@capxul/sdk 0.2.0-alpha.3 → 0.2.0-alpha.4

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @capxul/sdk
 
+## 0.2.0-alpha.4
+
+### Minor Changes
+
+- b6c1f94: Complete the auth dogfooding epic around the canonical auth surface.
+
+  The SDK now carries the guarded OTP proof path, bootstrap continuation states,
+  canonical auth service behavior, and final funnel proof support needed for
+  first-run auth dogfooding. The React SDK aligns its auth hooks and provider
+  state with that canonical flow, including signout cleanup, bootstrap-required
+  continuations, and funnel telemetry integration.
+
+### Patch Changes
+
+- 50d3c55: Bundle the internal Safe derivation package into the SDK artifact instead of
+  publishing it as a runtime dependency, and add a packaging guard that fails when
+  publishable packages leak private `@repo/*` runtime dependencies.
+
 ## 0.2.0-alpha.3
 
 ### Patch Changes

package/README.md

@@ -30,10 +30,10 @@ React-flavored entry point lives in `@capxul/sdk-react`. Pick:
 
 Capxul splits the platform into two layers with different licenses:
 
-| Layer | What it does | License |
-|---|---|---|
-| Custody (on-chain) | Safe v1.4.1 + ERC-4337 modules — every contract that holds, transfers, or signs over user funds | Open source, audited, in the [Capxul GitHub repo](https://github.com/Xelmar-tech/Capxul/tree/main/packages/contracts) |
-| Orchestration (this package) | Workflow logic, business rules, integration glue, the `/v1/*` HTTP client | Proprietary — see `LICENSE` |
+| Layer                        | What it does                                                                                    | License                                                                                                               |
+| ---------------------------- | ----------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
+| Custody (on-chain)           | Safe v1.4.1 + ERC-4337 modules — every contract that holds, transfers, or signs over user funds | Open source, audited, in the [Capxul GitHub repo](https://github.com/Xelmar-tech/Capxul/tree/main/packages/contracts) |
+| Orchestration (this package) | Workflow logic, business rules, integration glue, the `/v1/*` HTTP client                       | Proprietary — see `LICENSE`                                                                                           |
 
 You don't have to take our word for the parts that hold money — those
 contracts are open and auditable. The parts that orchestrate workflows
@@ -94,7 +94,10 @@ runtime URLs by POSTing to `/v1/client/bootstrap` on the first auth or
 small:
 
 ```json
-{ "authBaseUrl": "https://<deployment>.convex.site/api/auth", "convexUrl": "https://<deployment>.convex.cloud" }
+{
+  "authBaseUrl": "https://<deployment>.convex.site/api/auth",
+  "convexUrl": "https://<deployment>.convex.cloud"
+}
 ```
 
 The resolved runtime is cached for the lifetime of the transport. Concurrent
@@ -136,11 +139,11 @@ try {
 
 Runtime proof status:
 
-| Surface | Source support | Runtime proof | Status |
-|---|---|---|---|
-| SDK transport | `makeHttpTransport({ mode: "publishable-key", publishableKey })` | `packages/sdk/tests/unit/transport.test.ts` proves config validation, singleflight bootstrap, retry after failure, lifecycle transitions, and sanitized backend errors. | Proven with mocked fetch |
-| React provider | `CapxulProvider config={{ mode: "publishable-key", ... }}` | `packages/sdk-react/ops/proof/react-headless.test.tsx` proves bootstrap before a real `useMe()` read through the provider and lazy Convex data client. | Proven with mocked fetch + headless React |
-| Reference CLI | `bootstrap probe --mock --json` | `apps/reference-cli/scripts/agent-driver.ts` phase 0 and the direct CLI command prove provider/bootstrap/auth ordering and sanitized output. | Proven locally; live endpoint remains manual-key gated |
+| Surface        | Source support                                                   | Runtime proof                                                                                                                                                           | Status                                                 |
+| -------------- | ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------ |
+| SDK transport  | `makeHttpTransport({ mode: "publishable-key", publishableKey })` | `packages/sdk/tests/unit/transport.test.ts` proves config validation, singleflight bootstrap, retry after failure, lifecycle transitions, and sanitized backend errors. | Proven with mocked fetch                               |
+| React provider | `CapxulProvider config={{ mode: "publishable-key", ... }}`       | `packages/sdk-react/ops/proof/react-headless.test.tsx` proves bootstrap before a real `useMe()` read through the provider and lazy Convex data client.                  | Proven with mocked fetch + headless React              |
+| Reference CLI  | `bootstrap probe --mock --json`                                  | `apps/reference-cli/scripts/agent-driver.ts` phase 0 and the direct CLI command prove provider/bootstrap/auth ordering and sanitized output.                            | Proven locally; live endpoint remains manual-key gated |
 
 Copy-paste local replication:
 
@@ -160,7 +163,16 @@ fresh checkout; the CLI depends on their generated declaration outputs.
 Expected sanitized pass signal:
 
 ```json
-{"command":"bootstrap.probe","ok":true,"mode":"publishable-key","status":"ready","bootstrapRequests":1,"authRequests":1,"keyLengthClass":"provided","mocked":true}
+{
+  "command": "bootstrap.probe",
+  "ok": true,
+  "mode": "publishable-key",
+  "status": "ready",
+  "bootstrapRequests": 1,
+  "authRequests": 1,
+  "keyLengthClass": "provided",
+  "mocked": true
+}
 ```
 
 ## Public surface (alpha)
@@ -171,12 +183,36 @@ capxul.me            // get, update — first-party caller identity
 capxul.accounts      // create, retrieve, list
 capxul.organizations // CRUD + members + payments + treasury
 capxul.payments      // create, retrieve, list
-capxul.invoices      // create, retrieve, list
 capxul.withdrawals   // create, retrieve, list
-capxul.documents     // KYC uploads, invoices, receipts, tax forms
+capxul.documents     // personal invoices first; broader document variants typed
 capxul.flows.{auth, onboarding, provisioning} // XState v5 flows
 ```
 
+### Personal invoice documents
+
+The first `documents` runtime surface is the personal invoice pilot.
+It creates immutable open invoice documents with a canonical
+`invoiceHash`. The backend stores the private invoice payload; the
+chain receives only the hash as `documentHash`.
+
+```ts
+const [err, invoice] = await capxul.documents.create({
+  type: "invoice",
+  recipient: { email: "client@example.com" },
+  amount: { value: "25.00", currency: "USD" },
+  lineItems: [
+    { description: "Design", quantity: 1, unitPrice: "25.00", currency: "USD" },
+  ],
+  reference: "May design work",
+  dueAt: "2026-05-20T00:00:00.000Z",
+});
+```
+
+Use `capxul.documents.retrieve(docId)`, `.list({ type: "invoice" })`,
+and `.cancel(docId)` for the rest of the pilot surface. Org-admin
+invoices, file uploads, PDFs, partial payments, and mutable open
+invoices are outside this pilot.
+
 Helpers:
 
 - `tryCatch(promise)` — error tuple `[error, data]`; routes on
@@ -196,11 +232,12 @@ role-based access:
 const [err, org] = await capxul.organizations.create({ name: "Acme" });
 
 // Invite a member — returns the raw token once
-const [err, { member, inviteToken }] = await capxul.organizations.members.invite({
-  organizationId: org.id,
-  email: "alice@example.com",
-  role: "finance_manager",
-});
+const [err, { member, inviteToken }] =
+  await capxul.organizations.members.invite({
+    organizationId: org.id,
+    email: "alice@example.com",
+    role: "finance_manager",
+  });
 
 // List members — defaults to active; pass status to filter
 const [err, list] = await capxul.organizations.members.list({
@@ -209,7 +246,9 @@ const [err, list] = await capxul.organizations.members.list({
 });
 
 // Accept an invitation (called by the invitee)
-const [err, member] = await capxul.organizations.members.accept({ token: inviteToken });
+const [err, member] = await capxul.organizations.members.accept({
+  token: inviteToken,
+});
 
 // Revoke a pending invitation
 const [err] = await capxul.organizations.members.revoke({
@@ -241,9 +280,12 @@ const [err, account] = await tryCatch(capxul.me.get());
 
 if (err) {
   switch (err.code) {
-    case "PROFILE_NOT_FOUND": return router.push("/onboarding");
-    case "NOT_AUTHENTICATED": return router.push("/login");
-    default: throw err; // unhandled — bubble to the error boundary
+    case "PROFILE_NOT_FOUND":
+      return router.push("/onboarding");
+    case "NOT_AUTHENTICATED":
+      return router.push("/login");
+    default:
+      throw err; // unhandled — bubble to the error boundary
   }
 }
 ```

package/dist/{client-pMBRFcsz.d.ts → client-CbUeJoM9.d.ts}

@@ -1,9 +1,8 @@
 import { Account as Account$1 } from 'viem';
-import * as xstate from 'xstate';
 import { AnyStateMachine } from 'xstate';
 import { A as AccountId, S as SafeId, c as KycProfileId, b as ExternalAccountId, f as SubAccountId, d as OrganizationId, a as ApiKeyId, X as TimestampIso, U as Username, E as Email, D as DocumentId, O as OperationId, P as PaymentId, g as TransferId, k as WithdrawalId, W as WebhookEndpointId, j as WebhookEventId, M as MemberId, V as VirtualAccountId, i as VirtualCardId } from './next-action-CTGl8wpy.js';
-import { d as CapxulResult, C as CapxulError$1 } from './errors-CwhCWGxm.js';
-import { A as Account, X as UserIdentifier, a as AccountLookupResult, S as Safe, k as KycProfile, E as ExternalAccount, L as List, F as SubAccount, B as BalanceLedgerEntry, b as ApiKey, a5 as CreateApiKeyRequest, a6 as CreateDocumentRequest, D as Document, O as Operation, q as OperationStatus, p as Money, C as CreatePaymentResult, t as Payment, Q as TransferEndpoint, f as CreateTransferResult, J as Transfer, g as CreateWithdrawalResult, a3 as Withdrawal, a7 as CreateWebhookEndpointRequest, a1 as WebhookEndpoint, a2 as WebhookEvent, s as Organization, W as Treasury, o as MembershipStatus, M as Member, n as MemberInviteResponse, a8 as CreateVirtualAccountRequest, Y as VirtualAccount, a9 as CreateVirtualCardRequest, _ as VirtualCard } from './types-V_D7qjxY.js';
+import { d as CapxulResult, C as CapxulError } from './errors-CwhCWGxm.js';
+import { A as Account, X as UserIdentifier, a as AccountLookupResult, S as Safe, k as KycProfile, E as ExternalAccount, L as List, F as SubAccount, B as BalanceLedgerEntry, b as ApiKey, a5 as CreateApiKeyRequest, a6 as CreateDocumentRequest, D as Document, O as Operation, q as OperationStatus, p as Money, C as CreatePaymentResult, t as Payment, Q as TransferEndpoint, f as CreateTransferResult, J as Transfer, g as CreateWithdrawalResult, a3 as Withdrawal, a7 as CreateWebhookEndpointRequest, a1 as WebhookEndpoint, a2 as WebhookEvent, s as Organization, W as Treasury, o as MembershipStatus, M as Member, n as MemberInviteResponse, a8 as CreateVirtualAccountRequest, Y as VirtualAccount, a9 as CreateVirtualCardRequest, _ as VirtualCard } from './types-BD4VAQb5.js';
 
 /**
  * Accounts domain — individual user accounts per sdk-surface.md §1a.
@@ -184,13 +183,6 @@ type AuthSessionStore = {
     set(session: Session): void;
     clear(): void;
 };
-type AuthSendOtpInput = {
-    readonly email: string;
-};
-type AuthVerifyOtpInput = {
-    readonly email: string;
-    readonly otp: string;
-};
 type AuthBootstrapToken = string & {
     readonly __capxulAuthBootstrapTokenBrand: "AuthBootstrapToken";
 };
@@ -222,10 +214,6 @@ type CompleteBootstrapResult = {
     readonly username: Username;
     readonly safe: Safe;
 };
-type AuthServiceTokenMintInput = {
-    readonly apiKey: string;
-    readonly audience?: string;
-};
 /**
  * Options bag for auth methods that perform outbound `fetch` work.
  *
@@ -239,26 +227,37 @@ type AuthServiceTokenMintInput = {
 type AuthMethodOptions = {
     readonly signal?: AbortSignal;
 };
-type ServiceToken = {
-    readonly token: string;
-    readonly expiresAt: TimestampIso;
-};
-type SendOtpCodes = "EMAIL_DELIVERY_FAILED" | "INVALID_INPUT" | "RATE_LIMITED" | "NETWORK_ERROR" | "PROVIDER_ERROR" | "INTERNAL_ERROR" | "ENV_MISSING" | "UNKNOWN" | "NOT_AUTHENTICATED" | "PERMISSION_DENIED";
-type VerifyOtpCodes = "INVALID_INPUT" | "NOT_AUTHENTICATED" | "RATE_LIMITED" | "OPERATION_TIMEOUT" | "NETWORK_ERROR" | "PROVIDER_ERROR" | "INTERNAL_ERROR" | "ENV_MISSING" | "UNKNOWN" | "PERMISSION_DENIED";
-type CompleteBootstrapCodes = "INVALID_INPUT" | "IDEMPOTENCY_CONFLICT" | "RATE_LIMITED" | "PROFILE_NOT_FOUND" | "SMART_ACCOUNT_MISSING" | "PROVIDER_UNAVAILABLE" | "PROVIDER_REJECTED" | "OPERATION_TIMEOUT" | "NETWORK_ERROR" | "INTERNAL_ERROR";
-type GetSessionCodes = "NETWORK_ERROR";
-type SignOutCodes = "NOT_AUTHENTICATED" | "NETWORK_ERROR";
-type ServiceTokenMintCodes = "API_KEY_INVALID" | "API_KEY_EXPIRED" | "INVALID_INPUT" | "RATE_LIMITED" | "NETWORK_ERROR";
-type AuthClient = {
-    readonly sendOtp: (input: AuthSendOtpInput, options?: AuthMethodOptions) => Promise<CapxulResult<void, SendOtpCodes>>;
-    readonly verifyOtp: (input: AuthVerifyOtpInput, options?: AuthMethodOptions) => Promise<CapxulResult<VerifyOtpResult, VerifyOtpCodes>>;
-    readonly completeBootstrap: (input: CompleteBootstrapInput) => Promise<CapxulResult<CompleteBootstrapResult, CompleteBootstrapCodes>>;
-    readonly getSession: () => Promise<CapxulResult<Session | null, GetSessionCodes>>;
-    readonly signOut: () => Promise<CapxulResult<void, SignOutCodes>>;
-    readonly serviceTokenMint: (input: AuthServiceTokenMintInput) => Promise<CapxulResult<ServiceToken, ServiceTokenMintCodes>>;
-    /** Internal bridge for flow hooks that need the authenticated Convex data client. */
-    readonly getDataClient: () => CapxulDataClient | null;
-};
+
+/**
+ * AuthService — unified promise-based auth surface.
+ *
+ * Wraps the imperative `AuthClient` tuple API with a class-based,
+ * promise-based interface. `signOut` preserves the data-client
+ * reference so provider-owned singletons survive sign-in/sign-out
+ * cycles.
+ */
+
+declare class AuthService {
+    private authClient;
+    private sessionStore;
+    private config;
+    constructor(config?: CapxulConfig);
+    sendOtp(email: string, options?: AuthMethodOptions): Promise<void>;
+    verifyOtp(email: string, otp: string, options?: AuthMethodOptions): Promise<VerifyOtpResult>;
+    completeBootstrap(params: CompleteBootstrapInput, signer?: Account$1): Promise<CompleteBootstrapResult>;
+    /**
+     * Clears the persisted session and, when a transport was pre-injected,
+     * drops the cached auth header.
+     *
+     * **Transport safety note:** `clearAuth()` is only invoked when
+     * `config._transport` was supplied at construction (e.g. by the React
+     * provider). If `AuthService` is instantiated directly in a Node/CLI
+     * context without an injected transport, the transport-side auth cache
+     * is the caller's responsibility.
+     */
+    signOut(): Promise<void>;
+    getSession(): Promise<Session | null>;
+}
 
 /**
  * Documents domain — unified artifact primitive per sdk-surface.md §1a
@@ -294,9 +293,9 @@ type OrgDocumentsCancelInput = {
     readonly documentId: DocumentId;
 };
 type CreateCodes$7 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT" | "IDEMPOTENCY_CONFLICT" | "RATE_LIMITED" | "NETWORK_ERROR";
-type RetrieveCodes$c = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
+type RetrieveCodes$c = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "INVALID_INPUT";
 type ListCodes$9 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT";
-type CancelCodes$1 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "OPERATION_CANCELED";
+type CancelCodes$1 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "INVALID_INPUT" | "OPERATION_CANCELED";
 type DocumentsClient = {
     readonly create: (input: DocumentsCreateInput) => Promise<CapxulResult<Document, CreateCodes$7>>;
     readonly retrieve: (documentId: DocumentId) => Promise<CapxulResult<Document, RetrieveCodes$c>>;
@@ -922,7 +921,7 @@ type TransportState = {
     readonly runtime: TransportRuntime;
 } | {
     readonly status: "error";
-    readonly error: CapxulError$1;
+    readonly error: CapxulError;
 };
 type TransportRuntime = {
     readonly authBaseUrl: string;
@@ -1149,152 +1148,6 @@ type VirtualCardsClient = {
     readonly cancel: (virtualCardId: VirtualCardId) => Promise<CapxulResult<VirtualCard, MutateCodes>>;
 };
 
-/**
- * Unified error type used across the entire stack: backend, SDK, and frontend.
- * One class, one set of codes, one language.
- *
- * Backend throws CapxulError → withErrorBoundary serializes to ConvexError →
- * SDK deserializes back to CapxulError → frontend routes on err.code.
- */
-type CapxulErrorCode = "NOT_AUTHENTICATED" | "EMAIL_DELIVERY_FAILED" | "API_KEY_INVALID" | "API_KEY_EXPIRED" | "PROFILE_NOT_FOUND" | "SMART_ACCOUNT_MISSING" | "PLAYER_NOT_FOUND" | "ACCOUNT_NOT_FOUND" | "PROVIDER_ERROR" | "INVALID_INPUT" | "ENV_MISSING" | "NOT_IMPLEMENTED" | "VERIFICATION_REQUIRED" | "INSUFFICIENT_BALANCE" | "INVALID_RECIPIENT" | "TRANSACTION_FAILED" | "RATE_LIMITED" | "NETWORK_ERROR" | "PERMISSION_DENIED" | "IDEMPOTENCY_CONFLICT" | "NOT_FOUND" | "OPERATION_CANCELED" | "OPERATION_TIMEOUT" | "ACTION_REQUIRED" | "KYC_REQUIRED" | "POLICY_DENIED" | "SAFE_NOT_READY" | "PROVIDER_UNAVAILABLE" | "PROVIDER_REJECTED" | "RECONCILIATION_FAILED" | "INTERNAL_ERROR" | "QUOTE_EXPIRED" | "QUOTE_NOT_FOUND" | "INDEXER_DELIVERY_TIMEOUT" | "UNKNOWN";
-declare class CapxulError extends Error {
-    readonly code: CapxulErrorCode;
-    readonly details?: Record<string, unknown>;
-    readonly correlationId?: string;
-    readonly layer?: string;
-    constructor(code: CapxulErrorCode, message: string, options?: {
-        cause?: unknown;
-        details?: Record<string, unknown>;
-        correlationId?: string;
-        layer?: string;
-    });
-}
-
-type AuthBootstrapFlowError = CapxulError$1 | CapxulError;
-type AuthBootstrapFlowContext = {
-    readonly email: Email | null;
-    readonly code: string | null;
-    readonly username: Username | null;
-    readonly bootstrapToken: AuthBootstrapToken | null;
-    readonly bootstrapReason: AuthBootstrapReason | null;
-    readonly session: Session | null;
-    readonly account: Account | null;
-    readonly safe: Safe | null;
-    readonly error: AuthBootstrapFlowError | null;
-};
-type AuthBootstrapFlowEvent = {
-    readonly type: "ENTER_EMAIL";
-    readonly email: Email;
-} | {
-    readonly type: "REQUEST_OTP";
-} | {
-    readonly type: "ENTER_OTP";
-    readonly code: string;
-} | {
-    readonly type: "VERIFY_OTP";
-} | {
-    readonly type: "ENTER_USERNAME";
-    readonly username: Username;
-} | {
-    readonly type: "COMPLETE_BOOTSTRAP";
-} | {
-    readonly type: "BACK";
-} | {
-    readonly type: "RESET";
-} | {
-    readonly type: "SIGN_OUT";
-};
-declare function createAuthBootstrapFlowMachine(client: CapxulClient): xstate.StateMachine<AuthBootstrapFlowContext, {
-    readonly type: "ENTER_EMAIL";
-    readonly email: Email;
-} | {
-    readonly type: "REQUEST_OTP";
-} | {
-    readonly type: "ENTER_OTP";
-    readonly code: string;
-} | {
-    readonly type: "VERIFY_OTP";
-} | {
-    readonly type: "ENTER_USERNAME";
-    readonly username: Username;
-} | {
-    readonly type: "COMPLETE_BOOTSTRAP";
-} | {
-    readonly type: "BACK";
-} | {
-    readonly type: "RESET";
-} | {
-    readonly type: "SIGN_OUT";
-}, {
-    [x: string]: xstate.ActorRefFromLogic<xstate.PromiseActorLogic<void, void, xstate.EventObject>> | xstate.ActorRefFromLogic<xstate.PromiseActorLogic<void, {
-        email: Email;
-    }, xstate.EventObject>> | xstate.ActorRefFromLogic<xstate.PromiseActorLogic<VerifyOtpResult, {
-        email: Email;
-        code: string;
-    }, xstate.EventObject>> | xstate.ActorRefFromLogic<xstate.PromiseActorLogic<CompleteBootstrapResult, {
-        bootstrapToken: AuthBootstrapToken;
-        username: Username;
-    }, xstate.EventObject>> | undefined;
-}, {
-    src: "sendOtp";
-    logic: xstate.PromiseActorLogic<void, {
-        email: Email;
-    }, xstate.EventObject>;
-    id: string | undefined;
-} | {
-    src: "verifyOtp";
-    logic: xstate.PromiseActorLogic<VerifyOtpResult, {
-        email: Email;
-        code: string;
-    }, xstate.EventObject>;
-    id: string | undefined;
-} | {
-    src: "signOut";
-    logic: xstate.PromiseActorLogic<void, void, xstate.EventObject>;
-    id: string | undefined;
-} | {
-    src: "completeBootstrap";
-    logic: xstate.PromiseActorLogic<CompleteBootstrapResult, {
-        bootstrapToken: AuthBootstrapToken;
-        username: Username;
-    }, xstate.EventObject>;
-    id: string | undefined;
-}, {
-    type: "trackOtpRequested";
-    params: unknown;
-} | {
-    type: "trackTimeoutFailed";
-    params: unknown;
-} | {
-    type: "trackVerified";
-    params: unknown;
-} | {
-    type: "identifyAndTrack";
-    params: unknown;
-} | {
-    type: "trackSignedOut";
-    params: unknown;
-} | {
-    type: "trackFailed";
-    params: unknown;
-} | {
-    type: "trackBootstrapRequired";
-    params: unknown;
-}, never, never, "email" | "authenticated" | "error" | "bootstrap_required" | "sending_otp" | "otp_requested" | "signing_out" | "verifying_otp" | "completing_bootstrap", string, xstate.NonReducibleUnknown, xstate.NonReducibleUnknown, xstate.EventObject, xstate.MetaObject, {
-    id: "authBootstrap";
-    states: {
-        readonly email: {};
-        readonly sending_otp: {};
-        readonly otp_requested: {};
-        readonly verifying_otp: {};
-        readonly bootstrap_required: {};
-        readonly completing_bootstrap: {};
-        readonly authenticated: {};
-        readonly signing_out: {};
-        readonly error: {};
-    };
-}>;
-
 /**
  * Root `@capxul/sdk` client factory.
  *
@@ -1401,7 +1254,7 @@ type CapxulConfig = {
     readonly _transport?: HttpTransport;
 };
 /**
- * Per-call factories for the three Stack-1 XState v5 flow machines.
+ * Per-call factories for XState v5 flow machines.
  *
  * Each factory returns a fresh machine instance bound to this
  * `CapxulClient`. The consumer is responsible for creating a single
@@ -1417,8 +1270,6 @@ type CapxulConfig = {
  * `./flows/*` when they need them.
  */
 type CapxulFlowFactories = {
-    readonly auth: () => AnyStateMachine;
-    readonly authBootstrap: () => ReturnType<typeof createAuthBootstrapFlowMachine>;
     readonly onboarding: () => AnyStateMachine;
     readonly provisioning: () => AnyStateMachine;
 };
@@ -1439,7 +1290,7 @@ type CapxulClient = {
      * `createCapxulClient()` call. See Codex P1 finding on PR #406.
      */
     readonly id: string;
-    readonly auth: AuthClient;
+    readonly auth: AuthService;
     readonly me: MeClient;
     readonly accounts: AccountsClient;
     readonly organizations: OrganizationsClient;
@@ -1474,11 +1325,11 @@ type CapxulClient = {
  * Two-pass construction: the per-domain clients (`auth`, `me`, …) are
  * built first, then `flows` is assigned with factories that close over
  * the fully-built `client` so the spawned XState machines can call
- * back into `client.auth.sendOtp`, `client.accounts.provisionPersonal`,
- * etc. The intermediate `clientWithoutFlows` value is typed without
+ * back into `client.accounts.provisionPersonal`, etc. The intermediate
+ * `clientWithoutFlows` value is typed without
  * `flows`; `Object.assign` mutates a single `flows` field on it before
  * the returned `CapxulClient` cast — minimal and contained.
  */
 declare function createCapxulClient(config?: CapxulConfig): CapxulClient;
 
-export { type WithdrawalsClient as $, type AccountProvisionPersonalInput as A, type BrowserCapxulConfig as B, CapxulError as C, type DocumentsClient as D, type ExternalAccountsClient as E, type SubAccountsClient as F, type TokenTransferId as G, type HttpTransport as H, type TokenTransfersClient as I, type TokenTransfersListInput as J, type TokenTransfersListPage as K, type LocalPrivateKeySignerProvider as L, type MeClient as M, type TokenTransfersRetrieveInput as N, type OperationsClient as O, type PaymentsClient as P, type TransfersClient as Q, type TransportRuntime as R, type Session as S, type TokenTransfer as T, type TransportState as U, type VerifyOtpResult as V, type VirtualAccountsClient as W, type VirtualCardsClient as X, type WebhookEndpointCreateResult as Y, type WebhookEndpointsClient as Z, type WebhookEventsClient as _, type CapxulClient as a, createAuthBootstrapFlowMachine as a0, createCapxulClient as a1, makeHttpTransport as a2, toTokenTransferId as a3, type CapxulConfig as b, type CompleteBootstrapInput as c, type CompleteBootstrapResult as d, type AccountsClient as e, type ApiKeyCreateResult as f, type ApiKeysClient as g, type AuthBootstrapFlowContext as h, type AuthBootstrapFlowError as i, type AuthBootstrapFlowEvent as j, type AuthBootstrapReason as k, type AuthBootstrapToken as l, type AuthClient as m, type AuthSessionStore as n, type CapxulAuthConfig as o, type CapxulDataClient as p, type CapxulFlowFactories as q, type CapxulSigningConfig as r, type OrgDocumentsClient as s, type OrgMembersClient as t, type OrgPaymentsClient as u, type OrgSafesClient as v, type OrgTransfersClient as w, type OrgTreasuryClient as x, type OrgWithdrawalsClient as y, type OrganizationsClient as z };
+export { type AccountProvisionPersonalInput as A, type BrowserCapxulConfig as B, type CapxulClient as C, type DocumentsClient as D, type ExternalAccountsClient as E, type TokenTransfersListPage as F, type TokenTransfersRetrieveInput as G, type HttpTransport as H, type TransfersClient as I, type TransportRuntime as J, type TransportState as K, type LocalPrivateKeySignerProvider as L, type MeClient as M, type VirtualAccountsClient as N, type OperationsClient as O, type PaymentsClient as P, type VirtualCardsClient as Q, type WebhookEndpointsClient as R, type Session as S, type TokenTransfer as T, type WebhookEventsClient as U, type VerifyOtpResult as V, type WebhookEndpointCreateResult as W, type WithdrawalsClient as X, createCapxulClient as Y, makeHttpTransport as Z, toTokenTransferId as _, type AccountsClient as a, type ApiKeyCreateResult as b, type ApiKeysClient as c, type AuthBootstrapReason as d, type AuthBootstrapToken as e, AuthService as f, type AuthSessionStore as g, type CapxulAuthConfig as h, type CapxulConfig as i, type CapxulDataClient as j, type CapxulFlowFactories as k, type CapxulSigningConfig as l, type CompleteBootstrapInput as m, type CompleteBootstrapResult as n, type OrgDocumentsClient as o, type OrgMembersClient as p, type OrgPaymentsClient as q, type OrgSafesClient as r, type OrgTransfersClient as s, type OrgTreasuryClient as t, type OrgWithdrawalsClient as u, type OrganizationsClient as v, type SubAccountsClient as w, type TokenTransferId as x, type TokenTransfersClient as y, type TokenTransfersListInput as z };