@capxul/sdk 1.0.0-alpha.9 → 1.2.0

package/dist/node/index.d.mts

@@ -1,12 +1,9 @@
-import { s as AuthSession } from "../index-CTXgQ_xR.mjs";
-import { _ as CachedJwt, g as AuthCachePortTag, h as AuthCachePort, m as AuthCacheError, t as CapxulSigner } from "../signer-DqDtJU1l.mjs";
+import { T as AuthSession, _ as AuthCachePortTag, g as AuthCachePort, h as AuthCacheError, n as CapxulSigner, v as CachedJwt } from "../signer-CJT0pPiO.mjs";
 import { Hex } from "viem";
-import { Effect, Layer } from "effect";
-import * as PlatformFileSystem from "@effect/platform/FileSystem";
-import * as PlatformPath from "@effect/platform/Path";
+import { Effect, FileSystem, Layer, Path } from "effect";
 
 //#region src/adapters/auth-cache/FileSystemAuthCacheAdapter.d.ts
-type FileSystemRuntime = PlatformFileSystem.FileSystem | PlatformPath.Path;
+type FileSystemRuntime = FileSystem.FileSystem | Path.Path;
 declare class FileSystemAuthCacheAdapter implements AuthCachePort {
   private readonly path;
   private readonly runtime;

package/dist/node/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/adapters/auth-cache/FileSystemAuthCacheAdapter.ts","../../src/node/index.ts"],"mappings":";;;;;;;;KAqBK,iBAAA,GAAoB,kBAAA,CAAmB,UAAA,GAAa,YAAA,CAAa,IAAI;AAAA,cAQ7D,0BAAA,YAAsC,aAAA;EAAA,iBAChC,IAAA;EAAA,iBACA,OAAA;EAAA,SACR,UAAA,EAAY,MAAA,CAAO,MAAA,CAAO,WAAA,SAAoB,cAAA;EAAA,SAC9C,UAAA,GAAa,OAAA,EAAS,WAAA,KAAgB,MAAA,CAAO,MAAA,OAAa,cAAA;EAAA,SAC1D,YAAA,EAAc,MAAA,CAAO,MAAA,OAAa,cAAA;EAAA,SAClC,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO,SAAA,SAAkB,cAAA;EAAA,SACxC,MAAA,GAAS,GAAA,EAAK,SAAA,KAAc,MAAA,CAAO,MAAA,OAAa,cAAA;EAAA,SAChD,QAAA,EAAU,MAAA,CAAO,MAAA,OAAa,cAAA;cAE3B,IAAA,UAAc,OAAA,GAAS,KAAA,CAAM,KAAA,CAAM,iBAAA;EAAA,QAyCvC,IAAA;EAAA,QAyBA,KAAA;EAAA,QAgBA,GAAA;AAAA;AAAA,iBAWM,wBAAA,CAAyB,KAAA;EAAA,SAC9B,IAAA;EAAA,SACA,OAAA,GAAU,KAAA,CAAM,KAAA,CAAM,iBAAA;AAAA,IAC7B,KAAA,CAAM,KAAA,CAAM,gBAAA,EAAkB,cAAA;;;UC9GjB,iCAAA;EAAA,SACN,aAAA;EAAA,SACA,oBAAoB;AAAA;ADdC;;;;;AAAA,iBCsBhB,qBAAA,CAAsB,KAAA;EAAA,SAAkB,UAAA,EAAY,GAAA;AAAA,IAAQ,YAAY;;ADdd;AAQ1E;;;;;;;;iBC+BgB,0BAAA,CACd,OAAA,GAAS,iCAAA,GACR,aAAa"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/adapters/auth-cache/FileSystemAuthCacheAdapter.ts","../../src/node/index.ts"],"mappings":";;;;;KAwBK,iBAAA,GAAoB,UAAA,CAAmB,UAAA,GAAa,IAAA,CAAa,IAAI;AAAA,cAQ7D,0BAAA,YAAsC,aAAA;EAAA,iBAChC,IAAA;EAAA,iBACA,OAAA;EAAA,SACR,UAAA,EAAY,MAAA,CAAO,MAAA,CAAO,WAAA,SAAoB,cAAA;EAAA,SAC9C,UAAA,GAAa,OAAA,EAAS,WAAA,KAAgB,MAAA,CAAO,MAAA,OAAa,cAAA;EAAA,SAC1D,YAAA,EAAc,MAAA,CAAO,MAAA,OAAa,cAAA;EAAA,SAClC,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO,SAAA,SAAkB,cAAA;EAAA,SACxC,MAAA,GAAS,GAAA,EAAK,SAAA,KAAc,MAAA,CAAO,MAAA,OAAa,cAAA;EAAA,SAChD,QAAA,EAAU,MAAA,CAAO,MAAA,OAAa,cAAA;cAE3B,IAAA,UAAc,OAAA,GAAS,KAAA,CAAM,KAAA,CAAM,iBAAA;EAAA,QA0CvC,IAAA;EAAA,QA0BA,KAAA;EAAA,QAiBA,GAAA;AAAA;AAAA,iBAWM,wBAAA,CAAyB,KAAA;EAAA,SAC9B,IAAA;EAAA,SACA,OAAA,GAAU,KAAA,CAAM,KAAA,CAAM,iBAAA;AAAA,IAC7B,KAAA,CAAM,KAAA,CAAM,gBAAA,EAAkB,cAAA;;;UCpHjB,iCAAA;EAAA,SACN,aAAA;EAAA,SACA,oBAAoB;AAAA;;;;;;iBAQf,qBAAA,CAAsB,KAAA;EAAA,SAAkB,UAAA,EAAY,GAAA;AAAA,IAAQ,YAAY;;;;;;;;;;;iBAyBxE,0BAAA,CACd,OAAA,GAAS,iCAAA,GACR,aAAa"}

package/dist/node/index.mjs

@@ -1,12 +1,9 @@
-import { a as AuthCacheError, f as toAddress, i as parseCachedJwt, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, r as parseAuthSession, t as InMemoryAuthCacheAdapter } from "../InMemoryAuthCacheAdapter-v5W-XB5M.mjs";
-import { Effect, Layer } from "effect";
+import { a as AuthCacheError, f as toAddress, i as parseCachedJwt, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, r as parseAuthSession, t as InMemoryAuthCacheAdapter } from "../InMemoryAuthCacheAdapter-Dr1sEd9y.mjs";
+import { Effect, FileSystem, Layer, Path } from "effect";
 import { privateKeyToAccount } from "viem/accounts";
 import * as os from "node:os";
 import { join } from "node:path";
-import * as PlatformFileSystem from "@effect/platform/FileSystem";
-import * as PlatformPath from "@effect/platform/Path";
-import * as NodeFileSystem from "@effect/platform-node/NodeFileSystem";
-import * as NodePath from "@effect/platform-node/NodePath";
+import { NodeFileSystem, NodePath } from "@effect/platform-node";
 //#region src/adapters/auth-cache/FileSystemAuthCacheAdapter.ts
 function emptyPayload() {
 	return {
@@ -27,42 +24,44 @@ var FileSystemAuthCacheAdapter = class {
 	constructor(path, runtime = nodeFileSystemRuntime) {
 		this.path = path;
 		this.runtime = runtime;
+		const self = this;
 		this.getSession = this.run("getSession", this.read().pipe(Effect.map((payload) => payload.session)));
-		this.setSession = (session) => this.run("setSession", Effect.gen(this, function* () {
-			const cur = yield* this.read();
-			yield* this.write({
+		this.setSession = (session) => this.run("setSession", Effect.gen(function* () {
+			const cur = yield* self.read();
+			yield* self.write({
 				session,
 				jwt: cur.jwt
 			});
 		}));
-		this.clearSession = this.run("clearSession", Effect.gen(this, function* () {
-			const cur = yield* this.read();
-			yield* this.write({
+		this.clearSession = this.run("clearSession", Effect.gen(function* () {
+			const cur = yield* self.read();
+			yield* self.write({
 				session: null,
 				jwt: cur.jwt
 			});
 		}));
 		this.getJwt = this.run("getJwt", this.read().pipe(Effect.map((payload) => payload.jwt)));
-		this.setJwt = (jwt) => this.run("setJwt", Effect.gen(this, function* () {
-			const cur = yield* this.read();
-			yield* this.write({
+		this.setJwt = (jwt) => this.run("setJwt", Effect.gen(function* () {
+			const cur = yield* self.read();
+			yield* self.write({
 				session: cur.session,
 				jwt
 			});
 		}));
-		this.clearJwt = this.run("clearJwt", Effect.gen(this, function* () {
-			const cur = yield* this.read();
-			yield* this.write({
+		this.clearJwt = this.run("clearJwt", Effect.gen(function* () {
+			const cur = yield* self.read();
+			yield* self.write({
 				session: cur.session,
 				jwt: null
 			});
 		}));
 	}
 	read() {
-		return Effect.gen(this, function* () {
-			const fs = yield* PlatformFileSystem.FileSystem;
-			if (!(yield* fs.exists(this.path))) return emptyPayload();
-			const raw = yield* fs.readFileString(this.path, "utf-8");
+		const self = this;
+		return Effect.gen(function* () {
+			const fs = yield* FileSystem.FileSystem;
+			if (!(yield* fs.exists(self.path))) return emptyPayload();
+			const raw = yield* fs.readFileString(self.path, "utf-8");
 			let parsed;
 			try {
 				parsed = JSON.parse(raw);
@@ -78,15 +77,16 @@ var FileSystemAuthCacheAdapter = class {
 		});
 	}
 	write(payload) {
-		return Effect.gen(this, function* () {
-			const fs = yield* PlatformFileSystem.FileSystem;
-			const dir = (yield* PlatformPath.Path).dirname(this.path);
+		const self = this;
+		return Effect.gen(function* () {
+			const fs = yield* FileSystem.FileSystem;
+			const dir = (yield* Path.Path).dirname(self.path);
 			if (!(yield* fs.exists(dir))) yield* fs.makeDirectory(dir, {
 				recursive: true,
 				mode: 448
 			});
-			yield* fs.writeFileString(this.path, JSON.stringify(payload), { mode: 384 });
-			yield* fs.chmod(this.path, 384);
+			yield* fs.writeFileString(self.path, JSON.stringify(payload), { mode: 384 });
+			yield* fs.chmod(self.path, 384);
 		});
 	}
 	run(operation, effect) {

package/dist/node/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/adapters/auth-cache/FileSystemAuthCacheAdapter.ts","../../src/node/index.ts"],"sourcesContent":["import type * as PlatformError from \"@effect/platform/Error\";\nimport * as PlatformFileSystem from \"@effect/platform/FileSystem\";\nimport * as PlatformPath from \"@effect/platform/Path\";\nimport * as NodeFileSystem from \"@effect/platform-node/NodeFileSystem\";\nimport * as NodePath from \"@effect/platform-node/NodePath\";\nimport { Effect, Layer } from \"effect\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport {\n  AuthCacheError,\n  AuthCachePortTag,\n  type AuthCachePort,\n  type CachedJwt,\n} from \"../../ports/auth-cache\";\nimport { parseAuthSession, parseCachedJwt } from \"./serialization\";\n\ninterface FilePayload {\n  readonly session: AuthSession | null;\n  readonly jwt: CachedJwt | null;\n}\n\ntype FileSystemRuntime = PlatformFileSystem.FileSystem | PlatformPath.Path;\n\nfunction emptyPayload(): FilePayload {\n  return { session: null, jwt: null };\n}\n\nconst nodeFileSystemRuntime = Layer.merge(NodeFileSystem.layer, NodePath.layer);\n\nexport class FileSystemAuthCacheAdapter implements AuthCachePort {\n  private readonly path: string;\n  private readonly runtime: Layer.Layer<FileSystemRuntime>;\n  readonly getSession: Effect.Effect<AuthSession | null, AuthCacheError>;\n  readonly setSession: (session: AuthSession) => Effect.Effect<void, AuthCacheError>;\n  readonly clearSession: Effect.Effect<void, AuthCacheError>;\n  readonly getJwt: Effect.Effect<CachedJwt | null, AuthCacheError>;\n  readonly setJwt: (jwt: CachedJwt) => Effect.Effect<void, AuthCacheError>;\n  readonly clearJwt: Effect.Effect<void, AuthCacheError>;\n\n  constructor(path: string, runtime: Layer.Layer<FileSystemRuntime> = nodeFileSystemRuntime) {\n    this.path = path;\n    this.runtime = runtime;\n\n    this.getSession = this.run(\n      \"getSession\",\n      this.read().pipe(Effect.map((payload) => payload.session)),\n    );\n    this.setSession = (session: AuthSession) =>\n      this.run(\n        \"setSession\",\n        Effect.gen(this, function* () {\n          const cur = yield* this.read();\n          yield* this.write({ session, jwt: cur.jwt });\n        }),\n      );\n    this.clearSession = this.run(\n      \"clearSession\",\n      Effect.gen(this, function* () {\n        const cur = yield* this.read();\n        yield* this.write({ session: null, jwt: cur.jwt });\n      }),\n    );\n    this.getJwt = this.run(\"getJwt\", this.read().pipe(Effect.map((payload) => payload.jwt)));\n    this.setJwt = (jwt: CachedJwt) =>\n      this.run(\n        \"setJwt\",\n        Effect.gen(this, function* () {\n          const cur = yield* this.read();\n          yield* this.write({ session: cur.session, jwt });\n        }),\n      );\n    this.clearJwt = this.run(\n      \"clearJwt\",\n      Effect.gen(this, function* () {\n        const cur = yield* this.read();\n        yield* this.write({ session: cur.session, jwt: null });\n      }),\n    );\n  }\n\n  private read(): Effect.Effect<FilePayload, PlatformError.PlatformError, FileSystemRuntime> {\n    return Effect.gen(this, function* () {\n      const fs = yield* PlatformFileSystem.FileSystem;\n      const exists = yield* fs.exists(this.path);\n      if (!exists) return emptyPayload();\n      const raw = yield* fs.readFileString(this.path, \"utf-8\");\n\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(raw);\n      } catch {\n        return emptyPayload();\n      }\n      if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n        return emptyPayload();\n      }\n      const payload = parsed as { readonly session?: unknown; readonly jwt?: unknown };\n\n      return {\n        session: parseAuthSession(payload.session),\n        jwt: parseCachedJwt(payload.jwt),\n      };\n    });\n  }\n\n  private write(\n    payload: FilePayload,\n  ): Effect.Effect<void, PlatformError.PlatformError, FileSystemRuntime> {\n    return Effect.gen(this, function* () {\n      const fs = yield* PlatformFileSystem.FileSystem;\n      const path = yield* PlatformPath.Path;\n      const dir = path.dirname(this.path);\n      const dirExists = yield* fs.exists(dir);\n      if (!dirExists) {\n        yield* fs.makeDirectory(dir, { recursive: true, mode: 0o700 });\n      }\n      yield* fs.writeFileString(this.path, JSON.stringify(payload), { mode: 0o600 });\n      yield* fs.chmod(this.path, 0o600);\n    });\n  }\n\n  private run<T>(\n    operation: string,\n    effect: Effect.Effect<T, PlatformError.PlatformError, FileSystemRuntime>,\n  ): Effect.Effect<T, AuthCacheError> {\n    return effect.pipe(\n      Effect.mapError((cause) => toAuthCacheError(operation, cause)),\n      Effect.provide(this.runtime),\n    );\n  }\n}\n\nexport function FileSystemAuthCacheLayer(input: {\n  readonly path: string;\n  readonly runtime?: Layer.Layer<FileSystemRuntime>;\n}): Layer.Layer<AuthCachePortTag, AuthCacheError> {\n  return Layer.effect(\n    AuthCachePortTag,\n    Effect.sync(() => new FileSystemAuthCacheAdapter(input.path, input.runtime)).pipe(\n      Effect.mapError((cause) => toAuthCacheError(\"initialize\", cause)),\n    ),\n  );\n}\n\nfunction toAuthCacheError(operation: string, cause: unknown): AuthCacheError {\n  return new AuthCacheError({ operation, cause });\n}\n","// `@capxul/sdk/node` — node-only entry (published-package-boundaries.md).\n//\n// The default `@capxul/sdk` entry is browser-clean: it never statically reaches\n// `@effect/platform-node`. Node consumers import the on-disk auth cache and the\n// node key `CapxulSigner` from here.\n\nimport * as os from \"node:os\";\nimport { join } from \"node:path\";\n\nimport { toAddress } from \"@capxul/types\";\nimport { privateKeyToAccount } from \"viem/accounts\";\nimport type { Hex } from \"viem\";\n\nimport { BrowserAuthCacheAdapter } from \"../adapters/auth-cache/BrowserAuthCacheAdapter\";\nimport { FileSystemAuthCacheAdapter } from \"../adapters/auth-cache/FileSystemAuthCacheAdapter\";\nimport { InMemoryAuthCacheAdapter } from \"../adapters/auth-cache/InMemoryAuthCacheAdapter\";\nimport type { WindowLike } from \"../client/window-like\";\nimport type { AuthCachePort } from \"../ports/auth-cache\";\nimport type { CapxulSigner } from \"../signer\";\n\nexport {\n  FileSystemAuthCacheAdapter,\n  FileSystemAuthCacheLayer,\n} from \"../adapters/auth-cache/FileSystemAuthCacheAdapter\";\n\nexport interface DetectNodeAuthCacheAdapterOptions {\n  readonly authCachePath?: string;\n  readonly resolveHomeDirectory?: () => string;\n}\n\n/**\n * Node `CapxulSigner` backed by a raw private key. Signs the EIP-712 `SafeOp`\n * digest the backend returns for a prepared deployment UserOperation. The\n * reference CLI builds this from `DEPLOYER_PRIVATE_KEY` for the live capstone.\n */\nexport function localPrivateKeySigner(input: { readonly privateKey: Hex }): CapxulSigner {\n  const account = privateKeyToAccount(input.privateKey);\n  return {\n    source: \"local-private-key\",\n    async getAddress() {\n      return toAddress(account.address);\n    },\n    async signUserOpHash(hash: Hex): Promise<Hex> {\n      // `sign({ hash })` signs the already-computed SafeOp digest directly.\n      // `signMessage({ message: { raw: hash } })` would add an EIP-191 prefix.\n      return account.sign({ hash });\n    },\n  };\n}\n\n/**\n * Node-aware auth-cache detection. Mirrors the historic default order:\n * 1. Browser localStorage → BrowserAuthCacheAdapter\n * 2. Node.js process → FileSystemAuthCacheAdapter\n *    (`~/.config/capxul/auth-cache.json`)\n * 3. Neither detected → InMemoryAuthCacheAdapter\n *\n * Use this from a Node entrypoint and pass the result to\n * `createCapxulClient({ authCache })` for on-disk session persistence.\n */\nexport function detectNodeAuthCacheAdapter(\n  options: DetectNodeAuthCacheAdapterOptions = {},\n): AuthCachePort {\n  const globalAny = globalThis as unknown as {\n    readonly window?: WindowLike;\n    readonly process?: { readonly versions?: { readonly node?: string } };\n  };\n  if (globalAny.window?.localStorage !== undefined) {\n    return new BrowserAuthCacheAdapter(globalAny.window.localStorage);\n  }\n  if (globalAny.process?.versions?.node !== undefined) {\n    const authCachePath =\n      normalizeConfiguredAuthCachePath(options.authCachePath) ??\n      resolveDefaultAuthCachePath(options.resolveHomeDirectory ?? os.homedir);\n    if (authCachePath !== null) return new FileSystemAuthCacheAdapter(authCachePath);\n  }\n  return new InMemoryAuthCacheAdapter();\n}\n\nfunction normalizeConfiguredAuthCachePath(path: string | undefined): string | null {\n  if (path === undefined) return null;\n  const trimmed = path.trim();\n  return trimmed.length > 0 ? trimmed : null;\n}\n\nfunction resolveDefaultAuthCachePath(resolveHomeDirectory: () => string): string | null {\n  try {\n    return join(resolveHomeDirectory(), \".config\", \"capxul\", \"auth-cache.json\");\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";;;;;;;;;;AAuBA,SAAS,eAA4B;CACnC,OAAO;EAAE,SAAS;EAAM,KAAK;CAAK;AACpC;AAEA,MAAM,wBAAwB,MAAM,MAAM,eAAe,OAAO,SAAS,KAAK;AAE9E,IAAa,6BAAb,MAAiE;CAC/D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,MAAc,UAA0C,uBAAuB;EACzF,KAAK,OAAO;EACZ,KAAK,UAAU;EAEf,KAAK,aAAa,KAAK,IACrB,cACA,KAAK,KAAK,EAAE,KAAK,OAAO,KAAK,YAAY,QAAQ,OAAO,CAAC,CAC3D;EACA,KAAK,cAAc,YACjB,KAAK,IACH,cACA,OAAO,IAAI,MAAM,aAAa;GAC5B,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE;IAAS,KAAK,IAAI;GAAI,CAAC;EAC7C,CAAC,CACH;EACF,KAAK,eAAe,KAAK,IACvB,gBACA,OAAO,IAAI,MAAM,aAAa;GAC5B,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE,SAAS;IAAM,KAAK,IAAI;GAAI,CAAC;EACnD,CAAC,CACH;EACA,KAAK,SAAS,KAAK,IAAI,UAAU,KAAK,KAAK,EAAE,KAAK,OAAO,KAAK,YAAY,QAAQ,GAAG,CAAC,CAAC;EACvF,KAAK,UAAU,QACb,KAAK,IACH,UACA,OAAO,IAAI,MAAM,aAAa;GAC5B,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE,SAAS,IAAI;IAAS;GAAI,CAAC;EACjD,CAAC,CACH;EACF,KAAK,WAAW,KAAK,IACnB,YACA,OAAO,IAAI,MAAM,aAAa;GAC5B,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE,SAAS,IAAI;IAAS,KAAK;GAAK,CAAC;EACvD,CAAC,CACH;CACF;CAEA,OAA2F;EACzF,OAAO,OAAO,IAAI,MAAM,aAAa;GACnC,MAAM,KAAK,OAAO,mBAAmB;GAErC,IAAI,EAAC,OADiB,GAAG,OAAO,KAAK,IAAI,IAC5B,OAAO,aAAa;GACjC,MAAM,MAAM,OAAO,GAAG,eAAe,KAAK,MAAM,OAAO;GAEvD,IAAI;GACJ,IAAI;IACF,SAAS,KAAK,MAAM,GAAG;GACzB,QAAQ;IACN,OAAO,aAAa;GACtB;GACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GACvE,OAAO,aAAa;GAEtB,MAAM,UAAU;GAEhB,OAAO;IACL,SAAS,iBAAiB,QAAQ,OAAO;IACzC,KAAK,eAAe,QAAQ,GAAG;GACjC;EACF,CAAC;CACH;CAEA,MACE,SACqE;EACrE,OAAO,OAAO,IAAI,MAAM,aAAa;GACnC,MAAM,KAAK,OAAO,mBAAmB;GAErC,MAAM,OAAM,OADQ,aAAa,MAChB,QAAQ,KAAK,IAAI;GAElC,IAAI,EAAC,OADoB,GAAG,OAAO,GAAG,IAEpC,OAAO,GAAG,cAAc,KAAK;IAAE,WAAW;IAAM,MAAM;GAAM,CAAC;GAE/D,OAAO,GAAG,gBAAgB,KAAK,MAAM,KAAK,UAAU,OAAO,GAAG,EAAE,MAAM,IAAM,CAAC;GAC7E,OAAO,GAAG,MAAM,KAAK,MAAM,GAAK;EAClC,CAAC;CACH;CAEA,IACE,WACA,QACkC;EAClC,OAAO,OAAO,KACZ,OAAO,UAAU,UAAU,iBAAiB,WAAW,KAAK,CAAC,GAC7D,OAAO,QAAQ,KAAK,OAAO,CAC7B;CACF;AACF;AAEA,SAAgB,yBAAyB,OAGS;CAChD,OAAO,MAAM,OACX,kBACA,OAAO,WAAW,IAAI,2BAA2B,MAAM,MAAM,MAAM,OAAO,CAAC,EAAE,KAC3E,OAAO,UAAU,UAAU,iBAAiB,cAAc,KAAK,CAAC,CAClE,CACF;AACF;AAEA,SAAS,iBAAiB,WAAmB,OAAgC;CAC3E,OAAO,IAAI,eAAe;EAAE;EAAW;CAAM,CAAC;AAChD;;;;;;;;AC/GA,SAAgB,sBAAsB,OAAmD;CACvF,MAAM,UAAU,oBAAoB,MAAM,UAAU;CACpD,OAAO;EACL,QAAQ;EACR,MAAM,aAAa;GACjB,OAAO,UAAU,QAAQ,OAAO;EAClC;EACA,MAAM,eAAe,MAAyB;GAG5C,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC;EAC9B;CACF;AACF;;;;;;;;;;;AAYA,SAAgB,2BACd,UAA6C,CAAC,GAC/B;CACf,MAAM,YAAY;CAIlB,IAAI,UAAU,QAAQ,iBAAiB,KAAA,GACrC,OAAO,IAAI,wBAAwB,UAAU,OAAO,YAAY;CAElE,IAAI,UAAU,SAAS,UAAU,SAAS,KAAA,GAAW;EACnD,MAAM,gBACJ,iCAAiC,QAAQ,aAAa,KACtD,4BAA4B,QAAQ,wBAAwB,GAAG,OAAO;EACxE,IAAI,kBAAkB,MAAM,OAAO,IAAI,2BAA2B,aAAa;CACjF;CACA,OAAO,IAAI,yBAAyB;AACtC;AAEA,SAAS,iCAAiC,MAAyC;CACjF,IAAI,SAAS,KAAA,GAAW,OAAO;CAC/B,MAAM,UAAU,KAAK,KAAK;CAC1B,OAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,4BAA4B,sBAAmD;CACtF,IAAI;EACF,OAAO,KAAK,qBAAqB,GAAG,WAAW,UAAU,iBAAiB;CAC5E,QAAQ;EACN,OAAO;CACT;AACF"}
+{"version":3,"file":"index.mjs","names":["PlatformFileSystem","PlatformPath"],"sources":["../../src/adapters/auth-cache/FileSystemAuthCacheAdapter.ts","../../src/node/index.ts"],"sourcesContent":["/* oxlint-disable typescript/no-this-alias -- Effect.gen callbacks are generator functions, so adapter receivers are captured explicitly. */\nimport { NodeFileSystem, NodePath } from \"@effect/platform-node\";\nimport {\n  Effect,\n  FileSystem as PlatformFileSystem,\n  Layer,\n  Path as PlatformPath,\n  PlatformError,\n} from \"effect\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport {\n  AuthCacheError,\n  AuthCachePortTag,\n  type AuthCachePort,\n  type CachedJwt,\n} from \"../../ports/auth-cache\";\nimport { parseAuthSession, parseCachedJwt } from \"./serialization\";\n\ninterface FilePayload {\n  readonly session: AuthSession | null;\n  readonly jwt: CachedJwt | null;\n}\n\ntype FileSystemRuntime = PlatformFileSystem.FileSystem | PlatformPath.Path;\n\nfunction emptyPayload(): FilePayload {\n  return { session: null, jwt: null };\n}\n\nconst nodeFileSystemRuntime = Layer.merge(NodeFileSystem.layer, NodePath.layer);\n\nexport class FileSystemAuthCacheAdapter implements AuthCachePort {\n  private readonly path: string;\n  private readonly runtime: Layer.Layer<FileSystemRuntime>;\n  readonly getSession: Effect.Effect<AuthSession | null, AuthCacheError>;\n  readonly setSession: (session: AuthSession) => Effect.Effect<void, AuthCacheError>;\n  readonly clearSession: Effect.Effect<void, AuthCacheError>;\n  readonly getJwt: Effect.Effect<CachedJwt | null, AuthCacheError>;\n  readonly setJwt: (jwt: CachedJwt) => Effect.Effect<void, AuthCacheError>;\n  readonly clearJwt: Effect.Effect<void, AuthCacheError>;\n\n  constructor(path: string, runtime: Layer.Layer<FileSystemRuntime> = nodeFileSystemRuntime) {\n    this.path = path;\n    this.runtime = runtime;\n    const self = this;\n\n    this.getSession = this.run(\n      \"getSession\",\n      this.read().pipe(Effect.map((payload) => payload.session)),\n    );\n    this.setSession = (session: AuthSession) =>\n      this.run(\n        \"setSession\",\n        Effect.gen(function* () {\n          const cur = yield* self.read();\n          yield* self.write({ session, jwt: cur.jwt });\n        }),\n      );\n    this.clearSession = this.run(\n      \"clearSession\",\n      Effect.gen(function* () {\n        const cur = yield* self.read();\n        yield* self.write({ session: null, jwt: cur.jwt });\n      }),\n    );\n    this.getJwt = this.run(\"getJwt\", this.read().pipe(Effect.map((payload) => payload.jwt)));\n    this.setJwt = (jwt: CachedJwt) =>\n      this.run(\n        \"setJwt\",\n        Effect.gen(function* () {\n          const cur = yield* self.read();\n          yield* self.write({ session: cur.session, jwt });\n        }),\n      );\n    this.clearJwt = this.run(\n      \"clearJwt\",\n      Effect.gen(function* () {\n        const cur = yield* self.read();\n        yield* self.write({ session: cur.session, jwt: null });\n      }),\n    );\n  }\n\n  private read(): Effect.Effect<FilePayload, PlatformError.PlatformError, FileSystemRuntime> {\n    const self = this;\n    return Effect.gen(function* () {\n      const fs = yield* PlatformFileSystem.FileSystem;\n      const exists = yield* fs.exists(self.path);\n      if (!exists) return emptyPayload();\n      const raw = yield* fs.readFileString(self.path, \"utf-8\");\n\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(raw);\n      } catch {\n        return emptyPayload();\n      }\n      if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n        return emptyPayload();\n      }\n      const payload = parsed as { readonly session?: unknown; readonly jwt?: unknown };\n\n      return {\n        session: parseAuthSession(payload.session),\n        jwt: parseCachedJwt(payload.jwt),\n      };\n    });\n  }\n\n  private write(\n    payload: FilePayload,\n  ): Effect.Effect<void, PlatformError.PlatformError, FileSystemRuntime> {\n    const self = this;\n    return Effect.gen(function* () {\n      const fs = yield* PlatformFileSystem.FileSystem;\n      const path = yield* PlatformPath.Path;\n      const dir = path.dirname(self.path);\n      const dirExists = yield* fs.exists(dir);\n      if (!dirExists) {\n        yield* fs.makeDirectory(dir, { recursive: true, mode: 0o700 });\n      }\n      yield* fs.writeFileString(self.path, JSON.stringify(payload), { mode: 0o600 });\n      yield* fs.chmod(self.path, 0o600);\n    });\n  }\n\n  private run<T>(\n    operation: string,\n    effect: Effect.Effect<T, PlatformError.PlatformError, FileSystemRuntime>,\n  ): Effect.Effect<T, AuthCacheError> {\n    return effect.pipe(\n      Effect.mapError((cause) => toAuthCacheError(operation, cause)),\n      Effect.provide(this.runtime),\n    );\n  }\n}\n\nexport function FileSystemAuthCacheLayer(input: {\n  readonly path: string;\n  readonly runtime?: Layer.Layer<FileSystemRuntime>;\n}): Layer.Layer<AuthCachePortTag, AuthCacheError> {\n  return Layer.effect(\n    AuthCachePortTag,\n    Effect.sync(() => new FileSystemAuthCacheAdapter(input.path, input.runtime)).pipe(\n      Effect.mapError((cause) => toAuthCacheError(\"initialize\", cause)),\n    ),\n  );\n}\n\nfunction toAuthCacheError(operation: string, cause: unknown): AuthCacheError {\n  return new AuthCacheError({ operation, cause });\n}\n","// `@capxul/sdk/node` — node-only entry (published-package-boundaries.md).\n//\n// The default `@capxul/sdk` entry is browser-clean: it never statically reaches\n// `@effect/platform-node`. Node consumers import the on-disk auth cache and the\n// node key `CapxulSigner` from here.\n\nimport * as os from \"node:os\";\nimport { join } from \"node:path\";\n\nimport { toAddress } from \"@capxul/types\";\nimport { privateKeyToAccount } from \"viem/accounts\";\nimport type { Hex } from \"viem\";\n\nimport { BrowserAuthCacheAdapter } from \"../adapters/auth-cache/BrowserAuthCacheAdapter\";\nimport { FileSystemAuthCacheAdapter } from \"../adapters/auth-cache/FileSystemAuthCacheAdapter\";\nimport { InMemoryAuthCacheAdapter } from \"../adapters/auth-cache/InMemoryAuthCacheAdapter\";\nimport type { WindowLike } from \"../surface/window-like\";\nimport type { AuthCachePort } from \"../ports/auth-cache\";\nimport type { CapxulSigner } from \"../signer\";\n\nexport {\n  FileSystemAuthCacheAdapter,\n  FileSystemAuthCacheLayer,\n} from \"../adapters/auth-cache/FileSystemAuthCacheAdapter\";\n\nexport interface DetectNodeAuthCacheAdapterOptions {\n  readonly authCachePath?: string;\n  readonly resolveHomeDirectory?: () => string;\n}\n\n/**\n * Node `CapxulSigner` backed by a raw private key. Signs the EIP-712 `SafeOp`\n * digest the backend returns for a prepared deployment UserOperation. The\n * reference CLI builds this from `DEPLOYER_PRIVATE_KEY` for the live capstone.\n */\nexport function localPrivateKeySigner(input: { readonly privateKey: Hex }): CapxulSigner {\n  const account = privateKeyToAccount(input.privateKey);\n  return {\n    source: \"local-private-key\",\n    async getAddress() {\n      return toAddress(account.address);\n    },\n    async signUserOpHash(hash: Hex): Promise<Hex> {\n      // `sign({ hash })` signs the already-computed SafeOp digest directly.\n      // `signMessage({ message: { raw: hash } })` would add an EIP-191 prefix.\n      return account.sign({ hash });\n    },\n  };\n}\n\n/**\n * Node-aware auth-cache detection. Mirrors the historic default order:\n * 1. Browser localStorage → BrowserAuthCacheAdapter\n * 2. Node.js process → FileSystemAuthCacheAdapter\n *    (`~/.config/capxul/auth-cache.json`)\n * 3. Neither detected → InMemoryAuthCacheAdapter\n *\n * Use this from a Node entrypoint and pass the result to\n * `createCapxulClient({ authCache })` for on-disk session persistence.\n */\nexport function detectNodeAuthCacheAdapter(\n  options: DetectNodeAuthCacheAdapterOptions = {},\n): AuthCachePort {\n  const globalAny = globalThis as unknown as {\n    readonly window?: WindowLike;\n    readonly process?: { readonly versions?: { readonly node?: string } };\n  };\n  if (globalAny.window?.localStorage !== undefined) {\n    return new BrowserAuthCacheAdapter(globalAny.window.localStorage);\n  }\n  if (globalAny.process?.versions?.node !== undefined) {\n    const authCachePath =\n      normalizeConfiguredAuthCachePath(options.authCachePath) ??\n      resolveDefaultAuthCachePath(options.resolveHomeDirectory ?? os.homedir);\n    if (authCachePath !== null) return new FileSystemAuthCacheAdapter(authCachePath);\n  }\n  return new InMemoryAuthCacheAdapter();\n}\n\nfunction normalizeConfiguredAuthCachePath(path: string | undefined): string | null {\n  if (path === undefined) return null;\n  const trimmed = path.trim();\n  return trimmed.length > 0 ? trimmed : null;\n}\n\nfunction resolveDefaultAuthCachePath(resolveHomeDirectory: () => string): string | null {\n  try {\n    return join(resolveHomeDirectory(), \".config\", \"capxul\", \"auth-cache.json\");\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";;;;;;;AA0BA,SAAS,eAA4B;CACnC,OAAO;EAAE,SAAS;EAAM,KAAK;CAAK;AACpC;AAEA,MAAM,wBAAwB,MAAM,MAAM,eAAe,OAAO,SAAS,KAAK;AAE9E,IAAa,6BAAb,MAAiE;CAC/D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,MAAc,UAA0C,uBAAuB;EACzF,KAAK,OAAO;EACZ,KAAK,UAAU;EACf,MAAM,OAAO;EAEb,KAAK,aAAa,KAAK,IACrB,cACA,KAAK,KAAK,EAAE,KAAK,OAAO,KAAK,YAAY,QAAQ,OAAO,CAAC,CAC3D;EACA,KAAK,cAAc,YACjB,KAAK,IACH,cACA,OAAO,IAAI,aAAa;GACtB,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE;IAAS,KAAK,IAAI;GAAI,CAAC;EAC7C,CAAC,CACH;EACF,KAAK,eAAe,KAAK,IACvB,gBACA,OAAO,IAAI,aAAa;GACtB,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE,SAAS;IAAM,KAAK,IAAI;GAAI,CAAC;EACnD,CAAC,CACH;EACA,KAAK,SAAS,KAAK,IAAI,UAAU,KAAK,KAAK,EAAE,KAAK,OAAO,KAAK,YAAY,QAAQ,GAAG,CAAC,CAAC;EACvF,KAAK,UAAU,QACb,KAAK,IACH,UACA,OAAO,IAAI,aAAa;GACtB,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE,SAAS,IAAI;IAAS;GAAI,CAAC;EACjD,CAAC,CACH;EACF,KAAK,WAAW,KAAK,IACnB,YACA,OAAO,IAAI,aAAa;GACtB,MAAM,MAAM,OAAO,KAAK,KAAK;GAC7B,OAAO,KAAK,MAAM;IAAE,SAAS,IAAI;IAAS,KAAK;GAAK,CAAC;EACvD,CAAC,CACH;CACF;CAEA,OAA2F;EACzF,MAAM,OAAO;EACb,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,KAAK,OAAOA,WAAmB;GAErC,IAAI,EAAC,OADiB,GAAG,OAAO,KAAK,IAAI,IAC5B,OAAO,aAAa;GACjC,MAAM,MAAM,OAAO,GAAG,eAAe,KAAK,MAAM,OAAO;GAEvD,IAAI;GACJ,IAAI;IACF,SAAS,KAAK,MAAM,GAAG;GACzB,QAAQ;IACN,OAAO,aAAa;GACtB;GACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GACvE,OAAO,aAAa;GAEtB,MAAM,UAAU;GAEhB,OAAO;IACL,SAAS,iBAAiB,QAAQ,OAAO;IACzC,KAAK,eAAe,QAAQ,GAAG;GACjC;EACF,CAAC;CACH;CAEA,MACE,SACqE;EACrE,MAAM,OAAO;EACb,OAAO,OAAO,IAAI,aAAa;GAC7B,MAAM,KAAK,OAAOA,WAAmB;GAErC,MAAM,OAAM,OADQC,KAAa,MAChB,QAAQ,KAAK,IAAI;GAElC,IAAI,EAAC,OADoB,GAAG,OAAO,GAAG,IAEpC,OAAO,GAAG,cAAc,KAAK;IAAE,WAAW;IAAM,MAAM;GAAM,CAAC;GAE/D,OAAO,GAAG,gBAAgB,KAAK,MAAM,KAAK,UAAU,OAAO,GAAG,EAAE,MAAM,IAAM,CAAC;GAC7E,OAAO,GAAG,MAAM,KAAK,MAAM,GAAK;EAClC,CAAC;CACH;CAEA,IACE,WACA,QACkC;EAClC,OAAO,OAAO,KACZ,OAAO,UAAU,UAAU,iBAAiB,WAAW,KAAK,CAAC,GAC7D,OAAO,QAAQ,KAAK,OAAO,CAC7B;CACF;AACF;AAEA,SAAgB,yBAAyB,OAGS;CAChD,OAAO,MAAM,OACX,kBACA,OAAO,WAAW,IAAI,2BAA2B,MAAM,MAAM,MAAM,OAAO,CAAC,EAAE,KAC3E,OAAO,UAAU,UAAU,iBAAiB,cAAc,KAAK,CAAC,CAClE,CACF;AACF;AAEA,SAAS,iBAAiB,WAAmB,OAAgC;CAC3E,OAAO,IAAI,eAAe;EAAE;EAAW;CAAM,CAAC;AAChD;;;;;;;;ACrHA,SAAgB,sBAAsB,OAAmD;CACvF,MAAM,UAAU,oBAAoB,MAAM,UAAU;CACpD,OAAO;EACL,QAAQ;EACR,MAAM,aAAa;GACjB,OAAO,UAAU,QAAQ,OAAO;EAClC;EACA,MAAM,eAAe,MAAyB;GAG5C,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC;EAC9B;CACF;AACF;;;;;;;;;;;AAYA,SAAgB,2BACd,UAA6C,CAAC,GAC/B;CACf,MAAM,YAAY;CAIlB,IAAI,UAAU,QAAQ,iBAAiB,KAAA,GACrC,OAAO,IAAI,wBAAwB,UAAU,OAAO,YAAY;CAElE,IAAI,UAAU,SAAS,UAAU,SAAS,KAAA,GAAW;EACnD,MAAM,gBACJ,iCAAiC,QAAQ,aAAa,KACtD,4BAA4B,QAAQ,wBAAwB,GAAG,OAAO;EACxE,IAAI,kBAAkB,MAAM,OAAO,IAAI,2BAA2B,aAAa;CACjF;CACA,OAAO,IAAI,yBAAyB;AACtC;AAEA,SAAS,iCAAiC,MAAyC;CACjF,IAAI,SAAS,KAAA,GAAW,OAAO;CAC/B,MAAM,UAAU,KAAK,KAAK;CAC1B,OAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,4BAA4B,sBAAmD;CACtF,IAAI;EACF,OAAO,KAAK,qBAAqB,GAAG,WAAW,UAAU,iBAAiB;CAC5E,QAAQ;EACN,OAAO;CACT;AACF"}

package/dist/signer-CJT0pPiO.d.mts

@@ -0,0 +1,301 @@
+import { Account, Hex } from "viem";
+import { Context, Effect } from "effect";
+
+//#region ../errors/src/errors.d.ts
+declare const CAPXUL_ERROR_CODES: readonly ["NOT_AUTHENTICATED", "EMAIL_DELIVERY_FAILED", "PROFILE_NOT_FOUND", "SMART_ACCOUNT_MISSING", "PLAYER_NOT_FOUND", "ACCOUNT_NOT_FOUND", "PROVIDER_ERROR", "INVALID_INPUT", "ENV_MISSING", "NOT_IMPLEMENTED", "VERIFICATION_REQUIRED", "INSUFFICIENT_BALANCE", "INVALID_RECIPIENT", "ROLE_PERMISSION_DENIED", "TRANSACTION_FAILED", "RATE_LIMITED", "NETWORK_ERROR", "UNKNOWN", "OTP_EXPIRED", "SIGNER_REJECTED", "CANCELLED", "WRONG_STATE", "STALE_EPOCH", "SUPERSEDED", "WORK_DIED", "ACTOR_STOPPED"];
+type CapxulErrorCode = (typeof CAPXUL_ERROR_CODES)[number];
+/**
+ * Why an auth/provider call failed — a flat CAUSE enum. The *where* (which
+ * OpenFort operation) stays in the separate `operation` detail field; this
+ * names the root cause so a single `$exception` can be triaged without
+ * parsing the message. Five members, no free strings:
+ *
+ * - `auth-origin-mismatch`: OTP cookies live on `localhost:PORT` but OpenFort
+ *   hits the Convex host → no session reaches the provider.
+ * - `stale-openfort-cache`: an old `userId` in scoped storage makes the SDK
+ *   skip re-auth → 401 on `v2/accounts`.
+ * - `app-env-allowlist`: the selected app/deployment origin is not allowlisted
+ *   → 401.
+ * - `no-secure-context`: sandboxed/headless browser with no Web Crypto, so
+ *   `getAddress`/`configure` can never produce an address. Previously vanished
+ *   into `unknown`; the signer's secure-context probe now names it.
+ * - `unknown`: catch-all when no cause could be determined.
+ */
+type FailureMode = "auth-origin-mismatch" | "stale-openfort-cache" | "app-env-allowlist" | "no-secure-context" | "unknown";
+/**
+ * The one failure representation carried by domain state, actor work, and
+ * public error projection. Keeping it beside the canonical error catalog
+ * prevents a machine or shell from inventing a second code vocabulary.
+ */
+interface Failure {
+  readonly code: CapxulErrorCode;
+  readonly message: string;
+  readonly mode?: FailureMode;
+}
+type CapxulErrorDetails = Record<string, unknown>;
+type CapxulErrorOptions = {
+  readonly cause?: unknown;
+  readonly details?: CapxulErrorDetails;
+  readonly correlationId?: string;
+  readonly layer?: string;
+};
+declare class CapxulError extends Error {
+  readonly code: CapxulErrorCode;
+  readonly details?: CapxulErrorDetails;
+  readonly correlationId?: string;
+  readonly layer?: string;
+  constructor(code: CapxulErrorCode, message: string, options?: CapxulErrorOptions);
+}
+declare function isCapxulError(value: unknown): value is CapxulError;
+//#endregion
+//#region ../types/src/brand.d.ts
+/**
+ * Nominal type helper. `Brand<T, B>` is structurally a `T` at runtime but
+ * distinct at compile time, preventing accidental swaps between primitives.
+ *
+ * @internal
+ */
+declare const brand: unique symbol;
+type Brand<T, B extends string> = T & {
+  readonly [brand]: B;
+};
+//#endregion
+//#region ../types/src/index.d.ts
+type Address = Brand<string, "Address">;
+type Email = Brand<string, "Email">;
+type Profile$1 = {
+  readonly authUserId: AuthUserId;
+  readonly email: Email;
+  readonly displayName: string | null;
+  readonly country: CountryCode | null;
+  readonly onboarded: boolean;
+  readonly withdrawalAddress: Address | null;
+  readonly username: string | null;
+  readonly imageUrl: string | null;
+  readonly kycTier: KycTier;
+  readonly createdAt: EpochMs;
+  readonly updatedAt: EpochMs;
+};
+type SmartAccount$1 = {
+  readonly authUserId: AuthUserId;
+  readonly signerAddress: Address | null;
+  readonly smartAccountAddress: Address;
+  readonly chainId: ChainId;
+  readonly deployedAt: EpochMs | null;
+  readonly claimedAt: EpochMs | null;
+  readonly createdAt: EpochMs;
+};
+type Money = {
+  readonly currency: CurrencyCode;
+  readonly value: string;
+  readonly decimals: number;
+};
+type Account$1 = {
+  readonly id: AccountId;
+  readonly balance: Money;
+  readonly available: Money;
+};
+/** Named bucket partitioning a logical Account (canon §9). */
+type SubAccount = {
+  readonly id: SubAccountId;
+  readonly accountId: AccountId;
+  readonly name: string;
+  readonly balance: Money;
+  readonly createdAt: EpochMs;
+};
+type AuthUserId = Brand<string, "AuthUserId">;
+type AnonymousDistinctId = Brand<string, "AnonymousDistinctId">;
+type AccountId = Brand<string, "AccountId">;
+type SubAccountId = Brand<string, "SubAccountId">;
+type OrgId = Brand<string, "OrgId">;
+type AppId = Brand<string, "AppId">;
+type AllowedOrigin = Brand<string, "AllowedOrigin">;
+type PublishableKey = Brand<string, "PublishableKey">;
+type DurationMs = Brand<number, "DurationMs">;
+type TxHash = Brand<string, "TxHash">;
+type DocumentHash = Brand<string, "DocumentHash">;
+type EpochMs = Brand<number, "EpochMs">;
+type EpochSeconds = Brand<number, "EpochSeconds">;
+type ChainId = Brand<number, "ChainId">;
+type CountryCode = Brand<string, "CountryCode">;
+type CurrencyCode = Brand<SupportedCurrencyCode, "CurrencyCode">;
+type KycTier = Brand<0 | 1 | 2 | 3, "KycTier">;
+type BlockNumber = Brand<number, "BlockNumber">;
+type RunId = Brand<string, "RunId">;
+type RoleKey = Brand<string, "RoleKey">;
+type SessionToken = Brand<string, "SessionToken">;
+type JwtToken = Brand<string, "JwtToken">;
+type AuthSession = {
+  readonly authUserId: AuthUserId;
+  readonly email: Email;
+  readonly token: SessionToken;
+  readonly expiresAt: EpochMs;
+};
+declare const SUPPORTED_CURRENCIES: readonly [{
+  readonly code: "USD";
+  readonly symbol: "$";
+  readonly name: "US Dollar";
+}, {
+  readonly code: "NGN";
+  readonly symbol: "NGN";
+  readonly name: "Nigerian Naira";
+}, {
+  readonly code: "GHS";
+  readonly symbol: "GHS";
+  readonly name: "Ghanaian Cedi";
+}, {
+  readonly code: "KES";
+  readonly symbol: "KSh";
+  readonly name: "Kenyan Shilling";
+}, {
+  readonly code: "UGX";
+  readonly symbol: "USh";
+  readonly name: "Ugandan Shilling";
+}];
+type SupportedCurrencyCode = (typeof SUPPORTED_CURRENCIES)[number]["code"];
+declare function toAddress(raw: unknown): Address;
+declare function toCountryCode(raw: unknown): CountryCode;
+//#endregion
+//#region src/ports/auth-cache.d.ts
+/**
+ * AuthCachePort (TA4) — replaces `SessionStoragePort` in the rebuild slice's
+ * consumer-facing wiring. Stores the user-snapshot Session AND the cached
+ * Convex JWT (W7 bridge endpoint). The two slots are independent so a session
+ * refresh doesn't invalidate the JWT and vice versa.
+ *
+ * Three adapters (TA7):
+ *   - `BrowserAuthCacheAdapter`        — backed by `localStorage`
+ *   - `FileSystemAuthCacheAdapter`     — mode-0600 JSON file in `~/.config/capxul/`
+ *   - `InMemoryAuthCacheAdapter`       — for tests
+ *
+ * `SessionStoragePort` was retired by the Stage 4 rebuild; session and JWT
+ * persistence now share this cache boundary.
+ */
+interface AuthCachePort {
+  readonly getSession: Effect.Effect<AuthSession | null, AuthCacheError>;
+  readonly setSession: (session: AuthSession) => Effect.Effect<void, AuthCacheError>;
+  readonly clearSession: Effect.Effect<void, AuthCacheError>;
+  /**
+   * JWT cache for the `/api/auth/convex/token` bridge endpoint (W7).
+   * Stored separately from the session so a session refresh doesn't
+   * invalidate cached JWT.
+   */
+  readonly getJwt: Effect.Effect<CachedJwt | null, AuthCacheError>;
+  readonly setJwt: (jwt: CachedJwt) => Effect.Effect<void, AuthCacheError>;
+  readonly clearJwt: Effect.Effect<void, AuthCacheError>;
+}
+/**
+ * Cached Convex JWT shape (TA4). `expEpochSeconds` is decoded from the JWT's
+ * `exp` claim at fetch time so the `tokenProvider` cache eviction logic can
+ * proactively refresh at `exp - 30s` per TA3.
+ */
+interface CachedJwt {
+  readonly token: JwtToken;
+  readonly expEpochSeconds: EpochSeconds;
+}
+declare const AuthCacheError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "AuthCacheError";
+} & Readonly<A>;
+declare class AuthCacheError extends AuthCacheError_base<{
+  readonly operation: string;
+  readonly cause: unknown;
+}> {}
+declare const AuthCachePortTag_base: Context.ServiceClass<AuthCachePortTag, "@capxul/sdk/ports/AuthCachePort", AuthCachePort>;
+declare class AuthCachePortTag extends AuthCachePortTag_base {}
+//#endregion
+//#region src/surface/types.d.ts
+type Session = AuthSession;
+type Profile = Profile$1;
+type SmartAccount = SmartAccount$1;
+/**
+ * Result-shape returned by every method on `CapxulClient`. Mirrors the
+ * existing per-port `Result` aliases; centralized here so consumers have
+ * a single import for the consumer-facing surface.
+ */
+type CapxulResult<T> = {
+  readonly ok: true;
+  readonly value: T;
+} | {
+  readonly ok: false;
+  readonly error: CapxulError;
+};
+//#endregion
+//#region src/surface/account-providers.d.ts
+type AccountProviderSource = "local-private-key" | "openfort-embedded" | "injected-eip1193";
+type AccountRequirement = "none" | "counterfactual" | "deployed";
+interface AccountProvider {
+  readonly source: AccountProviderSource;
+  /**
+   * Resolve the signer's EVM address.
+   *
+   * @determinism MUST return the same `Address` across calls for the
+   * lifetime of a single provider instance — the SDK-level deploy mutex
+   * keys on `(authUserId, safeAddress)` where `safeAddress` is computed
+   * from `getAddress()`'s result before the port's `prepare()` round-trip.
+   * If two successive calls returned different addresses, concurrent
+   * `deploySafe` invocations would compute different mutex keys and
+   * bypass dedup, defeating the mutex.
+   *
+   * The two sanctioned providers both satisfy this invariant:
+   *   - `localPrivateKeyAccountProvider` — derives once from the key
+   *   - `eip1193AccountProvider` — reads `eth_accounts` (idempotent once
+   *     the wallet is connected; consumer is responsible for connection)
+   *
+   * The Openfort embedded path no longer needs a provider: the
+   * `openfortEmbeddedSigner` `CapxulSigner` caches its own address and the
+   * deploy is backend-orchestrated (backend-orchestrated-deploy.md).
+   *
+   * Custom providers MUST honor this contract.
+   */
+  getAddress(): Promise<CapxulResult<Address>>;
+  getDeployAccount(): Promise<CapxulResult<Account>>;
+}
+interface Eip1193Provider {
+  request(args: {
+    readonly method: string;
+    readonly params?: readonly unknown[];
+  }): Promise<unknown>;
+}
+declare function localPrivateKeyAccountProvider(input: {
+  readonly privateKey: Hex;
+}): AccountProvider;
+declare function eip1193AccountProvider(input: {
+  readonly provider: Eip1193Provider;
+}): AccountProvider;
+//#endregion
+//#region src/signer.d.ts
+interface CapxulDigestSigner {
+  /**
+   * Sign the EIP-712 `SafeOp` digest the backend returns for the prepared
+   * deployment UserOperation. Returns the raw 65-byte ECDSA signature; the
+   * backend packs `validAfter|validUntil|signature`.
+   */
+  signUserOpHash(hash: Hex): Promise<Hex>;
+}
+interface CapxulSigner extends CapxulDigestSigner {
+  /**
+   * Signer kind — surfaced on the `accountProviderReady` status so the
+   * readiness ladder reports which signer the consumer wired.
+   */
+  readonly source: AccountProviderSource;
+  /** Owner EOA address — the Safe's single owner. */
+  getAddress(): Promise<Address>;
+}
+/** Minimal EIP-1193 surface an injected browser wallet exposes. */
+interface Eip1193RequestProvider {
+  request(args: {
+    readonly method: string;
+    readonly params?: readonly unknown[];
+  }): Promise<unknown>;
+}
+/**
+ * Browser `CapxulSigner` backed by an injected EIP-1193 wallet (MetaMask, etc.).
+ * Signs the SafeOp digest via `eth_sign`, then verifies the returned signature
+ * recovers the selected account against that raw digest. Wallets that prefix
+ * `eth_sign` payloads are rejected before the backend submits an invalid SafeOp.
+ * The node key signer lives in `@capxul/sdk/node` (`localPrivateKeySigner`).
+ */
+declare function injectedWalletSigner(provider: Eip1193RequestProvider): CapxulSigner;
+//#endregion
+export { isCapxulError as $, CurrencyCode as A, RunId as B, AnonymousDistinctId as C, BlockNumber as D, AuthUserId as E, Money as F, TxHash as G, SmartAccount$1 as H, OrgId as I, CapxulError as J, toAddress as K, Profile$1 as L, DurationMs as M, Email as N, ChainId as O, EpochMs as P, FailureMode as Q, PublishableKey as R, AllowedOrigin as S, AuthSession as T, SubAccount as U, SessionToken as V, SubAccountId as W, CapxulErrorDetails as X, CapxulErrorCode as Y, Failure as Z, AuthCachePortTag as _, AccountProvider as a, AccountId as b, Eip1193Provider as c, CapxulResult as d, Profile as f, AuthCachePort as g, AuthCacheError as h, injectedWalletSigner as i, DocumentHash as j, CountryCode as k, eip1193AccountProvider as l, SmartAccount as m, CapxulSigner as n, AccountProviderSource as o, Session as p, toCountryCode as q, Eip1193RequestProvider as r, AccountRequirement as s, CapxulDigestSigner as t, localPrivateKeyAccountProvider as u, CachedJwt as v, AppId as w, Address as x, Account$1 as y, RoleKey as z };
+//# sourceMappingURL=signer-CJT0pPiO.d.mts.map

package/dist/signer-CJT0pPiO.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer-CJT0pPiO.d.mts","names":[],"sources":["../../errors/src/errors.ts","../../types/src/brand.ts","../../types/src/index.ts","../src/ports/auth-cache.ts","../src/surface/types.ts","../src/surface/account-providers.ts","../src/signer.ts"],"mappings":";;;;cAKa,kBAAA;AAAA,KA6BD,eAAA,WAA0B,kBAAkB;;;AAAA;AAiDxD;;;;AAAuB;AAYvB;;;;;;;;;KAZY,WAAA;AAeiB;AAG7B;;;;AAH6B,UAHZ,OAAA;EAAA,SACN,IAAA,EAAM,eAAA;EAAA,SACN,OAAA;EAAA,SACA,IAAA,GAAO,WAAW;AAAA;AAAA,KAGjB,kBAAA,GAAqB,MAAM;AAAA,KAgB3B,kBAAA;EAAA,SACD,KAAA;EAAA,SACA,OAAA,GAAU,kBAAkB;EAAA,SAC5B,aAAA;EAAA,SACA,KAAA;AAAA;AAAA,cAGE,WAAA,SAAoB,KAAA;EAAA,SACtB,IAAA,EAAM,eAAA;EAAA,SACN,OAAA,GAAU,kBAAA;EAAA,SACV,aAAA;EAAA,SACA,KAAA;cAEG,IAAA,EAAM,eAAA,EAAiB,OAAA,UAAiB,OAAA,GAAS,kBAAA;AAAA;AAAA,iBAgB/C,aAAA,CAAc,KAAA,YAAiB,KAAA,IAAS,WAAW;;;;;;;AA7InE;;cCCc,KAAA;AAAA,KAEF,KAAA,wBAA6B,CAAA;EAAA,UAAgB,KAAA,GAAQ,CAAA;AAAA;;;KCHrD,OAAA,GAAU,KAAK;AAAA,KACf,KAAA,GAAQ,KAAK;AAAA,KAMb,SAAA;EAAA,SACD,UAAA,EAAY,UAAA;EAAA,SACZ,KAAA,EAAO,KAAA;EAAA,SACP,WAAA;EAAA,SACA,OAAA,EAAS,WAAA;EAAA,SACT,SAAA;EAAA,SACA,iBAAA,EAAmB,OAAA;EAAA,SAInB,QAAA;EAAA,SACA,QAAA;EAAA,SACA,OAAA,EAAS,OAAA;EAAA,SACT,SAAA,EAAW,OAAA;EAAA,SACX,SAAA,EAAW,OAAA;AAAA;AAAA,KASV,cAAA;EAAA,SACD,UAAA,EAAY,UAAA;EAAA,SACZ,aAAA,EAAe,OAAA;EAAA,SACf,mBAAA,EAAqB,OAAA;EAAA,SACrB,OAAA,EAAS,OAAA;EAAA,SACT,UAAA,EAAY,OAAA;EAAA,SACZ,SAAA,EAAW,OAAA;EAAA,SACX,SAAA,EAAW,OAAA;AAAA;AAAA,KAQV,KAAA;EAAA,SACD,QAAA,EAAU,YAAY;EAAA,SACtB,KAAA;EAAA,SACA,QAAA;AAAA;AAAA,KAQC,SAAA;EAAA,SACD,EAAA,EAAI,SAAA;EAAA,SACJ,OAAA,EAAS,KAAA;EAAA,SACT,SAAA,EAAW,KAAA;AAAA;;KAIV,UAAA;EAAA,SACD,EAAA,EAAI,YAAA;EAAA,SACJ,SAAA,EAAW,SAAA;EAAA,SACX,IAAA;EAAA,SACA,OAAA,EAAS,KAAA;EAAA,SACT,SAAA,EAAW,OAAA;AAAA;AAAA,KAGV,UAAA,GAAa,KAAK;AAAA,KAClB,mBAAA,GAAsB,KAAK;AAAA,KAE3B,SAAA,GAAY,KAAK;AAAA,KACjB,YAAA,GAAe,KAAK;AAAA,KACpB,KAAA,GAAQ,KAAK;AAAA,KACb,KAAA,GAAQ,KAAK;AAAA,KACb,aAAA,GAAgB,KAAK;AAAA,KACrB,cAAA,GAAiB,KAAK;AAAA,KAEtB,UAAA,GAAa,KAAK;AAAA,KAqBlB,MAAA,GAAS,KAAK;AAAA,KACd,YAAA,GAAe,KAAK;AAAA,KACpB,OAAA,GAAU,KAAK;AAAA,KACf,YAAA,GAAe,KAAK;AAAA,KACpB,OAAA,GAAU,KAAK;AAAA,KACf,WAAA,GAAc,KAAK;AAAA,KACnB,YAAA,GAAe,KAAK,CAAC,qBAAA;AAAA,KACrB,OAAA,GAAU,KAAK;AAAA,KACf,WAAA,GAAc,KAAK;AAAA,KAKnB,KAAA,GAAQ,KAAK;AAAA,KACb,OAAA,GAAU,KAAK;AAAA,KAEf,YAAA,GAAe,KAAK;AAAA,KACpB,QAAA,GAAW,KAAK;AAAA,KAOhB,WAAA;EAAA,SACD,UAAA,EAAY,UAAA;EAAA,SACZ,KAAA,EAAO,KAAA;EAAA,SACP,KAAA,EAAO,YAAA;EAAA,SACP,SAAA,EAAW,OAAA;AAAA;AAAA,cAMT,oBAAA;EAAA;;;;;;;;;;;;;;;;;;;;KAQR,qBAAA,WAAgC,oBAAoB;AAAA,iBAyBzC,SAAA,CAAU,GAAA,YAAe,OAAO;AAAA,iBAkMhC,aAAA,CAAc,GAAA,YAAe,WAAW;;;;;AF3WxD;;;;AA2BU;AAEV;;;;AAAwD;AAiDxD;;UGlEiB,aAAA;EAAA,SACN,UAAA,EAAY,MAAA,CAAO,MAAA,CAAO,WAAA,SAAoB,cAAA;EAAA,SAC9C,UAAA,GAAa,OAAA,EAAS,WAAA,KAAgB,MAAA,CAAO,MAAA,OAAa,cAAA;EAAA,SAC1D,YAAA,EAAc,MAAA,CAAO,MAAA,OAAa,cAAA;EH2ErB;;;;;EAAA,SGpEb,MAAA,EAAQ,MAAA,CAAO,MAAA,CAAO,SAAA,SAAkB,cAAA;EAAA,SACxC,MAAA,GAAS,GAAA,EAAK,SAAA,KAAc,MAAA,CAAO,MAAA,OAAa,cAAA;EAAA,SAChD,QAAA,EAAU,MAAA,CAAO,MAAA,OAAa,cAAA;AAAA;AHqEZ;AAG7B;;;;AAH6B,UG7DZ,SAAA;EAAA,SACN,KAAA,EAAO,QAAA;EAAA,SACP,eAAA,EAAiB,YAAY;AAAA;AAAA,cACvC,mBAAA;;;cAEY,cAAA,SAAuB,mBAAA;EAAA,SACzB,SAAA;EAAA,SACA,KAAA;AAAA;AAAA,cACN,qBAAA;cAEQ,gBAAA,SAAyB,qBAErC;;;KC/BW,OAAA,GAAU,WAAW;AAAA,KACrB,OAAA,GAAU,SAAY;AAAA,KACtB,YAAA,GAAe,cAAiB;;;;AJYlC;AAEV;KIPY,YAAA;EAAA,SACG,EAAA;EAAA,SAAmB,KAAA,EAAO,CAAA;AAAA;EAAA,SAC1B,EAAA;EAAA,SAAoB,KAAA,EAAO,WAAW;AAAA;;;KCtBzC,qBAAA;AAAA,KAEA,kBAAA;AAAA,UAEK,eAAA;EAAA,SACN,MAAA,EAAQ,qBAAA;ELoBT;AAAA;AAEV;;;;AAAwD;AAiDxD;;;;AAAuB;AAYvB;;;;;;;;;;EK5DE,UAAA,IAAc,OAAA,CAAQ,YAAA,CAAa,OAAA;EACnC,gBAAA,IAAoB,OAAA,CAAQ,YAAA,CAAa,OAAA;AAAA;AAAA,UAG1B,eAAA;EACf,OAAA,CAAQ,IAAA;IAAA,SACG,MAAA;IAAA,SACA,MAAA;EAAA,IACP,OAAO;AAAA;AAAA,iBAGG,8BAAA,CAA+B,KAAA;EAAA,SACpC,UAAA,EAAY,GAAA;AAAA,IACnB,eAAe;AAAA,iBAcH,sBAAA,CAAuB,KAAA;EAAA,SAC5B,QAAA,EAAU,eAAA;AAAA,IACjB,eAAe;;;UCrCF,kBAAA;ENtBJ;;;;AA2BH;EMCR,cAAA,CAAe,IAAA,EAAM,GAAA,GAAM,OAAA,CAAQ,GAAA;AAAA;AAAA,UAGpB,YAAA,SAAqB,kBAAA;ENFkB;AAAA;AAiDxD;;EAjDwD,SMO7C,MAAA,EAAQ,qBAAA;EN0CI;EMxCrB,UAAA,IAAc,OAAA,CAAQ,OAAA;AAAA;;UAIP,sBAAA;EACf,OAAA,CAAQ,IAAA;IAAA,SACG,MAAA;IAAA,SACA,MAAA;EAAA,IACP,OAAO;AAAA;;;AN+CgB;AAG7B;;;;iBMxCgB,oBAAA,CAAqB,QAAA,EAAU,sBAAA,GAAyB,YAAY"}

package/dist/testing/index.d.mts

@@ -0,0 +1,54 @@
+import { an as TelemetryEvent, gn as IdentityTransition, on as TelemetryGroupInput, sn as TelemetryIdentifyInput, t as CapxulClient } from "../create-capxul-client-C7H5b68l.mjs";
+import { Effect, Layer } from "effect";
+
+//#region src/testing/telemetry/RecordingTelemetryAdapter.d.ts
+type RecordingTelemetryOperation = {
+  readonly type: "emit";
+  readonly event: TelemetryEvent;
+} | {
+  readonly type: "identify";
+  readonly input: TelemetryIdentifyInput;
+} | {
+  readonly type: "group";
+  readonly input: TelemetryGroupInput;
+} | {
+  readonly type: "reset";
+};
+//#endregion
+//#region src/testing/index.d.ts
+interface CreateCapxulTestClientOptions {
+  readonly requirement?: "none" | "counterfactual" | "deployed";
+}
+interface SeedTestIdentityInput {
+  readonly authUserId: string;
+  readonly email: string;
+  readonly displayName?: string;
+  readonly country?: string;
+}
+interface CapxulTestClient {
+  readonly client: CapxulClient;
+  readonly clock: CapxulTestClock;
+  readonly observation: CapxulTestObservation;
+  readonly transitions: readonly IdentityTransition[];
+  readonly observations: readonly RecordingTelemetryOperation[];
+  readonly peekOtp: (email: string) => string | undefined;
+  readonly seedIdentity: (input: SeedTestIdentityInput) => Promise<void>;
+  readonly close: () => Promise<void>;
+}
+interface CapxulTestClock {
+  readonly advance: (ms: number) => Promise<void>;
+}
+interface CapxulTestObservation {
+  readonly emit: (event: TelemetryEvent) => Promise<void>;
+  readonly identify: (input: TelemetryIdentifyInput) => Promise<void>;
+  readonly group: (input: TelemetryGroupInput) => Promise<void>;
+  readonly reset: () => Promise<void>;
+}
+/**
+ * Assemble the real public client over deterministic in-memory ports.
+ * Unconfigured backend calls fail locally; no adapter owns a network exit.
+ */
+declare function createCapxulTestClient(options?: CreateCapxulTestClientOptions): CapxulTestClient;
+//#endregion
+export { CapxulTestClient, CapxulTestClock, CapxulTestObservation, CreateCapxulTestClientOptions, SeedTestIdentityInput, createCapxulTestClient };
+//# sourceMappingURL=index.d.mts.map

package/dist/testing/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/testing/telemetry/RecordingTelemetryAdapter.ts","../../src/testing/index.ts"],"mappings":";;;;KAYY,2BAAA;EAAA,SACG,IAAA;EAAA,SAAuB,KAAA,EAAO,cAAA;AAAA;EAAA,SAC9B,IAAA;EAAA,SAA2B,KAAA,EAAO,sBAAA;AAAA;EAAA,SAClC,IAAA;EAAA,SAAwB,KAAA,EAAO,mBAAA;AAAA;EAAA,SAC/B,IAAA;AAAA;;;UCoCE,6BAAA;EAAA,SACN,WAAW;AAAA;AAAA,UAGL,qBAAA;EAAA,SACN,UAAA;EAAA,SACA,KAAA;EAAA,SACA,WAAA;EAAA,SACA,OAAA;AAAA;AAAA,UAGM,gBAAA;EAAA,SACN,MAAA,EAAQ,YAAA;EAAA,SACR,KAAA,EAAO,eAAA;EAAA,SACP,WAAA,EAAa,qBAAA;EAAA,SACb,WAAA,WAAsB,kBAAA;EAAA,SACtB,YAAA,WAAuB,2BAAA;EAAA,SACvB,OAAA,GAAU,KAAA;EAAA,SACV,YAAA,GAAe,KAAA,EAAO,qBAAA,KAA0B,OAAA;EAAA,SAChD,KAAA,QAAa,OAAA;AAAA;AAAA,UAGP,eAAA;EAAA,SACN,OAAA,GAAU,EAAA,aAAe,OAAO;AAAA;AAAA,UAG1B,qBAAA;EAAA,SACN,IAAA,GAAO,KAAA,EAAO,cAAA,KAAmB,OAAA;EAAA,SACjC,QAAA,GAAW,KAAA,EAAO,sBAAA,KAA2B,OAAA;EAAA,SAC7C,KAAA,GAAQ,KAAA,EAAO,mBAAA,KAAwB,OAAA;EAAA,SACvC,KAAA,QAAa,OAAA;AAAA;AA1BxB;;;;AAAA,iBAiCgB,sBAAA,CACd,OAAA,GAAS,6BAAA,GACR,gBAAgB"}