@capxul/sdk 1.0.0-alpha.21 → 1.0.0-alpha.22

package/dist/InMemoryAuthCacheAdapter-CHYpYyk5.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"InMemoryAuthCacheAdapter-CHYpYyk5.mjs","names":[],"sources":["../../errors/src/errors.ts","../../errors/src/convex-error-decoding.ts","../../types/src/index.ts","../src/ports/auth-cache.ts","../src/adapters/auth-cache/serialization.ts","../src/adapters/auth-cache/BrowserAuthCacheAdapter.ts","../src/adapters/auth-cache/InMemoryAuthCacheAdapter.ts"],"sourcesContent":["// The canonical error-code catalog as a runtime constant. `CapxulErrorCode`\n// is derived from it so the type and any runtime check that needs to\n// enumerate codes (e.g. the convex-error codec's `KNOWN_CODES`) share a\n// single source of truth — a TypeScript union alone can't be introspected\n// at runtime, which previously forced a hand-maintained duplicate.\nexport const CAPXUL_ERROR_CODES = [\n  \"NOT_AUTHENTICATED\",\n  \"EMAIL_DELIVERY_FAILED\",\n  \"PROFILE_NOT_FOUND\",\n  \"SMART_ACCOUNT_MISSING\",\n  \"PLAYER_NOT_FOUND\",\n  \"ACCOUNT_NOT_FOUND\",\n  \"PROVIDER_ERROR\",\n  \"INVALID_INPUT\",\n  \"ENV_MISSING\",\n  \"NOT_IMPLEMENTED\",\n  \"VERIFICATION_REQUIRED\",\n  \"INSUFFICIENT_BALANCE\",\n  \"INVALID_RECIPIENT\",\n  \"ROLE_PERMISSION_DENIED\",\n  \"TRANSACTION_FAILED\",\n  \"RATE_LIMITED\",\n  \"NETWORK_ERROR\",\n  \"UNKNOWN\",\n  \"OTP_EXPIRED\",\n  \"SIGNER_REJECTED\",\n  \"CANCELLED\",\n  \"WRONG_STATE\",\n] as const;\n\nexport type CapxulErrorCode = (typeof CAPXUL_ERROR_CODES)[number];\n\n/**\n * The error codes that represent an expected product outcome rather than a\n * defect. The SDK and backend observation boundaries both classify failures\n * against this set to route expected outcomes to their own PostHog event\n * stream; keeping the single copy here (adjacent to `CAPXUL_ERROR_CODES`, so a\n * code rename forces this set to move with it) stops the two sides of the wire\n * from drifting and silently splitting one outcome across two streams.\n */\nexport const EXPECTED_OPERATION_OUTCOMES: ReadonlySet<CapxulErrorCode> = new Set([\n  \"INVALID_INPUT\",\n  \"NOT_AUTHENTICATED\",\n  // A user with no Safe yet — the normal post-OTP / pre-provision state. Reading\n  // the account, current user, or balance in that window is an expected outcome,\n  // not a defect, so both observation boundaries route it to their\n  // `*_expected_outcome` stream instead of an unexpected `$exception` (#1031).\n  \"SMART_ACCOUNT_MISSING\",\n  \"CANCELLED\",\n  \"SIGNER_REJECTED\",\n  \"VERIFICATION_REQUIRED\",\n  \"INSUFFICIENT_BALANCE\",\n  \"INVALID_RECIPIENT\",\n  \"ROLE_PERMISSION_DENIED\",\n  \"RATE_LIMITED\",\n  \"OTP_EXPIRED\",\n  \"WRONG_STATE\",\n]);\n\n/**\n * Why an auth/provider call failed — a flat CAUSE enum. The *where* (which\n * OpenFort operation) stays in the separate `operation` detail field; this\n * names the root cause so a single `$exception` can be triaged without\n * parsing the message. Five members, no free strings:\n *\n * - `auth-origin-mismatch`: OTP cookies live on `localhost:PORT` but OpenFort\n *   hits the Convex host → no session reaches the provider.\n * - `stale-openfort-cache`: an old `userId` in scoped storage makes the SDK\n *   skip re-auth → 401 on `v2/accounts`.\n * - `app-env-allowlist`: the selected app/deployment origin is not allowlisted\n *   → 401.\n * - `no-secure-context`: sandboxed/headless browser with no Web Crypto, so\n *   `getAddress`/`configure` can never produce an address. Previously vanished\n *   into `unknown`; the signer's secure-context probe now names it.\n * - `unknown`: catch-all when no cause could be determined.\n */\nexport type FailureMode =\n  | \"auth-origin-mismatch\"\n  | \"stale-openfort-cache\"\n  | \"app-env-allowlist\"\n  | \"no-secure-context\"\n  | \"unknown\";\n\nexport type CapxulErrorDetails = Record<string, unknown>;\n\nexport type SignerSource = \"openfort-embedded\" | \"injected-eip1193\" | \"local-private-key\";\n\nexport type VerificationRequiredDetails =\n  | { readonly requiredTier: number }\n  | { readonly rail: string; readonly currentKind: string };\n\nexport type SerializedCapxulError = {\n  readonly code: CapxulErrorCode;\n  readonly message: string;\n  readonly details?: CapxulErrorDetails;\n  readonly correlationId?: string;\n  readonly layer?: string;\n};\n\nexport type CapxulErrorOptions = {\n  readonly cause?: unknown;\n  readonly details?: CapxulErrorDetails;\n  readonly correlationId?: string;\n  readonly layer?: string;\n};\n\nexport class CapxulError extends Error {\n  readonly code: CapxulErrorCode;\n  readonly details?: CapxulErrorDetails;\n  readonly correlationId?: string;\n  readonly layer?: string;\n\n  constructor(code: CapxulErrorCode, message: string, options: CapxulErrorOptions = {}) {\n    super(message, \"cause\" in options ? { cause: options.cause } : undefined);\n    this.name = \"CapxulError\";\n    this.code = code;\n    if (options.details !== undefined) {\n      this.details = options.details;\n    }\n    if (options.correlationId !== undefined) {\n      this.correlationId = options.correlationId;\n    }\n    if (options.layer !== undefined) {\n      this.layer = options.layer;\n    }\n  }\n}\n\nexport function isCapxulError(value: unknown): value is CapxulError {\n  return value instanceof CapxulError;\n}\n\nexport function serializeCapxulError(error: CapxulError): SerializedCapxulError {\n  return compactSerialized({\n    code: error.code,\n    message: error.message,\n    details: error.details,\n    correlationId: error.correlationId,\n    layer: error.layer,\n  });\n}\n\nexport function deserializeCapxulError(serialized: SerializedCapxulError): CapxulError {\n  return new CapxulError(\n    serialized.code,\n    serialized.message,\n    compactErrorOptions({\n      details: serialized.details,\n      correlationId: serialized.correlationId,\n      layer: serialized.layer,\n    }),\n  );\n}\n\nfunction compactSerialized(serialized: {\n  readonly code: CapxulErrorCode;\n  readonly message: string;\n  readonly details: CapxulErrorDetails | undefined;\n  readonly correlationId: string | undefined;\n  readonly layer: string | undefined;\n}): SerializedCapxulError {\n  const result: {\n    code: CapxulErrorCode;\n    message: string;\n    details?: CapxulErrorDetails;\n    correlationId?: string;\n    layer?: string;\n  } = {\n    code: serialized.code,\n    message: serialized.message,\n  };\n\n  if (serialized.details !== undefined) {\n    result.details = serialized.details;\n  }\n  if (serialized.correlationId !== undefined) {\n    result.correlationId = serialized.correlationId;\n  }\n  if (serialized.layer !== undefined) {\n    result.layer = serialized.layer;\n  }\n\n  return result;\n}\n\nfunction compactErrorOptions(options: {\n  readonly cause?: unknown;\n  readonly details: CapxulErrorDetails | undefined;\n  readonly correlationId: string | undefined;\n  readonly layer: string | undefined;\n}): CapxulErrorOptions {\n  const result: {\n    cause?: unknown;\n    details?: CapxulErrorDetails;\n    correlationId?: string;\n    layer?: string;\n  } = {};\n\n  if (\"cause\" in options) {\n    result.cause = options.cause;\n  }\n  if (options.details !== undefined) {\n    result.details = options.details;\n  }\n  if (options.correlationId !== undefined) {\n    result.correlationId = options.correlationId;\n  }\n  if (options.layer !== undefined) {\n    result.layer = options.layer;\n  }\n\n  return result;\n}\n\nexport const Errors = {\n  notAuthenticated: (message?: string, opts?: { readonly failure_mode?: FailureMode }) =>\n    new CapxulError(\n      \"NOT_AUTHENTICATED\",\n      message ?? \"Not authenticated\",\n      opts?.failure_mode ? { details: { failure_mode: opts.failure_mode } } : undefined,\n    ),\n  emailDeliveryFailed: (detail: string) =>\n    new CapxulError(\"EMAIL_DELIVERY_FAILED\", \"Failed to send email\", {\n      details: { detail },\n    }),\n\n  profileNotFound: (authUserId: string) =>\n    new CapxulError(\"PROFILE_NOT_FOUND\", `Profile not found for user ${authUserId}`, {\n      details: { authUserId },\n    }),\n\n  smartAccountMissing: (authUserId: string) =>\n    new CapxulError(\"SMART_ACCOUNT_MISSING\", \"Smart account not provisioned\", {\n      details: { authUserId },\n    }),\n\n  playerNotFound: (playerId?: string) =>\n    new CapxulError(\n      \"PLAYER_NOT_FOUND\",\n      playerId ? `Openfort player ${playerId} not found` : \"Openfort player not found\",\n      playerId === undefined ? undefined : { details: { playerId } },\n    ),\n\n  accountNotFound: (accountId?: string) =>\n    new CapxulError(\n      \"ACCOUNT_NOT_FOUND\",\n      accountId ? `Openfort account ${accountId} not found` : \"Openfort account not found\",\n      accountId === undefined ? undefined : { details: { accountId } },\n    ),\n\n  providerError: (\n    provider: string,\n    operation: string,\n    cause: unknown,\n    opts?: { readonly failure_mode?: FailureMode },\n  ) => {\n    const details: Record<string, unknown> = { provider, operation };\n    if (opts?.failure_mode) {\n      details.failure_mode = opts.failure_mode;\n    }\n    return new CapxulError(\"PROVIDER_ERROR\", `Provider error: ${provider} ${operation}`, {\n      cause,\n      details,\n    });\n  },\n\n  invalidInput: (field: string, reason: string) =>\n    new CapxulError(\"INVALID_INPUT\", `Invalid ${field}: ${reason}`, {\n      details: { field, reason },\n    }),\n\n  envMissing: (name: string) =>\n    new CapxulError(\"ENV_MISSING\", `Environment variable ${name} not configured`, {\n      details: { name },\n    }),\n\n  notImplemented: (domain: string, method: string) =>\n    new CapxulError(\n      \"NOT_IMPLEMENTED\",\n      `${domain}.${method} is not yet implemented. This feature is planned for a future release.`,\n      { details: { domain, method } },\n    ),\n\n  /**\n   * Sibling factory to {@link Errors.providerError} for the per-state timeout\n   * path in flows (initially ProvisioningFlow's mint_openfort / deploy_safe /\n   * register_indexer `after:` timers). Same `PROVIDER_ERROR` code as\n   * `providerError`, plus a `details.reason: \"timeout\"` discriminator so\n   * downstream observers can distinguish failure modes without parsing the\n   * message string. The redacted message names the timeout budget; the\n   * native `cause` carries the same information for `reportError` fidelity.\n   */\n  providerTimeout: (provider: string, operation: string, timeoutMs: number) =>\n    new CapxulError(\n      \"PROVIDER_ERROR\",\n      `Provider error: ${provider} ${operation} (timeout exceeded ${timeoutMs}ms)`,\n      {\n        details: { provider, operation, reason: \"timeout\" },\n        cause: new Error(`timeout: ${operation} exceeded ${timeoutMs}ms`),\n      },\n    ),\n\n  verificationRequired: (details: VerificationRequiredDetails) => {\n    const message =\n      \"rail\" in details\n        ? `Verification is required before ${details.rail} can use ${details.currentKind}.`\n        : `Verification tier ${details.requiredTier} is required.`;\n\n    return new CapxulError(\"VERIFICATION_REQUIRED\", message, {\n      details,\n    });\n  },\n\n  insufficientBalance: (asset: string, available: string, required: string) =>\n    new CapxulError(\"INSUFFICIENT_BALANCE\", `Insufficient ${asset} balance`, {\n      details: { asset, available, required },\n    }),\n\n  invalidRecipient: (reason: string) =>\n    new CapxulError(\"INVALID_RECIPIENT\", `Invalid recipient: ${reason}`, {\n      details: { reason },\n    }),\n\n  /**\n   * The org Zodiac Roles modifier REFUSED the spend on-chain (G4 · #547): the\n   * member's role condition (per-tx cap, per-day allowance, allowed recipient,\n   * or membership) was violated, so `execTransactionWithRole` reverted. This is\n   * a PERMISSION denial — explicitly NOT an `INSUFFICIENT_BALANCE` (the treasury\n   * held the funds; the role's authority is what bound). `reason` discriminates\n   * the violated condition (`over_cap` / `daily_cap` / `not_member` /\n   * `disallowed_recipient` / `condition_violation`); leak-safe — no on-chain\n   * identifiers ever enter the details.\n   */\n  rolePermissionDenied: (details: {\n    readonly reason:\n      | \"over_cap\"\n      | \"daily_cap\"\n      | \"not_member\"\n      | \"disallowed_recipient\"\n      | \"condition_violation\";\n    readonly operation?: string;\n  }) =>\n    new CapxulError(\n      \"ROLE_PERMISSION_DENIED\",\n      `Org role denied this spend on-chain (${details.reason}).`,\n      {\n        details:\n          details.operation === undefined\n            ? { reason: details.reason }\n            : { reason: details.reason, operation: details.operation },\n      },\n    ),\n\n  /**\n   * A transaction (or sponsored UserOp) failed. `details.reason` discriminates\n   * the failure mode for callers that must distinguish a CONFIRMED on-chain\n   * revert (`\"onchain_revert\"` — the op executed and reverted, e.g. a Zodiac\n   * Roles condition violation) from an inconclusive infra failure. A confirmed\n   * revert is the ONLY mode the org spend port may map to a roles denial.\n   */\n  transactionFailed: (operation: string, cause?: unknown, extra?: { readonly reason?: string }) =>\n    new CapxulError(\"TRANSACTION_FAILED\", `Transaction failed: ${operation}`, {\n      cause,\n      details: extra?.reason === undefined ? { operation } : { operation, reason: extra.reason },\n    }),\n\n  rateLimited: (details?: { readonly retryAfterMs?: number; readonly resource?: string }) =>\n    new CapxulError(\n      \"RATE_LIMITED\",\n      \"Rate limit exceeded\",\n      details === undefined ? undefined : { details: { ...details } },\n    ),\n\n  networkError: (operation: string, cause?: unknown) =>\n    new CapxulError(\"NETWORK_ERROR\", `Network error during ${operation}`, {\n      cause,\n      details: { operation },\n    }),\n\n  unknown: (cause?: unknown) => new CapxulError(\"UNKNOWN\", \"Unknown error\", { cause }),\n\n  otpExpired: (details?: { readonly email?: string; readonly expiredAt?: number }) =>\n    new CapxulError(\n      \"OTP_EXPIRED\",\n      \"Verification code has expired. Request a new one.\",\n      details === undefined ? undefined : { details: { ...details } },\n    ),\n\n  signerRejected: (details: {\n    readonly source: SignerSource;\n    readonly reason?: string;\n    readonly cause?: unknown;\n  }) =>\n    new CapxulError(\"SIGNER_REJECTED\", \"Signer rejected the request.\", {\n      cause: details.cause,\n      details:\n        details.reason === undefined\n          ? { source: details.source }\n          : { source: details.source, reason: details.reason },\n    }),\n\n  cancelled: (details?: { readonly operation?: string; readonly reason?: string }) =>\n    new CapxulError(\n      \"CANCELLED\",\n      \"Operation was cancelled.\",\n      details === undefined ? undefined : { details: { ...details } },\n    ),\n\n  /**\n   * Method called from a flow state where its precondition fails (TA16). The\n   * SDK's method API short-circuits with this error before driving the\n   * internal state machine. `currentState` is the Effect-machine snapshot\n   * tag (stringified — substrate is `@effect/experimental/Machine`; see\n   * `packages/errors/CONTEXT.md`); `validStates`\n   * enumerates the states the method accepts.\n   */\n  wrongState: (details: {\n    readonly method: string;\n    readonly currentState: string;\n    readonly validStates: readonly string[];\n  }) =>\n    new CapxulError(\n      \"WRONG_STATE\",\n      `${details.method} called from state '${details.currentState}'; valid states: ${details.validStates.join(\", \")}`,\n      { details: { ...details, validStates: [...details.validStates] } },\n    ),\n} as const;\n","// Shared `decodeConvexError` helper (TA5) — used by both the SDK's\n// `ConvexCallAdapter.mapToCapxulError` AND the backend `credentials/http.ts`\n// `bootstrapClient` handler. Single source of truth for cross-Convex-boundary\n// error decoding rules.\n//\n// Recognizes the `ConvexError(SerializedCapxulError)` object-shape produced by\n// `withErrorBoundary` (Probe B finding, 2026-05-19):\n//\n//   { name: \"ConvexError\", data: { code, message, details?, correlationId?, layer? } }\n//\n// AND the defensive string-shape branch for older Convex versions where\n// `data` is a JSON-serialized string. Pass-through for raw `CapxulError`\n// instances (which arrive directly when the throw happened in the same\n// V8 isolate as the catch). Returns null when the value is not a\n// recognizable shape — the caller falls back to NETWORK_ERROR + reportError.\n\nimport {\n  CAPXUL_ERROR_CODES,\n  CapxulError,\n  type CapxulErrorCode,\n  type SerializedCapxulError,\n  deserializeCapxulError,\n} from \"./errors.ts\";\n\n// Derived from the canonical catalog in errors.ts — single source of truth,\n// so a new code added to `CAPXUL_ERROR_CODES` is recognized here automatically.\nconst KNOWN_CODES: ReadonlySet<CapxulErrorCode> = new Set(CAPXUL_ERROR_CODES);\n\nfunction isCapxulCode(value: unknown): value is CapxulErrorCode {\n  return typeof value === \"string\" && KNOWN_CODES.has(value as CapxulErrorCode);\n}\n\nfunction reconstruct(serialized: Record<string, unknown>): CapxulError | null {\n  if (!isCapxulCode(serialized.code)) return null;\n  const payload: SerializedCapxulError = {\n    code: serialized.code,\n    message: typeof serialized.message === \"string\" ? serialized.message : String(serialized.code),\n    ...(typeof serialized.details === \"object\" &&\n    serialized.details !== null &&\n    !Array.isArray(serialized.details)\n      ? { details: serialized.details as Record<string, unknown> }\n      : {}),\n    ...(typeof serialized.correlationId === \"string\"\n      ? { correlationId: serialized.correlationId }\n      : {}),\n    ...(typeof serialized.layer === \"string\" ? { layer: serialized.layer } : {}),\n  };\n  return deserializeCapxulError(payload);\n}\n\nexport function decodeConvexError(err: unknown): CapxulError | null {\n  if (err === null || err === undefined) return null;\n\n  // Pass-through: same isolate, real CapxulError instance.\n  if (err instanceof CapxulError) return err;\n\n  if (typeof err !== \"object\") return null;\n\n  // The canonical shape produced by `withErrorBoundary` then crossed by\n  // Convex's `ctx.runQuery` / `ConvexHttpClient`: a `ConvexError` whose\n  // `data` is the `SerializedCapxulError` object literal.\n  const record = err as Record<string, unknown>;\n  if (!(\"data\" in record)) return null;\n  const data = record.data;\n\n  if (typeof data === \"object\" && data !== null) {\n    return reconstruct(data as Record<string, unknown>);\n  }\n\n  // Defensive depth — some Convex versions JSON-stringify the data at\n  // the runtime boundary. Probe B confirmed @convex-dev/better-auth 0.10.13\n  // + convex 1.39.x do NOT do this, but the cheap parse keeps forward\n  // compatibility.\n  if (typeof data === \"string\") {\n    try {\n      const parsed = JSON.parse(data) as unknown;\n      if (typeof parsed === \"object\" && parsed !== null) {\n        return reconstruct(parsed as Record<string, unknown>);\n      }\n    } catch {\n      // Fall through.\n    }\n  }\n\n  return null;\n}\n","import { Errors } from \"@capxul/errors\";\nimport type { Brand } from \"./brand\";\n\nexport type { Brand } from \"./brand\";\n\nexport type Address = Brand<string, \"Address\">;\nexport type Email = Brand<string, \"Email\">;\nexport type Identity = Brand<string, \"Identity\">;\n// `Profile` is the SDK's user-shaped record returned by `IdentityPort`. Pure\n// record of brand-typed fields — not itself a brand. The field-level brands\n// satisfy `IdentityPort` clause I8 at compile time. Hosted here per the\n// package contract (`packages/types/CONTEXT.md`).\nexport type Profile = {\n  readonly authUserId: AuthUserId;\n  readonly email: Email;\n  readonly displayName: string | null;\n  readonly country: CountryCode | null;\n  readonly onboarded: boolean;\n  readonly withdrawalAddress: Address | null;\n  readonly kycTier: KycTier;\n  readonly createdAt: EpochMs;\n  readonly updatedAt: EpochMs;\n};\n// `SmartAccount` is the SDK's ERC-4337 record returned by `SmartAccountPort`.\n// Pure record of brand-typed fields — not itself a brand. `deployedAt` is\n// nullable: `null` means the address is counterfactual (derived, not yet\n// on-chain). PRD #462 (derivation v2): `signerAddress` is the CLAIMED owner —\n// `null` until the claim userOp installs the user's signer (`claimedAt`\n// records that event); the address derives from the email alone. Hosted here\n// per the package contract (`packages/types/CONTEXT.md`).\nexport type SmartAccount = {\n  readonly authUserId: AuthUserId;\n  readonly signerAddress: Address | null;\n  readonly smartAccountAddress: Address;\n  readonly chainId: ChainId;\n  readonly deployedAt: EpochMs | null;\n  readonly claimedAt: EpochMs | null;\n  readonly createdAt: EpochMs;\n};\n// `Money` is the SDK's consumer-facing value type (canon\n// `account-balance-model.md` §10). Every public monetary value is a `Money`\n// — never wei, never raw token units. `value` is a major-unit decimal string\n// (e.g. \"1.5\" USD); `decimals` is the on-chain token precision used for the\n// internal `fromWei`/`toWei` round-trip at the SDK boundary (USDX is 6).\n// Pure record of a brand-typed field + primitives — not itself a brand.\nexport type Money = {\n  readonly currency: CurrencyCode;\n  readonly value: string;\n  readonly decimals: number;\n};\n\n// `Account` is the SDK's logical money account (canon §6, §9). `id` is the\n// `account_`-shaped `AccountId` — NOT the Safe address and NOT an Openfort id.\n// `balance` is the Safe's top-line holdings; `available` is money not assigned\n// to any sub-account (canon §5/§12). With no sub-accounts (Slice 1a),\n// `available === balance`. Pure record of brand-typed fields — not a brand.\nexport type Account = {\n  readonly id: AccountId;\n  readonly balance: Money;\n  readonly available: Money;\n};\n\n/** Named bucket partitioning a logical Account (canon §9). */\nexport type SubAccount = {\n  readonly id: SubAccountId;\n  readonly accountId: AccountId;\n  readonly name: string;\n  readonly balance: Money;\n  readonly createdAt: EpochMs;\n};\n\nexport type AuthUserId = Brand<string, \"AuthUserId\">;\nexport type AnonymousDistinctId = Brand<string, \"AnonymousDistinctId\">;\nexport type PlayerId = Brand<string, \"PlayerId\">;\nexport type AccountId = Brand<string, \"AccountId\">;\nexport type SubAccountId = Brand<string, \"SubAccountId\">;\nexport type OrgId = Brand<string, \"OrgId\">;\nexport type AppId = Brand<string, \"AppId\">;\nexport type AllowedOrigin = Brand<string, \"AllowedOrigin\">;\nexport type PublishableKey = Brand<string, \"PublishableKey\">;\nexport type PublishableKeyId = Brand<string, \"PublishableKeyId\">;\nexport type DurationMs = Brand<number, \"DurationMs\">;\n// `DeveloperApplication` and `PublishableKeyRecord` are the SDK's record\n// shapes returned by `CredentialsPort`. Pure records of brand-typed fields\n// — not themselves brands. The field-level brands satisfy CR13 + the record\n// branding clauses of `credentials.test-d.ts` at compile time. Hosted here\n// per the package contract (`packages/types/CONTEXT.md`).\nexport type DeveloperApplication = {\n  readonly id: AppId;\n  readonly authUserId: AuthUserId;\n  readonly name: string;\n  readonly allowedOrigins: readonly AllowedOrigin[];\n  readonly createdAt: EpochMs;\n  readonly archivedAt: EpochMs | null;\n};\nexport type PublishableKeyRecord = {\n  readonly id: PublishableKeyId;\n  readonly applicationId: AppId;\n  readonly activeFromMs: EpochMs;\n  readonly gracePeriodEndsMs: EpochMs | null;\n  readonly revokedAt: EpochMs | null;\n};\nexport type TxHash = Brand<string, \"TxHash\">;\nexport type DocumentHash = Brand<string, \"DocumentHash\">;\nexport type EpochMs = Brand<number, \"EpochMs\">;\nexport type EpochSeconds = Brand<number, \"EpochSeconds\">;\nexport type ChainId = Brand<number, \"ChainId\">;\nexport type CountryCode = Brand<string, \"CountryCode\">;\nexport type CurrencyCode = Brand<SupportedCurrencyCode, \"CurrencyCode\">;\nexport type KycTier = Brand<0 | 1 | 2 | 3, \"KycTier\">;\nexport type BlockNumber = Brand<number, \"BlockNumber\">;\nexport type LogIndex = Brand<number, \"LogIndex\">;\nexport type WeiAmount = Brand<string, \"WeiAmount\">;\nexport type SafeAddress = Brand<string, \"SafeAddress\">;\nexport type ModuleAddress = Brand<string, \"ModuleAddress\">;\nexport type RunId = Brand<string, \"RunId\">;\nexport type RoleKey = Brand<string, \"RoleKey\">;\nexport type AllowanceKey = Brand<string, \"AllowanceKey\">;\nexport type SessionToken = Brand<string, \"SessionToken\">;\nexport type JwtToken = Brand<string, \"JwtToken\">;\n\n// `AuthSession` is the record type shared by `AuthClientPort` and\n// `SessionStoragePort`. Hosted here per the canon\n// (`packages/types/CONTEXT.md`) so both ports depend on it\n// symmetrically. Every field is branded — field-level brands satisfy the\n// AuthSession branding contract asserted in `auth-client.test-d.ts`.\nexport type AuthSession = {\n  readonly authUserId: AuthUserId;\n  readonly email: Email;\n  readonly token: SessionToken;\n  readonly expiresAt: EpochMs;\n};\n\nexport const EVM_ADDRESS_RE = /^0x[0-9a-f]{40}$/i;\nexport const BYTES32_RE = /^0x[0-9a-f]{64}$/i;\nexport const PUBLISHABLE_KEY_PATTERN = /^cap_pk_(test|live)_[0-9A-HJKMNP-TV-Z]{32}$/;\nexport const SUPPORTED_CURRENCIES = [\n  { code: \"USD\", symbol: \"$\", name: \"US Dollar\" },\n  { code: \"NGN\", symbol: \"NGN\", name: \"Nigerian Naira\" },\n  { code: \"GHS\", symbol: \"GHS\", name: \"Ghanaian Cedi\" },\n  { code: \"KES\", symbol: \"KSh\", name: \"Kenyan Shilling\" },\n  { code: \"UGX\", symbol: \"USh\", name: \"Ugandan Shilling\" },\n] as const;\nexport const SUPPORTED_CURRENCY_CODES = SUPPORTED_CURRENCIES.map((currency) => currency.code);\ntype SupportedCurrencyCode = (typeof SUPPORTED_CURRENCIES)[number][\"code\"];\nexport const CURRENCY_SYMBOLS = Object.fromEntries(\n  SUPPORTED_CURRENCIES.map((currency) => [currency.code, currency.symbol]),\n) as Record<SupportedCurrencyCode, string>;\n\nconst EMAIL_RE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\nconst COUNTRY_CODE_RE = /^[A-Z]{2}$/;\nconst ANONYMOUS_DISTINCT_ID_RE = /^anon_[a-zA-Z0-9-]+$/;\n// Canon §6: the logical Account brand is `account_`-shaped. The tail mirrors\n// the `app_` ULID-shape generator (`account_<26 Crockford base32 chars>`) but\n// the brand only enforces the `account_` prefix + a non-empty alphanumeric\n// tail so existing opaque test ids (`account_123`) and generated ULIDs both\n// satisfy it.\nconst ACCOUNT_ID_RE = /^account_[0-9A-Za-z]+$/;\nconst SUBACCOUNT_ID_RE = /^subaccount_[0-9A-Za-z]+$/;\n// Exported so `@capxul/wire`'s `AppIdSchema` can reuse the same regex via\n// `Schema.filter(...)` and stay in lockstep with `toAppId` (Decision 2,\n// 2b parity).\nexport const APP_ID_RE = /^app_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;\nconst TX_HASH_RE = /^0x[0-9a-f]{64}$/i;\nconst DOCUMENT_HASH_HEX_RE = /^[0-9a-fA-F]{64}$/;\nconst WEI_RE = /^[0-9]+$/;\nconst RUN_ID_RE = /^run_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;\nconst MAX_SAFE_EPOCH_SECONDS = Math.floor(Number.MAX_SAFE_INTEGER / 1000);\n\nexport function toAddress(raw: unknown): Address {\n  if (typeof raw !== \"string\" || !EVM_ADDRESS_RE.test(raw)) {\n    throw Errors.invalidInput(\"address\", invalidValueReason(\"invalid EVM address format\", raw));\n  }\n\n  return raw.toLowerCase() as Address;\n}\n\nexport function isEvmAddress(raw: unknown): raw is string {\n  return typeof raw === \"string\" && EVM_ADDRESS_RE.test(raw);\n}\n\nexport function toEmail(raw: unknown): Email {\n  if (typeof raw !== \"string\" || !EMAIL_RE.test(raw)) {\n    throw Errors.invalidInput(\"email\", invalidValueReason(\"must look like an email address\", raw));\n  }\n\n  return raw.toLowerCase() as Email;\n}\n\nexport function toIdentity(raw: unknown): Identity {\n  return toNonEmptyStringBrand(raw, \"identity\") as Identity;\n}\n\nexport function toAuthUserId(raw: unknown): AuthUserId {\n  return toNonEmptyStringBrand(raw, \"authUserId\") as AuthUserId;\n}\n\nexport function toAnonymousDistinctId(raw: unknown): AnonymousDistinctId {\n  if (typeof raw !== \"string\" || !ANONYMOUS_DISTINCT_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"anonDistinctId\",\n      invalidValueReason(\"must be anon_ plus letters, digits, or hyphens\", raw),\n    );\n  }\n\n  return raw as AnonymousDistinctId;\n}\n\nexport function toPlayerId(raw: unknown): PlayerId {\n  return toNonEmptyStringBrand(raw, \"playerId\") as PlayerId;\n}\n\nexport function toAccountId(raw: unknown): AccountId {\n  if (typeof raw !== \"string\" || !ACCOUNT_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"accountId\",\n      invalidValueReason(\"must be account_ plus an alphanumeric id\", raw),\n    );\n  }\n\n  return raw as AccountId;\n}\n\nexport function toSubAccountId(raw: unknown): SubAccountId {\n  if (typeof raw !== \"string\" || !SUBACCOUNT_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"subAccountId\",\n      invalidValueReason(\"must be subaccount_ plus an alphanumeric id\", raw),\n    );\n  }\n\n  return raw as SubAccountId;\n}\n\nexport function toOrgId(raw: unknown): OrgId {\n  return toNonEmptyStringBrand(raw, \"orgId\") as OrgId;\n}\n\nexport function toAppId(raw: unknown): AppId {\n  if (typeof raw !== \"string\" || !APP_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\"appId\", invalidValueReason(\"must be app_ plus a ULID\", raw));\n  }\n\n  return raw as AppId;\n}\n\nexport function toAllowedOrigin(raw: unknown): AllowedOrigin {\n  if (typeof raw !== \"string\") {\n    throw Errors.invalidInput(\"allowedOrigin\", \"must be an http or https origin string\");\n  }\n\n  const normalized = normalizeAllowedOrigin(raw);\n  if (normalized === null) {\n    throw Errors.invalidInput(\n      \"allowedOrigin\",\n      invalidValueReason(\"must be an http or https origin\", raw),\n    );\n  }\n\n  return normalized as AllowedOrigin;\n}\n\nexport function toPublishableKeyId(raw: unknown): PublishableKeyId {\n  return toNonEmptyStringBrand(raw, \"keyId\") as PublishableKeyId;\n}\n\nexport function toDurationMs(raw: unknown): DurationMs {\n  if (typeof raw !== \"number\" || !Number.isSafeInteger(raw) || raw < 0) {\n    throw Errors.invalidInput(\n      \"duration\",\n      invalidValueReason(\"must be a non-negative safe integer\", raw),\n    );\n  }\n\n  return raw as DurationMs;\n}\n\nexport function toPublishableKey(raw: unknown): PublishableKey {\n  if (typeof raw !== \"string\" || !PUBLISHABLE_KEY_PATTERN.test(raw)) {\n    throw Errors.invalidInput(\n      \"publishableKey\",\n      invalidValueReason(\"must match cap_pk_(test|live) plus 32 Crockford base32 chars\", raw),\n    );\n  }\n\n  return raw as PublishableKey;\n}\n\nexport function toTxHash(raw: unknown): TxHash {\n  if (typeof raw !== \"string\" || !TX_HASH_RE.test(raw)) {\n    throw Errors.invalidInput(\"txHash\", invalidValueReason(\"must be 0x + 64 hex chars\", raw));\n  }\n\n  return raw.toLowerCase() as TxHash;\n}\n\nexport function toDocumentHash(raw: unknown): DocumentHash {\n  if (typeof raw !== \"string\") {\n    throw Errors.invalidInput(\"documentHash\", \"must be a string\");\n  }\n\n  const stripped = raw.startsWith(\"0x\") || raw.startsWith(\"0X\") ? raw.slice(2) : raw;\n  if (!DOCUMENT_HASH_HEX_RE.test(stripped)) {\n    throw Errors.invalidInput(\"documentHash\", \"must be 32 bytes of hex\");\n  }\n\n  return `0x${stripped.toLowerCase()}` as DocumentHash;\n}\n\nexport function toEpochMs(raw: unknown): EpochMs {\n  assertSafeNonNegativeInteger(raw, \"epochMs\");\n  return raw as EpochMs;\n}\n\nexport function toEpochSeconds(raw: unknown): EpochSeconds {\n  assertSafeNonNegativeInteger(raw, \"epochSeconds\");\n  return raw as EpochSeconds;\n}\n\nexport function secondsToMs(seconds: EpochSeconds): EpochMs {\n  if (seconds > MAX_SAFE_EPOCH_SECONDS) {\n    throw Errors.invalidInput(\"epochSeconds\", `${seconds} would overflow when multiplied by 1000`);\n  }\n\n  return toEpochMs(seconds * 1000);\n}\n\nexport function epochMsToSeconds(ms: EpochMs): EpochSeconds {\n  return toEpochSeconds(Math.floor(ms / 1000));\n}\n\nexport function toChainId(raw: unknown): ChainId {\n  if (typeof raw !== \"number\" || !Number.isSafeInteger(raw) || raw <= 0) {\n    throw Errors.invalidInput(\n      \"chainId\",\n      invalidValueReason(\"must be a positive safe integer\", raw),\n    );\n  }\n\n  return raw as ChainId;\n}\n\nexport function toBlockNumber(raw: unknown): BlockNumber {\n  assertSafeNonNegativeInteger(raw, \"blockNumber\");\n  return raw as BlockNumber;\n}\n\nexport function toLogIndex(raw: unknown): LogIndex {\n  assertSafeNonNegativeInteger(raw, \"logIndex\");\n  return raw as LogIndex;\n}\n\nexport function toWeiAmount(raw: unknown): WeiAmount {\n  if (typeof raw !== \"string\" || !WEI_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"weiAmount\",\n      invalidValueReason(\"must be a non-negative integer string\", raw),\n    );\n  }\n\n  return raw as WeiAmount;\n}\n\nexport function toCountryCode(raw: unknown): CountryCode {\n  if (typeof raw !== \"string\") {\n    throw Errors.invalidInput(\"countryCode\", \"must be a string\");\n  }\n\n  const upper = raw.toUpperCase();\n  if (!COUNTRY_CODE_RE.test(upper)) {\n    throw Errors.invalidInput(\n      \"countryCode\",\n      invalidValueReason(\"must be a 2-letter ISO 3166-1 alpha-2 code\", raw),\n    );\n  }\n\n  return upper as CountryCode;\n}\n\nexport function toCurrencyCode(raw: unknown): CurrencyCode {\n  if (typeof raw !== \"string\" || !SUPPORTED_CURRENCY_CODES.includes(raw as SupportedCurrencyCode)) {\n    throw Errors.invalidInput(\"currencyCode\", invalidValueReason(\"unsupported currency\", raw));\n  }\n\n  return raw as CurrencyCode;\n}\n\nexport function currencySymbolFor(code: CurrencyCode): string {\n  const symbol = CURRENCY_SYMBOLS[code as SupportedCurrencyCode];\n  if (symbol === undefined) {\n    throw Errors.invalidInput(\"currencyCode\", `no symbol registered for \"${String(code)}\"`);\n  }\n\n  return symbol;\n}\n\nexport function toKycTier(raw: unknown): KycTier {\n  if (typeof raw !== \"number\" || !Number.isInteger(raw) || raw < 0 || raw > 3) {\n    throw Errors.invalidInput(\"kycTier\", invalidValueReason(\"must be an integer in [0, 3]\", raw));\n  }\n\n  return raw as KycTier;\n}\n\nexport function toSafeAddress(raw: unknown): SafeAddress {\n  if (typeof raw !== \"string\" || !EVM_ADDRESS_RE.test(raw)) {\n    throw Errors.invalidInput(\"safeAddress\", invalidValueReason(\"invalid EVM address format\", raw));\n  }\n\n  return raw.toLowerCase() as SafeAddress;\n}\n\nexport function toModuleAddress(raw: unknown): ModuleAddress {\n  if (typeof raw !== \"string\" || !EVM_ADDRESS_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"moduleAddress\",\n      invalidValueReason(\"invalid EVM address format\", raw),\n    );\n  }\n\n  return raw.toLowerCase() as ModuleAddress;\n}\n\nexport function toRunId(raw: unknown): RunId {\n  if (typeof raw !== \"string\" || !RUN_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\"runId\", \"must match the format run_<uuid>\");\n  }\n\n  return raw as RunId;\n}\n\nexport function toRoleKey(raw: unknown): RoleKey {\n  if (typeof raw !== \"string\" || !BYTES32_RE.test(raw)) {\n    throw Errors.invalidInput(\"roleKey\", invalidValueReason(\"must be 0x + 64 hex chars\", raw));\n  }\n\n  return raw.toLowerCase() as RoleKey;\n}\n\nexport function toAllowanceKey(raw: unknown): AllowanceKey {\n  if (typeof raw !== \"string\" || !BYTES32_RE.test(raw)) {\n    throw Errors.invalidInput(\"allowanceKey\", invalidValueReason(\"must be 0x + 64 hex chars\", raw));\n  }\n\n  return raw.toLowerCase() as AllowanceKey;\n}\n\nexport function toSessionToken(raw: unknown): SessionToken {\n  if (typeof raw !== \"string\" || raw.length === 0) {\n    throw Errors.invalidInput(\"token\", \"must be a non-empty string\");\n  }\n\n  return raw as SessionToken;\n}\n\nexport function toJwtToken(raw: unknown): JwtToken {\n  if (typeof raw !== \"string\" || raw.length === 0) {\n    throw Errors.invalidInput(\"jwtToken\", \"must be a non-empty string\");\n  }\n\n  return raw as JwtToken;\n}\n\nfunction toNonEmptyStringBrand(raw: unknown, field: string): string {\n  if (typeof raw !== \"string\" || raw.length === 0) {\n    throw Errors.invalidInput(field, \"must be a non-empty string\");\n  }\n\n  return raw;\n}\n\nfunction assertSafeNonNegativeInteger(raw: unknown, field: string): asserts raw is number {\n  if (typeof raw !== \"number\" || !Number.isSafeInteger(raw) || raw < 0) {\n    throw Errors.invalidInput(\n      field,\n      invalidValueReason(\"must be a non-negative safe integer\", raw),\n    );\n  }\n}\n\nfunction normalizeAllowedOrigin(raw: string): string | null {\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    return null;\n  }\n\n  if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n    return null;\n  }\n\n  if (parsed.hostname.includes(\"*\")) {\n    return null;\n  }\n\n  return parsed.origin;\n}\n\nfunction invalidValueReason(prefix: string, raw: unknown): string {\n  if (typeof raw === \"string\") {\n    return `${prefix}: ${raw.slice(0, 40)}`;\n  }\n\n  return `${prefix}: ${String(raw)}`;\n}\n","import { Context, Data, Effect } from \"effect\";\nimport type { AuthSession, EpochSeconds, JwtToken } from \"@capxul/types\";\n\n/**\n * AuthCachePort (TA4) — replaces `SessionStoragePort` in the rebuild slice's\n * consumer-facing wiring. Stores the user-snapshot Session AND the cached\n * Convex JWT (W7 bridge endpoint). The two slots are independent so a session\n * refresh doesn't invalidate the JWT and vice versa.\n *\n * Three adapters (TA7):\n *   - `BrowserAuthCacheAdapter`        — backed by `localStorage`\n *   - `FileSystemAuthCacheAdapter`     — mode-0600 JSON file in `~/.config/capxul/`\n *   - `InMemoryAuthCacheAdapter`       — for tests\n *\n * `SessionStoragePort` was retired by the Stage 4 rebuild; session and JWT\n * persistence now share this cache boundary.\n */\nexport interface AuthCachePort {\n  readonly getSession: Effect.Effect<AuthSession | null, AuthCacheError>;\n  readonly setSession: (session: AuthSession) => Effect.Effect<void, AuthCacheError>;\n  readonly clearSession: Effect.Effect<void, AuthCacheError>;\n\n  /**\n   * JWT cache for the `/api/auth/convex/token` bridge endpoint (W7).\n   * Stored separately from the session so a session refresh doesn't\n   * invalidate cached JWT.\n   */\n  readonly getJwt: Effect.Effect<CachedJwt | null, AuthCacheError>;\n  readonly setJwt: (jwt: CachedJwt) => Effect.Effect<void, AuthCacheError>;\n  readonly clearJwt: Effect.Effect<void, AuthCacheError>;\n}\n\n/**\n * Cached Convex JWT shape (TA4). `expEpochSeconds` is decoded from the JWT's\n * `exp` claim at fetch time so the `tokenProvider` cache eviction logic can\n * proactively refresh at `exp - 30s` per TA3.\n */\nexport interface CachedJwt {\n  readonly token: JwtToken;\n  readonly expEpochSeconds: EpochSeconds;\n}\n\nexport class AuthCacheError extends Data.TaggedError(\"AuthCacheError\")<{\n  readonly operation: string;\n  readonly cause: unknown;\n}> {}\n\nexport class AuthCachePortTag extends Context.Tag(\"@capxul/sdk/ports/AuthCachePort\")<\n  AuthCachePortTag,\n  AuthCachePort\n>() {}\n","import {\n  toAuthUserId,\n  toEmail,\n  toEpochMs,\n  toEpochSeconds,\n  toJwtToken,\n  toSessionToken,\n  type AuthSession,\n} from \"@capxul/types\";\n\nimport type { CachedJwt } from \"../../ports/auth-cache\";\n\nexport function parseAuthSession(raw: unknown): AuthSession | null {\n  if (typeof raw !== \"object\" || raw === null) return null;\n  const candidate = raw as {\n    readonly authUserId?: unknown;\n    readonly email?: unknown;\n    readonly token?: unknown;\n    readonly expiresAt?: unknown;\n  };\n\n  try {\n    return {\n      authUserId: toAuthUserId(candidate.authUserId),\n      email: toEmail(candidate.email),\n      token: toSessionToken(candidate.token),\n      expiresAt: toEpochMs(candidate.expiresAt),\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport function parseCachedJwt(raw: unknown): CachedJwt | null {\n  if (typeof raw !== \"object\" || raw === null) return null;\n  const candidate = raw as {\n    readonly token?: unknown;\n    readonly expEpochSeconds?: unknown;\n  };\n\n  try {\n    return {\n      token: toJwtToken(candidate.token),\n      expEpochSeconds: toEpochSeconds(candidate.expEpochSeconds),\n    };\n  } catch {\n    return null;\n  }\n}\n","import { Effect, Layer } from \"effect\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport {\n  AuthCacheError,\n  AuthCachePortTag,\n  type AuthCachePort,\n  type CachedJwt,\n} from \"../../ports/auth-cache\";\nimport { parseAuthSession, parseCachedJwt } from \"./serialization\";\n\nexport interface BrowserStorageShape {\n  getItem(key: string): string | null;\n  setItem(key: string, value: string): void;\n  removeItem(key: string): void;\n}\n\nconst SESSION_KEY = \"capxul.session\";\nconst JWT_KEY = \"capxul.jwt\";\n\nexport class BrowserAuthCacheAdapter implements AuthCachePort {\n  private readonly storage: BrowserStorageShape;\n\n  constructor(storage: BrowserStorageShape) {\n    this.storage = storage;\n  }\n\n  readonly getSession = authCacheTry(\"getSession\", () => {\n    const raw = this.storage.getItem(SESSION_KEY);\n    if (raw === null) return null;\n    try {\n      return parseAuthSession(JSON.parse(raw));\n    } catch {\n      return null;\n    }\n  });\n\n  readonly setSession = (session: AuthSession) =>\n    authCacheTry(\"setSession\", () => {\n      this.storage.setItem(SESSION_KEY, JSON.stringify(session));\n    });\n\n  readonly clearSession = authCacheTry(\"clearSession\", () => {\n    this.storage.removeItem(SESSION_KEY);\n  });\n\n  readonly getJwt = authCacheTry(\"getJwt\", () => {\n    const raw = this.storage.getItem(JWT_KEY);\n    if (raw === null) return null;\n    try {\n      return parseCachedJwt(JSON.parse(raw));\n    } catch {\n      return null;\n    }\n  });\n\n  readonly setJwt = (jwt: CachedJwt) =>\n    authCacheTry(\"setJwt\", () => {\n      this.storage.setItem(JWT_KEY, JSON.stringify(jwt));\n    });\n\n  readonly clearJwt = authCacheTry(\"clearJwt\", () => {\n    this.storage.removeItem(JWT_KEY);\n  });\n}\n\nexport function BrowserAuthCacheLayer(input: {\n  readonly storage: BrowserStorageShape;\n}): Layer.Layer<AuthCachePortTag, AuthCacheError> {\n  return Layer.effect(\n    AuthCachePortTag,\n    Effect.sync(() => new BrowserAuthCacheAdapter(input.storage)).pipe(\n      Effect.mapError((cause) => toAuthCacheError(\"initialize\", cause)),\n    ),\n  );\n}\n\nfunction toAuthCacheError(operation: string, cause: unknown): AuthCacheError {\n  return new AuthCacheError({ operation, cause });\n}\n\nfunction authCacheTry<T>(operation: string, run: () => T): Effect.Effect<T, AuthCacheError> {\n  return Effect.try({\n    try: run,\n    catch: (cause) => toAuthCacheError(operation, cause),\n  });\n}\n","import { Effect, Layer } from \"effect\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport {\n  AuthCacheError,\n  AuthCachePortTag,\n  type AuthCachePort,\n  type CachedJwt,\n} from \"../../ports/auth-cache\";\n\nexport class InMemoryAuthCacheAdapter implements AuthCachePort {\n  private session: AuthSession | null = null;\n  private jwt: CachedJwt | null = null;\n\n  readonly getSession = Effect.sync(() => this.session);\n\n  readonly setSession = (session: AuthSession) =>\n    Effect.sync(() => {\n      this.session = session;\n    });\n\n  readonly clearSession = Effect.sync(() => {\n    this.session = null;\n  });\n\n  readonly getJwt = Effect.sync(() => this.jwt);\n\n  readonly setJwt = (jwt: CachedJwt) =>\n    Effect.sync(() => {\n      this.jwt = jwt;\n    });\n\n  readonly clearJwt = Effect.sync(() => {\n    this.jwt = null;\n  });\n}\n\nexport const InMemoryAuthCacheLayer = Layer.effect(\n  AuthCachePortTag,\n  Effect.sync(() => new InMemoryAuthCacheAdapter()).pipe(\n    Effect.mapError((cause) => new AuthCacheError({ operation: \"initialize\", cause })),\n  ),\n);\n"],"mappings":";;AAKA,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;;AAYA,MAAa,8BAA4D,IAAI,IAAI;CAC/E;CACA;CAKA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAiDD,IAAa,cAAb,cAAiC,MAAM;CACrC;CACA;CACA;CACA;CAEA,YAAY,MAAuB,SAAiB,UAA8B,CAAC,GAAG;EACpF,MAAM,SAAS,WAAW,UAAU,EAAE,OAAO,QAAQ,MAAM,IAAI,KAAA,CAAS;EACxE,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,IAAI,QAAQ,YAAY,KAAA,GACtB,KAAK,UAAU,QAAQ;EAEzB,IAAI,QAAQ,kBAAkB,KAAA,GAC5B,KAAK,gBAAgB,QAAQ;EAE/B,IAAI,QAAQ,UAAU,KAAA,GACpB,KAAK,QAAQ,QAAQ;CAEzB;AACF;AAEA,SAAgB,cAAc,OAAsC;CAClE,OAAO,iBAAiB;AAC1B;AAYA,SAAgB,uBAAuB,YAAgD;CACrF,OAAO,IAAI,YACT,WAAW,MACX,WAAW,SACX,oBAAoB;EAClB,SAAS,WAAW;EACpB,eAAe,WAAW;EAC1B,OAAO,WAAW;CACpB,CAAC,CACH;AACF;AAiCA,SAAS,oBAAoB,SAKN;CACrB,MAAM,SAKF,CAAC;CAEL,IAAI,WAAW,SACb,OAAO,QAAQ,QAAQ;CAEzB,IAAI,QAAQ,YAAY,KAAA,GACtB,OAAO,UAAU,QAAQ;CAE3B,IAAI,QAAQ,kBAAkB,KAAA,GAC5B,OAAO,gBAAgB,QAAQ;CAEjC,IAAI,QAAQ,UAAU,KAAA,GACpB,OAAO,QAAQ,QAAQ;CAGzB,OAAO;AACT;AAEA,MAAa,SAAS;CACpB,mBAAmB,SAAkB,SACnC,IAAI,YACF,qBACA,WAAW,qBACX,MAAM,eAAe,EAAE,SAAS,EAAE,cAAc,KAAK,aAAa,EAAE,IAAI,KAAA,CAC1E;CACF,sBAAsB,WACpB,IAAI,YAAY,yBAAyB,wBAAwB,EAC/D,SAAS,EAAE,OAAO,EACpB,CAAC;CAEH,kBAAkB,eAChB,IAAI,YAAY,qBAAqB,8BAA8B,cAAc,EAC/E,SAAS,EAAE,WAAW,EACxB,CAAC;CAEH,sBAAsB,eACpB,IAAI,YAAY,yBAAyB,iCAAiC,EACxE,SAAS,EAAE,WAAW,EACxB,CAAC;CAEH,iBAAiB,aACf,IAAI,YACF,oBACA,WAAW,mBAAmB,SAAS,cAAc,6BACrD,aAAa,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,SAAS,EAAE,CAC/D;CAEF,kBAAkB,cAChB,IAAI,YACF,qBACA,YAAY,oBAAoB,UAAU,cAAc,8BACxD,cAAc,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CACjE;CAEF,gBACE,UACA,WACA,OACA,SACG;EACH,MAAM,UAAmC;GAAE;GAAU;EAAU;EAC/D,IAAI,MAAM,cACR,QAAQ,eAAe,KAAK;EAE9B,OAAO,IAAI,YAAY,kBAAkB,mBAAmB,SAAS,GAAG,aAAa;GACnF;GACA;EACF,CAAC;CACH;CAEA,eAAe,OAAe,WAC5B,IAAI,YAAY,iBAAiB,WAAW,MAAM,IAAI,UAAU,EAC9D,SAAS;EAAE;EAAO;CAAO,EAC3B,CAAC;CAEH,aAAa,SACX,IAAI,YAAY,eAAe,wBAAwB,KAAK,kBAAkB,EAC5E,SAAS,EAAE,KAAK,EAClB,CAAC;CAEH,iBAAiB,QAAgB,WAC/B,IAAI,YACF,mBACA,GAAG,OAAO,GAAG,OAAO,yEACpB,EAAE,SAAS;EAAE;EAAQ;CAAO,EAAE,CAChC;;;;;;;;;;CAWF,kBAAkB,UAAkB,WAAmB,cACrD,IAAI,YACF,kBACA,mBAAmB,SAAS,GAAG,UAAU,qBAAqB,UAAU,MACxE;EACE,SAAS;GAAE;GAAU;GAAW,QAAQ;EAAU;EAClD,uBAAO,IAAI,MAAM,YAAY,UAAU,YAAY,UAAU,GAAG;CAClE,CACF;CAEF,uBAAuB,YAAyC;EAM9D,OAAO,IAAI,YAAY,yBAJrB,UAAU,UACN,mCAAmC,QAAQ,KAAK,WAAW,QAAQ,YAAY,KAC/E,qBAAqB,QAAQ,aAAa,gBAES,EACvD,QACF,CAAC;CACH;CAEA,sBAAsB,OAAe,WAAmB,aACtD,IAAI,YAAY,wBAAwB,gBAAgB,MAAM,WAAW,EACvE,SAAS;EAAE;EAAO;EAAW;CAAS,EACxC,CAAC;CAEH,mBAAmB,WACjB,IAAI,YAAY,qBAAqB,sBAAsB,UAAU,EACnE,SAAS,EAAE,OAAO,EACpB,CAAC;;;;;;;;;;;CAYH,uBAAuB,YASrB,IAAI,YACF,0BACA,wCAAwC,QAAQ,OAAO,KACvD,EACE,SACE,QAAQ,cAAc,KAAA,IAClB,EAAE,QAAQ,QAAQ,OAAO,IACzB;EAAE,QAAQ,QAAQ;EAAQ,WAAW,QAAQ;CAAU,EAC/D,CACF;;;;;;;;CASF,oBAAoB,WAAmB,OAAiB,UACtD,IAAI,YAAY,sBAAsB,uBAAuB,aAAa;EACxE;EACA,SAAS,OAAO,WAAW,KAAA,IAAY,EAAE,UAAU,IAAI;GAAE;GAAW,QAAQ,MAAM;EAAO;CAC3F,CAAC;CAEH,cAAc,YACZ,IAAI,YACF,gBACA,uBACA,YAAY,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAChE;CAEF,eAAe,WAAmB,UAChC,IAAI,YAAY,iBAAiB,wBAAwB,aAAa;EACpE;EACA,SAAS,EAAE,UAAU;CACvB,CAAC;CAEH,UAAU,UAAoB,IAAI,YAAY,WAAW,iBAAiB,EAAE,MAAM,CAAC;CAEnF,aAAa,YACX,IAAI,YACF,eACA,qDACA,YAAY,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAChE;CAEF,iBAAiB,YAKf,IAAI,YAAY,mBAAmB,gCAAgC;EACjE,OAAO,QAAQ;EACf,SACE,QAAQ,WAAW,KAAA,IACf,EAAE,QAAQ,QAAQ,OAAO,IACzB;GAAE,QAAQ,QAAQ;GAAQ,QAAQ,QAAQ;EAAO;CACzD,CAAC;CAEH,YAAY,YACV,IAAI,YACF,aACA,4BACA,YAAY,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAChE;;;;;;;;;CAUF,aAAa,YAKX,IAAI,YACF,eACA,GAAG,QAAQ,OAAO,sBAAsB,QAAQ,aAAa,mBAAmB,QAAQ,YAAY,KAAK,IAAI,KAC7G,EAAE,SAAS;EAAE,GAAG;EAAS,aAAa,CAAC,GAAG,QAAQ,WAAW;CAAE,EAAE,CACnE;AACJ;;;AChZA,MAAM,cAA4C,IAAI,IAAI,kBAAkB;AAE5E,SAAS,aAAa,OAA0C;CAC9D,OAAO,OAAO,UAAU,YAAY,YAAY,IAAI,KAAwB;AAC9E;AAEA,SAAS,YAAY,YAAyD;CAC5E,IAAI,CAAC,aAAa,WAAW,IAAI,GAAG,OAAO;CAc3C,OAAO,uBAAuB;EAZ5B,MAAM,WAAW;EACjB,SAAS,OAAO,WAAW,YAAY,WAAW,WAAW,UAAU,OAAO,WAAW,IAAI;EAC7F,GAAI,OAAO,WAAW,YAAY,YAClC,WAAW,YAAY,QACvB,CAAC,MAAM,QAAQ,WAAW,OAAO,IAC7B,EAAE,SAAS,WAAW,QAAmC,IACzD,CAAC;EACL,GAAI,OAAO,WAAW,kBAAkB,WACpC,EAAE,eAAe,WAAW,cAAc,IAC1C,CAAC;EACL,GAAI,OAAO,WAAW,UAAU,WAAW,EAAE,OAAO,WAAW,MAAM,IAAI,CAAC;CAExC,CAAC;AACvC;AAEA,SAAgB,kBAAkB,KAAkC;CAClE,IAAI,QAAQ,QAAQ,QAAQ,KAAA,GAAW,OAAO;CAG9C,IAAI,eAAe,aAAa,OAAO;CAEvC,IAAI,OAAO,QAAQ,UAAU,OAAO;CAKpC,MAAM,SAAS;CACf,IAAI,EAAE,UAAU,SAAS,OAAO;CAChC,MAAM,OAAO,OAAO;CAEpB,IAAI,OAAO,SAAS,YAAY,SAAS,MACvC,OAAO,YAAY,IAA+B;CAOpD,IAAI,OAAO,SAAS,UAClB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,IAAI,OAAO,WAAW,YAAY,WAAW,MAC3C,OAAO,YAAY,MAAiC;CAExD,QAAQ,CAER;CAGF,OAAO;AACT;;;ACgDA,MAAa,iBAAiB;AAC9B,MAAa,aAAa;AAC1B,MAAa,0BAA0B;AACvC,MAAa,uBAAuB;CAClC;EAAE,MAAM;EAAO,QAAQ;EAAK,MAAM;CAAY;CAC9C;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAiB;CACrD;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAgB;CACpD;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAkB;CACtD;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAmB;AACzD;AACA,MAAa,2BAA2B,qBAAqB,KAAK,aAAa,SAAS,IAAI;AAE5D,OAAO,YACrC,qBAAqB,KAAK,aAAa,CAAC,SAAS,MAAM,SAAS,MAAM,CAAC,CACzE;AAEA,MAAM,WAAW;AACjB,MAAM,kBAAkB;AACxB,MAAM,2BAA2B;AAMjC,MAAM,gBAAgB;AACtB,MAAM,mBAAmB;AAIzB,MAAa,YAAY;AAKM,KAAK,MAAM,OAAO,mBAAmB,GAAI;AAExE,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,eAAe,KAAK,GAAG,GACrD,MAAM,OAAO,aAAa,WAAW,mBAAmB,8BAA8B,GAAG,CAAC;CAG5F,OAAO,IAAI,YAAY;AACzB;AAMA,SAAgB,QAAQ,KAAqB;CAC3C,IAAI,OAAO,QAAQ,YAAY,CAAC,SAAS,KAAK,GAAG,GAC/C,MAAM,OAAO,aAAa,SAAS,mBAAmB,mCAAmC,GAAG,CAAC;CAG/F,OAAO,IAAI,YAAY;AACzB;AAMA,SAAgB,aAAa,KAA0B;CACrD,OAAO,sBAAsB,KAAK,YAAY;AAChD;AAEA,SAAgB,sBAAsB,KAAmC;CACvE,IAAI,OAAO,QAAQ,YAAY,CAAC,yBAAyB,KAAK,GAAG,GAC/D,MAAM,OAAO,aACX,kBACA,mBAAmB,kDAAkD,GAAG,CAC1E;CAGF,OAAO;AACT;AAMA,SAAgB,YAAY,KAAyB;CACnD,IAAI,OAAO,QAAQ,YAAY,CAAC,cAAc,KAAK,GAAG,GACpD,MAAM,OAAO,aACX,aACA,mBAAmB,4CAA4C,GAAG,CACpE;CAGF,OAAO;AACT;AAEA,SAAgB,eAAe,KAA4B;CACzD,IAAI,OAAO,QAAQ,YAAY,CAAC,iBAAiB,KAAK,GAAG,GACvD,MAAM,OAAO,aACX,gBACA,mBAAmB,+CAA+C,GAAG,CACvE;CAGF,OAAO;AACT;AAEA,SAAgB,QAAQ,KAAqB;CAC3C,OAAO,sBAAsB,KAAK,OAAO;AAC3C;AAEA,SAAgB,QAAQ,KAAqB;CAC3C,IAAI,OAAO,QAAQ,YAAY,CAAC,UAAU,KAAK,GAAG,GAChD,MAAM,OAAO,aAAa,SAAS,mBAAmB,4BAA4B,GAAG,CAAC;CAGxF,OAAO;AACT;AAEA,SAAgB,gBAAgB,KAA6B;CAC3D,IAAI,OAAO,QAAQ,UACjB,MAAM,OAAO,aAAa,iBAAiB,wCAAwC;CAGrF,MAAM,aAAa,uBAAuB,GAAG;CAC7C,IAAI,eAAe,MACjB,MAAM,OAAO,aACX,iBACA,mBAAmB,mCAAmC,GAAG,CAC3D;CAGF,OAAO;AACT;AAEA,SAAgB,mBAAmB,KAAgC;CACjE,OAAO,sBAAsB,KAAK,OAAO;AAC3C;AAEA,SAAgB,aAAa,KAA0B;CACrD,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,cAAc,GAAG,KAAK,MAAM,GACjE,MAAM,OAAO,aACX,YACA,mBAAmB,uCAAuC,GAAG,CAC/D;CAGF,OAAO;AACT;AAEA,SAAgB,iBAAiB,KAA8B;CAC7D,IAAI,OAAO,QAAQ,YAAY,CAAC,wBAAwB,KAAK,GAAG,GAC9D,MAAM,OAAO,aACX,kBACA,mBAAmB,gEAAgE,GAAG,CACxF;CAGF,OAAO;AACT;AAuBA,SAAgB,UAAU,KAAuB;CAC/C,6BAA6B,KAAK,SAAS;CAC3C,OAAO;AACT;AAEA,SAAgB,eAAe,KAA4B;CACzD,6BAA6B,KAAK,cAAc;CAChD,OAAO;AACT;AAcA,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,cAAc,GAAG,KAAK,OAAO,GAClE,MAAM,OAAO,aACX,WACA,mBAAmB,mCAAmC,GAAG,CAC3D;CAGF,OAAO;AACT;AAuBA,SAAgB,cAAc,KAA2B;CACvD,IAAI,OAAO,QAAQ,UACjB,MAAM,OAAO,aAAa,eAAe,kBAAkB;CAG7D,MAAM,QAAQ,IAAI,YAAY;CAC9B,IAAI,CAAC,gBAAgB,KAAK,KAAK,GAC7B,MAAM,OAAO,aACX,eACA,mBAAmB,8CAA8C,GAAG,CACtE;CAGF,OAAO;AACT;AAEA,SAAgB,eAAe,KAA4B;CACzD,IAAI,OAAO,QAAQ,YAAY,CAAC,yBAAyB,SAAS,GAA4B,GAC5F,MAAM,OAAO,aAAa,gBAAgB,mBAAmB,wBAAwB,GAAG,CAAC;CAG3F,OAAO;AACT;AAWA,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,KAAK,MAAM,GACxE,MAAM,OAAO,aAAa,WAAW,mBAAmB,gCAAgC,GAAG,CAAC;CAG9F,OAAO;AACT;AA6BA,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,WAAW,KAAK,GAAG,GACjD,MAAM,OAAO,aAAa,WAAW,mBAAmB,6BAA6B,GAAG,CAAC;CAG3F,OAAO,IAAI,YAAY;AACzB;AAUA,SAAgB,eAAe,KAA4B;CACzD,IAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAC5C,MAAM,OAAO,aAAa,SAAS,4BAA4B;CAGjE,OAAO;AACT;AAEA,SAAgB,WAAW,KAAwB;CACjD,IAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAC5C,MAAM,OAAO,aAAa,YAAY,4BAA4B;CAGpE,OAAO;AACT;AAEA,SAAS,sBAAsB,KAAc,OAAuB;CAClE,IAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAC5C,MAAM,OAAO,aAAa,OAAO,4BAA4B;CAG/D,OAAO;AACT;AAEA,SAAS,6BAA6B,KAAc,OAAsC;CACxF,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,cAAc,GAAG,KAAK,MAAM,GACjE,MAAM,OAAO,aACX,OACA,mBAAmB,uCAAuC,GAAG,CAC/D;AAEJ;AAEA,SAAS,uBAAuB,KAA4B;CAC1D,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,OAAO;CACT;CAEA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UACrD,OAAO;CAGT,IAAI,OAAO,SAAS,SAAS,GAAG,GAC9B,OAAO;CAGT,OAAO,OAAO;AAChB;AAEA,SAAS,mBAAmB,QAAgB,KAAsB;CAChE,IAAI,OAAO,QAAQ,UACjB,OAAO,GAAG,OAAO,IAAI,IAAI,MAAM,GAAG,EAAE;CAGtC,OAAO,GAAG,OAAO,IAAI,OAAO,GAAG;AACjC;;;AC/cA,IAAa,iBAAb,cAAoC,KAAK,YAAY,gBAAgB,EAGlE,CAAC;AAEJ,IAAa,mBAAb,cAAsC,QAAQ,IAAI,iCAAiC,EAGjF,EAAE,CAAC;;;ACtCL,SAAgB,iBAAiB,KAAkC;CACjE,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;CACpD,MAAM,YAAY;CAOlB,IAAI;EACF,OAAO;GACL,YAAY,aAAa,UAAU,UAAU;GAC7C,OAAO,QAAQ,UAAU,KAAK;GAC9B,OAAO,eAAe,UAAU,KAAK;GACrC,WAAW,UAAU,UAAU,SAAS;EAC1C;CACF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAgB,eAAe,KAAgC;CAC7D,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;CACpD,MAAM,YAAY;CAKlB,IAAI;EACF,OAAO;GACL,OAAO,WAAW,UAAU,KAAK;GACjC,iBAAiB,eAAe,UAAU,eAAe;EAC3D;CACF,QAAQ;EACN,OAAO;CACT;AACF;;;AC/BA,MAAM,cAAc;AACpB,MAAM,UAAU;AAEhB,IAAa,0BAAb,MAA8D;CAC5D;CAEA,YAAY,SAA8B;EACxC,KAAK,UAAU;CACjB;CAEA,aAAsB,aAAa,oBAAoB;EACrD,MAAM,MAAM,KAAK,QAAQ,QAAQ,WAAW;EAC5C,IAAI,QAAQ,MAAM,OAAO;EACzB,IAAI;GACF,OAAO,iBAAiB,KAAK,MAAM,GAAG,CAAC;EACzC,QAAQ;GACN,OAAO;EACT;CACF,CAAC;CAED,cAAuB,YACrB,aAAa,oBAAoB;EAC/B,KAAK,QAAQ,QAAQ,aAAa,KAAK,UAAU,OAAO,CAAC;CAC3D,CAAC;CAEH,eAAwB,aAAa,sBAAsB;EACzD,KAAK,QAAQ,WAAW,WAAW;CACrC,CAAC;CAED,SAAkB,aAAa,gBAAgB;EAC7C,MAAM,MAAM,KAAK,QAAQ,QAAQ,OAAO;EACxC,IAAI,QAAQ,MAAM,OAAO;EACzB,IAAI;GACF,OAAO,eAAe,KAAK,MAAM,GAAG,CAAC;EACvC,QAAQ;GACN,OAAO;EACT;CACF,CAAC;CAED,UAAmB,QACjB,aAAa,gBAAgB;EAC3B,KAAK,QAAQ,QAAQ,SAAS,KAAK,UAAU,GAAG,CAAC;CACnD,CAAC;CAEH,WAAoB,aAAa,kBAAkB;EACjD,KAAK,QAAQ,WAAW,OAAO;CACjC,CAAC;AACH;AAaA,SAAS,iBAAiB,WAAmB,OAAgC;CAC3E,OAAO,IAAI,eAAe;EAAE;EAAW;CAAM,CAAC;AAChD;AAEA,SAAS,aAAgB,WAAmB,KAAgD;CAC1F,OAAO,OAAO,IAAI;EAChB,KAAK;EACL,QAAQ,UAAU,iBAAiB,WAAW,KAAK;CACrD,CAAC;AACH;;;AC5EA,IAAa,2BAAb,MAA+D;CAC7D,UAAsC;CACtC,MAAgC;CAEhC,aAAsB,OAAO,WAAW,KAAK,OAAO;CAEpD,cAAuB,YACrB,OAAO,WAAW;EAChB,KAAK,UAAU;CACjB,CAAC;CAEH,eAAwB,OAAO,WAAW;EACxC,KAAK,UAAU;CACjB,CAAC;CAED,SAAkB,OAAO,WAAW,KAAK,GAAG;CAE5C,UAAmB,QACjB,OAAO,WAAW;EAChB,KAAK,MAAM;CACb,CAAC;CAEH,WAAoB,OAAO,WAAW;EACpC,KAAK,MAAM;CACb,CAAC;AACH;AAEsC,MAAM,OAC1C,kBACA,OAAO,WAAW,IAAI,yBAAyB,CAAC,EAAE,KAChD,OAAO,UAAU,UAAU,IAAI,eAAe;CAAE,WAAW;CAAc;AAAM,CAAC,CAAC,CACnF,CACF"}
+{"version":3,"file":"InMemoryAuthCacheAdapter-CHYpYyk5.mjs","names":[],"sources":["../../errors/src/errors.ts","../../errors/src/convex-error-decoding.ts","../../types/src/index.ts","../src/ports/auth-cache.ts","../src/adapters/auth-cache/serialization.ts","../src/adapters/auth-cache/BrowserAuthCacheAdapter.ts","../src/adapters/auth-cache/InMemoryAuthCacheAdapter.ts"],"sourcesContent":["// The canonical error-code catalog as a runtime constant. `CapxulErrorCode`\n// is derived from it so the type and any runtime check that needs to\n// enumerate codes (e.g. the convex-error codec's `KNOWN_CODES`) share a\n// single source of truth — a TypeScript union alone can't be introspected\n// at runtime, which previously forced a hand-maintained duplicate.\nexport const CAPXUL_ERROR_CODES = [\n  \"NOT_AUTHENTICATED\",\n  \"EMAIL_DELIVERY_FAILED\",\n  \"PROFILE_NOT_FOUND\",\n  \"SMART_ACCOUNT_MISSING\",\n  \"PLAYER_NOT_FOUND\",\n  \"ACCOUNT_NOT_FOUND\",\n  \"PROVIDER_ERROR\",\n  \"INVALID_INPUT\",\n  \"ENV_MISSING\",\n  \"NOT_IMPLEMENTED\",\n  \"VERIFICATION_REQUIRED\",\n  \"INSUFFICIENT_BALANCE\",\n  \"INVALID_RECIPIENT\",\n  \"ROLE_PERMISSION_DENIED\",\n  \"TRANSACTION_FAILED\",\n  \"RATE_LIMITED\",\n  \"NETWORK_ERROR\",\n  \"UNKNOWN\",\n  \"OTP_EXPIRED\",\n  \"SIGNER_REJECTED\",\n  \"CANCELLED\",\n  \"WRONG_STATE\",\n] as const;\n\nexport type CapxulErrorCode = (typeof CAPXUL_ERROR_CODES)[number];\n\n/**\n * The error codes that represent an expected product outcome rather than a\n * defect. The SDK and backend observation boundaries both classify failures\n * against this set to route expected outcomes to their own PostHog event\n * stream; keeping the single copy here (adjacent to `CAPXUL_ERROR_CODES`, so a\n * code rename forces this set to move with it) stops the two sides of the wire\n * from drifting and silently splitting one outcome across two streams.\n */\nexport const EXPECTED_OPERATION_OUTCOMES: ReadonlySet<CapxulErrorCode> = new Set([\n  \"INVALID_INPUT\",\n  \"NOT_AUTHENTICATED\",\n  // A user with no Safe yet — the normal post-OTP / pre-provision state. Reading\n  // the account, current user, or balance in that window is an expected outcome,\n  // not a defect, so both observation boundaries route it to their\n  // `*_expected_outcome` stream instead of an unexpected `$exception` (#1031).\n  \"SMART_ACCOUNT_MISSING\",\n  \"CANCELLED\",\n  \"SIGNER_REJECTED\",\n  \"VERIFICATION_REQUIRED\",\n  \"INSUFFICIENT_BALANCE\",\n  \"INVALID_RECIPIENT\",\n  \"ROLE_PERMISSION_DENIED\",\n  \"RATE_LIMITED\",\n  \"OTP_EXPIRED\",\n  \"WRONG_STATE\",\n]);\n\n/**\n * Why an auth/provider call failed — a flat CAUSE enum. The *where* (which\n * OpenFort operation) stays in the separate `operation` detail field; this\n * names the root cause so a single `$exception` can be triaged without\n * parsing the message. Five members, no free strings:\n *\n * - `auth-origin-mismatch`: OTP cookies live on `localhost:PORT` but OpenFort\n *   hits the Convex host → no session reaches the provider.\n * - `stale-openfort-cache`: an old `userId` in scoped storage makes the SDK\n *   skip re-auth → 401 on `v2/accounts`.\n * - `app-env-allowlist`: the selected app/deployment origin is not allowlisted\n *   → 401.\n * - `no-secure-context`: sandboxed/headless browser with no Web Crypto, so\n *   `getAddress`/`configure` can never produce an address. Previously vanished\n *   into `unknown`; the signer's secure-context probe now names it.\n * - `unknown`: catch-all when no cause could be determined.\n */\nexport type FailureMode =\n  | \"auth-origin-mismatch\"\n  | \"stale-openfort-cache\"\n  | \"app-env-allowlist\"\n  | \"no-secure-context\"\n  | \"unknown\";\n\nexport type CapxulErrorDetails = Record<string, unknown>;\n\nexport type SignerSource = \"openfort-embedded\" | \"injected-eip1193\" | \"local-private-key\";\n\nexport type VerificationRequiredDetails =\n  | { readonly requiredTier: number }\n  | { readonly rail: string; readonly currentKind: string };\n\nexport type SerializedCapxulError = {\n  readonly code: CapxulErrorCode;\n  readonly message: string;\n  readonly details?: CapxulErrorDetails;\n  readonly correlationId?: string;\n  readonly layer?: string;\n};\n\nexport type CapxulErrorOptions = {\n  readonly cause?: unknown;\n  readonly details?: CapxulErrorDetails;\n  readonly correlationId?: string;\n  readonly layer?: string;\n};\n\nexport class CapxulError extends Error {\n  readonly code: CapxulErrorCode;\n  readonly details?: CapxulErrorDetails;\n  readonly correlationId?: string;\n  readonly layer?: string;\n\n  constructor(code: CapxulErrorCode, message: string, options: CapxulErrorOptions = {}) {\n    super(message, \"cause\" in options ? { cause: options.cause } : undefined);\n    this.name = \"CapxulError\";\n    this.code = code;\n    if (options.details !== undefined) {\n      this.details = options.details;\n    }\n    if (options.correlationId !== undefined) {\n      this.correlationId = options.correlationId;\n    }\n    if (options.layer !== undefined) {\n      this.layer = options.layer;\n    }\n  }\n}\n\nexport function isCapxulError(value: unknown): value is CapxulError {\n  return value instanceof CapxulError;\n}\n\nexport function serializeCapxulError(error: CapxulError): SerializedCapxulError {\n  return compactSerialized({\n    code: error.code,\n    message: error.message,\n    details: error.details,\n    correlationId: error.correlationId,\n    layer: error.layer,\n  });\n}\n\nexport function deserializeCapxulError(serialized: SerializedCapxulError): CapxulError {\n  return new CapxulError(\n    serialized.code,\n    serialized.message,\n    compactErrorOptions({\n      details: serialized.details,\n      correlationId: serialized.correlationId,\n      layer: serialized.layer,\n    }),\n  );\n}\n\nfunction compactSerialized(serialized: {\n  readonly code: CapxulErrorCode;\n  readonly message: string;\n  readonly details: CapxulErrorDetails | undefined;\n  readonly correlationId: string | undefined;\n  readonly layer: string | undefined;\n}): SerializedCapxulError {\n  const result: {\n    code: CapxulErrorCode;\n    message: string;\n    details?: CapxulErrorDetails;\n    correlationId?: string;\n    layer?: string;\n  } = {\n    code: serialized.code,\n    message: serialized.message,\n  };\n\n  if (serialized.details !== undefined) {\n    result.details = serialized.details;\n  }\n  if (serialized.correlationId !== undefined) {\n    result.correlationId = serialized.correlationId;\n  }\n  if (serialized.layer !== undefined) {\n    result.layer = serialized.layer;\n  }\n\n  return result;\n}\n\nfunction compactErrorOptions(options: {\n  readonly cause?: unknown;\n  readonly details: CapxulErrorDetails | undefined;\n  readonly correlationId: string | undefined;\n  readonly layer: string | undefined;\n}): CapxulErrorOptions {\n  const result: {\n    cause?: unknown;\n    details?: CapxulErrorDetails;\n    correlationId?: string;\n    layer?: string;\n  } = {};\n\n  if (\"cause\" in options) {\n    result.cause = options.cause;\n  }\n  if (options.details !== undefined) {\n    result.details = options.details;\n  }\n  if (options.correlationId !== undefined) {\n    result.correlationId = options.correlationId;\n  }\n  if (options.layer !== undefined) {\n    result.layer = options.layer;\n  }\n\n  return result;\n}\n\nexport const Errors = {\n  notAuthenticated: (message?: string, opts?: { readonly failure_mode?: FailureMode }) =>\n    new CapxulError(\n      \"NOT_AUTHENTICATED\",\n      message ?? \"Not authenticated\",\n      opts?.failure_mode ? { details: { failure_mode: opts.failure_mode } } : undefined,\n    ),\n  emailDeliveryFailed: (detail: string) =>\n    new CapxulError(\"EMAIL_DELIVERY_FAILED\", \"Failed to send email\", {\n      details: { detail },\n    }),\n\n  profileNotFound: (authUserId: string) =>\n    new CapxulError(\"PROFILE_NOT_FOUND\", `Profile not found for user ${authUserId}`, {\n      details: { authUserId },\n    }),\n\n  smartAccountMissing: (authUserId: string) =>\n    new CapxulError(\"SMART_ACCOUNT_MISSING\", \"Smart account not provisioned\", {\n      details: { authUserId },\n    }),\n\n  playerNotFound: (playerId?: string) =>\n    new CapxulError(\n      \"PLAYER_NOT_FOUND\",\n      playerId ? `Openfort player ${playerId} not found` : \"Openfort player not found\",\n      playerId === undefined ? undefined : { details: { playerId } },\n    ),\n\n  accountNotFound: (accountId?: string) =>\n    new CapxulError(\n      \"ACCOUNT_NOT_FOUND\",\n      accountId ? `Openfort account ${accountId} not found` : \"Openfort account not found\",\n      accountId === undefined ? undefined : { details: { accountId } },\n    ),\n\n  providerError: (\n    provider: string,\n    operation: string,\n    cause: unknown,\n    opts?: { readonly failure_mode?: FailureMode },\n  ) => {\n    const details: Record<string, unknown> = { provider, operation };\n    if (opts?.failure_mode) {\n      details.failure_mode = opts.failure_mode;\n    }\n    return new CapxulError(\"PROVIDER_ERROR\", `Provider error: ${provider} ${operation}`, {\n      cause,\n      details,\n    });\n  },\n\n  invalidInput: (field: string, reason: string) =>\n    new CapxulError(\"INVALID_INPUT\", `Invalid ${field}: ${reason}`, {\n      details: { field, reason },\n    }),\n\n  envMissing: (name: string) =>\n    new CapxulError(\"ENV_MISSING\", `Environment variable ${name} not configured`, {\n      details: { name },\n    }),\n\n  notImplemented: (domain: string, method: string) =>\n    new CapxulError(\n      \"NOT_IMPLEMENTED\",\n      `${domain}.${method} is not yet implemented. This feature is planned for a future release.`,\n      { details: { domain, method } },\n    ),\n\n  /**\n   * Sibling factory to {@link Errors.providerError} for the per-state timeout\n   * path in flows (initially ProvisioningFlow's mint_openfort / deploy_safe /\n   * register_indexer `after:` timers). Same `PROVIDER_ERROR` code as\n   * `providerError`, plus a `details.reason: \"timeout\"` discriminator so\n   * downstream observers can distinguish failure modes without parsing the\n   * message string. The redacted message names the timeout budget; the\n   * native `cause` carries the same information for `reportError` fidelity.\n   */\n  providerTimeout: (provider: string, operation: string, timeoutMs: number) =>\n    new CapxulError(\n      \"PROVIDER_ERROR\",\n      `Provider error: ${provider} ${operation} (timeout exceeded ${timeoutMs}ms)`,\n      {\n        details: { provider, operation, reason: \"timeout\" },\n        cause: new Error(`timeout: ${operation} exceeded ${timeoutMs}ms`),\n      },\n    ),\n\n  verificationRequired: (details: VerificationRequiredDetails) => {\n    const message =\n      \"rail\" in details\n        ? `Verification is required before ${details.rail} can use ${details.currentKind}.`\n        : `Verification tier ${details.requiredTier} is required.`;\n\n    return new CapxulError(\"VERIFICATION_REQUIRED\", message, {\n      details,\n    });\n  },\n\n  insufficientBalance: (asset: string, available: string, required: string) =>\n    new CapxulError(\"INSUFFICIENT_BALANCE\", `Insufficient ${asset} balance`, {\n      details: { asset, available, required },\n    }),\n\n  invalidRecipient: (reason: string) =>\n    new CapxulError(\"INVALID_RECIPIENT\", `Invalid recipient: ${reason}`, {\n      details: { reason },\n    }),\n\n  /**\n   * The org Zodiac Roles modifier REFUSED the spend on-chain (G4 · #547): the\n   * member's role condition (per-tx cap, per-day allowance, allowed recipient,\n   * or membership) was violated, so `execTransactionWithRole` reverted. This is\n   * a PERMISSION denial — explicitly NOT an `INSUFFICIENT_BALANCE` (the treasury\n   * held the funds; the role's authority is what bound). `reason` discriminates\n   * the violated condition (`over_cap` / `daily_cap` / `not_member` /\n   * `disallowed_recipient` / `condition_violation`); leak-safe — no on-chain\n   * identifiers ever enter the details.\n   */\n  rolePermissionDenied: (details: {\n    readonly reason:\n      | \"over_cap\"\n      | \"daily_cap\"\n      | \"not_member\"\n      | \"disallowed_recipient\"\n      | \"condition_violation\";\n    readonly operation?: string;\n  }) =>\n    new CapxulError(\n      \"ROLE_PERMISSION_DENIED\",\n      `Org role denied this spend on-chain (${details.reason}).`,\n      {\n        details:\n          details.operation === undefined\n            ? { reason: details.reason }\n            : { reason: details.reason, operation: details.operation },\n      },\n    ),\n\n  /**\n   * A transaction (or sponsored UserOp) failed. `details.reason` discriminates\n   * the failure mode for callers that must distinguish a CONFIRMED on-chain\n   * revert (`\"onchain_revert\"` — the op executed and reverted, e.g. a Zodiac\n   * Roles condition violation) from an inconclusive infra failure. A confirmed\n   * revert is the ONLY mode the org spend port may map to a roles denial.\n   */\n  transactionFailed: (operation: string, cause?: unknown, extra?: { readonly reason?: string }) =>\n    new CapxulError(\"TRANSACTION_FAILED\", `Transaction failed: ${operation}`, {\n      cause,\n      details: extra?.reason === undefined ? { operation } : { operation, reason: extra.reason },\n    }),\n\n  rateLimited: (details?: { readonly retryAfterMs?: number; readonly resource?: string }) =>\n    new CapxulError(\n      \"RATE_LIMITED\",\n      \"Rate limit exceeded\",\n      details === undefined ? undefined : { details: { ...details } },\n    ),\n\n  networkError: (operation: string, cause?: unknown) =>\n    new CapxulError(\"NETWORK_ERROR\", `Network error during ${operation}`, {\n      cause,\n      details: { operation },\n    }),\n\n  unknown: (cause?: unknown) => new CapxulError(\"UNKNOWN\", \"Unknown error\", { cause }),\n\n  otpExpired: (details?: { readonly email?: string; readonly expiredAt?: number }) =>\n    new CapxulError(\n      \"OTP_EXPIRED\",\n      \"Verification code has expired. Request a new one.\",\n      details === undefined ? undefined : { details: { ...details } },\n    ),\n\n  signerRejected: (details: {\n    readonly source: SignerSource;\n    readonly reason?: string;\n    readonly cause?: unknown;\n  }) =>\n    new CapxulError(\"SIGNER_REJECTED\", \"Signer rejected the request.\", {\n      cause: details.cause,\n      details:\n        details.reason === undefined\n          ? { source: details.source }\n          : { source: details.source, reason: details.reason },\n    }),\n\n  cancelled: (details?: { readonly operation?: string; readonly reason?: string }) =>\n    new CapxulError(\n      \"CANCELLED\",\n      \"Operation was cancelled.\",\n      details === undefined ? undefined : { details: { ...details } },\n    ),\n\n  /**\n   * Method called from a flow state where its precondition fails (TA16). The\n   * SDK's method API short-circuits with this error before driving the\n   * internal state machine. `currentState` is the Effect-machine snapshot\n   * tag (stringified — substrate is `@effect/experimental/Machine`; see\n   * `packages/errors/CONTEXT.md`); `validStates`\n   * enumerates the states the method accepts.\n   */\n  wrongState: (details: {\n    readonly method: string;\n    readonly currentState: string;\n    readonly validStates: readonly string[];\n  }) =>\n    new CapxulError(\n      \"WRONG_STATE\",\n      `${details.method} called from state '${details.currentState}'; valid states: ${details.validStates.join(\", \")}`,\n      { details: { ...details, validStates: [...details.validStates] } },\n    ),\n} as const;\n","// Shared `decodeConvexError` helper (TA5) — used by both the SDK's\n// `ConvexCallAdapter.mapToCapxulError` AND the backend `credentials/http.ts`\n// `bootstrapClient` handler. Single source of truth for cross-Convex-boundary\n// error decoding rules.\n//\n// Recognizes the `ConvexError(SerializedCapxulError)` object-shape produced by\n// `withErrorBoundary` (Probe B finding, 2026-05-19):\n//\n//   { name: \"ConvexError\", data: { code, message, details?, correlationId?, layer? } }\n//\n// AND the defensive string-shape branch for older Convex versions where\n// `data` is a JSON-serialized string. Pass-through for raw `CapxulError`\n// instances (which arrive directly when the throw happened in the same\n// V8 isolate as the catch). Returns null when the value is not a\n// recognizable shape — the caller falls back to NETWORK_ERROR + reportError.\n\nimport {\n  CAPXUL_ERROR_CODES,\n  CapxulError,\n  type CapxulErrorCode,\n  type SerializedCapxulError,\n  deserializeCapxulError,\n} from \"./errors.ts\";\n\n// Derived from the canonical catalog in errors.ts — single source of truth,\n// so a new code added to `CAPXUL_ERROR_CODES` is recognized here automatically.\nconst KNOWN_CODES: ReadonlySet<CapxulErrorCode> = new Set(CAPXUL_ERROR_CODES);\n\nfunction isCapxulCode(value: unknown): value is CapxulErrorCode {\n  return typeof value === \"string\" && KNOWN_CODES.has(value as CapxulErrorCode);\n}\n\nfunction reconstruct(serialized: Record<string, unknown>): CapxulError | null {\n  if (!isCapxulCode(serialized.code)) return null;\n  const payload: SerializedCapxulError = {\n    code: serialized.code,\n    message: typeof serialized.message === \"string\" ? serialized.message : String(serialized.code),\n    ...(typeof serialized.details === \"object\" &&\n    serialized.details !== null &&\n    !Array.isArray(serialized.details)\n      ? { details: serialized.details as Record<string, unknown> }\n      : {}),\n    ...(typeof serialized.correlationId === \"string\"\n      ? { correlationId: serialized.correlationId }\n      : {}),\n    ...(typeof serialized.layer === \"string\" ? { layer: serialized.layer } : {}),\n  };\n  return deserializeCapxulError(payload);\n}\n\nexport function decodeConvexError(err: unknown): CapxulError | null {\n  if (err === null || err === undefined) return null;\n\n  // Pass-through: same isolate, real CapxulError instance.\n  if (err instanceof CapxulError) return err;\n\n  if (typeof err !== \"object\") return null;\n\n  // The canonical shape produced by `withErrorBoundary` then crossed by\n  // Convex's `ctx.runQuery` / `ConvexHttpClient`: a `ConvexError` whose\n  // `data` is the `SerializedCapxulError` object literal.\n  const record = err as Record<string, unknown>;\n  if (!(\"data\" in record)) return null;\n  const data = record.data;\n\n  if (typeof data === \"object\" && data !== null) {\n    return reconstruct(data as Record<string, unknown>);\n  }\n\n  // Defensive depth — some Convex versions JSON-stringify the data at\n  // the runtime boundary. Probe B confirmed @convex-dev/better-auth 0.10.13\n  // + convex 1.39.x do NOT do this, but the cheap parse keeps forward\n  // compatibility.\n  if (typeof data === \"string\") {\n    try {\n      const parsed = JSON.parse(data) as unknown;\n      if (typeof parsed === \"object\" && parsed !== null) {\n        return reconstruct(parsed as Record<string, unknown>);\n      }\n    } catch {\n      // Fall through.\n    }\n  }\n\n  return null;\n}\n","import { Errors } from \"@capxul/errors\";\nimport type { Brand } from \"./brand\";\n\nexport type { Brand } from \"./brand\";\n\nexport type Address = Brand<string, \"Address\">;\nexport type Email = Brand<string, \"Email\">;\nexport type Identity = Brand<string, \"Identity\">;\n// `Profile` is the SDK's user-shaped record returned by `IdentityPort`. Pure\n// record of brand-typed fields — not itself a brand. The field-level brands\n// satisfy `IdentityPort` clause I8 at compile time. Hosted here per the\n// package contract (`packages/types/CONTEXT.md`).\nexport type Profile = {\n  readonly authUserId: AuthUserId;\n  readonly email: Email;\n  readonly displayName: string | null;\n  readonly country: CountryCode | null;\n  readonly onboarded: boolean;\n  readonly withdrawalAddress: Address | null;\n  // #1062: globally-unique normalized handle; #1061 / ADR-0014: profile-image\n  // serving URL resolved at read time. Plain strings (not branded in this\n  // slice); null when unset — the Convex read boundary always maps both.\n  readonly username: string | null;\n  readonly imageUrl: string | null;\n  readonly kycTier: KycTier;\n  readonly createdAt: EpochMs;\n  readonly updatedAt: EpochMs;\n};\n// `SmartAccount` is the SDK's ERC-4337 record returned by `SmartAccountPort`.\n// Pure record of brand-typed fields — not itself a brand. `deployedAt` is\n// nullable: `null` means the address is counterfactual (derived, not yet\n// on-chain). PRD #462 (derivation v2): `signerAddress` is the CLAIMED owner —\n// `null` until the claim userOp installs the user's signer (`claimedAt`\n// records that event); the address derives from the email alone. Hosted here\n// per the package contract (`packages/types/CONTEXT.md`).\nexport type SmartAccount = {\n  readonly authUserId: AuthUserId;\n  readonly signerAddress: Address | null;\n  readonly smartAccountAddress: Address;\n  readonly chainId: ChainId;\n  readonly deployedAt: EpochMs | null;\n  readonly claimedAt: EpochMs | null;\n  readonly createdAt: EpochMs;\n};\n// `Money` is the SDK's consumer-facing value type (canon\n// `account-balance-model.md` §10). Every public monetary value is a `Money`\n// — never wei, never raw token units. `value` is a major-unit decimal string\n// (e.g. \"1.5\" USD); `decimals` is the on-chain token precision used for the\n// internal `fromWei`/`toWei` round-trip at the SDK boundary (USDX is 6).\n// Pure record of a brand-typed field + primitives — not itself a brand.\nexport type Money = {\n  readonly currency: CurrencyCode;\n  readonly value: string;\n  readonly decimals: number;\n};\n\n// `Account` is the SDK's logical money account (canon §6, §9). `id` is the\n// `account_`-shaped `AccountId` — NOT the Safe address and NOT an Openfort id.\n// `balance` is the Safe's top-line holdings; `available` is money not assigned\n// to any sub-account (canon §5/§12). With no sub-accounts (Slice 1a),\n// `available === balance`. Pure record of brand-typed fields — not a brand.\nexport type Account = {\n  readonly id: AccountId;\n  readonly balance: Money;\n  readonly available: Money;\n};\n\n/** Named bucket partitioning a logical Account (canon §9). */\nexport type SubAccount = {\n  readonly id: SubAccountId;\n  readonly accountId: AccountId;\n  readonly name: string;\n  readonly balance: Money;\n  readonly createdAt: EpochMs;\n};\n\nexport type AuthUserId = Brand<string, \"AuthUserId\">;\nexport type AnonymousDistinctId = Brand<string, \"AnonymousDistinctId\">;\nexport type PlayerId = Brand<string, \"PlayerId\">;\nexport type AccountId = Brand<string, \"AccountId\">;\nexport type SubAccountId = Brand<string, \"SubAccountId\">;\nexport type OrgId = Brand<string, \"OrgId\">;\nexport type AppId = Brand<string, \"AppId\">;\nexport type AllowedOrigin = Brand<string, \"AllowedOrigin\">;\nexport type PublishableKey = Brand<string, \"PublishableKey\">;\nexport type PublishableKeyId = Brand<string, \"PublishableKeyId\">;\nexport type DurationMs = Brand<number, \"DurationMs\">;\n// `DeveloperApplication` and `PublishableKeyRecord` are the SDK's record\n// shapes returned by `CredentialsPort`. Pure records of brand-typed fields\n// — not themselves brands. The field-level brands satisfy CR13 + the record\n// branding clauses of `credentials.test-d.ts` at compile time. Hosted here\n// per the package contract (`packages/types/CONTEXT.md`).\nexport type DeveloperApplication = {\n  readonly id: AppId;\n  readonly authUserId: AuthUserId;\n  readonly name: string;\n  readonly allowedOrigins: readonly AllowedOrigin[];\n  readonly createdAt: EpochMs;\n  readonly archivedAt: EpochMs | null;\n};\nexport type PublishableKeyRecord = {\n  readonly id: PublishableKeyId;\n  readonly applicationId: AppId;\n  readonly activeFromMs: EpochMs;\n  readonly gracePeriodEndsMs: EpochMs | null;\n  readonly revokedAt: EpochMs | null;\n};\nexport type TxHash = Brand<string, \"TxHash\">;\nexport type DocumentHash = Brand<string, \"DocumentHash\">;\nexport type EpochMs = Brand<number, \"EpochMs\">;\nexport type EpochSeconds = Brand<number, \"EpochSeconds\">;\nexport type ChainId = Brand<number, \"ChainId\">;\nexport type CountryCode = Brand<string, \"CountryCode\">;\nexport type CurrencyCode = Brand<SupportedCurrencyCode, \"CurrencyCode\">;\nexport type KycTier = Brand<0 | 1 | 2 | 3, \"KycTier\">;\nexport type BlockNumber = Brand<number, \"BlockNumber\">;\nexport type LogIndex = Brand<number, \"LogIndex\">;\nexport type WeiAmount = Brand<string, \"WeiAmount\">;\nexport type SafeAddress = Brand<string, \"SafeAddress\">;\nexport type ModuleAddress = Brand<string, \"ModuleAddress\">;\nexport type RunId = Brand<string, \"RunId\">;\nexport type RoleKey = Brand<string, \"RoleKey\">;\nexport type AllowanceKey = Brand<string, \"AllowanceKey\">;\nexport type SessionToken = Brand<string, \"SessionToken\">;\nexport type JwtToken = Brand<string, \"JwtToken\">;\n\n// `AuthSession` is the record type shared by `AuthClientPort` and\n// `SessionStoragePort`. Hosted here per the canon\n// (`packages/types/CONTEXT.md`) so both ports depend on it\n// symmetrically. Every field is branded — field-level brands satisfy the\n// AuthSession branding contract asserted in `auth-client.test-d.ts`.\nexport type AuthSession = {\n  readonly authUserId: AuthUserId;\n  readonly email: Email;\n  readonly token: SessionToken;\n  readonly expiresAt: EpochMs;\n};\n\nexport const EVM_ADDRESS_RE = /^0x[0-9a-f]{40}$/i;\nexport const BYTES32_RE = /^0x[0-9a-f]{64}$/i;\nexport const PUBLISHABLE_KEY_PATTERN = /^cap_pk_(test|live)_[0-9A-HJKMNP-TV-Z]{32}$/;\nexport const SUPPORTED_CURRENCIES = [\n  { code: \"USD\", symbol: \"$\", name: \"US Dollar\" },\n  { code: \"NGN\", symbol: \"NGN\", name: \"Nigerian Naira\" },\n  { code: \"GHS\", symbol: \"GHS\", name: \"Ghanaian Cedi\" },\n  { code: \"KES\", symbol: \"KSh\", name: \"Kenyan Shilling\" },\n  { code: \"UGX\", symbol: \"USh\", name: \"Ugandan Shilling\" },\n] as const;\nexport const SUPPORTED_CURRENCY_CODES = SUPPORTED_CURRENCIES.map((currency) => currency.code);\ntype SupportedCurrencyCode = (typeof SUPPORTED_CURRENCIES)[number][\"code\"];\nexport const CURRENCY_SYMBOLS = Object.fromEntries(\n  SUPPORTED_CURRENCIES.map((currency) => [currency.code, currency.symbol]),\n) as Record<SupportedCurrencyCode, string>;\n\nconst EMAIL_RE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\nconst COUNTRY_CODE_RE = /^[A-Z]{2}$/;\nconst ANONYMOUS_DISTINCT_ID_RE = /^anon_[a-zA-Z0-9-]+$/;\n// Canon §6: the logical Account brand is `account_`-shaped. The tail mirrors\n// the `app_` ULID-shape generator (`account_<26 Crockford base32 chars>`) but\n// the brand only enforces the `account_` prefix + a non-empty alphanumeric\n// tail so existing opaque test ids (`account_123`) and generated ULIDs both\n// satisfy it.\nconst ACCOUNT_ID_RE = /^account_[0-9A-Za-z]+$/;\nconst SUBACCOUNT_ID_RE = /^subaccount_[0-9A-Za-z]+$/;\n// Exported so `@capxul/wire`'s `AppIdSchema` can reuse the same regex via\n// `Schema.filter(...)` and stay in lockstep with `toAppId` (Decision 2,\n// 2b parity).\nexport const APP_ID_RE = /^app_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;\nconst TX_HASH_RE = /^0x[0-9a-f]{64}$/i;\nconst DOCUMENT_HASH_HEX_RE = /^[0-9a-fA-F]{64}$/;\nconst WEI_RE = /^[0-9]+$/;\nconst RUN_ID_RE = /^run_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;\nconst MAX_SAFE_EPOCH_SECONDS = Math.floor(Number.MAX_SAFE_INTEGER / 1000);\n\nexport function toAddress(raw: unknown): Address {\n  if (typeof raw !== \"string\" || !EVM_ADDRESS_RE.test(raw)) {\n    throw Errors.invalidInput(\"address\", invalidValueReason(\"invalid EVM address format\", raw));\n  }\n\n  return raw.toLowerCase() as Address;\n}\n\nexport function isEvmAddress(raw: unknown): raw is string {\n  return typeof raw === \"string\" && EVM_ADDRESS_RE.test(raw);\n}\n\nexport function toEmail(raw: unknown): Email {\n  if (typeof raw !== \"string\" || !EMAIL_RE.test(raw)) {\n    throw Errors.invalidInput(\"email\", invalidValueReason(\"must look like an email address\", raw));\n  }\n\n  return raw.toLowerCase() as Email;\n}\n\nexport function toIdentity(raw: unknown): Identity {\n  return toNonEmptyStringBrand(raw, \"identity\") as Identity;\n}\n\nexport function toAuthUserId(raw: unknown): AuthUserId {\n  return toNonEmptyStringBrand(raw, \"authUserId\") as AuthUserId;\n}\n\nexport function toAnonymousDistinctId(raw: unknown): AnonymousDistinctId {\n  if (typeof raw !== \"string\" || !ANONYMOUS_DISTINCT_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"anonDistinctId\",\n      invalidValueReason(\"must be anon_ plus letters, digits, or hyphens\", raw),\n    );\n  }\n\n  return raw as AnonymousDistinctId;\n}\n\nexport function toPlayerId(raw: unknown): PlayerId {\n  return toNonEmptyStringBrand(raw, \"playerId\") as PlayerId;\n}\n\nexport function toAccountId(raw: unknown): AccountId {\n  if (typeof raw !== \"string\" || !ACCOUNT_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"accountId\",\n      invalidValueReason(\"must be account_ plus an alphanumeric id\", raw),\n    );\n  }\n\n  return raw as AccountId;\n}\n\nexport function toSubAccountId(raw: unknown): SubAccountId {\n  if (typeof raw !== \"string\" || !SUBACCOUNT_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"subAccountId\",\n      invalidValueReason(\"must be subaccount_ plus an alphanumeric id\", raw),\n    );\n  }\n\n  return raw as SubAccountId;\n}\n\nexport function toOrgId(raw: unknown): OrgId {\n  return toNonEmptyStringBrand(raw, \"orgId\") as OrgId;\n}\n\nexport function toAppId(raw: unknown): AppId {\n  if (typeof raw !== \"string\" || !APP_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\"appId\", invalidValueReason(\"must be app_ plus a ULID\", raw));\n  }\n\n  return raw as AppId;\n}\n\nexport function toAllowedOrigin(raw: unknown): AllowedOrigin {\n  if (typeof raw !== \"string\") {\n    throw Errors.invalidInput(\"allowedOrigin\", \"must be an http or https origin string\");\n  }\n\n  const normalized = normalizeAllowedOrigin(raw);\n  if (normalized === null) {\n    throw Errors.invalidInput(\n      \"allowedOrigin\",\n      invalidValueReason(\"must be an http or https origin\", raw),\n    );\n  }\n\n  return normalized as AllowedOrigin;\n}\n\nexport function toPublishableKeyId(raw: unknown): PublishableKeyId {\n  return toNonEmptyStringBrand(raw, \"keyId\") as PublishableKeyId;\n}\n\nexport function toDurationMs(raw: unknown): DurationMs {\n  if (typeof raw !== \"number\" || !Number.isSafeInteger(raw) || raw < 0) {\n    throw Errors.invalidInput(\n      \"duration\",\n      invalidValueReason(\"must be a non-negative safe integer\", raw),\n    );\n  }\n\n  return raw as DurationMs;\n}\n\nexport function toPublishableKey(raw: unknown): PublishableKey {\n  if (typeof raw !== \"string\" || !PUBLISHABLE_KEY_PATTERN.test(raw)) {\n    throw Errors.invalidInput(\n      \"publishableKey\",\n      invalidValueReason(\"must match cap_pk_(test|live) plus 32 Crockford base32 chars\", raw),\n    );\n  }\n\n  return raw as PublishableKey;\n}\n\nexport function toTxHash(raw: unknown): TxHash {\n  if (typeof raw !== \"string\" || !TX_HASH_RE.test(raw)) {\n    throw Errors.invalidInput(\"txHash\", invalidValueReason(\"must be 0x + 64 hex chars\", raw));\n  }\n\n  return raw.toLowerCase() as TxHash;\n}\n\nexport function toDocumentHash(raw: unknown): DocumentHash {\n  if (typeof raw !== \"string\") {\n    throw Errors.invalidInput(\"documentHash\", \"must be a string\");\n  }\n\n  const stripped = raw.startsWith(\"0x\") || raw.startsWith(\"0X\") ? raw.slice(2) : raw;\n  if (!DOCUMENT_HASH_HEX_RE.test(stripped)) {\n    throw Errors.invalidInput(\"documentHash\", \"must be 32 bytes of hex\");\n  }\n\n  return `0x${stripped.toLowerCase()}` as DocumentHash;\n}\n\nexport function toEpochMs(raw: unknown): EpochMs {\n  assertSafeNonNegativeInteger(raw, \"epochMs\");\n  return raw as EpochMs;\n}\n\nexport function toEpochSeconds(raw: unknown): EpochSeconds {\n  assertSafeNonNegativeInteger(raw, \"epochSeconds\");\n  return raw as EpochSeconds;\n}\n\nexport function secondsToMs(seconds: EpochSeconds): EpochMs {\n  if (seconds > MAX_SAFE_EPOCH_SECONDS) {\n    throw Errors.invalidInput(\"epochSeconds\", `${seconds} would overflow when multiplied by 1000`);\n  }\n\n  return toEpochMs(seconds * 1000);\n}\n\nexport function epochMsToSeconds(ms: EpochMs): EpochSeconds {\n  return toEpochSeconds(Math.floor(ms / 1000));\n}\n\nexport function toChainId(raw: unknown): ChainId {\n  if (typeof raw !== \"number\" || !Number.isSafeInteger(raw) || raw <= 0) {\n    throw Errors.invalidInput(\n      \"chainId\",\n      invalidValueReason(\"must be a positive safe integer\", raw),\n    );\n  }\n\n  return raw as ChainId;\n}\n\nexport function toBlockNumber(raw: unknown): BlockNumber {\n  assertSafeNonNegativeInteger(raw, \"blockNumber\");\n  return raw as BlockNumber;\n}\n\nexport function toLogIndex(raw: unknown): LogIndex {\n  assertSafeNonNegativeInteger(raw, \"logIndex\");\n  return raw as LogIndex;\n}\n\nexport function toWeiAmount(raw: unknown): WeiAmount {\n  if (typeof raw !== \"string\" || !WEI_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"weiAmount\",\n      invalidValueReason(\"must be a non-negative integer string\", raw),\n    );\n  }\n\n  return raw as WeiAmount;\n}\n\nexport function toCountryCode(raw: unknown): CountryCode {\n  if (typeof raw !== \"string\") {\n    throw Errors.invalidInput(\"countryCode\", \"must be a string\");\n  }\n\n  const upper = raw.toUpperCase();\n  if (!COUNTRY_CODE_RE.test(upper)) {\n    throw Errors.invalidInput(\n      \"countryCode\",\n      invalidValueReason(\"must be a 2-letter ISO 3166-1 alpha-2 code\", raw),\n    );\n  }\n\n  return upper as CountryCode;\n}\n\nexport function toCurrencyCode(raw: unknown): CurrencyCode {\n  if (typeof raw !== \"string\" || !SUPPORTED_CURRENCY_CODES.includes(raw as SupportedCurrencyCode)) {\n    throw Errors.invalidInput(\"currencyCode\", invalidValueReason(\"unsupported currency\", raw));\n  }\n\n  return raw as CurrencyCode;\n}\n\nexport function currencySymbolFor(code: CurrencyCode): string {\n  const symbol = CURRENCY_SYMBOLS[code as SupportedCurrencyCode];\n  if (symbol === undefined) {\n    throw Errors.invalidInput(\"currencyCode\", `no symbol registered for \"${String(code)}\"`);\n  }\n\n  return symbol;\n}\n\nexport function toKycTier(raw: unknown): KycTier {\n  if (typeof raw !== \"number\" || !Number.isInteger(raw) || raw < 0 || raw > 3) {\n    throw Errors.invalidInput(\"kycTier\", invalidValueReason(\"must be an integer in [0, 3]\", raw));\n  }\n\n  return raw as KycTier;\n}\n\nexport function toSafeAddress(raw: unknown): SafeAddress {\n  if (typeof raw !== \"string\" || !EVM_ADDRESS_RE.test(raw)) {\n    throw Errors.invalidInput(\"safeAddress\", invalidValueReason(\"invalid EVM address format\", raw));\n  }\n\n  return raw.toLowerCase() as SafeAddress;\n}\n\nexport function toModuleAddress(raw: unknown): ModuleAddress {\n  if (typeof raw !== \"string\" || !EVM_ADDRESS_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"moduleAddress\",\n      invalidValueReason(\"invalid EVM address format\", raw),\n    );\n  }\n\n  return raw.toLowerCase() as ModuleAddress;\n}\n\nexport function toRunId(raw: unknown): RunId {\n  if (typeof raw !== \"string\" || !RUN_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\"runId\", \"must match the format run_<uuid>\");\n  }\n\n  return raw as RunId;\n}\n\nexport function toRoleKey(raw: unknown): RoleKey {\n  if (typeof raw !== \"string\" || !BYTES32_RE.test(raw)) {\n    throw Errors.invalidInput(\"roleKey\", invalidValueReason(\"must be 0x + 64 hex chars\", raw));\n  }\n\n  return raw.toLowerCase() as RoleKey;\n}\n\nexport function toAllowanceKey(raw: unknown): AllowanceKey {\n  if (typeof raw !== \"string\" || !BYTES32_RE.test(raw)) {\n    throw Errors.invalidInput(\"allowanceKey\", invalidValueReason(\"must be 0x + 64 hex chars\", raw));\n  }\n\n  return raw.toLowerCase() as AllowanceKey;\n}\n\nexport function toSessionToken(raw: unknown): SessionToken {\n  if (typeof raw !== \"string\" || raw.length === 0) {\n    throw Errors.invalidInput(\"token\", \"must be a non-empty string\");\n  }\n\n  return raw as SessionToken;\n}\n\nexport function toJwtToken(raw: unknown): JwtToken {\n  if (typeof raw !== \"string\" || raw.length === 0) {\n    throw Errors.invalidInput(\"jwtToken\", \"must be a non-empty string\");\n  }\n\n  return raw as JwtToken;\n}\n\nfunction toNonEmptyStringBrand(raw: unknown, field: string): string {\n  if (typeof raw !== \"string\" || raw.length === 0) {\n    throw Errors.invalidInput(field, \"must be a non-empty string\");\n  }\n\n  return raw;\n}\n\nfunction assertSafeNonNegativeInteger(raw: unknown, field: string): asserts raw is number {\n  if (typeof raw !== \"number\" || !Number.isSafeInteger(raw) || raw < 0) {\n    throw Errors.invalidInput(\n      field,\n      invalidValueReason(\"must be a non-negative safe integer\", raw),\n    );\n  }\n}\n\nfunction normalizeAllowedOrigin(raw: string): string | null {\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    return null;\n  }\n\n  if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n    return null;\n  }\n\n  if (parsed.hostname.includes(\"*\")) {\n    return null;\n  }\n\n  return parsed.origin;\n}\n\nfunction invalidValueReason(prefix: string, raw: unknown): string {\n  if (typeof raw === \"string\") {\n    return `${prefix}: ${raw.slice(0, 40)}`;\n  }\n\n  return `${prefix}: ${String(raw)}`;\n}\n","import { Context, Data, Effect } from \"effect\";\nimport type { AuthSession, EpochSeconds, JwtToken } from \"@capxul/types\";\n\n/**\n * AuthCachePort (TA4) — replaces `SessionStoragePort` in the rebuild slice's\n * consumer-facing wiring. Stores the user-snapshot Session AND the cached\n * Convex JWT (W7 bridge endpoint). The two slots are independent so a session\n * refresh doesn't invalidate the JWT and vice versa.\n *\n * Three adapters (TA7):\n *   - `BrowserAuthCacheAdapter`        — backed by `localStorage`\n *   - `FileSystemAuthCacheAdapter`     — mode-0600 JSON file in `~/.config/capxul/`\n *   - `InMemoryAuthCacheAdapter`       — for tests\n *\n * `SessionStoragePort` was retired by the Stage 4 rebuild; session and JWT\n * persistence now share this cache boundary.\n */\nexport interface AuthCachePort {\n  readonly getSession: Effect.Effect<AuthSession | null, AuthCacheError>;\n  readonly setSession: (session: AuthSession) => Effect.Effect<void, AuthCacheError>;\n  readonly clearSession: Effect.Effect<void, AuthCacheError>;\n\n  /**\n   * JWT cache for the `/api/auth/convex/token` bridge endpoint (W7).\n   * Stored separately from the session so a session refresh doesn't\n   * invalidate cached JWT.\n   */\n  readonly getJwt: Effect.Effect<CachedJwt | null, AuthCacheError>;\n  readonly setJwt: (jwt: CachedJwt) => Effect.Effect<void, AuthCacheError>;\n  readonly clearJwt: Effect.Effect<void, AuthCacheError>;\n}\n\n/**\n * Cached Convex JWT shape (TA4). `expEpochSeconds` is decoded from the JWT's\n * `exp` claim at fetch time so the `tokenProvider` cache eviction logic can\n * proactively refresh at `exp - 30s` per TA3.\n */\nexport interface CachedJwt {\n  readonly token: JwtToken;\n  readonly expEpochSeconds: EpochSeconds;\n}\n\nexport class AuthCacheError extends Data.TaggedError(\"AuthCacheError\")<{\n  readonly operation: string;\n  readonly cause: unknown;\n}> {}\n\nexport class AuthCachePortTag extends Context.Tag(\"@capxul/sdk/ports/AuthCachePort\")<\n  AuthCachePortTag,\n  AuthCachePort\n>() {}\n","import {\n  toAuthUserId,\n  toEmail,\n  toEpochMs,\n  toEpochSeconds,\n  toJwtToken,\n  toSessionToken,\n  type AuthSession,\n} from \"@capxul/types\";\n\nimport type { CachedJwt } from \"../../ports/auth-cache\";\n\nexport function parseAuthSession(raw: unknown): AuthSession | null {\n  if (typeof raw !== \"object\" || raw === null) return null;\n  const candidate = raw as {\n    readonly authUserId?: unknown;\n    readonly email?: unknown;\n    readonly token?: unknown;\n    readonly expiresAt?: unknown;\n  };\n\n  try {\n    return {\n      authUserId: toAuthUserId(candidate.authUserId),\n      email: toEmail(candidate.email),\n      token: toSessionToken(candidate.token),\n      expiresAt: toEpochMs(candidate.expiresAt),\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport function parseCachedJwt(raw: unknown): CachedJwt | null {\n  if (typeof raw !== \"object\" || raw === null) return null;\n  const candidate = raw as {\n    readonly token?: unknown;\n    readonly expEpochSeconds?: unknown;\n  };\n\n  try {\n    return {\n      token: toJwtToken(candidate.token),\n      expEpochSeconds: toEpochSeconds(candidate.expEpochSeconds),\n    };\n  } catch {\n    return null;\n  }\n}\n","import { Effect, Layer } from \"effect\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport {\n  AuthCacheError,\n  AuthCachePortTag,\n  type AuthCachePort,\n  type CachedJwt,\n} from \"../../ports/auth-cache\";\nimport { parseAuthSession, parseCachedJwt } from \"./serialization\";\n\nexport interface BrowserStorageShape {\n  getItem(key: string): string | null;\n  setItem(key: string, value: string): void;\n  removeItem(key: string): void;\n}\n\nconst SESSION_KEY = \"capxul.session\";\nconst JWT_KEY = \"capxul.jwt\";\n\nexport class BrowserAuthCacheAdapter implements AuthCachePort {\n  private readonly storage: BrowserStorageShape;\n\n  constructor(storage: BrowserStorageShape) {\n    this.storage = storage;\n  }\n\n  readonly getSession = authCacheTry(\"getSession\", () => {\n    const raw = this.storage.getItem(SESSION_KEY);\n    if (raw === null) return null;\n    try {\n      return parseAuthSession(JSON.parse(raw));\n    } catch {\n      return null;\n    }\n  });\n\n  readonly setSession = (session: AuthSession) =>\n    authCacheTry(\"setSession\", () => {\n      this.storage.setItem(SESSION_KEY, JSON.stringify(session));\n    });\n\n  readonly clearSession = authCacheTry(\"clearSession\", () => {\n    this.storage.removeItem(SESSION_KEY);\n  });\n\n  readonly getJwt = authCacheTry(\"getJwt\", () => {\n    const raw = this.storage.getItem(JWT_KEY);\n    if (raw === null) return null;\n    try {\n      return parseCachedJwt(JSON.parse(raw));\n    } catch {\n      return null;\n    }\n  });\n\n  readonly setJwt = (jwt: CachedJwt) =>\n    authCacheTry(\"setJwt\", () => {\n      this.storage.setItem(JWT_KEY, JSON.stringify(jwt));\n    });\n\n  readonly clearJwt = authCacheTry(\"clearJwt\", () => {\n    this.storage.removeItem(JWT_KEY);\n  });\n}\n\nexport function BrowserAuthCacheLayer(input: {\n  readonly storage: BrowserStorageShape;\n}): Layer.Layer<AuthCachePortTag, AuthCacheError> {\n  return Layer.effect(\n    AuthCachePortTag,\n    Effect.sync(() => new BrowserAuthCacheAdapter(input.storage)).pipe(\n      Effect.mapError((cause) => toAuthCacheError(\"initialize\", cause)),\n    ),\n  );\n}\n\nfunction toAuthCacheError(operation: string, cause: unknown): AuthCacheError {\n  return new AuthCacheError({ operation, cause });\n}\n\nfunction authCacheTry<T>(operation: string, run: () => T): Effect.Effect<T, AuthCacheError> {\n  return Effect.try({\n    try: run,\n    catch: (cause) => toAuthCacheError(operation, cause),\n  });\n}\n","import { Effect, Layer } from \"effect\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport {\n  AuthCacheError,\n  AuthCachePortTag,\n  type AuthCachePort,\n  type CachedJwt,\n} from \"../../ports/auth-cache\";\n\nexport class InMemoryAuthCacheAdapter implements AuthCachePort {\n  private session: AuthSession | null = null;\n  private jwt: CachedJwt | null = null;\n\n  readonly getSession = Effect.sync(() => this.session);\n\n  readonly setSession = (session: AuthSession) =>\n    Effect.sync(() => {\n      this.session = session;\n    });\n\n  readonly clearSession = Effect.sync(() => {\n    this.session = null;\n  });\n\n  readonly getJwt = Effect.sync(() => this.jwt);\n\n  readonly setJwt = (jwt: CachedJwt) =>\n    Effect.sync(() => {\n      this.jwt = jwt;\n    });\n\n  readonly clearJwt = Effect.sync(() => {\n    this.jwt = null;\n  });\n}\n\nexport const InMemoryAuthCacheLayer = Layer.effect(\n  AuthCachePortTag,\n  Effect.sync(() => new InMemoryAuthCacheAdapter()).pipe(\n    Effect.mapError((cause) => new AuthCacheError({ operation: \"initialize\", cause })),\n  ),\n);\n"],"mappings":";;AAKA,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;;AAYA,MAAa,8BAA4D,IAAI,IAAI;CAC/E;CACA;CAKA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAiDD,IAAa,cAAb,cAAiC,MAAM;CACrC;CACA;CACA;CACA;CAEA,YAAY,MAAuB,SAAiB,UAA8B,CAAC,GAAG;EACpF,MAAM,SAAS,WAAW,UAAU,EAAE,OAAO,QAAQ,MAAM,IAAI,KAAA,CAAS;EACxE,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,IAAI,QAAQ,YAAY,KAAA,GACtB,KAAK,UAAU,QAAQ;EAEzB,IAAI,QAAQ,kBAAkB,KAAA,GAC5B,KAAK,gBAAgB,QAAQ;EAE/B,IAAI,QAAQ,UAAU,KAAA,GACpB,KAAK,QAAQ,QAAQ;CAEzB;AACF;AAEA,SAAgB,cAAc,OAAsC;CAClE,OAAO,iBAAiB;AAC1B;AAYA,SAAgB,uBAAuB,YAAgD;CACrF,OAAO,IAAI,YACT,WAAW,MACX,WAAW,SACX,oBAAoB;EAClB,SAAS,WAAW;EACpB,eAAe,WAAW;EAC1B,OAAO,WAAW;CACpB,CAAC,CACH;AACF;AAiCA,SAAS,oBAAoB,SAKN;CACrB,MAAM,SAKF,CAAC;CAEL,IAAI,WAAW,SACb,OAAO,QAAQ,QAAQ;CAEzB,IAAI,QAAQ,YAAY,KAAA,GACtB,OAAO,UAAU,QAAQ;CAE3B,IAAI,QAAQ,kBAAkB,KAAA,GAC5B,OAAO,gBAAgB,QAAQ;CAEjC,IAAI,QAAQ,UAAU,KAAA,GACpB,OAAO,QAAQ,QAAQ;CAGzB,OAAO;AACT;AAEA,MAAa,SAAS;CACpB,mBAAmB,SAAkB,SACnC,IAAI,YACF,qBACA,WAAW,qBACX,MAAM,eAAe,EAAE,SAAS,EAAE,cAAc,KAAK,aAAa,EAAE,IAAI,KAAA,CAC1E;CACF,sBAAsB,WACpB,IAAI,YAAY,yBAAyB,wBAAwB,EAC/D,SAAS,EAAE,OAAO,EACpB,CAAC;CAEH,kBAAkB,eAChB,IAAI,YAAY,qBAAqB,8BAA8B,cAAc,EAC/E,SAAS,EAAE,WAAW,EACxB,CAAC;CAEH,sBAAsB,eACpB,IAAI,YAAY,yBAAyB,iCAAiC,EACxE,SAAS,EAAE,WAAW,EACxB,CAAC;CAEH,iBAAiB,aACf,IAAI,YACF,oBACA,WAAW,mBAAmB,SAAS,cAAc,6BACrD,aAAa,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,SAAS,EAAE,CAC/D;CAEF,kBAAkB,cAChB,IAAI,YACF,qBACA,YAAY,oBAAoB,UAAU,cAAc,8BACxD,cAAc,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CACjE;CAEF,gBACE,UACA,WACA,OACA,SACG;EACH,MAAM,UAAmC;GAAE;GAAU;EAAU;EAC/D,IAAI,MAAM,cACR,QAAQ,eAAe,KAAK;EAE9B,OAAO,IAAI,YAAY,kBAAkB,mBAAmB,SAAS,GAAG,aAAa;GACnF;GACA;EACF,CAAC;CACH;CAEA,eAAe,OAAe,WAC5B,IAAI,YAAY,iBAAiB,WAAW,MAAM,IAAI,UAAU,EAC9D,SAAS;EAAE;EAAO;CAAO,EAC3B,CAAC;CAEH,aAAa,SACX,IAAI,YAAY,eAAe,wBAAwB,KAAK,kBAAkB,EAC5E,SAAS,EAAE,KAAK,EAClB,CAAC;CAEH,iBAAiB,QAAgB,WAC/B,IAAI,YACF,mBACA,GAAG,OAAO,GAAG,OAAO,yEACpB,EAAE,SAAS;EAAE;EAAQ;CAAO,EAAE,CAChC;;;;;;;;;;CAWF,kBAAkB,UAAkB,WAAmB,cACrD,IAAI,YACF,kBACA,mBAAmB,SAAS,GAAG,UAAU,qBAAqB,UAAU,MACxE;EACE,SAAS;GAAE;GAAU;GAAW,QAAQ;EAAU;EAClD,uBAAO,IAAI,MAAM,YAAY,UAAU,YAAY,UAAU,GAAG;CAClE,CACF;CAEF,uBAAuB,YAAyC;EAM9D,OAAO,IAAI,YAAY,yBAJrB,UAAU,UACN,mCAAmC,QAAQ,KAAK,WAAW,QAAQ,YAAY,KAC/E,qBAAqB,QAAQ,aAAa,gBAES,EACvD,QACF,CAAC;CACH;CAEA,sBAAsB,OAAe,WAAmB,aACtD,IAAI,YAAY,wBAAwB,gBAAgB,MAAM,WAAW,EACvE,SAAS;EAAE;EAAO;EAAW;CAAS,EACxC,CAAC;CAEH,mBAAmB,WACjB,IAAI,YAAY,qBAAqB,sBAAsB,UAAU,EACnE,SAAS,EAAE,OAAO,EACpB,CAAC;;;;;;;;;;;CAYH,uBAAuB,YASrB,IAAI,YACF,0BACA,wCAAwC,QAAQ,OAAO,KACvD,EACE,SACE,QAAQ,cAAc,KAAA,IAClB,EAAE,QAAQ,QAAQ,OAAO,IACzB;EAAE,QAAQ,QAAQ;EAAQ,WAAW,QAAQ;CAAU,EAC/D,CACF;;;;;;;;CASF,oBAAoB,WAAmB,OAAiB,UACtD,IAAI,YAAY,sBAAsB,uBAAuB,aAAa;EACxE;EACA,SAAS,OAAO,WAAW,KAAA,IAAY,EAAE,UAAU,IAAI;GAAE;GAAW,QAAQ,MAAM;EAAO;CAC3F,CAAC;CAEH,cAAc,YACZ,IAAI,YACF,gBACA,uBACA,YAAY,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAChE;CAEF,eAAe,WAAmB,UAChC,IAAI,YAAY,iBAAiB,wBAAwB,aAAa;EACpE;EACA,SAAS,EAAE,UAAU;CACvB,CAAC;CAEH,UAAU,UAAoB,IAAI,YAAY,WAAW,iBAAiB,EAAE,MAAM,CAAC;CAEnF,aAAa,YACX,IAAI,YACF,eACA,qDACA,YAAY,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAChE;CAEF,iBAAiB,YAKf,IAAI,YAAY,mBAAmB,gCAAgC;EACjE,OAAO,QAAQ;EACf,SACE,QAAQ,WAAW,KAAA,IACf,EAAE,QAAQ,QAAQ,OAAO,IACzB;GAAE,QAAQ,QAAQ;GAAQ,QAAQ,QAAQ;EAAO;CACzD,CAAC;CAEH,YAAY,YACV,IAAI,YACF,aACA,4BACA,YAAY,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAChE;;;;;;;;;CAUF,aAAa,YAKX,IAAI,YACF,eACA,GAAG,QAAQ,OAAO,sBAAsB,QAAQ,aAAa,mBAAmB,QAAQ,YAAY,KAAK,IAAI,KAC7G,EAAE,SAAS;EAAE,GAAG;EAAS,aAAa,CAAC,GAAG,QAAQ,WAAW;CAAE,EAAE,CACnE;AACJ;;;AChZA,MAAM,cAA4C,IAAI,IAAI,kBAAkB;AAE5E,SAAS,aAAa,OAA0C;CAC9D,OAAO,OAAO,UAAU,YAAY,YAAY,IAAI,KAAwB;AAC9E;AAEA,SAAS,YAAY,YAAyD;CAC5E,IAAI,CAAC,aAAa,WAAW,IAAI,GAAG,OAAO;CAc3C,OAAO,uBAAuB;EAZ5B,MAAM,WAAW;EACjB,SAAS,OAAO,WAAW,YAAY,WAAW,WAAW,UAAU,OAAO,WAAW,IAAI;EAC7F,GAAI,OAAO,WAAW,YAAY,YAClC,WAAW,YAAY,QACvB,CAAC,MAAM,QAAQ,WAAW,OAAO,IAC7B,EAAE,SAAS,WAAW,QAAmC,IACzD,CAAC;EACL,GAAI,OAAO,WAAW,kBAAkB,WACpC,EAAE,eAAe,WAAW,cAAc,IAC1C,CAAC;EACL,GAAI,OAAO,WAAW,UAAU,WAAW,EAAE,OAAO,WAAW,MAAM,IAAI,CAAC;CAExC,CAAC;AACvC;AAEA,SAAgB,kBAAkB,KAAkC;CAClE,IAAI,QAAQ,QAAQ,QAAQ,KAAA,GAAW,OAAO;CAG9C,IAAI,eAAe,aAAa,OAAO;CAEvC,IAAI,OAAO,QAAQ,UAAU,OAAO;CAKpC,MAAM,SAAS;CACf,IAAI,EAAE,UAAU,SAAS,OAAO;CAChC,MAAM,OAAO,OAAO;CAEpB,IAAI,OAAO,SAAS,YAAY,SAAS,MACvC,OAAO,YAAY,IAA+B;CAOpD,IAAI,OAAO,SAAS,UAClB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,IAAI,OAAO,WAAW,YAAY,WAAW,MAC3C,OAAO,YAAY,MAAiC;CAExD,QAAQ,CAER;CAGF,OAAO;AACT;;;ACqDA,MAAa,iBAAiB;AAC9B,MAAa,aAAa;AAC1B,MAAa,0BAA0B;AACvC,MAAa,uBAAuB;CAClC;EAAE,MAAM;EAAO,QAAQ;EAAK,MAAM;CAAY;CAC9C;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAiB;CACrD;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAgB;CACpD;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAkB;CACtD;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAmB;AACzD;AACA,MAAa,2BAA2B,qBAAqB,KAAK,aAAa,SAAS,IAAI;AAE5D,OAAO,YACrC,qBAAqB,KAAK,aAAa,CAAC,SAAS,MAAM,SAAS,MAAM,CAAC,CACzE;AAEA,MAAM,WAAW;AACjB,MAAM,kBAAkB;AACxB,MAAM,2BAA2B;AAMjC,MAAM,gBAAgB;AACtB,MAAM,mBAAmB;AAIzB,MAAa,YAAY;AAKM,KAAK,MAAM,OAAO,mBAAmB,GAAI;AAExE,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,eAAe,KAAK,GAAG,GACrD,MAAM,OAAO,aAAa,WAAW,mBAAmB,8BAA8B,GAAG,CAAC;CAG5F,OAAO,IAAI,YAAY;AACzB;AAMA,SAAgB,QAAQ,KAAqB;CAC3C,IAAI,OAAO,QAAQ,YAAY,CAAC,SAAS,KAAK,GAAG,GAC/C,MAAM,OAAO,aAAa,SAAS,mBAAmB,mCAAmC,GAAG,CAAC;CAG/F,OAAO,IAAI,YAAY;AACzB;AAMA,SAAgB,aAAa,KAA0B;CACrD,OAAO,sBAAsB,KAAK,YAAY;AAChD;AAEA,SAAgB,sBAAsB,KAAmC;CACvE,IAAI,OAAO,QAAQ,YAAY,CAAC,yBAAyB,KAAK,GAAG,GAC/D,MAAM,OAAO,aACX,kBACA,mBAAmB,kDAAkD,GAAG,CAC1E;CAGF,OAAO;AACT;AAMA,SAAgB,YAAY,KAAyB;CACnD,IAAI,OAAO,QAAQ,YAAY,CAAC,cAAc,KAAK,GAAG,GACpD,MAAM,OAAO,aACX,aACA,mBAAmB,4CAA4C,GAAG,CACpE;CAGF,OAAO;AACT;AAEA,SAAgB,eAAe,KAA4B;CACzD,IAAI,OAAO,QAAQ,YAAY,CAAC,iBAAiB,KAAK,GAAG,GACvD,MAAM,OAAO,aACX,gBACA,mBAAmB,+CAA+C,GAAG,CACvE;CAGF,OAAO;AACT;AAEA,SAAgB,QAAQ,KAAqB;CAC3C,OAAO,sBAAsB,KAAK,OAAO;AAC3C;AAEA,SAAgB,QAAQ,KAAqB;CAC3C,IAAI,OAAO,QAAQ,YAAY,CAAC,UAAU,KAAK,GAAG,GAChD,MAAM,OAAO,aAAa,SAAS,mBAAmB,4BAA4B,GAAG,CAAC;CAGxF,OAAO;AACT;AAEA,SAAgB,gBAAgB,KAA6B;CAC3D,IAAI,OAAO,QAAQ,UACjB,MAAM,OAAO,aAAa,iBAAiB,wCAAwC;CAGrF,MAAM,aAAa,uBAAuB,GAAG;CAC7C,IAAI,eAAe,MACjB,MAAM,OAAO,aACX,iBACA,mBAAmB,mCAAmC,GAAG,CAC3D;CAGF,OAAO;AACT;AAEA,SAAgB,mBAAmB,KAAgC;CACjE,OAAO,sBAAsB,KAAK,OAAO;AAC3C;AAEA,SAAgB,aAAa,KAA0B;CACrD,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,cAAc,GAAG,KAAK,MAAM,GACjE,MAAM,OAAO,aACX,YACA,mBAAmB,uCAAuC,GAAG,CAC/D;CAGF,OAAO;AACT;AAEA,SAAgB,iBAAiB,KAA8B;CAC7D,IAAI,OAAO,QAAQ,YAAY,CAAC,wBAAwB,KAAK,GAAG,GAC9D,MAAM,OAAO,aACX,kBACA,mBAAmB,gEAAgE,GAAG,CACxF;CAGF,OAAO;AACT;AAuBA,SAAgB,UAAU,KAAuB;CAC/C,6BAA6B,KAAK,SAAS;CAC3C,OAAO;AACT;AAEA,SAAgB,eAAe,KAA4B;CACzD,6BAA6B,KAAK,cAAc;CAChD,OAAO;AACT;AAcA,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,cAAc,GAAG,KAAK,OAAO,GAClE,MAAM,OAAO,aACX,WACA,mBAAmB,mCAAmC,GAAG,CAC3D;CAGF,OAAO;AACT;AAuBA,SAAgB,cAAc,KAA2B;CACvD,IAAI,OAAO,QAAQ,UACjB,MAAM,OAAO,aAAa,eAAe,kBAAkB;CAG7D,MAAM,QAAQ,IAAI,YAAY;CAC9B,IAAI,CAAC,gBAAgB,KAAK,KAAK,GAC7B,MAAM,OAAO,aACX,eACA,mBAAmB,8CAA8C,GAAG,CACtE;CAGF,OAAO;AACT;AAEA,SAAgB,eAAe,KAA4B;CACzD,IAAI,OAAO,QAAQ,YAAY,CAAC,yBAAyB,SAAS,GAA4B,GAC5F,MAAM,OAAO,aAAa,gBAAgB,mBAAmB,wBAAwB,GAAG,CAAC;CAG3F,OAAO;AACT;AAWA,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,KAAK,MAAM,GACxE,MAAM,OAAO,aAAa,WAAW,mBAAmB,gCAAgC,GAAG,CAAC;CAG9F,OAAO;AACT;AA6BA,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,WAAW,KAAK,GAAG,GACjD,MAAM,OAAO,aAAa,WAAW,mBAAmB,6BAA6B,GAAG,CAAC;CAG3F,OAAO,IAAI,YAAY;AACzB;AAUA,SAAgB,eAAe,KAA4B;CACzD,IAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAC5C,MAAM,OAAO,aAAa,SAAS,4BAA4B;CAGjE,OAAO;AACT;AAEA,SAAgB,WAAW,KAAwB;CACjD,IAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAC5C,MAAM,OAAO,aAAa,YAAY,4BAA4B;CAGpE,OAAO;AACT;AAEA,SAAS,sBAAsB,KAAc,OAAuB;CAClE,IAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAC5C,MAAM,OAAO,aAAa,OAAO,4BAA4B;CAG/D,OAAO;AACT;AAEA,SAAS,6BAA6B,KAAc,OAAsC;CACxF,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,cAAc,GAAG,KAAK,MAAM,GACjE,MAAM,OAAO,aACX,OACA,mBAAmB,uCAAuC,GAAG,CAC/D;AAEJ;AAEA,SAAS,uBAAuB,KAA4B;CAC1D,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,OAAO;CACT;CAEA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UACrD,OAAO;CAGT,IAAI,OAAO,SAAS,SAAS,GAAG,GAC9B,OAAO;CAGT,OAAO,OAAO;AAChB;AAEA,SAAS,mBAAmB,QAAgB,KAAsB;CAChE,IAAI,OAAO,QAAQ,UACjB,OAAO,GAAG,OAAO,IAAI,IAAI,MAAM,GAAG,EAAE;CAGtC,OAAO,GAAG,OAAO,IAAI,OAAO,GAAG;AACjC;;;ACpdA,IAAa,iBAAb,cAAoC,KAAK,YAAY,gBAAgB,EAGlE,CAAC;AAEJ,IAAa,mBAAb,cAAsC,QAAQ,IAAI,iCAAiC,EAGjF,EAAE,CAAC;;;ACtCL,SAAgB,iBAAiB,KAAkC;CACjE,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;CACpD,MAAM,YAAY;CAOlB,IAAI;EACF,OAAO;GACL,YAAY,aAAa,UAAU,UAAU;GAC7C,OAAO,QAAQ,UAAU,KAAK;GAC9B,OAAO,eAAe,UAAU,KAAK;GACrC,WAAW,UAAU,UAAU,SAAS;EAC1C;CACF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAgB,eAAe,KAAgC;CAC7D,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;CACpD,MAAM,YAAY;CAKlB,IAAI;EACF,OAAO;GACL,OAAO,WAAW,UAAU,KAAK;GACjC,iBAAiB,eAAe,UAAU,eAAe;EAC3D;CACF,QAAQ;EACN,OAAO;CACT;AACF;;;AC/BA,MAAM,cAAc;AACpB,MAAM,UAAU;AAEhB,IAAa,0BAAb,MAA8D;CAC5D;CAEA,YAAY,SAA8B;EACxC,KAAK,UAAU;CACjB;CAEA,aAAsB,aAAa,oBAAoB;EACrD,MAAM,MAAM,KAAK,QAAQ,QAAQ,WAAW;EAC5C,IAAI,QAAQ,MAAM,OAAO;EACzB,IAAI;GACF,OAAO,iBAAiB,KAAK,MAAM,GAAG,CAAC;EACzC,QAAQ;GACN,OAAO;EACT;CACF,CAAC;CAED,cAAuB,YACrB,aAAa,oBAAoB;EAC/B,KAAK,QAAQ,QAAQ,aAAa,KAAK,UAAU,OAAO,CAAC;CAC3D,CAAC;CAEH,eAAwB,aAAa,sBAAsB;EACzD,KAAK,QAAQ,WAAW,WAAW;CACrC,CAAC;CAED,SAAkB,aAAa,gBAAgB;EAC7C,MAAM,MAAM,KAAK,QAAQ,QAAQ,OAAO;EACxC,IAAI,QAAQ,MAAM,OAAO;EACzB,IAAI;GACF,OAAO,eAAe,KAAK,MAAM,GAAG,CAAC;EACvC,QAAQ;GACN,OAAO;EACT;CACF,CAAC;CAED,UAAmB,QACjB,aAAa,gBAAgB;EAC3B,KAAK,QAAQ,QAAQ,SAAS,KAAK,UAAU,GAAG,CAAC;CACnD,CAAC;CAEH,WAAoB,aAAa,kBAAkB;EACjD,KAAK,QAAQ,WAAW,OAAO;CACjC,CAAC;AACH;AAaA,SAAS,iBAAiB,WAAmB,OAAgC;CAC3E,OAAO,IAAI,eAAe;EAAE;EAAW;CAAM,CAAC;AAChD;AAEA,SAAS,aAAgB,WAAmB,KAAgD;CAC1F,OAAO,OAAO,IAAI;EAChB,KAAK;EACL,QAAQ,UAAU,iBAAiB,WAAW,KAAK;CACrD,CAAC;AACH;;;AC5EA,IAAa,2BAAb,MAA+D;CAC7D,UAAsC;CACtC,MAAgC;CAEhC,aAAsB,OAAO,WAAW,KAAK,OAAO;CAEpD,cAAuB,YACrB,OAAO,WAAW;EAChB,KAAK,UAAU;CACjB,CAAC;CAEH,eAAwB,OAAO,WAAW;EACxC,KAAK,UAAU;CACjB,CAAC;CAED,SAAkB,OAAO,WAAW,KAAK,GAAG;CAE5C,UAAmB,QACjB,OAAO,WAAW;EAChB,KAAK,MAAM;CACb,CAAC;CAEH,WAAoB,OAAO,WAAW;EACpC,KAAK,MAAM;CACb,CAAC;AACH;AAEsC,MAAM,OAC1C,kBACA,OAAO,WAAW,IAAI,yBAAyB,CAAC,EAAE,KAChD,OAAO,UAAU,UAAU,IAAI,eAAe;CAAE,WAAW;CAAc;AAAM,CAAC,CAAC,CACnF,CACF"}

package/dist/{index-DsRoJ2Wc.d.mts → index-Bs-M7EPt.d.mts}

@@ -57,6 +57,8 @@ type Profile = {
   readonly country: CountryCode | null;
   readonly onboarded: boolean;
   readonly withdrawalAddress: Address | null;
+  readonly username: string | null;
+  readonly imageUrl: string | null;
   readonly kycTier: KycTier;
   readonly createdAt: EpochMs;
   readonly updatedAt: EpochMs;
@@ -158,4 +160,4 @@ declare function toAddress(raw: unknown): Address;
 declare function toCountryCode(raw: unknown): CountryCode;
 //#endregion
 export { SubAccount as A, PublishableKey as C, RunId as D, RoleKey as E, CapxulError as F, CapxulErrorCode as I, CapxulErrorDetails as L, TxHash as M, toAddress as N, SessionToken as O, toCountryCode as P, FailureMode as R, Profile as S, PublishableKeyRecord as T, EpochMs as _, AnonymousDistinctId as a, Money as b, AuthUserId as c, CountryCode as d, CurrencyCode as f, Email as g, DurationMs as h, AllowedOrigin as i, SubAccountId as j, SmartAccount as k, BlockNumber as l, DocumentHash as m, AccountId as n, AppId as o, DeveloperApplication as p, Address as r, AuthSession as s, Account as t, ChainId as u, EpochSeconds as v, PublishableKeyId as w, OrgId as x, JwtToken as y, isCapxulError as z };
-//# sourceMappingURL=index-DsRoJ2Wc.d.mts.map
+//# sourceMappingURL=index-Bs-M7EPt.d.mts.map

package/dist/index-Bs-M7EPt.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-Bs-M7EPt.d.mts","names":[],"sources":["../../errors/src/errors.ts","../../types/src/brand.ts","../../types/src/index.ts"],"mappings":";cAKa,kBAAA;AAAA,KAyBD,eAAA,WAA0B,kBAAkB;AA8CxD;;;;AAAuB;AAOvB;;;;AAAuC;AAgBvC;;;;;;;AAvBA,KAAY,WAAA;AAAA,KAOA,kBAAA,GAAqB,MAAM;AAAA,KAgB3B,kBAAA;EAAA,SACD,KAAA;EAAA,SACA,OAAA,GAAU,kBAAkB;EAAA,SAC5B,aAAA;EAAA,SACA,KAAA;AAAA;AAAA,cAGE,WAAA,SAAoB,KAAA;EAAA,SACtB,IAAA,EAAM,eAAA;EAAA,SACN,OAAA,GAAU,kBAAA;EAAA,SACV,aAAA;EAAA,SACA,KAAA;cAEG,IAAA,EAAM,eAAA,EAAiB,OAAA,UAAiB,OAAA,GAAS,kBAAA;AAAA;AAAA,iBAgB/C,aAAA,CAAc,KAAA,YAAiB,KAAA,IAAS,WAAW;;;;AA3HnE;;;;AAuBU;cCtBI,KAAA;AAAA,KAEF,KAAA,wBAA6B,CAAA;EAAA,UAAgB,KAAA,GAAQ,CAAA;AAAA;;;KCHrD,OAAA,GAAU,KAAK;AAAA,KACf,KAAA,GAAQ,KAAK;AAAA,KAMb,OAAA;EAAA,SACD,UAAA,EAAY,UAAA;EAAA,SACZ,KAAA,EAAO,KAAA;EAAA,SACP,WAAA;EAAA,SACA,OAAA,EAAS,WAAA;EAAA,SACT,SAAA;EAAA,SACA,iBAAA,EAAmB,OAAA;EAAA,SAInB,QAAA;EAAA,SACA,QAAA;EAAA,SACA,OAAA,EAAS,OAAA;EAAA,SACT,SAAA,EAAW,OAAA;EAAA,SACX,SAAA,EAAW,OAAA;AAAA;AAAA,KASV,YAAA;EAAA,SACD,UAAA,EAAY,UAAA;EAAA,SACZ,aAAA,EAAe,OAAA;EAAA,SACf,mBAAA,EAAqB,OAAA;EAAA,SACrB,OAAA,EAAS,OAAA;EAAA,SACT,UAAA,EAAY,OAAA;EAAA,SACZ,SAAA,EAAW,OAAA;EAAA,SACX,SAAA,EAAW,OAAA;AAAA;AAAA,KAQV,KAAA;EAAA,SACD,QAAA,EAAU,YAAY;EAAA,SACtB,KAAA;EAAA,SACA,QAAA;AAAA;AAAA,KAQC,OAAA;EAAA,SACD,EAAA,EAAI,SAAA;EAAA,SACJ,OAAA,EAAS,KAAA;EAAA,SACT,SAAA,EAAW,KAAA;AAAA;;KAIV,UAAA;EAAA,SACD,EAAA,EAAI,YAAA;EAAA,SACJ,SAAA,EAAW,SAAA;EAAA,SACX,IAAA;EAAA,SACA,OAAA,EAAS,KAAA;EAAA,SACT,SAAA,EAAW,OAAA;AAAA;AAAA,KAGV,UAAA,GAAa,KAAK;AAAA,KAClB,mBAAA,GAAsB,KAAK;AAAA,KAE3B,SAAA,GAAY,KAAK;AAAA,KACjB,YAAA,GAAe,KAAK;AAAA,KACpB,KAAA,GAAQ,KAAK;AAAA,KACb,KAAA,GAAQ,KAAK;AAAA,KACb,aAAA,GAAgB,KAAK;AAAA,KACrB,cAAA,GAAiB,KAAK;AAAA,KACtB,gBAAA,GAAmB,KAAK;AAAA,KACxB,UAAA,GAAa,KAAK;AAAA,KAMlB,oBAAA;EAAA,SACD,EAAA,EAAI,KAAA;EAAA,SACJ,UAAA,EAAY,UAAA;EAAA,SACZ,IAAA;EAAA,SACA,cAAA,WAAyB,aAAA;EAAA,SACzB,SAAA,EAAW,OAAA;EAAA,SACX,UAAA,EAAY,OAAA;AAAA;AAAA,KAEX,oBAAA;EAAA,SACD,EAAA,EAAI,gBAAA;EAAA,SACJ,aAAA,EAAe,KAAA;EAAA,SACf,YAAA,EAAc,OAAA;EAAA,SACd,iBAAA,EAAmB,OAAA;EAAA,SACnB,SAAA,EAAW,OAAA;AAAA;AAAA,KAEV,MAAA,GAAS,KAAK;AAAA,KACd,YAAA,GAAe,KAAK;AAAA,KACpB,OAAA,GAAU,KAAK;AAAA,KACf,YAAA,GAAe,KAAK;AAAA,KACpB,OAAA,GAAU,KAAK;AAAA,KACf,WAAA,GAAc,KAAK;AAAA,KACnB,YAAA,GAAe,KAAK,CAAC,qBAAA;AAAA,KACrB,OAAA,GAAU,KAAK;AAAA,KACf,WAAA,GAAc,KAAK;AAAA,KAKnB,KAAA,GAAQ,KAAK;AAAA,KACb,OAAA,GAAU,KAAK;AAAA,KAEf,YAAA,GAAe,KAAK;AAAA,KACpB,QAAA,GAAW,KAAK;AAAA,KAOhB,WAAA;EAAA,SACD,UAAA,EAAY,UAAA;EAAA,SACZ,KAAA,EAAO,KAAA;EAAA,SACP,KAAA,EAAO,YAAA;EAAA,SACP,SAAA,EAAW,OAAA;AAAA;AAAA,cAMT,oBAAA;EAAA;;;;;;;;;;;;;;;;;;;;KAQR,qBAAA,WAAgC,oBAAoB;AAAA,iBAyBzC,SAAA,CAAU,GAAA,YAAe,OAAO;AAAA,iBAkMhC,aAAA,CAAc,GAAA,YAAe,WAAW"}

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { A as SubAccount, C as PublishableKey, D as RunId, E as RoleKey, F as CapxulError, I as CapxulErrorCode, L as CapxulErrorDetails, N as toAddress, O as SessionToken, P as toCountryCode, R as FailureMode, S as Profile$1, T as PublishableKeyRecord, _ as EpochMs, a as AnonymousDistinctId, b as Money, c as AuthUserId, d as CountryCode, f as CurrencyCode, g as Email, h as DurationMs, i as AllowedOrigin, j as SubAccountId, k as SmartAccount$1, m as DocumentHash, n as AccountId, o as AppId, p as DeveloperApplication, r as Address, s as AuthSession, t as Account, u as ChainId, w as PublishableKeyId, x as OrgId, z as isCapxulError } from "./index-DsRoJ2Wc.mjs";
-import { a as SafeDeploymentEvidence, n as SafeDeploymentConfig } from "./safe-deployment-BbyXBMpR.mjs";
-import { a as AccountProvider, c as Eip1193Provider, d as CapxulResult, f as Profile, g as AuthCachePort, i as injectedWalletSigner, l as eip1193AccountProvider, m as SmartAccount, n as CapxulSigner, o as AccountProviderSource, p as Session, r as Eip1193RequestProvider, s as AccountRequirement, t as CapxulDigestSigner, u as localPrivateKeyAccountProvider, v as CachedJwt } from "./signer-CbC6igta.mjs";
+import { A as SubAccount, C as PublishableKey, D as RunId, E as RoleKey, F as CapxulError, I as CapxulErrorCode, L as CapxulErrorDetails, N as toAddress, O as SessionToken, P as toCountryCode, R as FailureMode, S as Profile$1, T as PublishableKeyRecord, _ as EpochMs, a as AnonymousDistinctId, b as Money, c as AuthUserId, d as CountryCode, f as CurrencyCode, g as Email, h as DurationMs, i as AllowedOrigin, j as SubAccountId, k as SmartAccount$1, m as DocumentHash, n as AccountId, o as AppId, p as DeveloperApplication, r as Address, s as AuthSession, t as Account, u as ChainId, w as PublishableKeyId, x as OrgId, z as isCapxulError } from "./index-Bs-M7EPt.mjs";
+import { a as SafeDeploymentEvidence, n as SafeDeploymentConfig } from "./safe-deployment-BLXJ5Ed8.mjs";
+import { a as AccountProvider, c as Eip1193Provider, d as CapxulResult, f as Profile, g as AuthCachePort, i as injectedWalletSigner, l as eip1193AccountProvider, m as SmartAccount, n as CapxulSigner, o as AccountProviderSource, p as Session, r as Eip1193RequestProvider, s as AccountRequirement, t as CapxulDigestSigner, u as localPrivateKeyAccountProvider, v as CachedJwt } from "./signer-Rr9Y8aGi.mjs";
 import { Hex } from "viem";
 import { Context, Effect, Layer, Request } from "effect";
 import { FunctionReference } from "convex/server";
@@ -365,7 +365,8 @@ type CompleteOnboardingIdentityInput = {
   readonly email: Email;
   readonly displayName: string;
   readonly country: CountryCode;
-  readonly withdrawalAddress?: Address;
+  readonly withdrawalAddress?: Address; /** #1062: optional globally-unique handle — store-when-present, backend-normalized. */
+  readonly username?: string;
 };
 declare const IdentityError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
   readonly _tag: "IdentityError";
@@ -655,6 +656,16 @@ interface IdentityMethods {
   loadCurrent(options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<Profile | null>>;
+  /**
+   * #1062: availability probe for the username the user is typing. Returns the
+   * canonical stored form so the UI can echo it.
+   */
+  usernameAvailable(username: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<{
+    readonly available: boolean;
+    readonly normalized: string;
+  }>>;
 }
 //#endregion
 //#region src/client/account-lane.d.ts
@@ -1184,24 +1195,36 @@ type DestinationPayload = {
   readonly currency: string;
   readonly phoneNumberLast4: string;
 } | {
-  readonly network: "base-sepolia";
+  readonly network: "base-sepolia" | "solana-devnet" | "starknet-sepolia";
   readonly address: string;
 };
 interface Destination {
   readonly id: string;
   readonly counterpartyId: string;
-  readonly ref: Ref;
-  readonly target: TargetReference;
+  /** #1063: null exactly when `ownerScope === "self"`. */
+  readonly ref: Ref | null;
+  /** Derived from `ref`; null for self-owned rows. */
+  readonly target: TargetReference | null;
   readonly kind: DestinationKind;
   readonly rail: DestinationRail;
+  /**
+   * #1063: "self" = the actor's own payout destination; "counterparty" = the
+   * address-book shape. The mapping always sets it (wire absence ⇒ "counterparty").
+   */
+  readonly ownerScope: "self" | "counterparty";
   readonly label: string | null;
   readonly payload: DestinationPayload;
   readonly createdAt: number;
   readonly updatedAt: number;
 }
+/** #1063 ratified shape: your own payout destination is `target: { self: true }`. */
+type SelfTarget = {
+  readonly self: true;
+};
+/** #1063: exactly one of `target` (counterparty or `{ self: true }`) or `ref`. */
 interface DestinationAddInput {
   readonly actor?: ActorReference;
-  readonly target?: TargetReference;
+  readonly target?: TargetReference | SelfTarget;
   readonly ref?: Ref;
   readonly kind: DestinationKind;
   readonly label?: string;
@@ -1209,7 +1232,8 @@ interface DestinationAddInput {
 }
 interface DestinationListInput {
   readonly actor?: ActorReference;
-  readonly target?: TargetReference;
+  /** #1063: `{ self: true }` narrows to the actor's own payout destinations. */
+  readonly target?: TargetReference | SelfTarget;
   readonly ref?: Ref;
   readonly kind?: DestinationKind;
 }
@@ -2077,7 +2101,9 @@ type OrgLifecycle = {
 type StartOrResumeOrganizationInput = {
   readonly name: string;
   readonly handle: string;
-  readonly country: string;
+  readonly country: string; /** #1064: optional onboarding-collected description + size bucket. */
+  readonly bio?: string;
+  readonly size?: string;
 };
 type OrganizationSetupStepInput = {
   readonly orgId: OrgId;
@@ -2136,7 +2162,10 @@ type OrgView = {
   readonly handle: string;
   readonly safeAddress: Address; /** The viewing member's own role label within this org. */
   readonly role: string; /** The Org treasury — the real M2 Account over the Org Safe (D3). */
-  readonly treasury: Account;
+  readonly treasury: Account; /** #1064: onboarding-collected description + size bucket; null when unset. */
+  readonly bio: string | null;
+  readonly size: string | null; /** #1061 / ADR-0014: logo serving URL resolved at read time; null when unset. */
+  readonly logoUrl: string | null;
 };
 interface OrganizationAccount {
   readonly id: string;
@@ -2453,6 +2482,30 @@ interface CurrentUserMethods {
   }): Promise<CapxulResult<CurrentUserContext>>;
 }
 //#endregion
+//#region src/client/media.d.ts
+interface MediaMethods {
+  uploadImage(blob: Blob, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<{
+    readonly storageId: string;
+  }>>;
+  setProfileImage(input: {
+    readonly storageId: string;
+  }, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<{
+    readonly imageUrl: string | null;
+  }>>;
+  setOrgLogo(input: {
+    readonly orgId: string;
+    readonly storageId: string;
+  }, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<{
+    readonly logoUrl: string | null;
+  }>>;
+}
+//#endregion
 //#region src/client/sub-accounts.d.ts
 interface SubAccountsMethods {
   create(accountId: AccountId, input: {
@@ -2484,6 +2537,8 @@ interface SubAccountsMethods {
  * `profile.withdrawalAddress`
  * is the OPTIONAL cash-out destination — a `0x`-prefixed 20-byte address string
  * (the one allowed raw-0x class), validated + normalized at the boundary.
+ * `profile.username` (#1062) is the OPTIONAL globally-unique handle —
+ * store-when-present, normalized + uniqueness-checked by the backend.
  */
 type CompletePersonalOnboardingInput = {
   readonly profile: ProfileInput;
@@ -2493,11 +2548,15 @@ type ProfileInput = {
   readonly displayName: string;
   readonly country: CountryCode;
   readonly withdrawalAddress?: EvmAddress;
+  readonly username?: string;
 };
+/** `bio` + `size` (#1064) are the optional onboarding-collected org details. */
 type OrganizationInput = {
   readonly name: string;
   readonly handle: string;
   readonly country: CountryCode;
+  readonly bio?: string;
+  readonly size?: string;
 };
 /**
  * Input to `capxul.onboarding.completeOrganization`. `organization.handle` is
@@ -2603,6 +2662,10 @@ interface CapxulClient {
    * stale-state / scope guards are enforced backend-side.
    */
   readonly workbench: WorkbenchMethods;
+  /**
+   * Media surface (#1061 / ADR-0014): profile-image + org-logo upload/record.
+   */
+  readonly media: MediaMethods;
   /** Sub-account lifecycle (M2 Slice S2a · #267). Transfer lands in S2b. */
   readonly subAccounts: SubAccountsMethods;
   /**
@@ -2949,5 +3012,5 @@ declare function captureException(telemetry: TelemetryPort, error: unknown, cont
  */
 declare function captureExceptionSync(telemetry: TelemetryPort, error: unknown, context?: HandledErrorReportContext): void;
 //#endregion
-export { type Account, type AccountId, type AccountLifecycle, type AccountMethods, type AccountProvider, type AccountProviderSource, type AccountRequirement, type AccountSetupStep, type AccountsMethods, type ActivityItem, type ActivityListParams, type ActivityMethods, type ActivityPage, type ActorProfile, type ActorProfileMethods, type ActorReference, type ActorRelationshipMethods, type ActorRequest, type ActorRequestIssueInput, type ActorRequestsMethods, type Address, type AddressBookAddInput, type AddressBookEntry, type AddressBookLabelInput, type AddressBookMethods, type AssignRoleInput, type AuthMethods, type AuthSession, type AuthUserId, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, type CapxulClient, type CapxulClientInput, type CapxulDigestSigner, CapxulError, type CapxulErrorCode, type CapxulErrorDetails, type CapxulResult, type CapxulSigner, type CompleteOrganizationOnboardingInput, type CompleteOrganizationOnboardingResult, type CompletePersonalOnboardingInput, type CompletePersonalOnboardingResult, type CountryCode, type CreateCapxulClientInput, type CreateOrgInput, type CurrentUserContext, type CurrentUserMethods, type DepositInstructions, type Destination, type DestinationAddInput, type DestinationKind, type DestinationListInput, type DestinationPayload, type DestinationRail, type DestinationRemoveInput, type DestinationsMethods, type DetectPendingOrgInvitationsResult, type DevPrivateKeySignerInput, type Eip1193Provider, type Eip1193RequestProvider, type EvmAddress, type FinancialOpsMethods, type HandledErrorReportContext, type HandlesMethods, type IdentityMethods, type InboxApproveInput, type InboxItem, type InboxMethods, type InsightsMethods, type InsightsSummary, type InviteMemberInput, type MeMethods, type MeProfile, type MemberStatus, type MemberView, type Money, type ObservationAdapter, type ObservationContext, type ObservationDelivery, type OfframpMethods, type OfframpQuote, type OfframpQuoteInput, type OfframpStatus, type OnboardingMethods, type OpenfortEmbeddedSignerInput, type OpenfortEmbeddedWalletApi, type OpenfortEmbeddedWalletPort, type OrgBatchPayrollInput, type OrgId, type OrgLifecycle, type OrgMethods, type OrgPayrollRun, type OrgScopedMethods, type OrgSetupStep, type OrgSpendViaPaymentsInput, type OrgTemplate, type OrgView, type OrganizationAccount, type OrganizationAuditLogItem, type OrganizationInput, type Payee, type PayeesMethods, type Payment, type PaymentDocumentRef, type PaymentDocumentRender, type PaymentDocumentVerification, type PaymentDocumentsMethods, type PaymentDraft, type PaymentDraftStatus, type PaymentMoney, type PaymentRequest, type PaymentRequestStatus, type PaymentRequestsCreateInput, type PaymentRequestsMethods, type PaymentSettlementInput, type PaymentStatus, type PaymentTiming, type PaymentType, type PaymentsMethods, type PaymentsPayInput, type PaymentsPayoutInput, type PaymentsWithdrawInput, type PayrollMethods, type PayrollPayslipTemplate, type PayrollRosterAddInput, type PayrollRosterLine, type PayrollRunInput, type PostHogObservationClient, type PostHogObservationOptions, type PostHogTelemetryClient, type PostHogTelemetryOptions, type Profile, type ProfileInput, type RecipientResolution, type RecipientResolutionKind, type ReconciliationEntry, type Ref, type RemoveMemberInput, type ResendInviteTokenInput, type ResolvedTarget, type RoleDefinition, type RoleKey, type RoleSpendCap, type RoleView, type SdkFailureObservation, type Session, type SmartAccount, type SmartAccountMethods, type SubAccount, type SubAccountId, type SubAccountsMethods, type TargetReference, type TargetsMethods, type TelemetryPort, type TransferEndpoint, type TransferInput, type TransferResult, type WorkbenchDraftInput, type WorkbenchExecuteInput, type WorkbenchMethods, type WorkbenchMintResult, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fromPostHog, injectedWalletSigner, isCapxulError, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, telemetryFromPostHog, toCountryCode, toAddress as toEvmAddress };
+export { type Account, type AccountId, type AccountLifecycle, type AccountMethods, type AccountProvider, type AccountProviderSource, type AccountRequirement, type AccountSetupStep, type AccountsMethods, type ActivityItem, type ActivityListParams, type ActivityMethods, type ActivityPage, type ActorProfile, type ActorProfileMethods, type ActorReference, type ActorRelationshipMethods, type ActorRequest, type ActorRequestIssueInput, type ActorRequestsMethods, type Address, type AddressBookAddInput, type AddressBookEntry, type AddressBookLabelInput, type AddressBookMethods, type AssignRoleInput, type AuthMethods, type AuthSession, type AuthUserId, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, type CapxulClient, type CapxulClientInput, type CapxulDigestSigner, CapxulError, type CapxulErrorCode, type CapxulErrorDetails, type CapxulResult, type CapxulSigner, type CompleteOrganizationOnboardingInput, type CompleteOrganizationOnboardingResult, type CompletePersonalOnboardingInput, type CompletePersonalOnboardingResult, type CountryCode, type CreateCapxulClientInput, type CreateOrgInput, type CurrentUserContext, type CurrentUserMethods, type DepositInstructions, type Destination, type DestinationAddInput, type DestinationKind, type DestinationListInput, type DestinationPayload, type DestinationRail, type DestinationRemoveInput, type DestinationsMethods, type DetectPendingOrgInvitationsResult, type DevPrivateKeySignerInput, type Eip1193Provider, type Eip1193RequestProvider, type EvmAddress, type FinancialOpsMethods, type HandledErrorReportContext, type HandlesMethods, type IdentityMethods, type InboxApproveInput, type InboxItem, type InboxMethods, type InsightsMethods, type InsightsSummary, type InviteMemberInput, type MeMethods, type MeProfile, type MediaMethods, type MemberStatus, type MemberView, type Money, type ObservationAdapter, type ObservationContext, type ObservationDelivery, type OfframpMethods, type OfframpQuote, type OfframpQuoteInput, type OfframpStatus, type OnboardingMethods, type OpenfortEmbeddedSignerInput, type OpenfortEmbeddedWalletApi, type OpenfortEmbeddedWalletPort, type OrgBatchPayrollInput, type OrgId, type OrgLifecycle, type OrgMethods, type OrgPayrollRun, type OrgScopedMethods, type OrgSetupStep, type OrgSpendViaPaymentsInput, type OrgTemplate, type OrgView, type OrganizationAccount, type OrganizationAuditLogItem, type OrganizationInput, type Payee, type PayeesMethods, type Payment, type PaymentDocumentRef, type PaymentDocumentRender, type PaymentDocumentVerification, type PaymentDocumentsMethods, type PaymentDraft, type PaymentDraftStatus, type PaymentMoney, type PaymentRequest, type PaymentRequestStatus, type PaymentRequestsCreateInput, type PaymentRequestsMethods, type PaymentSettlementInput, type PaymentStatus, type PaymentTiming, type PaymentType, type PaymentsMethods, type PaymentsPayInput, type PaymentsPayoutInput, type PaymentsWithdrawInput, type PayrollMethods, type PayrollPayslipTemplate, type PayrollRosterAddInput, type PayrollRosterLine, type PayrollRunInput, type PostHogObservationClient, type PostHogObservationOptions, type PostHogTelemetryClient, type PostHogTelemetryOptions, type Profile, type ProfileInput, type RecipientResolution, type RecipientResolutionKind, type ReconciliationEntry, type Ref, type RemoveMemberInput, type ResendInviteTokenInput, type ResolvedTarget, type RoleDefinition, type RoleKey, type RoleSpendCap, type RoleView, type SdkFailureObservation, type Session, type SmartAccount, type SmartAccountMethods, type SubAccount, type SubAccountId, type SubAccountsMethods, type TargetReference, type TargetsMethods, type TelemetryPort, type TransferEndpoint, type TransferInput, type TransferResult, type WorkbenchDraftInput, type WorkbenchExecuteInput, type WorkbenchMethods, type WorkbenchMintResult, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fromPostHog, injectedWalletSigner, isCapxulError, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, telemetryFromPostHog, toCountryCode, toAddress as toEvmAddress };
 //# sourceMappingURL=index.d.mts.map