@capxul/sdk 1.2.2 → 2.0.0

package/dist/node/index.d.mts

@@ -1,4 +1,4 @@
-import { T as AuthSession, _ as AuthCachePortTag, g as AuthCachePort, h as AuthCacheError, n as CapxulSigner, v as CachedJwt } from "../signer-CJT0pPiO.mjs";
+import { E as AuthSession, _ as AuthCachePortTag, g as AuthCachePort, h as AuthCacheError, n as CapxulSigner, v as CachedJwt } from "../signer-ZijoFiUs.mjs";
 import { Hex } from "viem";
 import { Effect, FileSystem, Layer, Path } from "effect";
 
@@ -48,5 +48,4 @@ declare function localPrivateKeySigner(input: {
  */
 declare function detectNodeAuthCacheAdapter(options?: DetectNodeAuthCacheAdapterOptions): AuthCachePort;
 //#endregion
-export { DetectNodeAuthCacheAdapterOptions, FileSystemAuthCacheAdapter, FileSystemAuthCacheLayer, detectNodeAuthCacheAdapter, localPrivateKeySigner };
-//# sourceMappingURL=index.d.mts.map
+export { DetectNodeAuthCacheAdapterOptions, FileSystemAuthCacheAdapter, FileSystemAuthCacheLayer, detectNodeAuthCacheAdapter, localPrivateKeySigner };

package/dist/node/index.mjs

@@ -1,4 +1,4 @@
-import { a as AuthCacheError, f as toAddress, i as parseCachedJwt, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, r as parseAuthSession, t as InMemoryAuthCacheAdapter } from "../InMemoryAuthCacheAdapter-Dr1sEd9y.mjs";
+import { a as AuthCacheError, i as parseCachedJwt, m as toAddress, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, r as parseAuthSession, t as InMemoryAuthCacheAdapter } from "../InMemoryAuthCacheAdapter-Rc8tCtml.mjs";
 import { Effect, FileSystem, Layer, Path } from "effect";
 import { privateKeyToAccount } from "viem/accounts";
 import * as os from "node:os";
@@ -154,5 +154,3 @@ function resolveDefaultAuthCachePath(resolveHomeDirectory) {
 }
 //#endregion
 export { FileSystemAuthCacheAdapter, FileSystemAuthCacheLayer, detectNodeAuthCacheAdapter, localPrivateKeySigner };
-
-//# sourceMappingURL=index.mjs.map

package/dist/{signer-CJT0pPiO.d.mts → signer-ZijoFiUs.d.mts}

@@ -2,7 +2,7 @@ import { Account, Hex } from "viem";
 import { Context, Effect } from "effect";
 
 //#region ../errors/src/errors.d.ts
-declare const CAPXUL_ERROR_CODES: readonly ["NOT_AUTHENTICATED", "EMAIL_DELIVERY_FAILED", "PROFILE_NOT_FOUND", "SMART_ACCOUNT_MISSING", "PLAYER_NOT_FOUND", "ACCOUNT_NOT_FOUND", "PROVIDER_ERROR", "INVALID_INPUT", "ENV_MISSING", "NOT_IMPLEMENTED", "VERIFICATION_REQUIRED", "INSUFFICIENT_BALANCE", "INVALID_RECIPIENT", "ROLE_PERMISSION_DENIED", "TRANSACTION_FAILED", "RATE_LIMITED", "NETWORK_ERROR", "UNKNOWN", "OTP_EXPIRED", "SIGNER_REJECTED", "CANCELLED", "WRONG_STATE", "STALE_EPOCH", "SUPERSEDED", "WORK_DIED", "ACTOR_STOPPED"];
+declare const CAPXUL_ERROR_CODES: readonly ["NOT_AUTHENTICATED", "EMAIL_DELIVERY_FAILED", "PROFILE_NOT_FOUND", "SMART_ACCOUNT_MISSING", "PLAYER_NOT_FOUND", "ACCOUNT_NOT_FOUND", "PROVIDER_ERROR", "CAPABILITY_UNAVAILABLE", "INVALID_INPUT", "ENV_MISSING", "NOT_IMPLEMENTED", "VERIFICATION_REQUIRED", "INSUFFICIENT_BALANCE", "INVALID_RECIPIENT", "ROLE_PERMISSION_DENIED", "TRANSACTION_FAILED", "RATE_LIMITED", "NETWORK_ERROR", "UNKNOWN", "OTP_EXPIRED", "SIGNER_REJECTED", "CANCELLED", "WRONG_STATE", "STALE_EPOCH", "SUPERSEDED", "WORK_DIED", "ACTOR_STOPPED"];
 type CapxulErrorCode = (typeof CAPXUL_ERROR_CODES)[number];
 /**
  * Why an auth/provider call failed — a flat CAUSE enum. The *where* (which
@@ -61,7 +61,7 @@ type Brand<T, B extends string> = T & {
 };
 //#endregion
 //#region ../types/src/index.d.ts
-type Address = Brand<string, "Address">;
+type Address$1 = Brand<string, "Address">;
 type Email = Brand<string, "Email">;
 type Profile$1 = {
   readonly authUserId: AuthUserId;
@@ -69,7 +69,7 @@ type Profile$1 = {
   readonly displayName: string | null;
   readonly country: CountryCode | null;
   readonly onboarded: boolean;
-  readonly withdrawalAddress: Address | null;
+  readonly withdrawalAddress: Address$1 | null;
   readonly username: string | null;
   readonly imageUrl: string | null;
   readonly kycTier: KycTier;
@@ -78,8 +78,8 @@ type Profile$1 = {
 };
 type SmartAccount$1 = {
   readonly authUserId: AuthUserId;
-  readonly signerAddress: Address | null;
-  readonly smartAccountAddress: Address;
+  readonly signerAddress: Address$1 | null;
+  readonly smartAccountAddress: Address$1;
   readonly chainId: ChainId;
   readonly deployedAt: EpochMs | null;
   readonly claimedAt: EpochMs | null;
@@ -95,18 +95,13 @@ type Account$1 = {
   readonly balance: Money;
   readonly available: Money;
 };
-/** Named bucket partitioning a logical Account (canon §9). */
-type SubAccount = {
-  readonly id: SubAccountId;
-  readonly accountId: AccountId;
-  readonly name: string;
-  readonly balance: Money;
-  readonly createdAt: EpochMs;
-};
 type AuthUserId = Brand<string, "AuthUserId">;
 type AnonymousDistinctId = Brand<string, "AnonymousDistinctId">;
 type AccountId = Brand<string, "AccountId">;
-type SubAccountId = Brand<string, "SubAccountId">;
+type MovementId = Brand<string, "MovementId">;
+type PermissionId = Brand<string, "PermissionId">;
+type PermissionAssignmentId = Brand<string, "PermissionAssignmentId">;
+type PaymentCommandId = Brand<string, "PaymentCommandId">;
 type OrgId = Brand<string, "OrgId">;
 type AppId = Brand<string, "AppId">;
 type AllowedOrigin = Brand<string, "AllowedOrigin">;
@@ -121,8 +116,9 @@ type CountryCode = Brand<string, "CountryCode">;
 type CurrencyCode = Brand<SupportedCurrencyCode, "CurrencyCode">;
 type KycTier = Brand<0 | 1 | 2 | 3, "KycTier">;
 type BlockNumber = Brand<number, "BlockNumber">;
-type RunId = Brand<string, "RunId">;
+type WeiAmount = Brand<string, "WeiAmount">;
 type RoleKey = Brand<string, "RoleKey">;
+type AllowanceKey = Brand<string, "AllowanceKey">;
 type SessionToken = Brand<string, "SessionToken">;
 type JwtToken = Brand<string, "JwtToken">;
 type AuthSession = {
@@ -153,7 +149,7 @@ declare const SUPPORTED_CURRENCIES: readonly [{
   readonly name: "Ugandan Shilling";
 }];
 type SupportedCurrencyCode = (typeof SUPPORTED_CURRENCIES)[number]["code"];
-declare function toAddress(raw: unknown): Address;
+declare function toAddress(raw: unknown): Address$1;
 declare function toCountryCode(raw: unknown): CountryCode;
 //#endregion
 //#region src/ports/auth-cache.d.ts
@@ -247,7 +243,7 @@ interface AccountProvider {
    *
    * Custom providers MUST honor this contract.
    */
-  getAddress(): Promise<CapxulResult<Address>>;
+  getAddress(): Promise<CapxulResult<Address$1>>;
   getDeployAccount(): Promise<CapxulResult<Account>>;
 }
 interface Eip1193Provider {
@@ -279,7 +275,7 @@ interface CapxulSigner extends CapxulDigestSigner {
    */
   readonly source: AccountProviderSource;
   /** Owner EOA address — the Safe's single owner. */
-  getAddress(): Promise<Address>;
+  getAddress(): Promise<Address$1>;
 }
 /** Minimal EIP-1193 surface an injected browser wallet exposes. */
 interface Eip1193RequestProvider {
@@ -297,5 +293,4 @@ interface Eip1193RequestProvider {
  */
 declare function injectedWalletSigner(provider: Eip1193RequestProvider): CapxulSigner;
 //#endregion
-export { isCapxulError as $, CurrencyCode as A, RunId as B, AnonymousDistinctId as C, BlockNumber as D, AuthUserId as E, Money as F, TxHash as G, SmartAccount$1 as H, OrgId as I, CapxulError as J, toAddress as K, Profile$1 as L, DurationMs as M, Email as N, ChainId as O, EpochMs as P, FailureMode as Q, PublishableKey as R, AllowedOrigin as S, AuthSession as T, SubAccount as U, SessionToken as V, SubAccountId as W, CapxulErrorDetails as X, CapxulErrorCode as Y, Failure as Z, AuthCachePortTag as _, AccountProvider as a, AccountId as b, Eip1193Provider as c, CapxulResult as d, Profile as f, AuthCachePort as g, AuthCacheError as h, injectedWalletSigner as i, DocumentHash as j, CountryCode as k, eip1193AccountProvider as l, SmartAccount as m, CapxulSigner as n, AccountProviderSource as o, Session as p, toCountryCode as q, Eip1193RequestProvider as r, AccountRequirement as s, CapxulDigestSigner as t, localPrivateKeyAccountProvider as u, CachedJwt as v, AppId as w, Address as x, Account$1 as y, RoleKey as z };
-//# sourceMappingURL=signer-CJT0pPiO.d.mts.map
+export { CapxulErrorDetails as $, CountryCode as A, PermissionAssignmentId as B, AllowedOrigin as C, AuthUserId as D, AuthSession as E, EpochMs as F, SessionToken as G, Profile$1 as H, Money as I, WeiAmount as J, SmartAccount$1 as K, MovementId as L, DocumentHash as M, DurationMs as N, BlockNumber as O, Email as P, CapxulErrorCode as Q, OrgId as R, AllowanceKey as S, AppId as T, PublishableKey as U, PermissionId as V, RoleKey as W, toCountryCode as X, toAddress as Y, CapxulError as Z, AuthCachePortTag as _, AccountProvider as a, AccountId as b, Eip1193Provider as c, CapxulResult as d, Failure as et, Profile as f, AuthCachePort as g, AuthCacheError as h, injectedWalletSigner as i, CurrencyCode as j, ChainId as k, eip1193AccountProvider as l, SmartAccount as m, CapxulSigner as n, isCapxulError as nt, AccountProviderSource as o, Session as p, TxHash as q, Eip1193RequestProvider as r, AccountRequirement as s, CapxulDigestSigner as t, FailureMode as tt, localPrivateKeyAccountProvider as u, CachedJwt as v, AnonymousDistinctId as w, Address$1 as x, Account$1 as y, PaymentCommandId as z };

package/dist/testing/index.d.mts

@@ -1,4 +1,4 @@
-import { an as TelemetryEvent, gn as IdentityTransition, on as TelemetryGroupInput, sn as TelemetryIdentifyInput, t as CapxulClient } from "../create-capxul-client-C7H5b68l.mjs";
+import { _n as IdentityTransition, an as TelemetryEvent, on as TelemetryGroupInput, sn as TelemetryIdentifyInput, t as CapxulClient } from "../create-capxul-client-klbklLYW.mjs";
 import { Effect, Layer } from "effect";
 
 //#region src/testing/telemetry/RecordingTelemetryAdapter.d.ts
@@ -50,5 +50,4 @@ interface CapxulTestObservation {
  */
 declare function createCapxulTestClient(options?: CreateCapxulTestClientOptions): CapxulTestClient;
 //#endregion
-export { CapxulTestClient, CapxulTestClock, CapxulTestObservation, CreateCapxulTestClientOptions, SeedTestIdentityInput, createCapxulTestClient };
-//# sourceMappingURL=index.d.mts.map
+export { CapxulTestClient, CapxulTestClock, CapxulTestObservation, CreateCapxulTestClientOptions, SeedTestIdentityInput, createCapxulTestClient };

package/dist/testing/index.mjs

@@ -1,5 +1,5 @@
-import { C as convexCallErrorFromCapxul, D as bootstrapErrorFromCapxul, H as deriveCapxulSafeAddress, O as authClientPortFromPromiseAdapter, _ as identityErrorFromCapxul, c as smartAccountErrorFromCapxul, d as fromWei, h as wireChainId, i as redactTelemetryEvent, m as toWei, p as accountReadErrorFromCapxul, t as assembleCapxulClient, u as subAccountErrorFromCapxul } from "../create-capxul-client-DVzm78RU.mjs";
-import { C as toJwtToken, E as toPublishableKey, N as Errors, O as toSessionToken, S as toEpochSeconds, _ as toCountryCode, b as toEmail, d as toAccountId, f as toAddress, g as toChainId, h as toAuthUserId, j as CapxulError, k as toSubAccountId, m as toAppId, p as toAllowedOrigin, t as InMemoryAuthCacheAdapter, v as toCurrencyCode, w as toKycTier, x as toEpochMs, y as toDurationMs } from "../InMemoryAuthCacheAdapter-Dr1sEd9y.mjs";
+import { E as authClientPortFromPromiseAdapter, T as bootstrapErrorFromCapxul, W as deriveCapxulSafeAddress, _ as wireChainId, f as smartAccountErrorFromCapxul, g as toWei, h as accountReadErrorFromCapxul, p as fromWei, t as assembleCapxulClient, u as redactTelemetryEvent, x as convexCallErrorFromCapxul, y as identityErrorFromCapxul } from "../create-capxul-client-N36cHqE2.mjs";
+import { A as toSessionToken, C as toEpochMs, E as toKycTier, M as CapxulError, O as toPublishableKey, P as Errors, S as toEmail, T as toJwtToken, _ as toAuthUserId, g as toAppId, h as toAllowedOrigin, m as toAddress, p as toAccountId, t as InMemoryAuthCacheAdapter, v as toChainId, w as toEpochSeconds, x as toDurationMs, y as toCountryCode } from "../InMemoryAuthCacheAdapter-Rc8tCtml.mjs";
 import { keccak256 } from "viem";
 import { Effect, Result, Semaphore } from "effect";
 import { getFunctionName } from "convex/server";
@@ -618,7 +618,7 @@ function isSupportedSmartAccountChain(chainId) {
 //#region src/testing/smart-account/InMemorySmartAccountAdapter.ts
 /**
 * Hermetic backend stand-in (PRD #462 / derivation v2): `provision` derives
-* the Safe from the identity email alone via the REAL canonical derivation
+* the Safe from the authenticated email via the REAL canonical derivation
 * (`deriveCapxulSafeAddress({ email })` — owner is the pinned bootstrap
 * constant). No signer exists at provision; `claim` installs the signer and
 * marks the row deployed, mirroring the backend's one-userOp claim lane.
@@ -626,12 +626,10 @@ function isSupportedSmartAccountChain(chainId) {
 var InMemorySmartAccountAdapter = class {
 	#accounts = /* @__PURE__ */ new Map();
 	#clock;
-	#identity;
 	#failures;
 	#provisionMutex = Semaphore.makeUnsafe(1);
 	constructor(deps) {
 		this.#clock = deps.clock;
-		this.#identity = deps.identity;
 		this.#failures = deps.failures;
 	}
 	loadByAuthUserId(authUserId) {
@@ -654,15 +652,13 @@ var InMemorySmartAccountAdapter = class {
 		const self = this;
 		return Effect.gen(function* () {
 			if (!isSupportedSmartAccountChain(input.chainId)) return yield* fail("provision", Errors.invalidInput("chainId", `unsupported chainId ${String(input.chainId)}`));
-			const identity = yield* self.#identity.loadByAuthUserId(input.authUserId).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("provision.identity", error.publicError, error)));
-			if (identity === null) return yield* fail("provision", Errors.profileNotFound(String(input.authUserId)));
 			const existing = self.#accounts.get(input.authUserId);
 			if (existing !== void 0) return cloneSmartAccount(existing);
 			const now = yield* self.#now("provision.clock");
 			const account = {
 				authUserId: input.authUserId,
 				signerAddress: null,
-				smartAccountAddress: toAddress(deriveCapxulSafeAddress({ email: identity.email })),
+				smartAccountAddress: toAddress(deriveCapxulSafeAddress({ email: input.email })),
 				chainId: input.chainId,
 				deployedAt: null,
 				claimedAt: null,
@@ -743,134 +739,6 @@ function cloneSmartAccountOrNull(account) {
 	return account === null ? null : cloneSmartAccount(account);
 }
 //#endregion
-//#region src/testing/sub-account/InMemorySubAccountAdapter.ts
-var InMemorySubAccountAdapter = class {
-	#rows = /* @__PURE__ */ new Map();
-	#failures;
-	#balanceOfRaw;
-	#created;
-	constructor(deps = {}) {
-		this.#failures = deps.failures ?? {};
-		this.#balanceOfRaw = deps.balanceOfRaw ?? "0";
-		for (const row of deps.seed ?? []) this.#rows.set(row.id, row);
-		this.#created = this.#rows.size;
-	}
-	create(input) {
-		const failure = this.#failures.create;
-		if (failure !== void 0) return Effect.fail(subAccountErrorFromCapxul("create", failure));
-		this.#created += 1;
-		const id = toSubAccountId(`subaccount_test${String(this.#created)}`);
-		const row = {
-			id,
-			accountId: input.accountId,
-			name: input.name,
-			balance: {
-				currency: toCurrencyCode("USD"),
-				value: "0",
-				decimals: 6
-			},
-			createdAt: toEpochMs(Date.now())
-		};
-		this.#rows.set(id, row);
-		return Effect.succeed(row);
-	}
-	get(input) {
-		return Effect.succeed(this.#rows.get(input.subAccountId) ?? null);
-	}
-	list(input) {
-		const accountId = input.accountId;
-		return Effect.succeed([...this.#rows.values()].filter((row) => row.accountId === accountId));
-	}
-	rename(input) {
-		const existing = this.#rows.get(input.subAccountId);
-		if (existing === void 0) return Effect.fail(subAccountErrorFromCapxul("rename", Errors.accountNotFound(input.subAccountId)));
-		const next = {
-			...existing,
-			name: input.name
-		};
-		this.#rows.set(input.subAccountId, next);
-		return Effect.succeed(next);
-	}
-	delete(input) {
-		const existing = this.#rows.get(input.subAccountId);
-		if (existing === void 0) return Effect.fail(subAccountErrorFromCapxul("delete", Errors.accountNotFound(input.subAccountId)));
-		if (Number(existing.balance.value) !== 0) return Effect.fail(subAccountErrorFromCapxul("delete", Errors.invalidInput("subAccountId", "delete requires zero balance")));
-		this.#rows.delete(input.subAccountId);
-		return Effect.succeed(void 0);
-	}
-	transfer(input) {
-		const decimals = input.amount.decimals;
-		const invalid = (field, reason) => Effect.fail(subAccountErrorFromCapxul("transfer", Errors.invalidInput(field, reason)));
-		let rawAmount;
-		try {
-			rawAmount = BigInt(toWei(input.amount));
-		} catch {
-			return invalid("amount", "must be a decimal money string");
-		}
-		if (rawAmount <= 0n) return invalid("amount", "must be positive");
-		if (input.from === input.to) return invalid("transfer", "from and to must differ");
-		const fromRow = input.from === "main" ? null : this.#rows.get(input.from) ?? "missing";
-		if (fromRow === "missing") return invalid("subAccountId", "unknown sub-account");
-		const toRow = input.to === "main" ? null : this.#rows.get(input.to) ?? "missing";
-		if (toRow === "missing") return invalid("subAccountId", "unknown sub-account");
-		const safeRaw = BigInt(this.#balanceOfRaw);
-		const subTotalRaw = this.#sumSubAccountRaws(decimals);
-		if (input.from === "main") {
-			const availableRaw = safeRaw - subTotalRaw;
-			if (availableRaw < rawAmount) return Effect.fail(subAccountErrorFromCapxul("transfer", Errors.insufficientBalance("main", maxRaw(availableRaw), rawAmount.toString(10))));
-		} else if (fromRow !== null) {
-			const fromRaw = BigInt(toWei({
-				value: fromRow.balance.value,
-				decimals
-			}));
-			if (fromRaw < rawAmount) return Effect.fail(subAccountErrorFromCapxul("transfer", Errors.insufficientBalance(fromRow.name, fromRaw.toString(10), rawAmount.toString(10))));
-		}
-		let nextFrom = null;
-		let nextTo = null;
-		if (fromRow !== null) {
-			const fromRaw = BigInt(toWei({
-				value: fromRow.balance.value,
-				decimals
-			}));
-			nextFrom = this.#patchBalance(fromRow, (fromRaw - rawAmount).toString(10), decimals);
-		}
-		if (toRow !== null) {
-			const toRaw = BigInt(toWei({
-				value: toRow.balance.value,
-				decimals
-			}));
-			nextTo = this.#patchBalance(toRow, (toRaw + rawAmount).toString(10), decimals);
-		}
-		const available = fromWei(maxRaw(safeRaw - this.#sumSubAccountRaws(decimals)), decimals, input.amount.currency);
-		return Effect.succeed({
-			available,
-			from: nextFrom,
-			to: nextTo
-		});
-	}
-	#sumSubAccountRaws(decimals) {
-		let total = 0n;
-		for (const row of this.#rows.values()) total += BigInt(toWei({
-			value: row.balance.value,
-			decimals
-		}));
-		return total;
-	}
-	#patchBalance(row, rawBalance, decimals) {
-		const balance = fromWei(rawBalance, decimals, row.balance.currency);
-		const next = {
-			...row,
-			balance
-		};
-		this.#rows.set(row.id, next);
-		return next;
-	}
-};
-/** Floor a (possibly negative) base-unit raw to a non-negative base-10 string. */
-function maxRaw(raw) {
-	return (raw < 0n ? 0n : raw).toString(10);
-}
-//#endregion
 //#region src/testing/telemetry/RecordingTelemetryAdapter.ts
 var RecordingTelemetryAdapter = class {
 	#events = [];
@@ -1007,12 +875,8 @@ function createCapxulTestClient(options = {}) {
 			authClient: authClientPortFromPromiseAdapter(authClient),
 			authCache,
 			identity,
-			smartAccount: new InMemorySmartAccountAdapter({
-				clock,
-				identity
-			}),
+			smartAccount: new InMemorySmartAccountAdapter({ clock }),
 			accountRead: new InMemoryAccountReadAdapter({ rawBalance: "0" }),
-			subAccount: new InMemorySubAccountAdapter(),
 			bootstrap: new BootstrapStubAdapter({ script: { resolutions: new Map([[`${toPublishableKey("cap_pk_test_0123456789ABCDEFGHJKMNPQRSTVWXYZ")}::${toAllowedOrigin("https://example.test")}`, TEST_BOOTSTRAP]]) } }),
 			clock,
 			telemetry,
@@ -1064,5 +928,3 @@ function createCapxulTestClient(options = {}) {
 }
 //#endregion
 export { createCapxulTestClient };
-
-//# sourceMappingURL=index.mjs.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/sdk",
-  "version": "1.2.2",
+  "version": "2.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Xelmar-tech/infrastructure.git",
@@ -38,29 +38,31 @@
   },
   "devDependencies": {
     "@effect/vitest": "4.0.0-beta.105",
+    "@typescript/native": "npm:typescript@7.0.2",
     "@vitest/coverage-v8": "4.1.7",
     "fast-check": "^3.23.2",
     "permissionless": "0.3.4",
     "posthog-js": "^1.399.2",
-    "typescript": "5.9.2",
+    "typescript": "npm:@typescript/typescript6@6.0.2",
+    "vite-plus": "0.1.23",
     "vitest": "npm:@voidzero-dev/vite-plus-test@0.1.23",
+    "@capxul/config": "0.1.1",
     "@capxul/errors": "0.0.1",
+    "@capxul/typescript-config": "0.0.0",
+    "@capxul/observability": "2.0.0",
     "@capxul/wire": "0.1.0",
-    "@capxul/observability": "1.2.2",
-    "@capxul/config": "0.1.0",
     "@capxul/types": "0.1.0"
   },
   "_permissionlessPinReason": "permissionless.toSafeSmartAccount is pinned to 0.3.4 for live Safe deployment E2E. Counterfactual address fixtures captured 2026-05-17 in packages/backend/convex/_shared/__tests__/counterfactual.test.ts and packages/config/tests/safe.test.ts must be re-verified before upgrading.",
   "scripts": {
-    "check-types": "vp exec tsc -p tsconfig.json --noEmit",
+    "check-types": "vp exec ../../node_modules/@typescript/native/bin/tsc -p tsconfig.json --noEmit",
     "lint": "vp exec oxlint -c ../../.oxlintrc.json . --deny-warnings",
-    "build": "NODE_OPTIONS=--max-old-space-size=24576 vp pack",
+    "build": "vp pack",
     "_vp-tasks-allowed": "vp-allowed: `test` + `test:coverage` are vp tasks in vite.config.ts so vitest self-writes don't bust cache (#205). `test:coverage:full` keeps the script form because it composes 5 reporters at invocation time.",
     "test:coverage:full": "CAPXUL_FAST_CHECK_NUM_RUNS=50 vp test run --coverage --coverage.reporter=text --coverage.reporter=json-summary --coverage.reporter=json --coverage.reporter=html --coverage.reporter=clover",
     "test:e2e": "vp test run --config vitest.e2e.config.ts",
     "proofs:live": "vp exec bash ../../scripts/prove-organization-core-live.sh",
     "proof:openfort-embedded-deploy": "vp test run --config vitest.e2e.config.ts e2e/openfort-embedded-deploy.live.ts",
-    "proof:observation-linkage": "CAPXUL_OBSERVATION_LINKAGE_ONLY=1 vp dlx tsx e2e/org-domain-sdk-live.ts",
-    "org:domain-live": "vp dlx tsx e2e/org-domain-sdk-live.ts"
+    "proof:dev-identity": "vp test run src/__e2e__/dev-identity-capability.l4.test.ts"
   }
 }

package/dist/InMemoryAuthCacheAdapter-Dr1sEd9y.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"InMemoryAuthCacheAdapter-Dr1sEd9y.mjs","names":[],"sources":["../../errors/src/errors.ts","../../errors/src/convex-error-decoding.ts","../../types/src/index.ts","../src/ports/auth-cache.ts","../src/adapters/auth-cache/serialization.ts","../src/adapters/auth-cache/BrowserAuthCacheAdapter.ts","../src/adapters/auth-cache/InMemoryAuthCacheAdapter.ts"],"sourcesContent":["// The canonical error-code catalog as a runtime constant. `CapxulErrorCode`\n// is derived from it so the type and any runtime check that needs to\n// enumerate codes (e.g. the convex-error codec's `KNOWN_CODES`) share a\n// single source of truth — a TypeScript union alone can't be introspected\n// at runtime, which previously forced a hand-maintained duplicate.\nexport const CAPXUL_ERROR_CODES = [\n  \"NOT_AUTHENTICATED\",\n  \"EMAIL_DELIVERY_FAILED\",\n  \"PROFILE_NOT_FOUND\",\n  \"SMART_ACCOUNT_MISSING\",\n  \"PLAYER_NOT_FOUND\",\n  \"ACCOUNT_NOT_FOUND\",\n  \"PROVIDER_ERROR\",\n  \"INVALID_INPUT\",\n  \"ENV_MISSING\",\n  \"NOT_IMPLEMENTED\",\n  \"VERIFICATION_REQUIRED\",\n  \"INSUFFICIENT_BALANCE\",\n  \"INVALID_RECIPIENT\",\n  \"ROLE_PERMISSION_DENIED\",\n  \"TRANSACTION_FAILED\",\n  \"RATE_LIMITED\",\n  \"NETWORK_ERROR\",\n  \"UNKNOWN\",\n  \"OTP_EXPIRED\",\n  \"SIGNER_REJECTED\",\n  \"CANCELLED\",\n  \"WRONG_STATE\",\n  \"STALE_EPOCH\",\n  \"SUPERSEDED\",\n  \"WORK_DIED\",\n  \"ACTOR_STOPPED\",\n] as const;\n\nexport type CapxulErrorCode = (typeof CAPXUL_ERROR_CODES)[number];\n\n/**\n * The error codes that represent an expected product outcome rather than a\n * defect. The SDK and backend observation boundaries both classify failures\n * against this set to route expected outcomes to their own PostHog event\n * stream; keeping the single copy here (adjacent to `CAPXUL_ERROR_CODES`, so a\n * code rename forces this set to move with it) stops the two sides of the wire\n * from drifting and silently splitting one outcome across two streams.\n */\nexport const EXPECTED_OPERATION_OUTCOMES: ReadonlySet<CapxulErrorCode> = new Set([\n  \"INVALID_INPUT\",\n  \"NOT_AUTHENTICATED\",\n  // A user with no Safe yet — the normal post-OTP / pre-provision state. Reading\n  // the account, current user, or balance in that window is an expected outcome,\n  // not a defect, so both observation boundaries route it to their\n  // `*_expected_outcome` stream instead of an unexpected `$exception` (#1031).\n  \"SMART_ACCOUNT_MISSING\",\n  \"CANCELLED\",\n  \"SIGNER_REJECTED\",\n  \"VERIFICATION_REQUIRED\",\n  \"INSUFFICIENT_BALANCE\",\n  \"INVALID_RECIPIENT\",\n  \"ROLE_PERMISSION_DENIED\",\n  \"RATE_LIMITED\",\n  \"OTP_EXPIRED\",\n  \"WRONG_STATE\",\n  \"STALE_EPOCH\",\n  \"SUPERSEDED\",\n  \"ACTOR_STOPPED\",\n]);\n\n/**\n * Why an auth/provider call failed — a flat CAUSE enum. The *where* (which\n * OpenFort operation) stays in the separate `operation` detail field; this\n * names the root cause so a single `$exception` can be triaged without\n * parsing the message. Five members, no free strings:\n *\n * - `auth-origin-mismatch`: OTP cookies live on `localhost:PORT` but OpenFort\n *   hits the Convex host → no session reaches the provider.\n * - `stale-openfort-cache`: an old `userId` in scoped storage makes the SDK\n *   skip re-auth → 401 on `v2/accounts`.\n * - `app-env-allowlist`: the selected app/deployment origin is not allowlisted\n *   → 401.\n * - `no-secure-context`: sandboxed/headless browser with no Web Crypto, so\n *   `getAddress`/`configure` can never produce an address. Previously vanished\n *   into `unknown`; the signer's secure-context probe now names it.\n * - `unknown`: catch-all when no cause could be determined.\n */\nexport type FailureMode =\n  | \"auth-origin-mismatch\"\n  | \"stale-openfort-cache\"\n  | \"app-env-allowlist\"\n  | \"no-secure-context\"\n  | \"unknown\";\n\n/**\n * The one failure representation carried by domain state, actor work, and\n * public error projection. Keeping it beside the canonical error catalog\n * prevents a machine or shell from inventing a second code vocabulary.\n */\nexport interface Failure {\n  readonly code: CapxulErrorCode;\n  readonly message: string;\n  readonly mode?: FailureMode;\n}\n\nexport type CapxulErrorDetails = Record<string, unknown>;\n\nexport type SignerSource = \"openfort-embedded\" | \"injected-eip1193\" | \"local-private-key\";\n\nexport type VerificationRequiredDetails =\n  | { readonly requiredTier: number }\n  | { readonly rail: string; readonly currentKind: string };\n\nexport type SerializedCapxulError = {\n  readonly code: CapxulErrorCode;\n  readonly message: string;\n  readonly details?: CapxulErrorDetails;\n  readonly correlationId?: string;\n  readonly layer?: string;\n};\n\nexport type CapxulErrorOptions = {\n  readonly cause?: unknown;\n  readonly details?: CapxulErrorDetails;\n  readonly correlationId?: string;\n  readonly layer?: string;\n};\n\nexport class CapxulError extends Error {\n  readonly code: CapxulErrorCode;\n  readonly details?: CapxulErrorDetails;\n  readonly correlationId?: string;\n  readonly layer?: string;\n\n  constructor(code: CapxulErrorCode, message: string, options: CapxulErrorOptions = {}) {\n    super(message, \"cause\" in options ? { cause: options.cause } : undefined);\n    this.name = \"CapxulError\";\n    this.code = code;\n    if (options.details !== undefined) {\n      this.details = options.details;\n    }\n    if (options.correlationId !== undefined) {\n      this.correlationId = options.correlationId;\n    }\n    if (options.layer !== undefined) {\n      this.layer = options.layer;\n    }\n  }\n}\n\nexport function isCapxulError(value: unknown): value is CapxulError {\n  return value instanceof CapxulError;\n}\n\nexport function serializeCapxulError(error: CapxulError): SerializedCapxulError {\n  return compactSerialized({\n    code: error.code,\n    message: error.message,\n    details: error.details,\n    correlationId: error.correlationId,\n    layer: error.layer,\n  });\n}\n\nexport function deserializeCapxulError(serialized: SerializedCapxulError): CapxulError {\n  return new CapxulError(\n    serialized.code,\n    serialized.message,\n    compactErrorOptions({\n      details: serialized.details,\n      correlationId: serialized.correlationId,\n      layer: serialized.layer,\n    }),\n  );\n}\n\nfunction compactSerialized(serialized: {\n  readonly code: CapxulErrorCode;\n  readonly message: string;\n  readonly details: CapxulErrorDetails | undefined;\n  readonly correlationId: string | undefined;\n  readonly layer: string | undefined;\n}): SerializedCapxulError {\n  const result: {\n    code: CapxulErrorCode;\n    message: string;\n    details?: CapxulErrorDetails;\n    correlationId?: string;\n    layer?: string;\n  } = {\n    code: serialized.code,\n    message: serialized.message,\n  };\n\n  if (serialized.details !== undefined) {\n    result.details = serialized.details;\n  }\n  if (serialized.correlationId !== undefined) {\n    result.correlationId = serialized.correlationId;\n  }\n  if (serialized.layer !== undefined) {\n    result.layer = serialized.layer;\n  }\n\n  return result;\n}\n\nfunction compactErrorOptions(options: {\n  readonly cause?: unknown;\n  readonly details: CapxulErrorDetails | undefined;\n  readonly correlationId: string | undefined;\n  readonly layer: string | undefined;\n}): CapxulErrorOptions {\n  const result: {\n    cause?: unknown;\n    details?: CapxulErrorDetails;\n    correlationId?: string;\n    layer?: string;\n  } = {};\n\n  if (\"cause\" in options) {\n    result.cause = options.cause;\n  }\n  if (options.details !== undefined) {\n    result.details = options.details;\n  }\n  if (options.correlationId !== undefined) {\n    result.correlationId = options.correlationId;\n  }\n  if (options.layer !== undefined) {\n    result.layer = options.layer;\n  }\n\n  return result;\n}\n\nexport const Errors = {\n  notAuthenticated: (message?: string, opts?: { readonly failure_mode?: FailureMode }) =>\n    new CapxulError(\n      \"NOT_AUTHENTICATED\",\n      message ?? \"Not authenticated\",\n      opts?.failure_mode ? { details: { failure_mode: opts.failure_mode } } : undefined,\n    ),\n  emailDeliveryFailed: (detail: string) =>\n    new CapxulError(\"EMAIL_DELIVERY_FAILED\", \"Failed to send email\", {\n      details: { detail },\n    }),\n\n  profileNotFound: (authUserId: string) =>\n    new CapxulError(\"PROFILE_NOT_FOUND\", `Profile not found for user ${authUserId}`, {\n      details: { authUserId },\n    }),\n\n  smartAccountMissing: (authUserId: string) =>\n    new CapxulError(\"SMART_ACCOUNT_MISSING\", \"Smart account not provisioned\", {\n      details: { authUserId },\n    }),\n\n  playerNotFound: (playerId?: string) =>\n    new CapxulError(\n      \"PLAYER_NOT_FOUND\",\n      playerId ? `Openfort player ${playerId} not found` : \"Openfort player not found\",\n      playerId === undefined ? undefined : { details: { playerId } },\n    ),\n\n  accountNotFound: (accountId?: string) =>\n    new CapxulError(\n      \"ACCOUNT_NOT_FOUND\",\n      accountId ? `Openfort account ${accountId} not found` : \"Openfort account not found\",\n      accountId === undefined ? undefined : { details: { accountId } },\n    ),\n\n  providerError: (\n    provider: string,\n    operation: string,\n    cause: unknown,\n    opts?: { readonly failure_mode?: FailureMode },\n  ) => {\n    const details: Record<string, unknown> = { provider, operation };\n    if (opts?.failure_mode) {\n      details.failure_mode = opts.failure_mode;\n    }\n    return new CapxulError(\"PROVIDER_ERROR\", `Provider error: ${provider} ${operation}`, {\n      cause,\n      details,\n    });\n  },\n\n  invalidInput: (field: string, reason: string) =>\n    new CapxulError(\"INVALID_INPUT\", `Invalid ${field}: ${reason}`, {\n      details: { field, reason },\n    }),\n\n  envMissing: (name: string) =>\n    new CapxulError(\"ENV_MISSING\", `Environment variable ${name} not configured`, {\n      details: { name },\n    }),\n\n  notImplemented: (domain: string, method: string) =>\n    new CapxulError(\n      \"NOT_IMPLEMENTED\",\n      `${domain}.${method} is not yet implemented. This feature is planned for a future release.`,\n      { details: { domain, method } },\n    ),\n\n  /**\n   * Sibling factory to {@link Errors.providerError} for the per-state timeout\n   * path in flows. Same `PROVIDER_ERROR` code as\n   * `providerError`, plus a `details.reason: \"timeout\"` discriminator so\n   * downstream observers can distinguish failure modes without parsing the\n   * message string. The redacted message names the timeout budget; the\n   * native `cause` carries the same information for `reportError` fidelity.\n   */\n  providerTimeout: (provider: string, operation: string, timeoutMs: number) =>\n    new CapxulError(\n      \"PROVIDER_ERROR\",\n      `Provider error: ${provider} ${operation} (timeout exceeded ${timeoutMs}ms)`,\n      {\n        details: { provider, operation, reason: \"timeout\" },\n        cause: new Error(`timeout: ${operation} exceeded ${timeoutMs}ms`),\n      },\n    ),\n\n  verificationRequired: (details: VerificationRequiredDetails) => {\n    const message =\n      \"rail\" in details\n        ? `Verification is required before ${details.rail} can use ${details.currentKind}.`\n        : `Verification tier ${details.requiredTier} is required.`;\n\n    return new CapxulError(\"VERIFICATION_REQUIRED\", message, {\n      details,\n    });\n  },\n\n  insufficientBalance: (asset: string, available: string, required: string) =>\n    new CapxulError(\"INSUFFICIENT_BALANCE\", `Insufficient ${asset} balance`, {\n      details: { asset, available, required },\n    }),\n\n  invalidRecipient: (reason: string) =>\n    new CapxulError(\"INVALID_RECIPIENT\", `Invalid recipient: ${reason}`, {\n      details: { reason },\n    }),\n\n  /**\n   * The org Zodiac Roles modifier REFUSED the spend on-chain (G4 · #547): the\n   * member's role condition (per-tx cap, per-day allowance, allowed recipient,\n   * or membership) was violated, so `execTransactionWithRole` reverted. This is\n   * a PERMISSION denial — explicitly NOT an `INSUFFICIENT_BALANCE` (the treasury\n   * held the funds; the role's authority is what bound). `reason` discriminates\n   * the violated condition (`over_cap` / `daily_cap` / `not_member` /\n   * `disallowed_recipient` / `condition_violation`); leak-safe — no on-chain\n   * identifiers ever enter the details.\n   */\n  rolePermissionDenied: (details: {\n    readonly reason:\n      | \"over_cap\"\n      | \"daily_cap\"\n      | \"not_member\"\n      | \"disallowed_recipient\"\n      | \"condition_violation\";\n    readonly operation?: string;\n  }) =>\n    new CapxulError(\n      \"ROLE_PERMISSION_DENIED\",\n      `Org role denied this spend on-chain (${details.reason}).`,\n      {\n        details:\n          details.operation === undefined\n            ? { reason: details.reason }\n            : { reason: details.reason, operation: details.operation },\n      },\n    ),\n\n  /**\n   * A transaction (or sponsored UserOp) failed. `details.reason` discriminates\n   * the failure mode for callers that must distinguish a CONFIRMED on-chain\n   * revert (`\"onchain_revert\"` — the op executed and reverted, e.g. a Zodiac\n   * Roles condition violation) from an inconclusive infra failure. A confirmed\n   * revert is the ONLY mode the org spend port may map to a roles denial.\n   */\n  transactionFailed: (operation: string, cause?: unknown, extra?: { readonly reason?: string }) =>\n    new CapxulError(\"TRANSACTION_FAILED\", `Transaction failed: ${operation}`, {\n      cause,\n      details: extra?.reason === undefined ? { operation } : { operation, reason: extra.reason },\n    }),\n\n  rateLimited: (details?: { readonly retryAfterMs?: number; readonly resource?: string }) =>\n    new CapxulError(\n      \"RATE_LIMITED\",\n      \"Rate limit exceeded\",\n      details === undefined ? undefined : { details: { ...details } },\n    ),\n\n  networkError: (operation: string, cause?: unknown) =>\n    new CapxulError(\"NETWORK_ERROR\", `Network error during ${operation}`, {\n      cause,\n      details: { operation },\n    }),\n\n  unknown: (cause?: unknown) => new CapxulError(\"UNKNOWN\", \"Unknown error\", { cause }),\n\n  otpExpired: (details?: { readonly email?: string; readonly expiredAt?: number }) =>\n    new CapxulError(\n      \"OTP_EXPIRED\",\n      \"Verification code has expired. Request a new one.\",\n      details === undefined ? undefined : { details: { ...details } },\n    ),\n\n  signerRejected: (details: {\n    readonly source: SignerSource;\n    readonly reason?: string;\n    readonly cause?: unknown;\n  }) =>\n    new CapxulError(\"SIGNER_REJECTED\", \"Signer rejected the request.\", {\n      cause: details.cause,\n      details:\n        details.reason === undefined\n          ? { source: details.source }\n          : { source: details.source, reason: details.reason },\n    }),\n\n  cancelled: (details?: { readonly operation?: string; readonly reason?: string }) =>\n    new CapxulError(\n      \"CANCELLED\",\n      \"Operation was cancelled.\",\n      details === undefined ? undefined : { details: { ...details } },\n    ),\n\n  /**\n   * Method called from a flow state where its precondition fails (TA16). The\n   * SDK's method API short-circuits with this error before driving the\n   * internal state machine. `currentState` is the Effect-machine snapshot\n   * tag (stringified from the SDK's actor-shell snapshot; see\n   * `packages/errors/CONTEXT.md`); `validStates`\n   * enumerates the states the method accepts.\n   */\n  wrongState: (details: {\n    readonly method: string;\n    readonly currentState: string;\n    readonly validStates: readonly string[];\n  }) =>\n    new CapxulError(\n      \"WRONG_STATE\",\n      `${details.method} called from state '${details.currentState}'; valid states: ${details.validStates.join(\", \")}`,\n      { details: { ...details, validStates: [...details.validStates] } },\n    ),\n} as const;\n","// Shared `decodeConvexError` helper (TA5) — used by both the SDK's\n// `ConvexCallAdapter.mapToCapxulError` AND the backend `credentials/http.ts`\n// `bootstrapClient` handler. Single source of truth for cross-Convex-boundary\n// error decoding rules.\n//\n// Recognizes the `ConvexError(SerializedCapxulError)` object-shape produced by\n// `withErrorBoundary` (Probe B finding, 2026-05-19):\n//\n//   { name: \"ConvexError\", data: { code, message, details?, correlationId?, layer? } }\n//\n// AND the defensive string-shape branch for older Convex versions where\n// `data` is a JSON-serialized string. Pass-through for raw `CapxulError`\n// instances (which arrive directly when the throw happened in the same\n// V8 isolate as the catch). Returns null when the value is not a\n// recognizable shape — the caller falls back to NETWORK_ERROR + reportError.\n\nimport {\n  CAPXUL_ERROR_CODES,\n  CapxulError,\n  type CapxulErrorCode,\n  type SerializedCapxulError,\n  deserializeCapxulError,\n} from \"./errors.ts\";\n\n// Derived from the canonical catalog in errors.ts — single source of truth,\n// so a new code added to `CAPXUL_ERROR_CODES` is recognized here automatically.\nconst KNOWN_CODES: ReadonlySet<CapxulErrorCode> = new Set(CAPXUL_ERROR_CODES);\n\nfunction isCapxulCode(value: unknown): value is CapxulErrorCode {\n  return typeof value === \"string\" && KNOWN_CODES.has(value as CapxulErrorCode);\n}\n\nfunction reconstruct(serialized: Record<string, unknown>): CapxulError | null {\n  if (!isCapxulCode(serialized.code)) return null;\n  const payload: SerializedCapxulError = {\n    code: serialized.code,\n    message: typeof serialized.message === \"string\" ? serialized.message : String(serialized.code),\n    ...(typeof serialized.details === \"object\" &&\n    serialized.details !== null &&\n    !Array.isArray(serialized.details)\n      ? { details: serialized.details as Record<string, unknown> }\n      : {}),\n    ...(typeof serialized.correlationId === \"string\"\n      ? { correlationId: serialized.correlationId }\n      : {}),\n    ...(typeof serialized.layer === \"string\" ? { layer: serialized.layer } : {}),\n  };\n  return deserializeCapxulError(payload);\n}\n\nexport function decodeConvexError(err: unknown): CapxulError | null {\n  if (err === null || err === undefined) return null;\n\n  // Pass-through: same isolate, real CapxulError instance.\n  if (err instanceof CapxulError) return err;\n\n  if (typeof err !== \"object\") return null;\n\n  // The canonical shape produced by `withErrorBoundary` then crossed by\n  // Convex's `ctx.runQuery` / `ConvexHttpClient`: a `ConvexError` whose\n  // `data` is the `SerializedCapxulError` object literal.\n  const record = err as Record<string, unknown>;\n  if (!(\"data\" in record)) return null;\n  const data = record.data;\n\n  if (typeof data === \"object\" && data !== null) {\n    return reconstruct(data as Record<string, unknown>);\n  }\n\n  // Defensive depth — some Convex versions JSON-stringify the data at\n  // the runtime boundary. Probe B confirmed @convex-dev/better-auth 0.10.13\n  // + convex 1.39.x do NOT do this, but the cheap parse keeps forward\n  // compatibility.\n  if (typeof data === \"string\") {\n    try {\n      const parsed = JSON.parse(data) as unknown;\n      if (typeof parsed === \"object\" && parsed !== null) {\n        return reconstruct(parsed as Record<string, unknown>);\n      }\n    } catch {\n      // Fall through.\n    }\n  }\n\n  return null;\n}\n","import { Errors } from \"@capxul/errors\";\nimport type { Brand } from \"./brand\";\n\nexport type { Brand } from \"./brand\";\n\nexport type Address = Brand<string, \"Address\">;\nexport type Email = Brand<string, \"Email\">;\nexport type Identity = Brand<string, \"Identity\">;\n// `Profile` is the SDK's user-shaped record returned by `IdentityPort`. Pure\n// record of brand-typed fields — not itself a brand. The field-level brands\n// satisfy `IdentityPort` clause I8 at compile time. Hosted here per the\n// package contract (`packages/types/CONTEXT.md`).\nexport type Profile = {\n  readonly authUserId: AuthUserId;\n  readonly email: Email;\n  readonly displayName: string | null;\n  readonly country: CountryCode | null;\n  readonly onboarded: boolean;\n  readonly withdrawalAddress: Address | null;\n  // #1062: globally-unique normalized handle; #1061 / ADR-0014: profile-image\n  // serving URL resolved at read time. Plain strings (not branded in this\n  // slice); null when unset — the Convex read boundary always maps both.\n  readonly username: string | null;\n  readonly imageUrl: string | null;\n  readonly kycTier: KycTier;\n  readonly createdAt: EpochMs;\n  readonly updatedAt: EpochMs;\n};\n// `SmartAccount` is the SDK's ERC-4337 record returned by `SmartAccountPort`.\n// Pure record of brand-typed fields — not itself a brand. `deployedAt` is\n// nullable: `null` means the address is counterfactual (derived, not yet\n// on-chain). PRD #462 (derivation v2): `signerAddress` is the CLAIMED owner —\n// `null` until the claim userOp installs the user's signer (`claimedAt`\n// records that event); the address derives from the email alone. Hosted here\n// per the package contract (`packages/types/CONTEXT.md`).\nexport type SmartAccount = {\n  readonly authUserId: AuthUserId;\n  readonly signerAddress: Address | null;\n  readonly smartAccountAddress: Address;\n  readonly chainId: ChainId;\n  readonly deployedAt: EpochMs | null;\n  readonly claimedAt: EpochMs | null;\n  readonly createdAt: EpochMs;\n};\n// `Money` is the SDK's consumer-facing value type (canon\n// `account-balance-model.md` §10). Every public monetary value is a `Money`\n// — never wei, never raw token units. `value` is a major-unit decimal string\n// (e.g. \"1.5\" USD); `decimals` is the on-chain token precision used for the\n// internal `fromWei`/`toWei` round-trip at the SDK boundary (USDX is 6).\n// Pure record of a brand-typed field + primitives — not itself a brand.\nexport type Money = {\n  readonly currency: CurrencyCode;\n  readonly value: string;\n  readonly decimals: number;\n};\n\n// `Account` is the SDK's logical money account (canon §6, §9). `id` is the\n// `account_`-shaped `AccountId` — NOT the Safe address and NOT an Openfort id.\n// `balance` is the Safe's top-line holdings; `available` is money not assigned\n// to any sub-account (canon §5/§12). With no sub-accounts (Slice 1a),\n// `available === balance`. Pure record of brand-typed fields — not a brand.\nexport type Account = {\n  readonly id: AccountId;\n  readonly balance: Money;\n  readonly available: Money;\n};\n\n/** Named bucket partitioning a logical Account (canon §9). */\nexport type SubAccount = {\n  readonly id: SubAccountId;\n  readonly accountId: AccountId;\n  readonly name: string;\n  readonly balance: Money;\n  readonly createdAt: EpochMs;\n};\n\nexport type AuthUserId = Brand<string, \"AuthUserId\">;\nexport type AnonymousDistinctId = Brand<string, \"AnonymousDistinctId\">;\nexport type PlayerId = Brand<string, \"PlayerId\">;\nexport type AccountId = Brand<string, \"AccountId\">;\nexport type SubAccountId = Brand<string, \"SubAccountId\">;\nexport type OrgId = Brand<string, \"OrgId\">;\nexport type AppId = Brand<string, \"AppId\">;\nexport type AllowedOrigin = Brand<string, \"AllowedOrigin\">;\nexport type PublishableKey = Brand<string, \"PublishableKey\">;\nexport type PublishableKeyId = Brand<string, \"PublishableKeyId\">;\nexport type DurationMs = Brand<number, \"DurationMs\">;\n// `DeveloperApplication` and `PublishableKeyRecord` are the SDK's record\n// shapes returned by `CredentialsPort`. Pure records of brand-typed fields\n// — not themselves brands. The field-level brands satisfy CR13 + the record\n// branding clauses of `credentials.test-d.ts` at compile time. Hosted here\n// per the package contract (`packages/types/CONTEXT.md`).\nexport type DeveloperApplication = {\n  readonly id: AppId;\n  readonly authUserId: AuthUserId;\n  readonly name: string;\n  readonly allowedOrigins: readonly AllowedOrigin[];\n  readonly createdAt: EpochMs;\n  readonly archivedAt: EpochMs | null;\n};\nexport type PublishableKeyRecord = {\n  readonly id: PublishableKeyId;\n  readonly applicationId: AppId;\n  readonly activeFromMs: EpochMs;\n  readonly gracePeriodEndsMs: EpochMs | null;\n  readonly revokedAt: EpochMs | null;\n};\nexport type TxHash = Brand<string, \"TxHash\">;\nexport type DocumentHash = Brand<string, \"DocumentHash\">;\nexport type EpochMs = Brand<number, \"EpochMs\">;\nexport type EpochSeconds = Brand<number, \"EpochSeconds\">;\nexport type ChainId = Brand<number, \"ChainId\">;\nexport type CountryCode = Brand<string, \"CountryCode\">;\nexport type CurrencyCode = Brand<SupportedCurrencyCode, \"CurrencyCode\">;\nexport type KycTier = Brand<0 | 1 | 2 | 3, \"KycTier\">;\nexport type BlockNumber = Brand<number, \"BlockNumber\">;\nexport type LogIndex = Brand<number, \"LogIndex\">;\nexport type WeiAmount = Brand<string, \"WeiAmount\">;\nexport type SafeAddress = Brand<string, \"SafeAddress\">;\nexport type ModuleAddress = Brand<string, \"ModuleAddress\">;\nexport type RunId = Brand<string, \"RunId\">;\nexport type RoleKey = Brand<string, \"RoleKey\">;\nexport type AllowanceKey = Brand<string, \"AllowanceKey\">;\nexport type SessionToken = Brand<string, \"SessionToken\">;\nexport type JwtToken = Brand<string, \"JwtToken\">;\n\n// `AuthSession` is the record type shared by `AuthClientPort` and\n// `SessionStoragePort`. Hosted here per the canon\n// (`packages/types/CONTEXT.md`) so both ports depend on it\n// symmetrically. Every field is branded — field-level brands satisfy the\n// AuthSession branding contract asserted in `auth-client.test-d.ts`.\nexport type AuthSession = {\n  readonly authUserId: AuthUserId;\n  readonly email: Email;\n  readonly token: SessionToken;\n  readonly expiresAt: EpochMs;\n};\n\nexport const EVM_ADDRESS_RE = /^0x[0-9a-f]{40}$/i;\nexport const BYTES32_RE = /^0x[0-9a-f]{64}$/i;\nexport const PUBLISHABLE_KEY_PATTERN = /^cap_pk_(test|live)_[0-9A-HJKMNP-TV-Z]{32}$/;\nexport const SUPPORTED_CURRENCIES = [\n  { code: \"USD\", symbol: \"$\", name: \"US Dollar\" },\n  { code: \"NGN\", symbol: \"NGN\", name: \"Nigerian Naira\" },\n  { code: \"GHS\", symbol: \"GHS\", name: \"Ghanaian Cedi\" },\n  { code: \"KES\", symbol: \"KSh\", name: \"Kenyan Shilling\" },\n  { code: \"UGX\", symbol: \"USh\", name: \"Ugandan Shilling\" },\n] as const;\nexport const SUPPORTED_CURRENCY_CODES = SUPPORTED_CURRENCIES.map((currency) => currency.code);\ntype SupportedCurrencyCode = (typeof SUPPORTED_CURRENCIES)[number][\"code\"];\nexport const CURRENCY_SYMBOLS = Object.fromEntries(\n  SUPPORTED_CURRENCIES.map((currency) => [currency.code, currency.symbol]),\n) as Record<SupportedCurrencyCode, string>;\n\nconst EMAIL_RE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\nconst COUNTRY_CODE_RE = /^[A-Z]{2}$/;\nconst ANONYMOUS_DISTINCT_ID_RE = /^anon_[a-zA-Z0-9-]+$/;\n// Canon §6: the logical Account brand is `account_`-shaped. The tail mirrors\n// the `app_` ULID-shape generator (`account_<26 Crockford base32 chars>`) but\n// the brand only enforces the `account_` prefix + a non-empty alphanumeric\n// tail so existing opaque test ids (`account_123`) and generated ULIDs both\n// satisfy it.\nconst ACCOUNT_ID_RE = /^account_[0-9A-Za-z]+$/;\nconst SUBACCOUNT_ID_RE = /^subaccount_[0-9A-Za-z]+$/;\n// Exported so `@capxul/wire`'s `AppIdSchema` can reuse the same regex via\n// `Schema.filter(...)` and stay in lockstep with `toAppId` (Decision 2,\n// 2b parity).\nexport const APP_ID_RE = /^app_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;\nconst TX_HASH_RE = /^0x[0-9a-f]{64}$/i;\nconst DOCUMENT_HASH_HEX_RE = /^[0-9a-fA-F]{64}$/;\nconst WEI_RE = /^[0-9]+$/;\nconst RUN_ID_RE = /^run_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;\nconst MAX_SAFE_EPOCH_SECONDS = Math.floor(Number.MAX_SAFE_INTEGER / 1000);\n\nexport function toAddress(raw: unknown): Address {\n  if (typeof raw !== \"string\" || !EVM_ADDRESS_RE.test(raw)) {\n    throw Errors.invalidInput(\"address\", invalidValueReason(\"invalid EVM address format\", raw));\n  }\n\n  return raw.toLowerCase() as Address;\n}\n\nexport function isEvmAddress(raw: unknown): raw is string {\n  return typeof raw === \"string\" && EVM_ADDRESS_RE.test(raw);\n}\n\nexport function toEmail(raw: unknown): Email {\n  if (typeof raw !== \"string\" || !EMAIL_RE.test(raw)) {\n    throw Errors.invalidInput(\"email\", invalidValueReason(\"must look like an email address\", raw));\n  }\n\n  return raw.toLowerCase() as Email;\n}\n\nexport function toIdentity(raw: unknown): Identity {\n  return toNonEmptyStringBrand(raw, \"identity\") as Identity;\n}\n\nexport function toAuthUserId(raw: unknown): AuthUserId {\n  return toNonEmptyStringBrand(raw, \"authUserId\") as AuthUserId;\n}\n\nexport function toAnonymousDistinctId(raw: unknown): AnonymousDistinctId {\n  if (typeof raw !== \"string\" || !ANONYMOUS_DISTINCT_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"anonDistinctId\",\n      invalidValueReason(\"must be anon_ plus letters, digits, or hyphens\", raw),\n    );\n  }\n\n  return raw as AnonymousDistinctId;\n}\n\nexport function toPlayerId(raw: unknown): PlayerId {\n  return toNonEmptyStringBrand(raw, \"playerId\") as PlayerId;\n}\n\nexport function toAccountId(raw: unknown): AccountId {\n  if (typeof raw !== \"string\" || !ACCOUNT_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"accountId\",\n      invalidValueReason(\"must be account_ plus an alphanumeric id\", raw),\n    );\n  }\n\n  return raw as AccountId;\n}\n\nexport function toSubAccountId(raw: unknown): SubAccountId {\n  if (typeof raw !== \"string\" || !SUBACCOUNT_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"subAccountId\",\n      invalidValueReason(\"must be subaccount_ plus an alphanumeric id\", raw),\n    );\n  }\n\n  return raw as SubAccountId;\n}\n\nexport function toOrgId(raw: unknown): OrgId {\n  return toNonEmptyStringBrand(raw, \"orgId\") as OrgId;\n}\n\nexport function toAppId(raw: unknown): AppId {\n  if (typeof raw !== \"string\" || !APP_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\"appId\", invalidValueReason(\"must be app_ plus a ULID\", raw));\n  }\n\n  return raw as AppId;\n}\n\nexport function toAllowedOrigin(raw: unknown): AllowedOrigin {\n  if (typeof raw !== \"string\") {\n    throw Errors.invalidInput(\"allowedOrigin\", \"must be an http or https origin string\");\n  }\n\n  const normalized = normalizeAllowedOrigin(raw);\n  if (normalized === null) {\n    throw Errors.invalidInput(\n      \"allowedOrigin\",\n      invalidValueReason(\"must be an http or https origin\", raw),\n    );\n  }\n\n  return normalized as AllowedOrigin;\n}\n\nexport function toPublishableKeyId(raw: unknown): PublishableKeyId {\n  return toNonEmptyStringBrand(raw, \"keyId\") as PublishableKeyId;\n}\n\nexport function toDurationMs(raw: unknown): DurationMs {\n  if (typeof raw !== \"number\" || !Number.isSafeInteger(raw) || raw < 0) {\n    throw Errors.invalidInput(\n      \"duration\",\n      invalidValueReason(\"must be a non-negative safe integer\", raw),\n    );\n  }\n\n  return raw as DurationMs;\n}\n\nexport function toPublishableKey(raw: unknown): PublishableKey {\n  if (typeof raw !== \"string\" || !PUBLISHABLE_KEY_PATTERN.test(raw)) {\n    throw Errors.invalidInput(\n      \"publishableKey\",\n      invalidValueReason(\"must match cap_pk_(test|live) plus 32 Crockford base32 chars\", raw),\n    );\n  }\n\n  return raw as PublishableKey;\n}\n\nexport function toTxHash(raw: unknown): TxHash {\n  if (typeof raw !== \"string\" || !TX_HASH_RE.test(raw)) {\n    throw Errors.invalidInput(\"txHash\", invalidValueReason(\"must be 0x + 64 hex chars\", raw));\n  }\n\n  return raw.toLowerCase() as TxHash;\n}\n\nexport function toDocumentHash(raw: unknown): DocumentHash {\n  if (typeof raw !== \"string\") {\n    throw Errors.invalidInput(\"documentHash\", \"must be a string\");\n  }\n\n  const stripped = raw.startsWith(\"0x\") || raw.startsWith(\"0X\") ? raw.slice(2) : raw;\n  if (!DOCUMENT_HASH_HEX_RE.test(stripped)) {\n    throw Errors.invalidInput(\"documentHash\", \"must be 32 bytes of hex\");\n  }\n\n  return `0x${stripped.toLowerCase()}` as DocumentHash;\n}\n\nexport function toEpochMs(raw: unknown): EpochMs {\n  assertSafeNonNegativeInteger(raw, \"epochMs\");\n  return raw as EpochMs;\n}\n\nexport function toEpochSeconds(raw: unknown): EpochSeconds {\n  assertSafeNonNegativeInteger(raw, \"epochSeconds\");\n  return raw as EpochSeconds;\n}\n\nexport function secondsToMs(seconds: EpochSeconds): EpochMs {\n  if (seconds > MAX_SAFE_EPOCH_SECONDS) {\n    throw Errors.invalidInput(\"epochSeconds\", `${seconds} would overflow when multiplied by 1000`);\n  }\n\n  return toEpochMs(seconds * 1000);\n}\n\nexport function epochMsToSeconds(ms: EpochMs): EpochSeconds {\n  return toEpochSeconds(Math.floor(ms / 1000));\n}\n\nexport function toChainId(raw: unknown): ChainId {\n  if (typeof raw !== \"number\" || !Number.isSafeInteger(raw) || raw <= 0) {\n    throw Errors.invalidInput(\n      \"chainId\",\n      invalidValueReason(\"must be a positive safe integer\", raw),\n    );\n  }\n\n  return raw as ChainId;\n}\n\nexport function toBlockNumber(raw: unknown): BlockNumber {\n  assertSafeNonNegativeInteger(raw, \"blockNumber\");\n  return raw as BlockNumber;\n}\n\nexport function toLogIndex(raw: unknown): LogIndex {\n  assertSafeNonNegativeInteger(raw, \"logIndex\");\n  return raw as LogIndex;\n}\n\nexport function toWeiAmount(raw: unknown): WeiAmount {\n  if (typeof raw !== \"string\" || !WEI_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"weiAmount\",\n      invalidValueReason(\"must be a non-negative integer string\", raw),\n    );\n  }\n\n  return raw as WeiAmount;\n}\n\nexport function toCountryCode(raw: unknown): CountryCode {\n  if (typeof raw !== \"string\") {\n    throw Errors.invalidInput(\"countryCode\", \"must be a string\");\n  }\n\n  const upper = raw.toUpperCase();\n  if (!COUNTRY_CODE_RE.test(upper)) {\n    throw Errors.invalidInput(\n      \"countryCode\",\n      invalidValueReason(\"must be a 2-letter ISO 3166-1 alpha-2 code\", raw),\n    );\n  }\n\n  return upper as CountryCode;\n}\n\nexport function toCurrencyCode(raw: unknown): CurrencyCode {\n  if (typeof raw !== \"string\" || !SUPPORTED_CURRENCY_CODES.includes(raw as SupportedCurrencyCode)) {\n    throw Errors.invalidInput(\"currencyCode\", invalidValueReason(\"unsupported currency\", raw));\n  }\n\n  return raw as CurrencyCode;\n}\n\nexport function currencySymbolFor(code: CurrencyCode): string {\n  const symbol = CURRENCY_SYMBOLS[code as SupportedCurrencyCode];\n  if (symbol === undefined) {\n    throw Errors.invalidInput(\"currencyCode\", `no symbol registered for \"${String(code)}\"`);\n  }\n\n  return symbol;\n}\n\nexport function toKycTier(raw: unknown): KycTier {\n  if (typeof raw !== \"number\" || !Number.isInteger(raw) || raw < 0 || raw > 3) {\n    throw Errors.invalidInput(\"kycTier\", invalidValueReason(\"must be an integer in [0, 3]\", raw));\n  }\n\n  return raw as KycTier;\n}\n\nexport function toSafeAddress(raw: unknown): SafeAddress {\n  if (typeof raw !== \"string\" || !EVM_ADDRESS_RE.test(raw)) {\n    throw Errors.invalidInput(\"safeAddress\", invalidValueReason(\"invalid EVM address format\", raw));\n  }\n\n  return raw.toLowerCase() as SafeAddress;\n}\n\nexport function toModuleAddress(raw: unknown): ModuleAddress {\n  if (typeof raw !== \"string\" || !EVM_ADDRESS_RE.test(raw)) {\n    throw Errors.invalidInput(\n      \"moduleAddress\",\n      invalidValueReason(\"invalid EVM address format\", raw),\n    );\n  }\n\n  return raw.toLowerCase() as ModuleAddress;\n}\n\nexport function toRunId(raw: unknown): RunId {\n  if (typeof raw !== \"string\" || !RUN_ID_RE.test(raw)) {\n    throw Errors.invalidInput(\"runId\", \"must match the format run_<uuid>\");\n  }\n\n  return raw as RunId;\n}\n\nexport function toRoleKey(raw: unknown): RoleKey {\n  if (typeof raw !== \"string\" || !BYTES32_RE.test(raw)) {\n    throw Errors.invalidInput(\"roleKey\", invalidValueReason(\"must be 0x + 64 hex chars\", raw));\n  }\n\n  return raw.toLowerCase() as RoleKey;\n}\n\nexport function toAllowanceKey(raw: unknown): AllowanceKey {\n  if (typeof raw !== \"string\" || !BYTES32_RE.test(raw)) {\n    throw Errors.invalidInput(\"allowanceKey\", invalidValueReason(\"must be 0x + 64 hex chars\", raw));\n  }\n\n  return raw.toLowerCase() as AllowanceKey;\n}\n\nexport function toSessionToken(raw: unknown): SessionToken {\n  if (typeof raw !== \"string\" || raw.length === 0) {\n    throw Errors.invalidInput(\"token\", \"must be a non-empty string\");\n  }\n\n  return raw as SessionToken;\n}\n\nexport function toJwtToken(raw: unknown): JwtToken {\n  if (typeof raw !== \"string\" || raw.length === 0) {\n    throw Errors.invalidInput(\"jwtToken\", \"must be a non-empty string\");\n  }\n\n  return raw as JwtToken;\n}\n\nfunction toNonEmptyStringBrand(raw: unknown, field: string): string {\n  if (typeof raw !== \"string\" || raw.length === 0) {\n    throw Errors.invalidInput(field, \"must be a non-empty string\");\n  }\n\n  return raw;\n}\n\nfunction assertSafeNonNegativeInteger(raw: unknown, field: string): asserts raw is number {\n  if (typeof raw !== \"number\" || !Number.isSafeInteger(raw) || raw < 0) {\n    throw Errors.invalidInput(\n      field,\n      invalidValueReason(\"must be a non-negative safe integer\", raw),\n    );\n  }\n}\n\nfunction normalizeAllowedOrigin(raw: string): string | null {\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    return null;\n  }\n\n  if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n    return null;\n  }\n\n  if (parsed.hostname.includes(\"*\")) {\n    return null;\n  }\n\n  return parsed.origin;\n}\n\nfunction invalidValueReason(prefix: string, raw: unknown): string {\n  if (typeof raw === \"string\") {\n    return `${prefix}: ${raw.slice(0, 40)}`;\n  }\n\n  return `${prefix}: ${String(raw)}`;\n}\n","import { Context, Data, Effect } from \"effect\";\nimport type { AuthSession, EpochSeconds, JwtToken } from \"@capxul/types\";\n\n/**\n * AuthCachePort (TA4) — replaces `SessionStoragePort` in the rebuild slice's\n * consumer-facing wiring. Stores the user-snapshot Session AND the cached\n * Convex JWT (W7 bridge endpoint). The two slots are independent so a session\n * refresh doesn't invalidate the JWT and vice versa.\n *\n * Three adapters (TA7):\n *   - `BrowserAuthCacheAdapter`        — backed by `localStorage`\n *   - `FileSystemAuthCacheAdapter`     — mode-0600 JSON file in `~/.config/capxul/`\n *   - `InMemoryAuthCacheAdapter`       — for tests\n *\n * `SessionStoragePort` was retired by the Stage 4 rebuild; session and JWT\n * persistence now share this cache boundary.\n */\nexport interface AuthCachePort {\n  readonly getSession: Effect.Effect<AuthSession | null, AuthCacheError>;\n  readonly setSession: (session: AuthSession) => Effect.Effect<void, AuthCacheError>;\n  readonly clearSession: Effect.Effect<void, AuthCacheError>;\n\n  /**\n   * JWT cache for the `/api/auth/convex/token` bridge endpoint (W7).\n   * Stored separately from the session so a session refresh doesn't\n   * invalidate cached JWT.\n   */\n  readonly getJwt: Effect.Effect<CachedJwt | null, AuthCacheError>;\n  readonly setJwt: (jwt: CachedJwt) => Effect.Effect<void, AuthCacheError>;\n  readonly clearJwt: Effect.Effect<void, AuthCacheError>;\n}\n\n/**\n * Cached Convex JWT shape (TA4). `expEpochSeconds` is decoded from the JWT's\n * `exp` claim at fetch time so the `tokenProvider` cache eviction logic can\n * proactively refresh at `exp - 30s` per TA3.\n */\nexport interface CachedJwt {\n  readonly token: JwtToken;\n  readonly expEpochSeconds: EpochSeconds;\n}\n\nexport class AuthCacheError extends Data.TaggedError(\"AuthCacheError\")<{\n  readonly operation: string;\n  readonly cause: unknown;\n}> {}\n\nexport class AuthCachePortTag extends Context.Service<AuthCachePortTag, AuthCachePort>()(\n  \"@capxul/sdk/ports/AuthCachePort\",\n) {}\n","import {\n  toAuthUserId,\n  toEmail,\n  toEpochMs,\n  toEpochSeconds,\n  toJwtToken,\n  toSessionToken,\n  type AuthSession,\n} from \"@capxul/types\";\n\nimport type { CachedJwt } from \"../../ports/auth-cache\";\n\nexport function parseAuthSession(raw: unknown): AuthSession | null {\n  if (typeof raw !== \"object\" || raw === null) return null;\n  const candidate = raw as {\n    readonly authUserId?: unknown;\n    readonly email?: unknown;\n    readonly token?: unknown;\n    readonly expiresAt?: unknown;\n  };\n\n  try {\n    return {\n      authUserId: toAuthUserId(candidate.authUserId),\n      email: toEmail(candidate.email),\n      token: toSessionToken(candidate.token),\n      expiresAt: toEpochMs(candidate.expiresAt),\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport function parseCachedJwt(raw: unknown): CachedJwt | null {\n  if (typeof raw !== \"object\" || raw === null) return null;\n  const candidate = raw as {\n    readonly token?: unknown;\n    readonly expEpochSeconds?: unknown;\n  };\n\n  try {\n    return {\n      token: toJwtToken(candidate.token),\n      expEpochSeconds: toEpochSeconds(candidate.expEpochSeconds),\n    };\n  } catch {\n    return null;\n  }\n}\n","import { Effect, Layer } from \"effect\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport {\n  AuthCacheError,\n  AuthCachePortTag,\n  type AuthCachePort,\n  type CachedJwt,\n} from \"../../ports/auth-cache\";\nimport { parseAuthSession, parseCachedJwt } from \"./serialization\";\n\nexport interface BrowserStorageShape {\n  getItem(key: string): string | null;\n  setItem(key: string, value: string): void;\n  removeItem(key: string): void;\n}\n\nconst SESSION_KEY = \"capxul.session\";\nconst JWT_KEY = \"capxul.jwt\";\n\nexport class BrowserAuthCacheAdapter implements AuthCachePort {\n  private readonly storage: BrowserStorageShape;\n\n  constructor(storage: BrowserStorageShape) {\n    this.storage = storage;\n  }\n\n  readonly getSession = authCacheTry(\"getSession\", () => {\n    const raw = this.storage.getItem(SESSION_KEY);\n    if (raw === null) return null;\n    try {\n      return parseAuthSession(JSON.parse(raw));\n    } catch {\n      return null;\n    }\n  });\n\n  readonly setSession = (session: AuthSession) =>\n    authCacheTry(\"setSession\", () => {\n      this.storage.setItem(SESSION_KEY, JSON.stringify(session));\n    });\n\n  readonly clearSession = authCacheTry(\"clearSession\", () => {\n    this.storage.removeItem(SESSION_KEY);\n  });\n\n  readonly getJwt = authCacheTry(\"getJwt\", () => {\n    const raw = this.storage.getItem(JWT_KEY);\n    if (raw === null) return null;\n    try {\n      return parseCachedJwt(JSON.parse(raw));\n    } catch {\n      return null;\n    }\n  });\n\n  readonly setJwt = (jwt: CachedJwt) =>\n    authCacheTry(\"setJwt\", () => {\n      this.storage.setItem(JWT_KEY, JSON.stringify(jwt));\n    });\n\n  readonly clearJwt = authCacheTry(\"clearJwt\", () => {\n    this.storage.removeItem(JWT_KEY);\n  });\n}\n\nexport function BrowserAuthCacheLayer(input: {\n  readonly storage: BrowserStorageShape;\n}): Layer.Layer<AuthCachePortTag, AuthCacheError> {\n  return Layer.effect(\n    AuthCachePortTag,\n    Effect.sync(() => new BrowserAuthCacheAdapter(input.storage)).pipe(\n      Effect.mapError((cause) => toAuthCacheError(\"initialize\", cause)),\n    ),\n  );\n}\n\nfunction toAuthCacheError(operation: string, cause: unknown): AuthCacheError {\n  return new AuthCacheError({ operation, cause });\n}\n\nfunction authCacheTry<T>(operation: string, run: () => T): Effect.Effect<T, AuthCacheError> {\n  return Effect.try({\n    try: run,\n    catch: (cause) => toAuthCacheError(operation, cause),\n  });\n}\n","import { Effect, Layer } from \"effect\";\nimport type { AuthSession } from \"@capxul/types\";\n\nimport {\n  AuthCacheError,\n  AuthCachePortTag,\n  type AuthCachePort,\n  type CachedJwt,\n} from \"../../ports/auth-cache\";\n\nexport class InMemoryAuthCacheAdapter implements AuthCachePort {\n  private session: AuthSession | null = null;\n  private jwt: CachedJwt | null = null;\n\n  readonly getSession = Effect.sync(() => this.session);\n\n  readonly setSession = (session: AuthSession) =>\n    Effect.sync(() => {\n      this.session = session;\n    });\n\n  readonly clearSession = Effect.sync(() => {\n    this.session = null;\n  });\n\n  readonly getJwt = Effect.sync(() => this.jwt);\n\n  readonly setJwt = (jwt: CachedJwt) =>\n    Effect.sync(() => {\n      this.jwt = jwt;\n    });\n\n  readonly clearJwt = Effect.sync(() => {\n    this.jwt = null;\n  });\n}\n\nexport const InMemoryAuthCacheLayer = Layer.effect(\n  AuthCachePortTag,\n  Effect.sync(() => new InMemoryAuthCacheAdapter()).pipe(\n    Effect.mapError((cause) => new AuthCacheError({ operation: \"initialize\", cause })),\n  ),\n);\n"],"mappings":";;AAKA,MAAa,qBAAqB;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;;AAYA,MAAa,8BAA4D,IAAI,IAAI;CAC/E;CACA;CAKA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AA4DD,IAAa,cAAb,cAAiC,MAAM;CACrC;CACA;CACA;CACA;CAEA,YAAY,MAAuB,SAAiB,UAA8B,CAAC,GAAG;EACpF,MAAM,SAAS,WAAW,UAAU,EAAE,OAAO,QAAQ,MAAM,IAAI,KAAA,CAAS;EACxE,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,IAAI,QAAQ,YAAY,KAAA,GACtB,KAAK,UAAU,QAAQ;EAEzB,IAAI,QAAQ,kBAAkB,KAAA,GAC5B,KAAK,gBAAgB,QAAQ;EAE/B,IAAI,QAAQ,UAAU,KAAA,GACpB,KAAK,QAAQ,QAAQ;CAEzB;AACF;AAEA,SAAgB,cAAc,OAAsC;CAClE,OAAO,iBAAiB;AAC1B;AAYA,SAAgB,uBAAuB,YAAgD;CACrF,OAAO,IAAI,YACT,WAAW,MACX,WAAW,SACX,oBAAoB;EAClB,SAAS,WAAW;EACpB,eAAe,WAAW;EAC1B,OAAO,WAAW;CACpB,CAAC,CACH;AACF;AAiCA,SAAS,oBAAoB,SAKN;CACrB,MAAM,SAKF,CAAC;CAEL,IAAI,WAAW,SACb,OAAO,QAAQ,QAAQ;CAEzB,IAAI,QAAQ,YAAY,KAAA,GACtB,OAAO,UAAU,QAAQ;CAE3B,IAAI,QAAQ,kBAAkB,KAAA,GAC5B,OAAO,gBAAgB,QAAQ;CAEjC,IAAI,QAAQ,UAAU,KAAA,GACpB,OAAO,QAAQ,QAAQ;CAGzB,OAAO;AACT;AAEA,MAAa,SAAS;CACpB,mBAAmB,SAAkB,SACnC,IAAI,YACF,qBACA,WAAW,qBACX,MAAM,eAAe,EAAE,SAAS,EAAE,cAAc,KAAK,aAAa,EAAE,IAAI,KAAA,CAC1E;CACF,sBAAsB,WACpB,IAAI,YAAY,yBAAyB,wBAAwB,EAC/D,SAAS,EAAE,OAAO,EACpB,CAAC;CAEH,kBAAkB,eAChB,IAAI,YAAY,qBAAqB,8BAA8B,cAAc,EAC/E,SAAS,EAAE,WAAW,EACxB,CAAC;CAEH,sBAAsB,eACpB,IAAI,YAAY,yBAAyB,iCAAiC,EACxE,SAAS,EAAE,WAAW,EACxB,CAAC;CAEH,iBAAiB,aACf,IAAI,YACF,oBACA,WAAW,mBAAmB,SAAS,cAAc,6BACrD,aAAa,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,SAAS,EAAE,CAC/D;CAEF,kBAAkB,cAChB,IAAI,YACF,qBACA,YAAY,oBAAoB,UAAU,cAAc,8BACxD,cAAc,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CACjE;CAEF,gBACE,UACA,WACA,OACA,SACG;EACH,MAAM,UAAmC;GAAE;GAAU;EAAU;EAC/D,IAAI,MAAM,cACR,QAAQ,eAAe,KAAK;EAE9B,OAAO,IAAI,YAAY,kBAAkB,mBAAmB,SAAS,GAAG,aAAa;GACnF;GACA;EACF,CAAC;CACH;CAEA,eAAe,OAAe,WAC5B,IAAI,YAAY,iBAAiB,WAAW,MAAM,IAAI,UAAU,EAC9D,SAAS;EAAE;EAAO;CAAO,EAC3B,CAAC;CAEH,aAAa,SACX,IAAI,YAAY,eAAe,wBAAwB,KAAK,kBAAkB,EAC5E,SAAS,EAAE,KAAK,EAClB,CAAC;CAEH,iBAAiB,QAAgB,WAC/B,IAAI,YACF,mBACA,GAAG,OAAO,GAAG,OAAO,yEACpB,EAAE,SAAS;EAAE;EAAQ;CAAO,EAAE,CAChC;;;;;;;;;CAUF,kBAAkB,UAAkB,WAAmB,cACrD,IAAI,YACF,kBACA,mBAAmB,SAAS,GAAG,UAAU,qBAAqB,UAAU,MACxE;EACE,SAAS;GAAE;GAAU;GAAW,QAAQ;EAAU;EAClD,uBAAO,IAAI,MAAM,YAAY,UAAU,YAAY,UAAU,GAAG;CAClE,CACF;CAEF,uBAAuB,YAAyC;EAM9D,OAAO,IAAI,YAAY,yBAJrB,UAAU,UACN,mCAAmC,QAAQ,KAAK,WAAW,QAAQ,YAAY,KAC/E,qBAAqB,QAAQ,aAAa,gBAES,EACvD,QACF,CAAC;CACH;CAEA,sBAAsB,OAAe,WAAmB,aACtD,IAAI,YAAY,wBAAwB,gBAAgB,MAAM,WAAW,EACvE,SAAS;EAAE;EAAO;EAAW;CAAS,EACxC,CAAC;CAEH,mBAAmB,WACjB,IAAI,YAAY,qBAAqB,sBAAsB,UAAU,EACnE,SAAS,EAAE,OAAO,EACpB,CAAC;;;;;;;;;;;CAYH,uBAAuB,YASrB,IAAI,YACF,0BACA,wCAAwC,QAAQ,OAAO,KACvD,EACE,SACE,QAAQ,cAAc,KAAA,IAClB,EAAE,QAAQ,QAAQ,OAAO,IACzB;EAAE,QAAQ,QAAQ;EAAQ,WAAW,QAAQ;CAAU,EAC/D,CACF;;;;;;;;CASF,oBAAoB,WAAmB,OAAiB,UACtD,IAAI,YAAY,sBAAsB,uBAAuB,aAAa;EACxE;EACA,SAAS,OAAO,WAAW,KAAA,IAAY,EAAE,UAAU,IAAI;GAAE;GAAW,QAAQ,MAAM;EAAO;CAC3F,CAAC;CAEH,cAAc,YACZ,IAAI,YACF,gBACA,uBACA,YAAY,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAChE;CAEF,eAAe,WAAmB,UAChC,IAAI,YAAY,iBAAiB,wBAAwB,aAAa;EACpE;EACA,SAAS,EAAE,UAAU;CACvB,CAAC;CAEH,UAAU,UAAoB,IAAI,YAAY,WAAW,iBAAiB,EAAE,MAAM,CAAC;CAEnF,aAAa,YACX,IAAI,YACF,eACA,qDACA,YAAY,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAChE;CAEF,iBAAiB,YAKf,IAAI,YAAY,mBAAmB,gCAAgC;EACjE,OAAO,QAAQ;EACf,SACE,QAAQ,WAAW,KAAA,IACf,EAAE,QAAQ,QAAQ,OAAO,IACzB;GAAE,QAAQ,QAAQ;GAAQ,QAAQ,QAAQ;EAAO;CACzD,CAAC;CAEH,YAAY,YACV,IAAI,YACF,aACA,4BACA,YAAY,KAAA,IAAY,KAAA,IAAY,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAChE;;;;;;;;;CAUF,aAAa,YAKX,IAAI,YACF,eACA,GAAG,QAAQ,OAAO,sBAAsB,QAAQ,aAAa,mBAAmB,QAAQ,YAAY,KAAK,IAAI,KAC7G,EAAE,SAAS;EAAE,GAAG;EAAS,aAAa,CAAC,GAAG,QAAQ,WAAW;CAAE,EAAE,CACnE;AACJ;;;ACjaA,MAAM,cAA4C,IAAI,IAAI,kBAAkB;AAE5E,SAAS,aAAa,OAA0C;CAC9D,OAAO,OAAO,UAAU,YAAY,YAAY,IAAI,KAAwB;AAC9E;AAEA,SAAS,YAAY,YAAyD;CAC5E,IAAI,CAAC,aAAa,WAAW,IAAI,GAAG,OAAO;CAc3C,OAAO,uBAAuB;EAZ5B,MAAM,WAAW;EACjB,SAAS,OAAO,WAAW,YAAY,WAAW,WAAW,UAAU,OAAO,WAAW,IAAI;EAC7F,GAAI,OAAO,WAAW,YAAY,YAClC,WAAW,YAAY,QACvB,CAAC,MAAM,QAAQ,WAAW,OAAO,IAC7B,EAAE,SAAS,WAAW,QAAmC,IACzD,CAAC;EACL,GAAI,OAAO,WAAW,kBAAkB,WACpC,EAAE,eAAe,WAAW,cAAc,IAC1C,CAAC;EACL,GAAI,OAAO,WAAW,UAAU,WAAW,EAAE,OAAO,WAAW,MAAM,IAAI,CAAC;CAExC,CAAC;AACvC;AAEA,SAAgB,kBAAkB,KAAkC;CAClE,IAAI,QAAQ,QAAQ,QAAQ,KAAA,GAAW,OAAO;CAG9C,IAAI,eAAe,aAAa,OAAO;CAEvC,IAAI,OAAO,QAAQ,UAAU,OAAO;CAKpC,MAAM,SAAS;CACf,IAAI,EAAE,UAAU,SAAS,OAAO;CAChC,MAAM,OAAO,OAAO;CAEpB,IAAI,OAAO,SAAS,YAAY,SAAS,MACvC,OAAO,YAAY,IAA+B;CAOpD,IAAI,OAAO,SAAS,UAClB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,IAAI,OAAO,WAAW,YAAY,WAAW,MAC3C,OAAO,YAAY,MAAiC;CAExD,QAAQ,CAER;CAGF,OAAO;AACT;;;ACqDA,MAAa,iBAAiB;AAC9B,MAAa,aAAa;AAC1B,MAAa,0BAA0B;AACvC,MAAa,uBAAuB;CAClC;EAAE,MAAM;EAAO,QAAQ;EAAK,MAAM;CAAY;CAC9C;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAiB;CACrD;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAgB;CACpD;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAkB;CACtD;EAAE,MAAM;EAAO,QAAQ;EAAO,MAAM;CAAmB;AACzD;AACA,MAAa,2BAA2B,qBAAqB,KAAK,aAAa,SAAS,IAAI;AAE5D,OAAO,YACrC,qBAAqB,KAAK,aAAa,CAAC,SAAS,MAAM,SAAS,MAAM,CAAC,CACzE;AAEA,MAAM,WAAW;AACjB,MAAM,kBAAkB;AAOxB,MAAM,gBAAgB;AACtB,MAAM,mBAAmB;AAIzB,MAAa,YAAY;AAKM,KAAK,MAAM,OAAO,mBAAmB,GAAI;AAExE,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,eAAe,KAAK,GAAG,GACrD,MAAM,OAAO,aAAa,WAAW,mBAAmB,8BAA8B,GAAG,CAAC;CAG5F,OAAO,IAAI,YAAY;AACzB;AAMA,SAAgB,QAAQ,KAAqB;CAC3C,IAAI,OAAO,QAAQ,YAAY,CAAC,SAAS,KAAK,GAAG,GAC/C,MAAM,OAAO,aAAa,SAAS,mBAAmB,mCAAmC,GAAG,CAAC;CAG/F,OAAO,IAAI,YAAY;AACzB;AAMA,SAAgB,aAAa,KAA0B;CACrD,OAAO,sBAAsB,KAAK,YAAY;AAChD;AAiBA,SAAgB,YAAY,KAAyB;CACnD,IAAI,OAAO,QAAQ,YAAY,CAAC,cAAc,KAAK,GAAG,GACpD,MAAM,OAAO,aACX,aACA,mBAAmB,4CAA4C,GAAG,CACpE;CAGF,OAAO;AACT;AAEA,SAAgB,eAAe,KAA4B;CACzD,IAAI,OAAO,QAAQ,YAAY,CAAC,iBAAiB,KAAK,GAAG,GACvD,MAAM,OAAO,aACX,gBACA,mBAAmB,+CAA+C,GAAG,CACvE;CAGF,OAAO;AACT;AAEA,SAAgB,QAAQ,KAAqB;CAC3C,OAAO,sBAAsB,KAAK,OAAO;AAC3C;AAEA,SAAgB,QAAQ,KAAqB;CAC3C,IAAI,OAAO,QAAQ,YAAY,CAAC,UAAU,KAAK,GAAG,GAChD,MAAM,OAAO,aAAa,SAAS,mBAAmB,4BAA4B,GAAG,CAAC;CAGxF,OAAO;AACT;AAEA,SAAgB,gBAAgB,KAA6B;CAC3D,IAAI,OAAO,QAAQ,UACjB,MAAM,OAAO,aAAa,iBAAiB,wCAAwC;CAGrF,MAAM,aAAa,uBAAuB,GAAG;CAC7C,IAAI,eAAe,MACjB,MAAM,OAAO,aACX,iBACA,mBAAmB,mCAAmC,GAAG,CAC3D;CAGF,OAAO;AACT;AAMA,SAAgB,aAAa,KAA0B;CACrD,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,cAAc,GAAG,KAAK,MAAM,GACjE,MAAM,OAAO,aACX,YACA,mBAAmB,uCAAuC,GAAG,CAC/D;CAGF,OAAO;AACT;AAEA,SAAgB,iBAAiB,KAA8B;CAC7D,IAAI,OAAO,QAAQ,YAAY,CAAC,wBAAwB,KAAK,GAAG,GAC9D,MAAM,OAAO,aACX,kBACA,mBAAmB,gEAAgE,GAAG,CACxF;CAGF,OAAO;AACT;AAuBA,SAAgB,UAAU,KAAuB;CAC/C,6BAA6B,KAAK,SAAS;CAC3C,OAAO;AACT;AAEA,SAAgB,eAAe,KAA4B;CACzD,6BAA6B,KAAK,cAAc;CAChD,OAAO;AACT;AAcA,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,cAAc,GAAG,KAAK,OAAO,GAClE,MAAM,OAAO,aACX,WACA,mBAAmB,mCAAmC,GAAG,CAC3D;CAGF,OAAO;AACT;AAuBA,SAAgB,cAAc,KAA2B;CACvD,IAAI,OAAO,QAAQ,UACjB,MAAM,OAAO,aAAa,eAAe,kBAAkB;CAG7D,MAAM,QAAQ,IAAI,YAAY;CAC9B,IAAI,CAAC,gBAAgB,KAAK,KAAK,GAC7B,MAAM,OAAO,aACX,eACA,mBAAmB,8CAA8C,GAAG,CACtE;CAGF,OAAO;AACT;AAEA,SAAgB,eAAe,KAA4B;CACzD,IAAI,OAAO,QAAQ,YAAY,CAAC,yBAAyB,SAAS,GAA4B,GAC5F,MAAM,OAAO,aAAa,gBAAgB,mBAAmB,wBAAwB,GAAG,CAAC;CAG3F,OAAO;AACT;AAWA,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,KAAK,MAAM,GACxE,MAAM,OAAO,aAAa,WAAW,mBAAmB,gCAAgC,GAAG,CAAC;CAG9F,OAAO;AACT;AA6BA,SAAgB,UAAU,KAAuB;CAC/C,IAAI,OAAO,QAAQ,YAAY,CAAC,WAAW,KAAK,GAAG,GACjD,MAAM,OAAO,aAAa,WAAW,mBAAmB,6BAA6B,GAAG,CAAC;CAG3F,OAAO,IAAI,YAAY;AACzB;AAUA,SAAgB,eAAe,KAA4B;CACzD,IAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAC5C,MAAM,OAAO,aAAa,SAAS,4BAA4B;CAGjE,OAAO;AACT;AAEA,SAAgB,WAAW,KAAwB;CACjD,IAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAC5C,MAAM,OAAO,aAAa,YAAY,4BAA4B;CAGpE,OAAO;AACT;AAEA,SAAS,sBAAsB,KAAc,OAAuB;CAClE,IAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAC5C,MAAM,OAAO,aAAa,OAAO,4BAA4B;CAG/D,OAAO;AACT;AAEA,SAAS,6BAA6B,KAAc,OAAsC;CACxF,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,cAAc,GAAG,KAAK,MAAM,GACjE,MAAM,OAAO,aACX,OACA,mBAAmB,uCAAuC,GAAG,CAC/D;AAEJ;AAEA,SAAS,uBAAuB,KAA4B;CAC1D,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,OAAO;CACT;CAEA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UACrD,OAAO;CAGT,IAAI,OAAO,SAAS,SAAS,GAAG,GAC9B,OAAO;CAGT,OAAO,OAAO;AAChB;AAEA,SAAS,mBAAmB,QAAgB,KAAsB;CAChE,IAAI,OAAO,QAAQ,UACjB,OAAO,GAAG,OAAO,IAAI,IAAI,MAAM,GAAG,EAAE;CAGtC,OAAO,GAAG,OAAO,IAAI,OAAO,GAAG;AACjC;;;ACpdA,IAAa,iBAAb,cAAoC,KAAK,YAAY,gBAAgB,EAGlE,CAAC;AAEJ,IAAa,mBAAb,cAAsC,QAAQ,QAAyC,EACrF,iCACF,EAAE,CAAC;;;ACrCH,SAAgB,iBAAiB,KAAkC;CACjE,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;CACpD,MAAM,YAAY;CAOlB,IAAI;EACF,OAAO;GACL,YAAY,aAAa,UAAU,UAAU;GAC7C,OAAO,QAAQ,UAAU,KAAK;GAC9B,OAAO,eAAe,UAAU,KAAK;GACrC,WAAW,UAAU,UAAU,SAAS;EAC1C;CACF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAgB,eAAe,KAAgC;CAC7D,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;CACpD,MAAM,YAAY;CAKlB,IAAI;EACF,OAAO;GACL,OAAO,WAAW,UAAU,KAAK;GACjC,iBAAiB,eAAe,UAAU,eAAe;EAC3D;CACF,QAAQ;EACN,OAAO;CACT;AACF;;;AC/BA,MAAM,cAAc;AACpB,MAAM,UAAU;AAEhB,IAAa,0BAAb,MAA8D;CAC5D;CAEA,YAAY,SAA8B;EACxC,KAAK,UAAU;CACjB;CAEA,aAAsB,aAAa,oBAAoB;EACrD,MAAM,MAAM,KAAK,QAAQ,QAAQ,WAAW;EAC5C,IAAI,QAAQ,MAAM,OAAO;EACzB,IAAI;GACF,OAAO,iBAAiB,KAAK,MAAM,GAAG,CAAC;EACzC,QAAQ;GACN,OAAO;EACT;CACF,CAAC;CAED,cAAuB,YACrB,aAAa,oBAAoB;EAC/B,KAAK,QAAQ,QAAQ,aAAa,KAAK,UAAU,OAAO,CAAC;CAC3D,CAAC;CAEH,eAAwB,aAAa,sBAAsB;EACzD,KAAK,QAAQ,WAAW,WAAW;CACrC,CAAC;CAED,SAAkB,aAAa,gBAAgB;EAC7C,MAAM,MAAM,KAAK,QAAQ,QAAQ,OAAO;EACxC,IAAI,QAAQ,MAAM,OAAO;EACzB,IAAI;GACF,OAAO,eAAe,KAAK,MAAM,GAAG,CAAC;EACvC,QAAQ;GACN,OAAO;EACT;CACF,CAAC;CAED,UAAmB,QACjB,aAAa,gBAAgB;EAC3B,KAAK,QAAQ,QAAQ,SAAS,KAAK,UAAU,GAAG,CAAC;CACnD,CAAC;CAEH,WAAoB,aAAa,kBAAkB;EACjD,KAAK,QAAQ,WAAW,OAAO;CACjC,CAAC;AACH;AAaA,SAAS,iBAAiB,WAAmB,OAAgC;CAC3E,OAAO,IAAI,eAAe;EAAE;EAAW;CAAM,CAAC;AAChD;AAEA,SAAS,aAAgB,WAAmB,KAAgD;CAC1F,OAAO,OAAO,IAAI;EAChB,KAAK;EACL,QAAQ,UAAU,iBAAiB,WAAW,KAAK;CACrD,CAAC;AACH;;;AC5EA,IAAa,2BAAb,MAA+D;CAC7D,UAAsC;CACtC,MAAgC;CAEhC,aAAsB,OAAO,WAAW,KAAK,OAAO;CAEpD,cAAuB,YACrB,OAAO,WAAW;EAChB,KAAK,UAAU;CACjB,CAAC;CAEH,eAAwB,OAAO,WAAW;EACxC,KAAK,UAAU;CACjB,CAAC;CAED,SAAkB,OAAO,WAAW,KAAK,GAAG;CAE5C,UAAmB,QACjB,OAAO,WAAW;EAChB,KAAK,MAAM;CACb,CAAC;CAEH,WAAoB,OAAO,WAAW;EACpC,KAAK,MAAM;CACb,CAAC;AACH;AAEsC,MAAM,OAC1C,kBACA,OAAO,WAAW,IAAI,yBAAyB,CAAC,EAAE,KAChD,OAAO,UAAU,UAAU,IAAI,eAAe;CAAE,WAAW;CAAc;AAAM,CAAC,CAAC,CACnF,CACF"}