@capxul/sdk 1.0.0-alpha.9 → 1.2.0

package/dist/create-capxul-client-C7H5b68l.d.mts

@@ -0,0 +1,2764 @@
+import { A as CurrencyCode, B as RunId, C as AnonymousDistinctId, D as BlockNumber, E as AuthUserId, F as Money, G as TxHash, H as SmartAccount, I as OrgId, J as CapxulError, L as Profile, M as DurationMs, N as Email, O as ChainId, P as EpochMs, Q as FailureMode, R as PublishableKey, S as AllowedOrigin, T as AuthSession, U as SubAccount, V as SessionToken, W as SubAccountId, X as CapxulErrorDetails, Y as CapxulErrorCode, Z as Failure, b as AccountId, d as CapxulResult, f as Profile$1, g as AuthCachePort, j as DocumentHash, k as CountryCode, m as SmartAccount$1, n as CapxulSigner, o as AccountProviderSource, p as Session$1, s as AccountRequirement, v as CachedJwt, w as AppId, x as Address, y as Account$1, z as RoleKey } from "./signer-CJT0pPiO.mjs";
+import { Hex } from "viem";
+import { Context, Effect, Layer, Schema, Scope, Tracer } from "effect";
+import { FunctionReference } from "convex/server";
+
+//#region src/domain/machine/shell.d.ts
+declare const INVOCATION_PARENT_SPAN: unique symbol;
+interface InvocationControls {
+  readonly signal?: AbortSignal;
+  readonly timeoutMs?: number;
+  readonly deadlineMs?: number;
+  readonly correlation_id?: string;
+  readonly journey_id?: string;
+  /** @internal Opaque in-process trace parent; symbols never enter wire or P3 records. */
+  readonly [INVOCATION_PARENT_SPAN]?: Tracer.AnySpan;
+}
+type RecordBase = {
+  readonly machine: string;
+  readonly event: string;
+  readonly slot: string;
+  readonly epoch: number;
+  readonly duration_ms: number;
+  readonly correlation_id?: string;
+  readonly journey_id?: string;
+};
+type IdentityTransition = (RecordBase & {
+  readonly outcome: "applied";
+  readonly from: string;
+  readonly to: string;
+  readonly refusal_code?: never;
+  readonly error_code?: never;
+}) | (RecordBase & {
+  readonly outcome: "refused";
+  readonly state: string;
+  readonly refusal_code: CapxulErrorCode;
+  readonly error_code?: never;
+}) | (RecordBase & {
+  readonly outcome: "failed" | "cancelled";
+  readonly state: string;
+  readonly error_code: CapxulErrorCode;
+  readonly refusal_code?: never;
+});
+declare class ActorFailure<Reason extends CapxulErrorCode> extends Error {
+  readonly reason: Reason;
+  readonly machine: string;
+  readonly state: string;
+  readonly event: string;
+  readonly details?: Readonly<Record<string, unknown>> | undefined;
+  readonly _tag = "ActorFailure";
+  constructor(reason: Reason, machine: string, state: string, event: string, details?: Readonly<Record<string, unknown>> | undefined);
+}
+interface Actor<S, Pub, Reason extends CapxulErrorCode> {
+  readonly ask: (event: Pub, controls?: InvocationControls) => Effect.Effect<S, ActorFailure<Reason | CapxulErrorCode>>;
+  readonly tell: (event: Pub, controls?: InvocationControls) => Effect.Effect<void, ActorFailure<Reason | CapxulErrorCode>>;
+  readonly snapshot: () => S;
+  readonly subscribe: (observer: (state: S) => void) => () => void;
+  readonly subscribeTransitions: (observer: (record: IdentityTransition) => void) => () => void;
+}
+//#endregion
+//#region src/domain/identity/model.d.ts
+type RefusalReason = "WRONG_STATE" | "INVALID_INPUT" | "OTP_EXPIRED" | "SIGNER_REJECTED";
+interface Session {
+  readonly email: string;
+  readonly authUserId: string;
+}
+/** the pre-S1 account lane — PRD #462: wallet→identity→provision is counterfactual
+ * and signerless; `deploy` is the separate claim step that needs a signer. */
+type AccountStep = "wallet" | "identity" | "provision" | "deploy";
+/** org-lifecycle.ts:7-11, verbatim. */
+type OrgStep = "preparingFounderAccount" | "awaitingFounderAuthorization" | "submittingBootstrap" | "confirmingBootstrap";
+interface OrgDraft {
+  readonly name: string;
+  readonly handle: string;
+  readonly country: string;
+}
+/** Full one-shot coordinator input. Only {@link OrgDraft} is retained in IdentityState. */
+interface OrgSubmissionDraft extends OrgDraft {
+  readonly bio?: string;
+  readonly size?: string;
+}
+/** The org lane, keyed by the active orgId — which does not exist yet while the
+ * FIRST DURABLE ORG WRITE is in flight, hence `creating` carrying only a draft. */
+type OrgLane = {
+  readonly at: "creating";
+  readonly draft: OrgDraft;
+} | {
+  readonly at: "loading";
+  readonly orgId: string;
+} | {
+  readonly at: "settingUp";
+  readonly orgId: string;
+  readonly step: OrgStep;
+} | {
+  readonly at: "ready";
+  readonly orgId: string;
+} | {
+  readonly at: "failed";
+  readonly orgId: string | null;
+  readonly step: OrgStep;
+  readonly failure: Failure;
+  readonly retryable: boolean;
+};
+/**
+ * Personal-account readiness — the ONLY pre-org readiness truth (#1049 #1051).
+ * `claimed` is the single variant with an `org` field: the map's ordering
+ * `Account deployed+claimed → first durable Organization write` is expressed by
+ * the absence of that field everywhere else, not by a guard someone can forget.
+ */
+type Readiness = {
+  readonly at: "unknown";
+} | {
+  readonly at: "deriving";
+  readonly step: AccountStep;
+} | {
+  readonly at: "counterfactual";
+  readonly address: string;
+} | {
+  readonly at: "claiming";
+  readonly address: string;
+} | {
+  readonly at: "claimed";
+  readonly address: string;
+  readonly org: OrgLane | null;
+} | {
+  readonly at: "failed";
+  readonly step: AccountStep;
+  readonly failure: Failure;
+  readonly retryable: boolean;
+};
+type IdentityState = {
+  readonly phase: "signed_out";
+} | {
+  readonly phase: "otp_sending";
+  readonly email: string;
+} | {
+  readonly phase: "otp_pending";
+  readonly email: string;
+  readonly requestedAt: number;
+} | {
+  readonly phase: "otp_verifying";
+  readonly email: string;
+  readonly requestedAt: number;
+} | {
+  readonly phase: "authenticated";
+  readonly session: Session;
+  readonly profileComplete: boolean;
+  readonly account: Readiness;
+} | {
+  readonly phase: "signing_out";
+  readonly session: Session | null;
+} | {
+  readonly phase: "faulted";
+  readonly failure: Failure;
+  /** Non-null exactly when an OTP entry is resumable — the incumbent's
+   * `email !== null && otpRequestedAt !== null` pair (the pre-S1 auth machine),
+   * made structural. */
+  readonly resume: {
+    readonly email: string;
+    readonly requestedAt: number;
+  } | null;
+};
+declare const STATE_LABELS: readonly ["signed_out", "otp_sending", "otp_pending", "otp_verifying", "authenticated:unknown", "authenticated:deriving", "authenticated:counterfactual", "authenticated:claiming", "authenticated:failed", "authenticated:claimed", "authenticated:claimed:creating", "authenticated:claimed:loading", "authenticated:claimed:settingUp", "authenticated:claimed:ready", "authenticated:claimed:failed", "signing_out", "faulted"];
+type StateLabel = (typeof STATE_LABELS)[number];
+type IdentityEvent = {
+  readonly _tag: "RequestOtp";
+  readonly email: string;
+} | {
+  readonly _tag: "VerifyOtp";
+  readonly email: string;
+  readonly otp: string;
+  readonly now: number;
+} | {
+  readonly _tag: "ReadSession";
+} | {
+  readonly _tag: "SignOut";
+} | {
+  readonly _tag: "RestoreSession";
+  readonly session: Session;
+  readonly profileComplete: boolean;
+} | {
+  readonly _tag: "ResumeOtpEntry";
+  readonly now: number;
+} | {
+  readonly _tag: "Reset";
+} | {
+  readonly _tag: "EnsureAccount";
+} | {
+  readonly _tag: "ClaimAccount";
+} | {
+  readonly _tag: "RetryAccount";
+} | {
+  readonly _tag: "CreateOrganization";
+  readonly draft: OrgSubmissionDraft;
+} | {
+  readonly _tag: "AttachOrganization";
+  readonly orgId: string;
+} | {
+  readonly _tag: "RetryOrganization";
+} | {
+  readonly _tag: "LeaveOrganization";
+};
+type Destination$1 = {
+  readonly to: "home";
+} | {
+  readonly to: "selectUserType";
+} | {
+  readonly to: "provisioning";
+  readonly scope: "personal";
+} | {
+  readonly to: "provisioning";
+  readonly scope: "organization";
+  readonly orgId: string | null;
+} | {
+  readonly to: "dashboardPersonal";
+} | {
+  readonly to: "dashboardOrganization";
+  readonly orgId: string;
+};
+/**
+ * The post-auth destination and provisioning lane merge as one total switch
+ * over the nest. "An active journey outranks default
+ * routing; org-list contents never choose a destination" holds by construction:
+ * there is no org list in the state, only the ONE active lane.
+ */
+declare const destination: (state: IdentityState) => Destination$1 | null;
+//#endregion
+//#region src/ports/auth-client.d.ts
+type AuthClientOperationOptions = {
+  readonly signal?: AbortSignal;
+};
+type SendOtpInput = {
+  readonly email: Email;
+};
+type CanSendOtpInput = {
+  readonly email: Email;
+};
+type CanSendOtpStatus = {
+  readonly allowed: boolean;
+  readonly cooldownMs: DurationMs;
+};
+type VerifyOtpInput = {
+  readonly email: Email;
+  readonly otp: string;
+};
+type GetConvexJwtOptions = AuthClientOperationOptions & {
+  readonly forceRefresh?: boolean;
+};
+declare const AuthClientError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "AuthClientError";
+} & Readonly<A>;
+declare class AuthClientError extends AuthClientError_base<{
+  readonly operation: string;
+  readonly kind: string;
+  readonly cause: unknown;
+}> {}
+interface AuthClientPort {
+  canSendOtp(input: CanSendOtpInput, options?: AuthClientOperationOptions): Effect.Effect<CanSendOtpStatus, AuthClientError>;
+  sendOtp(input: SendOtpInput, options?: AuthClientOperationOptions): Effect.Effect<void, AuthClientError>;
+  verifyOtp(input: VerifyOtpInput, options?: AuthClientOperationOptions): Effect.Effect<AuthSession, AuthClientError>;
+  getSession(options?: AuthClientOperationOptions): Effect.Effect<AuthSession | null, AuthClientError>;
+  signOut(options?: AuthClientOperationOptions): Effect.Effect<void, AuthClientError>;
+  /**
+   * Fetches a Convex-aud JWT from `/api/auth/convex/token` (W7). Server mints
+   * a fresh JWT on every call per Probe A's 2026-05-19 finding (RS256, 900 s
+   * lifetime, `iss = <site-url>`, `aud = convex`). The caller (the SDK's
+   * `tokenProvider` wired into ConvexCallPort) is responsible for the
+   * `exp - 30s` proactive cache + `forceRefresh` callback handshake.
+   */
+  getConvexJwt(options?: GetConvexJwtOptions): Effect.Effect<CachedJwt, AuthClientError>;
+}
+//#endregion
+//#region src/ports/clock.d.ts
+interface ClockPort {
+  readonly now: Effect.Effect<EpochMs, ClockError>;
+  readonly sleep: (duration: DurationMs) => Effect.Effect<void, ClockError>;
+}
+declare const ClockError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "ClockError";
+} & Readonly<A>;
+declare class ClockError extends ClockError_base<{
+  readonly operation: "now" | "sleep" | "initialize";
+  readonly cause: unknown;
+}> {}
+//#endregion
+//#region ../observability/src/telemetry-port.d.ts
+/**
+ * Context for reporting handled errors via `reportHandledError`.
+ * Carries structured metadata extracted from the error context.
+ */
+interface HandledErrorReportContext {
+  readonly layer?: string;
+  readonly operation?: string;
+  readonly failure_mode?: FailureMode;
+  readonly provider?: string;
+}
+/**
+ * Canonical TelemetryPort interface. Every adapter (production, test, in-memory)
+ * implements this contract. All methods return `Effect<void, never>` —
+ * fire-and-forget, defects are caught and traced.
+ */
+interface TelemetryPort {
+  readonly emit: (event: TelemetryEvent) => Effect.Effect<void, never>;
+  readonly identify: (input: TelemetryIdentifyInput) => Effect.Effect<void, never>;
+  readonly group: (input: TelemetryGroupInput) => Effect.Effect<void, never>;
+  readonly reset: () => Effect.Effect<void, never>;
+  readonly reportHandledError?: (error: CapxulError, context?: HandledErrorReportContext) => Effect.Effect<void, never>;
+}
+//#endregion
+//#region ../observability/src/index.d.ts
+declare const TELEMETRY_EVENT_NAMES: readonly ["auth_otp_requested", "auth_otp_delivered", "auth_otp_expired", "auth_verified", "auth_failed", "auth_signed_out", "onboarding_intent_selected", "onboarding_profile_submitted", "onboarding_organization_submitted", "onboarding_dashboard_reached", "provisioning_safe_created", "provisioning_safe_confirmed", "bootstrap_resolved", "bootstrap_failed", "member_activation_started", "member_activation_ready", "member_activation_failed", "organization_creation_started", "organization_creation_ready", "organization_creation_failed", "account_balance_read", "account_balance_failed", "faucet_requested", "faucet_confirmed", "faucet_failed", "subaccount_created", "subaccount_renamed", "subaccount_deleted", "subaccount_op_failed", "transfer_requested", "transfer_backend_received", "transfer_confirmed", "transfer_failed", "org_create_started", "org_safe_created", "org_safe_confirmed", "org_roles_seeded", "org_created", "org_create_failed", "org_invite_sent", "org_invite_accepted", "org_role_granted", "org_member_active", "org_member_removed", "org_invite_expired", "org_role_grant_failed", "payment_requested", "payment_resolved", "payment_document_attached", "payment_submitted", "payment_settled", "payment_claimed", "payment_cancelled", "payment_redirected", "payment_failed", "stream_created", "stream_claimed", "stream_cancelled", "stream_completed", "stream_failed", "withdrawal_requested", "withdrawal_submitted", "withdrawal_settled", "withdrawal_failed"];
+type TelemetryEventName = (typeof TELEMETRY_EVENT_NAMES)[number];
+type TelemetryProps = Record<string, unknown>;
+type TelemetryEvent = {
+  readonly name: TelemetryEventName;
+  readonly props?: TelemetryProps | undefined;
+};
+/**
+ * Environment discriminator (ADR-0020 A1 amendment, 2026-08-07). PostHog
+ * project 368736 is the SINGLE sink for every environment, so `capxul_env` —
+ * not project isolation — is what keeps a production surface from reading dev
+ * traffic. It is REQUIRED on every catalog event and every synced artifact
+ * filters on it.
+ *
+ * `unknown` is a defect marker, not an environment: it means a producer
+ * reached the transport without declaring where it runs. It is in the union so
+ * the property is never ABSENT (an absent property is invisible to a filter,
+ * a present `unknown` is loud), and sync v2 never synthesizes an artifact for
+ * it.
+ */
+declare const CAPXUL_ENVS: readonly ["development", "e2e", "staging", "production", "unknown"];
+type CapxulEnv = (typeof CAPXUL_ENVS)[number];
+interface TelemetryIdentifyInput {
+  readonly distinctId: string;
+  readonly anonDistinctId?: AnonymousDistinctId;
+  readonly traits?: TelemetryProps;
+  readonly properties?: TelemetryProps;
+}
+interface TelemetryGroupInput {
+  readonly groupType: string;
+  readonly groupKey: string;
+  readonly properties?: TelemetryProps;
+}
+//#endregion
+//#region src/ports/bootstrap.d.ts
+type BootstrapInput = {
+  readonly publishableKey: PublishableKey;
+  /**
+   * Browser callers send the App origin so bootstrap can enforce the
+   * publishable-key allowlist. Node/server callers may omit it; the backend
+   * only applies the origin allowlist when an origin is present.
+   */
+  readonly origin?: AllowedOrigin;
+};
+type BootstrapResolution = {
+  readonly applicationId: AppId;
+  readonly chainId: ChainId;
+  /**
+   * SDK-handshake session token — distinct from the user-auth `AuthSession`
+   * token issued by `AuthClientPort`. Both use the `SessionToken` brand for
+   * opaque-string discipline; the issuance source distinguishes them.
+   */
+  readonly sessionToken: SessionToken;
+  readonly issuedAt: EpochMs;
+  readonly expiresIn: DurationMs;
+  readonly authBaseUrl: string;
+  readonly convexUrl: string;
+  readonly siteBaseUrl: string;
+  readonly openfortPublishableKey: string;
+  readonly shieldPublishableKey: string;
+};
+type BootstrapErrorKind = "notAuthenticated" | "network" | "provider" | "malformedBody" | "invalidInput" | "rateLimited";
+declare const BootstrapError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "BootstrapError";
+} & Readonly<A>;
+declare class BootstrapError extends BootstrapError_base<{
+  readonly operation: "resolve";
+  readonly kind: BootstrapErrorKind;
+  readonly publicCode: CapxulErrorCode;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface BootstrapPort {
+  readonly resolve: (input: BootstrapInput) => Effect.Effect<BootstrapResolution, BootstrapError>;
+}
+//#endregion
+//#region src/ports/convex-call.d.ts
+/**
+ * Canonical teardown handle for substrate-level reactive callbacks.
+ *
+ * Calling it stops the subscription; no further snapshots will be delivered
+ * to the callback after the first invocation. Calling more than once is a
+ * no-op (idempotent).
+ *
+ * @internal-use
+ */
+type Unsubscribe = () => void;
+/**
+ * Snapshot is the substrate discriminated union for reactive callbacks over
+ * `ConvexCallPort.subscribe`. The public SDK surface is imperative
+ * (`Promise<CapxulResult>`).
+ *
+ *   - `loading` · initial state before any value arrives from the substrate
+ *   - `ok`      · a successful snapshot carrying `value`
+ *   - `error`   · a failed snapshot carrying a typed error (defaults to
+ *                 `CapxulError`)
+ *
+ * The substrate guarantees the first snapshot is `loading` (CC8 in the
+ * `ConvexCallPort` contract); subsequent snapshots carry `ok` or `error`
+ * per the underlying transport.
+ *
+ * Per ARCH-LOCK-1 (`docs/decisions/stage-4-reactivity-pivot.html`), domain
+ * ports do not expose reactive callback methods — this pair lives on the
+ * substrate port that owns `subscribe` (#1145 re-homed it from the former
+ * `ports/subscription.ts`, which was never a port).
+ *
+ * @internal-use
+ */
+type Snapshot<T, E = CapxulError> = {
+  readonly status: "loading";
+} | {
+  readonly status: "ok";
+  readonly value: T;
+} | {
+  readonly status: "error";
+  readonly error: E;
+};
+declare const ConvexCallError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "ConvexCallError";
+} & Readonly<A>;
+declare class ConvexCallError extends ConvexCallError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface ConvexCallPort {
+  query<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"query", "public", TArgs, TOutput>, args: TArgs): Effect.Effect<TOutput, ConvexCallError>;
+  mutation<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"mutation", "public", TArgs, TOutput>, args: TArgs): Effect.Effect<TOutput, ConvexCallError>;
+  action<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"action", "public", TArgs, TOutput>, args: TArgs): Effect.Effect<TOutput, ConvexCallError>;
+  /**
+   * Substrate-level reactive transport over Convex's `onUpdate`.
+   *
+   * @internal-use — substrate only; see `ports/subscription.ts`. Domain
+   * ports do not expose reactive callback methods to consumers (ARCH-LOCK-1).
+   */
+  subscribe<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"query", "public", TArgs, TOutput>, args: TArgs, callback: (snapshot: Snapshot<TOutput>) => void): Effect.Effect<Unsubscribe, ConvexCallError>;
+}
+//#endregion
+//#region src/ports/identity.d.ts
+type CreateIdentityInput = {
+  readonly authUserId: AuthUserId;
+  readonly email: Email;
+  readonly displayName?: string;
+  readonly country?: CountryCode;
+};
+type UpdateIdentityInput = {
+  readonly authUserId: AuthUserId;
+  readonly displayName?: string;
+  readonly country?: CountryCode;
+};
+/**
+ * D-ONBOARD (#669) — the onboarding-complete identity write. Composes the
+ * existing create/update write into one idempotent upsert that ALSO sets the
+ * `onboarded` flag and persists the optional `withdrawalAddress` (the one
+ * allowed raw-0x class). `displayName` + `country` are required at onboarding
+ * time. The returned `Profile` is the existing branded shape — the onboarding
+ * flags live on the wire row and are not projected onto the read surface.
+ */
+type CompleteOnboardingIdentityInput = {
+  readonly authUserId: AuthUserId;
+  readonly email: Email;
+  readonly displayName: string;
+  readonly country: CountryCode;
+  readonly withdrawalAddress?: Address; /** #1062: optional globally-unique handle — store-when-present, backend-normalized. */
+  readonly username?: string;
+};
+declare const IdentityError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "IdentityError";
+} & Readonly<A>;
+declare class IdentityError extends IdentityError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface IdentityPort {
+  loadByAuthUserId(authUserId: AuthUserId): Effect.Effect<Profile | null, IdentityError, never>;
+  create(input: CreateIdentityInput): Effect.Effect<Profile, IdentityError, never>;
+  update(input: UpdateIdentityInput): Effect.Effect<Profile, IdentityError, never>;
+  /** D-ONBOARD (#669): idempotent upsert that marks the identity onboarded. */
+  completeOnboarding(input: CompleteOnboardingIdentityInput): Effect.Effect<Profile, IdentityError, never>;
+}
+//#endregion
+//#region src/ports/smart-account.d.ts
+/**
+ * Configuration for a Safe deployment: the chain + RPC endpoint +
+ * gas-sponsorship policy. `receiptTimeoutMs` is optional; the deploying
+ * adapter applies a default when omitted.
+ *
+ * #1145 (DEMOLITION §D4): re-homed here from the deleted
+ * `ports/safe-deployment.ts`. The SafeDeploymentPort itself was fakes-only
+ * plus one e2e adapter; the real Safe lifecycle is backend-orchestrated
+ * through this port. Only the two data shapes below survive on the SDK
+ * surface — `SafeDeploymentConfig` parameterises the org-deploy seam
+ * (`orgDeploymentConfig`), `SafeDeploymentEvidence` is the payload of
+ * `confirmDeployment`.
+ */
+type SafeDeploymentConfig = {
+  readonly chainId: ChainId;
+  readonly rpcUrl: string;
+  readonly gasPolicyId: string;
+  readonly receiptTimeoutMs?: DurationMs;
+};
+/**
+ * Evidence of a successful Safe deployment.
+ *
+ * Every field except `chainId` / `signerAddress` / `safeAddress` is
+ * optional because the AC8 precheck short-circuit path (Safe already
+ * on-chain at this address; off-chain receipt evidence unavailable)
+ * calls the persistence step WITHOUT a `userOpHash`, `txHash`, or
+ * `blockNumber` — there is no recoverable transaction. Aaron's rule:
+ * "If there is no TX and it hasn't been deployed then there shouldn't
+ * be a hash." End-to-end nullable: `v.optional(v.string())` in the
+ * backend schema.
+ *
+ * **`deployedAt` is NOT a field on this type.** The SDK is never the
+ * oracle for `deployedAt`. The backend (`confirmDeployment` action —
+ * Convex mutations cannot `fetch`, so the chain re-verification lives
+ * in an action) derives it from on-chain data — `eth_getUserOperationReceipt`
+ * for the real-userOp path or `eth_getLogs` for the precheck path —
+ * then resolves the receipt block's timestamp via `eth_getBlockByNumber`.
+ * See `packages/sdk/docs/architecture.md` for the deployment trust boundary.
+ */
+type SafeDeploymentEvidence = {
+  readonly chainId: ChainId;
+  readonly signerAddress: Address;
+  readonly safeAddress: Address;
+  readonly txHash?: TxHash;
+  readonly userOpHash?: TxHash;
+  readonly blockNumber?: BlockNumber;
+};
+type ProvisionInput = {
+  readonly authUserId: AuthUserId;
+  readonly chainId: ChainId;
+};
+/**
+ * Input to `SmartAccountPort.confirmDeployment` (#161 · γ-B).
+ *
+ * The SDK provides evidence pointers; the backend is the oracle for
+ * `deployedAt`. `evidence.deployedAt` does NOT exist by schema (see
+ * `SafeDeploymentEvidence`) — the backend derives `deployedAt` from
+ * the on-chain receipt block via `eth_getBlockByNumber`.
+ *
+ * Precheck path: `evidence.userOpHash` omitted; backend scans
+ * `SafeProxyFactory.ProxyCreation(safeAddress, _)` via `eth_getLogs`.
+ *
+ * Real-userOp path: `evidence.userOpHash` populated; backend calls
+ * `eth_getUserOperationReceipt(userOpHash)` to re-verify and derive.
+ */
+type ConfirmDeploymentInput = {
+  readonly authUserId: AuthUserId;
+  readonly chainId: ChainId;
+  readonly safeAddress: Address;
+  readonly evidence: SafeDeploymentEvidence;
+  /**
+   * Optional live-E2E correlation id. This does not prove deployment; the
+   * backend still re-verifies chain evidence and only mirrors this branded
+   * id onto telemetry for PostHog run joins.
+   */
+  readonly telemetryRunId?: RunId;
+};
+/**
+ * Input to `SmartAccountPort.claim` (PRD #462). The authenticated session
+ * reports the browser-created signer address; the BACKEND builds and
+ * bootstrap-signs the claim userOp (deploy + swapOwner) — the consumer signs
+ * nothing at claim.
+ */
+type ClaimInput = {
+  readonly authUserId: AuthUserId;
+  readonly chainId: ChainId;
+  readonly signerAddress: Address;
+  readonly telemetryRunId?: RunId;
+};
+declare const SmartAccountError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "SmartAccountError";
+} & Readonly<A>;
+declare class SmartAccountError extends SmartAccountError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface SmartAccountPort {
+  loadByAuthUserId(authUserId: AuthUserId): Effect.Effect<SmartAccount | null, SmartAccountError, never>;
+  loadBySmartAccountAddress(address: Address): Effect.Effect<SmartAccount | null, SmartAccountError, never>;
+  provision(input: ProvisionInput): Effect.Effect<SmartAccount, SmartAccountError, never>;
+  /**
+   * Persist on-chain Safe-deployment evidence. The backend re-verifies
+   * the evidence against chain state and derives `deployedAt` from the
+   * receipt block's timestamp. Returns the updated `SmartAccount` row.
+   *
+   * γ-B trust model: the SDK supplies evidence pointers only. The
+   * backend is the SOLE oracle for `deployedAt` — see
+   * `packages/sdk/docs/architecture.md`.
+   */
+  confirmDeployment(input: ConfirmDeploymentInput): Effect.Effect<SmartAccount, SmartAccountError, never>;
+  /**
+   * Claim the account (PRD #462): the backend builds, bootstrap-signs, and
+   * submits ONE sponsored userOp — deploy (when undeployed) + swapOwner
+   * (bootstrap → `signerAddress`). Idempotent; returns the updated row. When
+   * another claim is in flight the row comes back with `claimedAt: null` —
+   * callers poll lifecycle until the claim lands.
+   */
+  claim(input: ClaimInput): Effect.Effect<SmartAccount, SmartAccountError, never>;
+}
+//#endregion
+//#region src/ports/account-read.d.ts
+type ReadAccountBalanceInput = {
+  readonly chainId: ChainId;
+};
+type FundFromFaucetInput = {
+  readonly chainId: ChainId;
+  readonly amount: Money;
+};
+type FundFromFaucetResult = {
+  readonly txHash: string;
+};
+declare const AccountReadError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "AccountReadError";
+} & Readonly<A>;
+declare class AccountReadError extends AccountReadError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+/**
+ * Logical Account money read (M2 Slice S1a). Joins the `accounts` row with a
+ * live RPC `balanceOf` pull; the adapter lifts wire integers to `Money`.
+ */
+interface AccountReadPort {
+  readBalance(input: ReadAccountBalanceInput): Effect.Effect<Account$1, AccountReadError, never>;
+  fundFromFaucet(input: FundFromFaucetInput): Effect.Effect<FundFromFaucetResult, AccountReadError, never>;
+}
+//#endregion
+//#region src/ports/sub-account.d.ts
+declare const SubAccountError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "SubAccountError";
+} & Readonly<A>;
+declare class SubAccountError extends SubAccountError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+type CreateSubAccountInput = {
+  readonly accountId: AccountId;
+  readonly name: string;
+};
+type SubAccountIdInput = {
+  readonly subAccountId: SubAccountId;
+};
+type RenameSubAccountInput = {
+  readonly subAccountId: SubAccountId;
+  readonly name: string;
+};
+/**
+ * A `transfer` endpoint is either the Account's MAIN balance (the remainder
+ * left over after every sub-account is funded — never a stored row) or a
+ * specific sub-account, addressed by its `SubAccountId` (canon
+ * `account-balance-model.md` §5, §12).
+ */
+type TransferEndpoint = "main" | SubAccountId;
+/**
+ * Move money between two of the SAME Account's balances (canon §12). The
+ * backend resolves the Account from auth (v1 = one Account per user), so the
+ * input carries no `accountId` — only the from/to endpoints and the `Money`
+ * amount. One verb covers money in (`main → sub`), money out (`sub → main`),
+ * and `sub → sub`.
+ */
+type TransferInput = {
+  readonly from: TransferEndpoint;
+  readonly to: TransferEndpoint;
+  readonly amount: Money;
+};
+/**
+ * Result of a `transfer`: the recomputed `available` (`balanceOf − Σ`), plus
+ * the updated source/destination sub-account rows. An endpoint that is `"main"`
+ * has no stored row, so its slot is `null`.
+ */
+type TransferResult = {
+  readonly available: Money;
+  readonly from: SubAccount | null;
+  readonly to: SubAccount | null;
+};
+interface SubAccountPort {
+  create(input: CreateSubAccountInput): Effect.Effect<SubAccount, SubAccountError, never>;
+  get(input: SubAccountIdInput): Effect.Effect<SubAccount | null, SubAccountError, never>;
+  list(input: {
+    readonly accountId: AccountId;
+  }): Effect.Effect<readonly SubAccount[], SubAccountError, never>;
+  rename(input: RenameSubAccountInput): Effect.Effect<SubAccount, SubAccountError, never>;
+  delete(input: SubAccountIdInput): Effect.Effect<void, SubAccountError, never>;
+  transfer(input: TransferInput): Effect.Effect<TransferResult, SubAccountError, never>;
+}
+//#endregion
+//#region src/flows/types.d.ts
+/**
+ * The full 10-port bundle that `assembleCapxulClient` (slice 5) consumes.
+ * (Was 13 before #1145 / DEMOLITION §D4 deleted the credentials, env and
+ * transport ports — built by `production.ts`, read by nobody.)
+ *
+ * The identity actor receives this bundle through `BootIdentityFlowInput` and
+ * uses only the existing ports needed by each work lane. Other domain flows
+ * retain their own narrowed inputs.
+ */
+interface FlowPorts {
+  readonly authClient: AuthClientPort;
+  readonly authCache: AuthCachePort;
+  readonly identity: IdentityPort;
+  readonly smartAccount: SmartAccountPort;
+  readonly accountRead: AccountReadPort;
+  readonly subAccount: SubAccountPort;
+  readonly bootstrap: BootstrapPort;
+  readonly clock: ClockPort;
+  readonly telemetry: TelemetryPort;
+  readonly convexCall: ConvexCallPort;
+}
+/** Legacy method input retained by the imperative auth surface. */
+interface ExternalSigner {
+  readonly address: Address;
+  readonly signedProof: string;
+}
+//#endregion
+//#region ../wire/src/observation-context.d.ts
+/**
+ * Bounded, non-authoritative observation metadata carried by selected SDK
+ * calls. Actor identity is deliberately absent: the backend derives it from
+ * the authenticated session and verifies organization/application hints.
+ */
+interface WireObservationContext {
+  readonly application?: string;
+  readonly applicationId?: string;
+  readonly release?: string;
+  readonly sessionId?: string;
+  readonly organizationId?: string;
+  readonly journeyId?: string;
+  readonly correlationId?: string;
+  readonly anonymousId?: string;
+  /** W3C trace carrier for the explicit Convex action hop; never product identity. */
+  readonly traceparent?: string;
+}
+//#endregion
+//#region src/surface/org-lifecycle.d.ts
+type OrgSetupStep = "preparingFounderAccount" | "awaitingFounderAuthorization" | "submittingBootstrap" | "confirmingBootstrap";
+/** Leak-safe readiness for exactly one Organization. */
+type OrgLifecycle = {
+  readonly status: "loading";
+  readonly orgId: OrgId;
+} | {
+  readonly status: "settingUp";
+  readonly orgId: OrgId;
+  readonly step: OrgSetupStep;
+} | {
+  readonly status: "ready";
+  readonly orgId: OrgId;
+  readonly canTransact: true;
+} | {
+  readonly status: "failed";
+  readonly orgId: OrgId;
+  readonly at: OrgSetupStep;
+  readonly error: CapxulError;
+  readonly retryable: boolean;
+};
+type StartOrResumeOrganizationInput = {
+  readonly name: string;
+  readonly handle: string;
+  readonly country: string; /** #1064: optional onboarding-collected description + size bucket. */
+  readonly bio?: string;
+  readonly size?: string; /** @internal Safe trace/correlation carriage owned by the identity flow. */
+  readonly observationContext?: WireObservationContext;
+};
+type OrganizationSetupStepInput = {
+  readonly orgId: OrgId;
+  readonly signal?: AbortSignal; /** @internal Safe trace/correlation carriage owned by the identity flow. */
+  readonly observationContext?: WireObservationContext;
+};
+type RecordOrganizationSetupFailureInput = {
+  readonly orgId: OrgId;
+  readonly error: CapxulError;
+  readonly retryable: boolean; /** @internal Safe trace/correlation carriage owned by the identity flow. */
+  readonly observationContext?: WireObservationContext;
+};
+/**
+ * Internal capability set used by the Core SDK's deep Organization boundary.
+ * Consumers never coordinate these steps directly. Production composition
+ * supplies them; hermetic contract tests provide a stateful implementation.
+ */
+interface OrganizationSetupOps {
+  startOrResume(input: StartOrResumeOrganizationInput): Promise<CapxulResult<{
+    readonly orgId: OrgId;
+    readonly lifecycle: OrgLifecycle;
+  }>>;
+  /** Completes and verifies the founder Account ownership handoff. */
+  prepareFounderAccount(input: OrganizationSetupStepInput): Promise<CapxulResult<OrgLifecycle>>;
+  /** Obtains configured signer authorization and submits the bootstrap once. */
+  authorizeAndSubmitBootstrap(input: OrganizationSetupStepInput): Promise<CapxulResult<OrgLifecycle>>;
+  /** Resumes a recorded provider-known submission without invoking the signer. */
+  resumeSubmittedBootstrap(input: OrganizationSetupStepInput): Promise<CapxulResult<OrgLifecycle>>;
+  /** Confirms a previously recorded submission without requesting authorization again. */
+  confirmSubmittedBootstrap(input: OrganizationSetupStepInput): Promise<CapxulResult<OrgLifecycle>>;
+  recordFailure(input: RecordOrganizationSetupFailureInput): Promise<CapxulResult<OrgLifecycle>>;
+  loadLifecycle(input: {
+    readonly orgId: OrgId;
+    readonly observationContext?: WireObservationContext;
+  }): Promise<CapxulResult<OrgLifecycle>>;
+  /** Resets durable failure state only; the Core SDK resumes the correct step. */
+  retry(input: OrganizationSetupStepInput): Promise<CapxulResult<OrgLifecycle>>;
+}
+//#endregion
+//#region src/flows/identity.d.ts
+interface IdentityActor extends Actor<IdentityState, IdentityEvent, RefusalReason> {
+  /** Full provider session retained beside the deliberately minimal model session. */
+  readonly authSession: () => AuthSession | null;
+  /** Trust a cache-resumed provider session before a later ReadSession verifies it. */
+  readonly restoreAuthSession: (session: AuthSession, controls?: InvocationControls) => Effect.Effect<IdentityState, ActorFailure<RefusalReason | CapxulErrorCode>>;
+}
+//#endregion
+//#region src/surface/auth.d.ts
+type AuthMethodOptions = InvocationControls;
+type SignInOptions = AuthMethodOptions;
+interface AuthMethods {
+  canSendOtp(input: {
+    readonly email: string;
+  }, options?: AuthMethodOptions): Promise<CapxulResult<CanSendOtpStatus>>;
+  signIn(input: {
+    readonly email: string;
+  }, options?: SignInOptions): Promise<CapxulResult<{
+    readonly sessionId: string;
+    readonly expiresAt: number;
+  }>>;
+  verifyOtp(input: {
+    readonly email: string;
+    readonly code: string;
+    readonly signer?: ExternalSigner;
+  }, options?: AuthMethodOptions): Promise<CapxulResult<Session$1>>;
+  signOut(options?: AuthMethodOptions): Promise<CapxulResult<void>>;
+  getSession(options?: AuthMethodOptions): Promise<CapxulResult<Session$1 | null>>;
+}
+//#endregion
+//#region src/surface/smart-account.d.ts
+interface SmartAccountMethods {
+  loadCurrent(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<SmartAccount$1 | null>>;
+  provision(input?: {
+    readonly externalSigner?: ExternalSigner;
+  }): Promise<CapxulResult<SmartAccount$1>>;
+}
+//#endregion
+//#region src/surface/identity.d.ts
+interface IdentityMethods {
+  loadCurrent(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Profile$1 | null>>;
+  /**
+   * #1062: availability probe for the username the user is typing. Returns the
+   * canonical stored form so the UI can echo it.
+   */
+  usernameAvailable(username: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<{
+    readonly available: boolean;
+    readonly normalized: string;
+  }>>;
+}
+//#endregion
+//#region src/surface/account-lifecycle.d.ts
+type ProvisioningFailureStep = "wallet" | "identity" | "provision" | "deploy";
+type ProvisioningPhase = {
+  readonly status: "idle";
+} | {
+  readonly status: "wallet";
+} | {
+  readonly status: "identity";
+} | {
+  readonly status: "provision";
+} | {
+  readonly status: "deploy";
+} | {
+  readonly status: "ready";
+} | {
+  readonly status: "failed";
+  readonly at: ProvisioningFailureStep;
+  readonly error: CapxulError;
+};
+type AccountSetupStep = "connecting" | "confirmingIdentity" | "registering" | "activating";
+type AccountLifecycle = {
+  readonly status: "loading";
+} | {
+  readonly status: "settingUp";
+  readonly step: AccountSetupStep;
+} | {
+  readonly status: "ready";
+  readonly accountId: string;
+  readonly canTransact: boolean;
+} | {
+  readonly status: "failed";
+  readonly at: AccountSetupStep;
+  readonly error: CapxulError;
+};
+declare function isSettingUpLifecycle(lifecycle: AccountLifecycle): boolean;
+//#endregion
+//#region ../wire/src/status.d.ts
+/** Payment lifecycle states carried on the wire (ADR-0018 P1). */
+declare const PAYMENT_STATUSES: readonly ["pending", "submitted", "pending_claim", "scheduled", "streaming", "settled", "cancelled", "redirected", "expired", "failed"];
+type PaymentStatus$1 = (typeof PAYMENT_STATUSES)[number];
+/** What a payment is FOR. Pairs with `PAYMENT_DOCUMENT_KINDS`. */
+declare const PAYMENT_TYPES: readonly ["unspecified", "invoice", "payroll", "reimbursement"];
+type PaymentType$1 = (typeof PAYMENT_TYPES)[number];
+/** Attachable document kinds; each maps to exactly one `PaymentType`. */
+declare const PAYMENT_DOCUMENT_KINDS: readonly ["memo", "invoice", "payslip", "receipt", "withdrawal"];
+type PaymentDocumentKind$1 = (typeof PAYMENT_DOCUMENT_KINDS)[number];
+/** Lifecycle of a payment REQUEST as its issuer sees it. */
+declare const REQUEST_STATUSES: readonly ["draft", "sent", "viewed", "pending_settlement", "paid", "declined", "cancelled", "expired"];
+type RequestStatus = (typeof REQUEST_STATUSES)[number];
+/** The same request as its RECIPIENT sees it, in the approval inbox. */
+declare const INBOX_STATUSES: readonly ["open", "approved", "declined", "paid", "cancelled", "expired"];
+type InboxStatus = (typeof INBOX_STATUSES)[number];
+//#endregion
+//#region ../wire/src/financial-ops.d.ts
+declare const AttachablePaymentDocumentEnvelope: Schema.Union<readonly [Schema.Struct<{
+  readonly protocol: Schema.Literal<"capxul.payment-document">;
+  readonly version: Schema.Literal<1>;
+  readonly domain: Schema.Struct<{
+    readonly name: Schema.Literal<"CapxulPayments">;
+    readonly version: Schema.Literal<"1">;
+    readonly chainId: Schema.Codec<ChainId, number, never, never>;
+    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
+  }>;
+  readonly primaryType: Schema.Literal<"Memo">;
+  readonly message: Schema.Struct<{
+    readonly kind: Schema.Literal<0>;
+    readonly reference: Schema.String;
+    readonly note: Schema.String;
+    readonly issuedAt: Schema.Number;
+  }>;
+}>, Schema.Struct<{
+  readonly protocol: Schema.Literal<"capxul.payment-document">;
+  readonly version: Schema.Literal<1>;
+  readonly domain: Schema.Struct<{
+    readonly name: Schema.Literal<"CapxulPayments">;
+    readonly version: Schema.Literal<"1">;
+    readonly chainId: Schema.Codec<ChainId, number, never, never>;
+    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
+  }>;
+  readonly primaryType: Schema.Literal<"Invoice">;
+  readonly message: Schema.Struct<{
+    readonly kind: Schema.Literal<1>;
+    readonly invoiceNumber: Schema.String;
+    readonly payerRef: Schema.String;
+    readonly payeeRef: Schema.String;
+    readonly amount: Schema.String;
+    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
+    readonly decimals: Schema.Number;
+    readonly issuedAt: Schema.Number;
+    readonly dueAt: Schema.Number;
+    readonly lineItemsHash: Schema.Codec<DocumentHash, string, never, never>;
+  }>;
+}>, Schema.Struct<{
+  readonly protocol: Schema.Literal<"capxul.payment-document">;
+  readonly version: Schema.Literal<1>;
+  readonly domain: Schema.Struct<{
+    readonly name: Schema.Literal<"CapxulPayments">;
+    readonly version: Schema.Literal<"1">;
+    readonly chainId: Schema.Codec<ChainId, number, never, never>;
+    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
+  }>;
+  readonly primaryType: Schema.Literal<"Payslip">;
+  readonly message: Schema.Struct<{
+    readonly kind: Schema.Literal<2>;
+    readonly employerRef: Schema.String;
+    readonly employeeRef: Schema.String;
+    readonly period: Schema.String;
+    readonly gross: Schema.String;
+    readonly net: Schema.String;
+    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
+    readonly decimals: Schema.Number;
+    readonly issuedAt: Schema.Number;
+  }>;
+}>, Schema.Struct<{
+  readonly protocol: Schema.Literal<"capxul.payment-document">;
+  readonly version: Schema.Literal<1>;
+  readonly domain: Schema.Struct<{
+    readonly name: Schema.Literal<"CapxulPayments">;
+    readonly version: Schema.Literal<"1">;
+    readonly chainId: Schema.Codec<ChainId, number, never, never>;
+    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
+  }>;
+  readonly primaryType: Schema.Literal<"Receipt">;
+  readonly message: Schema.Struct<{
+    readonly kind: Schema.Literal<3>;
+    readonly reference: Schema.String;
+    readonly amount: Schema.String;
+    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
+    readonly decimals: Schema.Number;
+    readonly paidAt: Schema.Number;
+    readonly note: Schema.String;
+  }>;
+}>]>;
+declare const WithdrawalDocumentEnvelope: Schema.Struct<{
+  readonly protocol: Schema.Literal<"capxul.payment-document">;
+  readonly version: Schema.Literal<1>;
+  readonly domain: Schema.Struct<{
+    readonly name: Schema.Literal<"CapxulPayments">;
+    readonly version: Schema.Literal<"1">;
+    readonly chainId: Schema.Codec<ChainId, number, never, never>;
+    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
+  }>;
+  readonly primaryType: Schema.Literal<"Withdrawal">;
+  readonly message: Schema.Struct<{
+    readonly kind: Schema.Literal<4>;
+    readonly reference: Schema.String;
+    readonly amount: Schema.String;
+    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
+    readonly decimals: Schema.Number;
+    readonly destChain: Schema.Codec<ChainId, number, never, never>;
+    readonly destAddress: Schema.String;
+    readonly settledAt: Schema.Number;
+    readonly provider: Schema.String;
+    readonly note: Schema.String;
+  }>;
+}>;
+declare const PaymentDocumentEnvelope: Schema.Union<readonly [Schema.Union<readonly [Schema.Struct<{
+  readonly protocol: Schema.Literal<"capxul.payment-document">;
+  readonly version: Schema.Literal<1>;
+  readonly domain: Schema.Struct<{
+    readonly name: Schema.Literal<"CapxulPayments">;
+    readonly version: Schema.Literal<"1">;
+    readonly chainId: Schema.Codec<ChainId, number, never, never>;
+    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
+  }>;
+  readonly primaryType: Schema.Literal<"Memo">;
+  readonly message: Schema.Struct<{
+    readonly kind: Schema.Literal<0>;
+    readonly reference: Schema.String;
+    readonly note: Schema.String;
+    readonly issuedAt: Schema.Number;
+  }>;
+}>, Schema.Struct<{
+  readonly protocol: Schema.Literal<"capxul.payment-document">;
+  readonly version: Schema.Literal<1>;
+  readonly domain: Schema.Struct<{
+    readonly name: Schema.Literal<"CapxulPayments">;
+    readonly version: Schema.Literal<"1">;
+    readonly chainId: Schema.Codec<ChainId, number, never, never>;
+    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
+  }>;
+  readonly primaryType: Schema.Literal<"Invoice">;
+  readonly message: Schema.Struct<{
+    readonly kind: Schema.Literal<1>;
+    readonly invoiceNumber: Schema.String;
+    readonly payerRef: Schema.String;
+    readonly payeeRef: Schema.String;
+    readonly amount: Schema.String;
+    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
+    readonly decimals: Schema.Number;
+    readonly issuedAt: Schema.Number;
+    readonly dueAt: Schema.Number;
+    readonly lineItemsHash: Schema.Codec<DocumentHash, string, never, never>;
+  }>;
+}>, Schema.Struct<{
+  readonly protocol: Schema.Literal<"capxul.payment-document">;
+  readonly version: Schema.Literal<1>;
+  readonly domain: Schema.Struct<{
+    readonly name: Schema.Literal<"CapxulPayments">;
+    readonly version: Schema.Literal<"1">;
+    readonly chainId: Schema.Codec<ChainId, number, never, never>;
+    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
+  }>;
+  readonly primaryType: Schema.Literal<"Payslip">;
+  readonly message: Schema.Struct<{
+    readonly kind: Schema.Literal<2>;
+    readonly employerRef: Schema.String;
+    readonly employeeRef: Schema.String;
+    readonly period: Schema.String;
+    readonly gross: Schema.String;
+    readonly net: Schema.String;
+    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
+    readonly decimals: Schema.Number;
+    readonly issuedAt: Schema.Number;
+  }>;
+}>, Schema.Struct<{
+  readonly protocol: Schema.Literal<"capxul.payment-document">;
+  readonly version: Schema.Literal<1>;
+  readonly domain: Schema.Struct<{
+    readonly name: Schema.Literal<"CapxulPayments">;
+    readonly version: Schema.Literal<"1">;
+    readonly chainId: Schema.Codec<ChainId, number, never, never>;
+    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
+  }>;
+  readonly primaryType: Schema.Literal<"Receipt">;
+  readonly message: Schema.Struct<{
+    readonly kind: Schema.Literal<3>;
+    readonly reference: Schema.String;
+    readonly amount: Schema.String;
+    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
+    readonly decimals: Schema.Number;
+    readonly paidAt: Schema.Number;
+    readonly note: Schema.String;
+  }>;
+}>]>, Schema.Struct<{
+  readonly protocol: Schema.Literal<"capxul.payment-document">;
+  readonly version: Schema.Literal<1>;
+  readonly domain: Schema.Struct<{
+    readonly name: Schema.Literal<"CapxulPayments">;
+    readonly version: Schema.Literal<"1">;
+    readonly chainId: Schema.Codec<ChainId, number, never, never>;
+    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
+  }>;
+  readonly primaryType: Schema.Literal<"Withdrawal">;
+  readonly message: Schema.Struct<{
+    readonly kind: Schema.Literal<4>;
+    readonly reference: Schema.String;
+    readonly amount: Schema.String;
+    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
+    readonly decimals: Schema.Number;
+    readonly destChain: Schema.Codec<ChainId, number, never, never>;
+    readonly destAddress: Schema.String;
+    readonly settledAt: Schema.Number;
+    readonly provider: Schema.String;
+    readonly note: Schema.String;
+  }>;
+}>]>;
+/**
+ * #592 invoice line item. `quantity` is a positive integer; `unitMinor` is the
+ * per-unit price in integer minor units. The list is canonically hashed by
+ * `hashLineItems` (payment-document-hash.ts) into the Invoice `lineItemsHash`,
+ * and Σ(quantity × unitMinor) MUST equal the invoice `amount`. The hash binds
+ * the documentHash to the exact items; the sum-check makes the items add up to
+ * the amount due. See the financial-operations contract in `packages/wire/CONTEXT.md`.
+ */
+declare const LineItem: Schema.Struct<{
+  readonly description: Schema.String;
+  readonly quantity: Schema.Number;
+  readonly unitMinor: Schema.String;
+}>;
+type AttachablePaymentDocumentEnvelopeV1 = Schema.Schema.Type<typeof AttachablePaymentDocumentEnvelope>;
+type PaymentDocumentEnvelopeV1 = Schema.Schema.Type<typeof PaymentDocumentEnvelope>;
+type WithdrawalDocumentEnvelopeV1 = Schema.Schema.Type<typeof WithdrawalDocumentEnvelope>;
+type LineItemV1 = Schema.Schema.Type<typeof LineItem>;
+//#endregion
+//#region ../wire/src/leak-safety.d.ts
+declare const OnchainEvidenceBrand: unique symbol;
+/**
+ * The branded `{ userOpHash, txHash }` pair. On-chain settlement evidence is
+ * INTERNAL — it flows on the server-internal channel only, never onto a wire
+ * Payment or any MCP tool output. The brand makes "this is internal evidence"
+ * a type, so a loose pair can't be passed where a wire field is expected.
+ */
+type OnchainEvidence = {
+  readonly userOpHash: string;
+  readonly txHash: string;
+} & {
+  readonly [OnchainEvidenceBrand]: "OnchainEvidence";
+};
+//#endregion
+//#region src/surface/money.d.ts
+type ActorReference = {
+  readonly kind: "personal";
+} | {
+  readonly kind: "organization";
+  readonly organizationId: string;
+};
+type TargetReference = {
+  readonly kind: "handle";
+  readonly handle: string;
+} | {
+  readonly kind: "email";
+  readonly email: string;
+} | {
+  readonly kind: "organization";
+  readonly handle: string;
+} | {
+  readonly kind: "payee";
+  readonly id: string;
+} | {
+  readonly kind: "destination";
+  readonly id: string;
+};
+interface ResolvedTarget {
+  readonly reference: TargetReference;
+  readonly label: string;
+  readonly kind: "person" | "organization" | "payee" | "destination";
+  readonly capabilities: {
+    readonly canPay: boolean;
+    readonly canRequest: boolean;
+    readonly canPayout: boolean;
+  };
+}
+interface TargetsMethods {
+  resolve(reference: TargetReference, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<ResolvedTarget>>;
+}
+type RecipientResolutionKind = "email" | "org" | "payee";
+type Ref$1 = {
+  readonly kind: "handle";
+  readonly handle: string;
+} | {
+  readonly kind: "email";
+  readonly email: string;
+} | {
+  readonly kind: "orgHandle";
+  readonly orgHandle: string;
+} | {
+  readonly kind: "capxulUserId";
+  readonly capxulUserId: string;
+} | {
+  readonly kind: "payeeId";
+  readonly payeeId: string;
+};
+interface MeProfile {
+  readonly authUserId: string;
+  readonly email: string;
+  readonly displayName: string | null;
+}
+interface DepositInstructions {
+  readonly accountKind: "personalSafe" | "orgTreasury";
+  readonly chainId: number;
+  readonly network: "base-sepolia";
+  readonly currency: "USD";
+  readonly address: string;
+  readonly label: string;
+}
+interface RecipientResolution {
+  readonly kind: RecipientResolutionKind;
+  readonly recipient: string;
+  readonly label: string;
+  readonly safeAddress: string;
+  readonly payeeId?: string;
+  readonly orgId?: string;
+  readonly handle?: string;
+  readonly email?: string;
+}
+interface Payee {
+  readonly payeeId: string;
+  readonly label: string;
+  readonly recipientRef: string;
+  readonly handle: string | null;
+  readonly destinationKind: "email" | "org" | "payeeHandle";
+  readonly safeAddress: string;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+}
+interface MeMethods {
+  get(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<MeProfile>>;
+  depositInstructions(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<DepositInstructions>>;
+}
+interface HandlesMethods {
+  resolve(handle: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<RecipientResolution>>;
+}
+interface PayeesMethods {
+  create(input: {
+    readonly label: string;
+    readonly recipient: string;
+    readonly handle?: string;
+  }, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payee>>;
+  get(payeeId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payee | null>>;
+  resolve(recipient: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<RecipientResolution>>;
+}
+interface PaymentMoney {
+  readonly currency: string;
+  readonly value: string;
+  readonly decimals: number;
+}
+type PaymentStatus = PaymentStatus$1;
+type PaymentType = PaymentType$1;
+type PaymentDocumentKind = PaymentDocumentKind$1;
+interface PaymentDocumentRef {
+  readonly documentHash: string;
+  readonly kind: PaymentDocumentKind;
+  readonly title?: string;
+  readonly uri?: string;
+  readonly issuedAt?: number;
+}
+type PaymentTiming = {
+  readonly kind: "instant";
+} | {
+  readonly kind: "scheduled";
+  readonly at: number;
+} | {
+  readonly kind: "stream";
+  readonly startsAt: number;
+  readonly endsAt: number;
+  readonly cliffAt?: number;
+};
+interface Payment {
+  readonly id: string;
+  readonly status: PaymentStatus;
+  readonly amount: PaymentMoney;
+  readonly paymentType: PaymentType;
+  readonly recipient: {
+    readonly kind: "handle" | "email" | "payee" | "capxulUserId" | "me" | "org" | "external_address";
+    readonly label: string;
+    readonly payeeId?: string;
+  };
+  readonly documents: readonly PaymentDocumentRef[];
+  readonly timing: PaymentTiming;
+  readonly released: PaymentMoney;
+  readonly availableToClaim: PaymentMoney;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+}
+interface PaymentsPayInput {
+  readonly actor?: ActorReference;
+  readonly to: TargetReference;
+  readonly amount: PaymentMoney;
+  /**
+   * How the payment is classified on the ledger. When a `document` is
+   * attached, the type derived from the document kind is AUTHORITATIVE
+   * (memo → unspecified, invoice → invoice, payslip → payroll, receipt →
+   * reimbursement) — an explicit conflicting value is rejected with
+   * INVALID_INPUT ("must match the attached document kind"). With no
+   * document the explicit value is honored, defaulting to "unspecified".
+   */
+  readonly paymentType?: PaymentType;
+  /** Full EIP-712 document envelope; hashed + stored, committed on-chain. */
+  readonly document?: AttachablePaymentDocumentEnvelopeV1;
+  /**
+   * Timing clause (D-SHAPE · #646). Omitted ⇒ `instant` (the G2 direct-send path).
+   * A `scheduled`/`stream` clause turns the payment into a Commitment
+   * (escrow-vest-claim) backed by `CapxulPayments.createCommitment`.
+   */
+  readonly timing?: PaymentTiming;
+  /**
+   * #592: itemized line items backing an Invoice `document`. The backend asserts
+   * `hashLineItems(lineItems) === document.lineItemsHash` AND `Σ(quantity ×
+   * unitMinor) === document.amount`, then persists the list for itemized render.
+   */
+  readonly lineItems?: readonly LineItemV1[];
+}
+/**
+ * B3 withdraw / cash-out input. Stripe-shaped: `to` is the EXTERNAL 0x wallet
+ * (the ONE place the SDK accepts a raw address — the pay lane never does),
+ * `amount` is a Money, `document` is the REQUIRED kind:4 Withdrawal envelope
+ * (carries the audit-visible destAddress). No chain / Safe / token / hash
+ * custody substrate on the input. Returns a leak-safe `Payment` whose recipient
+ * label is the redacted address — never the full 0x.
+ */
+interface PaymentsWithdrawInput {
+  readonly to: string;
+  readonly amount: PaymentMoney;
+  readonly document: WithdrawalDocumentEnvelopeV1;
+}
+/**
+ * Payout via a saved destination. The caller selects the destination by opaque
+ * id and never re-enters a raw wallet address on this path.
+ */
+interface PaymentsPayoutInput {
+  readonly actor?: ActorReference;
+  readonly destinationId: string;
+  readonly amount: PaymentMoney;
+}
+type DestinationKind = "bank_account" | "mobile_money" | "external_account";
+type DestinationRail = {
+  readonly kind: "bank";
+  readonly country: string;
+  readonly currency: string;
+} | {
+  readonly kind: "mobile_money";
+  readonly country: string;
+  readonly currency: string;
+  readonly provider: string;
+} | {
+  readonly kind: "chain";
+  readonly network: string;
+  readonly asset?: string;
+};
+type DestinationPayload = {
+  readonly accountHolderName: string;
+  readonly bankName: string;
+  readonly country: string;
+  readonly currency: string;
+  readonly accountNumberLast4: string;
+} | {
+  readonly provider: string;
+  readonly country: string;
+  readonly currency: string;
+  readonly phoneNumberLast4: string;
+} | {
+  readonly network: "base-sepolia" | "solana-devnet" | "starknet-sepolia";
+  readonly address: string;
+};
+interface Destination {
+  readonly id: string;
+  readonly counterpartyId: string;
+  /** #1063: null exactly when `ownerScope === "self"`. */
+  readonly ref: Ref$1 | null;
+  /** Derived from `ref`; null for self-owned rows. */
+  readonly target: TargetReference | null;
+  readonly kind: DestinationKind;
+  readonly rail: DestinationRail;
+  /**
+   * #1063: "self" = the actor's own payout destination; "counterparty" = the
+   * address-book shape. The mapping always sets it (wire absence ⇒ "counterparty").
+   */
+  readonly ownerScope: "self" | "counterparty";
+  readonly label: string | null;
+  readonly payload: DestinationPayload;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+}
+/** #1063 ratified shape: your own payout destination is `target: { self: true }`. */
+type SelfTarget = {
+  readonly self: true;
+};
+/** #1063: exactly one of `target` (counterparty or `{ self: true }`) or `ref`. */
+interface DestinationAddInput {
+  readonly actor?: ActorReference;
+  readonly target?: TargetReference | SelfTarget;
+  readonly ref?: Ref$1;
+  readonly kind: DestinationKind;
+  readonly label?: string;
+  readonly payload: DestinationPayload;
+}
+interface DestinationListInput {
+  readonly actor?: ActorReference;
+  /** #1063: `{ self: true }` narrows to the actor's own payout destinations. */
+  readonly target?: TargetReference | SelfTarget;
+  readonly ref?: Ref$1;
+  readonly kind?: DestinationKind;
+}
+interface DestinationRemoveInput {
+  readonly actor?: ActorReference;
+  readonly destinationId: string;
+}
+interface DestinationsMethods {
+  add(input: DestinationAddInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Destination>>;
+  list(input: DestinationListInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly Destination[]>>;
+  remove(input: DestinationRemoveInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<{
+    readonly id: string;
+  }>>;
+}
+interface ActivityListParams {
+  readonly actor?: ActorReference;
+  readonly cursor?: string;
+  readonly limit?: number;
+  readonly paymentType?: PaymentType;
+  readonly timing?: PaymentTiming["kind"];
+}
+interface ActivityItem {
+  readonly id: string;
+  readonly actor: ActorReference;
+  readonly kind: "payment" | "payout" | "withdrawal" | "deposit" | "claim";
+  readonly direction: "in" | "out" | "internal";
+  readonly status: PaymentStatus;
+  readonly amount: PaymentMoney;
+  readonly title: string;
+  readonly subtitle: string | null;
+  readonly target: TargetReference | null;
+  readonly paymentId: string | null;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+}
+interface ActivityPage {
+  readonly items: readonly ActivityItem[];
+  readonly nextCursor: string | null;
+}
+interface ActivityMethods {
+  list(params?: ActivityListParams, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<ActivityPage>>;
+}
+interface OfframpQuoteInput {
+  readonly actor?: ActorReference;
+  readonly destinationId: string;
+  readonly amount: PaymentMoney;
+}
+interface OfframpQuote {
+  readonly id: string;
+  readonly input: OfframpQuoteInput;
+  readonly expiresAt: number;
+  readonly receivedAmount: PaymentMoney;
+  readonly fee: PaymentMoney;
+}
+interface OfframpStatus {
+  readonly id: string;
+  readonly status: "pending" | "processing" | "completed" | "failed" | "cancelled";
+  readonly paymentId: string | null;
+  readonly destinationId: string;
+  readonly updatedAt: number;
+}
+interface OfframpMethods {
+  quote(input: OfframpQuoteInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<OfframpQuote>>;
+  status(offrampId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<OfframpStatus>>;
+}
+interface PaymentSettlementInput {
+  readonly paymentId: string;
+  readonly evidence: OnchainEvidence;
+}
+/**
+ * Host-execution callback recording the on-chain escrow of a commitment
+ * (G3 · #546): `createCommitment` returned `onchainCommitmentId`, escrowing
+ * the total. `onchainCommitmentId` + the userOp/tx hashes are internal evidence,
+ * never on the wire (internal channel only).
+ */
+interface CommitmentCreatedInput {
+  readonly paymentId: string;
+  readonly onchainCommitmentId: string;
+  readonly evidence: OnchainEvidence;
+}
+/** Host-execution callback recording a recipient-side `claim` (G3 · #546). */
+interface CommitmentClaimInput {
+  readonly paymentId: string;
+  readonly evidence: OnchainEvidence;
+}
+/**
+ * Host-execution callback recording a creator-side `cancel` (G3 · #546):
+ * on-chain the unvested remainder returns to the creator; vested-unclaimed
+ * stays the recipient's. An optional credit-note document is appended.
+ */
+interface CommitmentCancelInput {
+  readonly paymentId: string;
+  readonly evidence: OnchainEvidence;
+  readonly document?: PaymentDocumentEnvelopeV1;
+}
+/**
+ * Host-execution callback recording a pre-claim `redirect` to a new validated
+ * recipient (G3 · #546). `to` is a validated recipient (handle/email/payee id),
+ * never a raw address.
+ */
+interface CommitmentRedirectInput {
+  readonly paymentId: string;
+  readonly to: Ref$1;
+  readonly evidence: OnchainEvidence;
+  readonly document?: PaymentDocumentEnvelopeV1;
+}
+/**
+ * Host-execution callback recording a settled ORG spend/payroll on the ONE
+ * `payments` ledger (D3 · #565). An org spend is a KIND of Payment — it lands a
+ * real `payments` row with `source:"org"` + `orgId` (no parallel `orgSpends`
+ * table, no synthetic client-side fabrication). The signer-side host calls this
+ * AFTER the on-chain Roles-modifier spend settles; `evidence` carries the
+ * internal userOp/tx hashes (never wire fields). `recipient` is the validated
+ * recipient ref label; `recipientSafeAddress` is internal evidence on the row.
+ */
+interface OrgPaymentRecordInput {
+  readonly orgId: string;
+  readonly recipientLabel: string;
+  readonly recipientKind?: "handle" | "email" | "payee" | "capxulUserId" | "me" | "org";
+  readonly recipientRef?: string;
+  readonly recipientPayeeId?: string;
+  readonly recipientSafeAddress: string;
+  readonly amount: PaymentMoney;
+  readonly paymentType: PaymentType;
+  readonly document?: PaymentDocumentEnvelopeV1;
+  /** The org Safe the spend debited — bound as the `from` of the settlement transfer. */
+  readonly orgSafeAddress: string;
+  /**
+   * 0-based occurrence among batch runs with the same (recipient, amount), so
+   * each run binds to + de-dupes on its own on-chain `Transfer` (D3 · #565).
+   */
+  readonly occurrenceIndex: number;
+  readonly evidence: OnchainEvidence;
+}
+interface PaymentDocumentVerification {
+  readonly documentHash: string;
+  readonly ok: boolean;
+  readonly derivedHash: string;
+  readonly kind: PaymentDocumentKind;
+}
+/**
+ * #577 render-on-demand result. `html` is self-contained user-visible document
+ * HTML (stylesheet + rendered document). The MCP `paymentDocuments.render` tool
+ * exposes only `{documentHash, kind, ok}` to the model and returns `html` in an
+ * audience:["user"] content block (#506 redaction matrix).
+ */
+interface PaymentDocumentRender {
+  readonly documentHash: string;
+  readonly ok: boolean;
+  readonly kind: PaymentDocumentKind;
+  readonly html: string;
+}
+/**
+ * Internal commitment execution reference (G3 · #546). The on-chain
+ * `onchainCommitmentId` is internal evidence (like userOp/tx hashes) — it never
+ * appears on the wire `Payment` or any MCP tool output, but the signer-side host
+ * needs it to build a claim/cancel/redirect UserOp. This is the server-internal
+ * channel that carries it (and the recipient Safe address for an auto-claim
+ * relayer), never a consumer-facing surface.
+ */
+interface PaymentCommitmentRef {
+  readonly paymentId: string;
+  readonly onchainCommitmentId: string | null;
+  readonly status: PaymentStatus;
+}
+/**
+ * The host-execution + on-chain-evidence channel for Payments (D2 · #564).
+ * SPLIT OFF the public `PaymentsMethods` so an external builder consuming
+ * `@capxul/sdk` directly never sees the custody substrate. Reached only via
+ * `client.payments._internal` (mirrors `client._internal.*`); the signer-side
+ * host (the dev MCP edge / a self-custody integrator) drives it AFTER executing
+ * a UserOp. Every input carries the `OnchainEvidence` brand — never a wire field.
+ */
+interface PaymentsInternalMethods {
+  /** Report on-chain settlement evidence for an instant payment. */
+  markSettled(input: PaymentSettlementInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * B3: report on-chain settlement evidence for a withdraw/cash-out. The
+   * backend binds the userOp to a matching external `Transfer` before settling.
+   */
+  markWithdrawalSettled(input: PaymentSettlementInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * Record the on-chain escrow of a commitment after `createCommitment` returns
+   * its `onchainCommitmentId` (G3 · #546).
+   */
+  markCommitmentCreated(input: CommitmentCreatedInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * Record a settled ORG spend/payroll on the one `payments` ledger
+   * (D3 · #565) — `source:"org"` + `orgId`, read back as a leak-safe Payment.
+   */
+  recordOrgPayment(input: OrgPaymentRecordInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /** Record a recipient-side `claim` after the on-chain claim UserOp settles. */
+  claim(input: CommitmentClaimInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /** Record a creator-side `cancel` reclaiming only the unvested remainder. */
+  cancel(input: CommitmentCancelInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /** Record a pre-claim `redirect` to a new validated recipient. */
+  redirect(input: CommitmentRedirectInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * The on-chain commitment reference the signer-side host needs to build a
+   * claim/cancel/redirect UserOp. `onchainCommitmentId` is internal evidence.
+   */
+  commitmentRef(paymentId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentCommitmentRef | null>>;
+}
+/**
+ * The PUBLIC, Stripe-shaped Payments surface (D2 · #564). Genus verbs only —
+ * `pay` / `list` / `get`. No `userOpHash` / `txHash` / `onchainCommitmentId` /
+ * `chainId` / `safeAddress`. Host-execution + on-chain evidence live on the
+ * `_internal` channel below; an external builder never touches custody substrate.
+ */
+interface PaymentsMethods {
+  pay(input: PaymentsPayInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  payout(input: PaymentsPayoutInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * B3 withdraw / cash-out: send USDX from the user's custody Safe to an
+   * external 0x wallet, minting a kind:4 Withdrawal document. Returns a
+   * leak-safe `Payment` (recipient label is the redacted address).
+   */
+  withdraw(input: PaymentsWithdrawInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  list(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly Payment[]>>;
+  get(paymentId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment | null>>;
+  cancel(paymentId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * Host-execution + on-chain-evidence channel — off the public surface
+   * (production-surface-policy.md pattern). Self-custody integrators drive this;
+   * a Stripe-shaped consumer never does.
+   *
+   * @internal-use
+   */
+  readonly _internal: PaymentsInternalMethods;
+}
+interface PaymentDocumentsMethods {
+  verify(documentHash: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDocumentVerification>>;
+  /**
+   * #577: render-on-demand. Loads the owner's stored document by `documentHash`,
+   * re-verifies its EIP-712 hash, and renders it to self-contained HTML using the
+   * verified stored line items. Returns `{documentHash, kind, ok, html}`.
+   */
+  render(documentHash: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDocumentRender>>;
+}
+interface ReconciliationEntry {
+  readonly paymentRequestId: string;
+  readonly reference: string;
+  readonly status: "paid" | "exception";
+  readonly settledPaymentId: string | null;
+  readonly receiptDocumentHash: string | null;
+}
+interface FinancialOpsMethods {
+  readonly me: MeMethods;
+  readonly handles: HandlesMethods;
+  readonly payees: PayeesMethods;
+  readonly targets: TargetsMethods;
+  readonly destinations: DestinationsMethods;
+  readonly payments: PaymentsMethods;
+  readonly activity: ActivityMethods;
+  readonly offramp: OfframpMethods;
+  readonly paymentDocuments: PaymentDocumentsMethods;
+}
+//#endregion
+//#region src/surface/contacts.d.ts
+type ActorScopeRef = {
+  readonly kind: "account";
+} | {
+  readonly kind: "org";
+  readonly orgId: string;
+};
+interface ActorProfile {
+  readonly actor: ActorScopeRef;
+  readonly displayName: string | null;
+  readonly email?: string;
+  readonly handle?: string;
+}
+interface AddressBookEntry {
+  readonly id: string;
+  readonly ref: Ref$1;
+  readonly label: string;
+  readonly relationship: readonly ("paid" | "paidBy" | "requested" | "member" | "employee")[];
+  readonly hidden: boolean;
+}
+interface AddressBookAddInput {
+  readonly ref: Ref$1;
+  readonly label?: string;
+}
+interface AddressBookLabelInput {
+  readonly entryId: string;
+  readonly label: string;
+}
+interface AddressBookMethods {
+  list(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly AddressBookEntry[]>>;
+  get(entryId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<AddressBookEntry | null>>;
+  add(input: AddressBookAddInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<AddressBookEntry>>;
+  hide(entryId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<AddressBookEntry>>;
+  unhide(entryId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<AddressBookEntry>>;
+  label(input: AddressBookLabelInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<AddressBookEntry>>;
+}
+interface ActorRequest {
+  readonly id: string;
+  readonly payer?: Ref$1;
+  readonly amount: PaymentMoney;
+  readonly reference: string;
+  readonly status: RequestStatus;
+  readonly expiresAt: number | null;
+}
+interface ActorRequestIssueInput {
+  readonly payer: Ref$1;
+  readonly amount: PaymentMoney;
+  readonly reference: string;
+  readonly memo?: string;
+  readonly expiresAt?: number;
+}
+interface ActorRequestsMethods {
+  issue(input: ActorRequestIssueInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<ActorRequest>>;
+  list(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly ActorRequest[]>>;
+  get(requestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<ActorRequest | null>>;
+  cancel(requestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<ActorRequest>>;
+  reconcile(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly ReconciliationEntry[]>>;
+}
+interface InboxItem {
+  readonly id: string;
+  readonly issuer: Ref$1;
+  readonly amount: PaymentMoney;
+  readonly reference: string;
+  readonly status: InboxStatus;
+}
+interface InboxApproveInput {
+  readonly requestId: string;
+  readonly timing?: PaymentTiming;
+}
+interface InboxMethods {
+  list(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly InboxItem[]>>;
+  approve(input: InboxApproveInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  decline(requestId: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<InboxItem>>;
+}
+interface InsightsSummary {
+  readonly pending: {
+    readonly count: number;
+    readonly total: PaymentMoney;
+  };
+  readonly paidThisMonth: {
+    readonly count: number;
+    readonly total: PaymentMoney;
+  };
+  readonly drafts: {
+    readonly count: number;
+  };
+  readonly reconciliation: {
+    readonly open: number;
+    readonly exceptions: number;
+  };
+}
+interface InsightsMethods {
+  summary(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<InsightsSummary>>;
+  history(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly Payment[]>>;
+}
+interface ActorProfileMethods {
+  get(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<ActorProfile>>;
+  depositInstructions(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<DepositInstructions>>;
+}
+interface ActorRelationshipMethods {
+  readonly addressBook: AddressBookMethods;
+  readonly requests: ActorRequestsMethods;
+  readonly inbox: InboxMethods;
+  readonly insights: InsightsMethods;
+  readonly profile: ActorProfileMethods;
+}
+//#endregion
+//#region src/surface/account.d.ts
+type AccountStatus = {
+  readonly status: "notAuthenticated";
+} | {
+  readonly status: "accountRequired";
+  readonly requirement: AccountRequirement;
+  readonly chainId: number;
+} | {
+  readonly status: "accountProviderReady";
+  readonly requirement: AccountRequirement;
+  readonly chainId: number;
+  readonly source: AccountProviderSource;
+  readonly signerAddress: Address;
+} | {
+  readonly status: "accountPrepared";
+  readonly requirement: AccountRequirement;
+  readonly account: SmartAccount;
+  readonly deployment: {
+    readonly status: "counterfactual";
+  };
+} | {
+  readonly status: "accountReady";
+  readonly requirement: AccountRequirement;
+  readonly account: SmartAccount | null;
+  readonly deployment: {
+    readonly status: "counterfactual";
+  } | {
+    readonly status: "deployed";
+    readonly deployedAt: SmartAccount["deployedAt"];
+  };
+};
+/**
+ * Public consumer-facing surface (issue #159 · AC1+AC3). Exactly two
+ * methods. `provision` and `deploySafe` are intentionally NOT here —
+ * they are advanced/testing-only and will live on
+ * `client._internal.account` when sibling issue #161 lands. Per
+ * `packages/sdk/CONTEXT.md`, the narrowing is enforced at
+ * both the type level (the `keyof AccountMethods` extract is exactly
+ * `"getStatus" | "ensureReady"`) and at runtime (the bundle returned
+ * here has those two own-keys and nothing else).
+ *
+ * Per `packages/sdk/docs/architecture.md`, the
+ * `AccountStatus` discriminant — including the variants this slice can
+ * only reach via `getStatus` (e.g. `accountPrepared`) — is the durable
+ * shape consumers depend on. Sibling #161 will extend `ensureReady` to
+ * advance the ladder past `accountProviderReady` and from
+ * `accountPrepared` to `accountReady(deployed)`; until then, the type
+ * surface is stable and the runtime fixed-point is documented.
+ */
+interface AccountMethods extends ActorRelationshipMethods {
+  /**
+   * Post-auth account setup lifecycle — domain vocabulary over the internal
+   * readiness ladder + provisioning lane (#356).
+   */
+  getLifecycle(): Promise<CapxulResult<AccountLifecycle>>;
+  /** Resume setup after `failed` and return the updated lifecycle snapshot. */
+  retrySetup(): Promise<CapxulResult<AccountLifecycle>>;
+  /**
+   * Internal advanced surface (#161 · AC1). Reserved for the rebuild's
+   * own `ensureReady` upward transitions and for testing harnesses;
+   * consumers MUST NOT depend on this in production. Tagged
+   * `@internal-use` per `.claude/rules/flow-internal-substrate.md`.
+   *
+   * @internal-use
+   */
+  readonly _internal: AccountInternalSurface;
+}
+/**
+ * Internal `provision` + `deploySafe` arms exposed at
+ * `client._internal.account` (#161). Each returns `Promise<CapxulResult<T>>`
+ * with the same error catalog the public methods use.
+ *
+ * @internal-use
+ */
+interface AccountInternalSurface {
+  provision(): Promise<CapxulResult<SmartAccount>>;
+  deploySafe(observationSource?: unknown): Promise<CapxulResult<SmartAccount>>;
+  /** @internal-use Substrate readiness ladder — tests and e2e only. */
+  getStatus(): Promise<CapxulResult<AccountStatus>>;
+  /** @internal-use Lane runner — tests and e2e only. */
+  ensureReady(): Promise<CapxulResult<AccountStatus>>;
+  /** @internal-use Provisioning lane phase — tests and e2e only. */
+  getProvisioningPhase(): Promise<CapxulResult<ProvisioningPhase>>;
+  /** @internal-use Lane retry — tests and e2e only. */
+  retryProvisioning(): Promise<CapxulResult<ProvisioningPhase>>;
+}
+//#endregion
+//#region src/surface/accounts.d.ts
+interface AccountsMethods {
+  read(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Account$1>>;
+}
+/**
+ * Faucet surface (dev-only). Deliberately OFF the public `AccountsMethods`;
+ * reachable only via `client._internal.accounts` (production-surface-policy.md).
+ * The reference CLI uses it behind a test-env gate — consumers never see `fund`.
+ */
+interface AccountsFaucetMethods {
+  fund(amount: Money, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<{
+    readonly txHash: string;
+  }>>;
+}
+//#endregion
+//#region src/domain/org/spend-gate.d.ts
+/**
+ * The role's allowed recipients. The address form backs the S4 `spend` path
+ * (recipient is a resolved `Address`); the string form backs the G4
+ * `spendViaPayments` / `batchPayroll` path, whose recipient is a VALIDATED REF
+ * (handle/email/payee/org) compared in the same ref space as the role's set.
+ * Comparison is case-insensitive over the raw string value either way.
+ */
+type SpendGateRecipients = "anyone" | readonly (Address | string)[];
+type SpendGateSubAccountScope = {
+  readonly scope: "all";
+} | {
+  readonly scope: "only";
+  readonly subAccountIds: readonly SubAccountId[];
+};
+//#endregion
+//#region src/ports/org.d.ts
+/**
+ * The minimal `{from, to, amount}` spend shape the authority read keys off
+ * (D3 #565). The legacy address-keyed `OrgSpendInput`/`org.spend` lane was
+ * hard-removed when `orgSpends` folded into the one `payments` ledger; the
+ * leak-safe ref-based lane (`spendViaPayments`/`batchPayroll`) constructs this
+ * internally and enforces the real validated recipient on the gate.
+ */
+type OrgSpendShape = {
+  readonly from: SubAccountId;
+  readonly to: Address;
+  readonly amount: Money;
+};
+type CreateOrgPortInput = {
+  readonly input: CreateOrgInput;
+};
+type ReadOrgTreasuryInput = {
+  readonly orgId: OrgId;
+};
+type ListOrgsInput = Record<never, never>;
+type ListOrgRolesInput = {
+  readonly orgId: OrgId;
+};
+type ListOrgMembersInput = {
+  readonly orgId: OrgId;
+};
+type InviteOrgMemberInput = {
+  readonly orgId: OrgId;
+  readonly input: InviteMemberInput;
+};
+type ResendOrgInviteTokenInput = {
+  readonly orgId: OrgId;
+  readonly email: string;
+};
+type DetectPendingOrgInvitationsInput = Record<never, never>;
+type DetectPendingOrgInvitationsResult$1 = {
+  readonly matched: readonly OrgId[];
+};
+type DeployOrgRolesInput = {
+  readonly orgId: OrgId;
+};
+type OrgRolesDeploymentResult = {
+  readonly orgId: OrgId;
+  readonly roles: readonly RoleView[];
+};
+type GrantOrgRoleInput = {
+  readonly orgId: OrgId;
+  readonly input: AssignRoleInput;
+};
+type RevokeOrgRoleInput = {
+  readonly orgId: OrgId;
+  readonly input: RemoveMemberInput;
+};
+type OrgSpendAuthority = {
+  readonly activeMember: boolean;
+  readonly subAccountBalanceRaw: string;
+  readonly recipients: SpendGateRecipients;
+  readonly subAccounts: SpendGateSubAccountScope;
+  readonly perTxCapRaw?: string | null;
+  readonly perDayCapRaw?: string | null;
+  readonly spentTodayRaw?: string | null;
+  readonly role?: string;
+};
+type ReadOrgSpendAuthorityInput = {
+  readonly orgId: OrgId;
+  readonly input: OrgSpendShape;
+  readonly amountRaw: string;
+};
+declare const OrgError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "OrgError";
+} & Readonly<A>;
+declare class OrgError extends OrgError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+/**
+ * Live org seam. `createOrg` runs the SDK-orchestrated deploy (D10) and returns
+ * the created `OrgView` (its treasury is the real M2 `Account` over the Org
+ * Safe — $0 at creation, D3). `readTreasury` pulls the org's Account via RPC
+ * `balanceOf` (D3). `listOrgs` lists the orgs the authenticated user belongs to.
+ */
+interface OrgPort {
+  createOrg(input: CreateOrgPortInput): Effect.Effect<OrgView, OrgError, never>;
+  readTreasury(input: ReadOrgTreasuryInput): Effect.Effect<Account$1, OrgError, never>;
+  listOrgs(input: ListOrgsInput): Effect.Effect<readonly OrgView[], OrgError, never>;
+  listRoles(input: ListOrgRolesInput): Effect.Effect<readonly RoleView[], OrgError, never>;
+  listMembers(input: ListOrgMembersInput): Effect.Effect<readonly MemberView[], OrgError, never>;
+  pendingMembers?(input: ListOrgMembersInput): Effect.Effect<readonly MemberView[], OrgError, never>;
+  inviteMember(input: InviteOrgMemberInput): Effect.Effect<MemberView, OrgError, never>;
+  resendInviteToken?(input: ResendOrgInviteTokenInput): Effect.Effect<MemberView, OrgError, never>;
+  detectAndAcceptPendingInvitations(input: DetectPendingOrgInvitationsInput): Effect.Effect<DetectPendingOrgInvitationsResult$1, OrgError, never>;
+}
+interface OrgRolesDeploymentPort {
+  deployRoles(input: DeployOrgRolesInput): Effect.Effect<OrgRolesDeploymentResult, OrgError, never>;
+  grantRole(input: GrantOrgRoleInput): Effect.Effect<MemberView, OrgError, never>;
+  revokeRole(input: RevokeOrgRoleInput): Effect.Effect<void, OrgError, never>;
+}
+type SubmitOrgSpendViaPaymentsInput = {
+  readonly orgId: OrgId;
+  readonly input: OrgSpendViaPaymentsInput;
+  readonly amountRaw: string;
+  readonly authority: OrgSpendAuthority;
+};
+type SubmitOrgBatchPayrollInput = {
+  readonly orgId: OrgId;
+  readonly from: OrgSpendViaPaymentsInput["from"];
+  readonly runs: readonly {
+    readonly run: OrgPayrollRun;
+    readonly amountRaw: string;
+  }[];
+  readonly authorities: readonly OrgSpendAuthority[];
+};
+interface OrgSpendPort {
+  readSpendAuthority(input: ReadOrgSpendAuthorityInput): Effect.Effect<OrgSpendAuthority, OrgError, never>;
+  /**
+   * Leak-safe org spend (G4 · #547; D3 #565 — the one ledger of record): execute
+   * the spend through the payments engine (Roles modifier → CapxulPayments),
+   * write a real `payments` row (`source:"org"`) and read it back as a `Payment`
+   * — the wire carries no `txHash` / Safe / userOp internals. Optional so a
+   * hermetic adapter without a payments-submit lane still compiles; absent ⇒ the
+   * program falls back to a deterministic hermetic `Payment`.
+   */
+  submitSpendViaPayments?(input: SubmitOrgSpendViaPaymentsInput): Effect.Effect<Payment, OrgError, never>;
+  /** Leak-safe org payroll batch (G4 · #547): one MultiSend, one Payment per run. */
+  submitBatchPayroll?(input: SubmitOrgBatchPayrollInput): Effect.Effect<readonly Payment[], OrgError, never>;
+}
+//#endregion
+//#region src/surface/org.d.ts
+/**
+ * A member's lifecycle status (D9 — unified `Member` with status
+ * `pending | active | revoked | expired`). `pending` = invited (incl. a
+ * non-user emailed into existence) but not yet a provisioned member with an
+ * on-chain grant; `active` = on-chain role granted; `revoked` = offboarded
+ * (on-chain REVOKE fired); `expired` = pending invitation timed out.
+ */
+type MemberStatus = "pending" | "pending_safe" | "pending_grant" | "active" | "revoked" | "expired";
+/**
+ * One Org you belong to (canon §C1 "Org list" — name, role, balance).
+ * `role` is the member's role label within THIS org. `treasury` is the M2
+ * `Account` over the Org Safe (D3). `handle` is the globally-unique,
+ * normalized org handle (D10a). Pure record of brand-typed fields — not a
+ * brand.
+ */
+type OrgView = {
+  readonly id: OrgId;
+  readonly name: string;
+  readonly handle: string;
+  readonly safeAddress: Address; /** The viewing member's own role label within this org. */
+  readonly role: string; /** The Org treasury — the real M2 Account over the Org Safe (D3). */
+  readonly treasury: Account$1; /** #1064: onboarding-collected description + size bucket; null when unset. */
+  readonly bio: string | null;
+  readonly size: string | null; /** #1061 / ADR-0014: logo serving URL resolved at read time; null when unset. */
+  readonly logoUrl: string | null;
+};
+interface OrganizationAccount {
+  readonly id: string;
+  readonly address: string | null;
+  readonly balance: Money;
+  readonly available: Money;
+}
+interface OrganizationAuditLogItem {
+  readonly id: string;
+  readonly organizationId: string;
+  readonly action: string;
+  readonly actor: string | null;
+  readonly summary: string;
+  readonly createdAt: number;
+  readonly metadata?: Record<string, unknown>;
+}
+/**
+ * One member of an Org (canon §C1 "Members" — name/email, role, status; D7/D8).
+ * `personalSafeAddress` is the member-identity key (D7 — Safe-as-identity); it
+ * is `null` while the member is still `pending` (emailed into existence but not
+ * yet provisioned a personal Safe). `email` is the universal entry point (D8).
+ */
+type MemberView = {
+  readonly orgId: OrgId;
+  readonly email: Email;
+  readonly name: string | null; /** Member-identity key (D7). `null` until the invitee provisions a Safe. */
+  readonly personalSafeAddress: Address | null; /** The member's role label (maps deterministically to the on-chain `roleKey`, D9). */
+  readonly role: string;
+  readonly roleKey: RoleKey | null;
+  readonly status: MemberStatus;
+  readonly grantTxHash: string | null;
+  readonly revokeTxHash: string | null;
+};
+/**
+ * A role's on-chain Level-1 spend cap (D4/D5 — physically enforced via Zodiac
+ * Roles + Allowance). `perTx` / `perDay` are `Money`; `toRecipients` scopes the
+ * allowed recipient set. Omitting a field means "unbounded on that axis"
+ * (the Owner role).
+ */
+type RoleSpendCap = {
+  readonly perTx?: Money;
+  readonly perDay?: Money;
+  readonly toRecipients?: "anyone" | readonly Address[];
+};
+/**
+ * The Capxul-owned Role DSL definition (D4). `label` becomes the sticky
+ * bytes32 `roleKey` on-chain. `spend` compiles to Level-1 on-chain Zodiac
+ * conditions; `subAccounts` + `canManage*` compile to Level-2 off-chain Convex
+ * guards (D5).
+ */
+type RoleDefinition = {
+  readonly label: string;
+  readonly spend?: RoleSpendCap;
+  readonly subAccounts?: {
+    readonly scope: "all" | readonly SubAccountId[];
+  };
+  readonly canManageMembers?: boolean;
+  readonly canManageRoles?: boolean;
+};
+/**
+ * One role seeded on an Org (canon §C1 "Roles" — label + caps; D4/D6).
+ * `roleKey` is the on-chain bytes32 role key derived from the label. `definition`
+ * is the full Role DSL entry.
+ */
+type RoleView = {
+  readonly orgId: OrgId;
+  readonly label: string;
+  readonly roleKey: RoleKey;
+  readonly definition: RoleDefinition;
+};
+/** Built-in role templates that seed a new Org at creation (D6). */
+type OrgTemplate = "Solo" | "Startup" | "Custom";
+/**
+ * Input to `capxul.createOrg` (S1, D10a, D14). `name` is the display name;
+ * `handle` is the globally-unique normalized handle (`^[a-z0-9-]{3,32}$`, D10a);
+ * `template` seeds the initial role set (D6); `country` is stored unvalidated
+ * (D14 — KYB deferred). For `template: "Custom"`, `roles` carries the authored
+ * `RoleDefinition[]`.
+ */
+type CreateOrgInput = {
+  readonly name: string;
+  readonly handle: string;
+  readonly template: OrgTemplate;
+  readonly country?: string;
+  readonly roles?: readonly RoleDefinition[];
+};
+/**
+ * Input to `org(orgId).invite` (S3, D8). Email is the universal entry point —
+ * inviting an address that is not yet a Capxul user auto-creates a `pending`
+ * membership that resolves on sign-in (the virality loop). `role` names the
+ * role label the invitee is granted on accept.
+ */
+type InviteMemberInput = {
+  readonly email: string;
+  readonly role: string;
+};
+type ResendInviteTokenInput = {
+  readonly email: string;
+};
+/**
+ * Input to `org(orgId).removeMember` (S3, D8). Keyed on the member's personal
+ * Safe address (D7 — Safe-as-identity). Drives the on-chain REVOKE + Convex
+ * mirror.
+ */
+type RemoveMemberInput = {
+  readonly memberSafeAddress: Address;
+};
+/**
+ * Input to `org(orgId).assignRole` (S3, D7/D9). Keyed on the member's personal
+ * Safe address (D7). Drives the on-chain GRANT + Convex mirror; the `role`
+ * label maps deterministically to the on-chain `roleKey`.
+ */
+type AssignRoleInput = {
+  readonly memberSafeAddress: Address;
+  readonly role: string;
+};
+/**
+ * Input to `org(orgId).spendViaPayments` (G4 · #547). The LEAK-SAFE org spend:
+ * delegates `org.spend` to the payments engine WITH the member's org role
+ * authority and returns a `Payment`, not a `txHash`. `to` is a VALIDATED
+ * recipient ref (handle / email / payee id / org handle) — never a raw
+ * `Address` (the legacy address-keyed `org.spend` lane was hard-removed in D3
+ * #565 when `orgSpends` was folded into the one `payments` ledger).
+ * `from` is the Level-2 sub-account envelope the spend draws from (D5).
+ */
+type OrgSpendViaPaymentsInput = {
+  readonly from: SubAccountId; /** Validated recipient ref (handle/email/payee/org) — never a raw address. */
+  readonly to: Ref$1;
+  readonly amount: Money; /** Full EIP-712 payment document; hashed + stored, committed on-chain. */
+  readonly document?: PaymentDocumentEnvelopeV1;
+  readonly timing?: PaymentTiming;
+  readonly paymentType?: PaymentType;
+};
+/**
+ * One run in an `org(orgId).batchPayroll` batch (G4 · #547): a validated
+ * recipient, an amount, and an optional payslip document. Each run is gated
+ * independently against the role's per-tx / per-day / recipient conditions.
+ */
+type OrgPayrollRun = {
+  /** Validated recipient ref (handle/email/payee/org) — never a raw address. */readonly to: Ref$1;
+  readonly amount: Money;
+  readonly timing?: PaymentTiming; /** The payslip — an EIP-712 payment document, committed by `documentHash`. */
+  readonly payslip?: PaymentDocumentEnvelopeV1;
+};
+/**
+ * Input to `org(orgId).batchPayroll` (G4 · #547). Pays N employees in one
+ * MultiSend through the Roles modifier; each carries a payslip and settles as
+ * `paymentType = payroll`. Every run is gated; an over-cap run REJECTS the
+ * whole batch (no partial treasury drain). Returns one leak-safe `Payment` per
+ * run.
+ */
+type OrgBatchPayrollInput = {
+  readonly from: SubAccountId;
+  readonly runs: readonly OrgPayrollRun[];
+};
+type DetectPendingOrgInvitationsResult = {
+  readonly matched: readonly OrgId[];
+};
+/**
+ * Entity-scoped Org method bundle, returned by `capxul.org(orgId)`. Every
+ * method names the entity implicitly via the closed-over `orgId` (D13 — no
+ * stateful active context). `treasury()` returns the real M2 `Account` over
+ * the Org Safe (D3).
+ */
+interface PayrollRosterLine {
+  readonly id: string;
+  readonly employee: Ref$1;
+  readonly amount: Money;
+  readonly timing: PaymentTiming;
+  readonly status: "active" | "paused" | "ended";
+}
+interface PayrollPayslipTemplate {
+  readonly title: string;
+  readonly memo?: string;
+}
+interface PayrollRosterAddInput {
+  readonly employee: Ref$1;
+  readonly amount: Money;
+  readonly timing: PaymentTiming;
+  readonly payslipTemplate?: PaymentDocumentEnvelopeV1 | PayrollPayslipTemplate;
+}
+interface PayrollRunInput {
+  readonly from: SubAccountId;
+  readonly period: string;
+}
+interface PayrollMethods {
+  readonly roster: {
+    add(input: PayrollRosterAddInput, options?: {
+      readonly signal?: AbortSignal;
+    }): Promise<CapxulResult<PayrollRosterLine>>;
+    list(options?: {
+      readonly signal?: AbortSignal;
+    }): Promise<CapxulResult<readonly PayrollRosterLine[]>>;
+    update(rosterLineId: string, input: Partial<PayrollRosterAddInput>, options?: {
+      readonly signal?: AbortSignal;
+    }): Promise<CapxulResult<PayrollRosterLine>>;
+    remove(rosterLineId: string, options?: {
+      readonly signal?: AbortSignal;
+    }): Promise<CapxulResult<PayrollRosterLine>>;
+  };
+  run(input: PayrollRunInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly Payment[]>>;
+}
+interface OrgScopedMethods extends ActorRelationshipMethods {
+  /** Observe the durable, leak-safe lifecycle for this Organization only. */
+  getLifecycle(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<OrgLifecycle>>;
+  /** Explicitly resume this Organization's durable setup lane. */
+  retrySetup(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<OrgLifecycle>>;
+  /** The Org treasury — the real M2 Account over the Org Safe (D3). */
+  treasury(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Account$1>>;
+  readonly account: {
+    get(options?: {
+      readonly signal?: AbortSignal;
+    }): Promise<CapxulResult<OrganizationAccount>>;
+  };
+  members(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly MemberView[]>>;
+  roles(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly RoleView[]>>;
+  deployRoles(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly RoleView[]>>;
+  invite(input: InviteMemberInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<MemberView>>;
+  removeMember(input: RemoveMemberInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<void>>;
+  assignRole(input: AssignRoleInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<MemberView>>;
+  /**
+   * Leak-safe org spend (G4 · #547; D3 #565 — the one ledger of record): execute
+   * the spend through the payments engine with the member's org role authority
+   * and return a `Payment` (no `to: Address`, no `txHash`, no Safe / userOp
+   * internals). Writes a real `payments` row (`source:"org"`).
+   */
+  spendViaPayments(input: OrgSpendViaPaymentsInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  /**
+   * Org payroll batch (G4 · #547): pay N employees in one MultiSend through the
+   * Roles modifier, each with a payslip. Every run is gated; an over-cap run
+   * rejects the whole batch. Returns one leak-safe `Payment` per run.
+   */
+  batchPayroll(input: OrgBatchPayrollInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly Payment[]>>;
+  readonly payroll: PayrollMethods;
+  auditLog(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly OrganizationAuditLogItem[]>>;
+}
+type OrgsMethod = {
+  (options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly OrgView[]>>;
+  detectAndAcceptPendingInvitations(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<DetectPendingOrgInvitationsResult>>;
+};
+/**
+ * Top-level Org method bundle, exposed at `client.org` / `client.orgs` /
+ * `client.createOrg`. `org(orgId)` resolves the entity-scoped bundle (D13).
+ */
+interface OrgMethods {
+  createOrg(input: CreateOrgInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<OrgView>>;
+  readonly orgs: OrgsMethod;
+  /** Resolve the entity-scoped bundle for a specific Org (D13). */
+  org(orgId: OrgId): OrgScopedMethods;
+}
+//#endregion
+//#region src/surface/current-user.d.ts
+interface CurrentUserContext {
+  readonly user: {
+    readonly id: string;
+    readonly email: string;
+    readonly displayName: string | null;
+    readonly handle: string | null;
+    readonly paymentLink: {
+      readonly handle: string;
+      readonly url: string;
+    } | null;
+  };
+  readonly personalAccount: {
+    readonly id: string;
+    readonly address: string | null;
+  } | null;
+  readonly organizations: readonly {
+    readonly id: string;
+    readonly name: string;
+    readonly handle: string;
+    readonly role: string;
+    readonly account: {
+      readonly id: string;
+      readonly address: string | null;
+    } | null;
+  }[];
+}
+interface CurrentUserMethods {
+  get(options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<CurrentUserContext>>;
+}
+//#endregion
+//#region src/surface/media.d.ts
+interface MediaMethods {
+  uploadImage(blob: Blob, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<{
+    readonly storageId: string;
+  }>>;
+  setProfileImage(input: {
+    readonly storageId: string;
+  }, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<{
+    readonly imageUrl: string | null;
+  }>>;
+  setOrgLogo(input: {
+    readonly orgId: string;
+    readonly storageId: string;
+  }, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<{
+    readonly logoUrl: string | null;
+  }>>;
+}
+//#endregion
+//#region src/contract/system.d.ts
+/** What `system:health` answers. */
+interface SystemHealth {
+  /** The nonce the caller sent, as the backend saw it. */
+  readonly nonce: string;
+  /** Deployment that answered, e.g. `little-sandpiper-974`. */
+  readonly deployment: string;
+  /** Backend clock at execution (epoch ms). */
+  readonly at: number;
+}
+//#endregion
+//#region src/surface/system.d.ts
+interface SystemMethods {
+  health(nonce: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<SystemHealth>>;
+}
+//#endregion
+//#region src/surface/sub-accounts.d.ts
+interface SubAccountsMethods {
+  create(accountId: AccountId, input: {
+    readonly name: string;
+  }, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<SubAccount>>;
+  get(subAccountId: SubAccountId, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<SubAccount | null>>;
+  list(accountId: AccountId, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly SubAccount[]>>;
+  rename(subAccountId: SubAccountId, name: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<SubAccount>>;
+  delete(subAccountId: SubAccountId, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<void>>;
+  transfer(input: TransferInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<TransferResult>>;
+}
+//#endregion
+//#region src/surface/_shared/effect-actor-bridge.d.ts
+type IdentityFacadeVerb = "requestCode" | "verifyCode" | "signOut" | "createOrganization" | "completePersonal" | "retry";
+//#endregion
+//#region src/surface/create-capxul-client.d.ts
+type OrganizationSetupProofReceipt = {
+  readonly state: "submitted";
+  readonly orgId: string;
+  readonly chainId: number;
+  readonly signerEoa: string;
+  readonly founderAccount: string;
+  readonly organizationAccount: string;
+  readonly userOperationHash: string;
+  readonly submittedAt: number;
+  readonly attempt: number;
+} | {
+  readonly state: "confirmed";
+  readonly orgId: string;
+  readonly chainId: number;
+  readonly signerEoa: string;
+  readonly founderAccount: string;
+  readonly organizationAccount: string;
+  readonly userOperationHash: string;
+  readonly submittedAt: number;
+  readonly attempt: number;
+  readonly confirmationTransactionHash: string;
+  readonly readyAt: number;
+};
+type OrganizationSetupProofMethods = {
+  readonly getProofReceipt: (orgId: string) => Promise<CapxulResult<OrganizationSetupProofReceipt | null>>;
+};
+type IdentityRuntimeSendResult = {
+  readonly ok: true;
+  readonly state: IdentityState;
+} | {
+  readonly ok: false;
+  readonly refused: CapxulErrorCode;
+  readonly state: IdentityState;
+};
+type IdentityProfileDetails = {
+  readonly displayName: string;
+  readonly country: string;
+  readonly username?: string;
+};
+interface IdentityRuntime {
+  readonly snapshot: () => IdentityState;
+  readonly subscribe: IdentityActor["subscribe"];
+  readonly subscribeTransitions: IdentityActor["subscribeTransitions"];
+  readonly send: (event: IdentityEvent, controls?: InvocationControls) => Promise<IdentityRuntimeSendResult>;
+  readonly completeProfile: (profile: IdentityProfileDetails, controls?: InvocationControls) => Promise<{
+    readonly ok: true;
+  } | {
+    readonly ok: false;
+    readonly reason: CapxulErrorCode;
+  }>;
+  /** @internal One facade bridge; optional only for pre-S2 consumer test doubles. */
+  readonly runFacade?: <T>(verb: IdentityFacadeVerb, controls: InvocationControls | undefined, run: (controls: InvocationControls) => Promise<T>) => Promise<T>;
+}
+interface CapxulClient {
+  readonly auth: AuthMethods;
+  readonly smartAccount: SmartAccountMethods;
+  readonly identity: IdentityMethods;
+  /**
+   * Liveness surface (#1149 proof lane): `health(nonce)` round-trips a nonce
+   * through the configured deployment. The only method here that is useful
+   * before sign-in, and the only one whose whole point is that the answer
+   * came from the backend rather than from this process.
+   */
+  readonly system: SystemMethods;
+  /**
+   * Consumer-facing account readiness surface (issue #159 · AC1+AC3).
+   * Exactly `getStatus` + `ensureReady`; the `_internal.account`
+   * namespace with `provision` + `deploySafe` lands in sibling #161.
+   */
+  readonly account: AccountMethods;
+  /**
+   * Consumer-facing logical Account money read (M2 Slice S1a · #265).
+   * Returns `{ balance, available }` as `Money` — never wei or token units.
+   */
+  readonly accounts: AccountsMethods;
+  readonly currentUser: CurrentUserMethods;
+  readonly me: MeMethods;
+  readonly handles: HandlesMethods;
+  readonly payees: PayeesMethods;
+  readonly targets: TargetsMethods;
+  readonly destinations: DestinationsMethods;
+  /**
+   * Direct Payments surface (G2 · #545). `pay` records a validated-recipient
+   * payment; `list`/`get` read the ledger; `markSettled` is the host-execution
+   * callback.
+   */
+  readonly payments: PaymentsMethods;
+  readonly activity: ActivityMethods;
+  readonly offramp: OfframpMethods;
+  /** Payment document verification (G2 · #545): re-derive the EIP-712 hash. */
+  readonly paymentDocuments: PaymentDocumentsMethods;
+  /**
+   * Media surface (#1061 / ADR-0014): profile-image + org-logo upload/record.
+   */
+  readonly media: MediaMethods;
+  /** Sub-account lifecycle (M2 Slice S2a · #267). Transfer lands in S2b. */
+  readonly subAccounts: SubAccountsMethods;
+  /**
+   * Organization domain surface (canon `org-domain-model.md` §C2/§C3, D13).
+   * `createOrg(input)` creates an Org; `orgs()` lists the Orgs you belong to;
+   * `org(orgId)` resolves the entity-scoped bundle (treasury / members / roles
+   * / invite / removeMember / assignRole / spend). Explicit entity scoping —
+   * NO stateful active context (D13). RED until the S1→S4 slices fill it.
+   */
+  readonly createOrg: OrgMethods["createOrg"];
+  readonly orgs: OrgMethods["orgs"];
+  readonly org: OrgMethods["org"];
+  /**
+   * Internal identity integration runtime. It is consumed by
+   * `@capxul/sdk-react`, not exported as the actor substrate itself.
+   *
+   * @internal-use
+   */
+  readonly _internal: {
+    readonly identity: IdentityRuntime;
+    /**
+     * Resolved bootstrap for this client instance (chain, auth URLs, etc.).
+     * Off the public surface per production-surface-policy.md (#31).
+     */
+    readonly bootstrap: BootstrapResolution;
+    /**
+     * Dev-only faucet bundle (production-surface-policy.md). `fund` lives here,
+     * NOT on the public `client.accounts` surface.
+     */
+    readonly accounts: AccountsFaucetMethods; /** Quarantined Reference-harness evidence; never a product Organization method. */
+    readonly organizationSetup: OrganizationSetupProofMethods; /** Telemetry port for error reporting. Used by React hooks to report errors before throwing. */
+    readonly telemetry?: TelemetryPort;
+    readonly close?: () => Promise<void>;
+  };
+}
+interface CreateCapxulClientInput {
+  /**
+   * The 10-port `FlowPorts` bundle. The identity actor uses its auth, clock,
+   * identity, smart-account, and telemetry seams internally; the remaining
+   * method bundles consume the same canonical port authorities.
+   */
+  readonly ports: FlowPorts;
+  /**
+   * Bootstrap resolution for this client instance. The factory closes over
+   * `bootstrap.chainId` internally; consumers do not pass a standalone
+   * chainId and no method boundary accepts one.
+   */
+  readonly bootstrap: BootstrapResolution;
+  /**
+   * Optional AuthCachePort. When omitted, `detectAuthCacheAdapter()` selects
+   * the appropriate per-environment adapter (Browser/FileSystem/InMemory).
+   */
+  readonly authCache?: AuthCachePort;
+  /**
+   * Optional AbortSignal reserved for callers that coordinate client lifetime.
+   */
+  readonly signal?: AbortSignal;
+  /**
+   * OTP TTL window in ms. Default 300_000 (5 min).
+   */
+  readonly otpTtlMs?: number;
+  /**
+   * Optional per-call timeout for invoked auth requests.
+   */
+  readonly invokeTimeoutMs?: number;
+  /**
+   * Init-time account readiness target (issue #159 · AC4). The factory
+   * closes over this so `client.account.{getStatus,ensureReady}` don't
+   * need to take a per-call requirement arg. REQUIRED — there is no
+   * hidden default. Consumers building flows that never need a smart
+   * account pass `"none"`; flows that want a counterfactual deposit
+   * address pass `"counterfactual"`; flows that need an on-chain Safe
+   * pass `"deployed"` (deploy path lands in sibling #161).
+   */
+  readonly requirement: AccountRequirement;
+  /**
+   * Consumer-held signer (backend-orchestrated-deploy.md). Required for
+   * `requirement: "deployed"` flows: `provision` reads `getAddress()` and the
+   * deploy path signs the backend's SafeOp digest via `signUserOpHash()`. The
+   * backend orchestrates build + gas + paymaster + submit — the client never
+   * holds an RPC URL, a gas-sponsorship policy, or a bundler.
+   */
+  readonly signer?: CapxulSigner;
+  /**
+   * Optional live Org-deploy lane (canon D10 SDK-orchestrated Org Safe deploy +
+   * D3 RPC treasury). When supplied, `client.createOrg` / `org(id).treasury`
+   * run the live path (real deploy + on-chain balance); when omitted, the
+   * hermetic `$0` path runs (a fresh Org has no on-chain funds). The adapter
+   * that CONSTRUCTS this port (deployer key + RPC + authenticated Convex seam)
+   * is wired by the CLI deploy-stack; the factory only threads it through.
+   */
+  readonly orgDeploymentPort?: OrgPort;
+  /** Locked D6 data-port name. Prefer over `orgDeploymentPort` in new code. */
+  readonly orgPort?: OrgPort;
+  /** S2 deploy/grant/revoke port. S2 uses deploy; S3 adds grant/revoke. */
+  readonly orgRolesDeploymentPort?: OrgRolesDeploymentPort;
+  /** S4 treasury-spend authority + submit port. */
+  readonly orgSpendPort?: OrgSpendPort;
+  /**
+   * Internal Organization lifecycle capability. The Core SDK owns its
+   * choreography; production composition supplies the provider/backend steps.
+   */
+  readonly organizationSetup?: OrganizationSetupOps;
+  readonly orgDeploymentConfig?: SafeDeploymentConfig;
+  /** Internal runner carrying the composition root's logger/tracer references. */
+  readonly effectRunner?: {
+    readonly runSync: <A, E>(effect: Effect.Effect<A, E>) => A;
+    readonly runPromise: <A, E>(effect: Effect.Effect<A, E>) => Promise<A>;
+  };
+}
+//#endregion
+export { InsightsSummary as $, OrgSetupStep as $t, PayrollRosterLine as A, PaymentMoney as At, ActorProfileMethods as B, RecipientResolutionKind as Bt, OrgTemplate as C, PayeesMethods as Ct, PayrollMethods as D, PaymentDocumentRender as Dt, OrganizationAuditLogItem as E, PaymentDocumentRef as Et, RoleSpendCap as F, PaymentsMethods as Ft, AddressBookAddInput as G, TargetsMethods as Gt, ActorRequest as H, Ref$1 as Ht, RoleView as I, PaymentsPayInput as It, AddressBookMethods as J, isSettingUpLifecycle as Jt, AddressBookEntry as K, AccountLifecycle as Kt, AccountsMethods as L, PaymentsPayoutInput as Lt, RemoveMemberInput as M, PaymentStatus as Mt, ResendInviteTokenInput as N, PaymentTiming as Nt, PayrollPayslipTemplate as O, PaymentDocumentVerification as Ot, RoleDefinition as P, PaymentType as Pt, InsightsMethods as Q, OrgLifecycle as Qt, AccountMethods as R, PaymentsWithdrawInput as Rt, OrgSpendViaPaymentsInput as S, Payee as St, OrganizationAccount as T, PaymentDocumentKind as Tt, ActorRequestIssueInput as U, ResolvedTarget as Ut, ActorRelationshipMethods as V, ReconciliationEntry as Vt, ActorRequestsMethods as W, TargetReference as Wt, InboxItem as X, SmartAccountMethods as Xt, InboxApproveInput as Y, IdentityMethods as Yt, InboxMethods as Z, AuthMethods as Zt, MemberView as _, InvocationControls as _n, MeProfile as _t, IdentityRuntimeSendResult as a, TelemetryEvent as an, DepositInstructions as at, OrgPayrollRun as b, OfframpQuoteInput as bt, SystemHealth as c, TelemetryPort as cn, DestinationKind as ct, CurrentUserMethods as d, IdentityState as dn, DestinationRail as dt, WireObservationContext as en, ActivityItem as et, AssignRoleInput as f, OrgLane as fn, DestinationRemoveInput as ft, MemberStatus as g, IdentityTransition as gn, MeMethods as gt, InviteMemberInput as h, destination as hn, HandlesMethods as ht, IdentityRuntime as i, CapxulEnv as in, ActorReference as it, PayrollRunInput as j, PaymentSettlementInput as jt, PayrollRosterAddInput as k, PaymentDocumentsMethods as kt, MediaMethods as l, Destination$1 as ln, DestinationListInput as lt, DetectPendingOrgInvitationsResult as m, StateLabel as mn, FinancialOpsMethods as mt, CreateCapxulClientInput as n, TransferInput as nn, ActivityMethods as nt, SubAccountsMethods as o, TelemetryGroupInput as on, Destination as ot, CreateOrgInput as p, Readiness as pn, DestinationsMethods as pt, AddressBookLabelInput as q, AccountSetupStep as qt, IdentityProfileDetails as r, TransferResult as rn, ActivityPage as rt, SystemMethods as s, TelemetryIdentifyInput as sn, DestinationAddInput as st, CapxulClient as t, TransferEndpoint as tn, ActivityListParams as tt, CurrentUserContext as u, IdentityEvent as un, DestinationPayload as ut, OrgBatchPayrollInput as v, OfframpMethods as vt, OrgView as w, Payment as wt, OrgScopedMethods as x, OfframpStatus as xt, OrgMethods as y, OfframpQuote as yt, ActorProfile as z, RecipientResolution as zt };
+//# sourceMappingURL=create-capxul-client-C7H5b68l.d.mts.map