@capxul/sdk 0.2.0-alpha.5 → 1.0.0-alpha.7

package/README.md

@@ -1,8 +1,9 @@
 # @capxul/sdk
 
-Layer 0 SDK package. Stage 1 currently ships the `@capxul/sdk/env` subpath.
+Layer 0 SDK package.
 
-See `docs/env.md` for the env Module contract.
+- [Getting started](./docs/getting-started.md) — canonical consumer DX
+- [Package docs index](./docs/README.md)
+- [Env module](./docs/env.md)
 
-See `docs/identity-adapters.md` for the Effect-native identity port and adapter
-Layer exports.
+React apps: [`@capxul/sdk-react` provider docs](../sdk-react/docs/provider.md).

package/dist/InMemoryAuthCacheAdapter-v5W-XB5M.mjs

@@ -0,0 +1,457 @@
+import { Context, Data, Effect, Layer } from "effect";
+//#region ../errors/src/errors.ts
+const CAPXUL_ERROR_CODES = [
+	"NOT_AUTHENTICATED",
+	"EMAIL_DELIVERY_FAILED",
+	"PROFILE_NOT_FOUND",
+	"SMART_ACCOUNT_MISSING",
+	"PLAYER_NOT_FOUND",
+	"ACCOUNT_NOT_FOUND",
+	"PROVIDER_ERROR",
+	"INVALID_INPUT",
+	"ENV_MISSING",
+	"NOT_IMPLEMENTED",
+	"VERIFICATION_REQUIRED",
+	"INSUFFICIENT_BALANCE",
+	"INVALID_RECIPIENT",
+	"ROLE_PERMISSION_DENIED",
+	"TRANSACTION_FAILED",
+	"RATE_LIMITED",
+	"NETWORK_ERROR",
+	"UNKNOWN",
+	"OTP_EXPIRED",
+	"SIGNER_REJECTED",
+	"CANCELLED",
+	"WRONG_STATE"
+];
+var CapxulError = class extends Error {
+	code;
+	details;
+	correlationId;
+	layer;
+	constructor(code, message, options = {}) {
+		super(message, "cause" in options ? { cause: options.cause } : void 0);
+		this.name = "CapxulError";
+		this.code = code;
+		if (options.details !== void 0) this.details = options.details;
+		if (options.correlationId !== void 0) this.correlationId = options.correlationId;
+		if (options.layer !== void 0) this.layer = options.layer;
+	}
+};
+function isCapxulError(value) {
+	return value instanceof CapxulError;
+}
+function deserializeCapxulError(serialized) {
+	return new CapxulError(serialized.code, serialized.message, compactErrorOptions({
+		details: serialized.details,
+		correlationId: serialized.correlationId,
+		layer: serialized.layer
+	}));
+}
+function compactErrorOptions(options) {
+	const result = {};
+	if ("cause" in options) result.cause = options.cause;
+	if (options.details !== void 0) result.details = options.details;
+	if (options.correlationId !== void 0) result.correlationId = options.correlationId;
+	if (options.layer !== void 0) result.layer = options.layer;
+	return result;
+}
+const Errors = {
+	notAuthenticated: (message, opts) => new CapxulError("NOT_AUTHENTICATED", message ?? "Not authenticated", opts?.failure_mode ? { details: { failure_mode: opts.failure_mode } } : void 0),
+	emailDeliveryFailed: (detail) => new CapxulError("EMAIL_DELIVERY_FAILED", "Failed to send email", { details: { detail } }),
+	profileNotFound: (authUserId) => new CapxulError("PROFILE_NOT_FOUND", `Profile not found for user ${authUserId}`, { details: { authUserId } }),
+	smartAccountMissing: (authUserId) => new CapxulError("SMART_ACCOUNT_MISSING", "Smart account not provisioned", { details: { authUserId } }),
+	playerNotFound: (playerId) => new CapxulError("PLAYER_NOT_FOUND", playerId ? `Openfort player ${playerId} not found` : "Openfort player not found", playerId === void 0 ? void 0 : { details: { playerId } }),
+	accountNotFound: (accountId) => new CapxulError("ACCOUNT_NOT_FOUND", accountId ? `Openfort account ${accountId} not found` : "Openfort account not found", accountId === void 0 ? void 0 : { details: { accountId } }),
+	providerError: (provider, operation, cause, opts) => {
+		const details = {
+			provider,
+			operation
+		};
+		if (opts?.failure_mode) details.failure_mode = opts.failure_mode;
+		return new CapxulError("PROVIDER_ERROR", `Provider error: ${provider} ${operation}`, {
+			cause,
+			details
+		});
+	},
+	invalidInput: (field, reason) => new CapxulError("INVALID_INPUT", `Invalid ${field}: ${reason}`, { details: {
+		field,
+		reason
+	} }),
+	envMissing: (name) => new CapxulError("ENV_MISSING", `Environment variable ${name} not configured`, { details: { name } }),
+	notImplemented: (domain, method) => new CapxulError("NOT_IMPLEMENTED", `${domain}.${method} is not yet implemented. This feature is planned for a future release.`, { details: {
+		domain,
+		method
+	} }),
+	/**
+	* Sibling factory to {@link Errors.providerError} for the per-state timeout
+	* path in flows (initially ProvisioningFlow's mint_openfort / deploy_safe /
+	* register_indexer `after:` timers). Same `PROVIDER_ERROR` code as
+	* `providerError`, plus a `details.reason: "timeout"` discriminator so
+	* downstream observers can distinguish failure modes without parsing the
+	* message string. The redacted message names the timeout budget; the
+	* native `cause` carries the same information for `reportError` fidelity.
+	*/
+	providerTimeout: (provider, operation, timeoutMs) => new CapxulError("PROVIDER_ERROR", `Provider error: ${provider} ${operation} (timeout exceeded ${timeoutMs}ms)`, {
+		details: {
+			provider,
+			operation,
+			reason: "timeout"
+		},
+		cause: /* @__PURE__ */ new Error(`timeout: ${operation} exceeded ${timeoutMs}ms`)
+	}),
+	verificationRequired: (details) => {
+		return new CapxulError("VERIFICATION_REQUIRED", "rail" in details ? `Verification is required before ${details.rail} can use ${details.currentKind}.` : `Verification tier ${details.requiredTier} is required.`, { details });
+	},
+	insufficientBalance: (asset, available, required) => new CapxulError("INSUFFICIENT_BALANCE", `Insufficient ${asset} balance`, { details: {
+		asset,
+		available,
+		required
+	} }),
+	invalidRecipient: (reason) => new CapxulError("INVALID_RECIPIENT", `Invalid recipient: ${reason}`, { details: { reason } }),
+	/**
+	* The org Zodiac Roles modifier REFUSED the spend on-chain (G4 · #547): the
+	* member's role condition (per-tx cap, per-day allowance, allowed recipient,
+	* or membership) was violated, so `execTransactionWithRole` reverted. This is
+	* a PERMISSION denial — explicitly NOT an `INSUFFICIENT_BALANCE` (the treasury
+	* held the funds; the role's authority is what bound). `reason` discriminates
+	* the violated condition (`over_cap` / `daily_cap` / `not_member` /
+	* `disallowed_recipient` / `condition_violation`); leak-safe — no on-chain
+	* identifiers ever enter the details.
+	*/
+	rolePermissionDenied: (details) => new CapxulError("ROLE_PERMISSION_DENIED", `Org role denied this spend on-chain (${details.reason}).`, { details: details.operation === void 0 ? { reason: details.reason } : {
+		reason: details.reason,
+		operation: details.operation
+	} }),
+	/**
+	* A transaction (or sponsored UserOp) failed. `details.reason` discriminates
+	* the failure mode for callers that must distinguish a CONFIRMED on-chain
+	* revert (`"onchain_revert"` — the op executed and reverted, e.g. a Zodiac
+	* Roles condition violation) from an inconclusive infra failure. A confirmed
+	* revert is the ONLY mode the org spend port may map to a roles denial.
+	*/
+	transactionFailed: (operation, cause, extra) => new CapxulError("TRANSACTION_FAILED", `Transaction failed: ${operation}`, {
+		cause,
+		details: extra?.reason === void 0 ? { operation } : {
+			operation,
+			reason: extra.reason
+		}
+	}),
+	rateLimited: (details) => new CapxulError("RATE_LIMITED", "Rate limit exceeded", details === void 0 ? void 0 : { details: { ...details } }),
+	networkError: (operation, cause) => new CapxulError("NETWORK_ERROR", `Network error during ${operation}`, {
+		cause,
+		details: { operation }
+	}),
+	unknown: (cause) => new CapxulError("UNKNOWN", "Unknown error", { cause }),
+	otpExpired: (details) => new CapxulError("OTP_EXPIRED", "Verification code has expired. Request a new one.", details === void 0 ? void 0 : { details: { ...details } }),
+	signerRejected: (details) => new CapxulError("SIGNER_REJECTED", "Signer rejected the request.", {
+		cause: details.cause,
+		details: details.reason === void 0 ? { source: details.source } : {
+			source: details.source,
+			reason: details.reason
+		}
+	}),
+	cancelled: (details) => new CapxulError("CANCELLED", "Operation was cancelled.", details === void 0 ? void 0 : { details: { ...details } }),
+	/**
+	* Method called from a flow state where its precondition fails (TA16). The
+	* SDK's method API short-circuits with this error before driving the
+	* internal state machine. `currentState` is the Effect-machine snapshot
+	* tag (stringified — substrate is `@effect/experimental/Machine` per
+	* `docs/canon/decisions/state-machine-substrate.md`); `validStates`
+	* enumerates the states the method accepts.
+	*/
+	wrongState: (details) => new CapxulError("WRONG_STATE", `${details.method} called from state '${details.currentState}'; valid states: ${details.validStates.join(", ")}`, { details: {
+		...details,
+		validStates: [...details.validStates]
+	} })
+};
+//#endregion
+//#region ../errors/src/convex-error-decoding.ts
+const KNOWN_CODES = new Set(CAPXUL_ERROR_CODES);
+function isCapxulCode(value) {
+	return typeof value === "string" && KNOWN_CODES.has(value);
+}
+function reconstruct(serialized) {
+	if (!isCapxulCode(serialized.code)) return null;
+	return deserializeCapxulError({
+		code: serialized.code,
+		message: typeof serialized.message === "string" ? serialized.message : String(serialized.code),
+		...typeof serialized.details === "object" && serialized.details !== null && !Array.isArray(serialized.details) ? { details: serialized.details } : {},
+		...typeof serialized.correlationId === "string" ? { correlationId: serialized.correlationId } : {},
+		...typeof serialized.layer === "string" ? { layer: serialized.layer } : {}
+	});
+}
+function decodeConvexError(err) {
+	if (err === null || err === void 0) return null;
+	if (err instanceof CapxulError) return err;
+	if (typeof err !== "object") return null;
+	const record = err;
+	if (!("data" in record)) return null;
+	const data = record.data;
+	if (typeof data === "object" && data !== null) return reconstruct(data);
+	if (typeof data === "string") try {
+		const parsed = JSON.parse(data);
+		if (typeof parsed === "object" && parsed !== null) return reconstruct(parsed);
+	} catch {}
+	return null;
+}
+//#endregion
+//#region ../types/src/index.ts
+const EVM_ADDRESS_RE = /^0x[0-9a-f]{40}$/i;
+const BYTES32_RE = /^0x[0-9a-f]{64}$/i;
+const PUBLISHABLE_KEY_PATTERN = /^cap_pk_(test|live)_[0-9A-HJKMNP-TV-Z]{32}$/;
+const SUPPORTED_CURRENCIES = [
+	{
+		code: "USD",
+		symbol: "$",
+		name: "US Dollar"
+	},
+	{
+		code: "NGN",
+		symbol: "NGN",
+		name: "Nigerian Naira"
+	},
+	{
+		code: "GHS",
+		symbol: "GHS",
+		name: "Ghanaian Cedi"
+	},
+	{
+		code: "KES",
+		symbol: "KSh",
+		name: "Kenyan Shilling"
+	},
+	{
+		code: "UGX",
+		symbol: "USh",
+		name: "Ugandan Shilling"
+	}
+];
+const SUPPORTED_CURRENCY_CODES = SUPPORTED_CURRENCIES.map((currency) => currency.code);
+Object.fromEntries(SUPPORTED_CURRENCIES.map((currency) => [currency.code, currency.symbol]));
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const COUNTRY_CODE_RE = /^[A-Z]{2}$/;
+const ANONYMOUS_DISTINCT_ID_RE = /^anon_[a-zA-Z0-9-]+$/;
+const ACCOUNT_ID_RE = /^account_[0-9A-Za-z]+$/;
+const SUBACCOUNT_ID_RE = /^subaccount_[0-9A-Za-z]+$/;
+const APP_ID_RE = /^app_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+Math.floor(Number.MAX_SAFE_INTEGER / 1e3);
+function toAddress(raw) {
+	if (typeof raw !== "string" || !EVM_ADDRESS_RE.test(raw)) throw Errors.invalidInput("address", invalidValueReason("invalid EVM address format", raw));
+	return raw.toLowerCase();
+}
+function toEmail(raw) {
+	if (typeof raw !== "string" || !EMAIL_RE.test(raw)) throw Errors.invalidInput("email", invalidValueReason("must look like an email address", raw));
+	return raw.toLowerCase();
+}
+function toAuthUserId(raw) {
+	return toNonEmptyStringBrand(raw, "authUserId");
+}
+function toAnonymousDistinctId(raw) {
+	if (typeof raw !== "string" || !ANONYMOUS_DISTINCT_ID_RE.test(raw)) throw Errors.invalidInput("anonDistinctId", invalidValueReason("must be anon_ plus letters, digits, or hyphens", raw));
+	return raw;
+}
+function toAccountId(raw) {
+	if (typeof raw !== "string" || !ACCOUNT_ID_RE.test(raw)) throw Errors.invalidInput("accountId", invalidValueReason("must be account_ plus an alphanumeric id", raw));
+	return raw;
+}
+function toSubAccountId(raw) {
+	if (typeof raw !== "string" || !SUBACCOUNT_ID_RE.test(raw)) throw Errors.invalidInput("subAccountId", invalidValueReason("must be subaccount_ plus an alphanumeric id", raw));
+	return raw;
+}
+function toOrgId(raw) {
+	return toNonEmptyStringBrand(raw, "orgId");
+}
+function toAppId(raw) {
+	if (typeof raw !== "string" || !APP_ID_RE.test(raw)) throw Errors.invalidInput("appId", invalidValueReason("must be app_ plus a ULID", raw));
+	return raw;
+}
+function toAllowedOrigin(raw) {
+	if (typeof raw !== "string") throw Errors.invalidInput("allowedOrigin", "must be an http or https origin string");
+	const normalized = normalizeAllowedOrigin(raw);
+	if (normalized === null) throw Errors.invalidInput("allowedOrigin", invalidValueReason("must be an http or https origin", raw));
+	return normalized;
+}
+function toPublishableKeyId(raw) {
+	return toNonEmptyStringBrand(raw, "keyId");
+}
+function toDurationMs(raw) {
+	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw Errors.invalidInput("duration", invalidValueReason("must be a non-negative safe integer", raw));
+	return raw;
+}
+function toPublishableKey(raw) {
+	if (typeof raw !== "string" || !PUBLISHABLE_KEY_PATTERN.test(raw)) throw Errors.invalidInput("publishableKey", invalidValueReason("must match cap_pk_(test|live) plus 32 Crockford base32 chars", raw));
+	return raw;
+}
+function toEpochMs(raw) {
+	assertSafeNonNegativeInteger(raw, "epochMs");
+	return raw;
+}
+function toEpochSeconds(raw) {
+	assertSafeNonNegativeInteger(raw, "epochSeconds");
+	return raw;
+}
+function toChainId(raw) {
+	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw <= 0) throw Errors.invalidInput("chainId", invalidValueReason("must be a positive safe integer", raw));
+	return raw;
+}
+function toCountryCode(raw) {
+	if (typeof raw !== "string") throw Errors.invalidInput("countryCode", "must be a string");
+	const upper = raw.toUpperCase();
+	if (!COUNTRY_CODE_RE.test(upper)) throw Errors.invalidInput("countryCode", invalidValueReason("must be a 2-letter ISO 3166-1 alpha-2 code", raw));
+	return upper;
+}
+function toCurrencyCode(raw) {
+	if (typeof raw !== "string" || !SUPPORTED_CURRENCY_CODES.includes(raw)) throw Errors.invalidInput("currencyCode", invalidValueReason("unsupported currency", raw));
+	return raw;
+}
+function toKycTier(raw) {
+	if (typeof raw !== "number" || !Number.isInteger(raw) || raw < 0 || raw > 3) throw Errors.invalidInput("kycTier", invalidValueReason("must be an integer in [0, 3]", raw));
+	return raw;
+}
+function toRoleKey(raw) {
+	if (typeof raw !== "string" || !BYTES32_RE.test(raw)) throw Errors.invalidInput("roleKey", invalidValueReason("must be 0x + 64 hex chars", raw));
+	return raw.toLowerCase();
+}
+function toSessionToken(raw) {
+	if (typeof raw !== "string" || raw.length === 0) throw Errors.invalidInput("token", "must be a non-empty string");
+	return raw;
+}
+function toJwtToken(raw) {
+	if (typeof raw !== "string" || raw.length === 0) throw Errors.invalidInput("jwtToken", "must be a non-empty string");
+	return raw;
+}
+function toNonEmptyStringBrand(raw, field) {
+	if (typeof raw !== "string" || raw.length === 0) throw Errors.invalidInput(field, "must be a non-empty string");
+	return raw;
+}
+function assertSafeNonNegativeInteger(raw, field) {
+	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw Errors.invalidInput(field, invalidValueReason("must be a non-negative safe integer", raw));
+}
+function normalizeAllowedOrigin(raw) {
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		return null;
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+	if (parsed.hostname.includes("*")) return null;
+	return parsed.origin;
+}
+function invalidValueReason(prefix, raw) {
+	if (typeof raw === "string") return `${prefix}: ${raw.slice(0, 40)}`;
+	return `${prefix}: ${String(raw)}`;
+}
+//#endregion
+//#region src/ports/auth-cache.ts
+var AuthCacheError = class extends Data.TaggedError("AuthCacheError") {};
+var AuthCachePortTag = class extends Context.Tag("@capxul/sdk/ports/AuthCachePort")() {};
+//#endregion
+//#region src/adapters/auth-cache/serialization.ts
+function parseAuthSession(raw) {
+	if (typeof raw !== "object" || raw === null) return null;
+	const candidate = raw;
+	try {
+		return {
+			authUserId: toAuthUserId(candidate.authUserId),
+			email: toEmail(candidate.email),
+			token: toSessionToken(candidate.token),
+			expiresAt: toEpochMs(candidate.expiresAt)
+		};
+	} catch {
+		return null;
+	}
+}
+function parseCachedJwt(raw) {
+	if (typeof raw !== "object" || raw === null) return null;
+	const candidate = raw;
+	try {
+		return {
+			token: toJwtToken(candidate.token),
+			expEpochSeconds: toEpochSeconds(candidate.expEpochSeconds)
+		};
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/adapters/auth-cache/BrowserAuthCacheAdapter.ts
+const SESSION_KEY = "capxul.session";
+const JWT_KEY = "capxul.jwt";
+var BrowserAuthCacheAdapter = class {
+	storage;
+	constructor(storage) {
+		this.storage = storage;
+	}
+	getSession = authCacheTry("getSession", () => {
+		const raw = this.storage.getItem(SESSION_KEY);
+		if (raw === null) return null;
+		try {
+			return parseAuthSession(JSON.parse(raw));
+		} catch {
+			return null;
+		}
+	});
+	setSession = (session) => authCacheTry("setSession", () => {
+		this.storage.setItem(SESSION_KEY, JSON.stringify(session));
+	});
+	clearSession = authCacheTry("clearSession", () => {
+		this.storage.removeItem(SESSION_KEY);
+	});
+	getJwt = authCacheTry("getJwt", () => {
+		const raw = this.storage.getItem(JWT_KEY);
+		if (raw === null) return null;
+		try {
+			return parseCachedJwt(JSON.parse(raw));
+		} catch {
+			return null;
+		}
+	});
+	setJwt = (jwt) => authCacheTry("setJwt", () => {
+		this.storage.setItem(JWT_KEY, JSON.stringify(jwt));
+	});
+	clearJwt = authCacheTry("clearJwt", () => {
+		this.storage.removeItem(JWT_KEY);
+	});
+};
+function toAuthCacheError(operation, cause) {
+	return new AuthCacheError({
+		operation,
+		cause
+	});
+}
+function authCacheTry(operation, run) {
+	return Effect.try({
+		try: run,
+		catch: (cause) => toAuthCacheError(operation, cause)
+	});
+}
+//#endregion
+//#region src/adapters/auth-cache/InMemoryAuthCacheAdapter.ts
+var InMemoryAuthCacheAdapter = class {
+	session = null;
+	jwt = null;
+	getSession = Effect.sync(() => this.session);
+	setSession = (session) => Effect.sync(() => {
+		this.session = session;
+	});
+	clearSession = Effect.sync(() => {
+		this.session = null;
+	});
+	getJwt = Effect.sync(() => this.jwt);
+	setJwt = (jwt) => Effect.sync(() => {
+		this.jwt = jwt;
+	});
+	clearJwt = Effect.sync(() => {
+		this.jwt = null;
+	});
+};
+Layer.effect(AuthCachePortTag, Effect.sync(() => new InMemoryAuthCacheAdapter()).pipe(Effect.mapError((cause) => new AuthCacheError({
+	operation: "initialize",
+	cause
+}))));
+//#endregion
+export { toSessionToken as A, toEpochSeconds as C, toPublishableKey as D, toOrgId as E, isCapxulError as F, decodeConvexError as M, CapxulError as N, toPublishableKeyId as O, Errors as P, toEpochMs as S, toKycTier as T, toChainId as _, AuthCacheError as a, toDurationMs as b, BYTES32_RE as c, toAccountId as d, toAddress as f, toAuthUserId as g, toAppId as h, parseCachedJwt as i, toSubAccountId as j, toRoleKey as k, EVM_ADDRESS_RE as l, toAnonymousDistinctId as m, BrowserAuthCacheAdapter as n, AuthCachePortTag as o, toAllowedOrigin as p, parseAuthSession as r, APP_ID_RE as s, InMemoryAuthCacheAdapter as t, SUPPORTED_CURRENCY_CODES as u, toCountryCode as v, toJwtToken as w, toEmail as x, toCurrencyCode as y };
+
+//# sourceMappingURL=InMemoryAuthCacheAdapter-v5W-XB5M.mjs.map

package/dist/InMemoryAuthCacheAdapter-v5W-XB5M.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"InMemoryAuthCacheAdapter-v5W-XB5M.mjs","names":[],"sources":["../../errors/src/errors.ts","../../errors/src/convex-error-decoding.ts","../../types/src/index.ts","../src/ports/auth-cache.ts","../src/adapters/auth-cache/serialization.ts","../src/adapters/auth-cache/BrowserAuthCacheAdapter.ts","../src/adapters/auth-cache/InMemoryAuthCacheAdapter.ts"],"sourcesContent":["// The canonical error-code catalog as a runtime constant. `CapxulErrorCode`\n// is derived from it so the type and any runtime check that needs to\n// enumerate codes (e.g. the convex-error codec's `KNOWN_CODES`) share a\n// single source of truth — a TypeScript union alone can't be introspected\n// at runtime, which previously forced a hand-maintained duplicate.\nexport const CAPXUL_ERROR_CODES = [\n  \"NOT_AUTHENTICATED\",\n  \"EMAIL_DELIVERY_FAILED\",\n  \"PROFILE_NOT_FOUND\",\n  \"SMART_ACCOUNT_MISSING\",\n  \"PLAYER_NOT_FOUND\",\n  \"ACCOUNT_NOT_FOUND\",\n  \"PROVIDER_ERROR\",\n  \"INVALID_INPUT\",\n  \"ENV_MISSING\",\n  \"NOT_IMPLEMENTED\",\n  \"VERIFICATION_REQUIRED\",\n  \"INSUFFICIENT_BALANCE\",\n  \"INVALID_RECIPIENT\",\n  \"ROLE_PERMISSION_DENIED\",\n  \"TRANSACTION_FAILED\",\n  \"RATE_LIMITED\",\n  \"NETWORK_ERROR\",\n  \"UNKNOWN\",\n  \"OTP_EXPIRED\",\n  \"SIGNER_REJECTED\",\n  \"CANCELLED\",\n  \"WRONG_STATE\",\n] as const;\n\nexport type CapxulErrorCode = (typeof CAPXUL_ERROR_CODES)[number];\n\n/**\n * Why an auth/provider call failed — a flat CAUSE enum. The *where* (which\n * OpenFort operation) stays in the separate `operation` detail field; this\n * names the root cause so a single `$exception` can be triaged without\n * parsing the message. Five members, no free strings:\n *\n * - `auth-origin-mismatch`: OTP cookies live on `localhost:PORT` but OpenFort\n *   hits the Convex host → no session reaches the provider.\n * - `stale-openfort-cache`: an old `userId` in scoped storage makes the SDK\n *   skip re-auth → 401 on `v2/accounts`.\n * - `app-env-allowlist`: missing `VITE_CAPXUL_CONVEX_SITE_URL` / the origin is\n *   not allowlisted → 401.\n * - `no-secure-context`: sandboxed/headless browser with no Web Crypto, so\n *   `getAddress`/`configure` can never produce an address. Previously vanished\n *   into `unknown`; the signer's secure-context probe now names it.\n * - `unknown`: catch-all when no cause could be determined.\n */\nexport type FailureMode =\n  | \"auth-origin-mismatch\"\n  | \"stale-openfort-cache\"\n  | \"app-env-allowlist\"\n  | \"no-secure-context\"\n  | \"unknown\";\n\nexport type CapxulErrorDetails = Record<string, unknown>;\n\nexport type SignerSource = \"openfort-embedded\" | \"injected-eip1193\" | \"local-private-key\";\n\nexport type VerificationRequiredDetails =\n  | { readonly requiredTier: number }\n  | { readonly rail: string; readonly currentKind: string };\n\nexport type SerializedCapxulError = {\n  readonly code: CapxulErrorCode;\n  readonly message: string;\n  readonly details?: CapxulErrorDetails;\n  readonly correlationId?: string;\n  readonly layer?: string;\n};\n\nexport type CapxulErrorOptions = {\n  readonly cause?: unknown;\n  readonly details?: CapxulErrorDetails;\n  readonly correlationId?: string;\n  readonly layer?: string;\n};\n\nexport class CapxulError extends Error {\n  readonly code: CapxulErrorCode;\n  readonly details?: CapxulErrorDetails;\n  readonly correlationId?: string;\n  readonly layer?: string;\n\n  constructor(code: CapxulErrorCode, message: string, options: CapxulErrorOptions = {}) {\n    super(message, \"cause\" in options ? { cause: options.cause } : undefined);\n    this.name = \"CapxulError\";\n    this.code = code;\n    if (options.details !== undefined) {\n      this.details = options.details;\n    }\n    if (options.correlationId !== undefined) {\n      this.correlationId = options.correlationId;\n    }\n    if (options.layer !== undefined) {\n      this.layer = options.layer;\n    }\n  }\n}\n\nexport function isCapxulError(value: unknown): value is CapxulError {\n  return value instanceof CapxulError;\n}\n\nexport function serializeCapxulError(error: CapxulError): SerializedCapxulError {\n  return compactSerialized({\n    code: error.code,\n    message: error.message,\n    details: error.details,\n    correlationId: error.correlationId,\n    layer: error.layer,\n  });\n}\n\nexport function deserializeCapxulError(serialized: SerializedCapxulError): CapxulError {\n  return new CapxulError(\n    serialized.code,\n    serialized.message,\n    compactErrorOptions({\n      details: serialized.details,\n      correlationId: serialized.correlationId,\n      layer: serialized.layer,\n    }),\n  );\n}\n\nfunction compactSerialized(serialized: {\n  readonly code: CapxulErrorCode;\n  readonly message: string;\n  readonly details: CapxulErrorDetails | undefined;\n  readonly correlationId: string | undefined;\n  readonly layer: string | undefined;\n}): SerializedCapxulError {\n  const result: {\n    code: CapxulErrorCode;\n    message: string;\n    details?: CapxulErrorDetails;\n    correlationId?: string;\n    layer?: string;\n  } = {\n    code: serialized.code,\n    message: serialized.message,\n  };\n\n  if (serialized.details !== undefined) {\n    result.details = serialized.details;\n  }\n  if (serialized.correlationId !== undefined) {\n    result.correlationId = serialized.correlationId;\n  }\n  if (serialized.layer !== undefined) {\n    result.layer = serialized.layer;\n  }\n\n  return result;\n}\n\nfunction compactErrorOptions(options: {\n  readonly cause?: unknown;\n  readonly details: CapxulErrorDetails | undefined;\n  readonly correlationId: string | undefined;\n  readonly layer: string | undefined;\n}): CapxulErrorOptions {\n  const result: {\n    cause?: unknown;\n    details?: CapxulErrorDetails;\n    correlationId?: string;\n    layer?: string;\n  } = {};\n\n  if (\"cause\" in options) {\n    result.cause = options.cause;\n  }\n  if (options.details !== undefined) {\n    result.details = options.details;\n  }\n  if (options.correlationId !== undefined) {\n    result.correlationId = options.correlationId;\n  }\n  if (options.layer !== undefined) {\n    result.layer = options.layer;\n  }\n\n  return result;\n}\n\nexport const Errors = {\n  notAuthenticated: (message?: string, opts?: { readonly failure_mode?: FailureMode }) =>\n    new CapxulError(\n      \"NOT_AUTHENTICATED\",\n      message ?? \"Not authenticated\",\n      opts?.failure_mode ? { details: { failure_mode: opts.failure_mode } } : undefined,\n    ),\n  emailDeliveryFailed: (detail: string) =>\n    new CapxulError(\"EMAIL_DELIVERY_FAILED\", \"Failed to send email\", {\n      details: { detail },\n    }),\n\n  profileNotFound: (authUserId: string) =>\n    new CapxulError(\"PROFILE_NOT_FOUND\", `Profile not found for user ${authUserId}`, {\n      details: { authUserId },\n    }),\n\n  smartAccountMissing: (authUserId: string) =>\n    new CapxulError(\"SMART_ACCOUNT_MISSING\", \"Smart account not provisioned\", {\n      details: { authUserId },\n    }),\n\n  playerNotFound: (playerId?: string) =>\n    new CapxulError(\n      \"PLAYER_NOT_FOUND\",\n      playerId ? `Openfort player ${playerId} not found` : \"Openfort player not found\",\n      playerId === undefined ? undefined : { details: { playerId } },\n    ),\n\n  accountNotFound: (accountId?: string) =>\n    new CapxulError(\n      \"ACCOUNT_NOT_FOUND\",\n      accountId ? `Openfort account ${accountId} not found` : \"Openfort account not found\",\n      accountId === undefined ? undefined : { details: { accountId } },\n    ),\n\n  providerError: (\n    provider: string,\n    operation: string,\n    cause: unknown,\n    opts?: { readonly failure_mode?: FailureMode },\n  ) => {\n    const details: Record<string, unknown> = { provider, operation };\n    if (opts?.failure_mode) {\n      details.failure_mode = opts.failure_mode;\n    }\n    return new CapxulError(\"PROVIDER_ERROR\", `Provider error: ${provider} ${operation}`, {\n      cause,\n      details,\n    });\n  },\n\n  invalidInput: (field: string, reason: string) =>\n    new CapxulError(\"INVALID_INPUT\", `Invalid ${field}: ${reason}`, {\n      details: { field, reason },\n    }),\n\n  envMissing: (name: string) =>\n    new CapxulError(\"ENV_MISSING\", `Environment variable ${name} not configured`, {\n      details: { name },\n    }),\n\n  notImplemented: (domain: string, method: string) =>\n    new CapxulError(\n      \"NOT_IMPLEMENTED\",\n      `${domain}.${method} is not yet implemented. This feature is planned for a future release.`,\n      { details: { domain, method } },\n    ),\n\n  /**\n   * Sibling factory to {@link Errors.providerError} for the per-state timeout\n   * path in flows (initially ProvisioningFlow's mint_openfort / deploy_safe /\n   * register_indexer `after:` timers). Same `PROVIDER_ERROR` code as\n   * `providerError`, plus a `details.reason: \"timeout\"` discriminator so\n   * downstream observers can distinguish failure modes without parsing the\n   * message string. The redacted message names the timeout budget; the\n   * native `cause` carries the same information for `reportError` fidelity.\n   */\n  providerTimeout: (provider: string, operation: string, timeoutMs: number) =>\n    new CapxulError(\n      \"PROVIDER_ERROR\",\n      `Provider error: ${provider} ${operation} (timeout exceeded ${timeoutMs}ms)`,\n      {\n        details: { provider, operation, reason: \"timeout\" },\n        cause: new Error(`timeout: ${operation} exceeded ${timeoutMs}ms`),\n      },\n    ),\n\n  verificationRequired: (details: VerificationRequiredDetails) => {\n    const message =\n      \"rail\" in details\n        ? `Verification is required before ${details.rail} can use ${details.currentKind}.`\n        : `Verification tier ${details.requiredTier} is required.`;\n\n    return new CapxulError(\"VERIFICATION_REQUIRED\", message, {\n      details,\n    });\n  },\n\n  insufficientBalance: (asset: string, available: string, required: string) =>\n    new CapxulError(\"INSUFFICIENT_BALANCE\", `Insufficient ${asset} balance`, {\n      details: { asset, available, required },\n    }),\n\n  invalidRecipient: (reason: string) =>\n    new CapxulError(\"INVALID_RECIPIENT\", `Invalid recipient: ${reason}`, {\n      details: { reason },\n    }),\n\n  /**\n   * The org Zodiac Roles modifier REFUSED the spend on-chain (G4 · #547): the\n   * member's role condition (per-tx cap, per-day allowance, allowed recipient,\n   * or membership) was violated, so `execTransactionWithRole` reverted. This is\n   * a PERMISSION denial — explicitly NOT an `INSUFFICIENT_BALANCE` (the treasury\n   * held the funds; the role's authority is what bound). `reason` discriminates\n   * the violated condition (`over_cap` / `daily_cap` / `not_member` /\n   * `disallowed_recipient` / `condition_violation`); leak-safe — no on-chain\n   * identifiers ever enter the details.\n   */\n  rolePermissionDenied: (details: {\n    readonly reason:\n      | \"over_cap\"\n      | \"daily_cap\"\n      | \"not_member\"\n      | \"disallowed_recipient\"\n      | \"condition_violation\";\n    readonly operation?: string;\n  }) =>\n    new CapxulError(\n      \"ROLE_PERMISSION_DENIED\",\n      `Org role denied this spend on-chain (${details.reason}).`,\n      {\n        details:\n          details.operation === undefined\n            ? { reason: details.reason }\n            : { reason: details.reason, operation: details.operation },\n      },\n    ),\n\n  /**\n   * A transaction (or sponsored UserOp) failed. `details.reason` discriminates\n   * the failure mode for callers that must distinguish a CONFIRMED on-chain\n   * revert (`\"onchain_revert\"` — the op executed and reverted, e.g. a Zodiac\n   * Roles condition violation) from an inconclusive infra failure. A confirmed\n   * revert is the ONLY mode the org spend port may map to a roles denial.\n   */\n  transactionFailed: (operation: string, cause?: unknown, extra?: { readonly reason?: string }) =>\n    new CapxulError(\"TRANSACTION_FAILED\", `Transaction failed: ${operation}`, {\n      cause,\n      details: extra?.reason === undefined ? { operation } : { operation, reason: extra.reason },\n    }),\n\n  rateLimited: (details?: { readonly retryAfterMs?: number; readonly resource?: string }) =>\n    new CapxulError(\n      \"RATE_LIMITED\",\n      \"Rate limit exceeded\",\n      details === undefined ? undefined : { details: { ...details } },\n    ),\n\n  networkError: (operation: string, cause?: unknown) =>\n    new CapxulError(\"NETWORK_ERROR\", `Network error during ${operation}`, {\n      cause,\n      details: { operation },\n    }),\n\n  unknown: (cause?: unknown) => new CapxulError(\"UNKNOWN\", \"Unknown error\", { cause }),\n\n  otpExpired: (details?: { readonly email?: string; readonly expiredAt?: number }) =>\n    new CapxulError(\n      \"OTP_EXPIRED\",\n      \"Verification code has expired. Request a new one.\",\n      details === undefined ? undefined : { details: { ...details } },\n    ),\n\n  signerRejected: (details: {\n    readonly source: SignerSource;\n    readonly reason?: string;\n    readonly cause?: unknown;\n  }) =>\n    new CapxulError(\"SIGNER_REJECTED\", \"Signer rejected the request.\", {\n      cause: details.cause,\n      details:\n        details.reason === undefined\n          ? { source: details.source }\n          : { source: details.source, reason: details.reason },\n    }),\n\n  cancelled: (details?: { readonly operation?: string; readonly reason?: string }) =>\n    new CapxulError(\n      \"CANCELLED\",\n      \"Operation was cancelled.\",\n      details === undefined ? undefined : { details: { ...details } },\n    ),\n\n  /**\n   * Method called from a flow state where its precondition fails (TA16). The\n   * SDK's method API short-circuits with this error before driving the\n   * internal state machine. `currentState` is the Effect-machine snapshot\n   * tag (stringified — substrate is `@effect/experimental/Machine` per\n   * `docs/canon/decisions/state-machine-substrate.md`); `validStates`\n   * enumerates the states the method accepts.\n   */\n  wrongState: (details: {\n    readonly method: string;\n    readonly currentState: string;\n    readonly validStates: readonly string[];\n  }) =>\n    new CapxulError(\n      \"WRONG_STATE\",\n      `${details.method} called from state '${details.currentState}'; valid states: ${details.validStates.join(\", \")}`,\n      { details: { ...details, validStates: [...details.validStates] } },\n    ),\n} as const;\n","// Shared `decodeConvexError` helper (TA5) — used by both the SDK's\n// `ConvexCallAdapter.mapToCapxulError` AND the backend `credentials/http.ts`\n// `bootstrapClient` handler. Single source of truth for cross-Convex-boundary\n// error decoding rules.\n//\n// Recognizes the `ConvexError(SerializedCapxulError)` object-shape produced by\n// `withErrorBoundary` (Probe B finding, 2026-05-19):\n//\n//   { name: \"ConvexError\", data: { code, message, details?, correlationId?, layer? } }\n//\n// AND the defensive string-shape branch for older Convex versions where\n// `data` is a JSON-serialized string. Pass-through for raw `CapxulError`\n// instances (which arrive directly when the throw happened in the same\n// V8 isolate as the catch). Returns null when the value is not a\n// recognizable shape — the caller falls back to NETWORK_ERROR + reportError.\n\nimport {\n  CAPXUL_ERROR_CODES,\n  CapxulError,\n  type CapxulErrorCode,\n  type SerializedCapxulError,\n  deserializeCapxulError,\n} from \"./errors.ts\";\n\n// Derived from the canonical catalog in errors.ts — single source of truth,\n// so a new code added to `CAPXUL_ERROR_CODES` is recognized here automatically.\nconst KNOWN_CODES: ReadonlySet<CapxulErrorCode> = new Set(CAPXUL_ERROR_CODES);\n\nfunction isCapxulCode(value: unknown): value is CapxulErrorCode {\n  return typeof value === \"string\" && KNOWN_CODES.has(value as CapxulErrorCode);\n}\n\nfunction reconstruct(serialized: Record<string, unknown>): CapxulError | null {\n  if (!isCapxulCode(serialized.code)) return null;\n  const payload: SerializedCapxulError = {\n    code: serialized.code,\n    message: typeof serialized.message === \"string\" ? serialized.message : String(serialized.code),\n    ...(typeof serialized.details === \"object\" &&\n    serialized.details !== null &&\n    !Array.isArray(serialized.details)\n      ? { details: serialized.details as Record<string, unknown> }\n      : {}),\n    ...(typeof serialized.correlationId === \"string\"\n      ? { correlationId: serialized.correlationId }\n      : {}),\n    ...(typeof serialized.layer === \"string\" ? { layer: serialized.layer } : {}),\n  };\n  return deserializeCapxulError(payload);\n}\n\nexport function decodeConvexError(err: unknown): CapxulError | null {\n  if (err === null || err === undefined) return null;\n\n  // Pass-through: same isolate, real CapxulError instance.\n  if (err instanceof CapxulError) return err;\n\n  if (typeof err !== \"object\") return null;\n\n  // The canonical shape produced by `withErrorBoundary` then crossed by\n  // Convex's `ctx.runQuery` / `ConvexHttpClient`: a `ConvexError` whose\n  // `data` is the `SerializedCapxulError` object literal.\n  const record = err as Record<string, unknown>;\n  if (!(\"data\" in record)) return null;\n  const data = record.data;\n\n  if (typeof data === \"object\" && data !== null) {\n    return reconstruct(data as Record<string, unknown>);\n  }\n\n  // Defensive depth — some Convex versions JSON-stringify the data at\n  // the runtime boundary. Probe B confirmed @convex-dev/better-auth 0.10.13\n  // + convex 1.39.x do NOT do this, but the cheap parse keeps forward\n  // compatibility.\n  if (typeof data === \"string\") {\n    try {\n      const parsed = JSON.parse(data) as unknown;\n      if (typeof parsed === \"object\" && parsed !== null) {\n        return reconstruct(parsed as Record<string, unknown>);\n      }\n    } catch {\n      // Fall through.\n    }\n  }\n\n  return null;\n}\n","import { Errors } from \"@capxul/errors\";\nimport type { Brand } from \"./brand\";\n\nexport type { Brand } from \"./brand\";\n\nexport type Address = Brand<string, \"Address\">;\nexport type Email = Brand<string, \"Email\">;\nexport type Identity = Brand<string, \"Identity\">;\n// `Profile` is the SDK's user-shaped record returned by `IdentityPort`. Pure\n// record of brand-typed fields — not itself a brand. The field-level brands\n// satisfy `IdentityPort` clause I8 at compile time. Hosted here per the\n// canon (`docs/canon/ports/identity.md`).\nexport type Profile = {\n  readonly authUserId: AuthUserId;\n  readonly email: Email;\n  readonly displayName: string | null;\n  readonly country: CountryCode | null;\n  readonly kycTier: KycTier;\n  readonly createdAt: EpochMs;\n  readonly updatedAt: EpochMs;\n};\n// `SmartAccount` is the SDK's ERC-4337 record returned by `SmartAccountPort`.\n// Pure record of brand-typed fields — not itself a brand. `deployedAt` is\n// nullable: `null` means the address is counterfactual (derived, not yet\n// on-chain). PRD #462 (derivation v2): `signerAddress` is the CLAIMED owner —\n// `null` until the claim userOp installs the user's signer (`claimedAt`\n// records that event); the address derives from the email alone. Hosted here\n// per the canon (`docs/canon/ports/smart-account.md`).\nexport type SmartAccount = {\n  readonly authUserId: AuthUserId;\n  readonly signerAddress: Address | null;\n  readonly smartAccountAddress: Address;\n  readonly chainId: ChainId;\n  readonly deployedAt: EpochMs | null;\n  readonly claimedAt: EpochMs | null;\n  readonly createdAt: EpochMs;\n};\n// `Money` is the SDK's consumer-facing value type (canon\n// `account-balance-model.md` §10). Every public monetary value is a `Money`\n// — never wei, never raw token units. `value` is a major-unit decimal string\n// (e.g. \"1.5\" USD); `decimals` is the on-chain token precision used for the\n// internal `fromWei`/`toWei` round-trip at the SDK boundary (USDX is 6).\n// Pure record of a brand-typed field + primitives — not itself a brand.\nexport type Money = {\n  readonly currency: CurrencyCode;\n  readonly value: string;\n  readonly decimals: number;\n};\n\n// `Account` is the SDK's logical money account (canon §6, §9). `id` is the\n// `account_`-shaped `AccountId` — NOT the Safe address and NOT an Openfort id.\n// `balance` is the Safe's top-line holdings; `available` is money not assigned\n// to any sub-account (canon §5/§12). With no sub-accounts (Slice 1a),\n// `available === balance`. Pure record of brand-typed fields — not a brand.\nexport type Account = {\n  readonly id: AccountId;\n  readonly balance: Money;\n  readonly available: Money;\n};\n\n/** Named bucket partitioning a logical Account (canon §9). */\nexport type SubAccount = {\n  readonly id: SubAccountId;\n  readonly accountId: AccountId;\n  readonly name: string;\n  readonly balance: Money;\n  readonly createdAt: EpochMs;\n};\n\nexport type AuthUserId = Brand<string, \"AuthUserId\">;\nexport type AnonymousDistinctId = Brand<string, \"AnonymousDistinctId\">;\nexport type PlayerId = Brand<string, \"PlayerId\">;\nexport type AccountId = Brand<string, \"AccountId\">;\nexport type SubAccountId = Brand<string, \"SubAccountId\">;\nexport type OrgId = Brand<string, \"OrgId\">;\nexport type AppId = Brand<string, \"AppId\">;\nexport type AllowedOrigin = Brand<string, \"AllowedOrigin\">;\nexport type PublishableKey = Brand<string, \"PublishableKey\">;\nexport type PublishableKeyId = Brand<string, \"PublishableKeyId\">;\nexport type DurationMs = Brand<number, \"DurationMs\">;\n// `DeveloperApplication` and `PublishableKeyRecord` are the SDK's record\n// shapes returned by `CredentialsPort`. Pure records of brand-typed fields\n// — not themselves brands. The field-level brands satisfy CR13 + the record\n// branding clauses of `credentials.test-d.ts` at compile time. Hosted here\n// per the canon (`docs/canon/ports/credentials.md`).\nexport type DeveloperApplication = {\n  readonly id: AppId;\n  readonly authUserId: AuthUserId;\n  readonly name: string;\n  readonly allowedOrigins: readonly AllowedOrigin[];\n  readonly createdAt: EpochMs;\n  readonly archivedAt: EpochMs | null;\n};\nexport type PublishableKeyRecord = {\n  readonly id: PublishableKeyId;\n  readonly applicationId: AppId;\n  readonly activeFromMs: EpochMs;\n  readonly gracePeriodEndsMs: EpochMs | null;\n  readonly revokedAt: EpochMs | null;\n};\nexport type TxHash = Brand<string, \"TxHash\">;\nexport type DocumentHash = Brand<string, \"DocumentHash\">;\nexport type EpochMs = Brand<number, \"EpochMs\">;\nexport type EpochSeconds = Brand<number, \"EpochSeconds\">;\nexport type ChainId = Brand<number, \"ChainId\">;\nexport type CountryCode = Brand<string, \"CountryCode\">;\nexport type CurrencyCode = Brand<SupportedCurrencyCode, \"CurrencyCode\">;\nexport type KycTier = Brand<0 | 1 | 2 | 3, \"KycTier\">;\nexport type BlockNumber = Brand<number, \"BlockNumber\">;\nexport type LogIndex = Brand<number, \"LogIndex\">;\nexport type WeiAmount = Brand<string, \"WeiAmount\">;\nexport type SafeAddress = Brand<string, \"SafeAddress\">;\nexport type ModuleAddress = Brand<string, \"ModuleAddress\">;\nexport type RunId = Brand<string, \"RunId\">;\nexport type RoleKey = Brand<string, \"RoleKey\">;\nexport type AllowanceKey = Brand<string, \"AllowanceKey\">;\nexport type SessionToken = Brand<string, \"SessionToken\">;\nexport type JwtToken = Brand<string, \"JwtToken\">;\n\n// `AuthSession` is the record type shared by `AuthClientPort` and\n// `SessionStoragePort`. Hosted here per the canon\n// (`docs/canon/ports/auth-client.md`) so both ports depend on it\n// symmetrically. Every field is branded — field-level brands satisfy the\n// AuthSession branding contract asserted in `auth-client.test-d.ts`.\nexport type AuthSession = {\n  readonly authUserId: AuthUserId;\n  readonly email: Email;\n  readonly token: SessionToken;\n  readonly expiresAt: EpochMs;\n};\n\nexport const EVM_ADDRESS_RE = /^0x[0-9a-f]{40}$/i;\nexport const BYTES32_RE = /^0x[0-9a-f]{64}$/i;\nexport const PUBLISHABLE_KEY_PATTERN = /^cap_pk_(test|live)_[0-9A-HJKMNP-TV-Z]{32}$/;\nexport const SUPPORTED_CURRENCIES = [\n  { code: \"USD\", symbol: \"$\", name: \"US Dollar\" },\n  { code: \"NGN\", symbol: \"NGN\", name: \"Nigerian Naira\" },\n  { code: \"GHS\", symbol: \"GHS\", name: \"Ghanaian Cedi\" },\n  { code: \"KES\", symbol: \"KSh\", name: \"Kenyan Shilling\" },\n  { code: \"UGX\", symbol: \"USh\", name: \"Ugandan Shilling\" },\n] as const;\nexport const SUPPORTED_CURRENCY_CODES = SUPPORTED_CURRENCIES.map((currency) => currency.code);\ntype SupportedCurrencyCode = (typeof SUPPORTED_CURRENCIES)[number][\"code\"];\nexport const CURRENCY_SYMBOLS = Object.fromEntries(\n  SUPPORTED_CURRENCIES.map((currency) => [currency.code, currency.symbol]),\n) as Record<SupportedCurrencyCode, string>;\n\nconst EMAIL_RE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\nconst COUNTRY_CODE_RE = /^[A-Z]{2}$/;\nconst ANONYMOUS_DISTINCT_ID_RE = /^anon_[a-zA-Z0-9-]+$/;\n// Canon §6: the logical Account brand is `account_`-shaped. The tail mirrors\n// the `app_` ULID-shape generator (`account_<26 Crockford base32 chars>`) but\n// the brand only enforces the `account_` prefix + a non-empty alphanumeric\n// tail so existing opaque test ids (`account_123`) and generated ULIDs both\n// satisfy it.\nconst ACCOUNT_ID_RE = /^account_[0-9A-Za-z]+$/;\nconst SUBACCOUNT_ID_RE = /^subaccount_[0-9A-Za-z]+$/;\n// Exported so `@capxul/wire`'s `AppIdSchema` can reuse the same regex via\n// `Schema.filter(...)` and stay in lockstep with `toAppId` (Decision 2,\n// 2b parity).\nexport const APP_ID_RE = /^app_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;\nconst TX_HASH_RE = /^0x[0-9a-f]{64}$/i;\nconst DOCUMENT_HASH_HEX_RE = /^[0-9a-fA-F]{64}$/;\nconst WEI_RE = /^[0-9]+$/;\nconst RUN_ID_RE = /^run_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;\nconst MAX_SAFE_EPOCH_SECONDS = Math.floor(Number.MAX_SAFE_INTEGER / 1000);\n\nexport function toAddress(raw: unknown): Address {\n  if (typeof raw !== \"string\" || !EVM_ADDRESS_RE.test(raw)) {\n    throw Errors.invalidInput(\"address\", invalidValueReason(\"invalid EVM address format\", raw));\n  }\n\n  return raw.toLowerCase() as Address;\n}\n\nexport function isEvmAddress(raw: unknown): raw is string {\n  return typeof raw === \"string\" && EVM_ADDRESS_RE.test(raw);\n}\n\nexport function toEmail(raw: unknown): Email {\n  if (typeof raw !== \"string\" || !EMAIL_RE.test(raw)) {\n    throw Errors.invalidInput(\"email\", invalidValueReason(\"must look like an email address\", raw));\n  }\n\n  return raw.toLowerCase() as Email;\n}\n\nexport function toIdentity(raw: unknown): Identity {\n  return toNonEmptyStringBrand(raw, \"identity\") as Identity;\n}\n\nexport function toAuthUserId(raw: unknown): AuthUserId {\n  return toNonEmptyStringBrand(raw, \"authUserId\") as AuthUserId;\n}\n\nexport function toAnonymousDistinctId(raw: unknown): AnonymousDistinctId {\n  if (typeof raw !== \"string\" || !ANONYMOUS_DISTINCT_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"anonDistinctId\",\n      invalidValueReason(\"must be anon_ plus letters, digits, or hyphens\", raw),\n    );\n  }\n\n  return raw as AnonymousDistinctId;\n}\n\nexport function toPlayerId(raw: unknown): PlayerId {\n  return toNonEmptyStringBrand(raw, \"playerId\") as PlayerId;\n}\n\nexport function toAccountId(raw: unknown): AccountId {\n  if (typeof raw !== \"string\" || !ACCOUNT_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"accountId\",\n      invalidValueReason(\"must be account_ plus an alphanumeric id\", raw),\n    );\n  }\n\n  return raw as AccountId;\n}\n\nexport function toSubAccountId(raw: unknown): SubAccountId {\n  if (typeof raw !== \"string\" || !SUBACCOUNT_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"subAccountId\",\n      invalidValueReason(\"must be subaccount_ plus an alphanumeric id\", raw),\n    );\n  }\n\n  return raw as SubAccountId;\n}\n\nexport function toOrgId(raw: unknown): OrgId {\n  return toNonEmptyStringBrand(raw, \"orgId\") as OrgId;\n}\n\nexport function toAppId(raw: unknown): AppId {\n  if (typeof raw !== \"string\" || !APP_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\"appId\", invalidValueReason(\"must be app_ plus a ULID\", raw));\n  }\n\n  return raw as AppId;\n}\n\nexport function toAllowedOrigin(raw: unknown): AllowedOrigin {\n  if (typeof raw !== \"string\") {\n    throw Errors.invalidInput(\"allowedOrigin\", \"must be an http or https origin string\");\n  }\n\n  const normalized = normalizeAllowedOrigin(raw);\n  if (normalized === null) {\n    throw Errors.invalidInput(\n      \"allowedOrigin\",\n      invalidValueReason(\"must be an http or https origin\", raw),\n    );\n  }\n\n  return normalized as AllowedOrigin;\n}\n\nexport function toPublishableKeyId(raw: unknown): PublishableKeyId {\n  return toNonEmptyStringBrand(raw, \"keyId\") as PublishableKeyId;\n}\n\nexport function toDurationMs(raw: unknown): DurationMs {\n  if (typeof raw !== \"number\" || !Number.isSafeInteger(raw) || raw < 0) {\n    throw Errors.invalidInput(\n      \"duration\",\n      invalidValueReason(\"must be a non-negative safe integer\", raw),\n    );\n  }\n\n  return raw as DurationMs;\n}\n\nexport function toPublishableKey(raw: unknown): PublishableKey {\n  if (typeof raw !== \"string\" || !PUBLISHABLE_KEY_PATTERN.test(raw)) {\n    throw Errors.invalidInput(\n      \"publishableKey\",\n      invalidValueReason(\"must match cap_pk_(test|live) plus 32 Crockford base32 chars\", raw),\n    );\n  }\n\n  return raw as PublishableKey;\n}\n\nexport function toTxHash(raw: unknown): TxHash {\n  if (typeof raw !== \"string\" || !TX_HASH_RE.test(raw)) {\n    throw Errors.invalidInput(\"txHash\", invalidValueReason(\"must be 0x + 64 hex chars\", raw));\n  }\n\n  return raw.toLowerCase() as TxHash;\n}\n\nexport function toDocumentHash(raw: unknown): DocumentHash {\n  if (typeof raw !== \"string\") {\n    throw Errors.invalidInput(\"documentHash\", \"must be a string\");\n  }\n\n  const stripped = raw.startsWith(\"0x\") || raw.startsWith(\"0X\") ? raw.slice(2) : raw;\n  if (!DOCUMENT_HASH_HEX_RE.test(stripped)) {\n    throw Errors.invalidInput(\"documentHash\", \"must be 32 bytes of hex\");\n  }\n\n  return `0x${stripped.toLowerCase()}` as DocumentHash;\n}\n\nexport function toEpochMs(raw: unknown): EpochMs {\n  assertSafeNonNegativeInteger(raw, \"epochMs\");\n  return raw as EpochMs;\n}\n\nexport function toEpochSeconds(raw: unknown): EpochSeconds {\n  assertSafeNonNegativeInteger(raw, \"epochSeconds\");\n  return raw as EpochSeconds;\n}\n\nexport function secondsToMs(seconds: EpochSeconds): EpochMs {\n  if (seconds > MAX_SAFE_EPOCH_SECONDS) {\n    throw Errors.invalidInput(\"epochSeconds\", `${seconds} would overflow when multiplied by 1000`);\n  }\n\n  return toEpochMs(seconds * 1000);\n}\n\nexport function epochMsToSeconds(ms: EpochMs): EpochSeconds {\n  return toEpochSeconds(Math.floor(ms / 1000));\n}\n\nexport function toChainId(raw: unknown): ChainId {\n  if (typeof raw !== \"number\" || !Number.isSafeInteger(raw) || raw <= 0) {\n    throw Errors.invalidInput(\n      \"chainId\",\n      invalidValueReason(\"must be a positive safe integer\", raw),\n    );\n  }\n\n  return raw as ChainId;\n}\n\nexport function toBlockNumber(raw: unknown): BlockNumber {\n  assertSafeNonNegativeInteger(raw, \"blockNumber\");\n  return raw as BlockNumber;\n}\n\nexport function toLogIndex(raw: unknown): LogIndex {\n  assertSafeNonNegativeInteger(raw, \"logIndex\");\n  return raw as LogIndex;\n}\n\nexport function toWeiAmount(raw: unknown): WeiAmount {\n  if (typeof raw !== \"string\" || !WEI_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"weiAmount\",\n      invalidValueReason(\"must be a non-negative integer string\", raw),\n    );\n  }\n\n  return raw as WeiAmount;\n}\n\nexport function toCountryCode(raw: unknown): CountryCode {\n  if (typeof raw !== \"string\") {\n    throw Errors.invalidInput(\"countryCode\", \"must be a string\");\n  }\n\n  const upper = raw.toUpperCase();\n  if (!COUNTRY_CODE_RE.test(upper)) {\n    throw Errors.invalidInput(\n      \"countryCode\",\n      invalidValueReason(\"must be a 2-letter ISO 3166-1 alpha-2 code\", raw),\n    );\n  }\n\n  return upper as CountryCode;\n}\n\nexport function toCurrencyCode(raw: unknown): CurrencyCode {\n  if (typeof raw !== \"string\" || !SUPPORTED_CURRENCY_CODES.includes(raw as SupportedCurrencyCode)) {\n    throw Errors.invalidInput(\"currencyCode\", invalidValueReason(\"unsupported currency\", raw));\n  }\n\n  return raw as CurrencyCode;\n}\n\nexport function currencySymbolFor(code: CurrencyCode): string {\n  const symbol = CURRENCY_SYMBOLS[code as SupportedCurrencyCode];\n  if (symbol === undefined) {\n    throw Errors.invalidInput(\"currencyCode\", `no symbol registered for \"${String(code)}\"`);\n  }\n\n  return symbol;\n}\n\nexport function toKycTier(raw: unknown): KycTier {\n  if (typeof raw !== \"number\" || !Number.isInteger(raw) || raw < 0 || raw > 3) {\n    throw Errors.invalidInput(\"kycTier\", invalidValueReason(\"must be an integer in [0, 3]\", raw));\n  }\n\n  return raw as KycTier;\n}\n\nexport function toSafeAddress(raw: unknown): SafeAddress {\n  if (typeof raw !== \"string\" || !EVM_ADDRESS_RE.test(raw)) {\n    throw Errors.invalidInput(\"safeAddress\", invalidValueReason(\"invalid EVM address format\", raw));\n  }\n\n  return raw.toLowerCase() as SafeAddress;\n}\n\nexport function toModuleAddress(raw: unknown): ModuleAddress {\n  if (typeof raw !== \"string\" || !EVM_ADDRESS_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"moduleAddress\",\n      invalidValueReason(\"invalid EVM address format\", raw),\n    );\n  }\n\n  return raw.toLowerCase() as ModuleAddress;\n}\n\nexport function toRunId(raw: unknown): RunId {\n  if (typeof raw !== \"string\" || !RUN_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\"runId\", \"must match the format run_<uuid>\");\n  }\n\n  return raw as RunId;\n}\n\nexport function toRoleKey(raw: unknown): RoleKey {\n  if (typeof raw !== \"string\" || !BYTES32_RE.test(raw)) {\n    throw Errors.invalidInput(\"roleKey\", invalidValueReason(\"must be 0x + 64 hex chars\", raw));\n  }\n\n  return raw.toLowerCase() as RoleKey;\n}\n\nexport function toAllowanceKey(raw: unknown): AllowanceKey {\n  if (typeof raw !== \"string\" || !BYTES32_RE.test(raw)) {\n    throw Errors.invalidInput(\"allowanceKey\", invalidValueReason(\"must be 0x + 64 hex chars\", raw));\n  }\n\n  return raw.toLowerCase() as AllowanceKey;\n}\n\nexport function toSessionToken(raw: unknown): SessionToken {\n  if (typeof raw !== \"string\" || raw.length === 0) {\n    throw Errors.invalidInput(\"token\", \"must be a non-empty string\");\n  }\n\n  return raw as SessionToken;\n}\n\nexport function toJwtToken(raw: unknown): JwtToken {\n  if (typeof raw !== \"string\" || raw.length === 0) {\n    throw Errors.invalidInput(\"jwtToken\", \"must be a non-empty string\");\n  }\n\n  return raw as JwtToken;\n}\n\nfunction toNonEmptyStringBrand(raw: unknown, field: string): string {\n  if (typeof raw !== \"string\" || raw.length === 0) {\n    throw Errors.invalidInput(field, \"must be a non-empty string\");\n  }\n\n  return raw;\n}\n\nfunction assertSafeNonNegativeInteger(raw: unknown, field: string): asserts raw is number {\n  if (typeof raw !== \"number\" || !Number.isSafeInteger(raw) || raw < 0) {\n    throw Errors.invalidInput(\n      field,\n      invalidValueReason(\"must be a non-negative safe integer\", raw),\n    );\n  }\n}\n\nfunction normalizeAllowedOrigin(raw: string): string | null {\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    return null;\n  }\n\n  if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n    return null;\n  }\n\n  if (parsed.hostname.includes(\"*\")) {\n    return null;\n  }\n\n  return parsed.origin;\n}\n\nfunction invalidValueReason(prefix: string, raw: unknown): string {\n  if (typeof raw === \"string\") {\n    return `${prefix}: ${raw.slice(0, 40)}`;\n  }\n\n  return `${prefix}: ${String(raw)}`;\n}\n","import { Context, Data, Effect } from \"effect\";\nimport type { AuthSession, EpochSeconds, JwtToken } from \"@capxul/types\";\n\n/**\n * AuthCachePort (TA4) — replaces `SessionStoragePort` in the rebuild slice's\n * consumer-facing wiring. Stores the user-snapshot Session AND the cached\n * Convex JWT (W7 bridge endpoint). The two slots are independent so a session\n * refresh doesn't invalidate the JWT and vice versa.\n *\n * Three adapters (TA7):\n *   - `BrowserAuthCacheAdapter`        — backed by `localStorage`\n *   - `FileSystemAuthCacheAdapter`     — mode-0600 JSON file in `~/.config/capxul/`\n *   - `InMemoryAuthCacheAdapter`       — for tests\n *\n * `SessionStoragePort` was retired by the Stage 4 rebuild; session and JWT\n * persistence now share this cache boundary.\n */\nexport interface AuthCachePort {\n  readonly getSession: Effect.Effect<AuthSession | null, AuthCacheError>;\n  readonly setSession: (session: AuthSession) => Effect.Effect<void, AuthCacheError>;\n  readonly clearSession: Effect.Effect<void, AuthCacheError>;\n\n  /**\n   * JWT cache for the `/api/auth/convex/token` bridge endpoint (W7).\n   * Stored separately from the session so a session refresh doesn't\n   * invalidate cached JWT.\n   */\n  readonly getJwt: Effect.Effect<CachedJwt | null, AuthCacheError>;\n  readonly setJwt: (jwt: CachedJwt) => Effect.Effect<void, AuthCacheError>;\n  readonly clearJwt: Effect.Effect<void, AuthCacheError>;\n}\n\n/**\n * Cached Convex JWT shape (TA4). `expEpochSeconds` is decoded from the JWT's\n * `exp` claim at fetch time so the `tokenProvider` cache eviction logic can\n * proactively refresh at `exp - 30s` per TA3.\n */\nexport interface CachedJwt {\n  readonly token: JwtToken;\n  readonly expEpochSeconds: EpochSeconds;\n}\n\nexport class AuthCacheError extends Data.TaggedError(\"AuthCacheError\")<{\n  readonly operation: string;\n  readonly cause: unknown;\n}> {}\n\nexport class AuthCachePortTag extends Context.Tag(\"@capxul/sdk/ports/AuthCachePort\")<\n  AuthCachePortTag,\n  AuthCachePort\n>() {}\n","import {\n  toAuthUserId,\n  toEmail,\n  toEpochMs,\n  toEpochSeconds,\n  toJwtToken,\n  toSessionToken,\n  type AuthSession,\n} from \"@capxul/types\";\n\nimport type { CachedJwt } from \"../../ports/auth-cache\";\n\nexport function parseAuthSession(raw: unknown): AuthSession | null {\n  if (typeof raw !== \"object\" || raw === null) return null;\n  const candidate = raw as {\n    readonly authUserId?: unknown;\n    readonly email?: unknown;\n    readonly token?: unknown;\n    readonly expiresAt?: unknown;\n  };\n\n  try {\n    return {\n      authUserId: toAuthUserId(candidate.authUserId),\n      email: toEmail(candidate.email),\n      token: toSessionToken(candidate.token),\n      expiresAt: toEpochMs(candidate.expiresAt),\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport function parseCachedJwt(raw: unknown): CachedJwt | null {\n  if (typeof raw !== \"object\" || raw === null) return null;\n  const candidate = raw as {\n    readonly token?: unknown;\n    readonly expEpochSeconds?: unknown;\n  };\n\n  try {\n    return {\n      token: toJwtToken(candidate.token),\n      expEpochSeconds: toEpochSeconds(candidate.expEpochSeconds),\n    };\n  } catch {\n    return null;\n  }\n}\n","import { Effect, Layer } from \"effect\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport {\n  AuthCacheError,\n  AuthCachePortTag,\n  type AuthCachePort,\n  type CachedJwt,\n} from \"../../ports/auth-cache\";\nimport { parseAuthSession, parseCachedJwt } from \"./serialization\";\n\nexport interface BrowserStorageShape {\n  getItem(key: string): string | null;\n  setItem(key: string, value: string): void;\n  removeItem(key: string): void;\n}\n\nconst SESSION_KEY = \"capxul.session\";\nconst JWT_KEY = \"capxul.jwt\";\n\nexport class BrowserAuthCacheAdapter implements AuthCachePort {\n  private readonly storage: BrowserStorageShape;\n\n  constructor(storage: BrowserStorageShape) {\n    this.storage = storage;\n  }\n\n  readonly getSession = authCacheTry(\"getSession\", () => {\n    const raw = this.storage.getItem(SESSION_KEY);\n    if (raw === null) return null;\n    try {\n      return parseAuthSession(JSON.parse(raw));\n    } catch {\n      return null;\n    }\n  });\n\n  readonly setSession = (session: AuthSession) =>\n    authCacheTry(\"setSession\", () => {\n      this.storage.setItem(SESSION_KEY, JSON.stringify(session));\n    });\n\n  readonly clearSession = authCacheTry(\"clearSession\", () => {\n    this.storage.removeItem(SESSION_KEY);\n  });\n\n  readonly getJwt = authCacheTry(\"getJwt\", () => {\n    const raw = this.storage.getItem(JWT_KEY);\n    if (raw === null) return null;\n    try {\n      return parseCachedJwt(JSON.parse(raw));\n    } catch {\n      return null;\n    }\n  });\n\n  readonly setJwt = (jwt: CachedJwt) =>\n    authCacheTry(\"setJwt\", () => {\n      this.storage.setItem(JWT_KEY, JSON.stringify(jwt));\n    });\n\n  readonly clearJwt = authCacheTry(\"clearJwt\", () => {\n    this.storage.removeItem(JWT_KEY);\n  });\n}\n\nexport function BrowserAuthCacheLayer(input: {\n  readonly storage: BrowserStorageShape;\n}): Layer.Layer<AuthCachePortTag, AuthCacheError> {\n  return Layer.effect(\n    AuthCachePortTag,\n    Effect.sync(() => new BrowserAuthCacheAdapter(input.storage)).pipe(\n      Effect.mapError((cause) => toAuthCacheError(\"initialize\", cause)),\n    ),\n  );\n}\n\nfunction toAuthCacheError(operation: string, cause: unknown): AuthCacheError {\n  return new AuthCacheError({ operation, cause });\n}\n\nfunction authCacheTry<T>(operation: string, run: () => T): Effect.Effect<T, AuthCacheError> {\n  return Effect.try({\n    try: run,\n    catch: (cause) => toAuthCacheError(operation, cause),\n  });\n}\n","import { Effect, Layer } from \"effect\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport {\n  AuthCacheError,\n  AuthCachePortTag,\n  type AuthCachePort,\n  type CachedJwt,\n} from \"../../ports/auth-cache\";\n\nexport class InMemoryAuthCacheAdapter implements AuthCachePort {\n  private session: AuthSession | null = null;\n  private jwt: CachedJwt | null = null;\n\n  readonly getSession = Effect.sync(() => this.session);\n\n  readonly setSession = (session: AuthSession) =>\n    Effect.sync(() => {\n      this.session = session;\n    });\n\n  readonly clearSession = Effect.sync(() => {\n    this.session = null;\n  });\n\n  readonly getJwt = Effect.sync(() => this.jwt);\n\n  readonly setJwt = (jwt: CachedJwt) =>\n    Effect.sync(() => {\n      this.jwt = jwt;\n    });\n\n  readonly clearJwt = Effect.sync(() => {\n    this.jwt = null;\n  });\n}\n\nexport const InMemoryAuthCacheLayer = Layer.effect(\n  AuthCachePortTag,\n  Effect.sync(() => new InMemoryAuthCacheAdapter()).pipe(\n    Effect.mapError((cause) => new AuthCacheError({ operation: \"initialize\", cause })),\n  ),\n);\n"],"mappings":";;AAKA,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAmDA,IAAa,cAAb,cAAiC,MAAM;CACrC;CACA;CACA;CACA;CAEA,YAAY,MAAuB,SAAiB,UAA8B,CAAC,GAAG;EACpF,MAAM,SAAS,WAAW,UAAU,EAAE,OAAO,QAAQ,MAAM,IAAI,KAAA,CAAS;EACxE,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,IAAI,QAAQ,YAAY,KAAA,GACtB,KAAK,UAAU,QAAQ;EAEzB,IAAI,QAAQ,kBAAkB,KAAA,GAC5B,KAAK,gBAAgB,QAAQ;EAE/B,IAAI,QAAQ,UAAU,KAAA,GACpB,KAAK,QAAQ,QAAQ;CAEzB;AACF;AAEA,SAAgB,cAAc,OAAsC;CAClE,OAAO,iBAAiB;AAC1B;AAYA,SAAgB,uBAAuB,YAAgD;CACrF,OAAO,IAAI,YACT,WAAW,MACX,WAAW,SACX,oBAAoB;EAClB,SAAS,WAAW;EACpB,eAAe,WAAW;EAC1B,OAAO,WAAW;CACpB,CAAC,CACH;AACF;AAiCA,SAAS,oBAAoB,SAKN;CACrB,MAAM,SAKF,CAAC;CAEL,IAAI,WAAW,SACb,OAAO,QAAQ,QAAQ;CAEzB,IAAI,QAAQ,YAAY,KAAA,GACtB,OAAO,UAAU,QAAQ;CAE3B,IAAI,QAAQ,kBAAkB,KAAA,GAC5B,OAAO,gBAAgB,QAAQ;CAEjC,IAAI,QAAQ,UAAU,KAAA,GACpB,OAAO,QAAQ,QAAQ;CAGzB,OAAO;AACT;AAEA,MAAa,SAAS;CACpB,mBAAmB,SAAkB,SACnC,IAAI,YACF,qBACA,WAAW,qBACX,MAAM,eAAe,EAAE,SAAS,EAAE,cAAc,KAAK,aAAa,EAAE,IAAI,KAAA,CAC1E;CACF,sBAAsB,WACpB,IAAI,YAAY,yBAAyB,wBAAwB,EAC/D,SAAS,EAAE,OAAO,EACpB,CAAC;CAEH,kBAAkB,eAChB,IAAI,YAAY,qBAAqB,8BAA8B,cAAc,EAC/E,SAAS,EAAE,WAAW,EACxB,CAAC;CAEH,sBAAsB,eACpB,IAAI,YAAY,yBAAyB,iCAAiC,EACxE,SAAS,EAAE,WAAW,EACxB,CAAC;CAEH,iBAAiB,aACf,IAAI,YACF,oBACA,WAAW,mBAAmB,SAAS,cAAc,6BACrD,aAAa,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,SAAS,EAAE,CAC/D;CAEF,kBAAkB,cAChB,IAAI,YACF,qBACA,YAAY,oBAAoB,UAAU,cAAc,8BACxD,cAAc,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CACjE;CAEF,gBACE,UACA,WACA,OACA,SACG;EACH,MAAM,UAAmC;GAAE;GAAU;EAAU;EAC/D,IAAI,MAAM,cACR,QAAQ,eAAe,KAAK;EAE9B,OAAO,IAAI,YAAY,kBAAkB,mBAAmB,SAAS,GAAG,aAAa;GACnF;GACA;EACF,CAAC;CACH;CAEA,eAAe,OAAe,WAC5B,IAAI,YAAY,iBAAiB,WAAW,MAAM,IAAI,UAAU,EAC9D,SAAS;EAAE;EAAO;CAAO,EAC3B,CAAC;CAEH,aAAa,SACX,IAAI,YAAY,eAAe,wBAAwB,KAAK,kBAAkB,EAC5E,SAAS,EAAE,KAAK,EAClB,CAAC;CAEH,iBAAiB,QAAgB,WAC/B,IAAI,YACF,mBACA,GAAG,OAAO,GAAG,OAAO,yEACpB,EAAE,SAAS;EAAE;EAAQ;CAAO,EAAE,CAChC;;;;;;;;;;CAWF,kBAAkB,UAAkB,WAAmB,cACrD,IAAI,YACF,kBACA,mBAAmB,SAAS,GAAG,UAAU,qBAAqB,UAAU,MACxE;EACE,SAAS;GAAE;GAAU;GAAW,QAAQ;EAAU;EAClD,uBAAO,IAAI,MAAM,YAAY,UAAU,YAAY,UAAU,GAAG;CAClE,CACF;CAEF,uBAAuB,YAAyC;EAM9D,OAAO,IAAI,YAAY,yBAJrB,UAAU,UACN,mCAAmC,QAAQ,KAAK,WAAW,QAAQ,YAAY,KAC/E,qBAAqB,QAAQ,aAAa,gBAES,EACvD,QACF,CAAC;CACH;CAEA,sBAAsB,OAAe,WAAmB,aACtD,IAAI,YAAY,wBAAwB,gBAAgB,MAAM,WAAW,EACvE,SAAS;EAAE;EAAO;EAAW;CAAS,EACxC,CAAC;CAEH,mBAAmB,WACjB,IAAI,YAAY,qBAAqB,sBAAsB,UAAU,EACnE,SAAS,EAAE,OAAO,EACpB,CAAC;;;;;;;;;;;CAYH,uBAAuB,YASrB,IAAI,YACF,0BACA,wCAAwC,QAAQ,OAAO,KACvD,EACE,SACE,QAAQ,cAAc,KAAA,IAClB,EAAE,QAAQ,QAAQ,OAAO,IACzB;EAAE,QAAQ,QAAQ;EAAQ,WAAW,QAAQ;CAAU,EAC/D,CACF;;;;;;;;CASF,oBAAoB,WAAmB,OAAiB,UACtD,IAAI,YAAY,sBAAsB,uBAAuB,aAAa;EACxE;EACA,SAAS,OAAO,WAAW,KAAA,IAAY,EAAE,UAAU,IAAI;GAAE;GAAW,QAAQ,MAAM;EAAO;CAC3F,CAAC;CAEH,cAAc,YACZ,IAAI,YACF,gBACA,uBACA,YAAY,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAChE;CAEF,eAAe,WAAmB,UAChC,IAAI,YAAY,iBAAiB,wBAAwB,aAAa;EACpE;EACA,SAAS,EAAE,UAAU;CACvB,CAAC;CAEH,UAAU,UAAoB,IAAI,YAAY,WAAW,iBAAiB,EAAE,MAAM,CAAC;CAEnF,aAAa,YACX,IAAI,YACF,eACA,qDACA,YAAY,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAChE;CAEF,iBAAiB,YAKf,IAAI,YAAY,mBAAmB,gCAAgC;EACjE,OAAO,QAAQ;EACf,SACE,QAAQ,WAAW,KAAA,IACf,EAAE,QAAQ,QAAQ,OAAO,IACzB;GAAE,QAAQ,QAAQ;GAAQ,QAAQ,QAAQ;EAAO;CACzD,CAAC;CAEH,YAAY,YACV,IAAI,YACF,aACA,4BACA,YAAY,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAChE;;;;;;;;;CAUF,aAAa,YAKX,IAAI,YACF,eACA,GAAG,QAAQ,OAAO,sBAAsB,QAAQ,aAAa,mBAAmB,QAAQ,YAAY,KAAK,IAAI,KAC7G,EAAE,SAAS;EAAE,GAAG;EAAS,aAAa,CAAC,GAAG,QAAQ,WAAW;CAAE,EAAE,CACnE;AACJ;;;ACrXA,MAAM,cAA4C,IAAI,IAAI,kBAAkB;AAE5E,SAAS,aAAa,OAA0C;CAC9D,OAAO,OAAO,UAAU,YAAY,YAAY,IAAI,KAAwB;AAC9E;AAEA,SAAS,YAAY,YAAyD;CAC5E,IAAI,CAAC,aAAa,WAAW,IAAI,GAAG,OAAO;CAc3C,OAAO,uBAAuB;EAZ5B,MAAM,WAAW;EACjB,SAAS,OAAO,WAAW,YAAY,WAAW,WAAW,UAAU,OAAO,WAAW,IAAI;EAC7F,GAAI,OAAO,WAAW,YAAY,YAClC,WAAW,YAAY,QACvB,CAAC,MAAM,QAAQ,WAAW,OAAO,IAC7B,EAAE,SAAS,WAAW,QAAmC,IACzD,CAAC;EACL,GAAI,OAAO,WAAW,kBAAkB,WACpC,EAAE,eAAe,WAAW,cAAc,IAC1C,CAAC;EACL,GAAI,OAAO,WAAW,UAAU,WAAW,EAAE,OAAO,WAAW,MAAM,IAAI,CAAC;CAExC,CAAC;AACvC;AAEA,SAAgB,kBAAkB,KAAkC;CAClE,IAAI,QAAQ,QAAQ,QAAQ,KAAA,GAAW,OAAO;CAG9C,IAAI,eAAe,aAAa,OAAO;CAEvC,IAAI,OAAO,QAAQ,UAAU,OAAO;CAKpC,MAAM,SAAS;CACf,IAAI,EAAE,UAAU,SAAS,OAAO;CAChC,MAAM,OAAO,OAAO;CAEpB,IAAI,OAAO,SAAS,YAAY,SAAS,MACvC,OAAO,YAAY,IAA+B;CAOpD,IAAI,OAAO,SAAS,UAClB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,IAAI,OAAO,WAAW,YAAY,WAAW,MAC3C,OAAO,YAAY,MAAiC;CAExD,QAAQ,CAER;CAGF,OAAO;AACT;;;AC8CA,MAAa,iBAAiB;AAC9B,MAAa,aAAa;AAC1B,MAAa,0BAA0B;AACvC,MAAa,uBAAuB;CAClC;EAAE,MAAM;EAAO,QAAQ;EAAK,MAAM;CAAY;CAC9C;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAiB;CACrD;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAgB;CACpD;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAkB;CACtD;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAmB;AACzD;AACA,MAAa,2BAA2B,qBAAqB,KAAK,aAAa,SAAS,IAAI;AAE5D,OAAO,YACrC,qBAAqB,KAAK,aAAa,CAAC,SAAS,MAAM,SAAS,MAAM,CAAC,CACzE;AAEA,MAAM,WAAW;AACjB,MAAM,kBAAkB;AACxB,MAAM,2BAA2B;AAMjC,MAAM,gBAAgB;AACtB,MAAM,mBAAmB;AAIzB,MAAa,YAAY;AAKM,KAAK,MAAM,OAAO,mBAAmB,GAAI;AAExE,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,eAAe,KAAK,GAAG,GACrD,MAAM,OAAO,aAAa,WAAW,mBAAmB,8BAA8B,GAAG,CAAC;CAG5F,OAAO,IAAI,YAAY;AACzB;AAMA,SAAgB,QAAQ,KAAqB;CAC3C,IAAI,OAAO,QAAQ,YAAY,CAAC,SAAS,KAAK,GAAG,GAC/C,MAAM,OAAO,aAAa,SAAS,mBAAmB,mCAAmC,GAAG,CAAC;CAG/F,OAAO,IAAI,YAAY;AACzB;AAMA,SAAgB,aAAa,KAA0B;CACrD,OAAO,sBAAsB,KAAK,YAAY;AAChD;AAEA,SAAgB,sBAAsB,KAAmC;CACvE,IAAI,OAAO,QAAQ,YAAY,CAAC,yBAAyB,KAAK,GAAG,GAC/D,MAAM,OAAO,aACX,kBACA,mBAAmB,kDAAkD,GAAG,CAC1E;CAGF,OAAO;AACT;AAMA,SAAgB,YAAY,KAAyB;CACnD,IAAI,OAAO,QAAQ,YAAY,CAAC,cAAc,KAAK,GAAG,GACpD,MAAM,OAAO,aACX,aACA,mBAAmB,4CAA4C,GAAG,CACpE;CAGF,OAAO;AACT;AAEA,SAAgB,eAAe,KAA4B;CACzD,IAAI,OAAO,QAAQ,YAAY,CAAC,iBAAiB,KAAK,GAAG,GACvD,MAAM,OAAO,aACX,gBACA,mBAAmB,+CAA+C,GAAG,CACvE;CAGF,OAAO;AACT;AAEA,SAAgB,QAAQ,KAAqB;CAC3C,OAAO,sBAAsB,KAAK,OAAO;AAC3C;AAEA,SAAgB,QAAQ,KAAqB;CAC3C,IAAI,OAAO,QAAQ,YAAY,CAAC,UAAU,KAAK,GAAG,GAChD,MAAM,OAAO,aAAa,SAAS,mBAAmB,4BAA4B,GAAG,CAAC;CAGxF,OAAO;AACT;AAEA,SAAgB,gBAAgB,KAA6B;CAC3D,IAAI,OAAO,QAAQ,UACjB,MAAM,OAAO,aAAa,iBAAiB,wCAAwC;CAGrF,MAAM,aAAa,uBAAuB,GAAG;CAC7C,IAAI,eAAe,MACjB,MAAM,OAAO,aACX,iBACA,mBAAmB,mCAAmC,GAAG,CAC3D;CAGF,OAAO;AACT;AAEA,SAAgB,mBAAmB,KAAgC;CACjE,OAAO,sBAAsB,KAAK,OAAO;AAC3C;AAEA,SAAgB,aAAa,KAA0B;CACrD,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,cAAc,GAAG,KAAK,MAAM,GACjE,MAAM,OAAO,aACX,YACA,mBAAmB,uCAAuC,GAAG,CAC/D;CAGF,OAAO;AACT;AAEA,SAAgB,iBAAiB,KAA8B;CAC7D,IAAI,OAAO,QAAQ,YAAY,CAAC,wBAAwB,KAAK,GAAG,GAC9D,MAAM,OAAO,aACX,kBACA,mBAAmB,gEAAgE,GAAG,CACxF;CAGF,OAAO;AACT;AAuBA,SAAgB,UAAU,KAAuB;CAC/C,6BAA6B,KAAK,SAAS;CAC3C,OAAO;AACT;AAEA,SAAgB,eAAe,KAA4B;CACzD,6BAA6B,KAAK,cAAc;CAChD,OAAO;AACT;AAcA,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,cAAc,GAAG,KAAK,OAAO,GAClE,MAAM,OAAO,aACX,WACA,mBAAmB,mCAAmC,GAAG,CAC3D;CAGF,OAAO;AACT;AAuBA,SAAgB,cAAc,KAA2B;CACvD,IAAI,OAAO,QAAQ,UACjB,MAAM,OAAO,aAAa,eAAe,kBAAkB;CAG7D,MAAM,QAAQ,IAAI,YAAY;CAC9B,IAAI,CAAC,gBAAgB,KAAK,KAAK,GAC7B,MAAM,OAAO,aACX,eACA,mBAAmB,8CAA8C,GAAG,CACtE;CAGF,OAAO;AACT;AAEA,SAAgB,eAAe,KAA4B;CACzD,IAAI,OAAO,QAAQ,YAAY,CAAC,yBAAyB,SAAS,GAA4B,GAC5F,MAAM,OAAO,aAAa,gBAAgB,mBAAmB,wBAAwB,GAAG,CAAC;CAG3F,OAAO;AACT;AAWA,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,KAAK,MAAM,GACxE,MAAM,OAAO,aAAa,WAAW,mBAAmB,gCAAgC,GAAG,CAAC;CAG9F,OAAO;AACT;AA6BA,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,WAAW,KAAK,GAAG,GACjD,MAAM,OAAO,aAAa,WAAW,mBAAmB,6BAA6B,GAAG,CAAC;CAG3F,OAAO,IAAI,YAAY;AACzB;AAUA,SAAgB,eAAe,KAA4B;CACzD,IAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAC5C,MAAM,OAAO,aAAa,SAAS,4BAA4B;CAGjE,OAAO;AACT;AAEA,SAAgB,WAAW,KAAwB;CACjD,IAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAC5C,MAAM,OAAO,aAAa,YAAY,4BAA4B;CAGpE,OAAO;AACT;AAEA,SAAS,sBAAsB,KAAc,OAAuB;CAClE,IAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAC5C,MAAM,OAAO,aAAa,OAAO,4BAA4B;CAG/D,OAAO;AACT;AAEA,SAAS,6BAA6B,KAAc,OAAsC;CACxF,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,cAAc,GAAG,KAAK,MAAM,GACjE,MAAM,OAAO,aACX,OACA,mBAAmB,uCAAuC,GAAG,CAC/D;AAEJ;AAEA,SAAS,uBAAuB,KAA4B;CAC1D,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,OAAO;CACT;CAEA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UACrD,OAAO;CAGT,IAAI,OAAO,SAAS,SAAS,GAAG,GAC9B,OAAO;CAGT,OAAO,OAAO;AAChB;AAEA,SAAS,mBAAmB,QAAgB,KAAsB;CAChE,IAAI,OAAO,QAAQ,UACjB,OAAO,GAAG,OAAO,IAAI,IAAI,MAAM,GAAG,EAAE;CAGtC,OAAO,GAAG,OAAO,IAAI,OAAO,GAAG;AACjC;;;AC7cA,IAAa,iBAAb,cAAoC,KAAK,YAAY,gBAAgB,EAGlE,CAAC;AAEJ,IAAa,mBAAb,cAAsC,QAAQ,IAAI,iCAAiC,EAGjF,EAAE,CAAC;;;ACtCL,SAAgB,iBAAiB,KAAkC;CACjE,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;CACpD,MAAM,YAAY;CAOlB,IAAI;EACF,OAAO;GACL,YAAY,aAAa,UAAU,UAAU;GAC7C,OAAO,QAAQ,UAAU,KAAK;GAC9B,OAAO,eAAe,UAAU,KAAK;GACrC,WAAW,UAAU,UAAU,SAAS;EAC1C;CACF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAgB,eAAe,KAAgC;CAC7D,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;CACpD,MAAM,YAAY;CAKlB,IAAI;EACF,OAAO;GACL,OAAO,WAAW,UAAU,KAAK;GACjC,iBAAiB,eAAe,UAAU,eAAe;EAC3D;CACF,QAAQ;EACN,OAAO;CACT;AACF;;;AC/BA,MAAM,cAAc;AACpB,MAAM,UAAU;AAEhB,IAAa,0BAAb,MAA8D;CAC5D;CAEA,YAAY,SAA8B;EACxC,KAAK,UAAU;CACjB;CAEA,aAAsB,aAAa,oBAAoB;EACrD,MAAM,MAAM,KAAK,QAAQ,QAAQ,WAAW;EAC5C,IAAI,QAAQ,MAAM,OAAO;EACzB,IAAI;GACF,OAAO,iBAAiB,KAAK,MAAM,GAAG,CAAC;EACzC,QAAQ;GACN,OAAO;EACT;CACF,CAAC;CAED,cAAuB,YACrB,aAAa,oBAAoB;EAC/B,KAAK,QAAQ,QAAQ,aAAa,KAAK,UAAU,OAAO,CAAC;CAC3D,CAAC;CAEH,eAAwB,aAAa,sBAAsB;EACzD,KAAK,QAAQ,WAAW,WAAW;CACrC,CAAC;CAED,SAAkB,aAAa,gBAAgB;EAC7C,MAAM,MAAM,KAAK,QAAQ,QAAQ,OAAO;EACxC,IAAI,QAAQ,MAAM,OAAO;EACzB,IAAI;GACF,OAAO,eAAe,KAAK,MAAM,GAAG,CAAC;EACvC,QAAQ;GACN,OAAO;EACT;CACF,CAAC;CAED,UAAmB,QACjB,aAAa,gBAAgB;EAC3B,KAAK,QAAQ,QAAQ,SAAS,KAAK,UAAU,GAAG,CAAC;CACnD,CAAC;CAEH,WAAoB,aAAa,kBAAkB;EACjD,KAAK,QAAQ,WAAW,OAAO;CACjC,CAAC;AACH;AAaA,SAAS,iBAAiB,WAAmB,OAAgC;CAC3E,OAAO,IAAI,eAAe;EAAE;EAAW;CAAM,CAAC;AAChD;AAEA,SAAS,aAAgB,WAAmB,KAAgD;CAC1F,OAAO,OAAO,IAAI;EAChB,KAAK;EACL,QAAQ,UAAU,iBAAiB,WAAW,KAAK;CACrD,CAAC;AACH;;;AC5EA,IAAa,2BAAb,MAA+D;CAC7D,UAAsC;CACtC,MAAgC;CAEhC,aAAsB,OAAO,WAAW,KAAK,OAAO;CAEpD,cAAuB,YACrB,OAAO,WAAW;EAChB,KAAK,UAAU;CACjB,CAAC;CAEH,eAAwB,OAAO,WAAW;EACxC,KAAK,UAAU;CACjB,CAAC;CAED,SAAkB,OAAO,WAAW,KAAK,GAAG;CAE5C,UAAmB,QACjB,OAAO,WAAW;EAChB,KAAK,MAAM;CACb,CAAC;CAEH,WAAoB,OAAO,WAAW;EACpC,KAAK,MAAM;CACb,CAAC;AACH;AAEsC,MAAM,OAC1C,kBACA,OAAO,WAAW,IAAI,yBAAyB,CAAC,EAAE,KAChD,OAAO,UAAU,UAAU,IAAI,eAAe;CAAE,WAAW;CAAc;AAAM,CAAC,CAAC,CACnF,CACF"}