@capxul/sdk-react 0.1.0-alpha.1 → 0.1.0-alpha.10

package/CHANGELOG.md

@@ -1,5 +1,143 @@
 # @capxul/sdk-react
 
+## 0.1.0-alpha.10
+
+### Patch Changes
+
+- d252aa7: Widen the published React peer dependency to `>=18.2.0 <20` so React 18 consumers, including the Ink reference proof app, can install the alpha SDK without peer conflicts.
+
+## 0.1.0-alpha.9
+
+### Minor Changes
+
+- Add the canonical auth bootstrap flow.
+
+  `verifyOtp()` now resolves a verified email session into either an
+  `existing_member` identity or a `bootstrap_required` continuation. New and
+  incomplete members continue through `completeBootstrap()`, which validates a
+  server-issued bootstrap token, claims the username, provisions the account/Safe
+  through the backend bootstrap path, and returns the authenticated product
+  identity. The React SDK adds `useAuthBootstrapFlow()` as the typed first-run
+  flow wrapper.
+
+### Patch Changes
+
+- Updated dependencies
+  - @capxul/sdk@0.1.0-alpha.9
+
+## 0.1.0-alpha.8
+
+### Minor Changes
+
+- 3af04a9: Public `<CapxulProvider>` now wires authenticated Convex reads end-to-end (#487, closes #484).
+
+  The `build-time-urls` arm of `BrowserCapxulConfig` now causes the provider to internally instantiate a `ConvexReactClient`, wrap it as a `CapxulDataClient`, and feed it as `config.data` into `createCapxulClient`. The existing `auth.createDataClient` callback is wired to the same singleton so a `verifyOtp` call refreshes the data client's auth header without churning the WebSocket. The provider also wraps `client.auth.signOut` so the data client survives sign-out — post-signout reads return typed backend `NOT_AUTHENTICATED` instead of the SDK's `NOT_IMPLEMENTED` stub (closes the #474 friction as a side-effect).
+
+  New optional `sessionStore?: AuthSessionStore` prop lets browser apps opt into `localStorage`-backed persistence and Node consumers (CLIs, e2e harnesses) opt into file-backed persistence. Defaults to in-memory.
+
+  This closes the architectural gap that made the React hook surface (`useMe`, `useAccount`, `useSafe`, ...) impossible to exercise end-to-end through the public provider — previously `config.data` was never populated, so every authenticated read short-circuited to `NOT_IMPLEMENTED`. The Ink reference CLI (`apps/reference-cli/`) is rebuilt on top of the public provider as proof: 17/17 agent-driver assertions pass against live alpha-3 Convex, including a dev-OTP authenticated round-trip that mints a real session via `AUTH_DEV_OTP=00000` and exercises three distinct hook end-states (`NOT_AUTHENTICATED`, `PROFILE_NOT_FOUND`, post-signout `NOT_AUTHENTICATED`).
+
+- 57203a4: Withdrawals v1 W2 (#465) — public surface tightening + org-scope create
+  - `WithdrawalsCreateInput.destination` no longer accepts `kind`. The
+    backend now resolves the `external_account` row by FK and infers
+    the kind + rail server-side. Anything that doesn't route to
+    `chain_wallet` (or is chain_wallet but non-EVM in slice 1) returns
+    `VERIFICATION_REQUIRED` with `details.rail` + `details.currentKind`.
+  - `organizations.withdrawals.create` is now a real mutation (no
+    longer a `NOT_IMPLEMENTED` stub). Returns the `processing` row
+    only — Safe + Zodiac submission orchestration ships in W3+.
+  - `Errors.verificationRequired({ rail, currentKind })` factory
+    added; the `VERIFICATION_REQUIRED` code now broadens to cover
+    both KYC tier gates and unsupported withdrawal rails.
+
+  **Migration:** Remove `destination.kind` from any
+  `capxul.withdrawals.create({ destination: { kind, externalAccountId } })`
+  call sites. Pass only `externalAccountId`.
+
+### Patch Changes
+
+- Updated dependencies [57203a4]
+  - @capxul/sdk@0.1.0-alpha.8
+
+## 0.1.0-alpha.4
+
+### Minor Changes
+
+- Post-alpha hardening — WAVE 1 + WAVE 2 cumulative
+
+  **WAVE 1 (merged 2026-05-03 12:44Z):**
+  - S2 story 1: wire onboarding readback hooks (#469) — `me.update`, `accounts.retrieve`, `accounts.update`, `useAccount`, `useSafe`
+  - S3 phase 1: Ink reference CLI scaffold + `auth+me` end-to-end against live alpha-3 Convex (#470). Stickiness gate (D3) fired.
+  - S5: split `CapxulProvider` into public single-input `BrowserCapxulConfig` + test-only `CapxulTestProvider` from `@capxul/sdk-react/proof` (#473). Q1 lock honored. 7 type-level provider-shape guards including `@ts-expect-error` against test-provider leaking to public barrel.
+
+  **WAVE 2 (merged 2026-05-03 12:54-13:16Z):**
+  - S3 phase 2: per-domain CLI commands closing #458 (#476) — `account retrieve/update`, `safe retrieve`, `payment retrieve`, `withdrawal retrieve/list`. 12/12 agent-driver tests pass.
+  - S2 story 2: `capxul.tokenTransfers.*` non-canonical SDK namespace (#479) — Option A per #477 (canon-aligned `transfers.*` shape deferred to alpha.5+ pending backend canon work). New `useTokenTransfers` + `useTokenTransfer` hooks; new `getByTxLogIndex` backend query. Hook proof matrix length unchanged at 41 (non-canonical hooks deliberately excluded).
+
+  **S1 (#456) closed no-op** — alpha publish infrastructure (tsup, lazy-DX, transport state machine, npm metadata, READMEs, CHANGELOG, changesets, OIDC release workflow) physically merged into `api-first` via PRs #449-#452 earlier the same day; the slice merge produced 0 file changes per clean-room probe.
+
+  **Friction issues filed for alpha.4+ polish:**
+  - #474 — `me.get` returns `NOT_IMPLEMENTED` when `config.data` is undefined; should be `NOT_AUTHENTICATED`.
+  - #475 — `@capxul/sdk/headless` slim entry point excludes xstate flow machines + brand constructors (1.6 MB → much smaller).
+  - #477 / #478 — `transfers.*` / `balanceLedger.*` / `treasury` canon-shape alignment with indexer feed.
+  - #471 — Vercel-capxul-web preview-deploy systemic failure on api-first base (separate from epic).
+
+### Patch Changes
+
+- Updated dependencies
+  - @capxul/sdk@0.1.0-alpha.4
+
+## 0.1.0-alpha.3
+
+### Patch Changes
+
+- Re-export `tryCatch` from `@capxul/sdk`.
+
+  `tryCatch` is referenced in `packages/sdk/README.md` (live on npm at
+  `0.1.0-alpha.2`) and in `.claude/rules/sdk.md` as the canonical
+  async-error helper for SDK operations:
+
+  ```ts
+  import { tryCatch } from "@capxul/sdk";
+
+  const [err, payment] = await tryCatch(capxul.payments.create({ ... }));
+  ```
+
+  The helper lives at `@repo/observability/try-catch.ts` and is bundled
+  into the SDK dist via tsup `noExternal`, but it was never re-exported
+  from `packages/sdk/src/index.ts`. Consumers following the README example
+  hit `Module '"@capxul/sdk"' has no exported member 'tryCatch'.` at
+  import time.
+
+  Caught during alpha.2 spike-install verification (REVIEW.html, "What's
+  not proven" row 6). One-line public-export addition; no runtime change.
+
+- Updated dependencies
+  - @capxul/sdk@0.1.0-alpha.3
+
+## 0.1.0-alpha.2
+
+### Patch Changes
+
+- Add `convex` as a peer dependency.
+
+  `@capxul/sdk`'s bundled `_generated/api` snapshot calls
+  `anyApi` / `componentsGeneric` from `convex/server` at runtime — they
+  are not just types — and tsup correctly externalizes `convex` /
+  `convex/server` / `convex/react` so the consumer's own Convex install
+  is reused. The peer was missing from the published manifest, so
+  `require('@capxul/sdk')` failed with `Cannot find module 'convex/server'`
+  in any spike that hadn't already installed `convex`.
+
+  `@capxul/sdk-react` mirrors the peer because its bundle re-exports
+  flow-machine constructors from `@capxul/sdk` and may transitively
+  pull in the same module.
+
+  Caught during alpha.1 spike-install verification.
+
+- Updated dependencies
+  - @capxul/sdk@0.1.0-alpha.2
+
 ## 0.1.0-alpha.1
 
 ### Patch Changes

package/README.md

@@ -40,7 +40,12 @@ import { CapxulProvider } from "@capxul/sdk-react";
 
 export default function RootLayout({ children }) {
   return (
-    <CapxulProvider publishableKey={process.env.NEXT_PUBLIC_CAPXUL_KEY!}>
+    <CapxulProvider
+      config={{
+        mode: "publishable-key",
+        publishableKey: process.env.NEXT_PUBLIC_CAPXUL_PUBLISHABLE_KEY!,
+      }}
+    >
       {children}
     </CapxulProvider>
   );
@@ -119,6 +124,21 @@ subscription against the transport singleton — only the components
 that actually call it re-render when state changes. The provider
 itself never re-renders.
 
+## Publishable-key proof status
+
+The publishable-key path is runtime-proven where the repo can run it
+without secrets:
+
+| Surface | Runtime proof | Expected safe signal |
+|---|---|---|
+| Provider + `useMe()` | `corepack pnpm --filter @capxul/sdk-react check-types` plus the headless proof tests under `packages/sdk-react/ops/proof` | provider reaches `useCapxulStatus().status === "ready"` after one bootstrap request |
+| Reference CLI mock | `corepack pnpm --filter @capxul/reference-cli build && node apps/reference-cli/dist/cli.js bootstrap probe --mock --json` | `ok:true`, `mode:"publishable-key"`, `bootstrapRequests:1`, `authRequests:1`, `keyLengthClass:"provided"` |
+| Reference CLI live | same command without `--mock`, with `CAPXUL_REF_PUBLISHABLE_KEY` and optional `CAPXUL_REF_BOOTSTRAP_URL` set locally | success only when the key/origin/runtime are valid; otherwise sanitized SDK error JSON |
+
+Do not paste or commit publishable keys, session tokens, Convex JWTs,
+cookies, or provider payloads. Proof output reports only
+`keyLengthClass`.
+
 ## Hooks catalogue
 
 | Surface | Hook |