@capxul/sdk 0.2.0-alpha.3 → 0.2.0-alpha.5

package/dist/index.mjs

@@ -0,0 +1,4740 @@
+import { n as BrowserAuthCacheAdapter, o as AuthCachePortTag, t as InMemoryAuthCacheAdapter } from "./InMemoryAuthCacheAdapter-BK-B_ERB.mjs";
+import { Context, Data, Deferred, Duration, Effect, Either, Exit, Layer, Ref, Request, Scope } from "effect";
+import { Machine } from "@effect/experimental";
+import { CapxulError, Errors, USDX_CURRENCY, USDX_DECIMALS, compileOrgRoleDefinitions, decodeConvexError, isCapxulError, orgRoleKeyForLabel, orgRoleTemplateDefinitions } from "@capxul/config";
+import { toAccountId, toAddress, toAllowedOrigin, toAnonymousDistinctId, toAppId, toAuthUserId, toChainId, toCountryCode, toCurrencyCode, toDurationMs, toEmail, toEpochMs, toEpochSeconds, toJwtToken, toKycTier, toOrgId, toPublishableKey, toPublishableKeyId, toRoleKey, toSessionToken, toSubAccountId } from "@capxul/types";
+import { redactTelemetryProps } from "@capxul/observability";
+import { formatUnits, isHex, keccak256, parseUnits } from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+import { Schema, TreeFormatter } from "@effect/schema";
+import { BootstrapEnvelope } from "@capxul/wire";
+import { ConvexClient } from "convex/browser";
+import { getFunctionName, makeFunctionReference } from "convex/server";
+//#region src/ports/auth-client.ts
+var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
+var AuthClientPortTag = class extends Context.Tag("@capxul/sdk/ports/AuthClientPort")() {};
+//#endregion
+//#region src/ports/clock.ts
+var ClockError = class extends Data.TaggedError("ClockError") {};
+var ClockPortTag = class extends Context.Tag("@capxul/sdk/ports/ClockPort")() {};
+//#endregion
+//#region src/ports/telemetry.ts
+var TelemetryPortTag = class extends Context.Tag("@capxul/sdk/ports/TelemetryPort")() {};
+//#endregion
+//#region src/flows/auth.ts
+var AuthFlowError = class extends Data.TaggedError("AuthFlowError") {};
+var RequestOtpRequest = class extends Request.TaggedClass("RequestOtp") {};
+var VerifyOtpRequest = class extends Request.TaggedClass("VerifyOtp") {};
+var GetSessionRequest = class extends Request.TaggedClass("GetSession") {};
+var SignOutRequest = class extends Request.TaggedClass("SignOut") {};
+var ResumeOtpEntryRequest = class extends Request.TaggedClass("ResumeOtpEntry") {};
+var ResetAuthFlowRequest = class extends Request.TaggedClass("ResetAuthFlow") {};
+var CommitAuthFlowRequest = class extends Request.TaggedClass("CommitAuthFlow") {};
+const DEFAULT_OTP_TTL_MS = 3e5;
+const ACTOR_MACHINE = /* @__PURE__ */ new WeakMap();
+const RUNTIME_CONTROLS = /* @__PURE__ */ new WeakMap();
+const AUTH_FLOW_TRANSITION_TABLE = {
+	idle: {
+		valid: [
+			"RequestOtp",
+			"GetSession",
+			"ResetAuthFlow"
+		],
+		invalid: ["VerifyOtp WRONG_STATE", "SignOut WRONG_STATE"]
+	},
+	sending_otp: {
+		valid: ["ResetAuthFlow", "SignOut"],
+		invalid: [
+			"RequestOtp WRONG_STATE",
+			"VerifyOtp WRONG_STATE",
+			"GetSession WRONG_STATE"
+		]
+	},
+	otp_requested: {
+		valid: [
+			"RequestOtp",
+			"VerifyOtp",
+			"GetSession",
+			"SignOut",
+			"ResetAuthFlow"
+		],
+		invalid: []
+	},
+	verifying: {
+		valid: ["ResetAuthFlow", "SignOut"],
+		invalid: [
+			"RequestOtp WRONG_STATE",
+			"VerifyOtp WRONG_STATE",
+			"GetSession WRONG_STATE"
+		]
+	},
+	authenticated: {
+		valid: [
+			"GetSession",
+			"SignOut",
+			"ResetAuthFlow"
+		],
+		invalid: ["RequestOtp WRONG_STATE", "VerifyOtp WRONG_STATE"]
+	},
+	signing_out: {
+		valid: ["ResetAuthFlow"],
+		invalid: [
+			"RequestOtp WRONG_STATE",
+			"VerifyOtp WRONG_STATE",
+			"GetSession WRONG_STATE",
+			"SignOut WRONG_STATE"
+		]
+	},
+	error: {
+		valid: [
+			"ResetAuthFlow",
+			"RequestOtp",
+			"GetSession",
+			"ResumeOtpEntry"
+		],
+		invalid: ["VerifyOtp WRONG_STATE", "SignOut WRONG_STATE"]
+	}
+};
+function tuple(first, second) {
+	return [first, second];
+}
+function normalizeInput(input) {
+	return { otpTtlMs: input.otpTtlMs ?? DEFAULT_OTP_TTL_MS };
+}
+function publicInput(input) {
+	return { otpTtlMs: input.otpTtlMs };
+}
+function initialContext() {
+	return {
+		state: "idle",
+		email: null,
+		session: null,
+		otpRequestedAt: null,
+		error: null
+	};
+}
+function createAuthFlowMachine() {
+	return Machine.makeWith()((input) => {
+		const normalized = normalizeInput(input);
+		const bootInput = publicInput(normalized);
+		const control = runtimeControl(input);
+		return Machine.procedures.make(initialContext(), { identifier: `AuthFlow:${normalized.otpTtlMs}` }).pipe(Machine.procedures.addPrivate()("CommitAuthFlow", ({ request }) => Effect.succeed(tuple(tuple(request.input, request.context), request.context))), Machine.procedures.add()("RequestOtp", (context) => Effect.gen(function* () {
+			const email = assertEmailWellFormed(context.request.email);
+			if (!canTransition(context.state.state, "RequestOtp")) return yield* Effect.fail(wrongState("RequestOtp", context.state.state));
+			const anonDistinctId = context.state.anonDistinctId ?? makeAnonymousDistinctId();
+			const transient = {
+				state: "sending_otp",
+				email,
+				session: null,
+				otpRequestedAt: null,
+				anonDistinctId,
+				error: null
+			};
+			return yield* completeRequest(context.unsafeSendAwait, context.deferred, bootInput, control, requestOtpCompletion(email, anonDistinctId, context.request.options), (failure) => failureContext(failure, {
+				email: null,
+				session: null,
+				otpRequestedAt: null,
+				anonDistinctId
+			})).pipe(context.forkReplaceWith("auth-flow:request", transient), Effect.as(tuple(Machine.NoReply, transient)));
+		})), Machine.procedures.add()("VerifyOtp", (context) => Effect.gen(function* () {
+			const email = assertEmailWellFormed(context.request.email);
+			if (!/^\d{6}$/.test(context.request.otp)) return yield* Effect.fail(new AuthFlowError({
+				operation: "verifyOtp",
+				state: context.state.state,
+				publicError: Errors.invalidInput("otp", "must be a six digit code"),
+				publicCode: "INVALID_INPUT"
+			}));
+			if (!canTransition(context.state.state, "VerifyOtp")) return yield* Effect.fail(wrongState("VerifyOtp", context.state.state));
+			const current = context.state;
+			const anonDistinctId = current.anonDistinctId ?? makeAnonymousDistinctId();
+			const now = yield* (yield* ClockPortTag).now.pipe(Effect.mapError((cause) => new AuthFlowError({
+				operation: "verifyOtp",
+				state: current.state,
+				publicError: Errors.providerError("clock", "now", cause),
+				publicCode: "PROVIDER_ERROR",
+				cause
+			})));
+			if (Number(now) - Number(current.otpRequestedAt) > normalized.otpTtlMs) {
+				const failure = new AuthFlowError({
+					operation: "verifyOtp",
+					state: "otp_requested",
+					publicError: Errors.otpExpired({ expiredAt: Number(current.otpRequestedAt) + normalized.otpTtlMs }),
+					publicCode: "OTP_EXPIRED"
+				});
+				yield* emitTelemetry({
+					name: "auth_otp_expired",
+					props: { email_domain: emailDomain$1(current.email ?? email) }
+				});
+				return yield* Effect.fail(failure);
+			}
+			const transient = {
+				state: "verifying",
+				email,
+				session: null,
+				otpRequestedAt: current.otpRequestedAt,
+				anonDistinctId,
+				error: null
+			};
+			return yield* completeRequest(context.unsafeSendAwait, context.deferred, bootInput, control, verifyOtpCompletion(email, context.request.otp, anonDistinctId, context.request.options), (failure) => failureContext(failure, {
+				email,
+				session: null,
+				otpRequestedAt: current.otpRequestedAt,
+				anonDistinctId
+			})).pipe(context.forkReplaceWith("auth-flow:request", transient), Effect.as(tuple(Machine.NoReply, transient)));
+		})), Machine.procedures.add()("GetSession", (context) => Effect.gen(function* () {
+			if (!canTransition(context.state.state, "GetSession")) return yield* Effect.fail(wrongState("GetSession", context.state.state));
+			return yield* completeRequest(context.unsafeSendAwait, context.deferred, bootInput, control, getSessionCompletion(context.request.options), (failure) => failureContext(failure, {
+				email: context.state.email,
+				session: context.state.session,
+				otpRequestedAt: context.state.otpRequestedAt,
+				...context.state.anonDistinctId === void 0 ? {} : { anonDistinctId: context.state.anonDistinctId }
+			})).pipe(context.forkReplaceWith("auth-flow:request", context.state), Effect.as(tuple(Machine.NoReply, context.state)));
+		})), Machine.procedures.add()("SignOut", (context) => Effect.gen(function* () {
+			if (!canTransition(context.state.state, "SignOut")) return yield* Effect.fail(wrongState("SignOut", context.state.state));
+			const transient = {
+				state: "signing_out",
+				email: context.state.email,
+				session: context.state.session,
+				otpRequestedAt: null,
+				error: null
+			};
+			return yield* completeRequest(context.unsafeSendAwait, context.deferred, bootInput, control, signOutCompletion(context.request.options), () => initialContext()).pipe(context.forkReplaceWith("auth-flow:request", transient), Effect.as(tuple(Machine.NoReply, transient)));
+		})), Machine.procedures.add()("ResumeOtpEntry", (context) => Effect.gen(function* () {
+			if (!canTransition(context.state.state, "ResumeOtpEntry")) return yield* Effect.fail(wrongState("ResumeOtpEntry", context.state.state));
+			const current = context.state;
+			if (current.email === null || current.otpRequestedAt === null) return yield* Effect.fail(wrongState("ResumeOtpEntry", context.state.state));
+			const now = yield* (yield* ClockPortTag).now.pipe(Effect.mapError((cause) => new AuthFlowError({
+				operation: "verifyOtp",
+				state: current.state,
+				publicError: Errors.providerError("clock", "now", cause),
+				publicCode: "PROVIDER_ERROR",
+				cause
+			})));
+			if (Number(now) - Number(current.otpRequestedAt) > normalized.otpTtlMs) {
+				const failure = new AuthFlowError({
+					operation: "verifyOtp",
+					state: "error",
+					publicError: Errors.otpExpired({ expiredAt: Number(current.otpRequestedAt) + normalized.otpTtlMs }),
+					publicCode: "OTP_EXPIRED"
+				});
+				yield* emitTelemetry({
+					name: "auth_otp_expired",
+					props: { email_domain: emailDomain$1(current.email) }
+				});
+				return yield* Effect.fail(failure);
+			}
+			const restored = {
+				state: "otp_requested",
+				email: current.email,
+				session: null,
+				otpRequestedAt: current.otpRequestedAt,
+				...current.anonDistinctId === void 0 ? {} : { anonDistinctId: current.anonDistinctId },
+				error: null
+			};
+			return tuple(tuple(bootInput, restored), restored);
+		})), Machine.procedures.add()("ResetAuthFlow", () => {
+			const reset = initialContext();
+			return Effect.succeed(tuple(tuple(bootInput, reset), reset));
+		}));
+	});
+}
+function bootAuthFlow(machine, input) {
+	return Effect.gen(function* () {
+		const bootInput = publicInput(normalizeInput(input));
+		const scope = yield* Scope.make();
+		const control = { stopped: false };
+		const actor = yield* Machine.boot(machine, withRuntimeControl(bootInput, control)).pipe(Scope.extend(scope));
+		const statusRef = yield* Ref.make("active");
+		const stopDeferred = yield* Deferred.make();
+		const flowActor = {
+			input: bootInput,
+			getSnapshot() {
+				const context = Effect.runSync(actor.get);
+				const status = Effect.runSync(Ref.get(statusRef));
+				return {
+					value: context.state,
+					context,
+					status
+				};
+			},
+			stop() {
+				control.stopped = true;
+				Effect.runSync(Ref.set(statusRef, "stopped"));
+				Effect.runSync(Deferred.succeed(stopDeferred, void 0));
+				Effect.runFork(Scope.close(scope, Exit.void));
+			},
+			send(request) {
+				return Ref.get(statusRef).pipe(Effect.flatMap((status) => status === "active" ? actor.send(toMachineRequest(request)).pipe(Effect.raceFirst(Deferred.await(stopDeferred).pipe(Effect.flatMap(() => Effect.fail(new AuthFlowError({
+					operation: "transition",
+					state: Effect.runSync(actor.get).state,
+					publicError: Errors.cancelled({ operation: "authFlow.send" }),
+					publicCode: "CANCELLED"
+				})))))) : Effect.fail(new AuthFlowError({
+					operation: "transition",
+					state: Effect.runSync(actor.get).state,
+					publicError: Errors.cancelled({ operation: "authFlow.send" }),
+					publicCode: "CANCELLED"
+				}))), Effect.tapError((failure) => failure.publicCode === "OTP_EXPIRED" ? Effect.void : emitTelemetry({
+					name: "auth_failed",
+					props: {
+						auth_type: "otp",
+						reason: failure.publicCode
+					}
+				})));
+			}
+		};
+		ACTOR_MACHINE.set(flowActor, actor);
+		return flowActor;
+	});
+}
+function sendAuthFlowRequest(actor, request) {
+	return actor.send(request);
+}
+function assertEmailWellFormed(email) {
+	return toEmail(email);
+}
+function toMachineRequest(request) {
+	switch (request._tag) {
+		case "RequestOtp": return new RequestOtpRequest(optionalOptions({ email: request.email }, request.options));
+		case "VerifyOtp": return new VerifyOtpRequest(optionalOptions({
+			email: request.email,
+			otp: request.otp
+		}, request.options));
+		case "GetSession": return new GetSessionRequest(optionalOptions({}, request.options));
+		case "SignOut": return new SignOutRequest(optionalOptions({}, request.options));
+		case "ResumeOtpEntry": return new ResumeOtpEntryRequest();
+		case "ResetAuthFlow": return new ResetAuthFlowRequest();
+	}
+}
+function optionalOptions(base, options) {
+	return options === void 0 ? base : {
+		...base,
+		options
+	};
+}
+function requestOtpCompletion(email, anonDistinctId, options) {
+	return Effect.gen(function* () {
+		yield* withAuthFlowTimeout((yield* AuthClientPortTag).sendOtp({ email }, authClientOptions(options)), "requestOtp", "sending_otp", options).pipe(Effect.mapError((error) => authClientFailure("requestOtp", "sending_otp", error)));
+		const now = yield* (yield* ClockPortTag).now.pipe(Effect.mapError((cause) => new AuthFlowError({
+			operation: "requestOtp",
+			state: "sending_otp",
+			publicError: Errors.providerError("clock", "now", cause),
+			publicCode: "PROVIDER_ERROR",
+			cause
+		})));
+		yield* emitTelemetry({
+			name: "auth_otp_requested",
+			props: { email_domain: emailDomain$1(email) }
+		});
+		return {
+			state: "otp_requested",
+			email,
+			session: null,
+			otpRequestedAt: now,
+			anonDistinctId,
+			error: null
+		};
+	});
+}
+function verifyOtpCompletion(email, otp, anonDistinctId, options) {
+	return Effect.gen(function* () {
+		const session = yield* withAuthFlowTimeout((yield* AuthClientPortTag).verifyOtp({
+			email,
+			otp
+		}, authClientOptions(options)), "verifyOtp", "verifying", options).pipe(Effect.mapError((error) => authClientFailure("verifyOtp", "verifying", error)));
+		yield* emitTelemetry({
+			name: "auth_verified",
+			props: { auth_type: "otp" }
+		});
+		yield* identifyTelemetry({
+			distinctId: session.authUserId,
+			anonDistinctId,
+			traits: { email_domain: emailDomain$1(session.email) }
+		});
+		return {
+			state: "authenticated",
+			email: session.email,
+			session,
+			otpRequestedAt: null,
+			error: null
+		};
+	});
+}
+function getSessionCompletion(options) {
+	return Effect.gen(function* () {
+		const session = yield* withAuthFlowTimeout((yield* AuthClientPortTag).getSession(authClientOptions(options)), "getSession", "idle", options).pipe(Effect.mapError((error) => authClientFailure("getSession", "idle", error)));
+		if (session === null) return initialContext();
+		return {
+			state: "authenticated",
+			email: session.email,
+			session,
+			otpRequestedAt: null,
+			error: null
+		};
+	});
+}
+function signOutCompletion(options) {
+	return Effect.gen(function* () {
+		yield* withAuthFlowTimeout((yield* AuthClientPortTag).signOut(authClientOptions(options)), "signOut", "signing_out", options).pipe(Effect.mapError((error) => authClientFailure("signOut", "signing_out", error)));
+		yield* emitTelemetry({ name: "auth_signed_out" });
+		yield* resetTelemetry();
+		return initialContext();
+	});
+}
+function withAuthFlowTimeout(effect, operation, state, options) {
+	const timeoutMs = options?.timeoutMs;
+	if (timeoutMs === void 0) return effect;
+	return effect.pipe(Effect.timeoutFail({
+		duration: Duration.millis(timeoutMs),
+		onTimeout: () => new AuthFlowError({
+			operation,
+			state,
+			publicError: Errors.providerTimeout("auth-flow", operation, timeoutMs),
+			publicCode: "PROVIDER_ERROR"
+		})
+	}));
+}
+function authClientOptions(options) {
+	if (options?.signal === void 0) return void 0;
+	return { signal: options.signal };
+}
+function authClientFailure(operation, state, error) {
+	if (error instanceof AuthFlowError) return error;
+	return toAuthFlowError(operation, state, error);
+}
+function completeRequest(commit, deferred, input, control, effect, toFailureContext) {
+	return effect.pipe(Effect.either, Effect.flatMap((result) => {
+		const stopped = stoppedFailure();
+		if (control.stopped) return commit(new CommitAuthFlowRequest({
+			input,
+			context: toFailureContext(stopped)
+		})).pipe(Effect.zipRight(Deferred.fail(deferred, stopped)));
+		if (result._tag === "Right") return commit(new CommitAuthFlowRequest({
+			input,
+			context: result.right
+		})).pipe(Effect.flatMap((snapshot) => Deferred.succeed(deferred, snapshot)));
+		return commit(new CommitAuthFlowRequest({
+			input,
+			context: toFailureContext(result.left)
+		})).pipe(Effect.zipRight(Deferred.fail(deferred, result.left)));
+	}), Effect.catchAllDefect((cause) => {
+		const failure = new AuthFlowError({
+			operation: "transition",
+			state: "error",
+			publicError: Errors.unknown(cause),
+			publicCode: "UNKNOWN",
+			cause
+		});
+		return commit(new CommitAuthFlowRequest({
+			input,
+			context: toFailureContext(failure)
+		})).pipe(Effect.zipRight(Deferred.fail(deferred, failure)));
+	}), Effect.onInterrupt(() => commit(new CommitAuthFlowRequest({
+		input,
+		context: toFailureContext(stoppedFailure())
+	})).pipe(Effect.zipRight(Deferred.fail(deferred, stoppedFailure())))));
+}
+function stoppedFailure() {
+	return new AuthFlowError({
+		operation: "transition",
+		state: "error",
+		publicError: Errors.cancelled({ operation: "authFlow.request" }),
+		publicCode: "CANCELLED"
+	});
+}
+function withRuntimeControl(input, control) {
+	const runtimeInput = { ...input };
+	RUNTIME_CONTROLS.set(runtimeInput, control);
+	return runtimeInput;
+}
+function runtimeControl(input) {
+	return RUNTIME_CONTROLS.get(input) ?? { stopped: false };
+}
+function failureContext(failure, preserved) {
+	return {
+		state: "error",
+		email: preserved.email,
+		session: preserved.session,
+		otpRequestedAt: preserved.otpRequestedAt,
+		...preserved.anonDistinctId === void 0 ? {} : { anonDistinctId: preserved.anonDistinctId },
+		error: failure.publicError
+	};
+}
+function canTransition(state, request) {
+	return AUTH_FLOW_TRANSITION_TABLE[state].valid.includes(request);
+}
+function wrongState(request, state) {
+	return new AuthFlowError({
+		operation: "transition",
+		state,
+		publicError: Errors.wrongState({
+			method: request,
+			currentState: state,
+			validStates: AUTH_FLOW_TRANSITION_TABLE[state].valid
+		}),
+		publicCode: "WRONG_STATE"
+	});
+}
+function toAuthFlowError(operation, state, error) {
+	const publicError = toCapxulError(operation, error);
+	return new AuthFlowError({
+		operation,
+		state,
+		publicError,
+		publicCode: publicError.code,
+		cause: error
+	});
+}
+function toCapxulError(operation, error) {
+	if (error.cause instanceof CapxulError) return error.cause;
+	if (operation === "requestOtp" && error.kind === "provider") return Errors.emailDeliveryFailed("provider rejected OTP request");
+	return Errors.providerError("auth-client", operation, /* @__PURE__ */ new Error("auth-client provider failure"));
+}
+function emitTelemetry(event) {
+	return Effect.gen(function* () {
+		yield* (yield* TelemetryPortTag).emit(event).pipe(Effect.catchAllDefect(() => Effect.void), Effect.catchAll(() => Effect.void));
+	});
+}
+function identifyTelemetry(input) {
+	return Effect.gen(function* () {
+		yield* (yield* TelemetryPortTag).identify(input).pipe(Effect.catchAllDefect(() => Effect.void), Effect.catchAll(() => Effect.void));
+	});
+}
+function resetTelemetry() {
+	return Effect.gen(function* () {
+		yield* (yield* TelemetryPortTag).reset().pipe(Effect.catchAllDefect(() => Effect.void), Effect.catchAll(() => Effect.void));
+	});
+}
+function makeAnonymousDistinctId() {
+	return toAnonymousDistinctId(`anon_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`}`);
+}
+function emailDomain$1(email) {
+	const [, domain = "unknown"] = email.split("@");
+	return domain;
+}
+//#endregion
+//#region src/client/capxul-deps.ts
+/** The single Context tag the atoms + public methods both resolve. */
+var CapxulDepsTag = class extends Context.Tag("@capxul/sdk/CapxulDeps")() {};
+/** Wrap a bundle as the `Layer<CapxulDepsTag>` the React provider consumes. */
+function capxulDepsLayer(deps) {
+	return Layer.succeed(CapxulDepsTag, deps);
+}
+/**
+* Build the 3-port AuthFlow layer FROM the bundle. The single home for this
+* construction — `auth.ts` imports it for its per-method Effect runners, and
+* each program (`getSessionProgram`, …) provides it internally so the actor
+* send's `AuthClientPortTag | ClockPortTag | TelemetryPortTag` requirement is
+* discharged and the program's external requirement stays `CapxulDepsTag`.
+*/
+function authFlowLayer(deps) {
+	return Layer.mergeAll(Layer.succeed(AuthClientPortTag, deps.authClient), Layer.succeed(ClockPortTag, deps.clock), Layer.succeed(TelemetryPortTag, deps.telemetry ?? noopTelemetryPort()));
+}
+function noopTelemetryPort() {
+	return {
+		emit: () => Effect.void,
+		identify: () => Effect.void,
+		group: () => Effect.void,
+		reset: () => Effect.void
+	};
+}
+function hasMachineActor(actor) {
+	return typeof actor.send === "function";
+}
+/**
+* getSession as a single Effect requiring ONLY `CapxulDepsTag`. Faithful
+* transcription of the current public method body (auth.ts:250-281): the
+* leading `signal.aborted` pre-check stays in the thin method wrapper, while a
+* non-aborted signal is forwarded through the actor request options. The
+* `Effect.provide(authFlowLayer(deps))` on the inner actor send
+* is what narrows R from
+* `CapxulDepsTag | AuthClientPortTag | ClockPortTag | TelemetryPortTag` down to
+* `CapxulDepsTag` — the load-bearing structural property the explicit
+* annotation asserts.
+*/
+const getSessionProgramWithOptions = (options) => Effect.gen(function* () {
+	const deps = yield* CapxulDepsTag;
+	const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "getSession", e)));
+	if (cached !== null) return cached;
+	if (!hasMachineActor(deps.actor)) {
+		const existingError = deps.actor.getSnapshot().context.error;
+		if (existingError !== null) return yield* Effect.fail(existingError);
+	}
+	const refreshed = yield* sendAuthFlowRequest(deps.actor, {
+		_tag: "GetSession",
+		...depsRequestOptions(deps, options?.signal)
+	}).pipe(Effect.provide(authFlowLayer(deps)), Effect.mapError((failure) => failure.publicError));
+	if (refreshed[1].session !== null) return refreshed[1].session;
+	const session = deps.actor.getSnapshot().context.session;
+	if (session !== null) return session;
+	return null;
+});
+getSessionProgramWithOptions();
+/**
+* verifyOtp as a single Effect requiring ONLY `CapxulDepsTag` (PRD #209, slice
+* 3 — parallels {@link getSessionProgram}). Faithful transcription of the
+* current public method body (auth.ts:145-201): the leading `signal.aborted`
+* pre-check stays in the thin method wrapper, while non-aborted per-request
+* signals and the dep-level `invokeTimeoutMs` knob are forwarded. The
+* `Effect.provide(authFlowLayer(
+* deps))` on the inner actor send narrows R from
+* `CapxulDepsTag | AuthClientPortTag | ClockPortTag | TelemetryPortTag` down to
+* `CapxulDepsTag`.
+*/
+function verifyOtpProgram(input, options) {
+	return Effect.gen(function* () {
+		const deps = yield* CapxulDepsTag;
+		if (!/^\d{6}$/.test(input.code)) return yield* Effect.fail(Errors.invalidInput("otp", "must be 6 digits"));
+		let email;
+		try {
+			email = toEmail(input.email);
+		} catch (err) {
+			return yield* Effect.fail(err instanceof CapxulError ? err : Errors.invalidInput("email", "invalid email"));
+		}
+		let value = String(deps.actor.getSnapshot().value);
+		if (value === "error") {
+			yield* sendAuthFlowRequest(deps.actor, { _tag: "ResumeOtpEntry" }).pipe(Effect.provide(authFlowLayer(deps)), Effect.mapError((failure) => failure.publicError));
+			value = "otp_requested";
+		} else if (value !== "otp_requested") return yield* Effect.fail(Errors.wrongState({
+			method: "verifyOtp",
+			currentState: value,
+			validStates: ["otp_requested"]
+		}));
+		if (!hasMachineActor(deps.actor)) {
+			const next = deps.actor.getSnapshot();
+			if (String(next.value) === "error") return yield* Effect.fail(next.context.error ?? Errors.unknown({ method: "verifyOtp" }));
+		}
+		const session = yield* sendAuthFlowRequest(deps.actor, {
+			_tag: "VerifyOtp",
+			email,
+			otp: input.code,
+			...depsRequestOptions(deps, options?.signal)
+		}).pipe(Effect.provide(authFlowLayer(deps)), Effect.map((snapshot) => snapshot[1].session), Effect.mapError((failure) => failure.publicError));
+		if (session === null) return yield* Effect.fail(Errors.notAuthenticated());
+		yield* deps.authCache.setSession(session).pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "setSession", e)));
+		return session;
+	});
+}
+/**
+* Deps-only request-option builder. The verbatim deps half of `auth.ts`'s
+* former `authRequestOptions(deps, signal)` — the bundle-level
+* `invokeTimeoutMs` and per-request `signal` are forwarded into the actor
+* request options when present.
+*/
+function depsRequestOptions(deps, signal) {
+	if (deps.invokeTimeoutMs === void 0 && signal === void 0) return {};
+	return { options: {
+		...deps.invokeTimeoutMs === void 0 ? {} : { timeoutMs: deps.invokeTimeoutMs },
+		...signal === void 0 ? {} : { signal }
+	} };
+}
+/**
+* Clear the local auth cache (session then JWT), mapping each failure into a
+* typed `CapxulError`. Effect transcription of `auth.ts`'s former
+* `clearAuthCache` helper: `clearSession` runs first and short-circuits the
+* JWT clear on failure, matching the original's sequential `if (!ok) return`.
+*/
+function clearAuthCacheEffect(authCache) {
+	return authCache.clearSession.pipe(Effect.mapError((cause) => Errors.providerError("auth-cache", "clearSession", cause)), Effect.zipRight(authCache.clearJwt.pipe(Effect.mapError((cause) => Errors.providerError("auth-cache", "clearJwt", cause)))));
+}
+function cryptoRandomId() {
+	const bytes = new Uint8Array(8);
+	if (typeof globalThis.crypto !== "undefined" && typeof globalThis.crypto.getRandomValues === "function") globalThis.crypto.getRandomValues(bytes);
+	else for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+const canSendOtpProgram = (input, options) => Effect.gen(function* () {
+	const deps = yield* CapxulDepsTag;
+	const email = yield* Effect.try({
+		try: () => toEmail(input.email),
+		catch: (err) => err instanceof CapxulError ? err : Errors.invalidInput("email", "invalid email")
+	});
+	return yield* deps.authClient.canSendOtp({ email }, options?.signal === void 0 ? void 0 : { signal: options.signal }).pipe(Effect.mapError((failure) => failure.cause instanceof CapxulError ? failure.cause : Errors.providerError("auth-client", "canSendOtp", failure.cause)));
+});
+/**
+* `signIn` as a single Effect requiring ONLY `CapxulDepsTag`. Faithful
+* transcription of the former public method body: brand the email, enforce the
+* idle/otp_requested/error precondition, auto-RESET out of error, drive
+* `RequestOtp`, then mint the tracking Result from the clock. Each actor send
+* provides `authFlowLayer(deps)` INTERNALLY so external R stays `CapxulDepsTag`.
+*/
+const signInProgram = (input, options) => Effect.gen(function* () {
+	const deps = yield* CapxulDepsTag;
+	const email = yield* Effect.try({
+		try: () => toEmail(input.email),
+		catch: (err) => err instanceof CapxulError ? err : Errors.invalidInput("email", "invalid email")
+	});
+	const value = String(deps.actor.getSnapshot().value);
+	if (value !== "idle" && value !== "otp_requested" && value !== "error") return yield* Effect.fail(Errors.wrongState({
+		method: "signIn",
+		currentState: value,
+		validStates: [
+			"idle",
+			"otp_requested",
+			"error"
+		]
+	}));
+	if (value === "error") yield* sendAuthFlowRequest(deps.actor, {
+		_tag: "ResetAuthFlow",
+		...depsRequestOptions(deps, options?.signal)
+	}).pipe(Effect.provide(authFlowLayer(deps)), Effect.mapError((failure) => failure.publicError));
+	yield* sendAuthFlowRequest(deps.actor, {
+		_tag: "RequestOtp",
+		email,
+		...depsRequestOptions(deps, options?.signal)
+	}).pipe(Effect.provide(authFlowLayer(deps)), Effect.mapError((failure) => failure.publicError));
+	const now = yield* deps.clock.now.pipe(Effect.mapError((cause) => Errors.providerError("clock", "now", cause)));
+	return {
+		sessionId: cryptoRandomId(),
+		expiresAt: now + (deps.otpTtlMs ?? 3e5)
+	};
+});
+/**
+* `signOut` as a single Effect requiring ONLY `CapxulDepsTag`. Faithful
+* transcription of the former public method body: WRONG_STATE from idle,
+* reset-and-clear from error, otherwise drive `SignOut` and clear the local
+* cache REGARDLESS of the wire outcome. `Effect.either` captures the `SignOut`
+* result without short-circuiting so the cache clear always runs — a cache
+* clear failure then takes precedence over the wire error, matching the former
+* `if (!cacheClear.ok) return cacheClear; return result`.
+*/
+const signOutProgramWithOptions = (options) => Effect.gen(function* () {
+	const deps = yield* CapxulDepsTag;
+	const value = String(deps.actor.getSnapshot().value);
+	if (value === "idle") return yield* Effect.fail(Errors.wrongState({
+		method: "signOut",
+		currentState: value,
+		validStates: [
+			"authenticated",
+			"otp_requested",
+			"verifying",
+			"sending_otp",
+			"error"
+		]
+	}));
+	if (value === "error") {
+		yield* sendAuthFlowRequest(deps.actor, {
+			_tag: "ResetAuthFlow",
+			...depsRequestOptions(deps, options?.signal)
+		}).pipe(Effect.provide(authFlowLayer(deps)), Effect.mapError((failure) => failure.publicError));
+		yield* clearAuthCacheEffect(deps.authCache);
+		return;
+	}
+	const signOutResult = yield* sendAuthFlowRequest(deps.actor, {
+		_tag: "SignOut",
+		...depsRequestOptions(deps, options?.signal)
+	}).pipe(Effect.provide(authFlowLayer(deps)), Effect.mapError((failure) => failure.publicError), Effect.either);
+	yield* clearAuthCacheEffect(deps.authCache);
+	if (Either.isLeft(signOutResult)) return yield* Effect.fail(signOutResult.left);
+});
+signOutProgramWithOptions();
+//#endregion
+//#region src/client/to-capxul-result.ts
+async function toCapxulResult(program, layer) {
+	const result = await Effect.runPromise(program.pipe(Effect.provide(layer), Effect.catchAllDefect((defect) => Effect.fail(Errors.unknown(defect))), Effect.either));
+	if (Either.isLeft(result)) return {
+		ok: false,
+		error: result.left
+	};
+	return {
+		ok: true,
+		value: result.right
+	};
+}
+//#endregion
+//#region src/client/auth.ts
+function makeAuthMethods(deps) {
+	return {
+		async canSendOtp(input, options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "canSendOtp" })
+			};
+			return toCapxulResult(canSendOtpProgram(input, options), capxulDepsLayer(deps));
+		},
+		async signIn(input, options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "signIn" })
+			};
+			return toCapxulResult(signInProgram(input, options), capxulDepsLayer(deps));
+		},
+		async verifyOtp(input, options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "verifyOtp" })
+			};
+			const result = await toCapxulResult(verifyOtpProgram(input, options), capxulDepsLayer(deps));
+			if (result.ok) {
+				const afterVerifyOtp = deps.afterVerifyOtp;
+				if (afterVerifyOtp !== void 0) Promise.resolve().then(() => afterVerifyOtp()).catch(() => void 0);
+			}
+			return result;
+		},
+		async signOut(options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "signOut" })
+			};
+			return toCapxulResult(signOutProgramWithOptions(options), capxulDepsLayer(deps));
+		},
+		async getSession(options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "getSession" })
+			};
+			return toCapxulResult(getSessionProgramWithOptions(options), capxulDepsLayer(deps));
+		}
+	};
+}
+//#endregion
+//#region src/client/_shared/provisioning-telemetry.ts
+async function emitProvisioningTelemetry(telemetry, smartAccount) {
+	if (telemetry === void 0) return;
+	await Effect.runPromise(telemetry.emit({
+		name: "provisioning_safe_created",
+		props: { safe_address: smartAccount.smartAccountAddress }
+	}).pipe(Effect.catchAll((cause) => Effect.sync(() => reportProvisioningTelemetryFailure("error", smartAccount, cause))), Effect.catchAllDefect((cause) => Effect.sync(() => reportProvisioningTelemetryFailure("defect", smartAccount, cause)))));
+}
+function reportProvisioningTelemetryFailure(kind, smartAccount, cause) {
+	if (!isProvisioningTelemetryDebugEnabled()) return;
+	globalThis.console?.warn?.("[capxul] provisioning telemetry dropped", {
+		kind,
+		safeAddress: smartAccount.smartAccountAddress,
+		cause
+	});
+}
+function isProvisioningTelemetryDebugEnabled() {
+	return globalThis.process?.env?.CAPXUL_DEBUG_TELEMETRY === "1";
+}
+//#endregion
+//#region src/client/smart-account-deps.ts
+/** The single Context tag the `smartAccount.*` methods resolve. */
+var SmartAccountDepsTag = class extends Context.Tag("@capxul/sdk/SmartAccountDeps")() {};
+/** Wrap a bundle as the `Layer<SmartAccountDepsTag>` the React provider consumes. */
+function smartAccountDepsLayer(deps) {
+	return Layer.succeed(SmartAccountDepsTag, deps);
+}
+/**
+* `smartAccount.loadCurrent` as a single Effect requiring ONLY
+* `SmartAccountDepsTag`. Faithful transcription of the current public method
+* body (`smart-account.ts`): snapshot the actor for the session authUserId,
+* append the optional sentinel fallback, and return the first non-null
+* `SmartAccountPort` row. The leading `signal.aborted` pre-check stays in the
+* thin method wrapper. Port failures narrow to their `publicError`.
+*/
+const loadSmartAccountProgram = Effect.gen(function* () {
+	const deps = yield* SmartAccountDepsTag;
+	const snap = deps.actor.getSnapshot();
+	const fallback = deps.sessionAuthUserIdFallback ?? null;
+	const candidates = [];
+	if (snap.context.session?.authUserId !== void 0) candidates.push(snap.context.session.authUserId);
+	if (fallback !== null) candidates.push(fallback);
+	for (const candidate of candidates) {
+		const row = yield* deps.smartAccountPort.loadByAuthUserId(candidate).pipe(Effect.mapError((failure) => failure.publicError));
+		if (row !== null) return row;
+	}
+	return null;
+});
+/**
+* `smartAccount.provision` as an input-parameterised program requiring ONLY
+* `SmartAccountDepsTag`. Faithful transcription of the current public method
+* body (`smart-account.ts`): precondition the actor on `authenticated`, brand
+* the external signer at entry, then drive the `SmartAccountPort.provision`
+* port. The leading `signal.aborted` pre-check stays in the thin method
+* wrapper (provision currently takes no signal, so there is none).
+*/
+function provisionSmartAccountProgram(input) {
+	return Effect.gen(function* () {
+		const deps = yield* SmartAccountDepsTag;
+		const snap = deps.actor.getSnapshot();
+		const value = snap.value;
+		if (value !== "authenticated") return yield* Effect.fail(Errors.wrongState({
+			method: "smartAccount.provision",
+			currentState: value,
+			validStates: ["authenticated"]
+		}));
+		const signer = input?.externalSigner;
+		if (signer === void 0) return yield* Effect.fail(Errors.invalidInput("externalSigner", "required for provisioning"));
+		let signerAddress;
+		try {
+			signerAddress = toAddress(signer.address);
+		} catch (err) {
+			return yield* Effect.fail(err instanceof CapxulError ? err : Errors.invalidInput("externalSigner.address", "invalid EVM address"));
+		}
+		const session = snap.context.session;
+		if (session === null) return yield* Effect.fail(Errors.notAuthenticated());
+		const provisioned = yield* deps.smartAccountPort.provision({
+			authUserId: session.authUserId,
+			signerAddress,
+			chainId: deps.chainId
+		}).pipe(Effect.mapError((failure) => failure.publicError));
+		yield* Effect.promise(() => emitProvisioningTelemetry(deps.telemetry, provisioned));
+		return provisioned;
+	});
+}
+//#endregion
+//#region src/client/smart-account.ts
+function makeSmartAccountMethods(deps) {
+	return {
+		async loadCurrent(options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "smartAccount.loadCurrent" })
+			};
+			return toCapxulResult(loadSmartAccountProgram, smartAccountDepsLayer(deps));
+		},
+		async provision(input) {
+			return toCapxulResult(provisionSmartAccountProgram(input), smartAccountDepsLayer(deps));
+		}
+	};
+}
+//#endregion
+//#region src/ports/identity.ts
+var IdentityError = class extends Data.TaggedError("IdentityError") {};
+function identityErrorFromCapxul(operation, error, cause = error) {
+	return new IdentityError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var IdentityPortTag = class extends Context.Tag("@capxul/sdk/ports/IdentityPort")() {};
+//#endregion
+//#region src/client/identity-deps.ts
+/** The single Context tag the profile atom + `identity.loadCurrent` resolve. */
+var IdentityDepsTag = class extends Context.Tag("@capxul/sdk/IdentityDeps")() {};
+/** Wrap a bundle as the `Layer<IdentityDepsTag>` the React provider consumes. */
+function identityDepsLayer(deps) {
+	return Layer.succeed(IdentityDepsTag, deps);
+}
+/**
+* `identity.loadCurrent` as a single Effect requiring ONLY `IdentityDepsTag`.
+* Faithful transcription of the current public method body (`identity.ts`):
+* the leading `signal.aborted` pre-check stays in the thin method wrapper;
+* the program snapshots the actor session, then narrows the `IdentityPort`
+* failure to its `publicError`. Defects/sync-throws surface as `UNKNOWN`
+* through `toCapxulResult`'s `catchAllDefect` (and the atom's runtime), which
+* replaces the old outer `try/catch`.
+*/
+const loadIdentityProgram = Effect.gen(function* () {
+	const deps = yield* IdentityDepsTag;
+	if (deps.actor === void 0) return yield* Effect.fail(Errors.notAuthenticated());
+	const snapshot = deps.actor.getSnapshot();
+	const existingError = snapshot.context.error;
+	if (existingError instanceof CapxulError) return yield* Effect.fail(existingError);
+	const authUserId = snapshot.context.session?.authUserId;
+	if (authUserId === void 0) return null;
+	return yield* deps.identityPort.loadByAuthUserId(authUserId).pipe(Effect.catchAllDefect((cause) => Effect.fail(identityErrorFromCapxul("loadByAuthUserId", cause instanceof CapxulError ? cause : Errors.unknown(cause), cause))), Effect.mapError((failure) => failure.publicError));
+});
+//#endregion
+//#region src/client/identity.ts
+function makeIdentityMethods(deps) {
+	return { async loadCurrent(options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "identity.loadCurrent" })
+		};
+		return toCapxulResult(loadIdentityProgram, identityDepsLayer(deps));
+	} };
+}
+//#endregion
+//#region src/client/_shared/effect-actor-bridge.ts
+/**
+* Bridge an Effect whose typed failure carries `{ publicError: CapxulError }`
+* into the `Promise<CapxulResult<T>>` shape the consumer-facing method
+* bundles return. Applies to every port that surfaces a `publicError`
+* (smart-account, identity, auth-cache, and — post-#161 — account
+* provision/deploy).
+*/
+async function runPortEffect(effect) {
+	const result = await Effect.runPromise(Effect.either(effect));
+	if (Either.isRight(result)) return {
+		ok: true,
+		value: result.right
+	};
+	return {
+		ok: false,
+		error: result.left.publicError
+	};
+}
+/** The session carried by the actor's current snapshot, or `null`. */
+function sessionFromActor(actor) {
+	return actor.getSnapshot().context.session;
+}
+//#endregion
+//#region src/client/account-deps.ts
+/** The single Context tag the account atom + `account.getStatus` resolve. */
+var AccountDepsTag = class extends Context.Tag("@capxul/sdk/AccountDeps")() {};
+/** Wrap a bundle as the `Layer<AccountDepsTag>` the React provider consumes. */
+function accountDepsLayer(deps) {
+	return Layer.succeed(AccountDepsTag, deps);
+}
+/**
+* `account.getStatus` as a single Effect requiring ONLY `AccountDepsTag`.
+* Faithful transcription of the current public method body (`account.ts`):
+* resolve the session (actor first, then the resume-path `authCache`), then
+* walk the readiness ladder. The `SmartAccountPort` failure narrows to its
+* `publicError`; a consumer `AccountProvider.getAddress` rejection becomes a
+* `providerError` (defending the public `CapxulResult` contract).
+*/
+const accountStatusProgram = Effect.gen(function* () {
+	const deps = yield* AccountDepsTag;
+	const session = yield* Effect.promise(() => currentSession(deps.actor, deps.authCache));
+	if (session === null) return { status: "notAuthenticated" };
+	const current = yield* deps.smartAccountPort.loadByAuthUserId(session.authUserId).pipe(Effect.mapError((failure) => failure.publicError));
+	if (current !== null) return statusFromAccount(current, deps.requirement);
+	if (deps.requirement === "none") return {
+		status: "accountReady",
+		requirement: deps.requirement,
+		account: null,
+		deployment: { status: "counterfactual" }
+	};
+	const signer = deps.signer;
+	if (signer === void 0) return {
+		status: "accountRequired",
+		requirement: deps.requirement,
+		chainId: deps.chainId
+	};
+	const signerAddress = yield* Effect.tryPromise({
+		try: () => signer.getAddress(),
+		catch: (cause) => Errors.providerError("signer", "getAddress", cause)
+	});
+	return {
+		status: "accountProviderReady",
+		requirement: deps.requirement,
+		chainId: deps.chainId,
+		source: signer.source,
+		signerAddress
+	};
+});
+/**
+* Resume-path session resolution. Consults the actor first; if the actor has
+* no session (e.g. page refresh before any sign-in event), reads
+* `authCache.getSession`. `AuthCacheError` is non-fatal at this read point —
+* treat as "no session" and let the consumer's `auth.signIn` path resolve.
+*/
+async function currentSession(actor, authCache) {
+	const fromActor = sessionFromActor(actor);
+	if (fromActor !== null) return fromActor;
+	if (authCache === void 0) return null;
+	const cached = await Effect.runPromise(Effect.either(authCache.getSession));
+	if (Either.isRight(cached)) return cached.right;
+	return null;
+}
+/** Map a backend `SmartAccount` row onto the readiness `AccountStatus`. */
+function statusFromAccount(account, requirement) {
+	if (requirement === "deployed") {
+		if (account.deployedAt === null) return {
+			status: "accountPrepared",
+			requirement,
+			account,
+			deployment: { status: "counterfactual" }
+		};
+		return {
+			status: "accountReady",
+			requirement,
+			account,
+			deployment: {
+				status: "deployed",
+				deployedAt: account.deployedAt
+			}
+		};
+	}
+	return {
+		status: "accountReady",
+		requirement,
+		account,
+		deployment: account.deployedAt === null ? { status: "counterfactual" } : {
+			status: "deployed",
+			deployedAt: account.deployedAt
+		}
+	};
+}
+//#endregion
+//#region src/client/account.ts
+function makeAccountMethods(deps) {
+	toChainId(deps.chainId);
+	const requirement = deps.requirement;
+	const getStatus = () => toCapxulResult(accountStatusProgram, accountDepsLayer(deps));
+	const ensureIdentityProfile = async (session) => {
+		const existing = await runPortEffect(deps.identityPort.loadByAuthUserId(session.authUserId));
+		if (!existing.ok) return {
+			ok: false,
+			error: existing.error
+		};
+		if (existing.value !== null) return {
+			ok: true,
+			value: void 0
+		};
+		const created = await runPortEffect(deps.identityPort.create({
+			authUserId: session.authUserId,
+			email: session.email
+		}));
+		if (!created.ok) return {
+			ok: false,
+			error: created.error
+		};
+		return {
+			ok: true,
+			value: void 0
+		};
+	};
+	const provisionImpl = async () => {
+		const session = await currentSession(deps.actor, deps.authCache);
+		if (session === null) return {
+			ok: false,
+			error: Errors.notAuthenticated()
+		};
+		const profileReady = await ensureIdentityProfile(session);
+		if (!profileReady.ok) return {
+			ok: false,
+			error: profileReady.error
+		};
+		const signer = deps.signer;
+		if (signer === void 0) return {
+			ok: false,
+			error: Errors.smartAccountMissing("provision")
+		};
+		const signerAddressResult = await getSignerAddress(signer);
+		if (!signerAddressResult.ok) return {
+			ok: false,
+			error: signerAddressResult.error
+		};
+		const signerAddress = signerAddressResult.value;
+		const provisioned = await runPortEffect(deps.smartAccountPort.provision({
+			authUserId: session.authUserId,
+			signerAddress,
+			chainId: toChainId(deps.chainId)
+		}));
+		if (!provisioned.ok) return provisioned;
+		await emitProvisioningTelemetry(deps.telemetry, provisioned.value);
+		return {
+			ok: true,
+			value: provisioned.value
+		};
+	};
+	const deployMutex = /* @__PURE__ */ new Map();
+	const deploySafeImpl = async () => {
+		const session = await currentSession(deps.actor, deps.authCache);
+		if (session === null) return {
+			ok: false,
+			error: Errors.notAuthenticated()
+		};
+		const signer = deps.signer;
+		if (signer === void 0) return {
+			ok: false,
+			error: Errors.smartAccountMissing("deploySafe")
+		};
+		const existing = await runPortEffect(deps.smartAccountPort.loadByAuthUserId(session.authUserId));
+		if (!existing.ok) return existing;
+		if (existing.value !== null && existing.value.deployedAt !== null) return {
+			ok: true,
+			value: existing.value
+		};
+		if (existing.value === null) {
+			const provisioned = await provisionImpl();
+			if (!provisioned.ok) return provisioned;
+		}
+		const mutexKey = `${String(session.authUserId)}:${deps.chainId}`;
+		const inFlight = deployMutex.get(mutexKey);
+		if (inFlight !== void 0) return inFlight;
+		const work = runBackendDeploy({
+			authUserId: session.authUserId,
+			chainId: deps.chainId,
+			signer,
+			smartAccountPort: deps.smartAccountPort
+		}).finally(() => {
+			deployMutex.delete(mutexKey);
+		});
+		deployMutex.set(mutexKey, work);
+		return work;
+	};
+	const ensureReady = async () => {
+		const status = await getStatus();
+		if (!status.ok) return status;
+		if (status.value.status === "accountProviderReady" && requirement !== "deployed") {
+			const provisioned = await provisionImpl();
+			if (!provisioned.ok) return {
+				ok: false,
+				error: provisioned.error
+			};
+			return getStatus();
+		}
+		if (status.value.status === "accountProviderReady" && requirement === "deployed") {
+			const provisioned = await provisionImpl();
+			if (!provisioned.ok) return {
+				ok: false,
+				error: provisioned.error
+			};
+			const deployed = await deploySafeImpl();
+			if (!deployed.ok) return {
+				ok: false,
+				error: deployed.error
+			};
+			return getStatus();
+		}
+		if (status.value.status === "accountPrepared" && requirement === "deployed") {
+			const deployed = await deploySafeImpl();
+			if (!deployed.ok) return {
+				ok: false,
+				error: deployed.error
+			};
+			return getStatus();
+		}
+		return status;
+	};
+	return {
+		getStatus,
+		ensureReady,
+		_internal: {
+			provision: provisionImpl,
+			deploySafe: deploySafeImpl
+		}
+	};
+}
+async function getSignerAddress(signer) {
+	try {
+		return {
+			ok: true,
+			value: await signer.getAddress()
+		};
+	} catch (cause) {
+		return {
+			ok: false,
+			error: Errors.providerError("signer", "getAddress", cause)
+		};
+	}
+}
+/**
+* Backend-orchestrated deploy (backend-orchestrated-deploy.md):
+*   1. `deployPrepare` — backend builds + gas-fills + paymaster-sponsors the
+*      deployment UserOp and returns the EIP-712 SafeOp digest.
+*   2. `signer.signUserOpHash(digest)` — the only step needing the user's key.
+*   3. `deploySubmit` — backend submits via the bundler + confirms deployedAt.
+*/
+async function runBackendDeploy(input) {
+	const chainId = toChainId(input.chainId);
+	const prepared = await runPortEffect(input.smartAccountPort.deployPrepare({
+		authUserId: input.authUserId,
+		chainId
+	}));
+	if (!prepared.ok) return prepared;
+	let signature;
+	try {
+		signature = await input.signer.signUserOpHash(prepared.value.digest);
+	} catch (cause) {
+		return {
+			ok: false,
+			error: Errors.providerError("signer", "signUserOpHash", cause)
+		};
+	}
+	const confirmed = await runPortEffect(input.smartAccountPort.deploySubmit({
+		authUserId: input.authUserId,
+		chainId,
+		userOp: prepared.value.userOp,
+		signature
+	}));
+	if (!confirmed.ok) return confirmed;
+	if (confirmed.value.deployedAt === null) return {
+		ok: false,
+		error: Errors.providerError("smart-account", "deploySubmit", "missing deployedAt")
+	};
+	return {
+		ok: true,
+		value: confirmed.value
+	};
+}
+//#endregion
+//#region src/money/to-wei.ts
+/**
+* Lower consumer `Money` into an on-chain integer string for guarded writes.
+* Canon `account-balance-model.md` §10 — internal at the SDK boundary only.
+*/
+function toWei(money) {
+	return parseUnits(money.value, money.decimals).toString();
+}
+//#endregion
+//#region src/client/_shared/money-telemetry.ts
+/**
+* Lower a consumer `Money` into a non-negative integer WeiAmount string for
+* telemetry props. Reuses the SDK boundary `toWei` (viem `parseUnits`, string
+* math only — never a float multiply per `.claude/rules/numeric-parsing.md`).
+*/
+function moneyToWeiAmount(money) {
+	return toWei(money);
+}
+function transferDirection(from, to) {
+	if (from === "main") return "add";
+	if (to === "main") return "out";
+	return "between";
+}
+/** Fire-and-forget emit through an optional port; never throws. */
+async function emitMoneyTelemetry(telemetry, event) {
+	if (telemetry === void 0) return;
+	await Effect.runPromise(telemetry.emit(event).pipe(Effect.catchAll((cause) => Effect.sync(() => reportMoneyTelemetryFailure("error", event.name, cause))), Effect.catchAllDefect((cause) => Effect.sync(() => reportMoneyTelemetryFailure("defect", event.name, cause)))));
+}
+function emitFaucetRequested(telemetry, input) {
+	let amount;
+	try {
+		amount = moneyToWeiAmount(input.amount);
+	} catch (cause) {
+		reportMoneyTelemetryFailure("defect", "faucet_requested", cause);
+		return Promise.resolve();
+	}
+	return emitMoneyTelemetry(telemetry, {
+		name: "faucet_requested",
+		props: {
+			amount,
+			chainId: input.chainId
+		}
+	});
+}
+function emitFaucetFailed(telemetry, reason) {
+	return emitMoneyTelemetry(telemetry, {
+		name: "faucet_failed",
+		props: { reason }
+	});
+}
+function emitAccountBalanceFailed(telemetry, reason) {
+	return emitMoneyTelemetry(telemetry, {
+		name: "account_balance_failed",
+		props: { reason }
+	});
+}
+function emitTransferRequested(telemetry, input) {
+	let amount;
+	try {
+		amount = moneyToWeiAmount(input.amount);
+	} catch (cause) {
+		reportMoneyTelemetryFailure("defect", "transfer_requested", cause);
+		return Promise.resolve();
+	}
+	return emitMoneyTelemetry(telemetry, {
+		name: "transfer_requested",
+		props: {
+			amount,
+			direction: transferDirection(input.from, input.to)
+		}
+	});
+}
+function emitTransferFailed(telemetry, reason) {
+	return emitMoneyTelemetry(telemetry, {
+		name: "transfer_failed",
+		props: { reason }
+	});
+}
+function emitSubAccountCreated(telemetry, subAccountId) {
+	return emitMoneyTelemetry(telemetry, {
+		name: "subaccount_created",
+		props: { sub_account_id: subAccountId }
+	});
+}
+function emitSubAccountRenamed(telemetry, subAccountId) {
+	return emitMoneyTelemetry(telemetry, {
+		name: "subaccount_renamed",
+		props: { sub_account_id: subAccountId }
+	});
+}
+function emitSubAccountDeleted(telemetry, subAccountId) {
+	return emitMoneyTelemetry(telemetry, {
+		name: "subaccount_deleted",
+		props: { sub_account_id: subAccountId }
+	});
+}
+function emitSubAccountOpFailed(telemetry, op, reason) {
+	return emitMoneyTelemetry(telemetry, {
+		name: "subaccount_op_failed",
+		props: {
+			op,
+			reason
+		}
+	});
+}
+function reportMoneyTelemetryFailure(kind, name, cause) {
+	if (!isMoneyTelemetryDebugEnabled()) return;
+	globalThis.console?.warn?.("[capxul] money telemetry dropped", {
+		kind,
+		name,
+		cause
+	});
+}
+function isMoneyTelemetryDebugEnabled() {
+	return globalThis.process?.env?.CAPXUL_DEBUG_TELEMETRY === "1";
+}
+//#endregion
+//#region src/client/accounts-deps.ts
+var AccountsDepsTag = class extends Context.Tag("@capxul/sdk/AccountsDeps")() {};
+function accountsDepsLayer(deps) {
+	return Layer.succeed(AccountsDepsTag, deps);
+}
+const readAccountProgram = Effect.gen(function* () {
+	const deps = yield* AccountsDepsTag;
+	return yield* deps.accountReadPort.readBalance({ chainId: deps.chainId }).pipe(Effect.tapError((error) => Effect.promise(() => emitAccountBalanceFailed(deps.telemetry, error.publicCode))), Effect.mapError((error) => error.publicError));
+});
+function fundFromFaucetProgram(amount) {
+	return Effect.gen(function* () {
+		const deps = yield* AccountsDepsTag;
+		yield* Effect.promise(() => emitFaucetRequested(deps.telemetry, {
+			amount,
+			chainId: deps.chainId
+		}));
+		return yield* deps.accountReadPort.fundFromFaucet({
+			chainId: deps.chainId,
+			amount
+		}).pipe(Effect.tapError((error) => Effect.promise(() => emitFaucetFailed(deps.telemetry, error.publicCode))), Effect.mapError((error) => error.publicError));
+	});
+}
+//#endregion
+//#region src/client/accounts.ts
+/**
+* Build the accounts bundle. `assembleCapxulClient` exposes the public `read`
+* half at `client.accounts` (typed `AccountsMethods`) and the dev-only `fund`
+* half at `client._internal.accounts` (typed `AccountsFaucetMethods`), so the
+* faucet never appears on the public client surface.
+*/
+function makeAccountsMethods(deps) {
+	return {
+		async read(options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "accounts.read" })
+			};
+			return toCapxulResult(readAccountProgram, accountsDepsLayer(deps));
+		},
+		async fund(amount, options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "accounts.fund" })
+			};
+			return toCapxulResult(fundFromFaucetProgram(amount), accountsDepsLayer(deps));
+		}
+	};
+}
+//#endregion
+//#region src/client/sub-accounts-deps.ts
+var SubAccountsDepsTag = class extends Context.Tag("@capxul/sdk/SubAccountsDeps")() {};
+function subAccountsDepsLayer(deps) {
+	return Layer.succeed(SubAccountsDepsTag, deps);
+}
+function createSubAccountProgram(accountId, name) {
+	return Effect.gen(function* () {
+		const deps = yield* SubAccountsDepsTag;
+		const created = yield* deps.subAccountPort.create({
+			accountId,
+			name
+		}).pipe(Effect.tapError((error) => Effect.promise(() => emitSubAccountOpFailed(deps.telemetry, "create", error.publicCode))), Effect.mapError((error) => error.publicError));
+		yield* Effect.promise(() => emitSubAccountCreated(deps.telemetry, created.id));
+		return created;
+	});
+}
+function getSubAccountProgram(subAccountId) {
+	return Effect.gen(function* () {
+		return yield* (yield* SubAccountsDepsTag).subAccountPort.get({ subAccountId }).pipe(Effect.mapError((error) => error.publicError));
+	});
+}
+function listSubAccountsProgram(accountId) {
+	return Effect.gen(function* () {
+		return yield* (yield* SubAccountsDepsTag).subAccountPort.list({ accountId }).pipe(Effect.mapError((error) => error.publicError));
+	});
+}
+function renameSubAccountProgram(subAccountId, name) {
+	return Effect.gen(function* () {
+		const deps = yield* SubAccountsDepsTag;
+		const renamed = yield* deps.subAccountPort.rename({
+			subAccountId,
+			name
+		}).pipe(Effect.tapError((error) => Effect.promise(() => emitSubAccountOpFailed(deps.telemetry, "rename", error.publicCode))), Effect.mapError((error) => error.publicError));
+		yield* Effect.promise(() => emitSubAccountRenamed(deps.telemetry, renamed.id));
+		return renamed;
+	});
+}
+function deleteSubAccountProgram(subAccountId) {
+	return Effect.gen(function* () {
+		const deps = yield* SubAccountsDepsTag;
+		yield* deps.subAccountPort.delete({ subAccountId }).pipe(Effect.tapError((error) => Effect.promise(() => emitSubAccountOpFailed(deps.telemetry, "delete", error.publicCode))), Effect.mapError((error) => error.publicError));
+		yield* Effect.promise(() => emitSubAccountDeleted(deps.telemetry, subAccountId));
+	});
+}
+function transferSubAccountProgram(input) {
+	return Effect.gen(function* () {
+		const deps = yield* SubAccountsDepsTag;
+		yield* Effect.promise(() => emitTransferRequested(deps.telemetry, {
+			amount: input.amount,
+			from: input.from,
+			to: input.to
+		}));
+		return yield* deps.subAccountPort.transfer(input).pipe(Effect.tapError((error) => Effect.promise(() => emitTransferFailed(deps.telemetry, error.publicCode))), Effect.mapError((error) => error.publicError));
+	});
+}
+//#endregion
+//#region src/client/sub-accounts.ts
+function makeSubAccountsMethods(deps) {
+	const layer = subAccountsDepsLayer(deps);
+	return {
+		async create(accountId, input, options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "subAccounts.create" })
+			};
+			return toCapxulResult(createSubAccountProgram(accountId, input.name), layer);
+		},
+		async get(subAccountId, options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "subAccounts.get" })
+			};
+			return toCapxulResult(getSubAccountProgram(subAccountId), layer);
+		},
+		async list(accountId, options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "subAccounts.list" })
+			};
+			return toCapxulResult(listSubAccountsProgram(accountId), layer);
+		},
+		async rename(subAccountId, name, options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "subAccounts.rename" })
+			};
+			return toCapxulResult(renameSubAccountProgram(subAccountId, name), layer);
+		},
+		async delete(subAccountId, options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "subAccounts.delete" })
+			};
+			return toCapxulResult(deleteSubAccountProgram(subAccountId), layer);
+		},
+		async transfer(input, options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "subAccounts.transfer" })
+			};
+			return toCapxulResult(transferSubAccountProgram(input), layer);
+		}
+	};
+}
+//#endregion
+//#region src/money/from-wei.ts
+/**
+* Lift an on-chain integer (e.g. USDX 6-decimal) into consumer `Money`.
+* Canon `account-balance-model.md` §10 — internal at the SDK boundary only.
+*/
+function fromWei(rawBalance, decimals, currency) {
+	if (!Number.isInteger(decimals) || decimals < 0) throw new Error(`fromWei: decimals must be a non-negative integer, got ${String(decimals)}`);
+	const normalized = rawBalance.trim();
+	if (!/^\d+$/.test(normalized)) {
+		const truncated = normalized.length > 80 ? `${normalized.slice(0, 80)}…` : normalized;
+		throw new Error(`fromWei: rawBalance must be a base-10 integer string, got ${truncated}`);
+	}
+	return {
+		currency: toCurrencyCode(currency),
+		value: formatUnits(BigInt(normalized), decimals),
+		decimals
+	};
+}
+//#endregion
+//#region src/client/_shared/org-telemetry.ts
+/** Extract the domain from an email for telemetry (never the local part / PII). */
+function emailDomain(email) {
+	const at = email.lastIndexOf("@");
+	if (at < 0 || at === email.length - 1) return void 0;
+	return email.slice(at + 1).toLowerCase();
+}
+/** Fire-and-forget emit through an optional port; never throws. */
+async function emitOrgTelemetry(telemetry, event) {
+	if (telemetry === void 0) return;
+	await Effect.runPromise(telemetry.emit(event).pipe(Effect.catchAll((cause) => Effect.sync(() => reportOrgTelemetryFailure("error", event.name, cause))), Effect.catchAllDefect((cause) => Effect.sync(() => reportOrgTelemetryFailure("defect", event.name, cause)))));
+}
+function emitOrgCreateStarted(telemetry, input) {
+	const domain = input.email === void 0 ? void 0 : emailDomain(input.email);
+	return emitOrgTelemetry(telemetry, {
+		name: "org_create_started",
+		props: {
+			template: input.template,
+			...domain === void 0 ? {} : { email_domain: domain }
+		}
+	});
+}
+/** Spread the `chainId` prop only when known — never emit a misleading `0`. */
+function chainIdProp(chainId) {
+	return chainId === void 0 ? {} : { chainId };
+}
+function emitOrgSafeCreated(telemetry, input) {
+	return emitOrgTelemetry(telemetry, {
+		name: "org_safe_created",
+		props: {
+			org_id: input.orgId,
+			safe_address: input.safeAddress,
+			...chainIdProp(input.chainId)
+		}
+	});
+}
+function emitOrgSafeConfirmed(telemetry, input) {
+	return emitOrgTelemetry(telemetry, {
+		name: "org_safe_confirmed",
+		props: {
+			org_id: input.orgId,
+			safe_address: input.safeAddress,
+			...chainIdProp(input.chainId)
+		}
+	});
+}
+function emitOrgRolesSeeded(telemetry, input) {
+	return emitOrgTelemetry(telemetry, {
+		name: "org_roles_seeded",
+		props: {
+			org_id: input.orgId,
+			role: input.role
+		}
+	});
+}
+function emitOrgCreated(telemetry, input) {
+	return emitOrgTelemetry(telemetry, {
+		name: "org_created",
+		props: {
+			org_id: input.orgId,
+			safe_address: input.safeAddress,
+			...chainIdProp(input.chainId)
+		}
+	});
+}
+function emitOrgCreateFailed(telemetry, reason) {
+	return emitOrgTelemetry(telemetry, {
+		name: "org_create_failed",
+		props: { reason }
+	});
+}
+function emitOrgInviteSent(telemetry, input) {
+	const domain = emailDomain(input.email);
+	return emitOrgTelemetry(telemetry, {
+		name: "org_invite_sent",
+		props: {
+			org_id: input.orgId,
+			...domain === void 0 ? {} : { email_domain: domain },
+			role: input.role,
+			status: input.status
+		}
+	});
+}
+function orgSpendProps(input) {
+	return {
+		org_id: input.orgId,
+		amount: input.amountRaw,
+		currency: input.currency,
+		sub_account_id: input.subAccountId,
+		recipient: input.recipient,
+		...input.role === void 0 ? {} : { role: input.role },
+		...input.reason === void 0 ? {} : { reason: input.reason },
+		...input.txHash === void 0 ? {} : { txHash: input.txHash }
+	};
+}
+function emitOrgSpendStarted(telemetry, input) {
+	return emitOrgTelemetry(telemetry, {
+		name: "org_spend_started",
+		props: orgSpendProps(input)
+	});
+}
+function emitOrgSpendAuthorized(telemetry, input) {
+	return emitOrgTelemetry(telemetry, {
+		name: "org_spend_authorized",
+		props: orgSpendProps(input)
+	});
+}
+function emitOrgSpendSubmitted(telemetry, input) {
+	return emitOrgTelemetry(telemetry, {
+		name: "org_spend_submitted",
+		props: orgSpendProps(input)
+	});
+}
+function emitOrgSpendConfirmed(telemetry, input) {
+	return emitOrgTelemetry(telemetry, {
+		name: "org_spend_confirmed",
+		props: orgSpendProps(input)
+	});
+}
+function emitOrgSpendRejected(telemetry, input) {
+	return emitOrgTelemetry(telemetry, {
+		name: "org_spend_rejected",
+		props: orgSpendProps(input)
+	});
+}
+function reportOrgTelemetryFailure(kind, name, cause) {
+	if (!isOrgTelemetryDebugEnabled()) return;
+	globalThis.console?.warn?.("[capxul] org telemetry dropped", {
+		kind,
+		name,
+		cause
+	});
+}
+function isOrgTelemetryDebugEnabled() {
+	return globalThis.process?.env?.CAPXUL_DEBUG_TELEMETRY === "1";
+}
+//#endregion
+//#region src/client/org-spend-gate.ts
+function evaluateSpendGate(input) {
+	if (!input.activeMember) return reject("not_member", Errors.invalidInput("member", "you are not an active member"));
+	if (!recipientAllowed(input.recipients, input.recipient)) return reject("invalid_recipient", Errors.invalidRecipient("recipient is not allowed by this role"));
+	if (!subAccountAllowed(input.subAccounts, input.subAccountId)) return reject("wrong_envelope", Errors.invalidInput("subAccountId", "sub-account not in scope for this role"));
+	const amount = parseRaw(input.amountRaw, "amountRaw");
+	const balance = parseRaw(input.subAccountBalanceRaw, "subAccountBalanceRaw");
+	if (amount > balance) return reject("insufficient_subaccount_balance", Errors.insufficientBalance(input.currency, balance.toString(10), amount.toString(10)));
+	const perTxCap = parseOptionalRaw(input.perTxCapRaw, "perTxCapRaw");
+	if (perTxCap !== null && amount > perTxCap) return reject("over_cap", Errors.insufficientBalance("role per-transaction cap", perTxCap.toString(10), amount.toString(10)));
+	const perDayCap = parseOptionalRaw(input.perDayCapRaw, "perDayCapRaw");
+	if (perDayCap !== null) {
+		const remaining = perDayCap - (parseOptionalRaw(input.spentTodayRaw, "spentTodayRaw") ?? 0n);
+		if (remaining < amount) return reject("daily_cap_exhausted", Errors.insufficientBalance("role daily cap", remaining.toString(10), amount.toString(10)));
+	}
+	return { ok: true };
+}
+function reject(reason, error) {
+	return {
+		ok: false,
+		reason,
+		error
+	};
+}
+function recipientAllowed(recipients, recipient) {
+	if (recipients === "anyone") return true;
+	const normalized = recipient.toLowerCase();
+	return recipients.some((allowed) => allowed.toLowerCase() === normalized);
+}
+function subAccountAllowed(scope, subAccountId) {
+	if (scope.scope === "all") return true;
+	return scope.subAccountIds.includes(subAccountId);
+}
+function parseOptionalRaw(value, field) {
+	if (value === null || value === void 0) return null;
+	return parseRaw(value, field);
+}
+function parseRaw(value, field) {
+	if (!/^[0-9]+$/.test(value)) throw Errors.invalidInput(field, "must be a non-negative integer string");
+	return BigInt(value);
+}
+//#endregion
+//#region src/client/org-deps.ts
+var OrgDepsTag = class extends Context.Tag("@capxul/sdk/OrgDeps")() {};
+function orgDepsLayer(deps) {
+	return Layer.succeed(OrgDepsTag, deps);
+}
+function isHermeticOrgDeps(deps) {
+	return deps.orgPort === void 0 && deps.orgRolesDeploymentPort === void 0 && deps.orgSpendPort === void 0;
+}
+function missingLiveOrgDep(portName) {
+	return Errors.invalidInput("orgDeps", `${portName} is required in live org mode`);
+}
+/** Zero `Money` in the USDX-backed display currency (a fresh Org's treasury). */
+function zeroMoney() {
+	return fromWei("0", USDX_DECIMALS, USDX_CURRENCY);
+}
+/** A fresh Org's treasury Account: `$0` balance, `available === balance`. */
+function zeroTreasury(orgId) {
+	const balance = zeroMoney();
+	return {
+		id: toAccountId(`account_${stripPrefix(orgId)}`),
+		balance,
+		available: balance
+	};
+}
+/** Drop a known `<prefix>_` so the remainder is reusable as another brand seed. */
+function stripPrefix(value) {
+	const underscore = value.indexOf("_");
+	const cleaned = (underscore < 0 ? value : value.slice(underscore + 1)).replace(/[^0-9A-Za-z]/g, "");
+	return cleaned.length > 0 ? cleaned : "0";
+}
+/** Map an arbitrary string deterministically into lowercase hex chars. */
+function toHexSeed(value) {
+	let out = "";
+	for (const ch of value) out += (ch.codePointAt(0) ?? 0).toString(16).padStart(2, "0");
+	return out.length > 0 ? out : "0";
+}
+/**
+* Build the hermetic `OrgView` for the no-port L1 path: a deterministic
+* counterfactual-shaped placeholder Org Safe + a `$0` treasury (D3). The live
+* path replaces this with the real deployed address + RPC balance.
+*/
+function hermeticOrgView(input) {
+	const orgId = toOrgId(`org_${stripPrefix(`x_${input.handle}`)}`);
+	const placeholder = `0x${toHexSeed(input.handle).padEnd(40, "0").slice(0, 40)}`;
+	return {
+		id: orgId,
+		name: input.name,
+		handle: input.handle,
+		safeAddress: toAddress(placeholder),
+		role: "Owner",
+		treasury: zeroTreasury(orgId)
+	};
+}
+function moneyFromConfig(input) {
+	return {
+		currency: toCurrencyCode(input.currency),
+		value: input.value,
+		decimals: input.decimals
+	};
+}
+function recipientsFromConfig(toRecipients) {
+	if (toRecipients === void 0 || toRecipients === "anyone") return toRecipients;
+	return toRecipients.map((recipient) => toAddress(recipient));
+}
+function subAccountsFromConfig(subAccounts) {
+	if (subAccounts === void 0) return void 0;
+	if (subAccounts.scope === "all") return { scope: "all" };
+	return { scope: subAccounts.scope.map((subAccountId) => toSubAccountId(subAccountId)) };
+}
+function roleDefinitionFromConfig(definition) {
+	const toRecipients = recipientsFromConfig(definition.spend?.toRecipients);
+	const subAccounts = subAccountsFromConfig(definition.subAccounts);
+	return {
+		label: definition.label,
+		...definition.spend === void 0 ? {} : { spend: {
+			...definition.spend.perTx === void 0 ? {} : { perTx: moneyFromConfig(definition.spend.perTx) },
+			...definition.spend.perDay === void 0 ? {} : { perDay: moneyFromConfig(definition.spend.perDay) },
+			...toRecipients === void 0 ? {} : { toRecipients }
+		} },
+		...subAccounts === void 0 ? {} : { subAccounts },
+		...definition.canManageMembers === void 0 ? {} : { canManageMembers: definition.canManageMembers },
+		...definition.canManageRoles === void 0 ? {} : { canManageRoles: definition.canManageRoles }
+	};
+}
+function startupRoleViews(orgId) {
+	return compileOrgRoleDefinitions(orgRoleTemplateDefinitions("Startup")).roles.map((role) => ({
+		orgId,
+		label: role.label,
+		roleKey: toRoleKey(role.roleKey),
+		definition: roleDefinitionFromConfig(role.definition)
+	}));
+}
+function hermeticMember(input) {
+	return {
+		orgId: input.orgId,
+		email: toEmail(input.email),
+		name: null,
+		personalSafeAddress: input.personalSafeAddress ?? null,
+		role: input.role,
+		roleKey: toRoleKey(orgRoleKeyForLabel(input.role)),
+		status: input.status,
+		grantTxHash: input.grantTxHash ?? null,
+		revokeTxHash: input.revokeTxHash ?? null
+	};
+}
+function hermeticSpendAuthority(input) {
+	return {
+		activeMember: true,
+		subAccountBalanceRaw: "100000000000",
+		recipients: "anyone",
+		subAccounts: {
+			scope: "only",
+			subAccountIds: [input.from]
+		},
+		perTxCapRaw: "25000000000",
+		perDayCapRaw: "100000000000",
+		spentTodayRaw: "0",
+		role: "Finance Manager"
+	};
+}
+function hermeticSpendResult(orgId, input) {
+	return { txHash: `0x${toHexSeed(`${orgId}:${input.from}:${input.to}:${input.amount.value}`).padEnd(64, "0").slice(0, 64)}` };
+}
+function spendTelemetryInput(input) {
+	return {
+		orgId: input.orgId,
+		amountRaw: input.amountRaw,
+		currency: input.currency,
+		subAccountId: input.spend.from,
+		recipient: input.spend.to,
+		...input.authority?.role === void 0 ? {} : { role: input.authority.role },
+		...input.reason === void 0 ? {} : { reason: input.reason },
+		...input.txHash === void 0 ? {} : { txHash: input.txHash }
+	};
+}
+function spendGateInput(input) {
+	return {
+		activeMember: input.authority.activeMember,
+		subAccountId: input.spend.from,
+		subAccountBalanceRaw: input.authority.subAccountBalanceRaw,
+		amountRaw: input.amountRaw,
+		currency: input.currency,
+		recipient: input.spend.to,
+		recipients: input.authority.recipients,
+		subAccounts: input.authority.subAccounts,
+		...input.authority.perTxCapRaw === void 0 ? {} : { perTxCapRaw: input.authority.perTxCapRaw },
+		...input.authority.perDayCapRaw === void 0 ? {} : { perDayCapRaw: input.authority.perDayCapRaw },
+		...input.authority.spentTodayRaw === void 0 ? {} : { spentTodayRaw: input.authority.spentTodayRaw }
+	};
+}
+function createOrgProgram(input) {
+	return Effect.gen(function* () {
+		const deps = yield* OrgDepsTag;
+		const chainId = deps.chainId;
+		yield* Effect.promise(() => emitOrgCreateStarted(deps.telemetry, { template: input.template }));
+		return yield* Effect.gen(function* () {
+			if (deps.orgPort !== void 0) {
+				const org = yield* deps.orgPort.createOrg({ input }).pipe(Effect.mapError((error) => error.publicError));
+				yield* emitCreationFunnelTail(deps.telemetry, org, chainId);
+				return org;
+			}
+			const org = hermeticOrgView(input);
+			yield* emitCreationFunnelTail(deps.telemetry, org, chainId);
+			return org;
+		}).pipe(Effect.tapError((error) => Effect.promise(() => emitOrgCreateFailed(deps.telemetry, error.code))));
+	});
+}
+/** Emit the remaining `org_creation` funnel steps once the org is built. */
+function emitCreationFunnelTail(telemetry, org, chainId) {
+	return Effect.promise(async () => {
+		const chain = chainId === void 0 ? {} : { chainId };
+		await emitOrgSafeCreated(telemetry, {
+			orgId: org.id,
+			safeAddress: org.safeAddress,
+			...chain
+		});
+		await emitOrgSafeConfirmed(telemetry, {
+			orgId: org.id,
+			safeAddress: org.safeAddress,
+			...chain
+		});
+		await emitOrgRolesSeeded(telemetry, {
+			orgId: org.id,
+			role: org.role
+		});
+		await emitOrgCreated(telemetry, {
+			orgId: org.id,
+			safeAddress: org.safeAddress,
+			...chain
+		});
+	});
+}
+function readTreasuryProgram(orgId) {
+	return Effect.gen(function* () {
+		const deps = yield* OrgDepsTag;
+		if (deps.orgPort !== void 0) return yield* deps.orgPort.readTreasury({ orgId }).pipe(Effect.mapError((error) => error.publicError));
+		return zeroTreasury(orgId);
+	});
+}
+function listRolesProgram(orgId) {
+	return Effect.gen(function* () {
+		const deps = yield* OrgDepsTag;
+		if (deps.orgPort !== void 0) return yield* deps.orgPort.listRoles({ orgId }).pipe(Effect.mapError((error) => error.publicError));
+		return startupRoleViews(orgId);
+	});
+}
+function deployRolesProgram(orgId) {
+	return Effect.gen(function* () {
+		const deps = yield* OrgDepsTag;
+		if (deps.orgRolesDeploymentPort !== void 0) return (yield* deps.orgRolesDeploymentPort.deployRoles({ orgId }).pipe(Effect.mapError((error) => error.publicError))).roles;
+		if (!isHermeticOrgDeps(deps)) return yield* Effect.fail(missingLiveOrgDep("orgRolesDeploymentPort"));
+		return startupRoleViews(orgId);
+	});
+}
+function listMembersProgram(orgId) {
+	return Effect.gen(function* () {
+		const deps = yield* OrgDepsTag;
+		if (deps.orgPort !== void 0) return yield* deps.orgPort.listMembers({ orgId }).pipe(Effect.mapError((error) => error.publicError));
+		return [];
+	});
+}
+function inviteMemberProgram(orgId, input) {
+	return Effect.gen(function* () {
+		const deps = yield* OrgDepsTag;
+		const member = deps.orgPort !== void 0 ? yield* deps.orgPort.inviteMember({
+			orgId,
+			input
+		}).pipe(Effect.mapError((error) => error.publicError)) : hermeticMember({
+			orgId,
+			email: input.email,
+			role: input.role,
+			status: "pending"
+		});
+		yield* Effect.promise(() => emitOrgInviteSent(deps.telemetry, {
+			orgId,
+			email: input.email,
+			role: member.role,
+			status: member.status
+		}));
+		return member;
+	});
+}
+function detectAndAcceptPendingInvitationsProgram() {
+	return Effect.gen(function* () {
+		const deps = yield* OrgDepsTag;
+		if (deps.orgPort !== void 0) return yield* deps.orgPort.detectAndAcceptPendingInvitations({}).pipe(Effect.mapError((error) => error.publicError));
+		return { matched: [] };
+	});
+}
+function assignRoleProgram(orgId, input) {
+	return Effect.gen(function* () {
+		const deps = yield* OrgDepsTag;
+		if (deps.orgRolesDeploymentPort !== void 0) return yield* deps.orgRolesDeploymentPort.grantRole({
+			orgId,
+			input
+		}).pipe(Effect.mapError((error) => error.publicError));
+		if (!isHermeticOrgDeps(deps)) return yield* Effect.fail(missingLiveOrgDep("orgRolesDeploymentPort"));
+		return hermeticMember({
+			orgId,
+			email: "member@example.com",
+			role: input.role,
+			status: "active",
+			personalSafeAddress: input.memberSafeAddress,
+			grantTxHash: `0x${"0".repeat(64)}`
+		});
+	});
+}
+function removeMemberProgram(orgId, input) {
+	return Effect.gen(function* () {
+		const deps = yield* OrgDepsTag;
+		if (deps.orgRolesDeploymentPort !== void 0) return yield* deps.orgRolesDeploymentPort.revokeRole({
+			orgId,
+			input
+		}).pipe(Effect.mapError((error) => error.publicError));
+		if (!isHermeticOrgDeps(deps)) return yield* Effect.fail(missingLiveOrgDep("orgRolesDeploymentPort"));
+	});
+}
+function spendProgram(orgId, input) {
+	return Effect.gen(function* () {
+		const deps = yield* OrgDepsTag;
+		const amountRaw = yield* Effect.try({
+			try: () => toWei(input.amount),
+			catch: (cause) => Errors.invalidInput("amount", cause instanceof Error ? cause.message : "invalid money")
+		});
+		const currency = String(input.amount.currency);
+		yield* Effect.promise(() => emitOrgSpendStarted(deps.telemetry, {
+			orgId,
+			amountRaw,
+			currency,
+			subAccountId: input.from,
+			recipient: input.to
+		}));
+		if (deps.orgSpendPort === void 0 && !isHermeticOrgDeps(deps)) return yield* Effect.fail(missingLiveOrgDep("orgSpendPort"));
+		const authority = deps.orgSpendPort === void 0 ? hermeticSpendAuthority(input) : yield* deps.orgSpendPort.readSpendAuthority({
+			orgId,
+			input,
+			amountRaw
+		}).pipe(Effect.mapError((error) => error.publicError));
+		const decision = yield* Effect.try({
+			try: () => evaluateSpendGate(spendGateInput({
+				authority,
+				spend: input,
+				amountRaw,
+				currency
+			})),
+			catch: (cause) => isCapxulError(cause) ? cause : Errors.unknown(cause)
+		});
+		if (!decision.ok) {
+			yield* Effect.promise(() => emitOrgSpendRejected(deps.telemetry, spendTelemetryInput({
+				orgId,
+				amountRaw,
+				currency,
+				spend: input,
+				authority,
+				reason: decision.reason
+			})));
+			return yield* Effect.fail(decision.error);
+		}
+		yield* Effect.promise(() => emitOrgSpendAuthorized(deps.telemetry, spendTelemetryInput({
+			orgId,
+			amountRaw,
+			currency,
+			spend: input,
+			authority
+		})));
+		const result = deps.orgSpendPort === void 0 ? hermeticSpendResult(orgId, input) : yield* deps.orgSpendPort.submitSpend({
+			orgId,
+			input,
+			amountRaw,
+			authority
+		}).pipe(Effect.mapError((error) => error.publicError), Effect.tapError((error) => Effect.promise(() => emitOrgSpendRejected(deps.telemetry, spendTelemetryInput({
+			orgId,
+			amountRaw,
+			currency,
+			spend: input,
+			authority,
+			reason: error.code
+		})))));
+		yield* Effect.promise(() => emitOrgSpendSubmitted(deps.telemetry, spendTelemetryInput({
+			orgId,
+			amountRaw,
+			currency,
+			spend: input,
+			authority,
+			txHash: result.txHash
+		})));
+		yield* Effect.promise(() => emitOrgSpendConfirmed(deps.telemetry, spendTelemetryInput({
+			orgId,
+			amountRaw,
+			currency,
+			spend: input,
+			authority,
+			txHash: result.txHash
+		})));
+		return result;
+	});
+}
+function listOrgsProgram() {
+	return Effect.gen(function* () {
+		const deps = yield* OrgDepsTag;
+		if (deps.orgPort !== void 0) return yield* deps.orgPort.listOrgs({}).pipe(Effect.mapError((error) => error.publicError));
+		return [];
+	});
+}
+//#endregion
+//#region src/client/org.ts
+/**
+* Org method surface (canon §C2/§C3, D13). S1 (#274) wires `createOrg` /
+* `orgs` / `treasury` to their Effect programs (`org-deps.ts`); the S2→S4
+* member/role/spend verbs stay `Errors.notImplemented("org", "<verb>")` until
+* their slices land. The entity-scoped bundle is constructed per `org(orgId)`
+* call (D13 — explicit scoping, no shared mutable "active org" state); the
+* closed-over `orgId` is the only entity reference.
+*/
+function makeOrgMethods(deps) {
+	const layer = orgDepsLayer({
+		...deps.orgPort === void 0 ? {} : { orgPort: deps.orgPort },
+		...deps.orgRolesDeploymentPort === void 0 ? {} : { orgRolesDeploymentPort: deps.orgRolesDeploymentPort },
+		...deps.orgSpendPort === void 0 ? {} : { orgSpendPort: deps.orgSpendPort },
+		...deps.chainId === void 0 ? {} : { chainId: deps.chainId },
+		...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
+	});
+	return {
+		createOrg(input, options) {
+			if (options?.signal?.aborted) return Promise.resolve({
+				ok: false,
+				error: Errors.cancelled({ operation: "org.createOrg" })
+			});
+			return toCapxulResult(createOrgProgram(input), layer);
+		},
+		orgs: Object.assign((options) => {
+			if (options?.signal?.aborted) return Promise.resolve({
+				ok: false,
+				error: Errors.cancelled({ operation: "org.orgs" })
+			});
+			return toCapxulResult(listOrgsProgram(), layer);
+		}, { detectAndAcceptPendingInvitations(options) {
+			if (options?.signal?.aborted) return Promise.resolve({
+				ok: false,
+				error: Errors.cancelled({ operation: "orgs.detectAndAcceptPendingInvitations" })
+			});
+			return toCapxulResult(detectAndAcceptPendingInvitationsProgram(), layer);
+		} }),
+		org(orgId) {
+			return {
+				treasury(options) {
+					if (options?.signal?.aborted) return Promise.resolve({
+						ok: false,
+						error: Errors.cancelled({ operation: "org.treasury" })
+					});
+					return toCapxulResult(readTreasuryProgram(orgId), layer);
+				},
+				members(_options) {
+					if (_options?.signal?.aborted) return Promise.resolve({
+						ok: false,
+						error: Errors.cancelled({ operation: "org.members" })
+					});
+					return toCapxulResult(listMembersProgram(orgId), layer);
+				},
+				roles(_options) {
+					if (_options?.signal?.aborted) return Promise.resolve({
+						ok: false,
+						error: Errors.cancelled({ operation: "org.roles" })
+					});
+					return toCapxulResult(listRolesProgram(orgId), layer);
+				},
+				deployRoles(_options) {
+					if (_options?.signal?.aborted) return Promise.resolve({
+						ok: false,
+						error: Errors.cancelled({ operation: "org.deployRoles" })
+					});
+					return toCapxulResult(deployRolesProgram(orgId), layer);
+				},
+				invite(_input, _options) {
+					if (_options?.signal?.aborted) return Promise.resolve({
+						ok: false,
+						error: Errors.cancelled({ operation: "org.invite" })
+					});
+					return toCapxulResult(inviteMemberProgram(orgId, _input), layer);
+				},
+				removeMember(_input, _options) {
+					if (_options?.signal?.aborted) return Promise.resolve({
+						ok: false,
+						error: Errors.cancelled({ operation: "org.removeMember" })
+					});
+					return toCapxulResult(removeMemberProgram(orgId, _input), layer);
+				},
+				assignRole(_input, _options) {
+					if (_options?.signal?.aborted) return Promise.resolve({
+						ok: false,
+						error: Errors.cancelled({ operation: "org.assignRole" })
+					});
+					return toCapxulResult(assignRoleProgram(orgId, _input), layer);
+				},
+				spend(_input, _options) {
+					if (_options?.signal?.aborted) return Promise.resolve({
+						ok: false,
+						error: Errors.cancelled({ operation: "org.spend" })
+					});
+					return toCapxulResult(spendProgram(orgId, _input), layer);
+				}
+			};
+		}
+	};
+}
+//#endregion
+//#region src/client/factory.ts
+function detectAuthCacheAdapter() {
+	const globalAny = globalThis;
+	if (globalAny.window?.localStorage !== void 0) return new BrowserAuthCacheAdapter(globalAny.window.localStorage);
+	return new InMemoryAuthCacheAdapter();
+}
+//#endregion
+//#region src/client/create-capxul-client.ts
+function assembleCapxulClient(input) {
+	const authCache = input.authCache ?? detectAuthCacheAdapter();
+	const layer = Layer.mergeAll(Layer.succeed(AuthClientPortTag, input.ports.authClient), Layer.succeed(ClockPortTag, input.ports.clock), Layer.succeed(TelemetryPortTag, input.ports.telemetry));
+	const authFlowInput = input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs };
+	const actor = Effect.runSync(bootAuthFlow(createAuthFlowMachine(), authFlowInput).pipe(Effect.provide(layer)));
+	if (input.signal !== void 0) input.signal.addEventListener("abort", () => actor.stop(), { once: true });
+	const selectedOrgPort = input.orgPort ?? input.orgDeploymentPort;
+	let detectPendingOrgInvitations;
+	const auth = makeAuthMethods({
+		actor,
+		authClient: input.ports.authClient,
+		authCache,
+		clock: input.ports.clock,
+		telemetry: input.ports.telemetry,
+		...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
+		...input.invokeTimeoutMs === void 0 ? {} : { invokeTimeoutMs: input.invokeTimeoutMs },
+		...selectedOrgPort === void 0 ? {} : { afterVerifyOtp: async () => {
+			await detectPendingOrgInvitations?.();
+		} }
+	});
+	const smartAccount = makeSmartAccountMethods({
+		actor,
+		smartAccountPort: input.ports.smartAccount,
+		chainId: input.bootstrap.chainId,
+		sessionAuthUserIdFallback: null,
+		telemetry: input.ports.telemetry
+	});
+	const identity = makeIdentityMethods({
+		identityPort: input.ports.identity,
+		actor
+	});
+	const account = makeAccountMethods({
+		actor,
+		authCache,
+		identityPort: input.ports.identity,
+		smartAccountPort: input.ports.smartAccount,
+		telemetry: input.ports.telemetry,
+		chainId: input.bootstrap.chainId,
+		requirement: input.requirement,
+		...input.signer === void 0 ? {} : { signer: input.signer }
+	});
+	const accounts = makeAccountsMethods({
+		accountReadPort: input.ports.accountRead,
+		chainId: input.bootstrap.chainId,
+		telemetry: input.ports.telemetry
+	});
+	const subAccounts = makeSubAccountsMethods({
+		subAccountPort: input.ports.subAccount,
+		telemetry: input.ports.telemetry
+	});
+	const orgMethods = makeOrgMethods({
+		chainId: input.bootstrap.chainId,
+		telemetry: input.ports.telemetry,
+		...selectedOrgPort === void 0 ? {} : { orgPort: selectedOrgPort },
+		...input.orgRolesDeploymentPort === void 0 ? {} : { orgRolesDeploymentPort: input.orgRolesDeploymentPort },
+		...input.orgSpendPort === void 0 ? {} : { orgSpendPort: input.orgSpendPort }
+	});
+	if (selectedOrgPort !== void 0) detectPendingOrgInvitations = async () => {
+		await orgMethods.orgs.detectAndAcceptPendingInvitations();
+	};
+	return {
+		auth,
+		smartAccount,
+		identity,
+		account,
+		accounts,
+		subAccounts,
+		createOrg: orgMethods.createOrg,
+		orgs: orgMethods.orgs,
+		org: orgMethods.org,
+		bootstrap: input.bootstrap,
+		_internal: {
+			authActor: {
+				input: actor.input,
+				getSnapshot: actor.getSnapshot,
+				stop: actor.stop
+			},
+			accounts: { fund: accounts.fund }
+		}
+	};
+}
+//#endregion
+//#region src/client/account-providers.ts
+function localPrivateKeyAccountProvider(input) {
+	const account = privateKeyToAccount(input.privateKey);
+	const address = toAddress(account.address);
+	return {
+		source: "local-private-key",
+		async getAddress() {
+			return {
+				ok: true,
+				value: address
+			};
+		},
+		async getDeployAccount() {
+			return {
+				ok: true,
+				value: account
+			};
+		}
+	};
+}
+function eip1193AccountProvider(input) {
+	let cachedAddress = null;
+	let inFlight = null;
+	const getAddress = async () => {
+		if (cachedAddress !== null) return {
+			ok: true,
+			value: cachedAddress
+		};
+		if (inFlight !== null) return inFlight;
+		inFlight = (async () => {
+			try {
+				const first = firstAccount(await input.provider.request({ method: "eth_accounts" }));
+				if (first === null) return {
+					ok: false,
+					error: Errors.smartAccountMissing("eip1193-account")
+				};
+				const address = toAddress(first);
+				cachedAddress = address;
+				return {
+					ok: true,
+					value: address
+				};
+			} catch (err) {
+				return {
+					ok: false,
+					error: Errors.providerError("eip1193", "eth_accounts", err)
+				};
+			} finally {
+				inFlight = null;
+			}
+		})();
+		return inFlight;
+	};
+	return {
+		source: "injected-eip1193",
+		getAddress,
+		async getDeployAccount() {
+			return {
+				ok: false,
+				error: Errors.notImplemented("Eip1193AccountProvider", "getDeployAccount")
+			};
+		}
+	};
+}
+function openfortEmbeddedAccountProvider() {
+	return {
+		source: "openfort-embedded",
+		async getAddress() {
+			return {
+				ok: false,
+				error: Errors.notImplemented("OpenfortAccountProvider", "getAddress")
+			};
+		},
+		async getDeployAccount() {
+			return {
+				ok: false,
+				error: Errors.notImplemented("OpenfortAccountProvider", "getDeployAccount")
+			};
+		}
+	};
+}
+function firstAccount(value) {
+	if (!Array.isArray(value)) return null;
+	const first = value[0];
+	return typeof first === "string" ? first : null;
+}
+//#endregion
+//#region src/signer.ts
+const EVM_ADDRESS_HEX = /^0x[0-9a-fA-F]{40}$/;
+const ECDSA_SIGNATURE_HEX = /^0x[0-9a-fA-F]{130}$/;
+/**
+* Browser `CapxulSigner` backed by an injected EIP-1193 wallet (MetaMask, etc.).
+* Signs the SafeOp digest via `eth_sign` (raw-hash signing). The node key signer
+* lives in `@capxul/sdk/node` (`localPrivateKeySigner`). Wallets that disable
+* `eth_sign` must enable raw-hash signing before deployed-account flows run.
+*/
+function injectedWalletSigner(provider) {
+	const resolveAddress = async () => {
+		const accounts = await provider.request({ method: "eth_requestAccounts" });
+		const first = Array.isArray(accounts) ? accounts[0] : void 0;
+		if (typeof first !== "string") throw new Error("injectedWalletSigner: wallet returned no accounts");
+		if (!EVM_ADDRESS_HEX.test(first)) throw new Error("injectedWalletSigner: wallet returned invalid address format");
+		return toAddress(first);
+	};
+	return {
+		source: "injected-eip1193",
+		getAddress: resolveAddress,
+		async signUserOpHash(hash) {
+			const address = await resolveAddress();
+			let signature;
+			try {
+				signature = await provider.request({
+					method: "eth_sign",
+					params: [address, hash]
+				});
+			} catch (cause) {
+				const detail = cause instanceof Error ? cause.message : String(cause);
+				throw new Error(`injectedWalletSigner: eth_sign failed; enable raw-hash signing for deployment (${detail})`);
+			}
+			if (typeof signature !== "string") throw new Error("injectedWalletSigner: wallet returned a non-string signature");
+			if (!ECDSA_SIGNATURE_HEX.test(signature)) throw new Error("injectedWalletSigner: wallet returned invalid signature format");
+			return signature;
+		}
+	};
+}
+//#endregion
+//#region package.json
+var version = "0.2.0-alpha.5";
+//#endregion
+//#region src/adapters/auth-client/effect-port.ts
+function authClientPortFromPromiseAdapter(adapter) {
+	return {
+		canSendOtp: (input, options) => fromResult("canSendOtp", () => adapter.canSendOtp(input, options)),
+		sendOtp: (input, options) => fromResult("sendOtp", () => adapter.sendOtp(input, options)),
+		verifyOtp: (input, options) => fromResult("verifyOtp", () => adapter.verifyOtp(input, options)),
+		getSession: (options) => fromResult("getSession", () => adapter.getSession(options)),
+		signOut: (options) => fromResult("signOut", () => adapter.signOut(options)),
+		getConvexJwt: (options) => fromResult("getConvexJwt", () => adapter.getConvexJwt(options))
+	};
+}
+function fromResult(operation, run) {
+	return Effect.tryPromise({
+		try: run,
+		catch: (cause) => new AuthClientError({
+			operation,
+			kind: "thrown",
+			cause
+		})
+	}).pipe(Effect.flatMap((result) => result.ok ? Effect.succeed(result.value) : Effect.fail(new AuthClientError({
+		operation,
+		kind: errorKind(result.error),
+		cause: result.error
+	}))));
+}
+function errorKind(error) {
+	if (error.code === "CANCELLED") return "cancelled";
+	if (error.code === "NETWORK_ERROR") return "network";
+	if (error.code === "INVALID_INPUT" || error.code === "OTP_EXPIRED") return "validation";
+	return "provider";
+}
+//#endregion
+//#region src/adapters/auth-client/resolve-auth-url.ts
+/** Join bootstrap `authBaseUrl` with a BetterAuth route without duplicating `/api/auth`. */
+function resolveAuthClientUrl(authBaseUrl, path) {
+	const base = authBaseUrl.replace(/\/$/, "");
+	if (base.endsWith("/api/auth") && path.startsWith("/api/auth")) return `${base}${path.slice(9)}`;
+	return `${base}${path}`;
+}
+//#endregion
+//#region src/adapters/auth-client/BetterAuthBrowserAdapter.ts
+function withSignal$1(init, signal) {
+	return signal === void 0 ? init : {
+		...init,
+		signal
+	};
+}
+const DEFAULT_JWT_LIFETIME_S$1 = 900;
+function decodeJwtExp$1(jwt) {
+	const parts = jwt.split(".");
+	if (parts.length < 2 || parts[1] === void 0) return Math.floor(Date.now() / 1e3) + DEFAULT_JWT_LIFETIME_S$1;
+	try {
+		const raw = parts[1].replace(/\s+/g, "");
+		const pad = "=".repeat((4 - raw.length % 4) % 4);
+		const decoded = atob(raw.replace(/-/g, "+").replace(/_/g, "/") + pad);
+		const payload = JSON.parse(decoded);
+		if (typeof payload.exp === "number" && Number.isFinite(payload.exp) && payload.exp > 0) return payload.exp;
+	} catch {}
+	return Math.floor(Date.now() / 1e3) + DEFAULT_JWT_LIFETIME_S$1;
+}
+function authSessionFromBetterAuth$1(token, user) {
+	return {
+		authUserId: toAuthUserId(user.id),
+		email: toEmail(user.email),
+		token: toSessionToken(token),
+		expiresAt: toEpochMs(Date.now() + 10080 * 60 * 1e3)
+	};
+}
+async function safeJson$1(res) {
+	const raw = await res.text();
+	if (raw.length === 0 || raw === "null") return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+function mapBetterAuthError(operation, body) {
+	if (typeof body === "object" && body !== null) {
+		const errBody = body;
+		const code = typeof errBody.code === "string" ? errBody.code : "";
+		if (code === "OTP_EXPIRED") return Errors.otpExpired();
+		if (code === "INVALID_OTP") return Errors.invalidInput("otp", errBody.message ?? "invalid OTP");
+		if (code === "VALIDATION_ERROR" || code === "INVALID_EMAIL") return Errors.invalidInput("email", errBody.message ?? "invalid email");
+	}
+	return Errors.providerError("better-auth", operation, new Error(String(body)));
+}
+function isAbortError$1(err, signal) {
+	return signal?.aborted === true || err instanceof Error && err.name === "AbortError" || typeof DOMException !== "undefined" && err instanceof DOMException && err.name === "AbortError";
+}
+function mapFetchError$1(operation, err, signal) {
+	if (isAbortError$1(err, signal)) return Errors.cancelled({ operation });
+	return Errors.networkError(operation, err instanceof Error ? err : new Error(String(err)));
+}
+var BetterAuthBrowserAdapter = class {
+	authBaseUrl;
+	fetchImpl;
+	constructor(deps) {
+		this.authBaseUrl = deps.authBaseUrl.replace(/\/$/, "");
+		this.fetchImpl = deps.fetch ?? fetch;
+	}
+	url(path) {
+		return resolveAuthClientUrl(this.authBaseUrl, path);
+	}
+	async canSendOtp(_input, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "canSendOtp" })
+		};
+		return {
+			ok: true,
+			value: {
+				allowed: true,
+				cooldownMs: toDurationMs(0)
+			}
+		};
+	}
+	async sendOtp(input, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "sendOtp" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/email-otp/send-verification-otp"), withSignal$1({
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					email: input.email,
+					type: "sign-in"
+				}),
+				credentials: "include"
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "sendOtp" })
+			};
+			if (res.ok) return {
+				ok: true,
+				value: void 0
+			};
+			if (res.status === 429) return {
+				ok: false,
+				error: Errors.rateLimited({ resource: "better-auth/sendOtp" })
+			};
+			const body = await safeJson$1(res);
+			if (typeof body === "object" && body !== null) {
+				const errBody = body;
+				if (errBody.code === "INVALID_EMAIL" || errBody.code === "VALIDATION_ERROR") return {
+					ok: false,
+					error: Errors.invalidInput("email", errBody.message ?? "invalid email")
+				};
+			}
+			return {
+				ok: false,
+				error: Errors.providerError("better-auth", "sendOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError$1("sendOtp", err, options?.signal)
+			};
+		}
+	}
+	async verifyOtp(input, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "verifyOtp" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/sign-in/email-otp"), withSignal$1({
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					email: input.email,
+					otp: input.otp
+				}),
+				credentials: "include"
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "verifyOtp" })
+			};
+			const body = await safeJson$1(res);
+			if (res.ok) {
+				if (typeof body === "object" && body !== null) {
+					const okBody = body;
+					if (typeof okBody.token === "string" && typeof okBody.user === "object" && okBody.user !== null) return {
+						ok: true,
+						value: authSessionFromBetterAuth$1(okBody.token, okBody.user)
+					};
+				}
+				return {
+					ok: false,
+					error: Errors.providerError("better-auth", "verifyOtp", /* @__PURE__ */ new Error("unexpected 200 body"))
+				};
+			}
+			return {
+				ok: false,
+				error: mapBetterAuthError("verifyOtp", body)
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError$1("verifyOtp", err, options?.signal)
+			};
+		}
+	}
+	async getSession(options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "getSession" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/get-session"), withSignal$1({
+				method: "GET",
+				credentials: "include"
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "getSession" })
+			};
+			if (!res.ok) return {
+				ok: false,
+				error: Errors.providerError("better-auth", "getSession", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+			const body = await safeJson$1(res);
+			if (body === null) return {
+				ok: true,
+				value: null
+			};
+			if (typeof body === "object" && body !== null) {
+				const okBody = body;
+				if (typeof okBody.user === "object" && okBody.user !== null) return {
+					ok: true,
+					value: authSessionFromBetterAuth$1(okBody.session?.token ?? okBody.session?.id ?? "session", okBody.user)
+				};
+			}
+			return {
+				ok: true,
+				value: null
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError$1("getSession", err, options?.signal)
+			};
+		}
+	}
+	async signOut(options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "signOut" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/sign-out"), withSignal$1({
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: "{}",
+				credentials: "include"
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "signOut" })
+			};
+			if (res.ok) return {
+				ok: true,
+				value: void 0
+			};
+			return {
+				ok: false,
+				error: Errors.providerError("better-auth", "signOut", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError$1("signOut", err, options?.signal)
+			};
+		}
+	}
+	async getConvexJwt(options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "getConvexJwt" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/convex/token"), withSignal$1({
+				method: "GET",
+				credentials: "include"
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "getConvexJwt" })
+			};
+			if (res.status === 401) return {
+				ok: false,
+				error: Errors.notAuthenticated()
+			};
+			if (!res.ok) return {
+				ok: false,
+				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+			const body = await safeJson$1(res);
+			if (typeof body === "object" && body !== null) {
+				const okBody = body;
+				if (typeof okBody.token === "string" && okBody.token.length > 0) return {
+					ok: true,
+					value: {
+						token: toJwtToken(okBody.token),
+						expEpochSeconds: toEpochSeconds(decodeJwtExp$1(okBody.token))
+					}
+				};
+			}
+			return {
+				ok: false,
+				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error("unexpected body"))
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError$1("getConvexJwt", err, options?.signal)
+			};
+		}
+	}
+};
+function BetterAuthBrowserLayer(deps) {
+	return Layer.succeed(AuthClientPortTag, authClientPortFromPromiseAdapter(new BetterAuthBrowserAdapter(deps)));
+}
+//#endregion
+//#region src/adapters/auth-client/cookie-jar.ts
+function parseSetCookie(raw) {
+	const parts = raw.split(";").map((p) => p.trim());
+	if (parts.length === 0 || parts[0] === void 0) return null;
+	const nameValue = parts[0];
+	const eq = nameValue.indexOf("=");
+	if (eq < 0) return null;
+	const name = nameValue.slice(0, eq).trim();
+	const value = nameValue.slice(eq + 1).trim();
+	if (name.length === 0) return null;
+	let maxAgeSeconds = null;
+	let expiresEpochMs = null;
+	let path = null;
+	let httpOnly = false;
+	let secure = false;
+	let sameSite = null;
+	for (let i = 1; i < parts.length; i++) {
+		const part = parts[i];
+		if (part === void 0) continue;
+		const partEq = part.indexOf("=");
+		const key = (partEq < 0 ? part : part.slice(0, partEq)).trim().toLowerCase();
+		const val = partEq < 0 ? "" : part.slice(partEq + 1).trim();
+		if (key === "max-age") {
+			const n = Number(val);
+			if (Number.isFinite(n)) maxAgeSeconds = n;
+		} else if (key === "expires") {
+			const t = Date.parse(val);
+			if (Number.isFinite(t)) expiresEpochMs = t;
+		} else if (key === "path") path = val;
+		else if (key === "httponly") httpOnly = true;
+		else if (key === "secure") secure = true;
+		else if (key === "samesite") {
+			const lc = val.toLowerCase();
+			if (lc === "strict" || lc === "lax" || lc === "none") sameSite = lc;
+		}
+	}
+	return {
+		name,
+		value,
+		maxAgeSeconds,
+		expiresEpochMs,
+		path,
+		httpOnly,
+		secure,
+		sameSite
+	};
+}
+function isExpired(cookie, nowEpochMs) {
+	if (cookie.maxAgeSeconds !== null) {
+		if (cookie.maxAgeSeconds <= 0) return true;
+		return nowEpochMs >= cookie.storedAtEpochMs + cookie.maxAgeSeconds * 1e3;
+	}
+	if (cookie.expiresEpochMs !== null) return nowEpochMs >= cookie.expiresEpochMs;
+	return false;
+}
+var CookieJar = class {
+	store = /* @__PURE__ */ new Map();
+	set(host, setCookieHeaders) {
+		let perHost = this.store.get(host);
+		const now = Date.now();
+		for (const raw of setCookieHeaders) {
+			const parsed = parseSetCookie(raw);
+			if (parsed === null) continue;
+			if (perHost === void 0) {
+				perHost = /* @__PURE__ */ new Map();
+				this.store.set(host, perHost);
+			}
+			if (parsed.maxAgeSeconds !== null && parsed.maxAgeSeconds <= 0) {
+				perHost.delete(parsed.name);
+				continue;
+			}
+			perHost.set(parsed.name, {
+				...parsed,
+				storedAtEpochMs: now
+			});
+		}
+		if (perHost !== void 0 && perHost.size === 0) this.store.delete(host);
+	}
+	getCookieHeader(host) {
+		const perHost = this.store.get(host);
+		if (perHost === void 0 || perHost.size === 0) return null;
+		const now = Date.now();
+		const live = [];
+		for (const [name, cookie] of perHost.entries()) {
+			if (isExpired(cookie, now)) {
+				perHost.delete(name);
+				continue;
+			}
+			live.push(`${name}=${cookie.value}`);
+		}
+		if (live.length === 0) {
+			this.store.delete(host);
+			return null;
+		}
+		return live.join("; ");
+	}
+};
+//#endregion
+//#region src/adapters/auth-client/BetterAuthNodeAdapter.ts
+function withSignal(init, signal) {
+	return signal === void 0 ? init : {
+		...init,
+		signal
+	};
+}
+const DEFAULT_JWT_LIFETIME_S = 900;
+function decodeJwtExp(jwt) {
+	const parts = jwt.split(".");
+	if (parts.length < 2 || parts[1] === void 0) return Math.floor(Date.now() / 1e3) + DEFAULT_JWT_LIFETIME_S;
+	try {
+		const raw = parts[1].replace(/\s+/g, "");
+		const pad = "=".repeat((4 - raw.length % 4) % 4);
+		const decoded = Buffer.from(raw.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64").toString("utf-8");
+		const payload = JSON.parse(decoded);
+		if (typeof payload.exp === "number" && Number.isFinite(payload.exp) && payload.exp > 0) return payload.exp;
+	} catch {}
+	return Math.floor(Date.now() / 1e3) + DEFAULT_JWT_LIFETIME_S;
+}
+function authSessionFromBetterAuth(token, user) {
+	return {
+		authUserId: toAuthUserId(user.id),
+		email: toEmail(user.email),
+		token: toSessionToken(token),
+		expiresAt: toEpochMs(Date.now() + 10080 * 60 * 1e3)
+	};
+}
+async function safeJson(res) {
+	const raw = await res.text();
+	if (raw.length === 0 || raw === "null") return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+function hostFromBaseUrl(baseUrl) {
+	try {
+		return new URL(baseUrl).host;
+	} catch {
+		return baseUrl;
+	}
+}
+function originFromBaseUrl(baseUrl) {
+	try {
+		return new URL(baseUrl).origin;
+	} catch {
+		return;
+	}
+}
+function setCookiesFromResponse(jar, host, res) {
+	const ext = res.headers;
+	let setCookies = [];
+	if (typeof ext.getSetCookie === "function") setCookies = ext.getSetCookie();
+	else res.headers.forEach((value, key) => {
+		if (key.toLowerCase() === "set-cookie") setCookies.push(value);
+	});
+	if (setCookies.length > 0) jar.set(host, setCookies);
+}
+function isAbortError(err, signal) {
+	return signal?.aborted === true || err instanceof Error && err.name === "AbortError" || typeof DOMException !== "undefined" && err instanceof DOMException && err.name === "AbortError";
+}
+function mapFetchError(operation, err, signal) {
+	if (isAbortError(err, signal)) return Errors.cancelled({ operation });
+	return Errors.networkError(operation, err instanceof Error ? err : new Error(String(err)));
+}
+var BetterAuthNodeAdapter = class {
+	authBaseUrl;
+	host;
+	origin;
+	cookieJar;
+	fetchImpl;
+	constructor(deps) {
+		this.authBaseUrl = deps.authBaseUrl.replace(/\/$/, "");
+		this.host = hostFromBaseUrl(this.authBaseUrl);
+		this.origin = deps.origin?.replace(/\/$/, "");
+		this.cookieJar = deps.cookieJar ?? new CookieJar();
+		this.fetchImpl = deps.fetch ?? fetch;
+	}
+	url(path) {
+		return resolveAuthClientUrl(this.authBaseUrl, path);
+	}
+	headersWithCookie(extra = {}) {
+		const cookie = this.cookieJar.getCookieHeader(this.host);
+		return cookie !== null ? {
+			...extra,
+			cookie
+		} : { ...extra };
+	}
+	async canSendOtp(_input, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "canSendOtp" })
+		};
+		return {
+			ok: true,
+			value: {
+				allowed: true,
+				cooldownMs: toDurationMs(0)
+			}
+		};
+	}
+	async sendOtp(input, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "sendOtp" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/email-otp/send-verification-otp"), withSignal({
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					...this.origin ? { origin: this.origin } : {}
+				},
+				body: JSON.stringify({
+					email: input.email,
+					type: "sign-in"
+				})
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "sendOtp" })
+			};
+			if (res.ok) return {
+				ok: true,
+				value: void 0
+			};
+			if (res.status === 429) return {
+				ok: false,
+				error: Errors.rateLimited({ resource: "better-auth/sendOtp" })
+			};
+			const body = await safeJson(res);
+			if (typeof body === "object" && body !== null) {
+				const errBody = body;
+				if (errBody.code === "INVALID_EMAIL" || errBody.code === "VALIDATION_ERROR") return {
+					ok: false,
+					error: Errors.invalidInput("email", errBody.message ?? "invalid email")
+				};
+			}
+			return {
+				ok: false,
+				error: Errors.providerError("better-auth", "sendOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError("sendOtp", err, options?.signal)
+			};
+		}
+	}
+	async verifyOtp(input, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "verifyOtp" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/sign-in/email-otp"), withSignal({
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					...this.origin ? { origin: this.origin } : {}
+				},
+				body: JSON.stringify({
+					email: input.email,
+					otp: input.otp
+				})
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "verifyOtp" })
+			};
+			setCookiesFromResponse(this.cookieJar, this.host, res);
+			const body = await safeJson(res);
+			if (res.ok && typeof body === "object" && body !== null) {
+				const okBody = body;
+				if (typeof okBody.token === "string" && typeof okBody.user === "object" && okBody.user !== null) return {
+					ok: true,
+					value: authSessionFromBetterAuth(okBody.token, okBody.user)
+				};
+			}
+			if (!res.ok) {
+				if (typeof body === "object" && body !== null) {
+					const errBody = body;
+					if (errBody.code === "OTP_EXPIRED") return {
+						ok: false,
+						error: Errors.otpExpired()
+					};
+					if (errBody.code === "INVALID_OTP") return {
+						ok: false,
+						error: Errors.invalidInput("otp", errBody.message ?? "invalid OTP")
+					};
+				}
+			}
+			return {
+				ok: false,
+				error: Errors.providerError("better-auth", "verifyOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError("verifyOtp", err, options?.signal)
+			};
+		}
+	}
+	async getSession(options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "getSession" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/get-session"), withSignal({
+				method: "GET",
+				headers: this.headersWithCookie()
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "getSession" })
+			};
+			if (!res.ok) return {
+				ok: false,
+				error: Errors.providerError("better-auth", "getSession", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+			const body = await safeJson(res);
+			if (body === null) return {
+				ok: true,
+				value: null
+			};
+			if (typeof body === "object" && body !== null) {
+				const okBody = body;
+				if (typeof okBody.user === "object" && okBody.user !== null) return {
+					ok: true,
+					value: authSessionFromBetterAuth(okBody.session?.token ?? okBody.session?.id ?? "session", okBody.user)
+				};
+			}
+			return {
+				ok: true,
+				value: null
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError("getSession", err, options?.signal)
+			};
+		}
+	}
+	async signOut(options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "signOut" })
+		};
+		try {
+			const signOutOrigin = originFromBaseUrl(this.authBaseUrl) ?? this.origin;
+			const res = await this.fetchImpl(this.url("/api/auth/sign-out"), withSignal({
+				method: "POST",
+				headers: this.headersWithCookie({
+					"content-type": "application/json",
+					...signOutOrigin ? { origin: signOutOrigin } : {}
+				}),
+				body: "{}"
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "signOut" })
+			};
+			setCookiesFromResponse(this.cookieJar, this.host, res);
+			if (res.ok) return {
+				ok: true,
+				value: void 0
+			};
+			return {
+				ok: false,
+				error: Errors.providerError("better-auth", "signOut", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError("signOut", err, options?.signal)
+			};
+		}
+	}
+	async getConvexJwt(options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "getConvexJwt" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/convex/token"), withSignal({
+				method: "GET",
+				headers: this.headersWithCookie()
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "getConvexJwt" })
+			};
+			if (res.status === 401) return {
+				ok: false,
+				error: Errors.notAuthenticated()
+			};
+			if (!res.ok) return {
+				ok: false,
+				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+			const body = await safeJson(res);
+			if (typeof body === "object" && body !== null) {
+				const okBody = body;
+				if (typeof okBody.token === "string" && okBody.token.length > 0) return {
+					ok: true,
+					value: {
+						token: toJwtToken(okBody.token),
+						expEpochSeconds: toEpochSeconds(decodeJwtExp(okBody.token))
+					}
+				};
+			}
+			return {
+				ok: false,
+				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error("unexpected body"))
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError("getConvexJwt", err, options?.signal)
+			};
+		}
+	}
+};
+function BetterAuthNodeLayer(deps) {
+	return Layer.succeed(AuthClientPortTag, authClientPortFromPromiseAdapter(new BetterAuthNodeAdapter(deps)));
+}
+//#endregion
+//#region src/ports/bootstrap.ts
+var BootstrapError = class extends Data.TaggedError("BootstrapError") {};
+function bootstrapErrorFromCapxul(kind, error) {
+	return new BootstrapError({
+		operation: "resolve",
+		kind,
+		publicCode: error.code,
+		cause: error,
+		...kind === "notAuthenticated" || error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var BootstrapPortTag = class extends Context.Tag("@capxul/sdk/ports/BootstrapPort")() {};
+//#endregion
+//#region src/adapters/bootstrap/HttpBootstrapAdapter.ts
+async function safeText(res) {
+	try {
+		return await res.text();
+	} catch {
+		return "";
+	}
+}
+var HttpBootstrapAdapter = class {
+	bootstrapBaseUrl;
+	fetchImpl;
+	constructor(deps) {
+		this.bootstrapBaseUrl = deps.bootstrapBaseUrl.replace(/\/$/, "");
+		this.fetchImpl = deps.fetch ?? fetch;
+	}
+	resolve(input) {
+		return Effect.tryPromise({
+			try: () => {
+				const headers = {
+					"content-type": "application/json",
+					...input.origin === void 0 ? {} : { origin: input.origin }
+				};
+				return this.fetchImpl(`${this.bootstrapBaseUrl}/v1/client/bootstrap`, {
+					method: "POST",
+					headers,
+					body: JSON.stringify({ publishableKey: input.publishableKey })
+				});
+			},
+			catch: (cause) => bootstrapErrorFromCapxul("network", Errors.networkError("bootstrap", cause))
+		}).pipe(Effect.flatMap((res) => this.mapResponse(res)));
+	}
+	mapResponse(res) {
+		if (res.ok) return Effect.tryPromise({
+			try: async () => {
+				const body = await res.json();
+				const decoded = Schema.decodeUnknownEither(BootstrapEnvelope)(body);
+				if (Either.isLeft(decoded)) throw Errors.invalidInput("bootstrapEnvelope", decoded.left.message);
+				const { state } = decoded.right;
+				return {
+					applicationId: state.applicationId,
+					chainId: state.chainId,
+					sessionToken: state.sessionToken,
+					issuedAt: state.issuedAt,
+					expiresIn: state.expiresIn,
+					authBaseUrl: normalizeRuntimeUrl("authBaseUrl", state.authBaseUrl),
+					convexUrl: normalizeRuntimeUrl("convexUrl", state.convexUrl)
+				};
+			},
+			catch: (cause) => {
+				if (cause instanceof CapxulError && cause.code === "INVALID_INPUT") return bootstrapErrorFromCapxul("invalidInput", cause);
+				return bootstrapErrorFromCapxul("malformedBody", Errors.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
+			}
+		});
+		return Effect.promise(() => safeText(res)).pipe(Effect.flatMap((body) => {
+			if (res.status === 401 || body.startsWith("NOT_AUTHENTICATED")) return Effect.fail(bootstrapErrorFromCapxul("notAuthenticated", Errors.notAuthenticated()));
+			if (res.status === 400 || body.startsWith("INVALID_INPUT")) return Effect.fail(bootstrapErrorFromCapxul("invalidInput", Errors.invalidInput("publishableKey", "rejected by bootstrap")));
+			return Effect.fail(bootstrapErrorFromCapxul("provider", Errors.providerError("convex", "bootstrap", /* @__PURE__ */ new Error(`HTTP ${res.status}`))));
+		}));
+	}
+};
+function HttpBootstrapLayer(deps) {
+	return Layer.succeed(BootstrapPortTag, new HttpBootstrapAdapter(deps));
+}
+function normalizeRuntimeUrl(field, raw) {
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		throw Errors.invalidInput(field, "must be an http or https URL");
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors.invalidInput(field, "must be an http or https URL");
+	return parsed.toString().replace(/\/$/, "");
+}
+//#endregion
+//#region src/adapters/clock/SystemClockAdapter.ts
+var SystemClockAdapter = class {
+	now = Effect.try({
+		try: () => toEpochMs(Date.now()),
+		catch: (cause) => new ClockError({
+			operation: "now",
+			cause
+		})
+	});
+	sleep(duration) {
+		return Effect.async((resume) => {
+			const timeout = setTimeout(() => resume(Effect.void), duration);
+			return Effect.sync(() => clearTimeout(timeout));
+		});
+	}
+};
+function SystemClockLayer() {
+	return Layer.succeed(ClockPortTag, new SystemClockAdapter());
+}
+//#endregion
+//#region src/ports/convex-call.ts
+var ConvexCallError = class extends Data.TaggedError("ConvexCallError") {};
+function convexCallErrorFromCapxul(operation, error) {
+	return new ConvexCallError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause: error,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var ConvexCallPortTag = class extends Context.Tag("@capxul/sdk/ports/ConvexCallPort")() {};
+//#endregion
+//#region src/adapters/convex-call/ConvexCallAdapter.ts
+var ConvexCallAdapter = class {
+	#client;
+	#tokenProvider;
+	constructor(deps) {
+		this.#client = deps.client ?? new ConvexClient(deps.convexUrl);
+		this.#tokenProvider = deps.tokenProvider;
+		if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);
+	}
+	refreshAuth() {
+		if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);
+	}
+	query(fn, args) {
+		return Effect.tryPromise({
+			try: () => this.#client.query(fn, args),
+			catch: (cause) => mapToConvexCallError(getFunctionName(fn), cause)
+		});
+	}
+	mutation(fn, args) {
+		return Effect.tryPromise({
+			try: () => this.#client.mutation(fn, args),
+			catch: (cause) => mapToConvexCallError(getFunctionName(fn), cause)
+		});
+	}
+	action(fn, args) {
+		return Effect.tryPromise({
+			try: () => this.#client.action(fn, args),
+			catch: (cause) => mapToConvexCallError(getFunctionName(fn), cause)
+		});
+	}
+	subscribe(fn, args, callback) {
+		return Effect.try({
+			try: () => {
+				const path = getFunctionName(fn);
+				const unsubscribe = this.#client.onUpdate(fn, args, (value) => callback({
+					status: "ok",
+					value
+				}), (err) => callback({
+					status: "error",
+					error: mapToCapxulError(path, err)
+				}));
+				let active = true;
+				return () => {
+					if (!active) return;
+					active = false;
+					unsubscribe();
+				};
+			},
+			catch: (cause) => mapToConvexCallError(getFunctionName(fn), cause)
+		}).pipe(Effect.tap(() => Effect.sync(() => {
+			callback({ status: "loading" });
+		})));
+	}
+	async close() {
+		await this.#client.close();
+	}
+};
+function ConvexCallLayer(deps) {
+	return Layer.scoped(ConvexCallPortTag, Effect.acquireRelease(Effect.sync(() => new ConvexCallAdapter(deps)), (adapter) => Effect.promise(() => adapter.close()).pipe(Effect.orDie)));
+}
+function mapToCapxulError(operation, err) {
+	const decoded = decodeConvexError(err);
+	if (decoded !== null) return decoded;
+	if (err instanceof CapxulError) return err;
+	if (err instanceof Error) {
+		if (isTransportError(err)) return Errors.networkError(operation, err);
+		return Errors.providerError("convex", operation, err);
+	}
+	return Errors.providerError("convex", operation, new Error(String(err)));
+}
+function mapToConvexCallError(operation, err) {
+	return convexCallErrorFromCapxul(operation, mapToCapxulError(operation, err));
+}
+function isTransportError(err) {
+	const message = err.message.toLowerCase();
+	return message.includes("failed to fetch") || message.includes("network") || message.includes("econnrefused") || message.includes("econnreset") || message.includes("enotfound") || message.includes("etimedout") || message.includes("socket");
+}
+//#endregion
+//#region src/adapters/_shared/wire.ts
+/**
+* Documented brand-erasure helpers for the wire boundary.
+*
+* Branded primitives (`Address`, `ChainId`) carry compile-time tags that
+* vanish at runtime. When sending values across a wire — Convex function
+* args, viem's template-literal-typed parameters, raw JSON — we have to
+* remove the brand at the type level so the wire-side type system accepts
+* the value.
+*
+* Using these helpers (rather than ad-hoc `as number` / `as \`0x${string}\``
+* casts) localizes every de-branding site. If we ever need to centralize
+* validation (e.g. "must not de-brand a placeholder address"), the change
+* lands here once instead of grep-and-replace across every adapter.
+*/
+/**
+* De-brand a `ChainId` for the wire. The runtime representation is already
+* `number` — the cast removes the compile-time brand only.
+*/
+function wireChainId(chainId) {
+	return chainId;
+}
+/**
+* De-brand a `DurationMs` for the wire. The runtime representation is
+* already `number` — the cast removes the compile-time brand only.
+*
+* Used at Convex mutation call sites where the backend's schema expects
+* a plain `number` for `graceMs` (and similar duration fields). The
+* branded `DurationMs` type is the SDK's discipline; the wire format is
+* agnostic.
+*/
+function wireDurationMs(duration) {
+	return duration;
+}
+//#endregion
+//#region src/ports/credentials.ts
+var CredentialsError = class extends Data.TaggedError("CredentialsError") {};
+function credentialsErrorFromCapxul(operation, error, cause = error) {
+	return new CredentialsError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var CredentialsPortTag = class extends Context.Tag("@capxul/sdk/ports/CredentialsPort")() {};
+//#endregion
+//#region src/adapters/credentials/ConvexCredentialsAdapter.ts
+var ConvexCredentialsAdapter = class {
+	#convex;
+	constructor(deps) {
+		this.#convex = deps.convex;
+	}
+	listApplications(authUserId) {
+		return this.#convex.query(applicationsListFn, { authUserId: String(authUserId) }).pipe(Effect.mapError((error) => credentialsErrorFromCapxul("listApplications", error.publicError, error)), Effect.flatMap((rows) => Effect.try({
+			try: () => rows.map(brandDeveloperApplication),
+			catch: (cause) => credentialsErrorFromUnknown("listApplications", cause)
+		})));
+	}
+	createApplication(input) {
+		return this.#convex.mutation(applicationsCreateFn, {
+			authUserId: String(input.authUserId),
+			name: input.name,
+			allowedOrigins: input.allowedOrigins.map(String)
+		}).pipe(Effect.mapError((error) => credentialsErrorFromCapxul("createApplication", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => brandDeveloperApplication(row),
+			catch: (cause) => credentialsErrorFromUnknown("createApplication", cause)
+		})));
+	}
+	mintPublishableKey(input) {
+		return this.#convex.mutation(publishableKeysMintFn, {
+			applicationId: String(input.applicationId),
+			authUserId: String(input.authUserId)
+		}).pipe(Effect.mapError((error) => credentialsErrorFromCapxul("mintPublishableKey", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => brandPublishableKeyRecord(row),
+			catch: (cause) => credentialsErrorFromUnknown("mintPublishableKey", cause)
+		})));
+	}
+	rotatePublishableKey(input) {
+		return this.#convex.mutation(publishableKeysRotateFn, {
+			keyId: String(input.keyId),
+			authUserId: String(input.authUserId),
+			graceMs: wireDurationMs(input.graceMs)
+		}).pipe(Effect.mapError((error) => credentialsErrorFromCapxul("rotatePublishableKey", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => ({
+				active: brandPublishableKeyRecord(row.active),
+				retired: brandPublishableKeyRecord(row.retired)
+			}),
+			catch: (cause) => credentialsErrorFromUnknown("rotatePublishableKey", cause)
+		})));
+	}
+	revokePublishableKey(input) {
+		return this.#convex.mutation(publishableKeysRevokeFn, {
+			keyId: String(input.keyId),
+			authUserId: String(input.authUserId)
+		}).pipe(Effect.mapError((error) => credentialsErrorFromCapxul("revokePublishableKey", error.publicError, error)), Effect.asVoid);
+	}
+};
+function ConvexCredentialsLayer() {
+	return Layer.effect(CredentialsPortTag, Effect.map(ConvexCallPortTag, (convex) => new ConvexCredentialsAdapter({ convex })));
+}
+const applicationsListFn = makeFunctionReference("credentials/applications:list");
+const applicationsCreateFn = makeFunctionReference("credentials/applications:create");
+const publishableKeysMintFn = makeFunctionReference("credentials/publishableKeys:mint");
+const publishableKeysRotateFn = makeFunctionReference("credentials/publishableKeys:rotate");
+const publishableKeysRevokeFn = makeFunctionReference("credentials/publishableKeys:revoke");
+function brandDeveloperApplication(row) {
+	return {
+		id: toAppId(row.id),
+		authUserId: toAuthUserId(row.authUserId),
+		name: row.name,
+		allowedOrigins: row.allowedOrigins.map((o) => toAllowedOrigin(o)),
+		createdAt: toEpochMs(row.createdAt),
+		archivedAt: row.archivedAt === null ? null : toEpochMs(row.archivedAt)
+	};
+}
+function brandPublishableKeyRecord(row) {
+	return {
+		id: toPublishableKeyId(row.id),
+		applicationId: toAppId(row.applicationId),
+		activeFromMs: toEpochMs(row.activeFromMs),
+		gracePeriodEndsMs: row.gracePeriodEndsMs === null ? null : toEpochMs(row.gracePeriodEndsMs),
+		revokedAt: row.revokedAt === null ? null : toEpochMs(row.revokedAt)
+	};
+}
+function credentialsErrorFromUnknown(operation, cause) {
+	if (cause instanceof CapxulError) return credentialsErrorFromCapxul(operation, cause);
+	return credentialsErrorFromCapxul(operation, Errors.providerError("credentials", operation, cause instanceof Error ? cause : new Error(String(cause))), cause);
+}
+//#endregion
+//#region src/ports/env.ts
+var EnvError = class extends Data.TaggedError("EnvError") {};
+function envErrorFromCapxul(key, error, cause = error) {
+	return new EnvError({
+		publicError: error,
+		publicCode: error.code,
+		key,
+		...error.details === void 0 ? {} : { details: error.details },
+		cause
+	});
+}
+var EnvPortTag = class extends Context.Tag("@capxul/sdk/ports/EnvPort")() {};
+//#endregion
+//#region src/env/_internal.ts
+const envFields = {
+	NEXT_PUBLIC_CONVEX_URL: {
+		"runtime": "client",
+		"kind": "url",
+		"required": true,
+		"example": "https://example.convex.cloud"
+	},
+	NEXT_PUBLIC_CONVEX_SITE_URL: {
+		"runtime": "client",
+		"kind": "url",
+		"required": true,
+		"example": "https://example.convex.site"
+	},
+	NEXT_PUBLIC_OPENFORT_PUBLISHABLE_KEY: {
+		"runtime": "client",
+		"kind": "nonempty",
+		"required": true,
+		"example": "pk_test_openfort"
+	},
+	NEXT_PUBLIC_SHIELD_PUBLISHABLE_KEY: {
+		"runtime": "client",
+		"kind": "nonempty",
+		"required": true,
+		"example": "shield_pk_test"
+	},
+	NEXT_PUBLIC_FEE_SPONSORSHIP_ID: {
+		"runtime": "client",
+		"kind": "nonempty",
+		"required": false,
+		"example": "fee_sponsor"
+	},
+	NEXT_PUBLIC_POSTHOG_KEY: {
+		"runtime": "client",
+		"kind": "nonempty",
+		"required": false,
+		"example": "phc_test"
+	},
+	NEXT_PUBLIC_POSTHOG_HOST: {
+		"runtime": "client",
+		"kind": "url",
+		"required": false,
+		"example": "https://us.i.posthog.com"
+	},
+	NEXT_PUBLIC_SENTRY_DSN: {
+		"runtime": "client",
+		"kind": "url",
+		"required": false,
+		"example": "https://public@example.ingest.sentry.io/1"
+	},
+	SITE_URL: {
+		"runtime": "server",
+		"kind": "url",
+		"required": true,
+		"example": "https://app.capxul.test"
+	},
+	OPENFORT_SECRET_KEY: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": true,
+		"example": "sk_test_openfort"
+	},
+	OPENFORT_PUBLISHABLE_KEY: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": true,
+		"example": "pk_server_openfort"
+	},
+	OPENFORT_WALLET_SECRET: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": true,
+		"example": "wallet_secret"
+	},
+	SHIELD_PUBLISHABLE_KEY: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": true,
+		"example": "shield_pk_server"
+	},
+	SHIELD_SECRET_KEY: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": true,
+		"example": "shield_secret"
+	},
+	SHIELD_ENCRYPTION_SHARE: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": true,
+		"example": "shield_share"
+	},
+	FEE_SPONSORSHIP_ID: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": true,
+		"example": "fee_sponsor"
+	},
+	RESEND_API_KEY: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "re_test"
+	},
+	BREVO_API_KEY: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "brevo_test"
+	},
+	AUTH_MODE: {
+		"runtime": "server",
+		"kind": "authMode",
+		"required": false,
+		"example": "development"
+	},
+	AUTH_DEV_OTP: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "000000"
+	},
+	SENTRY_DSN: {
+		"runtime": "server",
+		"kind": "url",
+		"required": false,
+		"example": "https://public@example.ingest.sentry.io/1"
+	},
+	POSTHOG_API_KEY: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "phx_test"
+	},
+	POSTHOG_PROJECT_TOKEN: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "phc_test"
+	},
+	POSTHOG_INGEST_KEY: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "phc_test"
+	},
+	POSTHOG_HOST: {
+		"runtime": "server",
+		"kind": "url",
+		"required": false,
+		"example": "https://us.i.posthog.com"
+	},
+	POSTHOG_PERSONAL_API_KEY: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "phx_personal"
+	},
+	POSTHOG_PROJECT_ID: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "12345"
+	},
+	POSTHOG_ENV_ID: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "12345"
+	},
+	SENDER_EMAIL: {
+		"runtime": "server",
+		"kind": "email",
+		"required": false,
+		"example": "noreply@capxul.test"
+	},
+	SHIELD_API_URL: {
+		"runtime": "server",
+		"kind": "url",
+		"required": false,
+		"example": "https://api.shield.test"
+	},
+	ALCHEMY_API_KEY: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "alchemy_test"
+	},
+	ALCHEMY_GAS_POLICY_ID: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "policy_test"
+	},
+	ALCHEMY_WEBHOOK_SIGNING_KEY: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": true,
+		"example": "alchemy_hmac"
+	},
+	ALCHEMY_AUTH_TOKEN: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "alchemy_auth"
+	},
+	ALCHEMY_WEBHOOK_ID: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "wh_123"
+	},
+	GOLDSKY_WEBHOOK_SECRET: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "goldsky_secret"
+	},
+	DEPLOYER_PRIVATE_KEY: {
+		"runtime": "server",
+		"kind": "privateKey",
+		"required": true,
+		"example": "0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	},
+	BASE_SEPOLIA_RPC_URL: {
+		"runtime": "server",
+		"kind": "url",
+		"required": true,
+		"example": "https://sepolia.base.org"
+	},
+	CONVEX_SITE_URL: {
+		"runtime": "server",
+		"kind": "url",
+		"required": false,
+		"example": "https://example.convex.site"
+	},
+	AGENTMAIL_API_KEY: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "agentmail_test"
+	},
+	CAPXUL_E2E_PUBLISHABLE_KEY: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "cap_pk_test_00000000000000000000000000000000"
+	},
+	CAPXUL_E2E_ORIGIN: {
+		"runtime": "server",
+		"kind": "url",
+		"required": false,
+		"example": "https://e2e.test.capxul.local"
+	},
+	CAPXUL_E2E_REQUIRED: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "1"
+	},
+	CAPXUL_FAUCET_ENABLED: {
+		"runtime": "server",
+		"kind": "nonempty",
+		"required": false,
+		"example": "1"
+	}
+};
+function schemaFor(kind) {
+	switch (kind) {
+		case "authMode": return Schema.String.pipe(Schema.filter((value) => value === "development" || value === "production" || value === "test", { message: () => "Invalid enum value" }));
+		case "email": return Schema.String.pipe(Schema.filter((value) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value), { message: () => "Invalid email" }));
+		case "nonempty": return Schema.String.pipe(Schema.minLength(1));
+		case "privateKey": return Schema.String.pipe(Schema.filter((value) => /^0x[0-9a-fA-F]{64}$/.test(value), { message: () => "Must be a 0x-prefixed 32-byte hex private key" }));
+		case "url": return Schema.String.pipe(Schema.filter((value) => {
+			try {
+				return new URL(value).href.length > 0;
+			} catch {
+				return false;
+			}
+		}, { message: () => "Invalid url" }));
+		default: {
+			const unsupported = kind;
+			throw Errors.invalidInput(String(unsupported), "unsupported environment field kind");
+		}
+	}
+}
+const envShapeFields = Object.fromEntries(Object.entries(envFields).map(([key, field]) => [key, field.required ? schemaFor(field.kind) : Schema.optional(schemaFor(field.kind))]));
+const envShapeSchema = Schema.Struct(envShapeFields);
+Schema.partial(envShapeSchema);
+function parseEnvValue$1(key, raw, required) {
+	const field = envFields[key];
+	if (field === void 0) throw Errors.invalidInput(key, "unknown environment key");
+	const normalized = normalizeEnvRaw(raw);
+	if (normalized === void 0) {
+		if (required) throw Errors.envMissing(key);
+		return;
+	}
+	const result = Schema.decodeUnknownEither(schemaFor(field.kind))(normalized);
+	if (Either.isLeft(result)) throw Errors.invalidInput(key, TreeFormatter.formatErrorSync(result.left));
+	return result.right;
+}
+function normalizeEnvRaw(raw) {
+	if (raw === void 0 || raw.trim() === "") return;
+	return raw;
+}
+function runtimeEnv() {
+	return globalThis.process?.env ?? {};
+}
+//#endregion
+//#region src/adapters/env/_shared.ts
+function parseEnvValue(key, raw, required) {
+	return parseEnvValue$1(key, raw, required);
+}
+function hasEnvValue(key, raw) {
+	if (envFields[key] === void 0) throw envErrorFromCapxul(key, Errors.invalidInput(key, "unknown environment key"));
+	return normalizeEnvRaw(raw) !== void 0;
+}
+function catchEnvError(key, cause) {
+	if (cause instanceof EnvError) return cause;
+	if (isCapxulError(cause)) return envErrorFromCapxul(key, cause, cause);
+	const redactedCause = /* @__PURE__ */ new Error(`env ${key} read failed`);
+	return envErrorFromCapxul(key, Errors.providerError("env", key, redactedCause), redactedCause);
+}
+//#endregion
+//#region src/adapters/env/SystemEnvAdapter.ts
+var SystemEnvAdapter = class {
+	#source;
+	constructor(deps = {}) {
+		this.#source = deps.source ?? runtimeEnv();
+	}
+	require = (key) => Effect.try({
+		try: () => parseEnvValue(key, this.#source[key], true),
+		catch: (cause) => catchEnvError(key, cause)
+	});
+	optional = (key) => Effect.try({
+		try: () => parseEnvValue(key, this.#source[key], false),
+		catch: (cause) => catchEnvError(key, cause)
+	});
+	has = (key) => Effect.try({
+		try: () => hasEnvValue(key, this.#source[key]),
+		catch: (cause) => catchEnvError(key, cause)
+	});
+};
+function SystemEnvLayer(deps = {}) {
+	return Layer.succeed(EnvPortTag, new SystemEnvAdapter(deps));
+}
+//#endregion
+//#region src/ports/evm-signer.ts
+var EvmSignerError = class extends Data.TaggedError("EvmSignerError") {};
+function evmSignerErrorFromCapxul(operation, error, cause = error) {
+	return new EvmSignerError({
+		publicError: error,
+		publicCode: error.code,
+		operation,
+		...error.details === void 0 ? {} : { details: error.details },
+		cause
+	});
+}
+var EvmSignerPortTag = class extends Context.Tag("@capxul/sdk/ports/EvmSignerPort")() {};
+//#endregion
+//#region src/adapters/evm-signer/UnavailableEvmSignerAdapter.ts
+var UnavailableEvmSignerAdapter = class {
+	getAddress = Effect.fail(evmSignerErrorFromCapxul("getAddress", Errors.notImplemented("evmSigner", "getAddress")));
+	signMessage(_message) {
+		return Effect.fail(evmSignerErrorFromCapxul("signMessage", Errors.notImplemented("evmSigner", "signMessage")));
+	}
+	signUserOp(_userOperation) {
+		return Effect.fail(evmSignerErrorFromCapxul("signUserOp", Errors.notImplemented("evmSigner", "signUserOp")));
+	}
+};
+function UnavailableEvmSignerLayer() {
+	return Layer.effect(EvmSignerPortTag, Effect.succeed(new UnavailableEvmSignerAdapter()));
+}
+//#endregion
+//#region src/adapters/convex-identity.ts
+const identityLoadByAuthUserIdQuery = makeFunctionReference("identity/queries:loadByAuthUserId");
+const identityCreateMutation = makeFunctionReference("identity/mutations:create");
+const identityUpdateMutation = makeFunctionReference("identity/mutations:update");
+var ConvexIdentityAdapter = class {
+	#convex;
+	constructor(deps) {
+		this.#convex = deps.convex;
+	}
+	loadByAuthUserId(authUserId) {
+		return this.#convex.query(identityLoadByAuthUserIdQuery, { authUserId }).pipe(Effect.mapError((error) => identityErrorFromCapxul("loadByAuthUserId", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => row === null ? null : brandProfile(row),
+			catch: (cause) => identityErrorFromUnknown("loadByAuthUserId", cause)
+		})), Effect.catchAllDefect((cause) => Effect.fail(identityErrorFromUnknown("loadByAuthUserId", cause))));
+	}
+	create(input) {
+		return this.#convex.mutation(identityCreateMutation, input).pipe(Effect.mapError((error) => identityErrorFromCapxul("create", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => brandProfile(row),
+			catch: (cause) => identityErrorFromUnknown("create", cause)
+		})), Effect.catchAllDefect((cause) => Effect.fail(identityErrorFromUnknown("create", cause))));
+	}
+	update(input) {
+		return this.#convex.mutation(identityUpdateMutation, input).pipe(Effect.mapError((error) => identityErrorFromCapxul("update", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => brandProfile(row),
+			catch: (cause) => identityErrorFromUnknown("update", cause)
+		})), Effect.catchAllDefect((cause) => Effect.fail(identityErrorFromUnknown("update", cause))));
+	}
+};
+function ConvexIdentityLayer() {
+	return Layer.effect(IdentityPortTag, Effect.map(ConvexCallPortTag, (convex) => new ConvexIdentityAdapter({ convex })));
+}
+function brandProfile(raw) {
+	return {
+		authUserId: toAuthUserId(raw.authUserId),
+		email: toEmail(raw.email),
+		displayName: raw.displayName,
+		country: raw.country === null ? null : toCountryCode(raw.country),
+		kycTier: toKycTier(raw.kycTier),
+		createdAt: toEpochMs(raw.createdAt),
+		updatedAt: toEpochMs(raw.updatedAt)
+	};
+}
+function identityErrorFromUnknown(operation, cause) {
+	if (cause instanceof CapxulError) return identityErrorFromCapxul(operation, cause);
+	return identityErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
+}
+//#endregion
+//#region src/ports/account-read.ts
+var AccountReadError = class extends Data.TaggedError("AccountReadError") {};
+function accountReadErrorFromCapxul(operation, error, cause = error) {
+	return new AccountReadError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var AccountReadPortTag = class extends Context.Tag("@capxul/sdk/ports/AccountReadPort")() {};
+//#endregion
+//#region src/adapters/account-read/ConvexAccountAdapter.ts
+const DEFAULT_FUNCTIONS$2 = {
+	readBalance: makeFunctionReference("account/actions:readBalance"),
+	faucetMint: makeFunctionReference("account/actions:faucetMint")
+};
+var ConvexAccountAdapter = class {
+	#convex;
+	#fns;
+	constructor(deps) {
+		this.#convex = deps.convex;
+		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$2;
+	}
+	readBalance(input) {
+		return this.#convex.action(this.#fns.readBalance, { chainId: wireChainId(input.chainId) }).pipe(Effect.mapError((error) => accountReadErrorFromCapxul("readBalance", error.publicError, error)), Effect.flatMap((wire) => brandAccountEffect("readBalance", wire)), Effect.catchAllDefect((cause) => Effect.fail(accountReadErrorFromUnknown("readBalance", cause))));
+	}
+	fundFromFaucet(input) {
+		const operation = "fundFromFaucet";
+		return Effect.suspend(() => {
+			const rawAmount = toWei(input.amount);
+			return this.#convex.action(this.#fns.faucetMint, {
+				chainId: wireChainId(input.chainId),
+				rawAmount
+			});
+		}).pipe(Effect.mapError((error) => accountReadErrorFromCapxul(operation, error.publicError, error)), Effect.map((wire) => ({ txHash: wire.txHash })), Effect.catchAllDefect((cause) => Effect.fail(accountReadErrorFromUnknown(operation, cause))));
+	}
+};
+function ConvexAccountLayer() {
+	return Layer.effect(AccountReadPortTag, Effect.map(ConvexCallPortTag, (convex) => new ConvexAccountAdapter({ convex })));
+}
+function brandAccountEffect(operation, wire) {
+	return Effect.try({
+		try: () => brandAccount(wire),
+		catch: (cause) => accountReadErrorFromUnknown(operation, cause)
+	});
+}
+function brandAccount(wire) {
+	const balance = fromWei(wire.rawBalance, wire.decimals, wire.currency);
+	const available = fromWei(wire.rawAvailableBalance ?? wire.rawBalance, wire.decimals, wire.currency);
+	return {
+		id: toAccountId(wire.accountId),
+		balance,
+		available
+	};
+}
+function accountReadErrorFromUnknown(operation, cause) {
+	if (cause instanceof CapxulError) return accountReadErrorFromCapxul(operation, cause);
+	return accountReadErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
+}
+//#endregion
+//#region src/ports/sub-account.ts
+var SubAccountError = class extends Data.TaggedError("SubAccountError") {};
+function subAccountErrorFromCapxul(operation, error, cause = error) {
+	return new SubAccountError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var SubAccountPortTag = class extends Context.Tag("@capxul/sdk/ports/SubAccountPort")() {};
+//#endregion
+//#region src/adapters/sub-account/ConvexSubAccountAdapter.ts
+const DEFAULT_FUNCTIONS$1 = {
+	create: makeFunctionReference("subAccount/mutations:create"),
+	get: makeFunctionReference("subAccount/queries:get"),
+	list: makeFunctionReference("subAccount/queries:list"),
+	rename: makeFunctionReference("subAccount/mutations:rename"),
+	remove: makeFunctionReference("subAccount/mutations:remove"),
+	transfer: makeFunctionReference("subAccount/actions:transfer")
+};
+var ConvexSubAccountAdapter = class {
+	#convex;
+	#fns;
+	#chainId;
+	constructor(deps) {
+		this.#convex = deps.convex;
+		this.#chainId = deps.chainId;
+		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$1;
+	}
+	create(input) {
+		return this.#runMutation("create", this.#fns.create, {
+			accountId: input.accountId,
+			name: input.name
+		});
+	}
+	get(input) {
+		return this.#runQuery("get", this.#fns.get, { subAccountId: input.subAccountId }, (wire) => wire === null ? null : brandSubAccount(wire));
+	}
+	list(input) {
+		return this.#runQuery("list", this.#fns.list, { accountId: input.accountId }, (wires) => wires.map((wire) => brandSubAccount(wire)));
+	}
+	rename(input) {
+		return this.#runMutation("rename", this.#fns.rename, {
+			subAccountId: input.subAccountId,
+			name: input.name
+		});
+	}
+	delete(input) {
+		const operation = "delete";
+		return this.#convex.mutation(this.#fns.remove, { subAccountId: input.subAccountId }).pipe(Effect.mapError((error) => subAccountErrorFromCapxul(operation, error.publicError, error)), Effect.asVoid, Effect.catchAllDefect((cause) => Effect.fail(subAccountErrorFromUnknown(operation, cause))));
+	}
+	transfer(input) {
+		const operation = "transfer";
+		return Effect.suspend(() => {
+			const rawAmount = toWei(input.amount);
+			return this.#convex.action(this.#fns.transfer, {
+				chainId: this.#chainId,
+				from: input.from,
+				to: input.to,
+				rawAmount
+			});
+		}).pipe(Effect.mapError((error) => subAccountErrorFromCapxul(operation, error.publicError, error)), Effect.map((wire) => brandTransferResult(wire)), Effect.catchAllDefect((cause) => Effect.fail(subAccountErrorFromUnknown(operation, cause))));
+	}
+	#runMutation(operation, ref, args) {
+		return this.#convex.mutation(ref, args).pipe(Effect.mapError((error) => subAccountErrorFromCapxul(operation, error.publicError, error)), Effect.map((wire) => brandSubAccount(wire)), Effect.catchAllDefect((cause) => Effect.fail(subAccountErrorFromUnknown(operation, cause))));
+	}
+	#runQuery(operation, ref, args, map) {
+		return this.#convex.query(ref, args).pipe(Effect.mapError((error) => subAccountErrorFromCapxul(operation, error.publicError, error)), Effect.map(map), Effect.catchAllDefect((cause) => Effect.fail(subAccountErrorFromUnknown(operation, cause))));
+	}
+};
+function ConvexSubAccountLayer(chainId) {
+	return Layer.effect(SubAccountPortTag, Effect.map(ConvexCallPortTag, (convex) => new ConvexSubAccountAdapter({
+		convex,
+		chainId
+	})));
+}
+function brandTransferResult(wire) {
+	return {
+		available: fromWei(wire.availableRaw, wire.decimals, wire.currency),
+		from: wire.from === null ? null : brandSubAccount(wire.from),
+		to: wire.to === null ? null : brandSubAccount(wire.to)
+	};
+}
+function brandSubAccount(wire) {
+	return {
+		id: toSubAccountId(wire.subAccountId),
+		accountId: toAccountId(wire.accountId),
+		name: wire.name,
+		balance: fromWei(wire.rawBalance, wire.decimals, wire.currency),
+		createdAt: toEpochMs(wire.createdAt)
+	};
+}
+function subAccountErrorFromUnknown(operation, cause) {
+	if (cause instanceof CapxulError) return subAccountErrorFromCapxul(operation, cause);
+	return subAccountErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
+}
+//#endregion
+//#region src/ports/smart-account.ts
+var SmartAccountError = class extends Data.TaggedError("SmartAccountError") {};
+function smartAccountErrorFromCapxul(operation, error, cause = error) {
+	return new SmartAccountError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var SmartAccountPortTag = class extends Context.Tag("@capxul/sdk/ports/SmartAccountPort")() {};
+//#endregion
+//#region src/adapters/smart-account/ConvexSmartAccountAdapter.ts
+const DEFAULT_FUNCTIONS = {
+	loadByAuthUserId: makeFunctionReference("smartAccount/queries:loadByAuthUserId"),
+	loadBySmartAccountAddress: makeFunctionReference("smartAccount/queries:loadBySmartAccountAddress"),
+	provision: makeFunctionReference("smartAccount/mutations:provision"),
+	confirmDeployment: makeFunctionReference("smartAccount/actions:confirmDeployment"),
+	deployPrepare: makeFunctionReference("smartAccount/actions:deployPrepare"),
+	deploySubmit: makeFunctionReference("smartAccount/actions:deploySubmit")
+};
+var ConvexSmartAccountAdapter = class {
+	#convex;
+	#fns;
+	constructor(deps) {
+		this.#convex = deps.convex;
+		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS;
+	}
+	loadByAuthUserId(authUserId) {
+		return this.#convex.query(this.#fns.loadByAuthUserId, { authUserId }).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("loadByAuthUserId", error.publicError, error)), Effect.flatMap((row) => brandSmartAccountEffect("loadByAuthUserId", row)), Effect.catchAllDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("loadByAuthUserId", cause))));
+	}
+	loadBySmartAccountAddress(address) {
+		return this.#convex.query(this.#fns.loadBySmartAccountAddress, { address }).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("loadBySmartAccountAddress", error.publicError, error)), Effect.flatMap((row) => brandSmartAccountEffect("loadBySmartAccountAddress", row)), Effect.catchAllDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("loadBySmartAccountAddress", cause))));
+	}
+	provision(input) {
+		return this.#convex.mutation(this.#fns.provision, {
+			signerAddress: input.signerAddress,
+			chainId: wireChainId(input.chainId)
+		}).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("provision", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => brandProvisionedSmartAccount(input.authUserId, row),
+			catch: (cause) => smartAccountErrorFromUnknown("provision", cause)
+		})), Effect.catchAllDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("provision", cause))));
+	}
+	confirmDeployment(input) {
+		const evidence = {
+			chainId: wireChainId(input.evidence.chainId),
+			signerAddress: input.evidence.signerAddress,
+			safeAddress: input.evidence.safeAddress,
+			...input.evidence.userOpHash === void 0 ? {} : { userOpHash: input.evidence.userOpHash },
+			...input.evidence.txHash === void 0 ? {} : { txHash: input.evidence.txHash },
+			...input.evidence.blockNumber === void 0 ? {} : { blockNumber: input.evidence.blockNumber }
+		};
+		return this.#convex.action(this.#fns.confirmDeployment, {
+			chainId: wireChainId(input.chainId),
+			safeAddress: input.safeAddress,
+			...input.telemetryRunId === void 0 ? {} : { telemetryRunId: input.telemetryRunId },
+			evidence
+		}).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("confirmDeployment", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => brandProvisionedSmartAccount(input.authUserId, row),
+			catch: (cause) => smartAccountErrorFromUnknown("confirmDeployment", cause)
+		})), Effect.catchAllDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("confirmDeployment", cause))));
+	}
+	deployPrepare(input) {
+		return this.#convex.action(this.#fns.deployPrepare, {
+			chainId: wireChainId(input.chainId),
+			...input.telemetryRunId === void 0 ? {} : { telemetryRunId: input.telemetryRunId }
+		}).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("deployPrepare", error.publicError, error)), Effect.flatMap((result) => Effect.try({
+			try: () => {
+				if (typeof result.digest !== "string" || !isHex(result.digest) || result.digest.length !== 66) throw Errors.invalidInput("digest", "must be 0x-prefixed 32-byte hex");
+				return {
+					digest: result.digest,
+					safeAddress: toAddress(result.safeAddress),
+					userOp: result.userOp
+				};
+			},
+			catch: (cause) => smartAccountErrorFromUnknown("deployPrepare", cause)
+		})), Effect.catchAllDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("deployPrepare", cause))));
+	}
+	deploySubmit(input) {
+		return this.#convex.action(this.#fns.deploySubmit, {
+			chainId: wireChainId(input.chainId),
+			signature: input.signature,
+			userOp: input.userOp,
+			...input.telemetryRunId === void 0 ? {} : { telemetryRunId: input.telemetryRunId }
+		}).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("deploySubmit", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => brandProvisionedSmartAccount(input.authUserId, row),
+			catch: (cause) => smartAccountErrorFromUnknown("deploySubmit", cause)
+		})), Effect.catchAllDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("deploySubmit", cause))));
+	}
+};
+function ConvexSmartAccountLayer() {
+	return Layer.effect(SmartAccountPortTag, Effect.map(ConvexCallPortTag, (convex) => new ConvexSmartAccountAdapter({ convex })));
+}
+function brandSmartAccountEffect(operation, wire) {
+	return Effect.try({
+		try: () => wire === null ? null : brandNonNullSmartAccount(wire),
+		catch: (cause) => smartAccountErrorFromUnknown(operation, cause)
+	});
+}
+function brandNonNullSmartAccount(wire) {
+	return {
+		authUserId: toAuthUserId(wire.authUserId),
+		signerAddress: toAddress(wire.signerAddress),
+		smartAccountAddress: toAddress(wire.smartAccountAddress),
+		chainId: toChainId(wire.chainId),
+		deployedAt: wire.deployedAt === null ? null : toEpochMs(wire.deployedAt),
+		createdAt: toEpochMs(wire.createdAt)
+	};
+}
+function brandProvisionedSmartAccount(requestedAuthUserId, wire) {
+	if (wire.authUserId !== String(requestedAuthUserId)) throw Errors.notAuthenticated();
+	return brandNonNullSmartAccount(wire);
+}
+function smartAccountErrorFromUnknown(operation, cause) {
+	if (cause instanceof CapxulError) return smartAccountErrorFromCapxul(operation, cause);
+	return smartAccountErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
+}
+toAddress("0xa6b71e26c5e0845f74c812102ca7114b6a896ab2");
+keccak256("0x");
+`${"ab".repeat(32)}`;
+//#endregion
+//#region src/adapters/telemetry/PostHogTelemetryAdapter.ts
+var PostHogTelemetryAdapter = class {
+	#capture;
+	#identify;
+	#group;
+	#reset;
+	constructor(deps) {
+		this.#capture = deps.capture;
+		this.#identify = deps.identify ?? (() => void 0);
+		this.#group = deps.group ?? (() => void 0);
+		this.#reset = deps.reset ?? (() => void 0);
+	}
+	emit(event) {
+		return Effect.sync(() => {
+			this.#runFireAndForget(() => this.#capture(event.name, redactTelemetryProps(event.name, cloneProps(event.props))));
+		});
+	}
+	identify(input) {
+		return Effect.sync(() => {
+			this.#runFireAndForget(() => this.#identify(cloneIdentifyInput(input)));
+		});
+	}
+	group(input) {
+		return Effect.sync(() => {
+			this.#runFireAndForget(() => this.#group(cloneGroupInput(input)));
+		});
+	}
+	reset() {
+		return Effect.sync(() => {
+			this.#runFireAndForget(() => this.#reset());
+		});
+	}
+	#runFireAndForget(operation) {
+		try {
+			Promise.resolve(operation()).catch(() => {});
+		} catch {}
+	}
+};
+function PostHogTelemetryLayer(deps) {
+	return Layer.succeed(TelemetryPortTag, new PostHogTelemetryAdapter(deps));
+}
+function cloneIdentifyInput(input) {
+	const traits = input.traits === void 0 ? void 0 : cloneProps(input.traits);
+	const properties = input.properties === void 0 ? void 0 : cloneProps(input.properties);
+	return {
+		distinctId: input.distinctId,
+		...input.anonDistinctId === void 0 ? {} : { anonDistinctId: input.anonDistinctId },
+		...traits === void 0 ? {} : { traits },
+		...properties === void 0 ? {} : { properties }
+	};
+}
+function cloneGroupInput(input) {
+	const properties = input.properties === void 0 ? void 0 : cloneProps(input.properties);
+	return properties === void 0 ? {
+		groupType: input.groupType,
+		groupKey: input.groupKey
+	} : {
+		groupType: input.groupType,
+		groupKey: input.groupKey,
+		properties
+	};
+}
+function cloneProps(props) {
+	if (props === void 0) return void 0;
+	const cloned = {};
+	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue(value);
+	return cloned;
+}
+function cloneTelemetryValue(value) {
+	if (Array.isArray(value)) return value.map(cloneTelemetryValue);
+	if (value === null || typeof value !== "object") return value;
+	if (Object.getPrototypeOf(value) !== Object.prototype) return value;
+	const cloned = {};
+	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue(nested);
+	return cloned;
+}
+//#endregion
+//#region src/ports/transport.ts
+var TransportError = class extends Data.TaggedError("TransportError") {};
+function transportErrorFromCapxul(operation, request, error, cause = error) {
+	return new TransportError({
+		operation,
+		name: request.name,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...request.correlationId === void 0 ? {} : { correlationId: request.correlationId },
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var TransportPortTag = class extends Context.Tag("@capxul/sdk/ports/TransportPort")() {};
+//#endregion
+//#region src/adapters/transport/ConvexTransportAdapter.ts
+var ConvexTransportAdapter = class {
+	#convex;
+	constructor(convex) {
+		this.#convex = convex;
+	}
+	runQuery(request) {
+		return this.#call("query", request, () => {
+			const fn = makeFunctionReference(request.name);
+			return this.#convex.query(fn, asRecordArgs(request.args));
+		});
+	}
+	runMutation(request) {
+		return this.#call("mutation", request, () => {
+			const fn = makeFunctionReference(request.name);
+			return this.#convex.mutation(fn, asRecordArgs(request.args));
+		});
+	}
+	runAction(request) {
+		return this.#call("action", request, () => {
+			const fn = makeFunctionReference(request.name);
+			return this.#convex.action(fn, asRecordArgs(request.args));
+		});
+	}
+	#call(operation, request, run) {
+		return Effect.try({
+			try: run,
+			catch: (cause) => transportErrorFromThrown(operation, request, cause)
+		}).pipe(Effect.flatMap((effect) => effect.pipe(Effect.mapError((error) => transportErrorFromConvex(operation, request, error)), Effect.catchAllDefect((cause) => Effect.fail(transportErrorFromThrown(operation, request, cause))))));
+	}
+};
+function ConvexTransportLayer(_deps = {}) {
+	return Layer.effect(TransportPortTag, Effect.gen(function* () {
+		return new ConvexTransportAdapter(yield* ConvexCallPortTag);
+	}));
+}
+function transportErrorFromConvex(operation, request, error) {
+	return transportErrorFromCapxul(operation, request, error.publicError, error.cause);
+}
+function asRecordArgs(args) {
+	if (args !== null && typeof args === "object" && !Array.isArray(args)) return args;
+	return { value: args };
+}
+function transportErrorFromThrown(operation, request, cause) {
+	return transportErrorFromCapxul(operation, request, cause instanceof Error ? Errors.providerError("transport", request.name, cause) : Errors.providerError("transport", request.name, new Error(String(cause))), cause);
+}
+const SDK_VERSION = version;
+const collectProductionFlowPorts = Effect.gen(function* () {
+	const authClient = yield* AuthClientPortTag;
+	const authCache = yield* AuthCachePortTag;
+	const bootstrap = yield* BootstrapPortTag;
+	const clock = yield* ClockPortTag;
+	const convexCall = yield* ConvexCallPortTag;
+	const credentials = yield* CredentialsPortTag;
+	const env = yield* EnvPortTag;
+	const evmSigner = yield* EvmSignerPortTag;
+	return {
+		authClient,
+		authCache,
+		identity: yield* IdentityPortTag,
+		smartAccount: yield* SmartAccountPortTag,
+		accountRead: yield* AccountReadPortTag,
+		subAccount: yield* SubAccountPortTag,
+		credentials,
+		bootstrap,
+		evmSigner,
+		clock,
+		env,
+		telemetry: yield* TelemetryPortTag,
+		transport: yield* TransportPortTag,
+		convexCall
+	};
+});
+function makeProductionAdapterLayerEntries(input) {
+	const refreshConvexAuthRef = {
+		current: null,
+		pending: false
+	};
+	return [
+		{
+			name: "bootstrap",
+			layer: productionBootstrapPortLayer(input.bootstrap)
+		},
+		{
+			name: "authClient",
+			layer: productionAuthClientLayer(input, refreshConvexAuthRef)
+		},
+		{
+			name: "authCache",
+			layer: productionAuthCacheLayer(input)
+		},
+		{
+			name: "identity",
+			layer: ConvexIdentityLayer()
+		},
+		{
+			name: "smartAccount",
+			layer: ConvexSmartAccountLayer()
+		},
+		{
+			name: "accountRead",
+			layer: ConvexAccountLayer()
+		},
+		{
+			name: "subAccount",
+			layer: ConvexSubAccountLayer(input.chainId)
+		},
+		{
+			name: "credentials",
+			layer: ConvexCredentialsLayer()
+		},
+		{
+			name: "evmSigner",
+			layer: input.evmSigner === void 0 ? UnavailableEvmSignerLayer() : Layer.succeed(EvmSignerPortTag, input.evmSigner)
+		},
+		{
+			name: "clock",
+			layer: SystemClockLayer()
+		},
+		{
+			name: "env",
+			layer: SystemEnvLayer()
+		},
+		{
+			name: "telemetry",
+			layer: input.telemetry === void 0 ? PostHogTelemetryLayer({ capture: () => void 0 }) : Layer.succeed(TelemetryPortTag, input.telemetry)
+		},
+		{
+			name: "transport",
+			layer: ConvexTransportLayer()
+		},
+		{
+			name: "convexCall",
+			layer: productionConvexCallLayer(input, refreshConvexAuthRef)
+		}
+	];
+}
+function mergeProductionAdapterLayers(entries) {
+	const byName = /* @__PURE__ */ new Map();
+	for (const entry of entries) byName.set(entry.name, entry.layer);
+	const authClientLayer = byName.get("authClient");
+	const convexCallLayer = byName.get("convexCall");
+	const convexCallReadyLayer = convexCallLayer === void 0 || authClientLayer === void 0 ? convexCallLayer : convexCallLayer.pipe(Layer.provide(authClientLayer));
+	return entries.map((entry) => {
+		const layer = byName.get(entry.name) ?? entry.layer;
+		if (entry.name === "convexCall") return convexCallReadyLayer ?? layer;
+		if (isConvexDependentLayer(entry.name)) return convexCallReadyLayer === void 0 ? layer : layer.pipe(Layer.provide(convexCallReadyLayer));
+		return layer;
+	}).reduce((current, layer) => Layer.merge(current, layer), Layer.empty);
+}
+function isConvexDependentLayer(name) {
+	return name === "identity" || name === "smartAccount" || name === "accountRead" || name === "subAccount" || name === "credentials" || name === "transport";
+}
+function productionBootstrapPortLayer(bootstrap) {
+	return Layer.succeed(BootstrapPortTag, bootstrap);
+}
+function productionAuthClientLayer(input, refreshConvexAuthRef) {
+	return (input.runtime === "browser" ? BetterAuthBrowserLayer({
+		authBaseUrl: input.runtimeUrls.authBaseUrl,
+		...input.fetch === void 0 ? {} : { fetch: input.fetch }
+	}) : BetterAuthNodeLayer({
+		authBaseUrl: input.runtimeUrls.authBaseUrl,
+		...input.origin === void 0 ? {} : { origin: input.origin },
+		...input.fetch === void 0 ? {} : { fetch: input.fetch }
+	})).pipe(Layer.map((context) => {
+		const authClient = Context.get(context, AuthClientPortTag);
+		return Context.make(AuthClientPortTag, refreshConvexAuthOnSession(authClient, () => {
+			const refresh = refreshConvexAuthRef.current;
+			if (refresh === null) {
+				refreshConvexAuthRef.pending = true;
+				return;
+			}
+			refresh();
+		}));
+	}));
+}
+function productionAuthCacheLayer(input) {
+	return Layer.succeed(AuthCachePortTag, input.authCache ?? detectAuthCacheAdapter());
+}
+function productionConvexCallLayer(input, refreshConvexAuthRef) {
+	return Layer.unwrapEffect(Effect.map(AuthClientPortTag, (authClient) => ConvexCallLayer({
+		convexUrl: input.runtimeUrls.convexUrl,
+		...input.convexClient === void 0 ? {} : { client: input.convexClient },
+		tokenProvider: async ({ forceRefreshToken }) => {
+			const tokenResult = await Effect.runPromise(Effect.either(authClient.getConvexJwt({
+				forceRefresh: forceRefreshToken,
+				...input.signal === void 0 ? {} : { signal: input.signal }
+			})));
+			if (Either.isLeft(tokenResult)) return null;
+			return String(tokenResult.right.token);
+		}
+	}).pipe(Layer.map((context) => {
+		const convexCall = Context.get(context, ConvexCallPortTag);
+		if (isRefreshableConvexCallPort(convexCall)) {
+			refreshConvexAuthRef.current = () => convexCall.refreshAuth();
+			if (refreshConvexAuthRef.pending) {
+				refreshConvexAuthRef.pending = false;
+				refreshConvexAuthRef.current();
+			}
+		}
+		return context;
+	}))));
+}
+function isRefreshableConvexCallPort(convexCall) {
+	return "refreshAuth" in convexCall && typeof convexCall.refreshAuth === "function";
+}
+async function createProductionAdapters(input) {
+	const resolvedInput = resolveInput(input);
+	if (!resolvedInput.ok) return resolvedInput;
+	const scope = await Effect.runPromise(Scope.make());
+	const closeScope = idempotentClose(() => Effect.runPromise(Scope.close(scope, Exit.void)));
+	const bootstrapLayer = HttpBootstrapLayer({
+		bootstrapBaseUrl: resolvedInput.value.bootstrapBaseUrl,
+		...input.fetch === void 0 ? {} : { fetch: input.fetch }
+	});
+	try {
+		const bootstrapContext = await Effect.runPromise(Layer.buildWithScope(bootstrapLayer, scope));
+		const bootstrap = Context.get(bootstrapContext, BootstrapPortTag);
+		const bootstrapResult = await runBootstrap(bootstrap.resolve({
+			publishableKey: resolvedInput.value.publishableKey,
+			...resolvedInput.value.origin === void 0 ? {} : { origin: resolvedInput.value.origin }
+		}));
+		if (!bootstrapResult.ok) {
+			await emitBootstrapTelemetry(input.telemetry, {
+				name: "bootstrap_failed",
+				props: {
+					...bootstrapTelemetryEnvelope(input, resolvedInput.value),
+					reason: bootstrapResult.error.code
+				}
+			});
+			await closeScope().catch(() => void 0);
+			return bootstrapResult;
+		}
+		const runtimeUrls = resolveRuntimeUrls(bootstrapResult.value);
+		if (!runtimeUrls.ok) {
+			await emitBootstrapTelemetry(input.telemetry, {
+				name: "bootstrap_failed",
+				props: {
+					...bootstrapTelemetryEnvelope(input, resolvedInput.value),
+					applicationId: bootstrapResult.value.applicationId,
+					reason: runtimeUrls.error.code
+				}
+			});
+			await closeScope().catch(() => void 0);
+			return runtimeUrls;
+		}
+		await emitBootstrapTelemetry(input.telemetry, {
+			name: "bootstrap_resolved",
+			props: {
+				...bootstrapTelemetryEnvelope(input, resolvedInput.value),
+				applicationId: bootstrapResult.value.applicationId
+			}
+		});
+		let injectedClient;
+		const convexClientFactory = input.convexClientFactory;
+		if (convexClientFactory !== void 0) try {
+			injectedClient = convexClientFactory(runtimeUrls.value.convexUrl);
+		} catch (cause) {
+			await closeScope().catch(() => void 0);
+			return {
+				ok: false,
+				error: toPublicError(cause, "createProductionAdapters")
+			};
+		}
+		const portsLayer = mergeProductionAdapterLayers(makeProductionAdapterLayerEntries({
+			bootstrap,
+			runtime: resolvedInput.value.runtime,
+			...resolvedInput.value.origin === void 0 ? {} : { origin: resolvedInput.value.origin },
+			runtimeUrls: runtimeUrls.value,
+			chainId: bootstrapResult.value.chainId,
+			...input.authCache === void 0 ? {} : { authCache: input.authCache },
+			...input.telemetry === void 0 ? {} : { telemetry: input.telemetry },
+			...input.evmSigner === void 0 ? {} : { evmSigner: input.evmSigner },
+			...injectedClient === void 0 ? {} : { convexClient: injectedClient },
+			...input.fetch === void 0 ? {} : { fetch: input.fetch },
+			...input.signal === void 0 ? {} : { signal: input.signal }
+		}));
+		const portsContext = await Effect.runPromise(Layer.buildWithScope(portsLayer, scope));
+		return {
+			ok: true,
+			value: {
+				ports: await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(portsContext))),
+				bootstrap: bootstrapResult.value,
+				close: closeScope
+			}
+		};
+	} catch (cause) {
+		await closeScope().catch(() => void 0);
+		return {
+			ok: false,
+			error: toPublicError(cause, "createProductionAdapters")
+		};
+	}
+}
+function refreshConvexAuthOnSession(authClient, refresh) {
+	return {
+		...authClient,
+		verifyOtp: (input, options) => authClient.verifyOtp(input, options).pipe(Effect.tap(() => Effect.sync(refresh))),
+		signOut: (options) => authClient.signOut(options).pipe(Effect.tap(() => Effect.sync(refresh)))
+	};
+}
+async function createCapxulClient(input) {
+	const adapters = await createProductionAdapters(input);
+	if (!adapters.ok) return adapters;
+	try {
+		const orgDeploymentPort = input.orgDeploymentPortFactory === void 0 ? void 0 : input.orgDeploymentPortFactory(adapters.value.ports.convexCall);
+		const client = assembleCapxulClient({
+			ports: adapters.value.ports,
+			bootstrap: adapters.value.bootstrap,
+			authCache: adapters.value.ports.authCache,
+			requirement: input.requirement ?? "none",
+			...input.signer === void 0 ? {} : { signer: input.signer },
+			...orgDeploymentPort === void 0 ? {} : {
+				orgDeploymentPort,
+				orgRolesDeploymentPort: orgDeploymentPort,
+				orgSpendPort: orgDeploymentPort
+			},
+			...input.orgDeploymentConfig === void 0 ? {} : { orgDeploymentConfig: input.orgDeploymentConfig },
+			...input.signal === void 0 ? {} : { signal: input.signal },
+			...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
+			invokeTimeoutMs: input.invokeTimeoutMs ?? 3e4
+		});
+		return {
+			ok: true,
+			value: {
+				...client,
+				_internal: {
+					...client._internal,
+					close: adapters.value.close
+				}
+			}
+		};
+	} catch (cause) {
+		await adapters.value.close().catch(() => void 0);
+		return {
+			ok: false,
+			error: toPublicError(cause, "createCapxulClient")
+		};
+	}
+}
+function resolveInput(input) {
+	try {
+		const runtime = input.runtime ?? detectRuntime();
+		const publishableKey = toPublishableKey(input.publishableKey);
+		const origin = input.origin === void 0 ? runtime === "browser" ? toAllowedOrigin(derivedBrowserOrigin(runtime)) : void 0 : toAllowedOrigin(input.origin);
+		return {
+			ok: true,
+			value: {
+				publishableKey,
+				...origin === void 0 ? {} : { origin },
+				bootstrapBaseUrl: normalizeHttpUrl("bootstrapBaseUrl", input.bootstrapBaseUrl ?? "https://api.capxul.com"),
+				runtime
+			}
+		};
+	} catch (cause) {
+		return {
+			ok: false,
+			error: toPublicError(cause, "createProductionAdapters")
+		};
+	}
+}
+function detectRuntime() {
+	const globalAny = globalThis;
+	return globalAny.window !== void 0 || globalAny.document !== void 0 ? "browser" : "node";
+}
+function derivedBrowserOrigin(runtime) {
+	if (runtime !== "browser") throw Errors.invalidInput("origin", "required outside browser runtime");
+	const globalAny = globalThis;
+	if (typeof globalAny.location?.origin === "string" && globalAny.location.origin.length > 0) return globalAny.location.origin;
+	throw Errors.invalidInput("origin", "required when browser location is unavailable");
+}
+function resolveRuntimeUrls(bootstrap) {
+	try {
+		return {
+			ok: true,
+			value: {
+				authBaseUrl: normalizeHttpUrl("authBaseUrl", bootstrap.authBaseUrl),
+				convexUrl: normalizeHttpUrl("convexUrl", bootstrap.convexUrl)
+			}
+		};
+	} catch (cause) {
+		return {
+			ok: false,
+			error: toPublicError(cause, "createProductionAdapters")
+		};
+	}
+}
+async function runBootstrap(effect) {
+	const result = await Effect.runPromise(Effect.either(effect));
+	if (Either.isRight(result)) return {
+		ok: true,
+		value: result.right
+	};
+	return {
+		ok: false,
+		error: toPublicError(result.left, "bootstrap.resolve")
+	};
+}
+function bootstrapTelemetryEnvelope(input, resolvedInput) {
+	return {
+		capxulEnv: resolvedInput.runtime,
+		env: input.requirement ?? "none",
+		...resolvedInput.origin === void 0 ? {} : { origin: resolvedInput.origin },
+		sdkVersion: SDK_VERSION
+	};
+}
+async function emitBootstrapTelemetry(telemetry, event) {
+	if (telemetry === void 0) return;
+	await Effect.runPromise(telemetry.emit(event).pipe(Effect.catchAllDefect(() => Effect.void)));
+}
+function normalizeHttpUrl(field, raw) {
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		throw Errors.invalidInput(field, "must be an http or https URL");
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors.invalidInput(field, "must be an http or https URL");
+	return parsed.toString().replace(/\/$/, "");
+}
+function toPublicError(cause, operation) {
+	if (cause instanceof CapxulError) return cause;
+	if (typeof cause === "object" && cause !== null) {
+		const publicError = cause.publicError;
+		if (publicError instanceof CapxulError) return publicError;
+		const nestedCause = cause.cause;
+		if (nestedCause instanceof CapxulError) return nestedCause;
+	}
+	return Errors.providerError("sdk-production-adapters", operation, cause);
+}
+function idempotentClose(close) {
+	let closed = false;
+	return async () => {
+		if (closed) return;
+		closed = true;
+		await close();
+	};
+}
+//#endregion
+export { assembleCapxulClient, createCapxulClient, eip1193AccountProvider, injectedWalletSigner, localPrivateKeyAccountProvider, openfortEmbeddedAccountProvider };
+
+//# sourceMappingURL=index.mjs.map