@capxul/sdk 0.2.0-alpha.4 → 1.0.0-alpha.10

package/dist/index.d.mts

@@ -0,0 +1,2574 @@
+import { A as SubAccount, C as PublishableKey, D as RunId, E as RoleKey, F as CapxulErrorDetails, I as FailureMode, N as CapxulError, O as SessionToken, P as CapxulErrorCode, S as Profile$1, T as PublishableKeyRecord, _ as EpochMs, a as AnonymousDistinctId, b as Money, c as AuthUserId, d as CountryCode, f as CurrencyCode, g as Email, h as DurationMs, i as AllowedOrigin, j as SubAccountId, k as SmartAccount$1, m as DocumentHash, n as AccountId, o as AppId, p as DeveloperApplication, r as Address, s as AuthSession, t as Account, u as ChainId, w as PublishableKeyId, x as OrgId } from "./index-CTXgQ_xR.mjs";
+import { a as AccountProvider, c as Eip1193Provider, d as CapxulResult, f as Profile, g as AuthCachePort, i as injectedWalletSigner, l as eip1193AccountProvider, m as SmartAccount, n as CapxulSigner, o as AccountProviderSource, p as Session, r as Eip1193RequestProvider, s as AccountRequirement, t as CapxulDigestSigner, u as localPrivateKeyAccountProvider, v as CachedJwt } from "./signer-D9fUJp8o.mjs";
+import { a as SafeDeploymentEvidence, n as SafeDeploymentConfig } from "./safe-deployment-D3k9yndM.mjs";
+import { Hex } from "viem";
+import { Context, Effect, Layer, Request } from "effect";
+import { FunctionReference } from "convex/server";
+import { Schema } from "@effect/schema";
+import { Machine } from "@effect/experimental";
+
+//#region src/ports/auth-client.d.ts
+type AuthClientOperationOptions = {
+  readonly signal?: AbortSignal;
+};
+type SendOtpInput = {
+  readonly email: Email;
+};
+type CanSendOtpInput = {
+  readonly email: Email;
+};
+type CanSendOtpStatus = {
+  readonly allowed: boolean;
+  readonly cooldownMs: DurationMs;
+};
+type VerifyOtpInput = {
+  readonly email: Email;
+  readonly otp: string;
+};
+type GetConvexJwtOptions = AuthClientOperationOptions & {
+  readonly forceRefresh?: boolean;
+};
+declare const AuthClientError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "AuthClientError";
+} & Readonly<A>;
+declare class AuthClientError extends AuthClientError_base<{
+  readonly operation: string;
+  readonly kind: string;
+  readonly cause: unknown;
+}> {}
+interface AuthClientPort {
+  canSendOtp(input: CanSendOtpInput, options?: AuthClientOperationOptions): Effect.Effect<CanSendOtpStatus, AuthClientError>;
+  sendOtp(input: SendOtpInput, options?: AuthClientOperationOptions): Effect.Effect<void, AuthClientError>;
+  verifyOtp(input: VerifyOtpInput, options?: AuthClientOperationOptions): Effect.Effect<AuthSession, AuthClientError>;
+  getSession(options?: AuthClientOperationOptions): Effect.Effect<AuthSession | null, AuthClientError>;
+  signOut(options?: AuthClientOperationOptions): Effect.Effect<void, AuthClientError>;
+  /**
+   * Fetches a Convex-aud JWT from `/api/auth/convex/token` (W7). Server mints
+   * a fresh JWT on every call per Probe A's 2026-05-19 finding (RS256, 900 s
+   * lifetime, `iss = <site-url>`, `aud = convex`). The caller (the SDK's
+   * `tokenProvider` wired into ConvexCallPort) is responsible for the
+   * `exp - 30s` proactive cache + `forceRefresh` callback handshake.
+   */
+  getConvexJwt(options?: GetConvexJwtOptions): Effect.Effect<CachedJwt, AuthClientError>;
+}
+//#endregion
+//#region src/ports/clock.d.ts
+interface ClockPort {
+  readonly now: Effect.Effect<EpochMs, ClockError>;
+  readonly sleep: (duration: DurationMs) => Effect.Effect<void, ClockError>;
+}
+declare const ClockError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "ClockError";
+} & Readonly<A>;
+declare class ClockError extends ClockError_base<{
+  readonly operation: "now" | "sleep" | "initialize";
+  readonly cause: unknown;
+}> {}
+//#endregion
+//#region ../observability/src/telemetry-port.d.ts
+/**
+ * Context for reporting handled errors via `reportHandledError`.
+ * Carries structured metadata extracted from the error context.
+ */
+interface HandledErrorReportContext$1 {
+  readonly layer?: string;
+  readonly operation?: string;
+  readonly failure_mode?: FailureMode;
+  readonly provider?: string;
+}
+/**
+ * Canonical TelemetryPort interface. Every adapter (production, test, in-memory)
+ * implements this contract. All methods return `Effect<void, never>` —
+ * fire-and-forget, defects are caught and traced.
+ */
+interface TelemetryPort {
+  readonly emit: (event: TelemetryEvent) => Effect.Effect<void, never>;
+  readonly identify: (input: TelemetryIdentifyInput) => Effect.Effect<void, never>;
+  readonly group: (input: TelemetryGroupInput) => Effect.Effect<void, never>;
+  readonly reset: () => Effect.Effect<void, never>;
+  readonly reportHandledError?: (error: CapxulError, context?: HandledErrorReportContext$1) => Effect.Effect<void, never>;
+}
+//#endregion
+//#region ../observability/src/index.d.ts
+declare const TELEMETRY_EVENT_NAMES: readonly ["auth_otp_requested", "auth_otp_delivered", "auth_otp_expired", "auth_verified", "auth_failed", "auth_signed_out", "provisioning_safe_created", "provisioning_safe_confirmed", "bootstrap_resolved", "bootstrap_failed", "account_balance_read", "account_balance_failed", "faucet_requested", "faucet_confirmed", "faucet_failed", "subaccount_created", "subaccount_renamed", "subaccount_deleted", "subaccount_op_failed", "transfer_requested", "transfer_confirmed", "transfer_failed", "org_create_started", "org_safe_created", "org_safe_confirmed", "org_roles_seeded", "org_created", "org_create_failed", "org_invite_sent", "org_invite_accepted", "org_role_granted", "org_member_active", "org_member_removed", "org_invite_expired", "org_role_grant_failed", "payment_requested", "payment_resolved", "payment_document_attached", "payment_submitted", "payment_settled", "payment_claimed", "payment_cancelled", "payment_redirected", "payment_failed", "stream_created", "stream_claimed", "stream_cancelled", "stream_completed", "stream_failed", "withdrawal_requested", "withdrawal_submitted", "withdrawal_settled", "withdrawal_failed"];
+type TelemetryEventName = (typeof TELEMETRY_EVENT_NAMES)[number];
+type TelemetryProps = Record<string, unknown>;
+type TelemetryEvent = {
+  readonly name: TelemetryEventName;
+  readonly props?: TelemetryProps | undefined;
+};
+interface TelemetryIdentifyInput {
+  readonly distinctId: string;
+  readonly anonDistinctId?: AnonymousDistinctId;
+  readonly traits?: TelemetryProps;
+  readonly properties?: TelemetryProps;
+}
+interface TelemetryGroupInput {
+  readonly groupType: string;
+  readonly groupKey: string;
+  readonly properties?: TelemetryProps;
+}
+//#endregion
+//#region src/flows/auth.d.ts
+interface AuthFlowInput {
+  readonly otpTtlMs?: number;
+}
+type AuthFlowState = "idle" | "sending_otp" | "otp_requested" | "verifying" | "authenticated" | "signing_out" | "error";
+interface AuthFlowContext {
+  readonly state: AuthFlowState;
+  readonly email: Email | null;
+  readonly session: AuthSession | null;
+  readonly otpRequestedAt: EpochMs | null;
+  readonly anonDistinctId?: AnonymousDistinctId;
+  readonly error: CapxulError | null;
+}
+interface AuthFlowObserver {
+  readonly input: AuthFlowInput;
+  readonly getSnapshot: () => {
+    readonly value: AuthFlowState;
+    readonly context: AuthFlowContext;
+    readonly status: "active" | "stopped";
+  };
+  readonly stop: () => void;
+}
+//#endregion
+//#region src/env/_internal.d.ts
+declare const envShapeSchema: Schema.Struct<{
+  [k: string]: Schema.Schema<string, string, never> | Schema.optional<Schema.Schema<string, string, never>>;
+}>;
+type EnvShape = Schema.Schema.Type<typeof envShapeSchema>;
+type EnvKey = keyof EnvShape & string;
+//#endregion
+//#region src/env/index.d.ts
+type RequiredEnvKey = EnvKey;
+type OptionalEnvKey = EnvKey;
+//#endregion
+//#region src/ports/env.d.ts
+declare const EnvError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "EnvError";
+} & Readonly<A>;
+declare class EnvError extends EnvError_base<{
+  readonly publicError: CapxulError;
+  readonly publicCode?: CapxulErrorCode;
+  readonly key?: string;
+  readonly details?: CapxulErrorDetails;
+  readonly cause?: unknown;
+}> {}
+interface EnvPort {
+  readonly require: <K extends RequiredEnvKey>(key: K) => Effect.Effect<EnvShape[K], EnvError, never>;
+  readonly optional: <K extends OptionalEnvKey>(key: K) => Effect.Effect<EnvShape[K] | undefined, EnvError, never>;
+  readonly has: (key: EnvKey) => Effect.Effect<boolean, EnvError, never>;
+}
+//#endregion
+//#region src/ports/transport.d.ts
+type TransportOperationKind = "query" | "mutation" | "action";
+type TransportRequest<TArgs = unknown> = {
+  readonly name: string;
+  readonly args: TArgs;
+  readonly correlationId?: string;
+};
+declare const TransportError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "TransportError";
+} & Readonly<A>;
+declare class TransportError extends TransportError_base<{
+  readonly operation: TransportOperationKind;
+  readonly name: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly correlationId?: string;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface TransportPort {
+  readonly runQuery: <TOutput = unknown, TArgs = unknown>(request: TransportRequest<TArgs>) => Effect.Effect<TOutput, TransportError>;
+  readonly runMutation: <TOutput = unknown, TArgs = unknown>(request: TransportRequest<TArgs>) => Effect.Effect<TOutput, TransportError>;
+  readonly runAction: <TOutput = unknown, TArgs = unknown>(request: TransportRequest<TArgs>) => Effect.Effect<TOutput, TransportError>;
+}
+//#endregion
+//#region src/ports/bootstrap.d.ts
+type BootstrapInput = {
+  readonly publishableKey: PublishableKey;
+  /**
+   * Browser callers send the App origin so bootstrap can enforce the
+   * publishable-key allowlist. Node/server callers may omit it; the backend
+   * only applies the origin allowlist when an origin is present.
+   */
+  readonly origin?: AllowedOrigin;
+};
+type BootstrapResolution = {
+  readonly applicationId: AppId;
+  readonly chainId: ChainId;
+  /**
+   * SDK-handshake session token — distinct from the user-auth `AuthSession`
+   * token issued by `AuthClientPort`. Both use the `SessionToken` brand for
+   * opaque-string discipline; the issuance source distinguishes them.
+   */
+  readonly sessionToken: SessionToken;
+  readonly issuedAt: EpochMs;
+  readonly expiresIn: DurationMs;
+  readonly authBaseUrl: string;
+  readonly convexUrl: string;
+  readonly siteBaseUrl: string;
+  readonly openfortPublishableKey: string;
+  readonly shieldPublishableKey: string;
+};
+type BootstrapErrorKind = "notAuthenticated" | "network" | "provider" | "malformedBody" | "invalidInput" | "rateLimited";
+declare const BootstrapError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "BootstrapError";
+} & Readonly<A>;
+declare class BootstrapError extends BootstrapError_base<{
+  readonly operation: "resolve";
+  readonly kind: BootstrapErrorKind;
+  readonly publicCode: CapxulErrorCode;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface BootstrapPort {
+  readonly resolve: (input: BootstrapInput) => Effect.Effect<BootstrapResolution, BootstrapError>;
+}
+//#endregion
+//#region src/ports/subscription.d.ts
+/**
+ * Canonical teardown handle for substrate-level reactive callbacks.
+ *
+ * Calling it stops the subscription; no further snapshots will be delivered
+ * to the callback after the first invocation. Calling more than once is a
+ * no-op (idempotent).
+ *
+ * @internal-use
+ */
+type Unsubscribe = () => void;
+/**
+ * Snapshot is the substrate discriminated union for reactive callbacks over
+ * `ConvexCallPort.subscribe`. The public SDK surface is imperative
+ * (`Promise<CapxulResult>`). This type is reachable for internal XState
+ * `fromCallback` actor wiring,
+ * property-based `crossAdapterSubscriptionProperty` harness consumers, and
+ * genuinely non-React advanced consumers.
+ *
+ *   - `loading` · initial state before any value arrives from the substrate
+ *   - `ok`      · a successful snapshot carrying `value`
+ *   - `error`   · a failed snapshot carrying a typed error (defaults to
+ *                 `CapxulError`)
+ *
+ * Generic over the value type `T`. The error type `E` is parameterised but
+ * defaults to `CapxulError` — every shipped port today uses the default. A
+ * narrower or wider `E` is reserved for future ports that need a different
+ * error vocabulary.
+ *
+ * The substrate guarantees the first snapshot is `loading` (CC8 in the
+ * `ConvexCallPort` contract); subsequent snapshots carry `ok` or `error`
+ * per the underlying transport.
+ *
+ * Per ARCH-LOCK-1 (`docs/decisions/stage-4-reactivity-pivot.html`), domain
+ * ports do not expose reactive callback methods.
+ *
+ * @internal-use
+ */
+type Snapshot<T, E = CapxulError> = {
+  readonly status: "loading";
+} | {
+  readonly status: "ok";
+  readonly value: T;
+} | {
+  readonly status: "error";
+  readonly error: E;
+};
+//#endregion
+//#region src/ports/convex-call.d.ts
+declare const ConvexCallError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "ConvexCallError";
+} & Readonly<A>;
+declare class ConvexCallError extends ConvexCallError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface ConvexCallPort {
+  query<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"query", "public", TArgs, TOutput>, args: TArgs): Effect.Effect<TOutput, ConvexCallError>;
+  mutation<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"mutation", "public", TArgs, TOutput>, args: TArgs): Effect.Effect<TOutput, ConvexCallError>;
+  action<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"action", "public", TArgs, TOutput>, args: TArgs): Effect.Effect<TOutput, ConvexCallError>;
+  /**
+   * Substrate-level reactive transport over Convex's `onUpdate`.
+   *
+   * @internal-use — substrate only; see `ports/subscription.ts`. Domain
+   * ports do not expose reactive callback methods to consumers (ARCH-LOCK-1).
+   */
+  subscribe<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"query", "public", TArgs, TOutput>, args: TArgs, callback: (snapshot: Snapshot<TOutput>) => void): Effect.Effect<Unsubscribe, ConvexCallError>;
+}
+//#endregion
+//#region src/ports/credentials.d.ts
+type CreateApplicationInput = {
+  readonly authUserId: AuthUserId;
+  readonly name: string;
+  readonly allowedOrigins: readonly AllowedOrigin[];
+};
+type MintKeyInput = {
+  readonly applicationId: AppId;
+  readonly authUserId: AuthUserId;
+};
+type RotateKeyInput = {
+  readonly keyId: PublishableKeyId;
+  readonly authUserId: AuthUserId;
+  readonly graceMs: DurationMs;
+};
+type RevokeKeyInput = {
+  readonly keyId: PublishableKeyId;
+  readonly authUserId: AuthUserId;
+};
+type RotateKeyResult = {
+  readonly active: PublishableKeyRecord;
+  readonly retired: PublishableKeyRecord;
+};
+declare const CredentialsError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "CredentialsError";
+} & Readonly<A>;
+declare class CredentialsError extends CredentialsError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface CredentialsPort {
+  listApplications(authUserId: AuthUserId): Effect.Effect<readonly DeveloperApplication[], CredentialsError>;
+  createApplication(input: CreateApplicationInput): Effect.Effect<DeveloperApplication, CredentialsError>;
+  mintPublishableKey(input: MintKeyInput): Effect.Effect<PublishableKeyRecord, CredentialsError>;
+  rotatePublishableKey(input: RotateKeyInput): Effect.Effect<RotateKeyResult, CredentialsError>;
+  revokePublishableKey(input: RevokeKeyInput): Effect.Effect<void, CredentialsError>;
+}
+//#endregion
+//#region src/ports/identity.d.ts
+type CreateIdentityInput = {
+  readonly authUserId: AuthUserId;
+  readonly email: Email;
+  readonly displayName?: string;
+  readonly country?: CountryCode;
+};
+type UpdateIdentityInput = {
+  readonly authUserId: AuthUserId;
+  readonly displayName?: string;
+  readonly country?: CountryCode;
+};
+/**
+ * D-ONBOARD (#669) — the onboarding-complete identity write. Composes the
+ * existing create/update write into one idempotent upsert that ALSO sets the
+ * `onboarded` flag and persists the optional `withdrawalAddress` (the one
+ * allowed raw-0x class). `displayName` + `country` are required at onboarding
+ * time. The returned `Profile` is the existing branded shape — the onboarding
+ * flags live on the wire row and are not projected onto the read surface.
+ */
+type CompleteOnboardingIdentityInput = {
+  readonly authUserId: AuthUserId;
+  readonly email: Email;
+  readonly displayName: string;
+  readonly country: CountryCode;
+  readonly withdrawalAddress?: Address;
+};
+declare const IdentityError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "IdentityError";
+} & Readonly<A>;
+declare class IdentityError extends IdentityError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface IdentityPort {
+  loadByAuthUserId(authUserId: AuthUserId): Effect.Effect<Profile$1 | null, IdentityError, never>;
+  create(input: CreateIdentityInput): Effect.Effect<Profile$1, IdentityError, never>;
+  update(input: UpdateIdentityInput): Effect.Effect<Profile$1, IdentityError, never>;
+  /** D-ONBOARD (#669): idempotent upsert that marks the identity onboarded. */
+  completeOnboarding(input: CompleteOnboardingIdentityInput): Effect.Effect<Profile$1, IdentityError, never>;
+}
+//#endregion
+//#region src/ports/smart-account.d.ts
+type ProvisionInput = {
+  readonly authUserId: AuthUserId;
+  readonly chainId: ChainId;
+};
+/**
+ * Input to `SmartAccountPort.confirmDeployment` (#161 · γ-B).
+ *
+ * The SDK provides evidence pointers; the backend is the oracle for
+ * `deployedAt`. `evidence.deployedAt` does NOT exist by schema (see
+ * `SafeDeploymentEvidence`) — the backend derives `deployedAt` from
+ * the on-chain receipt block via `eth_getBlockByNumber`.
+ *
+ * Precheck path: `evidence.userOpHash` omitted; backend scans
+ * `SafeProxyFactory.ProxyCreation(safeAddress, _)` via `eth_getLogs`.
+ *
+ * Real-userOp path: `evidence.userOpHash` populated; backend calls
+ * `eth_getUserOperationReceipt(userOpHash)` to re-verify and derive.
+ */
+type ConfirmDeploymentInput = {
+  readonly authUserId: AuthUserId;
+  readonly chainId: ChainId;
+  readonly safeAddress: Address;
+  readonly evidence: SafeDeploymentEvidence;
+  /**
+   * Optional live-E2E correlation id. This does not prove deployment; the
+   * backend still re-verifies chain evidence and only mirrors this branded
+   * id onto telemetry for PostHog run joins.
+   */
+  readonly telemetryRunId?: RunId;
+};
+/**
+ * Input to `SmartAccountPort.claim` (PRD #462). The authenticated session
+ * reports the browser-created signer address; the BACKEND builds and
+ * bootstrap-signs the claim userOp (deploy + swapOwner) — the consumer signs
+ * nothing at claim.
+ */
+type ClaimInput = {
+  readonly authUserId: AuthUserId;
+  readonly chainId: ChainId;
+  readonly signerAddress: Address;
+  readonly telemetryRunId?: RunId;
+};
+declare const SmartAccountError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "SmartAccountError";
+} & Readonly<A>;
+declare class SmartAccountError extends SmartAccountError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface SmartAccountPort {
+  loadByAuthUserId(authUserId: AuthUserId): Effect.Effect<SmartAccount$1 | null, SmartAccountError, never>;
+  loadBySmartAccountAddress(address: Address): Effect.Effect<SmartAccount$1 | null, SmartAccountError, never>;
+  provision(input: ProvisionInput): Effect.Effect<SmartAccount$1, SmartAccountError, never>;
+  /**
+   * Persist on-chain Safe-deployment evidence. The backend re-verifies
+   * the evidence against chain state and derives `deployedAt` from the
+   * receipt block's timestamp. Returns the updated `SmartAccount` row.
+   *
+   * γ-B trust model: the SDK supplies evidence pointers only. The
+   * backend is the SOLE oracle for `deployedAt` — see
+   * `docs/canon/ports/smart-account.md`.
+   */
+  confirmDeployment(input: ConfirmDeploymentInput): Effect.Effect<SmartAccount$1, SmartAccountError, never>;
+  /**
+   * Claim the account (PRD #462): the backend builds, bootstrap-signs, and
+   * submits ONE sponsored userOp — deploy (when undeployed) + swapOwner
+   * (bootstrap → `signerAddress`). Idempotent; returns the updated row. When
+   * another claim is in flight the row comes back with `claimedAt: null` —
+   * callers poll lifecycle until the claim lands.
+   */
+  claim(input: ClaimInput): Effect.Effect<SmartAccount$1, SmartAccountError, never>;
+}
+//#endregion
+//#region src/ports/account-read.d.ts
+type ReadAccountBalanceInput = {
+  readonly chainId: ChainId;
+};
+type FundFromFaucetInput = {
+  readonly chainId: ChainId;
+  readonly amount: Money;
+};
+type FundFromFaucetResult = {
+  readonly txHash: string;
+};
+declare const AccountReadError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "AccountReadError";
+} & Readonly<A>;
+declare class AccountReadError extends AccountReadError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+/**
+ * Logical Account money read (M2 Slice S1a). Joins the `accounts` row with a
+ * live RPC `balanceOf` pull; the adapter lifts wire integers to `Money`.
+ */
+interface AccountReadPort {
+  readBalance(input: ReadAccountBalanceInput): Effect.Effect<Account, AccountReadError, never>;
+  fundFromFaucet(input: FundFromFaucetInput): Effect.Effect<FundFromFaucetResult, AccountReadError, never>;
+}
+//#endregion
+//#region src/ports/sub-account.d.ts
+declare const SubAccountError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "SubAccountError";
+} & Readonly<A>;
+declare class SubAccountError extends SubAccountError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+type CreateSubAccountInput = {
+  readonly accountId: AccountId;
+  readonly name: string;
+};
+type SubAccountIdInput = {
+  readonly subAccountId: SubAccountId;
+};
+type RenameSubAccountInput = {
+  readonly subAccountId: SubAccountId;
+  readonly name: string;
+};
+/**
+ * A `transfer` endpoint is either the Account's MAIN balance (the remainder
+ * left over after every sub-account is funded — never a stored row) or a
+ * specific sub-account, addressed by its `SubAccountId` (canon
+ * `account-balance-model.md` §5, §12).
+ */
+type TransferEndpoint = "main" | SubAccountId;
+/**
+ * Move money between two of the SAME Account's balances (canon §12). The
+ * backend resolves the Account from auth (v1 = one Account per user), so the
+ * input carries no `accountId` — only the from/to endpoints and the `Money`
+ * amount. One verb covers money in (`main → sub`), money out (`sub → main`),
+ * and `sub → sub`.
+ */
+type TransferInput = {
+  readonly from: TransferEndpoint;
+  readonly to: TransferEndpoint;
+  readonly amount: Money;
+};
+/**
+ * Result of a `transfer`: the recomputed `available` (`balanceOf − Σ`), plus
+ * the updated source/destination sub-account rows. An endpoint that is `"main"`
+ * has no stored row, so its slot is `null`.
+ */
+type TransferResult = {
+  readonly available: Money;
+  readonly from: SubAccount | null;
+  readonly to: SubAccount | null;
+};
+interface SubAccountPort {
+  create(input: CreateSubAccountInput): Effect.Effect<SubAccount, SubAccountError, never>;
+  get(input: SubAccountIdInput): Effect.Effect<SubAccount | null, SubAccountError, never>;
+  list(input: {
+    readonly accountId: AccountId;
+  }): Effect.Effect<readonly SubAccount[], SubAccountError, never>;
+  rename(input: RenameSubAccountInput): Effect.Effect<SubAccount, SubAccountError, never>;
+  delete(input: SubAccountIdInput): Effect.Effect<void, SubAccountError, never>;
+  transfer(input: TransferInput): Effect.Effect<TransferResult, SubAccountError, never>;
+}
+//#endregion
+//#region src/flows/types.d.ts
+/**
+ * The full 13-port bundle that `assembleCapxulClient` (slice 5) consumes.
+ * (Was 15 before the dead local-signer port was retired; the deploy path
+ * now signs exclusively through `CapxulSigner`.)
+ *
+ * Each per-flow factory in slices 2-4 takes a narrowed subset, e.g.
+ * `AuthFlowPorts = Pick<FlowPorts, "authClient" | "clock" | "telemetry">`.
+ * Slice 1 ships only the union; per Q6 each per-flow slice declares its
+ * own narrowed `Pick<FlowPorts, ...>` inside its flow file.
+ */
+interface FlowPorts {
+  readonly authClient: AuthClientPort;
+  readonly authCache: AuthCachePort;
+  readonly identity: IdentityPort;
+  readonly smartAccount: SmartAccountPort;
+  readonly accountRead: AccountReadPort;
+  readonly subAccount: SubAccountPort;
+  readonly credentials: CredentialsPort;
+  readonly bootstrap: BootstrapPort;
+  readonly clock: ClockPort;
+  readonly env: EnvPort;
+  readonly telemetry: TelemetryPort;
+  readonly transport: TransportPort;
+  readonly convexCall: ConvexCallPort;
+}
+/**
+ * Pre-resolved external signer + signed proof. The UI obtains this
+ * BEFORE prompting the user to verify (MetaMask popup, hardware-wallet
+ * confirm, etc.), then the consumer sends it to AuthFlow via the
+ * `SET_SIGNER` event between `idle` and `verifying`. AuthFlow assigns
+ * to `context.externalSigner` on the SET_SIGNER self-loop in either
+ * `idle` or `otp_requested`, then flows the value through to the
+ * invoked ProvisioningFlow child via `invoke.input.externalSigner`.
+ * The child's `branching` state inspects `context.signerAddress`
+ * (derived from `input.externalSigner?.address`) to route through
+ * `register_external` instead of `mint_openfort` when present.
+ *
+ * The signer's lifetime is the authenticated session — `clearAuthContext`
+ * (on SIGN_OUT → idle) and `clearErrorAndContext` (on error → RESET →
+ * idle) both wipe `context.externalSigner`. A subsequent sign-in cycle
+ * begins fresh; the consumer re-sends SET_SIGNER (or omits it for the
+ * Openfort fallback path). Reference:
+ * `docs/decisions/stage-3-external-signer-lifecycle.html` (Option C,
+ * locked 2026-05-17, supersedes the earlier factory-input shape).
+ *
+ * `signedProof` is an EIP-191 signed message proving the user controls
+ * the address. ProvisioningFlow does not verify the proof itself —
+ * verification is delegated to the indexer registration in Stage 4 when
+ * `IndexerPort.registerSafe` lands. For Stage 3 the field is recorded
+ * verbatim for trace fidelity.
+ *
+ * The type lives in this flows/types module (not in `@capxul/types`)
+ * because it is a flow-shape composite — `Address` + a freeform proof
+ * string — not a primitive brand. Per the Stage 3 plan's vocabulary
+ * convention, flow-shape composites stay co-located with their flow.
+ */
+interface ExternalSigner {
+  readonly address: Address;
+  readonly signedProof: string;
+}
+//#endregion
+//#region src/client/auth.d.ts
+interface SignInOptions {
+  readonly signal?: AbortSignal;
+}
+type AuthMethodOptions = SignInOptions;
+interface AuthMethods {
+  canSendOtp(input: {
+    readonly email: string;
+  }, options?: AuthMethodOptions): Promise<CapxulResult<CanSendOtpStatus>>;
+  signIn(input: {
+    readonly email: string;
+  }, options?: SignInOptions): Promise<CapxulResult<{
+    readonly sessionId: string;
+    readonly expiresAt: number;
+  }>>;
+  verifyOtp(input: {
+    readonly email: string;
+    readonly code: string;
+    readonly signer?: ExternalSigner;
+  }, options?: AuthMethodOptions): Promise<CapxulResult<Session>>;
+  signOut(options?: AuthMethodOptions): Promise<CapxulResult<void>>;
+  getSession(options?: AuthMethodOptions): Promise<CapxulResult<Session | null>>;
+}
+//#endregion
+//#region src/client/smart-account.d.ts
+interface SmartAccountMethods {
+  loadCurrent(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<SmartAccount | null>>;
+  provision(input?: {
+    readonly externalSigner?: ExternalSigner;
+  }): Promise<CapxulResult<SmartAccount>>;
+}
+//#endregion
+//#region src/client/identity.d.ts
+interface IdentityMethods {
+  loadCurrent(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Profile | null>>;
+}
+//#endregion
+//#region src/client/account-lane.d.ts
+type ProvisioningFailureStep = "wallet" | "identity" | "provision" | "deploy";
+type ProvisioningPhase = {
+  readonly status: "idle";
+} | {
+  readonly status: "wallet";
+} | {
+  readonly status: "identity";
+} | {
+  readonly status: "provision";
+} | {
+  readonly status: "deploy";
+} | {
+  readonly status: "ready";
+} | {
+  readonly status: "failed";
+  readonly at: ProvisioningFailureStep;
+  readonly error: CapxulError;
+};
+//#endregion
+//#region src/client/account-lifecycle.d.ts
+type AccountSetupStep = "connecting" | "confirmingIdentity" | "registering" | "activating";
+type AccountLifecycle = {
+  readonly status: "loading";
+} | {
+  readonly status: "settingUp";
+  readonly step: AccountSetupStep;
+} | {
+  readonly status: "ready";
+  readonly accountId: string;
+  readonly canTransact: boolean;
+} | {
+  readonly status: "failed";
+  readonly at: AccountSetupStep;
+  readonly error: CapxulError;
+};
+declare function isSettingUpLifecycle(lifecycle: AccountLifecycle): boolean;
+//#endregion
+//#region ../wire/src/financial-ops.d.ts
+declare const AttachablePaymentDocumentEnvelope: Schema.Union<[Schema.Struct<{
+  protocol: Schema.Literal<["capxul.payment-document"]>;
+  version: Schema.Literal<[1]>;
+  domain: Schema.Struct<{
+    name: Schema.Literal<["CapxulPayments"]>;
+    version: Schema.Literal<["1"]>;
+    chainId: Schema.Schema<ChainId, number, never>;
+    verifyingContract: Schema.Literal<["0xe740ea65521edc9bef0ea75d30b5334711db99f4"]>;
+  }>;
+  primaryType: Schema.Literal<["Memo"]>;
+  message: Schema.Struct<{
+    kind: Schema.Literal<[0]>;
+    reference: typeof Schema.String;
+    note: typeof Schema.String;
+    issuedAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+  }>;
+}>, Schema.Struct<{
+  protocol: Schema.Literal<["capxul.payment-document"]>;
+  version: Schema.Literal<[1]>;
+  domain: Schema.Struct<{
+    name: Schema.Literal<["CapxulPayments"]>;
+    version: Schema.Literal<["1"]>;
+    chainId: Schema.Schema<ChainId, number, never>;
+    verifyingContract: Schema.Literal<["0xe740ea65521edc9bef0ea75d30b5334711db99f4"]>;
+  }>;
+  primaryType: Schema.Literal<["Invoice"]>;
+  message: Schema.Struct<{
+    kind: Schema.Literal<[1]>;
+    invoiceNumber: typeof Schema.String;
+    payerRef: typeof Schema.String;
+    payeeRef: typeof Schema.String;
+    amount: Schema.refine<string, Schema.Schema<string, string, never>>;
+    currency: Schema.Schema<CurrencyCode, string, never>;
+    decimals: Schema.refine<number, Schema.Schema<number, number, never>>;
+    issuedAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+    dueAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+    lineItemsHash: Schema.Schema<DocumentHash, string, never>;
+  }>;
+}>, Schema.Struct<{
+  protocol: Schema.Literal<["capxul.payment-document"]>;
+  version: Schema.Literal<[1]>;
+  domain: Schema.Struct<{
+    name: Schema.Literal<["CapxulPayments"]>;
+    version: Schema.Literal<["1"]>;
+    chainId: Schema.Schema<ChainId, number, never>;
+    verifyingContract: Schema.Literal<["0xe740ea65521edc9bef0ea75d30b5334711db99f4"]>;
+  }>;
+  primaryType: Schema.Literal<["Payslip"]>;
+  message: Schema.Struct<{
+    kind: Schema.Literal<[2]>;
+    employerRef: typeof Schema.String;
+    employeeRef: typeof Schema.String;
+    period: typeof Schema.String;
+    gross: Schema.refine<string, Schema.Schema<string, string, never>>;
+    net: Schema.refine<string, Schema.Schema<string, string, never>>;
+    currency: Schema.Schema<CurrencyCode, string, never>;
+    decimals: Schema.refine<number, Schema.Schema<number, number, never>>;
+    issuedAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+  }>;
+}>, Schema.Struct<{
+  protocol: Schema.Literal<["capxul.payment-document"]>;
+  version: Schema.Literal<[1]>;
+  domain: Schema.Struct<{
+    name: Schema.Literal<["CapxulPayments"]>;
+    version: Schema.Literal<["1"]>;
+    chainId: Schema.Schema<ChainId, number, never>;
+    verifyingContract: Schema.Literal<["0xe740ea65521edc9bef0ea75d30b5334711db99f4"]>;
+  }>;
+  primaryType: Schema.Literal<["Receipt"]>;
+  message: Schema.Struct<{
+    kind: Schema.Literal<[3]>;
+    reference: typeof Schema.String;
+    amount: Schema.refine<string, Schema.Schema<string, string, never>>;
+    currency: Schema.Schema<CurrencyCode, string, never>;
+    decimals: Schema.refine<number, Schema.Schema<number, number, never>>;
+    paidAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+    note: typeof Schema.String;
+  }>;
+}>]>;
+declare const WithdrawalDocumentEnvelope: Schema.Struct<{
+  protocol: Schema.Literal<["capxul.payment-document"]>;
+  version: Schema.Literal<[1]>;
+  domain: Schema.Struct<{
+    name: Schema.Literal<["CapxulPayments"]>;
+    version: Schema.Literal<["1"]>;
+    chainId: Schema.Schema<ChainId, number, never>;
+    verifyingContract: Schema.Literal<["0xe740ea65521edc9bef0ea75d30b5334711db99f4"]>;
+  }>;
+  primaryType: Schema.Literal<["Withdrawal"]>;
+  message: Schema.Struct<{
+    kind: Schema.Literal<[4]>;
+    reference: typeof Schema.String;
+    amount: Schema.refine<string, Schema.Schema<string, string, never>>;
+    currency: Schema.Schema<CurrencyCode, string, never>;
+    decimals: Schema.refine<number, Schema.Schema<number, number, never>>;
+    destChain: Schema.Schema<ChainId, number, never>;
+    destAddress: Schema.refine<string, Schema.Schema<string, string, never>>;
+    settledAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+    provider: typeof Schema.String;
+    note: typeof Schema.String;
+  }>;
+}>;
+declare const PaymentDocumentEnvelope: Schema.Union<[Schema.Union<[Schema.Struct<{
+  protocol: Schema.Literal<["capxul.payment-document"]>;
+  version: Schema.Literal<[1]>;
+  domain: Schema.Struct<{
+    name: Schema.Literal<["CapxulPayments"]>;
+    version: Schema.Literal<["1"]>;
+    chainId: Schema.Schema<ChainId, number, never>;
+    verifyingContract: Schema.Literal<["0xe740ea65521edc9bef0ea75d30b5334711db99f4"]>;
+  }>;
+  primaryType: Schema.Literal<["Memo"]>;
+  message: Schema.Struct<{
+    kind: Schema.Literal<[0]>;
+    reference: typeof Schema.String;
+    note: typeof Schema.String;
+    issuedAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+  }>;
+}>, Schema.Struct<{
+  protocol: Schema.Literal<["capxul.payment-document"]>;
+  version: Schema.Literal<[1]>;
+  domain: Schema.Struct<{
+    name: Schema.Literal<["CapxulPayments"]>;
+    version: Schema.Literal<["1"]>;
+    chainId: Schema.Schema<ChainId, number, never>;
+    verifyingContract: Schema.Literal<["0xe740ea65521edc9bef0ea75d30b5334711db99f4"]>;
+  }>;
+  primaryType: Schema.Literal<["Invoice"]>;
+  message: Schema.Struct<{
+    kind: Schema.Literal<[1]>;
+    invoiceNumber: typeof Schema.String;
+    payerRef: typeof Schema.String;
+    payeeRef: typeof Schema.String;
+    amount: Schema.refine<string, Schema.Schema<string, string, never>>;
+    currency: Schema.Schema<CurrencyCode, string, never>;
+    decimals: Schema.refine<number, Schema.Schema<number, number, never>>;
+    issuedAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+    dueAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+    lineItemsHash: Schema.Schema<DocumentHash, string, never>;
+  }>;
+}>, Schema.Struct<{
+  protocol: Schema.Literal<["capxul.payment-document"]>;
+  version: Schema.Literal<[1]>;
+  domain: Schema.Struct<{
+    name: Schema.Literal<["CapxulPayments"]>;
+    version: Schema.Literal<["1"]>;
+    chainId: Schema.Schema<ChainId, number, never>;
+    verifyingContract: Schema.Literal<["0xe740ea65521edc9bef0ea75d30b5334711db99f4"]>;
+  }>;
+  primaryType: Schema.Literal<["Payslip"]>;
+  message: Schema.Struct<{
+    kind: Schema.Literal<[2]>;
+    employerRef: typeof Schema.String;
+    employeeRef: typeof Schema.String;
+    period: typeof Schema.String;
+    gross: Schema.refine<string, Schema.Schema<string, string, never>>;
+    net: Schema.refine<string, Schema.Schema<string, string, never>>;
+    currency: Schema.Schema<CurrencyCode, string, never>;
+    decimals: Schema.refine<number, Schema.Schema<number, number, never>>;
+    issuedAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+  }>;
+}>, Schema.Struct<{
+  protocol: Schema.Literal<["capxul.payment-document"]>;
+  version: Schema.Literal<[1]>;
+  domain: Schema.Struct<{
+    name: Schema.Literal<["CapxulPayments"]>;
+    version: Schema.Literal<["1"]>;
+    chainId: Schema.Schema<ChainId, number, never>;
+    verifyingContract: Schema.Literal<["0xe740ea65521edc9bef0ea75d30b5334711db99f4"]>;
+  }>;
+  primaryType: Schema.Literal<["Receipt"]>;
+  message: Schema.Struct<{
+    kind: Schema.Literal<[3]>;
+    reference: typeof Schema.String;
+    amount: Schema.refine<string, Schema.Schema<string, string, never>>;
+    currency: Schema.Schema<CurrencyCode, string, never>;
+    decimals: Schema.refine<number, Schema.Schema<number, number, never>>;
+    paidAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+    note: typeof Schema.String;
+  }>;
+}>]>, Schema.Struct<{
+  protocol: Schema.Literal<["capxul.payment-document"]>;
+  version: Schema.Literal<[1]>;
+  domain: Schema.Struct<{
+    name: Schema.Literal<["CapxulPayments"]>;
+    version: Schema.Literal<["1"]>;
+    chainId: Schema.Schema<ChainId, number, never>;
+    verifyingContract: Schema.Literal<["0xe740ea65521edc9bef0ea75d30b5334711db99f4"]>;
+  }>;
+  primaryType: Schema.Literal<["Withdrawal"]>;
+  message: Schema.Struct<{
+    kind: Schema.Literal<[4]>;
+    reference: typeof Schema.String;
+    amount: Schema.refine<string, Schema.Schema<string, string, never>>;
+    currency: Schema.Schema<CurrencyCode, string, never>;
+    decimals: Schema.refine<number, Schema.Schema<number, number, never>>;
+    destChain: Schema.Schema<ChainId, number, never>;
+    destAddress: Schema.refine<string, Schema.Schema<string, string, never>>;
+    settledAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+    provider: typeof Schema.String;
+    note: typeof Schema.String;
+  }>;
+}>]>;
+/**
+ * #592 invoice line item. `quantity` is a positive integer; `unitMinor` is the
+ * per-unit price in integer minor units. The list is canonically hashed by
+ * `hashLineItems` (payment-document-hash.ts) into the Invoice `lineItemsHash`,
+ * and Σ(quantity × unitMinor) MUST equal the invoice `amount`. The hash binds
+ * the documentHash to the exact items; the sum-check makes the items add up to
+ * the amount due. See the payment-document spec (canon/mcp/financial-ops.md).
+ */
+declare const LineItem: Schema.Struct<{
+  description: typeof Schema.String;
+  quantity: Schema.refine<number, Schema.Schema<number, number, never>>;
+  unitMinor: Schema.refine<string, Schema.Schema<string, string, never>>;
+}>;
+type AttachablePaymentDocumentEnvelopeV1 = Schema.Schema.Type<typeof AttachablePaymentDocumentEnvelope>;
+type PaymentDocumentEnvelopeV1 = Schema.Schema.Type<typeof PaymentDocumentEnvelope>;
+type WithdrawalDocumentEnvelopeV1 = Schema.Schema.Type<typeof WithdrawalDocumentEnvelope>;
+type LineItemV1 = Schema.Schema.Type<typeof LineItem>;
+//#endregion
+//#region ../wire/src/leak-safety.d.ts
+declare const OnchainEvidenceBrand: unique symbol;
+/**
+ * The branded `{ userOpHash, txHash }` pair. On-chain settlement evidence is
+ * INTERNAL — it flows on the server-internal channel only, never onto a wire
+ * Payment or any MCP tool output. The brand makes "this is internal evidence"
+ * a type, so a loose pair can't be passed where a wire field is expected.
+ */
+type OnchainEvidence = {
+  readonly userOpHash: string;
+  readonly txHash: string;
+} & {
+  readonly [OnchainEvidenceBrand]: "OnchainEvidence";
+};
+//#endregion
+//#region src/client/financial-ops.d.ts
+type RecipientResolutionKind = "email" | "org" | "payee";
+type Ref = {
+  readonly kind: "handle";
+  readonly handle: string;
+} | {
+  readonly kind: "email";
+  readonly email: string;
+} | {
+  readonly kind: "orgHandle";
+  readonly orgHandle: string;
+} | {
+  readonly kind: "capxulUserId";
+  readonly capxulUserId: string;
+} | {
+  readonly kind: "payeeId";
+  readonly payeeId: string;
+};
+interface MeProfile {
+  readonly authUserId: string;
+  readonly email: string;
+  readonly displayName: string | null;
+}
+interface DepositInstructions {
+  readonly accountKind: "personalSafe" | "orgTreasury";
+  readonly chainId: number;
+  readonly network: "base-sepolia";
+  readonly currency: "USD";
+  readonly address: string;
+  readonly label: string;
+}
+interface RecipientResolution {
+  readonly kind: RecipientResolutionKind;
+  readonly recipient: string;
+  readonly label: string;
+  readonly safeAddress: string;
+  readonly payeeId?: string;
+  readonly orgId?: string;
+  readonly handle?: string;
+  readonly email?: string;
+}
+interface Payee {
+  readonly payeeId: string;
+  readonly label: string;
+  readonly recipientRef: string;
+  readonly handle: string | null;
+  readonly destinationKind: "email" | "org" | "payeeHandle";
+  readonly safeAddress: string;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+}
+interface MeMethods {
+  get(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<MeProfile>>;
+  depositInstructions(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<DepositInstructions>>;
+}
+interface HandlesMethods {
+  resolve(handle: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<RecipientResolution>>;
+}
+interface PayeesMethods {
+  create(input: {
+    readonly label: string;
+    readonly recipient: string;
+    readonly handle?: string;
+  }, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payee>>;
+  get(payeeId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payee | null>>;
+  resolve(recipient: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<RecipientResolution>>;
+}
+interface PaymentMoney {
+  readonly currency: string;
+  readonly value: string;
+  readonly decimals: number;
+}
+type PaymentStatus = "pending" | "submitted" | "pending_claim" | "scheduled" | "streaming" | "settled" | "cancelled" | "redirected" | "expired" | "failed";
+type PaymentType = "unspecified" | "invoice" | "payroll" | "reimbursement";
+interface PaymentDocumentRef {
+  readonly documentHash: string;
+  readonly kind: "memo" | "invoice" | "payslip" | "receipt" | "withdrawal";
+  readonly title?: string;
+  readonly uri?: string;
+  readonly issuedAt?: number;
+}
+type PaymentTiming = {
+  readonly kind: "instant";
+} | {
+  readonly kind: "scheduled";
+  readonly at: number;
+} | {
+  readonly kind: "stream";
+  readonly startsAt: number;
+  readonly endsAt: number;
+  readonly cliffAt?: number;
+};
+interface Payment {
+  readonly id: string;
+  readonly status: PaymentStatus;
+  readonly amount: PaymentMoney;
+  readonly paymentType: PaymentType;
+  readonly recipient: {
+    readonly kind: "handle" | "email" | "payee" | "capxulUserId" | "me" | "org" | "external_address";
+    readonly label: string;
+    readonly payeeId?: string;
+  };
+  readonly documents: readonly PaymentDocumentRef[];
+  readonly timing: PaymentTiming;
+  readonly released: PaymentMoney;
+  readonly availableToClaim: PaymentMoney;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+}
+interface PaymentsPayInput {
+  readonly to: Ref;
+  readonly amount: PaymentMoney;
+  /** Full EIP-712 document envelope; hashed + stored, committed on-chain. */
+  readonly document?: AttachablePaymentDocumentEnvelopeV1;
+  /**
+   * Timing clause (D-SHAPE · #646). Omitted ⇒ `instant` (the G2 direct-send path).
+   * A `scheduled`/`stream` clause turns the payment into a Commitment
+   * (escrow-vest-claim) backed by `CapxulPayments.createCommitment`.
+   */
+  readonly timing?: PaymentTiming;
+  /**
+   * #592: itemized line items backing an Invoice `document`. The backend asserts
+   * `hashLineItems(lineItems) === document.lineItemsHash` AND `Σ(quantity ×
+   * unitMinor) === document.amount`, then persists the list for itemized render.
+   */
+  readonly lineItems?: readonly LineItemV1[];
+}
+/**
+ * B3 withdraw / cash-out input. Stripe-shaped: `to` is the EXTERNAL 0x wallet
+ * (the ONE place the SDK accepts a raw address — the pay lane never does),
+ * `amount` is a Money, `document` is the REQUIRED kind:4 Withdrawal envelope
+ * (carries the audit-visible destAddress). No chain / Safe / token / hash
+ * custody substrate on the input. Returns a leak-safe `Payment` whose recipient
+ * label is the redacted address — never the full 0x.
+ */
+interface PaymentsWithdrawInput {
+  readonly to: string;
+  readonly amount: PaymentMoney;
+  readonly document: WithdrawalDocumentEnvelopeV1;
+}
+/**
+ * Payout via a saved destination. The caller selects the destination by opaque
+ * id and never re-enters a raw wallet address on this path.
+ */
+interface PaymentsPayoutInput {
+  readonly actor?: {
+    readonly kind: "account";
+  } | {
+    readonly kind: "org";
+    readonly orgId: string;
+  };
+  readonly destinationId: string;
+  readonly amount: PaymentMoney;
+}
+type DestinationKind = "bank" | "mobile-money" | "wallet";
+type DestinationPayload = {
+  readonly accountHolderName: string;
+  readonly bankName: string;
+  readonly country: string;
+  readonly currency: string;
+  readonly accountNumberLast4: string;
+} | {
+  readonly provider: string;
+  readonly country: string;
+  readonly currency: string;
+  readonly phoneNumberLast4: string;
+} | {
+  readonly network: "base-sepolia";
+  readonly address: string;
+};
+interface Destination {
+  readonly id: string;
+  readonly counterpartyId: string;
+  readonly ref: Ref;
+  readonly kind: DestinationKind;
+  readonly label: string | null;
+  readonly payload: DestinationPayload;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+}
+interface DestinationAddInput {
+  readonly actor?: {
+    readonly kind: "account";
+  } | {
+    readonly kind: "org";
+    readonly orgId: string;
+  };
+  readonly ref: Ref;
+  readonly kind: DestinationKind;
+  readonly label?: string;
+  readonly payload: DestinationPayload;
+}
+interface DestinationListInput {
+  readonly actor?: {
+    readonly kind: "account";
+  } | {
+    readonly kind: "org";
+    readonly orgId: string;
+  };
+  readonly ref: Ref;
+}
+interface DestinationRemoveInput {
+  readonly actor?: {
+    readonly kind: "account";
+  } | {
+    readonly kind: "org";
+    readonly orgId: string;
+  };
+  readonly destinationId: string;
+}
+interface DestinationsMethods {
+  add(input: DestinationAddInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Destination>>;
+  list(input: DestinationListInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly Destination[]>>;
+  remove(input: DestinationRemoveInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<{
+    readonly id: string;
+  }>>;
+}
+interface PaymentSettlementInput {
+  readonly paymentId: string;
+  readonly evidence: OnchainEvidence;
+}
+/**
+ * Host-execution callback recording the on-chain escrow of a commitment
+ * (G3 · #546): `createCommitment` returned `onchainCommitmentId`, escrowing
+ * the total. `onchainCommitmentId` + the userOp/tx hashes are internal evidence,
+ * never on the wire (internal channel only).
+ */
+interface CommitmentCreatedInput {
+  readonly paymentId: string;
+  readonly onchainCommitmentId: string;
+  readonly evidence: OnchainEvidence;
+}
+/** Host-execution callback recording a recipient-side `claim` (G3 · #546). */
+interface CommitmentClaimInput {
+  readonly paymentId: string;
+  readonly evidence: OnchainEvidence;
+}
+/**
+ * Host-execution callback recording a creator-side `cancel` (G3 · #546):
+ * on-chain the unvested remainder returns to the creator; vested-unclaimed
+ * stays the recipient's. An optional credit-note document is appended.
+ */
+interface CommitmentCancelInput {
+  readonly paymentId: string;
+  readonly evidence: OnchainEvidence;
+  readonly document?: PaymentDocumentEnvelopeV1;
+}
+/**
+ * Host-execution callback recording a pre-claim `redirect` to a new validated
+ * recipient (G3 · #546). `to` is a validated recipient (handle/email/payee id),
+ * never a raw address.
+ */
+interface CommitmentRedirectInput {
+  readonly paymentId: string;
+  readonly to: Ref;
+  readonly evidence: OnchainEvidence;
+  readonly document?: PaymentDocumentEnvelopeV1;
+}
+/**
+ * Host-execution callback recording a settled ORG spend/payroll on the ONE
+ * `payments` ledger (D3 · #565). An org spend is a KIND of Payment — it lands a
+ * real `payments` row with `source:"org"` + `orgId` (no parallel `orgSpends`
+ * table, no synthetic client-side fabrication). The signer-side host calls this
+ * AFTER the on-chain Roles-modifier spend settles; `evidence` carries the
+ * internal userOp/tx hashes (never wire fields). `recipient` is the validated
+ * recipient ref label; `recipientSafeAddress` is internal evidence on the row.
+ */
+interface OrgPaymentRecordInput {
+  readonly orgId: string;
+  readonly recipientLabel: string;
+  readonly recipientKind?: "handle" | "email" | "payee" | "capxulUserId" | "me" | "org";
+  readonly recipientRef?: string;
+  readonly recipientPayeeId?: string;
+  readonly recipientSafeAddress: string;
+  readonly amount: PaymentMoney;
+  readonly paymentType: PaymentType;
+  readonly document?: PaymentDocumentEnvelopeV1;
+  /** The org Safe the spend debited — bound as the `from` of the settlement transfer. */
+  readonly orgSafeAddress: string;
+  /**
+   * 0-based occurrence among batch runs with the same (recipient, amount), so
+   * each run binds to + de-dupes on its own on-chain `Transfer` (D3 · #565).
+   */
+  readonly occurrenceIndex: number;
+  readonly evidence: OnchainEvidence;
+}
+interface PaymentDocumentVerification {
+  readonly documentHash: string;
+  readonly ok: boolean;
+  readonly derivedHash: string;
+  readonly kind: "memo" | "invoice" | "payslip" | "receipt" | "withdrawal";
+}
+/**
+ * #577 render-on-demand result. `html` is self-contained user-visible document
+ * HTML (stylesheet + rendered document). The MCP `paymentDocuments.render` tool
+ * exposes only `{documentHash, kind, ok}` to the model and returns `html` in an
+ * audience:["user"] content block (#506 redaction matrix).
+ */
+interface PaymentDocumentRender {
+  readonly documentHash: string;
+  readonly ok: boolean;
+  readonly kind: "memo" | "invoice" | "payslip" | "receipt" | "withdrawal";
+  readonly html: string;
+}
+/**
+ * Internal commitment execution reference (G3 · #546). The on-chain
+ * `onchainCommitmentId` is internal evidence (like userOp/tx hashes) — it never
+ * appears on the wire `Payment` or any MCP tool output, but the signer-side host
+ * needs it to build a claim/cancel/redirect UserOp. This is the server-internal
+ * channel that carries it (and the recipient Safe address for an auto-claim
+ * relayer), never a consumer-facing surface.
+ */
+interface PaymentCommitmentRef {
+  readonly paymentId: string;
+  readonly onchainCommitmentId: string | null;
+  readonly status: PaymentStatus;
+}
+/**
+ * The host-execution + on-chain-evidence channel for Payments (D2 · #564).
+ * SPLIT OFF the public `PaymentsMethods` so an external builder consuming
+ * `@capxul/sdk` directly never sees the custody substrate. Reached only via
+ * `client.payments._internal` (mirrors `client._internal.*`); the signer-side
+ * host (the dev MCP edge / a self-custody integrator) drives it AFTER executing
+ * a UserOp. Every input carries the `OnchainEvidence` brand — never a wire field.
+ */
+interface PaymentsInternalMethods {
+  /** Report on-chain settlement evidence for an instant payment. */
+  markSettled(input: PaymentSettlementInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * B3: report on-chain settlement evidence for a withdraw/cash-out. The
+   * backend binds the userOp to a matching external `Transfer` before settling.
+   */
+  markWithdrawalSettled(input: PaymentSettlementInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * Record the on-chain escrow of a commitment after `createCommitment` returns
+   * its `onchainCommitmentId` (G3 · #546).
+   */
+  markCommitmentCreated(input: CommitmentCreatedInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * Record a settled ORG spend/payroll on the one `payments` ledger
+   * (D3 · #565) — `source:"org"` + `orgId`, read back as a leak-safe Payment.
+   */
+  recordOrgPayment(input: OrgPaymentRecordInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /** Record a recipient-side `claim` after the on-chain claim UserOp settles. */
+  claim(input: CommitmentClaimInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /** Record a creator-side `cancel` reclaiming only the unvested remainder. */
+  cancel(input: CommitmentCancelInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /** Record a pre-claim `redirect` to a new validated recipient. */
+  redirect(input: CommitmentRedirectInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * The on-chain commitment reference the signer-side host needs to build a
+   * claim/cancel/redirect UserOp. `onchainCommitmentId` is internal evidence.
+   */
+  commitmentRef(paymentId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentCommitmentRef | null>>;
+}
+/**
+ * The PUBLIC, Stripe-shaped Payments surface (D2 · #564). Genus verbs only —
+ * `pay` / `list` / `get`. No `userOpHash` / `txHash` / `onchainCommitmentId` /
+ * `chainId` / `safeAddress`. Host-execution + on-chain evidence live on the
+ * `_internal` channel below; an external builder never touches custody substrate.
+ */
+interface PaymentsMethods {
+  pay(input: PaymentsPayInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  payout(input: PaymentsPayoutInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * B3 withdraw / cash-out: send USDX from the user's custody Safe to an
+   * external 0x wallet, minting a kind:4 Withdrawal document. Returns a
+   * leak-safe `Payment` (recipient label is the redacted address).
+   */
+  withdraw(input: PaymentsWithdrawInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  list(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly Payment[]>>;
+  get(paymentId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment | null>>;
+  /**
+   * Host-execution + on-chain-evidence channel — off the public surface
+   * (production-surface-policy.md pattern). Self-custody integrators drive this;
+   * a Stripe-shaped consumer never does.
+   *
+   * @internal-use
+   */
+  readonly _internal: PaymentsInternalMethods;
+}
+interface PaymentDocumentsMethods {
+  verify(documentHash: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDocumentVerification>>;
+  /**
+   * #577: render-on-demand. Loads the owner's stored document by `documentHash`,
+   * re-verifies its EIP-712 hash, and renders it to self-contained HTML using the
+   * verified stored line items. Returns `{documentHash, kind, ok, html}`.
+   */
+  render(documentHash: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDocumentRender>>;
+}
+type PaymentRequestStatus = "draft" | "sent" | "viewed" | "paid" | "expired" | "cancelled";
+interface PaymentRequest {
+  readonly id: string;
+  readonly status: PaymentRequestStatus;
+  readonly amount: PaymentMoney;
+  readonly reference: string;
+  readonly memo: string | null;
+  /** Fixed-amount payment link token (HITL #519: basic, not replay-hardened). */
+  readonly linkToken: string;
+  /** Minimal entitlement (HITL #501): true once paid. */
+  readonly entitlementGranted: boolean;
+  /** The Payment this receivable settled into (set on collect). */
+  readonly settledPaymentId: string | null;
+  /** The receipt document committed for this receivable (set on collect). */
+  readonly receiptDocumentHash: string | null;
+  readonly expiresAt: number | null;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+}
+interface ReconciliationEntry {
+  readonly paymentRequestId: string;
+  readonly reference: string;
+  readonly status: "paid" | "exception";
+  readonly settledPaymentId: string | null;
+  readonly receiptDocumentHash: string | null;
+}
+interface PaymentRequestsCreateInput {
+  readonly amount: PaymentMoney;
+  readonly reference: string;
+  readonly memo?: string;
+  /** Optional expiry (epoch ms). HITL #519: expiry policy is a basic timestamp. */
+  readonly expiresAt?: number;
+}
+interface PaymentRequestsMethods {
+  /** Open a receivable in `draft` with a fixed-amount payment link. */
+  create(input: PaymentRequestsCreateInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentRequest>>;
+  markSent(paymentRequestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentRequest>>;
+  markViewed(paymentRequestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentRequest>>;
+  cancel(paymentRequestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentRequest>>;
+  /**
+   * Collect the receivable (HERMETIC until a live inbound path exists): settle
+   * it into the Payment ledger and mint a receipt linked by `documentHash`.
+   */
+  collect(paymentRequestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentRequest>>;
+  list(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly PaymentRequest[]>>;
+  get(paymentRequestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentRequest | null>>;
+  getByLink(linkToken: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentRequest | null>>;
+  /** Inbound reconciliation: paid / exception status per receivable. */
+  reconcile(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly ReconciliationEntry[]>>;
+}
+type PaymentDraftStatus = "draft" | "simulated" | "approval_pending" | "approved" | "executed" | "cancelled" | "expired";
+/** The leak-safe, model-visible draft/approval (#506). */
+interface PaymentDraft {
+  readonly id: string;
+  readonly status: PaymentDraftStatus;
+  readonly recipient: {
+    readonly kind: string;
+    readonly label: string;
+  };
+  readonly amount: PaymentMoney;
+  readonly documentHash: string | null;
+  /** The canonical-plan binding fingerprint (set at approvals.request). */
+  readonly planHash: string | null;
+  /** The opaque read-model version the draft was simulated against (stale-state). */
+  readonly readModelVersion: string;
+  readonly idempotencyKey: string;
+  readonly policyDecision: "allow" | "deny";
+  readonly expiresAt: number | null;
+  readonly settledPaymentId: string | null;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+}
+interface WorkbenchDraftInput {
+  readonly clientId: string;
+  readonly audience: string;
+  readonly scopes: readonly string[];
+  readonly to: Ref;
+  readonly amount: PaymentMoney;
+  readonly document?: PaymentDocumentEnvelopeV1;
+  readonly idempotencyKey: string;
+  /** Untrusted connector/model suggestion blob (default-deny taint). */
+  readonly tainted?: Record<string, unknown>;
+}
+interface WorkbenchMintResult {
+  readonly approvalToken: string;
+  readonly planHash: string;
+  readonly expiresAt: number;
+}
+interface WorkbenchExecuteInput {
+  readonly draftId: string;
+  readonly clientId: string;
+  readonly approvalToken: string;
+  readonly readModelVersion: string;
+  readonly userOpHash: string;
+  readonly txHash: string;
+}
+/**
+ * The decomposed workbench (G6 · #549). The edge PROPOSES (draft → simulate →
+ * request); the BACKEND mints the one-time plan-bound token via the human's
+ * browser (`mint`); `execute` consumes it. `mint` is the human step — the edge
+ * normally only reaches `request`, then hands the human a browser URL.
+ */
+interface WorkbenchMethods {
+  draft(input: WorkbenchDraftInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDraft>>;
+  simulate(draftId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDraft>>;
+  requestApproval(draftId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDraft>>;
+  /**
+   * THE HUMAN STEP: mint the one-time approval token (browser/approval app).
+   * F2 (#549): the backend gates minting on a human-origin `capability` the
+   * agent/edge does NOT possess (`CAPXUL_APPROVAL_CAPABILITY`); only the
+   * apps/approve browser app passes it. The edge/SDK lane cannot self-approve.
+   */
+  mint(draftId: string, capability: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<WorkbenchMintResult>>;
+  execute(input: WorkbenchExecuteInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  status(draftId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDraft | null>>;
+  cancel(draftId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDraft>>;
+}
+interface FinancialOpsMethods {
+  readonly me: MeMethods;
+  readonly handles: HandlesMethods;
+  readonly payees: PayeesMethods;
+  readonly destinations: DestinationsMethods;
+  readonly payments: PaymentsMethods;
+  readonly paymentDocuments: PaymentDocumentsMethods;
+  /** Receivables surface (G5 · #548). */
+  readonly paymentRequests: PaymentRequestsMethods;
+  /** Decomposed workbench + trust substrate (G6 · #549). */
+  readonly workbench: WorkbenchMethods;
+}
+//#endregion
+//#region src/client/actor-scope.d.ts
+type ActorScopeRef = {
+  readonly kind: "account";
+} | {
+  readonly kind: "org";
+  readonly orgId: string;
+};
+interface ActorProfile {
+  readonly actor: ActorScopeRef;
+  readonly displayName: string | null;
+  readonly email?: string;
+  readonly handle?: string;
+}
+interface AddressBookEntry {
+  readonly id: string;
+  readonly ref: Ref;
+  readonly label: string;
+  readonly relationship: readonly ("paid" | "paidBy" | "requested" | "member" | "employee")[];
+  readonly hidden: boolean;
+}
+interface AddressBookAddInput {
+  readonly ref: Ref;
+  readonly label?: string;
+}
+interface AddressBookLabelInput {
+  readonly entryId: string;
+  readonly label: string;
+}
+interface AddressBookMethods {
+  list(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly AddressBookEntry[]>>;
+  get(entryId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<AddressBookEntry | null>>;
+  add(input: AddressBookAddInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<AddressBookEntry>>;
+  hide(entryId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<AddressBookEntry>>;
+  unhide(entryId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<AddressBookEntry>>;
+  label(input: AddressBookLabelInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<AddressBookEntry>>;
+}
+interface ActorRequest {
+  readonly id: string;
+  readonly payer?: Ref;
+  readonly amount: PaymentMoney;
+  readonly reference: string;
+  readonly status: "draft" | "sent" | "viewed" | "pending_settlement" | "paid" | "declined" | "cancelled" | "expired";
+  readonly expiresAt: number | null;
+}
+interface ActorRequestIssueInput {
+  readonly payer: Ref;
+  readonly amount: PaymentMoney;
+  readonly reference: string;
+  readonly memo?: string;
+  readonly expiresAt?: number;
+}
+interface ActorRequestsMethods {
+  issue(input: ActorRequestIssueInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<ActorRequest>>;
+  list(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly ActorRequest[]>>;
+  get(requestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<ActorRequest | null>>;
+  cancel(requestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<ActorRequest>>;
+  reconcile(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly ReconciliationEntry[]>>;
+}
+interface InboxItem {
+  readonly id: string;
+  readonly issuer: Ref;
+  readonly amount: PaymentMoney;
+  readonly reference: string;
+  readonly status: "open" | "approved" | "declined" | "paid" | "cancelled" | "expired";
+}
+interface InboxApproveInput {
+  readonly requestId: string;
+  readonly timing?: PaymentTiming;
+}
+interface InboxMethods {
+  list(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly InboxItem[]>>;
+  approve(input: InboxApproveInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  decline(requestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<InboxItem>>;
+}
+interface InsightsSummary {
+  readonly pending: {
+    readonly count: number;
+    readonly total: PaymentMoney;
+  };
+  readonly paidThisMonth: {
+    readonly count: number;
+    readonly total: PaymentMoney;
+  };
+  readonly drafts: {
+    readonly count: number;
+  };
+  readonly reconciliation: {
+    readonly open: number;
+    readonly exceptions: number;
+  };
+}
+interface InsightsMethods {
+  summary(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<InsightsSummary>>;
+  history(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly Payment[]>>;
+}
+interface ActorProfileMethods {
+  get(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<ActorProfile>>;
+  depositInstructions(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<DepositInstructions>>;
+}
+interface ActorRelationshipMethods {
+  readonly addressBook: AddressBookMethods;
+  readonly requests: ActorRequestsMethods;
+  readonly inbox: InboxMethods;
+  readonly insights: InsightsMethods;
+  readonly profile: ActorProfileMethods;
+}
+//#endregion
+//#region src/client/account.d.ts
+type AccountStatus = {
+  readonly status: "notAuthenticated";
+} | {
+  readonly status: "accountRequired";
+  readonly requirement: AccountRequirement;
+  readonly chainId: number;
+} | {
+  readonly status: "accountProviderReady";
+  readonly requirement: AccountRequirement;
+  readonly chainId: number;
+  readonly source: AccountProviderSource;
+  readonly signerAddress: Address;
+} | {
+  readonly status: "accountPrepared";
+  readonly requirement: AccountRequirement;
+  readonly account: SmartAccount$1;
+  readonly deployment: {
+    readonly status: "counterfactual";
+  };
+} | {
+  readonly status: "accountReady";
+  readonly requirement: AccountRequirement;
+  readonly account: SmartAccount$1 | null;
+  readonly deployment: {
+    readonly status: "counterfactual";
+  } | {
+    readonly status: "deployed";
+    readonly deployedAt: SmartAccount$1["deployedAt"];
+  };
+};
+/**
+ * Public consumer-facing surface (issue #159 · AC1+AC3). Exactly two
+ * methods. `provision` and `deploySafe` are intentionally NOT here —
+ * they are advanced/testing-only and will live on
+ * `client._internal.account` when sibling issue #161 lands. Per
+ * `docs/canon/rules/public-surface.md`, the narrowing is enforced at
+ * both the type level (the `keyof AccountMethods` extract is exactly
+ * `"getStatus" | "ensureReady"`) and at runtime (the bundle returned
+ * here has those two own-keys and nothing else).
+ *
+ * Per `docs/canon/conventions/flow-internal-substrate.md`, the
+ * `AccountStatus` discriminant — including the variants this slice can
+ * only reach via `getStatus` (e.g. `accountPrepared`) — is the durable
+ * shape consumers depend on. Sibling #161 will extend `ensureReady` to
+ * advance the ladder past `accountProviderReady` and from
+ * `accountPrepared` to `accountReady(deployed)`; until then, the type
+ * surface is stable and the runtime fixed-point is documented.
+ */
+interface AccountMethods extends ActorRelationshipMethods {
+  /**
+   * Post-auth account setup lifecycle — domain vocabulary over the internal
+   * readiness ladder + provisioning lane (#356).
+   */
+  getLifecycle(): Promise<CapxulResult<AccountLifecycle>>;
+  /** Resume setup after `failed` and return the updated lifecycle snapshot. */
+  retrySetup(): Promise<CapxulResult<AccountLifecycle>>;
+  /**
+   * Internal advanced surface (#161 · AC1). Reserved for the rebuild's
+   * own `ensureReady` upward transitions and for testing harnesses;
+   * consumers MUST NOT depend on this in production. Tagged
+   * `@internal-use` per `.claude/rules/flow-internal-substrate.md`.
+   *
+   * @internal-use
+   */
+  readonly _internal: AccountInternalSurface;
+}
+/**
+ * Internal `provision` + `deploySafe` arms exposed at
+ * `client._internal.account` (#161). Each returns `Promise<CapxulResult<T>>`
+ * with the same error catalog the public methods use.
+ *
+ * @internal-use
+ */
+interface AccountInternalSurface {
+  provision(): Promise<CapxulResult<SmartAccount$1>>;
+  deploySafe(): Promise<CapxulResult<SmartAccount$1>>;
+  /** @internal-use Substrate readiness ladder — tests and e2e only. */
+  getStatus(): Promise<CapxulResult<AccountStatus>>;
+  /** @internal-use Lane runner — tests and e2e only. */
+  ensureReady(): Promise<CapxulResult<AccountStatus>>;
+  /** @internal-use Provisioning lane phase — tests and e2e only. */
+  getProvisioningPhase(): Promise<CapxulResult<ProvisioningPhase>>;
+  /** @internal-use Lane retry — tests and e2e only. */
+  retryProvisioning(): Promise<CapxulResult<ProvisioningPhase>>;
+}
+//#endregion
+//#region src/client/accounts.d.ts
+interface AccountsMethods {
+  read(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Account>>;
+}
+/**
+ * Faucet surface (dev-only). Deliberately OFF the public `AccountsMethods`;
+ * reachable only via `client._internal.accounts` (production-surface-policy.md).
+ * The reference CLI uses it behind a test-env gate — consumers never see `fund`.
+ */
+interface AccountsFaucetMethods {
+  fund(amount: Money, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<{
+    readonly txHash: string;
+  }>>;
+}
+//#endregion
+//#region src/client/sub-accounts.d.ts
+interface SubAccountsMethods {
+  create(accountId: AccountId, input: {
+    readonly name: string;
+  }, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<SubAccount>>;
+  get(subAccountId: SubAccountId, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<SubAccount | null>>;
+  list(accountId: AccountId, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly SubAccount[]>>;
+  rename(subAccountId: SubAccountId, name: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<SubAccount>>;
+  delete(subAccountId: SubAccountId, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<void>>;
+  transfer(input: TransferInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<TransferResult>>;
+}
+//#endregion
+//#region src/client/org-spend-gate.d.ts
+/**
+ * The role's allowed recipients. The address form backs the S4 `spend` path
+ * (recipient is a resolved `Address`); the string form backs the G4
+ * `spendViaPayments` / `batchPayroll` path, whose recipient is a VALIDATED REF
+ * (handle/email/payee/org) compared in the same ref space as the role's set.
+ * Comparison is case-insensitive over the raw string value either way.
+ */
+type SpendGateRecipients = "anyone" | readonly (Address | string)[];
+type SpendGateSubAccountScope = {
+  readonly scope: "all";
+} | {
+  readonly scope: "only";
+  readonly subAccountIds: readonly SubAccountId[];
+};
+//#endregion
+//#region src/ports/org.d.ts
+/**
+ * The minimal `{from, to, amount}` spend shape the authority read keys off
+ * (D3 #565). The legacy address-keyed `OrgSpendInput`/`org.spend` lane was
+ * hard-removed when `orgSpends` folded into the one `payments` ledger; the
+ * leak-safe ref-based lane (`spendViaPayments`/`batchPayroll`) constructs this
+ * internally and enforces the real validated recipient on the gate.
+ */
+type OrgSpendShape = {
+  readonly from: SubAccountId;
+  readonly to: Address;
+  readonly amount: Money;
+};
+type CreateOrgPortInput = {
+  readonly input: CreateOrgInput;
+};
+type ReadOrgTreasuryInput = {
+  readonly orgId: OrgId;
+};
+type ListOrgsInput = Record<never, never>;
+type ListOrgRolesInput = {
+  readonly orgId: OrgId;
+};
+type ListOrgMembersInput = {
+  readonly orgId: OrgId;
+};
+type InviteOrgMemberInput = {
+  readonly orgId: OrgId;
+  readonly input: InviteMemberInput;
+};
+type ResendOrgInviteTokenInput = {
+  readonly orgId: OrgId;
+  readonly email: string;
+};
+type DetectPendingOrgInvitationsInput = Record<never, never>;
+type DetectPendingOrgInvitationsResult$1 = {
+  readonly matched: readonly OrgId[];
+};
+type DeployOrgRolesInput = {
+  readonly orgId: OrgId;
+};
+type OrgRolesDeploymentResult = {
+  readonly orgId: OrgId;
+  readonly roles: readonly RoleView[];
+};
+type GrantOrgRoleInput = {
+  readonly orgId: OrgId;
+  readonly input: AssignRoleInput;
+};
+type RevokeOrgRoleInput = {
+  readonly orgId: OrgId;
+  readonly input: RemoveMemberInput;
+};
+type OrgSpendAuthority = {
+  readonly activeMember: boolean;
+  readonly subAccountBalanceRaw: string;
+  readonly recipients: SpendGateRecipients;
+  readonly subAccounts: SpendGateSubAccountScope;
+  readonly perTxCapRaw?: string | null;
+  readonly perDayCapRaw?: string | null;
+  readonly spentTodayRaw?: string | null;
+  readonly role?: string;
+};
+type ReadOrgSpendAuthorityInput = {
+  readonly orgId: OrgId;
+  readonly input: OrgSpendShape;
+  readonly amountRaw: string;
+};
+declare const OrgError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "OrgError";
+} & Readonly<A>;
+declare class OrgError extends OrgError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+/**
+ * Live org seam. `createOrg` runs the SDK-orchestrated deploy (D10) and returns
+ * the created `OrgView` (its treasury is the real M2 `Account` over the Org
+ * Safe — $0 at creation, D3). `readTreasury` pulls the org's Account via RPC
+ * `balanceOf` (D3). `listOrgs` lists the orgs the authenticated user belongs to.
+ */
+interface OrgPort {
+  createOrg(input: CreateOrgPortInput): Effect.Effect<OrgView, OrgError, never>;
+  readTreasury(input: ReadOrgTreasuryInput): Effect.Effect<Account, OrgError, never>;
+  listOrgs(input: ListOrgsInput): Effect.Effect<readonly OrgView[], OrgError, never>;
+  listRoles(input: ListOrgRolesInput): Effect.Effect<readonly RoleView[], OrgError, never>;
+  listMembers(input: ListOrgMembersInput): Effect.Effect<readonly MemberView[], OrgError, never>;
+  pendingMembers?(input: ListOrgMembersInput): Effect.Effect<readonly MemberView[], OrgError, never>;
+  inviteMember(input: InviteOrgMemberInput): Effect.Effect<MemberView, OrgError, never>;
+  resendInviteToken?(input: ResendOrgInviteTokenInput): Effect.Effect<MemberView, OrgError, never>;
+  detectAndAcceptPendingInvitations(input: DetectPendingOrgInvitationsInput): Effect.Effect<DetectPendingOrgInvitationsResult$1, OrgError, never>;
+}
+interface OrgRolesDeploymentPort {
+  deployRoles(input: DeployOrgRolesInput): Effect.Effect<OrgRolesDeploymentResult, OrgError, never>;
+  grantRole(input: GrantOrgRoleInput): Effect.Effect<MemberView, OrgError, never>;
+  revokeRole(input: RevokeOrgRoleInput): Effect.Effect<void, OrgError, never>;
+}
+type SubmitOrgSpendViaPaymentsInput = {
+  readonly orgId: OrgId;
+  readonly input: OrgSpendViaPaymentsInput;
+  readonly amountRaw: string;
+  readonly authority: OrgSpendAuthority;
+};
+type SubmitOrgBatchPayrollInput = {
+  readonly orgId: OrgId;
+  readonly from: OrgSpendViaPaymentsInput["from"];
+  readonly runs: readonly {
+    readonly run: OrgPayrollRun;
+    readonly amountRaw: string;
+  }[];
+  readonly authorities: readonly OrgSpendAuthority[];
+};
+interface OrgSpendPort {
+  readSpendAuthority(input: ReadOrgSpendAuthorityInput): Effect.Effect<OrgSpendAuthority, OrgError, never>;
+  /**
+   * Leak-safe org spend (G4 · #547; D3 #565 — the one ledger of record): execute
+   * the spend through the payments engine (Roles modifier → CapxulPayments),
+   * write a real `payments` row (`source:"org"`) and read it back as a `Payment`
+   * — the wire carries no `txHash` / Safe / userOp internals. Optional so a
+   * hermetic adapter without a payments-submit lane still compiles; absent ⇒ the
+   * program falls back to a deterministic hermetic `Payment`.
+   */
+  submitSpendViaPayments?(input: SubmitOrgSpendViaPaymentsInput): Effect.Effect<Payment, OrgError, never>;
+  /** Leak-safe org payroll batch (G4 · #547): one MultiSend, one Payment per run. */
+  submitBatchPayroll?(input: SubmitOrgBatchPayrollInput): Effect.Effect<readonly Payment[], OrgError, never>;
+}
+//#endregion
+//#region src/client/org.d.ts
+/**
+ * A member's lifecycle status (D9 — unified `Member` with status
+ * `pending | active | revoked | expired`). `pending` = invited (incl. a
+ * non-user emailed into existence) but not yet a provisioned member with an
+ * on-chain grant; `active` = on-chain role granted; `revoked` = offboarded
+ * (on-chain REVOKE fired); `expired` = pending invitation timed out.
+ */
+type MemberStatus = "pending" | "pending_safe" | "pending_grant" | "active" | "revoked" | "expired";
+/**
+ * One Org you belong to (canon §C1 "Org list" — name, role, balance).
+ * `role` is the member's role label within THIS org. `treasury` is the M2
+ * `Account` over the Org Safe (D3). `handle` is the globally-unique,
+ * normalized org handle (D10a). Pure record of brand-typed fields — not a
+ * brand.
+ */
+type OrgView = {
+  readonly id: OrgId;
+  readonly name: string;
+  readonly handle: string;
+  readonly safeAddress: Address; /** The viewing member's own role label within this org. */
+  readonly role: string; /** The Org treasury — the real M2 Account over the Org Safe (D3). */
+  readonly treasury: Account;
+};
+/**
+ * One member of an Org (canon §C1 "Members" — name/email, role, status; D7/D8).
+ * `personalSafeAddress` is the member-identity key (D7 — Safe-as-identity); it
+ * is `null` while the member is still `pending` (emailed into existence but not
+ * yet provisioned a personal Safe). `email` is the universal entry point (D8).
+ */
+type MemberView = {
+  readonly orgId: OrgId;
+  readonly email: Email;
+  readonly name: string | null; /** Member-identity key (D7). `null` until the invitee provisions a Safe. */
+  readonly personalSafeAddress: Address | null; /** The member's role label (maps deterministically to the on-chain `roleKey`, D9). */
+  readonly role: string;
+  readonly roleKey: RoleKey | null;
+  readonly status: MemberStatus;
+  readonly grantTxHash: string | null;
+  readonly revokeTxHash: string | null;
+};
+/**
+ * A role's on-chain Level-1 spend cap (D4/D5 — physically enforced via Zodiac
+ * Roles + Allowance). `perTx` / `perDay` are `Money`; `toRecipients` scopes the
+ * allowed recipient set. Omitting a field means "unbounded on that axis"
+ * (the Owner role).
+ */
+type RoleSpendCap = {
+  readonly perTx?: Money;
+  readonly perDay?: Money;
+  readonly toRecipients?: "anyone" | readonly Address[];
+};
+/**
+ * The Capxul-owned Role DSL definition (D4). `label` becomes the sticky
+ * bytes32 `roleKey` on-chain. `spend` compiles to Level-1 on-chain Zodiac
+ * conditions; `subAccounts` + `canManage*` compile to Level-2 off-chain Convex
+ * guards (D5).
+ */
+type RoleDefinition = {
+  readonly label: string;
+  readonly spend?: RoleSpendCap;
+  readonly subAccounts?: {
+    readonly scope: "all" | readonly SubAccountId[];
+  };
+  readonly canManageMembers?: boolean;
+  readonly canManageRoles?: boolean;
+};
+/**
+ * One role seeded on an Org (canon §C1 "Roles" — label + caps; D4/D6).
+ * `roleKey` is the on-chain bytes32 role key derived from the label. `definition`
+ * is the full Role DSL entry.
+ */
+type RoleView = {
+  readonly orgId: OrgId;
+  readonly label: string;
+  readonly roleKey: RoleKey;
+  readonly definition: RoleDefinition;
+};
+/** Built-in role templates that seed a new Org at creation (D6). */
+type OrgTemplate = "Solo" | "Startup" | "Custom";
+/**
+ * Input to `capxul.createOrg` (S1, D10a, D14). `name` is the display name;
+ * `handle` is the globally-unique normalized handle (`^[a-z0-9-]{3,32}$`, D10a);
+ * `template` seeds the initial role set (D6); `country` is stored unvalidated
+ * (D14 — KYB deferred). For `template: "Custom"`, `roles` carries the authored
+ * `RoleDefinition[]`.
+ */
+type CreateOrgInput = {
+  readonly name: string;
+  readonly handle: string;
+  readonly template: OrgTemplate;
+  readonly country?: string;
+  readonly roles?: readonly RoleDefinition[];
+};
+/**
+ * Input to `org(orgId).invite` (S3, D8). Email is the universal entry point —
+ * inviting an address that is not yet a Capxul user auto-creates a `pending`
+ * membership that resolves on sign-in (the virality loop). `role` names the
+ * role label the invitee is granted on accept.
+ */
+type InviteMemberInput = {
+  readonly email: string;
+  readonly role: string;
+};
+type ResendInviteTokenInput = {
+  readonly email: string;
+};
+/**
+ * Input to `org(orgId).removeMember` (S3, D8). Keyed on the member's personal
+ * Safe address (D7 — Safe-as-identity). Drives the on-chain REVOKE + Convex
+ * mirror.
+ */
+type RemoveMemberInput = {
+  readonly memberSafeAddress: Address;
+};
+/**
+ * Input to `org(orgId).assignRole` (S3, D7/D9). Keyed on the member's personal
+ * Safe address (D7). Drives the on-chain GRANT + Convex mirror; the `role`
+ * label maps deterministically to the on-chain `roleKey`.
+ */
+type AssignRoleInput = {
+  readonly memberSafeAddress: Address;
+  readonly role: string;
+};
+/**
+ * Input to `org(orgId).spendViaPayments` (G4 · #547). The LEAK-SAFE org spend:
+ * delegates `org.spend` to the payments engine WITH the member's org role
+ * authority and returns a `Payment`, not a `txHash`. `to` is a VALIDATED
+ * recipient ref (handle / email / payee id / org handle) — never a raw
+ * `Address` (the legacy address-keyed `org.spend` lane was hard-removed in D3
+ * #565 when `orgSpends` was folded into the one `payments` ledger).
+ * `from` is the Level-2 sub-account envelope the spend draws from (D5).
+ */
+type OrgSpendViaPaymentsInput = {
+  readonly from: SubAccountId; /** Validated recipient ref (handle/email/payee/org) — never a raw address. */
+  readonly to: Ref;
+  readonly amount: Money; /** Full EIP-712 payment document; hashed + stored, committed on-chain. */
+  readonly document?: PaymentDocumentEnvelopeV1;
+  readonly timing?: PaymentTiming;
+  readonly paymentType?: PaymentType;
+};
+/**
+ * One run in an `org(orgId).batchPayroll` batch (G4 · #547): a validated
+ * recipient, an amount, and an optional payslip document. Each run is gated
+ * independently against the role's per-tx / per-day / recipient conditions.
+ */
+type OrgPayrollRun = {
+  /** Validated recipient ref (handle/email/payee/org) — never a raw address. */readonly to: Ref;
+  readonly amount: Money;
+  readonly timing?: PaymentTiming; /** The payslip — an EIP-712 payment document, committed by `documentHash`. */
+  readonly payslip?: PaymentDocumentEnvelopeV1;
+};
+/**
+ * Input to `org(orgId).batchPayroll` (G4 · #547). Pays N employees in one
+ * MultiSend through the Roles modifier; each carries a payslip and settles as
+ * `paymentType = payroll`. Every run is gated; an over-cap run REJECTS the
+ * whole batch (no partial treasury drain). Returns one leak-safe `Payment` per
+ * run.
+ */
+type OrgBatchPayrollInput = {
+  readonly from: SubAccountId;
+  readonly runs: readonly OrgPayrollRun[];
+};
+type DetectPendingOrgInvitationsResult = {
+  readonly matched: readonly OrgId[];
+};
+/**
+ * Entity-scoped Org method bundle, returned by `capxul.org(orgId)`. Every
+ * method names the entity implicitly via the closed-over `orgId` (D13 — no
+ * stateful active context). `treasury()` returns the real M2 `Account` over
+ * the Org Safe (D3).
+ */
+interface PayrollRosterLine {
+  readonly id: string;
+  readonly employee: Ref;
+  readonly amount: Money;
+  readonly timing: PaymentTiming;
+  readonly status: "active" | "paused" | "ended";
+}
+interface PayrollPayslipTemplate {
+  readonly title: string;
+  readonly memo?: string;
+}
+interface PayrollRosterAddInput {
+  readonly employee: Ref;
+  readonly amount: Money;
+  readonly timing: PaymentTiming;
+  readonly payslipTemplate?: PaymentDocumentEnvelopeV1 | PayrollPayslipTemplate;
+}
+interface PayrollRunInput {
+  readonly from: SubAccountId;
+  readonly period: string;
+}
+interface PayrollMethods {
+  readonly roster: {
+    add(input: PayrollRosterAddInput, options?: {
+      readonly signal?: AbortSignal;
+    }): Promise<CapxulResult<PayrollRosterLine>>;
+    list(options?: {
+      readonly signal?: AbortSignal;
+    }): Promise<CapxulResult<readonly PayrollRosterLine[]>>;
+    update(rosterLineId: string, input: Partial<PayrollRosterAddInput>, options?: {
+      readonly signal?: AbortSignal;
+    }): Promise<CapxulResult<PayrollRosterLine>>;
+    remove(rosterLineId: string, options?: {
+      readonly signal?: AbortSignal;
+    }): Promise<CapxulResult<PayrollRosterLine>>;
+  };
+  run(input: PayrollRunInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly Payment[]>>;
+}
+interface OrgScopedMethods extends ActorRelationshipMethods {
+  /** The Org treasury — the real M2 Account over the Org Safe (D3). */
+  treasury(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Account>>;
+  members(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly MemberView[]>>;
+  roles(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly RoleView[]>>;
+  deployRoles(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly RoleView[]>>;
+  invite(input: InviteMemberInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<MemberView>>;
+  pendingMembers(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly MemberView[]>>;
+  readonly inviteToken: {
+    resend(input: ResendInviteTokenInput, options?: {
+      readonly signal?: AbortSignal;
+    }): Promise<CapxulResult<MemberView>>;
+  };
+  removeMember(input: RemoveMemberInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<void>>;
+  assignRole(input: AssignRoleInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<MemberView>>;
+  /**
+   * Leak-safe org spend (G4 · #547; D3 #565 — the one ledger of record): execute
+   * the spend through the payments engine with the member's org role authority
+   * and return a `Payment` (no `to: Address`, no `txHash`, no Safe / userOp
+   * internals). Writes a real `payments` row (`source:"org"`).
+   */
+  spendViaPayments(input: OrgSpendViaPaymentsInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * Org payroll batch (G4 · #547): pay N employees in one MultiSend through the
+   * Roles modifier, each with a payslip. Every run is gated; an over-cap run
+   * rejects the whole batch. Returns one leak-safe `Payment` per run.
+   */
+  batchPayroll(input: OrgBatchPayrollInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly Payment[]>>;
+  readonly payroll: PayrollMethods;
+}
+type OrgsMethod = {
+  (options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly OrgView[]>>;
+  detectAndAcceptPendingInvitations(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<DetectPendingOrgInvitationsResult>>;
+};
+/**
+ * Top-level Org method bundle, exposed at `client.org` / `client.orgs` /
+ * `client.createOrg`. `org(orgId)` resolves the entity-scoped bundle (D13).
+ */
+interface OrgMethods {
+  createOrg(input: CreateOrgInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<OrgView>>;
+  readonly orgs: OrgsMethod;
+  /** Resolve the entity-scoped bundle for a specific Org (D13). */
+  org(orgId: OrgId): OrgScopedMethods;
+}
+//#endregion
+//#region src/client/onboarding.d.ts
+/**
+ * Input to `capxul.onboarding.completePersonal`. `displayName` + `country`
+ * (ISO-3166, persisted to `identities.country`) are required; `withdrawalAddress`
+ * is the OPTIONAL cash-out destination — a `0x`-prefixed 20-byte address string
+ * (the one allowed raw-0x class), validated + normalized at the boundary.
+ */
+type CompletePersonalOnboardingInput = {
+  readonly displayName: string;
+  readonly country: string;
+  readonly withdrawalAddress?: string;
+};
+/**
+ * Input to `capxul.onboarding.completeOrganization`. `handle` is the org slug
+ * (`createOrg` requires it); `ownerDisplayName` is the founder's personal
+ * identity profile.
+ */
+type CompleteOrganizationOnboardingInput = {
+  readonly organizationName: string;
+  readonly handle: string;
+  readonly country: string;
+  readonly ownerDisplayName: string;
+};
+/** Result of `completePersonal` — the post-onboarding readiness snapshot. */
+type CompletePersonalOnboardingResult = {
+  readonly lifecycle: AccountLifecycle;
+};
+/** Result of `completeOrganization` — the created org + readiness snapshot. */
+type CompleteOrganizationOnboardingResult = {
+  readonly org: OrgView;
+  readonly lifecycle: AccountLifecycle;
+};
+/**
+ * Onboarding method bundle, exposed at `client.onboarding`. Exactly two verbs;
+ * the choreography lives in `flows/onboarding.ts`.
+ */
+interface OnboardingMethods {
+  completePersonal(input: CompletePersonalOnboardingInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<CompletePersonalOnboardingResult>>;
+  completeOrganization(input: CompleteOrganizationOnboardingInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<CompleteOrganizationOnboardingResult>>;
+}
+//#endregion
+//#region src/client/create-capxul-client.d.ts
+interface CapxulClient {
+  readonly auth: AuthMethods;
+  readonly smartAccount: SmartAccountMethods;
+  readonly identity: IdentityMethods;
+  /**
+   * Consumer-facing account readiness surface (issue #159 · AC1+AC3).
+   * Exactly `getStatus` + `ensureReady`; the `_internal.account`
+   * namespace with `provision` + `deploySafe` lands in sibling #161.
+   */
+  readonly account: AccountMethods;
+  /**
+   * Consumer-facing logical Account money read (M2 Slice S1a · #265).
+   * Returns `{ balance, available }` as `Money` — never wei or token units.
+   */
+  readonly accounts: AccountsMethods;
+  readonly me: MeMethods;
+  readonly handles: HandlesMethods;
+  readonly payees: PayeesMethods;
+  readonly destinations: DestinationsMethods;
+  /**
+   * Direct Payments surface (G2 · #545). `pay` records a validated-recipient
+   * payment; `list`/`get` read the ledger; `markSettled` is the host-execution
+   * callback. The MCP `draft → simulate → approve → execute` workbench is G6.
+   */
+  readonly payments: PaymentsMethods;
+  /** Payment document verification (G2 · #545): re-derive the EIP-712 hash. */
+  readonly paymentDocuments: PaymentDocumentsMethods;
+  /**
+   * Receivables surface (G5 · #548). `create` opens a `PaymentRequest` with a
+   * fixed-amount link; `markSent`/`markViewed`/`cancel` move the funnel;
+   * `collect` settles the receivable into the Payment ledger + mints a receipt
+   * linked by `documentHash`; `list`/`get`/`getByLink`/`reconcile` read it.
+   */
+  readonly paymentRequests: PaymentRequestsMethods;
+  /**
+   * Decomposed workbench + trust substrate (G6 · #549). The MCP
+   * `draft → simulate → approvals.request → execute` workbench: the edge
+   * PROPOSES, the BACKEND mints a one-time plan-bound approval token via the
+   * human's browser (#510), and `execute` consumes it. Taint / idempotency /
+   * stale-state / scope guards are enforced backend-side.
+   */
+  readonly workbench: WorkbenchMethods;
+  /** Sub-account lifecycle (M2 Slice S2a · #267). Transfer lands in S2b. */
+  readonly subAccounts: SubAccountsMethods;
+  /**
+   * Organization domain surface (canon `org-domain-model.md` §C2/§C3, D13).
+   * `createOrg(input)` creates an Org; `orgs()` lists the Orgs you belong to;
+   * `org(orgId)` resolves the entity-scoped bundle (treasury / members / roles
+   * / invite / removeMember / assignRole / spend). Explicit entity scoping —
+   * NO stateful active context (D13). RED until the S1→S4 slices fill it.
+   */
+  readonly createOrg: OrgMethods["createOrg"];
+  readonly orgs: OrgMethods["orgs"];
+  readonly org: OrgMethods["org"];
+  /**
+   * Onboarding domain surface (D-ONBOARD · #669). `completePersonal` /
+   * `completeOrganization` bridge the post-OTP auth → provision bookends:
+   * persist the first identity profile (+ org), then trigger the existing
+   * provisioning lane. Pre-scope — the on-ramp before the D-RELATE actor
+   * scopes. `lifecycle.status` is the single routing source of truth.
+   */
+  readonly onboarding: OnboardingMethods;
+  /**
+   * Internal observation namespace. Consumers MUST NOT drive the actor
+   * directly — use the method bundles instead.
+   *
+   * @internal-use
+   */
+  readonly _internal: {
+    readonly authActor: AuthFlowObserver;
+    /**
+     * Resolved bootstrap for this client instance (chain, auth URLs, etc.).
+     * Off the public surface per production-surface-policy.md (#31).
+     */
+    readonly bootstrap: BootstrapResolution;
+    /**
+     * Dev-only faucet bundle (production-surface-policy.md). `fund` lives here,
+     * NOT on the public `client.accounts` surface.
+     */
+    readonly accounts: AccountsFaucetMethods; /** Telemetry port for error reporting. Used by React hooks to report errors before throwing. */
+    readonly telemetry?: TelemetryPort;
+    readonly close?: () => Promise<void>;
+  };
+}
+interface CreateCapxulClientInput {
+  /**
+   * The 13-port `FlowPorts` bundle. The factory narrows this to the
+   * 3-port AuthFlow subset (`authClient`, `clock`, `telemetry`) for
+   * the flow internally, and uses additional ports (`identity`,
+   * `smartAccount`) for the method bundles.
+   */
+  readonly ports: FlowPorts;
+  /**
+   * Bootstrap resolution for this client instance. The factory closes over
+   * `bootstrap.chainId` internally; consumers do not pass a standalone
+   * chainId and no method boundary accepts one.
+   */
+  readonly bootstrap: BootstrapResolution;
+  /**
+   * Optional AuthCachePort. When omitted, `detectAuthCacheAdapter()` selects
+   * the appropriate per-environment adapter (Browser/FileSystem/InMemory).
+   */
+  readonly authCache?: AuthCachePort;
+  /**
+   * Optional AbortSignal reserved for callers that coordinate client lifetime.
+   */
+  readonly signal?: AbortSignal;
+  /**
+   * OTP TTL window in ms. Default 300_000 (5 min).
+   */
+  readonly otpTtlMs?: number;
+  /**
+   * Optional per-call timeout for invoked auth requests.
+   */
+  readonly invokeTimeoutMs?: number;
+  /**
+   * Init-time account readiness target (issue #159 · AC4). The factory
+   * closes over this so `client.account.{getStatus,ensureReady}` don't
+   * need to take a per-call requirement arg. REQUIRED — there is no
+   * hidden default. Consumers building flows that never need a smart
+   * account pass `"none"`; flows that want a counterfactual deposit
+   * address pass `"counterfactual"`; flows that need an on-chain Safe
+   * pass `"deployed"` (deploy path lands in sibling #161).
+   */
+  readonly requirement: AccountRequirement;
+  /**
+   * Consumer-held signer (backend-orchestrated-deploy.md). Required for
+   * `requirement: "deployed"` flows: `provision` reads `getAddress()` and the
+   * deploy path signs the backend's SafeOp digest via `signUserOpHash()`. The
+   * backend orchestrates build + gas + paymaster + submit — the client never
+   * holds an RPC URL, a gas-sponsorship policy, or a bundler.
+   */
+  readonly signer?: CapxulSigner;
+  /**
+   * Optional live Org-deploy lane (canon D10 SDK-orchestrated Org Safe deploy +
+   * D3 RPC treasury). When supplied, `client.createOrg` / `org(id).treasury`
+   * run the live path (real deploy + on-chain balance); when omitted, the
+   * hermetic `$0` path runs (a fresh Org has no on-chain funds). The adapter
+   * that CONSTRUCTS this port (deployer key + RPC + authenticated Convex seam)
+   * is wired by the CLI deploy-stack; the factory only threads it through.
+   */
+  readonly orgDeploymentPort?: OrgPort;
+  /** Locked D6 data-port name. Prefer over `orgDeploymentPort` in new code. */
+  readonly orgPort?: OrgPort;
+  /** S2 deploy/grant/revoke port. S2 uses deploy; S3 adds grant/revoke. */
+  readonly orgRolesDeploymentPort?: OrgRolesDeploymentPort;
+  /** S4 treasury-spend authority + submit port. */
+  readonly orgSpendPort?: OrgSpendPort;
+  readonly orgDeploymentConfig?: SafeDeploymentConfig;
+}
+//#endregion
+//#region src/adapters/auth-cache/BrowserAuthCacheAdapter.d.ts
+interface BrowserStorageShape {
+  getItem(key: string): string | null;
+  setItem(key: string, value: string): void;
+  removeItem(key: string): void;
+}
+//#endregion
+//#region src/dev-signer.d.ts
+interface DevPrivateKeySignerInput {
+  /** Dev-only derivation seed (e.g. `VITE_CAPXUL_DEV_SIGNER_SEED`). Throwaway keys only. */
+  readonly seed: string;
+  /** Explicit email — skips the auth-cache lookup (tests, node harnesses). */
+  readonly email?: string;
+  /** Storage holding the cached session. Defaults to browser `localStorage`. */
+  readonly storage?: BrowserStorageShape;
+}
+/** Deterministic dev private key for an email under a seed. Exported for probes. */
+declare function deriveDevPrivateKey(seed: string, email: string): Hex;
+/**
+ * Browser-safe dev signer. Lazy: the email (and so the key) is resolved at
+ * each `getAddress()` / `signUserOpHash()` from the cached session, so the
+ * same signer instance follows whichever user is signed in.
+ */
+declare function devPrivateKeySigner(input: DevPrivateKeySignerInput): CapxulSigner;
+//#endregion
+//#region src/adapters/openfort/embedded-wallet-port.d.ts
+/**
+ * Minimal Openfort embedded-wallet surface for hermetic tests and
+ * `openfortEmbeddedSigner`. Keeps Convex / Shield secrets out of the SDK.
+ */
+interface OpenfortEmbeddedWalletPort {
+  /** Owner EOA address — must stay stable for the lifetime of this port. */
+  getAddress(): Promise<string>;
+  /**
+   * Sign a 32-byte SafeOp digest without EIP-191 prefixing (backend-orchestrated
+   * deploy contract).
+   */
+  signRawDigest(hash: Hex): Promise<Hex>;
+}
+/** Openfort `embeddedWallet` subset used by `openfortEmbeddedWalletPort`. */
+interface OpenfortEmbeddedWalletApi {
+  get(): Promise<{
+    readonly address: string;
+  }>;
+  signMessage(message: string | Uint8Array, options?: {
+    readonly hashMessage?: boolean;
+    readonly arrayifyMessage?: boolean;
+  }): Promise<string>;
+}
+declare function openfortEmbeddedWalletPort(input: {
+  readonly embeddedWallet: OpenfortEmbeddedWalletApi;
+  readonly ensureReady?: () => Promise<void>;
+}): OpenfortEmbeddedWalletPort;
+//#endregion
+//#region src/openfort-embedded-signer.d.ts
+interface OpenfortEmbeddedSignerInput {
+  readonly wallet: OpenfortEmbeddedWalletPort;
+}
+/** Browser helper: wrap an initialized Openfort `embeddedWallet` API. */
+declare function openfortEmbeddedSignerFromWallet(input: {
+  readonly embeddedWallet: OpenfortEmbeddedWalletApi;
+  readonly ensureWalletReady?: () => Promise<void>;
+}): OpenfortEmbeddedSigner;
+/**
+ * Browser `CapxulSigner` backed by an Openfort embedded wallet (#335).
+ * Signs the backend's SafeOp digest via raw `signMessage` (no EIP-191 prefix)
+ * and verifies recovery before the backend submits.
+ */
+type OpenfortEmbeddedSigner = CapxulSigner & {
+  /** Drop cached `getAddress()` so the next read hits the embedded wallet again. */readonly resetAddressCache: () => void;
+};
+declare function openfortEmbeddedSigner(input: OpenfortEmbeddedSignerInput): OpenfortEmbeddedSigner;
+/**
+ * Canonical name for the embedded-wallet `CapxulSigner` constructor
+ * (backend-orchestrated-deploy.md). The embedded-wallet (passkey / Openfort)
+ * member of the named constructor trio `localPrivateKeySigner` /
+ * `injectedWalletSigner` / `embeddedSigner`. Takes the provider-agnostic
+ * `OpenfortEmbeddedWalletPort` (getAddress + signRawDigest); the Openfort-API
+ * convenience wrapper is `openfortEmbeddedSignerFromWallet`.
+ */
+declare const embeddedSigner: typeof openfortEmbeddedSigner;
+//#endregion
+//#region src/production.d.ts
+/**
+ * Consumer-facing `createCapxulClient` input (SDK DX public surface · #326).
+ * The publishable key is the primary input; bootstrap host, invoke timeout,
+ * runtime detection, and auth-cache selection are SDK-owned defaults.
+ */
+interface CapxulClientInput {
+  readonly publishableKey: string;
+  /**
+   * Init-time account readiness target (issue #159 · AC4). Threaded into
+   * `assembleCapxulClient` so `client.account.{getStatus,ensureReady}` reflect
+   * the consumer's chosen requirement. Optional — defaults to `"none"` (SDK
+   * publish readiness · I3) so `createCapxulClient({ publishableKey })` works
+   * with no account lane.
+   */
+  readonly requirement?: AccountRequirement;
+  /**
+   * Consumer-held signer (backend-orchestrated-deploy.md). Required for
+   * `requirement: "deployed"` flows: `provision` reads `getAddress()` and the
+   * deploy path signs the backend's SafeOp digest via `signUserOpHash()`. The
+   * backend orchestrates build + gas + paymaster + submit — the client never
+   * holds an RPC URL, a gas-sponsorship policy, or a bundler.
+   */
+  readonly signer?: CapxulSigner;
+}
+//#endregion
+//#region src/client/create-capxul-client-from-production.d.ts
+/** Consumer-facing factory — accepts only production-meaningful inputs (#326). */
+declare function createCapxulClient(input: CapxulClientInput): Promise<CapxulResult<CapxulClient>>;
+//#endregion
+//#region src/telemetry/capture-exception.d.ts
+interface HandledErrorReportContext {
+  readonly layer?: string;
+  readonly operation?: string;
+  readonly provider?: string;
+  readonly capxul_error_code?: string;
+  readonly failure_mode?: FailureMode;
+}
+/**
+ * Capture an error as a `$exception` event through the telemetry port,
+ * formatted for PostHog Error Tracking.
+ *
+ * Parses stack traces into `$exception_list` format, extracts structured
+ * metadata from CapxulError objects, and supplements with context props.
+ * Fire-and-forget: telemetry defects are silently swallowed.
+ * Returns `Effect<void, never>` for use in Effect pipelines; the underlying
+ * adapter work is synchronous, so callers outside Effect contexts can
+ * use `Effect.runSync`.
+ */
+declare function captureException(telemetry: TelemetryPort, error: unknown, context?: HandledErrorReportContext): Effect.Effect<void, never>;
+/**
+ * Synchronous fire-and-forget capture. Runs the Effect inline with
+ * `Effect.runSync` so callers outside an Effect context (e.g. React
+ * hooks before throwing) can report errors without awaiting.
+ */
+declare function captureExceptionSync(telemetry: TelemetryPort, error: unknown, context?: HandledErrorReportContext): void;
+//#endregion
+export { type Account, type AccountLifecycle, type AccountMethods, type AccountProvider, type AccountProviderSource, type AccountRequirement, type AccountSetupStep, type AccountsMethods, type ActorProfile, type ActorProfileMethods, type ActorRelationshipMethods, type ActorRequest, type ActorRequestIssueInput, type ActorRequestsMethods, type Address, type AddressBookAddInput, type AddressBookEntry, type AddressBookLabelInput, type AddressBookMethods, type AssignRoleInput, type AuthMethods, type AuthSession, type AuthUserId, type CapxulClient, type CapxulClientInput, type CapxulDigestSigner, type CapxulResult, type CapxulSigner, type CompleteOrganizationOnboardingInput, type CompleteOrganizationOnboardingResult, type CompletePersonalOnboardingInput, type CompletePersonalOnboardingResult, type CreateCapxulClientInput, type CreateOrgInput, type DepositInstructions, type Destination, type DestinationAddInput, type DestinationKind, type DestinationListInput, type DestinationPayload, type DestinationRemoveInput, type DestinationsMethods, type DetectPendingOrgInvitationsResult, type DevPrivateKeySignerInput, type Eip1193Provider, type Eip1193RequestProvider, type FinancialOpsMethods, type HandledErrorReportContext, type HandlesMethods, type IdentityMethods, type InboxApproveInput, type InboxItem, type InboxMethods, type InsightsMethods, type InsightsSummary, type InviteMemberInput, type MeMethods, type MeProfile, type MemberStatus, type MemberView, type Money, type OnboardingMethods, type OpenfortEmbeddedSignerInput, type OpenfortEmbeddedWalletApi, type OpenfortEmbeddedWalletPort, type OrgBatchPayrollInput, type OrgId, type OrgMethods, type OrgPayrollRun, type OrgScopedMethods, type OrgSpendViaPaymentsInput, type OrgTemplate, type OrgView, type Payee, type PayeesMethods, type Payment, type PaymentDocumentRef, type PaymentDocumentRender, type PaymentDocumentVerification, type PaymentDocumentsMethods, type PaymentDraft, type PaymentDraftStatus, type PaymentMoney, type PaymentRequest, type PaymentRequestStatus, type PaymentRequestsCreateInput, type PaymentRequestsMethods, type PaymentSettlementInput, type PaymentStatus, type PaymentTiming, type PaymentType, type PaymentsMethods, type PaymentsPayInput, type PaymentsPayoutInput, type PaymentsWithdrawInput, type PayrollMethods, type PayrollPayslipTemplate, type PayrollRosterAddInput, type PayrollRosterLine, type PayrollRunInput, type Profile, type RecipientResolution, type RecipientResolutionKind, type ReconciliationEntry, type Ref, type RemoveMemberInput, type ResendInviteTokenInput, type RoleDefinition, type RoleKey, type RoleSpendCap, type RoleView, type Session, type SmartAccount, type SmartAccountMethods, type SubAccount, type SubAccountId, type SubAccountsMethods, type TelemetryPort, type TransferEndpoint, type TransferInput, type TransferResult, type WorkbenchDraftInput, type WorkbenchExecuteInput, type WorkbenchMethods, type WorkbenchMintResult, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, injectedWalletSigner, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort };
+//# sourceMappingURL=index.d.mts.map