@capxul/sdk-react 0.1.0-alpha.3 → 0.1.0-alpha.6

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import { ReactNode } from 'react';
-import { HttpTransport, TransportState, CapxulConfig, BrowserCapxulConfig, AccountId, OrganizationId, ApiKeyId, BalanceLedgerEntryId, ExternalAccountId, MemberId, Account, ApiKey, BalanceLedgerEntry, DocumentId, Document, ExternalAccount, KybProfile, KycProfile, CapxulError as CapxulError$1, Member, OperationId, Operation, Organization, PaymentId, Payment, SafeId, Safe, SubAccountId, SubAccount, TransferId, Transfer, Treasury, VirtualAccountId, VirtualAccount, VirtualCardId, VirtualCard, WebhookEndpointId, WebhookEndpoint, WebhookEventId, WebhookEvent, WithdrawalId, Withdrawal, List, LocalPrivateKeySignerProvider } from '@capxul/sdk';
+import { HttpTransport, TransportState, BrowserCapxulConfig, AuthSessionStore, AccountId, OrganizationId, ApiKeyId, BalanceLedgerEntryId, ExternalAccountId, MemberId, Account, ApiKey, BalanceLedgerEntry, DocumentId, Document, ExternalAccount, KybProfile, KycProfile, CapxulError as CapxulError$1, Member, OperationId, Operation, Organization, PaymentId, Payment, SafeId, Safe, SubAccountId, SubAccount, TokenTransfer, TransferId, Transfer, Treasury, VirtualAccountId, VirtualAccount, VirtualCardId, VirtualCard, WebhookEndpointId, WebhookEndpoint, WebhookEventId, WebhookEvent, WithdrawalId, Withdrawal, List, TokenTransfersListInput, TokenTransfersListPage, LocalPrivateKeySignerProvider } from '@capxul/sdk';
 export { AuthFlowContext, AuthFlowEvent, BrowserCapxulConfig, OnboardingFlowContext, OnboardingFlowEvent, ProvisioningFlowContext, ProvisioningFlowEvent } from '@capxul/sdk';
 import { QueryClient, UseQueryResult } from '@tanstack/react-query';
 import { CapxulClient } from '@capxul/sdk/client';
@@ -55,55 +55,64 @@ declare function CapxulTransportProvider({ transport, children, }: CapxulTranspo
 declare function useCapxulStatus(): TransportState;
 
 /**
- * `CapxulProvider` — React context provider that wires both the
- * `@capxul/sdk` client AND a TanStack Query `QueryClient` for the
- * subtree.
+ * `CapxulProvider` — public React provider for `@capxul/sdk-react`.
  *
- * Two construction paths:
+ * Single-input contract: accepts ONLY `{ config: BrowserCapxulConfig,
+ * sessionStore?, queryClient?, children }`. The browser config is the
+ * secret-safe discriminated union from `@capxul/sdk` — `apiKey`,
+ * `data`, `signer`, and other server-only fields are rejected at
+ * compile-time AND at runtime via `createCapxulConfig`'s allow-list
+ * validator.
  *
- * 1. **Legacy / harness path** — pass an already-assembled
- *    `config: CapxulConfig`. Used by the e2e harness and CLI-shaped
- *    integrations that build their own auth/data adapters.
+ * The provider builds an `HttpTransport` synchronously and injects it
+ * into `createCapxulClient` via the internal `_transport` slot. The
+ * transport is exposed through `CapxulTransportContext` so
+ * `useCapxulStatus()` can subscribe to its lifecycle state machine.
  *
- * 2. **Lazy-DX path (ADR #14c)** — pass either `publishableKey` or
- *    `browserConfig`. The provider builds an `HttpTransport`
- *    synchronously, injects it into `createCapxulClient` via the
- *    internal `_transport` slot, and exposes the transport through
- *    `CapxulTransportContext` so `useCapxulStatus()` can subscribe
- *    to its lifecycle state machine.
+ * The provider also builds a `ConvexReactClient`-backed data client
+ * for the `build-time-urls` arm and feeds it as `config.data` so the
+ * SDK domain methods (`me.get`, `accounts.retrieve`, ...) and the
+ * React hooks built on top can run authenticated reads against live
+ * Convex. The auth lifecycle threads through the optional
+ * `sessionStore` prop: `verifyOtp` writes a session to the store
+ * (which the SDK auth client persists), and the provider's data
+ * client re-reads the JWT on demand via `refreshAuth()`. Without a
+ * session store the provider falls back to an in-memory one, which
+ * is fine for browser apps that hold the page until next reload but
+ * inadequate for CLI / Node consumers that need cross-process
+ * persistence — those pass a file-backed store via the prop.
  *
- *    The lazy-DX provider mounts synchronously. There is no
- *    `useState` mutating config, no `useMemo` rebuilding config when
- *    state changes, and no Suspense gate at mount. State transitions
- *    happen on the transport (a stable singleton); React subscribes
- *    via `useSyncExternalStore` and re-renders only the components
- *    that actually depend on the transport state.
+ * Tests and the e2e harness need the server-augmented `CapxulConfig`
+ * shape (with `data`, `signer`, `signing`). Those callers use
+ * `CapxulTestProvider` from `@capxul/sdk-react/proof` instead.
  *
  * Per ADR 4 in the API-first architecture stack PLAN, only
  * `QueryClientProvider` is allowed to live OUTSIDE the single
  * `CapxulContext`. The `QueryClientProvider` is the outermost wrap;
- * the SDK client provider sits inside it; the optional transport
- * provider sits between the two when the lazy-DX path is active.
+ * the SDK client provider sits inside it; the transport provider sits
+ * between the two.
  */
 
 type CapxulProviderProps = {
     /**
-     * Pre-assembled `CapxulConfig` for the legacy / harness path.
-     * Mutually exclusive with `publishableKey` / `browserConfig`.
+     * Browser-safe Capxul config — the discriminated union from
+     * `@capxul/sdk`. Either the `build-time-urls` arm or the
+     * `publishable-key` arm. Server-only fields (`apiKey`, `data`,
+     * `signer`, `signing`) are rejected at compile-time and at runtime
+     * via `createCapxulConfig`'s allow-list validator.
      */
-    readonly config?: CapxulConfig;
+    readonly config: BrowserCapxulConfig;
     /**
-     * Shorthand for the publishable-key arm of `BrowserCapxulConfig`.
-     * Provider builds the transport synchronously and injects it into
-     * the SDK client — the canonical lazy-DX entry point per ADR #14c.
+     * Auth session persistence adapter. The SDK auth client writes
+     * sessions here on `verifyOtp` and clears them on `signOut`. The
+     * provider's data client re-reads the JWT from this store on every
+     * `refreshAuth` call so reads carry the right auth header.
+     *
+     * Defaults to an in-memory store scoped to this provider. Pass a
+     * file-backed (Node CLI) or `localStorage`-backed (browser) store
+     * to persist sessions across process or page lifetimes.
      */
-    readonly publishableKey?: string;
-    /**
-     * Full `BrowserCapxulConfig` for callers that need
-     * `mode: "build-time-urls"` or a custom `fetchImpl` (e.g. tests).
-     * Mutually exclusive with `publishableKey` / `config`.
-     */
-    readonly browserConfig?: BrowserCapxulConfig;
+    readonly sessionStore?: AuthSessionStore;
     /**
      * Optional TanStack Query `QueryClient`. Pass your app's existing
      * client to share the cache across the SDK hooks and the host
@@ -113,7 +122,7 @@ type CapxulProviderProps = {
     readonly queryClient?: QueryClient;
     readonly children: ReactNode;
 };
-declare function CapxulProvider({ config, publishableKey, browserConfig, queryClient, children, }: CapxulProviderProps): ReactNode;
+declare function CapxulProvider({ config, sessionStore, queryClient, children, }: CapxulProviderProps): ReactNode;
 
 /**
  * `QueryResult<T>` — the canonical three-state return shape for every
@@ -220,16 +229,27 @@ declare function useMe(): UseQueryResult<Account, CapxulError$1>;
 /**
  * Account by id. Omit `accountId` for the calling user (alias for
  * `useMe()` from a developer-perspective lens).
+ *
+ * Slice 2 (#457 story 1): wired via `capxul.accounts.retrieve` for
+ * the id-bearing call and `capxul.me.get()` for the self-lens
+ * shortcut. Returns the legacy `QueryResult<Account>` shape because
+ * only `useMe` has migrated to TanStack Query so far (PLAN.md task
+ * 1.8) — per-hook migration is the rollout pattern.
  */
-declare function useAccount(_accountId?: AccountId): QueryResult<Account>;
+declare function useAccount(accountId?: AccountId): QueryResult<Account>;
 declare function useOrganization(_organizationId: OrganizationId): QueryResult<Organization>;
 declare function useMember(_args: UseMemberArgs): QueryResult<Member>;
 /**
  * Live; status advances as the indexer reconciles the on-chain
  * deployment. Consumers pattern-match on `data.status` via
  * `matchStatus` (see `@capxul/sdk`).
+ *
+ * Slice 2 (#457 story 1): wired via
+ * `capxul.accounts.safes.retrieve(safeId)`. The SDK method is real
+ * post-Withdrawals v1 slice 1; this hook closes the React-side
+ * stub so onboarding can subscribe to Safe deploy progress.
  */
-declare function useSafe(_safeId: SafeId): QueryResult<Safe>;
+declare function useSafe(safeId: SafeId): QueryResult<Safe>;
 declare function useTreasury(_organizationId: OrganizationId): QueryResult<Treasury>;
 /**
  * Org-admin lens only — the hook NEVER returns `secret`.
@@ -237,19 +257,51 @@ declare function useTreasury(_organizationId: OrganizationId): QueryResult<Treas
 declare function useApiKey(_args: UseApiKeyArgs): QueryResult<ApiKey>;
 declare function useKycProfile(_accountId: AccountId): QueryResult<KycProfile>;
 declare function useKybProfile(_organizationId: OrganizationId): QueryResult<KybProfile>;
-declare function useExternalAccount(_args: UseExternalAccountArgs): QueryResult<ExternalAccount>;
+/**
+ * Withdrawals v1 W1 (#464) — wired through the SDK.
+ *
+ * Branches on `args.ownerKind` so `account` scope reads via the
+ * top-level `capxul.externalAccounts.retrieve(id)` (visibility-gated
+ * server-side by the caller's accountId), and `organization` scope
+ * reads via `capxul.organizations.externalAccounts.retrieve({ ... })`
+ * which adds an org-scope check for cross-org isolation. Both routes
+ * resolve to the same Convex query handler — the SDK ergonomics
+ * differ but the wire shape is identical.
+ */
+declare function useExternalAccount(args: UseExternalAccountArgs): QueryResult<ExternalAccount>;
 declare function useSubAccount(_subAccountId: SubAccountId): QueryResult<SubAccount>;
 declare function useVirtualAccount(_virtualAccountId: VirtualAccountId): QueryResult<VirtualAccount>;
 declare function useVirtualCard(_virtualCardId: VirtualCardId): QueryResult<VirtualCard>;
 declare function usePayment(_paymentId: PaymentId): QueryResult<Payment>;
 declare function useTransfer(_transferId: TransferId): QueryResult<Transfer>;
+type UseTokenTransferArgs = {
+    readonly txHash: string;
+    readonly logIndex: number;
+    readonly chainId?: number;
+};
+/**
+ * **NON-CANONICAL** raw on-chain ERC-20 transfer detail. Wired through
+ * `capxul.tokenTransfers.retrieve` per slice/02-story2-balance
+ * Option-A verdict. Identifier is the canonical on-chain composite
+ * `(txHash, logIndex)` so consumers don't have to round-trip through
+ * the Convex doc id.
+ *
+ * Intentionally NOT in `packages/sdk-react/ops/proof/hook-manifest.ts`
+ * — the canonical proof manifest tracks canon-aligned hooks only.
+ */
+declare function useTokenTransfer(args: UseTokenTransferArgs): QueryResult<TokenTransfer>;
 /**
  * Immutable once written; `live` semantically only for late
  * `paymentId` / `transferId` attachment per Doc 02 §"balance_ledger".
  */
 declare function useBalanceLedgerEntry(_args: UseBalanceLedgerEntryArgs): QueryResult<BalanceLedgerEntry>;
 declare function useDocument(_documentId: DocumentId): QueryResult<Document>;
-declare function useWithdrawal(_withdrawalId: WithdrawalId): QueryResult<Withdrawal>;
+/**
+ * Withdrawals v1 slice 1 (#440) — wired through `capxul.withdrawals.retrieve`.
+ * Mirrors `useOperation` (the canonical evidence subscription) since
+ * the withdrawal resource is operation-shaped at its core.
+ */
+declare function useWithdrawal(withdrawalId: WithdrawalId): QueryResult<Withdrawal>;
 /**
  * The canonical evidence subscription per CANON.md §3.3 —
  * `operationId` + `correlationId` are the cross-layer join keys for
@@ -328,7 +380,17 @@ type OrgDocumentsFilters = OrgScopedFilters & {
  */
 declare function useOrganizations(): QueryResult<List<Organization>>;
 declare function useMembers(_organizationId: OrganizationId): QueryResult<List<Member>>;
-declare function useExternalAccounts(_args: OwnerRef): QueryResult<List<ExternalAccount>>;
+/**
+ * Withdrawals v1 W1 (#464) — wired through the SDK.
+ *
+ * Personal scope reads through `capxul.accounts.externalAccounts.list({
+ * accountId })` (Pattern A nested namespace); org scope reads through
+ * `capxul.organizations.externalAccounts.list({ organizationId })`.
+ * Both resolve to the same Convex query handler — the SDK ergonomics
+ * differ. Backend filters out `revoked` rows but keeps
+ * `pending_verification` rows visible (D5).
+ */
+declare function useExternalAccounts(args: OwnerRef): QueryResult<List<ExternalAccount>>;
 declare function useSubAccounts(_args: OwnerRef): QueryResult<List<SubAccount>>;
 declare function useVirtualAccounts(_filters?: VirtualAccountsFilters): QueryResult<List<VirtualAccount>>;
 declare function useVirtualCards(_filters?: VirtualCardsFilters): QueryResult<List<VirtualCard>>;
@@ -340,6 +402,17 @@ declare function usePayments(_filters?: PaymentsFilters): QueryResult<List<Payme
 declare function useOrgPayments(_args: OrgScopedFilters): QueryResult<List<Payment>>;
 declare function useTransfers(_filters?: TransfersFilters): QueryResult<List<Transfer>>;
 declare function useOrgTransfers(_args: OrgScopedFilters): QueryResult<List<Transfer>>;
+/**
+ * **NON-CANONICAL** raw on-chain ERC-20 transfer feed. Wired through
+ * `capxul.tokenTransfers.list` per slice/02-story2-balance Option-A
+ * verdict. Will be subsumed by canonical `useTransfers` once the
+ * `transfers.*` shape alignment lands. See `core/token-transfers.ts`
+ * doc-comment for the full contract.
+ *
+ * Intentionally NOT in `packages/sdk-react/ops/proof/hook-manifest.ts`
+ * — the canonical proof manifest tracks canon-aligned hooks only.
+ */
+declare function useTokenTransfers(filters?: TokenTransfersListInput): QueryResult<TokenTransfersListPage>;
 /**
  * Append-only per-owner balance-delta feed. Live for late
  * `paymentId` / `transferId` attachment per Doc 02.
@@ -352,8 +425,15 @@ declare function useBalanceLedger(_args: OwnerScopedFilters): QueryResult<List<B
  */
 declare function useDocuments(_filters?: DocumentsFilters): QueryResult<List<Document>>;
 declare function useOrgDocuments(_args: OrgDocumentsFilters): QueryResult<List<Document>>;
-declare function useWithdrawals(_filters?: WithdrawalsFilters): QueryResult<List<Withdrawal>>;
-declare function useOrgWithdrawals(_args: OrgScopedFilters): QueryResult<List<Withdrawal>>;
+/**
+ * Withdrawals v1 slice 1 (#440) — wired through `capxul.withdrawals.list`.
+ */
+declare function useWithdrawals(filters?: WithdrawalsFilters): QueryResult<List<Withdrawal>>;
+/**
+ * Withdrawals v1 slice 1 (#440) — wired through
+ * `capxul.organizations.withdrawals.list`.
+ */
+declare function useOrgWithdrawals(args: OrgScopedFilters): QueryResult<List<Withdrawal>>;
 /**
  * Org-admin lens only — the hook NEVER returns `secret` for any row.
  */
@@ -458,4 +538,4 @@ declare function injectedConnector(options?: InjectedConnectorOptions): CapxulCo
  */
 declare function localPrivateKeyConnector(options: LocalPrivateKeyConnectorOptions): CapxulConnector;
 
-export { CapxulClientProvider, type CapxulClientProviderProps, type CapxulConnector, type CapxulConnectorKind, type CapxulConnectorSession, CapxulProvider, type CapxulProviderProps, CapxulTransportProvider, type CapxulTransportProviderProps, type DocumentsFilters, type InjectedConnectorOptions, type LocalPrivateKeyConnectorOptions, type OrgDocumentsFilters, type OrgScopedFilters, type OwnerRef, type OwnerScopedFilters, type PaginationFilters, type PaymentsFilters, type QueryResult, type TransfersFilters, type UseApiKeyArgs, type UseBalanceLedgerEntryArgs, type UseExternalAccountArgs, type UseMemberArgs, type VirtualAccountsFilters, type VirtualCardsFilters, type WithdrawalsFilters, createCapxulConfig, injectedConnector, localPrivateKeyConnector, useAccount, useApiKey, useApiKeys, useAuthFlow, useBalanceLedger, useBalanceLedgerEntry, useCapxul, useCapxulStatus, useDocument, useDocuments, useExternalAccount, useExternalAccounts, useKybProfile, useKycProfile, useMe, useMember, useMembers, useOnboardingFlow, useOperation, useOrgDocuments, useOrgPayments, useOrgTransfers, useOrgWithdrawals, useOrganization, useOrganizations, usePayment, usePayments, useProvisioningFlow, useSafe, useSubAccount, useSubAccounts, useTransfer, useTransfers, useTreasury, useVirtualAccount, useVirtualAccounts, useVirtualCard, useVirtualCards, useWebhookEndpoint, useWebhookEndpoints, useWebhookEvent, useWithdrawal, useWithdrawals };
+export { CapxulClientProvider, type CapxulClientProviderProps, type CapxulConnector, type CapxulConnectorKind, type CapxulConnectorSession, CapxulProvider, type CapxulProviderProps, CapxulTransportProvider, type CapxulTransportProviderProps, type DocumentsFilters, type InjectedConnectorOptions, type LocalPrivateKeyConnectorOptions, type OrgDocumentsFilters, type OrgScopedFilters, type OwnerRef, type OwnerScopedFilters, type PaginationFilters, type PaymentsFilters, type QueryResult, type TransfersFilters, type UseApiKeyArgs, type UseBalanceLedgerEntryArgs, type UseExternalAccountArgs, type UseMemberArgs, type UseTokenTransferArgs, type VirtualAccountsFilters, type VirtualCardsFilters, type WithdrawalsFilters, createCapxulConfig, injectedConnector, localPrivateKeyConnector, useAccount, useApiKey, useApiKeys, useAuthFlow, useBalanceLedger, useBalanceLedgerEntry, useCapxul, useCapxulStatus, useDocument, useDocuments, useExternalAccount, useExternalAccounts, useKybProfile, useKycProfile, useMe, useMember, useMembers, useOnboardingFlow, useOperation, useOrgDocuments, useOrgPayments, useOrgTransfers, useOrgWithdrawals, useOrganization, useOrganizations, usePayment, usePayments, useProvisioningFlow, useSafe, useSubAccount, useSubAccounts, useTokenTransfer, useTokenTransfers, useTransfer, useTransfers, useTreasury, useVirtualAccount, useVirtualAccounts, useVirtualCard, useVirtualCards, useWebhookEndpoint, useWebhookEndpoints, useWebhookEvent, useWithdrawal, useWithdrawals };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { ReactNode } from 'react';
-import { HttpTransport, TransportState, CapxulConfig, BrowserCapxulConfig, AccountId, OrganizationId, ApiKeyId, BalanceLedgerEntryId, ExternalAccountId, MemberId, Account, ApiKey, BalanceLedgerEntry, DocumentId, Document, ExternalAccount, KybProfile, KycProfile, CapxulError as CapxulError$1, Member, OperationId, Operation, Organization, PaymentId, Payment, SafeId, Safe, SubAccountId, SubAccount, TransferId, Transfer, Treasury, VirtualAccountId, VirtualAccount, VirtualCardId, VirtualCard, WebhookEndpointId, WebhookEndpoint, WebhookEventId, WebhookEvent, WithdrawalId, Withdrawal, List, LocalPrivateKeySignerProvider } from '@capxul/sdk';
+import { HttpTransport, TransportState, BrowserCapxulConfig, AuthSessionStore, AccountId, OrganizationId, ApiKeyId, BalanceLedgerEntryId, ExternalAccountId, MemberId, Account, ApiKey, BalanceLedgerEntry, DocumentId, Document, ExternalAccount, KybProfile, KycProfile, CapxulError as CapxulError$1, Member, OperationId, Operation, Organization, PaymentId, Payment, SafeId, Safe, SubAccountId, SubAccount, TokenTransfer, TransferId, Transfer, Treasury, VirtualAccountId, VirtualAccount, VirtualCardId, VirtualCard, WebhookEndpointId, WebhookEndpoint, WebhookEventId, WebhookEvent, WithdrawalId, Withdrawal, List, TokenTransfersListInput, TokenTransfersListPage, LocalPrivateKeySignerProvider } from '@capxul/sdk';
 export { AuthFlowContext, AuthFlowEvent, BrowserCapxulConfig, OnboardingFlowContext, OnboardingFlowEvent, ProvisioningFlowContext, ProvisioningFlowEvent } from '@capxul/sdk';
 import { QueryClient, UseQueryResult } from '@tanstack/react-query';
 import { CapxulClient } from '@capxul/sdk/client';
@@ -55,55 +55,64 @@ declare function CapxulTransportProvider({ transport, children, }: CapxulTranspo
 declare function useCapxulStatus(): TransportState;
 
 /**
- * `CapxulProvider` — React context provider that wires both the
- * `@capxul/sdk` client AND a TanStack Query `QueryClient` for the
- * subtree.
+ * `CapxulProvider` — public React provider for `@capxul/sdk-react`.
  *
- * Two construction paths:
+ * Single-input contract: accepts ONLY `{ config: BrowserCapxulConfig,
+ * sessionStore?, queryClient?, children }`. The browser config is the
+ * secret-safe discriminated union from `@capxul/sdk` — `apiKey`,
+ * `data`, `signer`, and other server-only fields are rejected at
+ * compile-time AND at runtime via `createCapxulConfig`'s allow-list
+ * validator.
  *
- * 1. **Legacy / harness path** — pass an already-assembled
- *    `config: CapxulConfig`. Used by the e2e harness and CLI-shaped
- *    integrations that build their own auth/data adapters.
+ * The provider builds an `HttpTransport` synchronously and injects it
+ * into `createCapxulClient` via the internal `_transport` slot. The
+ * transport is exposed through `CapxulTransportContext` so
+ * `useCapxulStatus()` can subscribe to its lifecycle state machine.
  *
- * 2. **Lazy-DX path (ADR #14c)** — pass either `publishableKey` or
- *    `browserConfig`. The provider builds an `HttpTransport`
- *    synchronously, injects it into `createCapxulClient` via the
- *    internal `_transport` slot, and exposes the transport through
- *    `CapxulTransportContext` so `useCapxulStatus()` can subscribe
- *    to its lifecycle state machine.
+ * The provider also builds a `ConvexReactClient`-backed data client
+ * for the `build-time-urls` arm and feeds it as `config.data` so the
+ * SDK domain methods (`me.get`, `accounts.retrieve`, ...) and the
+ * React hooks built on top can run authenticated reads against live
+ * Convex. The auth lifecycle threads through the optional
+ * `sessionStore` prop: `verifyOtp` writes a session to the store
+ * (which the SDK auth client persists), and the provider's data
+ * client re-reads the JWT on demand via `refreshAuth()`. Without a
+ * session store the provider falls back to an in-memory one, which
+ * is fine for browser apps that hold the page until next reload but
+ * inadequate for CLI / Node consumers that need cross-process
+ * persistence — those pass a file-backed store via the prop.
  *
- *    The lazy-DX provider mounts synchronously. There is no
- *    `useState` mutating config, no `useMemo` rebuilding config when
- *    state changes, and no Suspense gate at mount. State transitions
- *    happen on the transport (a stable singleton); React subscribes
- *    via `useSyncExternalStore` and re-renders only the components
- *    that actually depend on the transport state.
+ * Tests and the e2e harness need the server-augmented `CapxulConfig`
+ * shape (with `data`, `signer`, `signing`). Those callers use
+ * `CapxulTestProvider` from `@capxul/sdk-react/proof` instead.
  *
  * Per ADR 4 in the API-first architecture stack PLAN, only
  * `QueryClientProvider` is allowed to live OUTSIDE the single
  * `CapxulContext`. The `QueryClientProvider` is the outermost wrap;
- * the SDK client provider sits inside it; the optional transport
- * provider sits between the two when the lazy-DX path is active.
+ * the SDK client provider sits inside it; the transport provider sits
+ * between the two.
  */
 
 type CapxulProviderProps = {
     /**
-     * Pre-assembled `CapxulConfig` for the legacy / harness path.
-     * Mutually exclusive with `publishableKey` / `browserConfig`.
+     * Browser-safe Capxul config — the discriminated union from
+     * `@capxul/sdk`. Either the `build-time-urls` arm or the
+     * `publishable-key` arm. Server-only fields (`apiKey`, `data`,
+     * `signer`, `signing`) are rejected at compile-time and at runtime
+     * via `createCapxulConfig`'s allow-list validator.
      */
-    readonly config?: CapxulConfig;
+    readonly config: BrowserCapxulConfig;
     /**
-     * Shorthand for the publishable-key arm of `BrowserCapxulConfig`.
-     * Provider builds the transport synchronously and injects it into
-     * the SDK client — the canonical lazy-DX entry point per ADR #14c.
+     * Auth session persistence adapter. The SDK auth client writes
+     * sessions here on `verifyOtp` and clears them on `signOut`. The
+     * provider's data client re-reads the JWT from this store on every
+     * `refreshAuth` call so reads carry the right auth header.
+     *
+     * Defaults to an in-memory store scoped to this provider. Pass a
+     * file-backed (Node CLI) or `localStorage`-backed (browser) store
+     * to persist sessions across process or page lifetimes.
      */
-    readonly publishableKey?: string;
-    /**
-     * Full `BrowserCapxulConfig` for callers that need
-     * `mode: "build-time-urls"` or a custom `fetchImpl` (e.g. tests).
-     * Mutually exclusive with `publishableKey` / `config`.
-     */
-    readonly browserConfig?: BrowserCapxulConfig;
+    readonly sessionStore?: AuthSessionStore;
     /**
      * Optional TanStack Query `QueryClient`. Pass your app's existing
      * client to share the cache across the SDK hooks and the host
@@ -113,7 +122,7 @@ type CapxulProviderProps = {
     readonly queryClient?: QueryClient;
     readonly children: ReactNode;
 };
-declare function CapxulProvider({ config, publishableKey, browserConfig, queryClient, children, }: CapxulProviderProps): ReactNode;
+declare function CapxulProvider({ config, sessionStore, queryClient, children, }: CapxulProviderProps): ReactNode;
 
 /**
  * `QueryResult<T>` — the canonical three-state return shape for every
@@ -220,16 +229,27 @@ declare function useMe(): UseQueryResult<Account, CapxulError$1>;
 /**
  * Account by id. Omit `accountId` for the calling user (alias for
  * `useMe()` from a developer-perspective lens).
+ *
+ * Slice 2 (#457 story 1): wired via `capxul.accounts.retrieve` for
+ * the id-bearing call and `capxul.me.get()` for the self-lens
+ * shortcut. Returns the legacy `QueryResult<Account>` shape because
+ * only `useMe` has migrated to TanStack Query so far (PLAN.md task
+ * 1.8) — per-hook migration is the rollout pattern.
  */
-declare function useAccount(_accountId?: AccountId): QueryResult<Account>;
+declare function useAccount(accountId?: AccountId): QueryResult<Account>;
 declare function useOrganization(_organizationId: OrganizationId): QueryResult<Organization>;
 declare function useMember(_args: UseMemberArgs): QueryResult<Member>;
 /**
  * Live; status advances as the indexer reconciles the on-chain
  * deployment. Consumers pattern-match on `data.status` via
  * `matchStatus` (see `@capxul/sdk`).
+ *
+ * Slice 2 (#457 story 1): wired via
+ * `capxul.accounts.safes.retrieve(safeId)`. The SDK method is real
+ * post-Withdrawals v1 slice 1; this hook closes the React-side
+ * stub so onboarding can subscribe to Safe deploy progress.
  */
-declare function useSafe(_safeId: SafeId): QueryResult<Safe>;
+declare function useSafe(safeId: SafeId): QueryResult<Safe>;
 declare function useTreasury(_organizationId: OrganizationId): QueryResult<Treasury>;
 /**
  * Org-admin lens only — the hook NEVER returns `secret`.
@@ -237,19 +257,51 @@ declare function useTreasury(_organizationId: OrganizationId): QueryResult<Treas
 declare function useApiKey(_args: UseApiKeyArgs): QueryResult<ApiKey>;
 declare function useKycProfile(_accountId: AccountId): QueryResult<KycProfile>;
 declare function useKybProfile(_organizationId: OrganizationId): QueryResult<KybProfile>;
-declare function useExternalAccount(_args: UseExternalAccountArgs): QueryResult<ExternalAccount>;
+/**
+ * Withdrawals v1 W1 (#464) — wired through the SDK.
+ *
+ * Branches on `args.ownerKind` so `account` scope reads via the
+ * top-level `capxul.externalAccounts.retrieve(id)` (visibility-gated
+ * server-side by the caller's accountId), and `organization` scope
+ * reads via `capxul.organizations.externalAccounts.retrieve({ ... })`
+ * which adds an org-scope check for cross-org isolation. Both routes
+ * resolve to the same Convex query handler — the SDK ergonomics
+ * differ but the wire shape is identical.
+ */
+declare function useExternalAccount(args: UseExternalAccountArgs): QueryResult<ExternalAccount>;
 declare function useSubAccount(_subAccountId: SubAccountId): QueryResult<SubAccount>;
 declare function useVirtualAccount(_virtualAccountId: VirtualAccountId): QueryResult<VirtualAccount>;
 declare function useVirtualCard(_virtualCardId: VirtualCardId): QueryResult<VirtualCard>;
 declare function usePayment(_paymentId: PaymentId): QueryResult<Payment>;
 declare function useTransfer(_transferId: TransferId): QueryResult<Transfer>;
+type UseTokenTransferArgs = {
+    readonly txHash: string;
+    readonly logIndex: number;
+    readonly chainId?: number;
+};
+/**
+ * **NON-CANONICAL** raw on-chain ERC-20 transfer detail. Wired through
+ * `capxul.tokenTransfers.retrieve` per slice/02-story2-balance
+ * Option-A verdict. Identifier is the canonical on-chain composite
+ * `(txHash, logIndex)` so consumers don't have to round-trip through
+ * the Convex doc id.
+ *
+ * Intentionally NOT in `packages/sdk-react/ops/proof/hook-manifest.ts`
+ * — the canonical proof manifest tracks canon-aligned hooks only.
+ */
+declare function useTokenTransfer(args: UseTokenTransferArgs): QueryResult<TokenTransfer>;
 /**
  * Immutable once written; `live` semantically only for late
  * `paymentId` / `transferId` attachment per Doc 02 §"balance_ledger".
  */
 declare function useBalanceLedgerEntry(_args: UseBalanceLedgerEntryArgs): QueryResult<BalanceLedgerEntry>;
 declare function useDocument(_documentId: DocumentId): QueryResult<Document>;
-declare function useWithdrawal(_withdrawalId: WithdrawalId): QueryResult<Withdrawal>;
+/**
+ * Withdrawals v1 slice 1 (#440) — wired through `capxul.withdrawals.retrieve`.
+ * Mirrors `useOperation` (the canonical evidence subscription) since
+ * the withdrawal resource is operation-shaped at its core.
+ */
+declare function useWithdrawal(withdrawalId: WithdrawalId): QueryResult<Withdrawal>;
 /**
  * The canonical evidence subscription per CANON.md §3.3 —
  * `operationId` + `correlationId` are the cross-layer join keys for
@@ -328,7 +380,17 @@ type OrgDocumentsFilters = OrgScopedFilters & {
  */
 declare function useOrganizations(): QueryResult<List<Organization>>;
 declare function useMembers(_organizationId: OrganizationId): QueryResult<List<Member>>;
-declare function useExternalAccounts(_args: OwnerRef): QueryResult<List<ExternalAccount>>;
+/**
+ * Withdrawals v1 W1 (#464) — wired through the SDK.
+ *
+ * Personal scope reads through `capxul.accounts.externalAccounts.list({
+ * accountId })` (Pattern A nested namespace); org scope reads through
+ * `capxul.organizations.externalAccounts.list({ organizationId })`.
+ * Both resolve to the same Convex query handler — the SDK ergonomics
+ * differ. Backend filters out `revoked` rows but keeps
+ * `pending_verification` rows visible (D5).
+ */
+declare function useExternalAccounts(args: OwnerRef): QueryResult<List<ExternalAccount>>;
 declare function useSubAccounts(_args: OwnerRef): QueryResult<List<SubAccount>>;
 declare function useVirtualAccounts(_filters?: VirtualAccountsFilters): QueryResult<List<VirtualAccount>>;
 declare function useVirtualCards(_filters?: VirtualCardsFilters): QueryResult<List<VirtualCard>>;
@@ -340,6 +402,17 @@ declare function usePayments(_filters?: PaymentsFilters): QueryResult<List<Payme
 declare function useOrgPayments(_args: OrgScopedFilters): QueryResult<List<Payment>>;
 declare function useTransfers(_filters?: TransfersFilters): QueryResult<List<Transfer>>;
 declare function useOrgTransfers(_args: OrgScopedFilters): QueryResult<List<Transfer>>;
+/**
+ * **NON-CANONICAL** raw on-chain ERC-20 transfer feed. Wired through
+ * `capxul.tokenTransfers.list` per slice/02-story2-balance Option-A
+ * verdict. Will be subsumed by canonical `useTransfers` once the
+ * `transfers.*` shape alignment lands. See `core/token-transfers.ts`
+ * doc-comment for the full contract.
+ *
+ * Intentionally NOT in `packages/sdk-react/ops/proof/hook-manifest.ts`
+ * — the canonical proof manifest tracks canon-aligned hooks only.
+ */
+declare function useTokenTransfers(filters?: TokenTransfersListInput): QueryResult<TokenTransfersListPage>;
 /**
  * Append-only per-owner balance-delta feed. Live for late
  * `paymentId` / `transferId` attachment per Doc 02.
@@ -352,8 +425,15 @@ declare function useBalanceLedger(_args: OwnerScopedFilters): QueryResult<List<B
  */
 declare function useDocuments(_filters?: DocumentsFilters): QueryResult<List<Document>>;
 declare function useOrgDocuments(_args: OrgDocumentsFilters): QueryResult<List<Document>>;
-declare function useWithdrawals(_filters?: WithdrawalsFilters): QueryResult<List<Withdrawal>>;
-declare function useOrgWithdrawals(_args: OrgScopedFilters): QueryResult<List<Withdrawal>>;
+/**
+ * Withdrawals v1 slice 1 (#440) — wired through `capxul.withdrawals.list`.
+ */
+declare function useWithdrawals(filters?: WithdrawalsFilters): QueryResult<List<Withdrawal>>;
+/**
+ * Withdrawals v1 slice 1 (#440) — wired through
+ * `capxul.organizations.withdrawals.list`.
+ */
+declare function useOrgWithdrawals(args: OrgScopedFilters): QueryResult<List<Withdrawal>>;
 /**
  * Org-admin lens only — the hook NEVER returns `secret` for any row.
  */
@@ -458,4 +538,4 @@ declare function injectedConnector(options?: InjectedConnectorOptions): CapxulCo
  */
 declare function localPrivateKeyConnector(options: LocalPrivateKeyConnectorOptions): CapxulConnector;
 
-export { CapxulClientProvider, type CapxulClientProviderProps, type CapxulConnector, type CapxulConnectorKind, type CapxulConnectorSession, CapxulProvider, type CapxulProviderProps, CapxulTransportProvider, type CapxulTransportProviderProps, type DocumentsFilters, type InjectedConnectorOptions, type LocalPrivateKeyConnectorOptions, type OrgDocumentsFilters, type OrgScopedFilters, type OwnerRef, type OwnerScopedFilters, type PaginationFilters, type PaymentsFilters, type QueryResult, type TransfersFilters, type UseApiKeyArgs, type UseBalanceLedgerEntryArgs, type UseExternalAccountArgs, type UseMemberArgs, type VirtualAccountsFilters, type VirtualCardsFilters, type WithdrawalsFilters, createCapxulConfig, injectedConnector, localPrivateKeyConnector, useAccount, useApiKey, useApiKeys, useAuthFlow, useBalanceLedger, useBalanceLedgerEntry, useCapxul, useCapxulStatus, useDocument, useDocuments, useExternalAccount, useExternalAccounts, useKybProfile, useKycProfile, useMe, useMember, useMembers, useOnboardingFlow, useOperation, useOrgDocuments, useOrgPayments, useOrgTransfers, useOrgWithdrawals, useOrganization, useOrganizations, usePayment, usePayments, useProvisioningFlow, useSafe, useSubAccount, useSubAccounts, useTransfer, useTransfers, useTreasury, useVirtualAccount, useVirtualAccounts, useVirtualCard, useVirtualCards, useWebhookEndpoint, useWebhookEndpoints, useWebhookEvent, useWithdrawal, useWithdrawals };
+export { CapxulClientProvider, type CapxulClientProviderProps, type CapxulConnector, type CapxulConnectorKind, type CapxulConnectorSession, CapxulProvider, type CapxulProviderProps, CapxulTransportProvider, type CapxulTransportProviderProps, type DocumentsFilters, type InjectedConnectorOptions, type LocalPrivateKeyConnectorOptions, type OrgDocumentsFilters, type OrgScopedFilters, type OwnerRef, type OwnerScopedFilters, type PaginationFilters, type PaymentsFilters, type QueryResult, type TransfersFilters, type UseApiKeyArgs, type UseBalanceLedgerEntryArgs, type UseExternalAccountArgs, type UseMemberArgs, type UseTokenTransferArgs, type VirtualAccountsFilters, type VirtualCardsFilters, type WithdrawalsFilters, createCapxulConfig, injectedConnector, localPrivateKeyConnector, useAccount, useApiKey, useApiKeys, useAuthFlow, useBalanceLedger, useBalanceLedgerEntry, useCapxul, useCapxulStatus, useDocument, useDocuments, useExternalAccount, useExternalAccounts, useKybProfile, useKycProfile, useMe, useMember, useMembers, useOnboardingFlow, useOperation, useOrgDocuments, useOrgPayments, useOrgTransfers, useOrgWithdrawals, useOrganization, useOrganizations, usePayment, usePayments, useProvisioningFlow, useSafe, useSubAccount, useSubAccounts, useTokenTransfer, useTokenTransfers, useTransfer, useTransfers, useTreasury, useVirtualAccount, useVirtualAccounts, useVirtualCard, useVirtualCards, useWebhookEndpoint, useWebhookEndpoints, useWebhookEvent, useWithdrawal, useWithdrawals };