@capxul/sdk 1.0.0-alpha.11 → 1.0.0-alpha.12

package/dist/node/index.d.mts

@@ -1,7 +1,7 @@
-import { s as AuthSession } from "../index-CTXgQ_xR.mjs";
-import { _ as AuthCachePortTag, g as AuthCachePort, h as AuthCacheError, n as CapxulSigner, v as CachedJwt } from "../signer-D9fUJp8o.mjs";
-import { Hex } from "viem";
+import { _ as AuthCachePortTag, g as AuthCachePort, h as AuthCacheError, n as CapxulSigner, v as CachedJwt } from "../signer-DEMJbpJ2.mjs";
+import { AuthSession } from "@capxul/types";
 import { Effect, Layer } from "effect";
+import { Hex } from "viem";
 import * as PlatformFileSystem from "@effect/platform/FileSystem";
 import * as PlatformPath from "@effect/platform/Path";
 

package/dist/node/index.mjs

@@ -1,4 +1,5 @@
-import { a as AuthCacheError, f as toAddress, i as parseCachedJwt, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, r as parseAuthSession, t as InMemoryAuthCacheAdapter } from "../InMemoryAuthCacheAdapter-v5W-XB5M.mjs";
+import { a as AuthCacheError, i as parseCachedJwt, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, r as parseAuthSession, t as InMemoryAuthCacheAdapter } from "../InMemoryAuthCacheAdapter-EBzKEJmQ.mjs";
+import { toAddress } from "@capxul/types";
 import { Effect, Layer } from "effect";
 import { privateKeyToAccount } from "viem/accounts";
 import * as os from "node:os";

package/dist/node/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/adapters/auth-cache/FileSystemAuthCacheAdapter.ts","../../src/node/index.ts"],"sourcesContent":["import type * as PlatformError from \"@effect/platform/Error\";\nimport * as PlatformFileSystem from \"@effect/platform/FileSystem\";\nimport * as PlatformPath from \"@effect/platform/Path\";\nimport * as NodeFileSystem from \"@effect/platform-node/NodeFileSystem\";\nimport * as NodePath from \"@effect/platform-node/NodePath\";\nimport { Effect, Layer } from \"effect\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport {\n  AuthCacheError,\n  AuthCachePortTag,\n  type AuthCachePort,\n  type CachedJwt,\n} from \"../../ports/auth-cache\";\nimport { parseAuthSession, parseCachedJwt } from \"./serialization\";\n\ninterface FilePayload {\n  readonly session: AuthSession | null;\n  readonly jwt: CachedJwt | null;\n}\n\ntype FileSystemRuntime = PlatformFileSystem.FileSystem | PlatformPath.Path;\n\nfunction emptyPayload(): FilePayload {\n  return { session: null, jwt: null };\n}\n\nconst nodeFileSystemRuntime = Layer.merge(NodeFileSystem.layer, NodePath.layer);\n\nexport class FileSystemAuthCacheAdapter implements AuthCachePort {\n  private readonly path: string;\n  private readonly runtime: Layer.Layer<FileSystemRuntime>;\n  readonly getSession: Effect.Effect<AuthSession | null, AuthCacheError>;\n  readonly setSession: (session: AuthSession) => Effect.Effect<void, AuthCacheError>;\n  readonly clearSession: Effect.Effect<void, AuthCacheError>;\n  readonly getJwt: Effect.Effect<CachedJwt | null, AuthCacheError>;\n  readonly setJwt: (jwt: CachedJwt) => Effect.Effect<void, AuthCacheError>;\n  readonly clearJwt: Effect.Effect<void, AuthCacheError>;\n\n  constructor(path: string, runtime: Layer.Layer<FileSystemRuntime> = nodeFileSystemRuntime) {\n    this.path = path;\n    this.runtime = runtime;\n\n    this.getSession = this.run(\n      \"getSession\",\n      this.read().pipe(Effect.map((payload) => payload.session)),\n    );\n    this.setSession = (session: AuthSession) =>\n      this.run(\n        \"setSession\",\n        Effect.gen(this, function* () {\n          const cur = yield* this.read();\n          yield* this.write({ session, jwt: cur.jwt });\n        }),\n      );\n    this.clearSession = this.run(\n      \"clearSession\",\n      Effect.gen(this, function* () {\n        const cur = yield* this.read();\n        yield* this.write({ session: null, jwt: cur.jwt });\n      }),\n    );\n    this.getJwt = this.run(\"getJwt\", this.read().pipe(Effect.map((payload) => payload.jwt)));\n    this.setJwt = (jwt: CachedJwt) =>\n      this.run(\n        \"setJwt\",\n        Effect.gen(this, function* () {\n          const cur = yield* this.read();\n          yield* this.write({ session: cur.session, jwt });\n        }),\n      );\n    this.clearJwt = this.run(\n      \"clearJwt\",\n      Effect.gen(this, function* () {\n        const cur = yield* this.read();\n        yield* this.write({ session: cur.session, jwt: null });\n      }),\n    );\n  }\n\n  private read(): Effect.Effect<FilePayload, PlatformError.PlatformError, FileSystemRuntime> {\n    return Effect.gen(this, function* () {\n      const fs = yield* PlatformFileSystem.FileSystem;\n      const exists = yield* fs.exists(this.path);\n      if (!exists) return emptyPayload();\n      const raw = yield* fs.readFileString(this.path, \"utf-8\");\n\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(raw);\n      } catch {\n        return emptyPayload();\n      }\n      if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n        return emptyPayload();\n      }\n      const payload = parsed as { readonly session?: unknown; readonly jwt?: unknown };\n\n      return {\n        session: parseAuthSession(payload.session),\n        jwt: parseCachedJwt(payload.jwt),\n      };\n    });\n  }\n\n  private write(\n    payload: FilePayload,\n  ): Effect.Effect<void, PlatformError.PlatformError, FileSystemRuntime> {\n    return Effect.gen(this, function* () {\n      const fs = yield* PlatformFileSystem.FileSystem;\n      const path = yield* PlatformPath.Path;\n      const dir = path.dirname(this.path);\n      const dirExists = yield* fs.exists(dir);\n      if (!dirExists) {\n        yield* fs.makeDirectory(dir, { recursive: true, mode: 0o700 });\n      }\n      yield* fs.writeFileString(this.path, JSON.stringify(payload), { mode: 0o600 });\n      yield* fs.chmod(this.path, 0o600);\n    });\n  }\n\n  private run<T>(\n    operation: string,\n    effect: Effect.Effect<T, PlatformError.PlatformError, FileSystemRuntime>,\n  ): Effect.Effect<T, AuthCacheError> {\n    return effect.pipe(\n      Effect.mapError((cause) => toAuthCacheError(operation, cause)),\n      Effect.provide(this.runtime),\n    );\n  }\n}\n\nexport function FileSystemAuthCacheLayer(input: {\n  readonly path: string;\n  readonly runtime?: Layer.Layer<FileSystemRuntime>;\n}): Layer.Layer<AuthCachePortTag, AuthCacheError> {\n  return Layer.effect(\n    AuthCachePortTag,\n    Effect.sync(() => new FileSystemAuthCacheAdapter(input.path, input.runtime)).pipe(\n      Effect.mapError((cause) => toAuthCacheError(\"initialize\", cause)),\n    ),\n  );\n}\n\nfunction toAuthCacheError(operation: string, cause: unknown): AuthCacheError {\n  return new AuthCacheError({ operation, cause });\n}\n","// `@capxul/sdk/node` — node-only entry (published-package-boundaries.md).\n//\n// The default `@capxul/sdk` entry is browser-clean: it never statically reaches\n// `@effect/platform-node`. Node consumers import the on-disk auth cache and the\n// node key `CapxulSigner` from here.\n\nimport * as os from \"node:os\";\nimport { join } from \"node:path\";\n\nimport { toAddress } from \"@capxul/types\";\nimport { privateKeyToAccount } from \"viem/accounts\";\nimport type { Hex } from \"viem\";\n\nimport { BrowserAuthCacheAdapter } from \"../adapters/auth-cache/BrowserAuthCacheAdapter\";\nimport { FileSystemAuthCacheAdapter } from \"../adapters/auth-cache/FileSystemAuthCacheAdapter\";\nimport { InMemoryAuthCacheAdapter } from \"../adapters/auth-cache/InMemoryAuthCacheAdapter\";\nimport type { WindowLike } from \"../client/window-like\";\nimport type { AuthCachePort } from \"../ports/auth-cache\";\nimport type { CapxulSigner } from \"../signer\";\n\nexport {\n  FileSystemAuthCacheAdapter,\n  FileSystemAuthCacheLayer,\n} from \"../adapters/auth-cache/FileSystemAuthCacheAdapter\";\n\nexport interface DetectNodeAuthCacheAdapterOptions {\n  readonly authCachePath?: string;\n  readonly resolveHomeDirectory?: () => string;\n}\n\n/**\n * Node `CapxulSigner` backed by a raw private key. Signs the EIP-712 `SafeOp`\n * digest the backend returns for a prepared deployment UserOperation. The\n * reference CLI builds this from `DEPLOYER_PRIVATE_KEY` for the live capstone.\n */\nexport function localPrivateKeySigner(input: { readonly privateKey: Hex }): CapxulSigner {\n  const account = privateKeyToAccount(input.privateKey);\n  return {\n    source: \"local-private-key\",\n    async getAddress() {\n      return toAddress(account.address);\n    },\n    async signUserOpHash(hash: Hex): Promise<Hex> {\n      // `sign({ hash })` signs the already-computed SafeOp digest directly.\n      // `signMessage({ message: { raw: hash } })` would add an EIP-191 prefix.\n      return account.sign({ hash });\n    },\n  };\n}\n\n/**\n * Node-aware auth-cache detection. Mirrors the historic default order:\n * 1. Browser localStorage → BrowserAuthCacheAdapter\n * 2. Node.js process → FileSystemAuthCacheAdapter\n *    (`~/.config/capxul/auth-cache.json`)\n * 3. Neither detected → InMemoryAuthCacheAdapter\n *\n * Use this from a Node entrypoint and pass the result to\n * `createCapxulClient({ authCache })` for on-disk session persistence.\n */\nexport function detectNodeAuthCacheAdapter(\n  options: DetectNodeAuthCacheAdapterOptions = {},\n): AuthCachePort {\n  const globalAny = globalThis as unknown as {\n    readonly window?: WindowLike;\n    readonly process?: { readonly versions?: { readonly node?: string } };\n  };\n  if (globalAny.window?.localStorage !== undefined) {\n    return new BrowserAuthCacheAdapter(globalAny.window.localStorage);\n  }\n  if (globalAny.process?.versions?.node !== undefined) {\n    const authCachePath =\n      normalizeConfiguredAuthCachePath(options.authCachePath) ??\n      resolveDefaultAuthCachePath(options.resolveHomeDirectory ?? os.homedir);\n    if (authCachePath !== null) return new FileSystemAuthCacheAdapter(authCachePath);\n  }\n  return new InMemoryAuthCacheAdapter();\n}\n\nfunction normalizeConfiguredAuthCachePath(path: string | undefined): string | null {\n  if (path === undefined) return null;\n  const trimmed = path.trim();\n  return trimmed.length > 0 ? trimmed : null;\n}\n\nfunction resolveDefaultAuthCachePath(resolveHomeDirectory: () => string): string | null {\n  try {\n    return join(resolveHomeDirectory(), \".config\", \"capxul\", \"auth-cache.json\");\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;AAuBA,SAAS,eAA4B;CACnC,OAAO;EAAE,SAAS;EAAM,KAAK;CAAK;AACpC;AAEA,MAAM,wBAAwB,MAAM,MAAM,eAAe,OAAO,SAAS,KAAK;AAE9E,IAAa,6BAAb,MAAiE;CAC/D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,MAAc,UAA0C,uBAAuB;EACzF,KAAK,OAAO;EACZ,KAAK,UAAU;EAEf,KAAK,aAAa,KAAK,IACrB,cACA,KAAK,KAAK,EAAE,KAAK,OAAO,KAAK,YAAY,QAAQ,OAAO,CAAC,CAC3D;EACA,KAAK,cAAc,YACjB,KAAK,IACH,cACA,OAAO,IAAI,MAAM,aAAa;GAC5B,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE;IAAS,KAAK,IAAI;GAAI,CAAC;EAC7C,CAAC,CACH;EACF,KAAK,eAAe,KAAK,IACvB,gBACA,OAAO,IAAI,MAAM,aAAa;GAC5B,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE,SAAS;IAAM,KAAK,IAAI;GAAI,CAAC;EACnD,CAAC,CACH;EACA,KAAK,SAAS,KAAK,IAAI,UAAU,KAAK,KAAK,EAAE,KAAK,OAAO,KAAK,YAAY,QAAQ,GAAG,CAAC,CAAC;EACvF,KAAK,UAAU,QACb,KAAK,IACH,UACA,OAAO,IAAI,MAAM,aAAa;GAC5B,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE,SAAS,IAAI;IAAS;GAAI,CAAC;EACjD,CAAC,CACH;EACF,KAAK,WAAW,KAAK,IACnB,YACA,OAAO,IAAI,MAAM,aAAa;GAC5B,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE,SAAS,IAAI;IAAS,KAAK;GAAK,CAAC;EACvD,CAAC,CACH;CACF;CAEA,OAA2F;EACzF,OAAO,OAAO,IAAI,MAAM,aAAa;GACnC,MAAM,KAAK,OAAO,mBAAmB;GAErC,IAAI,EAAC,OADiB,GAAG,OAAO,KAAK,IAAI,IAC5B,OAAO,aAAa;GACjC,MAAM,MAAM,OAAO,GAAG,eAAe,KAAK,MAAM,OAAO;GAEvD,IAAI;GACJ,IAAI;IACF,SAAS,KAAK,MAAM,GAAG;GACzB,QAAQ;IACN,OAAO,aAAa;GACtB;GACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GACvE,OAAO,aAAa;GAEtB,MAAM,UAAU;GAEhB,OAAO;IACL,SAAS,iBAAiB,QAAQ,OAAO;IACzC,KAAK,eAAe,QAAQ,GAAG;GACjC;EACF,CAAC;CACH;CAEA,MACE,SACqE;EACrE,OAAO,OAAO,IAAI,MAAM,aAAa;GACnC,MAAM,KAAK,OAAO,mBAAmB;GAErC,MAAM,OAAM,OADQ,aAAa,MAChB,QAAQ,KAAK,IAAI;GAElC,IAAI,EAAC,OADoB,GAAG,OAAO,GAAG,IAEpC,OAAO,GAAG,cAAc,KAAK;IAAE,WAAW;IAAM,MAAM;GAAM,CAAC;GAE/D,OAAO,GAAG,gBAAgB,KAAK,MAAM,KAAK,UAAU,OAAO,GAAG,EAAE,MAAM,IAAM,CAAC;GAC7E,OAAO,GAAG,MAAM,KAAK,MAAM,GAAK;EAClC,CAAC;CACH;CAEA,IACE,WACA,QACkC;EAClC,OAAO,OAAO,KACZ,OAAO,UAAU,UAAU,iBAAiB,WAAW,KAAK,CAAC,GAC7D,OAAO,QAAQ,KAAK,OAAO,CAC7B;CACF;AACF;AAEA,SAAgB,yBAAyB,OAGS;CAChD,OAAO,MAAM,OACX,kBACA,OAAO,WAAW,IAAI,2BAA2B,MAAM,MAAM,MAAM,OAAO,CAAC,EAAE,KAC3E,OAAO,UAAU,UAAU,iBAAiB,cAAc,KAAK,CAAC,CAClE,CACF;AACF;AAEA,SAAS,iBAAiB,WAAmB,OAAgC;CAC3E,OAAO,IAAI,eAAe;EAAE;EAAW;CAAM,CAAC;AAChD;;;;;;;;AC/GA,SAAgB,sBAAsB,OAAmD;CACvF,MAAM,UAAU,oBAAoB,MAAM,UAAU;CACpD,OAAO;EACL,QAAQ;EACR,MAAM,aAAa;GACjB,OAAO,UAAU,QAAQ,OAAO;EAClC;EACA,MAAM,eAAe,MAAyB;GAG5C,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC;EAC9B;CACF;AACF;;;;;;;;;;;AAYA,SAAgB,2BACd,UAA6C,CAAC,GAC/B;CACf,MAAM,YAAY;CAIlB,IAAI,UAAU,QAAQ,iBAAiB,KAAA,GACrC,OAAO,IAAI,wBAAwB,UAAU,OAAO,YAAY;CAElE,IAAI,UAAU,SAAS,UAAU,SAAS,KAAA,GAAW;EACnD,MAAM,gBACJ,iCAAiC,QAAQ,aAAa,KACtD,4BAA4B,QAAQ,wBAAwB,GAAG,OAAO;EACxE,IAAI,kBAAkB,MAAM,OAAO,IAAI,2BAA2B,aAAa;CACjF;CACA,OAAO,IAAI,yBAAyB;AACtC;AAEA,SAAS,iCAAiC,MAAyC;CACjF,IAAI,SAAS,KAAA,GAAW,OAAO;CAC/B,MAAM,UAAU,KAAK,KAAK;CAC1B,OAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,4BAA4B,sBAAmD;CACtF,IAAI;EACF,OAAO,KAAK,qBAAqB,GAAG,WAAW,UAAU,iBAAiB;CAC5E,QAAQ;EACN,OAAO;CACT;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/adapters/auth-cache/FileSystemAuthCacheAdapter.ts","../../src/node/index.ts"],"sourcesContent":["import type * as PlatformError from \"@effect/platform/Error\";\nimport * as PlatformFileSystem from \"@effect/platform/FileSystem\";\nimport * as PlatformPath from \"@effect/platform/Path\";\nimport * as NodeFileSystem from \"@effect/platform-node/NodeFileSystem\";\nimport * as NodePath from \"@effect/platform-node/NodePath\";\nimport { Effect, Layer } from \"effect\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport {\n  AuthCacheError,\n  AuthCachePortTag,\n  type AuthCachePort,\n  type CachedJwt,\n} from \"../../ports/auth-cache\";\nimport { parseAuthSession, parseCachedJwt } from \"./serialization\";\n\ninterface FilePayload {\n  readonly session: AuthSession | null;\n  readonly jwt: CachedJwt | null;\n}\n\ntype FileSystemRuntime = PlatformFileSystem.FileSystem | PlatformPath.Path;\n\nfunction emptyPayload(): FilePayload {\n  return { session: null, jwt: null };\n}\n\nconst nodeFileSystemRuntime = Layer.merge(NodeFileSystem.layer, NodePath.layer);\n\nexport class FileSystemAuthCacheAdapter implements AuthCachePort {\n  private readonly path: string;\n  private readonly runtime: Layer.Layer<FileSystemRuntime>;\n  readonly getSession: Effect.Effect<AuthSession | null, AuthCacheError>;\n  readonly setSession: (session: AuthSession) => Effect.Effect<void, AuthCacheError>;\n  readonly clearSession: Effect.Effect<void, AuthCacheError>;\n  readonly getJwt: Effect.Effect<CachedJwt | null, AuthCacheError>;\n  readonly setJwt: (jwt: CachedJwt) => Effect.Effect<void, AuthCacheError>;\n  readonly clearJwt: Effect.Effect<void, AuthCacheError>;\n\n  constructor(path: string, runtime: Layer.Layer<FileSystemRuntime> = nodeFileSystemRuntime) {\n    this.path = path;\n    this.runtime = runtime;\n\n    this.getSession = this.run(\n      \"getSession\",\n      this.read().pipe(Effect.map((payload) => payload.session)),\n    );\n    this.setSession = (session: AuthSession) =>\n      this.run(\n        \"setSession\",\n        Effect.gen(this, function* () {\n          const cur = yield* this.read();\n          yield* this.write({ session, jwt: cur.jwt });\n        }),\n      );\n    this.clearSession = this.run(\n      \"clearSession\",\n      Effect.gen(this, function* () {\n        const cur = yield* this.read();\n        yield* this.write({ session: null, jwt: cur.jwt });\n      }),\n    );\n    this.getJwt = this.run(\"getJwt\", this.read().pipe(Effect.map((payload) => payload.jwt)));\n    this.setJwt = (jwt: CachedJwt) =>\n      this.run(\n        \"setJwt\",\n        Effect.gen(this, function* () {\n          const cur = yield* this.read();\n          yield* this.write({ session: cur.session, jwt });\n        }),\n      );\n    this.clearJwt = this.run(\n      \"clearJwt\",\n      Effect.gen(this, function* () {\n        const cur = yield* this.read();\n        yield* this.write({ session: cur.session, jwt: null });\n      }),\n    );\n  }\n\n  private read(): Effect.Effect<FilePayload, PlatformError.PlatformError, FileSystemRuntime> {\n    return Effect.gen(this, function* () {\n      const fs = yield* PlatformFileSystem.FileSystem;\n      const exists = yield* fs.exists(this.path);\n      if (!exists) return emptyPayload();\n      const raw = yield* fs.readFileString(this.path, \"utf-8\");\n\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(raw);\n      } catch {\n        return emptyPayload();\n      }\n      if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n        return emptyPayload();\n      }\n      const payload = parsed as { readonly session?: unknown; readonly jwt?: unknown };\n\n      return {\n        session: parseAuthSession(payload.session),\n        jwt: parseCachedJwt(payload.jwt),\n      };\n    });\n  }\n\n  private write(\n    payload: FilePayload,\n  ): Effect.Effect<void, PlatformError.PlatformError, FileSystemRuntime> {\n    return Effect.gen(this, function* () {\n      const fs = yield* PlatformFileSystem.FileSystem;\n      const path = yield* PlatformPath.Path;\n      const dir = path.dirname(this.path);\n      const dirExists = yield* fs.exists(dir);\n      if (!dirExists) {\n        yield* fs.makeDirectory(dir, { recursive: true, mode: 0o700 });\n      }\n      yield* fs.writeFileString(this.path, JSON.stringify(payload), { mode: 0o600 });\n      yield* fs.chmod(this.path, 0o600);\n    });\n  }\n\n  private run<T>(\n    operation: string,\n    effect: Effect.Effect<T, PlatformError.PlatformError, FileSystemRuntime>,\n  ): Effect.Effect<T, AuthCacheError> {\n    return effect.pipe(\n      Effect.mapError((cause) => toAuthCacheError(operation, cause)),\n      Effect.provide(this.runtime),\n    );\n  }\n}\n\nexport function FileSystemAuthCacheLayer(input: {\n  readonly path: string;\n  readonly runtime?: Layer.Layer<FileSystemRuntime>;\n}): Layer.Layer<AuthCachePortTag, AuthCacheError> {\n  return Layer.effect(\n    AuthCachePortTag,\n    Effect.sync(() => new FileSystemAuthCacheAdapter(input.path, input.runtime)).pipe(\n      Effect.mapError((cause) => toAuthCacheError(\"initialize\", cause)),\n    ),\n  );\n}\n\nfunction toAuthCacheError(operation: string, cause: unknown): AuthCacheError {\n  return new AuthCacheError({ operation, cause });\n}\n","// `@capxul/sdk/node` — node-only entry (published-package-boundaries.md).\n//\n// The default `@capxul/sdk` entry is browser-clean: it never statically reaches\n// `@effect/platform-node`. Node consumers import the on-disk auth cache and the\n// node key `CapxulSigner` from here.\n\nimport * as os from \"node:os\";\nimport { join } from \"node:path\";\n\nimport { toAddress } from \"@capxul/types\";\nimport { privateKeyToAccount } from \"viem/accounts\";\nimport type { Hex } from \"viem\";\n\nimport { BrowserAuthCacheAdapter } from \"../adapters/auth-cache/BrowserAuthCacheAdapter\";\nimport { FileSystemAuthCacheAdapter } from \"../adapters/auth-cache/FileSystemAuthCacheAdapter\";\nimport { InMemoryAuthCacheAdapter } from \"../adapters/auth-cache/InMemoryAuthCacheAdapter\";\nimport type { WindowLike } from \"../client/window-like\";\nimport type { AuthCachePort } from \"../ports/auth-cache\";\nimport type { CapxulSigner } from \"../signer\";\n\nexport {\n  FileSystemAuthCacheAdapter,\n  FileSystemAuthCacheLayer,\n} from \"../adapters/auth-cache/FileSystemAuthCacheAdapter\";\n\nexport interface DetectNodeAuthCacheAdapterOptions {\n  readonly authCachePath?: string;\n  readonly resolveHomeDirectory?: () => string;\n}\n\n/**\n * Node `CapxulSigner` backed by a raw private key. Signs the EIP-712 `SafeOp`\n * digest the backend returns for a prepared deployment UserOperation. The\n * reference CLI builds this from `DEPLOYER_PRIVATE_KEY` for the live capstone.\n */\nexport function localPrivateKeySigner(input: { readonly privateKey: Hex }): CapxulSigner {\n  const account = privateKeyToAccount(input.privateKey);\n  return {\n    source: \"local-private-key\",\n    async getAddress() {\n      return toAddress(account.address);\n    },\n    async signUserOpHash(hash: Hex): Promise<Hex> {\n      // `sign({ hash })` signs the already-computed SafeOp digest directly.\n      // `signMessage({ message: { raw: hash } })` would add an EIP-191 prefix.\n      return account.sign({ hash });\n    },\n  };\n}\n\n/**\n * Node-aware auth-cache detection. Mirrors the historic default order:\n * 1. Browser localStorage → BrowserAuthCacheAdapter\n * 2. Node.js process → FileSystemAuthCacheAdapter\n *    (`~/.config/capxul/auth-cache.json`)\n * 3. Neither detected → InMemoryAuthCacheAdapter\n *\n * Use this from a Node entrypoint and pass the result to\n * `createCapxulClient({ authCache })` for on-disk session persistence.\n */\nexport function detectNodeAuthCacheAdapter(\n  options: DetectNodeAuthCacheAdapterOptions = {},\n): AuthCachePort {\n  const globalAny = globalThis as unknown as {\n    readonly window?: WindowLike;\n    readonly process?: { readonly versions?: { readonly node?: string } };\n  };\n  if (globalAny.window?.localStorage !== undefined) {\n    return new BrowserAuthCacheAdapter(globalAny.window.localStorage);\n  }\n  if (globalAny.process?.versions?.node !== undefined) {\n    const authCachePath =\n      normalizeConfiguredAuthCachePath(options.authCachePath) ??\n      resolveDefaultAuthCachePath(options.resolveHomeDirectory ?? os.homedir);\n    if (authCachePath !== null) return new FileSystemAuthCacheAdapter(authCachePath);\n  }\n  return new InMemoryAuthCacheAdapter();\n}\n\nfunction normalizeConfiguredAuthCachePath(path: string | undefined): string | null {\n  if (path === undefined) return null;\n  const trimmed = path.trim();\n  return trimmed.length > 0 ? trimmed : null;\n}\n\nfunction resolveDefaultAuthCachePath(resolveHomeDirectory: () => string): string | null {\n  try {\n    return join(resolveHomeDirectory(), \".config\", \"capxul\", \"auth-cache.json\");\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;;AAuBA,SAAS,eAA4B;CACnC,OAAO;EAAE,SAAS;EAAM,KAAK;CAAK;AACpC;AAEA,MAAM,wBAAwB,MAAM,MAAM,eAAe,OAAO,SAAS,KAAK;AAE9E,IAAa,6BAAb,MAAiE;CAC/D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,MAAc,UAA0C,uBAAuB;EACzF,KAAK,OAAO;EACZ,KAAK,UAAU;EAEf,KAAK,aAAa,KAAK,IACrB,cACA,KAAK,KAAK,EAAE,KAAK,OAAO,KAAK,YAAY,QAAQ,OAAO,CAAC,CAC3D;EACA,KAAK,cAAc,YACjB,KAAK,IACH,cACA,OAAO,IAAI,MAAM,aAAa;GAC5B,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE;IAAS,KAAK,IAAI;GAAI,CAAC;EAC7C,CAAC,CACH;EACF,KAAK,eAAe,KAAK,IACvB,gBACA,OAAO,IAAI,MAAM,aAAa;GAC5B,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE,SAAS;IAAM,KAAK,IAAI;GAAI,CAAC;EACnD,CAAC,CACH;EACA,KAAK,SAAS,KAAK,IAAI,UAAU,KAAK,KAAK,EAAE,KAAK,OAAO,KAAK,YAAY,QAAQ,GAAG,CAAC,CAAC;EACvF,KAAK,UAAU,QACb,KAAK,IACH,UACA,OAAO,IAAI,MAAM,aAAa;GAC5B,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE,SAAS,IAAI;IAAS;GAAI,CAAC;EACjD,CAAC,CACH;EACF,KAAK,WAAW,KAAK,IACnB,YACA,OAAO,IAAI,MAAM,aAAa;GAC5B,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE,SAAS,IAAI;IAAS,KAAK;GAAK,CAAC;EACvD,CAAC,CACH;CACF;CAEA,OAA2F;EACzF,OAAO,OAAO,IAAI,MAAM,aAAa;GACnC,MAAM,KAAK,OAAO,mBAAmB;GAErC,IAAI,EAAC,OADiB,GAAG,OAAO,KAAK,IAAI,IAC5B,OAAO,aAAa;GACjC,MAAM,MAAM,OAAO,GAAG,eAAe,KAAK,MAAM,OAAO;GAEvD,IAAI;GACJ,IAAI;IACF,SAAS,KAAK,MAAM,GAAG;GACzB,QAAQ;IACN,OAAO,aAAa;GACtB;GACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GACvE,OAAO,aAAa;GAEtB,MAAM,UAAU;GAEhB,OAAO;IACL,SAAS,iBAAiB,QAAQ,OAAO;IACzC,KAAK,eAAe,QAAQ,GAAG;GACjC;EACF,CAAC;CACH;CAEA,MACE,SACqE;EACrE,OAAO,OAAO,IAAI,MAAM,aAAa;GACnC,MAAM,KAAK,OAAO,mBAAmB;GAErC,MAAM,OAAM,OADQ,aAAa,MAChB,QAAQ,KAAK,IAAI;GAElC,IAAI,EAAC,OADoB,GAAG,OAAO,GAAG,IAEpC,OAAO,GAAG,cAAc,KAAK;IAAE,WAAW;IAAM,MAAM;GAAM,CAAC;GAE/D,OAAO,GAAG,gBAAgB,KAAK,MAAM,KAAK,UAAU,OAAO,GAAG,EAAE,MAAM,IAAM,CAAC;GAC7E,OAAO,GAAG,MAAM,KAAK,MAAM,GAAK;EAClC,CAAC;CACH;CAEA,IACE,WACA,QACkC;EAClC,OAAO,OAAO,KACZ,OAAO,UAAU,UAAU,iBAAiB,WAAW,KAAK,CAAC,GAC7D,OAAO,QAAQ,KAAK,OAAO,CAC7B;CACF;AACF;AAEA,SAAgB,yBAAyB,OAGS;CAChD,OAAO,MAAM,OACX,kBACA,OAAO,WAAW,IAAI,2BAA2B,MAAM,MAAM,MAAM,OAAO,CAAC,EAAE,KAC3E,OAAO,UAAU,UAAU,iBAAiB,cAAc,KAAK,CAAC,CAClE,CACF;AACF;AAEA,SAAS,iBAAiB,WAAmB,OAAgC;CAC3E,OAAO,IAAI,eAAe;EAAE;EAAW;CAAM,CAAC;AAChD;;;;;;;;AC/GA,SAAgB,sBAAsB,OAAmD;CACvF,MAAM,UAAU,oBAAoB,MAAM,UAAU;CACpD,OAAO;EACL,QAAQ;EACR,MAAM,aAAa;GACjB,OAAO,UAAU,QAAQ,OAAO;EAClC;EACA,MAAM,eAAe,MAAyB;GAG5C,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC;EAC9B;CACF;AACF;;;;;;;;;;;AAYA,SAAgB,2BACd,UAA6C,CAAC,GAC/B;CACf,MAAM,YAAY;CAIlB,IAAI,UAAU,QAAQ,iBAAiB,KAAA,GACrC,OAAO,IAAI,wBAAwB,UAAU,OAAO,YAAY;CAElE,IAAI,UAAU,SAAS,UAAU,SAAS,KAAA,GAAW;EACnD,MAAM,gBACJ,iCAAiC,QAAQ,aAAa,KACtD,4BAA4B,QAAQ,wBAAwB,GAAG,OAAO;EACxE,IAAI,kBAAkB,MAAM,OAAO,IAAI,2BAA2B,aAAa;CACjF;CACA,OAAO,IAAI,yBAAyB;AACtC;AAEA,SAAS,iCAAiC,MAAyC;CACjF,IAAI,SAAS,KAAA,GAAW,OAAO;CAC/B,MAAM,UAAU,KAAK,KAAK;CAC1B,OAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,4BAA4B,sBAAmD;CACtF,IAAI;EACF,OAAO,KAAK,qBAAqB,GAAG,WAAW,UAAU,iBAAiB;CAC5E,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/ports/safe-deployment.d.mts

@@ -1,2 +1,2 @@
-import { a as SafeDeploymentEvidence, c as SafeDeploymentPortTag, i as SafeDeploymentError, l as safeDeploymentErrorFromCapxul, n as SafeDeploymentConfig, o as SafeDeploymentInput, r as SafeDeploymentDeployedQuery, s as SafeDeploymentPort, t as PreparedSafeAccount } from "../safe-deployment-D3k9yndM.mjs";
+import { a as SafeDeploymentEvidence, c as SafeDeploymentPortTag, i as SafeDeploymentError, l as safeDeploymentErrorFromCapxul, n as SafeDeploymentConfig, o as SafeDeploymentInput, r as SafeDeploymentDeployedQuery, s as SafeDeploymentPort, t as PreparedSafeAccount } from "../safe-deployment-DMGB1kEL.mjs";
 export { PreparedSafeAccount, SafeDeploymentConfig, SafeDeploymentDeployedQuery, SafeDeploymentError, SafeDeploymentEvidence, SafeDeploymentInput, SafeDeploymentPort, SafeDeploymentPortTag, safeDeploymentErrorFromCapxul };

package/dist/{safe-deployment-D3k9yndM.d.mts → safe-deployment-DMGB1kEL.d.mts}

@@ -1,6 +1,7 @@
-import { F as CapxulErrorDetails, M as TxHash, N as CapxulError, P as CapxulErrorCode, g as Email, h as DurationMs, l as BlockNumber, r as Address, u as ChainId } from "./index-CTXgQ_xR.mjs";
-import { Account } from "viem";
+import { CapxulError, CapxulErrorCode, CapxulErrorDetails } from "@capxul/config";
+import { Address, BlockNumber, ChainId, DurationMs, Email, TxHash } from "@capxul/types";
 import { Context, Effect } from "effect";
+import { Account as Account$1 } from "viem";
 
 //#region src/ports/safe-deployment.d.ts
 /**
@@ -55,7 +56,7 @@ type SafeDeploymentEvidence = {
   readonly blockNumber?: BlockNumber;
 };
 type SafeDeploymentInput = {
-  readonly signer: Account;
+  readonly signer: Account$1;
   readonly email: Email;
   readonly config: SafeDeploymentConfig;
 };
@@ -133,4 +134,4 @@ declare const SafeDeploymentPortTag_base: Context.TagClass<SafeDeploymentPortTag
 declare class SafeDeploymentPortTag extends SafeDeploymentPortTag_base {}
 //#endregion
 export { SafeDeploymentEvidence as a, SafeDeploymentPortTag as c, SafeDeploymentError as i, safeDeploymentErrorFromCapxul as l, SafeDeploymentConfig as n, SafeDeploymentInput as o, SafeDeploymentDeployedQuery as r, SafeDeploymentPort as s, PreparedSafeAccount as t };
-//# sourceMappingURL=safe-deployment-D3k9yndM.d.mts.map
+//# sourceMappingURL=safe-deployment-DMGB1kEL.d.mts.map

package/dist/safe-deployment-DMGB1kEL.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-deployment-DMGB1kEL.d.mts","names":[],"sources":["../src/ports/safe-deployment.ts"],"mappings":";;;;;;;;AAaA;;;;;KAAY,oBAAA;EAAA,SACD,OAAA,EAAS,OAAA;EAAA,SACT,MAAA;EAAA,SACA,WAAA;EAAA,SACA,gBAAA,GAAmB,UAAU;AAAA;AAAA;AAOxC;;;AAPwC,KAO5B,mBAAA;EAAA,SACD,OAAA,EAAS,OAAA;EAAA,SACT,aAAA,EAAe,OAAA;EAAA,SACf,WAAA,EAAa,OAAA;AAAA;;;;;;;;AAAO;AAwB/B;;;;;;;;;;;;;KAAY,sBAAA;EAAA,SACD,OAAA,EAAS,OAAA;EAAA,SACT,aAAA,EAAe,OAAA;EAAA,SACf,WAAA,EAAa,OAAA;EAAA,SACb,MAAA,GAAS,MAAA;EAAA,SACT,UAAA,GAAa,MAAA;EAAA,SACb,WAAA,GAAc,WAAA;AAAA;AAAA,KAGb,mBAAA;EAAA,SACD,MAAA,EAAQ,SAAA;EAAA,SACR,KAAA,EAAO,KAAA;EAAA,SACP,MAAA,EAAQ,oBAAA;AAAA;AAAA,KAGP,2BAAA;EAAA,SACD,WAAA,EAAa,OAAA;EAAA,SACb,MAAA,EAAQ,oBAAoB;AAAA;AAAA,cACrC,wBAAA;;;;;;;;cAOW,mBAAA,SAA4B,wBAAA;EAAA,SAC9B,SAAA;EAAA,SACA,UAAA,EAAY,eAAA;EAAA,SACZ,WAAA,EAAa,WAAA;EAAA,SACb,KAAA;EAAA,SACA,OAAA,GAAU,kBAAA;AAAA;;;;;AAbkB;AACrC;;;;;;;;;;;iBA+Bc,6BAAA,CACd,SAAA,UACA,KAAA,EAAO,WAAA,EACP,KAAA,aACC,mBAAmB;;;;;;;;;;;;;;UAuBL,kBAAA;;;;AAnDjB;EAwDE,OAAA,CACE,KAAA,EAAO,mBAAA,GACN,MAAA,CAAO,MAAA,CAAO,mBAAA,EAAqB,mBAAA;;;;;;EAOtC,MAAA,CACE,KAAA,EAAO,mBAAA,GACN,MAAA,CAAO,MAAA,CAAO,sBAAA,EAAwB,mBAAA;EAnEF;;;;;;;EA4EvC,UAAA,CACE,KAAA,EAAO,2BAAA,GACN,MAAA,CAAO,MAAA,UAAgB,mBAAA;AAAA;AAAA,cAC3B,0BAAA;cAEY,qBAAA,SAA8B,0BAGxC"}

package/dist/{signer-D9fUJp8o.d.mts → signer-DEMJbpJ2.d.mts}

@@ -1,6 +1,7 @@
-import { N as CapxulError, S as Profile$1, k as SmartAccount$1, r as Address, s as AuthSession, v as EpochSeconds, y as JwtToken } from "./index-CTXgQ_xR.mjs";
-import { Account, Hex } from "viem";
+import { CapxulError } from "@capxul/errors";
+import { Address, AuthSession, EpochSeconds, JwtToken, Profile, SmartAccount } from "@capxul/types";
 import { Context, Effect } from "effect";
+import { Account as Account$1, Hex } from "viem";
 
 //#region src/ports/auth-cache.d.ts
 /**
@@ -51,8 +52,8 @@ declare class AuthCachePortTag extends AuthCachePortTag_base {}
 //#endregion
 //#region src/client/types.d.ts
 type Session = AuthSession;
-type Profile = Profile$1;
-type SmartAccount = SmartAccount$1;
+type Profile$1 = Profile;
+type SmartAccount$1 = SmartAccount;
 /**
  * Result-shape returned by every method on `CapxulClient`. Mirrors the
  * existing per-port `Result` aliases; centralized here so consumers have
@@ -94,7 +95,7 @@ interface AccountProvider {
    * Custom providers MUST honor this contract.
    */
   getAddress(): Promise<CapxulResult<Address>>;
-  getDeployAccount(): Promise<CapxulResult<Account>>;
+  getDeployAccount(): Promise<CapxulResult<Account$1>>;
 }
 interface Eip1193Provider {
   request(args: {
@@ -143,5 +144,5 @@ interface Eip1193RequestProvider {
  */
 declare function injectedWalletSigner(provider: Eip1193RequestProvider): CapxulSigner;
 //#endregion
-export { AuthCachePortTag as _, AccountProvider as a, Eip1193Provider as c, CapxulResult as d, Profile as f, AuthCachePort as g, AuthCacheError as h, injectedWalletSigner as i, eip1193AccountProvider as l, SmartAccount as m, CapxulSigner as n, AccountProviderSource as o, Session as p, Eip1193RequestProvider as r, AccountRequirement as s, CapxulDigestSigner as t, localPrivateKeyAccountProvider as u, CachedJwt as v };
-//# sourceMappingURL=signer-D9fUJp8o.d.mts.map
+export { AuthCachePortTag as _, AccountProvider as a, Eip1193Provider as c, CapxulResult as d, Profile$1 as f, AuthCachePort as g, AuthCacheError as h, injectedWalletSigner as i, eip1193AccountProvider as l, SmartAccount$1 as m, CapxulSigner as n, AccountProviderSource as o, Session as p, Eip1193RequestProvider as r, AccountRequirement as s, CapxulDigestSigner as t, localPrivateKeyAccountProvider as u, CachedJwt as v };
+//# sourceMappingURL=signer-DEMJbpJ2.d.mts.map

package/dist/signer-DEMJbpJ2.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer-DEMJbpJ2.d.mts","names":[],"sources":["../src/ports/auth-cache.ts","../src/client/types.ts","../src/client/account-providers.ts","../src/signer.ts"],"mappings":";;;;;;;;;;AAiBA;;;;;;;;;;UAAiB,aAAA;EAAA,SACN,UAAA,EAAY,MAAA,CAAO,MAAA,CAAO,WAAA,SAAoB,cAAA;EAAA,SAC9C,UAAA,GAAa,OAAA,EAAS,WAAA,KAAgB,MAAA,CAAO,MAAA,OAAa,cAAA;EAAA,SAC1D,YAAA,EAAc,MAAA,CAAO,MAAA,OAAa,cAAA;EAQpB;;;;;EAAA,SADd,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO,SAAA,SAAkB,cAAA;EAAA,SACxC,MAAA,GAAS,GAAA,EAAK,SAAA,KAAc,MAAA,CAAO,MAAA,OAAa,cAAA;EAAA,SAChD,QAAA,EAAU,MAAA,CAAO,MAAA,OAAa,cAAA;AAAA;;;;;;UAQxB,SAAA;EAAA,SACN,KAAA,EAAO,QAAA;EAAA,SACP,eAAA,EAAiB,YAAY;AAAA;AAAA,cACvC,mBAAA;;;cAEY,cAAA,SAAuB,mBAAA;EAAA,SACzB,SAAA;EAAA,SACA,KAAA;AAAA;AAAA,cACN,qBAAA;cAEQ,gBAAA,SAAyB,qBAGnC;;;KChCS,OAAA,GAAU,WAAW;AAAA,KACrB,SAAA,GAAU,OAAY;AAAA,KACtB,cAAA,GAAe,YAAiB;;ADH5C;;;;KCUY,YAAA;EAAA,SACG,EAAA;EAAA,SAAmB,KAAA,EAAO,CAAA;AAAA;EAAA,SAC1B,EAAA;EAAA,SAAoB,KAAA,EAAO,WAAW;AAAA;;;KCtBzC,qBAAA;AAAA,KAEA,kBAAA;AAAA,UAEK,eAAA;EAAA,SACN,MAAA,EAAQ,qBAAA;EFKW;;;;;;;;;;;;;;;;;;;;;;EEkB5B,UAAA,IAAc,OAAA,CAAQ,YAAA,CAAa,OAAA;EACnC,gBAAA,IAAoB,OAAA,CAAQ,YAAA,CAAa,SAAA;AAAA;AAAA,UAG1B,eAAA;EACf,OAAA,CAAQ,IAAA;IAAA,SACG,MAAA;IAAA,SACA,MAAA;EAAA,IACP,OAAO;AAAA;AAAA,iBAGG,8BAAA,CAA+B,KAAA;EAAA,SACpC,UAAA,EAAY,GAAA;AAAA,IACnB,eAAe;AAAA,iBAcH,sBAAA,CAAuB,KAAA;EAAA,SAC5B,QAAA,EAAU,eAAA;AAAA,IACjB,eAAe;;;UCrCF,kBAAA;;;AHVjB;;;EGgBE,cAAA,CAAe,IAAA,EAAM,GAAA,GAAM,OAAA,CAAQ,GAAA;AAAA;AAAA,UAGpB,YAAA,SAAqB,kBAAA;EHjBL;;;;EAAA,SGsBtB,MAAA,EAAQ,qBAAA;EHdc;EGgB/B,UAAA,IAAc,OAAA,CAAQ,OAAA;AAAA;;UAIP,sBAAA;EACf,OAAA,CAAQ,IAAA;IAAA,SACG,MAAA;IAAA,SACA,MAAA;EAAA,IACP,OAAO;AAAA;;;;;;;;iBAUG,oBAAA,CAAqB,QAAA,EAAU,sBAAA,GAAyB,YAAY"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/sdk",
-  "version": "1.0.0-alpha.11",
+  "version": "1.0.0-alpha.12",
   "files": [
     "dist",
     "package.json",
@@ -33,7 +33,12 @@
     "@openfort/openfort-js": "^1.3.6",
     "convex": "^1.39.1",
     "effect": "^3.21.2",
-    "viem": "^2.53.1"
+    "viem": "^2.53.1",
+    "@capxul/config": "0.1.0-alpha.1",
+    "@capxul/observability": "0.1.0-alpha.0",
+    "@capxul/types": "0.1.0-alpha.0",
+    "@capxul/wire": "0.1.0-alpha.1",
+    "@capxul/errors": "0.0.0"
   },
   "devDependencies": {
     "@effect/vitest": "^0.29.0",
@@ -41,12 +46,7 @@
     "fast-check": "^3.23.2",
     "permissionless": "0.3.4",
     "typescript": "5.9.2",
-    "vitest": "npm:@voidzero-dev/vite-plus-test@0.1.23",
-    "@capxul/types": "0.1.0-alpha.0",
-    "@capxul/config": "0.1.0-alpha.1",
-    "@capxul/observability": "0.1.0-alpha.0",
-    "@capxul/errors": "0.0.0",
-    "@capxul/wire": "0.1.0-alpha.1"
+    "vitest": "npm:@voidzero-dev/vite-plus-test@0.1.23"
   },
   "_permissionlessPinReason": "permissionless.toSafeSmartAccount is pinned to 0.3.4 for live Safe deployment E2E. Counterfactual address fixtures captured 2026-05-17 in packages/backend/convex/_shared/__tests__/counterfactual.test.ts and packages/config/tests/safe.test.ts must be re-verified before upgrading.",
   "scripts": {

package/dist/InMemoryAuthCacheAdapter-v5W-XB5M.mjs

@@ -1,457 +0,0 @@
-import { Context, Data, Effect, Layer } from "effect";
-//#region ../errors/src/errors.ts
-const CAPXUL_ERROR_CODES = [
-	"NOT_AUTHENTICATED",
-	"EMAIL_DELIVERY_FAILED",
-	"PROFILE_NOT_FOUND",
-	"SMART_ACCOUNT_MISSING",
-	"PLAYER_NOT_FOUND",
-	"ACCOUNT_NOT_FOUND",
-	"PROVIDER_ERROR",
-	"INVALID_INPUT",
-	"ENV_MISSING",
-	"NOT_IMPLEMENTED",
-	"VERIFICATION_REQUIRED",
-	"INSUFFICIENT_BALANCE",
-	"INVALID_RECIPIENT",
-	"ROLE_PERMISSION_DENIED",
-	"TRANSACTION_FAILED",
-	"RATE_LIMITED",
-	"NETWORK_ERROR",
-	"UNKNOWN",
-	"OTP_EXPIRED",
-	"SIGNER_REJECTED",
-	"CANCELLED",
-	"WRONG_STATE"
-];
-var CapxulError = class extends Error {
-	code;
-	details;
-	correlationId;
-	layer;
-	constructor(code, message, options = {}) {
-		super(message, "cause" in options ? { cause: options.cause } : void 0);
-		this.name = "CapxulError";
-		this.code = code;
-		if (options.details !== void 0) this.details = options.details;
-		if (options.correlationId !== void 0) this.correlationId = options.correlationId;
-		if (options.layer !== void 0) this.layer = options.layer;
-	}
-};
-function isCapxulError(value) {
-	return value instanceof CapxulError;
-}
-function deserializeCapxulError(serialized) {
-	return new CapxulError(serialized.code, serialized.message, compactErrorOptions({
-		details: serialized.details,
-		correlationId: serialized.correlationId,
-		layer: serialized.layer
-	}));
-}
-function compactErrorOptions(options) {
-	const result = {};
-	if ("cause" in options) result.cause = options.cause;
-	if (options.details !== void 0) result.details = options.details;
-	if (options.correlationId !== void 0) result.correlationId = options.correlationId;
-	if (options.layer !== void 0) result.layer = options.layer;
-	return result;
-}
-const Errors = {
-	notAuthenticated: (message, opts) => new CapxulError("NOT_AUTHENTICATED", message ?? "Not authenticated", opts?.failure_mode ? { details: { failure_mode: opts.failure_mode } } : void 0),
-	emailDeliveryFailed: (detail) => new CapxulError("EMAIL_DELIVERY_FAILED", "Failed to send email", { details: { detail } }),
-	profileNotFound: (authUserId) => new CapxulError("PROFILE_NOT_FOUND", `Profile not found for user ${authUserId}`, { details: { authUserId } }),
-	smartAccountMissing: (authUserId) => new CapxulError("SMART_ACCOUNT_MISSING", "Smart account not provisioned", { details: { authUserId } }),
-	playerNotFound: (playerId) => new CapxulError("PLAYER_NOT_FOUND", playerId ? `Openfort player ${playerId} not found` : "Openfort player not found", playerId === void 0 ? void 0 : { details: { playerId } }),
-	accountNotFound: (accountId) => new CapxulError("ACCOUNT_NOT_FOUND", accountId ? `Openfort account ${accountId} not found` : "Openfort account not found", accountId === void 0 ? void 0 : { details: { accountId } }),
-	providerError: (provider, operation, cause, opts) => {
-		const details = {
-			provider,
-			operation
-		};
-		if (opts?.failure_mode) details.failure_mode = opts.failure_mode;
-		return new CapxulError("PROVIDER_ERROR", `Provider error: ${provider} ${operation}`, {
-			cause,
-			details
-		});
-	},
-	invalidInput: (field, reason) => new CapxulError("INVALID_INPUT", `Invalid ${field}: ${reason}`, { details: {
-		field,
-		reason
-	} }),
-	envMissing: (name) => new CapxulError("ENV_MISSING", `Environment variable ${name} not configured`, { details: { name } }),
-	notImplemented: (domain, method) => new CapxulError("NOT_IMPLEMENTED", `${domain}.${method} is not yet implemented. This feature is planned for a future release.`, { details: {
-		domain,
-		method
-	} }),
-	/**
-	* Sibling factory to {@link Errors.providerError} for the per-state timeout
-	* path in flows (initially ProvisioningFlow's mint_openfort / deploy_safe /
-	* register_indexer `after:` timers). Same `PROVIDER_ERROR` code as
-	* `providerError`, plus a `details.reason: "timeout"` discriminator so
-	* downstream observers can distinguish failure modes without parsing the
-	* message string. The redacted message names the timeout budget; the
-	* native `cause` carries the same information for `reportError` fidelity.
-	*/
-	providerTimeout: (provider, operation, timeoutMs) => new CapxulError("PROVIDER_ERROR", `Provider error: ${provider} ${operation} (timeout exceeded ${timeoutMs}ms)`, {
-		details: {
-			provider,
-			operation,
-			reason: "timeout"
-		},
-		cause: /* @__PURE__ */ new Error(`timeout: ${operation} exceeded ${timeoutMs}ms`)
-	}),
-	verificationRequired: (details) => {
-		return new CapxulError("VERIFICATION_REQUIRED", "rail" in details ? `Verification is required before ${details.rail} can use ${details.currentKind}.` : `Verification tier ${details.requiredTier} is required.`, { details });
-	},
-	insufficientBalance: (asset, available, required) => new CapxulError("INSUFFICIENT_BALANCE", `Insufficient ${asset} balance`, { details: {
-		asset,
-		available,
-		required
-	} }),
-	invalidRecipient: (reason) => new CapxulError("INVALID_RECIPIENT", `Invalid recipient: ${reason}`, { details: { reason } }),
-	/**
-	* The org Zodiac Roles modifier REFUSED the spend on-chain (G4 · #547): the
-	* member's role condition (per-tx cap, per-day allowance, allowed recipient,
-	* or membership) was violated, so `execTransactionWithRole` reverted. This is
-	* a PERMISSION denial — explicitly NOT an `INSUFFICIENT_BALANCE` (the treasury
-	* held the funds; the role's authority is what bound). `reason` discriminates
-	* the violated condition (`over_cap` / `daily_cap` / `not_member` /
-	* `disallowed_recipient` / `condition_violation`); leak-safe — no on-chain
-	* identifiers ever enter the details.
-	*/
-	rolePermissionDenied: (details) => new CapxulError("ROLE_PERMISSION_DENIED", `Org role denied this spend on-chain (${details.reason}).`, { details: details.operation === void 0 ? { reason: details.reason } : {
-		reason: details.reason,
-		operation: details.operation
-	} }),
-	/**
-	* A transaction (or sponsored UserOp) failed. `details.reason` discriminates
-	* the failure mode for callers that must distinguish a CONFIRMED on-chain
-	* revert (`"onchain_revert"` — the op executed and reverted, e.g. a Zodiac
-	* Roles condition violation) from an inconclusive infra failure. A confirmed
-	* revert is the ONLY mode the org spend port may map to a roles denial.
-	*/
-	transactionFailed: (operation, cause, extra) => new CapxulError("TRANSACTION_FAILED", `Transaction failed: ${operation}`, {
-		cause,
-		details: extra?.reason === void 0 ? { operation } : {
-			operation,
-			reason: extra.reason
-		}
-	}),
-	rateLimited: (details) => new CapxulError("RATE_LIMITED", "Rate limit exceeded", details === void 0 ? void 0 : { details: { ...details } }),
-	networkError: (operation, cause) => new CapxulError("NETWORK_ERROR", `Network error during ${operation}`, {
-		cause,
-		details: { operation }
-	}),
-	unknown: (cause) => new CapxulError("UNKNOWN", "Unknown error", { cause }),
-	otpExpired: (details) => new CapxulError("OTP_EXPIRED", "Verification code has expired. Request a new one.", details === void 0 ? void 0 : { details: { ...details } }),
-	signerRejected: (details) => new CapxulError("SIGNER_REJECTED", "Signer rejected the request.", {
-		cause: details.cause,
-		details: details.reason === void 0 ? { source: details.source } : {
-			source: details.source,
-			reason: details.reason
-		}
-	}),
-	cancelled: (details) => new CapxulError("CANCELLED", "Operation was cancelled.", details === void 0 ? void 0 : { details: { ...details } }),
-	/**
-	* Method called from a flow state where its precondition fails (TA16). The
-	* SDK's method API short-circuits with this error before driving the
-	* internal state machine. `currentState` is the Effect-machine snapshot
-	* tag (stringified — substrate is `@effect/experimental/Machine` per
-	* `docs/canon/decisions/state-machine-substrate.md`); `validStates`
-	* enumerates the states the method accepts.
-	*/
-	wrongState: (details) => new CapxulError("WRONG_STATE", `${details.method} called from state '${details.currentState}'; valid states: ${details.validStates.join(", ")}`, { details: {
-		...details,
-		validStates: [...details.validStates]
-	} })
-};
-//#endregion
-//#region ../errors/src/convex-error-decoding.ts
-const KNOWN_CODES = new Set(CAPXUL_ERROR_CODES);
-function isCapxulCode(value) {
-	return typeof value === "string" && KNOWN_CODES.has(value);
-}
-function reconstruct(serialized) {
-	if (!isCapxulCode(serialized.code)) return null;
-	return deserializeCapxulError({
-		code: serialized.code,
-		message: typeof serialized.message === "string" ? serialized.message : String(serialized.code),
-		...typeof serialized.details === "object" && serialized.details !== null && !Array.isArray(serialized.details) ? { details: serialized.details } : {},
-		...typeof serialized.correlationId === "string" ? { correlationId: serialized.correlationId } : {},
-		...typeof serialized.layer === "string" ? { layer: serialized.layer } : {}
-	});
-}
-function decodeConvexError(err) {
-	if (err === null || err === void 0) return null;
-	if (err instanceof CapxulError) return err;
-	if (typeof err !== "object") return null;
-	const record = err;
-	if (!("data" in record)) return null;
-	const data = record.data;
-	if (typeof data === "object" && data !== null) return reconstruct(data);
-	if (typeof data === "string") try {
-		const parsed = JSON.parse(data);
-		if (typeof parsed === "object" && parsed !== null) return reconstruct(parsed);
-	} catch {}
-	return null;
-}
-//#endregion
-//#region ../types/src/index.ts
-const EVM_ADDRESS_RE = /^0x[0-9a-f]{40}$/i;
-const BYTES32_RE = /^0x[0-9a-f]{64}$/i;
-const PUBLISHABLE_KEY_PATTERN = /^cap_pk_(test|live)_[0-9A-HJKMNP-TV-Z]{32}$/;
-const SUPPORTED_CURRENCIES = [
-	{
-		code: "USD",
-		symbol: "$",
-		name: "US Dollar"
-	},
-	{
-		code: "NGN",
-		symbol: "NGN",
-		name: "Nigerian Naira"
-	},
-	{
-		code: "GHS",
-		symbol: "GHS",
-		name: "Ghanaian Cedi"
-	},
-	{
-		code: "KES",
-		symbol: "KSh",
-		name: "Kenyan Shilling"
-	},
-	{
-		code: "UGX",
-		symbol: "USh",
-		name: "Ugandan Shilling"
-	}
-];
-const SUPPORTED_CURRENCY_CODES = SUPPORTED_CURRENCIES.map((currency) => currency.code);
-Object.fromEntries(SUPPORTED_CURRENCIES.map((currency) => [currency.code, currency.symbol]));
-const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-const COUNTRY_CODE_RE = /^[A-Z]{2}$/;
-const ANONYMOUS_DISTINCT_ID_RE = /^anon_[a-zA-Z0-9-]+$/;
-const ACCOUNT_ID_RE = /^account_[0-9A-Za-z]+$/;
-const SUBACCOUNT_ID_RE = /^subaccount_[0-9A-Za-z]+$/;
-const APP_ID_RE = /^app_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
-Math.floor(Number.MAX_SAFE_INTEGER / 1e3);
-function toAddress(raw) {
-	if (typeof raw !== "string" || !EVM_ADDRESS_RE.test(raw)) throw Errors.invalidInput("address", invalidValueReason("invalid EVM address format", raw));
-	return raw.toLowerCase();
-}
-function toEmail(raw) {
-	if (typeof raw !== "string" || !EMAIL_RE.test(raw)) throw Errors.invalidInput("email", invalidValueReason("must look like an email address", raw));
-	return raw.toLowerCase();
-}
-function toAuthUserId(raw) {
-	return toNonEmptyStringBrand(raw, "authUserId");
-}
-function toAnonymousDistinctId(raw) {
-	if (typeof raw !== "string" || !ANONYMOUS_DISTINCT_ID_RE.test(raw)) throw Errors.invalidInput("anonDistinctId", invalidValueReason("must be anon_ plus letters, digits, or hyphens", raw));
-	return raw;
-}
-function toAccountId(raw) {
-	if (typeof raw !== "string" || !ACCOUNT_ID_RE.test(raw)) throw Errors.invalidInput("accountId", invalidValueReason("must be account_ plus an alphanumeric id", raw));
-	return raw;
-}
-function toSubAccountId(raw) {
-	if (typeof raw !== "string" || !SUBACCOUNT_ID_RE.test(raw)) throw Errors.invalidInput("subAccountId", invalidValueReason("must be subaccount_ plus an alphanumeric id", raw));
-	return raw;
-}
-function toOrgId(raw) {
-	return toNonEmptyStringBrand(raw, "orgId");
-}
-function toAppId(raw) {
-	if (typeof raw !== "string" || !APP_ID_RE.test(raw)) throw Errors.invalidInput("appId", invalidValueReason("must be app_ plus a ULID", raw));
-	return raw;
-}
-function toAllowedOrigin(raw) {
-	if (typeof raw !== "string") throw Errors.invalidInput("allowedOrigin", "must be an http or https origin string");
-	const normalized = normalizeAllowedOrigin(raw);
-	if (normalized === null) throw Errors.invalidInput("allowedOrigin", invalidValueReason("must be an http or https origin", raw));
-	return normalized;
-}
-function toPublishableKeyId(raw) {
-	return toNonEmptyStringBrand(raw, "keyId");
-}
-function toDurationMs(raw) {
-	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw Errors.invalidInput("duration", invalidValueReason("must be a non-negative safe integer", raw));
-	return raw;
-}
-function toPublishableKey(raw) {
-	if (typeof raw !== "string" || !PUBLISHABLE_KEY_PATTERN.test(raw)) throw Errors.invalidInput("publishableKey", invalidValueReason("must match cap_pk_(test|live) plus 32 Crockford base32 chars", raw));
-	return raw;
-}
-function toEpochMs(raw) {
-	assertSafeNonNegativeInteger(raw, "epochMs");
-	return raw;
-}
-function toEpochSeconds(raw) {
-	assertSafeNonNegativeInteger(raw, "epochSeconds");
-	return raw;
-}
-function toChainId(raw) {
-	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw <= 0) throw Errors.invalidInput("chainId", invalidValueReason("must be a positive safe integer", raw));
-	return raw;
-}
-function toCountryCode(raw) {
-	if (typeof raw !== "string") throw Errors.invalidInput("countryCode", "must be a string");
-	const upper = raw.toUpperCase();
-	if (!COUNTRY_CODE_RE.test(upper)) throw Errors.invalidInput("countryCode", invalidValueReason("must be a 2-letter ISO 3166-1 alpha-2 code", raw));
-	return upper;
-}
-function toCurrencyCode(raw) {
-	if (typeof raw !== "string" || !SUPPORTED_CURRENCY_CODES.includes(raw)) throw Errors.invalidInput("currencyCode", invalidValueReason("unsupported currency", raw));
-	return raw;
-}
-function toKycTier(raw) {
-	if (typeof raw !== "number" || !Number.isInteger(raw) || raw < 0 || raw > 3) throw Errors.invalidInput("kycTier", invalidValueReason("must be an integer in [0, 3]", raw));
-	return raw;
-}
-function toRoleKey(raw) {
-	if (typeof raw !== "string" || !BYTES32_RE.test(raw)) throw Errors.invalidInput("roleKey", invalidValueReason("must be 0x + 64 hex chars", raw));
-	return raw.toLowerCase();
-}
-function toSessionToken(raw) {
-	if (typeof raw !== "string" || raw.length === 0) throw Errors.invalidInput("token", "must be a non-empty string");
-	return raw;
-}
-function toJwtToken(raw) {
-	if (typeof raw !== "string" || raw.length === 0) throw Errors.invalidInput("jwtToken", "must be a non-empty string");
-	return raw;
-}
-function toNonEmptyStringBrand(raw, field) {
-	if (typeof raw !== "string" || raw.length === 0) throw Errors.invalidInput(field, "must be a non-empty string");
-	return raw;
-}
-function assertSafeNonNegativeInteger(raw, field) {
-	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw Errors.invalidInput(field, invalidValueReason("must be a non-negative safe integer", raw));
-}
-function normalizeAllowedOrigin(raw) {
-	let parsed;
-	try {
-		parsed = new URL(raw);
-	} catch {
-		return null;
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
-	if (parsed.hostname.includes("*")) return null;
-	return parsed.origin;
-}
-function invalidValueReason(prefix, raw) {
-	if (typeof raw === "string") return `${prefix}: ${raw.slice(0, 40)}`;
-	return `${prefix}: ${String(raw)}`;
-}
-//#endregion
-//#region src/ports/auth-cache.ts
-var AuthCacheError = class extends Data.TaggedError("AuthCacheError") {};
-var AuthCachePortTag = class extends Context.Tag("@capxul/sdk/ports/AuthCachePort")() {};
-//#endregion
-//#region src/adapters/auth-cache/serialization.ts
-function parseAuthSession(raw) {
-	if (typeof raw !== "object" || raw === null) return null;
-	const candidate = raw;
-	try {
-		return {
-			authUserId: toAuthUserId(candidate.authUserId),
-			email: toEmail(candidate.email),
-			token: toSessionToken(candidate.token),
-			expiresAt: toEpochMs(candidate.expiresAt)
-		};
-	} catch {
-		return null;
-	}
-}
-function parseCachedJwt(raw) {
-	if (typeof raw !== "object" || raw === null) return null;
-	const candidate = raw;
-	try {
-		return {
-			token: toJwtToken(candidate.token),
-			expEpochSeconds: toEpochSeconds(candidate.expEpochSeconds)
-		};
-	} catch {
-		return null;
-	}
-}
-//#endregion
-//#region src/adapters/auth-cache/BrowserAuthCacheAdapter.ts
-const SESSION_KEY = "capxul.session";
-const JWT_KEY = "capxul.jwt";
-var BrowserAuthCacheAdapter = class {
-	storage;
-	constructor(storage) {
-		this.storage = storage;
-	}
-	getSession = authCacheTry("getSession", () => {
-		const raw = this.storage.getItem(SESSION_KEY);
-		if (raw === null) return null;
-		try {
-			return parseAuthSession(JSON.parse(raw));
-		} catch {
-			return null;
-		}
-	});
-	setSession = (session) => authCacheTry("setSession", () => {
-		this.storage.setItem(SESSION_KEY, JSON.stringify(session));
-	});
-	clearSession = authCacheTry("clearSession", () => {
-		this.storage.removeItem(SESSION_KEY);
-	});
-	getJwt = authCacheTry("getJwt", () => {
-		const raw = this.storage.getItem(JWT_KEY);
-		if (raw === null) return null;
-		try {
-			return parseCachedJwt(JSON.parse(raw));
-		} catch {
-			return null;
-		}
-	});
-	setJwt = (jwt) => authCacheTry("setJwt", () => {
-		this.storage.setItem(JWT_KEY, JSON.stringify(jwt));
-	});
-	clearJwt = authCacheTry("clearJwt", () => {
-		this.storage.removeItem(JWT_KEY);
-	});
-};
-function toAuthCacheError(operation, cause) {
-	return new AuthCacheError({
-		operation,
-		cause
-	});
-}
-function authCacheTry(operation, run) {
-	return Effect.try({
-		try: run,
-		catch: (cause) => toAuthCacheError(operation, cause)
-	});
-}
-//#endregion
-//#region src/adapters/auth-cache/InMemoryAuthCacheAdapter.ts
-var InMemoryAuthCacheAdapter = class {
-	session = null;
-	jwt = null;
-	getSession = Effect.sync(() => this.session);
-	setSession = (session) => Effect.sync(() => {
-		this.session = session;
-	});
-	clearSession = Effect.sync(() => {
-		this.session = null;
-	});
-	getJwt = Effect.sync(() => this.jwt);
-	setJwt = (jwt) => Effect.sync(() => {
-		this.jwt = jwt;
-	});
-	clearJwt = Effect.sync(() => {
-		this.jwt = null;
-	});
-};
-Layer.effect(AuthCachePortTag, Effect.sync(() => new InMemoryAuthCacheAdapter()).pipe(Effect.mapError((cause) => new AuthCacheError({
-	operation: "initialize",
-	cause
-}))));
-//#endregion
-export { toSessionToken as A, toEpochSeconds as C, toPublishableKey as D, toOrgId as E, isCapxulError as F, decodeConvexError as M, CapxulError as N, toPublishableKeyId as O, Errors as P, toEpochMs as S, toKycTier as T, toChainId as _, AuthCacheError as a, toDurationMs as b, BYTES32_RE as c, toAccountId as d, toAddress as f, toAuthUserId as g, toAppId as h, parseCachedJwt as i, toSubAccountId as j, toRoleKey as k, EVM_ADDRESS_RE as l, toAnonymousDistinctId as m, BrowserAuthCacheAdapter as n, AuthCachePortTag as o, toAllowedOrigin as p, parseAuthSession as r, APP_ID_RE as s, InMemoryAuthCacheAdapter as t, SUPPORTED_CURRENCY_CODES as u, toCountryCode as v, toJwtToken as w, toEmail as x, toCurrencyCode as y };
-
-//# sourceMappingURL=InMemoryAuthCacheAdapter-v5W-XB5M.mjs.map