@capxul/sdk-react 0.2.0-alpha.4 → 0.2.0-alpha.5

package/dist/index.d.cts

@@ -1,673 +0,0 @@
-import { ReactNode } from 'react';
-import { HttpTransport, TransportState, BrowserCapxulConfig, AuthSessionStore, AccountId, OrganizationId, ApiKeyId, BalanceLedgerEntryId, ExternalAccountId, MemberId, Account, ApiKey, BalanceLedgerEntry, DocumentId, Document, ExternalAccount, KycProfile, CapxulError as CapxulError$1, Member, OperationId, Operation, Organization, PaymentId, Payment, SafeId, Safe, SubAccountId, SubAccount, TokenTransfer, TransferId, Transfer, Treasury, VirtualAccountId, VirtualAccount, VirtualCardId, VirtualCard, WebhookEndpointId, WebhookEndpoint, WebhookEventId, WebhookEvent, WithdrawalId, Withdrawal, List, MembershipStatus, TokenTransfersListInput, TokenTransfersListPage, MemberInviteResponse, Session, AuthBootstrapToken, AuthBootstrapReason } from '@capxul/sdk';
-export { BrowserCapxulConfig, OnboardingFlowContext, OnboardingFlowEvent, ProvisioningFlowContext, ProvisioningFlowEvent } from '@capxul/sdk';
-import { QueryClient, UseQueryResult, UseMutationResult } from '@tanstack/react-query';
-import { CapxulClient } from '@capxul/sdk/client';
-import { CapxulError } from '@capxul/sdk/errors';
-import { Account as Account$1 } from 'viem';
-import * as xstate from 'xstate';
-
-type CapxulClientProviderProps = {
-    readonly client: CapxulClient;
-    readonly children: ReactNode;
-};
-declare function CapxulClientProvider({ client, children, }: CapxulClientProviderProps): ReactNode;
-/**
- * Returns the `@capxul/sdk` client attached to the nearest provider.
- *
- * @throws `Error` if called outside a provider subtree. This is a
- * developer error, not a `CapxulError`, because a missing provider
- * cannot be recovered at runtime.
- */
-declare function useCapxul(): CapxulClient;
-
-/**
- * `CapxulTransportContext` — sibling context that exposes the
- * `HttpTransport` lifecycle singleton built by the lazy-DX
- * `CapxulProvider` path (ADR #14c).
- *
- * Separate from `CapxulClientContext` because the legacy `config`
- * path doesn't build an externally-observable transport. When the
- * provider runs the legacy path, this context's value stays `null`
- * and `useCapxulStatus()` reports `"ready"` as a permissive default
- * (the legacy path implies the host has already wired auth and data;
- * there is nothing for the consumer to gate on).
- */
-
-type CapxulTransportProviderProps = {
-    readonly transport: HttpTransport;
-    readonly children: ReactNode;
-};
-declare function CapxulTransportProvider({ transport, children, }: CapxulTransportProviderProps): ReactNode;
-/**
- * Read the transport's current lifecycle state. Subscribes via
- * `useSyncExternalStore` so the host re-renders only when the
- * transport's state machine transitions, not when the provider tree
- * re-renders. Returns the `TransportState` discriminated union with
- * the contract-locked statuses:
- * `"idle" | "bootstrapping" | "ready" | "authenticated" | "error"`.
- *
- * Outside a provider tree (or inside the legacy `config` path that
- * does not build an externally-observable transport), the hook
- * returns a synthetic `{ status: "ready" }` snapshot — the legacy
- * path implies the host has already wired auth + data so there is
- * nothing to gate on.
- */
-declare function useCapxulStatus(): TransportState;
-
-/**
- * `CapxulProvider` — public React provider for `@capxul/sdk-react`.
- *
- * Single-input contract: accepts ONLY `{ config: BrowserCapxulConfig,
- * sessionStore?, queryClient?, children }`. The browser config is the
- * secret-safe discriminated union from `@capxul/sdk` — `apiKey`,
- * `data`, `signer`, and other server-only fields are rejected at
- * compile-time AND at runtime via `createCapxulConfig`'s allow-list
- * validator.
- *
- * The provider builds an `HttpTransport` synchronously and injects it
- * into `createCapxulClient` via the internal `_transport` slot. The
- * transport is exposed through `CapxulTransportContext` so
- * `useCapxulStatus()` can subscribe to its lifecycle state machine.
- *
- * The provider also builds a `ConvexReactClient`-backed data client
- * for the `build-time-urls` arm and feeds it as `config._data` so the
- * SDK domain methods (`me.get`, `accounts.retrieve`, ...) and the
- * React hooks built on top can run authenticated reads against live
- * Convex. The auth lifecycle threads through the optional
- * `sessionStore` prop: `verifyOtp` writes a session to the store
- * (which the SDK auth client persists), and the provider's data
- * client re-reads the JWT on demand via `refreshAuth()`. Without a
- * session store the provider falls back to an in-memory one, which
- * is fine for browser apps that hold the page until next reload but
- * inadequate for CLI / Node consumers that need cross-process
- * persistence — those pass a file-backed store via the prop.
- *
- * Tests and the e2e harness need the server-augmented `CapxulConfig`
- * shape (with `data`, `signer`, `signing`). Those callers use
- * `CapxulTestProvider` from `@capxul/sdk-react/proof` instead.
- *
- * Per ADR 4 in the API-first architecture stack PLAN, only
- * `QueryClientProvider` is allowed to live OUTSIDE the single
- * `CapxulContext`. The `QueryClientProvider` is the outermost wrap;
- * the SDK client provider sits inside it; the transport provider sits
- * between the two.
- */
-
-type CapxulProviderProps = {
-    /**
-     * Browser-safe Capxul config — the discriminated union from
-     * `@capxul/sdk`. Either the `build-time-urls` arm or the
-     * `publishable-key` arm. Server-only fields (`apiKey`, `data`,
-     * `signer`, `signing`) are rejected at compile-time and at runtime
-     * via `createCapxulConfig`'s allow-list validator.
-     */
-    readonly config: BrowserCapxulConfig;
-    /**
-     * Auth session persistence adapter. The SDK auth client writes
-     * sessions here on `verifyOtp` and clears them on `signOut`. The
-     * provider's data client re-reads the JWT from this store on every
-     * `refreshAuth` call so reads carry the right auth header.
-     *
-     * Defaults to an in-memory store scoped to this provider. Pass a
-     * file-backed (Node CLI) or `localStorage`-backed (browser) store
-     * to persist sessions across process or page lifetimes.
-     */
-    readonly sessionStore?: AuthSessionStore;
-    /**
-     * Optional TanStack Query `QueryClient`. Pass your app's existing
-     * client to share the cache across the SDK hooks and the host
-     * app's own queries; omit to receive a default instance scoped to
-     * this provider with a 30s `staleTime`.
-     */
-    readonly queryClient?: QueryClient;
-    readonly children: ReactNode;
-};
-declare function CapxulProvider({ config, sessionStore, queryClient, children, }: CapxulProviderProps): ReactNode;
-
-/**
- * `QueryResult<T>` — the canonical three-state return shape for every
- * read hook in `@capxul/sdk-react`, locked per CANON.md §4.29 and
- * reaffirmed by the ADR #14c lazy-DX contract (item 4).
- *
- * Three variants:
- * - `loading` — no data yet; the subscription is in flight (matches
- *   the contract's `"loading"` status)
- * - `data`    — data is live; will update reactively on next tick
- *   (the contract calls this `"ready"` colloquially — same semantics,
- *   different name; the canon name is binding)
- * - `error`   — terminal failure; `error.code` is a narrowed
- *   `CapxulErrorCode` so consumers can route via `matchError`
- *
- * Hooks NEVER throw for a "still loading" condition — the lazy-DX
- * contract collapses the multi-step lifecycle (not-bootstrapped,
- * bootstrapping, no-session, no-data, live) into these three states.
- * Consumers that want to surface the underlying transport state use
- * `useCapxulStatus()` which returns the 5-state `TransportState`
- * union.
- *
- * `useMe()` is the first live hook and maps the SDK tuple into this
- * shape. Hooks whose verticals have not landed still use the
- * `NOT_IMPLEMENTED` helper below.
- */
-
-type QueryResult<T> = {
-    readonly status: "loading";
-} | {
-    readonly status: "data";
-    readonly data: T;
-} | {
-    readonly status: "error";
-    readonly error: CapxulError;
-};
-
-/**
- * Per-resource singular read hooks — 21 total.
- *
- * Catalogued in the reset hook proof matrix. TanStack Query-backed
- * hooks return `UseQueryResult<T, CapxulError>` and route through
- * public `@capxul/sdk` reads with a 30s `staleTime` matching the
- * `CapxulProvider` default. Hooks not yet migrated still return
- * `QueryResult<T>` per the reset transport contract — per-hook
- * migration is the rollout pattern; later tasks lift each in turn.
- * `useOperation()` routes through `operations.retrieve()` so harness
- * observers can read durable operation state.
- *
- * Argument shapes follow sdk-surface.md §3b:
- * - Single-ID reads take the branded ID directly
- * - Composite-key reads (member, api-key, external account,
- *   balance-ledger entry) take an options object
- * - Owner-scoped composite keys use a discriminated `OwnerRef`
- */
-
-/**
- * Discriminated owner reference for hooks whose resource can belong
- * to either a personal account or an organization.
- */
-type OwnerRef = {
-    readonly ownerKind: "account";
-    readonly ownerId: AccountId;
-} | {
-    readonly ownerKind: "organization";
-    readonly ownerId: OrganizationId;
-};
-type UseMemberArgs = {
-    readonly organizationId: OrganizationId;
-    readonly memberId: MemberId;
-};
-type UseApiKeyArgs = {
-    readonly organizationId: OrganizationId;
-    readonly apiKeyId: ApiKeyId;
-};
-type UseExternalAccountArgs = OwnerRef & {
-    readonly externalAccountId: ExternalAccountId;
-};
-type UseBalanceLedgerEntryArgs = OwnerRef & {
-    readonly entryId: BalanceLedgerEntryId;
-};
-/**
- * The authenticated caller's identity (first-party only per §4.2).
- *
- * First hook migrated to TanStack Query per PLAN.md task 1.8.
- * Cache key `[capxul.id, "capxul", "me"]`; `staleTime` of 30s
- * matches the `CapxulProvider` default `QueryClient`. The query
- * function maps the SDK tuple into TanStack's throw-on-error
- * contract: a non-null `error` tuple slot is rethrown so TanStack
- * surfaces it on the result, and a non-`CapxulError` thrown by the
- * SDK transport is normalized to `CapxulError({ code: "UNKNOWN",
- * cause })` so the `UseQueryResult` `error` channel is always typed
- * `CapxulError`.
- *
- * The `capxul.id` leading segment isolates cache state across
- * `CapxulClient` swaps. Without it, swapping the client inside the
- * same `QueryClient` (e.g. after a sign-out / sign-in) would return
- * the previous account's cached data for up to the 30s stale window.
- * See Codex P1 finding on PR #406.
- */
-declare function useMe(): UseQueryResult<Account, CapxulError$1>;
-/**
- * Account by id. Omit `accountId` for the calling user (alias for
- * `useMe()` from a developer-perspective lens).
- *
- * Slice 2 (#457 story 1): wired via `capxul.accounts.retrieve` for
- * the id-bearing call and `capxul.me.get()` for the self-lens
- * shortcut. Returns the legacy `QueryResult<Account>` shape because
- * only `useMe` has migrated to TanStack Query so far (PLAN.md task
- * 1.8) — per-hook migration is the rollout pattern.
- */
-declare function useAccount(accountId?: AccountId): QueryResult<Account>;
-declare function useOrganization(organizationId: OrganizationId): UseQueryResult<Organization, CapxulError$1>;
-declare function useMember(args: UseMemberArgs): UseQueryResult<Member, CapxulError$1>;
-/**
- * Live; status advances as the indexer reconciles the on-chain
- * deployment. Consumers pattern-match on `data.status` via
- * `matchStatus` (see `@capxul/sdk`).
- *
- * Slice 2 (#457 story 1): wired via
- * `capxul.accounts.safes.retrieve(safeId)`. The SDK method is real
- * post-Withdrawals v1 slice 1; this hook closes the React-side
- * stub so onboarding can subscribe to Safe deploy progress.
- */
-declare function useSafe(safeId: SafeId): QueryResult<Safe>;
-declare function useTreasury(organizationId: OrganizationId): UseQueryResult<Treasury, CapxulError$1>;
-/**
- * Org-admin lens only — the hook NEVER returns `secret`.
- */
-declare function useApiKey(_args: UseApiKeyArgs): QueryResult<ApiKey>;
-declare function useKycProfile(_accountId: AccountId): QueryResult<KycProfile>;
-/**
- * Withdrawals v1 W1 (#464) — wired through the SDK.
- *
- * Branches on `args.ownerKind` so `account` scope reads via the
- * top-level `capxul.externalAccounts.retrieve(id)` (visibility-gated
- * server-side by the caller's accountId), and `organization` scope
- * reads via `capxul.organizations.externalAccounts.retrieve({ ... })`
- * which adds an org-scope check for cross-org isolation. Both routes
- * resolve to the same Convex query handler — the SDK ergonomics
- * differ but the wire shape is identical.
- */
-declare function useExternalAccount(args: UseExternalAccountArgs): QueryResult<ExternalAccount>;
-/**
- * Funds v1 PR-2b (#421) — wired through `capxul.subAccounts.retrieve`.
- *
- * The top-level `subAccounts.retrieve` resolves to the same Convex
- * query handler as `accounts.subAccounts.retrieve` /
- * `organizations.subAccounts.retrieve`; visibility is gated server-side
- * (canon §sub_account read contract — cross-scope reads surface as
- * `NOT_FOUND` rather than a distinct permission code). The SDK has
- * already branded the wire shape via `tryBrandSubAccount`, so the hook
- * receives a fully-branded `SubAccount` (`SubAccountId`, `Money`,
- * `TimestampIso`).
- */
-declare function useSubAccount(subAccountId: SubAccountId): QueryResult<SubAccount>;
-declare function useVirtualAccount(_virtualAccountId: VirtualAccountId): QueryResult<VirtualAccount>;
-declare function useVirtualCard(_virtualCardId: VirtualCardId): QueryResult<VirtualCard>;
-declare function usePayment(paymentId: PaymentId): UseQueryResult<Payment, CapxulError$1>;
-declare function useTransfer(_transferId: TransferId): QueryResult<Transfer>;
-type UseTokenTransferArgs = {
-    readonly txHash: string;
-    readonly logIndex: number;
-    readonly chainId?: number;
-};
-/**
- * **NON-CANONICAL** raw on-chain ERC-20 transfer detail. Wired through
- * `capxul.tokenTransfers.retrieve` per slice/02-story2-balance
- * Option-A verdict. Identifier is the canonical on-chain composite
- * `(txHash, logIndex)` so consumers don't have to round-trip through
- * the Convex doc id.
- *
- * Intentionally NOT in `packages/sdk-react/ops/proof/hook-manifest.ts`
- * — the canonical proof manifest tracks canon-aligned hooks only.
- */
-declare function useTokenTransfer(args: UseTokenTransferArgs): QueryResult<TokenTransfer>;
-/**
- * Immutable once written; `live` semantically only for late
- * `paymentId` / `transferId` attachment per Doc 02 §"balance_ledger".
- */
-declare function useBalanceLedgerEntry(args: UseBalanceLedgerEntryArgs): QueryResult<BalanceLedgerEntry>;
-declare function useDocument(_documentId: DocumentId): QueryResult<Document>;
-/**
- * Withdrawals v1 slice 1 (#440) — wired through `capxul.withdrawals.retrieve`.
- * Mirrors `useOperation` (the canonical evidence subscription) since
- * the withdrawal resource is operation-shaped at its core.
- */
-declare function useWithdrawal(withdrawalId: WithdrawalId): QueryResult<Withdrawal>;
-/**
- * The canonical evidence subscription per CANON.md §3.3 —
- * `operationId` + `correlationId` are the cross-layer join keys for
- * debugging any mutation's end-to-end trail.
- */
-declare function useOperation(operationId: OperationId): QueryResult<Operation>;
-/**
- * Org-admin lens only — the hook NEVER returns `signingSecret`.
- */
-declare function useWebhookEndpoint(_endpointId: WebhookEndpointId): QueryResult<WebhookEndpoint>;
-declare function useWebhookEvent(_eventId: WebhookEventId): QueryResult<WebhookEvent>;
-
-/**
- * Per-resource list read hooks — 17 total.
- *
- * Catalogued in Doc 08 §3. TanStack Query-backed hooks return
- * `UseQueryResult<List<T>, CapxulError>` and route through public
- * `@capxul/sdk` reads. Hooks not yet migrated still return
- * `QueryResult<List<T>>` per CANON.md §4.29.
- *
- * Argument shapes follow sdk-surface.md §3b:
- * - Cursor-paginated lists take `{ limit?, cursor? }` filters per
- *   §4.16 (cursor pagination convention)
- * - Org-scoped lists take `organizationId` explicitly per §4.30
- *   (Shape A — no ambient org context)
- * - Owner-scoped lists use the discriminated `OwnerRef`
- */
-
-/**
- * Cursor-pagination filters shared by list hooks. Mirrors the input
- * shape used by the vanilla SDK's `<domain>.list(...)` methods.
- */
-type PaginationFilters = {
-    readonly limit?: number;
-    readonly cursor?: string;
-};
-type OptionalOwnerFilter = {
-    readonly ownerKind?: undefined;
-    readonly ownerId?: undefined;
-};
-type AccountOwnerFilter = {
-    readonly ownerKind: "account";
-    readonly ownerId: AccountId;
-};
-type SubAccountOwnerFilter = {
-    readonly ownerKind: "sub_account";
-    readonly ownerId: SubAccountId;
-};
-type OrganizationOwnerFilter = {
-    readonly ownerKind: "organization";
-    readonly ownerId: OrganizationId;
-};
-/**
- * Filters for virtual-account listing. Narrows by owner when both
- * `ownerKind` and `ownerId` are supplied; otherwise returns every
- * virtual account the caller can see across their scope.
- */
-type VirtualAccountsFilters = PaginationFilters & (OptionalOwnerFilter | AccountOwnerFilter | SubAccountOwnerFilter | OrganizationOwnerFilter);
-type VirtualCardsFilters = PaginationFilters & (OptionalOwnerFilter | AccountOwnerFilter | SubAccountOwnerFilter | OrganizationOwnerFilter);
-type DocumentsFilters = PaginationFilters & {
-    readonly type?: "invoice" | "payroll_run" | "payroll_schedule" | "receipt" | "kyc_upload" | "bank_statement" | "tax_form";
-};
-type TransfersFilters = PaginationFilters;
-type PaymentsFilters = PaginationFilters;
-type WithdrawalsFilters = PaginationFilters;
-type OwnerScopedFilters = OwnerRef & PaginationFilters;
-type OrgScopedFilters = {
-    readonly organizationId: OrganizationId;
-} & PaginationFilters;
-type OrgDocumentsFilters = OrgScopedFilters & {
-    readonly type?: DocumentsFilters["type"];
-};
-/**
- * "My orgs" — returns every organization the authenticated caller
- * is a member of, with the co-member lens per row.
- */
-declare function useOrganizations(filters?: PaginationFilters): UseQueryResult<List<Organization>, CapxulError$1>;
-type MembersFilters = {
-    readonly status?: MembershipStatus | "all";
-};
-declare function useMembers(organizationId: OrganizationId, filters?: MembersFilters): UseQueryResult<List<Member>, CapxulError$1>;
-/**
- * Withdrawals v1 W1 (#464) — wired through the SDK.
- *
- * Personal scope reads through `capxul.accounts.externalAccounts.list({
- * accountId })` (Pattern A nested namespace); org scope reads through
- * `capxul.organizations.externalAccounts.list({ organizationId })`.
- * Both resolve to the same Convex query handler — the SDK ergonomics
- * differ. Backend filters out `revoked` rows but keeps
- * `pending_verification` rows visible (D5).
- */
-declare function useExternalAccounts(args: OwnerRef): QueryResult<List<ExternalAccount>>;
-/**
- * Funds v1 PR-2b (#421) — wired through the SDK.
- *
- * Branches on `args.ownerKind`: `account` scope reads through
- * `capxul.accounts.subAccounts.list({ accountId })`; `organization`
- * scope reads through `capxul.organizations.subAccounts.list({
- * organizationId })`. Both resolve to the same Convex domain (server
- * derives the writer scope per Pattern A — see `sdk.md`). The SDK
- * has already branded each row via `tryBrandSubAccount`, so consumers
- * receive `List<SubAccount>` with `SubAccountId`, `Money`, and
- * `TimestampIso` in place.
- *
- * Note: `OwnerRef` admits only `"account" | "organization"`. A
- * `sub_account` owner is a type error at the call site — not a runtime
- * not-supported branch — because there is no `listChildSubAccounts`
- * backend endpoint.
- */
-declare function useSubAccounts(args: OwnerRef): QueryResult<List<SubAccount>>;
-declare function useVirtualAccounts(_filters?: VirtualAccountsFilters): QueryResult<List<VirtualAccount>>;
-declare function useVirtualCards(_filters?: VirtualCardsFilters): QueryResult<List<VirtualCard>>;
-/**
- * Personal-scope payments feed (cursor-paginated per §4.16). Org-scope
- * payments live on `useOrgPayments` per §4.30 (Shape A).
- */
-declare function usePayments(filters?: PaymentsFilters): UseQueryResult<List<Payment>, CapxulError$1>;
-declare function useOrgPayments(_args: OrgScopedFilters): QueryResult<List<Payment>>;
-declare function useTransfers(_filters?: TransfersFilters): QueryResult<List<Transfer>>;
-declare function useOrgTransfers(_args: OrgScopedFilters): QueryResult<List<Transfer>>;
-/**
- * **NON-CANONICAL** raw on-chain ERC-20 transfer feed. Wired through
- * `capxul.tokenTransfers.list` per slice/02-story2-balance Option-A
- * verdict. Will be subsumed by canonical `useTransfers` once the
- * `transfers.*` shape alignment lands. See `core/token-transfers.ts`
- * doc-comment for the full contract.
- *
- * Intentionally NOT in `packages/sdk-react/ops/proof/hook-manifest.ts`
- * — the canonical proof manifest tracks canon-aligned hooks only.
- */
-declare function useTokenTransfers(filters?: TokenTransfersListInput): QueryResult<TokenTransfersListPage>;
-/**
- * Append-only per-owner balance-delta feed. Live for late
- * `paymentId` / `transferId` attachment per Doc 02.
- */
-declare function useBalanceLedger(args: OwnerScopedFilters): QueryResult<List<BalanceLedgerEntry>>;
-declare function useAccountBalanceLedger(accountId: AccountId, filters?: PaginationFilters): QueryResult<List<BalanceLedgerEntry>>;
-declare function useOrgBalanceLedger(args: OrgScopedFilters): QueryResult<List<BalanceLedgerEntry>>;
-/**
- * Personal-scope documents. `filters.type` narrows the polymorphic
- * `Document` union to a single variant (invoice, payroll_run,
- * receipt, etc. per §4.50).
- */
-declare function useDocuments(_filters?: DocumentsFilters): QueryResult<List<Document>>;
-declare function useOrgDocuments(_args: OrgDocumentsFilters): QueryResult<List<Document>>;
-/**
- * Withdrawals v1 slice 1 (#440) — wired through `capxul.withdrawals.list`.
- */
-declare function useWithdrawals(filters?: WithdrawalsFilters): QueryResult<List<Withdrawal>>;
-/**
- * Withdrawals v1 slice 1 (#440) — wired through
- * `capxul.organizations.withdrawals.list`.
- */
-declare function useOrgWithdrawals(args: OrgScopedFilters): QueryResult<List<Withdrawal>>;
-/**
- * Org-admin lens only — the hook NEVER returns `secret` for any row.
- */
-declare function useApiKeys(_organizationId: OrganizationId): QueryResult<List<ApiKey>>;
-/**
- * Org-admin / service-key lens — org scope is inferred from the
- * api-key claim, so no `organizationId` argument is needed.
- */
-declare function useWebhookEndpoints(): QueryResult<List<WebhookEndpoint>>;
-
-/**
- * Org-scoped member mutation hooks — TanStack `useMutation` wrappers.
- *
- * Slice 5 (#627): invite, accept, updateRole, revoke, remove, resend.
- * Each hook returns the standard `{ mutate, mutateAsync, isPending, error, data }`
- * shape so consumers can fire-and-forget or await + handle errors.
- */
-
-type InviteMemberArgs = {
-    readonly organizationId: OrganizationId;
-    readonly email: string;
-    readonly role: Member["role"];
-};
-type AcceptInvitationArgs = {
-    readonly token: string;
-};
-type UpdateMemberRoleArgs = {
-    readonly organizationId: OrganizationId;
-    readonly memberId: MemberId;
-    readonly role: Member["role"];
-};
-type RevokeMemberArgs = {
-    readonly organizationId: OrganizationId;
-    readonly memberId: MemberId;
-};
-type RemoveMemberArgs = {
-    readonly organizationId: OrganizationId;
-    readonly memberId: MemberId;
-};
-type ResendInvitationArgs = {
-    readonly organizationId: OrganizationId;
-    readonly memberId: MemberId;
-};
-declare function useInviteMember(): UseMutationResult<MemberInviteResponse, CapxulError$1, InviteMemberArgs>;
-declare function useAcceptInvitation(): UseMutationResult<Member, CapxulError$1, AcceptInvitationArgs>;
-declare function useUpdateMemberRole(): UseMutationResult<Member, CapxulError$1, UpdateMemberRoleArgs>;
-declare function useRevokeMember(): UseMutationResult<Member, CapxulError$1, RevokeMemberArgs>;
-declare function useRemoveMember(): UseMutationResult<void, CapxulError$1, RemoveMemberArgs>;
-declare function useResendInvitation(): UseMutationResult<MemberInviteResponse, CapxulError$1, ResendInvitationArgs>;
-
-/**
- * Public Capxul username. 3–30 chars, letter-first, lowercased,
- * remaining chars from `[a-z0-9_-]` (per `CANON.md` §4.54 and
- * `sdk-surface.md` §5h). Constructor lowercases before validating so
- * mixed-case input canonicalizes cleanly when the first char is a
- * letter; purely invalid shapes (too short, illegal chars, digit-first)
- * still throw.
- */
-type Username = string & {
-    readonly __capxulUsernameBrand: "Username";
-};
-
-type User = {
-    readonly account: Account;
-    readonly username: Username;
-    readonly safe: Safe;
-    readonly session: Session;
-};
-type AuthState = "idle" | "sendingOtp" | "awaitingOtp" | "bootstrapRequired" | "provisioningSigner" | "bootstrapping" | "authenticated" | "error";
-type BootstrapContinuation = {
-    readonly bootstrapToken: AuthBootstrapToken;
-    readonly email: string;
-    readonly reason: AuthBootstrapReason;
-    readonly username?: Username;
-    readonly session: Session;
-};
-type AuthVerifyResult = {
-    readonly kind: "existing_member";
-    readonly session: Session;
-    readonly user: User;
-} | {
-    readonly kind: "bootstrap_required";
-    readonly session: Session;
-    readonly bootstrap: BootstrapContinuation;
-};
-type UseAuthResult = {
-    readonly state: AuthState;
-    readonly user: User | null;
-    readonly bootstrap: BootstrapContinuation | null;
-    readonly error: Error | null;
-    readonly signIn: (email: string) => Promise<void>;
-    readonly verifyOtp: (email: string, otp: string) => Promise<AuthVerifyResult>;
-    readonly completeBootstrap: (username: Username, signer?: Account$1) => Promise<User>;
-    readonly signOut: () => Promise<void>;
-};
-type UseAuthOptions = {
-    /** Optional external signer to use during bootstrap instead of auto-provisioning. */
-    readonly signer?: Account$1;
-};
-/**
- * Canonical auth hook.
- *
- * Reactive state (`state`, `user`, `error`) is suitable for UI
- * observers; `signIn`, `verifyOtp`, and `signOut` return promises so
- * the reference CLI can drive the flow imperatively.
- *
- * OTP verification is intentionally branch-explicit: existing members
- * authenticate immediately, while first-run or incomplete accounts stop
- * at `bootstrapRequired` until the caller chooses a username and calls
- * `completeBootstrap()`.
- *
- * `completeBootstrap()` auto-provisions a fresh local-private-key signer
- * via `SignerProvisioner` unless the caller passes or configures an
- * explicit signer. Test harnesses use that override to keep the actor's
- * signer stable across later dogfooding operations.
- */
-declare function useAuth(options?: UseAuthOptions): UseAuthResult;
-
-declare function useOnboardingFlow(): {
-    readonly snapshot: xstate.MachineSnapshot<any, any, any, any, any, any, any, any>;
-    readonly send: (event: any) => void;
-};
-declare function useProvisioningFlow(): {
-    readonly snapshot: xstate.MachineSnapshot<any, any, any, any, any, any, any, any>;
-    readonly send: (event: any) => void;
-};
-
-/**
- * Browser-side Capxul SDK config — public ergonomics for `@capxul/sdk-react`
- * consumers.
- *
- * The canonical type lives in `@capxul/sdk` (`transport.ts`); this file
- * re-exports it so consumers can `import { BrowserCapxulConfig,
- * createCapxulConfig } from "@capxul/sdk-react"` without crossing the
- * package boundary themselves. The `BrowserCapxulConfig` discriminated
- * union stays single-source-of-truth in `@capxul/sdk` so Stack 2 can
- * extend it in-place when the `publishable-key` arm lands.
- *
- * `createCapxulConfig` is a runtime validator + freezer. It rejects
- * secret/server-only fields (apiKey, data, signer, ...) per ADR 5 and
- * PR #393's `assertBrowserCapxulConfig` precedent, but every error is
- * a typed `CapxulError` produced by `Errors.invalidInput()` — never a
- * raw `new Error(...)` (per `.claude/rules/error-handling.md`).
- */
-
-/**
- * Validate + freeze a `BrowserCapxulConfig`. The returned value is the
- * same input object frozen via `Object.freeze` so callers cannot mutate
- * it after handoff.
- *
- * Throws `Errors.invalidInput(...)` on:
- *  - any unknown key (rejects `apiKey`, `data`, `signer`, `fetch`, typos,
- *    Stack-2 server-only additions — the allow-list approach is
- *    secret-safe by default)
- *  - missing required field for the active `mode` arm
- *  - an unknown `mode` value (exhaustive guard via `Errors.internalError`)
- */
-declare function createCapxulConfig(input: BrowserCapxulConfig): BrowserCapxulConfig;
-
-type CapxulConnectorKind = "injected" | "local-private-key";
-type CapxulConnectorSession = {
-    readonly connectorId: string;
-    readonly connectorKind: CapxulConnectorKind;
-    readonly signerAddress: string;
-};
-type CapxulConnector = {
-    readonly id: string;
-    readonly name: string;
-    readonly kind: CapxulConnectorKind;
-    readonly autoConnect?: boolean;
-    connect(): Promise<CapxulConnectorSession>;
-    disconnect?(): Promise<void>;
-};
-type InjectedConnectorOptions = {
-    readonly id?: string;
-    readonly name?: string;
-};
-type LocalPrivateKeyConnectorOptions = {
-    readonly privateKey: `0x${string}`;
-    readonly id?: string;
-    readonly name?: string;
-};
-/**
- * Resolve a signer through an injected EIP-1193 provider (e.g.
- * MetaMask via `window.ethereum`).
- *
- * Throws `Errors.providerError("connector", "injected", cause)` on
- * provider absence or empty `eth_requestAccounts` response. Provider
- * rejections (user closed the prompt) bubble up unchanged so callers
- * can map them per UX requirements.
- */
-declare function injectedConnector(options?: InjectedConnectorOptions): CapxulConnector;
-/**
- * Resolve a signer from a local private key (dev / e2e harness path).
- *
- * Validates the private key shape (`0x` + 64 hex chars) synchronously
- * at factory time so misconfig surfaces before any UI flow advances.
- * Per-call `connect()` is pure computation — `privateKeyToAccount`
- * derives the address from the key with no I/O.
- *
- * Throws `Errors.invalidInput(...)` on bad inputs.
- */
-declare function localPrivateKeyConnector(options: LocalPrivateKeyConnectorOptions): CapxulConnector;
-
-export { type AuthState, type AuthVerifyResult, type BootstrapContinuation, CapxulClientProvider, type CapxulClientProviderProps, type CapxulConnector, type CapxulConnectorKind, type CapxulConnectorSession, CapxulProvider, type CapxulProviderProps, CapxulTransportProvider, type CapxulTransportProviderProps, type DocumentsFilters, type InjectedConnectorOptions, type LocalPrivateKeyConnectorOptions, type OrgDocumentsFilters, type OrgScopedFilters, type OwnerRef, type OwnerScopedFilters, type PaginationFilters, type PaymentsFilters, type QueryResult, type TransfersFilters, type UseApiKeyArgs, type UseAuthOptions, type UseAuthResult, type UseBalanceLedgerEntryArgs, type UseExternalAccountArgs, type UseMemberArgs, type UseTokenTransferArgs, type User, type VirtualAccountsFilters, type VirtualCardsFilters, type WithdrawalsFilters, createCapxulConfig, injectedConnector, localPrivateKeyConnector, useAcceptInvitation, useAccount, useAccountBalanceLedger, useApiKey, useApiKeys, useAuth, useBalanceLedger, useBalanceLedgerEntry, useCapxul, useCapxulStatus, useDocument, useDocuments, useExternalAccount, useExternalAccounts, useInviteMember, useKycProfile, useMe, useMember, useMembers, useOnboardingFlow, useOperation, useOrgBalanceLedger, useOrgDocuments, useOrgPayments, useOrgTransfers, useOrgWithdrawals, useOrganization, useOrganizations, usePayment, usePayments, useProvisioningFlow, useRemoveMember, useResendInvitation, useRevokeMember, useSafe, useSubAccount, useSubAccounts, useTokenTransfer, useTokenTransfers, useTransfer, useTransfers, useTreasury, useUpdateMemberRole, useVirtualAccount, useVirtualAccounts, useVirtualCard, useVirtualCards, useWebhookEndpoint, useWebhookEndpoints, useWebhookEvent, useWithdrawal, useWithdrawals };