@capxul/sdk 4.20.0-beta.4 → 4.20.0-beta.40

package/dist/OAuthBearerAuthClient-C-ip-z8M.d.mts

@@ -1,628 +0,0 @@
-import { Account, Address, Hex } from "viem";
-import { Context, Effect } from "effect";
-//#region ../errors/src/chain-cause.d.ts
-/**
- * Why an operation failed — the one flat vocabulary. The first four are the
- * auth/provider diagnoses that predate this file. The rest name the chain
- * path. `FailureMode` is derived from this list so a runtime membership check
- * (the SDK's `$exception` projection, the observability schema) and the type
- * can never drift apart.
- */
-declare const FAILURE_MODES: readonly [
-/** OTP cookies live on `localhost:PORT` but OpenFort hits the Convex host. */
-"auth-origin-mismatch",
-/** An old `userId` in scoped storage makes the SDK skip re-auth → 401. */
-"stale-openfort-cache",
-/** The selected app/deployment origin is not allowlisted → 401. */
-"app-env-allowlist",
-/** Sandboxed/headless browser with no Web Crypto. */
-"no-secure-context",
-/** The embedded wallet lost its configured signer state. */
-"signer-not-ready",
-/** One upstream answered HTTP 429 or JSON-RPC -32005. Retryable. */
-"rate-limited",
-/** No answer inside the budget. Retryable. */
-"timeout",
-/** HTTP 5xx, a connection failure, or a malformed envelope. Retryable. */
-"upstream-down",
-/** Simulation or execution reverted; `chain.revert` names it when decodable. */
-"revert",
-/** A balance pre-flight shortfall or a decoded `ERC20InsufficientBalance`. */
-"insufficient-balance",
-/** A decoded `ERC20InsufficientAllowance`. */
-"insufficient-allowance",
-/** The bundler's validation refused the operation (AA2x/AA3x); its text is carried. */
-"rejected",
-/** The upstream refused the credential (HTTP 401): the gateway token or a hosted node key. */
-"unauthorized",
-/** The upstream refused the key, origin, or method (HTTP 403). The next upstream's key may be fine. */
-"forbidden",
-/** The upstream refused the request shape (HTTP 400-family; JSON-RPC -32600, -32602, -32700). */
-"bad-request",
-/** The node does not serve the method (JSON-RPC -32601). The next upstream may. */
-"method-unsupported",
-/** No cause could be determined. */
-"unknown"];
-type FailureMode = (typeof FAILURE_MODES)[number];
-/** Who answered. `alto` is the bundler; `gateway` is the AA gateway's own logic. */
-declare const CHAIN_UPSTREAMS: readonly ["alchemy", "infura", "public", "alto", "gateway"];
-type ChainUpstream = (typeof CHAIN_UPSTREAMS)[number];
-/** A decoded revert. `name` is null when the selector is unknown or the data was empty. */
-type RevertSummary = {
-  readonly name: string | null;
-  readonly selector: string;
-  readonly args: Readonly<Record<string, string>>;
-};
-/**
- * The structured cause of a chain-path failure. Built once by the layer that
- * saw the failure and passed on unchanged. `providerMessage` is the provider's
- * own words, bounded and secret-masked by the producer; it is evidence, never
- * something a consumer routes on.
- */
-type ChainCause = {
-  readonly mode: FailureMode;
-  readonly upstream: ChainUpstream;
-  readonly method: string;
-  readonly retryable: boolean;
-  readonly httpStatus?: number;
-  readonly rpcCode?: number;
-  readonly revert?: RevertSummary;
-  readonly providerMessage?: string;
-  /**
-   * Every upstream tried for this read, in order, ending with the one whose
-   * answer this cause is (#1818). One `$exception` row then tells the whole
-   * story of an exhausted chain; the recovered case stays an event.
-   */
-  readonly attempts?: readonly ChainAttempt[];
-  /** The refusing upstream's allow-listed response headers, masked and bounded. */
-  readonly responseHeaders?: Readonly<Record<string, string>>;
-};
-/** One upstream tried and the word for how it failed (#1818). */
-type ChainAttempt = {
-  readonly upstream: ChainUpstream;
-  readonly mode: FailureMode;
-  readonly httpStatus?: number;
-  readonly rpcCode?: number;
-  readonly durationMs: number;
-};
-//#endregion
-//#region ../errors/src/errors.d.ts
-declare const CAPXUL_ERROR_CODES: readonly ["NOT_AUTHENTICATED", "EMAIL_DELIVERY_FAILED", "PROFILE_NOT_FOUND", "SMART_ACCOUNT_MISSING", "PLAYER_NOT_FOUND", "ACCOUNT_NOT_FOUND", "ACCOUNT_CLAIMED_BY_OTHER_SIGNER", "PROVIDER_ERROR", "CAPABILITY_UNAVAILABLE", "INVALID_INPUT", "ENV_MISSING", "NOT_IMPLEMENTED", "VERIFICATION_REQUIRED", "INSUFFICIENT_BALANCE", "INVALID_RECIPIENT", "ROLE_PERMISSION_DENIED", "TRANSACTION_FAILED", "RATE_LIMITED", "NETWORK_ERROR", "UNKNOWN", "OTP_EXPIRED", "SIGNER_REJECTED", "CANCELLED", "WRONG_STATE", "STALE_EPOCH", "SUPERSEDED", "WORK_DIED", "ACTOR_STOPPED"];
-type CapxulErrorCode = (typeof CAPXUL_ERROR_CODES)[number];
-/**
- * The one failure representation carried by domain state, actor work, and
- * public error projection. Keeping it beside the canonical error catalog
- * prevents a machine or shell from inventing a second code vocabulary.
- */
-interface Failure {
-  readonly code: CapxulErrorCode;
-  readonly message: string;
-  readonly mode?: FailureMode;
-  readonly error?: CapxulError;
-}
-type CapxulErrorDetails = Record<string, unknown>;
-type SignerSource = "openfort-embedded" | "injected-eip1193" | "local-private-key";
-type VerificationRequiredDetails = {
-  readonly requiredTier: number;
-} | {
-  readonly rail: string;
-  readonly currentKind: string;
-};
-type CapxulErrorOptions = {
-  readonly cause?: unknown;
-  readonly details?: CapxulErrorDetails;
-  readonly correlationId?: string;
-  readonly layer?: string;
-  readonly mode?: FailureMode;
-  readonly chain?: ChainCause;
-};
-declare class CapxulError extends Error {
-  readonly code: CapxulErrorCode;
-  readonly details?: CapxulErrorDetails;
-  readonly correlationId?: string;
-  readonly layer?: string;
-  /** The one-word cause (`FailureMode`). `chain.mode` when a chain cause is set. */
-  readonly mode?: FailureMode;
-  /** The structured chain-path cause. Never rewritten by a later layer. */
-  readonly chain?: ChainCause;
-  constructor(code: CapxulErrorCode, message: string, options?: CapxulErrorOptions);
-}
-declare function isCapxulError(value: unknown): value is CapxulError;
-type NetworkErrorOptions = {
-  readonly provider?: string;
-  readonly target_host?: string;
-  readonly failure_mode?: FailureMode;
-  readonly reason?: "connection-lost-in-flight";
-  readonly connection_id?: string;
-  readonly connection_count?: number;
-  readonly connection_retries?: number;
-  readonly close_code?: number;
-  readonly close_was_clean?: boolean;
-  readonly close_reason_present?: boolean;
-  readonly document_visibility?: string;
-  readonly navigator_online?: boolean;
-  readonly last_browser_event?: string;
-  readonly ms_since_browser_event?: number;
-};
-declare const Errors: {
-  readonly notAuthenticated: (message?: string, opts?: {
-    readonly failure_mode?: FailureMode;
-  }) => CapxulError;
-  readonly emailDeliveryFailed: (detail: string) => CapxulError;
-  readonly profileNotFound: (authUserId: string) => CapxulError;
-  readonly smartAccountMissing: (authUserId: string) => CapxulError;
-  readonly playerNotFound: (playerId?: string) => CapxulError;
-  readonly accountNotFound: (accountId?: string) => CapxulError;
-  /**
-   * The Safe at this email's address is deployed and its owner is neither the
-   * Capxul bootstrap owner nor the caller's signer. The claim
-   * `swapOwner(bootstrap → signer)` cannot succeed: only the on-chain owner
-   * can hand the account over. Read from `getOwners()` before any
-   * UserOperation is built (2026-09-02), so no simulation and no retry.
-   */
-  readonly accountClaimedByOtherSigner: (details: {
-    readonly safeAddress: string;
-    readonly onChainOwner: string;
-    /** A bounded sample of the `getOwners()` answer, for a Safe that is not single-owner. */
-    readonly owners?: readonly string[];
-    /** The full size of that answer, when the sample is shorter. */
-    readonly ownerCount?: number;
-    readonly expectedOwner: string;
-    readonly signerAddress: string;
-  }) => CapxulError;
-  readonly providerError: (provider: string, operation: string, cause: unknown, opts?: {
-    readonly failure_mode?: FailureMode;
-    readonly httpStatus?: number;
-    /** Extra evidence for the operator (response body, edge error code). */
-    readonly details?: Readonly<Record<string, unknown>>;
-    /** The structured chain-path cause; sets `mode` and `details.failure_mode` too. */
-    readonly chain?: ChainCause;
-  }) => CapxulError;
-  readonly capabilityUnavailable: (provider: string, operation: string) => CapxulError;
-  readonly invalidInput: (field: string, reason: string) => CapxulError;
-  readonly envMissing: (name: string) => CapxulError;
-  readonly notImplemented: (domain: string, method: string) => CapxulError;
-  /**
-   * Sibling factory to {@link Errors.providerError} for the per-state timeout
-   * path in flows. Same `PROVIDER_ERROR` code as
-   * `providerError`, plus a `details.reason: "timeout"` discriminator so
-   * downstream observers can distinguish failure modes without parsing the
-   * message string. The redacted message names the timeout budget; the
-   * native `cause` carries the same information for `reportError` fidelity.
-   */
-  readonly providerTimeout: (provider: string, operation: string, timeoutMs: number) => CapxulError;
-  readonly verificationRequired: (details: VerificationRequiredDetails) => CapxulError;
-  readonly insufficientBalance: (asset: string, available: string, required: string) => CapxulError;
-  readonly invalidRecipient: (reason: string) => CapxulError;
-  /**
-   * The org Zodiac Roles modifier REFUSED the spend on-chain (G4 · #547): the
-   * member's role condition (per-tx cap, per-day allowance, allowed recipient,
-   * or membership) was violated, so `execTransactionWithRole` reverted. This is
-   * a PERMISSION denial — explicitly NOT an `INSUFFICIENT_BALANCE` (the treasury
-   * held the funds; the role's authority is what bound). `reason` discriminates
-   * the violated condition (`over_cap` / `daily_cap` / `not_member` /
-   * `disallowed_recipient` / `condition_violation`); leak-safe — no on-chain
-   * identifiers ever enter the details.
-   */
-  readonly rolePermissionDenied: (details: {
-    readonly reason: "over_cap" | "daily_cap" | "not_member" | "disallowed_recipient" | "condition_violation";
-    readonly operation?: string;
-  }) => CapxulError;
-  /**
-   * A transaction (or sponsored UserOp) failed. `details.reason` discriminates
-   * the failure mode for callers that must distinguish a CONFIRMED on-chain
-   * revert (`"onchain_revert"` — the op executed and reverted, e.g. a Zodiac
-   * Roles condition violation) from an inconclusive infra failure. A confirmed
-   * revert is the ONLY mode the org spend port may map to a roles denial.
-   */
-  readonly transactionFailed: (operation: string, cause?: unknown, extra?: {
-    readonly reason?: string;
-  }) => CapxulError;
-  readonly rateLimited: (details?: {
-    readonly retryAfterMs?: number;
-    readonly resource?: string;
-  }) => CapxulError;
-  readonly networkError: (operation: string, cause?: unknown, opts?: NetworkErrorOptions) => CapxulError;
-  readonly unknown: (cause?: unknown) => CapxulError;
-  readonly otpExpired: (details?: {
-    readonly email?: string;
-    readonly expiredAt?: number;
-  }) => CapxulError;
-  readonly signerRejected: (details: {
-    readonly source: SignerSource;
-    readonly reason?: string;
-    readonly cause?: unknown;
-  }) => CapxulError;
-  readonly superseded: (details: {
-    readonly operation: string;
-    readonly reason: string;
-    readonly executionId?: string;
-  }) => CapxulError;
-  readonly cancelled: (details?: {
-    readonly operation?: string;
-    readonly reason?: string;
-  }) => CapxulError;
-  /**
-   * Method called from a flow state where its precondition fails (TA16). The
-   * SDK's method API short-circuits with this error before driving the
-   * internal state machine. `currentState` is the Effect-machine snapshot
-   * tag (stringified from the SDK's actor-shell snapshot; see
-   * `packages/errors/CONTEXT.md`); `validStates`
-   * enumerates the states the method accepts.
-   */
-  readonly wrongState: (details: {
-    readonly method: string;
-    readonly currentState: string;
-    readonly validStates: readonly string[];
-  }) => CapxulError;
-};
-//#endregion
-//#region ../types/src/brand.d.ts
-/**
- * Nominal type helper. `Brand<T, B>` is structurally a `T` at runtime but
- * distinct at compile time, preventing accidental swaps between primitives.
- *
- * @internal
- */
-declare const brand: unique symbol;
-type Brand<T, B extends string> = T & {
-  readonly [brand]: B;
-};
-//#endregion
-//#region ../types/src/index.d.ts
-type Address$1 = Brand<string, "Address">;
-/** Canonical ERC-20 CAIP-19 identity. Currency is not asset identity. */
-type AssetId = Brand<string, "AssetId">;
-/** One asset quantity in major units. Registry metadata supplies precision. */
-type AssetAmount = {
-  readonly asset: AssetId;
-  readonly value: string;
-};
-type Email = Brand<string, "Email">;
-type TesterKind = "human" | "e2e" | "agent";
-type Profile$1 = {
-  readonly testerKind?: TesterKind;
-  readonly authUserId: AuthUserId;
-  readonly email: Email;
-  readonly displayName: string | null;
-  readonly country: CountryCode | null;
-  readonly onboarded: boolean;
-  readonly withdrawalAddress: Address$1 | null;
-  readonly handle: Handle | null;
-  readonly imageUrl: string | null;
-  readonly kycTier: KycTier;
-  readonly createdAt: EpochMs;
-  readonly updatedAt: EpochMs;
-};
-type SmartAccount$1 = {
-  readonly authUserId: AuthUserId;
-  readonly signerAddress: Address$1 | null;
-  readonly smartAccountAddress: Address$1;
-  readonly chainId: ChainId;
-  readonly deployedAt: EpochMs | null;
-  readonly claimedAt: EpochMs | null;
-  readonly createdAt: EpochMs;
-};
-type Money = {
-  readonly currency: CurrencyCode;
-  readonly value: string;
-  readonly decimals: number;
-};
-type Account$1 = {
-  readonly id: AccountId;
-  readonly balance: Money;
-  readonly available: Money;
-};
-type AuthUserId = Brand<string, "AuthUserId">;
-type AnonymousDistinctId = Brand<string, "AnonymousDistinctId">;
-type AccountId = Brand<string, "AccountId">;
-type PartyId = Brand<string, "PartyId">;
-/** One globally unique public name for a claimed person or Organization Party. */
-type Handle = Brand<string, "Handle">;
-type PermissionId = Brand<string, "PermissionId">;
-type PermissionAssignmentId = Brand<string, "PermissionAssignmentId">;
-type BudgetId = Brand<string, "BudgetId">;
-type PaymentCommandId = Brand<string, "PaymentCommandId">;
-type PayrollRunId = Brand<string, "PayrollRunId">;
-type PayrollGroupId = Brand<string, "PayrollGroupId">;
-type OrgId = Brand<string, "OrgId">;
-type AppId = Brand<string, "AppId">;
-type AllowedOrigin = Brand<string, "AllowedOrigin">;
-type PublishableKey = Brand<string, "PublishableKey">;
-type DurationMs = Brand<number, "DurationMs">;
-type TxHash = Brand<string, "TxHash">;
-type DocumentHash = Brand<string, "DocumentHash">;
-type EpochMs = Brand<number, "EpochMs">;
-type EpochSeconds = Brand<number, "EpochSeconds">;
-type ChainId = Brand<number, "ChainId">;
-type CountryCode = Brand<string, "CountryCode">;
-type CurrencyCode = Brand<SupportedCurrencyCode, "CurrencyCode">;
-type KycTier = Brand<0 | 1 | 2 | 3, "KycTier">;
-type BlockNumber = Brand<number, "BlockNumber">;
-type WeiAmount = Brand<string, "WeiAmount">;
-type RoleKey = Brand<string, "RoleKey">;
-type AllowanceKey = Brand<string, "AllowanceKey">;
-type SessionToken = Brand<string, "SessionToken">;
-type JwtToken = Brand<string, "JwtToken">;
-type AuthSession = {
-  readonly authUserId: AuthUserId;
-  readonly email: Email;
-  readonly token: SessionToken;
-  readonly expiresAt: EpochMs;
-};
-declare const EVM_ADDRESS_RE: RegExp;
-declare const SUPPORTED_CURRENCIES: readonly [{
-  readonly code: "USD";
-  readonly symbol: "$";
-  readonly name: "US Dollar";
-}, {
-  readonly code: "NGN";
-  readonly symbol: "NGN";
-  readonly name: "Nigerian Naira";
-}, {
-  readonly code: "GHS";
-  readonly symbol: "GHS";
-  readonly name: "Ghanaian Cedi";
-}, {
-  readonly code: "KES";
-  readonly symbol: "KSh";
-  readonly name: "Kenyan Shilling";
-}, {
-  readonly code: "UGX";
-  readonly symbol: "USh";
-  readonly name: "Ugandan Shilling";
-}];
-type SupportedCurrencyCode = (typeof SUPPORTED_CURRENCIES)[number]["code"];
-declare function toAddress(raw: unknown): Address$1;
-declare function toPartyId(raw: unknown): PartyId;
-declare function toHandle(raw: unknown): Handle;
-declare function toCountryCode(raw: unknown): CountryCode;
-//#endregion
-//#region ../config/src/capxul-payments-v2.d.ts
-/** Immutable CapxulPaymentsV2 deployment on Base Sepolia. */
-declare const CAPXUL_PAYMENTS_V2_ADDRESS: Address;
-//#endregion
-//#region src/ports/auth-cache.d.ts
-/**
- * AuthCachePort stores the user session and the cached
- * Convex JWT. The two slots are independent. A session refresh does not
- * invalidate the JWT.
- *
- * Three adapters implement this port:
- *   - `BrowserAuthCacheAdapter`        — backed by `localStorage`
- *   - `FileSystemAuthCacheAdapter`     — mode-0600 JSON file in `~/.config/capxul/`
- *   - `InMemoryAuthCacheAdapter`       — for tests
- *
- * Session and JWT persistence share this cache boundary.
- */
-interface AuthCachePort {
-  readonly getSession: Effect.Effect<AuthSession | null, AuthCacheError>;
-  readonly setSession: (session: AuthSession) => Effect.Effect<void, AuthCacheError>;
-  readonly clearSession: Effect.Effect<void, AuthCacheError>;
-  /**
-   * JWT cache for the `/api/auth/convex/token` bridge endpoint.
-   * Stored separately from the session so a session refresh does not
-   * invalidate cached JWT.
-   */
-  readonly getJwt: Effect.Effect<CachedJwt | null, AuthCacheError>;
-  readonly setJwt: (jwt: CachedJwt) => Effect.Effect<void, AuthCacheError>;
-  readonly clearJwt: Effect.Effect<void, AuthCacheError>;
-}
-/**
- * Cached Convex JWT shape. `expEpochSeconds` is decoded from the JWT's
- * `exp` claim at fetch time so the `tokenProvider` cache eviction logic can
- * refresh at `exp - 30s`.
- */
-interface CachedJwt {
-  readonly token: JwtToken;
-  readonly expEpochSeconds: EpochSeconds;
-}
-declare const AuthCacheError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "AuthCacheError";
-} & Readonly<A>;
-declare class AuthCacheError extends AuthCacheError_base<{
-  readonly operation: string;
-  readonly cause: unknown;
-}> {}
-declare const AuthCachePortTag_base: Context.ServiceClass<AuthCachePortTag, "@capxul/sdk/ports/AuthCachePort", AuthCachePort>;
-declare class AuthCachePortTag extends AuthCachePortTag_base {}
-//#endregion
-//#region src/ports/auth-client.d.ts
-type AuthClientOperationOptions = {
-  readonly signal?: AbortSignal;
-};
-type SendOtpInput = {
-  readonly email: Email;
-};
-type CanSendOtpInput = {
-  readonly email: Email;
-};
-type CanSendOtpStatus = {
-  readonly allowed: boolean;
-  readonly cooldownMs: DurationMs;
-};
-type VerifyOtpInput = {
-  readonly email: Email;
-  readonly otp: string;
-};
-type GetConvexJwtOptions = AuthClientOperationOptions & {
-  readonly forceRefresh?: boolean;
-};
-declare const AuthClientError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "AuthClientError";
-} & Readonly<A>;
-declare class AuthClientError extends AuthClientError_base<{
-  readonly operation: string;
-  readonly kind: string;
-  readonly cause: unknown;
-}> {}
-interface AuthClientPort {
-  canSendOtp(input: CanSendOtpInput, options?: AuthClientOperationOptions): Effect.Effect<CanSendOtpStatus, AuthClientError>;
-  sendOtp(input: SendOtpInput, options?: AuthClientOperationOptions): Effect.Effect<void, AuthClientError>;
-  verifyOtp(input: VerifyOtpInput, options?: AuthClientOperationOptions): Effect.Effect<AuthSession, AuthClientError>;
-  getSession(options?: AuthClientOperationOptions): Effect.Effect<AuthSession | null, AuthClientError>;
-  signOut(options?: AuthClientOperationOptions): Effect.Effect<void, AuthClientError>;
-  /**
-   * Fetches a Convex-aud JWT from `/api/auth/convex/token` (W7). Server mints
-   * a fresh JWT on every call per Probe A's 2026-05-19 finding (RS256, 900 s
-   * lifetime, `iss = <site-url>`, `aud = convex`). The caller (the SDK's
-   * `tokenProvider` wired into ConvexCallPort) is responsible for the
-   * `exp - 30s` proactive cache + `forceRefresh` callback handshake.
-   */
-  getConvexJwt(options?: GetConvexJwtOptions): Effect.Effect<CachedJwt, AuthClientError>;
-}
-//#endregion
-//#region src/ports/clock.d.ts
-interface ClockPort {
-  readonly now: Effect.Effect<EpochMs, ClockError>;
-  readonly sleep: (duration: DurationMs) => Effect.Effect<void, ClockError>;
-}
-declare const ClockError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "ClockError";
-} & Readonly<A>;
-declare class ClockError extends ClockError_base<{
-  readonly operation: "now" | "sleep" | "initialize";
-  readonly cause: unknown;
-}> {}
-//#endregion
-//#region src/surface/types.d.ts
-type Session = AuthSession;
-type Profile = Profile$1;
-type SmartAccount = SmartAccount$1;
-/**
- * Result-shape returned by every method on `CapxulClient`. Mirrors the
- * existing per-port `Result` aliases; centralized here so consumers have
- * a single import for the consumer-facing surface.
- */
-type CapxulResult<T> = {
-  readonly ok: true;
-  readonly value: T;
-} | {
-  readonly ok: false;
-  readonly error: CapxulError;
-};
-//#endregion
-//#region src/surface/account-providers.d.ts
-type AccountProviderSource = "local-private-key" | "openfort-embedded" | "injected-eip1193";
-type AccountRequirement = "none" | "counterfactual" | "deployed";
-interface AccountProvider {
-  readonly source: AccountProviderSource;
-  /**
-   * Resolve the signer's EVM address.
-   *
-   * @determinism MUST return the same `Address` across calls for the
-   * lifetime of a single provider instance — the SDK-level deploy mutex
-   * keys on `(authUserId, safeAddress)` where `safeAddress` is computed
-   * from `getAddress()`'s result before the port's `prepare()` round-trip.
-   * If two successive calls returned different addresses, concurrent
-   * `deploySafe` invocations would compute different mutex keys and
-   * bypass dedup, defeating the mutex.
-   *
-   * The two sanctioned providers both satisfy this invariant:
-   *   - `localPrivateKeyAccountProvider` — derives once from the key
-   *   - `eip1193AccountProvider` — reads `eth_accounts` (idempotent once
-   *     the wallet is connected; consumer is responsible for connection)
-   *
-   * The Openfort embedded path no longer needs a provider: the
-   * `openfortEmbeddedSigner` `CapxulSigner` caches its own address and the
-   * deploy is backend-orchestrated (backend-orchestrated-deploy.md).
-   *
-   * Custom providers MUST honor this contract.
-   */
-  getAddress(): Promise<CapxulResult<Address$1>>;
-  getDeployAccount(): Promise<CapxulResult<Account>>;
-}
-interface Eip1193Provider {
-  request(args: {
-    readonly method: string;
-    readonly params?: readonly unknown[];
-  }): Promise<unknown>;
-}
-declare function localPrivateKeyAccountProvider(input: {
-  readonly privateKey: Hex;
-}): AccountProvider;
-declare function eip1193AccountProvider(input: {
-  readonly provider: Eip1193Provider;
-}): AccountProvider;
-//#endregion
-//#region src/signer.d.ts
-interface CapxulDigestSigner {
-  /**
-   * Sign the EIP-712 `SafeOp` digest the backend returns for the prepared
-   * deployment UserOperation. Returns the raw 65-byte ECDSA signature; the
-   * backend packs `validAfter|validUntil|signature`.
-   */
-  signUserOpHash(hash: Hex): Promise<Hex>;
-}
-interface CapxulSigner extends CapxulDigestSigner {
-  /**
-   * Signer kind — surfaced on the `accountProviderReady` status so the
-   * readiness ladder reports which signer the consumer wired.
-   */
-  readonly source: AccountProviderSource;
-  /** Owner EOA address — the Safe's single owner. */
-  getAddress(): Promise<Address$1>;
-  /**
-   * Readiness this signer reports, when it runs a readiness cycle at all. Only
-   * the Openfort browser signer does. `assembleCapxulClient` reads it onto
-   * `client.signer`, and substitutes `UNOBSERVABLE_SIGNER_STATUS` when absent.
-   */
-  readonly statusStore?: SignerStatusStore;
-  /**
-   * Start this signer's readiness cycle, or join the one already running,
-   * without signing anything. `assembleCapxulClient` calls it when the
-   * identity is claimed, so the status converges on `ready` or `unavailable`
-   * on its own (#1667). A signer that runs no cycle omits this, and keeps
-   * reporting `unknown`.
-   */
-  readonly ensureWalletReady?: () => Promise<void>;
-}
-/**
- * Observable signer readiness (ACCESS #1520 · C12). `unknown` means the
- * wallet-ready cycle did not start. `recovering` means it is running; the
- * stale-cache heal runs inside that phase. `ready` means the signer can sign.
- * `unavailable` means the cycle failed. A failure is distinguishable from a
- * cycle that never started. That is why there are four states.
- */
-type SignerStatus = "unknown" | "recovering" | "ready" | "unavailable";
-/** Subscribable readiness surface. Assembled onto `client.signer`. */
-interface SignerStatusStore {
-  /** The current status. */
-  status(): SignerStatus;
-  /** Fires on every change. Returns its own unsubscribe. */
-  subscribe(listener: (status: SignerStatus) => void): () => void;
-}
-/** Minimal EIP-1193 surface an injected browser wallet exposes. */
-interface Eip1193RequestProvider {
-  request(args: {
-    readonly method: string;
-    readonly params?: readonly unknown[];
-  }): Promise<unknown>;
-}
-/**
- * Browser `CapxulSigner` backed by an injected EIP-1193 wallet (MetaMask, etc.).
- * Signs the SafeOp digest via `eth_sign`, then verifies the returned signature
- * recovers the selected account against that raw digest. Wallets that prefix
- * `eth_sign` payloads are rejected before the backend submits an invalid SafeOp.
- * The node key signer lives in `@capxul/sdk/node` (`localPrivateKeySigner`).
- */
-declare function injectedWalletSigner(provider: Eip1193RequestProvider): CapxulSigner;
-//#endregion
-//#region src/adapters/auth-client/OAuthBearerAuthClient.d.ts
-interface OAuthBearerAuthClientInput {
-  /** The exchange endpoint: `{authBaseUrl}/api/auth/agent/exchange`. */
-  readonly exchangeUrl: string;
-  /** The shared secret the exchange endpoint checks. The caller holds it. */
-  readonly exchangeSecret: string;
-  /** The agent's OAuth access token. */
-  readonly accessToken: string;
-  readonly fetch?: typeof fetch;
-  readonly clock?: ClockPort;
-}
-/**
- * `AuthClientPort` over the backend agent-token exchange. Build one per OAuth
- * access token and hand it to `createCapxulClient({ authClient })`.
- */
-declare function oauthBearerAuthClient(input: OAuthBearerAuthClientInput): AuthClientPort;
-//#endregion
-export { PayrollGroupId as $, AllowanceKey as A, ChainId as B, AuthCachePort as C, ChainCause as Ct, Account$1 as D, RevertSummary as Dt, CAPXUL_PAYMENTS_V2_ADDRESS as E, FailureMode as Et, AssetId as F, EVM_ADDRESS_RE as G, CurrencyCode as H, AuthSession as I, Handle as J, Email as K, AuthUserId as L, AnonymousDistinctId as M, AppId as N, AccountId as O, AssetAmount as P, PaymentCommandId as Q, BlockNumber as R, AuthCacheError as S, CHAIN_UPSTREAMS as St, CachedJwt as T, FAILURE_MODES as Tt, DocumentHash as U, CountryCode as V, DurationMs as W, OrgId as X, Money as Y, PartyId as Z, Session as _, CapxulErrorCode as _t, Eip1193RequestProvider as a, RoleKey as at, AuthClientPort as b, Failure as bt, injectedWalletSigner as c, TesterKind as ct, AccountRequirement as d, toAddress as dt, PayrollRunId as et, Eip1193Provider as f, toCountryCode as ft, Profile as g, CapxulError as gt, CapxulResult as h, CAPXUL_ERROR_CODES as ht, CapxulSigner as i, PublishableKey as it, AllowedOrigin as j, Address$1 as k, AccountProvider as l, TxHash as lt, localPrivateKeyAccountProvider as m, toPartyId as mt, oauthBearerAuthClient as n, PermissionId as nt, SignerStatus as o, SessionToken as ot, eip1193AccountProvider as p, toHandle as pt, EpochMs as q, CapxulDigestSigner as r, Profile$1 as rt, SignerStatusStore as s, SmartAccount$1 as st, OAuthBearerAuthClientInput as t, PermissionAssignmentId as tt, AccountProviderSource as u, WeiAmount as ut, SmartAccount as v, CapxulErrorDetails as vt, AuthCachePortTag as w, ChainUpstream as wt, CanSendOtpStatus as x, isCapxulError as xt, ClockPort as y, Errors as yt, BudgetId as z };