so
- * it is a named failure a screen can catch and map to a failed state.
+ * @alpha
  */
-declare function divideAmounts(a: BlockchainAmount, b: BlockchainAmount): BlockchainAmount;
-type AssetSymbol = Newtype<string, 'AssetSymbol'>;
-declare const AssetSymbol: (value: string) => AssetSymbol;
+type CentrifugeOrderability<R extends CentrifugeOrderReason> = {
+    type: 'orderable';
+} | {
+    type: 'blocked';
+    reasons: [R, ...R[]];
+};
 /**
- * A stablecoin symbol is an {@link AssetSymbol} narrowed to the coins we
- * support. It shares the `AssetSymbol` brand so it stays assignable to it.
+ * A vault's own state, independent of any wallet or amount: the gate to poll.
+ * Centrifuge announces none of these changes, and an unlinked vault leaves the
+ * offer's proxy permanently dead, so a cached answer goes wrong silently.
+ *
+ * @alpha
  */
-type StablecoinSymbol = Newtype<'USDC' | 'USDT', 'AssetSymbol'>;
-declare const StablecoinSymbol: (value: "USDC" | "USDT") => StablecoinSymbol;
-type KnownAssetSymbol = StablecoinSymbol;
-declare const KnownAssetSymbol: (value: "USDC" | "USDT") => StablecoinSymbol;
-type Erc20Asset = {
-    name: string;
-    symbol: AssetSymbol;
-    decimals: AssetDecimals;
-};
-type Bps = Newtype<bigint, 'Bps'>;
-declare const Bps: (value: bigint) => Bps;
-
-type GetTokenAllowanceParams = {
-    tokenAddress: EvmContractAddress;
-    owner: EvmWalletAddress;
-    spender: EvmContractAddress;
-    chain: EthereumChain;
-};
-type GetTokenBalanceParams = {
-    tokenAddress: EvmContractAddress;
-    owner: EvmWalletAddress;
+type CentrifugeVaultStatus = {
     chain: EthereumChain;
+    symbol: AssetSymbol;
+    /** Centrifuge's vault behind the proxy. Fixed for the proxy's life. */
+    vaultAddress: EvmContractAddress;
+    /**
+     * Whether Centrifuge still links the vault to its pool. False is terminal
+     * for this proxy: no request or claim succeeds until a new one is deployed.
+     */
+    linked: boolean;
+    /**
+     * Whether the proxy is on the share token's memberlist. It holds shares for
+     * every wallet, so one expired entry stops the whole offer.
+     */
+    permissioned: boolean;
+    /** Watch it: {@link permissioned} goes false the moment it passes. */
+    membershipValidUntil: Date | null;
+    /** The proxy halted itself after a force-cancel; cleared only by hand. */
+    halted: boolean;
+    /** When the vault last published a price. A stale value means the price is old. */
+    priceUpdatedAt: Date | null;
+    orderability: CentrifugeOrderability<CentrifugeVaultReason>;
+    /** When the chain was read: how old everything above is. */
+    asOf: Date;
 };
-
 /**
- * OAuth 2.0 token response (RFC 6749 §5.1).
- * Maps to OpenAPI schema OauthToken.
+ * What both vault transactions share: calldata to broadcast verbatim, and the
+ * deadline on it.
+ *
+ * @alpha
  */
-type OAuthSessionDto = {
-    access_token: string;
-    expires_in: number;
-    refresh_token?: string;
-};
-
-type ClientCredentialsOAuth = Newtype<OAuthAccessToken, 'ClientCredentialsOAuth'>;
-declare const ClientCredentialsOAuth: (value: OAuthAccessToken) => ClientCredentialsOAuth;
-type OAuthAccessToken = {
-    value: string;
-    expiresAt: Date;
-};
-type OAuthRefreshToken = Newtype<string, 'OAuthRefreshToken'>;
-declare const OAuthRefreshToken: (value: string) => OAuthRefreshToken;
-type OAuthSession = {
-    accessToken: OAuthAccessToken;
-    refreshToken?: OAuthRefreshToken;
-};
-declare const OAuthSession: {
-    fromDto: (dto: OAuthSessionDto) => OAuthSession;
+type CentrifugeVaultTransactionCore = {
+    /** The `to` is the offer's proxy: the spender the deposit was approved to. */
+    tx: Tx;
+    /**
+     * When the calldata stops being accepted, or null when it carries no
+     * deadline - always the case for a claim, which nobody signs.
+     */
+    expiresAt: Date | null;
 };
-
-type HttpRequestAttributes = {
-    /**
-     * Correlates the log lines of one logical request. Minted by
-     * {@link HttpClient} on the first attempt and carried onto every retry and
-     * post-renewal re-send by {@link concat}, which is what lets a reader tell
-     * three attempts of one request from three separate requests.
-     */
-    requestId?: RequestId;
-    protected?: boolean;
-    userAgent?: boolean;
-    idempotencyKey?: boolean;
-    /** Zero-based attempt index: 0 = first request, 1 = first retry, etc. */
-    retryAttempt?: number;
-    renewAttempted?: boolean;
-    clientCredentials?: ClientCredentialsOAuth;
+/**
+ * A signed deposit request, ready to broadcast.
+ *
+ * **Broadcasting it buys nothing yet.** It places a request in the vault's
+ * queue; the fund fulfils it later at a price set then, and the user comes
+ * back to claim. Single-use: built once on confirmation, never on a timer.
+ *
+ * @alpha
+ */
+type CentrifugeVaultBuyTransaction = CentrifugeVaultTransactionCore & {
+    /** Exactly what the approval has to cover: no fee comes off it. */
+    spendInputAmount: BlockchainAmount;
 };
-
 /**
- * The value types a query-string parameter may take.
+ * The claim that moves fulfilled shares from the proxy to the wallet: the
+ * second transaction every vault purchase needs. The wallet that broadcasts it
+ * is the one credited.
  *
- * Declared here rather than beside the HTTP client because domain models build
- * query parameters too: `ParticipationsPaginationParams.toQueryParams` returns
- * a `Record<string, QueryParamValue>`, and a domain model must not import
- * `@/universal/api/**`.
+ * @alpha
  */
-type QueryParamValue = string | number | boolean | null | undefined;
-type QueryParamValues = QueryParamValue | QueryParamValue[];
-
-type HttpRequest<TBody = unknown> = {
-    method: 'GET';
-    url: string;
-    queryParams?: Record<string, QueryParamValues>;
-    headers?: Record<string, string>;
-    attributes?: HttpRequestAttributes;
-    redirect?: RequestRedirect;
-} | {
-    method: 'POST';
-    url: string;
-    queryParams?: Record<string, QueryParamValues>;
-    headers?: Record<string, string>;
-    body: TBody;
-    attributes?: HttpRequestAttributes;
-    redirect?: RequestRedirect;
-} | {
-    method: 'DELETE';
-    url: string;
-    queryParams?: Record<string, QueryParamValues>;
-    headers?: Record<string, string>;
-    attributes?: HttpRequestAttributes;
-    redirect?: RequestRedirect;
-};
-type HttpResponse<TBody = unknown> = {
-    status: number;
-    headers?: Record<string, string>;
-    body: TBody | null;
+type CentrifugeVaultClaimTransaction = CentrifugeVaultTransactionCore & {
     /**
-     * The id of the request that produced this response, stamped by
-     * {@link HttpClient} so that whoever turns a non-2xx into an
-     * {@link HttpError} can carry it without threading the request alongside.
-     * Absent when the response did not come from an `HttpClient`.
+     * Read when the calldata was built. A floor: a fill landing before the
+     * broadcast raises it, and the claim still collects everything.
      */
-    requestId?: RequestId;
+    claimableShares: BlockchainAmount;
 };
-declare class HttpError<TBody = unknown> extends Error {
-    readonly response: HttpResponse<TBody>;
-    constructor(response: HttpResponse<TBody>);
-    /**
-     * Correlates this failure with the `[HTTP]` log lines for the same request,
-     * which carry the method, the URL, the duration and every retry. `null` when
-     * the response did not come from an {@link HttpClient}.
-     *
-     * Worth quoting in a bug report: it is what makes a log excerpt readable.
-     */
-    get requestId(): RequestId | null;
-}
 /**
- * The machine-readable `code` frontline attaches to an error, or `null` for
- * anything else - a non-HTTP failure, or an error body that carries only a
- * message.
+ * The funding token a vault is paid in, in that token's decimals. Nominally
+ * distinct from {@link CentrifugeShares}: the two legs settle in opposite
+ * units, and the compiler, not a comment, keeps one from standing in for the
+ * other.
  *
- * Frontline answers a failure with `{ type, message, code?, errors?,
- * event_id? }`, and `code` is the only part of it meant to be branched on:
- * `message` is prose that may be reworded, and `type` distinguishes
- * `invalid_request_error` from `api_error` without saying which one.
+ * @alpha
+ */
+type CentrifugeAssets = BlockchainAmount & {
+    readonly [centrifugeUnit]: 'assets';
+};
+/** @alpha */
+declare const CentrifugeAssets: (amount: BlockchainAmount) => CentrifugeAssets;
+/**
+ * A vault's share token, in its decimals. See {@link CentrifugeAssets}.
  *
- * Reach for this only where a code has a distinct remedy the user can act on.
- * Mapping the whole vocabulary would couple the SDK to strings frontline does
- * not version; falling back to a generic failure is the right default.
+ * @alpha
  */
-declare function apiErrorCode(error: unknown): string | null;
-
+type CentrifugeShares = BlockchainAmount & {
+    readonly [centrifugeUnit]: 'shares';
+};
+/** @alpha */
+declare const CentrifugeShares: (amount: BlockchainAmount) => CentrifugeShares;
 /**
- * Structural interface satisfied by both {@link AuthenticatedApiClient} and
- * {@link ApiClient}. Used by the shared frontline API functions so they can
- * be called from either the client or server without any browser dependencies.
+ * The phantom key {@link CentrifugeAssets} and {@link CentrifugeShares} are
+ * told apart by. A second key rather than a second `Newtype`, because
+ * `BlockchainAmount` already spends the `Newtype` brand: two brands on one key
+ * intersect to `never`, and the units would become assignable to each other.
  */
-interface Sender {
-    send<T>(request: HttpRequest): Promise<T>;
-}
-
+declare const centrifugeUnit: unique symbol;
 /**
- * Where the SDK sends its on-chain reads, per chain.
+ * One wallet's Deposit (buy) standing on one vault, read from the proxy.
  *
- * Leave it undefined and reads go through CoinList's authenticated JSON-RPC
- * proxy (`POST /v1/chains/{chain}/rpc`), which needs no setup but does need a
- * logged-in user - the proxy is OAuth-gated, so a read on a chain the SDK is
- * proxying fails with its `401`, surfaced as the viem error wrapping it. A
- * chain you name here is read straight from your own node instead, and needs
- * no CoinList session at all.
- *
- * Each entry is either:
- *
- * - an RPC URL, which the SDK wraps in viem's `http()` transport, or
- * - a viem {@link Transport} used as it stands - `fallback([...])`,
- *   `webSocket()`, or your app's own.
+ * The proxy keeps one pooled position per wallet: a FIFO slice of the vault's
+ * queue, which the fund fills on its own schedule. `pending` and `claimable`
+ * coexist - a fill can cover part of the slice - and neither says anything
+ * about earlier claims.
  *
- * Chains you leave out fall back to the proxy individually, so overriding
- * mainnet does not opt Sepolia out. The SDK always constructs the viem
- * `PublicClient` itself, so the chain definition, batching and retry policy
- * stay the SDK's regardless of the transport you supply.
+ * Both are in the funding token, the unit the proxy tracks a deposit in. The
+ * shares a claim pays are not here: the proxy publishes no claim price, and
+ * its spot `convertToShares` is documented as not being one.
  *
- * @example
- * ```ts
- * createCoinListClient({
- *   clientId,
- *   redirectUri,
- *   rpc: {
- *     ethereum_mainnet: 'https://eth-mainnet.g.alchemy.com/v2/KEY',
- *     ethereum_sepolia: fallback([http(primary), http(backup)]),
- *     // base_* unset -> proxied through CoinList
- *   },
- * });
- * ```
+ * @alpha
  */
-type RpcConfig = Partial<Record<EthereumChain, string | Transport>>;
-interface Config {
-    /** OAuth2 public identifier. */
-    readonly clientId: ClientId;
-    /**
-     * OAuth2 redirect URI. Recommended to point to a frontend page where
-     * {@link CoinListClient#completeOauth} can be called to complete the PKCE
-     * flow on the client side.
-     */
-    readonly redirectUri: RedirectUri;
-    /**
-     * Recommended to leave undefined. Used to change the CoinList environment;
-     * default is production.
-     */
-    readonly baseUrl?: string;
-    /**
-     * Recommended to leave undefined. Overrides the base URL of the public
-     * token registry backing `coinlist.tokens`; default is the production
-     * registry.
-     */
-    readonly tokensBaseUrl?: string;
-    /**
-     * Where the SDK reports what it is doing. **Omit it and the SDK logs nothing
-     * at all** - no `console` fallback, at any level, on any codepath. Supply
-     * one and every request, every classified failure and every hook state
-     * transition is reported at the level your logger asks for.
-     *
-     * Absent, the SDK says nothing at all - there is no fallback to `console`,
-     * at any level, on any codepath.
-     *
-     * **Running the SDK's logging in production is not advised.** The safest
-     * posture is to leave this undefined outside development, staging and
-     * incident reproduction: a seam that emits nothing cannot disclose anything,
-     * and that property does not depend on the SDK continuing to get redaction
-     * right.
-     *
-     * If you do run one there, run it at `'info'` or above and know what that
-     * does and does not buy you. Those levels are **redacted by construction**:
-     * they carry only SDK-authored classification and server-authored
-     * identifiers, and the type system holds that line rather than a convention -
-     * an event at those levels accepts scalar fields only, so a body, a DTO or
-     * an operation's parameters cannot be put on one. What the SDK does **not**
-     * give you is a warranty that the result is safe for your environment. The
-     * mechanism is checkable and stated; the conclusion depends on your sink,
-     * your retention and your threat model, and it is yours to draw.
-     *
-     * **`'debug'` is not.** It reports request and response bodies, full URLs,
-     * headers and operation parameters verbatim - bearer tokens, KYC answers,
-     * tax-document fields, wallet signatures - and **the SDK does not redact**.
-     * Run it on a developer's machine, in tests, and in beta or staging
-     * environments where the data flowing through is not real customer data.
-     * The shipped implementations make that structural: built with
-     * `isDev: false`, `'debug'` does not typecheck. Either way, filtering,
-     * redaction and retention at your sink are yours, not the SDK's.
-     *
-     * Every method you implement here **must be total**: the SDK calls them on
-     * the codepath of the work they report and does not catch them, so a logger
-     * that throws fails the operation it was describing.
-     *
-     * See {@link Logger} for the full contract, and {@link pinoClientLogger} or
-     * {@link pinoServerLogger} for a ready-made implementation over pino.
-     */
-    readonly logger?: Logger;
-    /**
-     * Where on-chain reads go. Omit it and they are proxied through CoinList.
-     * See {@link RpcConfig}.
-     */
-    readonly rpc?: RpcConfig;
-}
-
+type CentrifugeDepositPosition = {
+    chain: EthereumChain;
+    /** The CoinList proxy the position lives on. */
+    proxy: EvmContractAddress;
+    walletAddress: EvmWalletAddress;
+    /** Still queued, not yet filled: `pendingDepositRequest`. */
+    pending: CentrifugeAssets;
+    /** Filled and not yet claimed: `claimableDepositRequest`. A claim takes it all. */
+    claimable: CentrifugeAssets;
+};
 /**
- * Resolves a chain to the viem `PublicClient` the SDK reads it through.
+ * One wallet's Redeem (sell) standing on one vault, read from the proxy. The
+ * mirror of {@link CentrifugeDepositPosition}, in shares, and as independent
+ * of it: a wallet can deposit and redeem on one vault at once.
  *
- * One function rather than a client per read, because the client is where the
- * batching lives: viem's multicall scheduler is keyed on the client's `uid`,
- * so two reads only ever share an `eth_call` if they share a client. Hence the
- * memoisation - it is correctness for batching, not a performance tweak.
+ * @alpha
  */
-type PublicClients = (chain: EthereumChain) => PublicClient;
-
-interface UniversalNamespaceContext {
-    readonly api: Sender;
-    /**
-     * The viem `PublicClient` for a chain, over whichever transport that chain
-     * resolved to - the host's own node, or CoinList's proxy.
-     *
-     * A factory rather than a client, because a namespace serves every chain and
-     * only the call knows which. Built once per client instance so that
-     * concurrent reads share a batch; see `publicClients`.
-     */
-    readonly rpc: PublicClients;
-    /**
-     * The host's logger, or `null` when they supplied none.
-     *
-     * Deliberately the raw port rather than a pre-scoped {@link InternalLogger}:
-     * one context serves every namespace, and each namespace owns its own scope.
-     * A namespace turns it into something usable in its constructor, with
-     * `internalLogger(ctx.logger, 'OFFERS')`.
-     */
-    readonly logger: Logger | null;
-    ensureUserAuthenticated(): Promise<void>;
-}
-
+type CentrifugeRedeemPosition = {
+    chain: EthereumChain;
+    /** The CoinList proxy the position lives on. */
+    proxy: EvmContractAddress;
+    walletAddress: EvmWalletAddress;
+    /** Still queued, not yet filled: `pendingRedeemRequest`. */
+    pending: CentrifugeShares;
+    /** Filled and not yet claimed: `claimableRedeemRequest`. A claim takes it all. */
+    claimable: CentrifugeShares;
+};
 /**
- * Generic ERC-20 reads shared across on-chain flows (swap, token sale): the
- * allowance an owner has granted a spender, and the raw token balance an owner
- * holds. These are plain token reads, not tied to any single product flow.
+ * One wallet's position on one side of a vault trade, tagged with the side.
+ * The two sides are tracked in opposite units - the funding token for
+ * `deposit`, shares for `redeem` - so the tag is what says which unit each
+ * figure is in.
  *
- * Read from the chain rather than from a CoinList endpoint. By default that
- * goes through CoinList's authenticated JSON-RPC proxy, so a logged-out caller
- * gets the proxy's `401` - surfaced as a viem error wrapping the SDK's
- * `HttpError`, not as `NotAuthenticatedError`, since viem re-wraps whatever a
- * `Transport` throws. Point `Config.rpc` at your own node for this chain and no
- * CoinList session is involved at all. See {@link RpcConfig}.
- */
-interface Erc20Namespace {
-    /**
-     * Reads the ERC-20 allowance an `owner` has granted a `spender`, as a raw
-     * on-chain integer.
-     */
-    getAllowance(params: GetTokenAllowanceParams): Promise<Uint256>;
-    /**
-     * Reads the raw ERC-20 balance an `owner` holds of a token.
-     */
-    getBalance(params: GetTokenBalanceParams): Promise<Uint256>;
-}
-declare class Erc20NamespaceImpl implements Erc20Namespace {
-    private readonly ctx;
-    private readonly log;
-    constructor(ctx: UniversalNamespaceContext);
-    getAllowance(params: GetTokenAllowanceParams): Promise<Uint256>;
-    getBalance(params: GetTokenBalanceParams): Promise<Uint256>;
-}
-
-/**
- * The logging surface SDK code uses. Never exported to hosts: they implement
- * {@link Logger}, which is deliberately smaller.
+ * @alpha
  */
-type InternalLogger = {
-    /**
-     * A logger narrowed by one more {@link LogBinding}, which every line it
-     * emits carries as its own field.
-     */
-    child(binding: LogBinding): InternalLogger;
-    /**
-     * The unredacted level. Request and response bodies, full URLs, headers,
-     * operation params and raw thrown errors belong here and **only** here.
-     */
-    debug(event: () => InternalDebugEvent): void;
-    info(event: () => InternalSafeEvent): void;
-    warn(event: () => InternalSafeEvent): void;
-    /**
-     * Reports a failure whose cause is already known, or has none. Prefer
-     * {@link failure}, which classifies a thrown error for you.
-     */
-    error(event: () => InternalSafeEvent): void;
-    /**
-     * Reports a thrown error, classifying it into a {@link LogCause}. Prefer
-     * this over `error` at a `catch`: classification only happens when the level
-     * admits it.
-     *
-     * The `error` line names the error's class but never its message, since an
-     * error the SDK did not author may say anything at all. The verbatim
-     * rendering goes onto a paired `debug` line instead.
-     *
-     * For a failure the SDK recovers from, use {@link warning} instead. An
-     * `error` line a host cannot act on is worse than no line at all: it trains
-     * them to ignore the ones that matter.
-     */
-    failure(event: () => InternalSafeEvent, error: unknown): void;
-    /**
-     * {@link failure} for trouble that did not break anything: a poll tick that
-     * failed while the last value still stands, a retried request.
-     *
-     * Carries the classified {@link LogCause} exactly as `failure` does. The two
-     * differ in level and in nothing else, because what separates them is
-     * whether anything actually broke - not how much is known about it.
-     */
-    warning(event: () => InternalSafeEvent, error: unknown): void;
-    /**
-     * Runs one namespace operation with logging around it: the call and its
-     * params at `debug`, and any throw at `error` with the cause classified.
-     * Every line carries `op` as a binding.
-     *
-     * **The params never reach the `error` line.** They routinely hold the
-     * things this SDK must not put in front of a production error tracker - an
-     * app bearer token, a document's signing fields, a wallet signature - and
-     * the `debug` line plus the request id is how you get them back. The type
-     * says so: `params` is `unknown`, which is not a {@link SafeFields} value.
-     *
-     * Always rethrows. Logging observes behaviour, it never changes it.
-     */
-    wrap<T>(op: string, params: unknown, run: () => Promise<T>): Promise<T>;
+type CentrifugeVaultLeg = {
+    direction: 'deposit';
+    position: CentrifugeDepositPosition;
+} | {
+    direction: 'redeem';
+    position: CentrifugeRedeemPosition;
+};
+/** @alpha */
+declare const CentrifugeVaultLeg: {
+    /** Whether the leg has anything queued or anything ready to claim. */
+    isActive: (leg: CentrifugeVaultLeg) => boolean;
 };
 /**
- * What a call site hands to `info`, `warn`, `error`, `failure` or `warning` -
- * a {@link SafeEvent} minus the scope and bindings the logger stamps itself.
+ * One wallet's position on one leg of one vault: what a claim targets. A
+ * wallet holds at most one per direction per chain, so the three together
+ * name it.
+ *
+ * @alpha
  */
-type InternalSafeEvent = {
-    /** A **constant** string literal. Every varying value belongs in `fields`. */
-    readonly msg: string;
-    readonly fields?: SafeFields;
-    readonly cause?: LogCause;
-};
-/** What a call site hands to `debug`. Its fields accept anything. */
-type InternalDebugEvent = {
-    /** A **constant** string literal. Every varying value belongs in `fields`. */
-    readonly msg: string;
-    readonly fields?: UnredactedFields;
+type CentrifugeVaultLegId = Newtype<string, 'CentrifugeVaultLegId'>;
+/** @alpha */
+declare const CentrifugeVaultLegId: {
+    /** Addresses compare case-insensitively: a host may pass either case. */
+    of: (leg: CentrifugeVaultLeg) => CentrifugeVaultLegId;
 };
-
 /**
- * The product an offer is checked out through. The backend sends one compound
- * `{supplier}::{saleType}` string, verbatim as spelled below: a double colon
- * between the two halves, `snake_case` within each. CoinList's token sale is
- * `coinlist::token_sale`; there is no `coinlist::sale` and no
- * `coinlist_token_sale`.
+ * The claim that pays a filled redemption out in the funding token: the
+ * second transaction every vault sale needs. The wallet that broadcasts it is
+ * the one paid.
  *
- * Kept flat rather than split into a supplier and a sale type, because a flat
- * union makes a `switch` over it exhaustive: adding a provider without
- * handling it becomes a compile error.
+ * TODO(frontline, ENG-1909): built against a guessed wire shape - see
+ * `CentrifugeVaultClaimProceedsDto`.
+ *
+ * @alpha
  */
-type OfferTypeDto = 'coinlist::token_sale' | 'superstate::swap' | 'ondo::swap';
+type CentrifugeVaultClaimProceedsTransaction = CentrifugeVaultTransactionCore & {
+    /** An estimate read when the calldata was built; the claim pays it all. */
+    claimableAssets: BlockchainAmount;
+};
+
 /**
- * One variant per {@link OfferTypeDto}, mirroring frontline#1365, which keys
- * `GET /v1/offers` on `type`. Read `type` first: it decides which of the
- * fields below mean anything.
+ * An absolute URL to a logo image in the token registry. Registry image URLs
+ * are content-fingerprinted and served immutable, so a value is safe to cache
+ * for as long as you hold it.
  */
-type OfferDto = CoinListTokenSaleOfferDto | SuperstateSwapOfferDto | OndoSwapOfferDto;
-type OfferBaseDto = {
-    id: string;
-    slug: string;
-    ends_at: string | null;
-    tokens: OfferTokenDto[];
+type TokenLogoUrl = Newtype<string, 'TokenLogoUrl'>;
+declare const TokenLogoUrl: (value: string) => TokenLogoUrl;
+type TokenLogoImage = {
+    url: TokenLogoUrl;
+    width: number;
+    height: number;
 };
 /**
- * A curated sale window and the hand-authored copy that goes with it. Required
- * on every variant that runs such a campaign, which is every one but Ondo.
+ * `VECTOR` is a single SVG. `RASTER` has webp variants at 32/64/128/256/512px
+ * widths (never wider than the original): use the smallest one that covers
+ * your render size, or `original` if none does.
  */
-type OfferEditorialDto = {
-    tagline: string;
-    banner_url: string;
-    starts_at: string;
+type TokenLogo = {
+    kind: 'VECTOR';
+    url: TokenLogoUrl;
+} | {
+    kind: 'RASTER';
+    original: TokenLogoImage;
+    variants: TokenLogoImage[];
 };
 /**
- * What an Ondo swap sends in place of {@link OfferEditorialDto}. It trades
- * continuously and runs no campaign, so the keys arrive as `null` and carry
- * nothing. Declared so a fixture can describe the real payload; no `fromDto`
- * reads them.
+ * Display metadata for one token, from CoinList's public token registry.
+ *
+ * Keyed by `(chain, address)` — never by symbol, which can collide. The
+ * registry is curated: a token missing from it is an expected answer, not an
+ * error, so lookups return `null` rather than throwing.
  */
-type OfferNoEditorialDto = {
-    tagline: null;
-    banner_url: null;
-    starts_at: null;
-};
-type CoinListTokenSaleOfferDto = OfferBaseDto & OfferEditorialDto & {
-    type: 'coinlist::token_sale';
-    logo_url: string;
-};
-type SuperstateSwapOfferDto = OfferBaseDto & OfferEditorialDto & {
-    type: 'superstate::swap';
-    /** Publishing a swap does not require anyone to upload artwork for it. */
-    logo_url: string | null;
-};
-type OndoSwapOfferDto = OfferBaseDto & OfferNoEditorialDto & {
-    type: 'ondo::swap';
-    /** Publishing a swap does not require anyone to upload artwork for it. */
-    logo_url: string | null;
-};
-type OfferTokenDto = {
-    role: 'funding' | 'distribution' | 'swap';
-    chain: string;
-    address: string;
+type TokenMetadata = {
+    identifier: TokenIdentifier;
+    name: string;
+    symbol: AssetSymbol;
+    decimals: AssetDecimals;
+    logo: TokenLogo;
+    /** Dark-theme logo; `null` when the registry configures none. */
+    logoDark: TokenLogo | null;
 };
 
-type OfferId = Newtype<string, 'OfferId'>;
-declare const OfferId: (value: string) => OfferId;
-type OfferSlug = Newtype<string, 'OfferSlug'>;
-declare const OfferSlug: (value: string) => OfferSlug;
-type OfferType = OfferTypeDto;
-declare const isOfferType: (value: string) => value is OfferType;
-type OfferBase = {
-    id: OfferId;
-    slug: OfferSlug;
-    endsAt: Date | null;
-    tokens: OfferToken[];
-};
-type CoinListTokenSaleOffer = OfferBase & OfferEditorial & {
-    type: 'coinlist::token_sale';
-    logoUrl: string;
-};
-type SuperstateSwapOffer = OfferBase & OfferEditorial & {
-    type: 'superstate::swap';
-    /** Null when nobody has uploaded artwork: a swap publishes without it. */
-    logoUrl: string | null;
-};
-type OndoSwapOffer = OfferBase & {
-    type: 'ondo::swap';
-    /** Null when nobody has uploaded artwork: a swap publishes without it. */
-    logoUrl: string | null;
+/**
+ * One chain a vault offer runs on, with everything a screen needs to read and
+ * show a position there: the proxy every request and claim goes through, the
+ * share token it issues, and the funding token it is paid in.
+ *
+ * The share token's `symbol` is the one amounts are labelled with. Vault
+ * routes are keyed by the offer's asset code, from `centrifugeShareSymbol`.
+ *
+ * @alpha
+ */
+type CentrifugeVault = {
+    chain: EthereumChain;
+    proxy: EvmContractAddress;
+    share: TokenMetadata;
+    funding: TokenMetadata;
 };
 /**
- * A curated sale window and the hand-authored copy that goes with it. Every
- * variant that runs such a campaign carries all three, validated; an Ondo swap
- * trades continuously, runs none, and carries none.
+ * The vaults an offer runs on, or why a chain could not be resolved: one
+ * entry per `vaultContracts` chain, in the offer's order.
+ *
+ * @alpha
  */
-type OfferEditorial = {
-    tagline: string;
-    bannerUrl: string;
-    startsAt: Date;
+type CentrifugeVaultResolution = {
+    type: 'resolved';
+    vault: CentrifugeVault;
+} | {
+    type: 'unresolved';
+    chain: OfferToken['chain'];
+    /** Which token the offer or the registry could not name. */
+    missing: 'share-token' | 'funding-token' | 'evm-chain';
 };
-declare const OfferEditorial: {
+/**
+ * Resolves each chain of a vault offer to its share and funding tokens.
+ *
+ * The offer names tokens by role and address only - the share token as
+ * `vault`, the coin it is paid in as `funding` - so `lookup` turns each into
+ * metadata. A function rather than a registry snapshot, so this module does
+ * not depend on where the metadata comes from.
+ *
+ * A chain whose tokens cannot be named is reported rather than dropped: its
+ * position cannot be read without the symbol, and a caller has to know it is
+ * not showing it. When a chain lists several funding tokens, the first one
+ * `lookup` knows wins - a vault is priced in one.
+ *
+ * @alpha
+ */
+declare function resolveCentrifugeVaults(offer: CentrifugeVaultOfferDetail, lookup: (token: OfferToken) => TokenMetadata | null): CentrifugeVaultResolution[];
+
+/** @alpha */
+type GetCentrifugeVaultStatusParams = {
+    /** Share token symbol of the vault, e.g. `deJTRSY`. */
+    symbol: AssetSymbol;
     /**
-     * `model` prefixes the field in the error (`'Offer'`, `'OfferDetail'`), so
-     * the same three checks name the payload that failed them.
+     * The chain whose proxy answers. Only chains this offer has a proxy on
+     * are accepted; the offer's `vault_contracts` lists them.
      */
-    fromDto: (dto: OfferEditorialDto, model: string) => OfferEditorial;
+    chain: EthereumChain;
 };
 /**
- * An offer as `GET /v1/offers` lists it: a union on {@link OfferType}, each
- * variant carrying only the fields that mean something for it. Narrow on
- * `type` before reading anything beyond {@link OfferBase} - an Ondo swap has
- * no `startsAt` to read, and the compiler says so.
+ * One wallet on one vault: what every position read and every claim is keyed
+ * by. There is no order id - a wallet has one pooled position per vault per
+ * direction.
+ *
+ * @alpha
  */
-type Offer = CoinListTokenSaleOffer | SuperstateSwapOffer | OndoSwapOffer;
-declare const Offer: {
-    fromDto: (dto: OfferDto) => Offer;
+type CentrifugeWalletParams = GetCentrifugeVaultStatusParams & {
     /**
-     * Maps a page of offers, dropping every offer whose `type` this SDK does not
-     * name. The same reasoning as {@link OfferToken.listFromDto}: a plain `.map`
-     * would throw out of `fromDto` and, through `PaginatedResponse.fromDto`,
-     * reject the whole page, so one offer of an unknown type would blank the
-     * grid for every offer beside it. A single offer fetched by id still
-     * throws, because there is nothing beside it to keep.
+     * The wallet whose position is read, or claimed for. A claim must then be
+     * broadcast from this same wallet: the proxy credits the sender.
      */
-    listFromDto: (dtos: OfferDto[]) => Offer[];
+    walletAddress: EvmWalletAddress;
 };
-type TokenRole = 'funding' | 'distribution' | 'swap';
-type OfferToken = {
-    role: TokenRole;
-    chain: Chain;
-    address: EvmContractAddress;
-};
-declare const OfferToken: {
-    fromDto: (dto: OfferTokenDto) => OfferToken;
-    /**
-     * Maps an offer's token list, dropping every token on a chain this SDK does
-     * not name. Frontline's chain registry runs ahead of {@link Chain}, and a
-     * plain `.map` would throw out of `Offer.fromDto` and, through
-     * `PaginatedResponse.fromDto`, reject the whole offers page - which is how
-     * one Base token blanked production's offers list. Dropping costs that
-     * token's metadata alone: `coinlist.tokens.get` takes an `EthereumChain`,
-     * so nobody could have looked it up anyway.
-     *
-     * Same shape as `TokenMetadata.fromRegistryDto`.
-     */
-    listFromDto: (dtos: OfferTokenDto[]) => OfferToken[];
-};
-
 /**
- * The cursor-paginated envelope every list endpoint returns.
+ * A chain read of one wallet on one vault. The vault is the resolved one:
+ * its proxy is what the views live on, and its tokens' decimals scale the
+ * amounts, so neither is read again.
  *
- * Generic in its item type, so each resource pairs it with its own item DTO
- * rather than declaring an envelope of its own.
- */
-interface PaginatedResponseDto<T> {
-    data: T[];
-    starting_after?: string;
-    starting_before?: string;
-}
-
-type Cursor = Newtype<string, 'Cursor'>;
-declare const Cursor: (value: string) => Cursor;
-interface PaginatedResponse<T> {
-    data: T[];
-    startingAfter: Cursor | null;
-    startingBefore: Cursor | null;
-}
-declare const PaginatedResponse: {
-    fromDto: <A, B>(dto: PaginatedResponseDto<A>, itemMapper: (item: A) => B) => PaginatedResponse<B>;
-    /**
-     * For a mapper that decides the page as a whole - one that drops items it
-     * cannot map, such as `Offer.listFromDto` - rather than item by item. The
-     * cursors are the wire's either way: dropping an item changes what the
-     * page holds, not where the next page starts.
-     */
-    fromDtoPage: <A, B>(dto: PaginatedResponseDto<A>, pageMapper: (items: A[]) => B[]) => PaginatedResponse<B>;
-};
-/**
- * Cursor-based pagination input used when requesting paginated API resources.
- * Set `after` or `before` to navigate relative to a known cursor, and `limit`
- * to control the maximum number of returned items.
- */
-interface PaginationParams {
-    before?: Cursor;
-    after?: Cursor;
-    limit?: number;
-}
-declare const PaginationParams: {
-    toQueryParams: (params: PaginationParams) => Record<string, QueryParamValue>;
-};
-
-type AssetDto = {
-    code: string;
-    fractional_digits: number;
-    id: string;
-    name: string;
-};
-
-type AssetId = Newtype<string, 'AssetId'>;
-declare const AssetId: (value: string) => AssetId;
-type AssetCode = Newtype<string, 'AssetCode'>;
-declare const AssetCode: (value: string) => AssetCode;
-type Asset = {
-    id: AssetId;
-    code: AssetCode;
-    name: string;
-    fractionalDigits: number;
-};
-declare const Asset: {
-    fromDto: (dto: AssetDto) => Asset;
-};
-
-type ParticipationStatusDto = 'prepared' | 'pending' | 'submitted' | 'completed' | 'failed' | 'remit_submitted' | 'remitted' | 'remit_failed';
-type ParticipationDto = {
-    object: 'participation';
-    id: string;
-    offer_id: string;
-    offer_option_id: string;
-    status: ParticipationStatusDto;
-    amount: string;
-    amount_string: string;
-    asset: AssetDto;
-    chain: string;
-    inserted_at: string | null | undefined;
-    updated_at: string | null | undefined;
-    wallet_address: string | null | undefined;
-};
-type CreateParticipationDto = {
-    offer_id: string;
-    offer_option_id: string;
-    chain: string;
-    wallet_address: string;
-    amount: string;
-    asset_id: string;
-    approval_transaction_hash: string | null | undefined;
-};
-
-/**
- * One variant per `OfferTypeDto`, the same split as `OfferDto` with what
- * `GET /v1/offers/:id` adds on top. Read `type` first.
+ * @alpha
  */
-type OfferDetailDto = CoinListTokenSaleOfferDetailDto | SuperstateSwapOfferDetailDto | OndoSwapOfferDetailDto;
-type CoinListTokenSaleOfferDetailDto = OfferDetailBaseDto & OfferEditorialDto & OfferDetailNoSwapContractsDto & {
-    type: 'coinlist::token_sale';
-    logo_url: string;
-};
-type SuperstateSwapOfferDetailDto = OfferDetailBaseDto & OfferEditorialDto & OfferDetailNoSwapContractsDto & {
-    type: 'superstate::swap';
-    logo_url: string | null;
-};
-type OndoSwapOfferDetailDto = OfferDetailBaseDto & OfferNoEditorialDto & {
-    type: 'ondo::swap';
-    logo_url: string | null;
-    /**
-     * Every chain this offer swaps on, with the contract each settles
-     * through. `[]` is an answer - "swaps nowhere" - and a missing key is not.
-     */
-    swap_contracts: OfferDetailSwapContractDto[];
+type ReadCentrifugePositionParams = {
+    vault: CentrifugeVault;
+    walletAddress: EvmWalletAddress;
 };
 /**
- * An offer that does not settle through a CoinList swap contract sends `[]`
- * or no key at all, and either way there is nothing to read. Declared so a
- * fixture can describe the real payload.
+ * What `POST /v1/centrifuge/vault/invest` is asked for: the wallet that will
+ * broadcast the request and fund it, plus the deposit.
+ *
+ * Built once, when the user confirms an amount. Broadcasting the result places
+ * a request; it does not buy shares.
+ *
+ * @alpha
  */
-type OfferDetailNoSwapContractsDto = {
-    swap_contracts?: OfferDetailSwapContractDto[];
-};
-type OfferDetailBaseDto = {
-    asset: AssetDto;
-    faqs: OfferDetailFaqDto[];
-    funding_assets: AssetDto[];
-    tokens: OfferTokenDto[];
-    id: string;
-    links: OfferDetailLinkDto[];
-    milestones: OfferDetailMilestoneDto[];
-    name: string;
-    object: 'offer_details';
-    options: OfferDetailOptionDto[];
-    slug: string;
-    terms: OfferDetailTermDto[];
-    about: string | null | undefined;
-    category: string;
-    ends_at: string | null;
-    /** Issuer of the *token*, not of the security it tracks. Ondo offers only. */
-    issuer: string | null;
-    /** ISO 6166 id of the underlying security. Null when the supplier has none. */
-    isin: string | null;
-    /** The underlying's symbol on its venue (`QQQ`), never the token's (`QQQon`). */
-    ticker: string | null;
-    /** Supplier vocabulary (`Stock`, `ETF`). Open set — display, do not branch. */
-    instrument_type: string | null;
-    /** Venue the underlying lists on. Not served by the supplier; entered by hand. */
-    listing_venue: string | null;
-};
-type OfferDetailFaqDto = {
-    answer: string | null;
-    question: string | null;
-};
-type OfferDetailLinkDto = {
-    label: string | null;
-    url: string | null;
-};
-type OfferDetailMilestoneDto = {
-    name: string | null;
-    schedule: string | null;
-    status: 'completed' | 'active' | 'upcoming';
-};
-type OfferDetailOptionDto = {
-    bid_increment: number | null;
-    floor_price_usd: number | null;
-    id: string;
-    minimum_purchase_usd: number | null;
-    price_usd: string | null;
-    sale_agreement_url: string | null;
-    slug: string;
-    total_token_supply: number | null;
-};
-type OfferDetailTermDto = {
-    key: string | null;
-    value: string | null;
-};
-type OfferDetailSwapContractDto = {
-    chain: string;
-    address: string;
+type BuildCentrifugeVaultBuyParams = CentrifugeWalletParams & {
+    /** How much of the funding token to deposit, in its base units. */
+    amount: BlockchainAmount;
 };
 
-type Ticker = Newtype<string, 'Ticker'>;
-declare const Ticker: (value: string) => Ticker;
 /**
- * An ISO 6166 International Securities Identification Number, e.g.
- * `US0378331005`. Identifies the security itself, which is what makes it the
- * stable key across venues where a {@link Ticker} is not: the same security
- * trades under different tickers in different places, and the same ticker
- * means different securities in different places.
+ * Centrifuge vault reads and claims: the vault-wide ordering gate, each
+ * wallet's position per direction, and the calldata that claims a filled
+ * request.
  *
- * Not validated on construction — the value comes from a supplier that has
- * already checked it, and a client-side check-digit test could only reject
- * data the SDK still has to display.
+ * The reads are free to poll - none spends an attestation, so a client may
+ * call them while the user sizes a deposit or waits on a fill.
+ *
+ * A vault trade settles in two legs: a request the fund fills on its own
+ * schedule, then a claim. There is no order id - each wallet has one pooled
+ * position per vault per direction - so the claims take a wallet, not an
+ * order, and collect everything claimable.
+ *
+ * The calldata builders are the exception: {@link CentrifugeNamespace.buildBuyTransaction}
+ * and the claims are each called once, when the user confirms, and never on a
+ * timer. Broadcasting the buy calldata places a request. It does not buy
+ * shares.
+ *
+ * Every Frontline method requires `AuthState === 'logged-in'` and throws
+ * {@link NotAuthenticatedError} otherwise.
+ * {@link CentrifugeNamespace.readDepositPosition} and
+ * {@link CentrifugeNamespace.readRedeemPosition} read the proxy over RPC and
+ * do not; through CoinList's RPC proxy a logged-out read fails with its 401.
+ *
+ * @alpha
  */
-type Isin = Newtype<string, 'Isin'>;
-declare const Isin: (value: string) => Isin;
-type OrderBookSide = 'buy' | 'sell';
-
-type CoinListTokenSaleOfferDetail = OfferDetailBase & OfferEditorial & {
-    type: 'coinlist::token_sale';
-    logoUrl: string;
-};
-type SuperstateSwapOfferDetail = OfferDetailBase & OfferEditorial & {
-    type: 'superstate::swap';
-    /** Null when nobody has uploaded artwork: a swap publishes without it. */
-    logoUrl: string | null;
-};
-type OndoSwapOfferDetail = OfferDetailBase & {
-    type: 'ondo::swap';
-    /** Null when nobody has uploaded artwork: a swap publishes without it. */
-    logoUrl: string | null;
-    /**
-     * Every chain this offer can be swapped on, with the CoinList contract each
-     * settles through. Empty means it cannot be swapped anywhere.
-     */
-    swapContracts: OfferSwapContract[];
-};
-type OfferDetailBase = {
-    id: OfferId;
-    slug: OfferSlug;
-    name: string;
-    asset: Asset;
-    fundingAssets: Asset[];
-    tokens: OfferToken[];
-    about: string | null;
-    category: string;
+interface CentrifugeNamespace {
+    getVaultStatus(params: GetCentrifugeVaultStatusParams): Promise<CentrifugeVaultStatus>;
     /**
-     * The legal issuer of the *token*, e.g. `'Ondo Global Markets'`. The issuer
-     * of the security it tracks is {@link OfferDetail.name} (`'Apple Inc.'`).
-     * Null on offers with no single named issuer.
+     * The wallet's Deposit (buy) standing on the vault: funding token still
+     * queued, and funding token filled and ready to claim. A wallet that has
+     * never touched the vault reads as zeroes.
      */
-    issuer: string | null;
+    readDepositPosition(params: ReadCentrifugePositionParams): Promise<CentrifugeDepositPosition>;
     /**
-     * ISO 6166 identifier of the underlying security, e.g. `'US0378331005'`.
-     * Null both on offers that tokenize no security and on the few that do but
-     * whose supplier publishes no ISIN, so absence does not imply "not a
-     * security".
+     * The wallet's Redeem (sell) standing on the vault: shares still queued,
+     * and shares filled and ready to claim.
      */
-    isin: Isin | null;
+    readRedeemPosition(params: ReadCentrifugePositionParams): Promise<CentrifugeRedeemPosition>;
     /**
-     * The underlying security's symbol on its listing venue, e.g. `'QQQ'`. This
-     * is *not* the token's symbol — that is `asset.code` (`'QQQon'`). Null on
-     * offers that tokenize no listed security.
+     * Calldata claiming every claimable share. Broadcast it from
+     * `params.walletAddress`: the proxy credits the sender.
      */
-    ticker: Ticker | null;
+    createClaim(params: CentrifugeWalletParams): Promise<CentrifugeVaultClaimTransaction>;
     /**
-     * What kind of instrument the underlying is, as the supplier classifies it:
-     * `'Stock'`, `'ETF'`. Distinct from {@link OfferDetail.category}, which is
-     * the broader class the offer is grouped under (`'Equities'`) — this field
-     * describes the single instrument, `category` describes the shelf it sits
-     * on.
+     * Calldata paying out every claimable redemption in the funding token.
+     * Broadcast it from `params.walletAddress`.
      *
-     * An open set: the vocabulary belongs to the supplier and may grow without
-     * notice, so render an unrecognized value rather than branching on it. Note
-     * the supplier's spelling is its own — a common stock arrives as `'Stock'`.
+     * TODO(frontline, ENG-1909): built against a guessed endpoint.
      */
-    instrumentType: string | null;
+    createClaimProceeds(params: CentrifugeWalletParams): Promise<CentrifugeVaultClaimProceedsTransaction>;
     /**
-     * The exchange the underlying security lists on, e.g. `'NASDAQ'`. Not
-     * derivable from {@link OfferDetail.isin}, whose country prefix is the
-     * country of issuance rather than the venue.
+     * Builds the calldata that places a deposit request.
      *
-     * Unlike the fields above, this one is recorded by hand rather than served
-     * by the supplier, so it is null until someone records it — on a newly
-     * listed offer that is the normal state, and it says nothing about whether
-     * the offer tokenizes a security.
+     * Called once on confirmation. The reads above are the ones a checkout polls.
      */
-    listingVenue: string | null;
-    endsAt: Date | null;
-    faqs: FaqItem[];
-    links: Link[];
-    milestones: Milestone[];
-    options: OfferOption[];
-    terms: TermItem[];
-};
-type OfferOptionId = Newtype<string, 'OfferOptionId'>;
-declare const OfferOptionId: (value: string) => OfferOptionId;
-type OfferOptionSlug = Newtype<string, 'OfferOptionSlug'>;
-declare const OfferOptionSlug: (value: string) => OfferOptionSlug;
-/**
- * A chain an offer can be swapped on, with the CoinList contract the swap
- * settles through - the spender to approve before any quote exists.
- *
- * Carries no role, unlike {@link OfferToken}: there is one swap contract per
- * chain and it serves every Ondo asset on it, so which token is being traded
- * does not change the answer.
- */
-type OfferSwapContract = {
-    chain: Chain;
-    address: EvmContractAddress;
-};
-declare const OfferSwapContract: {
-    fromDto: (dto: OfferDetailSwapContractDto) => OfferSwapContract;
-};
+    buildBuyTransaction(params: BuildCentrifugeVaultBuyParams): Promise<CentrifugeVaultBuyTransaction>;
+}
+
+type Cursor = Newtype<string, 'Cursor'>;
+declare const Cursor: (value: string) => Cursor;
 /**
- * An offer as `GET /v1/offers/:id` serves it: the same union on `type` as
- * {@link Offer}, each variant carrying only the fields that mean something
- * for it. Narrow on `type` before reading anything beyond
- * {@link OfferDetailBase}.
+ * Cursor-based pagination input used when requesting paginated API resources.
+ * Set `after` or `before` to navigate relative to a known cursor, and `limit`
+ * to control the maximum number of returned items.
  */
-type OfferDetail = CoinListTokenSaleOfferDetail | SuperstateSwapOfferDetail | OndoSwapOfferDetail;
-declare const OfferDetail: {
-    fromDto: (dto: OfferDetailDto) => OfferDetail;
-};
-type OfferOption = {
-    id: OfferOptionId;
-    slug: OfferOptionSlug;
-    bidIncrement: number | null;
-    floorPriceUsd: number | null;
-    minimumPurchaseUsd: number | null;
-    priceUsd: string | null;
-    saleAgreementUrl: string | null;
-    totalTokenSupply: number | null;
-};
-declare const OfferOption: {
-    fromDto: (dto: OfferDetailOptionDto) => OfferOption;
-};
-type FaqItem = {
-    question: string | null;
-    answer: string | null;
-};
-declare const FaqItem: {
-    fromDto: (dto: OfferDetailFaqDto) => FaqItem;
-};
-type Link = {
-    label: string | null;
-    url: string | null;
-};
-declare const Link: {
-    fromDto: (dto: OfferDetailLinkDto) => Link;
-};
-type TermItem = {
-    key: string | null;
-    value: string | null;
-};
-declare const TermItem: {
-    fromDto: (dto: OfferDetailTermDto) => TermItem;
-};
-type Milestone = {
-    name: string | null;
-    schedule: string | null;
-    status: 'completed' | 'active' | 'upcoming';
-};
-declare const Milestone: {
-    fromDto: (dto: OfferDetailMilestoneDto) => Milestone;
-};
+interface PaginationParams {
+    before?: Cursor;
+    after?: Cursor;
+    limit?: number;
+}
+interface PaginatedResponse<T> {
+    data: T[];
+    startingAfter: Cursor | null;
+    startingBefore: Cursor | null;
+}
 
 /** Unique identifier for a participation. */
 type ParticipationId = Newtype<string, 'ParticipationId'>;
@@ -1709,14 +1016,7 @@ type WalletAddress = Newtype<`0x${string}`, 'WalletAddress'>;
 /** Casts a `0x`-prefixed string into a typed {@link WalletAddress}. */
 declare const WalletAddress: (value: `0x${string}`) => WalletAddress;
 /** Possible participation lifecycle states returned by the API. */
-type ParticipationStatus = ParticipationStatusDto;
-/** Pagination params for listing participations, with an optional offer filter. */
-interface ParticipationsPaginationParams extends PaginationParams {
-    offerId?: OfferId;
-}
-declare const ParticipationsPaginationParams: {
-    toQueryParams: (params: ParticipationsPaginationParams) => Record<string, QueryParamValue>;
-};
+type ParticipationStatus = 'prepared' | 'pending' | 'submitted' | 'completed' | 'failed' | 'remit_submitted' | 'remitted' | 'remit_failed';
 /** Domain model for a participation returned by CoinList APIs. */
 type Participation = {
     /** Unique participation id. */
@@ -1742,10 +1042,6 @@ type Participation = {
     /** Wallet used for participation, blank values normalized to null. */
     walletAddress: WalletAddress | null;
 };
-declare const Participation: {
-    /** Maps API DTO shape into the SDK participation domain model. */
-    fromDto: (dto: ParticipationDto) => Participation;
-};
 /** Parameters required to create a new participation. */
 type CreateParticipationParams = {
     /** Offer to participate in. */
@@ -1771,10 +1067,10 @@ type CreateParticipationParams = {
      */
     approvalTransactionHash: string;
 };
-declare const CreateParticipationParams: {
-    /** Maps participation creation params into API DTO payload. */
-    toDto: (params: CreateParticipationParams) => CreateParticipationDto;
-};
+/** Pagination params for listing participations, with an optional offer filter. */
+interface ParticipationsPaginationParams extends PaginationParams {
+    offerId?: OfferId;
+}
 
 /**
  * Read/write operations for token sales: listing and reading the current user's
@@ -1812,377 +1108,6 @@ interface CoinListTokenSaleNamespace {
      */
     createParticipation(params: CreateParticipationParams): Promise<Participation>;
 }
-declare class CoinListTokenSaleNamespaceImpl implements CoinListTokenSaleNamespace {
-    private readonly ctx;
-    protected readonly log: InternalLogger;
-    constructor(ctx: UniversalNamespaceContext);
-    list(offerId?: OfferId): Promise<Participation[]>;
-    listPage(params: ParticipationsPaginationParams): Promise<PaginatedResponse<Participation>>;
-    get(id: ParticipationId): Promise<Participation>;
-    createParticipation(params: CreateParticipationParams): Promise<Participation>;
-}
-
-/**
- * No `chain` on the read params: Ondo runs no sandbox, so every environment
- * prices against Ondo production on Ethereum mainnet. Accepting a chain would
- * let a caller ask for Sepolia and silently receive mainnet pricing.
- * {@link BuildOndoSwapTransactionParams} is the exception, and says why.
- */
-type GetOndoTradingStatusParams = {
-    symbol: AssetSymbol;
-    /**
-     * Required, and deliberately not defaulted: `tradable` and both order caps
-     * describe this side only. Guessing `buy` would hand buy caps to someone
-     * sizing a sell. The endpoint answers 422 without it.
-     */
-    side: OrderBookSide;
-};
-/** How long Ondo should hold the price. Omit to take Ondo's own default. */
-type OndoQuoteDuration = 'short' | 'long';
-/**
- * A quote is sized by the quantity or by the dollar amount. The endpoint takes
- * exactly one; `getOndoQuote` sends whichever is present.
- */
-type OndoQuoteSize = {
-    tokenAmount: BlockchainAmount;
-} | {
-    notionalValue: DecimalString;
-};
-type GetOndoQuoteParams = {
-    symbol: AssetSymbol;
-    side: OrderBookSide;
-    duration?: OndoQuoteDuration;
-} & OndoQuoteSize;
-/**
- * What both builders take, before the one field whose meaning forks.
- *
- * There is no funding token and no asset here - frontline resolves both from
- * the offer, because Ninshubur signs a request bound to them and a caller that
- * could name them could have CoinList sign for a contract of its own. Which
- * endpoint was called is what says which of the two `amount` counts.
- *
- * `chain` is required although the read params refuse it, because these name a
- * real contract on a real chain rather than asking Ondo for a price.
- */
-type BuildOndoSwapParamsCore = {
-    symbol: AssetSymbol;
-    chain: EthereumChain;
-    /**
-     * The wallet that will *send* the transaction, and that receives the other
-     * token. The calldata is signed over it, so a transaction built for one
-     * wallet and broadcast by another reverts.
-     */
-    walletAddress: EvmWalletAddress;
-};
-/**
- * What it takes to turn an indicative price into signed, fillable calldata for
- * a purchase: `POST /v1/ondo/swap/buy`.
- *
- * Separate from {@link BuildOndoSellParams} although the fields match today,
- * because `amount` is denominated in a different token on each - which is
- * frontline's own reason for splitting the endpoint rather than taking a
- * `side`. Sharing one type would re-merge the distinction the split exists to
- * make, and the two will diverge the day either side gains a knob.
- */
-type BuildOndoBuyParams = BuildOndoSwapParamsCore & {
-    /**
-     * The **gross** deposit, in the base units of the funding token - the coin
-     * the user chose and approved.
-     *
-     * Sized by `amount` alone, with no `notionalValue` alternative: the calldata
-     * authorises a specific ERC-20 pull, so the number that ends up on chain has
-     * to be the number the caller meant rather than one derived from a dollar
-     * figure. CoinList's fee comes off it, and Ondo prices the remainder.
-     *
-     * Its `decimals` are also what the response's `spend_input_decimals` is
-     * checked against: frontline resolves the funding token from the offer
-     * rather than from this request, so the two are independent answers to the
-     * same question and a disagreement means the wrong token was sized.
-     */
-    amount: BlockchainAmount;
-};
-/**
- * What it takes to turn an indicative price into signed, fillable calldata for
- * a sale: `POST /v1/ondo/swap/sell`.
- *
- * See {@link BuildOndoBuyParams} for why this is its own type.
- */
-type BuildOndoSellParams = BuildOndoSwapParamsCore & {
-    /**
-     * The quantity of the **asset** to sell, in the asset's own base units - not
-     * in the funding token's, which is the same integer meaning something 1e12
-     * different.
-     *
-     * This is the figure the wallet must have approved: a sale delivers the
-     * asset, so the swap contract pulls it with `transferFrom` exactly as it
-     * pulls the deposit on a purchase.
-     *
-     * Its `decimals` are checked against the response's `spend_input_decimals`,
-     * which frontline reads on-chain from the asset on `chain`. The SDK's own
-     * answer comes from the quote, which resolves the asset on Ethereum mainnet,
-     * so on a testnet these are two independent resolutions of two different
-     * contracts - and the check is what says so.
-     */
-    amount: BlockchainAmount;
-};
-
-/**
- * Raw JSON models for the Ondo swap endpoints, mirroring
- * `OndoSwapTradingStatus`, `OndoSwapQuote`, `OndoSwapBuy` and `OndoSwapSell`
- * in frontline's OpenAPI schema. The two GETs are free to poll: neither spends
- * an attestation, so a client may call them while the user edits an order. The
- * two POSTs are not - each spends one and hands back signed calldata with a
- * deadline.
- *
- * **One endpoint per side, and therefore one model per side.** The reads take
- * a `side` and answer the same shape either way, so they stay single. The
- * writes do not: a buy commits to an exact quantity, a sell to a range with a
- * floor beneath it, and `amount` is the funding token on one and the asset on
- * the other. Only the transport fields mean the same thing on both.
- * `POST /v1/ondo/swap/transaction` survives as a deprecated alias of the buy
- * under the old `pay_input_*` names; the SDK does not call it.
- *
- * Neither GET takes a `chain`. Ondo runs no sandbox, so every environment
- * prices against Ondo production on Ethereum mainnet. The POSTs do carry one:
- * they target a real contract, which on every environment but production is
- * the Sepolia one with the mocked attestation.
- */
-/**
- * Whether an asset can be traded right now, and the caps if so.
- *
- * Every cap is a *human decimal* string and is nullable — Ondo answers a
- * restricted `/v1/limits/*` with a 403, which frontline turns into
- * `tradable: false` and three nulls rather than an error. A null cap therefore
- * means **Ondo restricted the asset, not that the cap is unlimited**. The
- * response carries no `asset_decimals`, so there is nothing to scale
- * `gross_max_tokens` by.
- *
- * There is no `reason` field. A restriction surfaces only as `tradable: false`
- * plus the nulls; frontline keeps Ondo's reason codes to its own admin surface
- * and does not forward them.
- */
-type OndoTradingStatusDto = {
-    object: 'ondo_swap_trading_status';
-    /** The `side` the request asked for, echoed back. */
-    side: 'buy' | 'sell';
-    /** For `side` only — an asset can be sellable while not buyable. */
-    tradable: boolean;
-    /** Whole tokens, for `side` only. E.g. `"100.000000000000000000"`. */
-    gross_max_tokens: string | null;
-    /** USD, for `side` only. E.g. `"1234.560000000000000000"`. */
-    gross_max_notional_value: string | null;
-    /**
-     * USD cap for the session the market is currently in, e.g. `"200000"`.
-     * Unlike the two above this comes from Ondo's sideless session endpoint, so
-     * it applies across buys and sells together.
-     */
-    gross_max_active_notional_value: string | null;
-};
-/** An indicative, size- and side-aware price for an Ondo asset. */
-type OndoQuoteDto = {
-    object: 'ondo_swap_quote';
-    /** EIP-155 chain id. Always `"1"`, per the no-sandbox note above. */
-    chain_id: string;
-    symbol: string;
-    /** Ticker of the underlying security, e.g. `"AAPL"` for `"AAPLon"`. */
-    ticker: string;
-    asset_address: string;
-    /** Decimals of the `asset_address` contract. Scales `token_base_units`. */
-    asset_decimals: number;
-    side: 'buy' | 'sell';
-    /**
-     * Quantity of the asset in its smallest unit, as a raw uint256 string:
-     * `"5000000000000000000"` is 5 tokens at 18 decimals. Map it with
-     * `blockchainAmountFromRawOrThrow`, not `parseBlockchainAmountOrThrow`.
-     *
-     * Not to be confused with the `token_amount` *request* parameter, which is
-     * the same quantity in whole tokens. Ondo names both `tokenAmount`, 1e18
-     * apart, so echoing one back as the other is a real hazard.
-     */
-    token_base_units: string;
-    /**
-     * USD price of one whole token as a human decimal string, e.g.
-     * `"225.273151158540753535"`. Already scaled, so it needs none of the
-     * handling `token_base_units` does.
-     */
-    price: string;
-};
-/**
- * The transport half of a built swap, identical on both sides.
- *
- * `spend_input_amount` is the only key here whose *token* depends on the side,
- * and `spend_input_decimals` is what says at what scale. Everything below this
- * point differs, which is why the two responses are two types rather than one
- * with nullable halves.
- *
- * There is no `object` envelope and no `side` echo. `action` says what to do
- * with the body, matching `AllowWalletResponseDto`; which trade it encodes is
- * settled by the endpoint that was called, so nothing on the wire has to say
- * it and nothing has to be checked against it.
- */
-type OndoSwapDtoCore = {
-    action: 'broadcast_transaction';
-    /** The swap contract the transaction is sent to. */
-    to: string;
-    /** ABI-encoded `swap(...)` calldata. Broadcast verbatim - never re-encode it. */
-    data: string;
-    /**
-     * When the signed calldata stops being accepted - RFC3339, e.g.
-     * `"2026-08-13T23:04:12Z"`. This is Ninshubur's `expiration`, which signs
-     * the same instant as the EIP-712 `deadline` in the calldata, so a
-     * transaction broadcast after it reverts.
-     */
-    expires_at: string;
-    /**
-     * Gross amount the wallet spends, echoing the requested `amount`, in the
-     * smallest unit of the token this side spends - the funding token on a buy,
-     * the asset on a sell. The approval is compared against this.
-     *
-     * Named `pay_input_amount` on the deprecated
-     * `POST /v1/ondo/swap/transaction`. `pay` was accurate only while a buy was
-     * the sole thing this could encode: a sell delivers the asset rather than
-     * paying for one.
-     */
-    spend_input_amount: string;
-    /**
-     * Decimals `spend_input_amount` is counted in.
-     *
-     * Frontline reads it on-chain from the token the side spends, which it
-     * resolves from the offer rather than from anything the caller sent. That
-     * makes it the only published scale for a token the request never names -
-     * and an independent answer to the one the SDK derived when it sized the
-     * order, which is why both builders compare the two.
-     *
-     * **The same key, two scales.** It counts whichever token the side spends:
-     * the funding token's 6 on a buy, the asset's 18 on a sell. Worth knowing
-     * before integrating against both.
-     */
-    spend_input_decimals: number;
-};
-/**
- * Signed, ready-to-broadcast calldata for a purchase, and the amounts it
- * commits to: `POST /v1/ondo/swap/buy`.
- *
- * Unlike {@link OndoQuoteDto} this **spends an attestation**, so it is not
- * pollable: one call per order, plus one per user-requested refresh. Frontline
- * also reads the wallet's allowance on the funding token before asking
- * Ninshubur for anything, so an unapproved wallet is refused here rather than
- * reverting on chain.
- *
- * The quantity is attested and exact, with no floor beneath it, which is what
- * separates a buy from an {@link OndoSellDto}.
- *
- * **Carries no identity and no price.** No `chain_id`, `symbol`, `ticker` or
- * `price` - the request named the first few and frontline drops Ninshubur's
- * `price` deliberately, because `GET /v1/ondo/swap/quote` already publishes
- * one under that name at a different scale. Anything the UI needs beyond the
- * amounts comes from that GET or from the offer.
- *
- * Two scales are on the wire: `fee` and `notional_value` are in
- * `spend_input_decimals`, and `receive_output_amount` is in
- * `receive_output_decimals`. Neither is interchangeable with the quote's
- * `asset_decimals`, which answers for a different number.
- */
-type OndoBuyDto = OndoSwapDtoCore & {
-    /**
-     * CoinList's cut of `spend_input_amount`, in the same units. `"0"` until
-     * ENG-1718 turns a fee on - frontline rejects a non-zero one today.
-     *
-     * Taken at execution rather than added on top, so the wallet never approves
-     * more than `spend_input_amount`.
-     */
-    fee: string;
-    /**
-     * `spend_input_amount` less `fee`, in `spend_input_decimals`: the part that
-     * reaches Ondo, what the quantity was priced against, and what the
-     * signature commits to.
-     */
-    notional_value: string;
-    /**
-     * Quantity of the asset the wallet receives, in the asset's smallest unit.
-     * Scale it by `receive_output_decimals`, not by the funding token's and not
-     * by {@link OndoQuoteDto}'s `asset_decimals`.
-     */
-    receive_output_amount: string;
-    /**
-     * Decimals `receive_output_amount` is counted in.
-     *
-     * Reported by whatever priced the quantity, rather than looked up from the
-     * asset. That is not the same number as {@link OndoQuoteDto}'s
-     * `asset_decimals`, which frontline resolves from its own catalogue: the two
-     * are allowed to disagree, and only this one answers for the quantity in
-     * this response.
-     */
-    receive_output_decimals: number;
-};
-/**
- * Signed, ready-to-broadcast calldata for a sale, and the range it commits to:
- * `POST /v1/ondo/swap/sell`.
- *
- * Like {@link OndoBuyDto} it **spends an attestation** and expires, so it is
- * called once on confirmation and never on a timer. Frontline reads the
- * wallet's allowance on the **asset** before signing - a sell delivers it -
- * and refuses a short one with a 422 naming that address.
- *
- * **A sell commits to a range rather than a quantity.** Ondo settles through
- * USDon before converting to the settlement token, so the response publishes
- * what to expect and the floor the calldata enforces, each with the fee
- * charged at it. There is no `notional_value`: a sell commits on the output
- * side, so there is no fee-exclusive input to report and frontline declines to
- * relate numbers Ninshubur did not relate.
- *
- * All four amounts below are in `receive_output_decimals`. The one amount that
- * is not is `spend_input_amount`, in `spend_input_decimals` - see
- * {@link OndoSwapDtoCore}.
- *
- * One thing the response does not say, and the calldata does: the floor signed
- * into `data` is **gross** of CoinList's fee, so a caller decoding it finds a
- * larger number than `minimum_quantity`. Both are correct; `minimum_quantity`
- * is what the wallet actually receives.
- */
-type OndoSellDto = OndoSwapDtoCore & {
-    /**
-     * CoinList's cut at the expected outcome, in the settlement token. Already
-     * deducted from `expected_quantity` rather than charged on top of it.
-     *
-     * `"0"` until ENG-1718 turns a fee on - frontline rejects a non-zero one on
-     * either side today.
-     */
-    expected_fee: string;
-    /**
-     * What the sale is expected to return, **net of `expected_fee`**, in the
-     * settlement token's smallest unit.
-     *
-     * An expectation rather than a guarantee. What the contract enforces is
-     * {@link OndoSellDto.minimum_quantity}.
-     */
-    expected_quantity: string;
-    /**
-     * CoinList's cut at the floor, in the same units.
-     *
-     * A different number from `expected_fee` because the two are charged on
-     * different amounts - which is why frontline publishes both rather than one.
-     * This is the one to disclose worst-case cost with.
-     */
-    minimum_fee: string;
-    /**
-     * The least the wallet can receive, **net of `minimum_fee`**, in the same
-     * units. Below it the transaction reverts on chain.
-     *
-     * Frontline guarantees it is at most `expected_quantity` and greater than
-     * zero. The settlement lands somewhere between the two.
-     */
-    minimum_quantity: string;
-    /**
-     * Decimals both quantities and both fees are counted in, reported by
-     * whatever priced them rather than looked up from the token.
-     *
-     * Not the same number as {@link OndoQuoteDto}'s `asset_decimals`, which
-     * answers for the asset being sold rather than for the coin the proceeds
-     * arrive in.
-     */
-    receive_output_decimals: number;
-};
 
 /**
  * Whether an Ondo asset can be traded right now.
@@ -2213,9 +1138,6 @@ type OndoTradingStatus = {
     type: 'not-tradable';
     side: OrderBookSide;
 };
-declare const OndoTradingStatus: {
-    fromDto: (dto: OndoTradingStatusDto) => OndoTradingStatus;
-};
 /**
  * An indicative price for an Ondo asset, free to poll while the user edits an
  * order.
@@ -2262,9 +1184,6 @@ type OndoQuote = {
      */
     price: DecimalString;
 };
-declare const OndoQuote: {
-    fromDto: (dto: OndoQuoteDto) => OndoQuote;
-};
 /**
  * The half of a built swap that both sides share: the calldata, its deadline,
  * and what the wallet parts with.
@@ -2349,9 +1268,6 @@ type OndoBuyTransaction = OndoSwapTransactionCore & {
      */
     receiveOutputAmount: BlockchainAmount;
 };
-declare const OndoBuyTransaction: {
-    fromDto: (dto: OndoBuyDto) => OndoBuyTransaction;
-};
 /**
  * One end of the range a sale commits to: what arrives, and what CoinList took
  * to get it there.
@@ -2407,112 +1323,230 @@ type OndoSellTransaction = OndoSwapTransactionCore & {
      */
     minimum: OndoSellOutcome;
 };
-declare const OndoSellTransaction: {
-    fromDto: (dto: OndoSellDto) => OndoSellTransaction;
-};
 
 /**
- * Ondo swap reads, plus the write that turns one into a fillable transaction.
- *
- * The two reads are free to poll - neither spends an attestation, so a client
- * may call them while the user edits an order. The two builders are not:
- * budget one call per order placed, plus one per refresh the user asks for.
- *
- * **One builder per side, mirroring the endpoints.** A purchase and a sale
- * agree on how to broadcast and on nothing else: a purchase commits to an
- * exact quantity, a sale to a range with a floor beneath it, and `amount` is
- * the funding token on one and the asset on the other. A single method taking
- * a `side` would have to return a union the caller then re-narrows, having
- * already decided which trade it was placing.
- *
- * **No CoinList fee is applied to a read quote, and no read discloses one.**
- * Ondo prices exactly the amount passed. A CoinList approval is fee-inclusive,
- * so sizing a quote against a user's approval without subtracting the fee
- * first overstates what they receive. A built transaction carries the fee
- * explicitly, and it is zero until one lands (ENG-1718).
- *
- * Every method requires `AuthState === 'logged-in'` and throws
- * {@link NotAuthenticatedError} otherwise.
+ * No `chain` on the read params: Ondo runs no sandbox, so every environment
+ * prices against Ondo production on Ethereum mainnet. Accepting a chain would
+ * let a caller ask for Sepolia and silently receive mainnet pricing.
+ * {@link BuildOndoSwapTransactionParams} is the exception, and says why.
  */
-interface OndoNamespace {
-    getTradingStatus(params: GetOndoTradingStatusParams): Promise<OndoTradingStatus>;
-    getQuote(params: GetOndoQuoteParams): Promise<OndoQuote>;
-    /**
-     * Builds a purchase for a specific wallet and deposit: spends an attestation
-     * and returns calldata to broadcast, valid until
-     * {@link OndoBuyTransaction.expiresAt}.
-     *
-     * The wallet must have approved the swap contract to spend `amount` of the
-     * offer's **funding token** first. Frontline reads that allowance before
-     * asking Ninshubur for anything, and rejects a short one with a 422 carrying
-     * `code: "insufficient_allowance"`. See `prepareBuy` on the client
-     * namespace, which approves and then builds, in that order.
-     *
-     * The tokens themselves are the offer's rather than the caller's to name.
-     */
-    buildBuyTransaction(params: BuildOndoBuyParams): Promise<OndoBuyTransaction>;
+type GetOndoTradingStatusParams = {
+    symbol: AssetSymbol;
     /**
-     * Builds a sale for a specific wallet and quantity: spends an attestation
-     * and returns calldata to broadcast, valid until
-     * {@link OndoSellTransaction.expiresAt}.
-     *
-     * The approval this one needs is on the **asset**, not on a stablecoin - a
-     * sale delivers the asset, so the swap contract pulls it with `transferFrom`
-     * exactly as it pulls the deposit on a purchase. Same 422 when it is short,
-     * with a message naming that address. See `prepareSell` on the client
-     * namespace.
-     *
-     * Returns a range rather than a quantity: Ondo settles through USDon before
-     * converting to the settlement token, so disclose
-     * {@link OndoSellTransaction.minimum} and not only `expected`.
+     * Required, and deliberately not defaulted: `tradable` and both order caps
+     * describe this side only. Guessing `buy` would hand buy caps to someone
+     * sizing a sell. The endpoint answers 422 without it.
      */
-    buildSellTransaction(params: BuildOndoSellParams): Promise<OndoSellTransaction>;
-}
-declare class OndoNamespaceImpl implements OndoNamespace {
-    private readonly ctx;
-    protected readonly log: InternalLogger;
-    constructor(ctx: UniversalNamespaceContext);
-    getTradingStatus(params: GetOndoTradingStatusParams): Promise<OndoTradingStatus>;
-    getQuote(params: GetOndoQuoteParams): Promise<OndoQuote>;
-    buildBuyTransaction(params: BuildOndoBuyParams): Promise<OndoBuyTransaction>;
-    buildSellTransaction(params: BuildOndoSellParams): Promise<OndoSellTransaction>;
-}
-
+    side: OrderBookSide;
+};
+/** How long Ondo should hold the price. Omit to take Ondo's own default. */
+type OndoQuoteDuration = 'short' | 'long';
 /**
- * Raw JSON models for the Superstate swap endpoints that are still backend
- * calls.
- *
- * The contract *reads* no longer have DTOs: the SDK calls `status()`,
- * `preview()`, `authorized()` and `outputToken()` on-chain through
- * `@/universal/api/rpc`, so their wire shape is the ABI rather than JSON.
- * Allow-listing a wallet stays here because it is a backend write, not a read.
+ * A quote is sized by the quantity or by the dollar amount. The endpoint takes
+ * exactly one; `getOndoQuote` sends whichever is present.
  */
-type AllowWalletResponseDto = {
-    action: 'broadcast_transaction';
-    to: string;
-    data: string;
+type OndoQuoteSize = {
+    tokenAmount: BlockchainAmount;
 } | {
-    action: 'none';
-    already_allowed: boolean;
+    notionalValue: DecimalString;
 };
-
+type GetOndoQuoteParams = {
+    symbol: AssetSymbol;
+    side: OrderBookSide;
+    duration?: OndoQuoteDuration;
+} & OndoQuoteSize;
 /**
- * A read-only quote for a swap: how much goes in, the protocol fee, and how
- * much would come out. All amounts are raw on-chain integers (uint256).
- */
-type SwapPreview = {
+ * What both builders take, before the one field whose meaning forks.
+ *
+ * There is no funding token and no asset here - frontline resolves both from
+ * the offer, because Ninshubur signs a request bound to them and a caller that
+ * could name them could have CoinList sign for a contract of its own. Which
+ * endpoint was called is what says which of the two `amount` counts.
+ *
+ * `chain` is required although the read params refuse it, because these name a
+ * real contract on a real chain rather than asking Ondo for a price.
+ */
+type BuildOndoSwapParamsCore = {
+    symbol: AssetSymbol;
+    chain: EthereumChain;
+    /**
+     * The wallet that will *send* the transaction, and that receives the other
+     * token. The calldata is signed over it, so a transaction built for one
+     * wallet and broadcast by another reverts.
+     */
+    walletAddress: EvmWalletAddress;
+};
+/**
+ * What it takes to turn an indicative price into signed, fillable calldata for
+ * a purchase: `POST /v1/ondo/swap/buy`.
+ *
+ * Separate from {@link BuildOndoSellParams} although the fields match today,
+ * because `amount` is denominated in a different token on each - which is
+ * frontline's own reason for splitting the endpoint rather than taking a
+ * `side`. Sharing one type would re-merge the distinction the split exists to
+ * make, and the two will diverge the day either side gains a knob.
+ */
+type BuildOndoBuyParams = BuildOndoSwapParamsCore & {
+    /**
+     * The **gross** deposit, in the base units of the funding token - the coin
+     * the user chose and approved.
+     *
+     * Sized by `amount` alone, with no `notionalValue` alternative: the calldata
+     * authorises a specific ERC-20 pull, so the number that ends up on chain has
+     * to be the number the caller meant rather than one derived from a dollar
+     * figure. CoinList's fee comes off it, and Ondo prices the remainder.
+     *
+     * Its `decimals` are also what the response's `spend_input_decimals` is
+     * checked against: frontline resolves the funding token from the offer
+     * rather than from this request, so the two are independent answers to the
+     * same question and a disagreement means the wrong token was sized.
+     */
+    amount: BlockchainAmount;
+};
+/**
+ * What it takes to turn an indicative price into signed, fillable calldata for
+ * a sale: `POST /v1/ondo/swap/sell`.
+ *
+ * See {@link BuildOndoBuyParams} for why this is its own type.
+ */
+type BuildOndoSellParams = BuildOndoSwapParamsCore & {
+    /**
+     * The quantity of the **asset** to sell, in the asset's own base units - not
+     * in the funding token's, which is the same integer meaning something 1e12
+     * different.
+     *
+     * This is the figure the wallet must have approved: a sale delivers the
+     * asset, so the swap contract pulls it with `transferFrom` exactly as it
+     * pulls the deposit on a purchase.
+     *
+     * Its `decimals` are checked against the response's `spend_input_decimals`,
+     * which frontline reads on-chain from the asset on `chain`. The SDK's own
+     * answer comes from the quote, which resolves the asset on Ethereum mainnet,
+     * so on a testnet these are two independent resolutions of two different
+     * contracts - and the check is what says so.
+     */
+    amount: BlockchainAmount;
+};
+
+/**
+ * Ondo swap reads, plus the write that turns one into a fillable transaction.
+ *
+ * The two reads are free to poll - neither spends an attestation, so a client
+ * may call them while the user edits an order. The two builders are not:
+ * budget one call per order placed, plus one per refresh the user asks for.
+ *
+ * **One builder per side, mirroring the endpoints.** A purchase and a sale
+ * agree on how to broadcast and on nothing else: a purchase commits to an
+ * exact quantity, a sale to a range with a floor beneath it, and `amount` is
+ * the funding token on one and the asset on the other. A single method taking
+ * a `side` would have to return a union the caller then re-narrows, having
+ * already decided which trade it was placing.
+ *
+ * **No CoinList fee is applied to a read quote, and no read discloses one.**
+ * Ondo prices exactly the amount passed. A CoinList approval is fee-inclusive,
+ * so sizing a quote against a user's approval without subtracting the fee
+ * first overstates what they receive. A built transaction carries the fee
+ * explicitly, and it is zero until one lands (ENG-1718).
+ *
+ * Every method requires `AuthState === 'logged-in'` and throws
+ * {@link NotAuthenticatedError} otherwise.
+ */
+interface OndoNamespace {
+    getTradingStatus(params: GetOndoTradingStatusParams): Promise<OndoTradingStatus>;
+    /**
+     * An indicative price for `params`' size, from Ondo's live market.
+     *
+     * Ondo refuses to quote while the market is closed or paused, or the asset
+     * is paused or closed for the session - including for about a minute at
+     * every US session change, when `getTradingStatus` may still have reported
+     * the asset tradable. The request then rejects with a 409 carrying
+     * `code: "not_tradable"`; tell it apart from a failure with
+     * {@link isOndoNotTradableError}. Retrying before the market opens fails the
+     * same way.
+     */
+    getQuote(params: GetOndoQuoteParams): Promise<OndoQuote>;
+    /**
+     * Builds a purchase for a specific wallet and deposit: spends an attestation
+     * and returns calldata to broadcast, valid until
+     * {@link OndoBuyTransaction.expiresAt}.
+     *
+     * The wallet must have approved the swap contract to spend `amount` of the
+     * offer's **funding token** first. Frontline reads that allowance before
+     * asking Ninshubur for anything, and rejects a short one with a 422 carrying
+     * `code: "insufficient_allowance"`. See `prepareBuy` on the client
+     * namespace, which approves and then builds, in that order.
+     *
+     * The tokens themselves are the offer's rather than the caller's to name.
+     */
+    buildBuyTransaction(params: BuildOndoBuyParams): Promise<OndoBuyTransaction>;
+    /**
+     * Builds a sale for a specific wallet and quantity: spends an attestation
+     * and returns calldata to broadcast, valid until
+     * {@link OndoSellTransaction.expiresAt}.
+     *
+     * The approval this one needs is on the **asset**, not on a stablecoin - a
+     * sale delivers the asset, so the swap contract pulls it with `transferFrom`
+     * exactly as it pulls the deposit on a purchase. Same 422 when it is short,
+     * with a message naming that address. See `prepareSell` on the client
+     * namespace.
+     *
+     * Returns a range rather than a quantity: Ondo settles through USDon before
+     * converting to the settlement token, so disclose
+     * {@link OndoSellTransaction.minimum} and not only `expected`.
+     */
+    buildSellTransaction(params: BuildOndoSellParams): Promise<OndoSellTransaction>;
+}
+
+/**
+ * A read-only quote for a swap as domain amounts: how much goes in, the
+ * protocol fee, and how much would come out. Derived from the raw
+ * {@link SwapPreview} the swap contract returns.
+ */
+type SwapQuote = {
+    inputTokenAmount: BlockchainAmount;
+    fee: BlockchainAmount;
+    outputTokenAmount: BlockchainAmount;
+};
+
+/** Parameters shared by contract reads scoped to a chain. */
+type SwapContractRef = {
+    contractAddress: EvmContractAddress;
+    chain: EthereumChain;
+};
+type GetSwapAuthorizationParams = SwapContractRef & {
+    walletAddress: EvmWalletAddress;
+};
+type GetSwapPreviewParams = SwapContractRef & {
+    inputToken: EvmContractAddress;
+    amount: bigint;
+};
+type GetSwapQuoteParams = SwapContractRef & {
+    inputToken: EvmContractAddress;
+    /** The gross amount to swap, in the input token. */
+    amount: BlockchainAmount;
+    /**
+     * Decimals of the contract's output token, from `getOutputToken`. A
+     * parameter rather than read per call because a quote is polled and the
+     * output token never changes.
+     */
+    outputTokenDecimals: AssetDecimals;
+};
+type AllowWalletParams = {
+    offerId: OfferId;
+    walletAddress: EvmWalletAddress;
+    chain: EthereumChain;
+    signature: string;
+};
+
+/**
+ * A read-only quote for a swap: how much goes in, the protocol fee, and how
+ * much would come out. All amounts are raw on-chain integers (uint256).
+ */
+type SwapPreview = {
     inputAmount: Uint256;
     fee: Uint256;
     outputAmount: Uint256;
 };
-declare const SwapPreview: {
-    /** Maps the contract's `Preview { input, fee, output }` struct. */
-    fromContract: (preview: {
-        input: bigint;
-        fee: bigint;
-        output: bigint;
-    }) => SwapPreview;
-};
 /**
  * The bitmask of operations a swap contract has paused, as `Operable.paused`
  * reports it. Each bit is one operation level; swapping is
@@ -2542,24 +1576,6 @@ type SwapStatus = {
 } | {
     state: 'stopped';
 };
-declare const SwapStatus: {
-    /**
-     * Maps the contract's `Status { uint32 flags; State state }` struct, where
-     * `State` is `0 = Active | 1 = Paused | 2 = Stopped`.
-     *
-     * `flags` is carried onto the `paused` arm only. On the other two the
-     * contract sets it to a self-identifying marker rather than to information -
-     * so repeating it would invite a caller to read meaning into a constant.
-     *
-     * @throws ValidationError on a `state` outside the enum. A contract that has
-     * grown a fourth state is one the SDK does not model, and guessing `active`
-     * would let a halted swap read as a live one.
-     */
-    fromContract: (status: {
-        flags: number;
-        state: number;
-    }) => SwapStatus;
-};
 /**
  * The backend's response to an allow-wallet request. Either the caller must
  * broadcast an on-chain transaction to complete allow-listing, or nothing is
@@ -2573,28 +1589,6 @@ type AllowWalletResponse = {
     action: 'none';
     alreadyAllowed: boolean;
 };
-declare const AllowWalletResponse: {
-    fromDto: (dto: AllowWalletResponseDto) => AllowWalletResponse;
-};
-
-/** Parameters shared by contract reads scoped to a chain. */
-type SwapContractRef = {
-    contractAddress: EvmContractAddress;
-    chain: EthereumChain;
-};
-type GetSwapAuthorizationParams = SwapContractRef & {
-    walletAddress: EvmWalletAddress;
-};
-type GetSwapPreviewParams = SwapContractRef & {
-    inputToken: EvmContractAddress;
-    amount: bigint;
-};
-type AllowWalletParams = {
-    offerId: OfferId;
-    walletAddress: EvmWalletAddress;
-    chain: EthereumChain;
-    signature: string;
-};
 
 /**
  * Read/write operations for the on-chain swap flow: quoting a swap, inspecting
@@ -2622,6 +1616,12 @@ interface SuperstateSwapNamespace {
      * {@link getStatus} first if you would rather not provoke one.
      */
     getPreview(params: GetSwapPreviewParams): Promise<SwapPreview>;
+    /**
+     * {@link getPreview} as domain amounts: what goes in, the fee, and what
+     * would come out. This is the quote `ClientSuperstateSwapNamespace.execute`
+     * takes, and it reverts on the same conditions.
+     */
+    getQuote(params: GetSwapQuoteParams): Promise<SwapQuote>;
     /**
      * Reads the current on-chain state of a swap contract. See
      * {@link isSwapAvailable} before concluding that a `paused` contract cannot
@@ -2641,113 +1641,190 @@ interface SuperstateSwapNamespace {
      */
     allowWallet(params: AllowWalletParams): Promise<AllowWalletResponse>;
 }
-declare class SuperstateSwapNamespaceImpl implements SuperstateSwapNamespace {
-    private readonly ctx;
-    protected readonly log: InternalLogger;
-    constructor(ctx: UniversalNamespaceContext);
-    getAuthorization(params: GetSwapAuthorizationParams): Promise<boolean>;
-    getPreview(params: GetSwapPreviewParams): Promise<SwapPreview>;
-    getStatus(params: SwapContractRef): Promise<SwapStatus>;
-    getOutputToken(params: SwapContractRef): Promise<Erc20Asset>;
-    allowWallet(params: AllowWalletParams): Promise<AllowWalletResponse>;
-}
 
-/** Request body for `POST /v1/offers/:offer_id/addresses`. */
-type CreateOfferOptionAddressDto = {
-    offer_option_id: string;
-    wallet_address: string;
-    chain: string;
-    signature: string;
-};
-/** Binding object returned by the `/v1/offers/:offer_id/addresses` resource. */
-type OfferOptionAddressDto = {
-    id: string;
-    offer_option_id: string;
-    address: string;
-    protocol: WalletProtocol;
-    created_at: string;
+/** Document types that can be signed via {@link CoinListClient.submitDocument}. */
+type DocumentType = 'tax_certification';
+/** Signing-state machine status for a document submission. */
+type DocumentSubmissionStatus = 'INITIALIZED' | 'SENT' | 'VIEWED' | 'COMPLETED' | 'DECLINED' | 'EXPIRED';
+/** The tax form derived from the entity's kind (individual vs company/trust). */
+type DocumentFormType = 'w8_ben' | 'w8_ben_e';
+/** Result of starting (or resuming) a document signing submission. */
+type DocumentSubmission = {
+    status: DocumentSubmissionStatus;
+    formType: DocumentFormType;
 };
 
-/** Unique identifier for a proven wallet binding on an offer option. */
-type OfferOptionAddressId = Newtype<string, 'OfferOptionAddressId'>;
-/** Casts a string into a typed {@link OfferOptionAddressId}. */
-declare const OfferOptionAddressId: (value: string) => OfferOptionAddressId;
 /**
- * A user's external wallet, proven via a wallet-ownership challenge and bound
- * to an offer option. Returned by the `/v1/offers/:offer_id/addresses` resource.
+ * Sumsub verification level name. Determines which screens the Sumsub WebSDK
+ * shows (levels are configured in the Sumsub dashboard). The backend
+ * prescribes the level (and whether the applicant must be reset first) in the
+ * requirement statuses response — clients never compute levels themselves.
  */
-type OfferOptionAddress = {
-    /** Unique binding id. */
-    id: OfferOptionAddressId;
-    /** Offer option the wallet is bound to. */
-    offerOptionId: OfferOptionId;
-    /** The connected external wallet address. */
-    address: EvmWalletAddress;
-    /**
-     * Protocol the binding is scoped to. An EVM address binds once per option
-     * regardless of which EVM chain proved ownership.
-     */
-    protocol: WalletProtocol;
-    /** When the binding was created. */
-    createdAt: Date;
-};
-declare const OfferOptionAddress: {
-    /** Maps the API DTO into the SDK offer-option-address domain model. */
-    fromDto: (dto: OfferOptionAddressDto) => OfferOptionAddress;
-};
-/** Parameters required to connect a proven external wallet to an offer option. */
-type ConnectExternalWalletParams = {
-    /** Offer the option belongs to. */
-    offerId: OfferId;
-    /** Offer option to bind the wallet to. */
-    offerOptionId: OfferOptionId;
-    /** External wallet address that was proven. */
-    walletAddress: EvmWalletAddress;
-    /** Chain the ownership was proven on. */
-    chain: EthereumChain;
-    /** Signature of the wallet-ownership challenge message. */
-    signature: Hex;
-};
-declare const ConnectExternalWalletParams: {
-    /** Maps connect-wallet params into the API DTO payload. */
-    toDto: (params: ConnectExternalWalletParams) => CreateOfferOptionAddressDto;
+type KycLevelName = string;
+/** Short-lived Sumsub WebSDK access token scoped to the current user. */
+type KycToken = {
+    token: string;
 };
 
-/** Challenge kinds accepted by `POST /v1/wallet-ownership`. */
-type WalletOwnershipChallengeTypeDto = 'plain' | 'siwe';
-/**
- * Request body for `POST /v1/wallet-ownership`. `challenge_type` defaults to
- * `plain` on the backend; the SIWE fields (`domain`, `uri`, `statement`) are
- * required only when `challenge_type` is `siwe` and must be absent otherwise.
- */
-type CreateWalletOwnershipChallengeDto = {
-    wallet_address: string;
-    chain: string;
-    challenge_type?: WalletOwnershipChallengeTypeDto;
-    domain?: string;
-    uri?: string;
-    statement?: string;
-};
-/** Response body for `POST /v1/wallet-ownership`. */
-type WalletOwnershipChallengeDto = {
-    message: string;
-    expires_at: string;
+/** Whether the PII belongs to an individual or a company/trust entity. */
+type PiiKind = 'person' | 'company';
+/** ISO 3166-1 alpha-2 country code (e.g. `'US'`). */
+type Iso2CountryCode = Newtype<string, 'Iso2CountryCode'>;
+declare const Iso2CountryCode: (value: string) => Iso2CountryCode;
+/** Jurisdiction derived from the entity's address country. */
+type PiiJurisdiction = {
+    iso2: Iso2CountryCode;
+    name: string | null;
+};
+/** Permanent address on file for the entity. */
+type PiiAddress = {
+    street: string | null;
+    city: string | null;
+    state: string | null;
+    postalCode: string | null;
+    country: string | null;
+};
+/**
+ * The current user's PII, used to pre-fill tax forms such as the W-8BEN.
+ * Fields the entity hasn't provided are `null`.
+ */
+type Pii = {
+    kind: PiiKind;
+    fullLegalName: string | null;
+    dateOfBirth: string | null;
+    jurisdiction: PiiJurisdiction | null;
+    taxId: string | null;
+    permanentAddress: PiiAddress;
 };
 
-/** Fields common to every wallet-ownership challenge request. */
-type WalletOwnershipChallengeParamsBase = {
-    /** Wallet address to prove ownership of. */
-    walletAddress: EvmWalletAddress;
-    /** Chain the wallet belongs to. */
-    chain: EthereumChain;
+type RequirementId = Newtype<string, 'RequirementId'>;
+declare const RequirementId: (value: string) => RequirementId;
+type RequirementType = 'kyc_approved' | 'external_wallet' | 'whitelisted_wallet' | 'jurisdiction' | 'accreditation' | 'document';
+type RequirementStatusValue = 'not_started' | 'in_progress' | 'action_needed' | 'completed' | 'rejected';
+type RequirementActionNeededReason = 'kyc_not_verified' | 'update_pii_data';
+type Requirement = {
+    id: RequirementId;
+    type: RequirementType;
+    details: Record<string, unknown> | null;
+};
+type RequirementStatusInfo = {
+    id: RequirementId;
+    status: RequirementStatusValue;
+    /** Why the requirement needs action (KYC-backed requirements only). */
+    action: RequirementActionNeededReason | null;
+    /**
+     * The Sumsub verification level that resolves this requirement, prescribed
+     * by the backend. Present exactly when an inline Sumsub flow can be started.
+     */
+    kycLevel?: KycLevelName;
+    /**
+     * Whether the Sumsub applicant must be reset before starting the flow
+     * (redoing an already-approved level, e.g. to update stale PII). Forward to
+     * the kyc-token request as-is.
+     */
+    kycReset?: boolean;
+};
+
+type CreateKycTokenParams = {
+    /**
+     * Sumsub verification level to run. Defaults to the backend's standard
+     * level.
+     */
+    levelName?: KycLevelName;
+    /**
+     * Resets the Sumsub applicant first, so an already-approved level can be
+     * executed again (e.g. to update stale PII). Pass the `kycReset` value from
+     * the requirement status, and never on mid-flow token refreshes.
+     */
+    reset?: boolean;
+};
+type SubmitDocumentParams = {
+    /** Currently only `tax_certification` (W-8BEN / W-8BEN-E). */
+    documentType: DocumentType;
+    /**
+     * Signing-form values keyed by the document's DocuSeal field names,
+     * forwarded verbatim to pre-fill the document.
+     */
+    fields: Record<string, string>;
 };
 /**
- * How the ownership challenge is framed: a plain message or a Sign-In With
- * Ethereum challenge. Extracted as its own type so SDK consumers can pass it as
- * a standalone param without reaching into the {@link CreateWalletOwnershipChallengeParams}
- * union.
+ * Everything a user must satisfy before they can participate in an offer:
+ * reading the checklist and its live statuses, and the operations that satisfy
+ * individual requirements — identity verification (KYC) and tax-document
+ * signing.
+ *
+ * Wallet requirements (`external_wallet`, `whitelisted_wallet`) are satisfied
+ * through `WalletsNamespace` instead, since wallet proofs are also used
+ * outside the requirements flow.
+ *
+ * Every method requires an authenticated user and throws
+ * {@link NotAuthenticatedError} otherwise.
  */
-type WalletChallengeType = CreateWalletOwnershipChallengeParams['challengeType'];
+interface RequirementsNamespace {
+    /**
+     * Fetches the requirements for every option of an offer, grouped by option
+     * id. This is the definition of the checklist; {@link statuses} tells you
+     * where the user stands against it.
+     */
+    forOffer(offerId: OfferId): Promise<Record<OfferOptionId, Requirement[]>>;
+    /**
+     * Fetches the current user's status for each requirement of an offer.
+     */
+    statuses(offerId: OfferId): Promise<RequirementStatusInfo[]>;
+    /**
+     * Creates a short-lived Sumsub WebSDK access token so an identity
+     * verification (KYC) flow can be started, e.g. by the `IdentityVerification`
+     * component.
+     */
+    createKycToken(params?: CreateKycTokenParams): Promise<KycToken>;
+    /**
+     * Fetches the current user's PII, used to pre-fill tax forms such as the
+     * W-8BEN. Fields the entity hasn't provided are `null`.
+     */
+    getPii(): Promise<Pii>;
+    /**
+     * Starts (or resumes) a document signing submission.
+     */
+    submitDocument(params: SubmitDocumentParams): Promise<DocumentSubmission>;
+}
+
+/** Unique identifier for a proven wallet binding on an offer option. */
+type OfferOptionAddressId = Newtype<string, 'OfferOptionAddressId'>;
+/** Casts a string into a typed {@link OfferOptionAddressId}. */
+declare const OfferOptionAddressId: (value: string) => OfferOptionAddressId;
+/**
+ * A user's external wallet, proven via a wallet-ownership challenge and bound
+ * to an offer option. Returned by the `/v1/offers/:offer_id/addresses` resource.
+ */
+type OfferOptionAddress = {
+    /** Unique binding id. */
+    id: OfferOptionAddressId;
+    /** Offer option the wallet is bound to. */
+    offerOptionId: OfferOptionId;
+    /** The connected external wallet address. */
+    address: EvmWalletAddress;
+    /**
+     * Protocol the binding is scoped to. An EVM address binds once per option
+     * regardless of which EVM chain proved ownership.
+     */
+    protocol: WalletProtocol;
+    /** When the binding was created. */
+    createdAt: Date;
+};
+/** Parameters required to connect a proven external wallet to an offer option. */
+type ConnectExternalWalletParams = {
+    /** Offer the option belongs to. */
+    offerId: OfferId;
+    /** Offer option to bind the wallet to. */
+    offerOptionId: OfferOptionId;
+    /** External wallet address that was proven. */
+    walletAddress: EvmWalletAddress;
+    /** Chain the ownership was proven on. */
+    chain: EthereumChain;
+    /** Signature of the wallet-ownership challenge message. */
+    signature: Hex;
+};
+
 /**
  * A single-use ownership challenge returned by `POST /v1/wallet-ownership`.
  * The consumer signs {@link message} with their wallet, then submits the
@@ -2759,9 +1836,12 @@ type WalletOwnershipChallenge = {
     /** When the challenge expires and can no longer be consumed. */
     expiresAt: Date;
 };
-declare const WalletOwnershipChallenge: {
-    /** Maps the API DTO into the SDK wallet-ownership-challenge domain model. */
-    fromDto: (dto: WalletOwnershipChallengeDto) => WalletOwnershipChallenge;
+/** Fields common to every wallet-ownership challenge request. */
+type WalletOwnershipChallengeParamsBase = {
+    /** Wallet address to prove ownership of. */
+    walletAddress: EvmWalletAddress;
+    /** Chain the wallet belongs to. */
+    chain: EthereumChain;
 };
 /**
  * Parameters for requesting a wallet-ownership challenge. Modeled as a
@@ -2781,14 +1861,13 @@ type CreateWalletOwnershipChallengeParams = (WalletOwnershipChallengeParamsBase
     /** Human-readable statement shown in the signing prompt. */
     statement: string;
 });
-declare const CreateWalletOwnershipChallengeParams: {
-    /**
-     * Maps challenge-request params into the API DTO payload. The discriminated
-     * union guarantees SIWE fields are present exactly when `challengeType` is
-     * `siwe`, so the mapping narrows on the discriminant.
-     */
-    toDto: (params: CreateWalletOwnershipChallengeParams) => CreateWalletOwnershipChallengeDto;
-};
+/**
+ * How the ownership challenge is framed: a plain message or a Sign-In With
+ * Ethereum challenge. Extracted as its own type so SDK consumers can pass it as
+ * a standalone param without reaching into the {@link CreateWalletOwnershipChallengeParams}
+ * union.
+ */
+type WalletChallengeType = CreateWalletOwnershipChallengeParams['challengeType'];
 
 type ListOptionAddressesParams = {
     offerId: OfferId;
@@ -2835,467 +1914,798 @@ interface WalletsNamespace {
      */
     remove(params: RemoveOptionAddressParams): Promise<OfferOptionAddress>;
 }
-declare class WalletsNamespaceImpl implements WalletsNamespace {
-    private readonly ctx;
-    private readonly log;
-    constructor(ctx: UniversalNamespaceContext);
-    createOwnershipChallenge(params: CreateWalletOwnershipChallengeParams): Promise<WalletOwnershipChallenge>;
-    connectExternal(params: ConnectExternalWalletParams): Promise<OfferOptionAddress>;
-    list(params: ListOptionAddressesParams): Promise<OfferOptionAddress[]>;
-    remove(params: RemoveOptionAddressParams): Promise<OfferOptionAddress>;
-}
-
-type DocumentSubmissionStatusDto = 'INITIALIZED' | 'SENT' | 'VIEWED' | 'COMPLETED' | 'DECLINED' | 'EXPIRED';
-type DocumentFormTypeDto = 'w8_ben' | 'w8_ben_e';
-type DocumentSubmissionDto = {
-    object: 'document_submission';
-    status: DocumentSubmissionStatusDto;
-    form_type: DocumentFormTypeDto;
-};
-
-/** Document types that can be signed via {@link CoinListClient.submitDocument}. */
-type DocumentType = 'tax_certification';
-/** Signing-state machine status for a document submission. */
-type DocumentSubmissionStatus = DocumentSubmissionStatusDto;
-/** The tax form derived from the entity's kind (individual vs company/trust). */
-type DocumentFormType = DocumentFormTypeDto;
-/** Result of starting (or resuming) a document signing submission. */
-type DocumentSubmission = {
-    status: DocumentSubmissionStatus;
-    formType: DocumentFormType;
-};
-declare const DocumentSubmission: {
-    fromDto: (dto: DocumentSubmissionDto) => DocumentSubmission;
-};
-
-type KycTokenDto = {
-    object: 'kyc_token';
-    token: string;
-};
 
 /**
- * Sumsub verification level name. Determines which screens the Sumsub WebSDK
- * shows (levels are configured in the Sumsub dashboard). The backend
- * prescribes the level (and whether the applicant must be reset first) in the
- * requirement statuses response — clients never compute levels themselves.
+ * Reads over CoinList's offers: the catalogue a user can browse, and the full
+ * detail of a single offer.
+ *
+ * Every method requires an authenticated user and throws
+ * {@link NotAuthenticatedError} otherwise. On the server, the same reads are
+ * additionally available with an app-level token — see
+ * `ServerOffersNamespace`.
  */
-type KycLevelName = string;
-/** Short-lived Sumsub WebSDK access token scoped to the current user. */
-type KycToken = {
-    token: string;
-};
-declare const KycToken: {
-    fromDto: (dto: KycTokenDto) => KycToken;
-};
+interface OffersNamespace {
+    /**
+     * Fetches every offer, iterating through all pages. Prefer {@link listPage}
+     * when you render a paginated list yourself.
+     */
+    list(): Promise<Offer[]>;
+    /**
+     * Fetches a single page of offers. Pass the previous response's
+     * `startingAfter` as `after` to advance.
+     */
+    listPage(params: PaginationParams): Promise<PaginatedResponse<Offer>>;
+    /**
+     * Fetches the full detail of one offer, including its options. Note this
+     * returns {@link OfferDetail} — a richer model than the {@link Offer}
+     * summaries {@link list} returns.
+     */
+    get(id: OfferId): Promise<OfferDetail>;
+}
 
-type PiiKindDto = 'person' | 'company';
-type PiiJurisdictionDto = {
-    iso_2: string;
-    name: string | null;
-};
-type PiiAddressDto = {
-    street: string | null;
-    city: string | null;
-    state: string | null;
-    postal_code: string | null;
-    country: string | null;
+type GetTokenAllowanceParams = {
+    tokenAddress: EvmContractAddress;
+    owner: EvmWalletAddress;
+    spender: EvmContractAddress;
+    chain: EthereumChain;
 };
-type PiiDto = {
-    object: 'user_pii';
-    kind: PiiKindDto;
-    full_legal_name: string | null;
-    date_of_birth: string | null;
-    jurisdiction: PiiJurisdictionDto | null;
-    tax_id: string | null;
-    permanent_address: PiiAddressDto;
+type GetTokenBalanceParams = {
+    tokenAddress: EvmContractAddress;
+    owner: EvmWalletAddress;
+    chain: EthereumChain;
 };
 
-/** Whether the PII belongs to an individual or a company/trust entity. */
-type PiiKind = PiiKindDto;
-/** ISO 3166-1 alpha-2 country code (e.g. `'US'`). */
-type Iso2CountryCode = Newtype<string, 'Iso2CountryCode'>;
-declare const Iso2CountryCode: (value: string) => Iso2CountryCode;
-/** Jurisdiction derived from the entity's address country. */
-type PiiJurisdiction = {
-    iso2: Iso2CountryCode;
-    name: string | null;
-};
-declare const PiiJurisdiction: {
-    fromDto: (dto: PiiJurisdictionDto) => PiiJurisdiction;
-};
-/** Permanent address on file for the entity. */
-type PiiAddress = {
-    street: string | null;
-    city: string | null;
-    state: string | null;
-    postalCode: string | null;
-    country: string | null;
-};
-declare const PiiAddress: {
-    fromDto: (dto: PiiAddressDto) => PiiAddress;
-};
 /**
- * The current user's PII, used to pre-fill tax forms such as the W-8BEN.
- * Fields the entity hasn't provided are `null`.
+ * Generic ERC-20 reads shared across on-chain flows (swap, token sale): the
+ * allowance an owner has granted a spender, and the raw token balance an owner
+ * holds. These are plain token reads, not tied to any single product flow.
+ *
+ * Read from the chain rather than from a CoinList endpoint. By default that
+ * goes through CoinList's authenticated JSON-RPC proxy, so a logged-out caller
+ * gets the proxy's `401` - surfaced as a viem error wrapping the SDK's
+ * `HttpError`, not as `NotAuthenticatedError`, since viem re-wraps whatever a
+ * `Transport` throws. Point `Config.rpc` at your own node for this chain and no
+ * CoinList session is involved at all. See {@link RpcConfig}.
  */
-type Pii = {
-    kind: PiiKind;
-    fullLegalName: string | null;
-    dateOfBirth: string | null;
-    jurisdiction: PiiJurisdiction | null;
-    taxId: string | null;
-    permanentAddress: PiiAddress;
-};
-declare const Pii: {
-    fromDto: (dto: PiiDto) => Pii;
-};
+interface Erc20Namespace {
+    /**
+     * Reads the ERC-20 allowance an `owner` has granted a `spender`, as a raw
+     * on-chain integer.
+     */
+    getAllowance(params: GetTokenAllowanceParams): Promise<Uint256>;
+    /**
+     * Reads the raw ERC-20 balance an `owner` holds of a token.
+     */
+    getBalance(params: GetTokenBalanceParams): Promise<Uint256>;
+}
 
-type RequirementTypeDto = 'kyc_approved' | 'external_wallet' | 'whitelisted_wallet' | 'jurisdiction' | 'accreditation' | 'document';
-type RequirementDto = {
-    object: 'requirement';
-    id: string;
-    type: RequirementTypeDto;
-    details: Record<string, unknown> | null;
-};
-type RequirementStatusValueDto = 'not_started' | 'in_progress' | 'action_needed' | 'completed' | 'rejected';
-type RequirementActionNeededReasonDto = 'kyc_not_verified' | 'update_pii_data';
 /**
- * Object form of a requirement status, used when the status carries extra
- * data: the action-needed reason and/or the Sumsub flow that resolves the
- * requirement (kyc_level + kyc_reset, forwarded to the kyc-token endpoint).
+ * Token display metadata — name, symbol, decimals, and logos — from
+ * CoinList's public token registry, keyed by {@link TokenIdentifier} (the
+ * same chain + address pairs `Offer.tokens` carries).
+ *
+ * Unlike the other namespaces, this one is public: no method requires an
+ * authenticated user, and nothing here touches the CoinList API — reads go to
+ * the registry's CDN.
  */
-type RequirementStatusObjectDto = {
-    status: RequirementStatusValueDto;
-    action?: RequirementActionNeededReasonDto;
-    kyc_level?: string;
-    kyc_reset?: boolean;
-};
-type RequirementStatusesDto = {
-    object: 'requirement_statuses';
-    offer_id: string;
-    statuses: Record<string, RequirementStatusValueDto | RequirementStatusObjectDto>;
-};
-
-type RequirementId = Newtype<string, 'RequirementId'>;
-declare const RequirementId: (value: string) => RequirementId;
-type RequirementType = RequirementTypeDto;
-type RequirementStatusValue = RequirementStatusValueDto;
-type RequirementActionNeededReason = RequirementActionNeededReasonDto;
-type Requirement = {
-    id: RequirementId;
-    type: RequirementType;
-    details: Record<string, unknown> | null;
-};
-declare const Requirement: {
-    fromDto: (dto: RequirementDto) => Requirement;
-};
-type RequirementStatusInfo = {
-    id: RequirementId;
-    status: RequirementStatusValue;
-    /** Why the requirement needs action (KYC-backed requirements only). */
-    action: RequirementActionNeededReason | null;
+interface TokensNamespace {
     /**
-     * The Sumsub verification level that resolves this requirement, prescribed
-     * by the backend. Present exactly when an inline Sumsub flow can be started.
+     * Fetches metadata for one token. Returns `null` when the registry does not
+     * list the token — the registry is curated, so callers must fall back to
+     * their own display defaults rather than treat this as an error.
      */
-    kycLevel?: KycLevelName;
+    get(token: TokenIdentifier): Promise<TokenMetadata | null>;
     /**
-     * Whether the Sumsub applicant must be reset before starting the flow
-     * (redoing an already-approved level, e.g. to update stale PII). Forward to
-     * the kyc-token request as-is.
+     * Fetches every token the registry lists, in one request: the complete
+     * snapshot with no `chain`, or one chain's snapshot with it. Prefer this
+     * over calling {@link get} in a loop when displaying a catalogue — two
+     * hundred tokens across three chains is still a single download.
+     *
+     * The complete snapshot spans every chain the registry knows; tokens on
+     * chains this SDK does not model (e.g. Solana) are left out of the result.
+     *
+     * Unlike {@link get}, a missing snapshot throws rather than returning `[]`:
+     * the registry always publishes the complete snapshot and one per chain it
+     * knows, so an absence is a deployment problem, not an empty catalogue.
      */
-    kycReset?: boolean;
-};
-declare const RequirementStatusInfo: {
-    fromStatusesDto: (dto: RequirementStatusesDto) => RequirementStatusInfo[];
-};
+    list(chain?: EthereumChain): Promise<TokenMetadata[]>;
+}
 
-type CreateKycTokenParams = {
+/**
+ * The observability seam a host implements to see inside the SDK.
+ *
+ * Pass an implementation as {@link Config.logger} and the SDK reports every
+ * request it makes, every failure it classifies, and every state a hook
+ * settles into. Leave it out and the SDK logs nothing at all - there is no
+ * fallback to `console`, at any level, on any codepath.
+ *
+ * Four methods over a {@link LogEvent} lambda, plus {@link level}. An event is
+ * a constant `msg`, the {@link LogScope} it came from, the accumulated
+ * {@link LogBindings}, and a bag of `fields` - so a host forwards structured
+ * records rather than parsing strings.
+ *
+ * ```ts
+ * const logger: Logger = {
+ *   level: () => 'info',
+ *   debug: () => {},
+ *   info: (event) => sink.info(toRecord(event())),
+ *   warn: (event) => sink.warn(toRecord(event())),
+ *   error: (event) => sink.error(toRecord(event())),
+ * };
+ * ```
+ *
+ * {@link pinoClientLogger} and {@link pinoServerLogger} are ready-made
+ * implementations over pino, and are what most hosts should reach for.
+ *
+ * ## Where to run it
+ *
+ * **Not in production, as the default answer.** Development, tests, staging,
+ * and reproducing a reported bug are where this seam earns its keep. Left
+ * undefined elsewhere it discloses nothing, and that holds no matter what a
+ * later revision of the SDK puts on a line.
+ *
+ * Where you do run one in production, `'info'` and above is the only sane
+ * choice, and the shipped implementations make the alternative unrepresentable
+ * rather than merely discouraged: `isDev: false` narrows the level to
+ * {@link ProductionLogLevel}, so `'debug'` does not compile. That narrowing is
+ * a guard for the partner who ignored this paragraph, not an endorsement of
+ * the practice.
+ *
+ * The distinction worth holding onto: `'info'` and above are **redacted by
+ * construction** - see the next section for exactly what that covers, and the
+ * type that enforces it. Redacted is a mechanism the SDK can hold itself to. A
+ * blanket "safe in production" is a promise about your environment that the
+ * SDK is in no position to make, and one that a single future field could
+ * quietly break.
+ *
+ * `'debug'` is for reproducing a bug: a developer's machine, tests, and beta
+ * or staging environments where the data flowing through the SDK is not real
+ * customer data.
+ *
+ * ## What each level may disclose
+ *
+ * **`'debug'` is unredacted. Every other level is not.**
+ *
+ * At `'debug'` the SDK reports request and response bodies, request headers,
+ * the full URL including its query string, and operation parameters
+ * **verbatim** - bearer tokens, KYC answers, tax-document fields, wallet
+ * signatures, the lot. There is no denylist and no redaction: see ADR-8 for
+ * why a partial guarantee was rejected in favour of an honest absence of one.
+ *
+ * At `'info'`, `'warn'` and `'error'` the SDK emits only its own
+ * classification of what happened and identifiers the server minted: a method
+ * and a bare path, a status, a duration, a {@link RequestId}, a frontline
+ * error code and event id, a {@link LogCause} arm. No request body, no
+ * response body, no query string, no host-supplied parameters, and no message
+ * text read off a thrown error the SDK did not author.
+ *
+ * The type carries that boundary rather than merely documenting it:
+ * {@link SafeEvent} constrains every field value to a {@link LogValue} scalar,
+ * so spreading a body, a DTO or an operation's params into an `info`, `warn`
+ * or `error` line does not compile. Only {@link DebugEvent} accepts arbitrary
+ * values.
+ *
+ * The one deliberate exception is an SDK-authored validation message, which
+ * quotes the single scalar that failed to map - `Unsupported chain:
+ * "solana_mainnet"`. It is a hand-written template naming one offending value,
+ * not a payload, and it is the whole reason this seam exists.
+ *
+ * ## Your responsibility
+ *
+ * The SDK hands you events. What happens next is yours: **you own the final
+ * filtering, redaction and retention** before anything is written to a file, a
+ * console, or a third-party sink such as Sentry or Datadog. In particular, if
+ * you implement {@link debug} and forward it anywhere durable, you have taken
+ * on storing live credentials and personal data, deliberately. Implement
+ * `debug` as a no-op - or return a level below it from {@link level} - in any
+ * environment where that is not acceptable.
+ *
+ * **Every event is a lambda, and that is load bearing.** The SDK consults
+ * {@link level} first and never invokes the lambda when the level forbids it,
+ * so an expensive debug event - a serialized DTO, a loop over balances - costs
+ * nothing in production where the level is `'error'` or `'none'`. Build the
+ * event inside the lambda, never outside it.
+ *
+ * ## Every method must be total
+ *
+ * **None of the five methods may throw, and that includes {@link level}.** The
+ * SDK calls them inline, on the codepath of the work it is reporting, and it
+ * does not catch them: a `logger.error` that throws while reporting a failed
+ * request turns that request's rejection into your logger's exception, and a
+ * `level()` that throws breaks the call it was asked about even when nothing
+ * else went wrong.
+ *
+ * That is deliberate. Swallowing would hide a logger that is broken in every
+ * environment, and the SDK cannot tell a transport blip in your sink from a
+ * bug in your implementation. So the contract is on this side of the seam:
+ * catch inside your implementation, and never let an exception out. The
+ * shipped pino implementations do exactly that.
+ *
+ * ```ts
+ * error: (event) => {
+ *   try {
+ *     const e = event();
+ *     Sentry.captureMessage(e.msg, { extra: e });
+ *   } catch {
+ *     // never rethrow: the SDK is on the other side of this call
+ *   }
+ * },
+ * ```
+ */
+interface Logger {
     /**
-     * Sumsub verification level to run. Defaults to the backend's standard
-     * level.
+     * The most detailed level this logger wants. Consulted before **every** log
+     * call, so keep it cheap and pure: return a captured constant or read a
+     * plain field. Do not read an environment variable, hit storage, or call
+     * out to a feature-flag service here.
+     *
+     * Returning `'none'` silences the SDK as completely as omitting the logger.
+     *
+     * **Must not throw.** It is consulted inside every SDK operation, so an
+     * exception here fails the operation itself.
      */
-    levelName?: KycLevelName;
+    level(): LogLevel;
     /**
-     * Resets the Sumsub applicant first, so an already-approved level can be
-     * executed again (e.g. to update stale PII). Pass the `kycReset` value from
-     * the requirement status, and never on mid-flow token refreshes.
+     * Fine-grained detail: request and response bodies, full URLs, headers,
+     * operation parameters, hook transitions.
+     *
+     * **Unredacted.** This is the only level that may carry credentials or
+     * personal data, and it always may. Its event is a {@link DebugEvent}, whose
+     * fields accept arbitrary values for exactly that reason. Do not forward it
+     * to a durable or third-party sink outside development and beta.
+     *
+     * **Must not throw**, here and on every method below.
      */
-    reset?: boolean;
-};
-type SubmitDocumentParams = {
-    /** Currently only `tax_certification` (W-8BEN / W-8BEN-E). */
-    documentType: DocumentType;
+    debug(event: () => DebugEvent): void;
+    /** Notable, expected events: a request completing, a flow advancing. */
+    info(event: () => SafeEvent): void;
     /**
-     * Signing-form values keyed by the document's DocuSeal field names,
-     * forwarded verbatim to pre-fill the document.
-     */
-    fields: Record<string, string>;
+     * Recoverable trouble: a retried request, a renewed session, a poll tick
+     * that failed while the last value still stands.
+     *
+     * Carries a {@link LogCause} when one was classified, the same as
+     * {@link error} does. What separates the two levels is whether anything
+     * actually broke, not how much is known about it.
+     */
+    warn(event: () => SafeEvent): void;
+    /**
+     * A failure. {@link SafeEvent.cause} carries what the SDK knows about it,
+     * classified into {@link LogCause}, and is absent when the failure is not an
+     * error the SDK caught - a flow reporting the step it stopped at, for
+     * instance.
+     *
+     * Every part of the event is SDK-authored classification or server-authored
+     * identifiers, so forwarding it as it stands is safe. `scope` says which
+     * part of the SDK the line came from, which is what to route or filter on.
+     */
+    error(event: () => SafeEvent): void;
+}
+/**
+ * A value the SDK is willing to put in a structured field above `'debug'`.
+ *
+ * Scalars only, and that is the redaction boundary made structural rather than
+ * documentary. Every leak ADR-8 found was an *object* spread onto a line that
+ * a host forwards to a tracker - an operation's params, a thrown wallet error,
+ * a response body. None of them is assignable to this, so each is now a
+ * compile error rather than a review catch.
+ *
+ * It does not stop a call site writing `{ token: accessToken }`, and it is not
+ * meant to: a string is a string. What it stops is the mistake that actually
+ * happened.
+ */
+type LogValue = string | number | boolean | null;
+/**
+ * Fields safe at every level: SDK-authored classification and server-minted
+ * identifiers, constrained to {@link LogValue}.
+ */
+type SafeFields = Readonly<Record<string, LogValue>>;
+/**
+ * Fields for `'debug'` only: bodies, headers, full URLs, operation params,
+ * raw thrown values. Arbitrary values, because that is the point of the level.
+ *
+ * The SDK's own implementations render these into a form that cannot fail to
+ * serialize - a `bigint`, a cycle or a getter that throws must never turn a
+ * log line into a second failure - but they are otherwise passed through.
+ */
+type UnredactedFields = Readonly<Record<string, unknown>>;
+/**
+ * One narrowing applied to a logger by {@link InternalLogger.child}.
+ *
+ * A union of single-key objects rather than a positional `string`, because the
+ * three things the SDK narrows by are not the same kind of thing: a request id
+ * correlates retries of one wire call, a flow name names an on-chain
+ * procedure, a hook name names a React binding. Rendered into one `[SCOPE:x]`
+ * prefix they were indistinguishable; as fields they must not be.
+ *
+ * `requestId` keeps its {@link RequestId} newtype rather than widening to
+ * `string` at the seam.
+ */
+type LogBinding = {
+    readonly requestId: RequestId;
+} | {
+    readonly flow: string;
+} | {
+    readonly hook: string;
+} | {
+    readonly op: string;
+};
+/**
+ * Every {@link LogBinding} applied so far, merged. This is what reaches a
+ * host, so a line from `prepareOndoSell` carries `flow: 'prepareSell'` as its
+ * own key and is filterable without parsing anything.
+ */
+type LogBindings = {
+    readonly [K in LogBinding as keyof K]?: K[keyof K];
+};
+type BaseEvent = {
+    /**
+     * What happened, as a **constant string literal**.
+     *
+     * Never interpolated. A log aggregator groups by message, so a `msg` that
+     * embeds a status, a count or a reason produces one group per distinct
+     * value and is not groupable at all. Every varying value belongs in
+     * `fields`, which is what a host filters and facets on.
+     *
+     * This is a convention, not a checked rule: deslop reasons about import
+     * edges and cannot see a template literal, and the type-level approximations
+     * catch only some interpolations. ADR-8 records why a partial guarantee was
+     * refused here as elsewhere.
+     */
+    readonly msg: string;
+    /**
+     * Which part of the SDK reported this. Stamped by
+     * {@link internalLogger}, never by a call site.
+     */
+    readonly scope: LogScope;
+    /** Every {@link LogBinding} applied by {@link InternalLogger.child}. */
+    readonly bindings: LogBindings;
+};
+/**
+ * An event for `'info'`, `'warn'` and `'error'` - the levels a host may run in
+ * production.
+ *
+ * Its fields are {@link SafeFields}, so nothing but a scalar can reach it.
+ */
+type SafeEvent = BaseEvent & {
+    readonly fields: SafeFields;
+    /**
+     * What the SDK knows about an accompanying failure, classified. Absent when
+     * there is nothing to classify.
+     */
+    readonly cause?: LogCause;
+};
+/**
+ * An event for `'debug'`, the unredacted level. Its fields accept anything.
+ */
+type DebugEvent = BaseEvent & {
+    readonly fields: UnredactedFields;
+};
+/**
+ * How much the SDK may report, from silent to everything.
+ *
+ * Ordered: each level admits itself and everything before it, so `'info'`
+ * shows errors, warnings and info but not debug. `'none'` admits nothing.
+ *
+ * `'debug'` is the unredacted level, and it is deliberately the bottom of the
+ * ladder: the guarantee "`debug` is unredacted and every other level is not"
+ * only closes if there is nothing below it. That is why the SDK keeps its own
+ * five levels rather than adopting pino's seven, which put `trace` underneath.
+ */
+type LogLevel = 'none' | 'error' | 'warn' | 'info' | 'debug';
+/**
+ * The redacted levels: the only ones to consider running in production.
+ *
+ * Every level except `'debug'`, which is unredacted by design. Used by the
+ * shipped pino implementations to make a production `'debug'` logger
+ * unrepresentable rather than merely discouraged - see
+ * {@link PinoLoggerOptions}.
+ *
+ * The name marks which levels are *redacted*, not a verdict that running them
+ * in production is safe. The SDK's advice is to leave {@link Config.logger}
+ * undefined there; this type is what stops the partner who does not take it
+ * from reaching the unredacted level as well.
+ */
+type ProductionLogLevel = Exclude<LogLevel, 'debug'>;
+/**
+ * How to build one of the SDK's pino-backed loggers.
+ *
+ * A union rather than `{ level, isDev }`, and that is the whole point:
+ * `{ isDev: false, level: 'debug' }` does not typecheck, so a production
+ * build cannot ship a logger that prints bearer tokens to a browser console.
+ *
+ * `isDev` does exactly one thing - decide whether `'debug'` is a legal level.
+ * It changes no formatting: dev output and production output are the same
+ * shape, so what you debug is what you ship. Pretty-printing is a pipe the
+ * host owns (`node server.js | npx pino-pretty`), not a dependency the SDK
+ * takes.
+ */
+type PinoLoggerOptions = {
+    readonly isDev: true;
+    readonly level: LogLevel;
+} | {
+    readonly isDev: false;
+    readonly level: ProductionLogLevel;
+};
+/**
+ * Which part of the SDK a line came from, carried as the `scope` field on
+ * every event.
+ *
+ * It names the seam that **reported** the line, not the layer that raised what
+ * it reports: an error from `OFFERS` surfaced by `useOffers` is reported on a
+ * `HOOKS` line, because that is the hook telling you what it did with it. The
+ * `OFFERS` line for the same error is emitted separately, by the namespace.
+ *
+ * A closed union rather than a free string so that `ONDO` and `Ondo` cannot
+ * both appear, so that adding a namespace without giving it a scope fails to
+ * compile, and so that a host can `switch` on it when routing. Anything finer
+ * - an operation, a flow, a hook - is a {@link LogBinding} and appears as its
+ * own field.
+ */
+type LogScope = 'HTTP' | 'RPC' | 'AUTH' | 'OFFERS' | 'REQUIREMENTS' | 'WALLETS' | 'ERC20' | 'TOKEN_SALE' | 'SUPERSTATE' | 'ONDO' | 'CENTRIFUGE' | 'TOKENS' | 'SUPPORT' | 'HOOKS';
+/**
+ * Correlates every line one logical request produces. The first attempt, each
+ * retry, and the re-send after a session renewal all carry the same id, so a
+ * failure can be read back to the request that caused it.
+ */
+type RequestId = Newtype<string, 'RequestId'>;
+/**
+ * The id frontline keys its own logs by, minted server-side and returned as
+ * `event_id` on an error envelope. Quote it when raising a ticket with
+ * CoinList support: it is what leads from a partner's log line to the request
+ * as the backend saw it.
+ *
+ * A {@link Newtype} rather than a bare `string` because it sits next to
+ * {@link RequestId} and frontline's `code` on the same cause, and the three
+ * are not interchangeable: an id swapped for a code reads plausibly and points
+ * a support engineer at nothing.
+ */
+type FrontlineEventId = Newtype<string, 'FrontlineEventId'>;
+/**
+ * What the SDK knows about a failure, classified.
+ *
+ * **Safe to forward as it stands.** Every arm is SDK-authored classification
+ * or a server-authored identifier: no request or response body, no host-
+ * supplied parameter, and no value read off a thrown error the SDK did not
+ * author. There is nothing here to strip before handing it to an error
+ * tracker, which is deliberate - a `LogCause` reaches {@link Logger.error},
+ * the level a host actually runs in production, and a guarantee that depends
+ * on the host remembering to strip a field is not a guarantee.
+ *
+ * It is the SDK's **only** structured classification of a thrown error, and it
+ * reaches {@link Logger.warn} as well as {@link Logger.error}: a recoverable
+ * failure is no less worth naming than a fatal one, and rendering it into a
+ * string instead would have meant interpolating into `msg`.
+ *
+ * Bodies are a `'debug'`-only disclosure and stay on the `HTTP` lines, which
+ * {@link RequestId} points at.
+ *
+ * The arms are the remedies, not the exception classes: a `validation` cause
+ * means the backend sent something the SDK does not understand and is worth
+ * reporting to CoinList, while an `invariant` cause means the SDK itself
+ * computed something impossible and is worth reporting as an SDK bug. Reading
+ * `type` should tell you who has to fix it.
+ *
+ * It carries no scope of its own. The {@link SafeEvent} it arrives on has one,
+ * and a cause could only ever have repeated it: the scope is stamped by the
+ * logger that *emits* the line, not by the layer that raised the error, so a
+ * `validation` failure from `OFFERS` surfaced by `useOffers` would have been
+ * tagged `HOOKS` on the hook's line. Forward the event, not the cause alone.
+ */
+/**
+ * Why an on-chain read failed, named after what a caller would do about it
+ * rather than after the viem error class that reported it. See the `rpc` arm
+ * of {@link LogCause}.
+ */
+type RpcFailureReason = 'reverted' | 'node-rejected' | 'transport' | 'malformed-response' | 'unknown';
+type LogCause = 
+/**
+ * A request reached the backend and came back non-2xx.
+ *
+ * Deliberately carries no response body. `requestId` is how you get the
+ * rest: the `HTTP` lines for the same request carry the method, the path,
+ * the duration, every retry, and at `'debug'` the body itself. `code` and
+ * `eventId` are frontline's own - quote `eventId` when raising a ticket with
+ * CoinList support.
+ */
+{
+    type: 'http';
+    requestId: RequestId | null;
+    status: number;
+    code: string | null;
+    eventId: FrontlineEventId | null;
+}
+/**
+ * The wire succeeded; the payload was not a shape the SDK can map.
+ *
+ * `message` is an SDK-authored template and may quote the single scalar that
+ * failed - `Unsupported chain: "solana_mainnet"`, `expires_at: not a date
+ * ("13/40/2026")`. That one value is the point of the arm; it is never a
+ * body and never a whole field set.
+ */
+ | {
+    type: 'validation';
+    message: string;
+}
+/**
+ * The SDK computed something impossible. An SDK bug - please report it.
+ * `message` is an SDK-authored template, like `validation`'s.
+ */
+ | {
+    type: 'invariant';
+    message: string;
+}
+/**
+ * Every operand was well-formed and the arithmetic on them still had no
+ * answer: a division by zero, a result outside the range its type can hold.
+ * `message` is an SDK-authored template, like `validation`'s.
+ *
+ * Separate from `invariant` because the remedy differs. An `invariant` says
+ * the SDK computed something impossible and is a bug to report against the
+ * SDK; a `math` says the operation was well-posed and the operands, which
+ * came off the wire, admit no result - so it points at the response the same
+ * way `validation` does, one step later.
+ */
+ | {
+    type: 'math';
+    message: string;
+}
+/** An API-backed call was made without a logged-in user. */
+ | {
+    type: 'not-authenticated';
+}
+/** A code path the SDK has not shipped yet. */
+ | {
+    type: 'not-implemented';
+}
+/**
+ * The user's wallet, or the chain, refused.
+ *
+ * {@link RedactedWalletError} rather than the full `WalletError`: its
+ * `unknown` arm arrives with its `cause` dropped, that field holding the raw
+ * wallet-library error whose message and metadata carry the transaction's
+ * `from`, `to`, `value` and calldata. It is still on the flow's own returned
+ * result, and on the `'debug'` line the flow seam emits beside this one.
+ *
+ * A type rather than a scrub applied at the call site, so an arm that grew a
+ * raw field would fail the build.
+ */
+ | {
+    type: 'wallet';
+    error: RedactedWalletError;
+}
+/**
+ * An on-chain read did not answer. `reason` names the remedy, not the viem
+ * class that carried it:
+ *
+ * - `reverted` - the contract refused the call. Check the arguments, or the
+ *   contract's own state (a stopped swap reverts its `preview`).
+ * - `node-rejected` - the node reached the contract and declined. Usually a
+ *   malformed request, a rate limit, or a method the node does not serve.
+ *   Also where a host-supplied `Transport` throwing something viem cannot
+ *   read a code off lands: `buildRequest` wraps it in `UnknownRpcError`.
+ * - `transport` - the node was not reached at all. Retry, or fail over.
+ *   A dropped `webSocket()` socket included.
+ * - `malformed-response` - the call returned something the ABI cannot
+ *   decode, which in practice means the wrong address or a stale ABI.
+ * - `unknown` - anything else. Rare, since viem wraps most of what a read
+ *   can throw into one of the classes the arms above name.
+ *
+ * Decided by `instanceof` alone. Nothing is read off the thrown error - not
+ * its `name`, not its `message`, not a revert reason - because a viem
+ * message embeds the calldata, the contract address and the caller, and
+ * `name` is a writable property a host-supplied transport could set to
+ * anything. All of that is on the paired `'debug'` line.
+ */
+ | {
+    type: 'rpc';
+    reason: RpcFailureReason;
+}
+/**
+ * Something the SDK does not recognise - usually a host-supplied lambda
+ * (`getAccessToken`, an {@link EvmWallet} method) throwing, or a
+ * network-level `fetch` failure.
+ *
+ * `name` is the error's class name and nothing else. The message and the
+ * thrown value itself are host-authored, so they are a `'debug'` disclosure:
+ * the paired debug line renders them in full.
+ */
+ | {
+    type: 'generic-error';
+    name: string;
 };
+
 /**
- * Everything a user must satisfy before they can participate in an offer:
- * reading the checklist and its live statuses, and the operations that satisfy
- * individual requirements — identity verification (KYC) and tax-document
- * signing.
+ * Where the SDK sends its on-chain reads, per chain.
  *
- * Wallet requirements (`external_wallet`, `whitelisted_wallet`) are satisfied
- * through `WalletsNamespace` instead, since wallet proofs are also used
- * outside the requirements flow.
+ * Leave it undefined and reads go through CoinList's authenticated JSON-RPC
+ * proxy (`POST /v1/chains/{chain}/rpc`), which needs no setup but does need a
+ * logged-in user - the proxy is OAuth-gated, so a read on a chain the SDK is
+ * proxying fails with its `401`, surfaced as the viem error wrapping it. A
+ * chain you name here is read straight from your own node instead, and needs
+ * no CoinList session at all.
  *
- * Every method requires an authenticated user and throws
- * {@link NotAuthenticatedError} otherwise.
+ * Each entry is either:
+ *
+ * - an RPC URL, which the SDK wraps in viem's `http()` transport, or
+ * - a viem {@link Transport} used as it stands - `fallback([...])`,
+ *   `webSocket()`, or your app's own.
+ *
+ * Chains you leave out fall back to the proxy individually, so overriding
+ * mainnet does not opt Sepolia out. The SDK always constructs the viem
+ * `PublicClient` itself, so the chain definition, batching and retry policy
+ * stay the SDK's regardless of the transport you supply.
+ *
+ * @example
+ * ```ts
+ * createCoinListClient({
+ *   clientId,
+ *   redirectUri,
+ *   rpc: {
+ *     ethereum_mainnet: 'https://eth-mainnet.g.alchemy.com/v2/KEY',
+ *     ethereum_sepolia: fallback([http(primary), http(backup)]),
+ *     // base_* unset -> proxied through CoinList
+ *   },
+ * });
+ * ```
  */
-interface RequirementsNamespace {
-    /**
-     * Fetches the requirements for every option of an offer, grouped by option
-     * id. This is the definition of the checklist; {@link statuses} tells you
-     * where the user stands against it.
-     */
-    forOffer(offerId: OfferId): Promise<Record<OfferOptionId, Requirement[]>>;
-    /**
-     * Fetches the current user's status for each requirement of an offer.
-     */
-    statuses(offerId: OfferId): Promise<RequirementStatusInfo[]>;
+type RpcConfig = Partial<Record<EthereumChain, string | Transport>>;
+interface Config {
+    /** OAuth2 public identifier. */
+    readonly clientId: ClientId;
     /**
-     * Creates a short-lived Sumsub WebSDK access token so an identity
-     * verification (KYC) flow can be started, e.g. by the `IdentityVerification`
-     * component.
+     * OAuth2 redirect URI. Recommended to point to a frontend page where
+     * {@link CoinListClient#completeOauth} can be called to complete the PKCE
+     * flow on the client side.
      */
-    createKycToken(params?: CreateKycTokenParams): Promise<KycToken>;
+    readonly redirectUri: RedirectUri;
     /**
-     * Fetches the current user's PII, used to pre-fill tax forms such as the
-     * W-8BEN. Fields the entity hasn't provided are `null`.
+     * Recommended to leave undefined. Used to change the CoinList environment;
+     * default is production.
      */
-    getPii(): Promise<Pii>;
+    readonly baseUrl?: string;
     /**
-     * Starts (or resumes) a document signing submission.
+     * Recommended to leave undefined. Overrides the base URL of the public
+     * token registry backing `coinlist.tokens`; default is the production
+     * registry.
      */
-    submitDocument(params: SubmitDocumentParams): Promise<DocumentSubmission>;
-}
-declare class RequirementsNamespaceImpl implements RequirementsNamespace {
-    protected readonly ctx: UniversalNamespaceContext;
-    protected readonly log: InternalLogger;
-    constructor(ctx: UniversalNamespaceContext);
-    forOffer(offerId: OfferId): Promise<Record<OfferOptionId, Requirement[]>>;
-    statuses(offerId: OfferId): Promise<RequirementStatusInfo[]>;
-    createKycToken(params?: CreateKycTokenParams): Promise<KycToken>;
-    getPii(): Promise<Pii>;
-    submitDocument(params: SubmitDocumentParams): Promise<DocumentSubmission>;
-}
-
-/**
- * Reads over CoinList's offers: the catalogue a user can browse, and the full
- * detail of a single offer.
- *
- * Every method requires an authenticated user and throws
- * {@link NotAuthenticatedError} otherwise. On the server, the same reads are
- * additionally available with an app-level token — see
- * `ServerOffersNamespace`.
- */
-interface OffersNamespace {
+    readonly tokensBaseUrl?: string;
     /**
-     * Fetches every offer, iterating through all pages. Prefer {@link listPage}
-     * when you render a paginated list yourself.
+     * Where the SDK reports what it is doing. **Omit it and the SDK logs nothing
+     * at all** - no `console` fallback, at any level, on any codepath. Supply
+     * one and every request, every classified failure and every hook state
+     * transition is reported at the level your logger asks for.
+     *
+     * Absent, the SDK says nothing at all - there is no fallback to `console`,
+     * at any level, on any codepath.
+     *
+     * **Running the SDK's logging in production is not advised.** The safest
+     * posture is to leave this undefined outside development, staging and
+     * incident reproduction: a seam that emits nothing cannot disclose anything,
+     * and that property does not depend on the SDK continuing to get redaction
+     * right.
+     *
+     * If you do run one there, run it at `'info'` or above and know what that
+     * does and does not buy you. Those levels are **redacted by construction**:
+     * they carry only SDK-authored classification and server-authored
+     * identifiers, and the type system holds that line rather than a convention -
+     * an event at those levels accepts scalar fields only, so a body, a DTO or
+     * an operation's parameters cannot be put on one. What the SDK does **not**
+     * give you is a warranty that the result is safe for your environment. The
+     * mechanism is checkable and stated; the conclusion depends on your sink,
+     * your retention and your threat model, and it is yours to draw.
+     *
+     * **`'debug'` is not.** It reports request and response bodies, full URLs,
+     * headers and operation parameters verbatim - bearer tokens, KYC answers,
+     * tax-document fields, wallet signatures - and **the SDK does not redact**.
+     * Run it on a developer's machine, in tests, and in beta or staging
+     * environments where the data flowing through is not real customer data.
+     * The shipped implementations make that structural: built with
+     * `isDev: false`, `'debug'` does not typecheck. Either way, filtering,
+     * redaction and retention at your sink are yours, not the SDK's.
+     *
+     * Every method you implement here **must be total**: the SDK calls them on
+     * the codepath of the work they report and does not catch them, so a logger
+     * that throws fails the operation it was describing.
+     *
+     * See {@link Logger} for the full contract, and {@link pinoClientLogger} or
+     * {@link pinoServerLogger} for a ready-made implementation over pino.
      */
-    list(): Promise<Offer[]>;
+    readonly logger?: Logger;
     /**
-     * Fetches a single page of offers. Pass the previous response's
-     * `startingAfter` as `after` to advance.
+     * Where on-chain reads go. Omit it and they are proxied through CoinList.
+     * See {@link RpcConfig}.
      */
-    listPage(params: PaginationParams): Promise<PaginatedResponse<Offer>>;
+    readonly rpc?: RpcConfig;
     /**
-     * Fetches the full detail of one offer, including its options. Note this
-     * returns {@link OfferDetail} — a richer model than the {@link Offer}
-     * summaries {@link list} returns.
+     * Called when the SDK has **confirmed** that the user's CoinList session is
+     * gone - its refresh token expired or was revoked - so you can clear your
+     * own state and show a sign-in entry point.
+     *
+     * Confirmed, because the backend answers "rotated a moment ago by a
+     * concurrent request" and "dead" identically. A single rejection is only a
+     * suspicion: the SDK acts on it only once the same session is rejected again
+     * after a settle window, so a lost refresh race never signs a user out.
+     *
+     * Each environment reports what it confirmed itself, so it fires in the
+     * one that drove the confirmation:
+     *
+     * - **`CoinListClient`**: fires when the SDK moves from `'logged-in'` to
+     *   `'logged-out'` because your `getAccessToken` answered `null` (or the
+     *   very token the API just refused) twice, a second apart.
+     * - **`CoinListServer`**: fires when the same process sees a refresh token
+     *   rejected twice, 5 to 60 seconds apart, or an expired session that
+     *   carries no refresh token. The SDK clears the session from your
+     *   `SessionStore` just before. The browser's confirmation, through your
+     *   `getAccessToken` endpoint, comes a second after the first rejection, so
+     *   it does not reach this verdict: when the browser drives renewal, expect
+     *   the `CoinListClient` callback, and this one only if a later request
+     *   presents the dead session 5 to 60 seconds on.
+     *
+     * It never fires on `auth.logout()`, on a 5xx, a timeout or a network
+     * failure - those mean the SDK could not find out, not that the session
+     * ended. Per environment it fires at most once per session, within a
+     * 60-second memory: the server remembers a verdict for 60 seconds per
+     * process (per JavaScript module instance, so Next.js middleware and route
+     * handlers count separately). The same dead session presented again after
+     * that, or to another instance, can be reported again, so make your handler
+     * idempotent.
+     *
+     * It is called on the next microtask and not awaited. A rejection is
+     * logged and dropped, so it cannot fail or delay the request that
+     * discovered the expiry. A synchronous handler is written `async () => {}`.
      */
-    get(id: OfferId): Promise<OfferDetail>;
-}
-declare class OffersNamespaceImpl implements OffersNamespace {
-    private readonly ctx;
-    private readonly log;
-    constructor(ctx: UniversalNamespaceContext);
-    list(): Promise<Offer[]>;
-    listPage(params: PaginationParams): Promise<PaginatedResponse<Offer>>;
-    get(id: OfferId): Promise<OfferDetail>;
+    readonly onSessionExpired?: () => Promise<void>;
 }
 
-/**
- * Raw JSON from the token registry (Nabu), a static CDN serving token display
- * metadata. It is a separate backend from frontline: responses omit optional
- * fields rather than sending `null`, and may grow unknown fields at any time;
- * we only read the fields named here.
- */
-type NabuLogoImageDto = {
-    url: string;
-    width: number;
-    height: number;
-};
-/**
- * A logo is either a single vector (valid at any size) or a dimensioned
- * raster original plus pre-scaled variants at ascending widths.
- */
-type NabuLogoDto = {
-    kind: 'VECTOR';
-    url: string;
-} | {
-    kind: 'RASTER';
-    original: NabuLogoImageDto;
-    variants: NabuLogoImageDto[];
-};
-/** One token from the registry's `/{chain}/token/{address}` route. */
-type NabuTokenDto = {
-    data_version: string;
-    schema_version: number;
-    chain: string;
-    protocol: string;
-    chain_id: number;
-    kind: string;
-    name: string;
-    symbol: string;
-    decimals: number;
-    logo: NabuLogoDto;
-    logo_dark?: NabuLogoDto;
-    coingecko_id?: string;
-    teller_code?: string;
-    address: string;
+type ClientCredentialsOAuth = Newtype<OAuthAccessToken, 'ClientCredentialsOAuth'>;
+declare const ClientCredentialsOAuth: (value: OAuthAccessToken) => ClientCredentialsOAuth;
+type OAuthAccessToken = {
+    value: string;
+    expiresAt: Date;
 };
-/**
- * One asset inside a chain snapshot. The snapshot mixes the chain's native
- * coin (`kind: 'COIN'`, no address) with its tokens (`kind: 'TOKEN'`), so
- * `address` is optional here where {@link NabuTokenDto} requires it.
- */
-type NabuChainAssetDto = {
-    kind: string;
-    name: string;
-    symbol: string;
-    decimals: number;
-    logo: NabuLogoDto;
-    logo_dark?: NabuLogoDto;
-    address?: string;
-};
-/** The registry's `/{chain}/assets.json` route: one chain, all its assets. */
-type NabuChainAssetsDto = {
-    data_version: string;
-    schema_version: number;
-    chain: string;
-    protocol: string;
-    assets: NabuChainAssetDto[];
-};
-/** The registry's `/assets.json` route: the complete snapshot, every chain. */
-type NabuRegistryDto = {
-    data_version: string;
-    schema_version: number;
-    chains: Array<{
-        chain: string;
-        protocol: string;
-        assets: NabuChainAssetDto[];
-    }>;
+type OAuthRefreshToken = Newtype<string, 'OAuthRefreshToken'>;
+declare const OAuthRefreshToken: (value: string) => OAuthRefreshToken;
+type OAuthSession = {
+    accessToken: OAuthAccessToken;
+    refreshToken?: OAuthRefreshToken;
 };
 
 /**
- * An absolute URL to a logo image in the token registry. Registry image URLs
- * are content-fingerprinted and served immutable, so a value is safe to cache
- * for as long as you hold it.
- */
-type TokenLogoUrl = Newtype<string, 'TokenLogoUrl'>;
-declare const TokenLogoUrl: (value: string) => TokenLogoUrl;
-type TokenLogoImage = {
-    url: TokenLogoUrl;
-    width: number;
-    height: number;
-};
-/**
- * `VECTOR` is a single SVG. `RASTER` has webp variants at 32/64/128/256/512px
- * widths (never wider than the original): use the smallest one that covers
- * your render size, or `original` if none does.
- */
-type TokenLogo = {
-    kind: 'VECTOR';
-    url: TokenLogoUrl;
-} | {
-    kind: 'RASTER';
-    original: TokenLogoImage;
-    variants: TokenLogoImage[];
-};
-declare const TokenLogo: {
-    /** `baseUrl` is the registry origin; registry URLs are root-relative. */
-    fromDto: (dto: NabuLogoDto, baseUrl: string) => TokenLogo;
-};
-/**
- * Display metadata for one token, from CoinList's public token registry.
- *
- * Keyed by `(chain, address)` — never by symbol, which can collide. The
- * registry is curated: a token missing from it is an expected answer, not an
- * error, so lookups return `null` rather than throwing.
+ * An instant: milliseconds since the Unix epoch, as `Date.now()` reads it.
+ * Distinct from {@link Millis}, a duration, so an instant cannot be passed
+ * where a timeout is expected or the other way round.
  */
-type TokenMetadata = {
-    identifier: TokenIdentifier;
-    name: string;
-    symbol: AssetSymbol;
-    decimals: AssetDecimals;
-    logo: TokenLogo;
-    /** Dark-theme logo; `null` when the registry configures none. */
-    logoDark: TokenLogo | null;
-};
-declare const TokenMetadata: {
-    /** `baseUrl` is the registry origin; registry logo URLs are root-relative. */
-    fromDto: (dto: NabuTokenDto, baseUrl: string) => TokenMetadata;
-    /**
-     * Maps the complete registry snapshot to every token it lists across the
-     * chains this SDK models, skipping native coins and chains outside
-     * {@link EthereumChain} (e.g. Solana) rather than failing on them — the
-     * registry may serve chains ahead of the SDK's type surface.
-     */
-    fromRegistryDto: (dto: NabuRegistryDto, baseUrl: string) => TokenMetadata[];
+type EpochMillis = Newtype<number, 'EpochMillis'>;
+declare const EpochMillis: {
     /**
-     * Maps a chain snapshot to the tokens it lists, skipping the chain's native
-     * coin (`kind: 'COIN'`, no contract address).
+     * @throws {@link ValidationError} unless `value` is an integer a `Date` can
+     * represent: at most {@link MAX_EPOCH_MILLIS} either side of the epoch.
      */
-    fromChainAssetsDto: (dto: NabuChainAssetsDto, baseUrl: string) => TokenMetadata[];
+    of: (value: number) => EpochMillis;
+    /** The wall clock. Code that needs the time takes a `TimeEff` instead. */
+    now: () => EpochMillis;
+    /** @throws {@link ValidationError} for an invalid `Date`. */
+    fromDate: (date: Date) => EpochMillis;
+    /** How long after `from` the instant `to` is; negative if it is before. */
+    elapsed: (from: EpochMillis, to: EpochMillis) => Millis;
+    plus: (at: EpochMillis, duration: Millis) => EpochMillis;
 };
-
 /**
- * Token display metadata — name, symbol, decimals, and logos — from
- * CoinList's public token registry, keyed by {@link TokenIdentifier} (the
- * same chain + address pairs `Offer.tokens` carries).
- *
- * Unlike the other namespaces, this one is public: no method requires an
- * authenticated user, and nothing here touches the CoinList API — reads go to
- * the registry's CDN.
+ * A duration in milliseconds. May be negative: the gap between two instants
+ * read off a wall clock that stepped back in between.
  */
-interface TokensNamespace {
-    /**
-     * Fetches metadata for one token. Returns `null` when the registry does not
-     * list the token — the registry is curated, so callers must fall back to
-     * their own display defaults rather than treat this as an error.
-     */
-    get(token: TokenIdentifier): Promise<TokenMetadata | null>;
-    /**
-     * Fetches every token the registry lists, in one request: the complete
-     * snapshot with no `chain`, or one chain's snapshot with it. Prefer this
-     * over calling {@link get} in a loop when displaying a catalogue — two
-     * hundred tokens across three chains is still a single download.
-     *
-     * The complete snapshot spans every chain the registry knows; tokens on
-     * chains this SDK does not model (e.g. Solana) are left out of the result.
-     *
-     * Unlike {@link get}, a missing snapshot throws rather than returning `[]`:
-     * the registry always publishes the complete snapshot and one per chain it
-     * knows, so an absence is a deployment problem, not an empty catalogue.
-     */
-    list(chain?: EthereumChain): Promise<TokenMetadata[]>;
-}
-declare class TokensNamespaceImpl implements TokensNamespace {
-    private readonly api;
-    private readonly log;
+type Millis = Newtype<number, 'Millis'>;
+declare const Millis: {
+    of: (value: number) => Millis;
+};
+/** A duration in whole, non-negative seconds. */
+type Seconds = Newtype<number, 'Seconds'>;
+declare const Seconds: {
     /**
-     * Takes the registry origin rather than a `UniversalNamespaceContext`: the
-     * registry is unauthenticated and on its own host, so the frontline sender
-     * and the auth check would both be dead weight here.
+     * @throws {@link ValidationError} unless `value` is a non-negative integer.
      */
-    constructor(baseUrl: string, logger?: Logger | null);
-    get(token: TokenIdentifier): Promise<TokenMetadata | null>;
-    list(chain?: EthereumChain): Promise<TokenMetadata[]>;
-}
+    of: (value: number) => Seconds;
+    toMillis: (value: Seconds) => Millis;
+};
 
-export { OndoTradingStatus as $, AuthorizationCode as A, BlockchainAmount as B, CodeVerifier as C, TokenMetadata as D, type Erc20Namespace as E, type OfferType as F, type OndoSwapOfferDetail as G, type CoinListTokenSaleOfferDetail as H, type SuperstateSwapOfferDetail as I, Offer as J, RequirementStatusInfo as K, type Logger as L, type RequirementType as M, type RequirementStatusValue as N, OfferId as O, Participation as P, OfferOptionAddress as Q, type RequirementsNamespace as R, type SuperstateSwapNamespace as S, type TokensNamespace as T, type UniversalNamespaceContext as U, RequirementId as V, type WalletError as W, type KycLevelName as X, DocumentSubmission as Y, type WalletChallengeType as Z, type PinoLoggerOptions as _, EthereumChain as a, type GetTokenBalanceParams as a$, AssetDecimals as a0, type BuildOndoBuyParams as a1, type BuildOndoSellParams as a2, OndoQuote as a3, type OndoQuoteSize as a4, type TokenIdentifier as a5, OfferOptionAddressId as a6, TokenLogo as a7, type DebugEvent as a8, type FrontlineEventId as a9, type Newtype as aA, type AllowWalletParams as aB, AllowWalletResponse as aC, Asset as aD, AssetCode as aE, Blockchain as aF, type BuildOndoSwapParamsCore as aG, Chain as aH, ClientId as aI, CodeChallenge as aJ, type CoinListTokenSaleOffer as aK, ConnectExternalWalletParams as aL, type CreateKycTokenParams as aM, CreateParticipationParams as aN, CreateWalletOwnershipChallengeParams as aO, Cursor as aP, type DocumentFormType as aQ, type DocumentSubmissionStatus as aR, type DocumentType as aS, ETHEREUM_CHAINS as aT, Erc20NamespaceImpl as aU, FaqItem as aV, type GetOndoQuoteParams as aW, type GetOndoTradingStatusParams as aX, type GetSwapAuthorizationParams as aY, type GetSwapPreviewParams as aZ, type GetTokenAllowanceParams as a_, HttpError as aa, type HttpResponse as ab, KycToken as ac, type LogBinding as ad, type LogBindings as ae, type LogCause as af, type LogLevel as ag, type LogScope as ah, type LogValue as ai, type ProductionLogLevel as aj, RedactedWalletError as ak, type RequestId as al, type RpcFailureReason as am, type SafeEvent as an, type SafeFields as ao, type UnredactedFields as ap, OAuthSession as aq, ClientCredentialsOAuth as ar, ClientSecret as as, type Sender as at, PaginationParams as au, PaginatedResponse as av, DecimalString as aw, SwapStatus as ax, type Uint256 as ay, KnownAssetSymbol as az, EvmContractAddress as b, HexEncodedTransactionData as b0, Isin as b1, Iso2CountryCode as b2, Link as b3, type ListOptionAddressesParams as b4, MAX_ASSET_DECIMALS as b5, MAX_UINT_256 as b6, Milestone as b7, OAuthRefreshToken as b8, type OfferBase as b9, SOLANA_CHAINS as bA, STABLE_DECIMALS as bB, SolanaChain as bC, type SubmitDocumentParams as bD, type SuperstateSwapOffer as bE, type SwapContractRef as bF, SwapPreview as bG, TermItem as bH, Ticker as bI, type TokenLogoImage as bJ, TokenLogoUrl as bK, type TokenRole as bL, TokensNamespaceImpl as bM, type Tx as bN, WalletAddress as bO, WalletOwnershipChallenge as bP, type WalletProtocol as bQ, WalletsNamespaceImpl as bR, apiErrorCode as bS, assertUint256 as bT, isChain as bU, isOfferType as bV, parseUint256 as bW, type OfferDetailBase as ba, OfferEditorial as bb, OfferOption as bc, OfferOptionSlug as bd, OfferSlug as be, OfferToken as bf, OffersNamespaceImpl as bg, type OndoQuoteDuration as bh, type OndoSellOutcome as bi, type OndoSwapOffer as bj, PKCEState as bk, type PaginatedResponseDto as bl, ParticipationId as bm, type ParticipationStatus as bn, ParticipationsPaginationParams as bo, PauseFlags as bp, Pii as bq, PiiAddress as br, PiiJurisdiction as bs, type PiiKind as bt, type QueryParamValue as bu, type QueryParamValues as bv, RedirectUri as bw, type RemoveOptionAddressParams as bx, type RequirementActionNeededReason as by, type RpcConfig as bz, type CoinListTokenSaleNamespace as c, OfferOptionId as d, AssetId as e, CoinListTokenSaleNamespaceImpl as f, type OndoNamespace as g, AssetSymbol as h, OfferSwapContract as i, OndoBuyTransaction as j, OndoSellTransaction as k, type OndoSwapTransactionCore as l, type OrderBookSide as m, OndoNamespaceImpl as n, type WalletsNamespace as o, Bps as p, EvmWalletAddress as q, SuperstateSwapNamespaceImpl as r, Requirement as s, RequirementsNamespaceImpl as t, type Config as u, type OAuthAccessToken as v, type OffersNamespace as w, StablecoinSymbol as x, type Erc20Asset as y, OfferDetail as z };
+export { type CentrifugeVaultStatus as $, AuthorizationCode as A, BlockchainAmount as B, CodeVerifier as C, type Offer as D, EthereumChain as E, type TokenMetadata as F, type OfferDetail as G, StablecoinSymbol as H, type Erc20Asset as I, type CoinListTokenSaleOfferDetail as J, CentrifugeVaultLegId as K, type CentrifugeVaultOfferDetail as L, Seconds as M, AsyncOfferDetail as N, type OfferVaultContract as O, type Participation as P, type RequirementStatusInfo as Q, type RequirementsNamespace as R, type SwapQuote as S, type TokensNamespace as T, type KycLevelName as U, type RequirementType as V, type WalletError as W, type RequirementStatusValue as X, RequirementId as Y, type PinoLoggerOptions as Z, type Logger as _, AssetSymbol as a, type FrontlineEventId as a$, type CentrifugeVaultRef as a0, type BuildCentrifugeVaultBuyParams as a1, type BuildOndoBuyParams as a2, type OndoSwapOfferDetail as a3, type BuildOndoSellParams as a4, type OndoQuote as a5, type OndoQuoteSize as a6, type OndoTradingStatus as a7, AssetDecimals as a8, type SuperstateSwapOfferDetail as a9, type CentrifugeDepositPosition as aA, type CentrifugeOrderReason as aB, type CentrifugeOrderability as aC, type CentrifugeRedeemPosition as aD, CentrifugeShares as aE, type CentrifugeVaultClaimProceedsTransaction as aF, type CentrifugeVaultClaimTransaction as aG, type CentrifugeVaultOffer as aH, type CentrifugeVaultReason as aI, type CentrifugeVaultResolution as aJ, type CentrifugeVaultTransactionCore as aK, type CentrifugeWalletParams as aL, Chain as aM, type CoinListTokenSaleOffer as aN, type ConnectExternalWalletParams as aO, type CreateKycTokenParams as aP, type CreateParticipationParams as aQ, type CreateWalletOwnershipChallengeParams as aR, Cursor as aS, type DebugEvent as aT, DecimalString as aU, type DocumentFormType as aV, type DocumentSubmissionStatus as aW, type DocumentType as aX, ETHEREUM_CHAINS as aY, EpochMillis as aZ, type FaqItem as a_, CentrifugeVaultLeg as aa, type CentrifugeVault as ab, OfferOptionAddressId as ac, type DocumentSubmission as ad, type TokenIdentifier as ae, type OAuthSession as af, ClientCredentialsOAuth as ag, type PaginationParams as ah, type PaginatedResponse as ai, ClientSecret as aj, type RequestId as ak, ClientId as al, RedirectUri as am, CodeChallenge as an, PKCEState as ao, type SwapStatus as ap, KnownAssetSymbol as aq, type AllowWalletParams as ar, type AllowWalletResponse as as, type Asset as at, AssetCode as au, type AsyncOfferType as av, type BaseEvent as aw, Blockchain as ax, type BuildOndoSwapParamsCore as ay, CentrifugeAssets as az, EvmContractAddress as b, type TokenLogo as b$, type GetCentrifugeVaultStatusParams as b0, type GetOndoQuoteParams as b1, type GetOndoTradingStatusParams as b2, type GetSwapAuthorizationParams as b3, type GetSwapPreviewParams as b4, type GetSwapQuoteParams as b5, type GetTokenAllowanceParams as b6, type GetTokenBalanceParams as b7, HexEncodedTransactionData as b8, Isin as b9, type OndoSwapOffer as bA, ParticipationId as bB, type ParticipationStatus as bC, type ParticipationsPaginationParams as bD, PauseFlags as bE, type Pii as bF, type PiiAddress as bG, type PiiJurisdiction as bH, type PiiKind as bI, type ProductionLogLevel as bJ, type ReadCentrifugePositionParams as bK, type RedactedWalletError as bL, type RemoveOptionAddressParams as bM, type RequirementActionNeededReason as bN, type RpcConfig as bO, type RpcFailureReason as bP, SOLANA_CHAINS as bQ, STABLE_DECIMALS as bR, type SafeEvent as bS, type SafeFields as bT, SolanaChain as bU, type SubmitDocumentParams as bV, type SuperstateSwapOffer as bW, type SwapContractRef as bX, type SwapPreview as bY, type TermItem as bZ, Ticker as b_, Iso2CountryCode as ba, type KycToken as bb, type Link as bc, type ListOptionAddressesParams as bd, type LogBinding as be, type LogBindings as bf, type LogCause as bg, type LogLevel as bh, type LogScope as bi, type LogValue as bj, MAX_ASSET_DECIMALS as bk, MAX_UINT_256 as bl, type Milestone as bm, Millis as bn, type Newtype as bo, OAuthRefreshToken as bp, type OfferBase as bq, type OfferDetailBase as br, type OfferEditorial as bs, type OfferOption as bt, OfferOptionSlug as bu, OfferSlug as bv, type OfferToken as bw, type OfferType as bx, type OndoQuoteDuration as by, type OndoSellOutcome as bz, type CentrifugeVaultBuyTransaction as c, type TokenLogoImage as c0, TokenLogoUrl as c1, type TokenRole as c2, type Tx as c3, type Uint256 as c4, type UnredactedFields as c5, WalletAddress as c6, type WalletOwnershipChallenge as c7, type WalletOwnershipChallengeParamsBase as c8, type WalletProtocol as c9, assertUint256 as ca, isChain as cb, isOfferType as cc, parseUint256 as cd, resolveCentrifugeVaults as ce, type CentrifugeClaimDirection as d, type CentrifugeNamespace as e, OfferId as f, OfferOptionId as g, AssetId as h, type CoinListTokenSaleNamespace as i, type OfferSwapContract as j, type OndoBuyTransaction as k, type OndoSellTransaction as l, type OndoNamespace as m, type OndoSwapTransactionCore as n, type OrderBookSide as o, Bps as p, EvmWalletAddress as q, type SuperstateSwapNamespace as r, type Requirement as s, type WalletChallengeType as t, type OfferOptionAddress as u, type WalletsNamespace as v, type Config as w, type OAuthAccessToken as x, type OffersNamespace as y, type Erc20Namespace as z };