@nadohq/otc-client 0.55.0 → 0.57.0

package/README.md

@@ -37,6 +37,33 @@ It is also available on a `NadoClient` context.
 const result = await nadoClient.context.otcClient.execute({ dealId, taker });
 ```
 
+## Private quote login
+
+Quotes keyed by an owner address need a session while `owner_auth_enabled` is on. Quotes keyed by
+the public wallet `0xfffffffffffffffffffffffffffffffffffffffe` never do. The session is an HttpOnly
+cookie the browser keeps; open a new quote socket after logging in, since a socket keeps whatever
+session it had at its handshake.
+
+```ts
+import { buildOtcSiweMessage, OtcClient } from '@nadohq/otc-client';
+
+const nonce = await otcClient.getAuthNonce({ sender });
+const message = buildOtcSiweMessage({
+  domain: 'testnet.nado.xyz',
+  uri: 'https://testnet.nado.xyz',
+  address: signerAddress, // owner or the sender's linked signer, checksummed
+  chainId: 763373,
+  nonce: nonce.nonce,
+  issuedAtMs: nonce.issued_at_ms,
+  sender,
+});
+const signature = await walletClient.signMessage({ message });
+await otcClient.verifyAuth({ message, signature }); // throws on a non-200
+```
+
+The login routes only admit approved web origins, so they can be called from a browser page
+on one of those origins.
+
 ## Quotes
 
 `subscribe` and `unsubscribe` are the only RFQ methods. Pass `streams`, 1–100 entries applied

package/dist/{OtcClient-qUPYb1BP.cjs → OtcClient-BYspxGIn.cjs}

@@ -44,6 +44,24 @@ var OtcClient = class {
 		});
 	}
 	/**
+	* Starts a private quote login for `sender`. Build the message with `buildOtcSiweMessage`,
+	* sign it, and pass it to {@link OtcClient.verifyAuth} within 60s. Throws on a non-200.
+	*/
+	async getAuthNonce(params) {
+		return this.postAuth("/v1/auth/nonce", { sender: params.sender });
+	}
+	/**
+	* Completes a private quote login. On success the browser holds the session cookie; open a
+	* new quote socket afterwards, since a socket keeps the session it had at its handshake.
+	* Throws on a non-200; the message carries the service's `error` code.
+	*/
+	async verifyAuth(params) {
+		return this.postAuth("/v1/auth/verify", {
+			message: params.message,
+			signature: params.signature
+		});
+	}
+	/**
 	* Submits a signed taker order. Send this body unchanged on `retry_same_request`.
 	*/
 	async execute(params) {
@@ -73,6 +91,15 @@ var OtcClient = class {
 			ready: response.status === 200
 		};
 	}
+	/** The login routes need credentials. */
+	async postAuth(path, body) {
+		const response = await this.axiosInstance.post(`${this.opts.url}${path}`, body, { withCredentials: true });
+		this.checkResponseStatus(response);
+		return response.data;
+	}
+	checkResponseStatus(response) {
+		if (response.status !== 200 || !response.data) throw Error(`Unexpected response from server: ${response.status} ${response.statusText}. Data: ${JSON.stringify(response.data)}`);
+	}
 	async postExecution(path, body) {
 		return (await this.axiosInstance.post(`${this.opts.url}${path}`, body)).data;
 	}
@@ -85,4 +112,4 @@ Object.defineProperty(exports, "OtcClient", {
 	}
 });
 
-//# sourceMappingURL=OtcClient-qUPYb1BP.cjs.map
+//# sourceMappingURL=OtcClient-BYspxGIn.cjs.map

package/dist/OtcClient-BYspxGIn.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OtcClient-BYspxGIn.cjs","names":[],"sources":["../src/OtcClient.ts"],"sourcesContent":["import { getNadoClientTypeHeaders } from '@nadohq/shared';\nimport axios, { AxiosInstance, AxiosResponse } from 'axios';\nimport {\n  OtcExecuteParams,\n  OtcGetAuthNonceParams,\n  OtcGetExecutionStatusParams,\n  OtcGetReadyParams,\n  OtcReadyResult,\n  OtcVerifyAuthParams,\n} from './types/clientTypes';\nimport {\n  OtcServerAuthNonce,\n  OtcServerAuthSession,\n  OtcServerExecutionResponse,\n} from './types/serverTypes';\n\nexport interface OtcClientOpts {\n  /**\n   * OTC service origin, without a path, e.g. {@link OTC_CLIENT_ENDPOINTS}.\n   */\n  url: string;\n  // If provided, identifies the calling client, sent as a header with every request\n  clientType?: string;\n}\n\n/**\n * Client for the public OTC service.\n *\n * {@link OtcClient.execute} does not sign. The caller supplies an already-signed taker order.\n * A quote is not required. {@link OtcClient.getExecutionStatus} only reads a deal; it does not\n * start or resume one.\n *\n * Responses are the JSON body as returned, including non-200 admission responses. Branch on\n * `status` and `recovery_action`.\n */\nexport class OtcClient {\n  readonly opts: OtcClientOpts;\n  readonly axiosInstance: AxiosInstance;\n\n  constructor(opts: OtcClientOpts) {\n    this.opts = opts;\n    this.axiosInstance = axios.create({\n      withCredentials: false,\n      validateStatus: () => true,\n      headers: getNadoClientTypeHeaders(opts.clientType),\n    });\n  }\n\n  /**\n   * Starts a private quote login for `sender`. Build the message with `buildOtcSiweMessage`,\n   * sign it, and pass it to {@link OtcClient.verifyAuth} within 60s. Throws on a non-200.\n   */\n  async getAuthNonce(\n    params: OtcGetAuthNonceParams,\n  ): Promise<OtcServerAuthNonce> {\n    return this.postAuth('/v1/auth/nonce', { sender: params.sender });\n  }\n\n  /**\n   * Completes a private quote login. On success the browser holds the session cookie; open a\n   * new quote socket afterwards, since a socket keeps the session it had at its handshake.\n   * Throws on a non-200; the message carries the service's `error` code.\n   */\n  async verifyAuth(params: OtcVerifyAuthParams): Promise<OtcServerAuthSession> {\n    return this.postAuth('/v1/auth/verify', {\n      message: params.message,\n      signature: params.signature,\n    });\n  }\n\n  /**\n   * Submits a signed taker order. Send this body unchanged on `retry_same_request`.\n   */\n  async execute(params: OtcExecuteParams): Promise<OtcServerExecutionResponse> {\n    return this.postExecution('/v1/executor', {\n      deal_id: params.dealId,\n      taker: params.taker,\n      ...(params.pricerId ? { pricer_id: params.pricerId } : {}),\n    });\n  }\n\n  /**\n   * Reads one execution. Use it after a lost response, a refresh, or `wait`.\n   */\n  async getExecutionStatus(\n    params: OtcGetExecutionStatusParams,\n  ): Promise<OtcServerExecutionResponse> {\n    return this.postExecution('/v1/executor/status', {\n      deal_id: params.dealId,\n      taker_digest: params.takerDigest,\n    });\n  }\n\n  /**\n   * Checks that quote and deal product scopes overlap for a route. An omitted `pricerId`\n   * asks the service default. A direct execution needs a matching deal worker, not a prior quote.\n   */\n  async getReady(params: OtcGetReadyParams = {}): Promise<OtcReadyResult> {\n    const response = await this.axiosInstance.get(`${this.opts.url}/ready`, {\n      params: params.pricerId ? { pricer_id: params.pricerId } : undefined,\n    });\n    return {\n      httpStatus: response.status,\n      ready: response.status === 200,\n    };\n  }\n\n  /** The login routes need credentials. */\n  private async postAuth<T>(path: string, body: unknown): Promise<T> {\n    const response = await this.axiosInstance.post(\n      `${this.opts.url}${path}`,\n      body,\n      { withCredentials: true },\n    );\n    this.checkResponseStatus(response);\n    return response.data as T;\n  }\n\n  private checkResponseStatus(response: AxiosResponse) {\n    if (response.status !== 200 || !response.data) {\n      throw Error(\n        `Unexpected response from server: ${response.status} ${response.statusText}. Data: ${JSON.stringify(response.data)}`,\n      );\n    }\n  }\n\n  private async postExecution(\n    path: string,\n    body: unknown,\n  ): Promise<OtcServerExecutionResponse> {\n    const response = await this.axiosInstance.post(\n      `${this.opts.url}${path}`,\n      body,\n    );\n    return response.data as OtcServerExecutionResponse;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,IAAa,YAAb,MAAuB;CAIrB,YAAY,MAAqB;EAC/B,KAAK,OAAO;EACZ,KAAK,gBAAgB,MAAA,QAAM,OAAO;GAChC,iBAAiB;GACjB,sBAAsB;GACtB,UAAA,GAAA,eAAA,0BAAkC,KAAK,UAAU;EACnD,CAAC;CACH;;;;;CAMA,MAAM,aACJ,QAC6B;EAC7B,OAAO,KAAK,SAAS,kBAAkB,EAAE,QAAQ,OAAO,OAAO,CAAC;CAClE;;;;;;CAOA,MAAM,WAAW,QAA4D;EAC3E,OAAO,KAAK,SAAS,mBAAmB;GACtC,SAAS,OAAO;GAChB,WAAW,OAAO;EACpB,CAAC;CACH;;;;CAKA,MAAM,QAAQ,QAA+D;EAC3E,OAAO,KAAK,cAAc,gBAAgB;GACxC,SAAS,OAAO;GAChB,OAAO,OAAO;GACd,GAAI,OAAO,WAAW,EAAE,WAAW,OAAO,SAAS,IAAI,CAAC;EAC1D,CAAC;CACH;;;;CAKA,MAAM,mBACJ,QACqC;EACrC,OAAO,KAAK,cAAc,uBAAuB;GAC/C,SAAS,OAAO;GAChB,cAAc,OAAO;EACvB,CAAC;CACH;;;;;CAMA,MAAM,SAAS,SAA4B,CAAC,GAA4B;EACtE,MAAM,WAAW,MAAM,KAAK,cAAc,IAAI,GAAG,KAAK,KAAK,IAAI,SAAS,EACtE,QAAQ,OAAO,WAAW,EAAE,WAAW,OAAO,SAAS,IAAI,KAAA,EAC7D,CAAC;EACD,OAAO;GACL,YAAY,SAAS;GACrB,OAAO,SAAS,WAAW;EAC7B;CACF;;CAGA,MAAc,SAAY,MAAc,MAA2B;EACjE,MAAM,WAAW,MAAM,KAAK,cAAc,KACxC,GAAG,KAAK,KAAK,MAAM,QACnB,MACA,EAAE,iBAAiB,KAAK,CAC1B;EACA,KAAK,oBAAoB,QAAQ;EACjC,OAAO,SAAS;CAClB;CAEA,oBAA4B,UAAyB;EACnD,IAAI,SAAS,WAAW,OAAO,CAAC,SAAS,MACvC,MAAM,MACJ,oCAAoC,SAAS,OAAO,GAAG,SAAS,WAAW,UAAU,KAAK,UAAU,SAAS,IAAI,GACnH;CAEJ;CAEA,MAAc,cACZ,MACA,MACqC;EAKrC,QAAO,MAJgB,KAAK,cAAc,KACxC,GAAG,KAAK,KAAK,MAAM,QACnB,IACF,GACgB;CAClB;AACF"}

package/dist/OtcClient.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_OtcClient = require("./OtcClient-qUPYb1BP.cjs");
+const require_OtcClient = require("./OtcClient-BYspxGIn.cjs");
 exports.OtcClient = require_OtcClient.OtcClient;

package/dist/OtcClient.d.cts

@@ -1,5 +1,5 @@
-import { i as OtcServerExecutionResponse } from "./serverTypes-CGY8MQaT.cjs";
-import { a as OtcReadyResult, n as OtcGetExecutionStatusParams, r as OtcGetReadyParams, t as OtcExecuteParams } from "./clientTypes-CjBtkKtk.cjs";
+import { n as OtcServerAuthNonce, o as OtcServerExecutionResponse, r as OtcServerAuthSession } from "./serverTypes-CgQcIVf1.cjs";
+import { i as OtcGetReadyParams, n as OtcGetAuthNonceParams, o as OtcReadyResult, r as OtcGetExecutionStatusParams, t as OtcExecuteParams, u as OtcVerifyAuthParams } from "./clientTypes-_bJZ6Psb.cjs";
 import { AxiosInstance } from "axios";
 
 //#region src/OtcClient.d.ts
@@ -24,6 +24,17 @@ declare class OtcClient {
   readonly opts: OtcClientOpts;
   readonly axiosInstance: AxiosInstance;
   constructor(opts: OtcClientOpts);
+  /**
+   * Starts a private quote login for `sender`. Build the message with `buildOtcSiweMessage`,
+   * sign it, and pass it to {@link OtcClient.verifyAuth} within 60s. Throws on a non-200.
+   */
+  getAuthNonce(params: OtcGetAuthNonceParams): Promise<OtcServerAuthNonce>;
+  /**
+   * Completes a private quote login. On success the browser holds the session cookie; open a
+   * new quote socket afterwards, since a socket keeps the session it had at its handshake.
+   * Throws on a non-200; the message carries the service's `error` code.
+   */
+  verifyAuth(params: OtcVerifyAuthParams): Promise<OtcServerAuthSession>;
   /**
    * Submits a signed taker order. Send this body unchanged on `retry_same_request`.
    */
@@ -37,6 +48,9 @@ declare class OtcClient {
    * asks the service default. A direct execution needs a matching deal worker, not a prior quote.
    */
   getReady(params?: OtcGetReadyParams): Promise<OtcReadyResult>;
+  /** The login routes need credentials. */
+  private postAuth;
+  private checkResponseStatus;
   private postExecution;
 }
 //#endregion

package/dist/OtcClient.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"OtcClient.d.cts","names":[],"sources":["../src/src/OtcClient.ts"],"mappings":";;;;;UAUiB,aAAA;;AAAjB;;EAIE,GAAA;EAEA,UAAU;AAAA;AAaZ;;;;;;;;;;AAAA,cAAa,SAAA;EAAA,SACF,IAAA,EAAM,aAAA;EAAA,SACN,aAAA,EAAe,aAAA;cAEZ,IAAA,EAAM,aAAA;EAoC8B;;;EAxB1C,OAAA,CAAQ,MAAA,EAAQ,gBAAA,GAAmB,OAAA,CAAQ,0BAAA;EAflC;;;EA0BT,kBAAA,CACJ,MAAA,EAAQ,2BAAA,GACP,OAAA,CAAQ,0BAAA;EAzBO;;;;EAoCZ,QAAA,CAAS,MAAA,GAAQ,iBAAA,GAAyB,OAAA,CAAQ,cAAA;EAAA,QAU1C,aAAA;AAAA"}
+{"version":3,"file":"OtcClient.d.cts","names":[],"sources":["../src/src/OtcClient.ts"],"mappings":";;;;;UAgBiB,aAAA;;AAAjB;;EAIE,GAAA;EAEA,UAAU;AAAA;AAaZ;;;;;;;;;;AAAA,cAAa,SAAA;EAAA,SACF,IAAA,EAAM,aAAA;EAAA,SACN,aAAA,EAAe,aAAA;cAEZ,IAAA,EAAM,aAAA;EAkCuB;;;;EArBnC,YAAA,CACJ,MAAA,EAAQ,qBAAA,GACP,OAAA,CAAQ,kBAAA;EA2C6C;;;;;EAlClD,UAAA,CAAW,MAAA,EAAQ,mBAAA,GAAsB,OAAA,CAAQ,oBAAA;EA1B9C;;;EAoCH,OAAA,CAAQ,MAAA,EAAQ,gBAAA,GAAmB,OAAA,CAAQ,0BAAA;EAlCrC;;;EA6CN,kBAAA,CACJ,MAAA,EAAQ,2BAAA,GACP,OAAA,CAAQ,0BAAA;EAhCR;;;;EA2CG,QAAA,CAAS,MAAA,GAAQ,iBAAA,GAAyB,OAAA,CAAQ,cAAA;EAlCT;EAAA,QA6CjC,QAAA;EAAA,QAUN,mBAAA;EAAA,QAQM,aAAA;AAAA"}

package/dist/OtcClient.d.ts

@@ -1,5 +1,5 @@
-import { i as OtcServerExecutionResponse } from "./serverTypes-CGY8MQaT.js";
-import { a as OtcReadyResult, n as OtcGetExecutionStatusParams, r as OtcGetReadyParams, t as OtcExecuteParams } from "./clientTypes-CMksWClt.js";
+import { n as OtcServerAuthNonce, o as OtcServerExecutionResponse, r as OtcServerAuthSession } from "./serverTypes-CgQcIVf1.js";
+import { i as OtcGetReadyParams, n as OtcGetAuthNonceParams, o as OtcReadyResult, r as OtcGetExecutionStatusParams, t as OtcExecuteParams, u as OtcVerifyAuthParams } from "./clientTypes-DadMpdOk.js";
 import { AxiosInstance } from "axios";
 
 //#region src/OtcClient.d.ts
@@ -24,6 +24,17 @@ declare class OtcClient {
   readonly opts: OtcClientOpts;
   readonly axiosInstance: AxiosInstance;
   constructor(opts: OtcClientOpts);
+  /**
+   * Starts a private quote login for `sender`. Build the message with `buildOtcSiweMessage`,
+   * sign it, and pass it to {@link OtcClient.verifyAuth} within 60s. Throws on a non-200.
+   */
+  getAuthNonce(params: OtcGetAuthNonceParams): Promise<OtcServerAuthNonce>;
+  /**
+   * Completes a private quote login. On success the browser holds the session cookie; open a
+   * new quote socket afterwards, since a socket keeps the session it had at its handshake.
+   * Throws on a non-200; the message carries the service's `error` code.
+   */
+  verifyAuth(params: OtcVerifyAuthParams): Promise<OtcServerAuthSession>;
   /**
    * Submits a signed taker order. Send this body unchanged on `retry_same_request`.
    */
@@ -37,6 +48,9 @@ declare class OtcClient {
    * asks the service default. A direct execution needs a matching deal worker, not a prior quote.
    */
   getReady(params?: OtcGetReadyParams): Promise<OtcReadyResult>;
+  /** The login routes need credentials. */
+  private postAuth;
+  private checkResponseStatus;
   private postExecution;
 }
 //#endregion

package/dist/OtcClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OtcClient.d.ts","names":[],"sources":["../src/src/OtcClient.ts"],"mappings":";;;;;UAUiB,aAAA;;AAAjB;;EAIE,GAAA;EAEA,UAAU;AAAA;AAaZ;;;;;;;;;;AAAA,cAAa,SAAA;EAAA,SACF,IAAA,EAAM,aAAA;EAAA,SACN,aAAA,EAAe,aAAA;cAEZ,IAAA,EAAM,aAAA;EAoC8B;;;EAxB1C,OAAA,CAAQ,MAAA,EAAQ,gBAAA,GAAmB,OAAA,CAAQ,0BAAA;EAflC;;;EA0BT,kBAAA,CACJ,MAAA,EAAQ,2BAAA,GACP,OAAA,CAAQ,0BAAA;EAzBO;;;;EAoCZ,QAAA,CAAS,MAAA,GAAQ,iBAAA,GAAyB,OAAA,CAAQ,cAAA;EAAA,QAU1C,aAAA;AAAA"}
+{"version":3,"file":"OtcClient.d.ts","names":[],"sources":["../src/src/OtcClient.ts"],"mappings":";;;;;UAgBiB,aAAA;;AAAjB;;EAIE,GAAA;EAEA,UAAU;AAAA;AAaZ;;;;;;;;;;AAAA,cAAa,SAAA;EAAA,SACF,IAAA,EAAM,aAAA;EAAA,SACN,aAAA,EAAe,aAAA;cAEZ,IAAA,EAAM,aAAA;EAkCuB;;;;EArBnC,YAAA,CACJ,MAAA,EAAQ,qBAAA,GACP,OAAA,CAAQ,kBAAA;EA2C6C;;;;;EAlClD,UAAA,CAAW,MAAA,EAAQ,mBAAA,GAAsB,OAAA,CAAQ,oBAAA;EA1B9C;;;EAoCH,OAAA,CAAQ,MAAA,EAAQ,gBAAA,GAAmB,OAAA,CAAQ,0BAAA;EAlCrC;;;EA6CN,kBAAA,CACJ,MAAA,EAAQ,2BAAA,GACP,OAAA,CAAQ,0BAAA;EAhCR;;;;EA2CG,QAAA,CAAS,MAAA,GAAQ,iBAAA,GAAyB,OAAA,CAAQ,cAAA;EAlCT;EAAA,QA6CjC,QAAA;EAAA,QAUN,mBAAA;EAAA,QAQM,aAAA;AAAA"}

package/dist/OtcClient.js

@@ -21,6 +21,24 @@ var OtcClient = class {
 		});
 	}
 	/**
+	* Starts a private quote login for `sender`. Build the message with `buildOtcSiweMessage`,
+	* sign it, and pass it to {@link OtcClient.verifyAuth} within 60s. Throws on a non-200.
+	*/
+	async getAuthNonce(params) {
+		return this.postAuth("/v1/auth/nonce", { sender: params.sender });
+	}
+	/**
+	* Completes a private quote login. On success the browser holds the session cookie; open a
+	* new quote socket afterwards, since a socket keeps the session it had at its handshake.
+	* Throws on a non-200; the message carries the service's `error` code.
+	*/
+	async verifyAuth(params) {
+		return this.postAuth("/v1/auth/verify", {
+			message: params.message,
+			signature: params.signature
+		});
+	}
+	/**
 	* Submits a signed taker order. Send this body unchanged on `retry_same_request`.
 	*/
 	async execute(params) {
@@ -50,6 +68,15 @@ var OtcClient = class {
 			ready: response.status === 200
 		};
 	}
+	/** The login routes need credentials. */
+	async postAuth(path, body) {
+		const response = await this.axiosInstance.post(`${this.opts.url}${path}`, body, { withCredentials: true });
+		this.checkResponseStatus(response);
+		return response.data;
+	}
+	checkResponseStatus(response) {
+		if (response.status !== 200 || !response.data) throw Error(`Unexpected response from server: ${response.status} ${response.statusText}. Data: ${JSON.stringify(response.data)}`);
+	}
 	async postExecution(path, body) {
 		return (await this.axiosInstance.post(`${this.opts.url}${path}`, body)).data;
 	}

package/dist/OtcClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"OtcClient.js","names":[],"sources":["../src/OtcClient.ts"],"sourcesContent":["import { getNadoClientTypeHeaders } from '@nadohq/shared';\nimport axios, { AxiosInstance } from 'axios';\nimport {\n  OtcExecuteParams,\n  OtcGetExecutionStatusParams,\n  OtcGetReadyParams,\n  OtcReadyResult,\n} from './types/clientTypes';\nimport { OtcServerExecutionResponse } from './types/serverTypes';\n\nexport interface OtcClientOpts {\n  /**\n   * OTC service origin, without a path, e.g. {@link OTC_CLIENT_ENDPOINTS}.\n   */\n  url: string;\n  // If provided, identifies the calling client, sent as a header with every request\n  clientType?: string;\n}\n\n/**\n * Client for the public OTC service.\n *\n * {@link OtcClient.execute} does not sign. The caller supplies an already-signed taker order.\n * A quote is not required. {@link OtcClient.getExecutionStatus} only reads a deal; it does not\n * start or resume one.\n *\n * Responses are the JSON body as returned, including non-200 admission responses. Branch on\n * `status` and `recovery_action`.\n */\nexport class OtcClient {\n  readonly opts: OtcClientOpts;\n  readonly axiosInstance: AxiosInstance;\n\n  constructor(opts: OtcClientOpts) {\n    this.opts = opts;\n    this.axiosInstance = axios.create({\n      withCredentials: false,\n      validateStatus: () => true,\n      headers: getNadoClientTypeHeaders(opts.clientType),\n    });\n  }\n\n  /**\n   * Submits a signed taker order. Send this body unchanged on `retry_same_request`.\n   */\n  async execute(params: OtcExecuteParams): Promise<OtcServerExecutionResponse> {\n    return this.postExecution('/v1/executor', {\n      deal_id: params.dealId,\n      taker: params.taker,\n      ...(params.pricerId ? { pricer_id: params.pricerId } : {}),\n    });\n  }\n\n  /**\n   * Reads one execution. Use it after a lost response, a refresh, or `wait`.\n   */\n  async getExecutionStatus(\n    params: OtcGetExecutionStatusParams,\n  ): Promise<OtcServerExecutionResponse> {\n    return this.postExecution('/v1/executor/status', {\n      deal_id: params.dealId,\n      taker_digest: params.takerDigest,\n    });\n  }\n\n  /**\n   * Checks that quote and deal product scopes overlap for a route. An omitted `pricerId`\n   * asks the service default. A direct execution needs a matching deal worker, not a prior quote.\n   */\n  async getReady(params: OtcGetReadyParams = {}): Promise<OtcReadyResult> {\n    const response = await this.axiosInstance.get(`${this.opts.url}/ready`, {\n      params: params.pricerId ? { pricer_id: params.pricerId } : undefined,\n    });\n    return {\n      httpStatus: response.status,\n      ready: response.status === 200,\n    };\n  }\n\n  private async postExecution(\n    path: string,\n    body: unknown,\n  ): Promise<OtcServerExecutionResponse> {\n    const response = await this.axiosInstance.post(\n      `${this.opts.url}${path}`,\n      body,\n    );\n    return response.data as OtcServerExecutionResponse;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AA6BA,IAAa,YAAb,MAAuB;CAIrB,YAAY,MAAqB;EAC/B,KAAK,OAAO;EACZ,KAAK,gBAAgB,MAAM,OAAO;GAChC,iBAAiB;GACjB,sBAAsB;GACtB,SAAS,yBAAyB,KAAK,UAAU;EACnD,CAAC;CACH;;;;CAKA,MAAM,QAAQ,QAA+D;EAC3E,OAAO,KAAK,cAAc,gBAAgB;GACxC,SAAS,OAAO;GAChB,OAAO,OAAO;GACd,GAAI,OAAO,WAAW,EAAE,WAAW,OAAO,SAAS,IAAI,CAAC;EAC1D,CAAC;CACH;;;;CAKA,MAAM,mBACJ,QACqC;EACrC,OAAO,KAAK,cAAc,uBAAuB;GAC/C,SAAS,OAAO;GAChB,cAAc,OAAO;EACvB,CAAC;CACH;;;;;CAMA,MAAM,SAAS,SAA4B,CAAC,GAA4B;EACtE,MAAM,WAAW,MAAM,KAAK,cAAc,IAAI,GAAG,KAAK,KAAK,IAAI,SAAS,EACtE,QAAQ,OAAO,WAAW,EAAE,WAAW,OAAO,SAAS,IAAI,KAAA,EAC7D,CAAC;EACD,OAAO;GACL,YAAY,SAAS;GACrB,OAAO,SAAS,WAAW;EAC7B;CACF;CAEA,MAAc,cACZ,MACA,MACqC;EAKrC,QAAO,MAJgB,KAAK,cAAc,KACxC,GAAG,KAAK,KAAK,MAAM,QACnB,IACF,GACgB;CAClB;AACF"}
+{"version":3,"file":"OtcClient.js","names":[],"sources":["../src/OtcClient.ts"],"sourcesContent":["import { getNadoClientTypeHeaders } from '@nadohq/shared';\nimport axios, { AxiosInstance, AxiosResponse } from 'axios';\nimport {\n  OtcExecuteParams,\n  OtcGetAuthNonceParams,\n  OtcGetExecutionStatusParams,\n  OtcGetReadyParams,\n  OtcReadyResult,\n  OtcVerifyAuthParams,\n} from './types/clientTypes';\nimport {\n  OtcServerAuthNonce,\n  OtcServerAuthSession,\n  OtcServerExecutionResponse,\n} from './types/serverTypes';\n\nexport interface OtcClientOpts {\n  /**\n   * OTC service origin, without a path, e.g. {@link OTC_CLIENT_ENDPOINTS}.\n   */\n  url: string;\n  // If provided, identifies the calling client, sent as a header with every request\n  clientType?: string;\n}\n\n/**\n * Client for the public OTC service.\n *\n * {@link OtcClient.execute} does not sign. The caller supplies an already-signed taker order.\n * A quote is not required. {@link OtcClient.getExecutionStatus} only reads a deal; it does not\n * start or resume one.\n *\n * Responses are the JSON body as returned, including non-200 admission responses. Branch on\n * `status` and `recovery_action`.\n */\nexport class OtcClient {\n  readonly opts: OtcClientOpts;\n  readonly axiosInstance: AxiosInstance;\n\n  constructor(opts: OtcClientOpts) {\n    this.opts = opts;\n    this.axiosInstance = axios.create({\n      withCredentials: false,\n      validateStatus: () => true,\n      headers: getNadoClientTypeHeaders(opts.clientType),\n    });\n  }\n\n  /**\n   * Starts a private quote login for `sender`. Build the message with `buildOtcSiweMessage`,\n   * sign it, and pass it to {@link OtcClient.verifyAuth} within 60s. Throws on a non-200.\n   */\n  async getAuthNonce(\n    params: OtcGetAuthNonceParams,\n  ): Promise<OtcServerAuthNonce> {\n    return this.postAuth('/v1/auth/nonce', { sender: params.sender });\n  }\n\n  /**\n   * Completes a private quote login. On success the browser holds the session cookie; open a\n   * new quote socket afterwards, since a socket keeps the session it had at its handshake.\n   * Throws on a non-200; the message carries the service's `error` code.\n   */\n  async verifyAuth(params: OtcVerifyAuthParams): Promise<OtcServerAuthSession> {\n    return this.postAuth('/v1/auth/verify', {\n      message: params.message,\n      signature: params.signature,\n    });\n  }\n\n  /**\n   * Submits a signed taker order. Send this body unchanged on `retry_same_request`.\n   */\n  async execute(params: OtcExecuteParams): Promise<OtcServerExecutionResponse> {\n    return this.postExecution('/v1/executor', {\n      deal_id: params.dealId,\n      taker: params.taker,\n      ...(params.pricerId ? { pricer_id: params.pricerId } : {}),\n    });\n  }\n\n  /**\n   * Reads one execution. Use it after a lost response, a refresh, or `wait`.\n   */\n  async getExecutionStatus(\n    params: OtcGetExecutionStatusParams,\n  ): Promise<OtcServerExecutionResponse> {\n    return this.postExecution('/v1/executor/status', {\n      deal_id: params.dealId,\n      taker_digest: params.takerDigest,\n    });\n  }\n\n  /**\n   * Checks that quote and deal product scopes overlap for a route. An omitted `pricerId`\n   * asks the service default. A direct execution needs a matching deal worker, not a prior quote.\n   */\n  async getReady(params: OtcGetReadyParams = {}): Promise<OtcReadyResult> {\n    const response = await this.axiosInstance.get(`${this.opts.url}/ready`, {\n      params: params.pricerId ? { pricer_id: params.pricerId } : undefined,\n    });\n    return {\n      httpStatus: response.status,\n      ready: response.status === 200,\n    };\n  }\n\n  /** The login routes need credentials. */\n  private async postAuth<T>(path: string, body: unknown): Promise<T> {\n    const response = await this.axiosInstance.post(\n      `${this.opts.url}${path}`,\n      body,\n      { withCredentials: true },\n    );\n    this.checkResponseStatus(response);\n    return response.data as T;\n  }\n\n  private checkResponseStatus(response: AxiosResponse) {\n    if (response.status !== 200 || !response.data) {\n      throw Error(\n        `Unexpected response from server: ${response.status} ${response.statusText}. Data: ${JSON.stringify(response.data)}`,\n      );\n    }\n  }\n\n  private async postExecution(\n    path: string,\n    body: unknown,\n  ): Promise<OtcServerExecutionResponse> {\n    const response = await this.axiosInstance.post(\n      `${this.opts.url}${path}`,\n      body,\n    );\n    return response.data as OtcServerExecutionResponse;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAmCA,IAAa,YAAb,MAAuB;CAIrB,YAAY,MAAqB;EAC/B,KAAK,OAAO;EACZ,KAAK,gBAAgB,MAAM,OAAO;GAChC,iBAAiB;GACjB,sBAAsB;GACtB,SAAS,yBAAyB,KAAK,UAAU;EACnD,CAAC;CACH;;;;;CAMA,MAAM,aACJ,QAC6B;EAC7B,OAAO,KAAK,SAAS,kBAAkB,EAAE,QAAQ,OAAO,OAAO,CAAC;CAClE;;;;;;CAOA,MAAM,WAAW,QAA4D;EAC3E,OAAO,KAAK,SAAS,mBAAmB;GACtC,SAAS,OAAO;GAChB,WAAW,OAAO;EACpB,CAAC;CACH;;;;CAKA,MAAM,QAAQ,QAA+D;EAC3E,OAAO,KAAK,cAAc,gBAAgB;GACxC,SAAS,OAAO;GAChB,OAAO,OAAO;GACd,GAAI,OAAO,WAAW,EAAE,WAAW,OAAO,SAAS,IAAI,CAAC;EAC1D,CAAC;CACH;;;;CAKA,MAAM,mBACJ,QACqC;EACrC,OAAO,KAAK,cAAc,uBAAuB;GAC/C,SAAS,OAAO;GAChB,cAAc,OAAO;EACvB,CAAC;CACH;;;;;CAMA,MAAM,SAAS,SAA4B,CAAC,GAA4B;EACtE,MAAM,WAAW,MAAM,KAAK,cAAc,IAAI,GAAG,KAAK,KAAK,IAAI,SAAS,EACtE,QAAQ,OAAO,WAAW,EAAE,WAAW,OAAO,SAAS,IAAI,KAAA,EAC7D,CAAC;EACD,OAAO;GACL,YAAY,SAAS;GACrB,OAAO,SAAS,WAAW;EAC7B;CACF;;CAGA,MAAc,SAAY,MAAc,MAA2B;EACjE,MAAM,WAAW,MAAM,KAAK,cAAc,KACxC,GAAG,KAAK,KAAK,MAAM,QACnB,MACA,EAAE,iBAAiB,KAAK,CAC1B;EACA,KAAK,oBAAoB,QAAQ;EACjC,OAAO,SAAS;CAClB;CAEA,oBAA4B,UAAyB;EACnD,IAAI,SAAS,WAAW,OAAO,CAAC,SAAS,MACvC,MAAM,MACJ,oCAAoC,SAAS,OAAO,GAAG,SAAS,WAAW,UAAU,KAAK,UAAU,SAAS,IAAI,GACnH;CAEJ;CAEA,MAAc,cACZ,MACA,MACqC;EAKrC,QAAO,MAJgB,KAAK,cAAc,KACxC,GAAG,KAAK,KAAK,MAAM,QACnB,IACF,GACgB;CAClB;AACF"}

package/dist/{clientTypes-CMksWClt.d.ts → clientTypes-DadMpdOk.d.ts}

@@ -1,4 +1,4 @@
-import { t as OtcQuoteSizeUnit } from "./serverTypes-CGY8MQaT.js";
+import { t as OtcQuoteSizeUnit } from "./serverTypes-CgQcIVf1.js";
 import { EngineServerPlaceOrderParams } from "@nadohq/engine-client";
 
 //#region src/types/clientTypes.d.ts
@@ -11,7 +11,7 @@ interface OtcExecuteParams {
   /** Client-generated idempotency key, 1–128 bytes. Kept across retries of this intent. */
   dealId: string;
   taker: OtcServerTakerOrderParams;
-  /** Execution route. Omitted selects the service default (`awr`). */
+  /** The route. The service requires it and has no default. */
   pricerId?: string;
 }
 interface OtcGetExecutionStatusParams {
@@ -21,6 +21,30 @@ interface OtcGetExecutionStatusParams {
 interface OtcGetReadyParams {
   pricerId?: string;
 }
+interface OtcGetAuthNonceParams {
+  /** The 32-byte subaccount the login is bound to. */
+  sender: string;
+}
+interface OtcSiweMessageParams {
+  /** Host of the page origin, e.g. `testnet.nado.xyz`. */
+  domain: string;
+  /** The page origin, with no path or trailing slash. */
+  uri: string;
+  /** The signing address, EIP-55 checksummed: the owner or the sender's linked signer. */
+  address: string;
+  chainId: number;
+  nonce: string;
+  /** `issued_at_ms` from the nonce response; a local clock can be rejected as future. */
+  issuedAtMs: number;
+  /** The same sender as the nonce request. */
+  sender: string;
+}
+interface OtcVerifyAuthParams {
+  /** The SIWE text exactly as signed. */
+  message: string;
+  /** 65-byte hex `personal_sign` signature of `message`. */
+  signature: string;
+}
 /**
  * Route coverage. HTTP 200 is ready; 400 and 503 are not. This does not guarantee liquidity
  * or that an order will be accepted.
@@ -39,7 +63,7 @@ interface OtcQuoteStream {
   wallet: string;
   size: string;
   sizeUnit: OtcQuoteSizeUnit;
-  /** Execution route. Omitted selects the service default (`awr`). */
+  /** The route. The service requires it and has no default. */
   pricerId?: string;
 }
 /** Subscribe or unsubscribe target: 1–100 streams, applied atomically. */
@@ -48,5 +72,5 @@ interface OtcRfqSubscriptionParams {
   streams: OtcQuoteStream[];
 }
 //#endregion
-export { OtcReadyResult as a, OtcQuoteStream as i, OtcGetExecutionStatusParams as n, OtcRfqSubscriptionParams as o, OtcGetReadyParams as r, OtcServerTakerOrderParams as s, OtcExecuteParams as t };
-//# sourceMappingURL=clientTypes-CMksWClt.d.ts.map
+export { OtcQuoteStream as a, OtcServerTakerOrderParams as c, OtcGetReadyParams as i, OtcSiweMessageParams as l, OtcGetAuthNonceParams as n, OtcReadyResult as o, OtcGetExecutionStatusParams as r, OtcRfqSubscriptionParams as s, OtcExecuteParams as t, OtcVerifyAuthParams as u };
+//# sourceMappingURL=clientTypes-DadMpdOk.d.ts.map

package/dist/clientTypes-DadMpdOk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientTypes-DadMpdOk.d.ts","names":[],"sources":["../src/types/src/types/clientTypes.ts"],"mappings":";;;;;;AAOA;;KAAY,yBAAA,GAA4B,IAAI,CAC1C,4BAAA;AAAA,UAIe,gBAAA;EAJa;EAM5B,MAAA;EACA,KAAA,EAAO,yBAAyB;;EAEhC,QAAA;AAAA;AAAA,UAGe,2BAAA;EACf,MAAA;EACA,WAAW;AAAA;AAAA,UAGI,iBAAA;EACf,QAAQ;AAAA;AAAA,UAGO,qBAAA;EARf;EAUA,MAAM;AAAA;AAAA,UAGS,oBAAA;;EAEf,MAAA;EAVQ;EAYR,GAAA;EAToC;EAWpC,OAAA;EACA,OAAA;EACA,KAAA;EARe;EAUf,UAAA;;EAEA,MAAA;AAAA;AAAA,UAGe,mBAAA;EATf;EAWA,OAAA;EATA;EAWA,SAAS;AAAA;;AAPH;AAGR;;UAWiB,cAAA;EACf,UAAA;EACA,KAAK;AAAA;;;;AAAA;UAOU,cAAA;EACf,IAAA;EACA,SAAA;EACA,MAAA;EACA,IAAA;EACA,QAAA,EAAU,gBAAgB;EAF1B;EAIA,QAAA;AAAA;;UAIe,wBAAA;EACf,EAAA;EACA,OAAA,EAAS,cAAc;AAAA"}

package/dist/{clientTypes-CjBtkKtk.d.cts → clientTypes-_bJZ6Psb.d.cts}

@@ -1,4 +1,4 @@
-import { t as OtcQuoteSizeUnit } from "./serverTypes-CGY8MQaT.cjs";
+import { t as OtcQuoteSizeUnit } from "./serverTypes-CgQcIVf1.cjs";
 import { EngineServerPlaceOrderParams } from "@nadohq/engine-client";
 
 //#region src/types/clientTypes.d.ts
@@ -11,7 +11,7 @@ interface OtcExecuteParams {
   /** Client-generated idempotency key, 1–128 bytes. Kept across retries of this intent. */
   dealId: string;
   taker: OtcServerTakerOrderParams;
-  /** Execution route. Omitted selects the service default (`awr`). */
+  /** The route. The service requires it and has no default. */
   pricerId?: string;
 }
 interface OtcGetExecutionStatusParams {
@@ -21,6 +21,30 @@ interface OtcGetExecutionStatusParams {
 interface OtcGetReadyParams {
   pricerId?: string;
 }
+interface OtcGetAuthNonceParams {
+  /** The 32-byte subaccount the login is bound to. */
+  sender: string;
+}
+interface OtcSiweMessageParams {
+  /** Host of the page origin, e.g. `testnet.nado.xyz`. */
+  domain: string;
+  /** The page origin, with no path or trailing slash. */
+  uri: string;
+  /** The signing address, EIP-55 checksummed: the owner or the sender's linked signer. */
+  address: string;
+  chainId: number;
+  nonce: string;
+  /** `issued_at_ms` from the nonce response; a local clock can be rejected as future. */
+  issuedAtMs: number;
+  /** The same sender as the nonce request. */
+  sender: string;
+}
+interface OtcVerifyAuthParams {
+  /** The SIWE text exactly as signed. */
+  message: string;
+  /** 65-byte hex `personal_sign` signature of `message`. */
+  signature: string;
+}
 /**
  * Route coverage. HTTP 200 is ready; 400 and 503 are not. This does not guarantee liquidity
  * or that an order will be accepted.
@@ -39,7 +63,7 @@ interface OtcQuoteStream {
   wallet: string;
   size: string;
   sizeUnit: OtcQuoteSizeUnit;
-  /** Execution route. Omitted selects the service default (`awr`). */
+  /** The route. The service requires it and has no default. */
   pricerId?: string;
 }
 /** Subscribe or unsubscribe target: 1–100 streams, applied atomically. */
@@ -48,5 +72,5 @@ interface OtcRfqSubscriptionParams {
   streams: OtcQuoteStream[];
 }
 //#endregion
-export { OtcReadyResult as a, OtcQuoteStream as i, OtcGetExecutionStatusParams as n, OtcRfqSubscriptionParams as o, OtcGetReadyParams as r, OtcServerTakerOrderParams as s, OtcExecuteParams as t };
-//# sourceMappingURL=clientTypes-CjBtkKtk.d.cts.map
+export { OtcQuoteStream as a, OtcServerTakerOrderParams as c, OtcGetReadyParams as i, OtcSiweMessageParams as l, OtcGetAuthNonceParams as n, OtcReadyResult as o, OtcGetExecutionStatusParams as r, OtcRfqSubscriptionParams as s, OtcExecuteParams as t, OtcVerifyAuthParams as u };
+//# sourceMappingURL=clientTypes-_bJZ6Psb.d.cts.map

package/dist/clientTypes-_bJZ6Psb.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientTypes-_bJZ6Psb.d.cts","names":[],"sources":["../src/types/src/types/clientTypes.ts"],"mappings":";;;;;;AAOA;;KAAY,yBAAA,GAA4B,IAAI,CAC1C,4BAAA;AAAA,UAIe,gBAAA;EAJa;EAM5B,MAAA;EACA,KAAA,EAAO,yBAAyB;;EAEhC,QAAA;AAAA;AAAA,UAGe,2BAAA;EACf,MAAA;EACA,WAAW;AAAA;AAAA,UAGI,iBAAA;EACf,QAAQ;AAAA;AAAA,UAGO,qBAAA;EARf;EAUA,MAAM;AAAA;AAAA,UAGS,oBAAA;;EAEf,MAAA;EAVQ;EAYR,GAAA;EAToC;EAWpC,OAAA;EACA,OAAA;EACA,KAAA;EARe;EAUf,UAAA;;EAEA,MAAA;AAAA;AAAA,UAGe,mBAAA;EATf;EAWA,OAAA;EATA;EAWA,SAAS;AAAA;;AAPH;AAGR;;UAWiB,cAAA;EACf,UAAA;EACA,KAAK;AAAA;;;;AAAA;UAOU,cAAA;EACf,IAAA;EACA,SAAA;EACA,MAAA;EACA,IAAA;EACA,QAAA,EAAU,gBAAgB;EAF1B;EAIA,QAAA;AAAA;;UAIe,wBAAA;EACf,EAAA;EACA,OAAA,EAAS,cAAc;AAAA"}

package/dist/index.cjs

@@ -1,11 +1,14 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_OtcClient = require("./OtcClient-qUPYb1BP.cjs");
+const require_OtcClient = require("./OtcClient-BYspxGIn.cjs");
 const require_endpoints = require("./endpoints.cjs");
 const require_rfqSubscription = require("./rfqSubscription.cjs");
+const require_siweMessage = require("./siweMessage.cjs");
 const require_types_otcErrorCodes = require("./types/otcErrorCodes.cjs");
 require("./types/index.cjs");
 exports.OTC_CLIENT_ENDPOINTS = require_endpoints.OTC_CLIENT_ENDPOINTS;
 exports.OTC_ERROR_CODES = require_types_otcErrorCodes.OTC_ERROR_CODES;
 exports.OTC_RFQ_WS_CLIENT_ENDPOINTS = require_endpoints.OTC_RFQ_WS_CLIENT_ENDPOINTS;
+exports.OTC_SIWE_STATEMENT = require_siweMessage.OTC_SIWE_STATEMENT;
 exports.OtcClient = require_OtcClient.OtcClient;
 exports.buildOtcRfqSubscriptionMessage = require_rfqSubscription.buildOtcRfqSubscriptionMessage;
+exports.buildOtcSiweMessage = require_siweMessage.buildOtcSiweMessage;

package/dist/index.d.cts

@@ -1,7 +1,8 @@
-import { a as OtcServerExecutionSuccess, c as OtcServerQuoteStream, d as OtcServerRfqSubscribeStreamsRequest, f as OtcServerRfqSubscriptionRequest, i as OtcServerExecutionResponse, l as OtcServerRfqAck, n as OtcServerExecutionFailure, o as OtcServerQuote, p as OtcServerRfqUnsubscribeStreamsRequest, r as OtcServerExecutionPendingResolution, s as OtcServerQuoteBatch, t as OtcQuoteSizeUnit, u as OtcServerRfqMessage } from "./serverTypes-CGY8MQaT.cjs";
-import { a as OtcReadyResult, i as OtcQuoteStream, n as OtcGetExecutionStatusParams, o as OtcRfqSubscriptionParams, r as OtcGetReadyParams, s as OtcServerTakerOrderParams, t as OtcExecuteParams } from "./clientTypes-CjBtkKtk.cjs";
+import { a as OtcServerExecutionPendingResolution, c as OtcServerQuote, d as OtcServerRfqAck, f as OtcServerRfqMessage, h as OtcServerRfqUnsubscribeStreamsRequest, i as OtcServerExecutionFailure, l as OtcServerQuoteBatch, m as OtcServerRfqSubscriptionRequest, n as OtcServerAuthNonce, o as OtcServerExecutionResponse, p as OtcServerRfqSubscribeStreamsRequest, r as OtcServerAuthSession, s as OtcServerExecutionSuccess, t as OtcQuoteSizeUnit, u as OtcServerQuoteStream } from "./serverTypes-CgQcIVf1.cjs";
+import { a as OtcQuoteStream, c as OtcServerTakerOrderParams, i as OtcGetReadyParams, l as OtcSiweMessageParams, n as OtcGetAuthNonceParams, o as OtcReadyResult, r as OtcGetExecutionStatusParams, s as OtcRfqSubscriptionParams, t as OtcExecuteParams, u as OtcVerifyAuthParams } from "./clientTypes-_bJZ6Psb.cjs";
 import { OtcClient, OtcClientOpts } from "./OtcClient.cjs";
 import { OTC_CLIENT_ENDPOINTS, OTC_RFQ_WS_CLIENT_ENDPOINTS } from "./endpoints.cjs";
 import { buildOtcRfqSubscriptionMessage } from "./rfqSubscription.cjs";
+import { OTC_SIWE_STATEMENT, buildOtcSiweMessage } from "./siweMessage.cjs";
 import { n as OtcErrorCode, t as OTC_ERROR_CODES } from "./otcErrorCodes-CsmoGjD_.cjs";
-export { OTC_CLIENT_ENDPOINTS, OTC_ERROR_CODES, OTC_RFQ_WS_CLIENT_ENDPOINTS, OtcClient, OtcClientOpts, OtcErrorCode, OtcExecuteParams, OtcGetExecutionStatusParams, OtcGetReadyParams, OtcQuoteSizeUnit, OtcQuoteStream, OtcReadyResult, OtcRfqSubscriptionParams, OtcServerExecutionFailure, OtcServerExecutionPendingResolution, OtcServerExecutionResponse, OtcServerExecutionSuccess, OtcServerQuote, OtcServerQuoteBatch, OtcServerQuoteStream, OtcServerRfqAck, OtcServerRfqMessage, OtcServerRfqSubscribeStreamsRequest, OtcServerRfqSubscriptionRequest, OtcServerRfqUnsubscribeStreamsRequest, OtcServerTakerOrderParams, buildOtcRfqSubscriptionMessage };
+export { OTC_CLIENT_ENDPOINTS, OTC_ERROR_CODES, OTC_RFQ_WS_CLIENT_ENDPOINTS, OTC_SIWE_STATEMENT, OtcClient, OtcClientOpts, OtcErrorCode, OtcExecuteParams, OtcGetAuthNonceParams, OtcGetExecutionStatusParams, OtcGetReadyParams, OtcQuoteSizeUnit, OtcQuoteStream, OtcReadyResult, OtcRfqSubscriptionParams, OtcServerAuthNonce, OtcServerAuthSession, OtcServerExecutionFailure, OtcServerExecutionPendingResolution, OtcServerExecutionResponse, OtcServerExecutionSuccess, OtcServerQuote, OtcServerQuoteBatch, OtcServerQuoteStream, OtcServerRfqAck, OtcServerRfqMessage, OtcServerRfqSubscribeStreamsRequest, OtcServerRfqSubscriptionRequest, OtcServerRfqUnsubscribeStreamsRequest, OtcServerTakerOrderParams, OtcSiweMessageParams, OtcVerifyAuthParams, buildOtcRfqSubscriptionMessage, buildOtcSiweMessage };

package/dist/index.d.ts

@@ -1,7 +1,8 @@
-import { a as OtcServerExecutionSuccess, c as OtcServerQuoteStream, d as OtcServerRfqSubscribeStreamsRequest, f as OtcServerRfqSubscriptionRequest, i as OtcServerExecutionResponse, l as OtcServerRfqAck, n as OtcServerExecutionFailure, o as OtcServerQuote, p as OtcServerRfqUnsubscribeStreamsRequest, r as OtcServerExecutionPendingResolution, s as OtcServerQuoteBatch, t as OtcQuoteSizeUnit, u as OtcServerRfqMessage } from "./serverTypes-CGY8MQaT.js";
-import { a as OtcReadyResult, i as OtcQuoteStream, n as OtcGetExecutionStatusParams, o as OtcRfqSubscriptionParams, r as OtcGetReadyParams, s as OtcServerTakerOrderParams, t as OtcExecuteParams } from "./clientTypes-CMksWClt.js";
+import { a as OtcServerExecutionPendingResolution, c as OtcServerQuote, d as OtcServerRfqAck, f as OtcServerRfqMessage, h as OtcServerRfqUnsubscribeStreamsRequest, i as OtcServerExecutionFailure, l as OtcServerQuoteBatch, m as OtcServerRfqSubscriptionRequest, n as OtcServerAuthNonce, o as OtcServerExecutionResponse, p as OtcServerRfqSubscribeStreamsRequest, r as OtcServerAuthSession, s as OtcServerExecutionSuccess, t as OtcQuoteSizeUnit, u as OtcServerQuoteStream } from "./serverTypes-CgQcIVf1.js";
+import { a as OtcQuoteStream, c as OtcServerTakerOrderParams, i as OtcGetReadyParams, l as OtcSiweMessageParams, n as OtcGetAuthNonceParams, o as OtcReadyResult, r as OtcGetExecutionStatusParams, s as OtcRfqSubscriptionParams, t as OtcExecuteParams, u as OtcVerifyAuthParams } from "./clientTypes-DadMpdOk.js";
 import { OtcClient, OtcClientOpts } from "./OtcClient.js";
 import { OTC_CLIENT_ENDPOINTS, OTC_RFQ_WS_CLIENT_ENDPOINTS } from "./endpoints.js";
 import { buildOtcRfqSubscriptionMessage } from "./rfqSubscription.js";
+import { OTC_SIWE_STATEMENT, buildOtcSiweMessage } from "./siweMessage.js";
 import { n as OtcErrorCode, t as OTC_ERROR_CODES } from "./otcErrorCodes-CsmoGjD_.js";
-export { OTC_CLIENT_ENDPOINTS, OTC_ERROR_CODES, OTC_RFQ_WS_CLIENT_ENDPOINTS, OtcClient, OtcClientOpts, OtcErrorCode, OtcExecuteParams, OtcGetExecutionStatusParams, OtcGetReadyParams, OtcQuoteSizeUnit, OtcQuoteStream, OtcReadyResult, OtcRfqSubscriptionParams, OtcServerExecutionFailure, OtcServerExecutionPendingResolution, OtcServerExecutionResponse, OtcServerExecutionSuccess, OtcServerQuote, OtcServerQuoteBatch, OtcServerQuoteStream, OtcServerRfqAck, OtcServerRfqMessage, OtcServerRfqSubscribeStreamsRequest, OtcServerRfqSubscriptionRequest, OtcServerRfqUnsubscribeStreamsRequest, OtcServerTakerOrderParams, buildOtcRfqSubscriptionMessage };
+export { OTC_CLIENT_ENDPOINTS, OTC_ERROR_CODES, OTC_RFQ_WS_CLIENT_ENDPOINTS, OTC_SIWE_STATEMENT, OtcClient, OtcClientOpts, OtcErrorCode, OtcExecuteParams, OtcGetAuthNonceParams, OtcGetExecutionStatusParams, OtcGetReadyParams, OtcQuoteSizeUnit, OtcQuoteStream, OtcReadyResult, OtcRfqSubscriptionParams, OtcServerAuthNonce, OtcServerAuthSession, OtcServerExecutionFailure, OtcServerExecutionPendingResolution, OtcServerExecutionResponse, OtcServerExecutionSuccess, OtcServerQuote, OtcServerQuoteBatch, OtcServerQuoteStream, OtcServerRfqAck, OtcServerRfqMessage, OtcServerRfqSubscribeStreamsRequest, OtcServerRfqSubscriptionRequest, OtcServerRfqUnsubscribeStreamsRequest, OtcServerTakerOrderParams, OtcSiweMessageParams, OtcVerifyAuthParams, buildOtcRfqSubscriptionMessage, buildOtcSiweMessage };

package/dist/index.js

@@ -1,6 +1,7 @@
 import { OtcClient } from "./OtcClient.js";
 import { OTC_CLIENT_ENDPOINTS, OTC_RFQ_WS_CLIENT_ENDPOINTS } from "./endpoints.js";
 import { buildOtcRfqSubscriptionMessage } from "./rfqSubscription.js";
+import { OTC_SIWE_STATEMENT, buildOtcSiweMessage } from "./siweMessage.js";
 import { OTC_ERROR_CODES } from "./types/otcErrorCodes.js";
 import "./types/index.js";
-export { OTC_CLIENT_ENDPOINTS, OTC_ERROR_CODES, OTC_RFQ_WS_CLIENT_ENDPOINTS, OtcClient, buildOtcRfqSubscriptionMessage };
+export { OTC_CLIENT_ENDPOINTS, OTC_ERROR_CODES, OTC_RFQ_WS_CLIENT_ENDPOINTS, OTC_SIWE_STATEMENT, OtcClient, buildOtcRfqSubscriptionMessage, buildOtcSiweMessage };

package/dist/rfqSubscription.d.cts

@@ -1,5 +1,5 @@
-import { f as OtcServerRfqSubscriptionRequest } from "./serverTypes-CGY8MQaT.cjs";
-import { o as OtcRfqSubscriptionParams } from "./clientTypes-CjBtkKtk.cjs";
+import { m as OtcServerRfqSubscriptionRequest } from "./serverTypes-CgQcIVf1.cjs";
+import { s as OtcRfqSubscriptionParams } from "./clientTypes-_bJZ6Psb.cjs";
 
 //#region src/rfqSubscription.d.ts
 /**

package/dist/rfqSubscription.d.ts

@@ -1,5 +1,5 @@
-import { f as OtcServerRfqSubscriptionRequest } from "./serverTypes-CGY8MQaT.js";
-import { o as OtcRfqSubscriptionParams } from "./clientTypes-CMksWClt.js";
+import { m as OtcServerRfqSubscriptionRequest } from "./serverTypes-CgQcIVf1.js";
+import { s as OtcRfqSubscriptionParams } from "./clientTypes-DadMpdOk.js";
 
 //#region src/rfqSubscription.d.ts
 /**

package/dist/{serverTypes-CGY8MQaT.d.cts → serverTypes-CgQcIVf1.d.cts}

@@ -1,5 +1,19 @@
 //#region src/types/serverTypes.d.ts
 type OtcQuoteSizeUnit = 'base' | 'quote';
+interface OtcServerAuthNonce {
+  nonce: string;
+  issued_at_ms: number;
+  /** The nonce lasts 60s from issuance. */
+  expires_at_ms: number;
+  session_expires_at_ms: number | null;
+}
+/** The verified login identity. The session itself lives in an HttpOnly cookie. */
+interface OtcServerAuthSession {
+  owner: string;
+  sender: string;
+  signer: string;
+  expires_at_ms: number;
+}
 interface OtcServerExecutionDiagnostics {
   failure_source?: string;
   failure_stage?: string;
@@ -79,5 +93,5 @@ interface OtcServerRfqAck {
 }
 type OtcServerRfqMessage = OtcServerRfqAck | OtcServerQuoteBatch;
 //#endregion
-export { OtcServerExecutionSuccess as a, OtcServerQuoteStream as c, OtcServerRfqSubscribeStreamsRequest as d, OtcServerRfqSubscriptionRequest as f, OtcServerExecutionResponse as i, OtcServerRfqAck as l, OtcServerExecutionFailure as n, OtcServerQuote as o, OtcServerRfqUnsubscribeStreamsRequest as p, OtcServerExecutionPendingResolution as r, OtcServerQuoteBatch as s, OtcQuoteSizeUnit as t, OtcServerRfqMessage as u };
-//# sourceMappingURL=serverTypes-CGY8MQaT.d.cts.map
+export { OtcServerExecutionPendingResolution as a, OtcServerQuote as c, OtcServerRfqAck as d, OtcServerRfqMessage as f, OtcServerRfqUnsubscribeStreamsRequest as h, OtcServerExecutionFailure as i, OtcServerQuoteBatch as l, OtcServerRfqSubscriptionRequest as m, OtcServerAuthNonce as n, OtcServerExecutionResponse as o, OtcServerRfqSubscribeStreamsRequest as p, OtcServerAuthSession as r, OtcServerExecutionSuccess as s, OtcQuoteSizeUnit as t, OtcServerQuoteStream as u };
+//# sourceMappingURL=serverTypes-CgQcIVf1.d.cts.map

package/dist/serverTypes-CgQcIVf1.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverTypes-CgQcIVf1.d.cts","names":[],"sources":["../src/types/src/types/serverTypes.ts"],"mappings":";KAAY,gBAAA;AAAA,UAEK,kBAAA;EACf,KAAA;EACA,YAAA;EAJ0B;EAM1B,aAAA;EACA,qBAAA;AAAA;;UAIe,oBAAA;EACf,KAAA;EACA,MAAA;EACA,MAAA;EACA,aAAA;AAAA;AAAA,UAGQ,6BAAA;EACR,cAAA;EACA,aAAA;EACA,mBAAA;EACA,SAAA;EAVA;;;;EAeA,eAAA;EACA,cAAA;AAAA;AAAA,UAGe,yBAAA;EACf,MAAA;EACA,OAAA;EACA,YAAA;EACA,aAAA;AAAA;AAAA,UAGe,yBAAA,SAAkC,6BAA6B;EAC9E,MAAA;EACA,KAAA;EACA,UAAA;EACA,OAAA;EACA,YAAA;AAAA;AAAA,UAGe,mCAAA,SAA4C,6BAA6B;EACxF,MAAA;EACA,OAAA;EACA,YAAA;EACA,KAAA;EACA,UAAA;AAAA;AAhBa;AAAA,KAoBH,0BAAA,GACR,yBAAA,GACA,yBAAA,GACA,mCAAA;AAAA,UAEa,oBAAA;EACf,IAAA;EACA,UAAA;EACA,MAAA;EACA,IAAA;EACA,SAAA,EAAW,gBAAgB;EAC3B,SAAA;AAAA;AAAA,UAGe,mCAAA;EACf,MAAA;EACA,EAAA;EACA,OAAA,EAAS,oBAAoB;AAAA;AAAA,UAGd,qCAAA;EACf,MAAA;EACA,EAAA;EACA,OAAA,EAAS,oBAAoB;AAAA;AAAA,KAGnB,+BAAA,GACR,mCAAA,GACA,qCAAqC;;UAGxB,cAAA;EACf,UAAA;EACA,IAAA;EACA,SAAA,EAAW,gBAAgB;EAC3B,IAAA;EACA,MAAA;EACA,SAAA;EACA,MAAA;EACA,SAAA;EACA,cAAA;EACA,SAAA;AAAA;AAAA,UAGe,mBAAA;EACf,IAAA;EACA,IAAA;EACA,MAAA,EAAQ,cAAc;AAAA;AAAA,UAGP,eAAA;EACf,MAAA;EACA,EAAA;EA9CA;EAgDA,KAAA;AAAA;AAAA,KAGU,mBAAA,GAAsB,eAAA,GAAkB,mBAAmB"}

package/dist/{serverTypes-CGY8MQaT.d.ts → serverTypes-CgQcIVf1.d.ts}

@@ -1,5 +1,19 @@
 //#region src/types/serverTypes.d.ts
 type OtcQuoteSizeUnit = 'base' | 'quote';
+interface OtcServerAuthNonce {
+  nonce: string;
+  issued_at_ms: number;
+  /** The nonce lasts 60s from issuance. */
+  expires_at_ms: number;
+  session_expires_at_ms: number | null;
+}
+/** The verified login identity. The session itself lives in an HttpOnly cookie. */
+interface OtcServerAuthSession {
+  owner: string;
+  sender: string;
+  signer: string;
+  expires_at_ms: number;
+}
 interface OtcServerExecutionDiagnostics {
   failure_source?: string;
   failure_stage?: string;
@@ -79,5 +93,5 @@ interface OtcServerRfqAck {
 }
 type OtcServerRfqMessage = OtcServerRfqAck | OtcServerQuoteBatch;
 //#endregion
-export { OtcServerExecutionSuccess as a, OtcServerQuoteStream as c, OtcServerRfqSubscribeStreamsRequest as d, OtcServerRfqSubscriptionRequest as f, OtcServerExecutionResponse as i, OtcServerRfqAck as l, OtcServerExecutionFailure as n, OtcServerQuote as o, OtcServerRfqUnsubscribeStreamsRequest as p, OtcServerExecutionPendingResolution as r, OtcServerQuoteBatch as s, OtcQuoteSizeUnit as t, OtcServerRfqMessage as u };
-//# sourceMappingURL=serverTypes-CGY8MQaT.d.ts.map
+export { OtcServerExecutionPendingResolution as a, OtcServerQuote as c, OtcServerRfqAck as d, OtcServerRfqMessage as f, OtcServerRfqUnsubscribeStreamsRequest as h, OtcServerExecutionFailure as i, OtcServerQuoteBatch as l, OtcServerRfqSubscriptionRequest as m, OtcServerAuthNonce as n, OtcServerExecutionResponse as o, OtcServerRfqSubscribeStreamsRequest as p, OtcServerAuthSession as r, OtcServerExecutionSuccess as s, OtcQuoteSizeUnit as t, OtcServerQuoteStream as u };
+//# sourceMappingURL=serverTypes-CgQcIVf1.d.ts.map

package/dist/serverTypes-CgQcIVf1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverTypes-CgQcIVf1.d.ts","names":[],"sources":["../src/types/src/types/serverTypes.ts"],"mappings":";KAAY,gBAAA;AAAA,UAEK,kBAAA;EACf,KAAA;EACA,YAAA;EAJ0B;EAM1B,aAAA;EACA,qBAAA;AAAA;;UAIe,oBAAA;EACf,KAAA;EACA,MAAA;EACA,MAAA;EACA,aAAA;AAAA;AAAA,UAGQ,6BAAA;EACR,cAAA;EACA,aAAA;EACA,mBAAA;EACA,SAAA;EAVA;;;;EAeA,eAAA;EACA,cAAA;AAAA;AAAA,UAGe,yBAAA;EACf,MAAA;EACA,OAAA;EACA,YAAA;EACA,aAAA;AAAA;AAAA,UAGe,yBAAA,SAAkC,6BAA6B;EAC9E,MAAA;EACA,KAAA;EACA,UAAA;EACA,OAAA;EACA,YAAA;AAAA;AAAA,UAGe,mCAAA,SAA4C,6BAA6B;EACxF,MAAA;EACA,OAAA;EACA,YAAA;EACA,KAAA;EACA,UAAA;AAAA;AAhBa;AAAA,KAoBH,0BAAA,GACR,yBAAA,GACA,yBAAA,GACA,mCAAA;AAAA,UAEa,oBAAA;EACf,IAAA;EACA,UAAA;EACA,MAAA;EACA,IAAA;EACA,SAAA,EAAW,gBAAgB;EAC3B,SAAA;AAAA;AAAA,UAGe,mCAAA;EACf,MAAA;EACA,EAAA;EACA,OAAA,EAAS,oBAAoB;AAAA;AAAA,UAGd,qCAAA;EACf,MAAA;EACA,EAAA;EACA,OAAA,EAAS,oBAAoB;AAAA;AAAA,KAGnB,+BAAA,GACR,mCAAA,GACA,qCAAqC;;UAGxB,cAAA;EACf,UAAA;EACA,IAAA;EACA,SAAA,EAAW,gBAAgB;EAC3B,IAAA;EACA,MAAA;EACA,SAAA;EACA,MAAA;EACA,SAAA;EACA,cAAA;EACA,SAAA;AAAA;AAAA,UAGe,mBAAA;EACf,IAAA;EACA,IAAA;EACA,MAAA,EAAQ,cAAc;AAAA;AAAA,UAGP,eAAA;EACf,MAAA;EACA,EAAA;EA9CA;EAgDA,KAAA;AAAA;AAAA,KAGU,mBAAA,GAAsB,eAAA,GAAkB,mBAAmB"}

package/dist/siweMessage.cjs

@@ -0,0 +1,31 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/siweMessage.ts
+/**
+* Statement shown to the user when the owner wallet signs. The service does not check it.
+*/
+const OTC_SIWE_STATEMENT = "Sign in to read Nado OTC quotes. This signature cannot place or authorize trades.";
+/**
+* Builds the exact ERC-4361 text the OTC service verifies for private quote login. Sign it
+* with `personal_sign` and send it unchanged to `verifyAuth`.
+*/
+function buildOtcSiweMessage({ domain, uri, address, chainId, nonce, issuedAtMs, sender }) {
+	return [
+		`${domain} wants you to sign in with your Ethereum account:`,
+		address,
+		"",
+		OTC_SIWE_STATEMENT,
+		"",
+		`URI: ${uri}`,
+		"Version: 1",
+		`Chain ID: ${chainId}`,
+		`Nonce: ${nonce}`,
+		`Issued At: ${new Date(issuedAtMs).toISOString()}`,
+		"Resources:",
+		`- urn:nado:subaccount:${sender}`
+	].join("\n");
+}
+//#endregion
+exports.OTC_SIWE_STATEMENT = OTC_SIWE_STATEMENT;
+exports.buildOtcSiweMessage = buildOtcSiweMessage;
+
+//# sourceMappingURL=siweMessage.cjs.map

package/dist/siweMessage.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"siweMessage.cjs","names":[],"sources":["../src/siweMessage.ts"],"sourcesContent":["import { OtcSiweMessageParams } from './types/clientTypes';\n\n/**\n * Statement shown to the user when the owner wallet signs. The service does not check it.\n */\nexport const OTC_SIWE_STATEMENT =\n  'Sign in to read Nado OTC quotes. This signature cannot place or authorize trades.';\n\n/**\n * Builds the exact ERC-4361 text the OTC service verifies for private quote login. Sign it\n * with `personal_sign` and send it unchanged to `verifyAuth`.\n */\nexport function buildOtcSiweMessage({\n  domain,\n  uri,\n  address,\n  chainId,\n  nonce,\n  issuedAtMs,\n  sender,\n}: OtcSiweMessageParams): string {\n  return [\n    `${domain} wants you to sign in with your Ethereum account:`,\n    address,\n    '',\n    OTC_SIWE_STATEMENT,\n    '',\n    `URI: ${uri}`,\n    'Version: 1',\n    `Chain ID: ${chainId}`,\n    `Nonce: ${nonce}`,\n    `Issued At: ${new Date(issuedAtMs).toISOString()}`,\n    'Resources:',\n    `- urn:nado:subaccount:${sender}`,\n  ].join('\\n');\n}\n"],"mappings":";;;;;AAKA,MAAa,qBACX;;;;;AAMF,SAAgB,oBAAoB,EAClC,QACA,KACA,SACA,SACA,OACA,YACA,UAC+B;CAC/B,OAAO;EACL,GAAG,OAAO;EACV;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA,aAAa;EACb,UAAU;EACV,cAAc,IAAI,KAAK,UAAU,EAAE,YAAY;EAC/C;EACA,yBAAyB;CAC3B,EAAE,KAAK,IAAI;AACb"}

package/dist/siweMessage.d.cts

@@ -0,0 +1,23 @@
+import { l as OtcSiweMessageParams } from "./clientTypes-_bJZ6Psb.cjs";
+
+//#region src/siweMessage.d.ts
+/**
+ * Statement shown to the user when the owner wallet signs. The service does not check it.
+ */
+declare const OTC_SIWE_STATEMENT = "Sign in to read Nado OTC quotes. This signature cannot place or authorize trades.";
+/**
+ * Builds the exact ERC-4361 text the OTC service verifies for private quote login. Sign it
+ * with `personal_sign` and send it unchanged to `verifyAuth`.
+ */
+declare function buildOtcSiweMessage({
+  domain,
+  uri,
+  address,
+  chainId,
+  nonce,
+  issuedAtMs,
+  sender
+}: OtcSiweMessageParams): string;
+//#endregion
+export { OTC_SIWE_STATEMENT, buildOtcSiweMessage };
+//# sourceMappingURL=siweMessage.d.cts.map

package/dist/siweMessage.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"siweMessage.d.cts","names":[],"sources":["../src/src/siweMessage.ts"],"mappings":";;;;;AAKA;cAAa,kBAAA;;;AAAkB;AAO/B;iBAAgB,mBAAA,CAAA;EACd,MAAA;EACA,GAAA;EACA,OAAA;EACA,OAAA;EACA,KAAA;EACA,UAAA;EACA;AAAA,GACC,oBAAA"}

package/dist/siweMessage.d.ts

@@ -0,0 +1,23 @@
+import { l as OtcSiweMessageParams } from "./clientTypes-DadMpdOk.js";
+
+//#region src/siweMessage.d.ts
+/**
+ * Statement shown to the user when the owner wallet signs. The service does not check it.
+ */
+declare const OTC_SIWE_STATEMENT = "Sign in to read Nado OTC quotes. This signature cannot place or authorize trades.";
+/**
+ * Builds the exact ERC-4361 text the OTC service verifies for private quote login. Sign it
+ * with `personal_sign` and send it unchanged to `verifyAuth`.
+ */
+declare function buildOtcSiweMessage({
+  domain,
+  uri,
+  address,
+  chainId,
+  nonce,
+  issuedAtMs,
+  sender
+}: OtcSiweMessageParams): string;
+//#endregion
+export { OTC_SIWE_STATEMENT, buildOtcSiweMessage };
+//# sourceMappingURL=siweMessage.d.ts.map

package/dist/siweMessage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"siweMessage.d.ts","names":[],"sources":["../src/src/siweMessage.ts"],"mappings":";;;;;AAKA;cAAa,kBAAA;;;AAAkB;AAO/B;iBAAgB,mBAAA,CAAA;EACd,MAAA;EACA,GAAA;EACA,OAAA;EACA,OAAA;EACA,KAAA;EACA,UAAA;EACA;AAAA,GACC,oBAAA"}

package/dist/siweMessage.js

@@ -0,0 +1,29 @@
+//#region src/siweMessage.ts
+/**
+* Statement shown to the user when the owner wallet signs. The service does not check it.
+*/
+const OTC_SIWE_STATEMENT = "Sign in to read Nado OTC quotes. This signature cannot place or authorize trades.";
+/**
+* Builds the exact ERC-4361 text the OTC service verifies for private quote login. Sign it
+* with `personal_sign` and send it unchanged to `verifyAuth`.
+*/
+function buildOtcSiweMessage({ domain, uri, address, chainId, nonce, issuedAtMs, sender }) {
+	return [
+		`${domain} wants you to sign in with your Ethereum account:`,
+		address,
+		"",
+		OTC_SIWE_STATEMENT,
+		"",
+		`URI: ${uri}`,
+		"Version: 1",
+		`Chain ID: ${chainId}`,
+		`Nonce: ${nonce}`,
+		`Issued At: ${new Date(issuedAtMs).toISOString()}`,
+		"Resources:",
+		`- urn:nado:subaccount:${sender}`
+	].join("\n");
+}
+//#endregion
+export { OTC_SIWE_STATEMENT, buildOtcSiweMessage };
+
+//# sourceMappingURL=siweMessage.js.map

package/dist/siweMessage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"siweMessage.js","names":[],"sources":["../src/siweMessage.ts"],"sourcesContent":["import { OtcSiweMessageParams } from './types/clientTypes';\n\n/**\n * Statement shown to the user when the owner wallet signs. The service does not check it.\n */\nexport const OTC_SIWE_STATEMENT =\n  'Sign in to read Nado OTC quotes. This signature cannot place or authorize trades.';\n\n/**\n * Builds the exact ERC-4361 text the OTC service verifies for private quote login. Sign it\n * with `personal_sign` and send it unchanged to `verifyAuth`.\n */\nexport function buildOtcSiweMessage({\n  domain,\n  uri,\n  address,\n  chainId,\n  nonce,\n  issuedAtMs,\n  sender,\n}: OtcSiweMessageParams): string {\n  return [\n    `${domain} wants you to sign in with your Ethereum account:`,\n    address,\n    '',\n    OTC_SIWE_STATEMENT,\n    '',\n    `URI: ${uri}`,\n    'Version: 1',\n    `Chain ID: ${chainId}`,\n    `Nonce: ${nonce}`,\n    `Issued At: ${new Date(issuedAtMs).toISOString()}`,\n    'Resources:',\n    `- urn:nado:subaccount:${sender}`,\n  ].join('\\n');\n}\n"],"mappings":";;;;AAKA,MAAa,qBACX;;;;;AAMF,SAAgB,oBAAoB,EAClC,QACA,KACA,SACA,SACA,OACA,YACA,UAC+B;CAC/B,OAAO;EACL,GAAG,OAAO;EACV;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA,aAAa;EACb,UAAU;EACV,cAAc,IAAI,KAAK,UAAU,EAAE,YAAY;EAC/C;EACA,yBAAyB;CAC3B,EAAE,KAAK,IAAI;AACb"}

package/dist/types/clientTypes.d.cts

@@ -1,2 +1,2 @@
-import { a as OtcReadyResult, i as OtcQuoteStream, n as OtcGetExecutionStatusParams, o as OtcRfqSubscriptionParams, r as OtcGetReadyParams, s as OtcServerTakerOrderParams, t as OtcExecuteParams } from "../clientTypes-CjBtkKtk.cjs";
-export { OtcExecuteParams, OtcGetExecutionStatusParams, OtcGetReadyParams, OtcQuoteStream, OtcReadyResult, OtcRfqSubscriptionParams, OtcServerTakerOrderParams };
+import { a as OtcQuoteStream, c as OtcServerTakerOrderParams, i as OtcGetReadyParams, l as OtcSiweMessageParams, n as OtcGetAuthNonceParams, o as OtcReadyResult, r as OtcGetExecutionStatusParams, s as OtcRfqSubscriptionParams, t as OtcExecuteParams, u as OtcVerifyAuthParams } from "../clientTypes-_bJZ6Psb.cjs";
+export { OtcExecuteParams, OtcGetAuthNonceParams, OtcGetExecutionStatusParams, OtcGetReadyParams, OtcQuoteStream, OtcReadyResult, OtcRfqSubscriptionParams, OtcServerTakerOrderParams, OtcSiweMessageParams, OtcVerifyAuthParams };

package/dist/types/clientTypes.d.ts

@@ -1,2 +1,2 @@
-import { a as OtcReadyResult, i as OtcQuoteStream, n as OtcGetExecutionStatusParams, o as OtcRfqSubscriptionParams, r as OtcGetReadyParams, s as OtcServerTakerOrderParams, t as OtcExecuteParams } from "../clientTypes-CMksWClt.js";
-export { OtcExecuteParams, OtcGetExecutionStatusParams, OtcGetReadyParams, OtcQuoteStream, OtcReadyResult, OtcRfqSubscriptionParams, OtcServerTakerOrderParams };
+import { a as OtcQuoteStream, c as OtcServerTakerOrderParams, i as OtcGetReadyParams, l as OtcSiweMessageParams, n as OtcGetAuthNonceParams, o as OtcReadyResult, r as OtcGetExecutionStatusParams, s as OtcRfqSubscriptionParams, t as OtcExecuteParams, u as OtcVerifyAuthParams } from "../clientTypes-DadMpdOk.js";
+export { OtcExecuteParams, OtcGetAuthNonceParams, OtcGetExecutionStatusParams, OtcGetReadyParams, OtcQuoteStream, OtcReadyResult, OtcRfqSubscriptionParams, OtcServerTakerOrderParams, OtcSiweMessageParams, OtcVerifyAuthParams };

package/dist/types/index.d.cts

@@ -1,4 +1,4 @@
-import { a as OtcServerExecutionSuccess, c as OtcServerQuoteStream, d as OtcServerRfqSubscribeStreamsRequest, f as OtcServerRfqSubscriptionRequest, i as OtcServerExecutionResponse, l as OtcServerRfqAck, n as OtcServerExecutionFailure, o as OtcServerQuote, p as OtcServerRfqUnsubscribeStreamsRequest, r as OtcServerExecutionPendingResolution, s as OtcServerQuoteBatch, t as OtcQuoteSizeUnit, u as OtcServerRfqMessage } from "../serverTypes-CGY8MQaT.cjs";
-import { a as OtcReadyResult, i as OtcQuoteStream, n as OtcGetExecutionStatusParams, o as OtcRfqSubscriptionParams, r as OtcGetReadyParams, s as OtcServerTakerOrderParams, t as OtcExecuteParams } from "../clientTypes-CjBtkKtk.cjs";
+import { a as OtcServerExecutionPendingResolution, c as OtcServerQuote, d as OtcServerRfqAck, f as OtcServerRfqMessage, h as OtcServerRfqUnsubscribeStreamsRequest, i as OtcServerExecutionFailure, l as OtcServerQuoteBatch, m as OtcServerRfqSubscriptionRequest, n as OtcServerAuthNonce, o as OtcServerExecutionResponse, p as OtcServerRfqSubscribeStreamsRequest, r as OtcServerAuthSession, s as OtcServerExecutionSuccess, t as OtcQuoteSizeUnit, u as OtcServerQuoteStream } from "../serverTypes-CgQcIVf1.cjs";
+import { a as OtcQuoteStream, c as OtcServerTakerOrderParams, i as OtcGetReadyParams, l as OtcSiweMessageParams, n as OtcGetAuthNonceParams, o as OtcReadyResult, r as OtcGetExecutionStatusParams, s as OtcRfqSubscriptionParams, t as OtcExecuteParams, u as OtcVerifyAuthParams } from "../clientTypes-_bJZ6Psb.cjs";
 import { n as OtcErrorCode, t as OTC_ERROR_CODES } from "../otcErrorCodes-CsmoGjD_.cjs";
-export { OTC_ERROR_CODES, OtcErrorCode, OtcExecuteParams, OtcGetExecutionStatusParams, OtcGetReadyParams, OtcQuoteSizeUnit, OtcQuoteStream, OtcReadyResult, OtcRfqSubscriptionParams, OtcServerExecutionFailure, OtcServerExecutionPendingResolution, OtcServerExecutionResponse, OtcServerExecutionSuccess, OtcServerQuote, OtcServerQuoteBatch, OtcServerQuoteStream, OtcServerRfqAck, OtcServerRfqMessage, OtcServerRfqSubscribeStreamsRequest, OtcServerRfqSubscriptionRequest, OtcServerRfqUnsubscribeStreamsRequest, OtcServerTakerOrderParams };
+export { OTC_ERROR_CODES, OtcErrorCode, OtcExecuteParams, OtcGetAuthNonceParams, OtcGetExecutionStatusParams, OtcGetReadyParams, OtcQuoteSizeUnit, OtcQuoteStream, OtcReadyResult, OtcRfqSubscriptionParams, OtcServerAuthNonce, OtcServerAuthSession, OtcServerExecutionFailure, OtcServerExecutionPendingResolution, OtcServerExecutionResponse, OtcServerExecutionSuccess, OtcServerQuote, OtcServerQuoteBatch, OtcServerQuoteStream, OtcServerRfqAck, OtcServerRfqMessage, OtcServerRfqSubscribeStreamsRequest, OtcServerRfqSubscriptionRequest, OtcServerRfqUnsubscribeStreamsRequest, OtcServerTakerOrderParams, OtcSiweMessageParams, OtcVerifyAuthParams };

package/dist/types/index.d.ts

@@ -1,4 +1,4 @@
-import { a as OtcServerExecutionSuccess, c as OtcServerQuoteStream, d as OtcServerRfqSubscribeStreamsRequest, f as OtcServerRfqSubscriptionRequest, i as OtcServerExecutionResponse, l as OtcServerRfqAck, n as OtcServerExecutionFailure, o as OtcServerQuote, p as OtcServerRfqUnsubscribeStreamsRequest, r as OtcServerExecutionPendingResolution, s as OtcServerQuoteBatch, t as OtcQuoteSizeUnit, u as OtcServerRfqMessage } from "../serverTypes-CGY8MQaT.js";
-import { a as OtcReadyResult, i as OtcQuoteStream, n as OtcGetExecutionStatusParams, o as OtcRfqSubscriptionParams, r as OtcGetReadyParams, s as OtcServerTakerOrderParams, t as OtcExecuteParams } from "../clientTypes-CMksWClt.js";
+import { a as OtcServerExecutionPendingResolution, c as OtcServerQuote, d as OtcServerRfqAck, f as OtcServerRfqMessage, h as OtcServerRfqUnsubscribeStreamsRequest, i as OtcServerExecutionFailure, l as OtcServerQuoteBatch, m as OtcServerRfqSubscriptionRequest, n as OtcServerAuthNonce, o as OtcServerExecutionResponse, p as OtcServerRfqSubscribeStreamsRequest, r as OtcServerAuthSession, s as OtcServerExecutionSuccess, t as OtcQuoteSizeUnit, u as OtcServerQuoteStream } from "../serverTypes-CgQcIVf1.js";
+import { a as OtcQuoteStream, c as OtcServerTakerOrderParams, i as OtcGetReadyParams, l as OtcSiweMessageParams, n as OtcGetAuthNonceParams, o as OtcReadyResult, r as OtcGetExecutionStatusParams, s as OtcRfqSubscriptionParams, t as OtcExecuteParams, u as OtcVerifyAuthParams } from "../clientTypes-DadMpdOk.js";
 import { n as OtcErrorCode, t as OTC_ERROR_CODES } from "../otcErrorCodes-CsmoGjD_.js";
-export { OTC_ERROR_CODES, OtcErrorCode, OtcExecuteParams, OtcGetExecutionStatusParams, OtcGetReadyParams, OtcQuoteSizeUnit, OtcQuoteStream, OtcReadyResult, OtcRfqSubscriptionParams, OtcServerExecutionFailure, OtcServerExecutionPendingResolution, OtcServerExecutionResponse, OtcServerExecutionSuccess, OtcServerQuote, OtcServerQuoteBatch, OtcServerQuoteStream, OtcServerRfqAck, OtcServerRfqMessage, OtcServerRfqSubscribeStreamsRequest, OtcServerRfqSubscriptionRequest, OtcServerRfqUnsubscribeStreamsRequest, OtcServerTakerOrderParams };
+export { OTC_ERROR_CODES, OtcErrorCode, OtcExecuteParams, OtcGetAuthNonceParams, OtcGetExecutionStatusParams, OtcGetReadyParams, OtcQuoteSizeUnit, OtcQuoteStream, OtcReadyResult, OtcRfqSubscriptionParams, OtcServerAuthNonce, OtcServerAuthSession, OtcServerExecutionFailure, OtcServerExecutionPendingResolution, OtcServerExecutionResponse, OtcServerExecutionSuccess, OtcServerQuote, OtcServerQuoteBatch, OtcServerQuoteStream, OtcServerRfqAck, OtcServerRfqMessage, OtcServerRfqSubscribeStreamsRequest, OtcServerRfqSubscriptionRequest, OtcServerRfqUnsubscribeStreamsRequest, OtcServerTakerOrderParams, OtcSiweMessageParams, OtcVerifyAuthParams };

package/dist/types/serverTypes.d.cts

@@ -1,2 +1,2 @@
-import { a as OtcServerExecutionSuccess, c as OtcServerQuoteStream, d as OtcServerRfqSubscribeStreamsRequest, f as OtcServerRfqSubscriptionRequest, i as OtcServerExecutionResponse, l as OtcServerRfqAck, n as OtcServerExecutionFailure, o as OtcServerQuote, p as OtcServerRfqUnsubscribeStreamsRequest, r as OtcServerExecutionPendingResolution, s as OtcServerQuoteBatch, t as OtcQuoteSizeUnit, u as OtcServerRfqMessage } from "../serverTypes-CGY8MQaT.cjs";
-export { OtcQuoteSizeUnit, OtcServerExecutionFailure, OtcServerExecutionPendingResolution, OtcServerExecutionResponse, OtcServerExecutionSuccess, OtcServerQuote, OtcServerQuoteBatch, OtcServerQuoteStream, OtcServerRfqAck, OtcServerRfqMessage, OtcServerRfqSubscribeStreamsRequest, OtcServerRfqSubscriptionRequest, OtcServerRfqUnsubscribeStreamsRequest };
+import { a as OtcServerExecutionPendingResolution, c as OtcServerQuote, d as OtcServerRfqAck, f as OtcServerRfqMessage, h as OtcServerRfqUnsubscribeStreamsRequest, i as OtcServerExecutionFailure, l as OtcServerQuoteBatch, m as OtcServerRfqSubscriptionRequest, n as OtcServerAuthNonce, o as OtcServerExecutionResponse, p as OtcServerRfqSubscribeStreamsRequest, r as OtcServerAuthSession, s as OtcServerExecutionSuccess, t as OtcQuoteSizeUnit, u as OtcServerQuoteStream } from "../serverTypes-CgQcIVf1.cjs";
+export { OtcQuoteSizeUnit, OtcServerAuthNonce, OtcServerAuthSession, OtcServerExecutionFailure, OtcServerExecutionPendingResolution, OtcServerExecutionResponse, OtcServerExecutionSuccess, OtcServerQuote, OtcServerQuoteBatch, OtcServerQuoteStream, OtcServerRfqAck, OtcServerRfqMessage, OtcServerRfqSubscribeStreamsRequest, OtcServerRfqSubscriptionRequest, OtcServerRfqUnsubscribeStreamsRequest };

package/dist/types/serverTypes.d.ts

@@ -1,2 +1,2 @@
-import { a as OtcServerExecutionSuccess, c as OtcServerQuoteStream, d as OtcServerRfqSubscribeStreamsRequest, f as OtcServerRfqSubscriptionRequest, i as OtcServerExecutionResponse, l as OtcServerRfqAck, n as OtcServerExecutionFailure, o as OtcServerQuote, p as OtcServerRfqUnsubscribeStreamsRequest, r as OtcServerExecutionPendingResolution, s as OtcServerQuoteBatch, t as OtcQuoteSizeUnit, u as OtcServerRfqMessage } from "../serverTypes-CGY8MQaT.js";
-export { OtcQuoteSizeUnit, OtcServerExecutionFailure, OtcServerExecutionPendingResolution, OtcServerExecutionResponse, OtcServerExecutionSuccess, OtcServerQuote, OtcServerQuoteBatch, OtcServerQuoteStream, OtcServerRfqAck, OtcServerRfqMessage, OtcServerRfqSubscribeStreamsRequest, OtcServerRfqSubscriptionRequest, OtcServerRfqUnsubscribeStreamsRequest };
+import { a as OtcServerExecutionPendingResolution, c as OtcServerQuote, d as OtcServerRfqAck, f as OtcServerRfqMessage, h as OtcServerRfqUnsubscribeStreamsRequest, i as OtcServerExecutionFailure, l as OtcServerQuoteBatch, m as OtcServerRfqSubscriptionRequest, n as OtcServerAuthNonce, o as OtcServerExecutionResponse, p as OtcServerRfqSubscribeStreamsRequest, r as OtcServerAuthSession, s as OtcServerExecutionSuccess, t as OtcQuoteSizeUnit, u as OtcServerQuoteStream } from "../serverTypes-CgQcIVf1.js";
+export { OtcQuoteSizeUnit, OtcServerAuthNonce, OtcServerAuthSession, OtcServerExecutionFailure, OtcServerExecutionPendingResolution, OtcServerExecutionResponse, OtcServerExecutionSuccess, OtcServerQuote, OtcServerQuoteBatch, OtcServerQuoteStream, OtcServerRfqAck, OtcServerRfqMessage, OtcServerRfqSubscribeStreamsRequest, OtcServerRfqSubscriptionRequest, OtcServerRfqUnsubscribeStreamsRequest };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nadohq/otc-client",
-  "version": "0.55.0",
+  "version": "0.57.0",
   "type": "module",
   "sideEffects": false,
   "description": "HTTP client for the Nado OTC service - execute a signed fill-or-kill order, read its status, and build RFQ quote subscriptions",
@@ -41,12 +41,12 @@
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "dependencies": {
-    "@nadohq/engine-client": "^0.55.0",
-    "@nadohq/shared": "^0.55.0",
+    "@nadohq/engine-client": "^0.57.0",
+    "@nadohq/shared": "^0.57.0",
     "axios": "1.16.1"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1"
   },
-  "gitHead": "b76772999226b64d52b03662246c7e98ba5b7d06"
+  "gitHead": "7cb8102ccb2b3632cad3a8c44c3bbe6c7a081ae6"
 }

package/src/OtcClient.ts

@@ -1,12 +1,18 @@
 import { getNadoClientTypeHeaders } from '@nadohq/shared';
-import axios, { AxiosInstance } from 'axios';
+import axios, { AxiosInstance, AxiosResponse } from 'axios';
 import {
   OtcExecuteParams,
+  OtcGetAuthNonceParams,
   OtcGetExecutionStatusParams,
   OtcGetReadyParams,
   OtcReadyResult,
+  OtcVerifyAuthParams,
 } from './types/clientTypes';
-import { OtcServerExecutionResponse } from './types/serverTypes';
+import {
+  OtcServerAuthNonce,
+  OtcServerAuthSession,
+  OtcServerExecutionResponse,
+} from './types/serverTypes';
 
 export interface OtcClientOpts {
   /**
@@ -40,6 +46,28 @@ export class OtcClient {
     });
   }
 
+  /**
+   * Starts a private quote login for `sender`. Build the message with `buildOtcSiweMessage`,
+   * sign it, and pass it to {@link OtcClient.verifyAuth} within 60s. Throws on a non-200.
+   */
+  async getAuthNonce(
+    params: OtcGetAuthNonceParams,
+  ): Promise<OtcServerAuthNonce> {
+    return this.postAuth('/v1/auth/nonce', { sender: params.sender });
+  }
+
+  /**
+   * Completes a private quote login. On success the browser holds the session cookie; open a
+   * new quote socket afterwards, since a socket keeps the session it had at its handshake.
+   * Throws on a non-200; the message carries the service's `error` code.
+   */
+  async verifyAuth(params: OtcVerifyAuthParams): Promise<OtcServerAuthSession> {
+    return this.postAuth('/v1/auth/verify', {
+      message: params.message,
+      signature: params.signature,
+    });
+  }
+
   /**
    * Submits a signed taker order. Send this body unchanged on `retry_same_request`.
    */
@@ -77,6 +105,25 @@ export class OtcClient {
     };
   }
 
+  /** The login routes need credentials. */
+  private async postAuth<T>(path: string, body: unknown): Promise<T> {
+    const response = await this.axiosInstance.post(
+      `${this.opts.url}${path}`,
+      body,
+      { withCredentials: true },
+    );
+    this.checkResponseStatus(response);
+    return response.data as T;
+  }
+
+  private checkResponseStatus(response: AxiosResponse) {
+    if (response.status !== 200 || !response.data) {
+      throw Error(
+        `Unexpected response from server: ${response.status} ${response.statusText}. Data: ${JSON.stringify(response.data)}`,
+      );
+    }
+  }
+
   private async postExecution(
     path: string,
     body: unknown,

package/src/index.ts

@@ -1,4 +1,5 @@
 export * from './endpoints';
 export * from './OtcClient';
 export * from './rfqSubscription';
+export * from './siweMessage';
 export * from './types';

package/src/siweMessage.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, it } from '@jest/globals';
+import { buildOtcSiweMessage } from './siweMessage';
+
+describe('buildOtcSiweMessage', () => {
+  it('matches the documented message layout', () => {
+    expect(
+      buildOtcSiweMessage({
+        domain: 'testnet.nado.xyz',
+        uri: 'https://testnet.nado.xyz',
+        address: '0x1111111111111111111111111111111111111111',
+        chainId: 763373,
+        nonce: 'Qm3Ys8Pd5Hc1Ja6R',
+        issuedAtMs: Date.UTC(2026, 9, 6, 12),
+        sender:
+          '0x111111111111111111111111111111111111111164656661756c740000000000',
+      }),
+    ).toBe(
+      [
+        'testnet.nado.xyz wants you to sign in with your Ethereum account:',
+        '0x1111111111111111111111111111111111111111',
+        '',
+        'Sign in to read Nado OTC quotes. This signature cannot place or authorize trades.',
+        '',
+        'URI: https://testnet.nado.xyz',
+        'Version: 1',
+        'Chain ID: 763373',
+        'Nonce: Qm3Ys8Pd5Hc1Ja6R',
+        'Issued At: 2026-10-06T12:00:00.000Z',
+        'Resources:',
+        '- urn:nado:subaccount:0x111111111111111111111111111111111111111164656661756c740000000000',
+      ].join('\n'),
+    );
+  });
+});

package/src/siweMessage.ts

@@ -0,0 +1,36 @@
+import { OtcSiweMessageParams } from './types/clientTypes';
+
+/**
+ * Statement shown to the user when the owner wallet signs. The service does not check it.
+ */
+export const OTC_SIWE_STATEMENT =
+  'Sign in to read Nado OTC quotes. This signature cannot place or authorize trades.';
+
+/**
+ * Builds the exact ERC-4361 text the OTC service verifies for private quote login. Sign it
+ * with `personal_sign` and send it unchanged to `verifyAuth`.
+ */
+export function buildOtcSiweMessage({
+  domain,
+  uri,
+  address,
+  chainId,
+  nonce,
+  issuedAtMs,
+  sender,
+}: OtcSiweMessageParams): string {
+  return [
+    `${domain} wants you to sign in with your Ethereum account:`,
+    address,
+    '',
+    OTC_SIWE_STATEMENT,
+    '',
+    `URI: ${uri}`,
+    'Version: 1',
+    `Chain ID: ${chainId}`,
+    `Nonce: ${nonce}`,
+    `Issued At: ${new Date(issuedAtMs).toISOString()}`,
+    'Resources:',
+    `- urn:nado:subaccount:${sender}`,
+  ].join('\n');
+}

package/src/types/clientTypes.ts

@@ -14,7 +14,7 @@ export interface OtcExecuteParams {
   /** Client-generated idempotency key, 1–128 bytes. Kept across retries of this intent. */
   dealId: string;
   taker: OtcServerTakerOrderParams;
-  /** Execution route. Omitted selects the service default (`awr`). */
+  /** The route. The service requires it and has no default. */
   pricerId?: string;
 }
 
@@ -27,6 +27,33 @@ export interface OtcGetReadyParams {
   pricerId?: string;
 }
 
+export interface OtcGetAuthNonceParams {
+  /** The 32-byte subaccount the login is bound to. */
+  sender: string;
+}
+
+export interface OtcSiweMessageParams {
+  /** Host of the page origin, e.g. `testnet.nado.xyz`. */
+  domain: string;
+  /** The page origin, with no path or trailing slash. */
+  uri: string;
+  /** The signing address, EIP-55 checksummed: the owner or the sender's linked signer. */
+  address: string;
+  chainId: number;
+  nonce: string;
+  /** `issued_at_ms` from the nonce response; a local clock can be rejected as future. */
+  issuedAtMs: number;
+  /** The same sender as the nonce request. */
+  sender: string;
+}
+
+export interface OtcVerifyAuthParams {
+  /** The SIWE text exactly as signed. */
+  message: string;
+  /** 65-byte hex `personal_sign` signature of `message`. */
+  signature: string;
+}
+
 /**
  * Route coverage. HTTP 200 is ready; 400 and 503 are not. This does not guarantee liquidity
  * or that an order will be accepted.
@@ -46,7 +73,7 @@ export interface OtcQuoteStream {
   wallet: string;
   size: string;
   sizeUnit: OtcQuoteSizeUnit;
-  /** Execution route. Omitted selects the service default (`awr`). */
+  /** The route. The service requires it and has no default. */
   pricerId?: string;
 }
 

package/src/types/serverTypes.ts

@@ -1,5 +1,21 @@
 export type OtcQuoteSizeUnit = 'base' | 'quote';
 
+export interface OtcServerAuthNonce {
+  nonce: string;
+  issued_at_ms: number;
+  /** The nonce lasts 60s from issuance. */
+  expires_at_ms: number;
+  session_expires_at_ms: number | null;
+}
+
+/** The verified login identity. The session itself lives in an HttpOnly cookie. */
+export interface OtcServerAuthSession {
+  owner: string;
+  sender: string;
+  signer: string;
+  expires_at_ms: number;
+}
+
 interface OtcServerExecutionDiagnostics {
   failure_source?: string;
   failure_stage?: string;

package/dist/OtcClient-qUPYb1BP.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"OtcClient-qUPYb1BP.cjs","names":[],"sources":["../src/OtcClient.ts"],"sourcesContent":["import { getNadoClientTypeHeaders } from '@nadohq/shared';\nimport axios, { AxiosInstance } from 'axios';\nimport {\n  OtcExecuteParams,\n  OtcGetExecutionStatusParams,\n  OtcGetReadyParams,\n  OtcReadyResult,\n} from './types/clientTypes';\nimport { OtcServerExecutionResponse } from './types/serverTypes';\n\nexport interface OtcClientOpts {\n  /**\n   * OTC service origin, without a path, e.g. {@link OTC_CLIENT_ENDPOINTS}.\n   */\n  url: string;\n  // If provided, identifies the calling client, sent as a header with every request\n  clientType?: string;\n}\n\n/**\n * Client for the public OTC service.\n *\n * {@link OtcClient.execute} does not sign. The caller supplies an already-signed taker order.\n * A quote is not required. {@link OtcClient.getExecutionStatus} only reads a deal; it does not\n * start or resume one.\n *\n * Responses are the JSON body as returned, including non-200 admission responses. Branch on\n * `status` and `recovery_action`.\n */\nexport class OtcClient {\n  readonly opts: OtcClientOpts;\n  readonly axiosInstance: AxiosInstance;\n\n  constructor(opts: OtcClientOpts) {\n    this.opts = opts;\n    this.axiosInstance = axios.create({\n      withCredentials: false,\n      validateStatus: () => true,\n      headers: getNadoClientTypeHeaders(opts.clientType),\n    });\n  }\n\n  /**\n   * Submits a signed taker order. Send this body unchanged on `retry_same_request`.\n   */\n  async execute(params: OtcExecuteParams): Promise<OtcServerExecutionResponse> {\n    return this.postExecution('/v1/executor', {\n      deal_id: params.dealId,\n      taker: params.taker,\n      ...(params.pricerId ? { pricer_id: params.pricerId } : {}),\n    });\n  }\n\n  /**\n   * Reads one execution. Use it after a lost response, a refresh, or `wait`.\n   */\n  async getExecutionStatus(\n    params: OtcGetExecutionStatusParams,\n  ): Promise<OtcServerExecutionResponse> {\n    return this.postExecution('/v1/executor/status', {\n      deal_id: params.dealId,\n      taker_digest: params.takerDigest,\n    });\n  }\n\n  /**\n   * Checks that quote and deal product scopes overlap for a route. An omitted `pricerId`\n   * asks the service default. A direct execution needs a matching deal worker, not a prior quote.\n   */\n  async getReady(params: OtcGetReadyParams = {}): Promise<OtcReadyResult> {\n    const response = await this.axiosInstance.get(`${this.opts.url}/ready`, {\n      params: params.pricerId ? { pricer_id: params.pricerId } : undefined,\n    });\n    return {\n      httpStatus: response.status,\n      ready: response.status === 200,\n    };\n  }\n\n  private async postExecution(\n    path: string,\n    body: unknown,\n  ): Promise<OtcServerExecutionResponse> {\n    const response = await this.axiosInstance.post(\n      `${this.opts.url}${path}`,\n      body,\n    );\n    return response.data as OtcServerExecutionResponse;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAa,YAAb,MAAuB;CAIrB,YAAY,MAAqB;EAC/B,KAAK,OAAO;EACZ,KAAK,gBAAgB,MAAA,QAAM,OAAO;GAChC,iBAAiB;GACjB,sBAAsB;GACtB,UAAA,GAAA,eAAA,0BAAkC,KAAK,UAAU;EACnD,CAAC;CACH;;;;CAKA,MAAM,QAAQ,QAA+D;EAC3E,OAAO,KAAK,cAAc,gBAAgB;GACxC,SAAS,OAAO;GAChB,OAAO,OAAO;GACd,GAAI,OAAO,WAAW,EAAE,WAAW,OAAO,SAAS,IAAI,CAAC;EAC1D,CAAC;CACH;;;;CAKA,MAAM,mBACJ,QACqC;EACrC,OAAO,KAAK,cAAc,uBAAuB;GAC/C,SAAS,OAAO;GAChB,cAAc,OAAO;EACvB,CAAC;CACH;;;;;CAMA,MAAM,SAAS,SAA4B,CAAC,GAA4B;EACtE,MAAM,WAAW,MAAM,KAAK,cAAc,IAAI,GAAG,KAAK,KAAK,IAAI,SAAS,EACtE,QAAQ,OAAO,WAAW,EAAE,WAAW,OAAO,SAAS,IAAI,KAAA,EAC7D,CAAC;EACD,OAAO;GACL,YAAY,SAAS;GACrB,OAAO,SAAS,WAAW;EAC7B;CACF;CAEA,MAAc,cACZ,MACA,MACqC;EAKrC,QAAO,MAJgB,KAAK,cAAc,KACxC,GAAG,KAAK,KAAK,MAAM,QACnB,IACF,GACgB;CAClB;AACF"}

package/dist/clientTypes-CMksWClt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"clientTypes-CMksWClt.d.ts","names":[],"sources":["../src/types/src/types/clientTypes.ts"],"mappings":";;;;;;AAOA;;KAAY,yBAAA,GAA4B,IAAI,CAC1C,4BAAA;AAAA,UAIe,gBAAA;EAJa;EAM5B,MAAA;EACA,KAAA,EAAO,yBAAyB;;EAEhC,QAAA;AAAA;AAAA,UAGe,2BAAA;EACf,MAAA;EACA,WAAW;AAAA;AAAA,UAGI,iBAAA;EACf,QAAQ;AAAA;;;AAJG;AAGb;UAQiB,cAAA;EACf,UAAA;EACA,KAAK;AAAA;AAFP;;;;AAAA,UASiB,cAAA;EACf,IAAA;EACA,SAAA;EACA,MAAA;EACA,IAAA;EACA,QAAA,EAAU,gBAAgB;EAH1B;EAKA,QAAA;AAAA;;UAIe,wBAAA;EACf,EAAA;EACA,OAAA,EAAS,cAAc;AAAA"}

package/dist/clientTypes-CjBtkKtk.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"clientTypes-CjBtkKtk.d.cts","names":[],"sources":["../src/types/src/types/clientTypes.ts"],"mappings":";;;;;;AAOA;;KAAY,yBAAA,GAA4B,IAAI,CAC1C,4BAAA;AAAA,UAIe,gBAAA;EAJa;EAM5B,MAAA;EACA,KAAA,EAAO,yBAAyB;;EAEhC,QAAA;AAAA;AAAA,UAGe,2BAAA;EACf,MAAA;EACA,WAAW;AAAA;AAAA,UAGI,iBAAA;EACf,QAAQ;AAAA;;;AAJG;AAGb;UAQiB,cAAA;EACf,UAAA;EACA,KAAK;AAAA;AAFP;;;;AAAA,UASiB,cAAA;EACf,IAAA;EACA,SAAA;EACA,MAAA;EACA,IAAA;EACA,QAAA,EAAU,gBAAgB;EAH1B;EAKA,QAAA;AAAA;;UAIe,wBAAA;EACf,EAAA;EACA,OAAA,EAAS,cAAc;AAAA"}

package/dist/serverTypes-CGY8MQaT.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"serverTypes-CGY8MQaT.d.cts","names":[],"sources":["../src/types/src/types/serverTypes.ts"],"mappings":";KAAY,gBAAA;AAAA,UAEF,6BAAA;EACR,cAAA;EACA,aAAA;EACA,mBAAA;EACA,SAAA;EAJQ;;;;EASR,eAAA;EACA,cAAA;AAAA;AAAA,UAGe,yBAAA;EACf,MAAA;EACA,OAAA;EACA,YAAA;EACA,aAAA;AAAA;AAAA,UAGe,yBAAA,SAAkC,6BAA6B;EAC9E,MAAA;EACA,KAAA;EACA,UAAA;EACA,OAAA;EACA,YAAA;AAAA;AAAA,UAGe,mCAAA,SAA4C,6BAA6B;EACxF,MAAA;EACA,OAAA;EACA,YAAA;EACA,KAAA;EACA,UAAA;AAAA;;KAIU,0BAAA,GACR,yBAAA,GACA,yBAAA,GACA,mCAAA;AAAA,UAEa,oBAAA;EACf,IAAA;EACA,UAAA;EACA,MAAA;EACA,IAAA;EACA,SAAA,EAAW,gBAAgB;EAC3B,SAAA;AAAA;AAAA,UAGe,mCAAA;EACf,MAAA;EACA,EAAA;EACA,OAAA,EAAS,oBAAoB;AAAA;AAAA,UAGd,qCAAA;EACf,MAAA;EACA,EAAA;EACA,OAAA,EAAS,oBAAoB;AAAA;AAAA,KAGnB,+BAAA,GACR,mCAAA,GACA,qCAAqC;;UAGxB,cAAA;EACf,UAAA;EACA,IAAA;EACA,SAAA,EAAW,gBAAgB;EAC3B,IAAA;EACA,MAAA;EACA,SAAA;EACA,MAAA;EACA,SAAA;EACA,cAAA;EACA,SAAA;AAAA;AAAA,UAGe,mBAAA;EACf,IAAA;EACA,IAAA;EACA,MAAA,EAAQ,cAAc;AAAA;AAAA,UAGP,eAAA;EACf,MAAA;EACA,EAAA;EAzCA;EA2CA,KAAA;AAAA;AAAA,KAGU,mBAAA,GAAsB,eAAA,GAAkB,mBAAmB"}

package/dist/serverTypes-CGY8MQaT.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"serverTypes-CGY8MQaT.d.ts","names":[],"sources":["../src/types/src/types/serverTypes.ts"],"mappings":";KAAY,gBAAA;AAAA,UAEF,6BAAA;EACR,cAAA;EACA,aAAA;EACA,mBAAA;EACA,SAAA;EAJQ;;;;EASR,eAAA;EACA,cAAA;AAAA;AAAA,UAGe,yBAAA;EACf,MAAA;EACA,OAAA;EACA,YAAA;EACA,aAAA;AAAA;AAAA,UAGe,yBAAA,SAAkC,6BAA6B;EAC9E,MAAA;EACA,KAAA;EACA,UAAA;EACA,OAAA;EACA,YAAA;AAAA;AAAA,UAGe,mCAAA,SAA4C,6BAA6B;EACxF,MAAA;EACA,OAAA;EACA,YAAA;EACA,KAAA;EACA,UAAA;AAAA;;KAIU,0BAAA,GACR,yBAAA,GACA,yBAAA,GACA,mCAAA;AAAA,UAEa,oBAAA;EACf,IAAA;EACA,UAAA;EACA,MAAA;EACA,IAAA;EACA,SAAA,EAAW,gBAAgB;EAC3B,SAAA;AAAA;AAAA,UAGe,mCAAA;EACf,MAAA;EACA,EAAA;EACA,OAAA,EAAS,oBAAoB;AAAA;AAAA,UAGd,qCAAA;EACf,MAAA;EACA,EAAA;EACA,OAAA,EAAS,oBAAoB;AAAA;AAAA,KAGnB,+BAAA,GACR,mCAAA,GACA,qCAAqC;;UAGxB,cAAA;EACf,UAAA;EACA,IAAA;EACA,SAAA,EAAW,gBAAgB;EAC3B,IAAA;EACA,MAAA;EACA,SAAA;EACA,MAAA;EACA,SAAA;EACA,cAAA;EACA,SAAA;AAAA;AAAA,UAGe,mBAAA;EACf,IAAA;EACA,IAAA;EACA,MAAA,EAAQ,cAAc;AAAA;AAAA,UAGP,eAAA;EACf,MAAA;EACA,EAAA;EAzCA;EA2CA,KAAA;AAAA;AAAA,KAGU,mBAAA,GAAsB,eAAA,GAAkB,mBAAmB"}