@capxul/sdk 0.2.0-alpha.5 → 1.0.0-alpha.6

package/dist/index.mjs

@@ -1,15 +1,16 @@
 import { n as BrowserAuthCacheAdapter, o as AuthCachePortTag, t as InMemoryAuthCacheAdapter } from "./InMemoryAuthCacheAdapter-BK-B_ERB.mjs";
 import { Context, Data, Deferred, Duration, Effect, Either, Exit, Layer, Ref, Request, Scope } from "effect";
 import { Machine } from "@effect/experimental";
-import { CapxulError, Errors, USDX_CURRENCY, USDX_DECIMALS, compileOrgRoleDefinitions, decodeConvexError, isCapxulError, orgRoleKeyForLabel, orgRoleTemplateDefinitions } from "@capxul/config";
+import { CapxulError, Errors, USDX_CURRENCY, USDX_DECIMALS, compileOrgRoleDefinitions, decodeConvexError, deriveCapxulSafeAddress, isCapxulError, orgRoleKeyForLabel, orgRoleTemplateDefinitions } from "@capxul/config";
 import { toAccountId, toAddress, toAllowedOrigin, toAnonymousDistinctId, toAppId, toAuthUserId, toChainId, toCountryCode, toCurrencyCode, toDurationMs, toEmail, toEpochMs, toEpochSeconds, toJwtToken, toKycTier, toOrgId, toPublishableKey, toPublishableKeyId, toRoleKey, toSessionToken, toSubAccountId } from "@capxul/types";
 import { redactTelemetryProps } from "@capxul/observability";
-import { formatUnits, isHex, keccak256, parseUnits } from "viem";
+import { formatUnits, hexToBytes, isHex, keccak256, parseUnits, recoverAddress } from "viem";
 import { privateKeyToAccount } from "viem/accounts";
 import { Schema, TreeFormatter } from "@effect/schema";
 import { BootstrapEnvelope } from "@capxul/wire";
 import { ConvexClient } from "convex/browser";
 import { getFunctionName, makeFunctionReference } from "convex/server";
+import { AccountTypeEnum, ChainTypeEnum, EmbeddedState, Openfort, RecoveryMethod, ThirdPartyOAuthProvider } from "@openfort/openfort-js";
 //#region src/ports/auth-client.ts
 var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
 var AuthClientPortTag = class extends Context.Tag("@capxul/sdk/ports/AuthClientPort")() {};
@@ -27,9 +28,11 @@ var RequestOtpRequest = class extends Request.TaggedClass("RequestOtp") {};
 var VerifyOtpRequest = class extends Request.TaggedClass("VerifyOtp") {};
 var GetSessionRequest = class extends Request.TaggedClass("GetSession") {};
 var SignOutRequest = class extends Request.TaggedClass("SignOut") {};
+var RestoreCachedSessionRequest = class extends Request.TaggedClass("RestoreCachedSession") {};
 var ResumeOtpEntryRequest = class extends Request.TaggedClass("ResumeOtpEntry") {};
 var ResetAuthFlowRequest = class extends Request.TaggedClass("ResetAuthFlow") {};
 var CommitAuthFlowRequest = class extends Request.TaggedClass("CommitAuthFlow") {};
+const AUTH_FLOW_CONTEXT_REVISIONS = /* @__PURE__ */ new WeakMap();
 const DEFAULT_OTP_TTL_MS = 3e5;
 const ACTOR_MACHINE = /* @__PURE__ */ new WeakMap();
 const RUNTIME_CONTROLS = /* @__PURE__ */ new WeakMap();
@@ -38,6 +41,7 @@ const AUTH_FLOW_TRANSITION_TABLE = {
 		valid: [
 			"RequestOtp",
 			"GetSession",
+			"RestoreCachedSession",
 			"ResetAuthFlow"
 		],
 		invalid: ["VerifyOtp WRONG_STATE", "SignOut WRONG_STATE"]
@@ -105,37 +109,40 @@ function publicInput(input) {
 	return { otpTtlMs: input.otpTtlMs };
 }
 function initialContext() {
-	return {
+	return withContextRevision({
 		state: "idle",
 		email: null,
 		session: null,
 		otpRequestedAt: null,
 		error: null
-	};
+	}, 0);
 }
 function createAuthFlowMachine() {
 	return Machine.makeWith()((input) => {
 		const normalized = normalizeInput(input);
 		const bootInput = publicInput(normalized);
 		const control = runtimeControl(input);
-		return Machine.procedures.make(initialContext(), { identifier: `AuthFlow:${normalized.otpTtlMs}` }).pipe(Machine.procedures.addPrivate()("CommitAuthFlow", ({ request }) => Effect.succeed(tuple(tuple(request.input, request.context), request.context))), Machine.procedures.add()("RequestOtp", (context) => Effect.gen(function* () {
+		return Machine.procedures.make(initialContext(), { identifier: `AuthFlow:${normalized.otpTtlMs}` }).pipe(Machine.procedures.addPrivate()("CommitAuthFlow", ({ request, state }) => {
+			const next = mergeCommittedContext(state, request.context, request.policy);
+			return Effect.succeed(tuple(tuple(request.input, next), next));
+		}), Machine.procedures.add()("RequestOtp", (context) => Effect.gen(function* () {
 			const email = assertEmailWellFormed(context.request.email);
 			if (!canTransition(context.state.state, "RequestOtp")) return yield* Effect.fail(wrongState("RequestOtp", context.state.state));
 			const anonDistinctId = context.state.anonDistinctId ?? makeAnonymousDistinctId();
-			const transient = {
+			const transient = mutationContext(context.state, {
 				state: "sending_otp",
 				email,
 				session: null,
 				otpRequestedAt: null,
 				anonDistinctId,
 				error: null
-			};
+			});
 			return yield* completeRequest(context.unsafeSendAwait, context.deferred, bootInput, control, requestOtpCompletion(email, anonDistinctId, context.request.options), (failure) => failureContext(failure, {
 				email: null,
 				session: null,
 				otpRequestedAt: null,
 				anonDistinctId
-			})).pipe(context.forkReplaceWith("auth-flow:request", transient), Effect.as(tuple(Machine.NoReply, transient)));
+			}), mutationCommitPolicy(transient)).pipe(context.forkReplaceWith("auth-flow:mutation", transient), Effect.as(tuple(Machine.NoReply, transient)));
 		})), Machine.procedures.add()("VerifyOtp", (context) => Effect.gen(function* () {
 			const email = assertEmailWellFormed(context.request.email);
 			if (!/^\d{6}$/.test(context.request.otp)) return yield* Effect.fail(new AuthFlowError({
@@ -167,38 +174,51 @@ function createAuthFlowMachine() {
 				});
 				return yield* Effect.fail(failure);
 			}
-			const transient = {
+			const transient = mutationContext(context.state, {
 				state: "verifying",
 				email,
 				session: null,
 				otpRequestedAt: current.otpRequestedAt,
 				anonDistinctId,
 				error: null
-			};
+			});
 			return yield* completeRequest(context.unsafeSendAwait, context.deferred, bootInput, control, verifyOtpCompletion(email, context.request.otp, anonDistinctId, context.request.options), (failure) => failureContext(failure, {
 				email,
 				session: null,
 				otpRequestedAt: current.otpRequestedAt,
 				anonDistinctId
-			})).pipe(context.forkReplaceWith("auth-flow:request", transient), Effect.as(tuple(Machine.NoReply, transient)));
+			}), mutationCommitPolicy(transient)).pipe(context.forkReplaceWith("auth-flow:mutation", transient), Effect.as(tuple(Machine.NoReply, transient)));
 		})), Machine.procedures.add()("GetSession", (context) => Effect.gen(function* () {
 			if (!canTransition(context.state.state, "GetSession")) return yield* Effect.fail(wrongState("GetSession", context.state.state));
-			return yield* completeRequest(context.unsafeSendAwait, context.deferred, bootInput, control, getSessionCompletion(context.request.options), (failure) => failureContext(failure, {
+			return yield* completeRequest(context.unsafeSendAwait, context.deferred, bootInput, control, getSessionCompletion(context.request.options, context.state), (failure) => failureContext(failure, {
 				email: context.state.email,
 				session: context.state.session,
 				otpRequestedAt: context.state.otpRequestedAt,
 				...context.state.anonDistinctId === void 0 ? {} : { anonDistinctId: context.state.anonDistinctId }
-			})).pipe(context.forkReplaceWith("auth-flow:request", context.state), Effect.as(tuple(Machine.NoReply, context.state)));
+			}), {
+				_tag: "sessionRefresh",
+				startedRevision: contextRevision(context.state)
+			}).pipe(context.forkReplaceWith("auth-flow:session", context.state), Effect.as(tuple(Machine.NoReply, context.state)));
 		})), Machine.procedures.add()("SignOut", (context) => Effect.gen(function* () {
 			if (!canTransition(context.state.state, "SignOut")) return yield* Effect.fail(wrongState("SignOut", context.state.state));
-			const transient = {
+			const transient = mutationContext(context.state, {
 				state: "signing_out",
 				email: context.state.email,
 				session: context.state.session,
 				otpRequestedAt: null,
 				error: null
-			};
-			return yield* completeRequest(context.unsafeSendAwait, context.deferred, bootInput, control, signOutCompletion(context.request.options), () => initialContext()).pipe(context.forkReplaceWith("auth-flow:request", transient), Effect.as(tuple(Machine.NoReply, transient)));
+			});
+			return yield* completeRequest(context.unsafeSendAwait, context.deferred, bootInput, control, signOutCompletion(context.request.options), () => initialContext(), mutationCommitPolicy(transient)).pipe(context.forkReplaceWith("auth-flow:mutation", transient), Effect.as(tuple(Machine.NoReply, transient)));
+		})), Machine.procedures.add()("RestoreCachedSession", (context) => Effect.gen(function* () {
+			if (!canTransition(context.state.state, "RestoreCachedSession")) return yield* Effect.fail(wrongState("RestoreCachedSession", context.state.state));
+			const restored = mutationContext(context.state, {
+				state: "authenticated",
+				email: context.request.session.email,
+				session: context.request.session,
+				otpRequestedAt: null,
+				error: null
+			});
+			return tuple(tuple(bootInput, restored), restored);
 		})), Machine.procedures.add()("ResumeOtpEntry", (context) => Effect.gen(function* () {
 			if (!canTransition(context.state.state, "ResumeOtpEntry")) return yield* Effect.fail(wrongState("ResumeOtpEntry", context.state.state));
 			const current = context.state;
@@ -223,17 +243,17 @@ function createAuthFlowMachine() {
 				});
 				return yield* Effect.fail(failure);
 			}
-			const restored = {
+			const restored = mutationContext(context.state, {
 				state: "otp_requested",
 				email: current.email,
 				session: null,
 				otpRequestedAt: current.otpRequestedAt,
 				...current.anonDistinctId === void 0 ? {} : { anonDistinctId: current.anonDistinctId },
 				error: null
-			};
+			});
 			return tuple(tuple(bootInput, restored), restored);
-		})), Machine.procedures.add()("ResetAuthFlow", () => {
-			const reset = initialContext();
+		})), Machine.procedures.add()("ResetAuthFlow", (context) => {
+			const reset = mutationContext(context.state, initialContext());
 			return Effect.succeed(tuple(tuple(bootInput, reset), reset));
 		}));
 	});
@@ -302,6 +322,7 @@ function toMachineRequest(request) {
 		}, request.options));
 		case "GetSession": return new GetSessionRequest(optionalOptions({}, request.options));
 		case "SignOut": return new SignOutRequest(optionalOptions({}, request.options));
+		case "RestoreCachedSession": return new RestoreCachedSessionRequest({ session: request.session });
 		case "ResumeOtpEntry": return new ResumeOtpEntryRequest();
 		case "ResetAuthFlow": return new ResetAuthFlowRequest();
 	}
@@ -360,10 +381,16 @@ function verifyOtpCompletion(email, otp, anonDistinctId, options) {
 		};
 	});
 }
-function getSessionCompletion(options) {
+function isInFlightOtpAuthState(state) {
+	return state === "otp_requested" || state === "sending_otp" || state === "verifying";
+}
+function getSessionCompletion(options, current) {
 	return Effect.gen(function* () {
-		const session = yield* withAuthFlowTimeout((yield* AuthClientPortTag).getSession(authClientOptions(options)), "getSession", "idle", options).pipe(Effect.mapError((error) => authClientFailure("getSession", "idle", error)));
-		if (session === null) return initialContext();
+		const session = yield* withAuthFlowTimeout((yield* AuthClientPortTag).getSession(authClientOptions(options)), "getSession", current.state, options).pipe(Effect.mapError((error) => authClientFailure("getSession", current.state, error)));
+		if (session === null) {
+			if (isInFlightOtpAuthState(current.state)) return current;
+			return initialContext();
+		}
 		return {
 			state: "authenticated",
 			email: session.email,
@@ -402,21 +429,11 @@ function authClientFailure(operation, state, error) {
 	if (error instanceof AuthFlowError) return error;
 	return toAuthFlowError(operation, state, error);
 }
-function completeRequest(commit, deferred, input, control, effect, toFailureContext) {
+function completeRequest(commit, deferred, input, control, effect, toFailureContext, policy) {
 	return effect.pipe(Effect.either, Effect.flatMap((result) => {
 		const stopped = stoppedFailure();
-		if (control.stopped) return commit(new CommitAuthFlowRequest({
-			input,
-			context: toFailureContext(stopped)
-		})).pipe(Effect.zipRight(Deferred.fail(deferred, stopped)));
-		if (result._tag === "Right") return commit(new CommitAuthFlowRequest({
-			input,
-			context: result.right
-		})).pipe(Effect.flatMap((snapshot) => Deferred.succeed(deferred, snapshot)));
-		return commit(new CommitAuthFlowRequest({
-			input,
-			context: toFailureContext(result.left)
-		})).pipe(Effect.zipRight(Deferred.fail(deferred, result.left)));
+		const resolution = control.stopped ? commit(commitAuthFlowRequest(input, toFailureContext(stopped), policy)).pipe(Effect.zipRight(Deferred.fail(deferred, stopped))) : result._tag === "Right" ? commit(commitAuthFlowRequest(input, result.right, policy)).pipe(Effect.flatMap((snapshot) => Deferred.succeed(deferred, snapshot))) : commit(commitAuthFlowRequest(input, toFailureContext(result.left), policy)).pipe(Effect.zipRight(Deferred.fail(deferred, result.left)));
+		return Effect.uninterruptible(resolution);
 	}), Effect.catchAllDefect((cause) => {
 		const failure = new AuthFlowError({
 			operation: "transition",
@@ -425,14 +442,41 @@ function completeRequest(commit, deferred, input, control, effect, toFailureCont
 			publicCode: "UNKNOWN",
 			cause
 		});
-		return commit(new CommitAuthFlowRequest({
-			input,
-			context: toFailureContext(failure)
-		})).pipe(Effect.zipRight(Deferred.fail(deferred, failure)));
-	}), Effect.onInterrupt(() => commit(new CommitAuthFlowRequest({
+		return Effect.uninterruptible(commit(commitAuthFlowRequest(input, toFailureContext(failure), policy)).pipe(Effect.zipRight(Deferred.fail(deferred, failure))));
+	}), Effect.onInterrupt(() => Effect.uninterruptible(commit(commitAuthFlowRequest(input, toFailureContext(stoppedFailure()), policy)).pipe(Effect.zipRight(Deferred.fail(deferred, stoppedFailure()))))));
+}
+function commitAuthFlowRequest(input, context, policy) {
+	if (policy === void 0) return new CommitAuthFlowRequest({
 		input,
-		context: toFailureContext(stoppedFailure())
-	})).pipe(Effect.zipRight(Deferred.fail(deferred, stoppedFailure())))));
+		context
+	});
+	return new CommitAuthFlowRequest({
+		input,
+		context,
+		policy
+	});
+}
+function mergeCommittedContext(current, next, policy) {
+	const currentRevision = contextRevision(current);
+	if (policy === void 0) return withContextRevision(next, currentRevision);
+	if (currentRevision !== policy.startedRevision) return current;
+	return withContextRevision(next, currentRevision);
+}
+function mutationCommitPolicy(context) {
+	return {
+		_tag: "mutation",
+		startedRevision: contextRevision(context)
+	};
+}
+function mutationContext(context, next) {
+	return withContextRevision(next, contextRevision(context) + 1);
+}
+function contextRevision(context) {
+	return AUTH_FLOW_CONTEXT_REVISIONS.get(context) ?? 0;
+}
+function withContextRevision(context, revision) {
+	AUTH_FLOW_CONTEXT_REVISIONS.set(context, revision);
+	return context;
 }
 function stoppedFailure() {
 	return new AuthFlowError({
@@ -555,7 +599,16 @@ function hasMachineActor(actor) {
 const getSessionProgramWithOptions = (options) => Effect.gen(function* () {
 	const deps = yield* CapxulDepsTag;
 	const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "getSession", e)));
-	if (cached !== null) return cached;
+	const actorState = String(deps.actor.getSnapshot().value);
+	if (cached === null && (actorState === "otp_requested" || actorState === "sending_otp" || actorState === "verifying")) return null;
+	if (cached !== null && actorState !== "idle") return cached;
+	if (cached !== null && actorState === "idle") {
+		yield* sendAuthFlowRequest(deps.actor, {
+			_tag: "RestoreCachedSession",
+			session: cached
+		}).pipe(Effect.provide(authFlowLayer(deps)), Effect.mapError((failure) => failure.publicError));
+		return cached;
+	}
 	if (!hasMachineActor(deps.actor)) {
 		const existingError = deps.actor.getSnapshot().context.error;
 		if (existingError !== null) return yield* Effect.fail(existingError);
@@ -567,6 +620,7 @@ const getSessionProgramWithOptions = (options) => Effect.gen(function* () {
 	if (refreshed[1].session !== null) return refreshed[1].session;
 	const session = deps.actor.getSnapshot().context.session;
 	if (session !== null) return session;
+	if (cached !== null) return cached;
 	return null;
 });
 getSessionProgramWithOptions();
@@ -700,18 +754,28 @@ const signInProgram = (input, options) => Effect.gen(function* () {
 */
 const signOutProgramWithOptions = (options) => Effect.gen(function* () {
 	const deps = yield* CapxulDepsTag;
-	const value = String(deps.actor.getSnapshot().value);
-	if (value === "idle") return yield* Effect.fail(Errors.wrongState({
-		method: "signOut",
-		currentState: value,
-		validStates: [
-			"authenticated",
-			"otp_requested",
-			"verifying",
-			"sending_otp",
-			"error"
-		]
-	}));
+	let value = String(deps.actor.getSnapshot().value);
+	if (value === "idle") {
+		const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "getSession", e)));
+		if (cached !== null) {
+			yield* sendAuthFlowRequest(deps.actor, {
+				_tag: "RestoreCachedSession",
+				session: cached
+			}).pipe(Effect.provide(authFlowLayer(deps)), Effect.mapError((failure) => failure.publicError));
+			value = String(deps.actor.getSnapshot().value);
+		}
+		if (value === "idle") return yield* Effect.fail(Errors.wrongState({
+			method: "signOut",
+			currentState: value,
+			validStates: [
+				"authenticated",
+				"otp_requested",
+				"verifying",
+				"sending_otp",
+				"error"
+			]
+		}));
+	}
 	if (value === "error") {
 		yield* sendAuthFlowRequest(deps.actor, {
 			_tag: "ResetAuthFlow",
@@ -765,9 +829,20 @@ function makeAuthMethods(deps) {
 				error: Errors.cancelled({ operation: "verifyOtp" })
 			};
 			const result = await toCapxulResult(verifyOtpProgram(input, options), capxulDepsLayer(deps));
-			if (result.ok) {
-				const afterVerifyOtp = deps.afterVerifyOtp;
-				if (afterVerifyOtp !== void 0) Promise.resolve().then(() => afterVerifyOtp()).catch(() => void 0);
+			if (!result.ok) return result;
+			const afterVerifyOtp = deps.afterVerifyOtp;
+			if (afterVerifyOtp === void 0) return result;
+			try {
+				await afterVerifyOtp();
+			} catch (cause) {
+				if (cause instanceof CapxulError) return {
+					ok: false,
+					error: cause
+				};
+				return {
+					ok: false,
+					error: Errors.providerError("sdk", "afterVerifyOtp", cause)
+				};
 			}
 			return result;
 		},
@@ -844,7 +919,7 @@ const loadSmartAccountProgram = Effect.gen(function* () {
 * port. The leading `signal.aborted` pre-check stays in the thin method
 * wrapper (provision currently takes no signal, so there is none).
 */
-function provisionSmartAccountProgram(input) {
+function provisionSmartAccountProgram() {
 	return Effect.gen(function* () {
 		const deps = yield* SmartAccountDepsTag;
 		const snap = deps.actor.getSnapshot();
@@ -854,19 +929,10 @@ function provisionSmartAccountProgram(input) {
 			currentState: value,
 			validStates: ["authenticated"]
 		}));
-		const signer = input?.externalSigner;
-		if (signer === void 0) return yield* Effect.fail(Errors.invalidInput("externalSigner", "required for provisioning"));
-		let signerAddress;
-		try {
-			signerAddress = toAddress(signer.address);
-		} catch (err) {
-			return yield* Effect.fail(err instanceof CapxulError ? err : Errors.invalidInput("externalSigner.address", "invalid EVM address"));
-		}
 		const session = snap.context.session;
 		if (session === null) return yield* Effect.fail(Errors.notAuthenticated());
 		const provisioned = yield* deps.smartAccountPort.provision({
 			authUserId: session.authUserId,
-			signerAddress,
 			chainId: deps.chainId
 		}).pipe(Effect.mapError((failure) => failure.publicError));
 		yield* Effect.promise(() => emitProvisioningTelemetry(deps.telemetry, provisioned));
@@ -884,8 +950,8 @@ function makeSmartAccountMethods(deps) {
 			};
 			return toCapxulResult(loadSmartAccountProgram, smartAccountDepsLayer(deps));
 		},
-		async provision(input) {
-			return toCapxulResult(provisionSmartAccountProgram(input), smartAccountDepsLayer(deps));
+		async provision(_input) {
+			return toCapxulResult(provisionSmartAccountProgram(), smartAccountDepsLayer(deps));
 		}
 	};
 }
@@ -1054,11 +1120,263 @@ function statusFromAccount(account, requirement) {
 	};
 }
 //#endregion
+//#region src/client/account-lane.ts
+function isActiveProvisioningPhase(phase) {
+	return phase.status === "wallet" || phase.status === "binding" || phase.status === "identity" || phase.status === "provision" || phase.status === "deploy";
+}
+function isRequirementMet(status, requirement) {
+	if (requirement === "none") return status.status !== "notAuthenticated";
+	if (status.status !== "accountReady") return false;
+	if (requirement === "deployed") return status.deployment.status === "deployed";
+	return true;
+}
+function createAccountLane(steps) {
+	let phase = { status: "idle" };
+	let inFlight = null;
+	const setPhase = (next) => {
+		phase = next;
+	};
+	const failAt = (at, error) => {
+		const failed = {
+			status: "failed",
+			at,
+			error
+		};
+		setPhase(failed);
+		return failed;
+	};
+	const shouldAutoStart = async () => {
+		if (steps.requirement === "none") return false;
+		if (phase.status === "failed") return false;
+		if (isActiveProvisioningPhase(phase)) return false;
+		if (phase.status === "ready") return false;
+		if (await steps.getSession() === null) return false;
+		const status = await steps.getStatus();
+		if (!status.ok) return false;
+		return !isRequirementMet(status.value, steps.requirement);
+	};
+	const runLane = async () => {
+		if (steps.requirement === "none") {
+			setPhase({ status: "idle" });
+			return phase;
+		}
+		const session = await steps.getSession();
+		if (session === null) {
+			setPhase({ status: "idle" });
+			return phase;
+		}
+		let status = await steps.getStatus();
+		if (!status.ok) return failAt("wallet", status.error);
+		if (isRequirementMet(status.value, steps.requirement)) {
+			setPhase({ status: "ready" });
+			return phase;
+		}
+		if (status.value.status === "accountRequired" || status.value.status === "accountProviderReady" || status.value.status === "notAuthenticated") {
+			setPhase({ status: "wallet" });
+			const wallet = await steps.runWallet();
+			if (!wallet.ok) return failAt("wallet", wallet.error);
+			status = await steps.getStatus();
+			if (!status.ok) return failAt("wallet", status.error);
+			if (isRequirementMet(status.value, steps.requirement)) {
+				setPhase({ status: "ready" });
+				return phase;
+			}
+		}
+		if (status.value.status === "accountProviderReady") {
+			setPhase({ status: "binding" });
+			const binding = await steps.runBinding(session);
+			if (!binding.ok) return failAt("binding", binding.error);
+			if (steps.requirement === "deployed") {
+				setPhase({ status: "deploy" });
+				const deployed = await steps.runDeploy();
+				if (!deployed.ok) return failAt("deploy", deployed.error);
+			} else {
+				setPhase({ status: "identity" });
+				const identity = await steps.runIdentity(session);
+				if (!identity.ok) return failAt("identity", identity.error);
+				setPhase({ status: "provision" });
+				const provisioned = await steps.runProvision();
+				if (!provisioned.ok) return failAt("provision", provisioned.error);
+			}
+			status = await steps.getStatus();
+			if (!status.ok) return failAt(steps.requirement === "deployed" ? "deploy" : "provision", status.error);
+			if (isRequirementMet(status.value, steps.requirement)) {
+				setPhase({ status: "ready" });
+				return phase;
+			}
+		}
+		if (status.value.status === "accountPrepared" && steps.requirement === "deployed") {
+			setPhase({ status: "deploy" });
+			const deployed = await steps.runDeploy();
+			if (!deployed.ok) return failAt("deploy", deployed.error);
+			status = await steps.getStatus();
+			if (!status.ok) return failAt("deploy", status.error);
+		}
+		if (status.ok && isRequirementMet(status.value, steps.requirement)) {
+			setPhase({ status: "ready" });
+			return phase;
+		}
+		setPhase({ status: "idle" });
+		return phase;
+	};
+	const startLane = () => {
+		if (inFlight !== null) return inFlight;
+		inFlight = runLane().finally(() => {
+			inFlight = null;
+		});
+		return inFlight;
+	};
+	return {
+		getProvisioningPhase() {
+			return phase;
+		},
+		kickProvisioning() {
+			(async () => {
+				if (await shouldAutoStart()) await startLane();
+			})();
+		},
+		async resolveProvisioningPhase() {
+			if (await shouldAutoStart()) return startLane();
+			if (inFlight !== null) return inFlight;
+			return phase;
+		},
+		async retryProvisioning() {
+			if (inFlight !== null) return inFlight;
+			if (phase.status === "failed" || phase.status === "idle") {
+				setPhase({ status: "idle" });
+				inFlight = runLane().finally(() => {
+					inFlight = null;
+				});
+				return inFlight;
+			}
+			return phase;
+		},
+		async runLane() {
+			if (inFlight !== null) return inFlight;
+			inFlight = runLane().finally(() => {
+				inFlight = null;
+			});
+			return inFlight;
+		}
+	};
+}
+//#endregion
+//#region src/client/account-lifecycle.ts
+function mapProvisioningFailureStep(step) {
+	switch (step) {
+		case "wallet": return "connecting";
+		case "binding": return "confirmingIdentity";
+		case "identity": return "registering";
+		case "provision":
+		case "deploy": return "activating";
+	}
+}
+function mapProvisioningPhaseToSetupStep(phase) {
+	switch (phase.status) {
+		case "idle":
+		case "wallet": return "connecting";
+		case "binding": return "confirmingIdentity";
+		case "identity": return "registering";
+		case "provision":
+		case "deploy": return "activating";
+		case "ready":
+		case "failed": return "connecting";
+	}
+}
+function isSettingUpLifecycle(lifecycle) {
+	return lifecycle.status === "settingUp";
+}
+function readyLifecycle(status, accountId) {
+	return {
+		status: "ready",
+		accountId,
+		canTransact: status.status === "accountReady" && status.deployment.status === "deployed"
+	};
+}
+function mapAccountLifecycle(input) {
+	const { status, phase, requirement, accountId } = input;
+	if (status.status === "notAuthenticated") return { status: "loading" };
+	if (phase.status === "failed") return {
+		status: "failed",
+		at: mapProvisioningFailureStep(phase.at),
+		error: phase.error
+	};
+	if (isRequirementMet(status, requirement) || phase.status === "ready") {
+		if (accountId === void 0) return { status: "loading" };
+		return readyLifecycle(status, accountId);
+	}
+	if (isActiveProvisioningPhase(phase) || phase.status === "idle") return {
+		status: "settingUp",
+		step: mapProvisioningPhaseToSetupStep(phase)
+	};
+	return { status: "loading" };
+}
+//#endregion
 //#region src/client/account.ts
 function makeAccountMethods(deps) {
 	toChainId(deps.chainId);
 	const requirement = deps.requirement;
 	const getStatus = () => toCapxulResult(accountStatusProgram, accountDepsLayer(deps));
+	const runWallet = async () => {
+		const signer = deps.signer;
+		if (signer === void 0) return {
+			ok: true,
+			value: void 0
+		};
+		try {
+			await signer.getAddress();
+			return {
+				ok: true,
+				value: void 0
+			};
+		} catch (cause) {
+			return {
+				ok: false,
+				error: Errors.providerError("signer", "getAddress", cause)
+			};
+		}
+	};
+	const alignBindingWithSigner = async (session) => {
+		const bindingPort = deps.bindingPort;
+		if (bindingPort === void 0) return {
+			ok: true,
+			value: void 0
+		};
+		const signer = deps.signer;
+		let walletAddress;
+		if (signer !== void 0) {
+			const wallet = await runWallet();
+			if (!wallet.ok) return wallet;
+			try {
+				walletAddress = toAddress(await signer.getAddress());
+			} catch (cause) {
+				return {
+					ok: false,
+					error: Errors.providerError("signer", "getAddress", cause)
+				};
+			}
+		}
+		const binding = await runPortEffect(bindingPort.ensureResolved({
+			email: session.email,
+			...walletAddress === void 0 ? {} : { signerAddress: walletAddress }
+		}));
+		if (!binding.ok) return {
+			ok: false,
+			error: binding.error
+		};
+		if (walletAddress === void 0) return {
+			ok: true,
+			value: void 0
+		};
+		if (walletAddress.toLowerCase() !== String(binding.value.signerAddress).toLowerCase()) return {
+			ok: false,
+			error: Errors.invalidInput("signer", `embedded wallet EOA (${walletAddress}) does not match binding signer (${binding.value.signerAddress})`)
+		};
+		return {
+			ok: true,
+			value: void 0
+		};
+	};
 	const ensureIdentityProfile = async (session) => {
 		const existing = await runPortEffect(deps.identityPort.loadByAuthUserId(session.authUserId));
 		if (!existing.ok) return {
@@ -1093,20 +1411,8 @@ function makeAccountMethods(deps) {
 			ok: false,
 			error: profileReady.error
 		};
-		const signer = deps.signer;
-		if (signer === void 0) return {
-			ok: false,
-			error: Errors.smartAccountMissing("provision")
-		};
-		const signerAddressResult = await getSignerAddress(signer);
-		if (!signerAddressResult.ok) return {
-			ok: false,
-			error: signerAddressResult.error
-		};
-		const signerAddress = signerAddressResult.value;
 		const provisioned = await runPortEffect(deps.smartAccountPort.provision({
 			authUserId: session.authUserId,
-			signerAddress,
 			chainId: toChainId(deps.chainId)
 		}));
 		if (!provisioned.ok) return provisioned;
@@ -1152,62 +1458,90 @@ function makeAccountMethods(deps) {
 		deployMutex.set(mutexKey, work);
 		return work;
 	};
+	const lane = createAccountLane({
+		requirement,
+		getStatus,
+		getSession: () => currentSession(deps.actor, deps.authCache),
+		runWallet,
+		runBinding: alignBindingWithSigner,
+		runIdentity: ensureIdentityProfile,
+		runProvision: provisionImpl,
+		runDeploy: deploySafeImpl
+	});
 	const ensureReady = async () => {
+		const ran = await lane.runLane();
+		if (ran.status === "failed") return {
+			ok: false,
+			error: ran.error
+		};
+		return getStatus();
+	};
+	const getProvisioningPhase = async () => {
+		return {
+			ok: true,
+			value: await lane.resolveProvisioningPhase()
+		};
+	};
+	const retryProvisioning = async () => {
+		return {
+			ok: true,
+			value: await lane.retryProvisioning()
+		};
+	};
+	const resolveLifecycle = async () => {
+		const phase = await lane.resolveProvisioningPhase();
 		const status = await getStatus();
-		if (!status.ok) return status;
-		if (status.value.status === "accountProviderReady" && requirement !== "deployed") {
-			const provisioned = await provisionImpl();
-			if (!provisioned.ok) return {
-				ok: false,
-				error: provisioned.error
-			};
-			return getStatus();
-		}
-		if (status.value.status === "accountProviderReady" && requirement === "deployed") {
-			const provisioned = await provisionImpl();
-			if (!provisioned.ok) return {
-				ok: false,
-				error: provisioned.error
-			};
-			const deployed = await deploySafeImpl();
-			if (!deployed.ok) return {
+		if (!status.ok) return {
+			ok: false,
+			error: status.error
+		};
+		let accountId;
+		if (status.value.status !== "notAuthenticated" && (phase.status === "ready" || isRequirementMet(status.value, requirement))) {
+			const accountReadPort = deps.accountReadPort;
+			if (accountReadPort === void 0) return {
 				ok: false,
-				error: deployed.error
+				error: Errors.invalidInput("account", "accountReadPort is required to resolve ready lifecycle")
 			};
-			return getStatus();
-		}
-		if (status.value.status === "accountPrepared" && requirement === "deployed") {
-			const deployed = await deploySafeImpl();
-			if (!deployed.ok) return {
+			const account = await runPortEffect(accountReadPort.readBalance({ chainId: toChainId(deps.chainId) }));
+			if (!account.ok) return {
 				ok: false,
-				error: deployed.error
+				error: account.error
 			};
-			return getStatus();
+			accountId = String(account.value.id);
 		}
-		return status;
+		return {
+			ok: true,
+			value: mapAccountLifecycle({
+				status: status.value,
+				phase,
+				requirement,
+				...accountId === void 0 ? {} : { accountId }
+			})
+		};
+	};
+	const getLifecycle = () => resolveLifecycle();
+	const retrySetup = async () => {
+		await lane.retryProvisioning();
+		return resolveLifecycle();
 	};
 	return {
-		getStatus,
-		ensureReady,
-		_internal: {
-			provision: provisionImpl,
-			deploySafe: deploySafeImpl
+		methods: {
+			getLifecycle,
+			retrySetup,
+			_internal: {
+				provision: provisionImpl,
+				deploySafe: deploySafeImpl,
+				getStatus,
+				ensureReady,
+				getProvisioningPhase,
+				retryProvisioning
+			}
+		},
+		kickProvisioning: () => {
+			lane.kickProvisioning();
 		}
 	};
 }
-async function getSignerAddress(signer) {
-	try {
-		return {
-			ok: true,
-			value: await signer.getAddress()
-		};
-	} catch (cause) {
-		return {
-			ok: false,
-			error: Errors.providerError("signer", "getAddress", cause)
-		};
-	}
-}
 /**
 * Backend-orchestrated deploy (backend-orchestrated-deploy.md):
 *   1. `deployPrepare` — backend builds + gas-fills + paymaster-sponsors the
@@ -1248,6 +1582,27 @@ async function runBackendDeploy(input) {
 	};
 }
 //#endregion
+//#region src/client/binding.ts
+function makeBindingMethods(deps) {
+	return { async ensureResolved(input) {
+		const port = deps.bindingPort;
+		if (port === void 0) return {
+			ok: false,
+			error: Errors.invalidInput("binding", "binding port not configured")
+		};
+		let email;
+		try {
+			email = toEmail(input.email);
+		} catch (cause) {
+			return {
+				ok: false,
+				error: cause instanceof Error && "code" in cause ? cause : Errors.invalidInput("email", "invalid email")
+			};
+		}
+		return runPortEffect(port.ensureResolved({ email }));
+	} };
+}
+//#endregion
 //#region src/money/to-wei.ts
 /**
 * Lower consumer `Money` into an on-chain integer string for guarded writes.
@@ -2197,8 +2552,24 @@ function assembleCapxulClient(input) {
 	const authFlowInput = input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs };
 	const actor = Effect.runSync(bootAuthFlow(createAuthFlowMachine(), authFlowInput).pipe(Effect.provide(layer)));
 	if (input.signal !== void 0) input.signal.addEventListener("abort", () => actor.stop(), { once: true });
+	const binding = makeBindingMethods({ bindingPort: input.ports.binding });
 	const selectedOrgPort = input.orgPort ?? input.orgDeploymentPort;
 	let detectPendingOrgInvitations;
+	let kickProvisioning;
+	const accountBundle = makeAccountMethods({
+		actor,
+		authCache,
+		identityPort: input.ports.identity,
+		smartAccountPort: input.ports.smartAccount,
+		telemetry: input.ports.telemetry,
+		chainId: input.bootstrap.chainId,
+		requirement: input.requirement,
+		bindingPort: input.ports.binding,
+		accountReadPort: input.ports.accountRead,
+		...input.signer === void 0 ? {} : { signer: input.signer }
+	});
+	kickProvisioning = accountBundle.kickProvisioning;
+	const account = accountBundle.methods;
 	const auth = makeAuthMethods({
 		actor,
 		authClient: input.ports.authClient,
@@ -2207,9 +2578,10 @@ function assembleCapxulClient(input) {
 		telemetry: input.ports.telemetry,
 		...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
 		...input.invokeTimeoutMs === void 0 ? {} : { invokeTimeoutMs: input.invokeTimeoutMs },
-		...selectedOrgPort === void 0 ? {} : { afterVerifyOtp: async () => {
+		afterVerifyOtp: async () => {
 			await detectPendingOrgInvitations?.();
-		} }
+			kickProvisioning?.();
+		}
 	});
 	const smartAccount = makeSmartAccountMethods({
 		actor,
@@ -2222,16 +2594,6 @@ function assembleCapxulClient(input) {
 		identityPort: input.ports.identity,
 		actor
 	});
-	const account = makeAccountMethods({
-		actor,
-		authCache,
-		identityPort: input.ports.identity,
-		smartAccountPort: input.ports.smartAccount,
-		telemetry: input.ports.telemetry,
-		chainId: input.bootstrap.chainId,
-		requirement: input.requirement,
-		...input.signer === void 0 ? {} : { signer: input.signer }
-	});
 	const accounts = makeAccountsMethods({
 		accountReadPort: input.ports.accountRead,
 		chainId: input.bootstrap.chainId,
@@ -2256,6 +2618,7 @@ function assembleCapxulClient(input) {
 		smartAccount,
 		identity,
 		account,
+		binding,
 		accounts,
 		subAccounts,
 		createOrg: orgMethods.createOrg,
@@ -2337,19 +2700,42 @@ function eip1193AccountProvider(input) {
 		}
 	};
 }
-function openfortEmbeddedAccountProvider() {
+function openfortEmbeddedAccountProvider(input) {
+	if (input.signer.source !== "openfort-embedded") throw Errors.invalidInput("signer.source", "must be \"openfort-embedded\"");
+	let cachedAddress = null;
+	let inFlight = null;
+	const getAddress = async () => {
+		if (cachedAddress !== null) return {
+			ok: true,
+			value: cachedAddress
+		};
+		if (inFlight !== null) return inFlight;
+		inFlight = (async () => {
+			try {
+				const address = await input.signer.getAddress();
+				cachedAddress = address;
+				return {
+					ok: true,
+					value: address
+				};
+			} catch (err) {
+				return {
+					ok: false,
+					error: Errors.providerError("openfort-embedded", "getAddress", err)
+				};
+			} finally {
+				inFlight = null;
+			}
+		})();
+		return inFlight;
+	};
 	return {
 		source: "openfort-embedded",
-		async getAddress() {
-			return {
-				ok: false,
-				error: Errors.notImplemented("OpenfortAccountProvider", "getAddress")
-			};
-		},
+		getAddress,
 		async getDeployAccount() {
 			return {
 				ok: false,
-				error: Errors.notImplemented("OpenfortAccountProvider", "getDeployAccount")
+				error: Errors.invalidInput("accountProvider", "openfort-embedded uses CapxulSigner + backend-orchestrated deploy; getDeployAccount is not supported")
 			};
 		}
 	};
@@ -2361,26 +2747,29 @@ function firstAccount(value) {
 }
 //#endregion
 //#region src/signer.ts
-const EVM_ADDRESS_HEX = /^0x[0-9a-fA-F]{40}$/;
-const ECDSA_SIGNATURE_HEX = /^0x[0-9a-fA-F]{130}$/;
+const EVM_ADDRESS_HEX$1 = /^0x[0-9a-fA-F]{40}$/;
+const ECDSA_SIGNATURE_HEX$1 = /^0x[0-9a-fA-F]{130}$/;
+const SAFE_OP_DIGEST_HEX$1 = /^0x[0-9a-fA-F]{64}$/;
 /**
 * Browser `CapxulSigner` backed by an injected EIP-1193 wallet (MetaMask, etc.).
-* Signs the SafeOp digest via `eth_sign` (raw-hash signing). The node key signer
-* lives in `@capxul/sdk/node` (`localPrivateKeySigner`). Wallets that disable
-* `eth_sign` must enable raw-hash signing before deployed-account flows run.
+* Signs the SafeOp digest via `eth_sign`, then verifies the returned signature
+* recovers the selected account against that raw digest. Wallets that prefix
+* `eth_sign` payloads are rejected before the backend submits an invalid SafeOp.
+* The node key signer lives in `@capxul/sdk/node` (`localPrivateKeySigner`).
 */
 function injectedWalletSigner(provider) {
 	const resolveAddress = async () => {
 		const accounts = await provider.request({ method: "eth_requestAccounts" });
 		const first = Array.isArray(accounts) ? accounts[0] : void 0;
 		if (typeof first !== "string") throw new Error("injectedWalletSigner: wallet returned no accounts");
-		if (!EVM_ADDRESS_HEX.test(first)) throw new Error("injectedWalletSigner: wallet returned invalid address format");
+		if (!EVM_ADDRESS_HEX$1.test(first)) throw new Error("injectedWalletSigner: wallet returned invalid address format");
 		return toAddress(first);
 	};
 	return {
 		source: "injected-eip1193",
 		getAddress: resolveAddress,
 		async signUserOpHash(hash) {
+			if (!SAFE_OP_DIGEST_HEX$1.test(hash)) throw new Error("injectedWalletSigner: SafeOp digest must be a 0x-prefixed 32-byte hex");
 			const address = await resolveAddress();
 			let signature;
 			try {
@@ -2393,14 +2782,110 @@ function injectedWalletSigner(provider) {
 				throw new Error(`injectedWalletSigner: eth_sign failed; enable raw-hash signing for deployment (${detail})`);
 			}
 			if (typeof signature !== "string") throw new Error("injectedWalletSigner: wallet returned a non-string signature");
-			if (!ECDSA_SIGNATURE_HEX.test(signature)) throw new Error("injectedWalletSigner: wallet returned invalid signature format");
+			if (!ECDSA_SIGNATURE_HEX$1.test(signature)) throw new Error("injectedWalletSigner: wallet returned invalid signature format");
+			if ((await recoverRawDigestSigner$1({
+				hash,
+				signature
+			})).toLowerCase() !== address.toLowerCase()) throw new Error("injectedWalletSigner: wallet signature did not recover the selected account for the raw SafeOp digest; use a raw-hash-capable wallet or @capxul/sdk/node localPrivateKeySigner for deployed flows");
 			return signature;
 		}
 	};
 }
+async function recoverRawDigestSigner$1(input) {
+	try {
+		return toAddress(await recoverAddress(input));
+	} catch (cause) {
+		const detail = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`injectedWalletSigner: could not verify raw SafeOp digest signature (${detail})`);
+	}
+}
+//#endregion
+//#region src/adapters/openfort/embedded-wallet-port.ts
+function openfortEmbeddedWalletPort(input) {
+	return {
+		async getAddress() {
+			if (input.ensureReady !== void 0) await input.ensureReady();
+			return (await input.embeddedWallet.get()).address;
+		},
+		async signRawDigest(hash) {
+			if (input.ensureReady !== void 0) await input.ensureReady();
+			const digestBytes = hexToBytes(hash, { size: 32 });
+			return await input.embeddedWallet.signMessage(digestBytes, {
+				hashMessage: false,
+				arrayifyMessage: false
+			});
+		}
+	};
+}
+//#endregion
+//#region src/openfort-embedded-signer.ts
+const EVM_ADDRESS_HEX = /^0x[0-9a-fA-F]{40}$/;
+const ECDSA_SIGNATURE_HEX = /^0x[0-9a-fA-F]{130}$/;
+const SAFE_OP_DIGEST_HEX = /^0x[0-9a-fA-F]{64}$/;
+/** Browser helper: wrap an initialized Openfort `embeddedWallet` API. */
+function openfortEmbeddedSignerFromWallet(input) {
+	return openfortEmbeddedSigner({ wallet: openfortEmbeddedWalletPort({
+		embeddedWallet: input.embeddedWallet,
+		...input.ensureWalletReady === void 0 ? {} : { ensureReady: input.ensureWalletReady }
+	}) });
+}
+/**
+* Browser `CapxulSigner` backed by an Openfort embedded wallet (#335).
+* Signs the backend's SafeOp digest via raw `signMessage` (no EIP-191 prefix)
+* and verifies recovery before the backend submits.
+*/
+function openfortEmbeddedSigner(input) {
+	let cachedAddress = null;
+	let addressInFlight = null;
+	const resolveAddress = async () => {
+		if (cachedAddress !== null) return cachedAddress;
+		if (addressInFlight !== null) return addressInFlight;
+		addressInFlight = (async () => {
+			try {
+				const raw = await input.wallet.getAddress();
+				if (!EVM_ADDRESS_HEX.test(raw)) throw new Error("openfortEmbeddedSigner: embedded wallet returned invalid address format");
+				const address = toAddress(raw);
+				cachedAddress = address;
+				return address;
+			} finally {
+				addressInFlight = null;
+			}
+		})();
+		return addressInFlight;
+	};
+	return {
+		source: "openfort-embedded",
+		getAddress: resolveAddress,
+		async signUserOpHash(hash) {
+			if (!SAFE_OP_DIGEST_HEX.test(hash)) throw new Error("openfortEmbeddedSigner: SafeOp digest must be a 0x-prefixed 32-byte hex");
+			const address = await resolveAddress();
+			let signature;
+			try {
+				signature = await input.wallet.signRawDigest(hash);
+			} catch (cause) {
+				const detail = cause instanceof Error ? cause.message : String(cause);
+				throw new Error(`openfortEmbeddedSigner: raw digest signing failed; ensure the embedded wallet is configured (${detail})`);
+			}
+			if (!ECDSA_SIGNATURE_HEX.test(signature)) throw new Error("openfortEmbeddedSigner: embedded wallet returned invalid signature format");
+			if ((await recoverRawDigestSigner({
+				hash,
+				signature
+			})).toLowerCase() !== address.toLowerCase()) throw new Error("openfortEmbeddedSigner: signature did not recover the embedded wallet address for the raw SafeOp digest");
+			return signature;
+		}
+	};
+}
+async function recoverRawDigestSigner(input) {
+	try {
+		return toAddress(await recoverAddress(input));
+	} catch (cause) {
+		const detail = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`openfortEmbeddedSigner: could not verify raw SafeOp digest signature (${detail})`);
+	}
+}
 //#endregion
 //#region package.json
-var version = "0.2.0-alpha.5";
+var version = "1.0.0-alpha.6";
 //#endregion
 //#region src/adapters/auth-client/effect-port.ts
 function authClientPortFromPromiseAdapter(adapter) {
@@ -2501,7 +2986,7 @@ var BetterAuthBrowserAdapter = class {
 	fetchImpl;
 	constructor(deps) {
 		this.authBaseUrl = deps.authBaseUrl.replace(/\/$/, "");
-		this.fetchImpl = deps.fetch ?? fetch;
+		this.fetchImpl = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
 	}
 	url(path) {
 		return resolveAuthClientUrl(this.authBaseUrl, path);
@@ -3184,7 +3669,7 @@ var HttpBootstrapAdapter = class {
 	fetchImpl;
 	constructor(deps) {
 		this.bootstrapBaseUrl = deps.bootstrapBaseUrl.replace(/\/$/, "");
-		this.fetchImpl = deps.fetch ?? fetch;
+		this.fetchImpl = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
 	}
 	resolve(input) {
 		return Effect.tryPromise({
@@ -3216,7 +3701,10 @@ var HttpBootstrapAdapter = class {
 					issuedAt: state.issuedAt,
 					expiresIn: state.expiresIn,
 					authBaseUrl: normalizeRuntimeUrl("authBaseUrl", state.authBaseUrl),
-					convexUrl: normalizeRuntimeUrl("convexUrl", state.convexUrl)
+					convexUrl: normalizeRuntimeUrl("convexUrl", state.convexUrl),
+					siteBaseUrl: normalizeRuntimeUrl("siteBaseUrl", state.siteBaseUrl),
+					openfortPublishableKey: state.openfortPublishableKey,
+					shieldPublishableKey: state.shieldPublishableKey
 				};
 			},
 			catch: (cause) => {
@@ -4082,6 +4570,52 @@ function subAccountErrorFromUnknown(operation, cause) {
 	return subAccountErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
 }
 //#endregion
+//#region src/ports/binding.ts
+var BindingError = class extends Data.TaggedError("BindingError") {};
+function bindingErrorFromCapxul(operation, error, cause = error) {
+	return new BindingError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var BindingPortTag = class extends Context.Tag("@capxul/sdk/BindingPort")() {};
+//#endregion
+//#region src/adapters/binding/ConvexBindingAdapter.ts
+const resolveEmailBindingAction = makeFunctionReference("binding/actions:resolveEmailBinding");
+function brandBinding(row, email) {
+	const expectedSafe = deriveCapxulSafeAddress({
+		signerAddress: row.signerAddress,
+		email
+	}).toLowerCase();
+	if (row.safeAddress.toLowerCase() !== expectedSafe) throw Errors.invalidInput("safeAddress", "binding safe does not match email derivation");
+	return {
+		bindingId: row.bindingId,
+		signerAddress: toAddress(row.signerAddress),
+		safeAddress: toAddress(row.safeAddress)
+	};
+}
+var ConvexBindingAdapter = class {
+	#convex;
+	constructor(deps) {
+		this.#convex = deps.convex;
+	}
+	ensureResolved(input) {
+		return this.#convex.action(resolveEmailBindingAction, {
+			email: input.email,
+			...input.signerAddress === void 0 ? {} : { signerAddress: String(input.signerAddress) }
+		}).pipe(Effect.mapError((error) => bindingErrorFromCapxul("ensureResolved", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => brandBinding(row, input.email),
+			catch: (cause) => bindingErrorFromCapxul("ensureResolved", cause instanceof Error && "code" in cause ? cause : Errors.providerError("binding", "brand", cause), cause)
+		})));
+	}
+};
+const ConvexBindingLayer = () => Layer.effect(BindingPortTag, Effect.gen(function* () {
+	return new ConvexBindingAdapter({ convex: yield* ConvexCallPortTag });
+}));
+//#endregion
 //#region src/ports/smart-account.ts
 var SmartAccountError = class extends Data.TaggedError("SmartAccountError") {};
 function smartAccountErrorFromCapxul(operation, error, cause = error) {
@@ -4118,10 +4652,7 @@ var ConvexSmartAccountAdapter = class {
 		return this.#convex.query(this.#fns.loadBySmartAccountAddress, { address }).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("loadBySmartAccountAddress", error.publicError, error)), Effect.flatMap((row) => brandSmartAccountEffect("loadBySmartAccountAddress", row)), Effect.catchAllDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("loadBySmartAccountAddress", cause))));
 	}
 	provision(input) {
-		return this.#convex.mutation(this.#fns.provision, {
-			signerAddress: input.signerAddress,
-			chainId: wireChainId(input.chainId)
-		}).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("provision", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+		return this.#convex.mutation(this.#fns.provision, { chainId: wireChainId(input.chainId) }).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("provision", error.publicError, error)), Effect.flatMap((row) => Effect.try({
 			try: () => brandProvisionedSmartAccount(input.authUserId, row),
 			catch: (cause) => smartAccountErrorFromUnknown("provision", cause)
 		})), Effect.catchAllDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("provision", cause))));
@@ -4342,6 +4873,85 @@ function asRecordArgs(args) {
 function transportErrorFromThrown(operation, request, cause) {
 	return transportErrorFromCapxul(operation, request, cause instanceof Error ? Errors.providerError("transport", request.name, cause) : Errors.providerError("transport", request.name, new Error(String(cause))), cause);
 }
+//#endregion
+//#region src/openfort/create-openfort-browser-signer.ts
+function createOpenfortBrowserSignerFromBootstrap(bootstrap) {
+	const authBaseUrl = normalizeBetterAuthBaseUrl(bootstrap.authBaseUrl);
+	function betterAuthSessionUrl() {
+		return `${authBaseUrl}/get-session`;
+	}
+	function encryptionSessionUrl() {
+		return `${authBaseUrl}/encryption-session`;
+	}
+	async function fetchBetterAuthAccessToken() {
+		const response = await fetch(betterAuthSessionUrl(), { credentials: "include" });
+		if (!response.ok) return null;
+		const token = (await response.json()).session?.token?.trim();
+		return token !== void 0 && token.length > 0 ? token : null;
+	}
+	const openfort = new Openfort({
+		baseConfiguration: { publishableKey: bootstrap.openfortPublishableKey },
+		shieldConfiguration: { shieldPublishableKey: bootstrap.shieldPublishableKey },
+		thirdPartyAuth: {
+			provider: ThirdPartyOAuthProvider.BETTER_AUTH,
+			getAccessToken: fetchBetterAuthAccessToken
+		}
+	});
+	let walletReadyPromise = null;
+	function startWalletReady() {
+		return (async () => {
+			await openfort.waitForInitialization();
+			const accessToken = await fetchBetterAuthAccessToken();
+			if (accessToken === null) throw Errors.notAuthenticated();
+			const encryptionResponse = await fetch(encryptionSessionUrl(), {
+				method: "POST",
+				credentials: "include",
+				headers: {
+					Authorization: `Bearer ${accessToken}`,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify({})
+			});
+			if (!encryptionResponse.ok) {
+				const detail = await encryptionResponse.text();
+				throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error(`Openfort encryption session failed (${encryptionResponse.status}): ${detail.slice(0, 200)}`));
+			}
+			const encryptionBody = await encryptionResponse.json();
+			if (typeof encryptionBody.sessionId !== "string" || encryptionBody.sessionId.length === 0) throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error("Openfort encryption session response missing sessionId"));
+			if (await openfort.embeddedWallet.getEmbeddedState() !== EmbeddedState.READY) await openfort.embeddedWallet.configure({
+				accountType: AccountTypeEnum.EOA,
+				chainType: ChainTypeEnum.EVM,
+				recoveryParams: {
+					recoveryMethod: RecoveryMethod.AUTOMATIC,
+					encryptionSession: encryptionBody.sessionId
+				}
+			});
+			await openfort.embeddedWallet.get();
+		})();
+	}
+	async function ensureOpenfortWalletReady() {
+		walletReadyPromise ??= startWalletReady();
+		try {
+			await walletReadyPromise;
+		} catch (cause) {
+			walletReadyPromise = null;
+			throw cause;
+		}
+	}
+	return {
+		...openfortEmbeddedSignerFromWallet({
+			embeddedWallet: openfort.embeddedWallet,
+			ensureWalletReady: ensureOpenfortWalletReady
+		}),
+		resetSession: () => {
+			walletReadyPromise = null;
+		}
+	};
+}
+function normalizeBetterAuthBaseUrl(raw) {
+	const trimmed = raw.replace(/\/$/, "");
+	return trimmed.endsWith("/api/auth") ? trimmed : `${trimmed}/api/auth`;
+}
 const SDK_VERSION = version;
 const collectProductionFlowPorts = Effect.gen(function* () {
 	const authClient = yield* AuthClientPortTag;
@@ -4357,6 +4967,7 @@ const collectProductionFlowPorts = Effect.gen(function* () {
 		authCache,
 		identity: yield* IdentityPortTag,
 		smartAccount: yield* SmartAccountPortTag,
+		binding: yield* BindingPortTag,
 		accountRead: yield* AccountReadPortTag,
 		subAccount: yield* SubAccountPortTag,
 		credentials,
@@ -4395,6 +5006,10 @@ function makeProductionAdapterLayerEntries(input) {
 			name: "smartAccount",
 			layer: ConvexSmartAccountLayer()
 		},
+		{
+			name: "binding",
+			layer: ConvexBindingLayer()
+		},
 		{
 			name: "accountRead",
 			layer: ConvexAccountLayer()
@@ -4447,7 +5062,7 @@ function mergeProductionAdapterLayers(entries) {
 	}).reduce((current, layer) => Layer.merge(current, layer), Layer.empty);
 }
 function isConvexDependentLayer(name) {
-	return name === "identity" || name === "smartAccount" || name === "accountRead" || name === "subAccount" || name === "credentials" || name === "transport";
+	return name === "identity" || name === "smartAccount" || name === "binding" || name === "accountRead" || name === "subAccount" || name === "credentials" || name === "transport";
 }
 function productionBootstrapPortLayer(bootstrap) {
 	return Layer.succeed(BootstrapPortTag, bootstrap);
@@ -4529,19 +5144,20 @@ async function createProductionAdapters(input) {
 			await closeScope().catch(() => void 0);
 			return bootstrapResult;
 		}
-		const runtimeUrls = resolveRuntimeUrls(bootstrapResult.value);
-		if (!runtimeUrls.ok) {
+		const runtimeUrlsResult = resolveRuntimeUrls(bootstrapResult.value, input.authBaseUrl);
+		if (!runtimeUrlsResult.ok) {
 			await emitBootstrapTelemetry(input.telemetry, {
 				name: "bootstrap_failed",
 				props: {
 					...bootstrapTelemetryEnvelope(input, resolvedInput.value),
 					applicationId: bootstrapResult.value.applicationId,
-					reason: runtimeUrls.error.code
+					reason: runtimeUrlsResult.error.code
 				}
 			});
 			await closeScope().catch(() => void 0);
-			return runtimeUrls;
+			return runtimeUrlsResult;
 		}
+		const runtimeUrls = runtimeUrlsResult;
 		await emitBootstrapTelemetry(input.telemetry, {
 			name: "bootstrap_resolved",
 			props: {
@@ -4597,34 +5213,54 @@ function refreshConvexAuthOnSession(authClient, refresh) {
 		signOut: (options) => authClient.signOut(options).pipe(Effect.tap(() => Effect.sync(refresh)))
 	};
 }
-async function createCapxulClient(input) {
+function wireOpenfortSignerLifecycle(client, signer) {
+	if (signer === void 0 || !("resetSession" in signer)) return client;
+	const { resetSession } = signer;
+	const signOut = client.auth.signOut.bind(client.auth);
+	return {
+		...client,
+		auth: {
+			...client.auth,
+			signOut: async (options) => {
+				try {
+					return await signOut(options);
+				} finally {
+					resetSession();
+				}
+			}
+		}
+	};
+}
+async function createCapxulClient$1(input) {
+	const validation = validateCreateCapxulClientInput(input);
+	if (!validation.ok) return validation;
 	const adapters = await createProductionAdapters(input);
 	if (!adapters.ok) return adapters;
 	try {
-		const orgDeploymentPort = input.orgDeploymentPortFactory === void 0 ? void 0 : input.orgDeploymentPortFactory(adapters.value.ports.convexCall);
-		const client = assembleCapxulClient({
+		const runtime = input.runtime ?? detectRuntime();
+		let signer = input.signer;
+		if (signer === void 0 && (input.requirement ?? "none") === "deployed" && runtime === "browser") signer = createOpenfortBrowserSignerFromBootstrap(adapters.value.bootstrap);
+		const client = wireOpenfortSignerLifecycle(assembleCapxulClient({
 			ports: adapters.value.ports,
 			bootstrap: adapters.value.bootstrap,
 			authCache: adapters.value.ports.authCache,
 			requirement: input.requirement ?? "none",
-			...input.signer === void 0 ? {} : { signer: input.signer },
-			...orgDeploymentPort === void 0 ? {} : {
-				orgDeploymentPort,
-				orgRolesDeploymentPort: orgDeploymentPort,
-				orgSpendPort: orgDeploymentPort
-			},
-			...input.orgDeploymentConfig === void 0 ? {} : { orgDeploymentConfig: input.orgDeploymentConfig },
+			...signer === void 0 ? {} : { signer },
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
 			invokeTimeoutMs: input.invokeTimeoutMs ?? 3e4
-		});
+		}), signer);
+		const upstreamClose = adapters.value.close;
 		return {
 			ok: true,
 			value: {
 				...client,
 				_internal: {
 					...client._internal,
-					close: adapters.value.close
+					close: async () => {
+						if ("resetSession" in (signer ?? {})) signer.resetSession();
+						await upstreamClose();
+					}
 				}
 			}
 		};
@@ -4636,6 +5272,17 @@ async function createCapxulClient(input) {
 		};
 	}
 }
+function validateCreateCapxulClientInput(input) {
+	const runtime = input.runtime ?? detectRuntime();
+	if ((input.requirement ?? "none") === "deployed" && input.signer === void 0 && runtime !== "browser") return {
+		ok: false,
+		error: Errors.invalidInput("signer", "required when requirement is \"deployed\"")
+	};
+	return {
+		ok: true,
+		value: void 0
+	};
+}
 function resolveInput(input) {
 	try {
 		const runtime = input.runtime ?? detectRuntime();
@@ -4646,7 +5293,7 @@ function resolveInput(input) {
 			value: {
 				publishableKey,
 				...origin === void 0 ? {} : { origin },
-				bootstrapBaseUrl: normalizeHttpUrl("bootstrapBaseUrl", input.bootstrapBaseUrl ?? "https://api.capxul.com"),
+				bootstrapBaseUrl: normalizeHttpUrl("bootstrapBaseUrl", input.bootstrapBaseUrl ?? (runtime === "browser" ? derivedBrowserOrigin(runtime) : "https://api.capxul.com")),
 				runtime
 			}
 		};
@@ -4667,12 +5314,12 @@ function derivedBrowserOrigin(runtime) {
 	if (typeof globalAny.location?.origin === "string" && globalAny.location.origin.length > 0) return globalAny.location.origin;
 	throw Errors.invalidInput("origin", "required when browser location is unavailable");
 }
-function resolveRuntimeUrls(bootstrap) {
+function resolveRuntimeUrls(bootstrap, authBaseUrlOverride) {
 	try {
 		return {
 			ok: true,
 			value: {
-				authBaseUrl: normalizeHttpUrl("authBaseUrl", bootstrap.authBaseUrl),
+				authBaseUrl: normalizeHttpUrl("authBaseUrl", authBaseUrlOverride ?? bootstrap.authBaseUrl),
 				convexUrl: normalizeHttpUrl("convexUrl", bootstrap.convexUrl)
 			}
 		};
@@ -4735,6 +5382,12 @@ function idempotentClose(close) {
 	};
 }
 //#endregion
-export { assembleCapxulClient, createCapxulClient, eip1193AccountProvider, injectedWalletSigner, localPrivateKeyAccountProvider, openfortEmbeddedAccountProvider };
+//#region src/client/create-capxul-client-from-production.ts
+/** Consumer-facing factory — accepts only production-meaningful inputs (#326). */
+async function createCapxulClient(input) {
+	return createCapxulClient$1(input);
+}
+//#endregion
+export { assembleCapxulClient, createCapxulClient, eip1193AccountProvider, injectedWalletSigner, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort };
 
 //# sourceMappingURL=index.mjs.map