@capxul/sdk 4.20.0-beta.3 → 4.20.0-beta.30

package/dist/production-CJwxgI8u.d.mts

@@ -1,3141 +0,0 @@
-import { $ as PayrollGroupId, A as AllowanceKey, B as ChainId, C as AuthCachePort, D as Account$1, Et as FailureMode, F as AssetId, H as CurrencyCode, I as AuthSession, K as Email, L as AuthUserId, M as AnonymousDistinctId, N as AppId, Q as PaymentCommandId, R as BlockNumber, U as DocumentHash, V as CountryCode, W as DurationMs, X as OrgId, Y as Money, Z as PartyId, _ as Session$1, _t as CapxulErrorCode, at as RoleKey, b as AuthClientPort, bt as Failure, ct as TesterKind, d as AccountRequirement, et as PayrollRunId, g as Profile$1, gt as CapxulError, h as CapxulResult, i as CapxulSigner, it as PublishableKey, j as AllowedOrigin, k as Address$1, lt as TxHash, nt as PermissionId, ot as SessionToken, q as EpochMs, rt as Profile, s as SignerStatusStore, st as SmartAccount, tt as PermissionAssignmentId, u as AccountProviderSource, ut as WeiAmount, v as SmartAccount$1, vt as CapxulErrorDetails, x as CanSendOtpStatus, y as ClockPort, z as BudgetId } from "./OAuthBearerAuthClient-C-ip-z8M.mjs";
-import { Hex } from "viem";
-import { Context, Duration, Effect, Layer, Logger, Metric, References, Schema, Scope, Tracer } from "effect";
-import { FunctionReference } from "convex/server";
-import { HttpClient, HttpClientError } from "effect/unstable/http";
-import { OtlpExporter, OtlpSerialization } from "effect/unstable/observability";
-//#region src/domain/machine/shell.d.ts
-declare const INVOCATION_PARENT_SPAN: unique symbol;
-interface InvocationControls {
-  readonly signal?: AbortSignal;
-  readonly timeoutMs?: number;
-  readonly deadlineMs?: number;
-  readonly correlation_id?: string;
-  readonly journey_id?: string;
-  /** @internal Opaque in-process trace parent; symbols never enter wire or P3 records. */
-  readonly [INVOCATION_PARENT_SPAN]?: Tracer.AnySpan;
-}
-type RecordBase = {
-  readonly machine: string;
-  readonly event: string;
-  readonly slot: string;
-  readonly epoch: number;
-  readonly duration_ms: number;
-  readonly correlation_id?: string;
-  readonly journey_id?: string;
-};
-type IdentityTransition = (RecordBase & {
-  readonly outcome: "applied";
-  readonly from: string;
-  readonly to: string;
-  readonly refusal_code?: never;
-  readonly error_code?: never;
-}) | (RecordBase & {
-  readonly outcome: "refused";
-  readonly state: string;
-  readonly refusal_code: CapxulErrorCode;
-  readonly error_code?: never;
-}) | (RecordBase & {
-  readonly outcome: "failed" | "cancelled";
-  readonly state: string;
-  readonly error_code: CapxulErrorCode;
-  readonly refusal_code?: never;
-  /** The typed failure behind `error_code`, with its `CapxulError` when the port gave one. */
-  readonly failure?: Failure;
-});
-declare class ActorFailure<Reason extends CapxulErrorCode> extends Error {
-  readonly reason: Reason;
-  readonly machine: string;
-  readonly state: string;
-  readonly event: string;
-  readonly details?: Readonly<Record<string, unknown>> | undefined;
-  readonly _tag = "ActorFailure";
-  constructor(reason: Reason, machine: string, state: string, event: string, details?: Readonly<Record<string, unknown>> | undefined, cause?: unknown);
-}
-interface Actor<S, Pub, Reason extends CapxulErrorCode> {
-  readonly ask: (event: Pub, controls?: InvocationControls) => Effect.Effect<S, ActorFailure<Reason | CapxulErrorCode>>;
-  readonly tell: (event: Pub, controls?: InvocationControls) => Effect.Effect<void, ActorFailure<Reason | CapxulErrorCode>>;
-  readonly snapshot: () => S;
-  readonly subscribe: (observer: (state: S) => void) => () => void;
-  readonly subscribeTransitions: (observer: (record: IdentityTransition) => void) => () => void;
-}
-//#endregion
-//#region src/domain/identity/model.d.ts
-type RefusalReason = "WRONG_STATE" | "INVALID_INPUT" | "OTP_EXPIRED" | "SIGNER_REJECTED";
-interface Session {
-  readonly email: string;
-  readonly authUserId: string;
-}
-/** The initial account state is counterfactual
- * and signerless; `deploy` is the separate claim step that needs a signer. */
-type AccountStep = "wallet" | "identity" | "provision" | "deploy";
-/** org-lifecycle.ts:7-11, verbatim. */
-type OrgStep = "preparingFounderAccount" | "awaitingFounderAuthorization" | "submittingBootstrap" | "confirmingBootstrap";
-interface OrgDraft {
-  readonly name: string;
-  readonly handle: string;
-  readonly country: string;
-}
-/** Full one-shot coordinator input. Only {@link OrgDraft} is retained in IdentityState. */
-interface OrgSubmissionDraft extends OrgDraft {
-  readonly bio?: string;
-  readonly size?: string;
-  /**
-   * #1955: the logo uploaded on file pick. The org lane spreads this draft
-   * straight into `startOrResume`, which records it on the `orgs` insert.
-   */
-  readonly logoStorageId?: string;
-}
-/** The org lane, keyed by the active orgId — which does not exist yet while the
- * FIRST DURABLE ORG WRITE is in flight, hence `creating` carrying only a draft. */
-type OrgLane = {
-  readonly at: "creating";
-  readonly draft: OrgDraft;
-} | {
-  readonly at: "loading";
-  readonly orgId: string;
-} | {
-  readonly at: "settingUp";
-  readonly orgId: string;
-  readonly step: OrgStep;
-} | {
-  readonly at: "ready";
-  readonly orgId: string;
-} | {
-  readonly at: "failed";
-  readonly orgId: string | null;
-  readonly step: OrgStep;
-  readonly failure: Failure;
-  readonly retryable: boolean;
-};
-/**
- * Personal-account readiness — the ONLY pre-org readiness truth (#1049 #1051).
- * `claimed` is the single variant with an `org` field: the map's ordering
- * `Account deployed+claimed → first durable Organization write` is expressed by
- * the absence of that field everywhere else, not by a guard someone can forget.
- */
-type Readiness = {
-  readonly at: "unknown";
-} | {
-  readonly at: "deriving";
-  readonly step: AccountStep;
-} | {
-  readonly at: "counterfactual";
-  readonly address: string;
-} | {
-  readonly at: "claiming";
-  readonly address: string;
-} | {
-  readonly at: "claimed";
-  readonly address: string;
-  readonly org: OrgLane | null;
-} | {
-  readonly at: "failed";
-  readonly step: AccountStep;
-  readonly failure: Failure;
-  readonly retryable: boolean;
-};
-type IdentityState =
-/** The INITIAL state: a session probe is in flight and the machine knows
- * nothing yet. Distinct from `signed_out`, which is a settled answer. Without
- * it every consumer read the restore window as a real sign-out. */
-{
-  readonly phase: "restoring";
-} | {
-  readonly phase: "signed_out";
-} | {
-  readonly phase: "otp_sending";
-  readonly email: string;
-} | {
-  readonly phase: "otp_pending";
-  readonly email: string;
-  readonly requestedAt: number;
-} | {
-  readonly phase: "otp_verifying";
-  readonly email: string;
-  readonly requestedAt: number;
-} | {
-  readonly phase: "authenticated";
-  readonly session: Session;
-  readonly profileComplete: boolean;
-  readonly account: Readiness;
-} | {
-  readonly phase: "signing_out";
-  readonly session: Session | null;
-} | {
-  readonly phase: "faulted";
-  readonly failure: Failure;
-  /** Non-null exactly when an OTP entry is resumable — the incumbent's
-   * `email !== null && otpRequestedAt !== null` pair,
-   * made structural. */
-  readonly resume: {
-    readonly email: string;
-    readonly requestedAt: number;
-  } | null;
-};
-declare const STATE_LABELS: readonly ["restoring", "signed_out", "otp_sending", "otp_pending", "otp_verifying", "authenticated:unknown", "authenticated:deriving", "authenticated:counterfactual", "authenticated:claiming", "authenticated:failed", "authenticated:claimed", "authenticated:claimed:creating", "authenticated:claimed:loading", "authenticated:claimed:settingUp", "authenticated:claimed:ready", "authenticated:claimed:failed", "signing_out", "faulted"];
-type StateLabel = (typeof STATE_LABELS)[number];
-type IdentityEvent = {
-  readonly _tag: "RequestOtp";
-  readonly email: string;
-} | {
-  readonly _tag: "VerifyOtp";
-  readonly email: string;
-  readonly otp: string;
-  readonly now: number;
-} | {
-  readonly _tag: "ReadSession";
-} | {
-  readonly _tag: "SignOut";
-} | {
-  readonly _tag: "RestoreSession";
-  readonly session: Session;
-  readonly profileComplete: boolean;
-} | {
-  readonly _tag: "ResumeOtpEntry";
-  readonly now: number;
-} | {
-  readonly _tag: "Reset";
-} | {
-  readonly _tag: "SessionRestored";
-  readonly session: Session;
-  readonly profileComplete: boolean;
-} | {
-  readonly _tag: "SessionAbsent";
-} | {
-  readonly _tag: "EnsureAccount";
-} | {
-  readonly _tag: "ClaimAccount";
-} | {
-  readonly _tag: "RetryAccount";
-} | {
-  readonly _tag: "CreateOrganization";
-  readonly draft: OrgSubmissionDraft;
-} | {
-  readonly _tag: "AttachOrganization";
-  readonly orgId: string;
-} | {
-  readonly _tag: "RetryOrganization";
-} | {
-  readonly _tag: "LeaveOrganization";
-};
-type Destination$1 = {
-  readonly to: "home";
-} | {
-  readonly to: "selectUserType";
-} | {
-  readonly to: "provisioning";
-  readonly scope: "personal";
-} | {
-  readonly to: "provisioning";
-  readonly scope: "organization";
-  readonly orgId: string | null;
-} | {
-  readonly to: "dashboardPersonal";
-} | {
-  readonly to: "dashboardOrganization";
-  readonly orgId: string;
-};
-/**
- * The post-auth destination and provisioning lane merge as one total switch
- * over the nest. "An active journey outranks default
- * routing; org-list contents never choose a destination" holds by construction:
- * there is no org list in the state, only the ONE active lane.
- */
-declare const destination: (state: IdentityState) => Destination$1 | null;
-/**
- * True while the machine has not settled enough to route or to gate on.
- *
- * NEGATIVE classification, deliberately: the SETTLED positions are the ones
- * enumerated, and everything else waits. A phase or readiness variant added
- * later therefore defaults to holding, never to redirecting a member who is in
- * fact signed in. Terminal for the account lane is `claimed | failed`.
- *
- * The org lane's own settledness (`ready | failed`) is the route gate's
- * question, not this one: every org lane sits under a CLAIMED account, and
- * `destination()` already names a real screen for each of its positions.
- */
-declare const isRestoring: (state: IdentityState) => boolean;
-/** The claimed-account gate as one function. The inlined consumers move onto
- * it in #1521; this ticket ships the selector they move onto. */
-declare const isClaimed: (state: IdentityState) => boolean;
-//#endregion
-//#region ../observability/src/telemetry-port.d.ts
-/**
- * Context for reporting handled errors via `reportHandledError`.
- * Carries structured metadata extracted from the error context.
- */
-interface HandledErrorReportContext {
-  readonly layer?: string;
-  /** Host input is normalized at the reporting boundary. */
-  readonly operation?: string;
-  readonly failure_mode?: FailureMode;
-  readonly provider?: string;
-}
-/**
- * Canonical TelemetryPort interface. Every adapter (production, test, in-memory)
- * implements this contract. All methods return `Effect<void, never>` —
- * fire-and-forget, defects are caught and traced.
- */
-interface TelemetryPort {
-  readonly emit: (event: TelemetryEvent) => Effect.Effect<void, never>;
-  readonly identify: (input: TelemetryIdentifyInput) => Effect.Effect<void, never>;
-  readonly group: (input: TelemetryGroupInput) => Effect.Effect<void, never>;
-  readonly reset: () => Effect.Effect<void, never>;
-  readonly reportHandledError?: (error: CapxulError, context?: HandledErrorReportContext) => Effect.Effect<void, never>;
-}
-//#endregion
-//#region ../observability/src/index.d.ts
-declare const TELEMETRY_EVENT_NAMES: readonly ["auth_otp_requested", "auth_otp_delivered", "auth_otp_expired", "auth_verified", "auth_failed", "identity_refused", "auth_signed_out", "onboarding_intent_selected", "onboarding_profile_submitted", "onboarding_organization_submitted", "onboarding_dashboard_reached", "provisioning_safe_created", "provisioning_safe_confirmed", "bootstrap_resolved", "bootstrap_failed", "member_activation_started", "member_activation_ready", "member_activation_failed", "organization_creation_started", "organization_creation_ready", "organization_creation_failed", "chain_upstream_fallback", "bundler_error", "receipt_pending", "operation_retried", "account_balance_read", "account_balance_failed", "faucet_requested", "faucet_confirmed", "faucet_failed", "org_create_started", "org_safe_created", "org_safe_confirmed", "org_roles_seeded", "org_created", "org_create_failed", "org_invite_sent", "org_invite_accepted", "org_invite_expired", "payment_initiated", "payment_settled", "payment_failed", "payment_verification_retry", "payment_lifecycle_transition", "quick_pay_external_address_acknowledged", "deposit_initiated", "deposit_settled", "permission_mirror_verification", "movement_scan_window", "movement_scan_checkpoint", "movement_scan_incident", "indexer_drift_corrected", "activity_annotation_saved", "ui_activity_action_completed", "contact_relationship_changed", "ui_contact_action_completed", "access_recovery_completed", "ui_access_step_completed", "org_invite_progressed", "invoice_issued", "invoice_request_transitioned", "ui_invoice_step_completed", "ui_treasury_step_completed", "ui_receive_step_completed", "payroll_group_changed", "payroll_run_transitioned", "ui_payroll_action_completed", "cli_diagnostic_completed", "cli_first_used", "cli_command_started", "cli_command_completed"];
-type TelemetryEventName = (typeof TELEMETRY_EVENT_NAMES)[number];
-type TelemetryProps = Record<string, unknown>;
-type TelemetryEvent = {
-  readonly name: TelemetryEventName;
-  readonly props?: TelemetryProps | undefined;
-};
-/**
- * Environment discriminator (ADR-0020 A1 amendment, 2026-08-07). PostHog
- * project 368736 is the SINGLE sink for every environment, so `capxul_env` —
- * not project isolation — is what keeps a production surface from reading dev
- * traffic. It is REQUIRED on every catalog event and every synced artifact
- * filters on it.
- *
- * `unknown` is a defect marker, not an environment: it means a producer
- * reached the transport without declaring where it runs. It is in the union so
- * the property is never ABSENT (an absent property is invisible to a filter,
- * a present `unknown` is loud), and sync v2 never synthesizes an artifact for
- * it.
- */
-declare const CAPXUL_ENVS: readonly ["development", "staging", "production", "unknown", "local"];
-type CapxulEnv = (typeof CAPXUL_ENVS)[number];
-interface TelemetryIdentifyInput {
-  readonly distinctId: string;
-  readonly anonDistinctId?: AnonymousDistinctId;
-  readonly traits?: TelemetryProps;
-  readonly properties?: TelemetryProps;
-}
-interface TelemetryGroupInput {
-  readonly groupType: string;
-  readonly groupKey: string;
-  readonly properties?: TelemetryProps;
-}
-//#endregion
-//#region ../wire/src/bootstrap.d.ts
-declare const EngineeringTelemetryBootstrapPolicy: Schema.Struct<{
-  readonly host: Schema.refine<string, Schema.String>;
-  readonly projectToken: Schema.refine<string, Schema.String>;
-  readonly capxulEnv: Schema.Union<readonly [Schema.Literal<"development">, Schema.Literal<"staging">, Schema.Literal<"production">, Schema.Literal<"local">]>;
-}>;
-type EngineeringTelemetryBootstrapPolicyV1 = Schema.Schema.Type<typeof EngineeringTelemetryBootstrapPolicy>;
-//#endregion
-//#region ../wire/src/status.d.ts
-/** The closed Payment status authority. */
-declare const PAYMENT_STATUSES: readonly ["pending", "settling", "unresolved", "scheduled", "streaming", "pending_claim", "settled", "cancelled", "failed"];
-type PaymentStatus$1 = (typeof PAYMENT_STATUSES)[number];
-declare const PAYMENT_EXECUTION_STATUSES: readonly ["pending", "included", "dropped", "replaced", "expired", "unresolved", "superseded", "failed", "settled"];
-type PaymentExecutionStatus = (typeof PAYMENT_EXECUTION_STATUSES)[number];
-/** Read-time execution meaning; it does not change the Payment's durable outcome. */
-interface PaymentExecutionView {
-  readonly status: PaymentExecutionStatus;
-  readonly retryRequired: boolean;
-  /** Present only when complete durable execution history supports no broadcast. */
-  readonly notSent?: true;
-}
-/** The payment direction relative to the current actor. */
-declare const PAYMENT_DIRECTIONS: readonly ["in", "out", "self"];
-type PaymentDirection$1 = (typeof PAYMENT_DIRECTIONS)[number];
-/** What a payment is FOR. Pairs with `PAYMENT_DOCUMENT_KINDS`. */
-declare const PAYMENT_TYPES: readonly ["unspecified", "invoice", "payroll", "reimbursement"];
-type PaymentType$1 = (typeof PAYMENT_TYPES)[number];
-/** Attachable document kinds; each maps to exactly one `PaymentType`. */
-declare const PAYMENT_DOCUMENT_KINDS: readonly ["memo", "invoice", "payslip", "receipt", "withdrawal"];
-type PaymentDocumentKind$1 = (typeof PAYMENT_DOCUMENT_KINDS)[number];
-/** Lifecycle of a payment REQUEST as its issuer sees it. */
-declare const REQUEST_STATUSES: readonly ["draft", "sent", "viewed", "pending_settlement", "paid", "declined", "cancelled", "expired"];
-type RequestStatus = (typeof REQUEST_STATUSES)[number];
-/** The same request as its RECIPIENT sees it, in the approval inbox. */
-declare const INBOX_STATUSES: readonly ["open", "approved", "declined", "paid", "cancelled", "expired"];
-type InboxStatus = (typeof INBOX_STATUSES)[number];
-//#endregion
-//#region ../wire/src/financial-ops.d.ts
-declare const AttachablePaymentDocumentEnvelope: Schema.Union<readonly [Schema.Struct<{
-  readonly protocol: Schema.Literal<"capxul.payment-document">;
-  readonly version: Schema.Literal<1>;
-  readonly domain: Schema.Struct<{
-    readonly name: Schema.Literal<"CapxulPayments">;
-    readonly version: Schema.Literal<"1">;
-    readonly chainId: Schema.Codec<ChainId, number, never, never>;
-    readonly verifyingContract: Schema.Literal<"0x7a5c25aB7ce91d7a475B71cd1ec33E230291f8a4">;
-  }>;
-  readonly primaryType: Schema.Literal<"Memo">;
-  readonly message: Schema.Struct<{
-    readonly kind: Schema.Literal<0>;
-    readonly reference: Schema.String;
-    readonly note: Schema.String;
-    readonly issuedAt: Schema.Number;
-  }>;
-}>, Schema.Struct<{
-  readonly protocol: Schema.Literal<"capxul.payment-document">;
-  readonly version: Schema.Literal<1>;
-  readonly domain: Schema.Struct<{
-    readonly name: Schema.Literal<"CapxulPayments">;
-    readonly version: Schema.Literal<"1">;
-    readonly chainId: Schema.Codec<ChainId, number, never, never>;
-    readonly verifyingContract: Schema.Literal<"0x7a5c25aB7ce91d7a475B71cd1ec33E230291f8a4">;
-  }>;
-  readonly primaryType: Schema.Literal<"Invoice">;
-  readonly message: Schema.Struct<{
-    readonly kind: Schema.Literal<1>;
-    readonly invoiceNumber: Schema.String;
-    readonly payerRef: Schema.String;
-    readonly payeeRef: Schema.String;
-    readonly amount: Schema.String;
-    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
-    readonly decimals: Schema.Number;
-    readonly issuedAt: Schema.Number;
-    readonly dueAt: Schema.Number;
-    readonly lineItemsHash: Schema.Codec<DocumentHash, string, never, never>;
-  }>;
-}>, Schema.Struct<{
-  readonly protocol: Schema.Literal<"capxul.payment-document">;
-  readonly version: Schema.Literal<1>;
-  readonly domain: Schema.Struct<{
-    readonly name: Schema.Literal<"CapxulPayments">;
-    readonly version: Schema.Literal<"1">;
-    readonly chainId: Schema.Codec<ChainId, number, never, never>;
-    readonly verifyingContract: Schema.Literal<"0x7a5c25aB7ce91d7a475B71cd1ec33E230291f8a4">;
-  }>;
-  readonly primaryType: Schema.Literal<"Payslip">;
-  readonly message: Schema.Struct<{
-    readonly kind: Schema.Literal<2>;
-    readonly employerRef: Schema.String;
-    readonly employeeRef: Schema.String;
-    readonly period: Schema.String;
-    readonly gross: Schema.String;
-    readonly net: Schema.String;
-    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
-    readonly decimals: Schema.Number;
-    readonly issuedAt: Schema.Number;
-  }>;
-}>, Schema.Struct<{
-  readonly protocol: Schema.Literal<"capxul.payment-document">;
-  readonly version: Schema.Literal<1>;
-  readonly domain: Schema.Struct<{
-    readonly name: Schema.Literal<"CapxulPayments">;
-    readonly version: Schema.Literal<"1">;
-    readonly chainId: Schema.Codec<ChainId, number, never, never>;
-    readonly verifyingContract: Schema.Literal<"0x7a5c25aB7ce91d7a475B71cd1ec33E230291f8a4">;
-  }>;
-  readonly primaryType: Schema.Literal<"Receipt">;
-  readonly message: Schema.Struct<{
-    readonly kind: Schema.Literal<3>;
-    readonly reference: Schema.String;
-    readonly amount: Schema.String;
-    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
-    readonly decimals: Schema.Number;
-    readonly paidAt: Schema.Number;
-    readonly note: Schema.String;
-  }>;
-}>]>;
-/**
- * #592 invoice line item. `quantity` is a positive integer; `unitMinor` is the
- * per-unit price in integer minor units. The list is canonically hashed by
- * `hashLineItems` (payment-document-hash.ts) into the Invoice `lineItemsHash`,
- * and Σ(quantity × unitMinor) MUST equal the invoice `amount`. The hash binds
- * the documentHash to the exact items; the sum-check makes the items add up to
- * the amount due. See the financial-operations contract in `packages/wire/CONTEXT.md`.
- */
-declare const LineItem: Schema.Struct<{
-  readonly description: Schema.String;
-  readonly quantity: Schema.Number;
-  readonly unitMinor: Schema.String;
-}>;
-type AttachablePaymentDocumentEnvelopeV1 = Schema.Schema.Type<typeof AttachablePaymentDocumentEnvelope>;
-type LineItemV1 = Schema.Schema.Type<typeof LineItem>;
-//#endregion
-//#region ../wire/src/money.d.ts
-declare const ActorRefSchema: Schema.Union<readonly [Schema.Struct<{
-  readonly kind: Schema.Literal<"account">;
-  readonly accountId: Schema.refine<string, Schema.String>;
-}>, Schema.Struct<{
-  readonly kind: Schema.Literal<"organization">;
-  readonly orgId: Schema.refine<string, Schema.String>;
-}>]>;
-type ActorRef = Schema.Schema.Type<typeof ActorRefSchema>;
-declare const PermissionSchema: Schema.Struct<{
-  readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
-  readonly orgId: Schema.refine<string, Schema.String>;
-  readonly type: Schema.Literals<readonly ["budget", "managePeople"]>;
-  readonly state: Schema.Literals<readonly ["pending", "active", "suspended", "revoked", "superseded"]>;
-  readonly revision: Schema.refine<number, Schema.Number>;
-  readonly roleKey: Schema.Codec<RoleKey, string, never, never>;
-  readonly tokenAddress: Schema.optional<Schema.Codec<Address$1, string, never, never>>;
-  readonly limitRaw: Schema.optional<Schema.Codec<WeiAmount, string, never, never>>;
-  readonly allowanceKey: Schema.optional<Schema.Codec<AllowanceKey, string, never, never>>;
-}>;
-type Permission = Schema.Schema.Type<typeof PermissionSchema>;
-declare const PermissionAssignmentSchema: Schema.Struct<{
-  readonly permissionAssignmentId: Schema.Codec<PermissionAssignmentId, string, never, never>;
-  readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
-  readonly actor: Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"account">;
-    readonly accountId: Schema.refine<string, Schema.String>;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"organization">;
-    readonly orgId: Schema.refine<string, Schema.String>;
-  }>]>;
-  readonly state: Schema.Literals<readonly ["pending", "active", "suspended", "revoked", "superseded"]>;
-}>;
-type PermissionAssignment = Schema.Schema.Type<typeof PermissionAssignmentSchema>;
-declare const CurrentHoldingsSchema: Schema.Struct<{
-  readonly actor: Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"account">;
-    readonly accountId: Schema.refine<string, Schema.String>;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"organization">;
-    readonly orgId: Schema.refine<string, Schema.String>;
-  }>]>;
-  readonly chainId: Schema.Codec<ChainId, number, never, never>;
-  readonly observedAt: Schema.refine<number, Schema.Number>;
-  readonly stale: Schema.Boolean;
-  readonly rows: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
-    readonly assetKind: Schema.Literal<"native">;
-    readonly symbol: Schema.optional<Schema.String>;
-    readonly decimals: Schema.optional<Schema.refine<number, Schema.Number>>;
-    readonly rawBalance: Schema.Codec<WeiAmount, string, never, never>;
-  }>, Schema.Struct<{
-    readonly assetKind: Schema.Literal<"erc20">;
-    readonly tokenAddress: Schema.Codec<Address$1, string, never, never>;
-    readonly symbol: Schema.optional<Schema.String>;
-    readonly decimals: Schema.optional<Schema.refine<number, Schema.Number>>;
-    readonly rawBalance: Schema.Codec<WeiAmount, string, never, never>;
-  }>]>>;
-}>;
-type CurrentHoldings = Schema.Schema.Type<typeof CurrentHoldingsSchema>;
-declare const PaymentCommandLineageSchema: Schema.Union<readonly [Schema.Struct<{
-  readonly kind: Schema.Literal<"payroll">;
-  readonly runId: Schema.refine<string, Schema.String>;
-}>, Schema.Struct<{
-  readonly kind: Schema.Literal<"payment_request">;
-  readonly requestId: Schema.refine<string, Schema.String>;
-}>]>;
-type PaymentCommandLineage = Schema.Schema.Type<typeof PaymentCommandLineageSchema>;
-declare const PermissionIntentSchema: Schema.Union<readonly [Schema.Struct<{
-  readonly type: Schema.Literal<"budget">;
-  readonly limit: Schema.Struct<{
-    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
-    readonly value: Schema.String;
-    readonly decimals: Schema.Number;
-  }>;
-}>, Schema.Struct<{
-  readonly type: Schema.Literal<"managePeople">;
-}>]>;
-type PermissionIntent = Schema.Schema.Type<typeof PermissionIntentSchema>;
-declare const SubmittedPermissionExecutionSchema: Schema.Struct<{
-  readonly status: Schema.Literal<"submitted">;
-  readonly executionId: Schema.refine<string, Schema.String>;
-  readonly commandId: Schema.Codec<PaymentCommandId, string, never, never>;
-  readonly userOpHash: Schema.Codec<string, string, never, never>;
-  readonly value: Schema.Union<readonly [Schema.Struct<{
-    readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
-    readonly orgId: Schema.refine<string, Schema.String>;
-    readonly type: Schema.Literals<readonly ["budget", "managePeople"]>;
-    readonly state: Schema.Literals<readonly ["pending", "active", "suspended", "revoked", "superseded"]>;
-    readonly revision: Schema.refine<number, Schema.Number>;
-    readonly roleKey: Schema.Codec<RoleKey, string, never, never>;
-    readonly tokenAddress: Schema.optional<Schema.Codec<Address$1, string, never, never>>;
-    readonly limitRaw: Schema.optional<Schema.Codec<WeiAmount, string, never, never>>;
-    readonly allowanceKey: Schema.optional<Schema.Codec<AllowanceKey, string, never, never>>;
-  }>, Schema.Struct<{
-    readonly permissionAssignmentId: Schema.Codec<PermissionAssignmentId, string, never, never>;
-    readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
-    readonly actor: Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"account">;
-      readonly accountId: Schema.refine<string, Schema.String>;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"organization">;
-      readonly orgId: Schema.refine<string, Schema.String>;
-    }>]>;
-    readonly state: Schema.Literals<readonly ["pending", "active", "suspended", "revoked", "superseded"]>;
-  }>, Schema.$Array<Schema.Struct<{
-    readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
-    readonly orgId: Schema.refine<string, Schema.String>;
-    readonly type: Schema.Literals<readonly ["budget", "managePeople"]>;
-    readonly state: Schema.Literals<readonly ["pending", "active", "suspended", "revoked", "superseded"]>;
-    readonly revision: Schema.refine<number, Schema.Number>;
-    readonly roleKey: Schema.Codec<RoleKey, string, never, never>;
-    readonly tokenAddress: Schema.optional<Schema.Codec<Address$1, string, never, never>>;
-    readonly limitRaw: Schema.optional<Schema.Codec<WeiAmount, string, never, never>>;
-    readonly allowanceKey: Schema.optional<Schema.Codec<AllowanceKey, string, never, never>>;
-  }>>]>;
-}>;
-type SubmittedPermissionExecution = Schema.Schema.Type<typeof SubmittedPermissionExecutionSchema>;
-declare const PayrollRunStatusSchema: Schema.Literals<readonly ["draft", "authorized", "settled"]>;
-type PayrollRunStatus$1 = Schema.Schema.Type<typeof PayrollRunStatusSchema>;
-declare const PayrollTermsUnitSchema: Schema.Literals<readonly ["hour", "week", "month", "year", "paycheck"]>;
-type PayrollTermsUnit$1 = Schema.Schema.Type<typeof PayrollTermsUnitSchema>;
-//#endregion
-//#region ../wire/src/observation-context.d.ts
-/**
- * Bounded, non-authoritative observation metadata carried by selected SDK
- * calls. Actor identity is deliberately absent: the backend derives it from
- * the authenticated session and verifies organization/application hints.
- */
-interface WireObservationContext {
-  readonly application?: string;
-  readonly applicationId?: string;
-  readonly release?: string;
-  readonly sessionId?: string;
-  readonly organizationId?: string;
-  readonly journeyId?: string;
-  readonly correlationId?: string;
-  readonly anonymousId?: string;
-  /** W3C trace carrier for the explicit Convex action hop; never product identity. */
-  readonly traceparent?: string;
-}
-//#endregion
-//#region src/ports/bootstrap.d.ts
-type BootstrapInput = {
-  readonly publishableKey: PublishableKey;
-  /**
-   * Browser callers send the App origin so bootstrap can enforce the
-   * publishable-key allowlist. Node/server callers may omit it; the backend
-   * only applies the origin allowlist when an origin is present.
-   */
-  readonly origin?: AllowedOrigin;
-};
-type BootstrapResolution = {
-  readonly applicationId: AppId;
-  readonly chainId: ChainId;
-  /**
-   * SDK-handshake session token — distinct from the user-auth `AuthSession`
-   * token issued by `AuthClientPort`. Both use the `SessionToken` brand for
-   * opaque-string discipline; the issuance source distinguishes them.
-   */
-  readonly sessionToken: SessionToken;
-  readonly issuedAt: EpochMs;
-  readonly expiresIn: DurationMs;
-  readonly authBaseUrl: string;
-  readonly convexUrl: string;
-  readonly siteBaseUrl: string;
-  readonly openfortPublishableKey: string;
-  readonly shieldPublishableKey: string;
-  /** Openfort third-party auth provider the signer presents; absent means better-auth. */
-  readonly openfortAuthProvider?: "better-auth" | "oidc";
-  /** Origin of the Ponder indexer the SDK reads directly; absent means no indexer reads. */
-  readonly indexerUrl?: string;
-  readonly engineeringTelemetry?: EngineeringTelemetryBootstrapPolicyV1;
-};
-type BootstrapErrorKind = "notAuthenticated" | "network" | "provider" | "malformedBody" | "invalidInput" | "rateLimited";
-declare const BootstrapError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "BootstrapError";
-} & Readonly<A>;
-declare class BootstrapError extends BootstrapError_base<{
-  readonly operation: "resolve";
-  readonly kind: BootstrapErrorKind;
-  readonly publicCode: CapxulErrorCode;
-  readonly cause: unknown;
-  readonly details?: CapxulErrorDetails;
-}> {}
-interface BootstrapPort {
-  readonly resolve: (input: BootstrapInput) => Effect.Effect<BootstrapResolution, BootstrapError>;
-}
-//#endregion
-//#region src/ports/convex-call.d.ts
-/**
- * Canonical teardown handle for substrate-level reactive callbacks.
- *
- * Calling it stops the subscription; no further snapshots will be delivered
- * to the callback after the first invocation. Calling more than once is a
- * no-op (idempotent).
- *
- * @internal-use
- */
-type Unsubscribe = () => void;
-/**
- * Snapshot is the substrate discriminated union for reactive callbacks over
- * `ConvexCallPort.subscribe`. The public SDK surface is imperative
- * (`Promise<CapxulResult>`).
- *
- *   - `loading` · initial state before any value arrives from the substrate
- *   - `ok`      · a successful snapshot carrying `value`
- *   - `error`   · a failed snapshot carrying a typed error (defaults to
- *                 `CapxulError`)
- *
- * The first snapshot is `loading`. Later snapshots carry `ok` or `error`.
- *
- * Domain ports do not expose reactive callback methods. `ConvexCallPort` owns
- * the `subscribe` method.
- *
- * @internal-use
- */
-type Snapshot<T, E = CapxulError> = {
-  readonly status: "loading";
-} | {
-  readonly status: "ok";
-  readonly value: T;
-} | {
-  readonly status: "error";
-  readonly error: E;
-};
-type ConvexTransportFailure = {
-  readonly kind: "connection-lost-in-flight";
-  readonly connection_id: string;
-  readonly start_connection_count: number;
-  readonly connection_count: number;
-  readonly connection_retries?: number;
-  readonly close_code?: number;
-  readonly close_was_clean?: boolean;
-  readonly close_reason_present?: boolean;
-  readonly document_visibility?: string;
-  readonly navigator_online?: boolean;
-  readonly last_browser_event?: "visibility-visible" | "visibility-hidden" | "pagehide" | "pageshow" | "online" | "offline";
-  readonly ms_since_browser_event?: number;
-};
-declare const ConvexCallError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "ConvexCallError";
-} & Readonly<A>;
-declare class ConvexCallError extends ConvexCallError_base<{
-  readonly operation: string;
-  readonly publicCode: CapxulErrorCode;
-  readonly publicError: CapxulError;
-  readonly cause: unknown;
-  readonly details?: CapxulErrorDetails;
-  readonly transport?: ConvexTransportFailure;
-}> {}
-interface ConvexCallPort {
-  query<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"query", "public", TArgs, TOutput>, args: TArgs): Effect.Effect<TOutput, ConvexCallError>;
-  mutation<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"mutation", "public", TArgs, TOutput>, args: TArgs): Effect.Effect<TOutput, ConvexCallError>;
-  action<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"action", "public", TArgs, TOutput>, args: TArgs): Effect.Effect<TOutput, ConvexCallError>;
-  /**
-   * Substrate-level reactive transport over Convex's `onUpdate`.
-   *
-   * @internal-use — substrate only; see `ports/subscription.ts`. Domain
-   * ports do not expose reactive callback methods to consumers.
-   */
-  subscribe<TArgs extends Record<string, unknown>, TOutput>(fn: FunctionReference<"query", "public", TArgs, TOutput>, args: TArgs, callback: (snapshot: Snapshot<TOutput>) => void): Effect.Effect<Unsubscribe, ConvexCallError>;
-}
-//#endregion
-//#region src/ports/identity.d.ts
-type CreateIdentityInput = {
-  readonly authUserId: AuthUserId;
-  readonly email: Email;
-  readonly displayName?: string;
-  readonly country?: CountryCode;
-};
-type UpdateIdentityInput = {
-  readonly authUserId: AuthUserId;
-  readonly displayName?: string;
-  readonly country?: CountryCode;
-};
-/** The chain families a payout address may name (#1955). */
-declare const PAYOUT_CHAINS: readonly ["evm", "solana", "starknet"];
-/**
- * One payout address, named BY CHAIN FAMILY. The network is the deployment's
- * and the backend derives it (#1955) — a caller never sends one.
- */
-type PayoutAddress = {
-  readonly chain: (typeof PAYOUT_CHAINS)[number];
-  readonly address: string;
-};
-/**
- * D-ONBOARD (#669) — the onboarding-complete identity write. Composes the
- * existing create/update write into one idempotent upsert that ALSO sets the
- * `onboarded` flag and persists the optional `withdrawalAddress` (the one
- * allowed raw-0x class). `displayName` + `country` are required at onboarding
- * time. The returned `Profile` is the existing branded shape — the onboarding
- * flags live on the wire row and are not projected onto the read surface.
- *
- * #1955: it also carries the photo the signup form uploaded and the payout
- * addresses it collected, so the backend writes all three in one transaction
- * instead of the app binding them with two more calls afterwards.
- */
-type CompleteOnboardingIdentityInput = {
-  readonly authUserId: AuthUserId;
-  readonly email: Email;
-  readonly displayName: string;
-  readonly country: CountryCode;
-  readonly withdrawalAddress?: Address$1;
-  /** One globally unique Party handle. */
-  readonly handle: string;
-  /** Storage id from `media.uploadImage`; bound on the identity write itself. */
-  readonly imageStorageId?: string;
-  readonly payoutAddresses?: readonly PayoutAddress[];
-};
-declare const IdentityError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "IdentityError";
-} & Readonly<A>;
-declare class IdentityError extends IdentityError_base<{
-  readonly operation: string;
-  readonly publicCode: CapxulErrorCode;
-  readonly publicError: CapxulError;
-  readonly cause: unknown;
-  readonly details?: CapxulErrorDetails;
-}> {}
-interface IdentityPort {
-  loadByAuthUserId(authUserId: AuthUserId): Effect.Effect<Profile | null, IdentityError, never>;
-  create(input: CreateIdentityInput): Effect.Effect<Profile, IdentityError, never>;
-  update(input: UpdateIdentityInput): Effect.Effect<Profile, IdentityError, never>;
-  /** D-ONBOARD (#669): idempotent upsert that marks the identity onboarded. */
-  completeOnboarding(input: CompleteOnboardingIdentityInput): Effect.Effect<Profile, IdentityError, never>;
-}
-//#endregion
-//#region src/ports/smart-account.d.ts
-/** Safe deployment configuration for the Organization setup adapter. */
-type SafeDeploymentConfig = {
-  readonly chainId: ChainId;
-  readonly rpcUrl: string;
-  readonly bundlerRpcUrl: string;
-  readonly receiptTimeoutMs?: DurationMs;
-};
-/**
- * Evidence of a successful Safe deployment.
- *
- * Every field except `chainId` / `signerAddress` / `safeAddress` is
- * optional because the AC8 precheck short-circuit path (Safe already
- * on-chain at this address; off-chain receipt evidence unavailable)
- * calls the persistence step WITHOUT a `userOpHash`, `txHash`, or
- * `blockNumber` — there is no recoverable transaction. Aaron's rule:
- * "If there is no TX and it hasn't been deployed then there shouldn't
- * be a hash." End-to-end nullable: `v.optional(v.string())` in the
- * backend schema.
- *
- * **`deployedAt` is NOT a field on this type.** The SDK is never the
- * oracle for `deployedAt`. The backend (`confirmDeployment` action —
- * Convex mutations cannot `fetch`, so the chain re-verification lives
- * in an action) derives it from on-chain data — `eth_getUserOperationReceipt`
- * for the real-userOp path or `eth_getLogs` for the precheck path —
- * then resolves the receipt block's timestamp via `eth_getBlockByNumber`.
- * See `packages/sdk/docs/architecture.md` for the deployment trust boundary.
- */
-type SafeDeploymentEvidence = {
-  readonly chainId: ChainId;
-  readonly signerAddress: Address$1;
-  readonly safeAddress: Address$1;
-  readonly txHash?: TxHash;
-  readonly userOpHash?: TxHash;
-  readonly blockNumber?: BlockNumber;
-};
-type ProvisionInput = {
-  readonly authUserId: AuthUserId;
-  readonly chainId: ChainId;
-  /** Verified session email. The backend reads the same value from BetterAuth. */
-  readonly email: Email;
-};
-/**
- * Input to `SmartAccountPort.confirmDeployment` (#161 · γ-B).
- *
- * The SDK provides evidence pointers; the backend is the oracle for
- * `deployedAt`. `evidence.deployedAt` does NOT exist by schema (see
- * `SafeDeploymentEvidence`) — the backend derives `deployedAt` from
- * the on-chain receipt block via `eth_getBlockByNumber`.
- *
- * Precheck path: `evidence.userOpHash` omitted; backend scans
- * `SafeProxyFactory.ProxyCreation(safeAddress, _)` via `eth_getLogs`.
- *
- * Real-userOp path: `evidence.userOpHash` populated; backend calls
- * `eth_getUserOperationReceipt(userOpHash)` to re-verify and derive.
- */
-type ConfirmDeploymentInput = {
-  readonly authUserId: AuthUserId;
-  readonly chainId: ChainId;
-  readonly safeAddress: Address$1;
-  readonly evidence: SafeDeploymentEvidence;
-};
-/**
- * Input to `SmartAccountPort.claim` (PRD #462). The authenticated session
- * reports the browser-created signer address; the BACKEND builds and
- * bootstrap-signs the claim userOp (deploy + swapOwner) — the consumer signs
- * nothing at claim.
- */
-type ClaimInput = {
-  readonly authUserId: AuthUserId;
-  readonly chainId: ChainId;
-  readonly signerAddress: Address$1;
-};
-declare const SmartAccountError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "SmartAccountError";
-} & Readonly<A>;
-declare class SmartAccountError extends SmartAccountError_base<{
-  readonly operation: string;
-  readonly publicCode: CapxulErrorCode;
-  readonly publicError: CapxulError;
-  readonly cause: unknown;
-  readonly details?: CapxulErrorDetails;
-}> {}
-interface SmartAccountPort {
-  loadByAuthUserId(authUserId: AuthUserId): Effect.Effect<SmartAccount | null, SmartAccountError, never>;
-  loadBySmartAccountAddress(address: Address$1): Effect.Effect<SmartAccount | null, SmartAccountError, never>;
-  provision(input: ProvisionInput): Effect.Effect<SmartAccount, SmartAccountError, never>;
-  /**
-   * Persist on-chain Safe-deployment evidence. The backend re-verifies
-   * the evidence against chain state and derives `deployedAt` from the
-   * receipt block's timestamp. Returns the updated `SmartAccount` row.
-   *
-   * γ-B trust model: the SDK supplies evidence pointers only. The
-   * backend is the SOLE oracle for `deployedAt` — see
-   * `packages/sdk/docs/architecture.md`.
-   */
-  confirmDeployment(input: ConfirmDeploymentInput): Effect.Effect<SmartAccount, SmartAccountError, never>;
-  /**
-   * Claim the account (PRD #462): the backend builds, bootstrap-signs, and
-   * submits ONE sponsored userOp — deploy (when undeployed) + swapOwner
-   * (bootstrap → `signerAddress`). Idempotent; returns the updated row. When
-   * another claim is in flight the row comes back with `claimedAt: null` —
-   * callers poll lifecycle until the claim lands.
-   */
-  claim(input: ClaimInput): Effect.Effect<SmartAccount, SmartAccountError, never>;
-}
-//#endregion
-//#region src/ports/account-read.d.ts
-type ReadAccountBalanceInput = {
-  readonly chainId: ChainId;
-};
-type FundFromFaucetInput = {
-  readonly chainId: ChainId;
-  readonly amount: Money;
-};
-type FundFromFaucetResult = {
-  readonly txHash: string;
-};
-declare const AccountReadError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "AccountReadError";
-} & Readonly<A>;
-declare class AccountReadError extends AccountReadError_base<{
-  readonly operation: string;
-  readonly publicCode: CapxulErrorCode;
-  readonly publicError: CapxulError;
-  readonly cause: unknown;
-  readonly details?: CapxulErrorDetails;
-}> {}
-/**
- * The Account money read joins the `accounts` row with a
- * live RPC `balanceOf` pull; the adapter lifts wire integers to `Money`.
- */
-interface AccountReadPort {
-  readBalance(input: ReadAccountBalanceInput): Effect.Effect<Account$1, AccountReadError, never>;
-  fundFromFaucet(input: FundFromFaucetInput): Effect.Effect<FundFromFaucetResult, AccountReadError, never>;
-}
-//#endregion
-//#region src/ports/indexer-read.d.ts
-/**
- * IndexerReadPort is the SDK's read seam onto the Ponder read model
- * (`apps/indexer`). Ponder holds what the chain said; Convex holds what the
- * user meant. Nothing here is copied into Convex, nothing waits for a
- * finality tag, and no write path may read through this port.
- *
- * Every read is scoped to one Safe and one page. The indexer accepts only the
- * exact compiled statements in `apps/indexer/src/queries.ts`, so the adapter
- * that implements this port reproduces those statements byte for byte and the
- * service refuses anything else with 403.
- */
-/** One page of rows for one Safe. `offset` defaults to 0 (the first page). */
-interface IndexerReadInput {
-  /** The Safe the caller owns. The indexer refuses a Safe outside the session claim. */
-  readonly safe: Address$1;
-  /** 1 to 1000 inclusive — the indexer's own bound. */
-  readonly limit: number;
-  readonly offset?: number;
-  readonly eventId?: string;
-  /** Exact Payment lookup for a bounded set of actor-authorized settlement IDs. */
-  readonly settlements?: readonly string[];
-  /** Transfer occurrence time in epoch seconds; continuation excludes the last row. */
-  readonly timeline?: {
-    readonly from: number;
-    readonly to: number;
-    readonly before?: {
-      readonly timestamp: number;
-      readonly id: string;
-    };
-  };
-}
-/**
- * The chain evidence every indexed row carries. `id` is the logical event id
- * `chainId:txHash:transactionLogOrdinal`; it survives a reorg, so it is the
- * key a Convex intent row stitches against.
- */
-interface IndexerEventIdentity {
-  readonly id: string;
-  readonly chainId: ChainId;
-  readonly txHash: TxHash;
-  readonly transactionLogOrdinal: number;
-  /**
-   * The block-global log index of the same log, as the transaction receipt
-   * reports it. The ordinal above is the identity; this is the key Convex
-   * settles a Payment on (P12).
-   */
-  readonly logIndex: number;
-  readonly blockNumber: bigint;
-  readonly blockHash: string;
-  /** Block timestamp in epoch seconds. */
-  readonly timestamp: bigint;
-}
-interface IndexerTransferRow extends IndexerEventIdentity {
-  /** Timeline projection only. Null means no protocol event owns this Transfer. */
-  readonly paymentSettlementId?: string | null;
-  readonly assetId: AssetId;
-  readonly token: Address$1;
-  readonly from: Address$1;
-  readonly to: Address$1;
-  /**
-   * Raw token units, exact. This is an evidence boundary, so the row never
-   * carries Money or AssetAmount: the reader owns the asset's decimals.
-   */
-  readonly amount: bigint;
-}
-interface IndexerPaymentRow extends IndexerEventIdentity {
-  readonly contract: Address$1;
-  /** The protocol settlement id a Convex Payment command stitches against. */
-  readonly settlementId: string;
-  readonly sender: Address$1;
-  readonly recipient: Address$1;
-  readonly assetId: AssetId;
-  readonly token: Address$1;
-  /** Raw token units, exact. */
-  readonly amount: bigint;
-  readonly kind: number;
-  readonly documentHash: string;
-}
-/** A row of the indexer's signed-transfer `balance` view. */
-interface IndexerBalanceRow {
-  readonly chainId: ChainId;
-  readonly assetId: AssetId;
-  readonly address: Address$1;
-  /** Raw token units, exact. */
-  readonly amount: bigint;
-}
-/** One chain's sync position, from the indexer's native `/status` route. */
-interface IndexerChainStatus {
-  readonly chain: string;
-  readonly chainId: ChainId;
-  readonly blockNumber: bigint;
-  /** Block timestamp in epoch seconds. Its age is the freshness label. */
-  readonly blockTimestamp: bigint;
-}
-/**
- * The tables this seam reads today. P04 adds the authority rows (`safe`,
- * `safe_event`, `roles_module`) and P05 adds `commitment`: each is one more
- * entry here plus its statement and decoder.
- */
-interface IndexerRowsByTable {
-  readonly transfer: readonly IndexerTransferRow[];
-  readonly payment: readonly IndexerPaymentRow[];
-  readonly balance: readonly IndexerBalanceRow[];
-}
-type IndexerTable = keyof IndexerRowsByTable;
-declare const IndexerReadError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "IndexerReadError";
-} & Readonly<A>;
-declare class IndexerReadError extends IndexerReadError_base<{
-  readonly operation: string;
-  readonly publicCode: CapxulErrorCode;
-  readonly publicError: CapxulError;
-  readonly cause: unknown;
-  readonly details?: CapxulErrorDetails;
-}> {}
-interface IndexerReadPort {
-  /** One page of rows, newest block first. An empty page is a value, not an error. */
-  read<T extends IndexerTable>(table: T, input: IndexerReadInput): Effect.Effect<IndexerRowsByTable[T], IndexerReadError>;
-  /**
-   * The same page over the indexer's live stream. The first snapshot is
-   * `loading`; each later snapshot carries the whole page again. The indexer
-   * closes the stream on token expiry or revoked authority, which arrives as
-   * one `error` snapshot — the caller re-reads with a refreshed token.
-   *
-   * @internal-use — substrate reactive transport, like `ConvexCallPort.subscribe`.
-   */
-  subscribe<T extends IndexerTable>(table: T, input: IndexerReadInput, callback: (snapshot: Snapshot<IndexerRowsByTable[T]>) => void): Effect.Effect<Unsubscribe, IndexerReadError>;
-  /** Sync position per chain. Unauthenticated: a stale index is not a refusal. */
-  readonly status: Effect.Effect<readonly IndexerChainStatus[], IndexerReadError>;
-}
-//#endregion
-//#region src/flows/types.d.ts
-/** The runtime port bundle that `assembleCapxulClient` uses. */
-interface FlowPorts {
-  readonly authClient: AuthClientPort;
-  readonly authCache: AuthCachePort;
-  readonly identity: IdentityPort;
-  readonly smartAccount: SmartAccountPort;
-  readonly accountRead: AccountReadPort;
-  readonly bootstrap: BootstrapPort;
-  readonly clock: ClockPort;
-  readonly telemetry: TelemetryPort;
-  readonly convexCall: ConvexCallPort;
-  /**
-   * The Ponder read seam (P02). Optional: it is present only when the client
-   * was given an indexer origin, and every existing flow works without it.
-   */
-  readonly indexerRead?: IndexerReadPort;
-}
-/** Legacy method input retained by the imperative auth surface. */
-interface ExternalSigner {
-  readonly address: Address$1;
-  readonly signedProof: string;
-}
-//#endregion
-//#region src/surface/org-lifecycle.d.ts
-type OrgSetupStep = "preparingFounderAccount" | "awaitingFounderAuthorization" | "submittingBootstrap" | "confirmingBootstrap";
-/** Leak-safe readiness for exactly one Organization. */
-type OrgLifecycle = {
-  readonly status: "loading";
-  readonly orgId: OrgId;
-} | {
-  readonly status: "settingUp";
-  readonly orgId: OrgId;
-  readonly step: OrgSetupStep;
-} | {
-  readonly status: "ready";
-  readonly orgId: OrgId;
-  readonly canTransact: true;
-} | {
-  readonly status: "failed";
-  readonly orgId: OrgId;
-  readonly at: OrgSetupStep;
-  readonly error: CapxulError;
-  readonly retryable: boolean;
-};
-type StartOrResumeOrganizationInput = {
-  readonly name: string;
-  readonly handle: string;
-  readonly country: string;
-  /** #1064: optional onboarding-collected description + size bucket. */
-  readonly bio?: string;
-  readonly size?: string;
-  /** #1955: storage id from `media.uploadImage`, recorded on the org insert. */
-  readonly logoStorageId?: string;
-  /** @internal Safe trace/correlation carriage owned by the identity flow. */
-  readonly observationContext?: WireObservationContext;
-};
-type OrganizationSetupStepInput = {
-  readonly orgId: OrgId;
-  readonly signal?: AbortSignal;
-  /** @internal Safe trace/correlation carriage owned by the identity flow. */
-  readonly observationContext?: WireObservationContext;
-  /**
-   * @internal #1655: milliseconds the identity flow waited before this
-   * confirmation attempt. Absent on the first attempt. The backend copies it
-   * onto `organization_creation_failed` as `backoff_ms`.
-   */
-  readonly retryDelayMs?: number;
-};
-type RecordOrganizationSetupFailureInput = {
-  readonly orgId: OrgId;
-  readonly error: CapxulError;
-  readonly retryable: boolean;
-  /** @internal Safe trace/correlation carriage owned by the identity flow. */
-  readonly observationContext?: WireObservationContext;
-};
-/**
- * Internal capability set used by the Core SDK's deep Organization boundary.
- * Consumers never coordinate these steps directly. Production composition
- * supplies them; hermetic contract tests provide a stateful implementation.
- */
-interface OrganizationSetupOps {
-  startOrResume(input: StartOrResumeOrganizationInput): Promise<CapxulResult<{
-    readonly orgId: OrgId;
-    readonly lifecycle: OrgLifecycle;
-  }>>;
-  /** Completes and verifies the founder Account ownership handoff. */
-  prepareFounderAccount(input: OrganizationSetupStepInput): Promise<CapxulResult<OrgLifecycle>>;
-  /** Obtains configured signer authorization and submits the bootstrap once. */
-  authorizeAndSubmitBootstrap(input: OrganizationSetupStepInput): Promise<CapxulResult<OrgLifecycle>>;
-  /** Resumes a recorded provider-known submission without invoking the signer. */
-  resumeSubmittedBootstrap(input: OrganizationSetupStepInput): Promise<CapxulResult<OrgLifecycle>>;
-  /** Confirms a previously recorded submission without requesting authorization again. */
-  confirmSubmittedBootstrap(input: OrganizationSetupStepInput): Promise<CapxulResult<OrgLifecycle>>;
-  recordFailure(input: RecordOrganizationSetupFailureInput): Promise<CapxulResult<OrgLifecycle>>;
-  loadLifecycle(input: {
-    readonly orgId: OrgId;
-    readonly observationContext?: WireObservationContext;
-  }): Promise<CapxulResult<OrgLifecycle>>;
-  /** Resets durable failure state only; the Core SDK resumes the correct step. */
-  retry(input: OrganizationSetupStepInput): Promise<CapxulResult<OrgLifecycle>>;
-}
-//#endregion
-//#region src/flows/identity.d.ts
-interface IdentityActor extends Actor<IdentityState, IdentityEvent, RefusalReason> {
-  /** Full provider session retained beside the deliberately minimal model session. */
-  readonly authSession: () => AuthSession | null;
-  /** Trust a cache-resumed provider session before a later ReadSession verifies it. */
-  readonly restoreAuthSession: (session: AuthSession, controls?: InvocationControls) => Effect.Effect<IdentityState, ActorFailure<RefusalReason | CapxulErrorCode>>;
-}
-//#endregion
-//#region src/surface/auth.d.ts
-type AuthMethodOptions = InvocationControls;
-type SignInOptions = AuthMethodOptions;
-interface AuthMethods {
-  canSendOtp(input: {
-    readonly email: string;
-  }, options?: AuthMethodOptions): Promise<CapxulResult<CanSendOtpStatus>>;
-  signIn(input: {
-    readonly email: string;
-  }, options?: SignInOptions): Promise<CapxulResult<{
-    readonly sessionId: string;
-    readonly expiresAt: number;
-  }>>;
-  verifyOtp(input: {
-    readonly email: string;
-    readonly code: string;
-    readonly signer?: ExternalSigner;
-  }, options?: AuthMethodOptions): Promise<CapxulResult<Session$1>>;
-  signOut(options?: AuthMethodOptions): Promise<CapxulResult<void>>;
-  getSession(options?: AuthMethodOptions): Promise<CapxulResult<Session$1 | null>>;
-}
-//#endregion
-//#region src/surface/smart-account.d.ts
-interface SmartAccountMethods {
-  loadCurrent(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<SmartAccount$1 | null>>;
-  provision(input?: {
-    readonly externalSigner?: ExternalSigner;
-  }): Promise<CapxulResult<SmartAccount$1>>;
-}
-//#endregion
-//#region src/surface/identity.d.ts
-/**
- * #1955: what a create call may carry besides the three required fields — the
- * photo already uploaded and the payout addresses the form collected.
- */
-interface ProfileCarriage {
-  /** Storage id from `media.uploadImage`. */
-  readonly imageStorageId?: string;
-  readonly payoutAddresses?: readonly PayoutAddress[];
-}
-interface CompleteProfileInput extends ProfileCarriage {
-  readonly displayName: string;
-  readonly country: string;
-  readonly handle: string;
-}
-interface IdentityMethods {
-  loadCurrent(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Profile$1 | null>>;
-  /** Complete the Person profile. A normalized, globally unique handle is required. */
-  completeProfile(profile: CompleteProfileInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Profile$1>>;
-  /**
-   * #1062: availability probe for the handle the user is typing. Returns the
-   * canonical stored form so the UI can echo it.
-   */
-  handleAvailable(handle: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<{
-    readonly available: boolean;
-    readonly normalized: string;
-  }>>;
-}
-//#endregion
-//#region src/surface/account-lifecycle.d.ts
-type ProvisioningFailureStep = "wallet" | "identity" | "provision" | "deploy";
-type ProvisioningPhase = {
-  readonly status: "idle";
-} | {
-  readonly status: "wallet";
-} | {
-  readonly status: "identity";
-} | {
-  readonly status: "provision";
-} | {
-  readonly status: "deploy";
-} | {
-  readonly status: "ready";
-} | {
-  readonly status: "failed";
-  readonly at: ProvisioningFailureStep;
-  readonly error: CapxulError;
-};
-type AccountSetupStep = "connecting" | "confirmingIdentity" | "registering" | "activating";
-type AccountLifecycle = {
-  readonly status: "loading";
-} | {
-  readonly status: "settingUp";
-  readonly step: AccountSetupStep;
-} | {
-  readonly status: "ready";
-  readonly accountId: string;
-  readonly canTransact: boolean;
-} | {
-  readonly status: "failed";
-  readonly at: AccountSetupStep;
-  readonly error: CapxulError;
-};
-declare function isSettingUpLifecycle(lifecycle: AccountLifecycle): boolean;
-//#endregion
-//#region src/surface/payment-command-execution.d.ts
-/** Return one stable fingerprint for one JSON payment intent. */
-declare function fingerprintPaymentIntent(intent: unknown): Promise<string>;
-//#endregion
-//#region src/surface/money.d.ts
-type ActorReference = {
-  readonly kind: "personal";
-} | {
-  readonly kind: "organization";
-  readonly organizationId: string;
-};
-type TargetReference = {
-  readonly kind: "handle";
-  readonly handle: string;
-} | {
-  readonly kind: "email";
-  readonly email: string;
-} | {
-  readonly kind: "address";
-  readonly address: Address$1;
-} | {
-  readonly kind: "party";
-  readonly partyId: PartyId;
-};
-interface ResolvedTarget {
-  readonly reference: TargetReference;
-  readonly label: string;
-  readonly status: RecipientResolution["status"];
-  readonly kind: "person" | "organization" | "external_address" | "unresolved";
-  readonly safeAddress: Address$1;
-  readonly isCapxulAccount: boolean;
-  readonly partyId?: PartyId;
-  readonly handle?: string;
-  readonly requiresAcknowledgement?: true;
-  readonly capabilities: {
-    readonly canPay: boolean;
-    readonly canRequest: boolean;
-    readonly canPayout: boolean;
-  };
-}
-/**
- * R09 (#1967): the declared option type is the `InvocationControls` the money
- * surface already forwards to `deps.invocationControls`, named here exactly as
- * R02 named it on the address book and R13 on payroll. A caller that captured
- * one user attempt can hand the same `correlation_id`/`journey_id` to the read
- * it starts, so the read joins that attempt instead of standing alone.
- * `{ signal }` callers are unaffected.
- */
-type PaymentReadOptions = InvocationControls;
-interface TargetsMethods {
-  resolve(reference: TargetReference, options?: PaymentReadOptions): Promise<CapxulResult<ResolvedTarget>>;
-}
-type Ref$1 = {
-  readonly kind: "handle";
-  readonly handle: string;
-} | {
-  readonly kind: "email";
-  readonly email: string;
-} | {
-  readonly kind: "address";
-  readonly address: Address$1;
-} | {
-  readonly kind: "party";
-  readonly partyId: PartyId;
-};
-interface MeProfile {
-  readonly authUserId: string;
-  readonly email: string;
-  readonly displayName: string | null;
-}
-interface DepositInstructions {
-  readonly accountKind: "personalSafe" | "orgTreasury";
-  readonly chainId: number;
-  readonly network: "base-sepolia";
-  readonly currency: "USD";
-  readonly address: string;
-  readonly label: string;
-}
-interface RecipientResolution {
-  readonly status: "known_party" | "new_email" | "external_address";
-  readonly kind: "party" | "email" | "external_address";
-  readonly locatorKind: Ref$1["kind"];
-  readonly recipient: Ref$1;
-  readonly label: string;
-  readonly safeAddress: string;
-  readonly isCapxulAccount: boolean;
-  readonly partyId?: string;
-  readonly partyKind?: "person" | "org";
-  readonly handle?: string;
-  readonly email?: string;
-  readonly address?: string;
-  readonly requiresAcknowledgement?: true;
-}
-interface MeMethods {
-  get(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<MeProfile>>;
-  /** R08 (#1966): accepts a captured attempt, exactly as the treasury read does. */
-  depositInstructions(options?: InvocationControls): Promise<CapxulResult<DepositInstructions>>;
-}
-interface PaymentMoney {
-  readonly currency: string;
-  readonly value: string;
-  readonly decimals: number;
-}
-type PaymentStatus = PaymentStatus$1;
-type PaymentDirection = PaymentDirection$1;
-type PaymentType = PaymentType$1;
-type PaymentDocumentKind = PaymentDocumentKind$1;
-interface PaymentDocumentRef {
-  readonly documentHash: string;
-  readonly kind: PaymentDocumentKind;
-  readonly title?: string;
-  readonly uri?: string;
-  readonly issuedAt?: number;
-}
-type PaymentTiming = {
-  readonly kind: "instant";
-} | {
-  readonly kind: "scheduled";
-  readonly at: number;
-} | {
-  readonly kind: "stream";
-  readonly startsAt: number;
-  readonly endsAt: number;
-  readonly cliffAt?: number;
-};
-interface Payment {
-  readonly id: string;
-  readonly status: PaymentStatus;
-  readonly amount: PaymentMoney;
-  readonly paymentType: PaymentType;
-  readonly direction: PaymentDirection;
-  readonly counterpartyLabel: string;
-  readonly receipt: {
-    readonly chainId: number;
-    readonly transactionHash: string;
-  } | null;
-  readonly recipient: {
-    readonly kind: "party";
-    readonly partyId: string;
-    readonly label: string;
-  } | {
-    readonly kind: "external_address";
-    readonly label: string;
-  };
-  readonly documents: readonly PaymentDocumentRef[];
-  readonly timing: PaymentTiming;
-  readonly released: PaymentMoney;
-  readonly availableToClaim: PaymentMoney;
-  readonly execution?: PaymentExecutionView;
-  readonly createdAt: number;
-  readonly updatedAt: number;
-}
-interface PaymentsPayInput {
-  readonly actor?: ActorReference;
-  readonly to: TargetReference;
-  readonly amount: PaymentMoney;
-  readonly externalAddressAcknowledged?: true;
-  /**
-   * How the payment is classified on the ledger. When a `document` is
-   * attached, the type derived from the document kind is AUTHORITATIVE
-   * (memo → unspecified, invoice → invoice, payslip → payroll, receipt →
-   * reimbursement) — an explicit conflicting value is rejected with
-   * INVALID_INPUT ("must match the attached document kind"). With no
-   * document the explicit value is honored, defaulting to "unspecified".
-   */
-  readonly paymentType?: PaymentType;
-  /** Full EIP-712 document envelope; hashed + stored, committed on-chain. */
-  readonly document?: AttachablePaymentDocumentEnvelopeV1;
-  /**
-   * Payment timing. Omitted means `instant`.
-   * A `scheduled`/`stream` clause turns the payment into a Commitment
-   * (escrow-vest-claim) backed by `CapxulPayments.createCommitment`.
-   */
-  readonly timing?: PaymentTiming;
-  /**
-   * #592: itemized line items backing an Invoice `document`. The backend asserts
-   * `hashLineItems(lineItems) === document.lineItemsHash` AND `Σ(quantity ×
-   * unitMinor) === document.amount`, then persists the list for itemized render.
-   */
-  readonly lineItems?: readonly LineItemV1[];
-}
-type DestinationKind = "bank_account" | "mobile_money" | "external_account";
-type DestinationRail = {
-  readonly kind: "bank";
-  readonly country: string;
-  readonly currency: string;
-} | {
-  readonly kind: "mobile_money";
-  readonly country: string;
-  readonly currency: string;
-  readonly provider: string;
-} | {
-  readonly kind: "chain";
-  readonly network: string;
-  readonly asset?: string;
-};
-type DestinationPayload = {
-  readonly accountHolderName: string;
-  readonly bankName: string;
-  readonly country: string;
-  readonly currency: string;
-  readonly accountNumberLast4: string;
-} | {
-  readonly provider: string;
-  readonly country: string;
-  readonly currency: string;
-  readonly phoneNumberLast4: string;
-} | {
-  readonly network: "base-sepolia" | "solana-devnet" | "starknet-sepolia";
-  readonly address: string;
-};
-interface Destination {
-  readonly id: string;
-  readonly counterpartyId: string;
-  /** #1063: null exactly when `ownerScope === "self"`. */
-  readonly ref: Ref$1 | null;
-  /** Derived from `ref`; null for self-owned rows. */
-  readonly target: TargetReference | null;
-  readonly kind: DestinationKind;
-  readonly rail: DestinationRail;
-  /**
-   * #1063: "self" = the actor's own payout destination; "counterparty" = the
-   * address-book shape. The mapping always sets it (wire absence ⇒ "counterparty").
-   */
-  readonly ownerScope: "self" | "counterparty";
-  readonly label: string | null;
-  readonly payload: DestinationPayload;
-  readonly createdAt: number;
-  readonly updatedAt: number;
-}
-/** #1063 ratified shape: your own payout destination is `target: { self: true }`. */
-type SelfTarget = {
-  readonly self: true;
-};
-/** #1063: exactly one of `target` (counterparty or `{ self: true }`) or `ref`. */
-interface DestinationAddInput {
-  readonly actor?: ActorReference;
-  readonly target?: TargetReference | SelfTarget;
-  readonly ref?: Ref$1;
-  readonly kind: DestinationKind;
-  readonly label?: string;
-  readonly payload: DestinationPayload;
-}
-interface DestinationListInput {
-  readonly actor?: ActorReference;
-  /** #1063: `{ self: true }` narrows to the actor's own payout destinations. */
-  readonly target?: TargetReference | SelfTarget;
-  readonly ref?: Ref$1;
-  readonly kind?: DestinationKind;
-}
-interface DestinationRemoveInput {
-  readonly actor?: ActorReference;
-  readonly destinationId: string;
-}
-interface DestinationsMethods {
-  add(input: DestinationAddInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Destination>>;
-  list(input: DestinationListInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly Destination[]>>;
-  remove(input: DestinationRemoveInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<{
-    readonly id: string;
-  }>>;
-}
-/** The one name for what an activity row IS. */
-type ActivityKind = "payment" | "movement";
-/** `createdAt` bounds in epoch milliseconds. Both ends are inclusive. */
-interface ActivityRange {
-  readonly from?: number;
-  readonly to?: number;
-}
-interface ActivityFilter {
-  readonly kind?: ActivityKind;
-  readonly direction?: PaymentDirection;
-  /** Payment rows only. A status filter therefore excludes Movements, which have none. */
-  readonly status?: readonly PaymentStatus[];
-}
-interface ActivityListParams {
-  readonly actor?: ActorReference;
-  readonly cursor?: string;
-  /** 1..100, default 25. The backend rejects anything outside that band. */
-  readonly limit?: number;
-  readonly range?: ActivityRange;
-  readonly filter?: ActivityFilter;
-}
-type ActivityReference = {
-  readonly kind: "payment";
-  readonly id: string;
-  readonly actor?: ActorReference;
-} | {
-  readonly kind: "movement";
-  readonly id: string;
-};
-type ActivityItem = {
-  readonly kind: "payment";
-  readonly execution?: PaymentExecutionView;
-  readonly id: string;
-  readonly ledgerKind: "Payment" | "Payout" | "Deposit";
-  readonly status: PaymentStatus;
-  /** What the payment is FOR. On the list row so a title needs no second read. */
-  readonly paymentType: PaymentType;
-  readonly amount: PaymentMoney;
-  readonly direction: PaymentDirection;
-  readonly counterpartyLabel: string;
-  readonly receipt: {
-    readonly chainId: number;
-    readonly transactionHash: string;
-  } | null;
-  readonly createdAt: number;
-  readonly updatedAt: number;
-} | {
-  readonly kind: "movement";
-  readonly id: string;
-  readonly classification: "movement_only_outflow";
-  readonly amount: PaymentMoney;
-  readonly direction: PaymentDirection;
-  /** Short-form counterparty address today. */
-  readonly counterpartyLabel: string;
-  readonly receipt: {
-    readonly chainId: number;
-    readonly transactionHash: string;
-  };
-  readonly createdAt: number;
-  readonly updatedAt: number;
-};
-interface ActivityPage {
-  /** Usable fallback data omits indexed movements; never present it as complete. */
-  readonly readWarning?: "indexer-unavailable";
-  readonly items: readonly ActivityItem[];
-  readonly cursor: string | null;
-  readonly checkpoint: number;
-  /** Server read time, so a consumer can say which of two reads is older. */
-  readonly observedAt: number;
-}
-interface ActivitySummaryParams {
-  readonly actor?: ActorReference;
-  readonly window?: ActivityRange;
-}
-interface ActivitySummaryTotal {
-  readonly currency: string;
-  readonly decimals: number;
-  /** Integer raw-unit strings. `net` is `in - out` and may be negative. */
-  readonly in: string;
-  readonly out: string;
-  readonly net: string;
-  /** The `in` share that is not yet terminal. */
-  readonly pendingIn: string;
-}
-interface ActivitySummary {
-  readonly readWarning?: ActivityPage["readWarning"];
-  readonly window: {
-    readonly from: number | null;
-    readonly to: number | null;
-  };
-  /** One bucket per currency, and EMPTY when the window holds no activity. */
-  readonly totals: readonly ActivitySummaryTotal[];
-  /**
-   * Every activity row in the window, whatever its direction or status. It
-   * therefore counts rows that move no money into the totals — a payment the
-   * actor sent to itself, and a cancelled one.
-   */
-  readonly count: number;
-  readonly observedAt: number;
-}
-interface PaymentActivityEvidence {
-  readonly chainId: 84532;
-  readonly contractAddress: string;
-  readonly tokenAddress: string;
-  readonly transactionHash: string;
-  readonly blockNumber: number;
-  readonly blockHash: string;
-  readonly inclusion: "included";
-  readonly verification: "verified";
-  /** @deprecated Use `inclusion` and `verification`. */
-  readonly finality: "finalized";
-  readonly paymentEventLogIndex: number | null;
-  readonly transferLogIndex: number;
-  readonly settlementId: string | null;
-  readonly source: string;
-  readonly destination: string;
-  readonly rawAmount: string;
-  readonly link: {
-    readonly paymentId: string;
-    readonly movementId: string | null;
-    readonly transactionHash: string;
-  };
-}
-interface MovementActivityEvidence {
-  readonly chainId: number;
-  readonly contractAddress: string;
-  readonly tokenAddress: string;
-  readonly transactionHash: string;
-  readonly blockNumber: number;
-  readonly blockHash: string;
-  readonly inclusion: "included";
-  readonly verification: "verified";
-  /** @deprecated Use `inclusion` and `verification`. */
-  readonly canonicalState: "finalized";
-  readonly transferLogIndex: number;
-  readonly source: string;
-  readonly destination: string;
-  readonly rawAmount: string;
-  readonly link: {
-    readonly movementId: string;
-    readonly depositPaymentId: string | null;
-  };
-}
-/**
- * The overlay one actor keeps over one activity row. `actor` and `lastEditor`
- * are the backend's own `ActorRef`, the same shape `MovementAnnotation` carried
- * before the overlay generalized past Movements.
- */
-interface ActivityAnnotation {
-  readonly reference: ActivityReference;
-  readonly actor: ActorRef;
-  readonly counterpartyLabel?: string;
-  readonly accountingCategory?: string;
-  readonly memo?: string;
-  readonly lastEditor: ActorRef;
-  readonly updatedAt: number;
-}
-type ActivityDetail = {
-  readonly kind: "payment";
-  readonly payment: Payment;
-  readonly annotation: ActivityAnnotation | null;
-  readonly evidence: PaymentActivityEvidence | null;
-} | {
-  readonly kind: "movement";
-  readonly movementId: string;
-  readonly annotation: ActivityAnnotation | null;
-  readonly evidence: MovementActivityEvidence;
-};
-interface ActivityAnnotationInput {
-  readonly actor?: ActorReference;
-  /** Any activity row, not only a Movement. */
-  readonly reference: ActivityReference;
-  readonly counterpartyLabel?: string;
-  readonly accountingCategory?: string;
-  readonly memo?: string;
-}
-/**
- * #1960 R02: the declared option type is the `InvocationControls` these methods
- * have always forwarded to `deps.invocationControls`, so an Activity action can
- * carry the correlation its UI observation already used. `{ signal }` callers
- * are unaffected.
- */
-interface ActivityMethods {
-  /**
-   * Tell the caller when the indexed page for this actor's Safe changed, over
-   * the indexer's one live connection. The callback carries no rows: it is the
-   * signal to re-read `list` or `summary`. Without an indexer this resolves a
-   * no-op teardown, so a caller needs no branch.
-   *
-   * @internal-use — substrate reactive transport, like `ConvexCallPort.subscribe`.
-   */
-  subscribe(onChange: () => void, params?: {
-    readonly actor?: ActorReference;
-  }, options?: InvocationControls): Promise<CapxulResult<() => void>>;
-  list(params?: ActivityListParams, options?: InvocationControls): Promise<CapxulResult<ActivityPage>>;
-  summary(params?: ActivitySummaryParams, options?: InvocationControls): Promise<CapxulResult<ActivitySummary>>;
-  get(reference: ActivityReference, options?: InvocationControls & {
-    readonly actor?: ActorReference;
-  }): Promise<CapxulResult<ActivityDetail | null>>;
-  annotate(input: ActivityAnnotationInput, options?: InvocationControls): Promise<CapxulResult<ActivityAnnotation>>;
-}
-interface OfframpQuoteInput {
-  readonly actor?: ActorReference;
-  readonly destinationId: string;
-  readonly amount: PaymentMoney;
-}
-interface OfframpQuote {
-  readonly id: string;
-  readonly input: OfframpQuoteInput;
-  readonly expiresAt: number;
-  readonly receivedAmount: PaymentMoney;
-  readonly fee: PaymentMoney;
-}
-interface OfframpStatus {
-  readonly id: string;
-  readonly status: "pending" | "processing" | "completed" | "failed" | "cancelled";
-  readonly paymentId: string | null;
-  readonly destinationId: string;
-  readonly updatedAt: number;
-}
-interface OfframpMethods {
-  quote(input: OfframpQuoteInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<OfframpQuote>>;
-  status(offrampId: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<OfframpStatus>>;
-}
-interface PaymentDocumentVerification {
-  readonly documentHash: string;
-  readonly ok: boolean;
-  readonly derivedHash: string;
-  readonly kind: PaymentDocumentKind;
-}
-/**
- * #577 render-on-demand result. `html` is self-contained user-visible document
- * HTML (stylesheet + rendered document). The MCP `paymentDocuments.render` tool
- * exposes only `{documentHash, kind, ok}` to the model and returns `html` in an
- * audience:["user"] content block (#506 redaction matrix).
- */
-interface PaymentDocumentRender {
-  readonly documentHash: string;
-  readonly ok: boolean;
-  readonly kind: PaymentDocumentKind;
-  readonly html: string;
-}
-/**
- * The public Payments surface uses product-level methods. A settled receipt can
- * include `chainId` and `transactionHash`. Internal custody fields stay private.
- */
-interface PaymentsMethods {
-  pay(input: PaymentsPayInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-  retry(paymentId: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly Payment[]>>;
-  createCommitment(input: PaymentsPayInput & {
-    readonly timing: Exclude<PaymentTiming, {
-      readonly kind: "instant";
-    }>;
-  }, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-  claim(paymentId: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-  list(options?: PaymentReadOptions): Promise<CapxulResult<readonly Payment[]>>;
-  get(paymentId: string, options?: PaymentReadOptions): Promise<CapxulResult<Payment | null>>;
-  cancel(paymentId: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-  redirect(input: {
-    readonly paymentId: string;
-    readonly to: TargetReference;
-  }, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-}
-interface PaymentDocumentsMethods {
-  verify(documentHash: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<PaymentDocumentVerification>>;
-  /**
-   * #577: render-on-demand. Loads the owner's stored document by `documentHash`,
-   * re-verifies its EIP-712 hash, and renders it to self-contained HTML using the
-   * verified stored line items. Returns `{documentHash, kind, ok, html}`.
-   */
-  render(documentHash: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<PaymentDocumentRender>>;
-}
-interface FinancialOpsMethods {
-  readonly me: MeMethods;
-  readonly targets: TargetsMethods;
-  readonly destinations: DestinationsMethods;
-  readonly payments: PaymentsMethods;
-  readonly activity: ActivityMethods;
-  readonly offramp: OfframpMethods;
-  readonly paymentDocuments: PaymentDocumentsMethods;
-}
-//#endregion
-//#region src/surface/contacts.d.ts
-type ActorScopeRef = {
-  readonly kind: "account";
-} | {
-  readonly kind: "org";
-  readonly orgId: string;
-};
-interface ActorProfile {
-  readonly actor: ActorScopeRef;
-  readonly displayName: string | null;
-  readonly email?: string;
-  readonly handle?: string;
-}
-/**
- * How a counterparty entered the book, and what they are to the actor today.
- *
- * The first six values are the backend edge provenance VERBATIM (ADR-0022 R2);
- * `employed` is projected from an open employment edge. The pre-substrate
- * union published `requested` (a value that collapsed two directions) and
- * `employee` (a value no backend path ever wrote).
- */
-type AddressBookRelationship = "paid" | "paidBy" | "invoiced" | "invoicedBy" | "member" | "manual" | "employed";
-interface AddressBookEntry {
-  /**
-   * The counterparty's `PartyId`. It is stable: the id you read before a
-   * counterparty signs up is the id you read after (ADR-0022 R1). The old id
-   * was a derived string that changed at signup.
-   */
-  readonly id: PartyId;
-  readonly ref: Ref$1;
-  readonly label: string;
-  readonly relationship: readonly AddressBookRelationship[];
-  readonly hidden: boolean;
-  /** Epoch milliseconds of the most recent activity with this counterparty. */
-  readonly lastActivityAt: number;
-}
-interface AddressBookAddInput {
-  readonly ref: Ref$1;
-  readonly label?: string;
-}
-interface AddressBookLabelInput {
-  readonly entryId: PartyId;
-  readonly label: string;
-}
-interface AddressBookListInput {
-  readonly includeHidden?: boolean;
-}
-/**
- * #1960 R02: the declared option type is the `InvocationControls` these methods
- * have always forwarded to `deps.invocationControls`. Naming it lets a caller
- * that captured one user attempt hand the same `correlation_id`/`journey_id` to
- * the operation the attempt starts. `{ signal }` callers are unaffected.
- */
-interface AddressBookMethods {
-  list(input?: AddressBookListInput, options?: InvocationControls): Promise<CapxulResult<readonly AddressBookEntry[]>>;
-  get(entryId: PartyId, options?: InvocationControls): Promise<CapxulResult<AddressBookEntry | null>>;
-  add(input: AddressBookAddInput, options?: InvocationControls): Promise<CapxulResult<AddressBookEntry>>;
-  hide(entryId: PartyId, options?: InvocationControls): Promise<CapxulResult<AddressBookEntry>>;
-  unhide(entryId: PartyId, options?: InvocationControls): Promise<CapxulResult<AddressBookEntry>>;
-  label(input: AddressBookLabelInput, options?: InvocationControls): Promise<CapxulResult<AddressBookEntry>>;
-}
-interface ActorRequest {
-  readonly id: string;
-  readonly payer?: Ref$1;
-  readonly amount: PaymentMoney;
-  readonly reference: string;
-  readonly status: RequestStatus;
-  readonly expiresAt: number | null;
-}
-interface ActorRequestIssueInput {
-  readonly payer: Ref$1;
-  readonly amount: PaymentMoney;
-  readonly reference: string;
-  readonly memo?: string;
-  readonly expiresAt?: number;
-}
-/**
- * The issuer's own requests. The options are the address book's
- * `InvocationControls` (R07 #1965), so a caller that captured one browser
- * attempt hands it to the operation that attempt started; `{ signal }` callers
- * are unaffected.
- */
-interface ActorRequestsMethods {
-  issue(input: ActorRequestIssueInput, options?: InvocationControls): Promise<CapxulResult<ActorRequest>>;
-  list(options?: InvocationControls): Promise<CapxulResult<readonly ActorRequest[]>>;
-  get(requestId: string, options?: InvocationControls): Promise<CapxulResult<ActorRequest | null>>;
-  cancel(requestId: string, options?: InvocationControls): Promise<CapxulResult<ActorRequest>>;
-}
-interface InboxItem {
-  readonly id: string;
-  readonly issuer: Ref$1;
-  readonly amount: PaymentMoney;
-  readonly reference: string;
-  readonly status: InboxStatus;
-}
-interface InboxApproveInput {
-  readonly requestId: string;
-  readonly timing?: PaymentTiming;
-  readonly permissionId?: string;
-}
-/** The payer's own inbox. Its scope is the payer's, never the issuer's. */
-interface InboxMethods {
-  list(options?: InvocationControls): Promise<CapxulResult<readonly InboxItem[]>>;
-  approve(input: InboxApproveInput, options?: InvocationControls): Promise<CapxulResult<Payment>>;
-  decline(requestId: string, options?: InvocationControls): Promise<CapxulResult<InboxItem>>;
-}
-interface ActorProfileMethods {
-  get(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<ActorProfile>>;
-  /** R08 (#1966): accepts a captured attempt, exactly as the treasury read does. */
-  depositInstructions(options?: InvocationControls): Promise<CapxulResult<DepositInstructions>>;
-}
-interface ActorRelationshipMethods {
-  readonly addressBook: AddressBookMethods;
-  readonly requests: ActorRequestsMethods;
-  readonly inbox: InboxMethods;
-  readonly profile: ActorProfileMethods;
-}
-//#endregion
-//#region src/surface/account.d.ts
-type AccountStatus = {
-  readonly status: "notAuthenticated";
-} | {
-  readonly status: "accountRequired";
-  readonly requirement: AccountRequirement;
-  readonly chainId: number;
-} | {
-  readonly status: "accountProviderReady";
-  readonly requirement: AccountRequirement;
-  readonly chainId: number;
-  readonly source: AccountProviderSource;
-  readonly signerAddress: Address$1;
-} | {
-  readonly status: "accountPrepared";
-  readonly requirement: AccountRequirement;
-  readonly account: SmartAccount;
-  readonly deployment: {
-    readonly status: "counterfactual";
-  };
-} | {
-  readonly status: "accountReady";
-  readonly requirement: AccountRequirement;
-  readonly account: SmartAccount | null;
-  readonly deployment: {
-    readonly status: "counterfactual";
-  } | {
-    readonly status: "deployed";
-    readonly deployedAt: SmartAccount["deployedAt"];
-  };
-};
-/**
- * Public consumer-facing surface (issue #159 · AC1+AC3). Exactly two
- * methods. `provision` and `deploySafe` are intentionally NOT here —
- * they are advanced/testing-only and will live on
- * `client._internal.account` when sibling issue #161 lands. Per
- * `packages/sdk/CONTEXT.md`, the narrowing is enforced at
- * both the type level (the `keyof AccountMethods` extract is exactly
- * `"getStatus" | "ensureReady"`) and at runtime (the bundle returned
- * here has those two own-keys and nothing else).
- *
- * Per `packages/sdk/docs/architecture.md`, the
- * `AccountStatus` discriminant includes variants that are returned only by
- * `getStatus` (for example, `accountPrepared`). It is the durable
- * shape consumers depend on. Sibling #161 will extend `ensureReady` to
- * advance the ladder past `accountProviderReady` and from
- * `accountPrepared` to `accountReady(deployed)`; until then, the type
- * surface is stable and the runtime fixed-point is documented.
- */
-interface AccountMethods extends ActorRelationshipMethods {
-  /**
-   * Post-auth account setup lifecycle — domain vocabulary over the internal
-   * readiness ladder + provisioning lane (#356).
-   */
-  getLifecycle(): Promise<CapxulResult<AccountLifecycle>>;
-  /** Resume setup after `failed` and return the updated lifecycle snapshot. */
-  retrySetup(): Promise<CapxulResult<AccountLifecycle>>;
-  /**
-   * Internal advanced surface (#161 · AC1). Reserved for the rebuild's
-   * own `ensureReady` upward transitions and for testing harnesses;
-   * consumers MUST NOT depend on this in production. Tagged
-   * `@internal-use` per `.claude/rules/flow-internal-substrate.md`.
-   *
-   * @internal-use
-   */
-  readonly _internal: AccountInternalSurface;
-}
-/**
- * Internal `provision` + `deploySafe` arms exposed at
- * `client._internal.account` (#161). Each returns `Promise<CapxulResult<T>>`
- * with the same error catalog the public methods use.
- *
- * @internal-use
- */
-interface AccountInternalSurface {
-  provision(): Promise<CapxulResult<SmartAccount>>;
-  deploySafe(observationSource?: unknown): Promise<CapxulResult<SmartAccount>>;
-  /** @internal-use Substrate readiness ladder — tests and e2e only. */
-  getStatus(): Promise<CapxulResult<AccountStatus>>;
-  /** @internal-use Lane runner — tests and e2e only. */
-  ensureReady(): Promise<CapxulResult<AccountStatus>>;
-  /** @internal-use Provisioning lane phase — tests and e2e only. */
-  getProvisioningPhase(): Promise<CapxulResult<ProvisioningPhase>>;
-  /** @internal-use Lane retry — tests and e2e only. */
-  retryProvisioning(): Promise<CapxulResult<ProvisioningPhase>>;
-}
-//#endregion
-//#region src/surface/onboarding.d.ts
-type PersonOnboardingInput = CompleteProfileInput;
-type ReadyAccountLifecycle = Extract<AccountLifecycle, {
-  readonly status: "ready";
-}>;
-type CompletedPersonProfile = Omit<Profile$1, "displayName" | "handle"> & {
-  readonly displayName: string;
-  readonly handle: string;
-};
-interface PersonOnboarding {
-  readonly profile: CompletedPersonProfile;
-  readonly account: ReadyAccountLifecycle;
-}
-interface OrganizationOnboardingInput {
-  readonly name: string;
-  readonly handle: string;
-  readonly country: string;
-  readonly bio?: string;
-  readonly size?: string;
-}
-interface OrganizationOnboarding {
-  readonly organizationId: string;
-}
-interface OnboardingMethods {
-  completePerson(input: PersonOnboardingInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<PersonOnboarding>>;
-  completeOrganization(input: OrganizationOnboardingInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<OrganizationOnboarding>>;
-}
-//#endregion
-//#region src/surface/accounts.d.ts
-interface AccountsMethods {
-  read(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Account$1>>;
-}
-/**
- * Faucet surface (dev-only). Deliberately OFF the public `AccountsMethods`;
- * reachable only via `client._internal.accounts` (production-surface-policy.md).
- * The reference CLI uses it only in the test environment. Consumers do not see `fund`.
- */
-interface AccountsFaucetMethods {
-  fund(amount: Money, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<{
-    readonly txHash: string;
-  }>>;
-}
-//#endregion
-//#region src/ports/org.d.ts
-type CreateOrgPortInput = {
-  readonly input: CreateOrgInput;
-};
-type ReadOrgTreasuryInput = {
-  readonly orgId: OrgId;
-};
-type ListOrgsInput = Record<never, never>;
-type ListOrgRolesInput = {
-  readonly orgId: OrgId;
-};
-type ListOrgMembersInput = {
-  readonly orgId: OrgId;
-};
-/**
- * R06 (#1964): the program attaches the caller's captured attempt to this
- * record through `copyInvocationObservation`, so the adapter forwards one
- * observation context to the backend action that owns `org_invite_sent`. The
- * carrier is a non-enumerable symbol and never becomes a wire field.
- */
-type InviteOrgMemberInput = {
-  readonly orgId: OrgId;
-  readonly input: InviteMemberInput;
-};
-type ResendOrgInviteTokenInput = {
-  readonly orgId: OrgId;
-  readonly email: string;
-};
-type DetectPendingOrgInvitationsInput = Record<never, never>;
-type DetectPendingOrgInvitationsResult$1 = {
-  readonly matched: readonly OrgId[];
-};
-declare const OrgError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "OrgError";
-} & Readonly<A>;
-declare class OrgError extends OrgError_base<{
-  readonly operation: string;
-  readonly publicCode: CapxulErrorCode;
-  readonly publicError: CapxulError;
-  readonly cause: unknown;
-  readonly details?: CapxulErrorDetails;
-}> {}
-/** The live Organization port creates, reads, and lists Organizations. */
-interface OrgPort {
-  createOrg(input: CreateOrgPortInput): Effect.Effect<OrgView, OrgError, never>;
-  readTreasury(input: ReadOrgTreasuryInput): Effect.Effect<Account$1, OrgError, never>;
-  listOrgs(input: ListOrgsInput): Effect.Effect<readonly OrgView[], OrgError, never>;
-  listRoles(input: ListOrgRolesInput): Effect.Effect<readonly RoleView[], OrgError, never>;
-  listMembers(input: ListOrgMembersInput): Effect.Effect<readonly MemberView[], OrgError, never>;
-  pendingMembers?(input: ListOrgMembersInput): Effect.Effect<readonly MemberView[], OrgError, never>;
-  inviteMember(input: InviteOrgMemberInput): Effect.Effect<MemberView, OrgError, never>;
-  resendInviteToken?(input: ResendOrgInviteTokenInput): Effect.Effect<MemberView, OrgError, never>;
-  detectAndAcceptPendingInvitations(input: DetectPendingOrgInvitationsInput): Effect.Effect<DetectPendingOrgInvitationsResult$1, OrgError, never>;
-}
-//#endregion
-//#region src/surface/org-me.d.ts
-/**
- * One spend authority the Member holds. `limit` is the cap the payment gate
- * enforces on a single payment — `null` means the Budget carries no cap. The
- * amount still available under the cap is not part of this read and is not
- * computable from it.
- */
-interface Budget {
-  readonly id: BudgetId;
-  /** Display name, taken from the Role the grant was motivated by. */
-  readonly label: string;
-  readonly limit: Money | null;
-}
-/**
- * The caller's own standing in one Organization.
- *
- * `role` is `null` when the Role catalog cannot name the Member's Role — a
- * label-less owner is tolerated (ADR-0017), so consumers must render an
- * absent Role rather than invent one.
- *
- * `capabilities` are the two facts the backend actually enforces, and nothing
- * else: managing people, and spending. Payroll and invoice approval are both
- * spending, so both read `canSpend`.
- */
-interface OrgMe {
-  readonly role: {
-    readonly label: string;
-  } | null;
-  readonly capabilities: {
-    readonly canManagePeople: boolean;
-    readonly canSpend: boolean;
-  };
-  /** Named Budgets this Member can spend from. `canSpend` is the authority fact. */
-  readonly budgets: readonly Budget[];
-  readonly observedAt: number;
-}
-type OrgMeOptions = {
-  readonly signal?: AbortSignal;
-};
-type OrgMeMethod = (options?: OrgMeOptions) => Promise<CapxulResult<OrgMe>>;
-//#endregion
-//#region src/contract/permission.d.ts
-interface PermissionReadResult {
-  readonly permissions: readonly Permission[];
-  readonly assignments: readonly PermissionAssignment[];
-}
-//#endregion
-//#region src/surface/permissions.d.ts
-type PermissionOptions = {
-  readonly signal?: AbortSignal;
-};
-type PermissionCreateInput = {
-  readonly requestKey: string;
-  readonly intent: PermissionIntent;
-};
-type PermissionChangeInput = PermissionCreateInput & {
-  readonly permissionId: string;
-};
-type PermissionAssignInput = {
-  readonly requestKey: string;
-  readonly permissionId: string;
-  readonly accountId: string;
-  /** Bind a staff activation to the invited Person at the backend authority boundary. */
-  readonly expectedMemberEmail?: string;
-};
-type PermissionRevokeInput = {
-  readonly requestKey: string;
-  readonly permissionAssignmentId: string;
-};
-type PermissionReplaceInput = {
-  readonly requestKey: string;
-};
-interface PermissionMethods {
-  create(input: PermissionCreateInput, options?: PermissionOptions): Promise<CapxulResult<SubmittedPermissionExecution>>;
-  change(input: PermissionChangeInput, options?: PermissionOptions): Promise<CapxulResult<SubmittedPermissionExecution>>;
-  assign(input: PermissionAssignInput, options?: PermissionOptions): Promise<CapxulResult<SubmittedPermissionExecution>>;
-  revoke(input: PermissionRevokeInput, options?: PermissionOptions): Promise<CapxulResult<SubmittedPermissionExecution>>;
-  replace(input: PermissionReplaceInput, options?: PermissionOptions): Promise<CapxulResult<SubmittedPermissionExecution>>;
-  list(options?: PermissionOptions): Promise<CapxulResult<PermissionReadResult>>;
-  get(permissionId: string, options?: PermissionOptions): Promise<CapxulResult<Permission | null>>;
-}
-//#endregion
-//#region src/surface/organization-payments.d.ts
-interface OrganizationPaymentItemInput {
-  readonly to: Ref$1;
-  readonly amount: PaymentMoney;
-  readonly externalAddressAcknowledged?: true;
-  readonly paymentType?: PaymentType;
-  readonly document?: AttachablePaymentDocumentEnvelopeV1;
-}
-interface OrganizationPaymentInput extends OrganizationPaymentItemInput {
-  readonly permissionId: string;
-  readonly lineage?: PaymentCommandLineage;
-}
-interface OrganizationPaymentBatchInput {
-  readonly permissionId: string;
-  readonly items: readonly OrganizationPaymentItemInput[];
-  readonly lineage?: PaymentCommandLineage;
-}
-interface OrganizationPaymentsMethods {
-  pay(input: OrganizationPaymentInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-  payBatch(input: OrganizationPaymentBatchInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly Payment[]>>;
-  retry(paymentId: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly Payment[]>>;
-}
-//#endregion
-//#region src/surface/payroll.d.ts
-/** ADR-0022 R9: where the run stands on the shipped command lifecycle. */
-type PayrollRunStatus = PayrollRunStatus$1;
-/** One authorized payroll run. `total` is the sum of its items' nets. */
-interface PayrollRun {
-  readonly id: PayrollRunId;
-  readonly status: PayrollRunStatus;
-  /** Epoch milliseconds. An instant run has `periodStart === periodEnd`. */
-  readonly periodStart: number;
-  readonly periodEnd: number;
-  readonly total: Money;
-  readonly recipientCount: number;
-}
-/**
- * An organization's runs, newest first, with the month total beside them.
- *
- * The aggregate travels WITH the list because the backend computes it over
- * every settled run in the calendar month while the list is one page. A
- * consumer that summed `runs` would under-report an employer past the page.
- */
-interface PayrollRuns {
-  readonly runs: readonly PayrollRun[];
-  /** Σ net of the runs that SETTLED this calendar month — the "Paid This Month" fact. */
-  readonly settledThisMonth: Money;
-}
-/**
- * One saved recipient on a group. `amount` is the employer's TYPED text, not
- * minor units: a group is a draft the run composer prefills, and the run
- * engine is the one place that parses an amount into money.
- */
-interface PayrollGroupMember {
-  /** The recipient's `PartyId` — the stable id (ADR-0022 R1), never an email. */
-  readonly partyId: string;
-  readonly amount: string;
-  readonly currency: CurrencyCode;
-}
-/** A saved roster the employer pays again. Server-held, so every member sees it. */
-interface PayrollGroup {
-  readonly id: PayrollGroupId;
-  readonly name: string;
-  /** A stored display preference; the consumer narrows it to its own union. */
-  readonly tone: string;
-  readonly members: readonly PayrollGroupMember[];
-}
-/** What a rate is counted PER (ADR-0022 R7). The substrate holds no cadence. */
-type PayrollTermsUnit = PayrollTermsUnit$1;
-/**
- * The rate in force for one open engagement, read at the moment of the call.
- *
- * Terms are versioned and insert-only, so this is a snapshot of a history: a
- * raise inserts a later row and the next read states the new rate. The SDK
- * derives NOTHING from it — ruling Q3 puts the prefill rule (which unit applies
- * over which period) in the run composer, and Capxul computes no pay.
- */
-interface PayrollEngagementTerms {
-  /** The EMPLOYEE's `PartyId` — the key an `.Amounts` row is found by. */
-  readonly partyId: string;
-  /** Minor units counted in `decimals`; never a float. */
-  readonly rate: string;
-  readonly unit: PayrollTermsUnit;
-  readonly currency: CurrencyCode;
-  readonly decimals: number;
-  /** Epoch milliseconds — when this rate took effect. */
-  readonly effectiveFrom: number;
-}
-/** `id` absent creates a group; `id` present replaces that group in place. */
-interface PayrollGroupInput {
-  readonly id?: PayrollGroupId;
-  readonly name: string;
-  readonly tone: string;
-  readonly members: readonly PayrollGroupMember[];
-}
-/**
- * One person on one run. `net` is what they are paid; `gross` plus every
- * adjustment must equal it (ADR-0022 R8) and the backend refuses a run where
- * it does not. Both are minor-unit strings; an adjustment is signed.
- */
-interface PayrollRunItemInput {
-  /**
-   * The recipient. An email `Ref` or a party `Ref` in v1 — the backend refuses
-   * any other kind, because the recipient is what the party is DERIVED from.
-   */
-  readonly to: Ref$1;
-  /**
-   * The caller's ASSERTION of the party `to` resolves to, never the authority
-   * for it. The backend resolves `to` — an email through the invite path's
-   * person-party ensure, a party `Ref` through the same recipient resolution
-   * the batch runs — and refuses the run when this id is not that party, so
-   * the money, the `employed` edge and the payslip's employee can never name
-   * three different people.
-   */
-  readonly partyId: string;
-  readonly gross: string;
-  readonly net: string;
-  readonly adjustments: readonly {
-    readonly label: string;
-    readonly amount: string;
-  }[];
-}
-interface AuthorizeRunInput {
-  /** The Budget the run spends from. The caller selects it; nothing is picked for them. */
-  readonly permissionId: string;
-  /** Epoch milliseconds. An instant run passes `start === end` — the payslip renders the date. */
-  readonly period: {
-    readonly start: number;
-    readonly end: number;
-  };
-  readonly items: readonly PayrollRunItemInput[];
-  /**
-   * Supply one to reuse a key minted elsewhere. Left absent, the shipped
-   * fingerprint lifecycle derives it from this intent, so a retry of the same
-   * run replays the SAME command instead of paying twice.
-   */
-  readonly requestKey?: string;
-}
-/**
- * R13 (#1968): the declared option type is the `InvocationControls` these
- * methods have always forwarded to `deps.invocationControls` — the same naming
- * R02 gave the address book. It lets a caller that captured one browser attempt
- * hand that attempt's `correlation_id`/`journey_id` to the payroll operation it
- * starts, so `ui_payroll_action_completed` and the durable group and run events
- * share a correlation. `{ signal }` callers are unaffected.
- */
-type PayrollOptions = InvocationControls;
-type AuthorizeRunOptions = PayrollOptions & {
-  /** Persist this SDK-allocated key before the first backend write. Reject to prevent execution. */
-  readonly onRequestKey?: (key: string) => void | Promise<void>;
-  /** A prior command is conclusively closed. The current failed result remains a failure. */
-  readonly onResolved?: (outcome: "failed" | "settled") => void | Promise<void>;
-};
-interface PayrollGroupsMethods {
-  list(options?: PayrollOptions): Promise<CapxulResult<readonly PayrollGroup[]>>;
-  save(input: PayrollGroupInput, options?: PayrollOptions): Promise<CapxulResult<PayrollGroup>>;
-  remove(id: PayrollGroupId, options?: PayrollOptions): Promise<CapxulResult<void>>;
-}
-interface PayrollMethods {
-  runs(options?: PayrollOptions): Promise<CapxulResult<PayrollRuns>>;
-  authorizeRun(input: AuthorizeRunInput, options?: AuthorizeRunOptions): Promise<CapxulResult<PayrollRun>>;
-  /** The active engagement terms of the org's employed people (ruling Q3). */
-  terms(options?: PayrollOptions): Promise<CapxulResult<readonly PayrollEngagementTerms[]>>;
-  readonly groups: PayrollGroupsMethods;
-}
-//#endregion
-//#region src/surface/org.d.ts
-/** The membership state for one Organization member. */
-type MemberStatus = "pending" | "pending_safe" | "pending_grant" | "active" | "revoked" | "expired";
-/** One Organization that the current user can access. */
-type OrgView = {
-  readonly creationSource?: TesterKind;
-  readonly id: OrgId;
-  readonly name: string;
-  readonly handle: string;
-  readonly safeAddress: Address$1;
-  /** The viewing member's own role label within this org. */
-  readonly role: string;
-  /** The Organization treasury Account. */
-  readonly treasury: Account$1;
-  /** #1064: onboarding-collected description + size bucket; null when unset. */
-  readonly bio: string | null;
-  readonly size: string | null;
-  /** #1061 / ADR-0014: logo serving URL resolved at read time; null when unset. */
-  readonly logoUrl: string | null;
-};
-interface OrganizationAccount {
-  readonly id: string;
-  readonly address: string | null;
-  readonly balance: Money;
-  readonly available: Money;
-}
-interface OrganizationAuditLogItem {
-  readonly id: string;
-  readonly organizationId: string;
-  readonly action: string;
-  readonly actor: string | null;
-  readonly summary: string;
-  readonly createdAt: number;
-  readonly metadata?: Record<string, unknown>;
-}
-/**
- * One Organization member. `personalSafeAddress` is the member identity key. It
- * is `null` while the member is still `pending` (emailed into existence but not
- * yet provisioned a personal Safe). `email` is the universal entry point.
- */
-type MemberView = {
-  readonly orgId: OrgId;
-  readonly email: Email;
-  readonly name: string | null;
-  /** Member identity key. `null` until the invitee provisions a Safe. */
-  readonly personalSafeAddress: Address$1 | null;
-  /** The member role label maps to the on-chain `roleKey`. */
-  readonly role: string;
-  readonly roleKey: RoleKey | null;
-  readonly status: MemberStatus;
-  readonly grantTxHash: string | null;
-  readonly revokeTxHash: string | null;
-};
-/** A role spend cap that Zodiac Roles and Allowance enforce on-chain. */
-type RoleSpendCap = {
-  readonly perTx?: Money;
-  readonly perDay?: Money;
-  readonly toRecipients?: "anyone" | readonly Address$1[];
-};
-/** A Capxul Role definition. */
-type RoleDefinition = {
-  readonly label: string;
-  readonly spend?: RoleSpendCap;
-  readonly canSpend?: boolean;
-  readonly canManageMembers?: boolean;
-  readonly canManageRoles?: boolean;
-};
-/**
- * One role a member can be invited into on an Organization — a role that
- * carries member-management authority. A Budget is granted, never offered as a
- * job title (ADR-0024 R5), so it never appears here.
- * `roleKey` is the on-chain bytes32 role key derived from the label. `definition`
- * is the full Role DSL entry.
- */
-type RoleView = {
-  readonly orgId: OrgId;
-  readonly label: string;
-  readonly roleKey: RoleKey;
-  readonly definition: RoleDefinition;
-};
-/**
- * The role template a new Organization is created from. Creation supports
- * exactly one shape — a single founding owner (ADR-0024 R8). Any other value
- * is REFUSED with `WRONG_STATE`.
- */
-type OrgTemplate = "Solo";
-/**
- * Input to `capxul.createOrg`. `name` is the display name.
- * `handle` uses the shared global Handle grammar (`^[a-z0-9_-]{3,30}$`).
- * `template` seeds the initial role set. `country` is stored without validation.
- */
-type CreateOrgInput = {
-  readonly name: string;
-  readonly handle: string;
-  readonly template: OrgTemplate;
-  readonly country?: string;
-};
-/**
- * Input to `org(orgId).invite`. Email is the universal entry point.
- * An address that is not yet a Capxul user creates a `pending`
- * membership that resolves on sign-in. `role` is invitation metadata. It does
- * not grant an on-chain Permission.
- */
-type InviteMemberInput = {
-  readonly email: string;
-  readonly role: string;
-};
-type ResendInviteTokenInput = {
-  readonly email: string;
-};
-/** Organization ids whose pending invitations match the current Account. */
-type DetectPendingOrgInvitationsResult = {
-  readonly matched: readonly OrgId[];
-};
-/** Organization methods for one `orgId`. */
-interface OrgScopedMethods extends ActorRelationshipMethods {
-  /**
-   * The caller's own standing in this Organization — Role, the two enforced
-   * capabilities, and the Budgets they can spend from. A caller who is not an
-   * active Member is refused, not reported as a Member without capabilities.
-   */
-  readonly me: OrgMeMethod;
-  /** Observe the durable, leak-safe lifecycle for this Organization only. */
-  getLifecycle(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<OrgLifecycle>>;
-  /** Explicitly resume this Organization's durable setup lane. */
-  retrySetup(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<OrgLifecycle>>;
-  /**
-   * The Organization treasury Account. R08 (#1966): the declared option type is
-   * the `InvocationControls` this surface already forwards, so a screen that
-   * captured one user attempt can hand the same `correlation_id`/`journey_id`
-   * to the read it starts. `{ signal }` callers are unaffected.
-   */
-  treasury(options?: InvocationControls): Promise<CapxulResult<Account$1>>;
-  readonly account: {
-    get(options?: InvocationControls): Promise<CapxulResult<OrganizationAccount>>;
-  };
-  members(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly MemberView[]>>;
-  roles(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly RoleView[]>>;
-  /**
-   * Invite a member by email. `options` is the browser attempt the caller
-   * captured before the person pressed the button (R06 #1964); it reaches the
-   * backend action unchanged, so the durable `org_invite_sent` and the later
-   * `org_invite_progressed` share the attempt's correlation. `{ signal }`
-   * callers are unaffected.
-   */
-  invite(input: InviteMemberInput, options?: InvocationControls): Promise<CapxulResult<MemberView>>;
-  /**
-   * Leak-safe Organization payment: execute through the payments engine with
-   * the selected receipt-verified Budget Permission
-   * and return a `Payment` (no `to: Address`, no `txHash`, no Safe / userOp
-   * internals). Writes a real `payments` row (`source:"org"`).
-   */
-  readonly permissions: PermissionMethods;
-  readonly payments: OrganizationPaymentsMethods;
-  /**
-   * Pay the team: the runs this Organization has authorized, the verb that
-   * authorizes one, and the saved groups a run is composed from (#1452).
-   * `authorizeRun` is a payment command like any other — same Budget gate,
-   * same signature, same request-key idempotency.
-   */
-  readonly payroll: PayrollMethods;
-  auditLog(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly OrganizationAuditLogItem[]>>;
-}
-type OrgsMethod = {
-  (options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly OrgView[]>>;
-  detectAndAcceptPendingInvitations(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<DetectPendingOrgInvitationsResult>>;
-};
-/**
- * Top-level Org method bundle, exposed at `client.org` / `client.orgs` /
- * `client.createOrg`. `org(orgId)` resolves the entity-scoped bundle.
- */
-interface OrgMethods {
-  createOrg(input: CreateOrgInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<OrgView>>;
-  readonly orgs: OrgsMethod;
-  /** Resolve the entity-scoped bundle for a specific Organization. */
-  org(orgId: OrgId): OrgScopedMethods;
-}
-//#endregion
-//#region src/surface/current-user.d.ts
-interface CurrentUserContext {
-  readonly user: {
-    readonly id: string;
-    readonly email: string;
-    readonly displayName: string | null;
-    readonly handle: string | null;
-    readonly paymentLink: {
-      readonly handle: string;
-      readonly url: string;
-    } | null;
-  };
-  readonly personalAccount: {
-    readonly id: string;
-    readonly address: string | null;
-  } | null;
-  readonly organizations: readonly {
-    readonly id: string;
-    readonly name: string;
-    readonly handle: string;
-    readonly role: string;
-    readonly account: {
-      readonly id: string;
-      readonly address: string | null;
-    } | null;
-  }[];
-}
-interface CurrentUserMethods {
-  get(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<CurrentUserContext>>;
-}
-//#endregion
-//#region src/surface/media.d.ts
-interface MediaMethods {
-  uploadImage(blob: Blob, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<{
-    readonly storageId: string;
-  }>>;
-  setProfileImage(input: {
-    readonly storageId: string;
-  }, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<{
-    readonly imageUrl: string | null;
-  }>>;
-  setOrgLogo(input: {
-    readonly orgId: string;
-    readonly storageId: string;
-  }, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<{
-    readonly logoUrl: string | null;
-  }>>;
-}
-//#endregion
-//#region src/contract/system.d.ts
-/** What `system:healthObserved` answers. */
-interface SystemHealth {
-  /** The nonce the caller sent, as the backend saw it. */
-  readonly nonce: string;
-  /** Deployment that answered, e.g. `api` for the Railway staging host. */
-  readonly deployment: string;
-  /** Backend clock at execution (epoch ms). */
-  readonly at: number;
-}
-//#endregion
-//#region src/surface/system.d.ts
-interface SystemMethods {
-  health(nonce: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<SystemHealth>>;
-}
-//#endregion
-//#region src/domain/money/primary-holding.d.ts
-/**
- * The one asset a screen shows when it can show only one. `symbol` is the
- * TOKEN symbol the chain reported (`"USDX"`); `available.currency` is the
- * consumer `CurrencyCode` that token stands for (`"USD"`). They are separate
- * fields because they are separate facts.
- */
-interface Holding {
-  readonly id: string;
-  readonly symbol: string;
-  readonly available: Money;
-}
-//#endregion
-//#region src/surface/holdings.d.ts
-interface HoldingsMethods {
-  current(input?: {
-    readonly actor?: ActorReference;
-  }, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<CurrentHoldings>>;
-  /**
-   * The designated display asset — the payable row holding the most money, or
-   * `null` when the snapshot carries no renderable row. Reads the same
-   * snapshot as `current` and picks from it; an empty answer is a value, not
-   * an error.
-   */
-  primary(input?: {
-    readonly actor?: ActorReference;
-  }, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Holding | null>>;
-}
-//#endregion
-//#region src/surface/_shared/effect-actor-bridge.d.ts
-type IdentityFacadeVerb = "requestCode" | "verifyCode" | "signOut" | "createOrganization" | "completePersonal" | "retry";
-//#endregion
-//#region src/surface/create-capxul-client.d.ts
-type OrganizationSetupProofReceipt = {
-  readonly state: "submitted";
-  readonly orgId: string;
-  readonly chainId: number;
-  readonly signerEoa: string;
-  readonly founderAccount: string;
-  readonly organizationAccount: string;
-  readonly userOperationHash: string;
-  readonly submittedAt: number;
-  readonly attempt: number;
-} | {
-  readonly state: "confirmed";
-  readonly orgId: string;
-  readonly chainId: number;
-  readonly signerEoa: string;
-  readonly founderAccount: string;
-  readonly organizationAccount: string;
-  readonly userOperationHash: string;
-  readonly submittedAt: number;
-  readonly attempt: number;
-  readonly confirmationTransactionHash: string;
-  readonly readyAt: number;
-};
-type OrganizationSetupProofMethods = {
-  readonly getProofReceipt: (orgId: string) => Promise<CapxulResult<OrganizationSetupProofReceipt | null>>;
-};
-type IdentityRuntimeSendResult = {
-  readonly ok: true;
-  readonly state: IdentityState;
-} | {
-  readonly ok: false;
-  readonly refused: CapxulErrorCode;
-  readonly state: IdentityState;
-};
-type IdentityProfileDetails = {
-  readonly displayName: string;
-  readonly country: string;
-  readonly handle: string;
-  /**
-   * #1955: the storage id `useCapxulUploadImage` handed back on file pick, and
-   * the payout addresses the form collected. The create call carries them, so
-   * the backend binds the photo and writes the rails in the same durable step.
-   */
-  readonly imageStorageId?: string;
-  readonly payoutAddresses?: readonly PayoutAddress[];
-};
-interface IdentityRuntime {
-  readonly snapshot: () => IdentityState;
-  readonly subscribe: IdentityActor["subscribe"];
-  readonly subscribeTransitions: IdentityActor["subscribeTransitions"];
-  readonly send: (event: IdentityEvent, controls?: InvocationControls) => Promise<IdentityRuntimeSendResult>;
-  readonly completeProfile: (profile: IdentityProfileDetails, controls?: InvocationControls) => Promise<{
-    readonly ok: true;
-  } | {
-    readonly ok: false;
-    readonly reason: CapxulErrorCode;
-    readonly error?: CapxulError;
-  }>;
-  /** @internal Optional facade bridge for consumer test doubles. */
-  readonly runFacade?: <T>(verb: IdentityFacadeVerb, controls: InvocationControls | undefined, run: (controls: InvocationControls) => Promise<T>) => Promise<T>;
-}
-interface CapxulClient {
-  /** Stop this client's resources. Repeated calls share the same cleanup. */
-  close(): Promise<CapxulResult<void>>;
-  readonly auth: AuthMethods;
-  readonly smartAccount: SmartAccountMethods;
-  readonly identity: IdentityMethods;
-  readonly onboarding: OnboardingMethods;
-  /** `health(nonce)` returns the nonce from the configured deployment. Use it to verify backend liveness before sign-in. */
-  readonly system: SystemMethods;
-  /**
-   * Consumer-facing account readiness surface (issue #159 · AC1+AC3).
-   * Exactly `getStatus` + `ensureReady`; the `_internal.account`
-   * namespace with `provision` + `deploySafe` lands in sibling #161.
-   */
-  readonly account: AccountMethods;
-  /**
-   * Consumer-facing Account money read.
-   * Returns `{ balance, available }` as `Money` — never wei or token units.
-   */
-  readonly accounts: AccountsMethods;
-  readonly currentUser: CurrentUserMethods;
-  readonly me: MeMethods;
-  readonly targets: TargetsMethods;
-  readonly destinations: DestinationsMethods;
-  /**
-   * Direct Payments surface. `pay` records a validated-recipient
-   * payment; `list`/`get` read the ledger; `markSettled` is the host-execution
-   * callback.
-   */
-  readonly payments: PaymentsMethods;
-  readonly activity: ActivityMethods;
-  readonly holdings: HoldingsMethods;
-  readonly offramp: OfframpMethods;
-  /** Re-derive a Payment document EIP-712 hash. */
-  readonly paymentDocuments: PaymentDocumentsMethods;
-  /**
-   * Media surface (#1061 / ADR-0014): profile-image + org-logo upload/record.
-   */
-  readonly media: MediaMethods;
-  /**
-   * Organization domain surface.
-   * `createOrg(input)` creates an Org; `orgs()` lists the Orgs you belong to;
-   * `org(orgId)` resolves the entity-scoped bundle (treasury / members / roles,
-   * invitations, Permissions, and payments). Explicit entity scoping —
-   * It has no stateful active context.
-   */
-  readonly createOrg: OrgMethods["createOrg"];
-  readonly orgs: OrgMethods["orgs"];
-  readonly org: OrgMethods["org"];
-  /**
-   * Observable signer readiness (ACCESS #1520 · C12). `status()` reads the
-   * current `SignerStatus`. `subscribe` fires on every change and returns its
-   * own unsubscribe. Only the Openfort browser signer runs a readiness cycle.
-   * Every other signer reports `"unknown"`, so a gate that reads this fails
-   * closed. This is an observation surface, not a domain method: it performs no
-   * work and cannot fail, so it returns a value rather than a `CapxulResult`.
-   * It is not a public React surface — the action part that needs it reads this.
-   */
-  readonly signer: SignerStatusStore;
-  /**
-   * Internal identity integration runtime. It is consumed by
-   * `@capxul/sdk-react`, not exported as the actor substrate itself.
-   *
-   * @internal-use
-   */
-  readonly _internal: {
-    readonly identity: IdentityRuntime;
-    /**
-     * Resolved bootstrap for this client instance (chain, auth URLs, etc.).
-     * Off the public surface per production-surface-policy.md (#31).
-     */
-    readonly bootstrap: BootstrapResolution;
-    /**
-     * Dev-only faucet bundle (production-surface-policy.md). `fund` lives here,
-     * NOT on the public `client.accounts` surface.
-     */
-    readonly accounts: AccountsFaucetMethods;
-    /**
-     * Ponder read seam (P02). Present only when the client was built with an
-     * indexer origin, so every reader treats it as optional. Ponder holds what
-     * the chain said; Convex holds what the user meant. Reads here never run
-     * inside a write path and never wait for a finality tag.
-     */
-    readonly indexer?: IndexerReadPort;
-    /** Quarantined Reference-harness evidence; never a product Organization method. */
-    readonly organizationSetup: OrganizationSetupProofMethods;
-    /** Product telemetry projection for internal composition and test harnesses. */
-    readonly telemetry?: TelemetryPort;
-    readonly captureExternalAddressAcknowledged: (address: string, organizationId?: string) => void;
-    readonly close?: () => Promise<void>;
-  };
-}
-interface CreateCapxulClientInput {
-  /**
-   * The 10-port `FlowPorts` bundle. The identity actor uses its auth, clock,
-   * identity, smart-account, and telemetry seams internally; the remaining
-   * method bundles consume the same canonical port authorities.
-   */
-  readonly ports: FlowPorts;
-  /**
-   * Bootstrap resolution for this client instance. The factory closes over
-   * `bootstrap.chainId` internally; consumers do not pass a standalone
-   * chainId and no method boundary accepts one.
-   */
-  readonly bootstrap: BootstrapResolution;
-  /**
-   * Optional AuthCachePort. When omitted, `detectAuthCacheAdapter()` selects
-   * the appropriate per-environment adapter (Browser/FileSystem/InMemory).
-   */
-  readonly authCache?: AuthCachePort;
-  /**
-   * Optional AbortSignal reserved for callers that coordinate client lifetime.
-   */
-  readonly signal?: AbortSignal;
-  /**
-   * OTP TTL window in ms. Default 300_000 (5 min).
-   */
-  readonly otpTtlMs?: number;
-  /**
-   * Optional per-call timeout for invoked auth requests.
-   */
-  readonly invokeTimeoutMs?: number;
-  /**
-   * Init-time account readiness target (issue #159 · AC4). The factory
-   * closes over this so `client.account.{getStatus,ensureReady}` don't
-   * need to take a per-call requirement arg. REQUIRED — there is no
-   * hidden default. Consumers building flows that never need a smart
-   * account pass `"none"`; flows that want a counterfactual deposit
-   * address pass `"counterfactual"`; flows that need an on-chain Safe
-   * pass `"deployed"` (deploy path lands in sibling #161).
-   */
-  readonly requirement: AccountRequirement;
-  /**
-   * Consumer-held signer (backend-orchestrated-deploy.md). Required for
-   * `requirement: "deployed"` flows: `provision` reads `getAddress()` and the
-   * deploy path signs the backend's SafeOp digest via `signUserOpHash()`. The
-   * backend orchestrates build + gas + paymaster + submit — the client never
-   * holds an RPC URL, a gas-sponsorship policy, or a bundler.
-   */
-  readonly signer?: CapxulSigner;
-  /**
-   * Optional live Organization deployment. When supplied, `client.createOrg` and `org(id).treasury`
-   * run the live path (real deploy + on-chain balance); when omitted, the
-   * hermetic `$0` path runs (a fresh Org has no on-chain funds). The adapter
-   * that CONSTRUCTS this port (deployer key + RPC + authenticated Convex seam)
-   * is wired by the CLI deploy-stack; the factory only threads it through.
-   */
-  readonly orgDeploymentPort?: OrgPort;
-  /** Preferred Organization deployment data port. */
-  readonly orgPort?: OrgPort;
-  /**
-   * Internal Organization lifecycle capability. The Core SDK owns its
-   * choreography; production composition supplies the provider/backend steps.
-   */
-  readonly organizationSetup?: OrganizationSetupOps;
-  readonly orgDeploymentConfig?: SafeDeploymentConfig;
-  /** Internal runner carrying the composition root's logger/tracer references. */
-  readonly effectRunner?: {
-    readonly runSync: <A, E>(effect: Effect.Effect<A, E>) => A;
-    readonly runPromise: <A, E>(effect: Effect.Effect<A, E>) => Promise<A>;
-  };
-}
-//#endregion
-//#region ../observability/src/engineering-delivery.d.ts
-type MetricEntry = Metric.Metric.Metadata<unknown, unknown>;
-interface CliEngineeringStats {
-  readonly records: number;
-  readonly reservedRecordBytes: number;
-  readonly peakRecords: number;
-  readonly peakReservedRecordBytes: number;
-  readonly activeRequests: number;
-  readonly requestBytes: number;
-  readonly peakRequests: number;
-  readonly peakRequestBytes: number;
-  /** Rejected records, fields, metric registrations and export attempts; not delivered-event count. */
-  readonly dropped: number;
-  readonly metricSeries: number;
-}
-/** Shared, closure-owned admission state; no queue or mutable counters are exposed. */
-declare function makeCliEngineeringBudget(): Readonly<{
-  metricRegistry: Map<string, MetricEntry>;
-  emptyMetricRegistry: () => Map<string, MetricEntry>;
-  drop: () => void;
-  admitRecord(terminal: boolean): (() => void) | undefined;
-  admitRequest(bytes: number, terminal: boolean): (() => void) | undefined;
-  snapshot(): CliEngineeringStats;
-}>;
-type CliEngineeringBudget = ReturnType<typeof makeCliEngineeringBudget>;
-//#endregion
-//#region src/host-observability.d.ts
-/** One host-owned observability module at the SDK consumer boundary. */
-interface HostObservability {
-  readonly failures: ObservationAdapter;
-  readonly product: TelemetryPort;
-}
-interface PostHogObservabilityClient {
-  capture(event: string, properties?: Readonly<Record<string, unknown>>): unknown;
-  captureException?(exception: Error, properties?: Readonly<Record<string, unknown>>): unknown;
-  identify?(distinctId: string, properties?: Readonly<Record<string, unknown>>): unknown;
-  group?(groupType: string, groupKey: string, properties?: Readonly<Record<string, unknown>>): unknown;
-  reset?(): unknown;
-}
-interface PostHogObservabilityOptions {
-  /** Consent / kill-switch seam. Defaults to enabled. */
-  readonly enabled?: boolean | (() => boolean);
-  /** Omission preserves bootstrap engineering. False/throw closes the acquired runtime's collection. */
-  readonly engineeringEnabled?: boolean | (() => boolean);
-  /** Opt in to code/timing/correlation-only engineering exports. Omission preserves full safe diagnostics. */
-  readonly engineeringPrivacy?: "minimal";
-  /** Shared CLI-only admission and transport budget; omitted for other hosts. */
-  readonly engineeringDeliveryBudget?: CliEngineeringBudget;
-  /** Host environment stamped on every SDK-owned product event. */
-  readonly capxulEnv?: CapxulEnv;
-  /** Host-owned correlation context shared by product and failure delivery. */
-  readonly context?: ObservationContext | (() => ObservationContext | undefined);
-}
-/** Build the SDK's one host module around an already-initialized PostHog client. */
-declare function postHogObservability(client: PostHogObservabilityClient | null | undefined, options?: PostHogObservabilityOptions): HostObservability;
-//#endregion
-//#region src/observation.d.ts
-/** Host-owned correlation fields that are safe to attach to an SDK failure. */
-interface ObservationContext extends Omit<WireObservationContext, "applicationId"> {}
-/**
- * The SDK-owned failure envelope delivered to observation adapters. It carries
- * the real error message, the `CapxulError.details` object, the cause chain,
- * and the stack. Secret material (keys, tokens, bearer headers) is masked;
- * nothing else is withheld. Ruling 2026-09-01: an operator reading an issue
- * needs the actual failure, not a placeholder.
- */
-interface SdkFailureObservation {
-  readonly exception: Error;
-  readonly sdkVersion: string;
-  readonly operation: string;
-  readonly errorKind: string;
-  /** Invocation snapshot; failure correlation wins over later host state. */
-  readonly context?: ObservationContext;
-  /** Enumerated discriminators from `CapxulError.details`, in property shape. */
-  readonly detail?: SdkFailureDetail;
-  /** The error's own message, secrets masked. */
-  readonly message?: string;
-  /** The full `CapxulError.details` object, secrets masked, JSON-safe. */
-  readonly details?: Readonly<Record<string, unknown>>;
-  /** Messages down the `cause` chain, outermost first, secrets masked. */
-  readonly causeChain?: readonly string[];
-  /** The original stack when the error had one, secrets masked. */
-  readonly stack?: string;
-}
-/**
- * The PII-safe subset of `CapxulError.details`, already in PostHog property
- * shape. `provider` + `provider_operation` name the failing dependency
- * (`convex bootstrap`, `openfort configure`). `provider_error_source` names
- * the owner of an allow-listed `provider_error_code`. `failure_mode` / `reason`
- * are enumerated codes. `http_status` is the upstream status. Anything else on
- * `details` (ids, field names, free text) is dropped at the boundary.
- */
-interface SdkFailureDetail {
-  readonly provider?: string;
-  readonly provider_operation?: string;
-  readonly provider_error_source?: string;
-  readonly provider_error_code?: string;
-  readonly target_host?: string;
-  readonly failure_mode?: string;
-  readonly reason?: string;
-  readonly http_status?: number;
-  readonly connection_id?: string;
-  readonly connection_count?: number;
-  readonly connection_retries?: number;
-  readonly close_code?: number;
-  readonly close_was_clean?: boolean;
-  readonly close_reason_present?: boolean;
-  readonly document_visibility?: string;
-  readonly navigator_online?: boolean;
-  readonly last_browser_event?: string;
-  readonly ms_since_browser_event?: number;
-  /** ADR-0023 R7: the chain cause, flat, same keys as every other producer. */
-  readonly chain_upstream?: string;
-  readonly chain_method?: string;
-  readonly chain_retryable?: boolean;
-  readonly chain_http_status?: number;
-  readonly chain_rpc_code?: number;
-  readonly chain_revert_name?: string;
-  readonly chain_revert_selector?: string;
-  readonly chain_revert_args?: Readonly<Record<string, string>>;
-  readonly chain_provider_message?: string;
-  /** #1818: the attempt sequence and the refusing upstream's headers, same bounds as the backend. */
-  readonly chain_attempts?: readonly SdkChainAttempt[];
-  readonly chain_response_headers?: Readonly<Record<string, string>>;
-}
-/** One upstream tried, flat: the `chain_attempts` entry shape on every producer's row. */
-interface SdkChainAttempt {
-  readonly upstream: string;
-  readonly failure_mode: string;
-  readonly http_status?: number;
-  readonly rpc_code?: number;
-  readonly duration_ms: number;
-}
-type ObservationDelivery = void | PromiseLike<void>;
-/**
- * High-level host observation boundary. The SDK owns when each method is
- * called; the host owns the destination client, consent, and delivery policy.
- */
-interface ObservationAdapter {
-  /**
-   * Optional read-only invocation context. Transport adapters snapshot it once
-   * at call start; implementations must not mutate global SDK state.
-   */
-  readonly resolveContext?: () => ObservationContext | undefined;
-  /** A method returned the SDK's typed `{ ok: false, error }` result. */
-  captureOperationFailure(failure: SdkFailureObservation): ObservationDelivery;
-  /** A method unexpectedly threw or rejected instead of returning a typed result. */
-  captureException(exception: SdkFailureObservation): ObservationDelivery;
-}
-/** Stable PostHog event used for typed failures that are expected product outcomes. */
-declare const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
-//#endregion
-//#region src/ports/diagnostic.d.ts
-type DiagnosticDetail = Readonly<Record<string, unknown>>;
-interface DiagnosticPort {
-  readonly trace: (scope: string, detail: DiagnosticDetail) => void;
-}
-//#endregion
-//#region src/openfort/create-openfort-browser-signer.d.ts
-interface OpenfortBrowserSignerOptions {
-  readonly diagnostic?: DiagnosticPort;
-  /** Testing seam below the existing one-retry recovery owner. */
-  readonly signUserOpHash?: ((hash: Parameters<CapxulSigner["signUserOpHash"]>[0], delegate: CapxulSigner["signUserOpHash"]) => ReturnType<CapxulSigner["signUserOpHash"]>) | undefined;
-}
-//#endregion
-//#region src/production.d.ts
-/**
- * Consumer-facing `createCapxulClient` input (SDK DX public surface · #326).
- * The publishable key is the primary input; bootstrap host, invoke timeout,
- * runtime detection, and auth-cache selection are SDK-owned defaults.
- */
-interface CapxulClientInput {
-  readonly publishableKey: string;
-  /** Public Capxul bootstrap origin; defaults remain unchanged when omitted. */
-  readonly bootstrapBaseUrl?: string;
-  /**
-   * One host-owned product/failure observability module around the host's
-   * existing analytics client. Omit for zero host observation work.
-   */
-  readonly observability?: HostObservability;
-  /**
-   * Init-time account readiness target (issue #159 · AC4). Threaded into
-   * `assembleCapxulClient` so `client.account.{getStatus,ensureReady}` reflect
-   * the consumer's chosen requirement. Optional — defaults to `"none"` (SDK
-   * publish readiness · I3) so `createCapxulClient({ publishableKey })` works
-   * with no account lane.
-   */
-  readonly requirement?: AccountRequirement;
-  /**
-   * Consumer-held signer (backend-orchestrated-deploy.md). Required for
-   * `requirement: "deployed"` flows: `provision` reads `getAddress()` and the
-   * deploy path signs the backend's SafeOp digest via `signUserOpHash()`. The
-   * backend orchestrates build + gas + paymaster + submit — the client never
-   * holds an RPC URL, a gas-sponsorship policy, or a bundler.
-   */
-  readonly signer?: CapxulSigner;
-}
-/** Per-client signing controls; only the testing entry exposes these to consumers. */
-interface ProductionSignerControls {
-  /** Final signing call. Address, readiness and session lifecycle retain their real owner. */
-  readonly signUserOpHash?: (hash: Parameters<CapxulSigner["signUserOpHash"]>[0], signer: CapxulSigner & {
-    readonly resetSession?: () => void;
-  }) => ReturnType<CapxulSigner["signUserOpHash"]>;
-  /** Embedded signing calls, including the existing recovery owner's single retry. */
-  readonly signEmbeddedUserOpHash?: OpenfortBrowserSignerOptions["signUserOpHash"];
-}
-//#endregion
-export { OrganizationPaymentBatchInput as $, RequestStatus as $n, Destination as $t, OrgScopedMethods as A, Ref$1 as An, AddressBookAddInput as At, AuthorizeRunOptions as B, SmartAccountMethods as Bn, ActivityFilter as Bt, CurrentUserMethods as C, PaymentMoney as Cn, AccountMethods as Ct, MemberStatus as D, PaymentsMethods as Dn, ActorRequest as Dt, InviteMemberInput as E, PaymentType as En, ActorRelationshipMethods as Et, ResendInviteTokenInput as F, AccountLifecycle as Fn, InboxItem as Ft, PayrollGroupsMethods as G, ActorRef as Gn, ActivityPage as Gt, PayrollGroup as H, OrgLifecycle as Hn, ActivityKind as Ht, RoleDefinition as I, AccountSetupStep as In, InboxMethods as It, PayrollRun as J, SubmittedPermissionExecution as Jn, ActivitySummary as Jt, PayrollMethods as K, CurrentHoldings as Kn, ActivityRange as Kt, RoleSpendCap as L, isSettingUpLifecycle as Ln, ActivityAnnotation as Lt, OrgView as M, TargetReference as Mn, AddressBookLabelInput as Mt, OrganizationAccount as N, TargetsMethods as Nn, AddressBookMethods as Nt, MemberView as O, PaymentsPayInput as On, ActorRequestIssueInput as Ot, OrganizationAuditLogItem as P, fingerprintPaymentIntent as Pn, InboxApproveInput as Pt, PayrollTermsUnit as Q, PaymentStatus$1 as Qn, DepositInstructions as Qt, RoleView as R, CompleteProfileInput as Rn, ActivityAnnotationInput as Rt, CurrentUserContext as S, PaymentDocumentsMethods as Sn, ReadyAccountLifecycle as St, DetectPendingOrgInvitationsResult as T, PaymentTiming as Tn, ActorProfileMethods as Tt, PayrollGroupInput as U, OrgSetupStep as Un, ActivityListParams as Ut, PayrollEngagementTerms as V, AuthMethods as Vn, ActivityItem as Vt, PayrollGroupMember as W, PayoutAddress as Wn, ActivityMethods as Wt, PayrollRunStatus as X, PAYMENT_DIRECTIONS as Xn, ActivitySummaryTotal as Xt, PayrollRunItemInput as Y, InboxStatus as Yn, ActivitySummaryParams as Yt, PayrollRuns as Z, PAYMENT_STATUSES as Zn, ActorReference as Zt, HoldingsMethods as _, PaymentDirection as _n, OnboardingMethods as _t, ObservationContext as a, DestinationRemoveInput as an, IdentityEvent as ar, PermissionCreateInput as at, SystemHealth as b, PaymentDocumentRender as bn, PersonOnboarding as bt, HostObservability as c, MeMethods as cn, Readiness as cr, PermissionReplaceInput as ct, postHogObservability as d, OfframpMethods as dn, isClaimed as dr, Budget as dt, DestinationAddInput as en, TelemetryEvent as er, OrganizationPaymentInput as et, CapxulClient as f, OfframpQuote as fn, isRestoring as fr, OrgMe as ft, IdentityRuntimeSendResult as g, PaymentActivityEvidence as gn, CompletedPersonProfile as gt, IdentityRuntime as h, Payment as hn, AccountsMethods as ht, ObservationAdapter as i, DestinationRail as in, Destination$1 as ir, PermissionChangeInput as it, OrgTemplate as j, ResolvedTarget as jn, AddressBookEntry as jt, OrgMethods as k, RecipientResolution as kn, ActorRequestsMethods as kt, PostHogObservabilityClient as l, MeProfile as ln, StateLabel as lr, PermissionRevokeInput as lt, IdentityProfileDetails as m, OfframpStatus as mn, InvocationControls as mr, OrgMeOptions as mt, ProductionSignerControls as n, DestinationListInput as nn, TelemetryIdentifyInput as nr, OrganizationPaymentsMethods as nt, ObservationDelivery as o, DestinationsMethods as on, IdentityState as or, PermissionMethods as ot, CreateCapxulClientInput as p, OfframpQuoteInput as pn, IdentityTransition as pr, OrgMeMethod as pt, PayrollOptions as q, Permission as qn, ActivityReference as qt, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as r, DestinationPayload as rn, TelemetryPort as rr, PermissionAssignInput as rt, SdkFailureObservation as s, FinancialOpsMethods as sn, OrgLane as sr, PermissionOptions as st, CapxulClientInput as t, DestinationKind as tn, TelemetryGroupInput as tr, OrganizationPaymentItemInput as tt, PostHogObservabilityOptions as u, MovementActivityEvidence as un, destination as ur, PermissionReadResult as ut, Holding as v, PaymentDocumentKind as vn, OrganizationOnboarding as vt, CreateOrgInput as w, PaymentStatus as wn, ActorProfile as wt, MediaMethods as x, PaymentDocumentVerification as xn, PersonOnboardingInput as xt, SystemMethods as y, PaymentDocumentRef as yn, OrganizationOnboardingInput as yt, AuthorizeRunInput as z, IdentityMethods as zn, ActivityDetail as zt };