@capxul/mcp 3.2.0 → 4.0.0

package/dist/main.mjs

@@ -3,6 +3,7 @@ import { a as __require, i as __exportAll, o as __toESM, r as __commonJSMin } fr
 import { a as aexists, c as clean, d as toBytes$2, f as u32, i as abytes, l as createHasher, n as sha256$2, o as anumber, r as Hash, s as aoutput, t as secp256k1, u as swap32IfBE } from "./secp256k1-oe2FO-K6.mjs";
 import { t as require_lib } from "./lib-vbuHK0v7.mjs";
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
+import { PostHog } from "posthog-node";
 import { createHash } from "node:crypto";
 import { createServer } from "node:http";
 import { localhostHostValidation, localhostOriginValidation, toNodeHandler } from "@modelcontextprotocol/node";
@@ -21,6 +22,7 @@ import { EventEmitter } from "events";
 import http2 from "http2";
 import zlib from "zlib";
 import { McpServer, createMcpHandler } from "@modelcontextprotocol/server";
+import { instrument } from "@posthog/mcp";
 //#region ../../packages/errors/src/secret-material.ts
 const SENSITIVE_MATERIAL_PATTERNS = [
 	/(?:^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u,
@@ -549,6 +551,31 @@ function decodeConvexError(err) {
 	return null;
 }
 //#endregion
+//#region ../../packages/errors/src/index.ts
+/** Canonical handle syntax shared by validation and branded constructors. */
+const HANDLE_RE$1 = /^[a-z0-9_-]{3,30}$/;
+//#endregion
+//#region ../../packages/config/src/handle.ts
+const RESERVED_HANDLES = /* @__PURE__ */ new Set([
+	"admin",
+	"api",
+	"capxul",
+	"help",
+	"root",
+	"support",
+	"system",
+	"www"
+]);
+function normalizeHandle(raw) {
+	return raw.trim().toLowerCase().replace(/^@/, "");
+}
+function validateHandle(raw) {
+	const handle = normalizeHandle(raw);
+	if (!HANDLE_RE$1.test(handle)) throw Errors.invalidInput("handle", "must be 3-30 characters of a-z, 0-9, underscore, or hyphen");
+	if (RESERVED_HANDLES.has(handle)) throw Errors.invalidInput("handle", "handle is reserved");
+	return handle;
+}
+//#endregion
 //#region ../../packages/config/src/tokens.ts
 /** `TestUSDC` ("USDX") — Base Sepolia, 6 decimals, open `mint`. (Canon §1.) */
 const USDX_ADDRESS_BASE_SEPOLIA = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
@@ -3390,6 +3417,19 @@ function readResourceEnvConfig(port, env = process.env) {
 function readHost(env = process.env) {
 	return env.CAPXUL_MCP_HOST?.trim() || "127.0.0.1";
 }
+/** MCP Analytics stays disabled until the process has a PostHog project token. */
+function readMcpAnalyticsEnvConfig(env = process.env) {
+	const projectToken = env.POSTHOG_PROJECT_TOKEN?.trim();
+	if (projectToken === void 0 || projectToken.length === 0) return void 0;
+	return {
+		projectToken,
+		host: env.POSTHOG_HOST?.trim() || "https://us.i.posthog.com",
+		environment: mcpAnalyticsEnvironment(env.CAPXUL_ENV?.trim() || env.APP_ENV?.trim())
+	};
+}
+function mcpAnalyticsEnvironment(value) {
+	return value === "development" || value === "staging" || value === "production" || value === "test" ? value : "unknown";
+}
 /** Stdio only: the bearer every request in the process is treated as carrying. */
 function readStdioAccessToken(env = process.env) {
 	const token = env.CAPXUL_MCP_ACCESS_TOKEN?.trim();
@@ -3882,6 +3922,10 @@ function toPartyId(raw) {
 	if (typeof raw !== "string" || !PARTY_ID_RE$1.test(raw)) throw Errors.invalidInput("partyId", invalidValueReason("must be party_ plus an alphanumeric id", raw));
 	return raw;
 }
+function toHandle(raw) {
+	if (typeof raw !== "string" || !HANDLE_RE$1.test(raw)) throw Errors.invalidInput("handle", invalidValueReason("must be 3-30 characters of a-z, 0-9, underscore, or hyphen", raw));
+	return raw;
+}
 function toBudgetId(raw) {
 	return toNonEmptyStringBrand(raw, "budgetId");
 }
@@ -3930,6 +3974,10 @@ function toCurrencyCode(raw) {
 	if (typeof raw !== "string" || !SUPPORTED_CURRENCY_CODES.includes(raw)) throw Errors.invalidInput("currencyCode", invalidValueReason("unsupported currency", raw));
 	return raw;
 }
+function toTesterKind(raw) {
+	if (raw !== "human" && raw !== "e2e" && raw !== "agent") throw Errors.invalidInput("testerKind", "must be human, e2e, or agent");
+	return raw;
+}
 function toKycTier(raw) {
 	if (typeof raw !== "number" || !Number.isInteger(raw) || raw < 0 || raw > 3) throw Errors.invalidInput("kycTier", invalidValueReason("must be an integer in [0, 3]", raw));
 	return raw;
@@ -4062,7 +4110,6 @@ const CAPXUL_OPERATIONS = {
 		current: "holdings.current",
 		primary: "holdings.primary"
 	},
-	handles: { resolve: "handles.resolve" },
 	identity: {
 		accountAt: "identity.AccountAt",
 		accountClaimed: "identity.AccountClaimed",
@@ -4098,7 +4145,7 @@ const CAPXUL_OPERATIONS = {
 		signOut: "identity.SignOut",
 		signOutFailed: "identity.SignOutFailed",
 		update: "identity.update",
-		usernameAvailable: "identity.usernameAvailable",
+		handleAvailable: "identity.handleAvailable",
 		verified: "identity.Verified",
 		verifyFailed: "identity.VerifyFailed",
 		verifyOtp: "identity.VerifyOtp"
@@ -4114,10 +4161,12 @@ const CAPXUL_OPERATIONS = {
 		get: "me.get"
 	},
 	moneyExecution: {
+		abandonPaymentExecution: "moneyExecution.abandonPaymentExecution",
 		prepareOrganizationPaymentExecution: "moneyExecution.prepareOrganizationPaymentExecution",
 		preparePaymentExecution: "moneyExecution.preparePaymentExecution",
 		preparePaymentLifecycleExecution: "moneyExecution.preparePaymentLifecycleExecution",
 		preparePermissionExecution: "moneyExecution.preparePermissionExecution",
+		recoverSubmissionClaims: "moneyExecution.recoverSubmissionClaims",
 		submit: "moneyExecution.submit",
 		submitPaymentCommandExecution: "moneyExecution.submitPaymentCommandExecution",
 		submitPaymentExecution: "moneyExecution.submitPaymentExecution",
@@ -4136,9 +4185,14 @@ const CAPXUL_OPERATIONS = {
 		quote: "offramp.quote",
 		status: "offramp.status"
 	},
-	onboarding: { completePerson: "onboarding.completePerson" },
+	onboarding: {
+		completeOrganization: "onboarding.completeOrganization",
+		completePerson: "onboarding.completePerson"
+	},
 	org: {
+		acceptInvitations: "org.acceptInvitations",
 		account: { get: "org.account.get" },
+		activateMember: "org.activateMember",
 		auditLog: "org.auditLog",
 		confirmBootstrap: "org.confirmBootstrap",
 		createOrg: "org.createOrg",
@@ -4149,6 +4203,7 @@ const CAPXUL_OPERATIONS = {
 		getProofReceipt: "org.getProofReceipt",
 		invite: "org.invite",
 		inviteMember: "org.inviteMember",
+		list: "org.list",
 		load: "org.load",
 		me: "org.me",
 		members: "org.members",
@@ -4241,11 +4296,7 @@ const CAPXUL_OPERATIONS = {
 		render: "paymentDocuments.render",
 		verify: "paymentDocuments.verify"
 	},
-	payees: {
-		create: "payees.create",
-		get: "payees.get",
-		resolve: "payees.resolve"
-	},
+	recipient: { resolve: "recipient.resolve" },
 	payroll: {
 		authorizeRun: "payroll.authorizeRun",
 		groups: {
@@ -4327,12 +4378,6 @@ const CAPXUL_OPERATIONS = {
 		ping: "system.ping",
 		runtimeChain: "system.runtimeChain"
 	},
-	targets: { resolve: {
-		email: "targets.resolve.email",
-		handle: "targets.resolve.handle",
-		organization: "targets.resolve.organization",
-		payee: "targets.resolve.payee"
-	} },
 	testUsdc: { mint: "TestUSDC.mint" },
 	_internal: {
 		accounts: { fund: "_internal.accounts.fund" },
@@ -4745,32 +4790,116 @@ const OrgInviteExpiredProps = Schema.Struct({
 	role: OptionalString,
 	status: OptionalString
 });
+const RecipientLocatorKindSchema = Schema.Literals([
+	"handle",
+	"email",
+	"address",
+	"party"
+]);
+const RecipientResolutionStatusSchema = Schema.Literals([
+	"known_party",
+	"new_email",
+	"external_address"
+]);
+const RecipientPartyKindSchema = Schema.Literals([
+	"person",
+	"organization",
+	"unresolved"
+]);
+const RecipientTelemetryProps = {
+	recipient_locator_kind: Schema.optional(RecipientLocatorKindSchema),
+	recipient_resolution_status: Schema.optional(RecipientResolutionStatusSchema),
+	recipient_party_id: OptionalString,
+	recipient_party_kind: Schema.optional(RecipientPartyKindSchema),
+	recipient_is_capxul_account: Schema.optional(Schema.Boolean),
+	recipient_handle: OptionalString,
+	recipient_address: OptionalAddress,
+	external_address_acknowledged: Schema.optional(Schema.Boolean)
+};
 const PaymentInitiatedProps = Schema.Struct({
+	command_id: OptionalString,
+	execution_id: OptionalString,
+	payment_lifecycle_id: OptionalString,
 	...TelemetryEnvelopeProps,
+	...RecipientTelemetryProps,
 	kind: Schema.String,
 	payment_id: Schema.String
 });
+const PaymentLifecycleProps = {
+	payment_state: OptionalString,
+	execution_state: OptionalString,
+	occurred_at: Schema.optional(Schema.Number),
+	causal_sequence: Schema.optional(Schema.Number),
+	sponsorship_valid_until: Schema.optional(Schema.Number),
+	terminal_event_id: OptionalString
+};
 const PaymentSettledL2Props = Schema.Struct({
+	...PaymentLifecycleProps,
 	...TelemetryEnvelopeProps,
+	...RecipientTelemetryProps,
 	kind: Schema.String,
 	chain_id: Schema.Number,
-	settlement_id: Schema.String
+	settlement_id: Schema.String,
+	payment_id: OptionalString,
+	payment_ids: OptionalString,
+	command_id: OptionalString,
+	payment_lifecycle_id: OptionalString,
+	execution_id: OptionalString,
+	user_op_hash: OptionalString,
+	transaction_hash: OptionalString
 });
 const PaymentFailedL2Props = Schema.Struct({
+	...PaymentLifecycleProps,
 	...TelemetryEnvelopeProps,
 	...ChainCauseTelemetryProps,
+	...RecipientTelemetryProps,
 	kind: Schema.String,
 	payment_id: Schema.String,
-	reason_code: Schema.String
+	payment_ids: OptionalString,
+	reason_code: Schema.String,
+	command_id: OptionalString,
+	payment_lifecycle_id: OptionalString,
+	execution_id: OptionalString,
+	user_op_hash: OptionalString
 });
 const PaymentVerificationRetryProps = Schema.Struct({
+	...PaymentLifecycleProps,
 	...TelemetryEnvelopeProps,
+	...RecipientTelemetryProps,
 	command_id: Schema.String,
+	payment_lifecycle_id: Schema.String,
 	attempt: Schema.Number,
 	reason_code: Schema.String,
 	chain_id: Schema.Number,
 	delay_ms: DurationMsSchema$1,
-	outcome: Schema.Literals(["scheduled", "unresolved"])
+	outcome: Schema.Literals(["scheduled", "unresolved"]),
+	payment_id: OptionalString,
+	payment_ids: OptionalString,
+	execution_id: OptionalString,
+	user_op_hash: OptionalString
+});
+const PaymentLifecycleTransitionProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	...RecipientTelemetryProps,
+	payment_id: Schema.String,
+	payment_lifecycle_id: Schema.String,
+	command_id: Schema.String,
+	payment_state: Schema.String,
+	occurred_at: Schema.Number,
+	causal_sequence: Schema.Number,
+	execution_id: OptionalString,
+	execution_state: OptionalString,
+	user_op_hash: OptionalString,
+	sponsorship_valid_until: Schema.optional(Schema.Number),
+	reason_code: OptionalString
+});
+const QuickPayExternalAddressAcknowledgedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	recipient_locator_kind: Schema.Literal("address"),
+	recipient_resolution_status: Schema.Literal("external_address"),
+	recipient_address: AddressSchema$1,
+	external_address_acknowledged: Schema.Literal(true),
+	organization_id: OptionalOrgId
 });
 const DepositInitiatedProps = Schema.Struct({ ...TelemetryEnvelopeProps });
 const DepositSettledProps = Schema.Struct({
@@ -4978,6 +5107,14 @@ Schema.Struct({
 	name: Schema.Literal("payment_verification_retry"),
 	props: PaymentVerificationRetryProps
 });
+Schema.Struct({
+	name: Schema.Literal("payment_lifecycle_transition"),
+	props: PaymentLifecycleTransitionProps
+});
+Schema.Struct({
+	name: Schema.Literal("quick_pay_external_address_acknowledged"),
+	props: QuickPayExternalAddressAcknowledgedProps
+});
 Schema.Struct({
 	name: Schema.Literal("deposit_initiated"),
 	props: DepositInitiatedProps
@@ -5320,16 +5457,13 @@ const CAPXUL_FUNCTIONS = {
 		list: "financialOps/destinations:list",
 		remove: "financialOps/destinations:remove"
 	},
-	"financialOps/mutations": { createPayee: "financialOps/mutations:createPayee" },
 	"financialOps/queries": {
 		depositInstructions: "financialOps/queries:depositInstructions",
-		getPayee: "financialOps/queries:getPayee",
 		getPayment: "financialOps/queries:getPayment",
 		listPayments: "financialOps/queries:listPayments",
 		me: "financialOps/queries:me",
 		renderStoredDocument: "financialOps/queries:renderStoredDocument",
-		resolveHandle: "financialOps/queries:resolveHandle",
-		resolvePayee: "financialOps/queries:resolvePayee",
+		resolveRecipient: "financialOps/queries:resolveRecipient",
 		verifyPaymentDocument: "financialOps/queries:verifyPaymentDocument"
 	},
 	"financialOps/requestsInbox": {
@@ -5348,7 +5482,7 @@ const CAPXUL_FUNCTIONS = {
 	},
 	"identity/queries": {
 		loadByAuthUserId: "identity/queries:loadByAuthUserId",
-		usernameAvailable: "identity/queries:usernameAvailable"
+		handleAvailable: "identity/queries:handleAvailable"
 	},
 	"holdings/actions": { current: "holdings/actions:current" },
 	"movement/activity": {
@@ -5358,6 +5492,7 @@ const CAPXUL_FUNCTIONS = {
 		summary: "movement/activity:summary"
 	},
 	"moneyExecution/actions": {
+		abandonPaymentExecution: "moneyExecution/actions:abandonPaymentExecution",
 		preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
 		preparePaymentExecution: "moneyExecution/actions:preparePaymentExecution",
 		submitPermissionExecution: "moneyExecution/actions:submitPermissionExecution",
@@ -5435,6 +5570,7 @@ const CAPXUL_FUNCTIONS = {
 const PAYMENT_STATUSES = [
 	"pending",
 	"settling",
+	"unresolved",
 	"scheduled",
 	"streaming",
 	"pending_claim",
@@ -5442,6 +5578,30 @@ const PAYMENT_STATUSES = [
 	"cancelled",
 	"failed"
 ];
+/** The lifecycle of one signed Payment execution attempt. */
+const PAYMENT_EXECUTION_STATUS = {
+	PENDING: "pending",
+	INCLUDED: "included",
+	DROPPED: "dropped",
+	REPLACED: "replaced",
+	EXPIRED: "expired",
+	UNRESOLVED: "unresolved",
+	SUPERSEDED: "superseded",
+	FAILED: "failed",
+	SETTLED: "settled"
+};
+const PAYMENT_EXECUTION_STATUSES = [
+	PAYMENT_EXECUTION_STATUS.PENDING,
+	PAYMENT_EXECUTION_STATUS.INCLUDED,
+	PAYMENT_EXECUTION_STATUS.DROPPED,
+	PAYMENT_EXECUTION_STATUS.REPLACED,
+	PAYMENT_EXECUTION_STATUS.EXPIRED,
+	PAYMENT_EXECUTION_STATUS.UNRESOLVED,
+	PAYMENT_EXECUTION_STATUS.SUPERSEDED,
+	PAYMENT_EXECUTION_STATUS.FAILED,
+	PAYMENT_EXECUTION_STATUS.SETTLED
+];
+PAYMENT_EXECUTION_STATUS.DROPPED, PAYMENT_EXECUTION_STATUS.REPLACED, PAYMENT_EXECUTION_STATUS.EXPIRED, PAYMENT_EXECUTION_STATUS.SUPERSEDED;
 /** The payment direction relative to the current actor. */
 const PAYMENT_DIRECTIONS = [
 	"in",
@@ -5477,22 +5637,16 @@ const EVM_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;
 */
 const PAYMENT_DOCUMENT_VERIFYING_CONTRACT = "0x7a5c25aB7ce91d7a475B71cd1ec33E230291f8a4";
 const PAYMENT_ID_RE = /^payment_[0-9A-Za-z]+$/;
-const PAYEE_ID_RE = /^payee_[0-9A-Za-z]+$/;
 const ORG_ID_RE = /^org_[0-9A-Za-z]+$/;
-const USER_ID_RE = /^user_[0-9A-Za-z]+$/;
 const PARTY_ID_RE = /^party_[0-9A-Za-z]+$/;
-const HANDLE_RE = /^@?[a-z0-9][a-z0-9-]{2,31}$/;
-const ORG_HANDLE_RE = /^[a-z0-9][a-z0-9-]{2,31}$/;
+const HANDLE_RE = /^@?[a-z0-9_-]{3,30}$/;
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 const MinorUnitStringSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => MINOR_UNIT_STRING_RE.test(value), { message: "must be a non-negative integer minor-unit string" })));
 const PaymentIdSchema$1 = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => PAYMENT_ID_RE.test(value), { message: "must be payment_ plus an alphanumeric id" })));
-const PayeeIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => PAYEE_ID_RE.test(value), { message: "must be payee_ plus an alphanumeric id" })));
 const OrgIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => ORG_ID_RE.test(value), { message: "must be org_ plus an alphanumeric id" })));
-const UserIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => USER_ID_RE.test(value), { message: "must be user_ plus an alphanumeric id" })));
 const PartyIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => PARTY_ID_RE.test(value), { message: "must be party_ plus an alphanumeric id" })));
 const DecimalStringSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => DECIMAL_STRING_RE.test(value), { message: "must be a non-negative decimal string" })));
 const HandleValueSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => !EVM_ADDRESS_RE.test(value) && HANDLE_RE.test(value), { message: "must be a handle; raw addresses are not accepted" })));
-const OrgHandleValueSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => !EVM_ADDRESS_RE.test(value) && ORG_HANDLE_RE.test(value), { message: "must be an org handle; raw addresses are not accepted" })));
 const EmailValueSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => !EVM_ADDRESS_RE.test(value) && EMAIL_RE.test(value), { message: "must be an email; raw addresses are not accepted" })));
 const Uint8Schema$1 = Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => Number.isSafeInteger(value) && value >= 0 && value <= 255, { message: "must be a uint8" })));
 const Uint64Schema = Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => Number.isSafeInteger(value) && value >= 0, { message: "must be a non-negative safe integer" })));
@@ -5612,42 +5766,39 @@ const WithdrawalDocumentEnvelope = Schema.Struct({
 	primaryType: Schema.Literal("Withdrawal"),
 	message: WithdrawalDocument
 });
-Schema.Union([AttachablePaymentDocumentEnvelope, WithdrawalDocumentEnvelope]);
-Schema.Struct({
-	payeeId: PayeeIdSchema,
-	label: Schema.String,
-	trustState: Schema.Literals([
-		"unverified",
-		"trusted",
-		"blocked"
-	]),
-	destinationKind: Schema.Literals([
-		"handle",
-		"email",
-		"saved-payee",
-		"org"
-	])
-});
-const PaymentRecipient = Schema.Struct({
-	kind: Schema.Literals([
-		"handle",
-		"email",
-		"payee",
-		"capxulUserId",
-		"me",
-		"org",
-		"party",
-		"external_address"
-	]),
-	label: Schema.String,
-	payeeId: Schema.optional(PayeeIdSchema)
-});
+const PaymentDocumentEnvelope = Schema.Union([AttachablePaymentDocumentEnvelope, WithdrawalDocumentEnvelope]);
+const ENVELOPE_PRIMARY_TYPE_TO_KIND = {
+	Memo: "memo",
+	Invoice: "invoice",
+	Payslip: "payslip",
+	Receipt: "receipt",
+	Withdrawal: "withdrawal"
+};
+/**
+* Derive the wire `paymentType` an UNKNOWN document envelope classifies to
+* (payment-document-spec.md D11: memo/withdrawal → unspecified, invoice →
+* invoice, payslip → payroll, receipt → reimbursement), or `undefined` if the
+* envelope is absent / malformed — the same tolerance as
+* `tryHashPaymentDocument`. Callers holding an untyped envelope (e.g. the MCP
+* org spend port, #712) use this so the type they record agrees with the type
+* the backend re-derives from the same document.
+*/
+function paymentTypeForDocumentEnvelope(envelope) {
+	if (envelope === void 0 || envelope === null) return void 0;
+	const decoded = SchemaParser.decodeUnknownResult(PaymentDocumentEnvelope)(envelope);
+	if (decoded._tag === "Failure") return void 0;
+	return paymentTypeForDocumentKind(ENVELOPE_PRIMARY_TYPE_TO_KIND[decoded.success.primaryType]);
+}
+const PaymentRecipient = Schema.Union([Schema.Struct({
+	kind: Schema.Literal("party"),
+	partyId: PartyIdSchema,
+	label: Schema.String
+}), Schema.Struct({
+	kind: Schema.Literal("external_address"),
+	label: Schema.String
+})]);
 /**
-* A raw external EVM address for the B3 withdraw lane — the cash-out
-* destination. This is the ONE schema that ACCEPTS a bare 0x (the withdraw
-* mutation args use it), as opposed to `PaymentRecipientRefSchema` which
-* REJECTS bare addresses to protect the pay lane. The full address never
-* crosses the model wire; it lives on the kind:4 Withdrawal document only.
+* A raw external EVM address for a payment or withdrawal destination.
 */
 const ExternalAddressSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => EVM_ADDRESS_RE.test(value), { message: "must be a 0x EVM address (40 hex chars)" })));
 const PaymentTiming = Schema.Union([
@@ -5673,16 +5824,8 @@ const PaymentRef = Schema.Union([
 		email: EmailValueSchema
 	}),
 	Schema.Struct({
-		kind: Schema.Literal("orgHandle"),
-		orgHandle: OrgHandleValueSchema
-	}),
-	Schema.Struct({
-		kind: Schema.Literal("capxulUserId"),
-		capxulUserId: UserIdSchema
-	}),
-	Schema.Struct({
-		kind: Schema.Literal("payeeId"),
-		payeeId: PayeeIdSchema
+		kind: Schema.Literal("address"),
+		address: ExternalAddressSchema
 	}),
 	Schema.Struct({
 		kind: Schema.Literal("party"),
@@ -5705,6 +5848,10 @@ const Payment = Schema.Struct({
 	timing: PaymentTiming,
 	released: FinancialOpsMoney,
 	availableToClaim: FinancialOpsMoney,
+	execution: Schema.optional(Schema.Struct({
+		status: Schema.Literals(PAYMENT_EXECUTION_STATUSES),
+		retryRequired: Schema.Boolean
+	})),
 	createdAt: EpochMsSchema,
 	updatedAt: EpochMsSchema
 }).pipe(Schema.check(Schema.makeFilter((payment) => payment.documents.every((document) => paymentTypeForDocumentKind(document.kind) === payment.paymentType), { message: "document kind must map to paymentType" })));
@@ -5849,11 +5996,21 @@ const MovementIdentitySchema = Schema.Struct({
 	txHash: TxHashSchema,
 	logIndex: LogIndexSchema
 });
-const MovementCanonicalStateSchema = Schema.Literals([
+const MovementCanonicalStateInputSchema = Schema.Literals([
 	"observed",
+	"included",
 	"finalized",
 	"removed"
 ]);
+const MovementCanonicalStateOutputSchema = Schema.Literals([
+	"observed",
+	"included",
+	"removed"
+]);
+const MovementCanonicalStateSchema = MovementCanonicalStateInputSchema.pipe(Schema.decodeTo(MovementCanonicalStateOutputSchema, {
+	decode: SchemaGetter.transform((state) => state === "finalized" ? "included" : state),
+	encode: SchemaGetter.transform((state) => state)
+}));
 const MovementSchema = Schema.Struct({
 	...MovementIdentitySchema.fields,
 	movementId: MovementIdSchema,
@@ -6204,7 +6361,7 @@ Schema.Struct({
 	transfers: Schema.Array(TransferEvidenceSchema),
 	requestCount: nonNegativeInteger("requestCount")
 });
-const FinalizedMoneyEvidenceCommonSchema = Schema.Struct({
+const VerifiedMoneyEvidenceCommonSchema = Schema.Struct({
 	chainId: BaseSepoliaChainIdSchema,
 	contractAddress: AddressSchema,
 	userOpHash: Bytes32Schema,
@@ -6214,8 +6371,8 @@ const FinalizedMoneyEvidenceCommonSchema = Schema.Struct({
 	blockTimestamp: Uint48Schema,
 	eventLogIndex: LogIndexSchema
 });
-const FinalizedPaymentEvidenceSchema = Schema.Struct({
-	...FinalizedMoneyEvidenceCommonSchema.fields,
+const VerifiedPaymentEvidenceSchema = Schema.Struct({
+	...VerifiedMoneyEvidenceCommonSchema.fields,
 	operation: Schema.Literal("send"),
 	settlementId: SettlementIdSchema,
 	purposeKind: PaymentPurposeKindSchema,
@@ -6227,8 +6384,8 @@ const FinalizedPaymentEvidenceSchema = Schema.Struct({
 	destination: AddressSchema,
 	rawAmount: WeiAmountSchema
 });
-const FinalizedCommitmentCreationEvidenceSchema = Schema.Struct({
-	...FinalizedMoneyEvidenceCommonSchema.fields,
+const VerifiedCommitmentCreationEvidenceSchema = Schema.Struct({
+	...VerifiedMoneyEvidenceCommonSchema.fields,
 	operation: Schema.Literal("create_commitment"),
 	commitmentId: Uint256StringSchema,
 	settlementId: SettlementIdSchema,
@@ -6244,8 +6401,8 @@ const FinalizedCommitmentCreationEvidenceSchema = Schema.Struct({
 	documentHash: NonzeroDocumentHashSchema,
 	transferLogIndex: LogIndexSchema
 });
-const FinalizedCommitmentClaimEvidenceSchema = Schema.Struct({
-	...FinalizedMoneyEvidenceCommonSchema.fields,
+const VerifiedCommitmentClaimEvidenceSchema = Schema.Struct({
+	...VerifiedMoneyEvidenceCommonSchema.fields,
 	operation: Schema.Literal("claim_commitment"),
 	commitmentId: Uint256StringSchema,
 	settlementId: SettlementIdSchema,
@@ -6258,8 +6415,8 @@ const FinalizedCommitmentClaimEvidenceSchema = Schema.Struct({
 	documentHash: NonzeroDocumentHashSchema,
 	transferLogIndex: LogIndexSchema
 });
-const FinalizedCommitmentCancelEvidenceSchema = Schema.Struct({
-	...FinalizedMoneyEvidenceCommonSchema.fields,
+const VerifiedCommitmentCancelEvidenceSchema = Schema.Struct({
+	...VerifiedMoneyEvidenceCommonSchema.fields,
 	operation: Schema.Literal("cancel_commitment"),
 	commitmentId: Uint256StringSchema,
 	settlementId: SettlementIdSchema,
@@ -6273,8 +6430,8 @@ const FinalizedCommitmentCancelEvidenceSchema = Schema.Struct({
 	documentHash: NonzeroDocumentHashSchema,
 	transfer: Schema.NullOr(TransferEvidenceSchema)
 });
-const FinalizedCommitmentRedirectEvidenceSchema = Schema.Struct({
-	...FinalizedMoneyEvidenceCommonSchema.fields,
+const VerifiedCommitmentRedirectEvidenceSchema = Schema.Struct({
+	...VerifiedMoneyEvidenceCommonSchema.fields,
 	operation: Schema.Literal("redirect_commitment"),
 	commitmentId: Uint256StringSchema,
 	settlementId: SettlementIdSchema,
@@ -6285,12 +6442,12 @@ const FinalizedCommitmentRedirectEvidenceSchema = Schema.Struct({
 	documentHash: NonzeroDocumentHashSchema,
 	transfer: Schema.Null
 });
-const FinalizedMoneyEvidenceSchema = Schema.Union([
-	FinalizedPaymentEvidenceSchema,
-	FinalizedCommitmentCreationEvidenceSchema,
-	FinalizedCommitmentClaimEvidenceSchema,
-	FinalizedCommitmentCancelEvidenceSchema,
-	FinalizedCommitmentRedirectEvidenceSchema
+const VerifiedMoneyEvidenceSchema = Schema.Union([
+	VerifiedPaymentEvidenceSchema,
+	VerifiedCommitmentCreationEvidenceSchema,
+	VerifiedCommitmentClaimEvidenceSchema,
+	VerifiedCommitmentCancelEvidenceSchema,
+	VerifiedCommitmentRedirectEvidenceSchema
 ]);
 Schema.Union([
 	Schema.Struct({
@@ -6300,7 +6457,7 @@ Schema.Union([
 	}),
 	Schema.Struct({
 		status: Schema.Literal("verified"),
-		evidence: FinalizedMoneyEvidenceSchema
+		evidence: VerifiedMoneyEvidenceSchema
 	}),
 	Schema.Struct({
 		status: Schema.Literal("mismatch"),
@@ -6312,7 +6469,7 @@ Schema.Union([
 		retryable: Schema.Literal(true)
 	})
 ]);
-const FinalizedAttributedInboundMovementSchema = Schema.Struct({
+const VerifiedAttributedInboundMovementSchema = Schema.Struct({
 	movement: MovementSchema,
 	attribution: MovementAttributionSchema
 });
@@ -6338,6 +6495,25 @@ const ProtocolBirthInputSchema = Schema.Struct({
 	release: ReleaseTermsSchema,
 	lineage: Schema.optional(PaymentCommandLineageSchema)
 }).pipe(Schema.refine((birth) => hasActorBoundPermission(birth.actor, birth.actor.kind === "organization" ? birth.actor.orgId : void 0, birth.permissionId), { message: "Organization Payment and Payout births require permissionId; personal births forbid it" }));
+const ApplyVerifiedEvidenceCommandSchema = Schema.Struct({
+	kind: Schema.Literal("apply_verified_evidence"),
+	paymentId: PaymentIdSchema,
+	evidence: VerifiedMoneyEvidenceSchema
+});
+const ApplyFinalizedEvidenceCommandSchema = Schema.Struct({
+	kind: Schema.Literal("apply_finalized_evidence"),
+	paymentId: PaymentIdSchema,
+	evidence: VerifiedMoneyEvidenceSchema
+}).pipe(Schema.decodeTo(ApplyVerifiedEvidenceCommandSchema, {
+	decode: SchemaGetter.transform((value) => ({
+		...value,
+		kind: "apply_verified_evidence"
+	})),
+	encode: SchemaGetter.transform((value) => ({
+		...value,
+		kind: "apply_finalized_evidence"
+	}))
+}));
 Schema.Union([
 	Schema.Struct({
 		kind: Schema.Literal("birth"),
@@ -6345,7 +6521,7 @@ Schema.Union([
 	}),
 	Schema.Struct({
 		kind: Schema.Literal("birth_deposit"),
-		movement: FinalizedAttributedInboundMovementSchema
+		movement: VerifiedAttributedInboundMovementSchema
 	}),
 	Schema.Struct({
 		kind: Schema.Literal("rollback_deposit"),
@@ -6357,11 +6533,8 @@ Schema.Union([
 		paymentIds: Schema.Array(PaymentIdSchema),
 		userOpHash: Bytes32Schema
 	}),
-	Schema.Struct({
-		kind: Schema.Literal("apply_finalized_evidence"),
-		paymentId: PaymentIdSchema,
-		evidence: FinalizedMoneyEvidenceSchema
-	}),
+	ApplyVerifiedEvidenceCommandSchema,
+	ApplyFinalizedEvidenceCommandSchema,
 	Schema.Struct({
 		kind: Schema.Literal("transition"),
 		paymentId: PaymentIdSchema,
@@ -6503,6 +6676,7 @@ const MoneyExecutionIdSchema = Schema.String.pipe(Schema.refine((value) => /^mon
 const OwnerSignatureSchema = Schema.String.pipe(Schema.refine((value) => /^0x[0-9a-fA-F]{130}$/u.test(value), { message: "signature must be a 65-byte 0x value" }));
 const PaymentExecutionIntentSchema = Schema.Struct({
 	to: PaymentRef,
+	externalAddressAcknowledged: Schema.optional(Schema.Literal(true)),
 	amount: FinancialOpsMoney,
 	paymentType: Schema.optional(Schema.Literals([
 		"unspecified",
@@ -6519,7 +6693,31 @@ Schema.Struct({
 	signerAddress: AddressSchema,
 	payment: PaymentExecutionIntentSchema
 });
+const RecipientObservationSchema = Schema.Struct({
+	recipient_locator_kind: Schema.Literals([
+		"handle",
+		"email",
+		"party",
+		"address"
+	]),
+	recipient_resolution_status: Schema.Literals([
+		"known_party",
+		"new_email",
+		"external_address"
+	]),
+	recipient_is_capxul_account: Schema.Boolean,
+	recipient_party_id: Schema.optional(Schema.String),
+	recipient_party_kind: Schema.optional(Schema.Literals([
+		"person",
+		"organization",
+		"unresolved"
+	])),
+	recipient_handle: Schema.optional(Schema.String),
+	recipient_address: AddressSchema,
+	external_address_acknowledged: Schema.Boolean
+});
 Schema.Struct({
+	recipientObservation: RecipientObservationSchema,
 	executionId: MoneyExecutionIdSchema,
 	commandId: PaymentCommandIdSchema,
 	paymentId: PaymentIdSchema,
@@ -6536,6 +6734,14 @@ Schema.Struct({
 	executionId: MoneyExecutionIdSchema,
 	signature: OwnerSignatureSchema
 });
+Schema.Struct({
+	executionId: MoneyExecutionIdSchema,
+	reason: Schema.Literals([
+		"signer_rejected",
+		"cancelled",
+		"prepared_mismatch"
+	])
+});
 Schema.Struct({
 	executionId: MoneyExecutionIdSchema,
 	commandId: PaymentCommandIdSchema,
@@ -6549,6 +6755,10 @@ Schema.Struct({
 	payments: Schema.Array(Payment)
 });
 const PaymentLifecycleExecutionIntentSchema = Schema.Union([
+	Schema.Struct({
+		kind: Schema.Literal("retry"),
+		paymentId: PaymentIdSchema
+	}),
 	Schema.Struct({
 		kind: Schema.Literal("claim"),
 		paymentId: PaymentIdSchema
@@ -6569,6 +6779,7 @@ Schema.Struct({
 });
 const OrganizationPaymentExecutionItemSchema = Schema.Struct({
 	to: PaymentRef,
+	externalAddressAcknowledged: Schema.optional(Schema.Literal(true)),
 	amount: FinancialOpsMoney,
 	paymentType: Schema.optional(Schema.Literals([
 		"unspecified",
@@ -6587,6 +6798,8 @@ Schema.Struct({
 	lineage: Schema.optional(PaymentCommandLineageSchema)
 });
 const PreparedPaymentCommandExecutionSchema = Schema.Struct({
+	recipientObservations: Schema.Array(RecipientObservationSchema),
+	emitPaymentInitiated: Schema.Boolean,
 	executionId: MoneyExecutionIdSchema,
 	commandId: PaymentCommandIdSchema,
 	paymentIds: Schema.Array(PaymentIdSchema),
@@ -6622,7 +6835,8 @@ const PermissionCommandSchema = Schema.Union([
 		operation: Schema.Literal("assign"),
 		requestKey: nonEmpty("requestKey"),
 		permissionId: PermissionIdSchema,
-		accountId: nonEmpty("accountId")
+		accountId: nonEmpty("accountId"),
+		expectedMemberEmail: Schema.optional(nonEmpty("expectedMemberEmail"))
 	}),
 	Schema.Struct({
 		operation: Schema.Literal("revoke"),
@@ -10806,25 +11020,11 @@ function normalizeRefForBackend$1(ref, field) {
 					email: nonEmptyRefValue$1(ref.email, "email")
 				}
 			};
-			case "orgHandle": return {
+			case "address": return {
 				ok: true,
 				value: {
-					kind: "orgHandle",
-					orgHandle: nonEmptyRefValue$1(ref.orgHandle, "orgHandle")
-				}
-			};
-			case "capxulUserId": return {
-				ok: true,
-				value: {
-					kind: "capxulUserId",
-					capxulUserId: nonEmptyRefValue$1(ref.capxulUserId, "capxulUserId")
-				}
-			};
-			case "payeeId": return {
-				ok: true,
-				value: {
-					kind: "payeeId",
-					payeeId: nonEmptyRefValue$1(ref.payeeId, "payeeId")
+					kind: "address",
+					address: toAddress(ref.address)
 				}
 			};
 			case "party": return {
@@ -11088,10 +11288,7 @@ function makeAccountMethods(deps) {
 const financialOpsContract = {
 	me: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].me),
 	depositInstructions: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].depositInstructions),
-	resolveHandle: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].resolveHandle),
-	createPayee: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/mutations"].createPayee),
-	getPayee: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].getPayee),
-	resolvePayee: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].resolvePayee),
+	resolveRecipient: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].resolveRecipient),
 	addDestination: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/destinations"].add),
 	listDestinations: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/destinations"].list),
 	removeDestination: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/destinations"].remove),
@@ -11107,6 +11304,7 @@ const financialOpsContract = {
 //#endregion
 //#region ../../packages/sdk/src/contract/money-execution.ts
 const moneyExecutionContract = {
+	abandonPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].abandonPaymentExecution),
 	preparePermissionExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePermissionExecution),
 	preparePaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePaymentExecution),
 	prepareOrganizationPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].prepareOrganizationPaymentExecution),
@@ -11117,7 +11315,7 @@ const moneyExecutionContract = {
 };
 //#endregion
 //#region ../../packages/sdk/package.json
-var version$1 = "3.2.0";
+var version$1 = "4.0.0";
 //#endregion
 //#region ../../packages/sdk/src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -11633,7 +11831,11 @@ function emitPaymentInitiated(telemetry, input) {
 		name: "payment_initiated",
 		props: {
 			kind: input.kind,
-			payment_id: input.paymentId
+			payment_id: input.paymentId,
+			payment_lifecycle_id: `payment_lifecycle_${input.paymentId}`,
+			...input.commandId === void 0 ? {} : { command_id: input.commandId },
+			...input.executionId === void 0 ? {} : { execution_id: input.executionId },
+			...input.recipient
 		}
 	});
 }
@@ -11665,7 +11867,17 @@ async function fingerprintPaymentIntent(intent) {
 function matchesIntent(expected) {
 	return async (request) => await fingerprintPaymentIntent(request) === await fingerprintPaymentIntent(expected);
 }
-async function executePrepared(deps, prepare, isExpectedRequest, signal) {
+async function abandonPrepared$1(deps, executionId, closePayment, reason, result, onPreparedClosed) {
+	if (!closePayment) return result;
+	const abandoned = await runIfActive(void 0, CAPXUL_OPERATIONS.moneyExecution.abandonPaymentExecution, () => deps.convexCall.action(deps.functions.abandonPaymentExecution, { input: {
+		executionId,
+		reason
+	} }));
+	if (!abandoned.ok) return abandoned;
+	if (abandoned.value) onPreparedClosed?.();
+	return result;
+}
+async function executePrepared(deps, prepare, isExpectedRequest, closePaymentOnExit, onPreparedClosed, signal) {
 	if (isAborted$2(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
@@ -11686,32 +11898,45 @@ async function executePrepared(deps, prepare, isExpectedRequest, signal) {
 	}
 	const prepared = await prepare(signerAddress);
 	if (!prepared.ok) return prepared;
-	if (!await isExpectedRequest(prepared.value.request)) return {
+	if (!await isExpectedRequest(prepared.value.request)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "prepared_mismatch", {
 		ok: false,
 		error: Errors.invalidInput("payment", "prepared command mismatch")
-	};
+	}, onPreparedClosed);
 	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
-	if (prepared.value.chainId !== deps.chainId || prepared.value.signerAddress.toLowerCase() !== signerAddress.toLowerCase() || prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return {
+	if (prepared.value.chainId !== deps.chainId || prepared.value.signerAddress.toLowerCase() !== signerAddress.toLowerCase() || prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "prepared_mismatch", {
 		ok: false,
 		error: Errors.invalidInput("payment", "prepared authority mismatch")
-	};
-	if (isAborted$2(signal)) return {
+	}, onPreparedClosed);
+	if (isAborted$2(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
-	};
+	}, onPreparedClosed);
+	if (prepared.value.emitPaymentInitiated && "items" in prepared.value.request) for (const [index, item] of prepared.value.request.items.entries()) {
+		const paymentId = prepared.value.paymentIds[index];
+		const recipient = prepared.value.recipientObservations[index];
+		if (paymentId === void 0 || recipient === void 0) continue;
+		const paymentType = paymentTypeForDocumentEnvelope(item.document) ?? item.paymentType ?? "unspecified";
+		await emitPaymentInitiated(deps.telemetry, {
+			commandId: prepared.value.commandId,
+			executionId: prepared.value.executionId,
+			paymentId,
+			kind: paymentType === "unspecified" ? "quick_pay" : paymentType,
+			recipient
+		});
+	}
 	let signature;
 	try {
 		signature = await deps.signer.signUserOpHash(prepared.value.digest);
 	} catch (cause) {
-		return {
+		return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "signer_rejected", {
 			ok: false,
 			error: signerFailure(deps.signer.source, "signUserOpHash", cause)
-		};
+		}, onPreparedClosed);
 	}
-	if (isAborted$2(signal)) return {
+	if (isAborted$2(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
-	};
+	}, onPreparedClosed);
 	return runIfActive(void 0, CAPXUL_OPERATIONS.payments.submitCommandExecution, () => deps.convexCall.action(deps.functions.submitPaymentCommandExecution, { input: {
 		executionId: prepared.value.executionId,
 		signature
@@ -11721,13 +11946,13 @@ function executePaymentLifecycle(deps, intent, signal) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.payments.prepareLifecycleExecution, () => deps.convexCall.action(deps.functions.preparePaymentLifecycleExecution, { input: {
 		signerAddress,
 		intent
-	} })), matchesIntent(intent), signal);
+	} })), matchesIntent(intent), false, void 0, signal);
 }
-function executeOrganizationPayment(deps, input, signal) {
+function executeOrganizationPayment(deps, input, signal, onPreparedClosed) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.organizationPayments.prepareExecution, () => deps.convexCall.action(deps.functions.prepareOrganizationPaymentExecution, { input: {
 		...input,
 		signerAddress
-	} })), matchesIntent(input), signal);
+	} })), matchesIntent(input), true, onPreparedClosed, signal);
 }
 //#endregion
 //#region ../../packages/sdk/src/surface/payment-execution.ts
@@ -11759,7 +11984,16 @@ async function signerCall(source, operation, run) {
 		};
 	}
 }
-async function executePersonalPayment(deps, payment, signal, requestKey) {
+async function abandonPrepared(deps, executionId, reason, result, onPreparedClosed) {
+	const abandoned = await runIfActive(void 0, CAPXUL_OPERATIONS.moneyExecution.abandonPaymentExecution, () => deps.convexCall.action(deps.functions.abandonPaymentExecution, { input: {
+		executionId,
+		reason
+	} }));
+	if (!abandoned.ok) return abandoned;
+	if (abandoned.value) onPreparedClosed?.();
+	return result;
+}
+async function executePersonalPayment(deps, payment, signal, requestKey, onPreparedClosed) {
 	if (isAborted$1(signal)) return cancelled(CAPXUL_OPERATIONS.payments.pay);
 	if (deps.signer === void 0) return mismatch("signer", "payments.pay requires a configured CapxulSigner");
 	const session = deps.actor.authSession();
@@ -11777,18 +12011,21 @@ async function executePersonalPayment(deps, payment, signal, requestKey) {
 		payment
 	} }));
 	if (!prepared.ok) return prepared;
-	if (prepared.value.requestKey !== resolvedRequestKey || canonicalJson(prepared.value.payment) !== canonicalJson(payment)) return mismatch("payment", "prepared Payment execution uses another request");
-	if (prepared.value.chainId !== deps.chainId) return mismatch("chainId", "prepared Payment execution uses another chain");
-	if (prepared.value.signerAddress.toLowerCase() !== signerAddress.value.toLowerCase()) return mismatch("signerAddress", "prepared Payment execution uses another signer");
-	if (prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return mismatch("userOpSenderSafe", "prepared Payment execution uses another Account Safe");
+	if (prepared.value.requestKey !== resolvedRequestKey || canonicalJson(prepared.value.payment) !== canonicalJson(payment)) return abandonPrepared(deps, prepared.value.executionId, "prepared_mismatch", mismatch("payment", "prepared Payment execution uses another request"), onPreparedClosed);
+	if (prepared.value.chainId !== deps.chainId) return abandonPrepared(deps, prepared.value.executionId, "prepared_mismatch", mismatch("chainId", "prepared Payment execution uses another chain"), onPreparedClosed);
+	if (prepared.value.signerAddress.toLowerCase() !== signerAddress.value.toLowerCase()) return abandonPrepared(deps, prepared.value.executionId, "prepared_mismatch", mismatch("signerAddress", "prepared Payment execution uses another signer"), onPreparedClosed);
+	if (prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return abandonPrepared(deps, prepared.value.executionId, "prepared_mismatch", mismatch("userOpSenderSafe", "prepared Payment execution uses another Account Safe"), onPreparedClosed);
 	if (prepared.value.emitPaymentInitiated) await emitPaymentInitiated(deps.telemetry, {
 		kind: prepared.value.purposeKind,
-		paymentId: prepared.value.paymentId
+		paymentId: prepared.value.paymentId,
+		commandId: prepared.value.commandId,
+		executionId: prepared.value.executionId,
+		recipient: prepared.value.recipientObservation
 	});
-	if (isAborted$1(signal)) return cancelled(CAPXUL_OPERATIONS.payments.pay);
+	if (isAborted$1(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
 	const signature = await signerCall(deps.signer.source, "signUserOpHash", () => deps.signer.signUserOpHash(prepared.value.digest));
-	if (!signature.ok) return signature;
-	if (isAborted$1(signal)) return cancelled(CAPXUL_OPERATIONS.payments.pay);
+	if (!signature.ok) return abandonPrepared(deps, prepared.value.executionId, "signer_rejected", signature, onPreparedClosed);
+	if (isAborted$1(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
 	return runIfActive(void 0, CAPXUL_OPERATIONS.payments.submitExecution, () => deps.convexCall.action(deps.functions.submitPaymentExecution, { input: {
 		executionId: prepared.value.executionId,
 		signature: signature.value
@@ -12016,6 +12253,30 @@ async function waitForPaymentSubmission(submission, signal, operation, onCancel
 		});
 	});
 }
+function normalizeActivityDetail(detail) {
+	if (detail === null) return null;
+	if (detail.kind === "payment") {
+		if (detail.evidence === null) return detail;
+		return {
+			...detail,
+			evidence: {
+				...detail.evidence,
+				inclusion: "included",
+				verification: "verified",
+				finality: "finalized"
+			}
+		};
+	}
+	return {
+		...detail,
+		evidence: {
+			...detail.evidence,
+			inclusion: "included",
+			verification: "verified",
+			canonicalState: "finalized"
+		}
+	};
+}
 function paymentExecutionIntent(input) {
 	if (actorReferenceToBackend(input.actor)?.kind === "org") return {
 		ok: false,
@@ -12028,6 +12289,7 @@ function paymentExecutionIntent(input) {
 		value: {
 			to: to.value,
 			amount: input.amount,
+			...input.externalAddressAcknowledged === void 0 ? {} : { externalAddressAcknowledged: input.externalAddressAcknowledged },
 			...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
 			...input.document === void 0 ? {} : { document: input.document },
 			...input.timing === void 0 ? {} : { timing: input.timing },
@@ -12065,6 +12327,7 @@ function makeFinancialOpsMethods(deps) {
 		let flight = inFlightPersonalPayments.get(sharedKey);
 		if (flight === void 0) {
 			const controller = new AbortController();
+			const requestState = { resolved: false };
 			const submission = executePersonalPayment({
 				actor: deps.actor,
 				chainId: deps.chainId,
@@ -12072,10 +12335,11 @@ function makeFinancialOpsMethods(deps) {
 				functions: executionFns,
 				...deps.signer === void 0 ? {} : { signer: deps.signer },
 				...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
-			}, payment.value, controller.signal, requestKey.key);
+			}, payment.value, controller.signal, requestKey.key, () => requestState.resolved = true);
 			flight = {
 				controller,
 				promise: submission,
+				requestState,
 				waiters: 0,
 				settled: false
 			};
@@ -12113,7 +12377,7 @@ function makeFinancialOpsMethods(deps) {
 		}
 		release(false);
 		try {
-			await requestKey.finish(submitted.ok);
+			await requestKey.finish(submitted.ok || flight.requestState.resolved);
 		} catch {}
 		return mapOk(submitted, (value) => normalizePaymentTiming(value.payment));
 	};
@@ -12153,61 +12417,34 @@ function makeFinancialOpsMethods(deps) {
 			};
 		}
 	};
+	const retryPayment = async (paymentId, signal) => {
+		const execution = lifecycleDependencies();
+		if (!execution.ok) return execution;
+		try {
+			const submitted = await executePaymentLifecycle(execution.value, {
+				kind: "retry",
+				paymentId
+			}, signal);
+			return submitted.ok ? {
+				ok: true,
+				value: submitted.value.payments.map((payment) => normalizePaymentTiming(payment))
+			} : submitted;
+		} catch (cause) {
+			return {
+				ok: false,
+				error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
+			};
+		}
+	};
 	return {
 		me: {
 			get: (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.me.get, () => deps.convexCall.query(fns.me, {})),
 			depositInstructions: (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.me.depositInstructions, () => deps.convexCall.query(fns.depositInstructions, {}).pipe(Effect.tap(() => Effect.promise(() => emitDepositInitiated(deps.telemetry)))))
 		},
-		handles: { resolve: (handle, options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.handles.resolve, () => deps.convexCall.query(fns.resolveHandle, { handle })) },
-		payees: {
-			create: (input, options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.payees.create, () => deps.convexCall.mutation(fns.createPayee, {
-				label: input.label,
-				recipient: input.recipient,
-				...input.handle === void 0 ? {} : { handle: input.handle }
-			})),
-			get: (payeeId, options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.payees.get, () => deps.convexCall.query(fns.getPayee, { payeeId })),
-			resolve: (recipient, options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.payees.resolve, () => deps.convexCall.query(fns.resolvePayee, { recipient }))
-		},
 		targets: { resolve: async (reference, options) => {
-			switch (reference.kind) {
-				case "handle": return mapOk(await runIfActive(options?.signal, CAPXUL_OPERATIONS.targets.resolve.handle, () => deps.convexCall.query(fns.resolveHandle, { handle: reference.handle })), (target) => resolvedTargetFromResolution(reference, target));
-				case "email": return mapOk(await runIfActive(options?.signal, CAPXUL_OPERATIONS.targets.resolve.email, () => deps.convexCall.query(fns.resolvePayee, { recipient: reference.email })), (target) => resolvedTargetFromResolution(reference, target));
-				case "organization": {
-					const resolved = await runIfActive(options?.signal, CAPXUL_OPERATIONS.targets.resolve.organization, () => deps.convexCall.query(fns.resolveHandle, { handle: reference.handle }));
-					if (!resolved.ok) return {
-						ok: false,
-						error: resolved.error
-					};
-					if (resolved.value.kind !== "org") return {
-						ok: false,
-						error: Errors.invalidInput("reference", "organization handle could not be resolved")
-					};
-					return {
-						ok: true,
-						value: resolvedTargetFromResolution(reference, resolved.value)
-					};
-				}
-				case "payee": {
-					const payee = await runIfActive(options?.signal, CAPXUL_OPERATIONS.targets.resolve.payee, () => deps.convexCall.query(fns.getPayee, { payeeId: reference.id }));
-					if (!payee.ok) return {
-						ok: false,
-						error: payee.error
-					};
-					if (payee.value === null) return {
-						ok: false,
-						error: Errors.invalidInput("reference", "payee not found")
-					};
-					return {
-						ok: true,
-						value: resolvedTargetFromPayee(reference, payee.value)
-					};
-				}
-				case "party":
-				case "destination": return Promise.resolve({
-					ok: false,
-					error: Errors.notImplemented("targets", `resolve.${reference.kind}`)
-				});
-			}
+			const recipient = normalizeTargetForBackend(reference, "reference");
+			if (!recipient.ok) return recipient;
+			return mapOk(await runIfActive(options?.signal, CAPXUL_OPERATIONS.recipient.resolve, () => deps.convexCall.query(fns.resolveRecipient, { recipient: recipient.value })), resolvedTargetFromResolution);
 		} },
 		destinations: {
 			add: async (input, options) => {
@@ -12250,6 +12487,7 @@ function makeFinancialOpsMethods(deps) {
 		},
 		payments: {
 			pay,
+			retry: (paymentId, options) => retryPayment(paymentId, options?.signal),
 			createCommitment: (input, options) => pay(input, options),
 			claim: (paymentId, options) => runLifecycle({
 				kind: "claim",
@@ -12292,7 +12530,7 @@ function makeFinancialOpsMethods(deps) {
 						...reference.kind === "payment" ? activityActorField(reference.actor) : {}
 					},
 					...actor === void 0 ? {} : { actor }
-				}));
+				}).pipe(Effect.map(normalizeActivityDetail)));
 			},
 			annotate: (input, options) => {
 				if (input.actor !== void 0 && input.reference.kind === "payment" && input.reference.actor !== void 0 && !sameActor(input.actor, input.reference.actor)) return Promise.resolve({
@@ -12379,18 +12617,11 @@ function refFromTargetReference(reference, field) {
 					email: reference.email
 				}
 			};
-			case "organization": return {
+			case "address": return {
 				ok: true,
 				value: {
-					kind: "orgHandle",
-					orgHandle: reference.handle
-				}
-			};
-			case "payee": return {
-				ok: true,
-				value: {
-					kind: "payeeId",
-					payeeId: reference.id
+					kind: "address",
+					address: reference.address
 				}
 			};
 			case "party": return {
@@ -12400,10 +12631,6 @@ function refFromTargetReference(reference, field) {
 					partyId: reference.partyId
 				}
 			};
-			case "destination": return {
-				ok: false,
-				error: Errors.notImplemented("targets", "reference.destination")
-			};
 			default: return {
 				ok: false,
 				error: Errors.invalidInput(field, "target must be a known TargetReference variant")
@@ -12458,39 +12685,28 @@ function targetReferenceFromBackendRef(ref) {
 			kind: "email",
 			email: ref.email
 		};
-		case "orgHandle": return {
-			kind: "organization",
-			handle: ref.orgHandle
-		};
-		case "payeeId": return {
-			kind: "payee",
-			id: ref.payeeId
+		case "address": return {
+			kind: "address",
+			address: ref.address
 		};
 		case "party": return {
 			kind: "party",
 			partyId: ref.partyId
 		};
-		case "capxulUserId": throw Errors.notImplemented("targets", "reference.capxulUserId");
 	}
 }
-function resolvedTargetFromResolution(reference, resolution) {
-	const kind = resolution.kind === "org" ? "organization" : resolution.kind === "payee" ? "payee" : "person";
+function resolvedTargetFromResolution(resolution) {
+	const kind = resolution.status === "known_party" ? resolution.partyKind === "org" ? "organization" : "person" : resolution.status === "external_address" ? "external_address" : "unresolved";
 	return {
-		reference,
+		reference: targetReferenceFromBackendRef(resolution.recipient),
 		label: resolution.label,
+		status: resolution.status,
 		kind,
-		capabilities: {
-			canPay: true,
-			canRequest: true,
-			canPayout: false
-		}
-	};
-}
-function resolvedTargetFromPayee(reference, payee) {
-	return {
-		reference,
-		label: payee.label,
-		kind: "payee",
+		safeAddress: toAddress(resolution.safeAddress),
+		isCapxulAccount: resolution.isCapxulAccount,
+		...resolution.partyId === void 0 ? {} : { partyId: toPartyId(resolution.partyId) },
+		...resolution.handle === void 0 ? {} : { handle: resolution.handle },
+		...resolution.requiresAcknowledgement === void 0 ? {} : { requiresAcknowledgement: resolution.requiresAcknowledgement },
 		capabilities: {
 			canPay: true,
 			canRequest: true,
@@ -12548,10 +12764,6 @@ function destinationFromBackend(destination) {
 	};
 }
 function normalizeDestinationRefForBackend(ref, field) {
-	if (typeof ref === "object" && ref !== null && "kind" in ref && ref.kind === "capxulUserId") return {
-		ok: false,
-		error: Errors.notImplemented("targets", "reference.capxulUserId")
-	};
 	return normalizeRefForBackend(ref, field);
 }
 function normalizeRefForBackend(ref, field) {
@@ -12579,25 +12791,11 @@ function normalizeRefForBackend(ref, field) {
 					email: nonEmptyRefValue(ref.email, "email")
 				}
 			};
-			case "orgHandle": return {
-				ok: true,
-				value: {
-					kind: "orgHandle",
-					orgHandle: nonEmptyRefValue(ref.orgHandle, "orgHandle")
-				}
-			};
-			case "capxulUserId": return {
-				ok: true,
-				value: {
-					kind: "capxulUserId",
-					capxulUserId: nonEmptyRefValue(ref.capxulUserId, "capxulUserId")
-				}
-			};
-			case "payeeId": return {
+			case "address": return {
 				ok: true,
 				value: {
-					kind: "payeeId",
-					payeeId: nonEmptyRefValue(ref.payeeId, "payeeId")
+					kind: "address",
+					address: toAddress(ref.address)
 				}
 			};
 			case "party": return {
@@ -17185,9 +17383,16 @@ const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
 	"org/actions:submitBootstrap",
 	"org/actions:resumeBootstrapSubmission",
 	"org/actions:confirmBootstrap",
-	"org/actions:readTreasury"
+	"org/actions:readTreasury",
+	"moneyExecution/actions:preparePaymentExecution",
+	"moneyExecution/actions:abandonPaymentExecution",
+	"moneyExecution/actions:submitPaymentExecution",
+	"moneyExecution/paymentCommandActions:preparePaymentLifecycleExecution",
+	"moneyExecution/paymentCommandActions:prepareOrganizationPaymentExecution",
+	"moneyExecution/paymentCommandActions:submitPaymentCommandExecution"
 ]);
 const OBSERVED_CONVEX_QUERIES = /* @__PURE__ */ new Set([
+	"financialOps/queries:resolveRecipient",
 	"identity/queries:loadByAuthUserId",
 	"smartAccount/queries:loadByAuthUserId",
 	"org/lifecycle:load"
@@ -17431,12 +17636,13 @@ function ConvexIdentityLayer() {
 function brandProfile(raw) {
 	return {
 		authUserId: toAuthUserId(raw.authUserId),
+		...raw.testerKind === void 0 ? {} : { testerKind: toTesterKind(raw.testerKind) },
 		email: toEmail(raw.email),
 		displayName: raw.displayName,
 		country: raw.country === null ? null : toCountryCode(raw.country),
 		onboarded: raw.onboarded ?? false,
 		withdrawalAddress: raw.withdrawalAddress === null || raw.withdrawalAddress === void 0 ? null : toAddress(raw.withdrawalAddress),
-		username: raw.username ?? null,
+		handle: raw.handle === null || raw.handle === void 0 ? null : toHandle(raw.handle),
 		imageUrl: raw.imageUrl ?? null,
 		kycTier: toKycTier(raw.kycTier),
 		createdAt: toEpochMs(raw.createdAt),
@@ -17712,8 +17918,9 @@ var OrgPortTag = class extends Context.Service()("@capxul/sdk/ports/OrgPort") {}
 function brandOrgView(wire, treasury, viewerRole) {
 	return {
 		id: toOrgId(wire.orgId),
+		...wire.creationSource === void 0 ? {} : { creationSource: toTesterKind(wire.creationSource) },
 		name: wire.name,
-		handle: wire.slug,
+		handle: wire.handle,
 		safeAddress: toAddress(wire.safeAddress.toLowerCase()),
 		role: viewerRole,
 		treasury,
@@ -42467,7 +42674,7 @@ function makeSmartAccountMethods(deps) {
 }
 //#endregion
 //#region ../../packages/sdk/src/contract/identity.ts
-const usernameAvailableQuery = makeFunctionReference(CAPXUL_FUNCTIONS["identity/queries"].usernameAvailable);
+const handleAvailableQuery = makeFunctionReference(CAPXUL_FUNCTIONS["identity/queries"].handleAvailable);
 //#endregion
 //#region ../../packages/sdk/src/surface/identity-deps.ts
 /** The single Context tag the profile atom + `identity.loadCurrent` resolve. */
@@ -42511,19 +42718,19 @@ function makeIdentityMethods(deps) {
 				ok: false,
 				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.identity.completeProfile })
 			};
-			if (typeof profile !== "object" || profile === null || typeof profile.displayName !== "string" || typeof profile.country !== "string" || typeof profile.username !== "string") return {
+			if (typeof profile !== "object" || profile === null || typeof profile.displayName !== "string" || typeof profile.country !== "string" || typeof profile.handle !== "string") return {
 				ok: false,
 				error: Errors.invalidInput("profile", "invalid profile")
 			};
 			const displayName = profile.displayName.trim();
-			const username = profile.username.trim();
+			const handle = profile.handle.trim();
 			if (displayName.length === 0) return {
 				ok: false,
 				error: Errors.invalidInput("displayName", "must not be empty")
 			};
-			if (username.length === 0) return {
+			if (handle.length === 0) return {
 				ok: false,
-				error: Errors.invalidInput("username", "must not be empty")
+				error: Errors.invalidInput("handle", "must not be empty")
 			};
 			let country;
 			try {
@@ -42544,98 +42751,259 @@ function makeIdentityMethods(deps) {
 				email: session.email,
 				displayName,
 				country,
-				username
+				handle
 			}), options, CAPXUL_OPERATIONS.identity.completeProfile);
 		},
-		async usernameAvailable(username, options) {
+		async handleAvailable(handle, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.identity.usernameAvailable })
+				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.identity.handleAvailable })
 			};
 			if (convexCall === void 0) return {
 				ok: false,
-				error: Errors.notImplemented("identity", "usernameAvailable")
+				error: Errors.notImplemented("identity", "handleAvailable")
 			};
-			return runPortEffect(convexCall.query(usernameAvailableQuery, { username }));
+			return runPortEffect(convexCall.query(handleAvailableQuery, { handle }));
 		}
 	};
 }
 //#endregion
 //#region ../../packages/sdk/src/surface/onboarding.ts
-const USERNAME_PATTERN = /^[a-z0-9_]{3,30}$/;
-function makeOnboardingMethods(deps) {
-	return { async completePerson(input, options) {
-		const isCancelled = () => options?.signal?.aborted === true;
-		if (typeof input !== "object" || input === null || typeof input.displayName !== "string" || typeof input.country !== "string" || typeof input.username !== "string" || !USERNAME_PATTERN.test(input.username.trim())) return {
-			ok: false,
-			error: Errors.invalidInput("username", "must be 3-30 characters of a-z, 0-9, or underscore")
+function normalizeHandleInput(input) {
+	if (typeof input !== "string") return {
+		ok: false,
+		error: Errors.invalidInput("handle", "is required")
+	};
+	try {
+		return {
+			ok: true,
+			value: validateHandle(input)
 		};
-		const username = input.username.trim();
-		const session = await deps.restoreSession(options);
-		if (!session.ok) return session;
-		if (session.value === null) return {
+	} catch (error) {
+		if (isCapxulError(error)) return {
 			ok: false,
-			error: Errors.notAuthenticated()
+			error
 		};
-		const available = await deps.usernameAvailable(username, options);
-		if (!available.ok) return available;
-		if (!available.value.available) return {
+		return {
 			ok: false,
-			error: Errors.invalidInput("username", "username is already taken")
+			error: Errors.unknown(error)
 		};
-		const completed = await deps.completeProfile({
-			...input,
-			username: available.value.normalized
-		}, options);
-		if (!completed.ok) return completed;
-		const refreshed = await deps.refreshIdentity(options);
-		if (!refreshed.ok) return refreshed;
-		if (isCancelled()) return {
+	}
+}
+function normalizeOrganization(input) {
+	if (typeof input !== "object" || input === null) return {
+		ok: false,
+		error: Errors.invalidInput("organization", "is required")
+	};
+	const name = typeof input.name === "string" ? input.name.trim() : "";
+	if (name.length === 0) return {
+		ok: false,
+		error: Errors.invalidInput("name", "is required")
+	};
+	const handle = normalizeHandleInput(input.handle);
+	if (!handle.ok) return handle;
+	if (input.bio !== void 0 && typeof input.bio !== "string") return {
+		ok: false,
+		error: Errors.invalidInput("bio", "must be text")
+	};
+	if (input.size !== void 0 && typeof input.size !== "string") return {
+		ok: false,
+		error: Errors.invalidInput("size", "must be text")
+	};
+	let country;
+	try {
+		country = toCountryCode(input.country);
+	} catch {
+		return {
 			ok: false,
-			error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
+			error: Errors.invalidInput("country", "must be an ISO country code")
 		};
-		const ensured = await deps.ensureAccount();
+	}
+	const bio = input.bio?.trim() ?? "";
+	const size = input.size?.trim() ?? "";
+	return {
+		ok: true,
+		value: {
+			name,
+			handle: handle.value,
+			country,
+			...bio.length === 0 ? {} : { bio },
+			...size.length === 0 ? {} : { size }
+		}
+	};
+}
+function isClaimedIdentityState(state) {
+	return state.phase === "authenticated" && state.account.at === "claimed";
+}
+function organizationWrongState(currentState, validStates) {
+	return {
+		ok: false,
+		error: Errors.wrongState({
+			method: CAPXUL_OPERATIONS.onboarding.completeOrganization,
+			currentState,
+			validStates: [...validStates]
+		})
+	};
+}
+function requestCancelled(options) {
+	return options?.signal?.aborted === true;
+}
+async function reachClaimedAccount(deps, options) {
+	let state = deps.snapshotIdentity();
+	if (state.phase !== "authenticated" || state.account.at === "unknown") {
+		const ensured = await deps.sendIdentity({ _tag: "EnsureAccount" }, options);
 		if (!ensured.ok) return ensured;
-		if (isCancelled()) return {
-			ok: false,
-			error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
-		};
-		const lifecycle = await deps.getLifecycle();
-		if (!lifecycle.ok) return lifecycle;
-		if (isCancelled()) return {
-			ok: false,
-			error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
-		};
-		if (lifecycle.value.status !== "ready") return {
-			ok: false,
-			error: Errors.wrongState({
-				method: CAPXUL_OPERATIONS.onboarding.completePerson,
-				currentState: lifecycle.value.status,
-				validStates: ["ready"]
-			})
-		};
-		const profile = await deps.loadProfile(options);
-		if (!profile.ok) return profile;
-		if (profile.value === null || profile.value.displayName === null || profile.value.username !== available.value.normalized) return {
-			ok: false,
-			error: Errors.wrongState({
-				method: CAPXUL_OPERATIONS.onboarding.completePerson,
-				currentState: "profile-incomplete",
-				validStates: ["profile-complete"]
-			})
-		};
-		return {
-			ok: true,
-			value: {
-				profile: {
-					...profile.value,
-					displayName: profile.value.displayName,
-					username: profile.value.username
-				},
-				account: lifecycle.value
-			}
-		};
-	} };
+		state = ensured.value;
+	}
+	if (state.phase !== "authenticated") return organizationWrongState(state.phase, ["authenticated:claimed"]);
+	if (state.account.at !== "claimed") {
+		const event = state.account.at === "failed" ? { _tag: "RetryAccount" } : state.account.at === "counterfactual" ? { _tag: "ClaimAccount" } : { _tag: "EnsureAccount" };
+		const claimed = await deps.sendIdentity(event, options);
+		if (!claimed.ok) return claimed;
+		state = claimed.value;
+	}
+	return isClaimedIdentityState(state) ? {
+		ok: true,
+		value: state
+	} : organizationWrongState(state.phase === "authenticated" ? state.account.at : state.phase, ["claimed"]);
+}
+async function createOrResumeOrganization(deps, state, draft, options) {
+	const active = state.account.org;
+	if (active?.at === "ready") return {
+		ok: true,
+		value: { organizationId: active.orgId }
+	};
+	if (active?.at === "failed" && !active.retryable) return {
+		ok: false,
+		error: publicIdentityFailure(active.failure)
+	};
+	if (active?.at === "failed" && active.orgId === null) {
+		const cleared = await deps.sendIdentity({ _tag: "LeaveOrganization" }, options);
+		if (!cleared.ok) return cleared;
+	}
+	const event = active?.at === "failed" && active.orgId !== null ? { _tag: "RetryOrganization" } : {
+		_tag: "CreateOrganization",
+		draft
+	};
+	const created = await deps.sendIdentity(event, options);
+	if (!created.ok) return created;
+	const final = created.value;
+	const organization = isClaimedIdentityState(final) ? final.account.org : null;
+	return organization?.at === "ready" ? {
+		ok: true,
+		value: { organizationId: organization.orgId }
+	} : organizationWrongState(organization?.at ?? "organization-missing", ["ready"]);
+}
+function makeOnboardingMethods(deps) {
+	return {
+		async completePerson(input, options) {
+			const isCancelled = () => options?.signal?.aborted === true;
+			if (typeof input !== "object" || input === null || typeof input.displayName !== "string" || typeof input.country !== "string") return {
+				ok: false,
+				error: Errors.invalidInput("profile", "displayName and country are required")
+			};
+			const handle = normalizeHandleInput(input.handle);
+			if (!handle.ok) return handle;
+			const session = await deps.restoreSession(options);
+			if (!session.ok) return session;
+			if (session.value === null) return {
+				ok: false,
+				error: Errors.notAuthenticated()
+			};
+			const available = await deps.handleAvailable(handle.value, options);
+			if (!available.ok) return available;
+			if (!available.value.available) return {
+				ok: false,
+				error: Errors.invalidInput("handle", "handle is already taken")
+			};
+			const completed = await deps.completeProfile({
+				...input,
+				handle: available.value.normalized
+			}, options);
+			if (!completed.ok) return completed;
+			const refreshed = await deps.refreshIdentity(options);
+			if (!refreshed.ok) return refreshed;
+			if (isCancelled()) return {
+				ok: false,
+				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
+			};
+			const ensured = await deps.ensureAccount();
+			if (!ensured.ok) return ensured;
+			if (isCancelled()) return {
+				ok: false,
+				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
+			};
+			const lifecycle = await deps.getLifecycle();
+			if (!lifecycle.ok) return lifecycle;
+			if (isCancelled()) return {
+				ok: false,
+				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
+			};
+			if (lifecycle.value.status !== "ready") return {
+				ok: false,
+				error: Errors.wrongState({
+					method: CAPXUL_OPERATIONS.onboarding.completePerson,
+					currentState: lifecycle.value.status,
+					validStates: ["ready"]
+				})
+			};
+			const profile = await deps.loadProfile(options);
+			if (!profile.ok) return profile;
+			if (profile.value === null || profile.value.displayName === null || profile.value.handle !== available.value.normalized) return {
+				ok: false,
+				error: Errors.wrongState({
+					method: CAPXUL_OPERATIONS.onboarding.completePerson,
+					currentState: "profile-incomplete",
+					validStates: ["profile-complete"]
+				})
+			};
+			return {
+				ok: true,
+				value: {
+					profile: {
+						...profile.value,
+						displayName: profile.value.displayName,
+						handle: profile.value.handle
+					},
+					account: lifecycle.value
+				}
+			};
+		},
+		async completeOrganization(input, options) {
+			const operation = CAPXUL_OPERATIONS.onboarding.completeOrganization;
+			const normalized = normalizeOrganization(input);
+			if (!normalized.ok) return normalized;
+			const session = await deps.restoreSession(options);
+			if (!session.ok) return session;
+			if (session.value === null) return {
+				ok: false,
+				error: Errors.notAuthenticated()
+			};
+			const profile = await deps.loadProfile(options);
+			if (!profile.ok) return profile;
+			if (profile.value === null || profile.value.displayName === null || profile.value.handle === null) return {
+				ok: false,
+				error: Errors.wrongState({
+					method: operation,
+					currentState: "profile-incomplete",
+					validStates: ["profile-complete"]
+				})
+			};
+			const refreshed = await deps.refreshIdentity(options);
+			if (!refreshed.ok) return refreshed;
+			if (requestCancelled(options)) return {
+				ok: false,
+				error: Errors.cancelled({ operation })
+			};
+			const claimed = await reachClaimedAccount(deps, options);
+			if (!claimed.ok) return claimed;
+			if (requestCancelled(options)) return {
+				ok: false,
+				error: Errors.cancelled({ operation })
+			};
+			return createOrResumeOrganization(deps, claimed.value, normalized.value, options);
+		}
+	};
 }
 //#endregion
 //#region ../../packages/sdk/src/surface/accounts-deps.ts
@@ -42938,7 +43306,8 @@ function executionDependencies$1(input) {
 		chainId: input.chainId,
 		convexCall: input.convexCall,
 		functions: moneyExecutionContract,
-		signer: input.signer
+		signer: input.signer,
+		...input.telemetry === void 0 ? {} : { telemetry: input.telemetry }
 	};
 }
 function makeOrganizationPaymentsMethods(deps, orgId) {
@@ -42970,16 +43339,18 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 		let flight = inFlightOrganizationPayments.get(flightKey);
 		if (flight === void 0) {
 			const controller = new AbortController();
+			const requestState = { resolved: false };
 			const submission = executeOrganizationPayment(execution, {
 				orgId,
 				permissionId: input.permissionId,
 				requestKey: requestKey.key,
 				items: input.items,
 				...input.lineage === void 0 ? {} : { lineage: input.lineage }
-			}, controller.signal);
+			}, controller.signal, () => requestState.resolved = true);
 			flight = {
 				controller,
 				promise: submission,
+				requestState,
 				waiters: 0,
 				settled: false
 			};
@@ -43017,11 +43388,29 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 		}
 		release(false);
 		try {
-			await requestKey.finish(result.ok);
+			await requestKey.finish(result.ok || flight.requestState.resolved);
 		} catch {}
-		return mapOk(result, (value) => value.payments.map((payment) => normalizePaymentTiming(payment)));
+		const normalized = mapOk(result, (value) => value.payments.map((payment) => normalizePaymentTiming(payment)));
+		if (!normalized.ok) return normalized;
+		return normalized;
 	};
 	return {
+		retry: async (paymentId, options) => {
+			const execution = executionDependencies$1(deps);
+			if (execution === null) return {
+				ok: false,
+				error: Errors.notImplemented("organizationPayments", "executionComposition")
+			};
+			const result = await executePaymentLifecycle(execution, {
+				kind: "retry",
+				paymentId
+			}, options?.signal);
+			if (!result.ok) return result;
+			return {
+				ok: true,
+				value: result.value.payments.map((payment) => normalizePaymentTiming(payment))
+			};
+		},
 		pay: async (input, options) => {
 			const { permissionId, requestKey: providedRequestKey, lineage, ...item } = input;
 			const result = await execute({
@@ -43153,6 +43542,7 @@ function makePayrollMethods(deps, orgId) {
 			input
 		}, input.requestKey);
 		let authorized;
+		let preparedClosed = false;
 		const submitted = await executePrepared(execution, async (signerAddress) => {
 			const prepared = await runIfActive(signal, AUTHORIZE_RUN, () => deps.convexCall.action(payrollContract.authorizeRun, { input: {
 				orgId,
@@ -43174,9 +43564,9 @@ function makePayrollMethods(deps, orgId) {
 			requestKey: requestKey.key,
 			runId: authorized.id,
 			items: input.items
-		})(request), signal);
+		})(request), true, () => preparedClosed = true, signal);
 		try {
-			await requestKey.finish(submitted.ok);
+			await requestKey.finish(submitted.ok || preparedClosed);
 		} catch {}
 		if (!submitted.ok) return submitted;
 		return authorized === void 0 ? {
@@ -43797,7 +44187,8 @@ function makeOrgMethods(deps) {
 					...deps.requestKeyScope === void 0 ? {} : { requestKeyScope: deps.requestKeyScope },
 					...deps.actor === void 0 ? {} : { actor: deps.actor },
 					...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
-					...deps.signer === void 0 ? {} : { signer: deps.signer }
+					...deps.signer === void 0 ? {} : { signer: deps.signer },
+					...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
 				}, String(orgId)),
 				payroll: convexCall === void 0 ? makeUnavailablePayrollMethods() : makePayrollMethods({
 					convexCall,
@@ -43824,7 +44215,8 @@ function makeNotImplementedPermissionMethods() {
 function makeNotImplementedOrganizationPaymentsMethods() {
 	return {
 		pay: organizationPaymentExecutionUnavailable,
-		payBatch: organizationPaymentExecutionUnavailable
+		payBatch: organizationPaymentExecutionUnavailable,
+		retry: organizationPaymentExecutionUnavailable
 	};
 }
 const orgMeUnavailable = () => Promise.resolve({
@@ -44267,11 +44659,13 @@ function assembleCapxulClient(input) {
 	const onboarding = makeOnboardingMethods({
 		restoreSession: auth.getSession,
 		refreshIdentity: (options) => runCapxulEffect(askIdentity(actor, { _tag: "ReadSession" }, options).pipe(Effect.asVoid), options, CAPXUL_OPERATIONS.identity.readSession, effectRunner.runPromise),
-		usernameAvailable: identity.usernameAvailable,
+		handleAvailable: identity.handleAvailable,
 		completeProfile: identity.completeProfile,
 		loadProfile: identity.loadCurrent,
 		ensureAccount: account._internal.ensureReady,
-		getLifecycle: account.getLifecycle
+		getLifecycle: account.getLifecycle,
+		snapshotIdentity: actor.snapshot,
+		sendIdentity: (event, options) => runCapxulEffect(askIdentity(actor, event, options), options, CAPXUL_OPERATIONS._internal.identity.send, effectRunner.runPromise)
 	});
 	const system = makeSystemMethods({ convexCall: input.ports.convexCall });
 	const media = makeMediaMethods({ convexCall: input.ports.convexCall });
@@ -44330,7 +44724,7 @@ function assembleCapxulClient(input) {
 			}
 		},
 		async completeProfile(profile, controls) {
-			if (typeof profile !== "object" || profile === null || typeof profile.displayName !== "string" || typeof profile.country !== "string" || profile.username !== void 0 && typeof profile.username !== "string") return {
+			if (typeof profile !== "object" || profile === null || typeof profile.displayName !== "string" || typeof profile.country !== "string" || typeof profile.handle !== "string") return {
 				ok: false,
 				reason: "INVALID_INPUT"
 			};
@@ -44348,8 +44742,8 @@ function assembleCapxulClient(input) {
 					reason: "INVALID_INPUT"
 				};
 			}
-			const username = profile.username?.trim();
-			if (profile.username !== void 0 && username?.length === 0) return {
+			const handle = profile.handle.trim();
+			if (handle.length === 0) return {
 				ok: false,
 				reason: "INVALID_INPUT"
 			};
@@ -44363,7 +44757,7 @@ function assembleCapxulClient(input) {
 				email: session.email,
 				displayName,
 				country,
-				...username === void 0 ? {} : { username }
+				handle
 			}), controls, CAPXUL_OPERATIONS.identity.completeProfile, effectRunner.runPromise);
 			return result.ok ? { ok: true } : {
 				ok: false,
@@ -44382,8 +44776,6 @@ function assembleCapxulClient(input) {
 		accounts,
 		currentUser,
 		me: financialOps.me,
-		handles: financialOps.handles,
-		payees: financialOps.payees,
 		targets: financialOps.targets,
 		destinations: financialOps.destinations,
 		payments: financialOps.payments,
@@ -44402,6 +44794,20 @@ function assembleCapxulClient(input) {
 			accounts: { fund: accounts.fund },
 			organizationSetup: { getProofReceipt: (orgId) => runPortEffect(input.ports.convexCall.query(organizationSetupProofReceiptQuery, { orgId })) },
 			telemetry: input.ports.telemetry,
+			captureExternalAddressAcknowledged: (address, organizationId) => {
+				const telemetry = input.ports.telemetry;
+				if (telemetry === void 0) return;
+				Effect.runPromise(Effect.suspend(() => telemetry.emit({
+					name: "quick_pay_external_address_acknowledged",
+					props: {
+						recipient_locator_kind: "address",
+						recipient_resolution_status: "external_address",
+						recipient_address: address,
+						external_address_acknowledged: true,
+						...organizationId === void 0 ? {} : { organization_id: organizationId }
+					}
+				})).pipe(Effect.catchCause(() => Effect.void)));
+			},
 			close: stopActor
 		}
 	}, observation.failureObservation, observation.hostObservationSnapshot);
@@ -45239,7 +45645,7 @@ const moneySchema = z.object({
 	value: z.string(),
 	decimals: z.number()
 });
-const usernameSchema = z.string().regex(/^[a-z0-9_]{3,30}$/, "3-30 characters: a-z, 0-9, or underscore");
+const handleSchema$1 = z.string().regex(/^[a-z0-9_]{3,30}$/, "3-30 characters: a-z, 0-9, or underscore");
 const accountTools = [
 	{
 		name: CAPXUL_OPERATIONS.onboarding.completePerson,
@@ -45247,18 +45653,18 @@ const accountTools = [
 		register: (server, scope) => {
 			server.registerTool(CAPXUL_OPERATIONS.onboarding.completePerson, {
 				title: "Complete Person onboarding",
-				description: "Claim a globally unique username, complete the signed-in Person profile, and make the personal Account ready. Call this before Organization creation or money tools.",
+				description: "Claim a globally unique handle, complete the signed-in Person profile, and make the personal Account ready. Call this before Organization creation or money tools.",
 				inputSchema: z.object({
 					displayName: z.string().trim().min(1),
 					country: z.string().trim().min(2),
-					username: usernameSchema
+					handle: handleSchema$1
 				}),
 				outputSchema: z.object({
 					profile: z.object({
 						email: z.string(),
 						displayName: z.string(),
 						country: z.string(),
-						username: usernameSchema
+						handle: handleSchema$1
 					}),
 					account: z.object({
 						status: z.literal("ready"),
@@ -45368,6 +45774,156 @@ function identityError(failure, operation) {
 	}
 }
 //#endregion
+//#region src/tools/organization.ts
+const MANAGE$1 = "org:manage";
+const handleSchema = z.string().trim().toLowerCase().regex(/^[a-z0-9-]{3,32}$/, "3-32 characters: a-z, 0-9, or hyphen");
+const organizationTools = [{
+	name: CAPXUL_OPERATIONS.onboarding.completeOrganization,
+	scope: MANAGE$1,
+	register: (server, scope) => {
+		server.registerTool(CAPXUL_OPERATIONS.onboarding.completeOrganization, {
+			title: "Complete Organization onboarding",
+			description: "Claim the personal Account, then create or resume one Organization through the canonical onboarding lifecycle. Reuse the same handle after an interrupted call.",
+			inputSchema: z.object({
+				name: z.string().trim().min(1),
+				handle: handleSchema,
+				country: z.string().trim().min(2),
+				bio: z.string().trim().min(1).optional(),
+				size: z.string().trim().min(1).optional()
+			}),
+			outputSchema: z.object({ organizationId: z.string() })
+		}, (input) => withClient(scope, CAPXUL_OPERATIONS.onboarding.completeOrganization, MANAGE$1, async (client) => {
+			const completed = await client.completeOrganization(input);
+			if (!completed.ok) return errorResult(completed.error);
+			return okResult({ ...completed.value });
+		}));
+	}
+}];
+//#endregion
+//#region src/tools/staff.ts
+const MANAGE = "org:manage";
+const orgInput = { organizationId: z.string().trim().min(1) };
+const email = z.string().trim().email();
+const memberStatus = z.enum([
+	"pending",
+	"pending_safe",
+	"pending_grant",
+	"active",
+	"revoked",
+	"expired"
+]);
+const staffTools = [
+	{
+		name: CAPXUL_OPERATIONS.org.list,
+		scope: MANAGE,
+		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.list, {
+			title: "List Organizations",
+			description: "List the Organizations that the signed-in Person can access.",
+			inputSchema: z.object({}),
+			outputSchema: z.object({ organizations: z.array(z.object({
+				organizationId: z.string(),
+				name: z.string(),
+				handle: z.string(),
+				role: z.string()
+			})) })
+		}, () => withClient(scope, CAPXUL_OPERATIONS.org.list, MANAGE, async (client) => {
+			const result = await client.listOrganizations();
+			return result.ok ? okResult({ organizations: [...result.value] }) : errorResult(result.error);
+		}))
+	},
+	{
+		name: CAPXUL_OPERATIONS.org.roles,
+		scope: MANAGE,
+		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.roles, {
+			title: "List Organization roles",
+			description: "List the active role labels that an Organization invitation can use.",
+			inputSchema: z.object(orgInput),
+			outputSchema: z.object({ roles: z.array(z.object({ label: z.string() })) })
+		}, ({ organizationId }) => withClient(scope, CAPXUL_OPERATIONS.org.roles, MANAGE, async (client) => {
+			const result = await client.listOrganizationRoles(organizationId);
+			return result.ok ? okResult({ roles: [...result.value] }) : errorResult(result.error);
+		}))
+	},
+	{
+		name: CAPXUL_OPERATIONS.org.members,
+		scope: MANAGE,
+		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.members, {
+			title: "List Organization members",
+			description: "List Organization member lifecycle states. Poll after activation until the member is active.",
+			inputSchema: z.object(orgInput),
+			outputSchema: z.object({ members: z.array(z.object({
+				email,
+				name: z.string().nullable(),
+				role: z.string(),
+				status: memberStatus
+			})) })
+		}, ({ organizationId }) => withClient(scope, CAPXUL_OPERATIONS.org.members, MANAGE, async (client) => {
+			const result = await client.listOrganizationMembers(organizationId);
+			return result.ok ? okResult({ members: [...result.value] }) : errorResult(result.error);
+		}))
+	},
+	{
+		name: CAPXUL_OPERATIONS.org.invite,
+		scope: MANAGE,
+		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.invite, {
+			title: "Invite Organization member",
+			description: "Invite one Person by email into an Organization. Use a role label returned by org.roles.",
+			inputSchema: z.object({
+				...orgInput,
+				email,
+				role: z.string().trim().min(1)
+			}),
+			outputSchema: z.object({
+				email,
+				role: z.string(),
+				status: memberStatus
+			})
+		}, ({ organizationId, email: invitee, role }) => withClient(scope, CAPXUL_OPERATIONS.org.invite, MANAGE, async (client) => {
+			const result = await client.inviteOrganizationMember(organizationId, {
+				email: invitee,
+				role
+			});
+			return result.ok ? okResult({ ...result.value }) : errorResult(result.error);
+		}))
+	},
+	{
+		name: CAPXUL_OPERATIONS.org.acceptInvitations,
+		scope: MANAGE,
+		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.acceptInvitations, {
+			title: "Accept Organization invitations",
+			description: "Accept every pending Organization invitation for the signed-in Person's verified email.",
+			inputSchema: z.object({}),
+			outputSchema: z.object({ organizationIds: z.array(z.string()) })
+		}, () => withClient(scope, CAPXUL_OPERATIONS.org.acceptInvitations, MANAGE, async (client) => {
+			const result = await client.acceptOrganizationInvitations();
+			return result.ok ? okResult({ ...result.value }) : errorResult(result.error);
+		}))
+	},
+	{
+		name: CAPXUL_OPERATIONS.org.activateMember,
+		scope: MANAGE,
+		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.activateMember, {
+			title: "Activate Organization member",
+			description: "Grant the invited role to a pending member's ready Account. The Organization founder signs this operation.",
+			inputSchema: z.object({
+				...orgInput,
+				email,
+				accountId: z.string().trim().min(1)
+			}),
+			outputSchema: z.object({
+				email,
+				status: z.enum(["active", "submitted"])
+			})
+		}, ({ organizationId, email: invitee, accountId }) => withClient(scope, CAPXUL_OPERATIONS.org.activateMember, MANAGE, async (client) => {
+			const result = await client.activateOrganizationMember(organizationId, {
+				email: invitee,
+				accountId
+			});
+			return result.ok ? okResult({ ...result.value }) : errorResult(result.error);
+		}))
+	}
+];
+//#endregion
 //#region src/tools/system.ts
 const systemTools = [{
 	name: CAPXUL_OPERATIONS.system.ping,
@@ -45442,7 +45998,12 @@ const AGENT_SCOPES = [
 	"org:manage",
 	"media:write"
 ];
-const TOOLS = [...systemTools, ...accountTools];
+const TOOLS = [
+	...systemTools,
+	...accountTools,
+	...organizationTools,
+	...staffTools
+];
 const TOOL_NAMES = TOOLS.map((tool) => tool.name);
 /**
 * The scope a named tool needs. `null` for a public tool, and `null` for a
@@ -45686,7 +46247,7 @@ function stdioIdentity(env = process.env, options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "3.2.0";
+var version = "4.0.0";
 //#endregion
 //#region src/deps.ts
 const NO_IDENTITY = async () => void 0;
@@ -45721,6 +46282,22 @@ function buildMcpServer(deps, identity) {
 	});
 	const scope = makeRequestScope(deps, identity);
 	registerAllTools(server, scope);
+	if (deps.posthog !== void 0) instrument(server, deps.posthog, {
+		context: { description: "Explain the user goal that requires this Capxul tool call." },
+		enableConversationId: true,
+		enableExceptionAutocapture: false,
+		identify: async () => {
+			const resolved = await scope.identity();
+			return resolved?.ok === true ? { distinctId: resolved.value.authUserId } : null;
+		},
+		eventProperties: async () => ({
+			capxul_env: deps.posthogEnvironment ?? "unknown",
+			producer: "mcp",
+			$geoip_disable: true
+		}),
+		beforeSend: privacySafeMcpEvent,
+		logger: (message) => console.error(`[capxul-mcp] posthog: ${message}`)
+	});
 	const previous = server.server.onclose;
 	server.server.onclose = () => {
 		scope.close();
@@ -45728,9 +46305,75 @@ function buildMcpServer(deps, identity) {
 	};
 	return server;
 }
+const SAFE_MCP_PROPERTIES = /* @__PURE__ */ new Set([
+	"$geoip_disable",
+	"$lib",
+	"$lib_version",
+	"$mcp_client_name",
+	"$mcp_conversation_id",
+	"$mcp_duration_ms",
+	"$mcp_intent",
+	"$mcp_intent_source",
+	"$mcp_is_error",
+	"$mcp_listed_tool_names",
+	"$mcp_protocol_version",
+	"$mcp_server_name",
+	"$mcp_server_version",
+	"$mcp_source",
+	"$mcp_tool_description",
+	"$mcp_tool_name",
+	"$process_person_profile",
+	"$session_id",
+	"capxul_env",
+	"producer"
+]);
+const SAFE_TOOL_INTENTS = {
+	[CAPXUL_OPERATIONS.system.ping]: "Verify MCP transport.",
+	[CAPXUL_OPERATIONS.system.health]: "Verify MCP backend health.",
+	[CAPXUL_OPERATIONS.onboarding.completePerson]: "Complete Person onboarding.",
+	[CAPXUL_OPERATIONS.onboarding.completeOrganization]: "Complete Organization onboarding.",
+	[CAPXUL_OPERATIONS.org.acceptInvitations]: "Accept Organization invitations.",
+	[CAPXUL_OPERATIONS.org.activateMember]: "Activate an Organization member.",
+	[CAPXUL_OPERATIONS.org.invite]: "Invite an Organization member.",
+	[CAPXUL_OPERATIONS.org.list]: "List Organizations.",
+	[CAPXUL_OPERATIONS.org.members]: "List Organization members.",
+	[CAPXUL_OPERATIONS.org.roles]: "List Organization roles.",
+	[CAPXUL_OPERATIONS.me.get]: "Verify authenticated Person identity.",
+	[CAPXUL_OPERATIONS.account.status]: "Verify Account readiness.",
+	[CAPXUL_OPERATIONS.account.balance]: "Verify Account funding."
+};
+const SAFE_MCP_TOOL_NAMES = new Set(TOOL_NAMES);
+const MCP_CONVERSATION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+const MCP_SESSION_ID = /^ses_(?:[0-9a-f]{32}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/u;
+function normalizeClientName(value) {
+	if (typeof value !== "string") return "other";
+	const name = value.trim().toLowerCase();
+	if (name.startsWith("codex")) return "codex";
+	if (name.startsWith("claude-code")) return "claude-code";
+	if (name === "capxul-journeys") return name;
+	if (name === "hermetic-client") return name;
+	return "other";
+}
+/** Keep MCP analytics useful without sending tool payloads or free-form PII. */
+const privacySafeMcpEvent = (event) => {
+	const properties = Object.fromEntries(Object.entries(event.properties).filter(([name]) => SAFE_MCP_PROPERTIES.has(name)));
+	const toolName = properties.$mcp_tool_name;
+	if (typeof toolName !== "string" || !SAFE_MCP_TOOL_NAMES.has(toolName)) delete properties.$mcp_tool_name;
+	if (typeof properties.$mcp_intent === "string") properties.$mcp_intent = typeof toolName === "string" ? SAFE_TOOL_INTENTS[toolName] ?? "Use a Capxul tool." : "Use a Capxul tool.";
+	properties.$mcp_client_name = normalizeClientName(properties.$mcp_client_name);
+	if (typeof properties.$mcp_conversation_id !== "string" || !MCP_CONVERSATION_ID.test(properties.$mcp_conversation_id)) delete properties.$mcp_conversation_id;
+	if (typeof properties.$session_id !== "string" || !MCP_SESSION_ID.test(properties.$session_id)) delete properties.$session_id;
+	if (properties.$mcp_protocol_version !== "2025-06-18" && properties.$mcp_protocol_version !== "2026-07-28") delete properties.$mcp_protocol_version;
+	const distinctId = properties.$process_person_profile === false ? `anon_${createHash("sha256").update(event.distinct_id).digest("hex").slice(0, 24)}` : event.distinct_id;
+	return {
+		...event,
+		distinct_id: distinctId,
+		properties
+	};
+};
 function createHandler(input) {
 	return createMcpHandler(({ authInfo }) => buildMcpServer(input.deps, identityOf(input, authInfo)), {
-		legacy: "reject",
+		legacy: "stateless",
 		responseMode: "json",
 		...input.onError === void 0 ? {} : { onerror: input.onError }
 	});
@@ -45778,7 +46421,8 @@ async function startHttpServer(input) {
 			resource,
 			identities,
 			mcp,
-			guards
+			guards,
+			posthog: input.deps.posthog
 		}).catch((cause) => {
 			if (!res.headersSent) writeJson(res, 500, { error: "internal_error" });
 			console.error("[capxul-mcp] request failed:", cause);
@@ -45818,6 +46462,11 @@ async function handle(input) {
 	const token = bearerToken(headerValue(req, "authorization"));
 	if (decision.identity !== void 0 && token !== void 0) authenticated.auth = toAuthInfo(decision.identity, token);
 	await input.mcp(req, res, body);
+	if (input.posthog !== void 0) try {
+		await input.posthog.flush();
+	} catch {
+		console.error("[capxul-mcp] PostHog flush failed");
+	}
 }
 function protectedResourceMetadata(resource) {
 	return {
@@ -45989,9 +46638,9 @@ function formatToolCallLine(event) {
 //#endregion
 //#region src/sdk.ts
 /**
-* One fresh client per request. `requirement: "counterfactual"` derives the
-* Safe from the email alone; the claim and deploy need the browser approval
-* surface, which no agent can reach.
+* One fresh client per request. Live mode derives the counterfactual Account
+* and fails closed before a signature. Dev mode has its explicit test signer,
+* so it requires a deployed Account and can exercise signed lifecycle paths.
 *
 * This code passes no `authCache`. The SDK detects one instead. A node process
 * has no `window`, so the SDK builds a fresh `InMemoryAuthCacheAdapter` for
@@ -46011,7 +46660,7 @@ async function createSdkClient(input, createClient = createCapxulClient) {
 		bootstrapBaseUrl: config.bootstrapBaseUrl,
 		origin: config.origin,
 		authBaseUrl: config.authBaseUrl,
-		requirement: "counterfactual",
+		requirement: signer === void 0 ? "counterfactual" : "deployed",
 		runtime: "node",
 		...identity === void 0 ? {} : { authClient: identity.authClient },
 		...signer === void 0 ? {} : { signer }
@@ -46059,7 +46708,7 @@ async function createSdkClient(input, createClient = createCapxulClient) {
 							email: String(result.value.profile.email),
 							displayName: result.value.profile.displayName,
 							country: String(result.value.profile.country),
-							username: result.value.profile.username
+							handle: result.value.profile.handle
 						},
 						account: {
 							status: "ready",
@@ -46069,6 +46718,120 @@ async function createSdkClient(input, createClient = createCapxulClient) {
 					}
 				};
 			},
+			completeOrganization: (organization) => client.onboarding.completeOrganization(organization),
+			listOrganizations: async () => {
+				const result = await client.orgs();
+				if (!result.ok) return result;
+				return {
+					ok: true,
+					value: result.value.map((organization) => ({
+						organizationId: String(organization.id),
+						name: organization.name,
+						handle: organization.handle,
+						role: organization.role
+					}))
+				};
+			},
+			listOrganizationRoles: async (orgId) => {
+				const result = await client.org(orgId).roles();
+				if (!result.ok) return result;
+				return {
+					ok: true,
+					value: result.value.map((role) => ({ label: role.label }))
+				};
+			},
+			listOrganizationMembers: async (orgId) => {
+				const result = await client.org(orgId).members();
+				if (!result.ok) return result;
+				return {
+					ok: true,
+					value: result.value.map((member) => ({
+						email: String(member.email),
+						name: member.name,
+						role: member.role,
+						status: member.status
+					}))
+				};
+			},
+			inviteOrganizationMember: async (orgId, invitation) => {
+				const result = await client.org(orgId).invite(invitation);
+				if (!result.ok) return result;
+				return {
+					ok: true,
+					value: {
+						email: String(result.value.email),
+						role: result.value.role,
+						status: result.value.status
+					}
+				};
+			},
+			acceptOrganizationInvitations: async () => {
+				const result = await client.orgs.detectAndAcceptPendingInvitations();
+				if (!result.ok) return result;
+				return {
+					ok: true,
+					value: { organizationIds: result.value.matched.map(String) }
+				};
+			},
+			activateOrganizationMember: async (orgId, activation) => {
+				const memberEmail = activation.email.trim().toLowerCase();
+				const scoped = client.org(orgId);
+				const members = await scoped.members();
+				if (!members.ok) return members;
+				const matches = members.value.filter((member) => String(member.email) === memberEmail);
+				const member = matches.length === 1 ? matches[0] : void 0;
+				if (member === void 0) return {
+					ok: false,
+					error: Errors.invalidInput("email", "member was not found")
+				};
+				if (member.status === "active") return {
+					ok: true,
+					value: {
+						email: memberEmail,
+						status: "active"
+					}
+				};
+				if (member.status !== "pending_grant" || member.roleKey === null) return {
+					ok: false,
+					error: Errors.wrongState({
+						method: CAPXUL_OPERATIONS.org.activateMember,
+						currentState: member.status,
+						validStates: ["pending_grant", "active"]
+					})
+				};
+				const permissions = await scoped.permissions.list();
+				if (!permissions.ok) return permissions;
+				const matchingPermissions = permissions.value.permissions.filter((permission) => permission.type === "managePeople" && permission.state === "active" && String(permission.roleKey).toLowerCase() === String(member.roleKey).toLowerCase());
+				const permission = matchingPermissions.length === 1 ? matchingPermissions[0] : void 0;
+				if (permission === void 0) return {
+					ok: false,
+					error: Errors.wrongState({
+						method: CAPXUL_OPERATIONS.org.activateMember,
+						currentState: "matching-permission-missing",
+						validStates: ["one-active-role-permission"]
+					})
+				};
+				const requestKey = `mcp-staff-${createHash("sha256").update(JSON.stringify({
+					orgId,
+					email: memberEmail,
+					accountId: activation.accountId,
+					permissionId: permission.permissionId
+				})).digest("hex")}`;
+				const assigned = await scoped.permissions.assign({
+					requestKey,
+					permissionId: String(permission.permissionId),
+					accountId: activation.accountId,
+					expectedMemberEmail: memberEmail
+				});
+				if (!assigned.ok) return assigned;
+				return {
+					ok: true,
+					value: {
+						email: memberEmail,
+						status: "submitted"
+					}
+				};
+			},
 			getLifecycle: async () => {
 				const result = await client.account.getLifecycle();
 				if (!result.ok) return result;
@@ -46143,6 +46906,8 @@ if (!modeConfig.ok) {
 }
 const mode = modeConfig.value;
 const port = cli.port;
+const analyticsConfig = readMcpAnalyticsEnvConfig();
+const posthog = analyticsConfig === void 0 ? void 0 : new PostHog(analyticsConfig.projectToken, { host: analyticsConfig.host });
 const deps = {
 	createSdkClient: (identity) => createSdkClient({
 		config: readSdkEnvConfig(),
@@ -46151,6 +46916,10 @@ const deps = {
 	}),
 	onToolCall: (event) => {
 		console.error(formatToolCallLine(event));
+	},
+	...posthog === void 0 ? {} : {
+		posthog,
+		posthogEnvironment: analyticsConfig?.environment ?? "unknown"
 	}
 };
 if (cli.stdio) {
@@ -46164,7 +46933,7 @@ if (cli.stdio) {
 		bearer: identity === void 0 ? "none" : "environment"
 	}));
 	const shutdownStdio = () => {
-		handle.close().finally(() => process.exit(0));
+		handle.close().catch(() => void 0).then(() => posthog?.shutdown()).catch(() => void 0).finally(() => process.exit(0));
 	};
 	process.on("SIGINT", shutdownStdio);
 	process.on("SIGTERM", shutdownStdio);
@@ -46183,7 +46952,7 @@ if (cli.stdio) {
 		bearer: "oauth"
 	}));
 	const shutdown = () => {
-		running.close().finally(() => process.exit(0));
+		running.close().catch(() => void 0).then(() => posthog?.shutdown()).catch(() => void 0).finally(() => process.exit(0));
 	};
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);