@coinlist-co/react 0.12.2-rc.e1f6c82 → 0.12.2

package/dist/client-credentials-BwcmPcn-.d.ts

@@ -0,0 +1,13 @@
+import { bp as Newtype, x as OAuthAccessToken } from './time-ChSGmKZe.js';
+
+/**
+ * An app-level access token, minted by `CoinListServer#auth.clientCredentials()`
+ * through the OAuth client-credentials grant. It authenticates the partner
+ * application rather than a user, so it must never reach a browser:
+ * `app-tokens-are-server-only` keeps every tree but the server and the api
+ * layer from importing this module.
+ */
+type ClientCredentialsOAuth = Newtype<OAuthAccessToken, 'ClientCredentialsOAuth'>;
+declare const ClientCredentialsOAuth: (value: OAuthAccessToken) => ClientCredentialsOAuth;
+
+export { ClientCredentialsOAuth as C };

package/dist/server/index.d.ts

@@ -1,51 +1,11 @@
-import { A as AuthorizationCode, C as CodeVerifier, af as OAuthSession, x as OAuthAccessToken, ag as ClientCredentialsOAuth, y as OffersNamespace, M as Offer, ah as PaginationParams, ai as PaginatedResponse, f as OfferId, H as OfferDetail, R as RequirementsNamespace, g as OfferOptionId, s as Requirement, v as WalletsNamespace, z as Erc20Namespace, i as CoinListTokenSaleNamespace, r as SuperstateSwapNamespace, m as OndoNamespace, e as CentrifugeNamespace, T as TokensNamespace, w as Config, aj as ClientSecret, K as Seconds, Z as PinoLoggerOptions, _ as Logger } from '../time-Bbqlt2x7.js';
+import { C as ClientCredentialsOAuth } from '../client-credentials-BwcmPcn-.js';
+import { A as AuthorizationGrant, ah as OAuthSession, x as OAuthAccessToken, y as OffersNamespace, D as Offer, ai as PaginationParams, aj as PaginatedResponse, n as OfferId, G as OfferDetail, R as RequirementsNamespace, f as OfferOptionId, s as Requirement, v as WalletsNamespace, z as Erc20Namespace, g as CoinListTokenSaleNamespace, r as SuperstateSwapNamespace, k as OndoNamespace, d as CentrifugeNamespace, T as TokensNamespace, w as Config, ak as ClientSecret, K as Seconds, X as PinoLoggerOptions, Y as Logger } from '../time-ChSGmKZe.js';
 import 'viem';
 
-interface SessionStore {
-    getSession(): Promise<OAuthSession | null>;
-    /**
-     * Persists or clears the OAuth session.
-     *
-     * **Omit this method to create a read-only store.** When absent, the SDK
-     * skips token refresh entirely — no network call is made and no refresh
-     * token is consumed. This is the correct approach for contexts that can read
-     * the session but cannot write it back, such as Next.js Server Components.
-     *
-     * ⚠️ Do **not** implement this as a no-op (`async () => {}`). If the method
-     * is present, the SDK assumes writes succeed: it will fire a token refresh
-     * network call, consume the refresh token, then invoke `setSession` — which
-     * would silently discard the new session and leave the browser holding an
-     * invalidated refresh token. Simply **omit** `setSession` to prevent any
-     * refresh from being attempted.
-     *
-     * {@link ServerAuthNamespace.completeOAuth} and
-     * {@link ServerAuthNamespace.logout} always require a writable store and
-     * throw {@link WritableSessionStoreRequiredError} if `setSession` is absent.
-     */
-    setSession?(session: OAuthSession | null): Promise<void>;
-}
-/**
- * The empty session store: holds no session, reads nothing, never writes.
- *
- * For server contexts that act without a user — the client-credentials grant
- * (`auth.clientCredentials`) and the public token registry (`tokens`) read
- * nothing from the store, so hosts building those paths need no store of
- * their own.
- *
- * `setSession` is deliberately absent, not a no-op — see
- * {@link SessionStore.setSession} for why a no-op is a bug.
- */
-declare function emptySessionStore(): SessionStore;
-/** The PKCE pair `CoinListClient#auth.completeOAuth` hands to the backend. */
-interface CompleteOAuthParams {
-    /** The short-lived authorization code parsed out of the redirect URL. */
-    code: AuthorizationCode;
-    /** The `code_verifier` the browser generated when starting the flow. */
-    codeVerifier: CodeVerifier;
-}
 /**
  * OAuth session lifecycle on your backend: exchanging authorization codes,
- * keeping the access token fresh, minting app-level tokens, and logging out.
+ * keeping the access token fresh and serving it to the browser, minting
+ * app-level tokens, and logging out - e.g. `coinlist.auth.getAccessToken()`.
  *
  * This namespace is server-only: every method needs the `clientSecret` and the
  * {@link SessionStore}, neither of which may exist in a browser.
@@ -63,7 +23,7 @@ interface ServerAuthNamespace {
      * does not provide `setSession`.
      * @throws {@link HttpError} if CoinList refuses the exchange.
      */
-    completeOAuth(params: CompleteOAuthParams): Promise<OAuthSession>;
+    completeOAuth(grant: AuthorizationGrant): Promise<OAuthSession>;
     /**
      * Returns a valid access token for the current session, refreshing it if it
      * is expired or near expiry. This is what you serve to
@@ -137,10 +97,51 @@ interface ServerAuthNamespace {
     logout(): Promise<void>;
 }
 
+declare class WritableSessionStoreRequiredError extends Error {
+    constructor(message?: string);
+}
+
+interface SessionStore {
+    getSession(): Promise<OAuthSession | null>;
+    /**
+     * Persists or clears the OAuth session.
+     *
+     * **Omit this method to create a read-only store.** When absent, the SDK
+     * skips token refresh entirely — no network call is made and no refresh
+     * token is consumed. This is the correct approach for contexts that can read
+     * the session but cannot write it back, such as Next.js Server Components.
+     *
+     * ⚠️ Do **not** implement this as a no-op (`async () => {}`). If the method
+     * is present, the SDK assumes writes succeed: it will fire a token refresh
+     * network call, consume the refresh token, then invoke `setSession` — which
+     * would silently discard the new session and leave the browser holding an
+     * invalidated refresh token. Simply **omit** `setSession` to prevent any
+     * refresh from being attempted.
+     *
+     * {@link ServerAuthNamespace.completeOAuth} and
+     * {@link ServerAuthNamespace.logout} always require a writable store and
+     * throw {@link WritableSessionStoreRequiredError} if `setSession` is absent.
+     */
+    setSession?(session: OAuthSession | null): Promise<void>;
+}
+/**
+ * The empty session store: holds no session, reads nothing, never writes.
+ *
+ * For server contexts that act without a user — the client-credentials grant
+ * (`auth.clientCredentials`) and the public token registry (`tokens`) read
+ * nothing from the store, so hosts building those paths need no store of
+ * their own.
+ *
+ * `setSession` is deliberately absent, not a no-op — see
+ * {@link SessionStore.setSession} for why a no-op is a bug.
+ */
+declare function emptySessionStore(): SessionStore;
+
 /**
  * The server-side offers namespace: the same reads as the shared
  * {@link OffersNamespace}, each additionally callable with an app-level token
- * from `ServerAuthNamespace.clientCredentials` instead of a user session.
+ * from `ServerAuthNamespace.clientCredentials` instead of a user session -
+ * e.g. `coinlist.offers.list(await coinlist.auth.clientCredentials())`.
  *
  * When a user session exists it takes precedence and `clientCreds` acts as a
  * fallback. Without either, the reads throw {@link NotAuthenticatedError}.
@@ -218,70 +219,25 @@ interface ServerConfig extends Config {
  * {@link ServerAuthNamespace.getAccessToken}.
  */
 interface CoinListServer {
-    /**
-     * OAuth session lifecycle: exchanging an authorization code, serving a valid
-     * access token to the browser, minting app-level tokens, and logging out —
-     * e.g. `coinlist.auth.getAccessToken()`.
-     */
+    /** The OAuth session lifecycle on your backend - see {@link ServerAuthNamespace}. */
     readonly auth: ServerAuthNamespace;
-    /**
-     * The offer catalogue — e.g. `coinlist.offers.list()`. Every read also
-     * accepts an app-level token from {@link ServerAuthNamespace.clientCredentials}
-     * so it can run without a user session.
-     */
+    /** The offer catalogue, e.g. `coinlist.offers.list()` - see {@link ServerOffersNamespace}. */
     readonly offers: ServerOffersNamespace;
-    /**
-     * Offer requirements and the operations that satisfy them — e.g.
-     * `coinlist.requirements.statuses(offerId)`. `forOffer` also accepts an
-     * app-level token; the rest is per-user data and needs a user session.
-     */
+    /** What a user must satisfy to participate - see {@link ServerRequirementsNamespace}. */
     readonly requirements: ServerRequirementsNamespace;
-    /**
-     * The user's external wallets: ownership proofs and offer-option bindings —
-     * e.g. `coinlist.wallets.list({ offerId, offerOptionId })`.
-     */
+    /** Wallet ownership proofs and offer-option bindings - see {@link WalletsNamespace}. */
     readonly wallets: WalletsNamespace;
-    /**
-     * Generic ERC-20 reads (token allowance and balance) — e.g.
-     * `coinlist.erc20.getBalance({ ... })`.
-     */
+    /** Generic ERC-20 allowance and balance reads - see {@link Erc20Namespace}. */
     readonly erc20: Erc20Namespace;
-    /**
-     * Token-sale operations: listing, reading, and recording participations —
-     * e.g. `coinlist.tokenSale.list()`. The on-chain `execute`
-     * flow is client-only and is not exposed here.
-     */
+    /** Token-sale participations - see {@link CoinListTokenSaleNamespace}. */
     readonly tokenSale: CoinListTokenSaleNamespace;
-    /**
-     * On-chain swap operations: quoting a swap, reading swap-contract state, and
-     * allow-listing a proven wallet — e.g.
-     * `coinlist.superstate.getOutputToken({ contractAddress, chain })`.
-     */
+    /** Superstate swap reads and wallet allow-listing - see {@link SuperstateSwapNamespace}. */
     readonly superstate: SuperstateSwapNamespace;
-    /**
-     * Ondo swap reads: trading status and quoting. Both are free to poll.
-     *
-     * No CoinList fee is applied to a quote; see {@link OndoNamespace}.
-     *
-     * This is Ondo's whole surface for now — the wallet-driven half arrives with
-     * ENG-1680 and will be client-only, since it needs a wallet to sign with.
-     */
+    /** Ondo swap quotes and transaction builders - see {@link OndoNamespace}. */
     readonly ondo: OndoNamespace;
-    /**
-     * Centrifuge vault reads: the vault-wide ordering gate, and each wallet's
-     * position. The status read is free to poll.
-     */
+    /** Centrifuge vault reads and calldata builders - see {@link CentrifugeNamespace}. */
     readonly centrifuge: CentrifugeNamespace;
-    /**
-     * Token display metadata (name, symbol, decimals, logos) from CoinList's
-     * public token registry, keyed by chain + contract address — e.g.
-     * `coinlist.tokens.get({ chain, address })` for an entry of
-     * `Offer.tokens`, or `coinlist.tokens.list()` for the whole
-     * catalogue in one request.
-     *
-     * Public and unauthenticated: unlike the other namespaces, its methods never
-     * require a session, so it also works with a read-only store.
-     */
+    /** Public token display metadata - see {@link TokensNamespace}. */
     readonly tokens: TokensNamespace;
 }
 declare function createCoinListServer(config: ServerConfig): CoinListServer;
@@ -345,8 +301,4 @@ declare function createCoinListServer(config: ServerConfig): CoinListServer;
  */
 declare function pinoServerLogger(options: PinoLoggerOptions): Logger;
 
-declare class WritableSessionStoreRequiredError extends Error {
-    constructor(message?: string);
-}
-
-export { type CoinListServer, type CompleteOAuthParams, type ServerAuthNamespace, type ServerConfig, type ServerOffersNamespace, type ServerRequirementsNamespace, type SessionStore, WritableSessionStoreRequiredError, createCoinListServer, emptySessionStore, pinoServerLogger };
+export { type CoinListServer, type ServerAuthNamespace, type ServerConfig, type ServerOffersNamespace, type ServerRequirementsNamespace, type SessionStore, WritableSessionStoreRequiredError, createCoinListServer, emptySessionStore, pinoServerLogger };