@capxul/sdk 0.2.0-alpha.4 → 0.2.0-alpha.5

package/dist/client-CbUeJoM9.d.ts

@@ -1,1335 +0,0 @@
-import { Account as Account$1 } from 'viem';
-import { AnyStateMachine } from 'xstate';
-import { A as AccountId, S as SafeId, c as KycProfileId, b as ExternalAccountId, f as SubAccountId, d as OrganizationId, a as ApiKeyId, X as TimestampIso, U as Username, E as Email, D as DocumentId, O as OperationId, P as PaymentId, g as TransferId, k as WithdrawalId, W as WebhookEndpointId, j as WebhookEventId, M as MemberId, V as VirtualAccountId, i as VirtualCardId } from './next-action-CTGl8wpy.js';
-import { d as CapxulResult, C as CapxulError } from './errors-CwhCWGxm.js';
-import { A as Account, X as UserIdentifier, a as AccountLookupResult, S as Safe, k as KycProfile, E as ExternalAccount, L as List, F as SubAccount, B as BalanceLedgerEntry, b as ApiKey, a5 as CreateApiKeyRequest, a6 as CreateDocumentRequest, D as Document, O as Operation, q as OperationStatus, p as Money, C as CreatePaymentResult, t as Payment, Q as TransferEndpoint, f as CreateTransferResult, J as Transfer, g as CreateWithdrawalResult, a3 as Withdrawal, a7 as CreateWebhookEndpointRequest, a1 as WebhookEndpoint, a2 as WebhookEvent, s as Organization, W as Treasury, o as MembershipStatus, M as Member, n as MemberInviteResponse, a8 as CreateVirtualAccountRequest, Y as VirtualAccount, a9 as CreateVirtualCardRequest, _ as VirtualCard } from './types-BD4VAQb5.js';
-
-/**
- * Accounts domain — individual user accounts per sdk-surface.md §1a.
- *
- * Nested namespaces under `accounts.*` follow Pattern A per CANON.md
- * §4.30: `accounts.safes.retrieve(safeId)`, `accounts.subAccounts.list()`,
- * etc. — no ambient account context; the argument carries the scope.
- */
-
-type AccountLookupInput = UserIdentifier;
-type AccountUpdateInput = Partial<{
-    readonly name: string;
-    readonly username: string;
-    readonly countryCode: string;
-}>;
-type LocalPrivateKeySignerProvider = {
-    readonly kind: "local-private-key";
-    readonly signerAddress: string;
-};
-type AccountProvisionPersonalInput = {
-    readonly displayName?: string;
-    readonly username?: string;
-    readonly countryCode?: string;
-    readonly signerProvider: LocalPrivateKeySignerProvider;
-};
-type AccountCreateKycProfileInput = {
-    readonly accountId: AccountId;
-};
-type AccountListInput = {
-    readonly limit?: number;
-    readonly cursor?: string;
-};
-type AccountCreateSubAccountInput = {
-    readonly accountId: AccountId;
-    readonly name: string;
-    readonly purpose?: string;
-};
-type AccountCreateExternalAccountInput = {
-    readonly accountId: AccountId;
-    readonly kind: "bank" | "evm" | "solana" | "starknet" | "card_payout";
-    readonly label?: string;
-    readonly address?: string;
-    readonly iban?: string;
-    readonly bic?: string;
-    readonly accountHolder?: string;
-    readonly network?: "visa" | "mastercard";
-    readonly panToken?: string;
-    readonly last4?: string;
-};
-type RetrieveCodes$e = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
-type LookupCodes = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT";
-type UpdateCodes$1 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "INVALID_INPUT";
-type ListCodes$b = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT";
-type SafeRetrieveCodes$1 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "SAFE_NOT_READY";
-type RemoveCodes$5 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
-type SubAccountRemoveCodes$1 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "INVALID_INPUT";
-type AccountSafesClient = {
-    readonly retrieve: (safeId: SafeId) => Promise<CapxulResult<Safe, SafeRetrieveCodes$1>>;
-};
-type AccountKycProfilesClient = {
-    readonly create: (input: AccountCreateKycProfileInput) => Promise<CapxulResult<KycProfile, UpdateCodes$1>>;
-    readonly retrieve: (kycProfileId: KycProfileId) => Promise<CapxulResult<KycProfile, RetrieveCodes$e>>;
-};
-type AccountExternalAccountsClient = {
-    readonly create: (input: AccountCreateExternalAccountInput) => Promise<CapxulResult<ExternalAccount, UpdateCodes$1>>;
-    readonly list: (input: {
-        readonly accountId: AccountId;
-    } & AccountListInput) => Promise<CapxulResult<List<ExternalAccount>, ListCodes$b>>;
-    readonly retrieve: (externalAccountId: ExternalAccountId) => Promise<CapxulResult<ExternalAccount, RetrieveCodes$e>>;
-    readonly remove: (externalAccountId: ExternalAccountId) => Promise<CapxulResult<void, RemoveCodes$5>>;
-};
-type AccountSubAccountsClient = {
-    readonly create: (input: AccountCreateSubAccountInput) => Promise<CapxulResult<SubAccount, UpdateCodes$1 | "PROVIDER_ERROR">>;
-    readonly list: (input: {
-        readonly accountId: AccountId;
-    } & AccountListInput) => Promise<CapxulResult<List<SubAccount>, ListCodes$b | "PROVIDER_ERROR">>;
-    readonly retrieve: (subAccountId: SubAccountId) => Promise<CapxulResult<SubAccount, RetrieveCodes$e | "PROVIDER_ERROR">>;
-    readonly remove: (subAccountId: SubAccountId) => Promise<CapxulResult<SubAccount, SubAccountRemoveCodes$1 | "PROVIDER_ERROR">>;
-};
-type AccountBalanceLedgerClient = {
-    readonly list: (input: {
-        readonly accountId: AccountId;
-    } & AccountListInput) => Promise<CapxulResult<List<BalanceLedgerEntry>, ListCodes$b>>;
-    readonly retrieve: (entryId: string) => Promise<CapxulResult<BalanceLedgerEntry, RetrieveCodes$e>>;
-};
-type AccountsClient = {
-    readonly retrieve: (accountId: AccountId) => Promise<CapxulResult<Account, RetrieveCodes$e>>;
-    readonly lookup: (input: AccountLookupInput) => Promise<CapxulResult<AccountLookupResult, LookupCodes>>;
-    readonly update: (input: {
-        readonly accountId: AccountId;
-    } & AccountUpdateInput) => Promise<CapxulResult<Account, UpdateCodes$1>>;
-    readonly provisionPersonal: (input: AccountProvisionPersonalInput) => Promise<CapxulResult<Account, UpdateCodes$1 | "NETWORK_ERROR">>;
-    readonly safes: AccountSafesClient;
-    readonly kycProfiles: AccountKycProfilesClient;
-    readonly externalAccounts: AccountExternalAccountsClient;
-    readonly subAccounts: AccountSubAccountsClient;
-    readonly balanceLedger: AccountBalanceLedgerClient;
-};
-
-/**
- * API keys domain — org-issued credentials per sdk-surface.md §1b +
- * §4.21 + §4.57. Key types: `cap_test_` / `cap_live_` (secret) and
- * `cap_pk_test_` / `cap_pk_live_` (publishable).
- *
- * All methods are org-nested. The one-time `secret` value is returned
- * on `create` only; subsequent reads omit it.
- */
-
-type ApiKeysCreateInput = CreateApiKeyRequest & {
-    readonly organizationId: OrganizationId;
-};
-type ApiKeysRetrieveInput = {
-    readonly organizationId: OrganizationId;
-    readonly apiKeyId: ApiKeyId;
-};
-type ApiKeysListInput = {
-    readonly organizationId: OrganizationId;
-    readonly limit?: number;
-    readonly cursor?: string;
-};
-type ApiKeysRevokeInput = ApiKeysRetrieveInput;
-type CreateCodes$8 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT" | "RATE_LIMITED" | "NETWORK_ERROR";
-type RetrieveCodes$d = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
-type ListCodes$a = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT";
-type RevokeCodes = RetrieveCodes$d;
-/**
- * Shape returned by `organizations.apiKeys.create` — the one-time
- * secret `value` is included here and omitted from every subsequent
- * read.
- */
-type ApiKeyCreateResult = ApiKey & {
-    readonly value: string;
-};
-type ApiKeysClient = {
-    readonly create: (input: ApiKeysCreateInput) => Promise<CapxulResult<ApiKeyCreateResult, CreateCodes$8>>;
-    readonly retrieve: (input: ApiKeysRetrieveInput) => Promise<CapxulResult<ApiKey, RetrieveCodes$d>>;
-    readonly list: (input: ApiKeysListInput) => Promise<CapxulResult<List<ApiKey>, ListCodes$a>>;
-    readonly revoke: (input: ApiKeysRevokeInput) => Promise<CapxulResult<ApiKey, RevokeCodes>>;
-};
-
-interface CapxulDataClient {
-    query(name: any, args: any): Promise<any>;
-    mutation(name: any, args: any): Promise<any>;
-    action?(name: any, args: any): Promise<any>;
-}
-
-/**
- * Authentication domain.
- *
- * Maps 1:1 to `/v1/auth/*` HTTP endpoints. Human sign-in via email OTP;
- * partner servers mint short-lived service tokens from a long-lived
- * API key per sdk-surface.md §3.2.
- *
- * Stack-1 update: outbound HTTP routes through `makeHttpTransport`
- * (`packages/sdk/src/transport.ts`) so that `core/auth.ts` no longer
- * owns base-URL validation or `fetch` indirection. The BetterAuth
- * `/api/auth` path-mangling stays here — it is auth-protocol-specific
- * and the transport layer is auth-protocol-agnostic by design.
- *
- * Lazy transport construction: when `config.auth.baseUrl` is absent the
- * SDK is in scaffold/CLI mode and `sendOtp` / `verifyOtp` return the
- * `NOT_IMPLEMENTED` `stub` tuple (preserving the prior behavior). Only
- * when `baseUrl` is configured do we construct the transport — at
- * which point the build-time-urls variant of `BrowserCapxulConfig`
- * runs its own `Errors.invalidInput` validation.
- */
-
-type Session = {
-    readonly authUserId: string;
-    readonly accountId?: AccountId;
-    readonly email: string;
-    readonly token: string;
-    readonly convexJwt?: string;
-    readonly expiresAt: TimestampIso;
-};
-type AuthSessionStore = {
-    get(): Session | null;
-    set(session: Session): void;
-    clear(): void;
-};
-type AuthBootstrapToken = string & {
-    readonly __capxulAuthBootstrapTokenBrand: "AuthBootstrapToken";
-};
-type AuthBootstrapReason = "new_member" | "missing_profile" | "missing_account" | "missing_safe" | "missing_signer_grant";
-type VerifyOtpResult = {
-    readonly kind: "existing_member";
-    readonly session: Session;
-    readonly account: Account;
-    readonly username: Username;
-    readonly safe: Safe;
-} | {
-    readonly kind: "bootstrap_required";
-    readonly session: Session;
-    readonly bootstrapToken: AuthBootstrapToken;
-    readonly email: Email;
-    readonly reason: AuthBootstrapReason;
-    readonly username?: Username;
-};
-type CompleteBootstrapInput = {
-    readonly bootstrapToken: AuthBootstrapToken;
-    readonly username: Username;
-    readonly displayName?: string;
-    readonly countryCode?: string;
-};
-type CompleteBootstrapResult = {
-    readonly kind: "authenticated";
-    readonly session: Session;
-    readonly account: Account;
-    readonly username: Username;
-    readonly safe: Safe;
-};
-/**
- * Options bag for auth methods that perform outbound `fetch` work.
- *
- * Accepts an `AbortSignal` so XState v5 actors (and any other caller
- * that wants cancellation) can cancel the in-flight HTTP request when
- * the actor stops. The signal flows through `transport.fetch`'s
- * `RequestInit.signal` and into the underlying `fetch` impl, so
- * `signal.aborted === true` propagates to the network layer per the
- * Web Platform `fetch` contract. See PR #406 S5.
- */
-type AuthMethodOptions = {
-    readonly signal?: AbortSignal;
-};
-
-/**
- * AuthService — unified promise-based auth surface.
- *
- * Wraps the imperative `AuthClient` tuple API with a class-based,
- * promise-based interface. `signOut` preserves the data-client
- * reference so provider-owned singletons survive sign-in/sign-out
- * cycles.
- */
-
-declare class AuthService {
-    private authClient;
-    private sessionStore;
-    private config;
-    constructor(config?: CapxulConfig);
-    sendOtp(email: string, options?: AuthMethodOptions): Promise<void>;
-    verifyOtp(email: string, otp: string, options?: AuthMethodOptions): Promise<VerifyOtpResult>;
-    completeBootstrap(params: CompleteBootstrapInput, signer?: Account$1): Promise<CompleteBootstrapResult>;
-    /**
-     * Clears the persisted session and, when a transport was pre-injected,
-     * drops the cached auth header.
-     *
-     * **Transport safety note:** `clearAuth()` is only invoked when
-     * `config._transport` was supplied at construction (e.g. by the React
-     * provider). If `AuthService` is instantiated directly in a Node/CLI
-     * context without an injected transport, the transport-side auth cache
-     * is the caller's responsibility.
-     */
-    signOut(): Promise<void>;
-    getSession(): Promise<Session | null>;
-}
-
-/**
- * Documents domain — unified artifact primitive per sdk-surface.md §1a
- * + §4.50.
- *
- * Subsumes the former `invoice` and `org_payroll_entry` top-level
- * primitives. The `Document` union discriminates on `type`:
- * `invoice | payroll_run | payroll_schedule | receipt | kyc_upload |
- * bank_statement | tax_form`.
- */
-
-type DocumentsCreateInput = CreateDocumentRequest;
-type DocumentsListInput = {
-    readonly limit?: number;
-    readonly cursor?: string;
-    readonly type?: Document["type"];
-};
-type OrgDocumentsCreateInput = DocumentsCreateInput & {
-    readonly organizationId: OrganizationId;
-};
-type OrgDocumentsRetrieveInput = {
-    readonly organizationId: OrganizationId;
-    readonly documentId: DocumentId;
-};
-type OrgDocumentsListInput = {
-    readonly organizationId: OrganizationId;
-    readonly limit?: number;
-    readonly cursor?: string;
-    readonly type?: Document["type"];
-};
-type OrgDocumentsCancelInput = {
-    readonly organizationId: OrganizationId;
-    readonly documentId: DocumentId;
-};
-type CreateCodes$7 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT" | "IDEMPOTENCY_CONFLICT" | "RATE_LIMITED" | "NETWORK_ERROR";
-type RetrieveCodes$c = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "INVALID_INPUT";
-type ListCodes$9 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT";
-type CancelCodes$1 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "INVALID_INPUT" | "OPERATION_CANCELED";
-type DocumentsClient = {
-    readonly create: (input: DocumentsCreateInput) => Promise<CapxulResult<Document, CreateCodes$7>>;
-    readonly retrieve: (documentId: DocumentId) => Promise<CapxulResult<Document, RetrieveCodes$c>>;
-    readonly list: (input?: DocumentsListInput) => Promise<CapxulResult<List<Document>, ListCodes$9>>;
-    readonly cancel: (documentId: DocumentId) => Promise<CapxulResult<Document, CancelCodes$1>>;
-};
-type OrgDocumentsClient = {
-    readonly create: (input: OrgDocumentsCreateInput) => Promise<CapxulResult<Document, CreateCodes$7>>;
-    readonly retrieve: (input: OrgDocumentsRetrieveInput) => Promise<CapxulResult<Document, RetrieveCodes$c>>;
-    readonly list: (input: OrgDocumentsListInput) => Promise<CapxulResult<List<Document>, ListCodes$9>>;
-    readonly cancel: (input: OrgDocumentsCancelInput) => Promise<CapxulResult<Document, CancelCodes$1>>;
-};
-
-/**
- * External-accounts domain — top-level `capxul.externalAccounts.*`.
- *
- * Per sdk-surface.md §1a, `external_account` is a reusable withdrawal
- * destination. `create` + `list` live under the owner's nested
- * namespace (Pattern A — `accounts.externalAccounts.*` or
- * `organizations.externalAccounts.*`). The top-level `retrieve` and
- * `remove` keep PERSONAL-scope semantics — for org rows route via
- * the `organizations.externalAccounts.*` namespace which carries
- * `organizationId` end-to-end and pins the row's owner pair to
- * prevent cross-org IDOR (revision 1, #464).
- *
- * Withdrawals v1 W1 (#464) wires these stubs through the
- * `externalAccounts/{queries,mutations}` Convex domain. The wire shape
- * matches OpenAPI: `{ object: "external_account", id, kind, status,
- * ..., operation: { id, status, correlationId } }` — the trust-chain
- * ids live under the canonical nested `operation: OperationSummary`
- * envelope (revision 3, #464), matching Withdrawal / Payment /
- * Transfer / Organization. The SDK rebrands `id` + the nested
- * `operation` sub-ids at the read edge.
- */
-
-type RetrieveCodes$b = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
-type RemoveCodes$4 = RetrieveCodes$b;
-type ExternalAccountsClient = {
-    readonly retrieve: (externalAccountId: ExternalAccountId) => Promise<CapxulResult<ExternalAccount, RetrieveCodes$b>>;
-    readonly remove: (externalAccountId: ExternalAccountId) => Promise<CapxulResult<void, RemoveCodes$4>>;
-};
-
-/**
- * `me` — first-party-only surface for the authenticated user.
- *
- * Partner SDK code (service-key lens) uses `capxul.accounts.retrieve(id)`
- * instead. This namespace exists because the CLI and `useMe()` hook
- * in `@capxul/sdk-react` always know the calling user and shouldn't
- * need to pass the account id.
- *
- * See `/docs/internal/reset/sdk-surface` + `packages/sdk/tests/walkthroughs/me-retrieve.ts`.
- */
-
-type MeUpdateInput = Partial<{
-    readonly name: string;
-    readonly username: string;
-    readonly countryCode: string;
-}>;
-type MeGetCodes = "NOT_AUTHENTICATED" | "PROFILE_NOT_FOUND";
-type MeUpdateCodes = "NOT_AUTHENTICATED" | "PROFILE_NOT_FOUND" | "INVALID_INPUT";
-type MeClient = {
-    readonly get: () => Promise<CapxulResult<Account, MeGetCodes>>;
-    readonly update: (input: MeUpdateInput) => Promise<CapxulResult<Account, MeUpdateCodes>>;
-};
-
-/**
- * Operations domain — durable async-work envelope per sdk-surface.md §1b.
- *
- * `retrieve` is a snapshot read (no polling). `wait` is the opt-in
- * polling helper per CANON.md §4.40 — caller explicitly asks to block
- * until a terminal condition or timeout.
- */
-
-type OperationsWaitInput = {
-    readonly until?: readonly OperationStatus[];
-    readonly timeoutSeconds?: number;
-    readonly pollIntervalMs?: number;
-};
-type RetrieveCodes$a = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
-type WaitCodes = RetrieveCodes$a | "OPERATION_TIMEOUT";
-type OperationsClient = {
-    readonly retrieve: (operationId: OperationId) => Promise<CapxulResult<Operation, RetrieveCodes$a>>;
-    readonly wait: (operationId: OperationId, input?: OperationsWaitInput) => Promise<CapxulResult<Operation, WaitCodes>>;
-};
-
-/**
- * Payments domain.
- *
- * Exposes both the personal-scope `PaymentsClient` (under
- * `capxul.payments.*`) and the org-scoped `OrgPaymentsClient` (under
- * `capxul.organizations.payments.*`). The org variant takes
- * `organizationId` explicitly on every call; there is no ambient org
- * context.
- *
- * See `/docs/internal/reset/sdk-surface` and the walkthroughs in
- * `packages/sdk/tests/walkthroughs/`.
- */
-
-type PaymentsCreateInput = {
-    readonly to: UserIdentifier;
-    readonly amount: Money;
-    readonly reference?: string;
-    readonly idempotencyKey?: string;
-    readonly include?: readonly string[];
-    /**
-     * Funds v1 (#420): tag the payment with the originating sub-account.
-     * This personal data-path forwards the field to Convex; broader
-     * organization and React hook wiring lands in #421 alongside
-     * `include: ["balancesByCustody"]` read paths.
-     */
-    readonly source?: {
-        readonly subAccountId: SubAccountId;
-    };
-};
-type PaymentsListInput = {
-    readonly limit?: number;
-    readonly cursor?: string;
-    readonly include?: readonly string[];
-};
-type OrgPaymentsCreateInput = {
-    readonly organizationId: OrganizationId;
-    readonly source?: {
-        readonly subAccountId: SubAccountId;
-    };
-    readonly to: UserIdentifier;
-    readonly amount: Money;
-    readonly reference?: string;
-    readonly idempotencyKey?: string;
-    readonly include?: readonly string[];
-};
-type OrgPaymentsRetrieveInput = {
-    readonly organizationId: OrganizationId;
-    readonly paymentId: PaymentId;
-};
-type OrgPaymentsListInput = {
-    readonly organizationId: OrganizationId;
-    readonly limit?: number;
-    readonly cursor?: string;
-    readonly include?: readonly string[];
-};
-type CreateCodes$6 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT" | "INVALID_RECIPIENT" | "INSUFFICIENT_BALANCE" | "IDEMPOTENCY_CONFLICT" | "RATE_LIMITED" | "NETWORK_ERROR";
-type OrgCreateCodes = CreateCodes$6 | "POLICY_DENIED" | "SAFE_NOT_READY";
-type RetrieveCodes$9 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
-type ListCodes$8 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT";
-type PaymentsClient = {
-    readonly create: (input: PaymentsCreateInput) => Promise<CapxulResult<CreatePaymentResult, CreateCodes$6>>;
-    readonly retrieve: (paymentId: PaymentId) => Promise<CapxulResult<Payment, RetrieveCodes$9>>;
-    readonly list: (input?: PaymentsListInput) => Promise<CapxulResult<List<Payment>, ListCodes$8>>;
-};
-type OrgPaymentsClient = {
-    readonly create: (input: OrgPaymentsCreateInput) => Promise<CapxulResult<CreatePaymentResult, OrgCreateCodes>>;
-    readonly retrieve: (input: OrgPaymentsRetrieveInput) => Promise<CapxulResult<Payment, RetrieveCodes$9>>;
-    readonly list: (input: OrgPaymentsListInput) => Promise<CapxulResult<List<Payment>, ListCodes$8>>;
-};
-
-/**
- * Transfers domain — cross-custody internal moves per CANON.md §4.53.
- *
- * A transfer moves balance between custody sources owned by the same
- * account or organization (e.g. EUR virtual-account → USD stablecoin
- * pool). When currencies differ the wire carries an `fx` block with a
- * quote id the caller confirms via `transfers.confirm(...)` per §4.58.
- */
-
-type TransfersCreateInput = {
-    readonly source: TransferEndpoint;
-    readonly destination: TransferEndpoint;
-    readonly amount: Money;
-    readonly idempotencyKey?: string;
-    readonly include?: readonly string[];
-};
-type TransfersListInput = {
-    readonly limit?: number;
-    readonly cursor?: string;
-};
-type TransfersConfirmInput = {
-    readonly transferId: TransferId;
-    readonly quoteId: string;
-};
-type OrgTransfersCreateInput = TransfersCreateInput & {
-    readonly organizationId: OrganizationId;
-};
-type OrgTransfersRetrieveInput = {
-    readonly organizationId: OrganizationId;
-    readonly transferId: TransferId;
-};
-type OrgTransfersListInput = {
-    readonly organizationId: OrganizationId;
-    readonly limit?: number;
-    readonly cursor?: string;
-};
-type OrgTransfersConfirmInput = {
-    readonly organizationId: OrganizationId;
-    readonly transferId: TransferId;
-    readonly quoteId: string;
-};
-type OrgTransfersCancelInput = {
-    readonly organizationId: OrganizationId;
-    readonly transferId: TransferId;
-};
-type CreateCodes$5 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT" | "INSUFFICIENT_BALANCE" | "IDEMPOTENCY_CONFLICT" | "RATE_LIMITED" | "NETWORK_ERROR";
-type RetrieveCodes$8 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
-type ListCodes$7 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT";
-type ConfirmCodes = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "QUOTE_EXPIRED" | "QUOTE_NOT_FOUND";
-type CancelCodes = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "OPERATION_CANCELED";
-type TransfersClient = {
-    readonly create: (input: TransfersCreateInput) => Promise<CapxulResult<CreateTransferResult, CreateCodes$5>>;
-    readonly retrieve: (transferId: TransferId) => Promise<CapxulResult<Transfer, RetrieveCodes$8>>;
-    readonly list: (input?: TransfersListInput) => Promise<CapxulResult<List<Transfer>, ListCodes$7>>;
-    readonly confirm: (input: TransfersConfirmInput) => Promise<CapxulResult<Transfer, ConfirmCodes>>;
-    readonly cancel: (transferId: TransferId) => Promise<CapxulResult<Transfer, CancelCodes>>;
-};
-type OrgTransfersClient = {
-    readonly create: (input: OrgTransfersCreateInput) => Promise<CapxulResult<CreateTransferResult, CreateCodes$5>>;
-    readonly retrieve: (input: OrgTransfersRetrieveInput) => Promise<CapxulResult<Transfer, RetrieveCodes$8>>;
-    readonly list: (input: OrgTransfersListInput) => Promise<CapxulResult<List<Transfer>, ListCodes$7>>;
-    readonly confirm: (input: OrgTransfersConfirmInput) => Promise<CapxulResult<Transfer, ConfirmCodes>>;
-    readonly cancel: (input: OrgTransfersCancelInput) => Promise<CapxulResult<Transfer, CancelCodes>>;
-};
-
-/**
- * Withdrawals domain — funds exit Capxul via an `external_account` per
- * sdk-surface.md §1a + §4.52 + withdrawal-orchestration.mdx.
- *
- * Withdrawals v1 W2 (#465) refactor:
- * - The `kind` shim on `destination` is GONE. The backend now resolves
- *   the destination row by FK and infers kind + rail. Anything that
- *   doesn't route to `chain_wallet` returns `VERIFICATION_REQUIRED`.
- * - Org-scope `create` is now a real mutation (no longer a stub).
- *   Personal-scope keeps the on-chain submission tail; org-scope
- *   returns the `processing` row only — Safe + Zodiac orchestration
- *   ships in W3+ (D6).
- * - All raw `try/catch` blocks have been replaced with `tryCatch` from
- *   `@repo/observability`, mirroring `core/external-accounts.ts`
- *   (precedent D2).
- */
-
-type WithdrawalsCreateInput = {
-    readonly amount: Money;
-    readonly destination: {
-        readonly externalAccountId: ExternalAccountId;
-    };
-    readonly source?: {
-        readonly subAccountId: SubAccountId;
-    };
-    readonly reference?: string;
-    readonly idempotencyKey?: string;
-    readonly include?: readonly string[];
-};
-type WithdrawalsListInput = {
-    readonly limit?: number;
-    readonly cursor?: string;
-};
-/**
- * Withdrawals v1 W4 (#467) — input for the reconciliation pipe.
- * Caller passes the same `txHash` that `recordSubmitted` wrote; the
- * backend cross-checks the value against the persisted operation row.
- *
- * `withdrawalId` accepts either the branded `WithdrawalId` or a raw
- * string. `txHash` is a raw string at the SDK boundary — the backend
- * re-validates the shape via `toTxHash` at the mutation handler (the
- * SDK package is no longer coupled to `@repo/types`'s brand surface
- * post the alpha-epic decoupling; see
- * `packages/sdk/docs/internal/decoupling-prep.md`).
- */
-type WithdrawalsRecordCompletedInput = {
-    readonly withdrawalId: WithdrawalId | string;
-    readonly txHash: string;
-};
-type OrgWithdrawalsCreateInput = WithdrawalsCreateInput & {
-    readonly organizationId: OrganizationId;
-};
-type OrgWithdrawalsRetrieveInput = {
-    readonly organizationId: OrganizationId;
-    readonly withdrawalId: WithdrawalId;
-};
-type OrgWithdrawalsListInput = {
-    readonly organizationId: OrganizationId;
-    readonly limit?: number;
-    readonly cursor?: string;
-};
-type CreateCodes$4 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT" | "INSUFFICIENT_BALANCE" | "IDEMPOTENCY_CONFLICT" | "KYC_REQUIRED" | "POLICY_DENIED" | "RATE_LIMITED" | "NETWORK_ERROR" | "NOT_FOUND" | "VERIFICATION_REQUIRED";
-type RetrieveCodes$7 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
-type ListCodes$6 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT";
-/**
- * Narrow code set for `recordCompleted`. Mirror of `recordSubmitted`'s
- * code surface — the SDK does NOT export `recordSubmitted` publicly
- * (the create signing tail invokes it), but the call shape is the
- * reference. Per ADR 9, `recordCompleted` is exposed on personal-scope
- * `WithdrawalsClient` ONLY.
- */
-type RecordCompletedCodes = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT" | "NOT_FOUND" | "NETWORK_ERROR" | "INTERNAL_ERROR";
-type WithdrawalsClient = {
-    readonly create: (input: WithdrawalsCreateInput) => Promise<CapxulResult<CreateWithdrawalResult, CreateCodes$4>>;
-    readonly retrieve: (withdrawalId: WithdrawalId) => Promise<CapxulResult<Withdrawal, RetrieveCodes$7>>;
-    readonly list: (input?: WithdrawalsListInput) => Promise<CapxulResult<List<Withdrawal>, ListCodes$6>>;
-    /**
-     * Withdrawals v1 W4 (#467) — reconciliation pipe.
-     *
-     * Caller invokes this AFTER `withdrawals.create` resolves AND after
-     * the on-chain receipt confirms (e.g., via the harness's
-     * `chain.waitReceipt`). The mutation patches the withdrawal +
-     * execution + attempt + operation rows to terminal happy state and
-     * emits a single `operation.succeeded` outbox event joined to the
-     * original correlationId. Idempotent on already-`completed` rows.
-     *
-     * Personal-scope only — the org-scope client does NOT expose this
-     * method (mirror of `recordSubmitted`; see ADR 9 in #467).
-     */
-    readonly recordCompleted: (input: WithdrawalsRecordCompletedInput) => Promise<CapxulResult<null, RecordCompletedCodes>>;
-};
-type OrgWithdrawalsClient = {
-    readonly create: (input: OrgWithdrawalsCreateInput) => Promise<CapxulResult<CreateWithdrawalResult, CreateCodes$4>>;
-    readonly retrieve: (input: OrgWithdrawalsRetrieveInput) => Promise<CapxulResult<Withdrawal, RetrieveCodes$7>>;
-    readonly list: (input: OrgWithdrawalsListInput) => Promise<CapxulResult<List<Withdrawal>, ListCodes$6>>;
-};
-
-/**
- * Webhook endpoints domain — developer-registered receivers per
- * sdk-surface.md §1b. All methods are org-nested (accessed via
- * `capxul.organizations.webhookEndpoints.*` per CANON.md §4.30).
- * The top-level `webhookEndpoints` surface on `CapxulClient` is kept
- * as an alias for discoverability; its methods proxy to the org
- * variant at call time and require `organizationId` explicitly.
- */
-
-type WebhookEndpointsCreateInput = CreateWebhookEndpointRequest & {
-    readonly organizationId: OrganizationId;
-};
-type WebhookEndpointsRetrieveInput = {
-    readonly organizationId: OrganizationId;
-    readonly webhookEndpointId: WebhookEndpointId;
-};
-type WebhookEndpointsListInput = {
-    readonly organizationId: OrganizationId;
-    readonly limit?: number;
-    readonly cursor?: string;
-};
-type WebhookEndpointsRemoveInput = WebhookEndpointsRetrieveInput;
-type CreateCodes$3 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT" | "RATE_LIMITED" | "NETWORK_ERROR";
-type RetrieveCodes$6 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
-type ListCodes$5 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT";
-type RemoveCodes$3 = RetrieveCodes$6;
-/**
- * Shape returned by `organizations.webhookEndpoints.create` — the
- * one-time `signingSecret` is included here and omitted from every
- * subsequent read (per sdk-surface.md §1b).
- */
-type WebhookEndpointCreateResult = WebhookEndpoint & {
-    readonly signingSecret: string;
-};
-type WebhookEndpointsClient = {
-    readonly create: (input: WebhookEndpointsCreateInput) => Promise<CapxulResult<WebhookEndpointCreateResult, CreateCodes$3>>;
-    readonly retrieve: (input: WebhookEndpointsRetrieveInput) => Promise<CapxulResult<WebhookEndpoint, RetrieveCodes$6>>;
-    readonly list: (input: WebhookEndpointsListInput) => Promise<CapxulResult<List<WebhookEndpoint>, ListCodes$5>>;
-    readonly remove: (input: WebhookEndpointsRemoveInput) => Promise<CapxulResult<void, RemoveCodes$3>>;
-};
-
-/**
- * Webhook events domain — individual delivery attempt + payload per
- * sdk-surface.md §1b. v1 is read-only (partner replay lands in v1.5
- * per §4.20). All methods are org-nested.
- */
-
-type WebhookEventsRetrieveInput = {
-    readonly organizationId: OrganizationId;
-    readonly webhookEventId: WebhookEventId;
-};
-type WebhookEventsListInput = {
-    readonly organizationId: OrganizationId;
-    readonly limit?: number;
-    readonly cursor?: string;
-    readonly endpointId?: string;
-    readonly type?: string;
-};
-type RetrieveCodes$5 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
-type ListCodes$4 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT";
-type WebhookEventsClient = {
-    readonly retrieve: (input: WebhookEventsRetrieveInput) => Promise<CapxulResult<WebhookEvent, RetrieveCodes$5>>;
-    readonly list: (input: WebhookEventsListInput) => Promise<CapxulResult<List<WebhookEvent>, ListCodes$4>>;
-};
-
-/**
- * Organizations domain per sdk-surface.md §1a.
- *
- * The org surface is broad because org-scoped flows for every money-
- * movement + identity primitive live under `organizations.*` per
- * CANON.md §4.30 (Shape A). Sub-client factories delegate to the
- * dedicated domain factories in `core/*.ts` so the tuple-return +
- * error-narrowing plumbing is shared.
- */
-
-type OrganizationsCreateInput = {
-    readonly name: string;
-    readonly country?: string;
-};
-type OrganizationsListInput = {
-    readonly limit?: number;
-    readonly cursor?: string;
-};
-type OrganizationsUpdateInput = {
-    readonly organizationId: OrganizationId;
-    readonly name?: string;
-};
-type OrgSafeRetrieveInput = {
-    readonly organizationId: OrganizationId;
-    readonly safeId: SafeId;
-};
-type OrgMemberInviteInput = {
-    readonly organizationId: OrganizationId;
-    readonly email: string;
-    readonly role: Member["role"];
-};
-type OrgMemberAcceptInput = {
-    readonly token: string;
-};
-type OrgMemberUpdateRoleInput = {
-    readonly organizationId: OrganizationId;
-    readonly memberId: MemberId;
-    readonly role: Member["role"];
-};
-type OrgMemberRemoveInput = {
-    readonly organizationId: OrganizationId;
-    readonly memberId: MemberId;
-};
-type OrgMemberRetrieveInput = OrgMemberRemoveInput;
-type OrgMemberRevokeInput = OrgMemberRemoveInput;
-type OrgMemberResendInput = OrgMemberRemoveInput;
-type OrgListInput = {
-    readonly organizationId: OrganizationId;
-    readonly limit?: number;
-    readonly cursor?: string;
-};
-type OrgMemberListInput = {
-    readonly organizationId: OrganizationId;
-    readonly status?: MembershipStatus | "all";
-    readonly limit?: number;
-    readonly cursor?: string;
-};
-type OrgCreateSubAccountInput = {
-    readonly organizationId: OrganizationId;
-    readonly name: string;
-    readonly purpose?: string;
-};
-type OrgCreateExternalAccountInput = {
-    readonly organizationId: OrganizationId;
-    readonly kind: "bank" | "evm" | "solana" | "starknet" | "card_payout";
-    readonly label?: string;
-    readonly address?: string;
-    readonly iban?: string;
-    readonly bic?: string;
-    readonly accountHolder?: string;
-    readonly network?: "visa" | "mastercard";
-    readonly panToken?: string;
-    readonly last4?: string;
-};
-type CreateCodes$2 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT" | "RATE_LIMITED" | "NETWORK_ERROR";
-type RetrieveCodes$4 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
-type ListCodes$3 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT";
-type UpdateCodes = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "INVALID_INPUT";
-/**
- * Org safe retrieve does NOT surface `SAFE_NOT_READY` — a co-member
- * who tries to read an in-flight Safe hits `PERMISSION_DENIED` (Safes
- * are admin-lens-only), and an admin gets `processing` via the
- * operation field. The mid-deploy balance view surfaces via
- * `treasury.retrieve` which DOES carry `SAFE_NOT_READY`.
- *
- * Contrast with `accounts.safes.retrieve` which DOES surface
- * `SAFE_NOT_READY` because personal Safes are visible to the owner
- * while deploying.
- */
-type SafeRetrieveCodes = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
-type TreasuryRetrieveCodes = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "SAFE_NOT_READY";
-type RemoveCodes$2 = RetrieveCodes$4;
-type SubAccountRemoveCodes = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "INVALID_INPUT";
-type OrgSafesClient = {
-    readonly retrieve: (input: OrgSafeRetrieveInput) => Promise<CapxulResult<Safe, SafeRetrieveCodes>>;
-};
-type OrgTreasuryClient = {
-    readonly retrieve: (organizationId: OrganizationId) => Promise<CapxulResult<Treasury, TreasuryRetrieveCodes>>;
-};
-type OrgMembersClient = {
-    readonly list: (input: OrgMemberListInput) => Promise<CapxulResult<List<Member>, ListCodes$3>>;
-    readonly retrieve: (input: OrgMemberRetrieveInput) => Promise<CapxulResult<Member, RetrieveCodes$4>>;
-    readonly invite: (input: OrgMemberInviteInput) => Promise<CapxulResult<MemberInviteResponse, UpdateCodes>>;
-    readonly accept: (input: OrgMemberAcceptInput) => Promise<CapxulResult<Member, UpdateCodes>>;
-    readonly updateRole: (input: OrgMemberUpdateRoleInput) => Promise<CapxulResult<Member, UpdateCodes>>;
-    readonly revoke: (input: OrgMemberRevokeInput) => Promise<CapxulResult<Member, UpdateCodes>>;
-    readonly remove: (input: OrgMemberRemoveInput) => Promise<CapxulResult<void, RemoveCodes$2>>;
-    readonly resend: (input: OrgMemberResendInput) => Promise<CapxulResult<MemberInviteResponse, UpdateCodes>>;
-};
-type OrgSubAccountsClient = {
-    readonly create: (input: OrgCreateSubAccountInput) => Promise<CapxulResult<SubAccount, UpdateCodes | "PROVIDER_ERROR">>;
-    readonly list: (input: OrgListInput) => Promise<CapxulResult<List<SubAccount>, ListCodes$3 | "PROVIDER_ERROR">>;
-    readonly retrieve: (input: {
-        readonly organizationId: OrganizationId;
-        readonly subAccountId: SubAccountId;
-    }) => Promise<CapxulResult<SubAccount, RetrieveCodes$4 | "PROVIDER_ERROR">>;
-    readonly remove: (input: {
-        readonly organizationId: OrganizationId;
-        readonly subAccountId: SubAccountId;
-    }) => Promise<CapxulResult<SubAccount, SubAccountRemoveCodes | "PROVIDER_ERROR">>;
-};
-type OrgExternalAccountsClient = {
-    readonly create: (input: OrgCreateExternalAccountInput) => Promise<CapxulResult<ExternalAccount, UpdateCodes>>;
-    readonly list: (input: OrgListInput) => Promise<CapxulResult<List<ExternalAccount>, ListCodes$3>>;
-    readonly retrieve: (input: {
-        readonly organizationId: OrganizationId;
-        readonly externalAccountId: ExternalAccountId;
-    }) => Promise<CapxulResult<ExternalAccount, RetrieveCodes$4>>;
-    readonly remove: (input: {
-        readonly organizationId: OrganizationId;
-        readonly externalAccountId: ExternalAccountId;
-    }) => Promise<CapxulResult<void, RemoveCodes$2>>;
-};
-type OrgBalanceLedgerClient = {
-    readonly list: (input: OrgListInput) => Promise<CapxulResult<List<BalanceLedgerEntry>, ListCodes$3>>;
-    readonly retrieve: (input: {
-        readonly organizationId: OrganizationId;
-        readonly entryId: string;
-    }) => Promise<CapxulResult<BalanceLedgerEntry, RetrieveCodes$4>>;
-};
-type OrgApiKeysClient = ApiKeysClient;
-type OrganizationsClient = {
-    readonly create: (input: OrganizationsCreateInput) => Promise<CapxulResult<Organization, CreateCodes$2>>;
-    readonly retrieve: (organizationId: OrganizationId) => Promise<CapxulResult<Organization, RetrieveCodes$4>>;
-    readonly list: (input?: OrganizationsListInput) => Promise<CapxulResult<List<Organization>, ListCodes$3>>;
-    readonly update: (input: OrganizationsUpdateInput) => Promise<CapxulResult<Organization, UpdateCodes>>;
-    readonly safes: OrgSafesClient;
-    readonly treasury: OrgTreasuryClient;
-    readonly members: OrgMembersClient;
-    readonly apiKeys: OrgApiKeysClient;
-    readonly subAccounts: OrgSubAccountsClient;
-    readonly externalAccounts: OrgExternalAccountsClient;
-    readonly balanceLedger: OrgBalanceLedgerClient;
-    readonly payments: OrgPaymentsClient;
-    readonly transfers: OrgTransfersClient;
-    readonly withdrawals: OrgWithdrawalsClient;
-    readonly documents: OrgDocumentsClient;
-    readonly webhookEndpoints: WebhookEndpointsClient;
-    readonly webhookEvents: WebhookEventsClient;
-};
-
-/**
- * HTTP transport — the SDK's outbound network seam AND the canonical
- * lifecycle observable for the publishable-key DX path (ADR #14c).
- *
- * The transport plays two roles:
- *
- * 1. **Network seam.** `fetch(path, init?)` resolves a path against
- *    `authBaseUrl` (absolute URLs are forwarded unchanged). The
- *    `build-time-urls` arm exposes the URLs immediately; the
- *    `publishable-key` arm resolves them lazily on first use through
- *    `/v1/client/bootstrap`, with singleflight + reset-on-failure.
- *
- * 2. **Lifecycle observable.** A 5-state machine
- *    (`idle → bootstrapping → ready → authenticated → error`) drives
- *    the React `useCapxulStatus()` hook. The transport is a stable
- *    singleton across renders — React subscribes to its lifecycle via
- *    `useSyncExternalStore` and re-renders only when the state
- *    transitions, never because the provider rebuilt.
- *
- * The transport is auth-protocol-agnostic. Path mangling like
- * BetterAuth's `/api/auth` prefix lives in `core/auth.ts` and stays
- * out of this file.
- */
-
-/**
- * Browser-side SDK config — discriminated union per ADR 5.
- *
- * Stack 2 ships the full union:
- * - `mode: "build-time-urls"` for explicit local/dev wiring
- * - `mode: "publishable-key"` for browser-safe lazy bootstrap through
- *   `/v1/client/bootstrap`
- */
-type BrowserCapxulConfig = {
-    readonly mode: "build-time-urls";
-    readonly authBaseUrl: string;
-    readonly convexUrl: string;
-    /**
-     * Inject a `fetch` implementation. Defaults to `globalThis.fetch`.
-     * Named `fetchImpl` to avoid shadowing the global.
-     */
-    readonly fetchImpl?: typeof fetch;
-} | {
-    readonly mode: "publishable-key";
-    readonly publishableKey: string;
-    /**
-     * Override the absolute URL used for `/v1/client/bootstrap`.
-     *
-     * Defaults to `${CAPXUL_API_BASE_URL}/v1/client/bootstrap` from
-     * `@repo/config`. Tests and alternative staging deployments set
-     * this to point at a local mock server or a non-alpha Convex
-     * site. A trailing slash is stripped before joining.
-     */
-    readonly bootstrapUrl?: string;
-    readonly fetchImpl?: typeof fetch;
-};
-/**
- * Transport lifecycle state — the canonical state machine for the
- * publishable-key DX path per ADR #14c.
- *
- * Transitions:
- * - `idle → bootstrapping` on first network call
- * - `bootstrapping → ready` on successful `/v1/client/bootstrap`
- * - `bootstrapping → error` on bootstrap failure
- * - `error → bootstrapping` when a subsequent caller retries (reset-on-failure)
- * - `ready → authenticated` via `markAuthenticated()` after verifyOtp
- * - `authenticated → ready` via `signOut()` / `clearAuth()`
- *
- * The `build-time-urls` arm starts in `ready` immediately because no
- * bootstrap is required.
- */
-type TransportState = {
-    readonly status: "idle";
-} | {
-    readonly status: "bootstrapping";
-} | {
-    readonly status: "ready";
-    readonly runtime: TransportRuntime;
-} | {
-    readonly status: "authenticated";
-    readonly runtime: TransportRuntime;
-} | {
-    readonly status: "error";
-    readonly error: CapxulError;
-};
-type TransportRuntime = {
-    readonly authBaseUrl: string;
-    readonly convexUrl: string;
-};
-/**
- * HTTP transport surface consumed by every domain client (auth, me,
- * payments, …) once Stack 1 task 1.5 routes them through here.
- *
- * - `fetch(path, init?)` resolves a relative path against
- *   `authBaseUrl` (absolute URLs are forwarded unchanged).
- * - `authBaseUrl` and `convexUrl` are exposed as resolved values so
- *   downstream consumers (e.g. Convex client construction) can read
- *   them directly. The publishable-key arm populates these lazily
- *   after the first bootstrap resolution; before that they are empty
- *   strings.
- * - `getState()` / `subscribe()` are the React-friendly observable
- *   surface for `useCapxulStatus()`. Use `useSyncExternalStore` on the
- *   React side.
- * - `markAuthenticated()` / `clearAuth()` are the post-verifyOtp /
- *   post-signOut transition methods (ADR #14c contract item 3 — the
- *   provider does NOT setState; it lets the transport's state machine
- *   drive React subscriptions).
- */
-type HttpTransport = {
-    readonly fetch: (path: string, init?: RequestInit) => Promise<Response>;
-    readonly ensureRuntime: () => Promise<TransportRuntime>;
-    readonly authBaseUrl: string;
-    readonly convexUrl: string;
-    readonly getState: () => TransportState;
-    readonly subscribe: (listener: () => void) => () => void;
-    readonly getDataClient: () => CapxulDataClient | null;
-    readonly markAuthenticated: (opts: {
-        readonly dataClient?: CapxulDataClient;
-    }) => void;
-    readonly clearAuth: () => void;
-};
-/**
- * Build an `HttpTransport` from a `BrowserCapxulConfig`.
- *
- * Throws `CapxulError<"INVALID_INPUT">` with
- * `details.source === "sdk-config"` when local transport config is
- * malformed. Backend bootstrap failures also throw `CapxulError`, but
- * carry `details.source === "backend-bootstrap"` so consumers can
- * distinguish setup mistakes from server-side bootstrap refusals.
- */
-declare function makeHttpTransport(config: BrowserCapxulConfig): HttpTransport;
-
-/**
- * Sub-accounts domain — the top-level `capxul.subAccounts.*` surface.
- *
- * Per sdk-surface.md §1a, `sub_account` is a named partition under an
- * account or organization that aggregates balance across custody
- * sources (stablecoin pool + virtual accounts + cards). `create` and
- * `list` live on the owner's nested namespace (Pattern A —
- * `accounts.subAccounts.create(...)` or
- * `organizations.subAccounts.create(...)`), so only `retrieve` and
- * `remove` live at the top level.
- *
- * Wired in PR-2a of the funds-v1 balance-closure stack: the backend
- * always returns truthful `balance: Money` per canon §sub_account
- * (PR-1 made `toCanonShape` populate it from `computeSubAccountBalance`).
- * The SDK brands the wire shape and passes the balance through as-is.
- * NO zero-balance fallback exists at the SDK layer — if the backend
- * ever omits `balance`, that is a bug to surface, not paper over.
- */
-
-type RetrieveCodes$3 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "PROVIDER_ERROR";
-type RemoveCodes$1 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "INVALID_INPUT" | "PROVIDER_ERROR";
-type SubAccountsClient = {
-    readonly retrieve: (subAccountId: SubAccountId) => Promise<CapxulResult<SubAccount, RetrieveCodes$3>>;
-    readonly remove: (subAccountId: SubAccountId) => Promise<CapxulResult<SubAccount, RemoveCodes$1>>;
-};
-
-/**
- * **NON-CANONICAL surface.**
- *
- * `capxul.tokenTransfers.*` exposes the indexer's raw on-chain ERC-20
- * transfer rows directly to consumers, backed by
- * `packages/backend/convex/tokenTransfers/queries.ts`. Authorized at
- * `slice/02-story2-balance` per the conductor's Option-A verdict —
- * the canonical SDK `transfers.*` namespace assumes a cross-custody
- * internal-move shape (`Transfer = { source, destination, fx,
- * operation, ... }`) that has no canon-aligned backing query yet.
- * Surfacing the on-chain feed under a separate, clearly-marked
- * non-canonical namespace lets the Ink CLI's activity dashboard
- * progress without forcing canon synthesis.
- *
- * **NOT in `packages/api-contract`.** Do NOT use this surface as the
- * basis for new canon. When `transfers.*` shape alignment lands
- * (post-alpha.4 follow-up issue), the canonical `transfers.*` will
- * subsume this and `tokenTransfers.*` becomes a deprecation alias.
- *
- * Stub families that REMAIN deferred at this slice
- * (per `[DEFERRED-CANON]` markers in
- * `.claude/worktrees/post-alpha-wire2/.progress.txt`):
- * - `transfers.{create,retrieve,list,confirm,cancel}` — canon shape mismatch
- * - `accounts.balanceLedger.{list,retrieve}` — no canon backing query
- * - `organizations.balanceLedger.*` — no canon backing query
- * - `organizations.transfers.*` — canon shape mismatch
- * - `organizations.treasury.retrieve` — backing query has different shape
- */
-
-/**
- * Branded id for an on-chain `tokenTransfer` row. Backed by the
- * Convex document id; the brand prevents accidental swaps with other
- * SDK ids without leaking the document-id constraint into call sites.
- *
- * Returned in `TokenTransfer.id` for clients that want a stable
- * back-reference; the canonical lookup key is the
- * `(txHash, logIndex)` composite used by `retrieve`.
- */
-type TokenTransferId = string & {
-    readonly __capxulTokenTransferIdBrand: "TokenTransferId";
-};
-declare const toTokenTransferId: (raw: string) => TokenTransferId;
-/**
- * Raw on-chain ERC-20 transfer row. Shape mirrors
- * `tokenTransfers/queries.ts` `list` / `getByTxLogIndex` output. The
- * primitive fields (`txHash`, `tokenAddress`, etc.) match
- * `@repo/api-contract` conventions — `string` for hashes/addresses,
- * `number` for block + chain ids — so consumers don't need to import
- * a brand surface that isn't in the SDK's published deps.
- */
-type TokenTransfer = {
-    readonly id: TokenTransferId;
-    readonly object: "token_transfer";
-    readonly direction: "in" | "out";
-    /** Token-units string ("123456" not "1.23456"). Decimals carried in `tokenDecimals`. */
-    readonly amount: string;
-    readonly tokenSymbol: string;
-    readonly tokenDecimals: number;
-    readonly tokenAddress: string;
-    readonly counterpartyName: string | null;
-    readonly counterpartyAddress: string;
-    readonly description: string;
-    /** Block timestamp in epoch milliseconds. */
-    readonly createdAt: number;
-    readonly txHash: string;
-    readonly blockNumber: number;
-    readonly chainId: number;
-};
-type TokenTransfersListPage = {
-    readonly object: "list";
-    readonly data: readonly TokenTransfer[];
-    readonly page: {
-        readonly hasMore: boolean;
-        /** Block-timestamp cursor (epoch ms) for the next page; null when exhausted. */
-        readonly nextCursor: number | null;
-    };
-    /** Caller's display currency. The backend echoes it so renderers don't need a second round-trip. */
-    readonly displayCurrency: string;
-};
-type TokenTransfersListInput = {
-    readonly limit?: number;
-    /** Block-timestamp cursor (epoch ms) returned in the previous page's `page.nextCursor`. */
-    readonly cursor?: number;
-    readonly direction?: "in" | "out";
-};
-type TokenTransfersRetrieveInput = {
-    readonly txHash: string;
-    readonly logIndex: number;
-    /** Optional chain filter. When omitted, the first index hit wins (single-chain default). */
-    readonly chainId?: number;
-};
-type ListCodes$2 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT";
-type RetrieveCodes$2 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
-type TokenTransfersClient = {
-    readonly list: (input?: TokenTransfersListInput) => Promise<CapxulResult<TokenTransfersListPage, ListCodes$2>>;
-    readonly retrieve: (input: TokenTransfersRetrieveInput) => Promise<CapxulResult<TokenTransfer, RetrieveCodes$2>>;
-};
-
-/**
- * Virtual accounts domain — International Bank Account Number (IBAN)-
- * bearing receive rails per sdk-surface.md §1a + §4.51.
- *
- * Uses Pattern C (ownerKind in body): the caller specifies
- * `owner = { kind: "account" | "sub_account" | "organization", id: ... }`
- * in the create payload rather than nesting the route under the owner.
- */
-
-type VirtualAccountsCreateInput = CreateVirtualAccountRequest;
-type VirtualAccountsListInput = {
-    readonly limit?: number;
-    readonly cursor?: string;
-    readonly ownerKind?: "account" | "sub_account" | "organization";
-    readonly ownerId?: string;
-};
-type CreateCodes$1 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT" | "KYC_REQUIRED" | "PROVIDER_UNAVAILABLE" | "RATE_LIMITED" | "NETWORK_ERROR";
-type RetrieveCodes$1 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
-type ListCodes$1 = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT";
-type RemoveCodes = RetrieveCodes$1;
-type VirtualAccountsClient = {
-    readonly create: (input: VirtualAccountsCreateInput) => Promise<CapxulResult<VirtualAccount, CreateCodes$1>>;
-    readonly retrieve: (virtualAccountId: VirtualAccountId) => Promise<CapxulResult<VirtualAccount, RetrieveCodes$1>>;
-    readonly list: (input?: VirtualAccountsListInput) => Promise<CapxulResult<List<VirtualAccount>, ListCodes$1>>;
-    readonly remove: (virtualAccountId: VirtualAccountId) => Promise<CapxulResult<void, RemoveCodes>>;
-};
-
-/**
- * Virtual cards domain — issued Visa / Mastercard spending sub-account
- * balance per sdk-surface.md §1a + §4.51.
- *
- * Uses Pattern C (ownerKind in body).
- */
-
-type VirtualCardsCreateInput = CreateVirtualCardRequest;
-type VirtualCardsListInput = {
-    readonly limit?: number;
-    readonly cursor?: string;
-    readonly ownerKind?: "account" | "sub_account" | "organization";
-    readonly ownerId?: string;
-};
-type CreateCodes = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT" | "KYC_REQUIRED" | "PROVIDER_UNAVAILABLE" | "RATE_LIMITED" | "NETWORK_ERROR";
-type RetrieveCodes = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND";
-type ListCodes = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "INVALID_INPUT";
-type MutateCodes = "NOT_AUTHENTICATED" | "PERMISSION_DENIED" | "NOT_FOUND" | "PROVIDER_UNAVAILABLE";
-type VirtualCardsClient = {
-    readonly create: (input: VirtualCardsCreateInput) => Promise<CapxulResult<VirtualCard, CreateCodes>>;
-    readonly retrieve: (virtualCardId: VirtualCardId) => Promise<CapxulResult<VirtualCard, RetrieveCodes>>;
-    readonly list: (input?: VirtualCardsListInput) => Promise<CapxulResult<List<VirtualCard>, ListCodes>>;
-    readonly freeze: (virtualCardId: VirtualCardId) => Promise<CapxulResult<VirtualCard, MutateCodes>>;
-    readonly unfreeze: (virtualCardId: VirtualCardId) => Promise<CapxulResult<VirtualCard, MutateCodes>>;
-    readonly cancel: (virtualCardId: VirtualCardId) => Promise<CapxulResult<VirtualCard, MutateCodes>>;
-};
-
-/**
- * Root `@capxul/sdk` client factory.
- *
- * Canonical construction per sdk-surface.md §3a:
- *
- * ```ts
- * import { createCapxulClient, createLocalSigner } from "@capxul/sdk";
- *
- * const capxul = createCapxulClient({
- *   apiKey: process.env.CAPXUL_API_KEY!,
- *   signer: createLocalSigner(process.env.CAPXUL_PRIVATE_KEY as `0x${string}`),
- * });
- * ```
- *
- * Three auth modes are mutually exclusive:
- * - `apiKey` — server-to-server partner flows (`cap_live_` / `cap_test_`)
- * - `publishableKey` — installed-app flows with OTP-established human
- *   sessions (`cap_pk_live_` / `cap_pk_test_`); sessions persist
- *   via the SDK's auth adapter (file / cookie depending on runtime)
- * - neither — unauthenticated only; useful for `auth.sendOtp` +
- *   `auth.verifyOtp` bootstrap before a session exists
- *
- * The `signer` (viem `Account`) is required for methods that submit
- * on-chain UserOperations (payments, withdrawals, transfers) per
- * CANON.md §4.28.
- */
-
-type CapxulSigningConfig = {
-    /** EVM chain ID (currently Base Sepolia). */
-    readonly chainId: number;
-    /** JSON-RPC URL for UserOperation submission. */
-    readonly rpcUrl: string;
-    /** Alchemy gas policy ID for UserOperation sponsorship. */
-    readonly gasPolicyId: string;
-};
-type CapxulAuthConfig = {
-    /**
-     * Convex `.site` URL that hosts the BetterAuth endpoints.
-     *
-     * Optional when the client is configured with a publishable key and
-     * lazy bootstrap resolves the runtime URLs instead.
-     */
-    readonly baseUrl?: string;
-    /** Optional explicit Convex token endpoint. Defaults to `${baseUrl}/api/auth/convex/token`. */
-    readonly convexTokenUrl?: string;
-    /** Scenario/browser-local session store shared by auth + onboarding hooks. */
-    readonly sessionStore?: AuthSessionStore;
-};
-type CapxulConfig = {
-    /** Server-to-server partner key. Mutually exclusive with `publishableKey`. */
-    readonly apiKey?: string;
-    /**
-     * Installed-app publishable key. Pairs with an OTP-established human
-     * session persisted by the SDK's auth adapter.
-     */
-    readonly publishableKey?: string;
-    /**
-     * viem `Account` used to sign UserOperations for on-chain methods
-     * (payments, withdrawals, transfers) per CANON.md §4.28.
-     */
-    readonly signer?: Account$1;
-    /**
-     * @internal
-     *
-     * Test-only override seam for injecting an authenticated Convex data client.
-     * The SDK now owns runtime construction of the data client; this field is
-     * reserved for tests and the React provider's singleton lifecycle.
-     */
-    readonly _data?: CapxulDataClient;
-    /**
-     * Chain + bundler configuration for on-chain submission.
-     *
-     * Required alongside `signer` for runtime `payments.create`.
-     */
-    readonly signing?: CapxulSigningConfig;
-    /** Human OTP auth runtime configuration. */
-    readonly auth?: CapxulAuthConfig;
-    /**
-     * Override the API base URL. Defaults to `https://api.capxul.com`
-     * in production builds; point at `http://localhost:<port>/v1` for
-     * local development against Convex's httpAction router.
-     */
-    readonly baseUrl?: string;
-    /**
-     * Inject a `fetch` implementation. Defaults to global `fetch`. Used
-     * for testing or to plug in `undici` / `node-fetch` in older Node
-     * environments.
-     */
-    readonly fetch?: typeof fetch;
-    /**
-     * @internal
-     *
-     * Inject a pre-built `HttpTransport`. The `@capxul/sdk-react`
-     * `CapxulProvider` uses this in the lazy-DX path (ADR #14c) so the
-     * provider's externally-built transport is the SAME singleton used by
-     * the auth client's bootstrap calls. Without injection, the SDK would
-     * build a second transport internally — the `useCapxulStatus()` hook
-     * would observe a different state machine than the one auth methods
-     * actually drive.
-     *
-     * Underscored to mark it as an internal SDK seam, not a partner-facing
-     * config field. Do not document publicly.
-     */
-    readonly _transport?: HttpTransport;
-};
-/**
- * Per-call factories for XState v5 flow machines.
- *
- * Each factory returns a fresh machine instance bound to this
- * `CapxulClient`. The consumer is responsible for creating a single
- * actor (e.g. via `createActor` / React's `useMemo` + `useActor`) and
- * keeping it alive for the duration of the flow. Calling a factory
- * twice yields two independent machines — useful for parallel
- * onboarding sessions in tests, never the desired pattern in app code.
- *
- * The return types are intentionally erased to `AnyStateMachine` to
- * keep this surface stable across XState v5 type-parameter changes;
- * downstream consumers (`@capxul/sdk-react` hooks, the e2e harness's
- * `xstateFlowSequence` primitive) re-import the precise types from
- * `./flows/*` when they need them.
- */
-type CapxulFlowFactories = {
-    readonly onboarding: () => AnyStateMachine;
-    readonly provisioning: () => AnyStateMachine;
-};
-type CapxulClient = {
-    /**
-     * @internal
-     *
-     * Per-client UUID minted at construction. Used as a TanStack Query
-     * cache-key prefix to isolate per-client cache when multiple
-     * `CapxulClient` instances are mounted in the same React tree.
-     *
-     * MUST NOT be passed to `identify()`, `track()`, or any analytics
-     * surface — PostHog has no way to distinguish "namespace UUID" from
-     * "person UUID" and conflating the two creates fake users in
-     * analytics. Treat as opaque cache implementation detail.
-     *
-     * Stable for the lifetime of the client; new on every
-     * `createCapxulClient()` call. See Codex P1 finding on PR #406.
-     */
-    readonly id: string;
-    readonly auth: AuthService;
-    readonly me: MeClient;
-    readonly accounts: AccountsClient;
-    readonly organizations: OrganizationsClient;
-    readonly payments: PaymentsClient;
-    readonly transfers: TransfersClient;
-    /**
-     * **NON-CANONICAL.** On-chain ERC-20 transfer feed (raw indexer
-     * rows). NOT part of `packages/api-contract`. Slated for
-     * deprecation when canonical `transfers.*` shape alignment lands.
-     * See `core/token-transfers.ts` for the doc-comment contract.
-     */
-    readonly tokenTransfers: TokenTransfersClient;
-    readonly withdrawals: WithdrawalsClient;
-    readonly documents: DocumentsClient;
-    readonly subAccounts: SubAccountsClient;
-    readonly virtualAccounts: VirtualAccountsClient;
-    readonly virtualCards: VirtualCardsClient;
-    readonly externalAccounts: ExternalAccountsClient;
-    readonly operations: OperationsClient;
-    readonly webhookEndpoints: WebhookEndpointsClient;
-    readonly webhookEvents: WebhookEventsClient;
-    readonly apiKeys: ApiKeysClient;
-    readonly flows: CapxulFlowFactories;
-};
-/**
- * Construct a Capxul client. Every method stub in Slice C throws
- * `NOT_IMPLEMENTED` per CANON.md §2 (types-first scaffold). Slice F.2
- * wires the restart `payments` + `operations` runtime path through an
- * injected authenticated Convex client; the broader `/v1/*` surface is
- * still pending.
- *
- * Two-pass construction: the per-domain clients (`auth`, `me`, …) are
- * built first, then `flows` is assigned with factories that close over
- * the fully-built `client` so the spawned XState machines can call
- * back into `client.accounts.provisionPersonal`, etc. The intermediate
- * `clientWithoutFlows` value is typed without
- * `flows`; `Object.assign` mutates a single `flows` field on it before
- * the returned `CapxulClient` cast — minimal and contained.
- */
-declare function createCapxulClient(config?: CapxulConfig): CapxulClient;
-
-export { type AccountProvisionPersonalInput as A, type BrowserCapxulConfig as B, type CapxulClient as C, type DocumentsClient as D, type ExternalAccountsClient as E, type TokenTransfersListPage as F, type TokenTransfersRetrieveInput as G, type HttpTransport as H, type TransfersClient as I, type TransportRuntime as J, type TransportState as K, type LocalPrivateKeySignerProvider as L, type MeClient as M, type VirtualAccountsClient as N, type OperationsClient as O, type PaymentsClient as P, type VirtualCardsClient as Q, type WebhookEndpointsClient as R, type Session as S, type TokenTransfer as T, type WebhookEventsClient as U, type VerifyOtpResult as V, type WebhookEndpointCreateResult as W, type WithdrawalsClient as X, createCapxulClient as Y, makeHttpTransport as Z, toTokenTransferId as _, type AccountsClient as a, type ApiKeyCreateResult as b, type ApiKeysClient as c, type AuthBootstrapReason as d, type AuthBootstrapToken as e, AuthService as f, type AuthSessionStore as g, type CapxulAuthConfig as h, type CapxulConfig as i, type CapxulDataClient as j, type CapxulFlowFactories as k, type CapxulSigningConfig as l, type CompleteBootstrapInput as m, type CompleteBootstrapResult as n, type OrgDocumentsClient as o, type OrgMembersClient as p, type OrgPaymentsClient as q, type OrgSafesClient as r, type OrgTransfersClient as s, type OrgTreasuryClient as t, type OrgWithdrawalsClient as u, type OrganizationsClient as v, type SubAccountsClient as w, type TokenTransferId as x, type TokenTransfersClient as y, type TokenTransfersListInput as z };