@capxul/sdk 0.2.0-alpha.5 → 1.0.0-alpha.7

package/dist/index.d.mts

@@ -1,13 +1,11 @@
-import { a as AccountProviderSource, c as eip1193AccountProvider, d as CapxulResult, f as Profile, g as AuthCachePort, i as AccountProvider, l as localPrivateKeyAccountProvider, m as SmartAccount, n as Eip1193RequestProvider, o as AccountRequirement, p as Session, r as injectedWalletSigner, s as Eip1193Provider, t as CapxulSigner, u as openfortEmbeddedAccountProvider, v as CachedJwt } from "./signer-oaYGfjDe.mjs";
-import { a as SafeDeploymentEvidence, n as SafeDeploymentConfig } from "./safe-deployment-Vni46k3t.mjs";
-import { Context, Effect, Layer, Request } from "effect";
-import { Machine } from "@effect/experimental";
-import { CapxulError, CapxulErrorCode, CapxulErrorDetails } from "@capxul/config";
-import { Account, Account as Account$1, AccountId, Address, Address as Address$1, AllowedOrigin, AnonymousDistinctId, AppId, AuthSession, AuthSession as AuthSession$1, AuthUserId, AuthUserId as AuthUserId$1, ChainId, CountryCode, DeveloperApplication, DurationMs, Email, EpochMs, Money, Money as Money$1, OrgId, OrgId as OrgId$1, Profile as Profile$1, PublishableKey, PublishableKeyId, PublishableKeyRecord, RoleKey, RoleKey as RoleKey$1, RunId, SessionToken, SmartAccount as SmartAccount$1, SubAccount, SubAccount as SubAccount$1, SubAccountId, SubAccountId as SubAccountId$1 } from "@capxul/types";
-import { TelemetryEvent, TelemetryGroupInput, TelemetryIdentifyInput } from "@capxul/observability";
+import { A as SubAccount, C as PublishableKey, D as RunId, E as RoleKey, F as CapxulErrorDetails, I as FailureMode, N as CapxulError, O as SessionToken, P as CapxulErrorCode, S as Profile$1, T as PublishableKeyRecord, _ as EpochMs, a as AnonymousDistinctId, b as Money, c as AuthUserId, d as CountryCode, f as CurrencyCode, g as Email, h as DurationMs, i as AllowedOrigin, j as SubAccountId, k as SmartAccount$1, m as DocumentHash, n as AccountId, o as AppId, p as DeveloperApplication, r as Address, s as AuthSession, t as Account, u as ChainId, w as PublishableKeyId, x as OrgId } from "./index-CTXgQ_xR.mjs";
+import { _ as CachedJwt, a as AccountProviderSource, c as eip1193AccountProvider, d as Profile, f as Session, h as AuthCachePort, i as AccountProvider, l as localPrivateKeyAccountProvider, n as Eip1193RequestProvider, o as AccountRequirement, p as SmartAccount, r as injectedWalletSigner, s as Eip1193Provider, t as CapxulSigner, u as CapxulResult } from "./signer-DqDtJU1l.mjs";
+import { a as SafeDeploymentEvidence, n as SafeDeploymentConfig } from "./safe-deployment-D3k9yndM.mjs";
 import { Hex } from "viem";
+import { Context, Effect, Layer, Request } from "effect";
 import { Schema } from "@effect/schema";
 import { FunctionReference } from "convex/server";
+import { Machine } from "@effect/experimental";
 
 //#region src/ports/auth-client.d.ts
 type AuthClientOperationOptions = {
@@ -41,8 +39,8 @@ declare class AuthClientError extends AuthClientError_base<{
 interface AuthClientPort {
   canSendOtp(input: CanSendOtpInput, options?: AuthClientOperationOptions): Effect.Effect<CanSendOtpStatus, AuthClientError>;
   sendOtp(input: SendOtpInput, options?: AuthClientOperationOptions): Effect.Effect<void, AuthClientError>;
-  verifyOtp(input: VerifyOtpInput, options?: AuthClientOperationOptions): Effect.Effect<AuthSession$1, AuthClientError>;
-  getSession(options?: AuthClientOperationOptions): Effect.Effect<AuthSession$1 | null, AuthClientError>;
+  verifyOtp(input: VerifyOtpInput, options?: AuthClientOperationOptions): Effect.Effect<AuthSession, AuthClientError>;
+  getSession(options?: AuthClientOperationOptions): Effect.Effect<AuthSession | null, AuthClientError>;
   signOut(options?: AuthClientOperationOptions): Effect.Effect<void, AuthClientError>;
   /**
    * Fetches a Convex-aud JWT from `/api/auth/convex/token` (W7). Server mints
@@ -67,12 +65,48 @@ declare class ClockError extends ClockError_base<{
   readonly cause: unknown;
 }> {}
 //#endregion
-//#region src/ports/telemetry.d.ts
+//#region ../observability/src/telemetry-port.d.ts
+/**
+ * Context for reporting handled errors via `reportHandledError`.
+ * Carries structured metadata extracted from the error context.
+ */
+interface HandledErrorReportContext$1 {
+  readonly layer?: string;
+  readonly operation?: string;
+  readonly failure_mode?: FailureMode;
+  readonly provider?: string;
+}
+/**
+ * Canonical TelemetryPort interface. Every adapter (production, test, in-memory)
+ * implements this contract. All methods return `Effect<void, never>` —
+ * fire-and-forget, defects are caught and traced.
+ */
 interface TelemetryPort {
   readonly emit: (event: TelemetryEvent) => Effect.Effect<void, never>;
   readonly identify: (input: TelemetryIdentifyInput) => Effect.Effect<void, never>;
   readonly group: (input: TelemetryGroupInput) => Effect.Effect<void, never>;
   readonly reset: () => Effect.Effect<void, never>;
+  readonly reportHandledError?: (error: CapxulError, context?: HandledErrorReportContext$1) => Effect.Effect<void, never>;
+}
+//#endregion
+//#region ../observability/src/index.d.ts
+declare const TELEMETRY_EVENT_NAMES: readonly ["auth_otp_requested", "auth_otp_delivered", "auth_otp_expired", "auth_verified", "auth_failed", "auth_signed_out", "provisioning_safe_created", "provisioning_safe_confirmed", "bootstrap_resolved", "bootstrap_failed", "account_balance_read", "account_balance_failed", "faucet_requested", "faucet_confirmed", "faucet_failed", "subaccount_created", "subaccount_renamed", "subaccount_deleted", "subaccount_op_failed", "transfer_requested", "transfer_confirmed", "transfer_failed", "org_create_started", "org_safe_created", "org_safe_confirmed", "org_roles_seeded", "org_created", "org_create_failed", "org_invite_sent", "org_invite_accepted", "org_role_granted", "org_member_active", "org_member_removed", "org_invite_expired", "org_role_grant_failed", "payment_requested", "payment_resolved", "payment_document_attached", "payment_submitted", "payment_settled", "payment_claimed", "payment_cancelled", "payment_redirected", "payment_failed", "stream_created", "stream_claimed", "stream_cancelled", "stream_completed", "stream_failed", "withdrawal_requested", "withdrawal_submitted", "withdrawal_settled", "withdrawal_failed"];
+type TelemetryEventName = (typeof TELEMETRY_EVENT_NAMES)[number];
+type TelemetryProps = Record<string, unknown>;
+type TelemetryEvent = {
+  readonly name: TelemetryEventName;
+  readonly props?: TelemetryProps | undefined;
+};
+interface TelemetryIdentifyInput {
+  readonly distinctId: string;
+  readonly anonDistinctId?: AnonymousDistinctId;
+  readonly traits?: TelemetryProps;
+  readonly properties?: TelemetryProps;
+}
+interface TelemetryGroupInput {
+  readonly groupType: string;
+  readonly groupKey: string;
+  readonly properties?: TelemetryProps;
 }
 //#endregion
 //#region src/flows/auth.d.ts
@@ -83,7 +117,7 @@ type AuthFlowState = "idle" | "sending_otp" | "otp_requested" | "verifying" | "a
 interface AuthFlowContext {
   readonly state: AuthFlowState;
   readonly email: Email | null;
-  readonly session: AuthSession$1 | null;
+  readonly session: AuthSession | null;
   readonly otpRequestedAt: EpochMs | null;
   readonly anonDistinctId?: AnonymousDistinctId;
   readonly error: CapxulError | null;
@@ -126,41 +160,6 @@ interface EnvPort {
   readonly has: (key: EnvKey) => Effect.Effect<boolean, EnvError, never>;
 }
 //#endregion
-//#region src/ports/evm-signer.d.ts
-type HexString = `0x${string}`;
-type UserOperationRequest = {
-  readonly sender: Address$1;
-  readonly chainId: ChainId;
-  readonly callData: HexString;
-  readonly nonce?: HexString;
-  readonly maxFeePerGas?: HexString;
-  readonly maxPriorityFeePerGas?: HexString;
-  readonly callGasLimit?: HexString;
-  readonly verificationGasLimit?: HexString;
-  readonly preVerificationGas?: HexString;
-  readonly paymasterAndData?: HexString;
-};
-type SignedUserOperation = UserOperationRequest & {
-  readonly sender: Address$1;
-  readonly signature: HexString;
-  readonly userOpHash: HexString;
-};
-declare const EvmSignerError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "EvmSignerError";
-} & Readonly<A>;
-declare class EvmSignerError extends EvmSignerError_base<{
-  readonly publicError: CapxulError;
-  readonly publicCode?: CapxulErrorCode;
-  readonly operation?: string;
-  readonly details?: CapxulErrorDetails;
-  readonly cause?: unknown;
-}> {}
-interface EvmSignerPort {
-  readonly getAddress: Effect.Effect<Address$1, EvmSignerError, never>;
-  readonly signMessage: (message: string | Uint8Array) => Effect.Effect<HexString, EvmSignerError, never>;
-  readonly signUserOp: (userOperation: UserOperationRequest) => Effect.Effect<SignedUserOperation, EvmSignerError, never>;
-}
-//#endregion
 //#region src/ports/transport.d.ts
 type TransportOperationKind = "query" | "mutation" | "action";
 type TransportRequest<TArgs = unknown> = {
@@ -209,6 +208,9 @@ type BootstrapResolution = {
   readonly expiresIn: DurationMs;
   readonly authBaseUrl: string;
   readonly convexUrl: string;
+  readonly siteBaseUrl: string;
+  readonly openfortPublishableKey: string;
+  readonly shieldPublishableKey: string;
 };
 type BootstrapErrorKind = "notAuthenticated" | "network" | "provider" | "malformedBody" | "invalidInput" | "rateLimited";
 declare const BootstrapError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
@@ -299,22 +301,22 @@ interface ConvexCallPort {
 //#endregion
 //#region src/ports/credentials.d.ts
 type CreateApplicationInput = {
-  readonly authUserId: AuthUserId$1;
+  readonly authUserId: AuthUserId;
   readonly name: string;
   readonly allowedOrigins: readonly AllowedOrigin[];
 };
 type MintKeyInput = {
   readonly applicationId: AppId;
-  readonly authUserId: AuthUserId$1;
+  readonly authUserId: AuthUserId;
 };
 type RotateKeyInput = {
   readonly keyId: PublishableKeyId;
-  readonly authUserId: AuthUserId$1;
+  readonly authUserId: AuthUserId;
   readonly graceMs: DurationMs;
 };
 type RevokeKeyInput = {
   readonly keyId: PublishableKeyId;
-  readonly authUserId: AuthUserId$1;
+  readonly authUserId: AuthUserId;
 };
 type RotateKeyResult = {
   readonly active: PublishableKeyRecord;
@@ -331,7 +333,7 @@ declare class CredentialsError extends CredentialsError_base<{
   readonly details?: CapxulErrorDetails;
 }> {}
 interface CredentialsPort {
-  listApplications(authUserId: AuthUserId$1): Effect.Effect<readonly DeveloperApplication[], CredentialsError>;
+  listApplications(authUserId: AuthUserId): Effect.Effect<readonly DeveloperApplication[], CredentialsError>;
   createApplication(input: CreateApplicationInput): Effect.Effect<DeveloperApplication, CredentialsError>;
   mintPublishableKey(input: MintKeyInput): Effect.Effect<PublishableKeyRecord, CredentialsError>;
   rotatePublishableKey(input: RotateKeyInput): Effect.Effect<RotateKeyResult, CredentialsError>;
@@ -340,13 +342,13 @@ interface CredentialsPort {
 //#endregion
 //#region src/ports/identity.d.ts
 type CreateIdentityInput = {
-  readonly authUserId: AuthUserId$1;
+  readonly authUserId: AuthUserId;
   readonly email: Email;
   readonly displayName?: string;
   readonly country?: CountryCode;
 };
 type UpdateIdentityInput = {
-  readonly authUserId: AuthUserId$1;
+  readonly authUserId: AuthUserId;
   readonly displayName?: string;
   readonly country?: CountryCode;
 };
@@ -361,15 +363,14 @@ declare class IdentityError extends IdentityError_base<{
   readonly details?: CapxulErrorDetails;
 }> {}
 interface IdentityPort {
-  loadByAuthUserId(authUserId: AuthUserId$1): Effect.Effect<Profile$1 | null, IdentityError, never>;
+  loadByAuthUserId(authUserId: AuthUserId): Effect.Effect<Profile$1 | null, IdentityError, never>;
   create(input: CreateIdentityInput): Effect.Effect<Profile$1, IdentityError, never>;
   update(input: UpdateIdentityInput): Effect.Effect<Profile$1, IdentityError, never>;
 }
 //#endregion
 //#region src/ports/smart-account.d.ts
 type ProvisionInput = {
-  readonly authUserId: AuthUserId$1;
-  readonly signerAddress: Address$1;
+  readonly authUserId: AuthUserId;
   readonly chainId: ChainId;
 };
 /**
@@ -387,9 +388,9 @@ type ProvisionInput = {
  * `eth_getUserOperationReceipt(userOpHash)` to re-verify and derive.
  */
 type ConfirmDeploymentInput = {
-  readonly authUserId: AuthUserId$1;
+  readonly authUserId: AuthUserId;
   readonly chainId: ChainId;
-  readonly safeAddress: Address$1;
+  readonly safeAddress: Address;
   readonly evidence: SafeDeploymentEvidence;
   /**
    * Optional live-E2E correlation id. This does not prove deployment; the
@@ -398,41 +399,16 @@ type ConfirmDeploymentInput = {
    */
   readonly telemetryRunId?: RunId;
 };
-/** Opaque wire form of the backend-built deployment UserOperation (hex strings). */
-type DeploymentUserOpFields = {
-  readonly sender: string;
-  readonly nonce: string;
-  readonly factory: string;
-  readonly factoryData: string;
-  readonly callData: string;
-  readonly callGasLimit: string;
-  readonly verificationGasLimit: string;
-  readonly preVerificationGas: string;
-  readonly maxFeePerGas: string;
-  readonly maxPriorityFeePerGas: string;
-  readonly paymaster: string;
-  readonly paymasterVerificationGasLimit: string;
-  readonly paymasterPostOpGasLimit: string;
-  readonly paymasterData: string;
-};
-/** Input to `SmartAccountPort.deployPrepare` (backend-orchestrated-deploy.md · #289). */
-type DeployPrepareInput = {
-  readonly authUserId: AuthUserId$1;
-  readonly chainId: ChainId;
-  readonly telemetryRunId?: RunId;
-};
-/** Backend-built deployment UserOp + the EIP-712 SafeOp digest the CapxulSigner signs. */
-type DeployPrepareResult = {
-  readonly digest: Hex;
-  readonly safeAddress: Address$1;
-  readonly userOp: DeploymentUserOpFields;
-};
-/** Input to `SmartAccountPort.deploySubmit` — the consumer-signed deployment UserOp. */
-type DeploySubmitInput = {
-  readonly authUserId: AuthUserId$1;
+/**
+ * Input to `SmartAccountPort.claim` (PRD #462). The authenticated session
+ * reports the browser-created signer address; the BACKEND builds and
+ * bootstrap-signs the claim userOp (deploy + swapOwner) — the consumer signs
+ * nothing at claim.
+ */
+type ClaimInput = {
+  readonly authUserId: AuthUserId;
   readonly chainId: ChainId;
-  readonly userOp: DeploymentUserOpFields;
-  readonly signature: Hex;
+  readonly signerAddress: Address;
   readonly telemetryRunId?: RunId;
 };
 declare const SmartAccountError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
@@ -446,8 +422,8 @@ declare class SmartAccountError extends SmartAccountError_base<{
   readonly details?: CapxulErrorDetails;
 }> {}
 interface SmartAccountPort {
-  loadByAuthUserId(authUserId: AuthUserId$1): Effect.Effect<SmartAccount$1 | null, SmartAccountError, never>;
-  loadBySmartAccountAddress(address: Address$1): Effect.Effect<SmartAccount$1 | null, SmartAccountError, never>;
+  loadByAuthUserId(authUserId: AuthUserId): Effect.Effect<SmartAccount$1 | null, SmartAccountError, never>;
+  loadBySmartAccountAddress(address: Address): Effect.Effect<SmartAccount$1 | null, SmartAccountError, never>;
   provision(input: ProvisionInput): Effect.Effect<SmartAccount$1, SmartAccountError, never>;
   /**
    * Persist on-chain Safe-deployment evidence. The backend re-verifies
@@ -460,18 +436,13 @@ interface SmartAccountPort {
    */
   confirmDeployment(input: ConfirmDeploymentInput): Effect.Effect<SmartAccount$1, SmartAccountError, never>;
   /**
-   * Build + gas-fill + paymaster-sponsor the deployment UserOperation
-   * server-side and return the EIP-712 `SafeOp` digest for the consumer's
-   * `CapxulSigner` to sign. The client never holds RPC, a gas policy, or a
-   * bundler — see `docs/canon/decisions/backend-orchestrated-deploy.md`.
-   */
-  deployPrepare(input: DeployPrepareInput): Effect.Effect<DeployPrepareResult, SmartAccountError, never>;
-  /**
-   * Submit the signed deployment UserOperation through the bundler and confirm
-   * `deployedAt` on-chain (absorbing the `confirmDeployment` verify path).
-   * Returns the updated `SmartAccount` row.
+   * Claim the account (PRD #462): the backend builds, bootstrap-signs, and
+   * submits ONE sponsored userOp — deploy (when undeployed) + swapOwner
+   * (bootstrap → `signerAddress`). Idempotent; returns the updated row. When
+   * another claim is in flight the row comes back with `claimedAt: null` —
+   * callers poll lifecycle until the claim lands.
    */
-  deploySubmit(input: DeploySubmitInput): Effect.Effect<SmartAccount$1, SmartAccountError, never>;
+  claim(input: ClaimInput): Effect.Effect<SmartAccount$1, SmartAccountError, never>;
 }
 //#endregion
 //#region src/ports/account-read.d.ts
@@ -480,7 +451,7 @@ type ReadAccountBalanceInput = {
 };
 type FundFromFaucetInput = {
   readonly chainId: ChainId;
-  readonly amount: Money$1;
+  readonly amount: Money;
 };
 type FundFromFaucetResult = {
   readonly txHash: string;
@@ -500,7 +471,7 @@ declare class AccountReadError extends AccountReadError_base<{
  * live RPC `balanceOf` pull; the adapter lifts wire integers to `Money`.
  */
 interface AccountReadPort {
-  readBalance(input: ReadAccountBalanceInput): Effect.Effect<Account$1, AccountReadError, never>;
+  readBalance(input: ReadAccountBalanceInput): Effect.Effect<Account, AccountReadError, never>;
   fundFromFaucet(input: FundFromFaucetInput): Effect.Effect<FundFromFaucetResult, AccountReadError, never>;
 }
 //#endregion
@@ -520,10 +491,10 @@ type CreateSubAccountInput = {
   readonly name: string;
 };
 type SubAccountIdInput = {
-  readonly subAccountId: SubAccountId$1;
+  readonly subAccountId: SubAccountId;
 };
 type RenameSubAccountInput = {
-  readonly subAccountId: SubAccountId$1;
+  readonly subAccountId: SubAccountId;
   readonly name: string;
 };
 /**
@@ -532,7 +503,7 @@ type RenameSubAccountInput = {
  * specific sub-account, addressed by its `SubAccountId` (canon
  * `account-balance-model.md` §5, §12).
  */
-type TransferEndpoint = "main" | SubAccountId$1;
+type TransferEndpoint = "main" | SubAccountId;
 /**
  * Move money between two of the SAME Account's balances (canon §12). The
  * backend resolves the Account from auth (v1 = one Account per user), so the
@@ -543,7 +514,7 @@ type TransferEndpoint = "main" | SubAccountId$1;
 type TransferInput = {
   readonly from: TransferEndpoint;
   readonly to: TransferEndpoint;
-  readonly amount: Money$1;
+  readonly amount: Money;
 };
 /**
  * Result of a `transfer`: the recomputed `available` (`balanceOf − Σ`), plus
@@ -551,27 +522,29 @@ type TransferInput = {
  * has no stored row, so its slot is `null`.
  */
 type TransferResult = {
-  readonly available: Money$1;
-  readonly from: SubAccount$1 | null;
-  readonly to: SubAccount$1 | null;
+  readonly available: Money;
+  readonly from: SubAccount | null;
+  readonly to: SubAccount | null;
 };
 interface SubAccountPort {
-  create(input: CreateSubAccountInput): Effect.Effect<SubAccount$1, SubAccountError, never>;
-  get(input: SubAccountIdInput): Effect.Effect<SubAccount$1 | null, SubAccountError, never>;
+  create(input: CreateSubAccountInput): Effect.Effect<SubAccount, SubAccountError, never>;
+  get(input: SubAccountIdInput): Effect.Effect<SubAccount | null, SubAccountError, never>;
   list(input: {
     readonly accountId: AccountId;
-  }): Effect.Effect<readonly SubAccount$1[], SubAccountError, never>;
-  rename(input: RenameSubAccountInput): Effect.Effect<SubAccount$1, SubAccountError, never>;
+  }): Effect.Effect<readonly SubAccount[], SubAccountError, never>;
+  rename(input: RenameSubAccountInput): Effect.Effect<SubAccount, SubAccountError, never>;
   delete(input: SubAccountIdInput): Effect.Effect<void, SubAccountError, never>;
   transfer(input: TransferInput): Effect.Effect<TransferResult, SubAccountError, never>;
 }
 //#endregion
 //#region src/flows/types.d.ts
 /**
- * The full 14-port bundle that `assembleCapxulClient` (slice 5) consumes.
+ * The full 13-port bundle that `assembleCapxulClient` (slice 5) consumes.
+ * (Was 15 before the dead local-signer port was retired; the deploy path
+ * now signs exclusively through `CapxulSigner`.)
  *
  * Each per-flow factory in slices 2-4 takes a narrowed subset, e.g.
- * `AuthFlowPorts = Pick<FlowPorts, "authClient" | "authCache" | "clock" | "telemetry">`.
+ * `AuthFlowPorts = Pick<FlowPorts, "authClient" | "clock" | "telemetry">`.
  * Slice 1 ships only the union; per Q6 each per-flow slice declares its
  * own narrowed `Pick<FlowPorts, ...>` inside its flow file.
  */
@@ -584,7 +557,6 @@ interface FlowPorts {
   readonly subAccount: SubAccountPort;
   readonly credentials: CredentialsPort;
   readonly bootstrap: BootstrapPort;
-  readonly evmSigner: EvmSignerPort;
   readonly clock: ClockPort;
   readonly env: EnvPort;
   readonly telemetry: TelemetryPort;
@@ -623,7 +595,7 @@ interface FlowPorts {
  * convention, flow-shape composites stay co-located with their flow.
  */
 interface ExternalSigner {
-  readonly address: Address$1;
+  readonly address: Address;
   readonly signedProof: string;
 }
 //#endregion
@@ -668,6 +640,44 @@ interface IdentityMethods {
   }): Promise<CapxulResult<Profile | null>>;
 }
 //#endregion
+//#region src/client/account-lane.d.ts
+type ProvisioningFailureStep = "wallet" | "identity" | "provision" | "deploy";
+type ProvisioningPhase = {
+  readonly status: "idle";
+} | {
+  readonly status: "wallet";
+} | {
+  readonly status: "identity";
+} | {
+  readonly status: "provision";
+} | {
+  readonly status: "deploy";
+} | {
+  readonly status: "ready";
+} | {
+  readonly status: "failed";
+  readonly at: ProvisioningFailureStep;
+  readonly error: CapxulError;
+};
+//#endregion
+//#region src/client/account-lifecycle.d.ts
+type AccountSetupStep = "connecting" | "confirmingIdentity" | "registering" | "activating";
+type AccountLifecycle = {
+  readonly status: "loading";
+} | {
+  readonly status: "settingUp";
+  readonly step: AccountSetupStep;
+} | {
+  readonly status: "ready";
+  readonly accountId: string;
+  readonly canTransact: boolean;
+} | {
+  readonly status: "failed";
+  readonly at: AccountSetupStep;
+  readonly error: CapxulError;
+};
+declare function isSettingUpLifecycle(lifecycle: AccountLifecycle): boolean;
+//#endregion
 //#region src/client/account.d.ts
 type AccountStatus = {
   readonly status: "notAuthenticated";
@@ -680,7 +690,7 @@ type AccountStatus = {
   readonly requirement: AccountRequirement;
   readonly chainId: number;
   readonly source: AccountProviderSource;
-  readonly signerAddress: Address$1;
+  readonly signerAddress: Address;
 } | {
   readonly status: "accountPrepared";
   readonly requirement: AccountRequirement;
@@ -719,19 +729,12 @@ type AccountStatus = {
  */
 interface AccountMethods {
   /**
-   * Read-only status inspection. Safe to call anytime.
+   * Post-auth account setup lifecycle — domain vocabulary over the internal
+   * readiness ladder + provisioning lane (#356).
    */
-  getStatus(): Promise<CapxulResult<AccountStatus>>;
-  /**
-   * Normal app entry point. Idempotent.
-   *
-   * Per #161, `ensureReady` now advances the ladder upward:
-   *   - `accountProviderReady → accountReady` via `_internal.account.provision`
-   *   - `accountPrepared → accountReady(deployed)` via
-   *     `_internal.account.deploySafe` (when `requirement === "deployed"`
-   *     and deploy deps are configured).
-   */
-  ensureReady(): Promise<CapxulResult<AccountStatus>>;
+  getLifecycle(): Promise<CapxulResult<AccountLifecycle>>;
+  /** Resume setup after `failed` and return the updated lifecycle snapshot. */
+  retrySetup(): Promise<CapxulResult<AccountLifecycle>>;
   /**
    * Internal advanced surface (#161 · AC1). Reserved for the rebuild's
    * own `ensureReady` upward transitions and for testing harnesses;
@@ -752,13 +755,21 @@ interface AccountMethods {
 interface AccountInternalSurface {
   provision(): Promise<CapxulResult<SmartAccount$1>>;
   deploySafe(): Promise<CapxulResult<SmartAccount$1>>;
+  /** @internal-use Substrate readiness ladder — tests and e2e only. */
+  getStatus(): Promise<CapxulResult<AccountStatus>>;
+  /** @internal-use Lane runner — tests and e2e only. */
+  ensureReady(): Promise<CapxulResult<AccountStatus>>;
+  /** @internal-use Provisioning lane phase — tests and e2e only. */
+  getProvisioningPhase(): Promise<CapxulResult<ProvisioningPhase>>;
+  /** @internal-use Lane retry — tests and e2e only. */
+  retryProvisioning(): Promise<CapxulResult<ProvisioningPhase>>;
 }
 //#endregion
 //#region src/client/accounts.d.ts
 interface AccountsMethods {
   read(options?: {
     readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Account$1>>;
+  }): Promise<CapxulResult<Account>>;
 }
 /**
  * Faucet surface (dev-only). Deliberately OFF the public `AccountsMethods`;
@@ -766,30 +777,658 @@ interface AccountsMethods {
  * The reference CLI uses it behind a test-env gate — consumers never see `fund`.
  */
 interface AccountsFaucetMethods {
-  fund(amount: Money$1, options?: {
+  fund(amount: Money, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<{
     readonly txHash: string;
   }>>;
 }
 //#endregion
+//#region ../wire/src/financial-ops.d.ts
+declare const PaymentDocumentEnvelope: Schema.Union<[Schema.Struct<{
+  protocol: Schema.Literal<["capxul.payment-document"]>;
+  version: Schema.Literal<[1]>;
+  domain: Schema.Struct<{
+    name: Schema.Literal<["CapxulPayments"]>;
+    version: Schema.Literal<["1"]>;
+    chainId: Schema.Schema<ChainId, number, never>;
+    verifyingContract: Schema.Literal<["0xe740ea65521edc9bef0ea75d30b5334711db99f4"]>;
+  }>;
+  primaryType: Schema.Literal<["Memo"]>;
+  message: Schema.Struct<{
+    kind: Schema.Literal<[0]>;
+    reference: typeof Schema.String;
+    note: typeof Schema.String;
+    issuedAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+  }>;
+}>, Schema.Struct<{
+  protocol: Schema.Literal<["capxul.payment-document"]>;
+  version: Schema.Literal<[1]>;
+  domain: Schema.Struct<{
+    name: Schema.Literal<["CapxulPayments"]>;
+    version: Schema.Literal<["1"]>;
+    chainId: Schema.Schema<ChainId, number, never>;
+    verifyingContract: Schema.Literal<["0xe740ea65521edc9bef0ea75d30b5334711db99f4"]>;
+  }>;
+  primaryType: Schema.Literal<["Invoice"]>;
+  message: Schema.Struct<{
+    kind: Schema.Literal<[1]>;
+    invoiceNumber: typeof Schema.String;
+    payerRef: typeof Schema.String;
+    payeeRef: typeof Schema.String;
+    amount: Schema.refine<string, Schema.Schema<string, string, never>>;
+    currency: Schema.Schema<CurrencyCode, string, never>;
+    decimals: Schema.refine<number, Schema.Schema<number, number, never>>;
+    issuedAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+    dueAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+    lineItemsHash: Schema.Schema<DocumentHash, string, never>;
+  }>;
+}>, Schema.Struct<{
+  protocol: Schema.Literal<["capxul.payment-document"]>;
+  version: Schema.Literal<[1]>;
+  domain: Schema.Struct<{
+    name: Schema.Literal<["CapxulPayments"]>;
+    version: Schema.Literal<["1"]>;
+    chainId: Schema.Schema<ChainId, number, never>;
+    verifyingContract: Schema.Literal<["0xe740ea65521edc9bef0ea75d30b5334711db99f4"]>;
+  }>;
+  primaryType: Schema.Literal<["Payslip"]>;
+  message: Schema.Struct<{
+    kind: Schema.Literal<[2]>;
+    employerRef: typeof Schema.String;
+    employeeRef: typeof Schema.String;
+    period: typeof Schema.String;
+    gross: Schema.refine<string, Schema.Schema<string, string, never>>;
+    net: Schema.refine<string, Schema.Schema<string, string, never>>;
+    currency: Schema.Schema<CurrencyCode, string, never>;
+    decimals: Schema.refine<number, Schema.Schema<number, number, never>>;
+    issuedAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+  }>;
+}>, Schema.Struct<{
+  protocol: Schema.Literal<["capxul.payment-document"]>;
+  version: Schema.Literal<[1]>;
+  domain: Schema.Struct<{
+    name: Schema.Literal<["CapxulPayments"]>;
+    version: Schema.Literal<["1"]>;
+    chainId: Schema.Schema<ChainId, number, never>;
+    verifyingContract: Schema.Literal<["0xe740ea65521edc9bef0ea75d30b5334711db99f4"]>;
+  }>;
+  primaryType: Schema.Literal<["Receipt"]>;
+  message: Schema.Struct<{
+    kind: Schema.Literal<[3]>;
+    reference: typeof Schema.String;
+    amount: Schema.refine<string, Schema.Schema<string, string, never>>;
+    currency: Schema.Schema<CurrencyCode, string, never>;
+    decimals: Schema.refine<number, Schema.Schema<number, number, never>>;
+    paidAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+    note: typeof Schema.String;
+  }>;
+}>, Schema.Struct<{
+  protocol: Schema.Literal<["capxul.payment-document"]>;
+  version: Schema.Literal<[1]>;
+  domain: Schema.Struct<{
+    name: Schema.Literal<["CapxulPayments"]>;
+    version: Schema.Literal<["1"]>;
+    chainId: Schema.Schema<ChainId, number, never>;
+    verifyingContract: Schema.Literal<["0xe740ea65521edc9bef0ea75d30b5334711db99f4"]>;
+  }>;
+  primaryType: Schema.Literal<["Withdrawal"]>;
+  message: Schema.Struct<{
+    kind: Schema.Literal<[4]>;
+    reference: typeof Schema.String;
+    amount: Schema.refine<string, Schema.Schema<string, string, never>>;
+    currency: Schema.Schema<CurrencyCode, string, never>;
+    decimals: Schema.refine<number, Schema.Schema<number, number, never>>;
+    destChain: Schema.Schema<ChainId, number, never>;
+    destAddress: Schema.refine<string, Schema.Schema<string, string, never>>;
+    settledAt: Schema.refine<number, Schema.Schema<number, number, never>>;
+    provider: typeof Schema.String;
+    note: typeof Schema.String;
+  }>;
+}>]>;
+/**
+ * #592 invoice line item. `quantity` is a positive integer; `unitMinor` is the
+ * per-unit price in integer minor units. The list is canonically hashed by
+ * `hashLineItems` (payment-document-hash.ts) into the Invoice `lineItemsHash`,
+ * and Σ(quantity × unitMinor) MUST equal the invoice `amount`. The hash binds
+ * the documentHash to the exact items; the sum-check makes the items add up to
+ * the amount due. See the payment-document spec (canon/mcp/financial-ops.md).
+ */
+declare const LineItem: Schema.Struct<{
+  description: typeof Schema.String;
+  quantity: Schema.refine<number, Schema.Schema<number, number, never>>;
+  unitMinor: Schema.refine<string, Schema.Schema<string, string, never>>;
+}>;
+type PaymentDocumentEnvelopeV1 = Schema.Schema.Type<typeof PaymentDocumentEnvelope>;
+type LineItemV1 = Schema.Schema.Type<typeof LineItem>;
+//#endregion
+//#region ../wire/src/leak-safety.d.ts
+declare const OnchainEvidenceBrand: unique symbol;
+/**
+ * The branded `{ userOpHash, txHash }` pair. On-chain settlement evidence is
+ * INTERNAL — it flows on the server-internal channel only, never onto a wire
+ * Payment or any MCP tool output. The brand makes "this is internal evidence"
+ * a type, so a loose pair can't be passed where a wire field is expected.
+ */
+type OnchainEvidence = {
+  readonly userOpHash: string;
+  readonly txHash: string;
+} & {
+  readonly [OnchainEvidenceBrand]: "OnchainEvidence";
+};
+//#endregion
+//#region src/client/financial-ops.d.ts
+type RecipientResolutionKind = "email" | "org" | "payee";
+interface MeProfile {
+  readonly authUserId: string;
+  readonly email: string;
+  readonly displayName: string | null;
+  readonly personalSafeAddress: string;
+}
+interface DepositInstructions {
+  readonly accountKind: "personalSafe";
+  readonly chainId: number;
+  readonly network: "base-sepolia";
+  readonly currency: "USD";
+  readonly address: string;
+  readonly label: string;
+}
+interface RecipientResolution {
+  readonly kind: RecipientResolutionKind;
+  readonly recipient: string;
+  readonly label: string;
+  readonly safeAddress: string;
+  readonly payeeId?: string;
+  readonly orgId?: string;
+  readonly handle?: string;
+  readonly email?: string;
+}
+interface Payee {
+  readonly payeeId: string;
+  readonly label: string;
+  readonly recipientRef: string;
+  readonly handle: string | null;
+  readonly destinationKind: "email" | "org" | "payeeHandle";
+  readonly safeAddress: string;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+}
+interface MeMethods {
+  get(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<MeProfile>>;
+  depositInstructions(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<DepositInstructions>>;
+}
+interface HandlesMethods {
+  resolve(handle: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<RecipientResolution>>;
+}
+interface PayeesMethods {
+  create(input: {
+    readonly label: string;
+    readonly recipient: string;
+    readonly handle?: string;
+  }, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payee>>;
+  get(payeeId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payee | null>>;
+  resolve(recipient: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<RecipientResolution>>;
+}
+interface PaymentMoney {
+  readonly currency: string;
+  readonly value: string;
+  readonly decimals: number;
+}
+type PaymentStatus = "pending" | "submitted" | "pending_claim" | "scheduled" | "streaming" | "settled" | "cancelled" | "redirected" | "expired" | "failed";
+type PaymentType = "unspecified" | "invoice" | "payroll" | "reimbursement";
+interface PaymentDocumentRef {
+  readonly documentHash: string;
+  readonly kind: "memo" | "invoice" | "payslip" | "receipt" | "withdrawal";
+  readonly title?: string;
+  readonly uri?: string;
+  readonly issuedAt?: number;
+}
+type PaymentRelease = {
+  readonly kind: "instant";
+} | {
+  readonly kind: "scheduled";
+  readonly at: number;
+} | {
+  readonly kind: "stream";
+  readonly startsAt: number;
+  readonly endsAt: number;
+  readonly cliffAt?: number;
+};
+interface Payment {
+  readonly id: string;
+  readonly status: PaymentStatus;
+  readonly amount: PaymentMoney;
+  readonly paymentType: PaymentType;
+  readonly recipient: {
+    readonly kind: "handle" | "email" | "payee" | "me" | "org" | "external_address";
+    readonly label: string;
+    readonly payeeId?: string;
+  };
+  readonly documents: readonly PaymentDocumentRef[];
+  readonly release: PaymentRelease;
+  readonly released: PaymentMoney;
+  readonly availableToClaim: PaymentMoney;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+}
+interface PaymentsPayInput {
+  readonly to: string;
+  readonly amount: PaymentMoney;
+  /** Full EIP-712 document envelope; hashed + stored, committed on-chain. */
+  readonly document?: PaymentDocumentEnvelopeV1;
+  /**
+   * Release clause (G3 · #546). Omitted ⇒ `instant` (the G2 direct-send path).
+   * A `scheduled`/`stream` clause turns the payment into a Commitment
+   * (escrow-vest-claim) backed by `CapxulPayments.createCommitment`.
+   */
+  readonly release?: PaymentRelease;
+  /**
+   * #592: itemized line items backing an Invoice `document`. The backend asserts
+   * `hashLineItems(lineItems) === document.lineItemsHash` AND `Σ(quantity ×
+   * unitMinor) === document.amount`, then persists the list for itemized render.
+   */
+  readonly lineItems?: readonly LineItemV1[];
+}
+/**
+ * B3 withdraw / cash-out input. Stripe-shaped: `to` is the EXTERNAL 0x wallet
+ * (the ONE place the SDK accepts a raw address — the pay lane never does),
+ * `amount` is a Money, `document` is the REQUIRED kind:4 Withdrawal envelope
+ * (carries the audit-visible destAddress). No chain / Safe / token / hash
+ * custody substrate on the input. Returns a leak-safe `Payment` whose recipient
+ * label is the redacted address — never the full 0x.
+ */
+interface PaymentsWithdrawInput {
+  readonly to: string;
+  readonly amount: PaymentMoney;
+  readonly document: PaymentDocumentEnvelopeV1;
+}
+interface PaymentSettlementInput {
+  readonly paymentId: string;
+  readonly evidence: OnchainEvidence;
+}
+/**
+ * Host-execution callback recording the on-chain escrow of a commitment
+ * (G3 · #546): `createCommitment` returned `onchainCommitmentId`, escrowing
+ * the total. `onchainCommitmentId` + the userOp/tx hashes are internal evidence,
+ * never on the wire (internal channel only).
+ */
+interface CommitmentCreatedInput {
+  readonly paymentId: string;
+  readonly onchainCommitmentId: string;
+  readonly evidence: OnchainEvidence;
+}
+/** Host-execution callback recording a recipient-side `claim` (G3 · #546). */
+interface CommitmentClaimInput {
+  readonly paymentId: string;
+  readonly evidence: OnchainEvidence;
+}
+/**
+ * Host-execution callback recording a creator-side `cancel` (G3 · #546):
+ * on-chain the unvested remainder returns to the creator; vested-unclaimed
+ * stays the recipient's. An optional credit-note document is appended.
+ */
+interface CommitmentCancelInput {
+  readonly paymentId: string;
+  readonly evidence: OnchainEvidence;
+  readonly document?: PaymentDocumentEnvelopeV1;
+}
+/**
+ * Host-execution callback recording a pre-claim `redirect` to a new validated
+ * recipient (G3 · #546). `to` is a validated recipient (handle/email/payee id),
+ * never a raw address.
+ */
+interface CommitmentRedirectInput {
+  readonly paymentId: string;
+  readonly to: string;
+  readonly evidence: OnchainEvidence;
+  readonly document?: PaymentDocumentEnvelopeV1;
+}
+/**
+ * Host-execution callback recording a settled ORG spend/payroll on the ONE
+ * `payments` ledger (D3 · #565). An org spend is a KIND of Payment — it lands a
+ * real `payments` row with `source:"org"` + `orgId` (no parallel `orgSpends`
+ * table, no synthetic client-side fabrication). The signer-side host calls this
+ * AFTER the on-chain Roles-modifier spend settles; `evidence` carries the
+ * internal userOp/tx hashes (never wire fields). `recipient` is the validated
+ * recipient ref label; `recipientSafeAddress` is internal evidence on the row.
+ */
+interface OrgPaymentRecordInput {
+  readonly orgId: string;
+  readonly recipientLabel: string;
+  readonly recipientSafeAddress: string;
+  readonly amount: PaymentMoney;
+  readonly paymentType: PaymentType;
+  readonly document?: PaymentDocumentEnvelopeV1;
+  /** The org Safe the spend debited — bound as the `from` of the settlement transfer. */
+  readonly orgSafeAddress: string;
+  /**
+   * 0-based occurrence among batch runs with the same (recipient, amount), so
+   * each run binds to + de-dupes on its own on-chain `Transfer` (D3 · #565).
+   */
+  readonly occurrenceIndex: number;
+  readonly evidence: OnchainEvidence;
+}
+interface PaymentDocumentVerification {
+  readonly documentHash: string;
+  readonly ok: boolean;
+  readonly derivedHash: string;
+  readonly kind: "memo" | "invoice" | "payslip" | "receipt" | "withdrawal";
+}
+/**
+ * #577 render-on-demand result. `html` is self-contained user-visible document
+ * HTML (stylesheet + rendered document). The MCP `paymentDocuments.render` tool
+ * exposes only `{documentHash, kind, ok}` to the model and returns `html` in an
+ * audience:["user"] content block (#506 redaction matrix).
+ */
+interface PaymentDocumentRender {
+  readonly documentHash: string;
+  readonly ok: boolean;
+  readonly kind: "memo" | "invoice" | "payslip" | "receipt" | "withdrawal";
+  readonly html: string;
+}
+/**
+ * Internal commitment execution reference (G3 · #546). The on-chain
+ * `onchainCommitmentId` is internal evidence (like userOp/tx hashes) — it never
+ * appears on the wire `Payment` or any MCP tool output, but the signer-side host
+ * needs it to build a claim/cancel/redirect UserOp. This is the server-internal
+ * channel that carries it (and the recipient Safe address for an auto-claim
+ * relayer), never a consumer-facing surface.
+ */
+interface PaymentCommitmentRef {
+  readonly paymentId: string;
+  readonly onchainCommitmentId: string | null;
+  readonly status: PaymentStatus;
+}
+/**
+ * The host-execution + on-chain-evidence channel for Payments (D2 · #564).
+ * SPLIT OFF the public `PaymentsMethods` so an external builder consuming
+ * `@capxul/sdk` directly never sees the custody substrate. Reached only via
+ * `client.payments._internal` (mirrors `client._internal.*`); the signer-side
+ * host (the dev MCP edge / a self-custody integrator) drives it AFTER executing
+ * a UserOp. Every input carries the `OnchainEvidence` brand — never a wire field.
+ */
+interface PaymentsInternalMethods {
+  /** Report on-chain settlement evidence for an instant payment. */
+  markSettled(input: PaymentSettlementInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * B3: report on-chain settlement evidence for a withdraw/cash-out. The
+   * backend binds the userOp to a matching external `Transfer` before settling.
+   */
+  markWithdrawalSettled(input: PaymentSettlementInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * Record the on-chain escrow of a commitment after `createCommitment` returns
+   * its `onchainCommitmentId` (G3 · #546).
+   */
+  markCommitmentCreated(input: CommitmentCreatedInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * Record a settled ORG spend/payroll on the one `payments` ledger
+   * (D3 · #565) — `source:"org"` + `orgId`, read back as a leak-safe Payment.
+   */
+  recordOrgPayment(input: OrgPaymentRecordInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /** Record a recipient-side `claim` after the on-chain claim UserOp settles. */
+  claim(input: CommitmentClaimInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /** Record a creator-side `cancel` reclaiming only the unvested remainder. */
+  cancel(input: CommitmentCancelInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /** Record a pre-claim `redirect` to a new validated recipient. */
+  redirect(input: CommitmentRedirectInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * The on-chain commitment reference the signer-side host needs to build a
+   * claim/cancel/redirect UserOp. `onchainCommitmentId` is internal evidence.
+   */
+  commitmentRef(paymentId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentCommitmentRef | null>>;
+}
+/**
+ * The PUBLIC, Stripe-shaped Payments surface (D2 · #564). Genus verbs only —
+ * `pay` / `list` / `get`. No `userOpHash` / `txHash` / `onchainCommitmentId` /
+ * `chainId` / `safeAddress`. Host-execution + on-chain evidence live on the
+ * `_internal` channel below; an external builder never touches custody substrate.
+ */
+interface PaymentsMethods {
+  pay(input: PaymentsPayInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * B3 withdraw / cash-out: send USDX from the user's custody Safe to an
+   * external 0x wallet, minting a kind:4 Withdrawal document. Returns a
+   * leak-safe `Payment` (recipient label is the redacted address).
+   */
+  withdraw(input: PaymentsWithdrawInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  list(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly Payment[]>>;
+  get(paymentId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment | null>>;
+  /**
+   * Host-execution + on-chain-evidence channel — off the public surface
+   * (production-surface-policy.md pattern). Self-custody integrators drive this;
+   * a Stripe-shaped consumer never does.
+   *
+   * @internal-use
+   */
+  readonly _internal: PaymentsInternalMethods;
+}
+interface PaymentDocumentsMethods {
+  verify(documentHash: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDocumentVerification>>;
+  /**
+   * #577: render-on-demand. Loads the owner's stored document by `documentHash`,
+   * re-verifies its EIP-712 hash, and renders it to self-contained HTML using the
+   * verified stored line items. Returns `{documentHash, kind, ok, html}`.
+   */
+  render(documentHash: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDocumentRender>>;
+}
+type PaymentRequestStatus = "draft" | "sent" | "viewed" | "paid" | "expired" | "cancelled";
+interface PaymentRequest {
+  readonly id: string;
+  readonly status: PaymentRequestStatus;
+  readonly amount: PaymentMoney;
+  readonly reference: string;
+  readonly memo: string | null;
+  /** Fixed-amount payment link token (HITL #519: basic, not replay-hardened). */
+  readonly linkToken: string;
+  /** Minimal entitlement (HITL #501): true once paid. */
+  readonly entitlementGranted: boolean;
+  /** The Payment this receivable settled into (set on collect). */
+  readonly settledPaymentId: string | null;
+  /** The receipt document committed for this receivable (set on collect). */
+  readonly receiptDocumentHash: string | null;
+  readonly expiresAt: number | null;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+}
+interface ReconciliationEntry {
+  readonly paymentRequestId: string;
+  readonly reference: string;
+  readonly status: "paid" | "exception";
+  readonly settledPaymentId: string | null;
+  readonly receiptDocumentHash: string | null;
+}
+interface PaymentRequestsCreateInput {
+  readonly amount: PaymentMoney;
+  readonly reference: string;
+  readonly memo?: string;
+  /** Optional expiry (epoch ms). HITL #519: expiry policy is a basic timestamp. */
+  readonly expiresAt?: number;
+}
+interface PaymentRequestsMethods {
+  /** Open a receivable in `draft` with a fixed-amount payment link. */
+  create(input: PaymentRequestsCreateInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentRequest>>;
+  markSent(paymentRequestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentRequest>>;
+  markViewed(paymentRequestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentRequest>>;
+  cancel(paymentRequestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentRequest>>;
+  /**
+   * Collect the receivable (HERMETIC until a live inbound path exists): settle
+   * it into the Payment ledger and mint a receipt linked by `documentHash`.
+   */
+  collect(paymentRequestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentRequest>>;
+  list(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly PaymentRequest[]>>;
+  get(paymentRequestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentRequest | null>>;
+  getByLink(linkToken: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentRequest | null>>;
+  /** Inbound reconciliation: paid / exception status per receivable. */
+  reconcile(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly ReconciliationEntry[]>>;
+}
+type PaymentDraftStatus = "draft" | "simulated" | "approval_pending" | "approved" | "executed" | "cancelled" | "expired";
+/** The leak-safe, model-visible draft/approval (#506). */
+interface PaymentDraft {
+  readonly id: string;
+  readonly status: PaymentDraftStatus;
+  readonly recipient: {
+    readonly kind: string;
+    readonly label: string;
+  };
+  readonly amount: PaymentMoney;
+  readonly documentHash: string | null;
+  /** The canonical-plan binding fingerprint (set at approvals.request). */
+  readonly planHash: string | null;
+  /** The opaque read-model version the draft was simulated against (stale-state). */
+  readonly readModelVersion: string;
+  readonly idempotencyKey: string;
+  readonly policyDecision: "allow" | "deny";
+  readonly expiresAt: number | null;
+  readonly settledPaymentId: string | null;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+}
+interface WorkbenchDraftInput {
+  readonly clientId: string;
+  readonly audience: string;
+  readonly scopes: readonly string[];
+  readonly to: string;
+  readonly amount: PaymentMoney;
+  readonly document?: PaymentDocumentEnvelopeV1;
+  readonly idempotencyKey: string;
+  /** Untrusted connector/model suggestion blob (default-deny taint). */
+  readonly tainted?: Record<string, unknown>;
+}
+interface WorkbenchMintResult {
+  readonly approvalToken: string;
+  readonly planHash: string;
+  readonly expiresAt: number;
+}
+interface WorkbenchExecuteInput {
+  readonly draftId: string;
+  readonly clientId: string;
+  readonly approvalToken: string;
+  readonly readModelVersion: string;
+  readonly userOpHash: string;
+  readonly txHash: string;
+}
+/**
+ * The decomposed workbench (G6 · #549). The edge PROPOSES (draft → simulate →
+ * request); the BACKEND mints the one-time plan-bound token via the human's
+ * browser (`mint`); `execute` consumes it. `mint` is the human step — the edge
+ * normally only reaches `request`, then hands the human a browser URL.
+ */
+interface WorkbenchMethods {
+  draft(input: WorkbenchDraftInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDraft>>;
+  simulate(draftId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDraft>>;
+  requestApproval(draftId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDraft>>;
+  /**
+   * THE HUMAN STEP: mint the one-time approval token (browser/approval app).
+   * F2 (#549): the backend gates minting on a human-origin `capability` the
+   * agent/edge does NOT possess (`CAPXUL_APPROVAL_CAPABILITY`); only the
+   * apps/approve browser app passes it. The edge/SDK lane cannot self-approve.
+   */
+  mint(draftId: string, capability: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<WorkbenchMintResult>>;
+  execute(input: WorkbenchExecuteInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  status(draftId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDraft | null>>;
+  cancel(draftId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDraft>>;
+}
+interface FinancialOpsMethods {
+  readonly me: MeMethods;
+  readonly handles: HandlesMethods;
+  readonly payees: PayeesMethods;
+  readonly payments: PaymentsMethods;
+  readonly paymentDocuments: PaymentDocumentsMethods;
+  /** Receivables surface (G5 · #548). */
+  readonly paymentRequests: PaymentRequestsMethods;
+  /** Decomposed workbench + trust substrate (G6 · #549). */
+  readonly workbench: WorkbenchMethods;
+}
+//#endregion
 //#region src/client/sub-accounts.d.ts
 interface SubAccountsMethods {
   create(accountId: AccountId, input: {
     readonly name: string;
   }, options?: {
     readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<SubAccount$1>>;
-  get(subAccountId: SubAccountId$1, options?: {
+  }): Promise<CapxulResult<SubAccount>>;
+  get(subAccountId: SubAccountId, options?: {
     readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<SubAccount$1 | null>>;
+  }): Promise<CapxulResult<SubAccount | null>>;
   list(accountId: AccountId, options?: {
     readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly SubAccount$1[]>>;
-  rename(subAccountId: SubAccountId$1, name: string, options?: {
+  }): Promise<CapxulResult<readonly SubAccount[]>>;
+  rename(subAccountId: SubAccountId, name: string, options?: {
     readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<SubAccount$1>>;
-  delete(subAccountId: SubAccountId$1, options?: {
+  }): Promise<CapxulResult<SubAccount>>;
+  delete(subAccountId: SubAccountId, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<void>>;
   transfer(input: TransferInput, options?: {
@@ -798,49 +1437,68 @@ interface SubAccountsMethods {
 }
 //#endregion
 //#region src/client/org-spend-gate.d.ts
-type SpendGateRecipients = "anyone" | readonly Address$1[];
+/**
+ * The role's allowed recipients. The address form backs the S4 `spend` path
+ * (recipient is a resolved `Address`); the string form backs the G4
+ * `spendViaPayments` / `batchPayroll` path, whose recipient is a VALIDATED REF
+ * (handle/email/payee/org) compared in the same ref space as the role's set.
+ * Comparison is case-insensitive over the raw string value either way.
+ */
+type SpendGateRecipients = "anyone" | readonly (Address | string)[];
 type SpendGateSubAccountScope = {
   readonly scope: "all";
 } | {
   readonly scope: "only";
-  readonly subAccountIds: readonly SubAccountId$1[];
+  readonly subAccountIds: readonly SubAccountId[];
 };
 //#endregion
 //#region src/ports/org.d.ts
+/**
+ * The minimal `{from, to, amount}` spend shape the authority read keys off
+ * (D3 #565). The legacy address-keyed `OrgSpendInput`/`org.spend` lane was
+ * hard-removed when `orgSpends` folded into the one `payments` ledger; the
+ * leak-safe ref-based lane (`spendViaPayments`/`batchPayroll`) constructs this
+ * internally and enforces the real validated recipient on the gate.
+ */
+type OrgSpendShape = {
+  readonly from: SubAccountId;
+  readonly to: Address;
+  readonly amount: Money;
+};
 type CreateOrgPortInput = {
   readonly input: CreateOrgInput;
 };
 type ReadOrgTreasuryInput = {
-  readonly orgId: OrgId$1;
+  readonly orgId: OrgId;
 };
 type ListOrgsInput = Record<never, never>;
 type ListOrgRolesInput = {
-  readonly orgId: OrgId$1;
+  readonly orgId: OrgId;
 };
 type ListOrgMembersInput = {
-  readonly orgId: OrgId$1;
+  readonly orgId: OrgId;
 };
 type InviteOrgMemberInput = {
-  readonly orgId: OrgId$1;
+  readonly orgId: OrgId;
   readonly input: InviteMemberInput;
 };
 type DetectPendingOrgInvitationsInput = Record<never, never>;
 type DetectPendingOrgInvitationsResult$1 = {
-  readonly matched: readonly OrgId$1[];
+  readonly matched: readonly OrgId[];
 };
 type DeployOrgRolesInput = {
-  readonly orgId: OrgId$1;
+  readonly orgId: OrgId;
 };
 type OrgRolesDeploymentResult = {
-  readonly orgId: OrgId$1;
+  readonly orgId: OrgId;
   readonly roles: readonly RoleView[];
 };
 type GrantOrgRoleInput = {
-  readonly orgId: OrgId$1;
+  readonly orgId: OrgId;
   readonly input: AssignRoleInput;
 };
 type RevokeOrgRoleInput = {
-  readonly orgId: OrgId$1;
+  readonly orgId: OrgId;
   readonly input: RemoveMemberInput;
 };
 type OrgSpendAuthority = {
@@ -854,15 +1512,9 @@ type OrgSpendAuthority = {
   readonly role?: string;
 };
 type ReadOrgSpendAuthorityInput = {
-  readonly orgId: OrgId$1;
-  readonly input: OrgSpendInput;
-  readonly amountRaw: string;
-};
-type SubmitOrgSpendInput = {
-  readonly orgId: OrgId$1;
-  readonly input: OrgSpendInput;
+  readonly orgId: OrgId;
+  readonly input: OrgSpendShape;
   readonly amountRaw: string;
-  readonly authority: OrgSpendAuthority;
 };
 declare const OrgError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
   readonly _tag: "OrgError";
@@ -882,7 +1534,7 @@ declare class OrgError extends OrgError_base<{
  */
 interface OrgPort {
   createOrg(input: CreateOrgPortInput): Effect.Effect<OrgView, OrgError, never>;
-  readTreasury(input: ReadOrgTreasuryInput): Effect.Effect<Account$1, OrgError, never>;
+  readTreasury(input: ReadOrgTreasuryInput): Effect.Effect<Account, OrgError, never>;
   listOrgs(input: ListOrgsInput): Effect.Effect<readonly OrgView[], OrgError, never>;
   listRoles(input: ListOrgRolesInput): Effect.Effect<readonly RoleView[], OrgError, never>;
   listMembers(input: ListOrgMembersInput): Effect.Effect<readonly MemberView[], OrgError, never>;
@@ -894,9 +1546,34 @@ interface OrgRolesDeploymentPort {
   grantRole(input: GrantOrgRoleInput): Effect.Effect<MemberView, OrgError, never>;
   revokeRole(input: RevokeOrgRoleInput): Effect.Effect<void, OrgError, never>;
 }
+type SubmitOrgSpendViaPaymentsInput = {
+  readonly orgId: OrgId;
+  readonly input: OrgSpendViaPaymentsInput;
+  readonly amountRaw: string;
+  readonly authority: OrgSpendAuthority;
+};
+type SubmitOrgBatchPayrollInput = {
+  readonly orgId: OrgId;
+  readonly from: OrgSpendViaPaymentsInput["from"];
+  readonly runs: readonly {
+    readonly run: OrgPayrollRun;
+    readonly amountRaw: string;
+  }[];
+  readonly authorities: readonly OrgSpendAuthority[];
+};
 interface OrgSpendPort {
   readSpendAuthority(input: ReadOrgSpendAuthorityInput): Effect.Effect<OrgSpendAuthority, OrgError, never>;
-  submitSpend(input: SubmitOrgSpendInput): Effect.Effect<OrgSpendResult, OrgError, never>;
+  /**
+   * Leak-safe org spend (G4 · #547; D3 #565 — the one ledger of record): execute
+   * the spend through the payments engine (Roles modifier → CapxulPayments),
+   * write a real `payments` row (`source:"org"`) and read it back as a `Payment`
+   * — the wire carries no `txHash` / Safe / userOp internals. Optional so a
+   * hermetic adapter without a payments-submit lane still compiles; absent ⇒ the
+   * program falls back to a deterministic hermetic `Payment`.
+   */
+  submitSpendViaPayments?(input: SubmitOrgSpendViaPaymentsInput): Effect.Effect<Payment, OrgError, never>;
+  /** Leak-safe org payroll batch (G4 · #547): one MultiSend, one Payment per run. */
+  submitBatchPayroll?(input: SubmitOrgBatchPayrollInput): Effect.Effect<readonly Payment[], OrgError, never>;
 }
 //#endregion
 //#region src/client/org.d.ts
@@ -916,12 +1593,12 @@ type MemberStatus = "pending" | "pending_safe" | "pending_grant" | "active" | "r
  * brand.
  */
 type OrgView = {
-  readonly id: OrgId$1;
+  readonly id: OrgId;
   readonly name: string;
   readonly handle: string;
-  readonly safeAddress: Address$1; /** The viewing member's own role label within this org. */
+  readonly safeAddress: Address; /** The viewing member's own role label within this org. */
   readonly role: string; /** The Org treasury — the real M2 Account over the Org Safe (D3). */
-  readonly treasury: Account$1;
+  readonly treasury: Account;
 };
 /**
  * One member of an Org (canon §C1 "Members" — name/email, role, status; D7/D8).
@@ -930,12 +1607,12 @@ type OrgView = {
  * yet provisioned a personal Safe). `email` is the universal entry point (D8).
  */
 type MemberView = {
-  readonly orgId: OrgId$1;
+  readonly orgId: OrgId;
   readonly email: Email;
   readonly name: string | null; /** Member-identity key (D7). `null` until the invitee provisions a Safe. */
-  readonly personalSafeAddress: Address$1 | null; /** The member's role label (maps deterministically to the on-chain `roleKey`, D9). */
+  readonly personalSafeAddress: Address | null; /** The member's role label (maps deterministically to the on-chain `roleKey`, D9). */
   readonly role: string;
-  readonly roleKey: RoleKey$1 | null;
+  readonly roleKey: RoleKey | null;
   readonly status: MemberStatus;
   readonly grantTxHash: string | null;
   readonly revokeTxHash: string | null;
@@ -947,9 +1624,9 @@ type MemberView = {
  * (the Owner role).
  */
 type RoleSpendCap = {
-  readonly perTx?: Money$1;
-  readonly perDay?: Money$1;
-  readonly toRecipients?: "anyone" | readonly Address$1[];
+  readonly perTx?: Money;
+  readonly perDay?: Money;
+  readonly toRecipients?: "anyone" | readonly Address[];
 };
 /**
  * The Capxul-owned Role DSL definition (D4). `label` becomes the sticky
@@ -961,7 +1638,7 @@ type RoleDefinition = {
   readonly label: string;
   readonly spend?: RoleSpendCap;
   readonly subAccounts?: {
-    readonly scope: "all" | readonly SubAccountId$1[];
+    readonly scope: "all" | readonly SubAccountId[];
   };
   readonly canManageMembers?: boolean;
   readonly canManageRoles?: boolean;
@@ -972,9 +1649,9 @@ type RoleDefinition = {
  * is the full Role DSL entry.
  */
 type RoleView = {
-  readonly orgId: OrgId$1;
+  readonly orgId: OrgId;
   readonly label: string;
-  readonly roleKey: RoleKey$1;
+  readonly roleKey: RoleKey;
   readonly definition: RoleDefinition;
 };
 /** Built-in role templates that seed a new Org at creation (D6). */
@@ -1009,7 +1686,7 @@ type InviteMemberInput = {
  * mirror.
  */
 type RemoveMemberInput = {
-  readonly memberSafeAddress: Address$1;
+  readonly memberSafeAddress: Address;
 };
 /**
  * Input to `org(orgId).assignRole` (S3, D7/D9). Keyed on the member's personal
@@ -1017,26 +1694,48 @@ type RemoveMemberInput = {
  * label maps deterministically to the on-chain `roleKey`.
  */
 type AssignRoleInput = {
-  readonly memberSafeAddress: Address$1;
+  readonly memberSafeAddress: Address;
   readonly role: string;
 };
 /**
- * Input to `org(orgId).spend` (S4, capstone, D5). A member spends `amount` from
- * a scoped sub-account `from` to `to`, gated Level 1 (Zodiac cap) + Level 2
- * (envelope scope/balance). One UserOp: signer → personal Safe → Org Roles
- * modifier → `CapxulPayments.send`.
+ * Input to `org(orgId).spendViaPayments` (G4 · #547). The LEAK-SAFE org spend:
+ * delegates `org.spend` to the payments engine WITH the member's org role
+ * authority and returns a `Payment`, not a `txHash`. `to` is a VALIDATED
+ * recipient ref (handle / email / payee id / org handle) — never a raw
+ * `Address` (the legacy address-keyed `org.spend` lane was hard-removed in D3
+ * #565 when `orgSpends` was folded into the one `payments` ledger).
+ * `from` is the Level-2 sub-account envelope the spend draws from (D5).
  */
-type OrgSpendInput = {
-  /** The sub-account (envelope) the spend draws from (Level-2 scope, D5). */readonly from: SubAccountId$1;
-  readonly to: Address$1;
-  readonly amount: Money$1;
+type OrgSpendViaPaymentsInput = {
+  readonly from: SubAccountId; /** Validated recipient ref (handle/email/payee/org) — never a raw address. */
+  readonly to: string;
+  readonly amount: Money; /** Full EIP-712 payment document; hashed + stored, committed on-chain. */
+  readonly document?: PaymentDocumentEnvelopeV1;
+  readonly paymentType?: PaymentType;
 };
-/** Result of a settled Org spend — the settling transaction hash (S4). */
-type OrgSpendResult = {
-  readonly txHash: string;
+/**
+ * One run in an `org(orgId).batchPayroll` batch (G4 · #547): a validated
+ * recipient, an amount, and an optional payslip document. Each run is gated
+ * independently against the role's per-tx / per-day / recipient conditions.
+ */
+type OrgPayrollRun = {
+  /** Validated recipient ref (handle/email/payee/org) — never a raw address. */readonly to: string;
+  readonly amount: Money; /** The payslip — an EIP-712 payment document, committed by `documentHash`. */
+  readonly payslip?: PaymentDocumentEnvelopeV1;
+};
+/**
+ * Input to `org(orgId).batchPayroll` (G4 · #547). Pays N employees in one
+ * MultiSend through the Roles modifier; each carries a payslip and settles as
+ * `paymentType = payroll`. Every run is gated; an over-cap run REJECTS the
+ * whole batch (no partial treasury drain). Returns one leak-safe `Payment` per
+ * run.
+ */
+type OrgBatchPayrollInput = {
+  readonly from: SubAccountId;
+  readonly runs: readonly OrgPayrollRun[];
 };
 type DetectPendingOrgInvitationsResult = {
-  readonly matched: readonly OrgId$1[];
+  readonly matched: readonly OrgId[];
 };
 /**
  * Entity-scoped Org method bundle, returned by `capxul.org(orgId)`. Every
@@ -1048,7 +1747,7 @@ interface OrgScopedMethods {
   /** The Org treasury — the real M2 Account over the Org Safe (D3). */
   treasury(options?: {
     readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Account$1>>;
+  }): Promise<CapxulResult<Account>>;
   members(options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<readonly MemberView[]>>;
@@ -1067,9 +1766,23 @@ interface OrgScopedMethods {
   assignRole(input: AssignRoleInput, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<MemberView>>;
-  spend(input: OrgSpendInput, options?: {
+  /**
+   * Leak-safe org spend (G4 · #547; D3 #565 — the one ledger of record): execute
+   * the spend through the payments engine with the member's org role authority
+   * and return a `Payment` (no `to: Address`, no `txHash`, no Safe / userOp
+   * internals). Writes a real `payments` row (`source:"org"`).
+   */
+  spendViaPayments(input: OrgSpendViaPaymentsInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * Org payroll batch (G4 · #547): pay N employees in one MultiSend through the
+   * Roles modifier, each with a payslip. Every run is gated; an over-cap run
+   * rejects the whole batch. Returns one leak-safe `Payment` per run.
+   */
+  batchPayroll(input: OrgBatchPayrollInput, options?: {
     readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<OrgSpendResult>>;
+  }): Promise<CapxulResult<readonly Payment[]>>;
 }
 type OrgsMethod = {
   (options?: {
@@ -1089,7 +1802,7 @@ interface OrgMethods {
   }): Promise<CapxulResult<OrgView>>;
   readonly orgs: OrgsMethod;
   /** Resolve the entity-scoped bundle for a specific Org (D13). */
-  org(orgId: OrgId$1): OrgScopedMethods;
+  org(orgId: OrgId): OrgScopedMethods;
 }
 //#endregion
 //#region src/client/create-capxul-client.d.ts
@@ -1108,6 +1821,32 @@ interface CapxulClient {
    * Returns `{ balance, available }` as `Money` — never wei or token units.
    */
   readonly accounts: AccountsMethods;
+  readonly me: MeMethods;
+  readonly handles: HandlesMethods;
+  readonly payees: PayeesMethods;
+  /**
+   * Direct Payments surface (G2 · #545). `pay` records a validated-recipient
+   * payment; `list`/`get` read the ledger; `markSettled` is the host-execution
+   * callback. The MCP `draft → simulate → approve → execute` workbench is G6.
+   */
+  readonly payments: PaymentsMethods;
+  /** Payment document verification (G2 · #545): re-derive the EIP-712 hash. */
+  readonly paymentDocuments: PaymentDocumentsMethods;
+  /**
+   * Receivables surface (G5 · #548). `create` opens a `PaymentRequest` with a
+   * fixed-amount link; `markSent`/`markViewed`/`cancel` move the funnel;
+   * `collect` settles the receivable into the Payment ledger + mints a receipt
+   * linked by `documentHash`; `list`/`get`/`getByLink`/`reconcile` read it.
+   */
+  readonly paymentRequests: PaymentRequestsMethods;
+  /**
+   * Decomposed workbench + trust substrate (G6 · #549). The MCP
+   * `draft → simulate → approvals.request → execute` workbench: the edge
+   * PROPOSES, the BACKEND mints a one-time plan-bound approval token via the
+   * human's browser (#510), and `execute` consumes it. Taint / idempotency /
+   * stale-state / scope guards are enforced backend-side.
+   */
+  readonly workbench: WorkbenchMethods;
   /** Sub-account lifecycle (M2 Slice S2a · #267). Transfer lands in S2b. */
   readonly subAccounts: SubAccountsMethods;
   /**
@@ -1120,8 +1859,6 @@ interface CapxulClient {
   readonly createOrg: OrgMethods["createOrg"];
   readonly orgs: OrgMethods["orgs"];
   readonly org: OrgMethods["org"];
-  /** Resolved bootstrap for this client instance (chain, auth URLs, etc.). */
-  readonly bootstrap: BootstrapResolution;
   /**
    * Internal observation namespace. Consumers MUST NOT drive the actor
    * directly — use the method bundles instead.
@@ -1130,17 +1867,23 @@ interface CapxulClient {
    */
   readonly _internal: {
     readonly authActor: AuthFlowObserver;
+    /**
+     * Resolved bootstrap for this client instance (chain, auth URLs, etc.).
+     * Off the public surface per production-surface-policy.md (#31).
+     */
+    readonly bootstrap: BootstrapResolution;
     /**
      * Dev-only faucet bundle (production-surface-policy.md). `fund` lives here,
      * NOT on the public `client.accounts` surface.
      */
-    readonly accounts: AccountsFaucetMethods;
+    readonly accounts: AccountsFaucetMethods; /** Telemetry port for error reporting. Used by React hooks to report errors before throwing. */
+    readonly telemetry?: TelemetryPort;
     readonly close?: () => Promise<void>;
   };
 }
 interface CreateCapxulClientInput {
   /**
-   * The 12-port `FlowPorts` bundle. The factory narrows this to the
+   * The 13-port `FlowPorts` bundle. The factory narrows this to the
    * 3-port AuthFlow subset (`authClient`, `clock`, `telemetry`) for
    * the flow internally, and uses additional ports (`identity`,
    * `smartAccount`) for the method bundles.
@@ -1204,23 +1947,97 @@ interface CreateCapxulClientInput {
   readonly orgSpendPort?: OrgSpendPort;
   readonly orgDeploymentConfig?: SafeDeploymentConfig;
 }
-declare function assembleCapxulClient(input: CreateCapxulClientInput): CapxulClient;
+//#endregion
+//#region src/adapters/auth-cache/BrowserAuthCacheAdapter.d.ts
+interface BrowserStorageShape {
+  getItem(key: string): string | null;
+  setItem(key: string, value: string): void;
+  removeItem(key: string): void;
+}
+//#endregion
+//#region src/dev-signer.d.ts
+interface DevPrivateKeySignerInput {
+  /** Dev-only derivation seed (e.g. `VITE_CAPXUL_DEV_SIGNER_SEED`). Throwaway keys only. */
+  readonly seed: string;
+  /** Explicit email — skips the auth-cache lookup (tests, node harnesses). */
+  readonly email?: string;
+  /** Storage holding the cached session. Defaults to browser `localStorage`. */
+  readonly storage?: BrowserStorageShape;
+}
+/** Deterministic dev private key for an email under a seed. Exported for probes. */
+declare function deriveDevPrivateKey(seed: string, email: string): Hex;
+/**
+ * Browser-safe dev signer. Lazy: the email (and so the key) is resolved at
+ * each `getAddress()` / `signUserOpHash()` from the cached session, so the
+ * same signer instance follows whichever user is signed in.
+ */
+declare function devPrivateKeySigner(input: DevPrivateKeySignerInput): CapxulSigner;
+//#endregion
+//#region src/adapters/openfort/embedded-wallet-port.d.ts
+/**
+ * Minimal Openfort embedded-wallet surface for hermetic tests and
+ * `openfortEmbeddedSigner`. Keeps Convex / Shield secrets out of the SDK.
+ */
+interface OpenfortEmbeddedWalletPort {
+  /** Owner EOA address — must stay stable for the lifetime of this port. */
+  getAddress(): Promise<string>;
+  /**
+   * Sign a 32-byte SafeOp digest without EIP-191 prefixing (backend-orchestrated
+   * deploy contract).
+   */
+  signRawDigest(hash: Hex): Promise<Hex>;
+}
+/** Openfort `embeddedWallet` subset used by `openfortEmbeddedWalletPort`. */
+interface OpenfortEmbeddedWalletApi {
+  get(): Promise<{
+    readonly address: string;
+  }>;
+  signMessage(message: string | Uint8Array, options?: {
+    readonly hashMessage?: boolean;
+    readonly arrayifyMessage?: boolean;
+  }): Promise<string>;
+}
+declare function openfortEmbeddedWalletPort(input: {
+  readonly embeddedWallet: OpenfortEmbeddedWalletApi;
+  readonly ensureReady?: () => Promise<void>;
+}): OpenfortEmbeddedWalletPort;
+//#endregion
+//#region src/openfort-embedded-signer.d.ts
+interface OpenfortEmbeddedSignerInput {
+  readonly wallet: OpenfortEmbeddedWalletPort;
+}
+/** Browser helper: wrap an initialized Openfort `embeddedWallet` API. */
+declare function openfortEmbeddedSignerFromWallet(input: {
+  readonly embeddedWallet: OpenfortEmbeddedWalletApi;
+  readonly ensureWalletReady?: () => Promise<void>;
+}): OpenfortEmbeddedSigner;
+/**
+ * Browser `CapxulSigner` backed by an Openfort embedded wallet (#335).
+ * Signs the backend's SafeOp digest via raw `signMessage` (no EIP-191 prefix)
+ * and verifies recovery before the backend submits.
+ */
+type OpenfortEmbeddedSigner = CapxulSigner & {
+  /** Drop cached `getAddress()` so the next read hits the embedded wallet again. */readonly resetAddressCache: () => void;
+};
+declare function openfortEmbeddedSigner(input: OpenfortEmbeddedSignerInput): OpenfortEmbeddedSigner;
+/**
+ * Canonical name for the embedded-wallet `CapxulSigner` constructor
+ * (backend-orchestrated-deploy.md). The embedded-wallet (passkey / Openfort)
+ * member of the named constructor trio `localPrivateKeySigner` /
+ * `injectedWalletSigner` / `embeddedSigner`. Takes the provider-agnostic
+ * `OpenfortEmbeddedWalletPort` (getAddress + signRawDigest); the Openfort-API
+ * convenience wrapper is `openfortEmbeddedSignerFromWallet`.
+ */
+declare const embeddedSigner: typeof openfortEmbeddedSigner;
 //#endregion
 //#region src/production.d.ts
-type ProductionRuntime = "browser" | "node";
-type ProductionAdapterClose = () => Promise<void>;
-interface ProductionAdapterInput {
+/**
+ * Consumer-facing `createCapxulClient` input (SDK DX public surface · #326).
+ * The publishable key is the primary input; bootstrap host, invoke timeout,
+ * runtime detection, and auth-cache selection are SDK-owned defaults.
+ */
+interface CapxulClientInput {
   readonly publishableKey: string;
-  readonly origin?: string;
-  readonly bootstrapBaseUrl?: string;
-  readonly runtime?: ProductionRuntime;
-  readonly authCache?: AuthCachePort;
-  readonly telemetry?: TelemetryPort;
-  readonly evmSigner?: EvmSignerPort;
-  readonly fetch?: typeof fetch;
-  readonly signal?: AbortSignal;
-  readonly otpTtlMs?: number;
-  readonly invokeTimeoutMs?: number;
   /**
    * Init-time account readiness target (issue #159 · AC4). Threaded into
    * `assembleCapxulClient` so `client.account.{getStatus,ensureReady}` reflect
@@ -1237,27 +2054,38 @@ interface ProductionAdapterInput {
    * holds an RPC URL, a gas-sponsorship policy, or a bundler.
    */
   readonly signer?: CapxulSigner;
-  /**
-   * Optional live Org-deploy lane (canon D10 SDK-orchestrated Org Safe deploy +
-   * D3 RPC treasury). Supplied as a FACTORY rather than a pre-built port because
-   * the live `OrgPort` (`LiveOrgDeploymentAdapter`) talks to the backend
-   * `org.createOrg` mutation through the SAME authenticated Convex seam the rest
-   * of the client uses (`tokenProvider → getConvexJwt → ConvexCallAdapter`),
-   * which only exists AFTER `createProductionAdapters` resolves bootstrap. The
-   * factory receives that resolved `ConvexCallPort` and returns the port; the
-   * CLI deploy-stack builds the factory from the deployer key + RPC (the same
-   * env/signer as `safeDeploymentPort`). When omitted, the hermetic `$0` path
-   * runs (a fresh Org has no on-chain funds).
-   */
-  readonly orgDeploymentPortFactory?: (convex: ConvexCallPort) => OrgPort & OrgRolesDeploymentPort & OrgSpendPort;
-  readonly orgDeploymentConfig?: SafeDeploymentConfig;
 }
-interface ProductionAdapters {
-  readonly ports: FlowPorts;
-  readonly bootstrap: BootstrapResolution;
-  readonly close: ProductionAdapterClose;
+//#endregion
+//#region src/client/create-capxul-client-from-production.d.ts
+/** Consumer-facing factory — accepts only production-meaningful inputs (#326). */
+declare function createCapxulClient(input: CapxulClientInput): Promise<CapxulResult<CapxulClient>>;
+//#endregion
+//#region src/telemetry/capture-exception.d.ts
+interface HandledErrorReportContext {
+  readonly layer?: string;
+  readonly operation?: string;
+  readonly provider?: string;
+  readonly capxul_error_code?: string;
+  readonly failure_mode?: FailureMode;
 }
-declare function createCapxulClient(input: ProductionAdapterInput): Promise<CapxulResult<CapxulClient>>;
+/**
+ * Capture an error as a `$exception` event through the telemetry port,
+ * formatted for PostHog Error Tracking.
+ *
+ * Parses stack traces into `$exception_list` format, extracts structured
+ * metadata from CapxulError objects, and supplements with context props.
+ * Fire-and-forget: telemetry defects are silently swallowed.
+ * Returns `Effect<void, never>` for use in Effect pipelines; the underlying
+ * adapter work is synchronous, so callers outside Effect contexts can
+ * use `Effect.runSync`.
+ */
+declare function captureException(telemetry: TelemetryPort, error: unknown, context?: HandledErrorReportContext): Effect.Effect<void, never>;
+/**
+ * Synchronous fire-and-forget capture. Runs the Effect inline with
+ * `Effect.runSync` so callers outside an Effect context (e.g. React
+ * hooks before throwing) can report errors without awaiting.
+ */
+declare function captureExceptionSync(telemetry: TelemetryPort, error: unknown, context?: HandledErrorReportContext): void;
 //#endregion
-export { type Account, type AccountMethods, type AccountProvider, type AccountProviderSource, type AccountRequirement, type AccountStatus, type AccountsMethods, type Address, type AssignRoleInput, type AuthMethods, type AuthSession, type AuthUserId, type CapxulClient, type CapxulResult, type CapxulSigner, type CreateCapxulClientInput, type CreateOrgInput, type DetectPendingOrgInvitationsResult, type Eip1193Provider, type Eip1193RequestProvider, type IdentityMethods, type InviteMemberInput, type MemberStatus, type MemberView, type Money, type OrgId, type OrgMethods, type OrgScopedMethods, type OrgSpendInput, type OrgSpendResult, type OrgTemplate, type OrgView, type ProductionAdapterClose, type ProductionAdapterInput, type ProductionAdapters, type ProductionRuntime, type Profile, type RemoveMemberInput, type RoleDefinition, type RoleKey, type RoleSpendCap, type RoleView, type Session, type SmartAccount, type SmartAccountMethods, type SubAccount, type SubAccountId, type SubAccountsMethods, type TransferEndpoint, type TransferInput, type TransferResult, assembleCapxulClient, createCapxulClient, eip1193AccountProvider, injectedWalletSigner, localPrivateKeyAccountProvider, openfortEmbeddedAccountProvider };
+export { type Account, type AccountLifecycle, type AccountMethods, type AccountProvider, type AccountProviderSource, type AccountRequirement, type AccountSetupStep, type AccountsMethods, type Address, type AssignRoleInput, type AuthMethods, type AuthSession, type AuthUserId, type CapxulClient, type CapxulClientInput, type CapxulResult, type CapxulSigner, type CreateCapxulClientInput, type CreateOrgInput, type DepositInstructions, type DetectPendingOrgInvitationsResult, type DevPrivateKeySignerInput, type Eip1193Provider, type Eip1193RequestProvider, type FinancialOpsMethods, type HandledErrorReportContext, type HandlesMethods, type IdentityMethods, type InviteMemberInput, type MeMethods, type MeProfile, type MemberStatus, type MemberView, type Money, type OpenfortEmbeddedSignerInput, type OpenfortEmbeddedWalletApi, type OpenfortEmbeddedWalletPort, type OrgBatchPayrollInput, type OrgId, type OrgMethods, type OrgPayrollRun, type OrgScopedMethods, type OrgSpendViaPaymentsInput, type OrgTemplate, type OrgView, type Payee, type PayeesMethods, type Payment, type PaymentDocumentRef, type PaymentDocumentRender, type PaymentDocumentVerification, type PaymentDocumentsMethods, type PaymentDraft, type PaymentDraftStatus, type PaymentMoney, type PaymentRelease, type PaymentRequest, type PaymentRequestStatus, type PaymentRequestsCreateInput, type PaymentRequestsMethods, type PaymentSettlementInput, type PaymentStatus, type PaymentType, type PaymentsMethods, type PaymentsPayInput, type PaymentsWithdrawInput, type Profile, type RecipientResolution, type RecipientResolutionKind, type ReconciliationEntry, type RemoveMemberInput, type RoleDefinition, type RoleKey, type RoleSpendCap, type RoleView, type Session, type SmartAccount, type SmartAccountMethods, type SubAccount, type SubAccountId, type SubAccountsMethods, type TelemetryPort, type TransferEndpoint, type TransferInput, type TransferResult, type WorkbenchDraftInput, type WorkbenchExecuteInput, type WorkbenchMethods, type WorkbenchMintResult, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, injectedWalletSigner, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort };
 //# sourceMappingURL=index.d.mts.map