@capxul/sdk 0.2.0-alpha.3 → 0.2.0-alpha.5

package/dist/index.d.mts

@@ -0,0 +1,1263 @@
+import { a as AccountProviderSource, c as eip1193AccountProvider, d as CapxulResult, f as Profile, g as AuthCachePort, i as AccountProvider, l as localPrivateKeyAccountProvider, m as SmartAccount, n as Eip1193RequestProvider, o as AccountRequirement, p as Session, r as injectedWalletSigner, s as Eip1193Provider, t as CapxulSigner, u as openfortEmbeddedAccountProvider, v as CachedJwt } from "./signer-oaYGfjDe.mjs";
+import { a as SafeDeploymentEvidence, n as SafeDeploymentConfig } from "./safe-deployment-Vni46k3t.mjs";
+import { Context, Effect, Layer, Request } from "effect";
+import { Machine } from "@effect/experimental";
+import { CapxulError, CapxulErrorCode, CapxulErrorDetails } from "@capxul/config";
+import { Account, Account as Account$1, AccountId, Address, Address as Address$1, AllowedOrigin, AnonymousDistinctId, AppId, AuthSession, AuthSession as AuthSession$1, AuthUserId, AuthUserId as AuthUserId$1, ChainId, CountryCode, DeveloperApplication, DurationMs, Email, EpochMs, Money, Money as Money$1, OrgId, OrgId as OrgId$1, Profile as Profile$1, PublishableKey, PublishableKeyId, PublishableKeyRecord, RoleKey, RoleKey as RoleKey$1, RunId, SessionToken, SmartAccount as SmartAccount$1, SubAccount, SubAccount as SubAccount$1, SubAccountId, SubAccountId as SubAccountId$1 } from "@capxul/types";
+import { TelemetryEvent, TelemetryGroupInput, TelemetryIdentifyInput } from "@capxul/observability";
+import { Hex } from "viem";
+import { Schema } from "@effect/schema";
+import { FunctionReference } from "convex/server";
+
+//#region src/ports/auth-client.d.ts
+type AuthClientOperationOptions = {
+  readonly signal?: AbortSignal;
+};
+type SendOtpInput = {
+  readonly email: Email;
+};
+type CanSendOtpInput = {
+  readonly email: Email;
+};
+type CanSendOtpStatus = {
+  readonly allowed: boolean;
+  readonly cooldownMs: DurationMs;
+};
+type VerifyOtpInput = {
+  readonly email: Email;
+  readonly otp: string;
+};
+type GetConvexJwtOptions = AuthClientOperationOptions & {
+  readonly forceRefresh?: boolean;
+};
+declare const AuthClientError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "AuthClientError";
+} & Readonly<A>;
+declare class AuthClientError extends AuthClientError_base<{
+  readonly operation: string;
+  readonly kind: string;
+  readonly cause: unknown;
+}> {}
+interface AuthClientPort {
+  canSendOtp(input: CanSendOtpInput, options?: AuthClientOperationOptions): Effect.Effect<CanSendOtpStatus, AuthClientError>;
+  sendOtp(input: SendOtpInput, options?: AuthClientOperationOptions): Effect.Effect<void, AuthClientError>;
+  verifyOtp(input: VerifyOtpInput, options?: AuthClientOperationOptions): Effect.Effect<AuthSession$1, AuthClientError>;
+  getSession(options?: AuthClientOperationOptions): Effect.Effect<AuthSession$1 | null, AuthClientError>;
+  signOut(options?: AuthClientOperationOptions): Effect.Effect<void, AuthClientError>;
+  /**
+   * Fetches a Convex-aud JWT from `/api/auth/convex/token` (W7). Server mints
+   * a fresh JWT on every call per Probe A's 2026-05-19 finding (RS256, 900 s
+   * lifetime, `iss = <site-url>`, `aud = convex`). The caller (the SDK's
+   * `tokenProvider` wired into ConvexCallPort) is responsible for the
+   * `exp - 30s` proactive cache + `forceRefresh` callback handshake.
+   */
+  getConvexJwt(options?: GetConvexJwtOptions): Effect.Effect<CachedJwt, AuthClientError>;
+}
+//#endregion
+//#region src/ports/clock.d.ts
+interface ClockPort {
+  readonly now: Effect.Effect<EpochMs, ClockError>;
+  readonly sleep: (duration: DurationMs) => Effect.Effect<void, ClockError>;
+}
+declare const ClockError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "ClockError";
+} & Readonly<A>;
+declare class ClockError extends ClockError_base<{
+  readonly operation: "now" | "sleep" | "initialize";
+  readonly cause: unknown;
+}> {}
+//#endregion
+//#region src/ports/telemetry.d.ts
+interface TelemetryPort {
+  readonly emit: (event: TelemetryEvent) => Effect.Effect<void, never>;
+  readonly identify: (input: TelemetryIdentifyInput) => Effect.Effect<void, never>;
+  readonly group: (input: TelemetryGroupInput) => Effect.Effect<void, never>;
+  readonly reset: () => Effect.Effect<void, never>;
+}
+//#endregion
+//#region src/flows/auth.d.ts
+interface AuthFlowInput {
+  readonly otpTtlMs?: number;
+}
+type AuthFlowState = "idle" | "sending_otp" | "otp_requested" | "verifying" | "authenticated" | "signing_out" | "error";
+interface AuthFlowContext {
+  readonly state: AuthFlowState;
+  readonly email: Email | null;
+  readonly session: AuthSession$1 | null;
+  readonly otpRequestedAt: EpochMs | null;
+  readonly anonDistinctId?: AnonymousDistinctId;
+  readonly error: CapxulError | null;
+}
+interface AuthFlowObserver {
+  readonly input: AuthFlowInput;
+  readonly getSnapshot: () => {
+    readonly value: AuthFlowState;
+    readonly context: AuthFlowContext;
+    readonly status: "active" | "stopped";
+  };
+  readonly stop: () => void;
+}
+//#endregion
+//#region src/env/_internal.d.ts
+declare const envShapeSchema: Schema.Struct<{
+  [k: string]: Schema.Schema<string, string, never> | Schema.optional<Schema.Schema<string, string, never>>;
+}>;
+type EnvShape = Schema.Schema.Type<typeof envShapeSchema>;
+type EnvKey = keyof EnvShape & string;
+//#endregion
+//#region src/env/index.d.ts
+type RequiredEnvKey = EnvKey;
+type OptionalEnvKey = EnvKey;
+//#endregion
+//#region src/ports/env.d.ts
+declare const EnvError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "EnvError";
+} & Readonly<A>;
+declare class EnvError extends EnvError_base<{
+  readonly publicError: CapxulError;
+  readonly publicCode?: CapxulErrorCode;
+  readonly key?: string;
+  readonly details?: CapxulErrorDetails;
+  readonly cause?: unknown;
+}> {}
+interface EnvPort {
+  readonly require: <K extends RequiredEnvKey>(key: K) => Effect.Effect<EnvShape[K], EnvError, never>;
+  readonly optional: <K extends OptionalEnvKey>(key: K) => Effect.Effect<EnvShape[K] | undefined, EnvError, never>;
+  readonly has: (key: EnvKey) => Effect.Effect<boolean, EnvError, never>;
+}
+//#endregion
+//#region src/ports/evm-signer.d.ts
+type HexString = `0x${string}`;
+type UserOperationRequest = {
+  readonly sender: Address$1;
+  readonly chainId: ChainId;
+  readonly callData: HexString;
+  readonly nonce?: HexString;
+  readonly maxFeePerGas?: HexString;
+  readonly maxPriorityFeePerGas?: HexString;
+  readonly callGasLimit?: HexString;
+  readonly verificationGasLimit?: HexString;
+  readonly preVerificationGas?: HexString;
+  readonly paymasterAndData?: HexString;
+};
+type SignedUserOperation = UserOperationRequest & {
+  readonly sender: Address$1;
+  readonly signature: HexString;
+  readonly userOpHash: HexString;
+};
+declare const EvmSignerError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "EvmSignerError";
+} & Readonly<A>;
+declare class EvmSignerError extends EvmSignerError_base<{
+  readonly publicError: CapxulError;
+  readonly publicCode?: CapxulErrorCode;
+  readonly operation?: string;
+  readonly details?: CapxulErrorDetails;
+  readonly cause?: unknown;
+}> {}
+interface EvmSignerPort {
+  readonly getAddress: Effect.Effect<Address$1, EvmSignerError, never>;
+  readonly signMessage: (message: string | Uint8Array) => Effect.Effect<HexString, EvmSignerError, never>;
+  readonly signUserOp: (userOperation: UserOperationRequest) => Effect.Effect<SignedUserOperation, EvmSignerError, never>;
+}
+//#endregion
+//#region src/ports/transport.d.ts
+type TransportOperationKind = "query" | "mutation" | "action";
+type TransportRequest<TArgs = unknown> = {
+  readonly name: string;
+  readonly args: TArgs;
+  readonly correlationId?: string;
+};
+declare const TransportError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "TransportError";
+} & Readonly<A>;
+declare class TransportError extends TransportError_base<{
+  readonly operation: TransportOperationKind;
+  readonly name: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly correlationId?: string;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface TransportPort {
+  readonly runQuery: <TOutput = unknown, TArgs = unknown>(request: TransportRequest<TArgs>) => Effect.Effect<TOutput, TransportError>;
+  readonly runMutation: <TOutput = unknown, TArgs = unknown>(request: TransportRequest<TArgs>) => Effect.Effect<TOutput, TransportError>;
+  readonly runAction: <TOutput = unknown, TArgs = unknown>(request: TransportRequest<TArgs>) => Effect.Effect<TOutput, TransportError>;
+}
+//#endregion
+//#region src/ports/bootstrap.d.ts
+type BootstrapInput = {
+  readonly publishableKey: PublishableKey;
+  /**
+   * Browser callers send the App origin so bootstrap can enforce the
+   * publishable-key allowlist. Node/server callers may omit it; the backend
+   * only applies the origin allowlist when an origin is present.
+   */
+  readonly origin?: AllowedOrigin;
+};
+type BootstrapResolution = {
+  readonly applicationId: AppId;
+  readonly chainId: ChainId;
+  /**
+   * SDK-handshake session token — distinct from the user-auth `AuthSession`
+   * token issued by `AuthClientPort`. Both use the `SessionToken` brand for
+   * opaque-string discipline; the issuance source distinguishes them.
+   */
+  readonly sessionToken: SessionToken;
+  readonly issuedAt: EpochMs;
+  readonly expiresIn: DurationMs;
+  readonly authBaseUrl: string;
+  readonly convexUrl: string;
+};
+type BootstrapErrorKind = "notAuthenticated" | "network" | "provider" | "malformedBody" | "invalidInput" | "rateLimited";
+declare const BootstrapError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "BootstrapError";
+} & Readonly<A>;
+declare class BootstrapError extends BootstrapError_base<{
+  readonly operation: "resolve";
+  readonly kind: BootstrapErrorKind;
+  readonly publicCode: CapxulErrorCode;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface BootstrapPort {
+  readonly resolve: (input: BootstrapInput) => Effect.Effect<BootstrapResolution, BootstrapError>;
+}
+//#endregion
+//#region src/ports/subscription.d.ts
+/**
+ * Canonical teardown handle for substrate-level reactive callbacks.
+ *
+ * Calling it stops the subscription; no further snapshots will be delivered
+ * to the callback after the first invocation. Calling more than once is a
+ * no-op (idempotent).
+ *
+ * @internal-use
+ */
+type Unsubscribe = () => void;
+/**
+ * Snapshot is the substrate discriminated union for reactive callbacks over
+ * `ConvexCallPort.subscribe`. The public SDK surface is imperative
+ * (`Promise<CapxulResult>`). This type is reachable for internal XState
+ * `fromCallback` actor wiring,
+ * property-based `crossAdapterSubscriptionProperty` harness consumers, and
+ * genuinely non-React advanced consumers.
+ *
+ *   - `loading` · initial state before any value arrives from the substrate
+ *   - `ok`      · a successful snapshot carrying `value`
+ *   - `error`   · a failed snapshot carrying a typed error (defaults to
+ *                 `CapxulError`)
+ *
+ * Generic over the value type `T`. The error type `E` is parameterised but
+ * defaults to `CapxulError` — every shipped port today uses the default. A
+ * narrower or wider `E` is reserved for future ports that need a different
+ * error vocabulary.
+ *
+ * The substrate guarantees the first snapshot is `loading` (CC8 in the
+ * `ConvexCallPort` contract); subsequent snapshots carry `ok` or `error`
+ * per the underlying transport.
+ *
+ * Per ARCH-LOCK-1 (`docs/decisions/stage-4-reactivity-pivot.html`), domain
+ * ports do not expose reactive callback methods.
+ *
+ * @internal-use
+ */
+type Snapshot<T, E = CapxulError> = {
+  readonly status: "loading";
+} | {
+  readonly status: "ok";
+  readonly value: T;
+} | {
+  readonly status: "error";
+  readonly error: E;
+};
+//#endregion
+//#region src/ports/convex-call.d.ts
+declare const ConvexCallError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "ConvexCallError";
+} & Readonly<A>;
+declare class ConvexCallError extends ConvexCallError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface ConvexCallPort {
+  query<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"query", "public", TArgs, TOutput>, args: TArgs): Effect.Effect<TOutput, ConvexCallError>;
+  mutation<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"mutation", "public", TArgs, TOutput>, args: TArgs): Effect.Effect<TOutput, ConvexCallError>;
+  action<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"action", "public", TArgs, TOutput>, args: TArgs): Effect.Effect<TOutput, ConvexCallError>;
+  /**
+   * Substrate-level reactive transport over Convex's `onUpdate`.
+   *
+   * @internal-use — substrate only; see `ports/subscription.ts`. Domain
+   * ports do not expose reactive callback methods to consumers (ARCH-LOCK-1).
+   */
+  subscribe<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"query", "public", TArgs, TOutput>, args: TArgs, callback: (snapshot: Snapshot<TOutput>) => void): Effect.Effect<Unsubscribe, ConvexCallError>;
+}
+//#endregion
+//#region src/ports/credentials.d.ts
+type CreateApplicationInput = {
+  readonly authUserId: AuthUserId$1;
+  readonly name: string;
+  readonly allowedOrigins: readonly AllowedOrigin[];
+};
+type MintKeyInput = {
+  readonly applicationId: AppId;
+  readonly authUserId: AuthUserId$1;
+};
+type RotateKeyInput = {
+  readonly keyId: PublishableKeyId;
+  readonly authUserId: AuthUserId$1;
+  readonly graceMs: DurationMs;
+};
+type RevokeKeyInput = {
+  readonly keyId: PublishableKeyId;
+  readonly authUserId: AuthUserId$1;
+};
+type RotateKeyResult = {
+  readonly active: PublishableKeyRecord;
+  readonly retired: PublishableKeyRecord;
+};
+declare const CredentialsError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "CredentialsError";
+} & Readonly<A>;
+declare class CredentialsError extends CredentialsError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface CredentialsPort {
+  listApplications(authUserId: AuthUserId$1): Effect.Effect<readonly DeveloperApplication[], CredentialsError>;
+  createApplication(input: CreateApplicationInput): Effect.Effect<DeveloperApplication, CredentialsError>;
+  mintPublishableKey(input: MintKeyInput): Effect.Effect<PublishableKeyRecord, CredentialsError>;
+  rotatePublishableKey(input: RotateKeyInput): Effect.Effect<RotateKeyResult, CredentialsError>;
+  revokePublishableKey(input: RevokeKeyInput): Effect.Effect<void, CredentialsError>;
+}
+//#endregion
+//#region src/ports/identity.d.ts
+type CreateIdentityInput = {
+  readonly authUserId: AuthUserId$1;
+  readonly email: Email;
+  readonly displayName?: string;
+  readonly country?: CountryCode;
+};
+type UpdateIdentityInput = {
+  readonly authUserId: AuthUserId$1;
+  readonly displayName?: string;
+  readonly country?: CountryCode;
+};
+declare const IdentityError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "IdentityError";
+} & Readonly<A>;
+declare class IdentityError extends IdentityError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface IdentityPort {
+  loadByAuthUserId(authUserId: AuthUserId$1): Effect.Effect<Profile$1 | null, IdentityError, never>;
+  create(input: CreateIdentityInput): Effect.Effect<Profile$1, IdentityError, never>;
+  update(input: UpdateIdentityInput): Effect.Effect<Profile$1, IdentityError, never>;
+}
+//#endregion
+//#region src/ports/smart-account.d.ts
+type ProvisionInput = {
+  readonly authUserId: AuthUserId$1;
+  readonly signerAddress: Address$1;
+  readonly chainId: ChainId;
+};
+/**
+ * Input to `SmartAccountPort.confirmDeployment` (#161 · γ-B).
+ *
+ * The SDK provides evidence pointers; the backend is the oracle for
+ * `deployedAt`. `evidence.deployedAt` does NOT exist by schema (see
+ * `SafeDeploymentEvidence`) — the backend derives `deployedAt` from
+ * the on-chain receipt block via `eth_getBlockByNumber`.
+ *
+ * Precheck path: `evidence.userOpHash` omitted; backend scans
+ * `SafeProxyFactory.ProxyCreation(safeAddress, _)` via `eth_getLogs`.
+ *
+ * Real-userOp path: `evidence.userOpHash` populated; backend calls
+ * `eth_getUserOperationReceipt(userOpHash)` to re-verify and derive.
+ */
+type ConfirmDeploymentInput = {
+  readonly authUserId: AuthUserId$1;
+  readonly chainId: ChainId;
+  readonly safeAddress: Address$1;
+  readonly evidence: SafeDeploymentEvidence;
+  /**
+   * Optional live-E2E correlation id. This does not prove deployment; the
+   * backend still re-verifies chain evidence and only mirrors this branded
+   * id onto telemetry for PostHog run joins.
+   */
+  readonly telemetryRunId?: RunId;
+};
+/** Opaque wire form of the backend-built deployment UserOperation (hex strings). */
+type DeploymentUserOpFields = {
+  readonly sender: string;
+  readonly nonce: string;
+  readonly factory: string;
+  readonly factoryData: string;
+  readonly callData: string;
+  readonly callGasLimit: string;
+  readonly verificationGasLimit: string;
+  readonly preVerificationGas: string;
+  readonly maxFeePerGas: string;
+  readonly maxPriorityFeePerGas: string;
+  readonly paymaster: string;
+  readonly paymasterVerificationGasLimit: string;
+  readonly paymasterPostOpGasLimit: string;
+  readonly paymasterData: string;
+};
+/** Input to `SmartAccountPort.deployPrepare` (backend-orchestrated-deploy.md · #289). */
+type DeployPrepareInput = {
+  readonly authUserId: AuthUserId$1;
+  readonly chainId: ChainId;
+  readonly telemetryRunId?: RunId;
+};
+/** Backend-built deployment UserOp + the EIP-712 SafeOp digest the CapxulSigner signs. */
+type DeployPrepareResult = {
+  readonly digest: Hex;
+  readonly safeAddress: Address$1;
+  readonly userOp: DeploymentUserOpFields;
+};
+/** Input to `SmartAccountPort.deploySubmit` — the consumer-signed deployment UserOp. */
+type DeploySubmitInput = {
+  readonly authUserId: AuthUserId$1;
+  readonly chainId: ChainId;
+  readonly userOp: DeploymentUserOpFields;
+  readonly signature: Hex;
+  readonly telemetryRunId?: RunId;
+};
+declare const SmartAccountError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "SmartAccountError";
+} & Readonly<A>;
+declare class SmartAccountError extends SmartAccountError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface SmartAccountPort {
+  loadByAuthUserId(authUserId: AuthUserId$1): Effect.Effect<SmartAccount$1 | null, SmartAccountError, never>;
+  loadBySmartAccountAddress(address: Address$1): Effect.Effect<SmartAccount$1 | null, SmartAccountError, never>;
+  provision(input: ProvisionInput): Effect.Effect<SmartAccount$1, SmartAccountError, never>;
+  /**
+   * Persist on-chain Safe-deployment evidence. The backend re-verifies
+   * the evidence against chain state and derives `deployedAt` from the
+   * receipt block's timestamp. Returns the updated `SmartAccount` row.
+   *
+   * γ-B trust model: the SDK supplies evidence pointers only. The
+   * backend is the SOLE oracle for `deployedAt` — see
+   * `docs/canon/ports/smart-account.md`.
+   */
+  confirmDeployment(input: ConfirmDeploymentInput): Effect.Effect<SmartAccount$1, SmartAccountError, never>;
+  /**
+   * Build + gas-fill + paymaster-sponsor the deployment UserOperation
+   * server-side and return the EIP-712 `SafeOp` digest for the consumer's
+   * `CapxulSigner` to sign. The client never holds RPC, a gas policy, or a
+   * bundler — see `docs/canon/decisions/backend-orchestrated-deploy.md`.
+   */
+  deployPrepare(input: DeployPrepareInput): Effect.Effect<DeployPrepareResult, SmartAccountError, never>;
+  /**
+   * Submit the signed deployment UserOperation through the bundler and confirm
+   * `deployedAt` on-chain (absorbing the `confirmDeployment` verify path).
+   * Returns the updated `SmartAccount` row.
+   */
+  deploySubmit(input: DeploySubmitInput): Effect.Effect<SmartAccount$1, SmartAccountError, never>;
+}
+//#endregion
+//#region src/ports/account-read.d.ts
+type ReadAccountBalanceInput = {
+  readonly chainId: ChainId;
+};
+type FundFromFaucetInput = {
+  readonly chainId: ChainId;
+  readonly amount: Money$1;
+};
+type FundFromFaucetResult = {
+  readonly txHash: string;
+};
+declare const AccountReadError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "AccountReadError";
+} & Readonly<A>;
+declare class AccountReadError extends AccountReadError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+/**
+ * Logical Account money read (M2 Slice S1a). Joins the `accounts` row with a
+ * live RPC `balanceOf` pull; the adapter lifts wire integers to `Money`.
+ */
+interface AccountReadPort {
+  readBalance(input: ReadAccountBalanceInput): Effect.Effect<Account$1, AccountReadError, never>;
+  fundFromFaucet(input: FundFromFaucetInput): Effect.Effect<FundFromFaucetResult, AccountReadError, never>;
+}
+//#endregion
+//#region src/ports/sub-account.d.ts
+declare const SubAccountError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "SubAccountError";
+} & Readonly<A>;
+declare class SubAccountError extends SubAccountError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+type CreateSubAccountInput = {
+  readonly accountId: AccountId;
+  readonly name: string;
+};
+type SubAccountIdInput = {
+  readonly subAccountId: SubAccountId$1;
+};
+type RenameSubAccountInput = {
+  readonly subAccountId: SubAccountId$1;
+  readonly name: string;
+};
+/**
+ * A `transfer` endpoint is either the Account's MAIN balance (the remainder
+ * left over after every sub-account is funded — never a stored row) or a
+ * specific sub-account, addressed by its `SubAccountId` (canon
+ * `account-balance-model.md` §5, §12).
+ */
+type TransferEndpoint = "main" | SubAccountId$1;
+/**
+ * Move money between two of the SAME Account's balances (canon §12). The
+ * backend resolves the Account from auth (v1 = one Account per user), so the
+ * input carries no `accountId` — only the from/to endpoints and the `Money`
+ * amount. One verb covers money in (`main → sub`), money out (`sub → main`),
+ * and `sub → sub`.
+ */
+type TransferInput = {
+  readonly from: TransferEndpoint;
+  readonly to: TransferEndpoint;
+  readonly amount: Money$1;
+};
+/**
+ * Result of a `transfer`: the recomputed `available` (`balanceOf − Σ`), plus
+ * the updated source/destination sub-account rows. An endpoint that is `"main"`
+ * has no stored row, so its slot is `null`.
+ */
+type TransferResult = {
+  readonly available: Money$1;
+  readonly from: SubAccount$1 | null;
+  readonly to: SubAccount$1 | null;
+};
+interface SubAccountPort {
+  create(input: CreateSubAccountInput): Effect.Effect<SubAccount$1, SubAccountError, never>;
+  get(input: SubAccountIdInput): Effect.Effect<SubAccount$1 | null, SubAccountError, never>;
+  list(input: {
+    readonly accountId: AccountId;
+  }): Effect.Effect<readonly SubAccount$1[], SubAccountError, never>;
+  rename(input: RenameSubAccountInput): Effect.Effect<SubAccount$1, SubAccountError, never>;
+  delete(input: SubAccountIdInput): Effect.Effect<void, SubAccountError, never>;
+  transfer(input: TransferInput): Effect.Effect<TransferResult, SubAccountError, never>;
+}
+//#endregion
+//#region src/flows/types.d.ts
+/**
+ * The full 14-port bundle that `assembleCapxulClient` (slice 5) consumes.
+ *
+ * Each per-flow factory in slices 2-4 takes a narrowed subset, e.g.
+ * `AuthFlowPorts = Pick<FlowPorts, "authClient" | "authCache" | "clock" | "telemetry">`.
+ * Slice 1 ships only the union; per Q6 each per-flow slice declares its
+ * own narrowed `Pick<FlowPorts, ...>` inside its flow file.
+ */
+interface FlowPorts {
+  readonly authClient: AuthClientPort;
+  readonly authCache: AuthCachePort;
+  readonly identity: IdentityPort;
+  readonly smartAccount: SmartAccountPort;
+  readonly accountRead: AccountReadPort;
+  readonly subAccount: SubAccountPort;
+  readonly credentials: CredentialsPort;
+  readonly bootstrap: BootstrapPort;
+  readonly evmSigner: EvmSignerPort;
+  readonly clock: ClockPort;
+  readonly env: EnvPort;
+  readonly telemetry: TelemetryPort;
+  readonly transport: TransportPort;
+  readonly convexCall: ConvexCallPort;
+}
+/**
+ * Pre-resolved external signer + signed proof. The UI obtains this
+ * BEFORE prompting the user to verify (MetaMask popup, hardware-wallet
+ * confirm, etc.), then the consumer sends it to AuthFlow via the
+ * `SET_SIGNER` event between `idle` and `verifying`. AuthFlow assigns
+ * to `context.externalSigner` on the SET_SIGNER self-loop in either
+ * `idle` or `otp_requested`, then flows the value through to the
+ * invoked ProvisioningFlow child via `invoke.input.externalSigner`.
+ * The child's `branching` state inspects `context.signerAddress`
+ * (derived from `input.externalSigner?.address`) to route through
+ * `register_external` instead of `mint_openfort` when present.
+ *
+ * The signer's lifetime is the authenticated session — `clearAuthContext`
+ * (on SIGN_OUT → idle) and `clearErrorAndContext` (on error → RESET →
+ * idle) both wipe `context.externalSigner`. A subsequent sign-in cycle
+ * begins fresh; the consumer re-sends SET_SIGNER (or omits it for the
+ * Openfort fallback path). Reference:
+ * `docs/decisions/stage-3-external-signer-lifecycle.html` (Option C,
+ * locked 2026-05-17, supersedes the earlier factory-input shape).
+ *
+ * `signedProof` is an EIP-191 signed message proving the user controls
+ * the address. ProvisioningFlow does not verify the proof itself —
+ * verification is delegated to the indexer registration in Stage 4 when
+ * `IndexerPort.registerSafe` lands. For Stage 3 the field is recorded
+ * verbatim for trace fidelity.
+ *
+ * The type lives in this flows/types module (not in `@capxul/types`)
+ * because it is a flow-shape composite — `Address` + a freeform proof
+ * string — not a primitive brand. Per the Stage 3 plan's vocabulary
+ * convention, flow-shape composites stay co-located with their flow.
+ */
+interface ExternalSigner {
+  readonly address: Address$1;
+  readonly signedProof: string;
+}
+//#endregion
+//#region src/client/auth.d.ts
+interface SignInOptions {
+  readonly signal?: AbortSignal;
+}
+type AuthMethodOptions = SignInOptions;
+interface AuthMethods {
+  canSendOtp(input: {
+    readonly email: string;
+  }, options?: AuthMethodOptions): Promise<CapxulResult<CanSendOtpStatus>>;
+  signIn(input: {
+    readonly email: string;
+  }, options?: SignInOptions): Promise<CapxulResult<{
+    readonly sessionId: string;
+    readonly expiresAt: number;
+  }>>;
+  verifyOtp(input: {
+    readonly email: string;
+    readonly code: string;
+    readonly signer?: ExternalSigner;
+  }, options?: AuthMethodOptions): Promise<CapxulResult<Session>>;
+  signOut(options?: AuthMethodOptions): Promise<CapxulResult<void>>;
+  getSession(options?: AuthMethodOptions): Promise<CapxulResult<Session | null>>;
+}
+//#endregion
+//#region src/client/smart-account.d.ts
+interface SmartAccountMethods {
+  loadCurrent(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<SmartAccount | null>>;
+  provision(input?: {
+    readonly externalSigner?: ExternalSigner;
+  }): Promise<CapxulResult<SmartAccount>>;
+}
+//#endregion
+//#region src/client/identity.d.ts
+interface IdentityMethods {
+  loadCurrent(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Profile | null>>;
+}
+//#endregion
+//#region src/client/account.d.ts
+type AccountStatus = {
+  readonly status: "notAuthenticated";
+} | {
+  readonly status: "accountRequired";
+  readonly requirement: AccountRequirement;
+  readonly chainId: number;
+} | {
+  readonly status: "accountProviderReady";
+  readonly requirement: AccountRequirement;
+  readonly chainId: number;
+  readonly source: AccountProviderSource;
+  readonly signerAddress: Address$1;
+} | {
+  readonly status: "accountPrepared";
+  readonly requirement: AccountRequirement;
+  readonly account: SmartAccount$1;
+  readonly deployment: {
+    readonly status: "counterfactual";
+  };
+} | {
+  readonly status: "accountReady";
+  readonly requirement: AccountRequirement;
+  readonly account: SmartAccount$1 | null;
+  readonly deployment: {
+    readonly status: "counterfactual";
+  } | {
+    readonly status: "deployed";
+    readonly deployedAt: SmartAccount$1["deployedAt"];
+  };
+};
+/**
+ * Public consumer-facing surface (issue #159 · AC1+AC3). Exactly two
+ * methods. `provision` and `deploySafe` are intentionally NOT here —
+ * they are advanced/testing-only and will live on
+ * `client._internal.account` when sibling issue #161 lands. Per
+ * `docs/canon/rules/public-surface.md`, the narrowing is enforced at
+ * both the type level (the `keyof AccountMethods` extract is exactly
+ * `"getStatus" | "ensureReady"`) and at runtime (the bundle returned
+ * here has those two own-keys and nothing else).
+ *
+ * Per `docs/canon/conventions/flow-internal-substrate.md`, the
+ * `AccountStatus` discriminant — including the variants this slice can
+ * only reach via `getStatus` (e.g. `accountPrepared`) — is the durable
+ * shape consumers depend on. Sibling #161 will extend `ensureReady` to
+ * advance the ladder past `accountProviderReady` and from
+ * `accountPrepared` to `accountReady(deployed)`; until then, the type
+ * surface is stable and the runtime fixed-point is documented.
+ */
+interface AccountMethods {
+  /**
+   * Read-only status inspection. Safe to call anytime.
+   */
+  getStatus(): Promise<CapxulResult<AccountStatus>>;
+  /**
+   * Normal app entry point. Idempotent.
+   *
+   * Per #161, `ensureReady` now advances the ladder upward:
+   *   - `accountProviderReady → accountReady` via `_internal.account.provision`
+   *   - `accountPrepared → accountReady(deployed)` via
+   *     `_internal.account.deploySafe` (when `requirement === "deployed"`
+   *     and deploy deps are configured).
+   */
+  ensureReady(): Promise<CapxulResult<AccountStatus>>;
+  /**
+   * Internal advanced surface (#161 · AC1). Reserved for the rebuild's
+   * own `ensureReady` upward transitions and for testing harnesses;
+   * consumers MUST NOT depend on this in production. Tagged
+   * `@internal-use` per `.claude/rules/flow-internal-substrate.md`.
+   *
+   * @internal-use
+   */
+  readonly _internal: AccountInternalSurface;
+}
+/**
+ * Internal `provision` + `deploySafe` arms exposed at
+ * `client._internal.account` (#161). Each returns `Promise<CapxulResult<T>>`
+ * with the same error catalog the public methods use.
+ *
+ * @internal-use
+ */
+interface AccountInternalSurface {
+  provision(): Promise<CapxulResult<SmartAccount$1>>;
+  deploySafe(): Promise<CapxulResult<SmartAccount$1>>;
+}
+//#endregion
+//#region src/client/accounts.d.ts
+interface AccountsMethods {
+  read(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Account$1>>;
+}
+/**
+ * Faucet surface (dev-only). Deliberately OFF the public `AccountsMethods`;
+ * reachable only via `client._internal.accounts` (production-surface-policy.md).
+ * The reference CLI uses it behind a test-env gate — consumers never see `fund`.
+ */
+interface AccountsFaucetMethods {
+  fund(amount: Money$1, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<{
+    readonly txHash: string;
+  }>>;
+}
+//#endregion
+//#region src/client/sub-accounts.d.ts
+interface SubAccountsMethods {
+  create(accountId: AccountId, input: {
+    readonly name: string;
+  }, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<SubAccount$1>>;
+  get(subAccountId: SubAccountId$1, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<SubAccount$1 | null>>;
+  list(accountId: AccountId, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly SubAccount$1[]>>;
+  rename(subAccountId: SubAccountId$1, name: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<SubAccount$1>>;
+  delete(subAccountId: SubAccountId$1, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<void>>;
+  transfer(input: TransferInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<TransferResult>>;
+}
+//#endregion
+//#region src/client/org-spend-gate.d.ts
+type SpendGateRecipients = "anyone" | readonly Address$1[];
+type SpendGateSubAccountScope = {
+  readonly scope: "all";
+} | {
+  readonly scope: "only";
+  readonly subAccountIds: readonly SubAccountId$1[];
+};
+//#endregion
+//#region src/ports/org.d.ts
+type CreateOrgPortInput = {
+  readonly input: CreateOrgInput;
+};
+type ReadOrgTreasuryInput = {
+  readonly orgId: OrgId$1;
+};
+type ListOrgsInput = Record<never, never>;
+type ListOrgRolesInput = {
+  readonly orgId: OrgId$1;
+};
+type ListOrgMembersInput = {
+  readonly orgId: OrgId$1;
+};
+type InviteOrgMemberInput = {
+  readonly orgId: OrgId$1;
+  readonly input: InviteMemberInput;
+};
+type DetectPendingOrgInvitationsInput = Record<never, never>;
+type DetectPendingOrgInvitationsResult$1 = {
+  readonly matched: readonly OrgId$1[];
+};
+type DeployOrgRolesInput = {
+  readonly orgId: OrgId$1;
+};
+type OrgRolesDeploymentResult = {
+  readonly orgId: OrgId$1;
+  readonly roles: readonly RoleView[];
+};
+type GrantOrgRoleInput = {
+  readonly orgId: OrgId$1;
+  readonly input: AssignRoleInput;
+};
+type RevokeOrgRoleInput = {
+  readonly orgId: OrgId$1;
+  readonly input: RemoveMemberInput;
+};
+type OrgSpendAuthority = {
+  readonly activeMember: boolean;
+  readonly subAccountBalanceRaw: string;
+  readonly recipients: SpendGateRecipients;
+  readonly subAccounts: SpendGateSubAccountScope;
+  readonly perTxCapRaw?: string | null;
+  readonly perDayCapRaw?: string | null;
+  readonly spentTodayRaw?: string | null;
+  readonly role?: string;
+};
+type ReadOrgSpendAuthorityInput = {
+  readonly orgId: OrgId$1;
+  readonly input: OrgSpendInput;
+  readonly amountRaw: string;
+};
+type SubmitOrgSpendInput = {
+  readonly orgId: OrgId$1;
+  readonly input: OrgSpendInput;
+  readonly amountRaw: string;
+  readonly authority: OrgSpendAuthority;
+};
+declare const OrgError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "OrgError";
+} & Readonly<A>;
+declare class OrgError extends OrgError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+/**
+ * Live org seam. `createOrg` runs the SDK-orchestrated deploy (D10) and returns
+ * the created `OrgView` (its treasury is the real M2 `Account` over the Org
+ * Safe — $0 at creation, D3). `readTreasury` pulls the org's Account via RPC
+ * `balanceOf` (D3). `listOrgs` lists the orgs the authenticated user belongs to.
+ */
+interface OrgPort {
+  createOrg(input: CreateOrgPortInput): Effect.Effect<OrgView, OrgError, never>;
+  readTreasury(input: ReadOrgTreasuryInput): Effect.Effect<Account$1, OrgError, never>;
+  listOrgs(input: ListOrgsInput): Effect.Effect<readonly OrgView[], OrgError, never>;
+  listRoles(input: ListOrgRolesInput): Effect.Effect<readonly RoleView[], OrgError, never>;
+  listMembers(input: ListOrgMembersInput): Effect.Effect<readonly MemberView[], OrgError, never>;
+  inviteMember(input: InviteOrgMemberInput): Effect.Effect<MemberView, OrgError, never>;
+  detectAndAcceptPendingInvitations(input: DetectPendingOrgInvitationsInput): Effect.Effect<DetectPendingOrgInvitationsResult$1, OrgError, never>;
+}
+interface OrgRolesDeploymentPort {
+  deployRoles(input: DeployOrgRolesInput): Effect.Effect<OrgRolesDeploymentResult, OrgError, never>;
+  grantRole(input: GrantOrgRoleInput): Effect.Effect<MemberView, OrgError, never>;
+  revokeRole(input: RevokeOrgRoleInput): Effect.Effect<void, OrgError, never>;
+}
+interface OrgSpendPort {
+  readSpendAuthority(input: ReadOrgSpendAuthorityInput): Effect.Effect<OrgSpendAuthority, OrgError, never>;
+  submitSpend(input: SubmitOrgSpendInput): Effect.Effect<OrgSpendResult, OrgError, never>;
+}
+//#endregion
+//#region src/client/org.d.ts
+/**
+ * A member's lifecycle status (D9 — unified `Member` with status
+ * `pending | active | revoked | expired`). `pending` = invited (incl. a
+ * non-user emailed into existence) but not yet a provisioned member with an
+ * on-chain grant; `active` = on-chain role granted; `revoked` = offboarded
+ * (on-chain REVOKE fired); `expired` = pending invitation timed out.
+ */
+type MemberStatus = "pending" | "pending_safe" | "pending_grant" | "active" | "revoked" | "expired";
+/**
+ * One Org you belong to (canon §C1 "Org list" — name, role, balance).
+ * `role` is the member's role label within THIS org. `treasury` is the M2
+ * `Account` over the Org Safe (D3). `handle` is the globally-unique,
+ * normalized org handle (D10a). Pure record of brand-typed fields — not a
+ * brand.
+ */
+type OrgView = {
+  readonly id: OrgId$1;
+  readonly name: string;
+  readonly handle: string;
+  readonly safeAddress: Address$1; /** The viewing member's own role label within this org. */
+  readonly role: string; /** The Org treasury — the real M2 Account over the Org Safe (D3). */
+  readonly treasury: Account$1;
+};
+/**
+ * One member of an Org (canon §C1 "Members" — name/email, role, status; D7/D8).
+ * `personalSafeAddress` is the member-identity key (D7 — Safe-as-identity); it
+ * is `null` while the member is still `pending` (emailed into existence but not
+ * yet provisioned a personal Safe). `email` is the universal entry point (D8).
+ */
+type MemberView = {
+  readonly orgId: OrgId$1;
+  readonly email: Email;
+  readonly name: string | null; /** Member-identity key (D7). `null` until the invitee provisions a Safe. */
+  readonly personalSafeAddress: Address$1 | null; /** The member's role label (maps deterministically to the on-chain `roleKey`, D9). */
+  readonly role: string;
+  readonly roleKey: RoleKey$1 | null;
+  readonly status: MemberStatus;
+  readonly grantTxHash: string | null;
+  readonly revokeTxHash: string | null;
+};
+/**
+ * A role's on-chain Level-1 spend cap (D4/D5 — physically enforced via Zodiac
+ * Roles + Allowance). `perTx` / `perDay` are `Money`; `toRecipients` scopes the
+ * allowed recipient set. Omitting a field means "unbounded on that axis"
+ * (the Owner role).
+ */
+type RoleSpendCap = {
+  readonly perTx?: Money$1;
+  readonly perDay?: Money$1;
+  readonly toRecipients?: "anyone" | readonly Address$1[];
+};
+/**
+ * The Capxul-owned Role DSL definition (D4). `label` becomes the sticky
+ * bytes32 `roleKey` on-chain. `spend` compiles to Level-1 on-chain Zodiac
+ * conditions; `subAccounts` + `canManage*` compile to Level-2 off-chain Convex
+ * guards (D5).
+ */
+type RoleDefinition = {
+  readonly label: string;
+  readonly spend?: RoleSpendCap;
+  readonly subAccounts?: {
+    readonly scope: "all" | readonly SubAccountId$1[];
+  };
+  readonly canManageMembers?: boolean;
+  readonly canManageRoles?: boolean;
+};
+/**
+ * One role seeded on an Org (canon §C1 "Roles" — label + caps; D4/D6).
+ * `roleKey` is the on-chain bytes32 role key derived from the label. `definition`
+ * is the full Role DSL entry.
+ */
+type RoleView = {
+  readonly orgId: OrgId$1;
+  readonly label: string;
+  readonly roleKey: RoleKey$1;
+  readonly definition: RoleDefinition;
+};
+/** Built-in role templates that seed a new Org at creation (D6). */
+type OrgTemplate = "Solo" | "Startup" | "Custom";
+/**
+ * Input to `capxul.createOrg` (S1, D10a, D14). `name` is the display name;
+ * `handle` is the globally-unique normalized handle (`^[a-z0-9-]{3,32}$`, D10a);
+ * `template` seeds the initial role set (D6); `country` is stored unvalidated
+ * (D14 — KYB deferred). For `template: "Custom"`, `roles` carries the authored
+ * `RoleDefinition[]`.
+ */
+type CreateOrgInput = {
+  readonly name: string;
+  readonly handle: string;
+  readonly template: OrgTemplate;
+  readonly country?: string;
+  readonly roles?: readonly RoleDefinition[];
+};
+/**
+ * Input to `org(orgId).invite` (S3, D8). Email is the universal entry point —
+ * inviting an address that is not yet a Capxul user auto-creates a `pending`
+ * membership that resolves on sign-in (the virality loop). `role` names the
+ * role label the invitee is granted on accept.
+ */
+type InviteMemberInput = {
+  readonly email: string;
+  readonly role: string;
+};
+/**
+ * Input to `org(orgId).removeMember` (S3, D8). Keyed on the member's personal
+ * Safe address (D7 — Safe-as-identity). Drives the on-chain REVOKE + Convex
+ * mirror.
+ */
+type RemoveMemberInput = {
+  readonly memberSafeAddress: Address$1;
+};
+/**
+ * Input to `org(orgId).assignRole` (S3, D7/D9). Keyed on the member's personal
+ * Safe address (D7). Drives the on-chain GRANT + Convex mirror; the `role`
+ * label maps deterministically to the on-chain `roleKey`.
+ */
+type AssignRoleInput = {
+  readonly memberSafeAddress: Address$1;
+  readonly role: string;
+};
+/**
+ * Input to `org(orgId).spend` (S4, capstone, D5). A member spends `amount` from
+ * a scoped sub-account `from` to `to`, gated Level 1 (Zodiac cap) + Level 2
+ * (envelope scope/balance). One UserOp: signer → personal Safe → Org Roles
+ * modifier → `CapxulPayments.send`.
+ */
+type OrgSpendInput = {
+  /** The sub-account (envelope) the spend draws from (Level-2 scope, D5). */readonly from: SubAccountId$1;
+  readonly to: Address$1;
+  readonly amount: Money$1;
+};
+/** Result of a settled Org spend — the settling transaction hash (S4). */
+type OrgSpendResult = {
+  readonly txHash: string;
+};
+type DetectPendingOrgInvitationsResult = {
+  readonly matched: readonly OrgId$1[];
+};
+/**
+ * Entity-scoped Org method bundle, returned by `capxul.org(orgId)`. Every
+ * method names the entity implicitly via the closed-over `orgId` (D13 — no
+ * stateful active context). `treasury()` returns the real M2 `Account` over
+ * the Org Safe (D3).
+ */
+interface OrgScopedMethods {
+  /** The Org treasury — the real M2 Account over the Org Safe (D3). */
+  treasury(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Account$1>>;
+  members(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly MemberView[]>>;
+  roles(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly RoleView[]>>;
+  deployRoles(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly RoleView[]>>;
+  invite(input: InviteMemberInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<MemberView>>;
+  removeMember(input: RemoveMemberInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<void>>;
+  assignRole(input: AssignRoleInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<MemberView>>;
+  spend(input: OrgSpendInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<OrgSpendResult>>;
+}
+type OrgsMethod = {
+  (options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly OrgView[]>>;
+  detectAndAcceptPendingInvitations(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<DetectPendingOrgInvitationsResult>>;
+};
+/**
+ * Top-level Org method bundle, exposed at `client.org` / `client.orgs` /
+ * `client.createOrg`. `org(orgId)` resolves the entity-scoped bundle (D13).
+ */
+interface OrgMethods {
+  createOrg(input: CreateOrgInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<OrgView>>;
+  readonly orgs: OrgsMethod;
+  /** Resolve the entity-scoped bundle for a specific Org (D13). */
+  org(orgId: OrgId$1): OrgScopedMethods;
+}
+//#endregion
+//#region src/client/create-capxul-client.d.ts
+interface CapxulClient {
+  readonly auth: AuthMethods;
+  readonly smartAccount: SmartAccountMethods;
+  readonly identity: IdentityMethods;
+  /**
+   * Consumer-facing account readiness surface (issue #159 · AC1+AC3).
+   * Exactly `getStatus` + `ensureReady`; the `_internal.account`
+   * namespace with `provision` + `deploySafe` lands in sibling #161.
+   */
+  readonly account: AccountMethods;
+  /**
+   * Consumer-facing logical Account money read (M2 Slice S1a · #265).
+   * Returns `{ balance, available }` as `Money` — never wei or token units.
+   */
+  readonly accounts: AccountsMethods;
+  /** Sub-account lifecycle (M2 Slice S2a · #267). Transfer lands in S2b. */
+  readonly subAccounts: SubAccountsMethods;
+  /**
+   * Organization domain surface (canon `org-domain-model.md` §C2/§C3, D13).
+   * `createOrg(input)` creates an Org; `orgs()` lists the Orgs you belong to;
+   * `org(orgId)` resolves the entity-scoped bundle (treasury / members / roles
+   * / invite / removeMember / assignRole / spend). Explicit entity scoping —
+   * NO stateful active context (D13). RED until the S1→S4 slices fill it.
+   */
+  readonly createOrg: OrgMethods["createOrg"];
+  readonly orgs: OrgMethods["orgs"];
+  readonly org: OrgMethods["org"];
+  /** Resolved bootstrap for this client instance (chain, auth URLs, etc.). */
+  readonly bootstrap: BootstrapResolution;
+  /**
+   * Internal observation namespace. Consumers MUST NOT drive the actor
+   * directly — use the method bundles instead.
+   *
+   * @internal-use
+   */
+  readonly _internal: {
+    readonly authActor: AuthFlowObserver;
+    /**
+     * Dev-only faucet bundle (production-surface-policy.md). `fund` lives here,
+     * NOT on the public `client.accounts` surface.
+     */
+    readonly accounts: AccountsFaucetMethods;
+    readonly close?: () => Promise<void>;
+  };
+}
+interface CreateCapxulClientInput {
+  /**
+   * The 12-port `FlowPorts` bundle. The factory narrows this to the
+   * 3-port AuthFlow subset (`authClient`, `clock`, `telemetry`) for
+   * the flow internally, and uses additional ports (`identity`,
+   * `smartAccount`) for the method bundles.
+   */
+  readonly ports: FlowPorts;
+  /**
+   * Bootstrap resolution for this client instance. The factory closes over
+   * `bootstrap.chainId` internally; consumers do not pass a standalone
+   * chainId and no method boundary accepts one.
+   */
+  readonly bootstrap: BootstrapResolution;
+  /**
+   * Optional AuthCachePort. When omitted, `detectAuthCacheAdapter()` selects
+   * the appropriate per-environment adapter (Browser/FileSystem/InMemory).
+   */
+  readonly authCache?: AuthCachePort;
+  /**
+   * Optional AbortSignal reserved for callers that coordinate client lifetime.
+   */
+  readonly signal?: AbortSignal;
+  /**
+   * OTP TTL window in ms. Default 300_000 (5 min).
+   */
+  readonly otpTtlMs?: number;
+  /**
+   * Optional per-call timeout for invoked auth requests.
+   */
+  readonly invokeTimeoutMs?: number;
+  /**
+   * Init-time account readiness target (issue #159 · AC4). The factory
+   * closes over this so `client.account.{getStatus,ensureReady}` don't
+   * need to take a per-call requirement arg. REQUIRED — there is no
+   * hidden default. Consumers building flows that never need a smart
+   * account pass `"none"`; flows that want a counterfactual deposit
+   * address pass `"counterfactual"`; flows that need an on-chain Safe
+   * pass `"deployed"` (deploy path lands in sibling #161).
+   */
+  readonly requirement: AccountRequirement;
+  /**
+   * Consumer-held signer (backend-orchestrated-deploy.md). Required for
+   * `requirement: "deployed"` flows: `provision` reads `getAddress()` and the
+   * deploy path signs the backend's SafeOp digest via `signUserOpHash()`. The
+   * backend orchestrates build + gas + paymaster + submit — the client never
+   * holds an RPC URL, a gas-sponsorship policy, or a bundler.
+   */
+  readonly signer?: CapxulSigner;
+  /**
+   * Optional live Org-deploy lane (canon D10 SDK-orchestrated Org Safe deploy +
+   * D3 RPC treasury). When supplied, `client.createOrg` / `org(id).treasury`
+   * run the live path (real deploy + on-chain balance); when omitted, the
+   * hermetic `$0` path runs (a fresh Org has no on-chain funds). The adapter
+   * that CONSTRUCTS this port (deployer key + RPC + authenticated Convex seam)
+   * is wired by the CLI deploy-stack; the factory only threads it through.
+   */
+  readonly orgDeploymentPort?: OrgPort;
+  /** Locked D6 data-port name. Prefer over `orgDeploymentPort` in new code. */
+  readonly orgPort?: OrgPort;
+  /** S2 deploy/grant/revoke port. S2 uses deploy; S3 adds grant/revoke. */
+  readonly orgRolesDeploymentPort?: OrgRolesDeploymentPort;
+  /** S4 treasury-spend authority + submit port. */
+  readonly orgSpendPort?: OrgSpendPort;
+  readonly orgDeploymentConfig?: SafeDeploymentConfig;
+}
+declare function assembleCapxulClient(input: CreateCapxulClientInput): CapxulClient;
+//#endregion
+//#region src/production.d.ts
+type ProductionRuntime = "browser" | "node";
+type ProductionAdapterClose = () => Promise<void>;
+interface ProductionAdapterInput {
+  readonly publishableKey: string;
+  readonly origin?: string;
+  readonly bootstrapBaseUrl?: string;
+  readonly runtime?: ProductionRuntime;
+  readonly authCache?: AuthCachePort;
+  readonly telemetry?: TelemetryPort;
+  readonly evmSigner?: EvmSignerPort;
+  readonly fetch?: typeof fetch;
+  readonly signal?: AbortSignal;
+  readonly otpTtlMs?: number;
+  readonly invokeTimeoutMs?: number;
+  /**
+   * Init-time account readiness target (issue #159 · AC4). Threaded into
+   * `assembleCapxulClient` so `client.account.{getStatus,ensureReady}` reflect
+   * the consumer's chosen requirement. Optional — defaults to `"none"` (SDK
+   * publish readiness · I3) so `createCapxulClient({ publishableKey })` works
+   * with no account lane.
+   */
+  readonly requirement?: AccountRequirement;
+  /**
+   * Consumer-held signer (backend-orchestrated-deploy.md). Required for
+   * `requirement: "deployed"` flows: `provision` reads `getAddress()` and the
+   * deploy path signs the backend's SafeOp digest via `signUserOpHash()`. The
+   * backend orchestrates build + gas + paymaster + submit — the client never
+   * holds an RPC URL, a gas-sponsorship policy, or a bundler.
+   */
+  readonly signer?: CapxulSigner;
+  /**
+   * Optional live Org-deploy lane (canon D10 SDK-orchestrated Org Safe deploy +
+   * D3 RPC treasury). Supplied as a FACTORY rather than a pre-built port because
+   * the live `OrgPort` (`LiveOrgDeploymentAdapter`) talks to the backend
+   * `org.createOrg` mutation through the SAME authenticated Convex seam the rest
+   * of the client uses (`tokenProvider → getConvexJwt → ConvexCallAdapter`),
+   * which only exists AFTER `createProductionAdapters` resolves bootstrap. The
+   * factory receives that resolved `ConvexCallPort` and returns the port; the
+   * CLI deploy-stack builds the factory from the deployer key + RPC (the same
+   * env/signer as `safeDeploymentPort`). When omitted, the hermetic `$0` path
+   * runs (a fresh Org has no on-chain funds).
+   */
+  readonly orgDeploymentPortFactory?: (convex: ConvexCallPort) => OrgPort & OrgRolesDeploymentPort & OrgSpendPort;
+  readonly orgDeploymentConfig?: SafeDeploymentConfig;
+}
+interface ProductionAdapters {
+  readonly ports: FlowPorts;
+  readonly bootstrap: BootstrapResolution;
+  readonly close: ProductionAdapterClose;
+}
+declare function createCapxulClient(input: ProductionAdapterInput): Promise<CapxulResult<CapxulClient>>;
+//#endregion
+export { type Account, type AccountMethods, type AccountProvider, type AccountProviderSource, type AccountRequirement, type AccountStatus, type AccountsMethods, type Address, type AssignRoleInput, type AuthMethods, type AuthSession, type AuthUserId, type CapxulClient, type CapxulResult, type CapxulSigner, type CreateCapxulClientInput, type CreateOrgInput, type DetectPendingOrgInvitationsResult, type Eip1193Provider, type Eip1193RequestProvider, type IdentityMethods, type InviteMemberInput, type MemberStatus, type MemberView, type Money, type OrgId, type OrgMethods, type OrgScopedMethods, type OrgSpendInput, type OrgSpendResult, type OrgTemplate, type OrgView, type ProductionAdapterClose, type ProductionAdapterInput, type ProductionAdapters, type ProductionRuntime, type Profile, type RemoveMemberInput, type RoleDefinition, type RoleKey, type RoleSpendCap, type RoleView, type Session, type SmartAccount, type SmartAccountMethods, type SubAccount, type SubAccountId, type SubAccountsMethods, type TransferEndpoint, type TransferInput, type TransferResult, assembleCapxulClient, createCapxulClient, eip1193AccountProvider, injectedWalletSigner, localPrivateKeyAccountProvider, openfortEmbeddedAccountProvider };
+//# sourceMappingURL=index.d.mts.map