@capxul/mcp 3.2.0 → 4.0.1

package/dist/main.mjs

@@ -3,11 +3,12 @@ import { a as __require, i as __exportAll, o as __toESM, r as __commonJSMin } fr
 import { a as aexists, c as clean, d as toBytes$2, f as u32, i as abytes, l as createHasher, n as sha256$2, o as anumber, r as Hash, s as aoutput, t as secp256k1, u as swap32IfBE } from "./secp256k1-oe2FO-K6.mjs";
 import { t as require_lib } from "./lib-vbuHK0v7.mjs";
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
+import { PostHog } from "posthog-node";
 import { createHash } from "node:crypto";
 import { createServer } from "node:http";
 import { localhostHostValidation, localhostOriginValidation, toNodeHandler } from "@modelcontextprotocol/node";
 import { z } from "zod";
-import { Cause, Context, Data, Deferred, Duration, Effect, Exit, Fiber, Layer, Queue, Ref, Result, Schedule, Schema, SchemaGetter, SchemaIssue, SchemaParser, Scope, Tracer } from "effect";
+import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, Fiber, Layer, Queue, Ref, Result, Schedule, Schema, SchemaGetter, SchemaIssue, SchemaParser, Scope, Tracer } from "effect";
 import { FetchHttpClient, Headers, HttpClient } from "effect/unstable/http";
 import { OtlpExporter, OtlpLogger, OtlpSerialization, OtlpTracer } from "effect/unstable/observability";
 import { resolve } from "path";
@@ -21,6 +22,7 @@ import { EventEmitter } from "events";
 import http2 from "http2";
 import zlib from "zlib";
 import { McpServer, createMcpHandler } from "@modelcontextprotocol/server";
+import { instrument } from "@posthog/mcp";
 //#region ../../packages/errors/src/secret-material.ts
 const SENSITIVE_MATERIAL_PATTERNS = [
 	/(?:^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u,
@@ -549,6 +551,31 @@ function decodeConvexError(err) {
 	return null;
 }
 //#endregion
+//#region ../../packages/errors/src/index.ts
+/** Canonical handle syntax shared by validation and branded constructors. */
+const HANDLE_RE$1 = /^[a-z0-9_-]{3,30}$/;
+//#endregion
+//#region ../../packages/config/src/handle.ts
+const RESERVED_HANDLES = /* @__PURE__ */ new Set([
+	"admin",
+	"api",
+	"capxul",
+	"help",
+	"root",
+	"support",
+	"system",
+	"www"
+]);
+function normalizeHandle(raw) {
+	return raw.trim().toLowerCase().replace(/^@/, "");
+}
+function validateHandle(raw) {
+	const handle = normalizeHandle(raw);
+	if (!HANDLE_RE$1.test(handle)) throw Errors.invalidInput("handle", "must be 3-30 characters of a-z, 0-9, underscore, or hyphen");
+	if (RESERVED_HANDLES.has(handle)) throw Errors.invalidInput("handle", "handle is reserved");
+	return handle;
+}
+//#endregion
 //#region ../../packages/config/src/tokens.ts
 /** `TestUSDC` ("USDX") — Base Sepolia, 6 decimals, open `mint`. (Canon §1.) */
 const USDX_ADDRESS_BASE_SEPOLIA = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
@@ -3390,6 +3417,19 @@ function readResourceEnvConfig(port, env = process.env) {
 function readHost(env = process.env) {
 	return env.CAPXUL_MCP_HOST?.trim() || "127.0.0.1";
 }
+/** MCP Analytics stays disabled until the process has a PostHog project token. */
+function readMcpAnalyticsEnvConfig(env = process.env) {
+	const projectToken = env.POSTHOG_PROJECT_TOKEN?.trim();
+	if (projectToken === void 0 || projectToken.length === 0) return void 0;
+	return {
+		projectToken,
+		host: env.POSTHOG_HOST?.trim() || "https://us.i.posthog.com",
+		environment: mcpAnalyticsEnvironment(env.CAPXUL_ENV?.trim() || env.APP_ENV?.trim())
+	};
+}
+function mcpAnalyticsEnvironment(value) {
+	return value === "development" || value === "staging" || value === "production" || value === "test" ? value : "unknown";
+}
 /** Stdio only: the bearer every request in the process is treated as carrying. */
 function readStdioAccessToken(env = process.env) {
 	const token = env.CAPXUL_MCP_ACCESS_TOKEN?.trim();
@@ -3882,6 +3922,10 @@ function toPartyId(raw) {
 	if (typeof raw !== "string" || !PARTY_ID_RE$1.test(raw)) throw Errors.invalidInput("partyId", invalidValueReason("must be party_ plus an alphanumeric id", raw));
 	return raw;
 }
+function toHandle(raw) {
+	if (typeof raw !== "string" || !HANDLE_RE$1.test(raw)) throw Errors.invalidInput("handle", invalidValueReason("must be 3-30 characters of a-z, 0-9, underscore, or hyphen", raw));
+	return raw;
+}
 function toBudgetId(raw) {
 	return toNonEmptyStringBrand(raw, "budgetId");
 }
@@ -3930,6 +3974,10 @@ function toCurrencyCode(raw) {
 	if (typeof raw !== "string" || !SUPPORTED_CURRENCY_CODES.includes(raw)) throw Errors.invalidInput("currencyCode", invalidValueReason("unsupported currency", raw));
 	return raw;
 }
+function toTesterKind(raw) {
+	if (raw !== "human" && raw !== "e2e" && raw !== "agent") throw Errors.invalidInput("testerKind", "must be human, e2e, or agent");
+	return raw;
+}
 function toKycTier(raw) {
 	if (typeof raw !== "number" || !Number.isInteger(raw) || raw < 0 || raw > 3) throw Errors.invalidInput("kycTier", invalidValueReason("must be an integer in [0, 3]", raw));
 	return raw;
@@ -4062,7 +4110,6 @@ const CAPXUL_OPERATIONS = {
 		current: "holdings.current",
 		primary: "holdings.primary"
 	},
-	handles: { resolve: "handles.resolve" },
 	identity: {
 		accountAt: "identity.AccountAt",
 		accountClaimed: "identity.AccountClaimed",
@@ -4077,6 +4124,7 @@ const CAPXUL_OPERATIONS = {
 		createOrganization: "identity.CreateOrganization",
 		ensureAccount: "identity.EnsureAccount",
 		leaveOrganization: "identity.LeaveOrganization",
+		loadByAuthUserId: "identity.loadByAuthUserId",
 		loadCurrent: "identity.loadCurrent",
 		orgAt: "identity.OrgAt",
 		orgFailed: "identity.OrgFailed",
@@ -4098,7 +4146,7 @@ const CAPXUL_OPERATIONS = {
 		signOut: "identity.SignOut",
 		signOutFailed: "identity.SignOutFailed",
 		update: "identity.update",
-		usernameAvailable: "identity.usernameAvailable",
+		handleAvailable: "identity.handleAvailable",
 		verified: "identity.Verified",
 		verifyFailed: "identity.VerifyFailed",
 		verifyOtp: "identity.VerifyOtp"
@@ -4114,10 +4162,12 @@ const CAPXUL_OPERATIONS = {
 		get: "me.get"
 	},
 	moneyExecution: {
+		abandonPaymentExecution: "moneyExecution.abandonPaymentExecution",
 		prepareOrganizationPaymentExecution: "moneyExecution.prepareOrganizationPaymentExecution",
 		preparePaymentExecution: "moneyExecution.preparePaymentExecution",
 		preparePaymentLifecycleExecution: "moneyExecution.preparePaymentLifecycleExecution",
 		preparePermissionExecution: "moneyExecution.preparePermissionExecution",
+		recoverSubmissionClaims: "moneyExecution.recoverSubmissionClaims",
 		submit: "moneyExecution.submit",
 		submitPaymentCommandExecution: "moneyExecution.submitPaymentCommandExecution",
 		submitPaymentExecution: "moneyExecution.submitPaymentExecution",
@@ -4136,9 +4186,14 @@ const CAPXUL_OPERATIONS = {
 		quote: "offramp.quote",
 		status: "offramp.status"
 	},
-	onboarding: { completePerson: "onboarding.completePerson" },
+	onboarding: {
+		completeOrganization: "onboarding.completeOrganization",
+		completePerson: "onboarding.completePerson"
+	},
 	org: {
+		acceptInvitations: "org.acceptInvitations",
 		account: { get: "org.account.get" },
+		activateMember: "org.activateMember",
 		auditLog: "org.auditLog",
 		confirmBootstrap: "org.confirmBootstrap",
 		createOrg: "org.createOrg",
@@ -4149,6 +4204,7 @@ const CAPXUL_OPERATIONS = {
 		getProofReceipt: "org.getProofReceipt",
 		invite: "org.invite",
 		inviteMember: "org.inviteMember",
+		list: "org.list",
 		load: "org.load",
 		me: "org.me",
 		members: "org.members",
@@ -4219,7 +4275,8 @@ const CAPXUL_OPERATIONS = {
 	organizationPayments: {
 		pay: "organizationPayments.pay",
 		payBatch: "organizationPayments.payBatch",
-		prepareExecution: "organizationPayments.prepareExecution"
+		prepareExecution: "organizationPayments.prepareExecution",
+		retry: "organizationPayments.retry"
 	},
 	organizationSetup: { getProofReceipt: "organizationSetup.getProofReceipt" },
 	organizations: { detectAndAcceptPendingInvitations: "orgs.detectAndAcceptPendingInvitations" },
@@ -4234,6 +4291,7 @@ const CAPXUL_OPERATIONS = {
 		prepareExecution: "payments.prepareExecution",
 		prepareLifecycleExecution: "payments.prepareLifecycleExecution",
 		redirect: "payments.redirect",
+		retry: "payments.retry",
 		submitCommandExecution: "payments.submitCommandExecution",
 		submitExecution: "payments.submitExecution"
 	},
@@ -4241,11 +4299,7 @@ const CAPXUL_OPERATIONS = {
 		render: "paymentDocuments.render",
 		verify: "paymentDocuments.verify"
 	},
-	payees: {
-		create: "payees.create",
-		get: "payees.get",
-		resolve: "payees.resolve"
-	},
+	recipient: { resolve: "recipient.resolve" },
 	payroll: {
 		authorizeRun: "payroll.authorizeRun",
 		groups: {
@@ -4319,6 +4373,7 @@ const CAPXUL_OPERATIONS = {
 	smartAccount: {
 		claim: "smartAccount.claim",
 		confirmDeployment: "smartAccount.confirmDeployment",
+		loadByAuthUserId: "smartAccount.loadByAuthUserId",
 		loadCurrent: "smartAccount.loadCurrent",
 		provision: "smartAccount.provision"
 	},
@@ -4327,12 +4382,6 @@ const CAPXUL_OPERATIONS = {
 		ping: "system.ping",
 		runtimeChain: "system.runtimeChain"
 	},
-	targets: { resolve: {
-		email: "targets.resolve.email",
-		handle: "targets.resolve.handle",
-		organization: "targets.resolve.organization",
-		payee: "targets.resolve.payee"
-	} },
 	testUsdc: { mint: "TestUSDC.mint" },
 	_internal: {
 		accounts: { fund: "_internal.accounts.fund" },
@@ -4745,32 +4794,116 @@ const OrgInviteExpiredProps = Schema.Struct({
 	role: OptionalString,
 	status: OptionalString
 });
+const RecipientLocatorKindSchema = Schema.Literals([
+	"handle",
+	"email",
+	"address",
+	"party"
+]);
+const RecipientResolutionStatusSchema = Schema.Literals([
+	"known_party",
+	"new_email",
+	"external_address"
+]);
+const RecipientPartyKindSchema = Schema.Literals([
+	"person",
+	"organization",
+	"unresolved"
+]);
+const RecipientTelemetryProps = {
+	recipient_locator_kind: Schema.optional(RecipientLocatorKindSchema),
+	recipient_resolution_status: Schema.optional(RecipientResolutionStatusSchema),
+	recipient_party_id: OptionalString,
+	recipient_party_kind: Schema.optional(RecipientPartyKindSchema),
+	recipient_is_capxul_account: Schema.optional(Schema.Boolean),
+	recipient_handle: OptionalString,
+	recipient_address: OptionalAddress,
+	external_address_acknowledged: Schema.optional(Schema.Boolean)
+};
 const PaymentInitiatedProps = Schema.Struct({
+	command_id: OptionalString,
+	execution_id: OptionalString,
+	payment_lifecycle_id: OptionalString,
 	...TelemetryEnvelopeProps,
+	...RecipientTelemetryProps,
 	kind: Schema.String,
 	payment_id: Schema.String
 });
+const PaymentLifecycleProps = {
+	payment_state: OptionalString,
+	execution_state: OptionalString,
+	occurred_at: Schema.optional(Schema.Number),
+	causal_sequence: Schema.optional(Schema.Number),
+	sponsorship_valid_until: Schema.optional(Schema.Number),
+	terminal_event_id: OptionalString
+};
 const PaymentSettledL2Props = Schema.Struct({
+	...PaymentLifecycleProps,
 	...TelemetryEnvelopeProps,
+	...RecipientTelemetryProps,
 	kind: Schema.String,
 	chain_id: Schema.Number,
-	settlement_id: Schema.String
+	settlement_id: Schema.String,
+	payment_id: OptionalString,
+	payment_ids: OptionalString,
+	command_id: OptionalString,
+	payment_lifecycle_id: OptionalString,
+	execution_id: OptionalString,
+	user_op_hash: OptionalString,
+	transaction_hash: OptionalString
 });
 const PaymentFailedL2Props = Schema.Struct({
+	...PaymentLifecycleProps,
 	...TelemetryEnvelopeProps,
 	...ChainCauseTelemetryProps,
+	...RecipientTelemetryProps,
 	kind: Schema.String,
 	payment_id: Schema.String,
-	reason_code: Schema.String
+	payment_ids: OptionalString,
+	reason_code: Schema.String,
+	command_id: OptionalString,
+	payment_lifecycle_id: OptionalString,
+	execution_id: OptionalString,
+	user_op_hash: OptionalString
 });
 const PaymentVerificationRetryProps = Schema.Struct({
+	...PaymentLifecycleProps,
 	...TelemetryEnvelopeProps,
+	...RecipientTelemetryProps,
 	command_id: Schema.String,
+	payment_lifecycle_id: Schema.String,
 	attempt: Schema.Number,
 	reason_code: Schema.String,
 	chain_id: Schema.Number,
 	delay_ms: DurationMsSchema$1,
-	outcome: Schema.Literals(["scheduled", "unresolved"])
+	outcome: Schema.Literals(["scheduled", "unresolved"]),
+	payment_id: OptionalString,
+	payment_ids: OptionalString,
+	execution_id: OptionalString,
+	user_op_hash: OptionalString
+});
+const PaymentLifecycleTransitionProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	...RecipientTelemetryProps,
+	payment_id: Schema.String,
+	payment_lifecycle_id: Schema.String,
+	command_id: Schema.String,
+	payment_state: Schema.String,
+	occurred_at: Schema.Number,
+	causal_sequence: Schema.Number,
+	execution_id: OptionalString,
+	execution_state: OptionalString,
+	user_op_hash: OptionalString,
+	sponsorship_valid_until: Schema.optional(Schema.Number),
+	reason_code: OptionalString
+});
+const QuickPayExternalAddressAcknowledgedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	recipient_locator_kind: Schema.Literal("address"),
+	recipient_resolution_status: Schema.Literal("external_address"),
+	recipient_address: AddressSchema$1,
+	external_address_acknowledged: Schema.Literal(true),
+	organization_id: OptionalOrgId
 });
 const DepositInitiatedProps = Schema.Struct({ ...TelemetryEnvelopeProps });
 const DepositSettledProps = Schema.Struct({
@@ -4978,6 +5111,14 @@ Schema.Struct({
 	name: Schema.Literal("payment_verification_retry"),
 	props: PaymentVerificationRetryProps
 });
+Schema.Struct({
+	name: Schema.Literal("payment_lifecycle_transition"),
+	props: PaymentLifecycleTransitionProps
+});
+Schema.Struct({
+	name: Schema.Literal("quick_pay_external_address_acknowledged"),
+	props: QuickPayExternalAddressAcknowledgedProps
+});
 Schema.Struct({
 	name: Schema.Literal("deposit_initiated"),
 	props: DepositInitiatedProps
@@ -5320,16 +5461,13 @@ const CAPXUL_FUNCTIONS = {
 		list: "financialOps/destinations:list",
 		remove: "financialOps/destinations:remove"
 	},
-	"financialOps/mutations": { createPayee: "financialOps/mutations:createPayee" },
 	"financialOps/queries": {
 		depositInstructions: "financialOps/queries:depositInstructions",
-		getPayee: "financialOps/queries:getPayee",
 		getPayment: "financialOps/queries:getPayment",
 		listPayments: "financialOps/queries:listPayments",
 		me: "financialOps/queries:me",
 		renderStoredDocument: "financialOps/queries:renderStoredDocument",
-		resolveHandle: "financialOps/queries:resolveHandle",
-		resolvePayee: "financialOps/queries:resolvePayee",
+		resolveRecipient: "financialOps/queries:resolveRecipient",
 		verifyPaymentDocument: "financialOps/queries:verifyPaymentDocument"
 	},
 	"financialOps/requestsInbox": {
@@ -5348,7 +5486,7 @@ const CAPXUL_FUNCTIONS = {
 	},
 	"identity/queries": {
 		loadByAuthUserId: "identity/queries:loadByAuthUserId",
-		usernameAvailable: "identity/queries:usernameAvailable"
+		handleAvailable: "identity/queries:handleAvailable"
 	},
 	"holdings/actions": { current: "holdings/actions:current" },
 	"movement/activity": {
@@ -5358,6 +5496,7 @@ const CAPXUL_FUNCTIONS = {
 		summary: "movement/activity:summary"
 	},
 	"moneyExecution/actions": {
+		abandonPaymentExecution: "moneyExecution/actions:abandonPaymentExecution",
 		preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
 		preparePaymentExecution: "moneyExecution/actions:preparePaymentExecution",
 		submitPermissionExecution: "moneyExecution/actions:submitPermissionExecution",
@@ -5435,6 +5574,7 @@ const CAPXUL_FUNCTIONS = {
 const PAYMENT_STATUSES = [
 	"pending",
 	"settling",
+	"unresolved",
 	"scheduled",
 	"streaming",
 	"pending_claim",
@@ -5442,6 +5582,30 @@ const PAYMENT_STATUSES = [
 	"cancelled",
 	"failed"
 ];
+/** The lifecycle of one signed Payment execution attempt. */
+const PAYMENT_EXECUTION_STATUS = {
+	PENDING: "pending",
+	INCLUDED: "included",
+	DROPPED: "dropped",
+	REPLACED: "replaced",
+	EXPIRED: "expired",
+	UNRESOLVED: "unresolved",
+	SUPERSEDED: "superseded",
+	FAILED: "failed",
+	SETTLED: "settled"
+};
+const PAYMENT_EXECUTION_STATUSES = [
+	PAYMENT_EXECUTION_STATUS.PENDING,
+	PAYMENT_EXECUTION_STATUS.INCLUDED,
+	PAYMENT_EXECUTION_STATUS.DROPPED,
+	PAYMENT_EXECUTION_STATUS.REPLACED,
+	PAYMENT_EXECUTION_STATUS.EXPIRED,
+	PAYMENT_EXECUTION_STATUS.UNRESOLVED,
+	PAYMENT_EXECUTION_STATUS.SUPERSEDED,
+	PAYMENT_EXECUTION_STATUS.FAILED,
+	PAYMENT_EXECUTION_STATUS.SETTLED
+];
+PAYMENT_EXECUTION_STATUS.DROPPED, PAYMENT_EXECUTION_STATUS.REPLACED, PAYMENT_EXECUTION_STATUS.EXPIRED, PAYMENT_EXECUTION_STATUS.SUPERSEDED;
 /** The payment direction relative to the current actor. */
 const PAYMENT_DIRECTIONS = [
 	"in",
@@ -5477,22 +5641,16 @@ const EVM_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;
 */
 const PAYMENT_DOCUMENT_VERIFYING_CONTRACT = "0x7a5c25aB7ce91d7a475B71cd1ec33E230291f8a4";
 const PAYMENT_ID_RE = /^payment_[0-9A-Za-z]+$/;
-const PAYEE_ID_RE = /^payee_[0-9A-Za-z]+$/;
 const ORG_ID_RE = /^org_[0-9A-Za-z]+$/;
-const USER_ID_RE = /^user_[0-9A-Za-z]+$/;
 const PARTY_ID_RE = /^party_[0-9A-Za-z]+$/;
-const HANDLE_RE = /^@?[a-z0-9][a-z0-9-]{2,31}$/;
-const ORG_HANDLE_RE = /^[a-z0-9][a-z0-9-]{2,31}$/;
+const HANDLE_RE = /^@?[a-z0-9_-]{3,30}$/;
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 const MinorUnitStringSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => MINOR_UNIT_STRING_RE.test(value), { message: "must be a non-negative integer minor-unit string" })));
 const PaymentIdSchema$1 = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => PAYMENT_ID_RE.test(value), { message: "must be payment_ plus an alphanumeric id" })));
-const PayeeIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => PAYEE_ID_RE.test(value), { message: "must be payee_ plus an alphanumeric id" })));
 const OrgIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => ORG_ID_RE.test(value), { message: "must be org_ plus an alphanumeric id" })));
-const UserIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => USER_ID_RE.test(value), { message: "must be user_ plus an alphanumeric id" })));
 const PartyIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => PARTY_ID_RE.test(value), { message: "must be party_ plus an alphanumeric id" })));
 const DecimalStringSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => DECIMAL_STRING_RE.test(value), { message: "must be a non-negative decimal string" })));
 const HandleValueSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => !EVM_ADDRESS_RE.test(value) && HANDLE_RE.test(value), { message: "must be a handle; raw addresses are not accepted" })));
-const OrgHandleValueSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => !EVM_ADDRESS_RE.test(value) && ORG_HANDLE_RE.test(value), { message: "must be an org handle; raw addresses are not accepted" })));
 const EmailValueSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => !EVM_ADDRESS_RE.test(value) && EMAIL_RE.test(value), { message: "must be an email; raw addresses are not accepted" })));
 const Uint8Schema$1 = Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => Number.isSafeInteger(value) && value >= 0 && value <= 255, { message: "must be a uint8" })));
 const Uint64Schema = Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => Number.isSafeInteger(value) && value >= 0, { message: "must be a non-negative safe integer" })));
@@ -5612,42 +5770,39 @@ const WithdrawalDocumentEnvelope = Schema.Struct({
 	primaryType: Schema.Literal("Withdrawal"),
 	message: WithdrawalDocument
 });
-Schema.Union([AttachablePaymentDocumentEnvelope, WithdrawalDocumentEnvelope]);
-Schema.Struct({
-	payeeId: PayeeIdSchema,
-	label: Schema.String,
-	trustState: Schema.Literals([
-		"unverified",
-		"trusted",
-		"blocked"
-	]),
-	destinationKind: Schema.Literals([
-		"handle",
-		"email",
-		"saved-payee",
-		"org"
-	])
-});
-const PaymentRecipient = Schema.Struct({
-	kind: Schema.Literals([
-		"handle",
-		"email",
-		"payee",
-		"capxulUserId",
-		"me",
-		"org",
-		"party",
-		"external_address"
-	]),
-	label: Schema.String,
-	payeeId: Schema.optional(PayeeIdSchema)
-});
+const PaymentDocumentEnvelope = Schema.Union([AttachablePaymentDocumentEnvelope, WithdrawalDocumentEnvelope]);
+const ENVELOPE_PRIMARY_TYPE_TO_KIND = {
+	Memo: "memo",
+	Invoice: "invoice",
+	Payslip: "payslip",
+	Receipt: "receipt",
+	Withdrawal: "withdrawal"
+};
+/**
+* Derive the wire `paymentType` an UNKNOWN document envelope classifies to
+* (payment-document-spec.md D11: memo/withdrawal → unspecified, invoice →
+* invoice, payslip → payroll, receipt → reimbursement), or `undefined` if the
+* envelope is absent / malformed — the same tolerance as
+* `tryHashPaymentDocument`. Callers holding an untyped envelope (e.g. the MCP
+* org spend port, #712) use this so the type they record agrees with the type
+* the backend re-derives from the same document.
+*/
+function paymentTypeForDocumentEnvelope(envelope) {
+	if (envelope === void 0 || envelope === null) return void 0;
+	const decoded = SchemaParser.decodeUnknownResult(PaymentDocumentEnvelope)(envelope);
+	if (decoded._tag === "Failure") return void 0;
+	return paymentTypeForDocumentKind(ENVELOPE_PRIMARY_TYPE_TO_KIND[decoded.success.primaryType]);
+}
+const PaymentRecipient = Schema.Union([Schema.Struct({
+	kind: Schema.Literal("party"),
+	partyId: PartyIdSchema,
+	label: Schema.String
+}), Schema.Struct({
+	kind: Schema.Literal("external_address"),
+	label: Schema.String
+})]);
 /**
-* A raw external EVM address for the B3 withdraw lane — the cash-out
-* destination. This is the ONE schema that ACCEPTS a bare 0x (the withdraw
-* mutation args use it), as opposed to `PaymentRecipientRefSchema` which
-* REJECTS bare addresses to protect the pay lane. The full address never
-* crosses the model wire; it lives on the kind:4 Withdrawal document only.
+* A raw external EVM address for a payment or withdrawal destination.
 */
 const ExternalAddressSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => EVM_ADDRESS_RE.test(value), { message: "must be a 0x EVM address (40 hex chars)" })));
 const PaymentTiming = Schema.Union([
@@ -5673,16 +5828,8 @@ const PaymentRef = Schema.Union([
 		email: EmailValueSchema
 	}),
 	Schema.Struct({
-		kind: Schema.Literal("orgHandle"),
-		orgHandle: OrgHandleValueSchema
-	}),
-	Schema.Struct({
-		kind: Schema.Literal("capxulUserId"),
-		capxulUserId: UserIdSchema
-	}),
-	Schema.Struct({
-		kind: Schema.Literal("payeeId"),
-		payeeId: PayeeIdSchema
+		kind: Schema.Literal("address"),
+		address: ExternalAddressSchema
 	}),
 	Schema.Struct({
 		kind: Schema.Literal("party"),
@@ -5705,6 +5852,10 @@ const Payment = Schema.Struct({
 	timing: PaymentTiming,
 	released: FinancialOpsMoney,
 	availableToClaim: FinancialOpsMoney,
+	execution: Schema.optional(Schema.Struct({
+		status: Schema.Literals(PAYMENT_EXECUTION_STATUSES),
+		retryRequired: Schema.Boolean
+	})),
 	createdAt: EpochMsSchema,
 	updatedAt: EpochMsSchema
 }).pipe(Schema.check(Schema.makeFilter((payment) => payment.documents.every((document) => paymentTypeForDocumentKind(document.kind) === payment.paymentType), { message: "document kind must map to paymentType" })));
@@ -5849,11 +6000,21 @@ const MovementIdentitySchema = Schema.Struct({
 	txHash: TxHashSchema,
 	logIndex: LogIndexSchema
 });
-const MovementCanonicalStateSchema = Schema.Literals([
+const MovementCanonicalStateInputSchema = Schema.Literals([
 	"observed",
+	"included",
 	"finalized",
 	"removed"
 ]);
+const MovementCanonicalStateOutputSchema = Schema.Literals([
+	"observed",
+	"included",
+	"removed"
+]);
+const MovementCanonicalStateSchema = MovementCanonicalStateInputSchema.pipe(Schema.decodeTo(MovementCanonicalStateOutputSchema, {
+	decode: SchemaGetter.transform((state) => state === "finalized" ? "included" : state),
+	encode: SchemaGetter.transform((state) => state)
+}));
 const MovementSchema = Schema.Struct({
 	...MovementIdentitySchema.fields,
 	movementId: MovementIdSchema,
@@ -6204,7 +6365,7 @@ Schema.Struct({
 	transfers: Schema.Array(TransferEvidenceSchema),
 	requestCount: nonNegativeInteger("requestCount")
 });
-const FinalizedMoneyEvidenceCommonSchema = Schema.Struct({
+const VerifiedMoneyEvidenceCommonSchema = Schema.Struct({
 	chainId: BaseSepoliaChainIdSchema,
 	contractAddress: AddressSchema,
 	userOpHash: Bytes32Schema,
@@ -6214,8 +6375,8 @@ const FinalizedMoneyEvidenceCommonSchema = Schema.Struct({
 	blockTimestamp: Uint48Schema,
 	eventLogIndex: LogIndexSchema
 });
-const FinalizedPaymentEvidenceSchema = Schema.Struct({
-	...FinalizedMoneyEvidenceCommonSchema.fields,
+const VerifiedPaymentEvidenceSchema = Schema.Struct({
+	...VerifiedMoneyEvidenceCommonSchema.fields,
 	operation: Schema.Literal("send"),
 	settlementId: SettlementIdSchema,
 	purposeKind: PaymentPurposeKindSchema,
@@ -6227,8 +6388,8 @@ const FinalizedPaymentEvidenceSchema = Schema.Struct({
 	destination: AddressSchema,
 	rawAmount: WeiAmountSchema
 });
-const FinalizedCommitmentCreationEvidenceSchema = Schema.Struct({
-	...FinalizedMoneyEvidenceCommonSchema.fields,
+const VerifiedCommitmentCreationEvidenceSchema = Schema.Struct({
+	...VerifiedMoneyEvidenceCommonSchema.fields,
 	operation: Schema.Literal("create_commitment"),
 	commitmentId: Uint256StringSchema,
 	settlementId: SettlementIdSchema,
@@ -6244,8 +6405,8 @@ const FinalizedCommitmentCreationEvidenceSchema = Schema.Struct({
 	documentHash: NonzeroDocumentHashSchema,
 	transferLogIndex: LogIndexSchema
 });
-const FinalizedCommitmentClaimEvidenceSchema = Schema.Struct({
-	...FinalizedMoneyEvidenceCommonSchema.fields,
+const VerifiedCommitmentClaimEvidenceSchema = Schema.Struct({
+	...VerifiedMoneyEvidenceCommonSchema.fields,
 	operation: Schema.Literal("claim_commitment"),
 	commitmentId: Uint256StringSchema,
 	settlementId: SettlementIdSchema,
@@ -6258,8 +6419,8 @@ const FinalizedCommitmentClaimEvidenceSchema = Schema.Struct({
 	documentHash: NonzeroDocumentHashSchema,
 	transferLogIndex: LogIndexSchema
 });
-const FinalizedCommitmentCancelEvidenceSchema = Schema.Struct({
-	...FinalizedMoneyEvidenceCommonSchema.fields,
+const VerifiedCommitmentCancelEvidenceSchema = Schema.Struct({
+	...VerifiedMoneyEvidenceCommonSchema.fields,
 	operation: Schema.Literal("cancel_commitment"),
 	commitmentId: Uint256StringSchema,
 	settlementId: SettlementIdSchema,
@@ -6273,8 +6434,8 @@ const FinalizedCommitmentCancelEvidenceSchema = Schema.Struct({
 	documentHash: NonzeroDocumentHashSchema,
 	transfer: Schema.NullOr(TransferEvidenceSchema)
 });
-const FinalizedCommitmentRedirectEvidenceSchema = Schema.Struct({
-	...FinalizedMoneyEvidenceCommonSchema.fields,
+const VerifiedCommitmentRedirectEvidenceSchema = Schema.Struct({
+	...VerifiedMoneyEvidenceCommonSchema.fields,
 	operation: Schema.Literal("redirect_commitment"),
 	commitmentId: Uint256StringSchema,
 	settlementId: SettlementIdSchema,
@@ -6285,12 +6446,12 @@ const FinalizedCommitmentRedirectEvidenceSchema = Schema.Struct({
 	documentHash: NonzeroDocumentHashSchema,
 	transfer: Schema.Null
 });
-const FinalizedMoneyEvidenceSchema = Schema.Union([
-	FinalizedPaymentEvidenceSchema,
-	FinalizedCommitmentCreationEvidenceSchema,
-	FinalizedCommitmentClaimEvidenceSchema,
-	FinalizedCommitmentCancelEvidenceSchema,
-	FinalizedCommitmentRedirectEvidenceSchema
+const VerifiedMoneyEvidenceSchema = Schema.Union([
+	VerifiedPaymentEvidenceSchema,
+	VerifiedCommitmentCreationEvidenceSchema,
+	VerifiedCommitmentClaimEvidenceSchema,
+	VerifiedCommitmentCancelEvidenceSchema,
+	VerifiedCommitmentRedirectEvidenceSchema
 ]);
 Schema.Union([
 	Schema.Struct({
@@ -6300,7 +6461,7 @@ Schema.Union([
 	}),
 	Schema.Struct({
 		status: Schema.Literal("verified"),
-		evidence: FinalizedMoneyEvidenceSchema
+		evidence: VerifiedMoneyEvidenceSchema
 	}),
 	Schema.Struct({
 		status: Schema.Literal("mismatch"),
@@ -6312,7 +6473,7 @@ Schema.Union([
 		retryable: Schema.Literal(true)
 	})
 ]);
-const FinalizedAttributedInboundMovementSchema = Schema.Struct({
+const VerifiedAttributedInboundMovementSchema = Schema.Struct({
 	movement: MovementSchema,
 	attribution: MovementAttributionSchema
 });
@@ -6338,6 +6499,25 @@ const ProtocolBirthInputSchema = Schema.Struct({
 	release: ReleaseTermsSchema,
 	lineage: Schema.optional(PaymentCommandLineageSchema)
 }).pipe(Schema.refine((birth) => hasActorBoundPermission(birth.actor, birth.actor.kind === "organization" ? birth.actor.orgId : void 0, birth.permissionId), { message: "Organization Payment and Payout births require permissionId; personal births forbid it" }));
+const ApplyVerifiedEvidenceCommandSchema = Schema.Struct({
+	kind: Schema.Literal("apply_verified_evidence"),
+	paymentId: PaymentIdSchema,
+	evidence: VerifiedMoneyEvidenceSchema
+});
+const ApplyFinalizedEvidenceCommandSchema = Schema.Struct({
+	kind: Schema.Literal("apply_finalized_evidence"),
+	paymentId: PaymentIdSchema,
+	evidence: VerifiedMoneyEvidenceSchema
+}).pipe(Schema.decodeTo(ApplyVerifiedEvidenceCommandSchema, {
+	decode: SchemaGetter.transform((value) => ({
+		...value,
+		kind: "apply_verified_evidence"
+	})),
+	encode: SchemaGetter.transform((value) => ({
+		...value,
+		kind: "apply_finalized_evidence"
+	}))
+}));
 Schema.Union([
 	Schema.Struct({
 		kind: Schema.Literal("birth"),
@@ -6345,7 +6525,7 @@ Schema.Union([
 	}),
 	Schema.Struct({
 		kind: Schema.Literal("birth_deposit"),
-		movement: FinalizedAttributedInboundMovementSchema
+		movement: VerifiedAttributedInboundMovementSchema
 	}),
 	Schema.Struct({
 		kind: Schema.Literal("rollback_deposit"),
@@ -6357,11 +6537,8 @@ Schema.Union([
 		paymentIds: Schema.Array(PaymentIdSchema),
 		userOpHash: Bytes32Schema
 	}),
-	Schema.Struct({
-		kind: Schema.Literal("apply_finalized_evidence"),
-		paymentId: PaymentIdSchema,
-		evidence: FinalizedMoneyEvidenceSchema
-	}),
+	ApplyVerifiedEvidenceCommandSchema,
+	ApplyFinalizedEvidenceCommandSchema,
 	Schema.Struct({
 		kind: Schema.Literal("transition"),
 		paymentId: PaymentIdSchema,
@@ -6503,6 +6680,7 @@ const MoneyExecutionIdSchema = Schema.String.pipe(Schema.refine((value) => /^mon
 const OwnerSignatureSchema = Schema.String.pipe(Schema.refine((value) => /^0x[0-9a-fA-F]{130}$/u.test(value), { message: "signature must be a 65-byte 0x value" }));
 const PaymentExecutionIntentSchema = Schema.Struct({
 	to: PaymentRef,
+	externalAddressAcknowledged: Schema.optional(Schema.Literal(true)),
 	amount: FinancialOpsMoney,
 	paymentType: Schema.optional(Schema.Literals([
 		"unspecified",
@@ -6519,7 +6697,31 @@ Schema.Struct({
 	signerAddress: AddressSchema,
 	payment: PaymentExecutionIntentSchema
 });
+const RecipientObservationSchema = Schema.Struct({
+	recipient_locator_kind: Schema.Literals([
+		"handle",
+		"email",
+		"party",
+		"address"
+	]),
+	recipient_resolution_status: Schema.Literals([
+		"known_party",
+		"new_email",
+		"external_address"
+	]),
+	recipient_is_capxul_account: Schema.Boolean,
+	recipient_party_id: Schema.optional(Schema.String),
+	recipient_party_kind: Schema.optional(Schema.Literals([
+		"person",
+		"organization",
+		"unresolved"
+	])),
+	recipient_handle: Schema.optional(Schema.String),
+	recipient_address: AddressSchema,
+	external_address_acknowledged: Schema.Boolean
+});
 Schema.Struct({
+	recipientObservation: RecipientObservationSchema,
 	executionId: MoneyExecutionIdSchema,
 	commandId: PaymentCommandIdSchema,
 	paymentId: PaymentIdSchema,
@@ -6536,6 +6738,14 @@ Schema.Struct({
 	executionId: MoneyExecutionIdSchema,
 	signature: OwnerSignatureSchema
 });
+Schema.Struct({
+	executionId: MoneyExecutionIdSchema,
+	reason: Schema.Literals([
+		"signer_rejected",
+		"cancelled",
+		"prepared_mismatch"
+	])
+});
 Schema.Struct({
 	executionId: MoneyExecutionIdSchema,
 	commandId: PaymentCommandIdSchema,
@@ -6549,6 +6759,10 @@ Schema.Struct({
 	payments: Schema.Array(Payment)
 });
 const PaymentLifecycleExecutionIntentSchema = Schema.Union([
+	Schema.Struct({
+		kind: Schema.Literal("retry"),
+		paymentId: PaymentIdSchema
+	}),
 	Schema.Struct({
 		kind: Schema.Literal("claim"),
 		paymentId: PaymentIdSchema
@@ -6569,6 +6783,7 @@ Schema.Struct({
 });
 const OrganizationPaymentExecutionItemSchema = Schema.Struct({
 	to: PaymentRef,
+	externalAddressAcknowledged: Schema.optional(Schema.Literal(true)),
 	amount: FinancialOpsMoney,
 	paymentType: Schema.optional(Schema.Literals([
 		"unspecified",
@@ -6587,6 +6802,8 @@ Schema.Struct({
 	lineage: Schema.optional(PaymentCommandLineageSchema)
 });
 const PreparedPaymentCommandExecutionSchema = Schema.Struct({
+	recipientObservations: Schema.Array(RecipientObservationSchema),
+	emitPaymentInitiated: Schema.Boolean,
 	executionId: MoneyExecutionIdSchema,
 	commandId: PaymentCommandIdSchema,
 	paymentIds: Schema.Array(PaymentIdSchema),
@@ -6622,7 +6839,8 @@ const PermissionCommandSchema = Schema.Union([
 		operation: Schema.Literal("assign"),
 		requestKey: nonEmpty("requestKey"),
 		permissionId: PermissionIdSchema,
-		accountId: nonEmpty("accountId")
+		accountId: nonEmpty("accountId"),
+		expectedMemberEmail: Schema.optional(nonEmpty("expectedMemberEmail"))
 	}),
 	Schema.Struct({
 		operation: Schema.Literal("revoke"),
@@ -6877,9 +7095,10 @@ const INVOCATION_OBSERVATION = Symbol("capxul.invocation-observation");
 const FAILURE_INVOCATION_SNAPSHOT = Symbol("capxul.failure-invocation-snapshot");
 /** @internal Attach one immutable, non-wire invocation snapshot to an SDK-owned object. */
 function attachInvocationObservation(target, source) {
-	const snapshot = Object.freeze(source.context === void 0 ? { active: source.active } : {
+	const snapshot = Object.freeze({
 		active: source.active,
-		context: Object.freeze({ ...source.context })
+		...source.actorId === void 0 ? {} : { actorId: source.actorId },
+		...source.context === void 0 ? {} : { context: Object.freeze({ ...source.context }) }
 	});
 	Object.defineProperty(target, INVOCATION_OBSERVATION, {
 		configurable: false,
@@ -6909,6 +7128,12 @@ function markFailureInvocationSnapshot(failure, snapshot) {
 	});
 	return failure;
 }
+/** @internal Read the call-start delivery decision; undefined means a direct adapter call. */
+function readFailureInvocationSnapshot(failure) {
+	if (typeof failure !== "object" || failure === null) return void 0;
+	const snapshot = failure[FAILURE_INVOCATION_SNAPSHOT];
+	return typeof snapshot === "object" && snapshot !== null && "active" in snapshot ? snapshot : void 0;
+}
 //#endregion
 //#region ../../packages/sdk/src/surface/_shared/provisioning-telemetry.ts
 async function emitProvisioningTelemetry(telemetry, smartAccount) {
@@ -9526,10 +9751,10 @@ const logIdentityTransition = (record) => (record.outcome === "applied" ? Effect
 //#region ../../packages/sdk/src/domain/machine/shell.ts
 const INVOCATION_PARENT_SPAN = Symbol("@capxul/sdk/identity-invocation-parent-span");
 function carryInvocationParentSpan(controls, parent) {
-	return {
+	return copyInvocationObservation(controls, {
 		...controls,
 		[INVOCATION_PARENT_SPAN]: parent
-	};
+	});
 }
 function withInvocationParentSpan(effect, controls) {
 	const parent = controls?.[INVOCATION_PARENT_SPAN];
@@ -9880,13 +10105,13 @@ async function toCapxulResult(program, layer) {
 * with `{ publicError }` rather than a bare `CapxulError`, so the wrapper is
 * unwrapped here — once — instead of at every call site.
 */
-async function runIfActive(signal, operation, effect, runPromise = Effect.runPromise) {
-	if (signal?.aborted === true) return {
+async function runIfActive(signal, operation, effect, runPromise = Effect.runPromise, observe) {
+	if (signal?.aborted === true && observe === void 0) return {
 		ok: false,
 		error: Errors.cancelled({ operation })
 	};
-	const program = effect().pipe(Effect.mapError((error) => error.publicError));
-	return runProgram(signal === void 0 ? program : Effect.raceFirst(program, Effect.callback((resume) => {
+	const program = signal?.aborted === true ? Effect.fail(Errors.cancelled({ operation })) : Effect.suspend(effect).pipe(Effect.mapError((error) => error.publicError));
+	const controlled = signal === void 0 ? program : Effect.raceFirst(program, Effect.callback((resume) => {
 		if (signal.aborted) {
 			resume(Effect.fail(Errors.cancelled({ operation })));
 			return Effect.void;
@@ -9894,7 +10119,8 @@ async function runIfActive(signal, operation, effect, runPromise = Effect.runPro
 		const onAbort = () => resume(Effect.fail(Errors.cancelled({ operation })));
 		signal.addEventListener("abort", onAbort, { once: true });
 		return Effect.sync(() => signal.removeEventListener("abort", onAbort));
-	})), runPromise);
+	}));
+	return runProgram(observe === void 0 ? controlled : observe(controlled), runPromise);
 }
 //#endregion
 //#region ../../packages/sdk/src/surface/_shared/effect-actor-bridge.ts
@@ -9945,22 +10171,52 @@ async function runPortEffect(effect, controls, operation = CAPXUL_OPERATIONS.run
 		orElse: () => Effect.fail({ publicError: Errors.providerTimeout("sdk", operation, timeoutMs) })
 	}))).pipe(Effect.mapError((failure) => failure.publicError)), controls, operation, runPromise);
 }
+/** Keep observation metadata while the compound operation owns cancellation. */
+function observationOnlyControls(controls) {
+	const { signal: _signal, timeoutMs: _timeoutMs, deadlineMs: _deadlineMs, ...observation } = controls ?? {};
+	return copyInvocationObservation(controls, observation);
+}
 /** Observe a public Effect that already uses the canonical CapxulError channel. */
 async function runCapxulEffect(effect, controls, operation = CAPXUL_OPERATIONS.runtime.port, runPromise = Effect.runPromise) {
 	const invocation = readInvocationObservation(controls);
-	const correlationId = safeEngineeringIdentifier(controls?.correlation_id ?? invocation?.context?.correlationId);
-	const observed = effect.pipe(Effect.tap(() => Effect.annotateCurrentSpan({ outcome: "succeeded" })), Effect.tapError((error) => {
-		const mode = error.mode ?? error.details?.failure_mode;
-		return Effect.annotateCurrentSpan({
-			outcome: portFailureOutcome(error.code),
-			failure_code: error.code,
-			...typeof mode === "string" ? { mode } : {}
-		});
-	}), Effect.tapDefect(() => Effect.annotateCurrentSpan({
-		outcome: "failed",
-		failure_code: "UNKNOWN"
-	})), Effect.withSpan(`identity.port.${operation}`), Effect.annotateSpans(correlationId === void 0 ? {} : { correlation_id: correlationId }));
-	return runIfActive(controls?.signal, operation, () => withInvocationParentSpan(observed, controls).pipe(Effect.mapError((publicError) => ({ publicError }))), runPromise);
+	const correlationId = safeEngineeringIdentifier(invocation?.context?.correlationId ?? controls?.correlation_id);
+	const context = invocation?.active === false ? void 0 : sanitizeObservationContext(invocation?.context);
+	const fields = {
+		operation,
+		...correlationId === void 0 ? {} : { correlation_id: correlationId },
+		...context?.sessionId === void 0 ? {} : {
+			session_id: context.sessionId,
+			sessionId: context.sessionId
+		},
+		...context?.journeyId === void 0 ? {} : { journey_id: context.journeyId },
+		...context?.release === void 0 ? {} : { release: context.release },
+		...context?.application === void 0 ? {} : { application: context.application },
+		...safeEngineeringIdentifier(invocation?.actorId) === void 0 ? {} : {
+			actor_id: invocation.actorId,
+			actor_kind: "authenticated",
+			posthogDistinctId: invocation.actorId
+		}
+	};
+	const result = await runIfActive(controls?.signal, operation, () => effect.pipe(Effect.mapError((publicError) => ({ publicError }))), runPromise, (program) => withInvocationParentSpan(Effect.gen(function* () {
+		const startedAt = yield* Clock.currentTimeMillis;
+		const exit = yield* Effect.exit(program.pipe(Effect.catchDefect((cause) => Effect.fail(Errors.unknown(cause)))));
+		const duration_ms = (yield* Clock.currentTimeMillis) - startedAt;
+		const error = Exit.isFailure(exit) ? Cause.squash(exit.cause) : void 0;
+		const failure = error instanceof CapxulError ? error : void 0;
+		const outcome = Exit.isSuccess(exit) ? "succeeded" : failure?.code === "CANCELLED" ? "cancelled" : failure !== void 0 && EXPECTED_OPERATION_OUTCOMES.has(failure.code) ? "refused" : "failed";
+		const completion = {
+			...fields,
+			duration_ms,
+			outcome,
+			...failure === void 0 ? {} : { failure_code: failure.code },
+			...typeof failure?.mode === "string" ? { mode: failure.mode } : {},
+			...failure?.mode === void 0 && typeof failure?.details?.failure_mode === "string" ? { mode: failure.details.failure_mode } : {}
+		};
+		yield* Effect.annotateCurrentSpan(completion).pipe(Effect.catchCause(() => Effect.void));
+		yield* (outcome === "failed" ? Effect.logError("capxul_sdk_operation") : Effect.logInfo("capxul_sdk_operation")).pipe(Effect.annotateLogs(completion), Effect.catchCause(() => Effect.void));
+		return yield* Exit.isSuccess(exit) ? Effect.succeed(exit.value) : Effect.failCause(exit.cause);
+	}).pipe(Effect.withSpan(operation)), controls));
+	return !result.ok && invocation !== void 0 ? markFailureInvocationSnapshot(result, invocation) : result;
 }
 /** Map machine-internal failure state onto the public SDK error vocabulary. */
 function publicIdentityFailure(failure) {
@@ -10519,76 +10775,110 @@ function makeActorRelationshipMethods(deps) {
 	const fns = actorScopeContract;
 	return {
 		addressBook: {
-			list: (input, options) => mapOk$1(CAPXUL_OPERATIONS.addressBook.list, awaitableConvex(options?.signal, CAPXUL_OPERATIONS.addressBook.list, () => convexCall.query(fns.addressBookList, {
-				actor,
-				...input?.includeHidden === void 0 ? {} : { includeHidden: input.includeHidden }
-			})), (entries) => entries.map(mapAddressBookEntry)),
-			get: (entryId, options) => mapOk$1(CAPXUL_OPERATIONS.addressBook.get, awaitableConvex(options?.signal, CAPXUL_OPERATIONS.addressBook.get, () => convexCall.query(fns.addressBookGet, {
-				actor,
-				partyId: entryId
-			})), (entry) => entry === null ? null : mapAddressBookEntry(entry)),
-			add: async (input, options) => {
+			list: (input, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(mapReply(CAPXUL_OPERATIONS.addressBook.list, Effect.suspend(() => convexCall.query(fns.addressBookList, copyInvocationObservation(controls, {
+					actor,
+					...input?.includeHidden === void 0 ? {} : { includeHidden: input.includeHidden }
+				}))), (entries) => entries.map(mapAddressBookEntry)), controls, CAPXUL_OPERATIONS.addressBook.list, deps.runPromise);
+			},
+			get: (entryId, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(mapReply(CAPXUL_OPERATIONS.addressBook.get, Effect.suspend(() => convexCall.query(fns.addressBookGet, copyInvocationObservation(controls, {
+					actor,
+					partyId: entryId
+				}))), (entry) => entry === null ? null : mapAddressBookEntry(entry)), controls, CAPXUL_OPERATIONS.addressBook.get, deps.runPromise);
+			},
+			add: (input, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
 				const ref = normalizeRefForBackend$1(input.ref, "ref");
-				if (!ref.ok) return ref;
-				return mapOk$1(CAPXUL_OPERATIONS.addressBook.add, await awaitableConvex(options?.signal, CAPXUL_OPERATIONS.addressBook.add, () => convexCall.mutation(fns.addressBookAdd, {
+				if (!ref.ok) return runCapxulEffect(Effect.fail(ref.error), controls, CAPXUL_OPERATIONS.addressBook.add, deps.runPromise);
+				return runPortEffect(mapReply(CAPXUL_OPERATIONS.addressBook.add, Effect.suspend(() => convexCall.mutation(fns.addressBookAdd, copyInvocationObservation(controls, {
 					actor,
 					ref: ref.value,
 					...input.label === void 0 ? {} : { label: input.label }
-				})), mapAddressBookEntry);
+				}))), mapAddressBookEntry), controls, CAPXUL_OPERATIONS.addressBook.add, deps.runPromise);
+			},
+			hide: (entryId, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(mapReply(CAPXUL_OPERATIONS.addressBook.hide, Effect.suspend(() => convexCall.mutation(fns.addressBookHide, copyInvocationObservation(controls, {
+					actor,
+					partyId: entryId
+				}))), mapAddressBookEntry), controls, CAPXUL_OPERATIONS.addressBook.hide, deps.runPromise);
+			},
+			unhide: (entryId, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(mapReply(CAPXUL_OPERATIONS.addressBook.unhide, Effect.suspend(() => convexCall.mutation(fns.addressBookUnhide, copyInvocationObservation(controls, {
+					actor,
+					partyId: entryId
+				}))), mapAddressBookEntry), controls, CAPXUL_OPERATIONS.addressBook.unhide, deps.runPromise);
 			},
-			hide: (entryId, options) => mapOk$1(CAPXUL_OPERATIONS.addressBook.hide, awaitableConvex(options?.signal, CAPXUL_OPERATIONS.addressBook.hide, () => convexCall.mutation(fns.addressBookHide, {
-				actor,
-				partyId: entryId
-			})), mapAddressBookEntry),
-			unhide: (entryId, options) => mapOk$1(CAPXUL_OPERATIONS.addressBook.unhide, awaitableConvex(options?.signal, CAPXUL_OPERATIONS.addressBook.unhide, () => convexCall.mutation(fns.addressBookUnhide, {
-				actor,
-				partyId: entryId
-			})), mapAddressBookEntry),
-			label: (input, options) => mapOk$1(CAPXUL_OPERATIONS.addressBook.label, awaitableConvex(options?.signal, CAPXUL_OPERATIONS.addressBook.label, () => convexCall.mutation(fns.addressBookLabel, {
-				actor,
-				partyId: input.entryId,
-				label: input.label
-			})), mapAddressBookEntry)
+			label: (input, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(mapReply(CAPXUL_OPERATIONS.addressBook.label, Effect.suspend(() => convexCall.mutation(fns.addressBookLabel, copyInvocationObservation(controls, {
+					actor,
+					partyId: input.entryId,
+					label: input.label
+				}))), mapAddressBookEntry), controls, CAPXUL_OPERATIONS.addressBook.label, deps.runPromise);
+			}
 		},
 		requests: {
-			issue: async (input, options) => {
+			issue: (input, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
 				const payer = normalizeRefForBackend$1(input.payer, "payer");
-				if (!payer.ok) return payer;
-				return mapOk$1(CAPXUL_OPERATIONS.requests.issue, await awaitableConvex(options?.signal, CAPXUL_OPERATIONS.requests.issue, () => convexCall.mutation(fns.requestsIssue, {
+				if (!payer.ok) return runCapxulEffect(Effect.fail(payer.error), controls, CAPXUL_OPERATIONS.requests.issue, deps.runPromise);
+				return runPortEffect(mapReply(CAPXUL_OPERATIONS.requests.issue, Effect.suspend(() => convexCall.mutation(fns.requestsIssue, copyInvocationObservation(controls, {
 					actor,
 					payer: payer.value,
 					amount: input.amount,
 					reference: input.reference,
 					...input.memo === void 0 ? {} : { memo: input.memo },
 					...input.expiresAt === void 0 ? {} : { expiresAt: input.expiresAt }
-				})), (request) => mapActorRequest(request, input.payer));
+				}))), (request) => mapActorRequest(request, input.payer)), controls, CAPXUL_OPERATIONS.requests.issue, deps.runPromise);
+			},
+			list: (options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(mapReply(CAPXUL_OPERATIONS.requests.list, Effect.suspend(() => convexCall.query(fns.requestsList, copyInvocationObservation(controls, { actor }))), (requests) => requests.map((request) => mapActorRequest(request))), controls, CAPXUL_OPERATIONS.requests.list, deps.runPromise);
+			},
+			get: (requestId, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(mapReply(CAPXUL_OPERATIONS.requests.get, Effect.suspend(() => convexCall.query(fns.requestsGet, copyInvocationObservation(controls, {
+					actor,
+					paymentRequestId: requestId
+				}))), (request) => request === null ? null : mapActorRequest(request)), controls, CAPXUL_OPERATIONS.requests.get, deps.runPromise);
 			},
-			list: (options) => mapOk$1(CAPXUL_OPERATIONS.requests.list, awaitableConvex(options?.signal, CAPXUL_OPERATIONS.requests.list, () => convexCall.query(fns.requestsList, { actor })), (requests) => requests.map((request) => mapActorRequest(request))),
-			get: (requestId, options) => mapOk$1(CAPXUL_OPERATIONS.requests.get, awaitableConvex(options?.signal, CAPXUL_OPERATIONS.requests.get, () => convexCall.query(fns.requestsGet, {
-				actor,
-				paymentRequestId: requestId
-			})), (request) => request === null ? null : mapActorRequest(request)),
-			cancel: (requestId, options) => mapOk$1(CAPXUL_OPERATIONS.requests.cancel, awaitableConvex(options?.signal, CAPXUL_OPERATIONS.requests.cancel, () => convexCall.mutation(fns.requestsCancel, {
-				actor,
-				paymentRequestId: requestId
-			})), (request) => mapActorRequest(request))
+			cancel: (requestId, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(mapReply(CAPXUL_OPERATIONS.requests.cancel, Effect.suspend(() => convexCall.mutation(fns.requestsCancel, copyInvocationObservation(controls, {
+					actor,
+					paymentRequestId: requestId
+				}))), (request) => mapActorRequest(request)), controls, CAPXUL_OPERATIONS.requests.cancel, deps.runPromise);
+			}
 		},
 		inbox: {
-			list: (options) => mapOk$1(CAPXUL_OPERATIONS.inbox.list, awaitableConvex(options?.signal, CAPXUL_OPERATIONS.inbox.list, () => convexCall.query(fns.inboxList, { actor })), (items) => items.map(mapInboxItem)),
-			approve: async (input, options) => {
-				const result = await awaitableConvex(options?.signal, CAPXUL_OPERATIONS.inbox.approve, () => convexCall.mutation(fns.inboxApprove, {
+			list: (options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(mapReply(CAPXUL_OPERATIONS.inbox.list, Effect.suspend(() => convexCall.query(fns.inboxList, copyInvocationObservation(controls, { actor }))), (items) => items.map(mapInboxItem)), controls, CAPXUL_OPERATIONS.inbox.list, deps.runPromise);
+			},
+			approve: (input, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(Effect.suspend(() => convexCall.mutation(fns.inboxApprove, copyInvocationObservation(controls, {
 					actor,
 					paymentRequestId: input.requestId,
 					...input.timing === void 0 ? {} : { timing: input.timing },
 					...input.permissionId === void 0 ? {} : { permissionId: input.permissionId }
-				}));
-				if (!result.ok) return result;
-				return mapApprovedInboxPayment(result.value, input);
+				}))).pipe(Effect.flatMap((prepared) => {
+					const result = mapApprovedInboxPayment(prepared, input);
+					return result.ok ? Effect.succeed(result.value) : Effect.fail({ publicError: result.error });
+				})), controls, CAPXUL_OPERATIONS.inbox.approve, deps.runPromise);
 			},
-			decline: (requestId, options) => mapOk$1(CAPXUL_OPERATIONS.inbox.decline, awaitableConvex(options?.signal, CAPXUL_OPERATIONS.inbox.decline, () => convexCall.mutation(fns.inboxDecline, {
-				actor,
-				paymentRequestId: requestId
-			})), mapInboxItem)
+			decline: (requestId, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(mapReply(CAPXUL_OPERATIONS.inbox.decline, Effect.suspend(() => convexCall.mutation(fns.inboxDecline, copyInvocationObservation(controls, {
+					actor,
+					paymentRequestId: requestId
+				}))), mapInboxItem), controls, CAPXUL_OPERATIONS.inbox.decline, deps.runPromise);
+			}
 		},
 		profile: {
 			get: (options) => {
@@ -10665,22 +10955,12 @@ function missingConvexCall(operation) {
 * promise and the caller's `if (!result.ok)` never runs (ADR-0023: errors are
 * values, and a code crosses the seam).
 */
-async function mapOk$1(operation, resultOrPromise, f) {
-	const result = await resultOrPromise;
-	if (!result.ok) return result;
-	try {
-		return {
-			ok: true,
-			value: f(result.value)
-		};
-	} catch (cause) {
-		return {
-			ok: false,
-			error: cause instanceof CapxulError ? cause : Errors.providerError("convex", operation, cause)
-		};
-	}
+function mapReply(operation, program, project) {
+	return program.pipe(Effect.flatMap((value) => Effect.try({
+		try: () => project(value),
+		catch: (cause) => ({ publicError: cause instanceof CapxulError ? cause : Errors.providerError("convex", operation, cause) })
+	})));
 }
-const awaitableConvex = runIfActive;
 const ADDRESS_BOOK_RELATIONSHIPS = [
 	"paid",
 	"paidBy",
@@ -10806,25 +11086,11 @@ function normalizeRefForBackend$1(ref, field) {
 					email: nonEmptyRefValue$1(ref.email, "email")
 				}
 			};
-			case "orgHandle": return {
-				ok: true,
-				value: {
-					kind: "orgHandle",
-					orgHandle: nonEmptyRefValue$1(ref.orgHandle, "orgHandle")
-				}
-			};
-			case "capxulUserId": return {
-				ok: true,
-				value: {
-					kind: "capxulUserId",
-					capxulUserId: nonEmptyRefValue$1(ref.capxulUserId, "capxulUserId")
-				}
-			};
-			case "payeeId": return {
+			case "address": return {
 				ok: true,
 				value: {
-					kind: "payeeId",
-					payeeId: nonEmptyRefValue$1(ref.payeeId, "payeeId")
+					kind: "address",
+					address: toAddress(ref.address)
 				}
 			};
 			case "party": return {
@@ -11062,6 +11328,8 @@ function makeAccountMethods(deps) {
 	return {
 		methods: {
 			...makeActorRelationshipMethods({
+				...deps.runPromise === void 0 ? {} : { runPromise: deps.runPromise },
+				...deps.invocationControls === void 0 ? {} : { invocationControls: deps.invocationControls },
 				actor: { kind: "account" },
 				...deps.convexCall === void 0 ? {} : { convexCall: deps.convexCall },
 				...deps.profileMethods === void 0 ? {} : { accountProfileMethods: deps.profileMethods }
@@ -11088,10 +11356,7 @@ function makeAccountMethods(deps) {
 const financialOpsContract = {
 	me: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].me),
 	depositInstructions: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].depositInstructions),
-	resolveHandle: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].resolveHandle),
-	createPayee: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/mutations"].createPayee),
-	getPayee: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].getPayee),
-	resolvePayee: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].resolvePayee),
+	resolveRecipient: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].resolveRecipient),
 	addDestination: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/destinations"].add),
 	listDestinations: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/destinations"].list),
 	removeDestination: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/destinations"].remove),
@@ -11107,6 +11372,7 @@ const financialOpsContract = {
 //#endregion
 //#region ../../packages/sdk/src/contract/money-execution.ts
 const moneyExecutionContract = {
+	abandonPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].abandonPaymentExecution),
 	preparePermissionExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePermissionExecution),
 	preparePaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePaymentExecution),
 	prepareOrganizationPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].prepareOrganizationPaymentExecution),
@@ -11117,7 +11383,7 @@ const moneyExecutionContract = {
 };
 //#endregion
 //#region ../../packages/sdk/package.json
-var version$1 = "3.2.0";
+var version$1 = "4.0.1";
 //#endregion
 //#region ../../packages/sdk/src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -11196,7 +11462,8 @@ function observeSdkClient(client, adapter, snapshot) {
 	};
 	const processOutput = (output, path, invocation) => {
 		if (isFailedResult(output)) {
-			report(adapter, "operation", path.join("."), output.error, invocation);
+			const captured = readFailureInvocationSnapshot(output);
+			report(adapter, "operation", path.join("."), output.error, captured ?? invocation, void 0, captured !== void 0);
 			return output;
 		}
 		if (isCapxulResult(output)) return output;
@@ -11228,7 +11495,7 @@ function reportedByMachine(cause) {
 	}
 	return false;
 }
-function report(adapter, kind, operation, cause, invocation, origin) {
+function report(adapter, kind, operation, cause, invocation, origin, authoritativeSnapshot = false) {
 	if (origin === "machine") {
 		let link = cause;
 		for (let depth = 0; depth < 8 && typeof link === "object" && link !== null; depth++) {
@@ -11240,7 +11507,7 @@ function report(adapter, kind, operation, cause, invocation, origin) {
 	const kindName = normalizeErrorKind(errorKind$1(cause));
 	const context = sanitizeObservationContext({
 		...invocation.context,
-		...isCapxulError(cause) && cause.correlationId !== void 0 ? { correlationId: cause.correlationId } : {}
+		...!authoritativeSnapshot && isCapxulError(cause) && cause.correlationId !== void 0 ? { correlationId: cause.correlationId } : {}
 	});
 	const detail = failureDetail(cause);
 	const evidence = failureEvidence(cause);
@@ -11254,6 +11521,7 @@ function report(adapter, kind, operation, cause, invocation, origin) {
 		...evidence
 	}, {
 		active: invocation.active,
+		...invocation.actorId === void 0 ? {} : { actorId: invocation.actorId },
 		...context === void 0 ? {} : { context }
 	});
 	try {
@@ -11633,7 +11901,11 @@ function emitPaymentInitiated(telemetry, input) {
 		name: "payment_initiated",
 		props: {
 			kind: input.kind,
-			payment_id: input.paymentId
+			payment_id: input.paymentId,
+			payment_lifecycle_id: `payment_lifecycle_${input.paymentId}`,
+			...input.commandId === void 0 ? {} : { command_id: input.commandId },
+			...input.executionId === void 0 ? {} : { execution_id: input.executionId },
+			...input.recipient
 		}
 	});
 }
@@ -11665,7 +11937,17 @@ async function fingerprintPaymentIntent(intent) {
 function matchesIntent(expected) {
 	return async (request) => await fingerprintPaymentIntent(request) === await fingerprintPaymentIntent(expected);
 }
-async function executePrepared(deps, prepare, isExpectedRequest, signal) {
+async function abandonPrepared$1(deps, executionId, closePayment, reason, result, onPreparedClosed, controls) {
+	if (!closePayment) return result;
+	const abandoned = await runIfActive(void 0, CAPXUL_OPERATIONS.moneyExecution.abandonPaymentExecution, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(deps.functions.abandonPaymentExecution, copyInvocationObservation(controls, { input: {
+		executionId,
+		reason
+	} }))), controls), deps.runPromise);
+	if (!abandoned.ok) return abandoned;
+	if (abandoned.value) onPreparedClosed?.();
+	return result;
+}
+async function executePrepared(deps, prepare, isExpectedRequest, closePaymentOnExit, onPreparedClosed, signal, controls) {
 	if (isAborted$2(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
@@ -11686,48 +11968,61 @@ async function executePrepared(deps, prepare, isExpectedRequest, signal) {
 	}
 	const prepared = await prepare(signerAddress);
 	if (!prepared.ok) return prepared;
-	if (!await isExpectedRequest(prepared.value.request)) return {
+	if (!await isExpectedRequest(prepared.value.request)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "prepared_mismatch", {
 		ok: false,
 		error: Errors.invalidInput("payment", "prepared command mismatch")
-	};
+	}, onPreparedClosed, controls);
 	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
-	if (prepared.value.chainId !== deps.chainId || prepared.value.signerAddress.toLowerCase() !== signerAddress.toLowerCase() || prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return {
+	if (prepared.value.chainId !== deps.chainId || prepared.value.signerAddress.toLowerCase() !== signerAddress.toLowerCase() || prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "prepared_mismatch", {
 		ok: false,
 		error: Errors.invalidInput("payment", "prepared authority mismatch")
-	};
-	if (isAborted$2(signal)) return {
+	}, onPreparedClosed, controls);
+	if (isAborted$2(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
-	};
+	}, onPreparedClosed, controls);
+	if (prepared.value.emitPaymentInitiated && "items" in prepared.value.request) for (const [index, item] of prepared.value.request.items.entries()) {
+		const paymentId = prepared.value.paymentIds[index];
+		const recipient = prepared.value.recipientObservations[index];
+		if (paymentId === void 0 || recipient === void 0) continue;
+		const paymentType = paymentTypeForDocumentEnvelope(item.document) ?? item.paymentType ?? "unspecified";
+		await emitPaymentInitiated(deps.telemetry, {
+			commandId: prepared.value.commandId,
+			executionId: prepared.value.executionId,
+			paymentId,
+			kind: paymentType === "unspecified" ? "quick_pay" : paymentType,
+			recipient
+		});
+	}
 	let signature;
 	try {
 		signature = await deps.signer.signUserOpHash(prepared.value.digest);
 	} catch (cause) {
-		return {
+		return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "signer_rejected", {
 			ok: false,
 			error: signerFailure(deps.signer.source, "signUserOpHash", cause)
-		};
+		}, onPreparedClosed, controls);
 	}
-	if (isAborted$2(signal)) return {
+	if (isAborted$2(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
-	};
-	return runIfActive(void 0, CAPXUL_OPERATIONS.payments.submitCommandExecution, () => deps.convexCall.action(deps.functions.submitPaymentCommandExecution, { input: {
+	}, onPreparedClosed, controls);
+	return runIfActive(void 0, CAPXUL_OPERATIONS.payments.submitCommandExecution, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(deps.functions.submitPaymentCommandExecution, copyInvocationObservation(controls, { input: {
 		executionId: prepared.value.executionId,
 		signature
-	} }));
+	} }))), controls), deps.runPromise);
 }
-function executePaymentLifecycle(deps, intent, signal) {
-	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.payments.prepareLifecycleExecution, () => deps.convexCall.action(deps.functions.preparePaymentLifecycleExecution, { input: {
+function executePaymentLifecycle(deps, intent, signal, controls) {
+	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.payments.prepareLifecycleExecution, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(deps.functions.preparePaymentLifecycleExecution, copyInvocationObservation(controls, { input: {
 		signerAddress,
 		intent
-	} })), matchesIntent(intent), signal);
+	} }))), controls), deps.runPromise), matchesIntent(intent), false, void 0, signal, controls);
 }
-function executeOrganizationPayment(deps, input, signal) {
-	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.organizationPayments.prepareExecution, () => deps.convexCall.action(deps.functions.prepareOrganizationPaymentExecution, { input: {
+function executeOrganizationPayment(deps, input, signal, onPreparedClosed, controls) {
+	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.organizationPayments.prepareExecution, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(deps.functions.prepareOrganizationPaymentExecution, copyInvocationObservation(controls, { input: {
 		...input,
 		signerAddress
-	} })), matchesIntent(input), signal);
+	} }))), controls), deps.runPromise), matchesIntent(input), true, onPreparedClosed, signal, controls);
 }
 //#endregion
 //#region ../../packages/sdk/src/surface/payment-execution.ts
@@ -11759,7 +12054,16 @@ async function signerCall(source, operation, run) {
 		};
 	}
 }
-async function executePersonalPayment(deps, payment, signal, requestKey) {
+async function abandonPrepared(deps, executionId, reason, result, onPreparedClosed) {
+	const abandoned = await runIfActive(void 0, CAPXUL_OPERATIONS.moneyExecution.abandonPaymentExecution, () => deps.convexCall.action(deps.functions.abandonPaymentExecution, { input: {
+		executionId,
+		reason
+	} }));
+	if (!abandoned.ok) return abandoned;
+	if (abandoned.value) onPreparedClosed?.();
+	return result;
+}
+async function executePersonalPayment(deps, payment, signal, requestKey, onPreparedClosed) {
 	if (isAborted$1(signal)) return cancelled(CAPXUL_OPERATIONS.payments.pay);
 	if (deps.signer === void 0) return mismatch("signer", "payments.pay requires a configured CapxulSigner");
 	const session = deps.actor.authSession();
@@ -11777,18 +12081,21 @@ async function executePersonalPayment(deps, payment, signal, requestKey) {
 		payment
 	} }));
 	if (!prepared.ok) return prepared;
-	if (prepared.value.requestKey !== resolvedRequestKey || canonicalJson(prepared.value.payment) !== canonicalJson(payment)) return mismatch("payment", "prepared Payment execution uses another request");
-	if (prepared.value.chainId !== deps.chainId) return mismatch("chainId", "prepared Payment execution uses another chain");
-	if (prepared.value.signerAddress.toLowerCase() !== signerAddress.value.toLowerCase()) return mismatch("signerAddress", "prepared Payment execution uses another signer");
-	if (prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return mismatch("userOpSenderSafe", "prepared Payment execution uses another Account Safe");
+	if (prepared.value.requestKey !== resolvedRequestKey || canonicalJson(prepared.value.payment) !== canonicalJson(payment)) return abandonPrepared(deps, prepared.value.executionId, "prepared_mismatch", mismatch("payment", "prepared Payment execution uses another request"), onPreparedClosed);
+	if (prepared.value.chainId !== deps.chainId) return abandonPrepared(deps, prepared.value.executionId, "prepared_mismatch", mismatch("chainId", "prepared Payment execution uses another chain"), onPreparedClosed);
+	if (prepared.value.signerAddress.toLowerCase() !== signerAddress.value.toLowerCase()) return abandonPrepared(deps, prepared.value.executionId, "prepared_mismatch", mismatch("signerAddress", "prepared Payment execution uses another signer"), onPreparedClosed);
+	if (prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return abandonPrepared(deps, prepared.value.executionId, "prepared_mismatch", mismatch("userOpSenderSafe", "prepared Payment execution uses another Account Safe"), onPreparedClosed);
 	if (prepared.value.emitPaymentInitiated) await emitPaymentInitiated(deps.telemetry, {
 		kind: prepared.value.purposeKind,
-		paymentId: prepared.value.paymentId
+		paymentId: prepared.value.paymentId,
+		commandId: prepared.value.commandId,
+		executionId: prepared.value.executionId,
+		recipient: prepared.value.recipientObservation
 	});
-	if (isAborted$1(signal)) return cancelled(CAPXUL_OPERATIONS.payments.pay);
+	if (isAborted$1(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
 	const signature = await signerCall(deps.signer.source, "signUserOpHash", () => deps.signer.signUserOpHash(prepared.value.digest));
-	if (!signature.ok) return signature;
-	if (isAborted$1(signal)) return cancelled(CAPXUL_OPERATIONS.payments.pay);
+	if (!signature.ok) return abandonPrepared(deps, prepared.value.executionId, "signer_rejected", signature, onPreparedClosed);
+	if (isAborted$1(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
 	return runIfActive(void 0, CAPXUL_OPERATIONS.payments.submitExecution, () => deps.convexCall.action(deps.functions.submitPaymentExecution, { input: {
 		executionId: prepared.value.executionId,
 		signature: signature.value
@@ -12016,6 +12323,30 @@ async function waitForPaymentSubmission(submission, signal, operation, onCancel
 		});
 	});
 }
+function normalizeActivityDetail(detail) {
+	if (detail === null) return null;
+	if (detail.kind === "payment") {
+		if (detail.evidence === null) return detail;
+		return {
+			...detail,
+			evidence: {
+				...detail.evidence,
+				inclusion: "included",
+				verification: "verified",
+				finality: "finalized"
+			}
+		};
+	}
+	return {
+		...detail,
+		evidence: {
+			...detail.evidence,
+			inclusion: "included",
+			verification: "verified",
+			canonicalState: "finalized"
+		}
+	};
+}
 function paymentExecutionIntent(input) {
 	if (actorReferenceToBackend(input.actor)?.kind === "org") return {
 		ok: false,
@@ -12028,6 +12359,7 @@ function paymentExecutionIntent(input) {
 		value: {
 			to: to.value,
 			amount: input.amount,
+			...input.externalAddressAcknowledged === void 0 ? {} : { externalAddressAcknowledged: input.externalAddressAcknowledged },
 			...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
 			...input.document === void 0 ? {} : { document: input.document },
 			...input.timing === void 0 ? {} : { timing: input.timing },
@@ -12065,6 +12397,7 @@ function makeFinancialOpsMethods(deps) {
 		let flight = inFlightPersonalPayments.get(sharedKey);
 		if (flight === void 0) {
 			const controller = new AbortController();
+			const requestState = { resolved: false };
 			const submission = executePersonalPayment({
 				actor: deps.actor,
 				chainId: deps.chainId,
@@ -12072,10 +12405,11 @@ function makeFinancialOpsMethods(deps) {
 				functions: executionFns,
 				...deps.signer === void 0 ? {} : { signer: deps.signer },
 				...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
-			}, payment.value, controller.signal, requestKey.key);
+			}, payment.value, controller.signal, requestKey.key, () => requestState.resolved = true);
 			flight = {
 				controller,
 				promise: submission,
+				requestState,
 				waiters: 0,
 				settled: false
 			};
@@ -12113,7 +12447,7 @@ function makeFinancialOpsMethods(deps) {
 		}
 		release(false);
 		try {
-			await requestKey.finish(submitted.ok);
+			await requestKey.finish(submitted.ok || flight.requestState.resolved);
 		} catch {}
 		return mapOk(submitted, (value) => normalizePaymentTiming(value.payment));
 	};
@@ -12127,87 +12461,61 @@ function makeFinancialOpsMethods(deps) {
 			chainId: deps.chainId,
 			convexCall: deps.convexCall,
 			functions: executionFns,
-			signer: deps.signer
-		}
-	};
-	const runLifecycle = async (intent, signal) => {
-		const execution = lifecycleDependencies();
-		if (!execution.ok) return execution;
-		try {
-			const submitted = await executePaymentLifecycle(execution.value, intent, signal);
-			if (!submitted.ok) return submitted;
-			const payments = submitted.value.payments;
-			const payment = payments[0];
-			if (payment === void 0 || payments.length !== 1) return {
-				ok: false,
-				error: Errors.unknown()
-			};
-			return {
-				ok: true,
-				value: normalizePaymentTiming(payment)
-			};
-		} catch (cause) {
-			return {
-				ok: false,
-				error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
-			};
+			signer: deps.signer,
+			...deps.runPromise === void 0 ? {} : { runPromise: deps.runPromise }
 		}
 	};
+	const runLifecycle = (intent, controls, operation) => runCapxulEffect(Effect.gen(function* () {
+		const captured = carryInvocationParentSpan(controls, yield* Effect.currentSpan.pipe(Effect.orDie));
+		const result = yield* Effect.tryPromise({
+			try: async () => {
+				const execution = lifecycleDependencies();
+				if (!execution.ok) return execution;
+				const submitted = await executePaymentLifecycle(execution.value, intent, controls?.signal, captured);
+				if (!submitted.ok) return submitted;
+				const payments = submitted.value.payments;
+				const payment = payments[0];
+				if (payment === void 0 || payments.length !== 1) return {
+					ok: false,
+					error: Errors.unknown()
+				};
+				return {
+					ok: true,
+					value: normalizePaymentTiming(payment)
+				};
+			},
+			catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
+		});
+		return yield* result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
+	}), observationOnlyControls(controls), operation, deps.runPromise);
+	const retryPayment = (paymentId, controls) => runCapxulEffect(Effect.gen(function* () {
+		const captured = carryInvocationParentSpan(controls, yield* Effect.currentSpan.pipe(Effect.orDie));
+		const result = yield* Effect.tryPromise({
+			try: async () => {
+				const execution = lifecycleDependencies();
+				if (!execution.ok) return execution;
+				const submitted = await executePaymentLifecycle(execution.value, {
+					kind: "retry",
+					paymentId
+				}, controls?.signal, captured);
+				return submitted.ok ? {
+					ok: true,
+					value: submitted.value.payments.map((payment) => normalizePaymentTiming(payment))
+				} : submitted;
+			},
+			catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
+		});
+		return yield* result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
+	}), observationOnlyControls(controls), CAPXUL_OPERATIONS.payments.retry, deps.runPromise);
 	return {
 		me: {
 			get: (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.me.get, () => deps.convexCall.query(fns.me, {})),
 			depositInstructions: (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.me.depositInstructions, () => deps.convexCall.query(fns.depositInstructions, {}).pipe(Effect.tap(() => Effect.promise(() => emitDepositInitiated(deps.telemetry)))))
 		},
-		handles: { resolve: (handle, options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.handles.resolve, () => deps.convexCall.query(fns.resolveHandle, { handle })) },
-		payees: {
-			create: (input, options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.payees.create, () => deps.convexCall.mutation(fns.createPayee, {
-				label: input.label,
-				recipient: input.recipient,
-				...input.handle === void 0 ? {} : { handle: input.handle }
-			})),
-			get: (payeeId, options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.payees.get, () => deps.convexCall.query(fns.getPayee, { payeeId })),
-			resolve: (recipient, options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.payees.resolve, () => deps.convexCall.query(fns.resolvePayee, { recipient }))
-		},
 		targets: { resolve: async (reference, options) => {
-			switch (reference.kind) {
-				case "handle": return mapOk(await runIfActive(options?.signal, CAPXUL_OPERATIONS.targets.resolve.handle, () => deps.convexCall.query(fns.resolveHandle, { handle: reference.handle })), (target) => resolvedTargetFromResolution(reference, target));
-				case "email": return mapOk(await runIfActive(options?.signal, CAPXUL_OPERATIONS.targets.resolve.email, () => deps.convexCall.query(fns.resolvePayee, { recipient: reference.email })), (target) => resolvedTargetFromResolution(reference, target));
-				case "organization": {
-					const resolved = await runIfActive(options?.signal, CAPXUL_OPERATIONS.targets.resolve.organization, () => deps.convexCall.query(fns.resolveHandle, { handle: reference.handle }));
-					if (!resolved.ok) return {
-						ok: false,
-						error: resolved.error
-					};
-					if (resolved.value.kind !== "org") return {
-						ok: false,
-						error: Errors.invalidInput("reference", "organization handle could not be resolved")
-					};
-					return {
-						ok: true,
-						value: resolvedTargetFromResolution(reference, resolved.value)
-					};
-				}
-				case "payee": {
-					const payee = await runIfActive(options?.signal, CAPXUL_OPERATIONS.targets.resolve.payee, () => deps.convexCall.query(fns.getPayee, { payeeId: reference.id }));
-					if (!payee.ok) return {
-						ok: false,
-						error: payee.error
-					};
-					if (payee.value === null) return {
-						ok: false,
-						error: Errors.invalidInput("reference", "payee not found")
-					};
-					return {
-						ok: true,
-						value: resolvedTargetFromPayee(reference, payee.value)
-					};
-				}
-				case "party":
-				case "destination": return Promise.resolve({
-					ok: false,
-					error: Errors.notImplemented("targets", `resolve.${reference.kind}`)
-				});
-			}
+			const recipient = normalizeTargetForBackend(reference, "reference");
+			if (!recipient.ok) return recipient;
+			return mapOk(await runIfActive(options?.signal, CAPXUL_OPERATIONS.recipient.resolve, () => deps.convexCall.query(fns.resolveRecipient, { recipient: recipient.value })), resolvedTargetFromResolution);
 		} },
 		destinations: {
 			add: async (input, options) => {
@@ -12250,57 +12558,64 @@ function makeFinancialOpsMethods(deps) {
 		},
 		payments: {
 			pay,
+			retry: (paymentId, options) => retryPayment(paymentId, deps.invocationControls?.(options) ?? options),
 			createCommitment: (input, options) => pay(input, options),
 			claim: (paymentId, options) => runLifecycle({
 				kind: "claim",
 				paymentId
-			}, options?.signal),
+			}, deps.invocationControls?.(options) ?? options, CAPXUL_OPERATIONS.payments.claim),
 			list: async (options) => mapOk(await runIfActive(options?.signal, CAPXUL_OPERATIONS.payments.list, () => deps.convexCall.query(fns.listPayments, {})), (payments) => payments.map(normalizePaymentTiming)),
 			get: async (paymentId, options) => mapOk(await runIfActive(options?.signal, CAPXUL_OPERATIONS.payments.get, () => deps.convexCall.query(fns.getPayment, { paymentId })), (payment) => payment === null ? null : normalizePaymentTiming(payment)),
 			cancel: (paymentId, options) => runLifecycle({
 				kind: "cancel",
 				paymentId
-			}, options?.signal),
+			}, deps.invocationControls?.(options) ?? options, CAPXUL_OPERATIONS.payments.cancel),
 			redirect: async (input, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
 				const recipient = normalizeTargetForBackend(input.to, "to");
-				if (!recipient.ok) return recipient;
+				if (!recipient.ok) return runCapxulEffect(Effect.fail(recipient.error), observationOnlyControls(controls), CAPXUL_OPERATIONS.payments.redirect, deps.runPromise);
 				return runLifecycle({
 					kind: "redirect",
 					paymentId: input.paymentId,
 					recipient: recipient.value
-				}, options?.signal);
+				}, controls, CAPXUL_OPERATIONS.payments.redirect);
 			}
 		},
 		activity: {
-			list: (params, options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.activity.list, () => deps.convexCall.query(fns.activityList, { input: {
-				...activityActorField(params?.actor),
-				...params?.cursor === void 0 ? {} : { cursor: params.cursor },
-				...params?.limit === void 0 ? {} : { limit: params.limit },
-				...params?.range === void 0 ? {} : { range: params.range },
-				...params?.filter === void 0 ? {} : { filter: params.filter }
-			} })),
-			summary: (params, options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.activity.summary, () => deps.convexCall.query(fns.activitySummary, { input: {
-				...activityActorField(params?.actor),
-				...params?.window === void 0 ? {} : { window: params.window }
-			} })),
+			list: (params, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(Effect.suspend(() => deps.convexCall.query(fns.activityList, copyInvocationObservation(controls, { input: {
+					...activityActorField(params?.actor),
+					...params?.cursor === void 0 ? {} : { cursor: params.cursor },
+					...params?.limit === void 0 ? {} : { limit: params.limit },
+					...params?.range === void 0 ? {} : { range: params.range },
+					...params?.filter === void 0 ? {} : { filter: params.filter }
+				} }))), controls, CAPXUL_OPERATIONS.activity.list, deps.runPromise);
+			},
+			summary: (params, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(Effect.suspend(() => deps.convexCall.query(fns.activitySummary, copyInvocationObservation(controls, { input: {
+					...activityActorField(params?.actor),
+					...params?.window === void 0 ? {} : { window: params.window }
+				} }))), controls, CAPXUL_OPERATIONS.activity.summary, deps.runPromise);
+			},
 			get: (reference, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
 				const actor = actorReferenceToBackend(options?.actor);
-				return runIfActive(options?.signal, CAPXUL_OPERATIONS.activity.get, () => deps.convexCall.query(fns.activityGet, {
+				return runPortEffect(Effect.suspend(() => deps.convexCall.query(fns.activityGet, copyInvocationObservation(controls, {
 					input: {
 						kind: reference.kind,
 						id: reference.id,
 						...reference.kind === "payment" ? activityActorField(reference.actor) : {}
 					},
 					...actor === void 0 ? {} : { actor }
-				}));
+				}))).pipe(Effect.map(normalizeActivityDetail)), controls, CAPXUL_OPERATIONS.activity.get, deps.runPromise);
 			},
 			annotate: (input, options) => {
-				if (input.actor !== void 0 && input.reference.kind === "payment" && input.reference.actor !== void 0 && !sameActor(input.actor, input.reference.actor)) return Promise.resolve({
-					ok: false,
-					error: Errors.invalidInput("reference.actor", "must match the annotation actor")
-				});
+				const controls = deps.invocationControls?.(options) ?? options;
+				if (input.actor !== void 0 && input.reference.kind === "payment" && input.reference.actor !== void 0 && !sameActor(input.actor, input.reference.actor)) return runCapxulEffect(Effect.fail(Errors.invalidInput("reference.actor", "must match the annotation actor")), controls, CAPXUL_OPERATIONS.activity.annotate, deps.runPromise);
 				const referenceActor = input.reference.kind === "payment" ? activityActorField(input.reference.actor).actor : void 0;
-				return runIfActive(options?.signal, CAPXUL_OPERATIONS.activity.annotate, () => deps.convexCall.mutation(fns.activityAnnotate, { input: {
+				return runPortEffect(Effect.suspend(() => deps.convexCall.mutation(fns.activityAnnotate, copyInvocationObservation(controls, { input: {
 					...activityActorField(input.actor),
 					reference: input.reference.kind === "payment" && referenceActor !== void 0 ? {
 						kind: "payment",
@@ -12313,7 +12628,7 @@ function makeFinancialOpsMethods(deps) {
 					...input.counterpartyLabel === void 0 ? {} : { counterpartyLabel: input.counterpartyLabel },
 					...input.accountingCategory === void 0 ? {} : { accountingCategory: input.accountingCategory },
 					...input.memo === void 0 ? {} : { memo: input.memo }
-				} }));
+				} }))), controls, CAPXUL_OPERATIONS.activity.annotate, deps.runPromise);
 			}
 		},
 		offramp: {
@@ -12339,8 +12654,14 @@ function makeFinancialOpsMethods(deps) {
 			}
 		},
 		paymentDocuments: {
-			verify: (documentHash, options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.paymentDocuments.verify, () => deps.convexCall.query(fns.verifyPaymentDocument, { documentHash })),
-			render: (documentHash, options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.paymentDocuments.render, () => deps.convexCall.query(fns.renderStoredDocument, { documentHash }))
+			verify: (documentHash, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(Effect.suspend(() => deps.convexCall.query(fns.verifyPaymentDocument, copyInvocationObservation(controls, { documentHash }))), controls, CAPXUL_OPERATIONS.paymentDocuments.verify, deps.runPromise);
+			},
+			render: (documentHash, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(Effect.suspend(() => deps.convexCall.query(fns.renderStoredDocument, copyInvocationObservation(controls, { documentHash }))), controls, CAPXUL_OPERATIONS.paymentDocuments.render, deps.runPromise);
+			}
 		}
 	};
 }
@@ -12379,18 +12700,11 @@ function refFromTargetReference(reference, field) {
 					email: reference.email
 				}
 			};
-			case "organization": return {
-				ok: true,
-				value: {
-					kind: "orgHandle",
-					orgHandle: reference.handle
-				}
-			};
-			case "payee": return {
+			case "address": return {
 				ok: true,
 				value: {
-					kind: "payeeId",
-					payeeId: reference.id
+					kind: "address",
+					address: reference.address
 				}
 			};
 			case "party": return {
@@ -12400,10 +12714,6 @@ function refFromTargetReference(reference, field) {
 					partyId: reference.partyId
 				}
 			};
-			case "destination": return {
-				ok: false,
-				error: Errors.notImplemented("targets", "reference.destination")
-			};
 			default: return {
 				ok: false,
 				error: Errors.invalidInput(field, "target must be a known TargetReference variant")
@@ -12458,39 +12768,28 @@ function targetReferenceFromBackendRef(ref) {
 			kind: "email",
 			email: ref.email
 		};
-		case "orgHandle": return {
-			kind: "organization",
-			handle: ref.orgHandle
-		};
-		case "payeeId": return {
-			kind: "payee",
-			id: ref.payeeId
+		case "address": return {
+			kind: "address",
+			address: ref.address
 		};
 		case "party": return {
 			kind: "party",
 			partyId: ref.partyId
 		};
-		case "capxulUserId": throw Errors.notImplemented("targets", "reference.capxulUserId");
 	}
 }
-function resolvedTargetFromResolution(reference, resolution) {
-	const kind = resolution.kind === "org" ? "organization" : resolution.kind === "payee" ? "payee" : "person";
+function resolvedTargetFromResolution(resolution) {
+	const kind = resolution.status === "known_party" ? resolution.partyKind === "org" ? "organization" : "person" : resolution.status === "external_address" ? "external_address" : "unresolved";
 	return {
-		reference,
+		reference: targetReferenceFromBackendRef(resolution.recipient),
 		label: resolution.label,
+		status: resolution.status,
 		kind,
-		capabilities: {
-			canPay: true,
-			canRequest: true,
-			canPayout: false
-		}
-	};
-}
-function resolvedTargetFromPayee(reference, payee) {
-	return {
-		reference,
-		label: payee.label,
-		kind: "payee",
+		safeAddress: toAddress(resolution.safeAddress),
+		isCapxulAccount: resolution.isCapxulAccount,
+		...resolution.partyId === void 0 ? {} : { partyId: toPartyId(resolution.partyId) },
+		...resolution.handle === void 0 ? {} : { handle: resolution.handle },
+		...resolution.requiresAcknowledgement === void 0 ? {} : { requiresAcknowledgement: resolution.requiresAcknowledgement },
 		capabilities: {
 			canPay: true,
 			canRequest: true,
@@ -12548,10 +12847,6 @@ function destinationFromBackend(destination) {
 	};
 }
 function normalizeDestinationRefForBackend(ref, field) {
-	if (typeof ref === "object" && ref !== null && "kind" in ref && ref.kind === "capxulUserId") return {
-		ok: false,
-		error: Errors.notImplemented("targets", "reference.capxulUserId")
-	};
 	return normalizeRefForBackend(ref, field);
 }
 function normalizeRefForBackend(ref, field) {
@@ -12579,25 +12874,11 @@ function normalizeRefForBackend(ref, field) {
 					email: nonEmptyRefValue(ref.email, "email")
 				}
 			};
-			case "orgHandle": return {
+			case "address": return {
 				ok: true,
 				value: {
-					kind: "orgHandle",
-					orgHandle: nonEmptyRefValue(ref.orgHandle, "orgHandle")
-				}
-			};
-			case "capxulUserId": return {
-				ok: true,
-				value: {
-					kind: "capxulUserId",
-					capxulUserId: nonEmptyRefValue(ref.capxulUserId, "capxulUserId")
-				}
-			};
-			case "payeeId": return {
-				ok: true,
-				value: {
-					kind: "payeeId",
-					payeeId: nonEmptyRefValue(ref.payeeId, "payeeId")
+					kind: "address",
+					address: toAddress(ref.address)
 				}
 			};
 			case "party": return {
@@ -17177,6 +17458,7 @@ function makeConnectionId() {
 //#region ../../packages/sdk/src/adapters/convex-call/ConvexCallAdapter.ts
 /** Exact floor-first allowlist; every additional handler must migrate its validator first. */
 const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
+	"payroll/actions:authorizeRun",
 	"account/actions:readBalance",
 	"holdings/actions:current",
 	"smartAccount/actions:claim",
@@ -17185,14 +17467,45 @@ const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
 	"org/actions:submitBootstrap",
 	"org/actions:resumeBootstrapSubmission",
 	"org/actions:confirmBootstrap",
-	"org/actions:readTreasury"
+	"org/actions:readTreasury",
+	"moneyExecution/actions:preparePaymentExecution",
+	"moneyExecution/actions:abandonPaymentExecution",
+	"moneyExecution/actions:submitPaymentExecution",
+	"moneyExecution/paymentCommandActions:preparePaymentLifecycleExecution",
+	"moneyExecution/paymentCommandActions:prepareOrganizationPaymentExecution",
+	"moneyExecution/paymentCommandActions:submitPaymentCommandExecution"
 ]);
 const OBSERVED_CONVEX_QUERIES = /* @__PURE__ */ new Set([
+	"movement/activity:list",
+	"movement/activity:summary",
+	"movement/activity:get",
+	"financialOps/queries:verifyPaymentDocument",
+	"financialOps/queries:renderStoredDocument",
+	"financialOps/addressBook:list",
+	"financialOps/addressBook:get",
+	"financialOps/requestsInbox:list",
+	"financialOps/requestsInbox:get",
+	"financialOps/requestsInbox:inboxList",
+	"payroll/queries:runs",
+	"payroll/queries:groups",
+	"payroll/queries:terms",
+	"financialOps/queries:resolveRecipient",
 	"identity/queries:loadByAuthUserId",
 	"smartAccount/queries:loadByAuthUserId",
 	"org/lifecycle:load"
 ]);
 const OBSERVED_CONVEX_MUTATIONS = /* @__PURE__ */ new Set([
+	"movement/activity:annotate",
+	"financialOps/addressBook:add",
+	"financialOps/addressBook:hide",
+	"financialOps/addressBook:unhide",
+	"financialOps/addressBook:label",
+	"financialOps/requestsInbox:issue",
+	"financialOps/requestsInbox:cancel",
+	"financialOps/requestsInbox:approve",
+	"financialOps/requestsInbox:decline",
+	"payroll/mutations:saveGroup",
+	"payroll/mutations:removeGroup",
 	"identity/mutations:create",
 	"identity/mutations:update",
 	"identity/mutations:completeOnboarding",
@@ -17261,7 +17574,7 @@ var ConvexCallAdapter = class {
 		const carriedContext = sanitizeObservationContext(args.observationContext);
 		let hostContext;
 		const invocationSnapshot = readInvocationObservation(args);
-		if (invocationSnapshot !== void 0) hostContext = invocationSnapshot.context;
+		if (invocationSnapshot !== void 0) hostContext = invocationSnapshot.active ? invocationSnapshot.context : void 0;
 		else {
 			const resolveContext = this.#observation?.resolveContext;
 			if (resolveContext !== void 0) try {
@@ -17431,12 +17744,13 @@ function ConvexIdentityLayer() {
 function brandProfile(raw) {
 	return {
 		authUserId: toAuthUserId(raw.authUserId),
+		...raw.testerKind === void 0 ? {} : { testerKind: toTesterKind(raw.testerKind) },
 		email: toEmail(raw.email),
 		displayName: raw.displayName,
 		country: raw.country === null ? null : toCountryCode(raw.country),
 		onboarded: raw.onboarded ?? false,
 		withdrawalAddress: raw.withdrawalAddress === null || raw.withdrawalAddress === void 0 ? null : toAddress(raw.withdrawalAddress),
-		username: raw.username ?? null,
+		handle: raw.handle === null || raw.handle === void 0 ? null : toHandle(raw.handle),
 		imageUrl: raw.imageUrl ?? null,
 		kycTier: toKycTier(raw.kycTier),
 		createdAt: toEpochMs(raw.createdAt),
@@ -17712,8 +18026,9 @@ var OrgPortTag = class extends Context.Service()("@capxul/sdk/ports/OrgPort") {}
 function brandOrgView(wire, treasury, viewerRole) {
 	return {
 		id: toOrgId(wire.orgId),
+		...wire.creationSource === void 0 ? {} : { creationSource: toTesterKind(wire.creationSource) },
 		name: wire.name,
-		handle: wire.slug,
+		handle: wire.handle,
 		safeAddress: toAddress(wire.safeAddress.toLowerCase()),
 		role: viewerRole,
 		treasury,
@@ -42467,7 +42782,7 @@ function makeSmartAccountMethods(deps) {
 }
 //#endregion
 //#region ../../packages/sdk/src/contract/identity.ts
-const usernameAvailableQuery = makeFunctionReference(CAPXUL_FUNCTIONS["identity/queries"].usernameAvailable);
+const handleAvailableQuery = makeFunctionReference(CAPXUL_FUNCTIONS["identity/queries"].handleAvailable);
 //#endregion
 //#region ../../packages/sdk/src/surface/identity-deps.ts
 /** The single Context tag the profile atom + `identity.loadCurrent` resolve. */
@@ -42511,19 +42826,19 @@ function makeIdentityMethods(deps) {
 				ok: false,
 				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.identity.completeProfile })
 			};
-			if (typeof profile !== "object" || profile === null || typeof profile.displayName !== "string" || typeof profile.country !== "string" || typeof profile.username !== "string") return {
+			if (typeof profile !== "object" || profile === null || typeof profile.displayName !== "string" || typeof profile.country !== "string" || typeof profile.handle !== "string") return {
 				ok: false,
 				error: Errors.invalidInput("profile", "invalid profile")
 			};
 			const displayName = profile.displayName.trim();
-			const username = profile.username.trim();
+			const handle = profile.handle.trim();
 			if (displayName.length === 0) return {
 				ok: false,
 				error: Errors.invalidInput("displayName", "must not be empty")
 			};
-			if (username.length === 0) return {
+			if (handle.length === 0) return {
 				ok: false,
-				error: Errors.invalidInput("username", "must not be empty")
+				error: Errors.invalidInput("handle", "must not be empty")
 			};
 			let country;
 			try {
@@ -42544,98 +42859,259 @@ function makeIdentityMethods(deps) {
 				email: session.email,
 				displayName,
 				country,
-				username
+				handle
 			}), options, CAPXUL_OPERATIONS.identity.completeProfile);
 		},
-		async usernameAvailable(username, options) {
+		async handleAvailable(handle, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.identity.usernameAvailable })
+				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.identity.handleAvailable })
 			};
 			if (convexCall === void 0) return {
 				ok: false,
-				error: Errors.notImplemented("identity", "usernameAvailable")
+				error: Errors.notImplemented("identity", "handleAvailable")
 			};
-			return runPortEffect(convexCall.query(usernameAvailableQuery, { username }));
+			return runPortEffect(convexCall.query(handleAvailableQuery, { handle }));
 		}
 	};
 }
 //#endregion
 //#region ../../packages/sdk/src/surface/onboarding.ts
-const USERNAME_PATTERN = /^[a-z0-9_]{3,30}$/;
-function makeOnboardingMethods(deps) {
-	return { async completePerson(input, options) {
-		const isCancelled = () => options?.signal?.aborted === true;
-		if (typeof input !== "object" || input === null || typeof input.displayName !== "string" || typeof input.country !== "string" || typeof input.username !== "string" || !USERNAME_PATTERN.test(input.username.trim())) return {
-			ok: false,
-			error: Errors.invalidInput("username", "must be 3-30 characters of a-z, 0-9, or underscore")
+function normalizeHandleInput(input) {
+	if (typeof input !== "string") return {
+		ok: false,
+		error: Errors.invalidInput("handle", "is required")
+	};
+	try {
+		return {
+			ok: true,
+			value: validateHandle(input)
 		};
-		const username = input.username.trim();
-		const session = await deps.restoreSession(options);
-		if (!session.ok) return session;
-		if (session.value === null) return {
+	} catch (error) {
+		if (isCapxulError(error)) return {
 			ok: false,
-			error: Errors.notAuthenticated()
+			error
 		};
-		const available = await deps.usernameAvailable(username, options);
-		if (!available.ok) return available;
-		if (!available.value.available) return {
+		return {
 			ok: false,
-			error: Errors.invalidInput("username", "username is already taken")
+			error: Errors.unknown(error)
 		};
-		const completed = await deps.completeProfile({
-			...input,
-			username: available.value.normalized
-		}, options);
-		if (!completed.ok) return completed;
-		const refreshed = await deps.refreshIdentity(options);
-		if (!refreshed.ok) return refreshed;
-		if (isCancelled()) return {
+	}
+}
+function normalizeOrganization(input) {
+	if (typeof input !== "object" || input === null) return {
+		ok: false,
+		error: Errors.invalidInput("organization", "is required")
+	};
+	const name = typeof input.name === "string" ? input.name.trim() : "";
+	if (name.length === 0) return {
+		ok: false,
+		error: Errors.invalidInput("name", "is required")
+	};
+	const handle = normalizeHandleInput(input.handle);
+	if (!handle.ok) return handle;
+	if (input.bio !== void 0 && typeof input.bio !== "string") return {
+		ok: false,
+		error: Errors.invalidInput("bio", "must be text")
+	};
+	if (input.size !== void 0 && typeof input.size !== "string") return {
+		ok: false,
+		error: Errors.invalidInput("size", "must be text")
+	};
+	let country;
+	try {
+		country = toCountryCode(input.country);
+	} catch {
+		return {
 			ok: false,
-			error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
+			error: Errors.invalidInput("country", "must be an ISO country code")
 		};
-		const ensured = await deps.ensureAccount();
+	}
+	const bio = input.bio?.trim() ?? "";
+	const size = input.size?.trim() ?? "";
+	return {
+		ok: true,
+		value: {
+			name,
+			handle: handle.value,
+			country,
+			...bio.length === 0 ? {} : { bio },
+			...size.length === 0 ? {} : { size }
+		}
+	};
+}
+function isClaimedIdentityState(state) {
+	return state.phase === "authenticated" && state.account.at === "claimed";
+}
+function organizationWrongState(currentState, validStates) {
+	return {
+		ok: false,
+		error: Errors.wrongState({
+			method: CAPXUL_OPERATIONS.onboarding.completeOrganization,
+			currentState,
+			validStates: [...validStates]
+		})
+	};
+}
+function requestCancelled(options) {
+	return options?.signal?.aborted === true;
+}
+async function reachClaimedAccount(deps, options) {
+	let state = deps.snapshotIdentity();
+	if (state.phase !== "authenticated" || state.account.at === "unknown") {
+		const ensured = await deps.sendIdentity({ _tag: "EnsureAccount" }, options);
 		if (!ensured.ok) return ensured;
-		if (isCancelled()) return {
-			ok: false,
-			error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
-		};
-		const lifecycle = await deps.getLifecycle();
-		if (!lifecycle.ok) return lifecycle;
-		if (isCancelled()) return {
-			ok: false,
-			error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
-		};
-		if (lifecycle.value.status !== "ready") return {
-			ok: false,
-			error: Errors.wrongState({
-				method: CAPXUL_OPERATIONS.onboarding.completePerson,
-				currentState: lifecycle.value.status,
-				validStates: ["ready"]
-			})
-		};
-		const profile = await deps.loadProfile(options);
-		if (!profile.ok) return profile;
-		if (profile.value === null || profile.value.displayName === null || profile.value.username !== available.value.normalized) return {
-			ok: false,
-			error: Errors.wrongState({
-				method: CAPXUL_OPERATIONS.onboarding.completePerson,
-				currentState: "profile-incomplete",
-				validStates: ["profile-complete"]
-			})
-		};
-		return {
-			ok: true,
-			value: {
-				profile: {
-					...profile.value,
-					displayName: profile.value.displayName,
-					username: profile.value.username
-				},
-				account: lifecycle.value
-			}
-		};
-	} };
+		state = ensured.value;
+	}
+	if (state.phase !== "authenticated") return organizationWrongState(state.phase, ["authenticated:claimed"]);
+	if (state.account.at !== "claimed") {
+		const event = state.account.at === "failed" ? { _tag: "RetryAccount" } : state.account.at === "counterfactual" ? { _tag: "ClaimAccount" } : { _tag: "EnsureAccount" };
+		const claimed = await deps.sendIdentity(event, options);
+		if (!claimed.ok) return claimed;
+		state = claimed.value;
+	}
+	return isClaimedIdentityState(state) ? {
+		ok: true,
+		value: state
+	} : organizationWrongState(state.phase === "authenticated" ? state.account.at : state.phase, ["claimed"]);
+}
+async function createOrResumeOrganization(deps, state, draft, options) {
+	const active = state.account.org;
+	if (active?.at === "ready") return {
+		ok: true,
+		value: { organizationId: active.orgId }
+	};
+	if (active?.at === "failed" && !active.retryable) return {
+		ok: false,
+		error: publicIdentityFailure(active.failure)
+	};
+	if (active?.at === "failed" && active.orgId === null) {
+		const cleared = await deps.sendIdentity({ _tag: "LeaveOrganization" }, options);
+		if (!cleared.ok) return cleared;
+	}
+	const event = active?.at === "failed" && active.orgId !== null ? { _tag: "RetryOrganization" } : {
+		_tag: "CreateOrganization",
+		draft
+	};
+	const created = await deps.sendIdentity(event, options);
+	if (!created.ok) return created;
+	const final = created.value;
+	const organization = isClaimedIdentityState(final) ? final.account.org : null;
+	return organization?.at === "ready" ? {
+		ok: true,
+		value: { organizationId: organization.orgId }
+	} : organizationWrongState(organization?.at ?? "organization-missing", ["ready"]);
+}
+function makeOnboardingMethods(deps) {
+	return {
+		async completePerson(input, options) {
+			const isCancelled = () => options?.signal?.aborted === true;
+			if (typeof input !== "object" || input === null || typeof input.displayName !== "string" || typeof input.country !== "string") return {
+				ok: false,
+				error: Errors.invalidInput("profile", "displayName and country are required")
+			};
+			const handle = normalizeHandleInput(input.handle);
+			if (!handle.ok) return handle;
+			const session = await deps.restoreSession(options);
+			if (!session.ok) return session;
+			if (session.value === null) return {
+				ok: false,
+				error: Errors.notAuthenticated()
+			};
+			const available = await deps.handleAvailable(handle.value, options);
+			if (!available.ok) return available;
+			if (!available.value.available) return {
+				ok: false,
+				error: Errors.invalidInput("handle", "handle is already taken")
+			};
+			const completed = await deps.completeProfile({
+				...input,
+				handle: available.value.normalized
+			}, options);
+			if (!completed.ok) return completed;
+			const refreshed = await deps.refreshIdentity(options);
+			if (!refreshed.ok) return refreshed;
+			if (isCancelled()) return {
+				ok: false,
+				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
+			};
+			const ensured = await deps.ensureAccount();
+			if (!ensured.ok) return ensured;
+			if (isCancelled()) return {
+				ok: false,
+				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
+			};
+			const lifecycle = await deps.getLifecycle();
+			if (!lifecycle.ok) return lifecycle;
+			if (isCancelled()) return {
+				ok: false,
+				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
+			};
+			if (lifecycle.value.status !== "ready") return {
+				ok: false,
+				error: Errors.wrongState({
+					method: CAPXUL_OPERATIONS.onboarding.completePerson,
+					currentState: lifecycle.value.status,
+					validStates: ["ready"]
+				})
+			};
+			const profile = await deps.loadProfile(options);
+			if (!profile.ok) return profile;
+			if (profile.value === null || profile.value.displayName === null || profile.value.handle !== available.value.normalized) return {
+				ok: false,
+				error: Errors.wrongState({
+					method: CAPXUL_OPERATIONS.onboarding.completePerson,
+					currentState: "profile-incomplete",
+					validStates: ["profile-complete"]
+				})
+			};
+			return {
+				ok: true,
+				value: {
+					profile: {
+						...profile.value,
+						displayName: profile.value.displayName,
+						handle: profile.value.handle
+					},
+					account: lifecycle.value
+				}
+			};
+		},
+		async completeOrganization(input, options) {
+			const operation = CAPXUL_OPERATIONS.onboarding.completeOrganization;
+			const normalized = normalizeOrganization(input);
+			if (!normalized.ok) return normalized;
+			const session = await deps.restoreSession(options);
+			if (!session.ok) return session;
+			if (session.value === null) return {
+				ok: false,
+				error: Errors.notAuthenticated()
+			};
+			const profile = await deps.loadProfile(options);
+			if (!profile.ok) return profile;
+			if (profile.value === null || profile.value.displayName === null || profile.value.handle === null) return {
+				ok: false,
+				error: Errors.wrongState({
+					method: operation,
+					currentState: "profile-incomplete",
+					validStates: ["profile-complete"]
+				})
+			};
+			const refreshed = await deps.refreshIdentity(options);
+			if (!refreshed.ok) return refreshed;
+			if (requestCancelled(options)) return {
+				ok: false,
+				error: Errors.cancelled({ operation })
+			};
+			const claimed = await reachClaimedAccount(deps, options);
+			if (!claimed.ok) return claimed;
+			if (requestCancelled(options)) return {
+				ok: false,
+				error: Errors.cancelled({ operation })
+			};
+			return createOrResumeOrganization(deps, claimed.value, normalized.value, options);
+		}
+	};
 }
 //#endregion
 //#region ../../packages/sdk/src/surface/accounts-deps.ts
@@ -42938,13 +43414,15 @@ function executionDependencies$1(input) {
 		chainId: input.chainId,
 		convexCall: input.convexCall,
 		functions: moneyExecutionContract,
-		signer: input.signer
+		signer: input.signer,
+		...input.runPromise === void 0 ? {} : { runPromise: input.runPromise },
+		...input.telemetry === void 0 ? {} : { telemetry: input.telemetry }
 	};
 }
 function makeOrganizationPaymentsMethods(deps, orgId) {
 	const requestKeyScope = deps.requestKeyScope ?? `client-${crypto.randomUUID()}`;
 	const inFlightOrganizationPayments = /* @__PURE__ */ new Map();
-	const execute = async (input, signal, operation = "organization-pay-batch") => {
+	const execute = async (input, signal, operation = "organization-pay-batch", controls) => {
 		if (signal?.aborted === true) return {
 			ok: false,
 			error: Errors.cancelled({ operation })
@@ -42970,16 +43448,18 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 		let flight = inFlightOrganizationPayments.get(flightKey);
 		if (flight === void 0) {
 			const controller = new AbortController();
+			const requestState = { resolved: false };
 			const submission = executeOrganizationPayment(execution, {
 				orgId,
 				permissionId: input.permissionId,
 				requestKey: requestKey.key,
 				items: input.items,
 				...input.lineage === void 0 ? {} : { lineage: input.lineage }
-			}, controller.signal);
+			}, controller.signal, () => requestState.resolved = true, controls);
 			flight = {
 				controller,
 				promise: submission,
+				requestState,
 				waiters: 0,
 				settled: false
 			};
@@ -43017,30 +43497,80 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 		}
 		release(false);
 		try {
-			await requestKey.finish(result.ok);
+			await requestKey.finish(result.ok || flight.requestState.resolved);
 		} catch {}
-		return mapOk(result, (value) => value.payments.map((payment) => normalizePaymentTiming(payment)));
+		const normalized = mapOk(result, (value) => value.payments.map((payment) => normalizePaymentTiming(payment)));
+		if (!normalized.ok) return normalized;
+		return normalized;
 	};
 	return {
-		pay: async (input, options) => {
-			const { permissionId, requestKey: providedRequestKey, lineage, ...item } = input;
-			const result = await execute({
-				permissionId,
-				...providedRequestKey === void 0 ? {} : { requestKey: providedRequestKey },
-				items: [item],
-				...lineage === void 0 ? {} : { lineage }
-			}, options?.signal, "organization-pay");
-			if (!result.ok) return result;
-			const payment = result.value[0];
-			return payment === void 0 ? {
-				ok: false,
-				error: Errors.unknown()
-			} : {
-				ok: true,
-				value: payment
-			};
+		retry: (paymentId, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runCapxulEffect(Effect.gen(function* () {
+				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+				const captured = carryInvocationParentSpan(controls, parent);
+				const completed = yield* Effect.tryPromise({
+					try: async () => {
+						const execution = executionDependencies$1(deps);
+						if (execution === null) return {
+							ok: false,
+							error: Errors.notImplemented("organizationPayments", "executionComposition")
+						};
+						const result = await executePaymentLifecycle(execution, {
+							kind: "retry",
+							paymentId
+						}, controls?.signal, captured);
+						if (!result.ok) return result;
+						return {
+							ok: true,
+							value: result.value.payments.map((payment) => normalizePaymentTiming(payment))
+						};
+					},
+					catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
+				});
+				return yield* completed.ok ? Effect.succeed(completed.value) : Effect.fail(completed.error);
+			}), observationOnlyControls(controls), CAPXUL_OPERATIONS.organizationPayments.retry, deps.runPromise);
 		},
-		payBatch: (input, options) => execute(input, options?.signal)
+		pay: (input, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runCapxulEffect(Effect.gen(function* () {
+				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+				const captured = carryInvocationParentSpan(controls, parent);
+				const completed = yield* Effect.tryPromise({
+					try: async () => {
+						const { permissionId, requestKey: providedRequestKey, lineage, ...item } = input;
+						const result = await execute({
+							permissionId,
+							...providedRequestKey === void 0 ? {} : { requestKey: providedRequestKey },
+							items: [item],
+							...lineage === void 0 ? {} : { lineage }
+						}, controls?.signal, "organization-pay", captured);
+						if (!result.ok) return result;
+						const payment = result.value[0];
+						return payment === void 0 ? {
+							ok: false,
+							error: Errors.unknown()
+						} : {
+							ok: true,
+							value: payment
+						};
+					},
+					catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
+				});
+				return yield* completed.ok ? Effect.succeed(completed.value) : Effect.fail(completed.error);
+			}), observationOnlyControls(controls), CAPXUL_OPERATIONS.organizationPayments.pay, deps.runPromise);
+		},
+		payBatch: (input, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runCapxulEffect(Effect.gen(function* () {
+				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+				const completed = yield* Effect.tryPromise({
+					try: () => execute(input, controls?.signal, void 0, carryInvocationParentSpan(controls, parent)),
+					catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
+				});
+				return yield* completed.ok ? Effect.succeed(completed.value) : Effect.fail(completed.error);
+			}), observationOnlyControls(controls), CAPXUL_OPERATIONS.organizationPayments.payBatch, deps.runPromise);
+		}
 	};
 }
 //#endregion
@@ -43137,12 +43667,14 @@ function executionDependencies(deps) {
 		chainId: deps.chainId,
 		convexCall: deps.convexCall,
 		functions: moneyExecutionContract,
+		...deps.runPromise === void 0 ? {} : { runPromise: deps.runPromise },
 		signer: deps.signer
 	};
 }
 function makePayrollMethods(deps, orgId) {
 	const requestKeyScope = deps.requestKeyScope ?? `client-${crypto.randomUUID()}`;
-	async function authorize(input, signal) {
+	async function authorize(input, controls) {
+		const signal = controls?.signal;
 		const execution = executionDependencies(deps);
 		if (execution === null) return {
 			ok: false,
@@ -43153,15 +43685,16 @@ function makePayrollMethods(deps, orgId) {
 			input
 		}, input.requestKey);
 		let authorized;
+		let preparedClosed = false;
 		const submitted = await executePrepared(execution, async (signerAddress) => {
-			const prepared = await runIfActive(signal, AUTHORIZE_RUN, () => deps.convexCall.action(payrollContract.authorizeRun, { input: {
+			const prepared = await runIfActive(signal, AUTHORIZE_RUN, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(payrollContract.authorizeRun, copyInvocationObservation(controls, { input: {
 				orgId,
 				permissionId: input.permissionId,
 				requestKey: requestKey.key,
 				signerAddress,
 				period: input.period,
 				items: input.items
-			} }));
+			} }))), controls), deps.runPromise);
 			if (!prepared.ok) return prepared;
 			authorized = prepared.value.run;
 			return {
@@ -43174,9 +43707,9 @@ function makePayrollMethods(deps, orgId) {
 			requestKey: requestKey.key,
 			runId: authorized.id,
 			items: input.items
-		})(request), signal);
+		})(request), true, () => preparedClosed = true, signal, controls);
 		try {
-			await requestKey.finish(submitted.ok);
+			await requestKey.finish(submitted.ok || preparedClosed);
 		} catch {}
 		if (!submitted.ok) return submitted;
 		return authorized === void 0 ? {
@@ -43188,35 +43721,48 @@ function makePayrollMethods(deps, orgId) {
 		};
 	}
 	return {
-		runs: (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.payroll.runs, () => Effect.map(deps.convexCall.query(payrollContract.runs, { orgId }), toPayrollRuns)),
-		authorizeRun: async (input, options) => {
-			if (options?.signal?.aborted === true) return {
-				ok: false,
-				error: Errors.cancelled({ operation: AUTHORIZE_RUN })
-			};
-			try {
-				return await authorize(input, options?.signal);
-			} catch (cause) {
-				return {
-					ok: false,
-					error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
-				};
-			}
+		runs: (options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runPortEffect(Effect.suspend(() => deps.convexCall.query(payrollContract.runs, copyInvocationObservation(controls, { orgId }))).pipe(Effect.map(toPayrollRuns)), controls, CAPXUL_OPERATIONS.payroll.runs, deps.runPromise);
+		},
+		authorizeRun: (input, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runCapxulEffect(Effect.gen(function* () {
+				if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation: AUTHORIZE_RUN }));
+				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+				const result = yield* Effect.tryPromise({
+					try: () => authorize(input, carryInvocationParentSpan(controls, parent)),
+					catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
+				});
+				return yield* result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
+			}), observationOnlyControls(controls), AUTHORIZE_RUN, deps.runPromise);
+		},
+		terms: (options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runPortEffect(Effect.suspend(() => deps.convexCall.query(payrollContract.terms, copyInvocationObservation(controls, { orgId }))), controls, CAPXUL_OPERATIONS.payroll.terms, deps.runPromise);
 		},
-		terms: (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.payroll.terms, () => deps.convexCall.query(payrollContract.terms, { orgId })),
 		groups: {
-			list: (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.payroll.groups.list, () => Effect.map(deps.convexCall.query(payrollContract.groups, { orgId }), (groups) => groups.map(toPayrollGroup))),
-			save: (input, options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.payroll.groups.save, () => Effect.map(deps.convexCall.mutation(payrollContract.saveGroup, {
-				orgId,
-				...input.id === void 0 ? {} : { id: String(input.id) },
-				name: input.name,
-				tone: input.tone,
-				members: input.members
-			}), toPayrollGroup)),
-			remove: (id, options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.payroll.groups.remove, () => Effect.map(deps.convexCall.mutation(payrollContract.removeGroup, {
-				orgId,
-				id
-			}), () => void 0))
+			list: (options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(Effect.suspend(() => deps.convexCall.query(payrollContract.groups, copyInvocationObservation(controls, { orgId }))).pipe(Effect.map((groups) => groups.map(toPayrollGroup))), controls, CAPXUL_OPERATIONS.payroll.groups.list, deps.runPromise);
+			},
+			save: (input, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(Effect.suspend(() => deps.convexCall.mutation(payrollContract.saveGroup, copyInvocationObservation(controls, {
+					orgId,
+					...input.id === void 0 ? {} : { id: String(input.id) },
+					name: input.name,
+					tone: input.tone,
+					members: input.members
+				}))).pipe(Effect.map(toPayrollGroup)), controls, CAPXUL_OPERATIONS.payroll.groups.save, deps.runPromise);
+			},
+			remove: (id, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(Effect.suspend(() => deps.convexCall.mutation(payrollContract.removeGroup, copyInvocationObservation(controls, {
+					orgId,
+					id
+				}))).pipe(Effect.asVoid), controls, CAPXUL_OPERATIONS.payroll.groups.remove, deps.runPromise);
+			}
 		}
 	};
 }
@@ -43665,6 +44211,8 @@ function makeOrgMethods(deps) {
 			const convexCall = deps.convexCall;
 			return {
 				...makeActorRelationshipMethods({
+					...deps.runPromise === void 0 ? {} : { runPromise: deps.runPromise },
+					...deps.invocationControls === void 0 ? {} : { invocationControls: deps.invocationControls },
 					actor: {
 						kind: "org",
 						orgId: String(orgId)
@@ -43794,13 +44342,18 @@ function makeOrgMethods(deps) {
 				}, String(orgId)),
 				payments: convexCall === void 0 ? makeNotImplementedOrganizationPaymentsMethods() : makeOrganizationPaymentsMethods({
 					convexCall,
+					...deps.runPromise === void 0 ? {} : { runPromise: deps.runPromise },
+					...deps.invocationControls === void 0 ? {} : { invocationControls: deps.invocationControls },
 					...deps.requestKeyScope === void 0 ? {} : { requestKeyScope: deps.requestKeyScope },
 					...deps.actor === void 0 ? {} : { actor: deps.actor },
 					...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
-					...deps.signer === void 0 ? {} : { signer: deps.signer }
+					...deps.signer === void 0 ? {} : { signer: deps.signer },
+					...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
 				}, String(orgId)),
 				payroll: convexCall === void 0 ? makeUnavailablePayrollMethods() : makePayrollMethods({
 					convexCall,
+					...deps.runPromise === void 0 ? {} : { runPromise: deps.runPromise },
+					...deps.invocationControls === void 0 ? {} : { invocationControls: deps.invocationControls },
 					...deps.requestKeyScope === void 0 ? {} : { requestKeyScope: deps.requestKeyScope },
 					...deps.actor === void 0 ? {} : { actor: deps.actor },
 					...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
@@ -43824,7 +44377,8 @@ function makeNotImplementedPermissionMethods() {
 function makeNotImplementedOrganizationPaymentsMethods() {
 	return {
 		pay: organizationPaymentExecutionUnavailable,
-		payBatch: organizationPaymentExecutionUnavailable
+		payBatch: organizationPaymentExecutionUnavailable,
+		retry: organizationPaymentExecutionUnavailable
 	};
 }
 const orgMeUnavailable = () => Promise.resolve({
@@ -44209,6 +44763,8 @@ function assembleCapxulClient(input) {
 	let detectPendingOrgInvitations;
 	let kickProvisioning;
 	const financialOps = makeFinancialOpsMethods({
+		runPromise: effectRunner.runPromise,
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId),
 		actor,
 		chainId: input.bootstrap.chainId,
 		convexCall: input.ports.convexCall,
@@ -44228,7 +44784,7 @@ function assembleCapxulClient(input) {
 		profileMethods: financialOps.me,
 		convexCall: input.ports.convexCall,
 		runPromise: effectRunner.runPromise,
-		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls),
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId),
 		...input.signer === void 0 ? {} : { signer: input.signer }
 	});
 	kickProvisioning = accountBundle.kickProvisioning;
@@ -44267,11 +44823,13 @@ function assembleCapxulClient(input) {
 	const onboarding = makeOnboardingMethods({
 		restoreSession: auth.getSession,
 		refreshIdentity: (options) => runCapxulEffect(askIdentity(actor, { _tag: "ReadSession" }, options).pipe(Effect.asVoid), options, CAPXUL_OPERATIONS.identity.readSession, effectRunner.runPromise),
-		usernameAvailable: identity.usernameAvailable,
+		handleAvailable: identity.handleAvailable,
 		completeProfile: identity.completeProfile,
 		loadProfile: identity.loadCurrent,
 		ensureAccount: account._internal.ensureReady,
-		getLifecycle: account.getLifecycle
+		getLifecycle: account.getLifecycle,
+		snapshotIdentity: actor.snapshot,
+		sendIdentity: (event, options) => runCapxulEffect(askIdentity(actor, event, options), options, CAPXUL_OPERATIONS._internal.identity.send, effectRunner.runPromise)
 	});
 	const system = makeSystemMethods({ convexCall: input.ports.convexCall });
 	const media = makeMediaMethods({ convexCall: input.ports.convexCall });
@@ -44279,21 +44837,21 @@ function assembleCapxulClient(input) {
 		convexCall: input.ports.convexCall,
 		telemetry: input.ports.telemetry,
 		runPromise: effectRunner.runPromise,
-		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls)
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId)
 	});
 	const accounts = makeAccountsMethods({
 		accountReadPort: input.ports.accountRead,
 		chainId: input.bootstrap.chainId,
 		telemetry: input.ports.telemetry,
 		runPromise: effectRunner.runPromise,
-		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls)
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId)
 	});
 	const orgMethods = makeOrgMethods({
 		actor,
 		chainId: input.bootstrap.chainId,
 		telemetry: input.ports.telemetry,
 		runPromise: effectRunner.runPromise,
-		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls),
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId),
 		requestKeyScope: `${input.bootstrap.convexUrl}:${String(input.bootstrap.chainId)}`,
 		...selectedOrgPort === void 0 ? {} : { orgPort: selectedOrgPort },
 		convexCall: input.ports.convexCall,
@@ -44330,7 +44888,7 @@ function assembleCapxulClient(input) {
 			}
 		},
 		async completeProfile(profile, controls) {
-			if (typeof profile !== "object" || profile === null || typeof profile.displayName !== "string" || typeof profile.country !== "string" || profile.username !== void 0 && typeof profile.username !== "string") return {
+			if (typeof profile !== "object" || profile === null || typeof profile.displayName !== "string" || typeof profile.country !== "string" || typeof profile.handle !== "string") return {
 				ok: false,
 				reason: "INVALID_INPUT"
 			};
@@ -44348,8 +44906,8 @@ function assembleCapxulClient(input) {
 					reason: "INVALID_INPUT"
 				};
 			}
-			const username = profile.username?.trim();
-			if (profile.username !== void 0 && username?.length === 0) return {
+			const handle = profile.handle.trim();
+			if (handle.length === 0) return {
 				ok: false,
 				reason: "INVALID_INPUT"
 			};
@@ -44363,7 +44921,7 @@ function assembleCapxulClient(input) {
 				email: session.email,
 				displayName,
 				country,
-				...username === void 0 ? {} : { username }
+				handle
 			}), controls, CAPXUL_OPERATIONS.identity.completeProfile, effectRunner.runPromise);
 			return result.ok ? { ok: true } : {
 				ok: false,
@@ -44382,8 +44940,6 @@ function assembleCapxulClient(input) {
 		accounts,
 		currentUser,
 		me: financialOps.me,
-		handles: financialOps.handles,
-		payees: financialOps.payees,
 		targets: financialOps.targets,
 		destinations: financialOps.destinations,
 		payments: financialOps.payments,
@@ -44402,6 +44958,20 @@ function assembleCapxulClient(input) {
 			accounts: { fund: accounts.fund },
 			organizationSetup: { getProofReceipt: (orgId) => runPortEffect(input.ports.convexCall.query(organizationSetupProofReceiptQuery, { orgId })) },
 			telemetry: input.ports.telemetry,
+			captureExternalAddressAcknowledged: (address, organizationId) => {
+				const telemetry = input.ports.telemetry;
+				if (telemetry === void 0) return;
+				Effect.runPromise(Effect.suspend(() => telemetry.emit({
+					name: "quick_pay_external_address_acknowledged",
+					props: {
+						recipient_locator_kind: "address",
+						recipient_resolution_status: "external_address",
+						recipient_address: address,
+						external_address_acknowledged: true,
+						...organizationId === void 0 ? {} : { organization_id: organizationId }
+					}
+				})).pipe(Effect.catchCause(() => Effect.void)));
+			},
 			close: stopActor
 		}
 	}, observation.failureObservation, observation.hostObservationSnapshot);
@@ -44432,7 +45002,7 @@ function transitionError(record) {
 }
 function withHostObservation(actor, snapshot) {
 	if (snapshot === void 0) return actor;
-	const controls = (input) => withHostObservationControls(snapshot, input);
+	const controls = (input) => withHostObservationControls(snapshot, input, actor.authSession()?.authUserId);
 	return {
 		...actor,
 		ask: (event, input) => actor.ask(event, controls(input)),
@@ -44440,10 +45010,14 @@ function withHostObservation(actor, snapshot) {
 		restoreAuthSession: (session, input) => actor.restoreAuthSession(session, controls(input))
 	};
 }
-function withHostObservationControls(snapshot, input) {
-	const copied = { ...input };
-	const captured = snapshot?.();
-	return captured === void 0 ? copied : attachInvocationObservation(copied, captured);
+function withHostObservationControls(snapshot, input, actorId) {
+	const previous = readInvocationObservation(input);
+	if (previous !== void 0) return attachInvocationObservation({ ...input }, previous);
+	const captured = snapshot?.() ?? { active: true };
+	return attachInvocationObservation({ ...input }, {
+		...captured,
+		...actorId === void 0 ? {} : { actorId }
+	});
 }
 //#endregion
 //#region ../../packages/sdk/src/host-observability.ts
@@ -45239,7 +45813,7 @@ const moneySchema = z.object({
 	value: z.string(),
 	decimals: z.number()
 });
-const usernameSchema = z.string().regex(/^[a-z0-9_]{3,30}$/, "3-30 characters: a-z, 0-9, or underscore");
+const handleSchema$1 = z.string().regex(/^[a-z0-9_]{3,30}$/, "3-30 characters: a-z, 0-9, or underscore");
 const accountTools = [
 	{
 		name: CAPXUL_OPERATIONS.onboarding.completePerson,
@@ -45247,18 +45821,18 @@ const accountTools = [
 		register: (server, scope) => {
 			server.registerTool(CAPXUL_OPERATIONS.onboarding.completePerson, {
 				title: "Complete Person onboarding",
-				description: "Claim a globally unique username, complete the signed-in Person profile, and make the personal Account ready. Call this before Organization creation or money tools.",
+				description: "Claim a globally unique handle, complete the signed-in Person profile, and make the personal Account ready. Call this before Organization creation or money tools.",
 				inputSchema: z.object({
 					displayName: z.string().trim().min(1),
 					country: z.string().trim().min(2),
-					username: usernameSchema
+					handle: handleSchema$1
 				}),
 				outputSchema: z.object({
 					profile: z.object({
 						email: z.string(),
 						displayName: z.string(),
 						country: z.string(),
-						username: usernameSchema
+						handle: handleSchema$1
 					}),
 					account: z.object({
 						status: z.literal("ready"),
@@ -45368,6 +45942,156 @@ function identityError(failure, operation) {
 	}
 }
 //#endregion
+//#region src/tools/organization.ts
+const MANAGE$1 = "org:manage";
+const handleSchema = z.string().trim().toLowerCase().regex(/^[a-z0-9-]{3,32}$/, "3-32 characters: a-z, 0-9, or hyphen");
+const organizationTools = [{
+	name: CAPXUL_OPERATIONS.onboarding.completeOrganization,
+	scope: MANAGE$1,
+	register: (server, scope) => {
+		server.registerTool(CAPXUL_OPERATIONS.onboarding.completeOrganization, {
+			title: "Complete Organization onboarding",
+			description: "Claim the personal Account, then create or resume one Organization through the canonical onboarding lifecycle. Reuse the same handle after an interrupted call.",
+			inputSchema: z.object({
+				name: z.string().trim().min(1),
+				handle: handleSchema,
+				country: z.string().trim().min(2),
+				bio: z.string().trim().min(1).optional(),
+				size: z.string().trim().min(1).optional()
+			}),
+			outputSchema: z.object({ organizationId: z.string() })
+		}, (input) => withClient(scope, CAPXUL_OPERATIONS.onboarding.completeOrganization, MANAGE$1, async (client) => {
+			const completed = await client.completeOrganization(input);
+			if (!completed.ok) return errorResult(completed.error);
+			return okResult({ ...completed.value });
+		}));
+	}
+}];
+//#endregion
+//#region src/tools/staff.ts
+const MANAGE = "org:manage";
+const orgInput = { organizationId: z.string().trim().min(1) };
+const email = z.string().trim().email();
+const memberStatus = z.enum([
+	"pending",
+	"pending_safe",
+	"pending_grant",
+	"active",
+	"revoked",
+	"expired"
+]);
+const staffTools = [
+	{
+		name: CAPXUL_OPERATIONS.org.list,
+		scope: MANAGE,
+		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.list, {
+			title: "List Organizations",
+			description: "List the Organizations that the signed-in Person can access.",
+			inputSchema: z.object({}),
+			outputSchema: z.object({ organizations: z.array(z.object({
+				organizationId: z.string(),
+				name: z.string(),
+				handle: z.string(),
+				role: z.string()
+			})) })
+		}, () => withClient(scope, CAPXUL_OPERATIONS.org.list, MANAGE, async (client) => {
+			const result = await client.listOrganizations();
+			return result.ok ? okResult({ organizations: [...result.value] }) : errorResult(result.error);
+		}))
+	},
+	{
+		name: CAPXUL_OPERATIONS.org.roles,
+		scope: MANAGE,
+		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.roles, {
+			title: "List Organization roles",
+			description: "List the active role labels that an Organization invitation can use.",
+			inputSchema: z.object(orgInput),
+			outputSchema: z.object({ roles: z.array(z.object({ label: z.string() })) })
+		}, ({ organizationId }) => withClient(scope, CAPXUL_OPERATIONS.org.roles, MANAGE, async (client) => {
+			const result = await client.listOrganizationRoles(organizationId);
+			return result.ok ? okResult({ roles: [...result.value] }) : errorResult(result.error);
+		}))
+	},
+	{
+		name: CAPXUL_OPERATIONS.org.members,
+		scope: MANAGE,
+		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.members, {
+			title: "List Organization members",
+			description: "List Organization member lifecycle states. Poll after activation until the member is active.",
+			inputSchema: z.object(orgInput),
+			outputSchema: z.object({ members: z.array(z.object({
+				email,
+				name: z.string().nullable(),
+				role: z.string(),
+				status: memberStatus
+			})) })
+		}, ({ organizationId }) => withClient(scope, CAPXUL_OPERATIONS.org.members, MANAGE, async (client) => {
+			const result = await client.listOrganizationMembers(organizationId);
+			return result.ok ? okResult({ members: [...result.value] }) : errorResult(result.error);
+		}))
+	},
+	{
+		name: CAPXUL_OPERATIONS.org.invite,
+		scope: MANAGE,
+		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.invite, {
+			title: "Invite Organization member",
+			description: "Invite one Person by email into an Organization. Use a role label returned by org.roles.",
+			inputSchema: z.object({
+				...orgInput,
+				email,
+				role: z.string().trim().min(1)
+			}),
+			outputSchema: z.object({
+				email,
+				role: z.string(),
+				status: memberStatus
+			})
+		}, ({ organizationId, email: invitee, role }) => withClient(scope, CAPXUL_OPERATIONS.org.invite, MANAGE, async (client) => {
+			const result = await client.inviteOrganizationMember(organizationId, {
+				email: invitee,
+				role
+			});
+			return result.ok ? okResult({ ...result.value }) : errorResult(result.error);
+		}))
+	},
+	{
+		name: CAPXUL_OPERATIONS.org.acceptInvitations,
+		scope: MANAGE,
+		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.acceptInvitations, {
+			title: "Accept Organization invitations",
+			description: "Accept every pending Organization invitation for the signed-in Person's verified email.",
+			inputSchema: z.object({}),
+			outputSchema: z.object({ organizationIds: z.array(z.string()) })
+		}, () => withClient(scope, CAPXUL_OPERATIONS.org.acceptInvitations, MANAGE, async (client) => {
+			const result = await client.acceptOrganizationInvitations();
+			return result.ok ? okResult({ ...result.value }) : errorResult(result.error);
+		}))
+	},
+	{
+		name: CAPXUL_OPERATIONS.org.activateMember,
+		scope: MANAGE,
+		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.activateMember, {
+			title: "Activate Organization member",
+			description: "Grant the invited role to a pending member's ready Account. The Organization founder signs this operation.",
+			inputSchema: z.object({
+				...orgInput,
+				email,
+				accountId: z.string().trim().min(1)
+			}),
+			outputSchema: z.object({
+				email,
+				status: z.enum(["active", "submitted"])
+			})
+		}, ({ organizationId, email: invitee, accountId }) => withClient(scope, CAPXUL_OPERATIONS.org.activateMember, MANAGE, async (client) => {
+			const result = await client.activateOrganizationMember(organizationId, {
+				email: invitee,
+				accountId
+			});
+			return result.ok ? okResult({ ...result.value }) : errorResult(result.error);
+		}))
+	}
+];
+//#endregion
 //#region src/tools/system.ts
 const systemTools = [{
 	name: CAPXUL_OPERATIONS.system.ping,
@@ -45442,7 +46166,12 @@ const AGENT_SCOPES = [
 	"org:manage",
 	"media:write"
 ];
-const TOOLS = [...systemTools, ...accountTools];
+const TOOLS = [
+	...systemTools,
+	...accountTools,
+	...organizationTools,
+	...staffTools
+];
 const TOOL_NAMES = TOOLS.map((tool) => tool.name);
 /**
 * The scope a named tool needs. `null` for a public tool, and `null` for a
@@ -45686,7 +46415,7 @@ function stdioIdentity(env = process.env, options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "3.2.0";
+var version = "4.0.1";
 //#endregion
 //#region src/deps.ts
 const NO_IDENTITY = async () => void 0;
@@ -45721,6 +46450,22 @@ function buildMcpServer(deps, identity) {
 	});
 	const scope = makeRequestScope(deps, identity);
 	registerAllTools(server, scope);
+	if (deps.posthog !== void 0) instrument(server, deps.posthog, {
+		context: { description: "Explain the user goal that requires this Capxul tool call." },
+		enableConversationId: true,
+		enableExceptionAutocapture: false,
+		identify: async () => {
+			const resolved = await scope.identity();
+			return resolved?.ok === true ? { distinctId: resolved.value.authUserId } : null;
+		},
+		eventProperties: async () => ({
+			capxul_env: deps.posthogEnvironment ?? "unknown",
+			producer: "mcp",
+			$geoip_disable: true
+		}),
+		beforeSend: privacySafeMcpEvent,
+		logger: (message) => console.error(`[capxul-mcp] posthog: ${message}`)
+	});
 	const previous = server.server.onclose;
 	server.server.onclose = () => {
 		scope.close();
@@ -45728,9 +46473,75 @@ function buildMcpServer(deps, identity) {
 	};
 	return server;
 }
+const SAFE_MCP_PROPERTIES = /* @__PURE__ */ new Set([
+	"$geoip_disable",
+	"$lib",
+	"$lib_version",
+	"$mcp_client_name",
+	"$mcp_conversation_id",
+	"$mcp_duration_ms",
+	"$mcp_intent",
+	"$mcp_intent_source",
+	"$mcp_is_error",
+	"$mcp_listed_tool_names",
+	"$mcp_protocol_version",
+	"$mcp_server_name",
+	"$mcp_server_version",
+	"$mcp_source",
+	"$mcp_tool_description",
+	"$mcp_tool_name",
+	"$process_person_profile",
+	"$session_id",
+	"capxul_env",
+	"producer"
+]);
+const SAFE_TOOL_INTENTS = {
+	[CAPXUL_OPERATIONS.system.ping]: "Verify MCP transport.",
+	[CAPXUL_OPERATIONS.system.health]: "Verify MCP backend health.",
+	[CAPXUL_OPERATIONS.onboarding.completePerson]: "Complete Person onboarding.",
+	[CAPXUL_OPERATIONS.onboarding.completeOrganization]: "Complete Organization onboarding.",
+	[CAPXUL_OPERATIONS.org.acceptInvitations]: "Accept Organization invitations.",
+	[CAPXUL_OPERATIONS.org.activateMember]: "Activate an Organization member.",
+	[CAPXUL_OPERATIONS.org.invite]: "Invite an Organization member.",
+	[CAPXUL_OPERATIONS.org.list]: "List Organizations.",
+	[CAPXUL_OPERATIONS.org.members]: "List Organization members.",
+	[CAPXUL_OPERATIONS.org.roles]: "List Organization roles.",
+	[CAPXUL_OPERATIONS.me.get]: "Verify authenticated Person identity.",
+	[CAPXUL_OPERATIONS.account.status]: "Verify Account readiness.",
+	[CAPXUL_OPERATIONS.account.balance]: "Verify Account funding."
+};
+const SAFE_MCP_TOOL_NAMES = new Set(TOOL_NAMES);
+const MCP_CONVERSATION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+const MCP_SESSION_ID = /^ses_(?:[0-9a-f]{32}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/u;
+function normalizeClientName(value) {
+	if (typeof value !== "string") return "other";
+	const name = value.trim().toLowerCase();
+	if (name.startsWith("codex")) return "codex";
+	if (name.startsWith("claude-code")) return "claude-code";
+	if (name === "capxul-journeys") return name;
+	if (name === "hermetic-client") return name;
+	return "other";
+}
+/** Keep MCP analytics useful without sending tool payloads or free-form PII. */
+const privacySafeMcpEvent = (event) => {
+	const properties = Object.fromEntries(Object.entries(event.properties).filter(([name]) => SAFE_MCP_PROPERTIES.has(name)));
+	const toolName = properties.$mcp_tool_name;
+	if (typeof toolName !== "string" || !SAFE_MCP_TOOL_NAMES.has(toolName)) delete properties.$mcp_tool_name;
+	if (typeof properties.$mcp_intent === "string") properties.$mcp_intent = typeof toolName === "string" ? SAFE_TOOL_INTENTS[toolName] ?? "Use a Capxul tool." : "Use a Capxul tool.";
+	properties.$mcp_client_name = normalizeClientName(properties.$mcp_client_name);
+	if (typeof properties.$mcp_conversation_id !== "string" || !MCP_CONVERSATION_ID.test(properties.$mcp_conversation_id)) delete properties.$mcp_conversation_id;
+	if (typeof properties.$session_id !== "string" || !MCP_SESSION_ID.test(properties.$session_id)) delete properties.$session_id;
+	if (properties.$mcp_protocol_version !== "2025-06-18" && properties.$mcp_protocol_version !== "2026-07-28") delete properties.$mcp_protocol_version;
+	const distinctId = properties.$process_person_profile === false ? `anon_${createHash("sha256").update(event.distinct_id).digest("hex").slice(0, 24)}` : event.distinct_id;
+	return {
+		...event,
+		distinct_id: distinctId,
+		properties
+	};
+};
 function createHandler(input) {
 	return createMcpHandler(({ authInfo }) => buildMcpServer(input.deps, identityOf(input, authInfo)), {
-		legacy: "reject",
+		legacy: "stateless",
 		responseMode: "json",
 		...input.onError === void 0 ? {} : { onerror: input.onError }
 	});
@@ -45778,7 +46589,8 @@ async function startHttpServer(input) {
 			resource,
 			identities,
 			mcp,
-			guards
+			guards,
+			posthog: input.deps.posthog
 		}).catch((cause) => {
 			if (!res.headersSent) writeJson(res, 500, { error: "internal_error" });
 			console.error("[capxul-mcp] request failed:", cause);
@@ -45818,6 +46630,11 @@ async function handle(input) {
 	const token = bearerToken(headerValue(req, "authorization"));
 	if (decision.identity !== void 0 && token !== void 0) authenticated.auth = toAuthInfo(decision.identity, token);
 	await input.mcp(req, res, body);
+	if (input.posthog !== void 0) try {
+		await input.posthog.flush();
+	} catch {
+		console.error("[capxul-mcp] PostHog flush failed");
+	}
 }
 function protectedResourceMetadata(resource) {
 	return {
@@ -45989,9 +46806,9 @@ function formatToolCallLine(event) {
 //#endregion
 //#region src/sdk.ts
 /**
-* One fresh client per request. `requirement: "counterfactual"` derives the
-* Safe from the email alone; the claim and deploy need the browser approval
-* surface, which no agent can reach.
+* One fresh client per request. Live mode derives the counterfactual Account
+* and fails closed before a signature. Dev mode has its explicit test signer,
+* so it requires a deployed Account and can exercise signed lifecycle paths.
 *
 * This code passes no `authCache`. The SDK detects one instead. A node process
 * has no `window`, so the SDK builds a fresh `InMemoryAuthCacheAdapter` for
@@ -46011,7 +46828,7 @@ async function createSdkClient(input, createClient = createCapxulClient) {
 		bootstrapBaseUrl: config.bootstrapBaseUrl,
 		origin: config.origin,
 		authBaseUrl: config.authBaseUrl,
-		requirement: "counterfactual",
+		requirement: signer === void 0 ? "counterfactual" : "deployed",
 		runtime: "node",
 		...identity === void 0 ? {} : { authClient: identity.authClient },
 		...signer === void 0 ? {} : { signer }
@@ -46059,7 +46876,7 @@ async function createSdkClient(input, createClient = createCapxulClient) {
 							email: String(result.value.profile.email),
 							displayName: result.value.profile.displayName,
 							country: String(result.value.profile.country),
-							username: result.value.profile.username
+							handle: result.value.profile.handle
 						},
 						account: {
 							status: "ready",
@@ -46069,6 +46886,120 @@ async function createSdkClient(input, createClient = createCapxulClient) {
 					}
 				};
 			},
+			completeOrganization: (organization) => client.onboarding.completeOrganization(organization),
+			listOrganizations: async () => {
+				const result = await client.orgs();
+				if (!result.ok) return result;
+				return {
+					ok: true,
+					value: result.value.map((organization) => ({
+						organizationId: String(organization.id),
+						name: organization.name,
+						handle: organization.handle,
+						role: organization.role
+					}))
+				};
+			},
+			listOrganizationRoles: async (orgId) => {
+				const result = await client.org(orgId).roles();
+				if (!result.ok) return result;
+				return {
+					ok: true,
+					value: result.value.map((role) => ({ label: role.label }))
+				};
+			},
+			listOrganizationMembers: async (orgId) => {
+				const result = await client.org(orgId).members();
+				if (!result.ok) return result;
+				return {
+					ok: true,
+					value: result.value.map((member) => ({
+						email: String(member.email),
+						name: member.name,
+						role: member.role,
+						status: member.status
+					}))
+				};
+			},
+			inviteOrganizationMember: async (orgId, invitation) => {
+				const result = await client.org(orgId).invite(invitation);
+				if (!result.ok) return result;
+				return {
+					ok: true,
+					value: {
+						email: String(result.value.email),
+						role: result.value.role,
+						status: result.value.status
+					}
+				};
+			},
+			acceptOrganizationInvitations: async () => {
+				const result = await client.orgs.detectAndAcceptPendingInvitations();
+				if (!result.ok) return result;
+				return {
+					ok: true,
+					value: { organizationIds: result.value.matched.map(String) }
+				};
+			},
+			activateOrganizationMember: async (orgId, activation) => {
+				const memberEmail = activation.email.trim().toLowerCase();
+				const scoped = client.org(orgId);
+				const members = await scoped.members();
+				if (!members.ok) return members;
+				const matches = members.value.filter((member) => String(member.email) === memberEmail);
+				const member = matches.length === 1 ? matches[0] : void 0;
+				if (member === void 0) return {
+					ok: false,
+					error: Errors.invalidInput("email", "member was not found")
+				};
+				if (member.status === "active") return {
+					ok: true,
+					value: {
+						email: memberEmail,
+						status: "active"
+					}
+				};
+				if (member.status !== "pending_grant" || member.roleKey === null) return {
+					ok: false,
+					error: Errors.wrongState({
+						method: CAPXUL_OPERATIONS.org.activateMember,
+						currentState: member.status,
+						validStates: ["pending_grant", "active"]
+					})
+				};
+				const permissions = await scoped.permissions.list();
+				if (!permissions.ok) return permissions;
+				const matchingPermissions = permissions.value.permissions.filter((permission) => permission.type === "managePeople" && permission.state === "active" && String(permission.roleKey).toLowerCase() === String(member.roleKey).toLowerCase());
+				const permission = matchingPermissions.length === 1 ? matchingPermissions[0] : void 0;
+				if (permission === void 0) return {
+					ok: false,
+					error: Errors.wrongState({
+						method: CAPXUL_OPERATIONS.org.activateMember,
+						currentState: "matching-permission-missing",
+						validStates: ["one-active-role-permission"]
+					})
+				};
+				const requestKey = `mcp-staff-${createHash("sha256").update(JSON.stringify({
+					orgId,
+					email: memberEmail,
+					accountId: activation.accountId,
+					permissionId: permission.permissionId
+				})).digest("hex")}`;
+				const assigned = await scoped.permissions.assign({
+					requestKey,
+					permissionId: String(permission.permissionId),
+					accountId: activation.accountId,
+					expectedMemberEmail: memberEmail
+				});
+				if (!assigned.ok) return assigned;
+				return {
+					ok: true,
+					value: {
+						email: memberEmail,
+						status: "submitted"
+					}
+				};
+			},
 			getLifecycle: async () => {
 				const result = await client.account.getLifecycle();
 				if (!result.ok) return result;
@@ -46143,6 +47074,8 @@ if (!modeConfig.ok) {
 }
 const mode = modeConfig.value;
 const port = cli.port;
+const analyticsConfig = readMcpAnalyticsEnvConfig();
+const posthog = analyticsConfig === void 0 ? void 0 : new PostHog(analyticsConfig.projectToken, { host: analyticsConfig.host });
 const deps = {
 	createSdkClient: (identity) => createSdkClient({
 		config: readSdkEnvConfig(),
@@ -46151,6 +47084,10 @@ const deps = {
 	}),
 	onToolCall: (event) => {
 		console.error(formatToolCallLine(event));
+	},
+	...posthog === void 0 ? {} : {
+		posthog,
+		posthogEnvironment: analyticsConfig?.environment ?? "unknown"
 	}
 };
 if (cli.stdio) {
@@ -46164,7 +47101,7 @@ if (cli.stdio) {
 		bearer: identity === void 0 ? "none" : "environment"
 	}));
 	const shutdownStdio = () => {
-		handle.close().finally(() => process.exit(0));
+		handle.close().catch(() => void 0).then(() => posthog?.shutdown()).catch(() => void 0).finally(() => process.exit(0));
 	};
 	process.on("SIGINT", shutdownStdio);
 	process.on("SIGTERM", shutdownStdio);
@@ -46183,7 +47120,7 @@ if (cli.stdio) {
 		bearer: "oauth"
 	}));
 	const shutdown = () => {
-		running.close().finally(() => process.exit(0));
+		running.close().catch(() => void 0).then(() => posthog?.shutdown()).catch(() => void 0).finally(() => process.exit(0));
 	};
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);