@capxul/sdk 0.2.0-alpha.3 → 0.2.0-alpha.4

package/dist/{client-B_Z3ThFO.d.cts → client-UEm2oZbZ.d.cts}

@@ -1,9 +1,8 @@
 import { Account as Account$1 } from 'viem';
-import * as xstate from 'xstate';
 import { AnyStateMachine } from 'xstate';
 import { A as AccountId, S as SafeId, c as KycProfileId, b as ExternalAccountId, f as SubAccountId, d as OrganizationId, a as ApiKeyId, X as TimestampIso, U as Username, E as Email, D as DocumentId, O as OperationId, P as PaymentId, g as TransferId, k as WithdrawalId, W as WebhookEndpointId, j as WebhookEventId, M as MemberId, V as VirtualAccountId, i as VirtualCardId } from './next-action-CTGl8wpy.cjs';
-import { d as CapxulResult, C as CapxulError$1 } from './errors-rqxuUhQP.cjs';
-import { A as Account, X as UserIdentifier, a as AccountLookupResult, S as Safe, k as KycProfile, E as ExternalAccount, L as List, F as SubAccount, B as BalanceLedgerEntry, b as ApiKey, a5 as CreateApiKeyRequest, a6 as CreateDocumentRequest, D as Document, O as Operation, q as OperationStatus, p as Money, C as CreatePaymentResult, t as Payment, Q as TransferEndpoint, f as CreateTransferResult, J as Transfer, g as CreateWithdrawalResult, a3 as Withdrawal, a7 as CreateWebhookEndpointRequest, a1 as WebhookEndpoint, a2 as WebhookEvent, s as Organization, W as Treasury, o as MembershipStatus, M as Member, n as MemberInviteResponse, a8 as CreateVirtualAccountRequest, Y as VirtualAccount, a9 as CreateVirtualCardRequest, _ as VirtualCard } from './types-Brucpq0Z.cjs';
+import { d as CapxulResult, C as CapxulError } from './errors-rqxuUhQP.cjs';
+import { A as Account, X as UserIdentifier, a as AccountLookupResult, S as Safe, k as KycProfile, E as ExternalAccount, L as List, F as SubAccount, B as BalanceLedgerEntry, b as ApiKey, a5 as CreateApiKeyRequest, a6 as CreateDocumentRequest, D as Document, O as Operation, q as OperationStatus, p as Money, C as CreatePaymentResult, t as Payment, Q as TransferEndpoint, f as CreateTransferResult, J as Transfer, g as CreateWithdrawalResult, a3 as Withdrawal, a7 as CreateWebhookEndpointRequest, a1 as WebhookEndpoint, a2 as WebhookEvent, s as Organization, W as Treasury, o as MembershipStatus, M as Member, n as MemberInviteResponse, a8 as CreateVirtualAccountRequest, Y as VirtualAccount, a9 as CreateVirtualCardRequest, _ as VirtualCard } from './types-HlwCIjgQ.cjs';
 
 /**
  * Accounts domain — individual user accounts per sdk-surface.md §1a.
@@ -184,13 +183,6 @@ type AuthSessionStore = {
     set(session: Session): void;
     clear(): void;
 };
-type AuthSendOtpInput = {
-    readonly email: string;
-};
-type AuthVerifyOtpInput = {
-    readonly email: string;
-    readonly otp: string;
-};
 type AuthBootstrapToken = string & {
     readonly __capxulAuthBootstrapTokenBrand: "AuthBootstrapToken";
 };
@@ -222,10 +214,6 @@ type CompleteBootstrapResult = {
     readonly username: Username;
     readonly safe: Safe;
 };
-type AuthServiceTokenMintInput = {
-    readonly apiKey: string;
-    readonly audience?: string;
-};
 /**
  * Options bag for auth methods that perform outbound `fetch` work.
  *
@@ -239,26 +227,37 @@ type AuthServiceTokenMintInput = {
 type AuthMethodOptions = {
     readonly signal?: AbortSignal;
 };
-type ServiceToken = {
-    readonly token: string;
-    readonly expiresAt: TimestampIso;
-};
-type SendOtpCodes = "EMAIL_DELIVERY_FAILED" | "INVALID_INPUT" | "RATE_LIMITED" | "NETWORK_ERROR" | "PROVIDER_ERROR" | "INTERNAL_ERROR" | "ENV_MISSING" | "UNKNOWN" | "NOT_AUTHENTICATED" | "PERMISSION_DENIED";
-type VerifyOtpCodes = "INVALID_INPUT" | "NOT_AUTHENTICATED" | "RATE_LIMITED" | "OPERATION_TIMEOUT" | "NETWORK_ERROR" | "PROVIDER_ERROR" | "INTERNAL_ERROR" | "ENV_MISSING" | "UNKNOWN" | "PERMISSION_DENIED";
-type CompleteBootstrapCodes = "INVALID_INPUT" | "IDEMPOTENCY_CONFLICT" | "RATE_LIMITED" | "PROFILE_NOT_FOUND" | "SMART_ACCOUNT_MISSING" | "PROVIDER_UNAVAILABLE" | "PROVIDER_REJECTED" | "OPERATION_TIMEOUT" | "NETWORK_ERROR" | "INTERNAL_ERROR";
-type GetSessionCodes = "NETWORK_ERROR";
-type SignOutCodes = "NOT_AUTHENTICATED" | "NETWORK_ERROR";
-type ServiceTokenMintCodes = "API_KEY_INVALID" | "API_KEY_EXPIRED" | "INVALID_INPUT" | "RATE_LIMITED" | "NETWORK_ERROR";
-type AuthClient = {
-    readonly sendOtp: (input: AuthSendOtpInput, options?: AuthMethodOptions) => Promise<CapxulResult<void, SendOtpCodes>>;
-    readonly verifyOtp: (input: AuthVerifyOtpInput, options?: AuthMethodOptions) => Promise<CapxulResult<VerifyOtpResult, VerifyOtpCodes>>;
-    readonly completeBootstrap: (input: CompleteBootstrapInput) => Promise<CapxulResult<CompleteBootstrapResult, CompleteBootstrapCodes>>;
-    readonly getSession: () => Promise<CapxulResult<Session | null, GetSessionCodes>>;
-    readonly signOut: () => Promise<CapxulResult<void, SignOutCodes>>;
-    readonly serviceTokenMint: (input: AuthServiceTokenMintInput) => Promise<CapxulResult<ServiceToken, ServiceTokenMintCodes>>;
-    /** Internal bridge for flow hooks that need the authenticated Convex data client. */
-    readonly getDataClient: () => CapxulDataClient | null;
-};
+
+/**
+ * AuthService — unified promise-based auth surface.
+ *
+ * Wraps the imperative `AuthClient` tuple API with a class-based,
+ * promise-based interface. `signOut` preserves the data-client
+ * reference so provider-owned singletons survive sign-in/sign-out
+ * cycles.
+ */
+
+declare class AuthService {
+    private authClient;
+    private sessionStore;
+    private config;
+    constructor(config?: CapxulConfig);
+    sendOtp(email: string, options?: AuthMethodOptions): Promise<void>;
+    verifyOtp(email: string, otp: string, options?: AuthMethodOptions): Promise<VerifyOtpResult>;
+    completeBootstrap(params: CompleteBootstrapInput, signer?: Account$1): Promise<CompleteBootstrapResult>;
+    /**
+     * Clears the persisted session and, when a transport was pre-injected,
+     * drops the cached auth header.
+     *
+     * **Transport safety note:** `clearAuth()` is only invoked when
+     * `config._transport` was supplied at construction (e.g. by the React
+     * provider). If `AuthService` is instantiated directly in a Node/CLI
+     * context without an injected transport, the transport-side auth cache
+     * is the caller's responsibility.
+     */
+    signOut(): Promise<void>;
+    getSession(): Promise<Session | null>;
+}
 
 /**
  * Documents domain — unified artifact primitive per sdk-surface.md §1a
@@ -294,9 +293,9 @@ type OrgDocumentsCancelInput = {
     readonly documentId: DocumentId;
 };
 type CreateCodes$7 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT" | "IDEMPOTENCY_CONFLICT" | "RATE_LIMITED" | "NETWORK_ERROR";
-type RetrieveCodes$c = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
+type RetrieveCodes$c = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "INVALID_INPUT";
 type ListCodes$9 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT";
-type CancelCodes$1 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "OPERATION_CANCELED";
+type CancelCodes$1 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "INVALID_INPUT" | "OPERATION_CANCELED";
 type DocumentsClient = {
     readonly create: (input: DocumentsCreateInput) => Promise<CapxulResult<Document, CreateCodes$7>>;
     readonly retrieve: (documentId: DocumentId) => Promise<CapxulResult<Document, RetrieveCodes$c>>;
@@ -922,7 +921,7 @@ type TransportState = {
     readonly runtime: TransportRuntime;
 } | {
     readonly status: "error";
-    readonly error: CapxulError$1;
+    readonly error: CapxulError;
 };
 type TransportRuntime = {
     readonly authBaseUrl: string;
@@ -1149,152 +1148,6 @@ type VirtualCardsClient = {
     readonly cancel: (virtualCardId: VirtualCardId) => Promise<CapxulResult<VirtualCard, MutateCodes>>;
 };
 
-/**
- * Unified error type used across the entire stack: backend, SDK, and frontend.
- * One class, one set of codes, one language.
- *
- * Backend throws CapxulError → withErrorBoundary serializes to ConvexError →
- * SDK deserializes back to CapxulError → frontend routes on err.code.
- */
-type CapxulErrorCode = "NOT_AUTHENTICATED" | "EMAIL_DELIVERY_FAILED" | "API_KEY_INVALID" | "API_KEY_EXPIRED" | "PROFILE_NOT_FOUND" | "SMART_ACCOUNT_MISSING" | "PLAYER_NOT_FOUND" | "ACCOUNT_NOT_FOUND" | "PROVIDER_ERROR" | "INVALID_INPUT" | "ENV_MISSING" | "NOT_IMPLEMENTED" | "VERIFICATION_REQUIRED" | "INSUFFICIENT_BALANCE" | "INVALID_RECIPIENT" | "TRANSACTION_FAILED" | "RATE_LIMITED" | "NETWORK_ERROR" | "PERMISSION_DENIED" | "IDEMPOTENCY_CONFLICT" | "NOT_FOUND" | "OPERATION_CANCELED" | "OPERATION_TIMEOUT" | "ACTION_REQUIRED" | "KYC_REQUIRED" | "POLICY_DENIED" | "SAFE_NOT_READY" | "PROVIDER_UNAVAILABLE" | "PROVIDER_REJECTED" | "RECONCILIATION_FAILED" | "INTERNAL_ERROR" | "QUOTE_EXPIRED" | "QUOTE_NOT_FOUND" | "INDEXER_DELIVERY_TIMEOUT" | "UNKNOWN";
-declare class CapxulError extends Error {
-    readonly code: CapxulErrorCode;
-    readonly details?: Record<string, unknown>;
-    readonly correlationId?: string;
-    readonly layer?: string;
-    constructor(code: CapxulErrorCode, message: string, options?: {
-        cause?: unknown;
-        details?: Record<string, unknown>;
-        correlationId?: string;
-        layer?: string;
-    });
-}
-
-type AuthBootstrapFlowError = CapxulError$1 | CapxulError;
-type AuthBootstrapFlowContext = {
-    readonly email: Email | null;
-    readonly code: string | null;
-    readonly username: Username | null;
-    readonly bootstrapToken: AuthBootstrapToken | null;
-    readonly bootstrapReason: AuthBootstrapReason | null;
-    readonly session: Session | null;
-    readonly account: Account | null;
-    readonly safe: Safe | null;
-    readonly error: AuthBootstrapFlowError | null;
-};
-type AuthBootstrapFlowEvent = {
-    readonly type: "ENTER_EMAIL";
-    readonly email: Email;
-} | {
-    readonly type: "REQUEST_OTP";
-} | {
-    readonly type: "ENTER_OTP";
-    readonly code: string;
-} | {
-    readonly type: "VERIFY_OTP";
-} | {
-    readonly type: "ENTER_USERNAME";
-    readonly username: Username;
-} | {
-    readonly type: "COMPLETE_BOOTSTRAP";
-} | {
-    readonly type: "BACK";
-} | {
-    readonly type: "RESET";
-} | {
-    readonly type: "SIGN_OUT";
-};
-declare function createAuthBootstrapFlowMachine(client: CapxulClient): xstate.StateMachine<AuthBootstrapFlowContext, {
-    readonly type: "ENTER_EMAIL";
-    readonly email: Email;
-} | {
-    readonly type: "REQUEST_OTP";
-} | {
-    readonly type: "ENTER_OTP";
-    readonly code: string;
-} | {
-    readonly type: "VERIFY_OTP";
-} | {
-    readonly type: "ENTER_USERNAME";
-    readonly username: Username;
-} | {
-    readonly type: "COMPLETE_BOOTSTRAP";
-} | {
-    readonly type: "BACK";
-} | {
-    readonly type: "RESET";
-} | {
-    readonly type: "SIGN_OUT";
-}, {
-    [x: string]: xstate.ActorRefFromLogic<xstate.PromiseActorLogic<void, void, xstate.EventObject>> | xstate.ActorRefFromLogic<xstate.PromiseActorLogic<void, {
-        email: Email;
-    }, xstate.EventObject>> | xstate.ActorRefFromLogic<xstate.PromiseActorLogic<VerifyOtpResult, {
-        email: Email;
-        code: string;
-    }, xstate.EventObject>> | xstate.ActorRefFromLogic<xstate.PromiseActorLogic<CompleteBootstrapResult, {
-        bootstrapToken: AuthBootstrapToken;
-        username: Username;
-    }, xstate.EventObject>> | undefined;
-}, {
-    src: "sendOtp";
-    logic: xstate.PromiseActorLogic<void, {
-        email: Email;
-    }, xstate.EventObject>;
-    id: string | undefined;
-} | {
-    src: "verifyOtp";
-    logic: xstate.PromiseActorLogic<VerifyOtpResult, {
-        email: Email;
-        code: string;
-    }, xstate.EventObject>;
-    id: string | undefined;
-} | {
-    src: "signOut";
-    logic: xstate.PromiseActorLogic<void, void, xstate.EventObject>;
-    id: string | undefined;
-} | {
-    src: "completeBootstrap";
-    logic: xstate.PromiseActorLogic<CompleteBootstrapResult, {
-        bootstrapToken: AuthBootstrapToken;
-        username: Username;
-    }, xstate.EventObject>;
-    id: string | undefined;
-}, {
-    type: "trackOtpRequested";
-    params: unknown;
-} | {
-    type: "trackTimeoutFailed";
-    params: unknown;
-} | {
-    type: "trackVerified";
-    params: unknown;
-} | {
-    type: "identifyAndTrack";
-    params: unknown;
-} | {
-    type: "trackSignedOut";
-    params: unknown;
-} | {
-    type: "trackFailed";
-    params: unknown;
-} | {
-    type: "trackBootstrapRequired";
-    params: unknown;
-}, never, never, "email" | "authenticated" | "error" | "bootstrap_required" | "sending_otp" | "otp_requested" | "signing_out" | "verifying_otp" | "completing_bootstrap", string, xstate.NonReducibleUnknown, xstate.NonReducibleUnknown, xstate.EventObject, xstate.MetaObject, {
-    id: "authBootstrap";
-    states: {
-        readonly email: {};
-        readonly sending_otp: {};
-        readonly otp_requested: {};
-        readonly verifying_otp: {};
-        readonly bootstrap_required: {};
-        readonly completing_bootstrap: {};
-        readonly authenticated: {};
-        readonly signing_out: {};
-        readonly error: {};
-    };
-}>;
-
 /**
  * Root `@capxul/sdk` client factory.
  *
@@ -1401,7 +1254,7 @@ type CapxulConfig = {
     readonly _transport?: HttpTransport;
 };
 /**
- * Per-call factories for the three Stack-1 XState v5 flow machines.
+ * Per-call factories for XState v5 flow machines.
  *
  * Each factory returns a fresh machine instance bound to this
  * `CapxulClient`. The consumer is responsible for creating a single
@@ -1417,8 +1270,6 @@ type CapxulConfig = {
  * `./flows/*` when they need them.
  */
 type CapxulFlowFactories = {
-    readonly auth: () => AnyStateMachine;
-    readonly authBootstrap: () => ReturnType<typeof createAuthBootstrapFlowMachine>;
     readonly onboarding: () => AnyStateMachine;
     readonly provisioning: () => AnyStateMachine;
 };
@@ -1439,7 +1290,7 @@ type CapxulClient = {
      * `createCapxulClient()` call. See Codex P1 finding on PR #406.
      */
     readonly id: string;
-    readonly auth: AuthClient;
+    readonly auth: AuthService;
     readonly me: MeClient;
     readonly accounts: AccountsClient;
     readonly organizations: OrganizationsClient;
@@ -1474,11 +1325,11 @@ type CapxulClient = {
  * Two-pass construction: the per-domain clients (`auth`, `me`, …) are
  * built first, then `flows` is assigned with factories that close over
  * the fully-built `client` so the spawned XState machines can call
- * back into `client.auth.sendOtp`, `client.accounts.provisionPersonal`,
- * etc. The intermediate `clientWithoutFlows` value is typed without
+ * back into `client.accounts.provisionPersonal`, etc. The intermediate
+ * `clientWithoutFlows` value is typed without
  * `flows`; `Object.assign` mutates a single `flows` field on it before
  * the returned `CapxulClient` cast — minimal and contained.
  */
 declare function createCapxulClient(config?: CapxulConfig): CapxulClient;
 
-export { type WithdrawalsClient as $, type AccountProvisionPersonalInput as A, type BrowserCapxulConfig as B, CapxulError as C, type DocumentsClient as D, type ExternalAccountsClient as E, type SubAccountsClient as F, type TokenTransferId as G, type HttpTransport as H, type TokenTransfersClient as I, type TokenTransfersListInput as J, type TokenTransfersListPage as K, type LocalPrivateKeySignerProvider as L, type MeClient as M, type TokenTransfersRetrieveInput as N, type OperationsClient as O, type PaymentsClient as P, type TransfersClient as Q, type TransportRuntime as R, type Session as S, type TokenTransfer as T, type TransportState as U, type VerifyOtpResult as V, type VirtualAccountsClient as W, type VirtualCardsClient as X, type WebhookEndpointCreateResult as Y, type WebhookEndpointsClient as Z, type WebhookEventsClient as _, type CapxulClient as a, createAuthBootstrapFlowMachine as a0, createCapxulClient as a1, makeHttpTransport as a2, toTokenTransferId as a3, type CapxulConfig as b, type CompleteBootstrapInput as c, type CompleteBootstrapResult as d, type AccountsClient as e, type ApiKeyCreateResult as f, type ApiKeysClient as g, type AuthBootstrapFlowContext as h, type AuthBootstrapFlowError as i, type AuthBootstrapFlowEvent as j, type AuthBootstrapReason as k, type AuthBootstrapToken as l, type AuthClient as m, type AuthSessionStore as n, type CapxulAuthConfig as o, type CapxulDataClient as p, type CapxulFlowFactories as q, type CapxulSigningConfig as r, type OrgDocumentsClient as s, type OrgMembersClient as t, type OrgPaymentsClient as u, type OrgSafesClient as v, type OrgTransfersClient as w, type OrgTreasuryClient as x, type OrgWithdrawalsClient as y, type OrganizationsClient as z };
+export { type AccountProvisionPersonalInput as A, type BrowserCapxulConfig as B, type CapxulClient as C, type DocumentsClient as D, type ExternalAccountsClient as E, type TokenTransfersListPage as F, type TokenTransfersRetrieveInput as G, type HttpTransport as H, type TransfersClient as I, type TransportRuntime as J, type TransportState as K, type LocalPrivateKeySignerProvider as L, type MeClient as M, type VirtualAccountsClient as N, type OperationsClient as O, type PaymentsClient as P, type VirtualCardsClient as Q, type WebhookEndpointsClient as R, type Session as S, type TokenTransfer as T, type WebhookEventsClient as U, type VerifyOtpResult as V, type WebhookEndpointCreateResult as W, type WithdrawalsClient as X, createCapxulClient as Y, makeHttpTransport as Z, toTokenTransferId as _, type AccountsClient as a, type ApiKeyCreateResult as b, type ApiKeysClient as c, type AuthBootstrapReason as d, type AuthBootstrapToken as e, AuthService as f, type AuthSessionStore as g, type CapxulAuthConfig as h, type CapxulConfig as i, type CapxulDataClient as j, type CapxulFlowFactories as k, type CapxulSigningConfig as l, type CompleteBootstrapInput as m, type CompleteBootstrapResult as n, type OrgDocumentsClient as o, type OrgMembersClient as p, type OrgPaymentsClient as q, type OrgSafesClient as r, type OrgTransfersClient as s, type OrgTreasuryClient as t, type OrgWithdrawalsClient as u, type OrganizationsClient as v, type SubAccountsClient as w, type TokenTransferId as x, type TokenTransfersClient as y, type TokenTransfersListInput as z };